Defragmenting Qt and Uniting Our Ecosystem - <AUTHOR> http://blog.qt.digia.com/blog/2014/08/06/defragmenting-qt-and-uniting-our-ecosystem/ <comment><USER2> One of the things "missing" from Go is the ability to do a GUI. Some work is being done to build out a QT library, but it seems like the progress on atom- shell and node-webkit may almost make Qt overly cumbersome to work with.

Other than native controls and the potential DOM lag of a webkit interface, is there any particular reason why someone programming in Go, Python, Ruby, etc. would want to engage Qt; assuming a stable, working library?

<comment><USER3> You say "other than", but native controls are a big deal. As an OS X user, I for one would strongly avoid using an application that uses (often generally poor, almost always slightly off with keyboard shortcuts and such) HTML replacements for native UI. (For the record, I don't use Atom, but in that case the horrid performance is more important.)

Actually, Qt suffers from this as well compared to native Cocoa, because of both small issues with reimplemented controls (as of recently, anyway) and, more importantly, generally Windows-focused UI paradigms. But it's not as bad as HTML.

<comment><USER4> When I hear "GUI" and "native", wxWidgets immediately pops up in my head, which is a decent framework and wraps native controls. I wish it had more publicity.

<comment><USER3> After trying to maintain a wxWidgets project about a year ago, I'm afraid I must disagree. It wraps native controls, but it is a horrible broken framework. Among other things,

\- It uses macros instead of C++ templates in order to support ancient compilers.

\- To handle events, you're supposed to make an enum for your controls and go through these EVENT_TABLE macros - it works, but generally it's a mess compared to nicer frameworks like Qt.

\- Threading support is really lame, e.g. this quirk of AddPendingEvent: [http://docs.wxwidgets.org/trunk/classwx_evt_handler.html#a07...](http://docs.wxwidgets.org/trunk/classwx_evt_handler.html#a0737c6d2cbcd5ded4b1ecdd53ed0def3)

\- Then and probably still today, OS X Retina support was completely broken. Not a great turnaround time - it was already a year after the release of Retina laptops.

<comment><USER5> wxWidgets looks like a reimplementation of MFC almost. This might be good for some people or bad for others. MFC is/was the Microsoft Foundation Classes, an OO framework for doing GUI development on Windows that dates back to 1992.

I'm guessing that when wxWidgets was originally written (also 1992!), the author(s) thought it would ease the transition from writing Windows-only apps to cross-platform apps. wxWidgets has a very similar class hierarchy and uses the same preprocessor techniques.

Not that knowing any of that background makes it any more pleasant to work with.

</comment></comment></comment></comment></comment><comment><USER6> Digia, and anyone else who might still use it, please remove AddThis.

[http://www.propublica.org/article/meet-the-online- tracking-d...](http://www.propublica.org/article/meet-the-online-tracking- device-that-is-virtually-impossible-to-block)

<comment><USER7> What exactly is the difference between this canvas tracking tech and cookies, flash cookies, and panopticlick? That just sounds like FUD because people are just learning about this.

<comment><USER8> blocked by disconnect.me , just as the rest of this tracking bullshit.

</comment></comment></comment><comment><USER9> Qt always seems like a thing that has so much potential, but whenever I use it I'm struck by how it never seems quite good enough. 5 seems a big imporvement on 4 though, so we'll see.

<comment><USER10> I'm wondering what you mean by "not quite good enough". It's by far the best UI toolkit out there and a very high quality application toolkit.

It has shortcomings, but to the point it's unusable?

<comment><USER9> Not unusable at all! I think my comment sounded more negative than I am about Qt, I enjoy using it but there's a lot of little things, just glitches mostly, that are annoying and detract from it being amazing.

<comment><USER10> Ah. I understood your comment differently.

It definitely does have shortcomings, but I don't think any library is ever perfect, especially in a project as massive as Qt. I found the Qt community is very open to contributions, feature requests and such when things make sense.

</comment></comment></comment></comment><comment><USER11> Dear lazyweb, what exactly is Qt's current business? The blog post makes it sound as if the commercial version of Qt wasn't free software. What freedoms does it take away? I know that Trolltech commercialised Qt by selling exceptions. What's the current business? Also, if 25% of all contributions are coming from non-Digia employees, does Digia require copyright assignment? Does their current commercial model require copyright assignments?

<comment><USER12> Qt is licensed under GPL v3 and LGPL v2.1, but you can also buy a license if you want to use and/or modify Qt in a project without having to redistribute the whole thing under GPLv3 or redistribute your modified Qt under LGPL v2.1.

There's actually a lot of closed-source software you know of that uses Qt in some form: Autodesk Maya, Google Earth, Skype, and Spotify are just a few.

I'm not sure whether all of these teams use the commercial version (some may use e.g. the LGPL version) but it's probably not zero.

[http://en.wikipedia.org/wiki/Qt_(software)#Software_using_Qt](http://en.wikipedia.org/wiki/Qt_\(software\)#Software_using_Qt)

<comment><USER11> So they're back to selling exceptions again? I thought they had stopped when it was owned by Nokia.

<comment><USER13> The commercial business/licensing was sold off to Digia, which eventually bought the whole Qt division.

<comment><USER11> Yes, I understand this, but Digia went back to GPL and back to selling GPL exceptions like Trolltech did originally?

<comment><USER14> Digia is doing the same thing Nokia did, which was the same thing Trolltech did. The only difference is that, since the Nokia takeover, the open source version is _also_ available under LGPL. This has not changed under Digia.

</comment></comment></comment></comment></comment></comment><comment><USER15> Phew, for a moment I thought that they will be focusing only on enterprise licenses and make Qt closed-source (which would probably be a suicide).

<comment><USER16> note

[http://www.kde.org/community/whatiskde/kdefreeqtfoundation.p...](http://www.kde.org/community/whatiskde/kdefreeqtfoundation.php)

> The Foundation has a license agreement with Digia and Nokia. This agreement > ensures that the Qt will continue to be available under both the LGPL 2.1 > and the GPL 3. Should Digia discontinue the development of the Qt Free > Edition under these licenses, then the Foundation has the right to release > Qt under a BSD-style license or under other open source licenses. The > agreement stays valid in case of a buy-out, a merger or bankruptcy.

<comment><USER15> Amazing, I did not know this (and I use KDE). Thanks.

</comment></comment></comment><comment><USER17> I'm not too much concerned by this, but it does not sound like a good move.

> The unified web page will give a broad overview of the Qt technology, both > enterprise and open-source, from a technical, business and messaging > perspective.

So, the new web page will still have to be fragmented, because it has to serve open source and business visitors. Who speak a completely different language and look for different information.

Might be a good thing if it leads to a better website, might reflect good changes, but that alone sounds rather complicated. In my eyes it is not bad to have a fragmentation between sites targeting business users and those who do not, and it seems sound to have the one for business users in the reign of the company.

The new company seems to be the real news (at least it was new to me), that Qt will be managed by a company focussing solely on Qt.

<comment><USER18> Yeah, but the new company will be 100% owned by Digia.

So basically this is a nice move from Digia to consolidate its ownership and leadership of Qt.

I guess its similar to what Google does.

<comment><USER14> Or a move from Digia to prepare a sale - it's much easier to sell something like QT if you also include all the relevant developers in one nice package.

Or maybe it's a way to insulate Digia from losses resulting from QT operations, who knows?

I have to say I'm happy they'll review the installer though; ever since they started packing their own compiler, I got the feeling things became a bit more chaotic than they were.

</comment></comment></comment><comment><USER19> One thing you do not see fragmenting are command-line tools, because people tend to agree on their function(1). However, QT is huge; its scope goes far beyond GUI functionality, into string classes, SQL databases, networking, etc. And moc, its C++ code generator. More scope equals more possible disagreements, which necessarily entails fragmentation.

I tried installing the Qt version of wireshark using exherbo (one of the most minimal Linux distros) and it wanted MySQL as a dependency! For me, if you cannot build a well focused tool with a GUI toolkit it's not worth using.

1 (sure different Unices have different options, but that is more historical)

<comment><USER20> > it wanted MySQL as a dependency! For me, if you cannot build a well focused > tool with a GUI toolkit it's not worth using.

How is Wireshark not well focused? It probably uses a mysql database for its activity history (note: I didn't look, its just a common design pattern). I mean, it seems like a program like Wireshark would be better suited by a simpler sqlite database, but its really up to the project lead on these things.

<comment><USER21> Wireshark doesn't use MySQL or any other SQL backend. I'm not sure what sort of dependency chain would trigger the installation of MySQL but it's unusual to say the least.

<comment><USER22> Almost certainly a packaging error where Wireshark depends on Qt and Qt includes all modules, including QtSql.

</comment></comment></comment></comment><comment><USER23> Just great. As if their licensing cost wasn't high enough, this will probably make it way worse.

<comment><USER22> I'm not sure it's going to affect it at all. What makes you think it will? All they're doing is spinning off a subsidiary to do what the Qt division is already doing.

<comment><USER23> And does that have a completely zero cost to accomplish?

As I see it, leaving Qt entirely at the mercy of it's licensing revenue stream and not supplemented by Digia's consulting revenue stream means 1) Qt needs to sell more licenses going ahead or 2) Qt needs to charge more per license. The cost of doing business or paying developers will not be going down any time soon. It can only be flat or, more likely, up. And I don't see Qt license numbers making a radical change upward in the near future.

<comment><USER24> Are there other options to improve the financial health of the Qt ecosystem?

<comment><USER23> Sadly, no. And it's distressing. Especially as I finish work on a UI system that's using it.

<comment><USER24> Microsoft is supposedly consolidating their Windows versions, including desktop and mobile. Too bad they didn't support Qt on mobile from the beginning, as it could have seeded their ecosystem.

It's a shame that Digia pricing has no elasticity for the large pool of indie mobile developers. It's either LGPL for zero revenue or $$$ for a paid license. Within that large price gap are products which perform "cloud compilation" that require handing over your IP to a 3rd-party. MoSync had a good open-source run with their LLVM toolchain, but didn't reach stability.

If a Qt-native mobile OS had been successful (e.g. Meego pre-Elop), the picture would be different today. Engineering feats have brought Qt to Android and iOS, but it's not the same as being a first-class business citizen of the platform.

<comment><USER23> _Engineering feats have brought Qt to Android and iOS, but it 's not the same as being a first-class business citizen of the platform._

Very true. At one point I was considering a Qt application on top of Android to let some legacy products continue to run on a modern platform. Until I saw that Digia was pretty much asking for a full Qt license royalty on that platform. At that point it became "screw this, I can just contract a Java developer to port it and it will come out WAY cheaper".

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> I wish they could just spin off a QT3-era widget library for cross platform desktop only stuff. All the new QtQuick declarative and mobile stuff just confuses me and gets in the way. Believe it or not, Qt used to be a small and lightweight library.

<comment><USER26> QWidgets are still there.You don't have to use QtQuick.

<comment><USER27> And the best part is that in Qt 5.x the individual components are separate source packages. Off the top of my head ... base for the core Qt; widgets for old style widget library; script and declarative for QtQuick; system for I-don't-remember-what; and so on.

If you don't need QtQuick or QtWebKit, you can actually drop quite a few of the packages.

</comment></comment></comment><comment><USER22> Original announcement at [http://qfx.quartalflife.com/Clients/fi/digia/rss/newsentry.a...](http://qfx.quartalflife.com/Clients/fi/digia/rss/newsentry.aspx?id=1002481436&culture=en- EN)

</comment><comment><USER28> For me , Qooxdoo (qooxdoo.org) making QT almost obselete. Qooxdoo + CEF (nodewebkit, atom-shell) making QT un-necessary. I wonder why qooxdoo is very less known around here.

</comment><comment><USER29> How big is Qt's commercial market? Any breakdown by license fee and professional consulting fee?

</comment><comment><USER30> What will be KDE's future?

<comment><USER22> Completely unchanged of course.</comment></comment>


Why VCs Should Think More Like Warren Buffett - <AUTHOR> http://rre.com/blog/why-vcs-should-think-more-warren-buffett

<comment><USER2> _"Successful VCs have to both identify trends and determine the intrinsic value of the business opportunities the trend gives rise to. Many can do the former, fewer can do the latter."_

How are VCs supposed to determine the 'intrinsic value' of a startup? There's no track record to go on!

According to the book 'Buffetology', part of Buffett's research involves looking at earnings for 10+ years of any company he is thinking of investing in.

[http://www.worldcat.org/search?qt=wikipedia&q=isbn:97806...](http://www.worldcat.org/search?qt=wikipedia&q=isbn:9780684848211)

For this reason I think this article is flawed as the author doesn't really appear to know what value investing really entails.</comment>


Microsoft Azure introduces new machines with SSDs and faster processors - <AUTHOR> http://azure.microsoft.com/en-us/pricing/details/virtual-machines/

<comment><AUTHOR> From my preliminary tests on a Solr server, using the SSD drive leads to worse performance than using the normal drive.</comment>


Introducing 'Mastering Go Programming' - <AUTHOR> http://www.minaandrawos.com/2017/02/08/introducing-mastering-golang-programming/ <comment><USER2> There's a quote somewhere, which I can't track down at the minute, which goes something like:

How I'd like to learn coding:

1\. From online documentation

2\. From a printed book

3\. From blog articles

...

99\. Printed on the side of an elephant

100\. From videos

<comment><AUTHOR> I believe it depends on the person. Learning styles differ based on how our brains work. Some people tend to enjoy and consume video\audio learning better than books. While others can consume the written word much better than videos\audios

<comment><USER2> True. But I think video is a really bad fit for learning code. For a start you can't copy/paste the boilerplate stuff. For a second, it's much more difficult to read code off video than from printed or digital text. I'd feel similarly dubious about a 'Learn to Draw' course delivered via radio.

<comment><AUTHOR> I still strongly believe it depends on the person. If learning programming is bad in video, companies like Udemy, or Treehouse won't find the success they are currently enjoying. Also, copying and pasting isn't an option for printed books unless they are ebooks, but still people buy printed books.</comment></comment></comment></comment>


Ask HN: Turn my home directory into a Git repo? - <AUTHOR> I'm on OS X, but this question is of course relevant to Linux as well:
I was thinking of making my home directory into a Git repo, so that I could easily see when new files (hidden or otherwise) are added by programs I use, and so that I could just generally track changes. I would probably add directories like Music, etc. to .gitignore to avoid bloat.
Some of the things that would be interesting to notice are all the little hidden configuration files that build up over time, e.g.:
.android, .bash_history, .bash_profile, .bash_profile.pysave, .boot2docker, .cache, .cleanup, .config, .cups, .docker, .fctsslvpnhistory, .filezilla, .gitconfig, .heroku, .ipython, .local, .netrc, .node-gyp, .npm, .oracle_jre_usage, .pip, .putty, .python_history, .swt, .thinkorswim, .v8flags.188.8.131.52.me.json, .vim, .viminfo, .virtualenvs
Do you have any thoughts on doing this? Is it a terrible idea? <comment><USER2> I actually version control my config files ([https://github.com/tombert/dotfiles](https://github.com/tombert/dotfiles)) after reading this tutorial:[http://brandon.invergo.net/news/2012-05-26-using- gnu-stow-to...](http://brandon.invergo.net/news/2012-05-26-using-gnu-stow-to- manage-your-dotfiles.html)

Obviously you should change that to git instead of CVS.

<comment><USER3> tombert is right. dotfiles are the way to go.

Maybe find some additional info on [http://dotfiles.github.io/](http://dotfiles.github.io/) to get you started.

</comment></comment><comment><USER4> This depends on how you manage your computer. If you put all your personal projects in your home directory this could be a pita. Really what you'll need to do is to make heavy use of gitignore. Obviously bash_history changes on every command so that may be one you want to avoid tracking. You may also want to take a look at dotfiles repos on github, which are meant for actively tracking your configuration files instead of seeing what new files have been added.

</comment><comment><USER5> I do something similar, so I know it's feasible. I whitelist the dotfiles that I want to keep hold of (.vim, .bashrc, &c.) in my homefolder and whenever I update something, I just push to the remote.

It's really enlightening to see just how quickly a perfectly clean home folder can get filled with hidden directories.

</comment><comment><USER6> You could separate the work tree and git directory in your home folder. Works like a charm for me!

[https://fuller.li/posts/organising-dotfiles-in-a-git- reposit...](https://fuller.li/posts/organising-dotfiles-in-a-git-repository/)

</comment><comment><USER7> You can also refer to this recent post around managing dot files: [https://news.ycombinator.com/item?id=11071754](https://news.ycombinator.com/item?id=11071754)

</comment><comment><USER8> It is an interesting idea. I would recommend you to start and then make the .gitignore grow with things you don't need. Your list is already big enough to start. Looking forward to see how your experiment goes.

</comment><comment><USER9> Just put * in your gitignore. Then everything you don't add is ignored.

Edit: Oh, this doesn't help you with seeing what new stuff is added, at least not in the root of the tree. But it's a useful trick.

</comment><comment><AUTHOR> Thanks everyone herein for the advice!</comment>


A tale of two's complement - <AUTHOR> http://discuss.rust-lang.org/t/a-tale-of-twos-complement/1062 <comment><USER2> This seems like a pretty good compromise on integer overflow. I'm happy to see the Rust core team taking the problem seriously after seeing so much discussion about it.

</comment><comment><USER3> I love the compromise on integer overflow. Default overflow checking in debug mode will keep most Rust programs free of overflow, and that should ensure that if hardware designers ever come to their senses and implement free hardware overflow traps, Rust code can enable them without issue.

<comment><USER4> Rust's position is reasonable, but it won't keep most programs free of overflow. Overflow and underflow bugs typically require malicious input to expose; casual testing usually doesn't encounter them.

Also, in release builds they promise an undefined value, not undefined behavior. By my reading, hardware-assisted overflow checks cannot log errors or do anything else useful under this policy. (Probably saturating arithmetic is best, since it's most likely to trigger an out-of-bounds error.)

Their saving grace is the other safety checks (e.g. bounds checking), and their assertion that "we reserve the right to make checking stricter in the future" which enables them to strengthen this policy.

</comment></comment><comment><USER5> I wonder how many bits the int would have on an 8088.

<comment><USER6> If it's the 20-bit address stuff, `int` would have 32 bits on that platform. (The same as `intptr_t` in C.)

</comment></comment><comment><USER7> > Since overflow cannot cause crashes or data races (outside of unsafe code), > we can skip these checks without endangering Rust's core value proposition > of safe systems programming. Whenever checks are disabled, overflow will > yield an undefined value (this is distinct from--and much more limited than > --the "undefined behavior" you get in C).

This is too dismissive of the seriousness of problems that might occur due to unchecked overflow [1].

[1] [https://news.ycombinator.com/item?id=8690206](https://news.ycombinator.com/item?id=8690206)

<comment><USER8> Nobody is attempting to dismiss the idea that overflow is a problem. The fact that we have had innumerable discussions over this very topic should be indication that this is something that Rust cares about, and will be investigating further in the future as compiler support improves (it's not stated outright, but I suspect the fact that overflow yields an "undefined value" is to leave open the possibility of making overflow saturating-by- default sometime in the future without breaking backwards-compatibility, if the performance hit turns out to be acceptable).

<comment><USER9> Saturating overflow? Egads.

What's the problem with just trapping overflow by default again?

I'm willing to bet many would happily take the performance hit in favor of having a genuinely safe language.

<comment><USER8> 1\. Overflow doesn't cause memory unsafety in Rust, so trying to imply that it's not a genuinely safe language is incorrect.

2\. Even if it did, saturating on overflow is exactly as safe as trapping, and has the added benefit of not introducing an untold number of new ways that your program can panic.

3\. Trapping on overflow is oversold as a solution to logical errors because you're still opening yourself up to approximately four billion (or 18 quintillion, depending on width) invalid states before your program bites it. If you want a real solution, stick numeric bounds in your type system.

<comment><USER9> So, I'm not really caring about memory safety--there are lots of reasons _to care_ , mind you, but that's not my concern.

It's that, quite simply, not being able to easily catch integer arithmetic errors is a really annoying flaw in a language that needs to do systems work-- especially if it's used in places where, say, you are decoding buffers or handling IO or basically getting data from an untrusted/faulty source.

It could even be done as a basic addition to the standard library...I frankly don't care _how_. It's just that it is a really obvious wart to anyone that's ever had to do safe integer work in the lingua-franca of languages, C.

Just because the program doesn't _crash_ doesn't mean it's being _useful_.

<comment><USER8> As mentioned in the OP, support for checked arithmetic does exist in the stdlib, and has for ages.</comment></comment></comment></comment></comment></comment>


Day Jobs - <AUTHOR>

Might anyone have any tips on finding day jobs which are not immoral, pointless, demoralizingly stupid, or energetically draining?
It's a rollercoaster. One minute, Google thinks I'm the hottest thing. The next, the interviewer is fired (literally), and I'm talking to interviewers claiming about my 'junior' status and how I haven't used Access.
I know that if I take a fulltime job, there won't be many hours left in the week for my own project. HAs anyone had any luck negotiating for a fulltime position, and then just dropping one or two days off the schedule? <comment><USER2> Do what you love. That's all that really matters.

Ask employees about their schedules, not HR folks. Catch them outside of the formal interview if you can. You'll know if things are really flexible.

I wouldn't count on not working full time unless you're a contractor declared to be part time.

If you can't get funding to go full time on your own project, nights and weekends with a day job provide a pretty good amount of time.

Don't get a job that requires skills in MS tools. Period.

</comment><comment><USER3> I suggest waiting and seeing if you get into YC but in case you don't and you still need to eat (I like to eat too) then I would suggest looking on Craiglist for a job.

If they really like you ask to see if you can work 3 weeks a month and take 1 week to work on your project in there office on there computer, that way you are there available to them but they don't have to pay you.

That is what I am doing and if I get into YC I will be in a position to quit entirely and only work on my project.

<comment><AUTHOR> If I do get into YC, I still have _three months_ of expenses until the winter. I don't have to funds to coast, and I don't want to put my project on hold, either.

<comment><USER3> I forgot about the 3 months, at least do something that hones your skills. Anything that makes you better will be worth the time plus you will make some extra money.

</comment></comment></comment><comment><USER4> How about doing some consulting for a startup, maybe even one from a previous YC round? You should be able to negotiate a pretty flexible schedule if you have expertise they need.

<comment><AUTHOR> I've started out looking to do just that. I'm amazed by how bright and receptive these people are. It's a breath of fresh air.</comment></comment>


Left Truncatable Prime - <AUTHOR> http://www.solipsys.co.uk/new/LeftTruncatablePrime.html?HN_20171021 <comment><USER2> It's fun to see this. I investigated these on my own as an undergrad, but I called them solid primes. Originally I wrote a visual basic program (it was a long time ago) to find all the solid primes in base ten, which obviously involved writing a big num implementation. It ran for three days, only half solved the problem and then ran out of memory. Recoding it in Mathematica took 6 lines, ran in 20 minutes and found all of them.

Plotting the distribution gives a nice curve which you can model quite well with the prime number theorem. From memory it looks like x^2*e^-x. Then plotting in different bases is also interesting.

</comment><comment><USER3> Pretty cool.

I first learned about truncatable primes from Project Euler problem 37: "Find the sum of the only eleven primes that are both truncatable from left to right and right to left."

[https://projecteuler.net/problem=37](https://projecteuler.net/problem=37)

(I have some rust code that solves this problem in ~300 microseconds on my laptop. I bet it's possible to get it faster though. Anyone want to try?)

<comment><USER4> I'm curious how you got it to even go that fast. My best solution takes about 6 milliseconds, so 20x longer.

<comment><USER3> I used a branch and prune algorithm, starting with the 1 digit primes and then adding digits to the right, pruning using a non-memoising prime test and testing for left truncatability to see if the new numbers should be added to the sum. The tree came to an end fairly quickly, which made the algorithm fast.

I also avoided any string manipulation, favoring truncating by using integer division for right truncation and modulus for left truncation.

Is that similar to your algorithm?

<comment><USER4> Ah, I guessed that you might be taking some approach that generated numbers to try.

Mine was the brute-force "calculate all primes under a million then test them all" approach.

</comment></comment></comment></comment><comment><USER5> When written in base 10, anyway :)

I suppose an extra challenge would be to find values which are truncatable primes in more than one base at once... Hmmm.

<comment><USER6> It's often worthy to first check the OEIS[1] prior to committing a large number of cpu cycles to the effort.

[1] [https://oeis.org/search?q=left+truncatable+primes+base&sort=...](https://oeis.org/search?q=left+truncatable+primes+base&sort=&language=english&go=Search)

<comment><USER7> I wonder why base 24 is such an extreme outlier. I had noticed it already when I was playing with this concept in Mathematica, it's the only one I couldn't exhaustively search.

<comment><USER8> These primes can be built up right to left, and the last "digit" of a prime, mod 24, can only take on phi(24) = 8 different values. (phi is Euler's phi function here.) So when you're considering adding on a digit (base 24) to the left of a prime, the chances of getting a prime are relatively high, since the last digit is already stacked in your favor. Notice that for example that sequence is really small when n is prime, because you don't get that same advantage. To get a lot of left truncatable primes you want your base n to be large (so you have a lot of choices at each step of the search) and you want phi(n)/n to be small (so you can stack the deck in your favor on the last digit).

And why does the sequence stop at 29? phi(30) = 8, setting a new minimum for phi(n)/n.

</comment></comment></comment></comment><comment><USER9> The primality test uses Fermat's Little Theorem, but I thought it was not 100% perfect. (Or perhaps it is for left-truncatable primes?)

I didn't know about the third parameter in pow(), either. Quite interesting.

<comment><AUTHOR> It's not perfect, but it's fast, easy to code, and the first false positive for this version is a _long_ way out. Early Carmichael numbers have small factors, and although I'm only testing against prime bases up to 19, I'm not sure where the first false positive is. But it's a long way further out than the numbers we're dealing with here.

I should go looking ...

<comment><USER10> Here are the first ten false positives for the is_prime function in the post, along with their factors:

        252601: 41 61 101
        294409: 37 73 109
        399001: 31 61 211
        410041: 41 73 137
        488881: 37 73 181
        512461: 31 61 271
        1152271: 43 127 211
        1193221: 31 61 631
        1461241: 37 73 541
        1857241: 31 181 331

<comment><AUTHOR> Thanks for that. As it happens it's not a problem because the first 30 all have even digits and so can't be a final segment of a left-truncatable prime, except 7519441, and 441 isn't prime.

I could write a more comprehensive test - didn't seem worth it for this case, but it's an interesting exercise. It's easy to extend this test so the list of primes used goes as far as the smallest factor in each of these factorisations, say, 109. Then these would all be correctly identified as composite. It would also be easy to combine it with Pollard Rho or PPP tests, to extend the range before we need to do something more serious.

Anyway, here are the first 30 with factorisations

       252601 : 41 61 101
       294409 : 37 73 109
       399001 : 31 61 211
       410041 : 41 73 137
       488881 : 37 73 181
       512461 : 31 61 271
      1152271 : 43 127 211
      1193221 : 31 61 631
      1461241 : 37 73 541
      1615681 : 23 199 353
      1857241 : 31 181 331
      1909001 : 41 101 461
      2508013 : 53 79 599
      3057601 : 43 211 337
      3581761 : 29 113 1093
      3828001 : 101 151 251
      4335241 : 53 157 521
      5049001 : 31 271 601
      5148001 : 41 241 521
      5444489 : 29 197 953
      5481451 : 31 151 1171
      5968873 : 43 127 1093
      6189121 : 61 241 421
      6733693 : 109 163 379
      6868261 : 43 211 757
      7519441 : 41 241 761
      8134561 : 37 109 2017
      8927101 : 31 37 43 181
      9439201 : 61 271 571
      9494101 : 23 61 67 101

<comment><USER10> Yes the full program for left-truncatable primes happens to be fine (no false positives in its output for any length, as I verified with a different primality test).

The primality test in the post (Fermat's test) is interesting to analyze though. BTW how did you generate your list of false positives? I didn't mention it earlier, but as a shortcut I used the list from [https://oeis.org/A001567](https://oeis.org/A001567) (the base-2 pseudoprimes up to 10^12), and found that the function in the post has 2690 of these false positives less than 10^12. I wrote out only the first 10 above (after piping through `factor`). Of these 2690 false positives, these have the 5 largest smallest prime factors:

        681719179681: 5743 8527 13921
        802204143001: 5981 8971 14951
        747734199031: 6791 8731 12611
        949631589089: 6917 10193 13469
        251994268081: 354961 709921

And indeed the `small_primes` used by the test needs to be extended up to the prime 6917, if we want to get no false positives at least for numbers up to 10^12. And even if we went that far, we'd encounter the next false positive soon after, at 1025414056801 (factors 7561 8101 16741) and then (if we included primes up to 7561) at 1196508858409 (factors 8059 11833 12547). (See [https://oeis.org/A083876](https://oeis.org/A083876))

I think compared to the Fermat test used in the post, the Miller-Rabin test is almost as easy to write (only a few lines longer), and it comes with stronger guarantees. Not only is it a test used in the real world (using it with just a few random bases gives a high degree of confidence), but it also comes with guarantees when a deterministic set of primes (like your idea) is used: for example with the first 13 primes (2 to 41), the first false positive is over 3.3 × 10^24 ([https://en.wikipedia.org/w/index.php?title=Miller%E2%80%93Ra...](https://en.wikipedia.org/w/index.php?title=Miller%E2%80%93Rabin_primality_test&oldid=797113714#Deterministic_variants)). See also [https://miller-rabin.appspot.com/](https://miller- rabin.appspot.com/)

<comment><USER10> For what it's worth, here is an implementation of the Miller-Rabin primality test that first tries the smallest 13 primes and then tries some random bases:

        def is_probable_prime(n, num_random_trials=5):
            """
            An implementation of the Miller-Rabin primality test.
            If this function returns False, then n is definitely not prime.
            If this function returns True, then n is probably prime:
            the probability of n being composite is less than 1/4^(num_random_trials), and
            nonzero only if n >= 3317044064679887385961981 > 3.3*10^24 > 1.3*2^81 (by https://arxiv.org/abs/1509.00864).
            """
            assert n == abs(int(n)), 'Need a nonnegative integer, got %s' % n
            if n < 2: return False
            if n % 2 == 0: return n == 2
            (s, d) = (0, n - 1)
            while d % 2 == 0: (s, d) = (s + 1, d // 2)
            assert n - 1 == (2**s) * d and d % 2 == 1
            small_primes = [2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41]
            for i in range(len(small_primes) + num_random_trials):
                a = small_primes[i] if i < len(small_primes) else random.randrange(small_primes[-1], n - 1)
                if a >= n: break
                if not (pow(a, d, n) == 1 or any(pow(a, 2**j * d, n) == n - 1 for j in range(s))):
                    return False
            return True

</comment></comment></comment></comment></comment></comment><comment><USER11> [https://en.wikipedia.org/wiki/Truncatable_prime](https://en.wikipedia.org/wiki/Truncatable_prime)

</comment><comment><USER12> I wonder how long one could be if we only require it to stay prime when it has more than K digits? Take K=0 to get the original problem.

In this form of the problem, it is not the length, L, of the initial prime that we want to maximize but rather L-K.

My guess is that these looser requirements won't make much difference. Estimating based on the prime number theorem and pretending that primes are essentially random numbers (an assumption that works remarkably well a large fraction of the time), I get, if I didn't totally botch it, that given a k digit integer that is prime, there is about a 1/(2k) chance that you can add a digit on the left and still have a prime.

Another generalization comes to mind. Suppose that instead of a pencil, we are dealing with some item with break-away segment. Each segment has d digits printed on it, so when we have L segments we have a dL digit number. As we break away segments we left truncate this number by d digits.

I don't think that would make much of a difference. We can treat it as an L digit number in base 10^d, which we truncate a digit at a time. Another hand wavy application of prime number theorem gives 1/(2kd) as the chance that you can left-extend a k digit base 10^d prime by one digit and get a prime.

</comment><comment><USER11> What if we allowed 0 as a digit?

Are there infinitely many 0-enabled left-truncatable primes?

<comment><AUTHOR> I would guess that there are infinitely many primes of the form 10^k+1. If so, that would be a yes.

<comment><USER11> But these truncate to 1, which is normally not considered prime.

<comment><AUTHOR> Yah, I wrote that without thinking. Replace 1 with 3, and take a.10^k+p with p a small prime, _etc._

</comment></comment></comment></comment><comment><USER13> AFAICT, The code would never find a prime of the form 100p

<comment><AUTHOR> Leading zeros are generally not allowed, so if you had, say 503, then that's prime, 3 is prime, but 03 isn't allowed.

<comment><USER13> Okay, I'm getting confused because the code does test for 10p.

<comment><AUTHOR> I don't think it does. Are you aware that "range(1,10)" in Python is the list [1, 2, 3, 4, 5, 6, 7, 8, 9] ??

Ranges in Python don't include their endpoint. A few people have expressed confusion as to this choice in the design, but it means that the expression:

      range(a,b) + range(b,c) + range(c,d)

includes everything from a to d-1 one and only once. Knuth said that intervals should include the initial point and not the endpoint for this reason.

<comment><USER14> This issue is one of the things Perl 6 addresses well in my opinion.

Regular ranges include their endpoints, and you can think of ^ as "not including" or "up to (exclusive)"

1..5 is 1, 2, 3, 4, 5

1..^5 is 1, 2, 3, 4

1^..5 is 2, 3, 4, 5

1^..^5 is 2, 3, 4

There's also convenient shorthand for 0..^n (useful if you want to do something n times): ^n

</comment></comment></comment></comment></comment><comment><USER15> The article mentions a "DON'T DO DRUGS" pencil. The actual pencil, distributed in 1998 by the Bureau for At-Risk Youth, was even funnier. It said "TOO COOL TO DO DRUGS", and apparently the company had no clue what would happen as you sharpened it:

      ◄ TOO COOL TO DO DRUGS

          ◄ COOL TO DO DRUGS

                  ◄ DO DRUGS

                     ◄ DRUGS

[http://www.nytimes.com/1998/12/12/nyregion/slogan-causes- pen...](http://www.nytimes.com/1998/12/12/nyregion/slogan-causes-pencil- recall.html)

Someone has even done a remake of the pencil:

[http://shop.brrybnds.com/product/cool-to-do-drugs- pencil](http://shop.brrybnds.com/product/cool-to-do-drugs-pencil)

<comment><AUTHOR> Thank you! I'll edit the post.

(edit) Now edited - thanks again.

<comment><USER16> Linking to the HN front page as a reference won't be of much use, even only a few hours from now.

<comment><AUTHOR> The link to the front page is the reference to Hacker News in general, not to this specific item. I never intended to link to the specific reference, although I can see why people might think it's relevant. I mentioned the person with a link to their profile, I linked to the forum in general, and I quoted/paraphrased the relevant information. I wouldn't think anything more was needed.

<comment><USER15> I certainly wasn't offended by not having a link to the specific comment.

Heck, I didn't even expect a mention of my _nom de bit_.

I was just happy to be able to help you make a fun story even more fun!

      ◄ TOO COOL TO CARE ABOUT LINKS

          ◄ COOL TO CARE ABOUT LINKS

                  ◄ CARE ABOUT LINKS

                             ◄ LINKS

<comment><AUTHOR> I've actually updated the page to make the references clearer and more specific.

> _I certainly wasn 't offended by not having a link to the specific comment._

"It is amazing what you can accomplish if you do not care who gets the credit." ― Harry Truman

Long may you accomplish many things, and I hope the credit sticks at least occasionally.</comment></comment></comment></comment></comment></comment>


People are biased against creative ideas, studies find - <AUTHOR> http://www.news.cornell.edu/stories/Aug11/ILRCreativityBias.html

<comment><USER3> In case you're interested in reading the actual study here's a link to the PDF. Why the article didn't link to it directly is a mystery to me.

[http://digitalcommons.ilr.cornell.edu/cgi/viewcontent.cgi?ar...](http://digitalcommons.ilr.cornell.edu/cgi/viewcontent.cgi?article=1457&context=articles&sei- redir=1)

</comment><comment><USER4> I've observed this as well and I think I've recently glommed onto an idea that seems to explain it.

Most people operate in their day-to-day via procedures. They learn that to accomplish task X, they do A then B then C.

Creative ideas require a procedure-less thinking process (or at least one where the procedure is not all that important so long as X is accomplished).

Most of the time I've hit resistance to a creative idea is because it requires people to learn new procedures to implement the idea. "You mean to accomplish X I should do A then D _then_ F? What's wrong with A, B then C?"

Even in the face of evidence that the new idea might be easier, or faster, or as a side-effect _also_ accomplish task Y, people simply don't want to take the mental effort to learn the new process.

Creative thinking is just not highly valued among the vast majority of humanity and it's a very hard sell.

<comment><USER5> I always thought it was evolutionary. To be afraid of change and new things because new things bring unforeseen consequences. Better to stick with what works, picking berries in this bush, rather than venture across the river to get to the other bushes and risk being eaten by something.

Also, I remember a study done a long time ago on primates on an island. They all had a very specific way of opening coconuts or whatever, that they taught their young and each other, it wasn't very effective. So the researchers taught one of the primates a new and better way of opening a coconut and released him back with the others. Even though they others could clearly see that his way of opening coconuts was better and easier, the group stuck with the ways of the old. Perhaps because they wanted to conform and not stand out. Little by little a large number of them started using the new method over time. And when a certain percentage of them were using the new method the others converted as well. Lesson: We do what we do because society tells us to.

</comment></comment><comment><USER6> Don't worry about people stealing your ideas. If your ideas are any good, you'll have to ram them down people's throats. -- Howard Aiken

<comment><USER7> "There is nothing more difficult to take in hand, more perilous to conduct, or more uncertain in its success, than to take the lead in the introduction of a new order of things. For the reformer has enemies in all those who profit by the old order, and only lukewarm defenders in all those who would profit by the new order, this lukewarmness arising partly from fear of their adversaries … and partly from the incredulity of mankind, who do not truly believe in anything new until they have had actual experience of it."

– Niccolo Machiavelli

<comment><USER8> Julia Gillard (Australian Prime Minister, who's getting voted out for trying to introduce a Carbon Tax and use the money to reform income taxes) really needed to hear that.

<comment><USER9> On the other hand, if your idea generates a lot of hostility it does not necessarily mean that it's creative or beneficial.

</comment></comment></comment></comment><comment><USER10> It's not that surprising it it? Most new ideas are unproductive (not to suggest that having them is!). Makes sense that we'd develop a resistance to them as a defense mechanism.

</comment><comment><USER11> The study sounds dubious. (Though I do agree with the conclusion, but for other reasons).

> For example, subjects had a negative reaction to a running shoe equipped > with nanotechnology that adjusted fabric thickness to cool the foot and > reduce blisters.

As if no reasonable person could ever have a negative reaction to that? I hope this wasn't their only test.

Personally, I think most people are biased against creative ideas because most people are concrete thinkers (as opposed to abstract thinkers). Their motto in life is "better the evil you know". Now all you have to do is test people on whether they're abstract or concrete thinkers, then correlate that to how they react to new ideas. I think you will find most concrete thinkers will react negatively to creative ideas that haven't been tried before.

<comment><USER12> >Goncalo said this bias caused subjects to reject ideas for new products that were novel and high quality.

Article lost me here. Because its hard to judge an idea as 'novel and high quality' in prospect. They should have used an idea that's proven but unknown to the test subjects.Makes the study harder but you end up with more concrete proof.

</comment></comment><comment><USER13> I've experienced this problem in focus testing.

"What do you think of this new idea?"

\- "I don't like that, it's not something I'd want. I think it would be pointless."

<lets them try a demo>

\- "Wow, this is amazing!"

</comment><comment><USER14> For me it is rewarding to here these findings written on paper. I am forever generating ideas and am continuously faced with awkard silences as people are not sure whether to laugh or congratulate me - it seems true, many people are unable to distinguish a good idea from a bad one (although the article talks specifically about 'creativity').

NB: In many occasions laughing maybe the most appropriate option!

</comment><comment><USER15> SciFi idea: An alternate universe where people are able to recognize talented people and quality work/ideas when they see them. Society quickly collapses.

</comment><comment><USER16> "People dismiss creative ideas in favor of ideas that are purely practical -- tried and true."

What about practical, creative ideas, aka. hacks and lifehacks? Most of the people I know dismiss any 'non-standard' solution unless you actually implement it, and then force them to accept it. If you tell your idea before actually realizing it, there's no way they'll let you.

Also reminds me of stories from "Surely You're Joking, Mr. Feynman!" - <USER2> seems that Feynman experienced this first-hand as a child, when trying to optimize some kitchen chores (one of the solutions is now sold in stores, and nobody objects it now...).

</comment><comment><USER17> It is totally reasonable that people act like that. They already have experience in how they solve their daily problems. So beside being highly unlikely to work, new ideas also mean a cost of relearning old habits. This is a big cost and people don't want to do that. Actually we spent a lot of time and energy to not need to relearn our habits so often. Not having to pay this cost is luxury or maybe even goal of life to many people.

<comment><USER18> Yes! Sadly most of the new "visionary", "creative" ideas people try to promulgate are, in fact, _bad_. Usually there's a reason things are done the way they are, and the complexities of the current system are hard to appreciate from the outside. So a bias against "creative" ideas may be entirely appropriate.

Now, on the flip side, some creative ideas are awesome, and would be great, but no one knows about them, and everyone is tired of suffering through the 99% that are fiascoes, so they resist them. It's a pity, but the response is a reasonable one. Thus both the barriers to, and the rewards of, a truly groundbreaking innovation are high, and the innovator is called upon to do a lot of painful, frustrating, tedious selling of the idea.

<comment><USER17> Yeah it's really tedious to try to change something. It's a pitty people don't value the work you've put into getting something done at all. I also surprisingly saw, that people don't know how much trouble it is, because it tends to look so easy to get something great done.

</comment></comment></comment><comment><USER19> Some of us are deeply biased in favour of creativity. Isn't it possible that this creates a backlash? Especially when lots of new ideas are actually unproven. The best way to change things is incrementally in small steps. It is ego that makes us think that we can just skip steps.

</comment><comment><USER20> Could this be another reason why 2nd mover in a field actually has an advantage, above being able to learn from the first mover mistakes?

The first in the market educates, and all but a few say "I don't want that, that's useless". Then a competitor arrives, and now the idea is no longer as creative, it is now somewhat familiar, and a much smaller leap for people to grasp.

</comment><comment><USER21> Isn't that what makes them creative ideas? Else they'd be obvious.

</comment><comment><USER22> [https://secure.wikimedia.org/wikipedia/en/wiki/Appeal_to_tra...](https://secure.wikimedia.org/wikipedia/en/wiki/Appeal_to_tradition)

</comment><comment><USER23> I think it also matters where the idea comes from: boss, peer, intern, consultant, etc.

<comment><USER6> I think this is the downside of intelligence. You see so many patterns you start to believe that everything falls into one. New ideas are assumed to be no better than old ones.

I don't think it should matter where an idea comes from. I read an article from Fred Wilson that mentioned (in a good way) how surprised a CEO was to find so many good ideas coming from customer service reps (who have the most direct experience with customers). I won't assume you ignored interns, but I think stereotyping by position is a good recipe for overlooking opportunities, just to save yourself some mental fatigue.

<comment><USER24> At my former employer (a commercial software division of a major electronics manufacturer) my managers were dumbfounded when I suggested we ask the tech support people for input when we did feature planning for the next version.

That was around the time I started thinking about finding somewhere else to work.</comment></comment></comment>


Show HN: Index Ping - Get an email when your new website is indexed by Google. - <AUTHOR> http://www.indexping.com

<comment><USER2> As the contact page and the FAQ require signing in, I can't comment on the exact implementation. I suspect they monitor Google's cache as that's the only publicly available data that can power this service. This is the wrong way to do it for many reasons:

1\. There can be a delay between crawling and the page showing up in the cache. I've seen it to be on the order of several days in some cases, even though the page was ranking well and getting traffic!

2\. Email is not a good log format. It's just not. I suspect for this service you'll need to enter each URL you want to monitor manually (yikes!) and then you get an email. If your sitemaps are any good, you already have a good list of your website's URLs and this could be a massive copy-paste operation, but then you'll get bombarded with emails. One time when I implemented such a system, GMail locked for days.

3\. A much better solution is to do it server side with a proper log like in MySQL or MongoDB or whatever. You can do this with a cron job that analyzes the HTTP server's log files at the end of each day, does clever number crunching, generates a report and emails you.

Clever number crunching means calculating numbers that affect your business's bottom line. You can monitor percentage of pages indexed, segment by sections, do trends over time analyses, and more clever stuff like time between crawl and first Google-referred traffic.

<comment><AUTHOR> Great feedback, thanks a lot!

All valid points and if this grows into something larger than what I intended it, I'll certainly look into some more advanced/clever ways of handling the email side of things.

Index Ping was intended for top-level domain names only. IE, "Bob" launches a new website and wants to know when it is indexed. Not down to the individual page level, just when he "breaks" in to the index. If people want more granular control over this, I'll take a look.

Cheers!

<comment><USER2> Two things for you to consider:

1\. Turn this into an API that webmasters can send you their data which you crunch into useful reports. This just might be a decent money earner.

2\. A sitemap importer to kick start the reporting. It should be quite easy as sitemaps are some flavour of XML or plain text.

</comment></comment></comment><comment><USER3> How do you differentiate from Google Alerts ?

<comment><AUTHOR> Just thought I'd make a simpler, more accessible tool that focuses on one thing, finding your site in Google's index. I think simplicity is the main differentiator. Not that Google Alerts is difficult, but it's main use is not geared towards finding your site in Google's index.

</comment></comment><comment><USER4> I'm curious if Google will rate-limit you if your site gets popular.

How frequently do you check each site?

Tried to read your FAQ, but it requires login. Also the 'contact us' page requires login.

Minor nitpick - fix the spelling of "your're".

<comment><AUTHOR> Not sure regarding rate-limiting from Google. Needs investigation. If anyone has any comments regarding this, I'd be interested in hearing.

Sites are checked every 30 minutes.

Fixed up the FAQ and Contact Us pages to be visible without requiring a log in. Silly error, fixed.

Fixed "your're". I hate when people spell that wrong - I really messed that one up!

Thanks again!

</comment></comment><comment><USER5> Nice. I like it, simple, solves a real problem.

<comment><AUTHOR> Thanks, glad you like it!</comment></comment>


Show HN: A Sublime Text plugin to move around and reform things - <AUTHOR> https://github.com/Suor/sublime-reform

<comment><USER2> [https://github.com/facebook/codemod](https://github.com/facebook/codemod) has been very helpful in the few times I needed it.

Of course, a tool that really "understood" code (and multi-language projects) would be much better, but that is only happening next year (like Linux on the desktop).

<comment><USER3> That has been happening for several years now: [http://www.jetbrains.com/products.html](http://www.jetbrains.com/products.html)

<comment><USER4> Oh man, I'd love to be able to do most of my work on the same platform to the extent that I could use a specialized editor.

</comment></comment></comment><comment><USER5> Great work, seems promising. Will give it a run through now.</comment>


How to Choose the Right Logistics Management Software? - <AUTHOR> https://www.fingent.com/blog/how-to-choose-the-right-logistics-management-software <comment><USER2> Will a custom solution be a better choice or use an already existing software</comment>


Bringing Black Talent to Silicon Valley - <AUTHOR> http://www.theroot.com/views/tristan-walker-code-2040

<comment><USER2> new york beats silicon valley for one simple reason: If you're a programmer who just graduated college, would you rather live in suburban California and work at a sterile "office park" or would you rather live/work in Manhattan?</comment>


Why AM and Eurisko Appear to Work (1984) [pdf] - <AUTHOR> http://eksl.isi.edu/files/library/Lenat_Brown-1984-why-AM-and-EURISKO-work.pdf

<comment><USER2> AM may not be ... the best name for an AI. [https://en.wikipedia.org/wiki/I_Have_No_Mouth,_and_I_Must_Sc...](https://en.wikipedia.org/wiki/I_Have_No_Mouth,_and_I_Must_Scream)

<comment><AUTHOR> AM was short for Automated Mathematician.</comment></comment>


Princess Mako to lose Japan royal status by marrying commoner - <AUTHOR> http://www.bbc.com/news/world-asia-39957217 <comment><USER2> Honest question: does she have much choice? How large is the extent Japanese royalty (post war)? Is her only alternative to remain unmarried?

</comment><comment><USER3> do ppl still actually care about royalty?

<comment><USER4> Yes. William + Kate (Britain) have been all over the media the last decade. Millions and millions watched their wedding.</comment></comment>


Git (and Github) Cheatsheet - <AUTHOR> http://leandot.com/technology/git-cheatsheet/

<comment><USER2> Nice guide - very simple and to the point.

One minor issue. For "git commit -a -m "this is my commit message" you don't explain what the "-a" flag does in your description which could lead some to dismiss it, whereas it does actually perform extra actions beyond simply committing. A developer might not always want to add unstaged modifications, so they should be aware of this.

<comment><AUTHOR> True, updated. Thanks

</comment></comment><comment><AUTHOR> I've compiled some useful git commands I've found myself using over the years on my blog. Hope it helps someone.

</comment><comment><USER3> great post, liked especially the info about "Github Compare View"! thx</comment>


Reanalyzing the State of Java EE - <AUTHOR> http://johnclingan.com/2016/12/19/reanalyzing-the-state-of-java-ee/ <comment><AUTHOR> In case anyone is interested in the other side of the "JavaEE is heavy" story.</comment>


Email Stamps to Solve Spam - <AUTHOR> http://adam.blog.heroku.com/past/2008/11/17/email_stamps_to_solve_spam/ <comment><USER2> Wow, it's been a while since a pay-to-send email mechanism has been floated about. They all seem to fail long before implementation, and for many of the same reasons.

One of the biggest reasons is that you can already get 99% of this effect for free today. There are a number of services and options where any email that comes from an unknown sender is quarantined by a system, which sends an email to the unknown sender. This email contains some instructions, perhaps to click a link, or solve a simple math problem, or some other such gating factor that makes it near impossible for the common spammer to invest the effort to circumvent the system in any reliable way.

<comment><USER3> And systems like qsecretary tend to provoke reactions like this:

[http://www.ops.ietf.org/lists/namedroppers/namedroppers.2003...](http://www.ops.ietf.org/lists/namedroppers/namedroppers.2003/msg00051.html)

<comment><USER2> Yes. Any mishandled whitelisting system is going to produce responses similar to the one in your link.

I imagine the author would be even more outraged if he had to pay 5cents multiple times to get past a poorly implemented spam block.

</comment></comment></comment><comment><USER4> Honestly, even if this sorta works and you somehow magically get everyone into it, we had and still have spam in the form of physical mail. At 5 cents it sounds like email spam will still be cheaper than that. ...I am now very tempted to scream 'fail'.</comment>


Linux containers in a few lines of code - <AUTHOR> https://zserge.com/posts/containers/ <comment><USER2> A little bit of education about container systems in linux[1]. A container system is typically made up a number of components:

 _isolation layer_ : the piece that limits privileges and resource usage. (On linux, this is usually handled by cgroups and the kernel, but could also be handled by something like kvm for vm-based containers)

 _raw container configuration_ : Given an image and some metadata (like cpu limits), launch an isolated process. (On linux, this is usually handled by runc when working with cgroups)

 _container api daemon_ : Manage the list of container processes and available images. Provide a unix socket based API for manipulating isolated processes, launching, deleting, connecting, etc. (In the case of docker, they provide a daemon which abstracts the containerd daemon, or you can use containerd alone without docker)

 _container command line tool_ : Provide a user/developer interface to the three things above. This is the docker command. When you install containerd without docker this is the ctr command.

Docker, which is probably the most famous container distribution, pairs the docker command with the docker daemon to abstract away the containerd daemon, runc, and cgroups.

If you use containerd alone, you get ctr/containerd/runc/cgroups.

There's a standalone command line tool (crictl) which replaces both ctr and docker and can be used on top of either the docker daemon or containerd.

[1] Container systems seem to have a relatively complex abstraction over what is a relatively simple architecture.

<comment><USER3> I feel like podman is proving that you don't really need the api daemon and a porcelain over runc with a one-off process supervisor is sufficient for a good number of workloads.

Being able to run containers like any other process and leave the lifecycle management to systemd is actually really nice.

<comment><USER4> Could not agree more. As a Fedora user I was mildly intrigued when Podman showed up, I played with it briefly but stopped because most of my projects used docker-compose, which doesn't work with Podman.

When I went to work at Red Hat I decided to really try Podman, and I love it now. Once I discovered that Podman supports Kubernetes Pods (same YAML and all) I realized how clunky docker-compose actually is. Since most of my projects now run in K8s anyway, it's awesome to have the app run as a Pod locally so it can easily be tested with any sidecars in the same configuration.

There are still uses for docker-compose, and I don't expect it to disappear from my life completely any time soon, but Podman does have a great place in my toolkit.

<comment><USER5> podman-compose works fine for me, despite being advertised as "still under development".

[https://github.com/containers/podman- compose](https://github.com/containers/podman-compose)

<comment><USER6> podman-compose works better than expected, however, it is NoT a "drop-in" replacement for docker-compose, at least now.

</comment></comment></comment></comment></comment><comment><AUTHOR> I love minimal code like this as a way of really understanding how something works. The author is pretty consistent too - he's got some great projects like an ultra-minimal electron alternative: [https://github.com/zserge/webview](https://github.com/zserge/webview)

<comment><USER7> Same, I really like the book 500 Lines or Less for this as well: [https://github.com/aosabook/500lines](https://github.com/aosabook/500lines)

I've personally been getting in to writing minimal code because I've grown frustrated with how simple tasks can result in complex code that's difficult to maintain. Minimal code is easier to come back to. A 100 line script can be easier to understand than a 500 line script.

</comment></comment><comment><USER8> Big caution here. Do NOT use this style of code to invoke ip tools. This was the cause of a huge number of security vulnerabilities on Android in the first few years. Even if you're hardcoding interfaces to start, it's likely someone else will drive by later on and replace one of the args with %s.

> system("ip link add veth0 type veth peer name veth1");

Always, always, always use exec*() APIs.

<comment><USER9> Are there not better C APIs to call that `ip` et al are wrapping?

<comment><USER10> Yes, rtnerlink is used to configure networking via a netlink socket, and libnetlink provides an abstraction over sending raw datagrams.

</comment></comment></comment><comment><USER11> Nice work. I'm reminded of bocker [0], which also implements this sort of functionality in only a few dozen lines of code. The function which corresponds to this post [1] is relatively short and readable.

[0] [https://github.com/p8952/bocker](https://github.com/p8952/bocker)

[1] [https://github.com/p8952/bocker/blob/master/bocker#L61-L90](https://github.com/p8952/bocker/blob/master/bocker#L61-L90)

</comment><comment><USER12> Julia Evans has an excellent zine on how containers work, including a 15-line bash implementation: [https://jvns.ca/blog/2020/04/27/new-zine-how-containers- work...](https://jvns.ca/blog/2020/04/27/new-zine-how-containers-work/)

Definitely worth the $12.

<comment><USER13> I loved it. It helped me understand the nitty gritty of containers.

You can download it for free too: [https://gumroad.com/l/containers- zine/buyonegiveone](https://gumroad.com/l/containers-zine/buyonegiveone)

There is an official option to either pay or get it for free. Do support her if you can.

</comment></comment><comment><USER14> DIY Containers on Linux is probably a better term here given that Linux Containers is already heavily in use around the world and included in ubuntu by Canonical?

For me this is enough to get a container running:

        lxd init
        lxc launch ubuntu mycontainer
        lxc exec mycontainer bash

[https://linuxcontainers.org/](https://linuxcontainers.org/)

<comment><USER15> I don't know, I find "Linux Containers" to be sufficiently generic as Linux has _native_ support for them. LXD/LXC, Docker, etc, are simply tools built upon that.

<comment><USER16> I agree. Most people who read "Linux Containers" are going to think of Docker, not LXD.

<comment><USER17> People are different.

When I think about containers, I think about isolated system images, lightweight VMs, which I can use and adapt to solve a problem at hand.

When I hear Docker, I think about static, locked-down _application-images_ made by others, to deploy in the cloud, which I'm not given to adapt to my needs, and I also think about things which is not natively integrated into my Linux-distro and for which I will have to provide glue manually. I also think about a startling amount of complexity in a new stack which I would have to learn, just to manage what is actually really just basic Linux-systems.

While all that may or may not be true, that's what I _think_ about when I hear "Docker".

Hearing "containers" on the other hand, makes me happy. And yeah, I'll got with LXC/LXD any day.

</comment></comment></comment></comment><comment><USER18> Could someone comment on how secure such a container is, at least nominally? Should I be able to theoretically run untrusted code on such a container if the system is bug-free and I add proper error-checking to the code? Or are there things that you'd need to worry about the code being able to access? Any considerations regarding sudo permissions?

<comment><USER19> Definitely not secure. The author did a great job explaining container runtimes in basic terms, but there's a lot of security features missing. Mainly: * Reducing the container's capabilities * Restricting access to resources through cgroups * Applying seccomp filters to prevent certain syscalls.

As another comment suggested, user namespaces are another hardening feature, but not all container runtimes enable it by default. Podman does, Docker doesn't. In fact user namespaces are so powerful that I believe they pretty much cover most of the hardening provided by the three features I listed above. If you're wondering why they're not enabled by default in Docker, take a look at this [1].

Exploiting the missing isolation mechanisms, the following bash commands will allow you to escape from the author's containers:

$ ls -al /sys/dev/block # find the root fs device (e.g. /dev/sda1) major and minor device numbers (e.g. {maj=8, min=1}, {maj=259, min=1})

$ mknod --mode 0600 /dev/host_fs_dev b $major $minor

$ mkdir /host_fs && mount /dev/host_fs_dev /host_fs

(warning: shameless plug to my posts follows:)

If you want more details, I wrote a post on this exact same problem in the context of three vulnerabilities I found in rkt (another container runtime) [2].

Beside the issues above, the author's runtime also exposes host file descriptors like /proc/self/exe that can be used to escape the container. This is a post I wrote on runC CVE-2019-5736 that explains this kind of issues.

[1] [https://docs.docker.com/engine/security/userns- remap/#user-n...](https://docs.docker.com/engine/security/userns-remap/#user- namespace-known-limitations) [2] [https://unit42.paloaltonetworks.com/breaking-out-of- coresos-...](https://unit42.paloaltonetworks.com/breaking-out-of-coresos- rkt-3-new-cves/) [3] [https://unit42.paloaltonetworks.com/breaking-docker-via- runc...](https://unit42.paloaltonetworks.com/breaking-docker-via-runc- explaining-cve-2019-5736/)

<comment><USER20> Thank you for detailed answer and interesting links!

Could you please explain/point me to some information/source, why docker can't use -net=host namespace if userns is enabled, while on the other hand rootlesskit[1] which uses userns by default, dont have problem with using host netns (--net=host) ?

[1] [https://github.com/rootless- containers/rootlesskit](https://github.com/rootless-containers/rootlesskit)

</comment></comment></comment><comment><USER21> See also:

Linux containers in 500 lines of code (2016) [https://news.ycombinator.com/item?id=22232705](https://news.ycombinator.com/item?id=22232705)

</comment><comment><USER22> A few weeks back had published on how to build a container in go programming ... In case interested here are the links:

[https://www.polarsparc.com/xhtml/Containers-1.html](https://www.polarsparc.com/xhtml/Containers-1.html) [https://www.polarsparc.com/xhtml/Containers-2.html](https://www.polarsparc.com/xhtml/Containers-2.html)

</comment><comment><USER23> Small container implementation in Scheme: [http://git.savannah.gnu.org/cgit/guix.git/tree/gnu/build/lin...](http://git.savannah.gnu.org/cgit/guix.git/tree/gnu/build/linux- container.scm)

</comment><comment><USER24> One thing to note, is that using a PID namespace in that way is incorrect. PID1 in a PID namespace has to perform the duties normally performed by a PID1, so you will normally want PID1 in the namespace to be a minimal init. If not, there may be issues, like unreaped zombie processes.

</comment><comment><USER25> While this is interesting, it doesn't really show how containers _actually work_ , only lists the specific syscall flags to _tell Linux create one_.

A similar snippet[1] exists for go, and it doesn't do anything particularly special either.

I don't know, maybe David beazley has altered my sense of what "from scratch" means.

[1] [https://gist.github.com/lizrice/a5ef4d175fd0cd3491c7e8d71682...](https://gist.github.com/lizrice/a5ef4d175fd0cd3491c7e8d716826d27)

<comment><USER16> This is how containers work though. Or did you want more detail about the internals of pivot_root or something?

<comment><USER25> Yes, something like that.

Like here's David's "Build Your Own Async" [1], which I prefer over Philip's (still extremely good) "What the heck is the event loop anyway?" [2].

It's one thing to _tell_ how something works, but to successfully show what the hell its actually doing under the covers, just conveys much more information.

[1] [https://www.youtube.com/watch?v=Y4Gt3Xjd7G8](https://www.youtube.com/watch?v=Y4Gt3Xjd7G8) [2] [https://www.youtube.com/watch?v=8aGhZQkoFbQ](https://www.youtube.com/watch?v=8aGhZQkoFbQ)

</comment></comment></comment><comment><USER26> I love this kind of posts, it's never something you will effectively use instead of the actual product (here, Docker), but it's really a great way to learn new little things.

</comment><comment><USER27> Linux containers in one shell statement

      $ echo $$ > tasks

<comment><USER8> I'm not sure if this is serious or a joke, but can you explain it further?

<comment><USER27> Given certain initial conditions, this statement moves the current process (and any process it subsequently creates) into a control group, which meets minimal definitions of containerization.

<comment><USER28> It really doesn't. I would say that "unshare -mpf ; pivot_root" matches the most minimal definition of a container more accurately than joining a cgroup (it's an isolated system which can't directly interact with the host).

Otherwise you'd have to argue that configuring rlimits actually makes your shell a container, which is too much of a stretch (for me at least).

<comment><USER27> I think that just underscores my point, which is that containment means different things to different people. To me, it means only the resource limiting features from cgroups. I have no use for namespaces, bind mounts, virtual network interfaces, or any of that stuff. In my application all that stuff is either pointless or harmful. But to you, container means at least PID and mount namespaces.

rlimit is sort of a thing but it's not actually effective so to me it's not part of the picture. If unix limits worked, Google would not have needed to contribute cgroups before deploying Borg. Indeed, in this LWN article which is actually about control groups, they call control groups "containers". Just shows there is not a universal meaning of the term.

The earliest control groups patch I can find says "We use the term container to indicate a structure against which we track and charge utilization of system resources like memory, tasks etc for a workload." It doesn't say anything about isolation, namespaces, or security, but it uses the term container to describe resource control.

[https://lwn.net/Articles/236038/](https://lwn.net/Articles/236038/)

<comment><USER29> Regardless of what was said when cgroups was first implemented, the current industry term "container" does actually mean isolation. I suspect you'd find yourself in a very small minority of people who use it to mean simply "running in a cgroup".

> _Just shows there is not a universal meaning of the term._

Yes, there is. That meaning has just evolved since 2007.

</comment></comment></comment></comment></comment></comment><comment> streb-lo Anyone want to chime in on why pivot_root is preferable to a chroot jail? It's kind of hand-waved in the article.

<comment><USER28> This is mostly to do with the implementation of chroot(). Because it only applies to a single process (and mount tables are per mount namespace), it was implemented in such a way that directories above the root of the chroot are still technically accessible (the mounts above the root directory are still present in the mount hierarchy). This results in all sorts of fun bugs where if you chroot() inside a chroot() you can get out of the chroot() entirely. Container runtimes generally block CAP_SYS_CHROOT by default for this reason, but there are all sorts of other subtle security bugs which pop up because of this fundamental design choice.

pivot_root() doesn't suffer from this problem because it applies to the entire mount namespace, and thus its implementation could be made much safer. Instead of just changing the current process's filesystem root, the actual / mount of the mount namespace is swapped with another mountpoint on the system (and the old root is mounted elsewhere). Thus once the old root is unmounted there isn't a way to get back to the old mountpoints. This isn't perfect protection (magic-links and other mounts could expose the host filesystem) but it is a damn sight better than chroot(). Oh, and nesting pivot_root()s doesn't cause a breakout.

Note that this different behaviour in relation to mounts has resulted in completely unrelated security bugs with containers (such as being able to bypass procfs masks because chroot() doesn't hide the unmasked procfs in the host mount namespace). This is why us container runtime authors always tell people they should never use chroot() and always use pivot_root() -- though sadly sometimes chroot() is needed because pivot_root() doesn't work on initramfs.

(I'm one of the maintainers of runc, the runtime which underlies Docker/podman/containerd/cri-o/...)

<comment><USER29> > _though sadly sometimes chroot() is needed because pivot_root() doesn 't > work on initramfs._

Are people actually attempting to boot a super-minimalist system that just has a kernel and an initramfs with something like docker into it where they don't bother with a rootfs at all and just start running containers directly from the initramfs? That's kinda cool, if that's the case.

<comment><USER28> You could do that (though one could argue that there's no real benefit to using containers in that case), but the issue is sadly more general than that. You cannot use pivot_root() if the _current root_ is on initramfs. The reason is fairly historic, and boils down to "you cannot unmount initramfs" in the same way that "you cannot kill pid1".

This means that setups where you have the entire OS image in initramfs, and you try to run a container (even if it has a different filesystem as its rootfs) it will fail with pivot_root(). There are solutions for this but they require changing how the system is started (which can be a bit complicated depending on what system you're using to build your initramfs). From memory, minikube has used --no-pivot-root for a while precisely for this reason, though I believe they have switched away from it sometime recently.

</comment></comment></comment></comment><comment><USER17> The title is about _Docker_ containers in a few lines of code.

Could the mods consider renaming the submission?

</comment><comment><USER30> thanks for sharing!

</comment><comment><USER31> Software history should be written that Docker gave Phil Katz the Oliver Cromwell treatment.</comment>


An onion of obfuscation - <AUTHOR> http://arcanesentiment.blogspot.com/2010/01/onion-of-obfuscation.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+ArcaneSentiment+%28Arcane+Sentiment%29&utm_content=Google+Reader <comment><USER2> I'm a little confused. He says that it's a phishing attack and not a virus, but isn't the eventual payload an executable that does lots of dark win32 magic? I kept expecting him to describe how it launches your browser to a fake bank login site. Just curious... did I miss something?

<comment><USER3> He thinks it's for replacing a bit of your browser and doing phishing that way, based entirely on the symbols the executable imports. So it's a guess, but a semi-educated one.

<comment><USER2> I'll capitulate, but only if we get to subsequently call it a "phirus". (Though I suppose the lack of self-replication precludes calling it a virus.)

<comment><USER4> _by chance it appeared to come from someone who has previously written to me_

To me, this suggests a viral nature of the attack.

</comment></comment></comment></comment><comment><USER5> I'd be interested to know which steps of the packaging process were done automatically. Presumably these two could be automated in a straightforward fashion:

 _Embedding a script in a command via cmd /C ... & ... & ... (twice)_

 _Generating a script and then running it (four times)_

The call to isDebuggerPresent in the final payload executable would be about zero inconvenience to a malware analyst. The sophistication of the packing makes me think there are probably other antidebug techniques present.

</comment><comment><USER6> I was hoping that an onion was the name for a group of obfuscations as per <http://www.futilitycloset.com/2010/01/03/a-field-guide/></comment>


Name a few angels that love auto racing? - <AUTHOR>

Name a few of those who are passionate about cars, modifying cars, and will race their own. Those who have deep understanding of this particular industry. <comment><USER2> I do. What's up?

<comment><AUTHOR> we are a team of four developing a webapp aiming to disrupt aftermarket performance parts industry and change how car enthusiasts interact now. We are looking to pitch the idea and get some help on feedback and advise.

Would you mind I drop you an email to explain in more detail about us?

btw. I was a big fan of Delicious back in the days. :)

Thanks, Ken

<comment><USER2> Sure, drop me a note.

<comment><AUTHOR> Just sent to your gmail.</comment></comment></comment></comment>


Ask HN: I am crazy (but can you help?) - <AUTHOR>

I'm one of the co-founders of a startup called Bundio that enables artists and record labels to set up direct-to-fan subscriptions to their content. Prior to getting into startups I was a singer-songwriter but about two years ago I put music to the side for the most part. It's a real problem because I strongly believe those that build the best platforms are actually users of those platforms. I came to the realization that I need to get back into music so I can be a user of the platform and build something remarkable. I also realized that money wasn't going to be well-spent signing onto a new one year lease for $1k / month in Boston.
So I'm getting out of the office and hitting the road!
On January 13th I will embark from Guilford, CT (my hometown) on a cross-country tour playing/recording DIY concerts, making field recordings of artists (that I'll add to a Bundio subscription), and meeting up with other startup founders as I pass through their towns.
55 days on the road, 25+ states (and Vancouver, BC), 30 shows (hopefully)
I'll be documenting the entire journey daily on the site I created for the tour: http://housecallstour.com
How can you help? A number of ways: connect with me if you are on my route (http://housecallstour.com/route) or know someone that is. I'm particularly interested in meeting up with those working on digital media, social media, and music startups. As I said above, I'm trying to put on DIY shows in living rooms and houses (Edit: adding link to my music - http://housecallstour.com/about_drj). These will be house concerts (tame), not house parties (wild), so even if you haven't hosted something like this before please do consider - it will be fun! Joining me for each show will be local performers. I could also use some help with couches to crash on along the way.
Anything I'm missing? Please let me know if you have any ideas for me or other ways you think the HN community can help!
Julian email@example.com (email me for my cell #) <comment><AUTHOR> Why did I title the post this way?

Recently I found a post titled, "Ask HN: Am I crazy?" ([https://news.ycombinator.com/item?id=801208](https://news.ycombinator.com/item?id=801208))

The OP had laid out his desires to travel around the United States after finishing college to meet up with founders around the country and write about them. I was happy to see that the HN community encouraged him. I shot him an email at 1am the night I discovered the post asking if he ever went on the adventure. I never heard back.

<comment><USER2> Perhaps he'd already gone? :)

<comment><AUTHOR> That's what I'd like to think but there were no follow-up posts on HN and the original post was from a while back.

Edit: and his post was from 1559 days ago - hopefully he didn't get lost ;)

</comment></comment></comment><comment><USER3> Disappointed to see nothing at all around the middle/north of the country. I suppose I'd stay away from the snow if I was planning on travelling January - March too.

<comment><AUTHOR> Sorry about that. I'm from New England and familiar with driving in some rough weather but I'd still be a bit concerned about traveling in the north of the country during that time of year.

</comment></comment><comment><USER4> Just a heads up, be careful when going over the border into Canada. I've had many friends rejected at the border because they were going to play a 'concert'. Even DIY ones will get you bounced back to the US. Don't say you're playing a concert or anything. That is unless if you've gotten the requisite paperwork then your'e okay.

<comment><AUTHOR> Definitely sound advice. I think I'll just be going to Canada to see a concert ;)

<comment><USER5> If you are playing a show, do not lie. Get all of your paperwork and do it by the book. It's free and easy, especially if it's a DIY show with no guarantee. You just need the promoter to sign some stuff and follow a few simple rules. If they catch you in a lie, they can do all kinds of crazy shit that makes it hard or impossible to play or even visit in the future. You can email me if you'd like, firstname.lastname@example.com, I can try to track down the templates we used last time.

</comment></comment></comment><comment><USER6> You might post links to some of your music -- I think more people would be interested in hosting a house concert for music that they've heard and like, rather than taking a blind risk.

YouTube? mp3 links? We're not your fans yet, you need to convince us that you have a product we're interested in.

<comment><AUTHOR> Certainly!

It's on the music + bio section of the site but I should add it to the OP:

[http://housecallstour.com/about_drj](http://housecallstour.com/about_drj)

<comment><USER7> Totally dig it! Unfortunately, you're not stopping by my town... Best of luck, it's gonna be an interesting time in the south for an Americana solo act from Connecticut.

<comment><AUTHOR> Thanks! I've only had the pleasure of being in Austin, New Orleans and Nashville previously.

<comment><USER8> Of which, only Nashville is "the south". New Orleans is maybe 50% "the south" and 50% its own thing.

</comment></comment></comment></comment></comment><comment><USER9> Denton, Victoria, Marfa. You've sure chosen an eclectic mix of cities in Texas (plus, of course, Austin). BTW, you might want to take the "Dallas" off of "Dallas/Denton" since Denton is its own unique institution. :) Denton is a (two-)college town so Craigslist will help a lot.

<comment><AUTHOR> Thanks for the tips!

I have things like Dallas/Denton the route because the actual stop is TBD but the cities are fairly close together (Dallas and Denton are about 50 minutes away from each other).

I've got a friend in Victoria so I'm stopping there for a show and to take a bit of a breather at the end of this marathon!

<comment><USER9> More like 90 minutes given how horrible 35E is these days (source: former Dentonite). I think Denton will be better suited to what you're trying to accomplish, but I'd skip any of the suburbs in between to have the best chance of drawing the audience you're after.

<comment><USER10> That might be the case for a commute in rush hour, but mid day it doesn't take nearly that long to drive between the two (I live nearby).

</comment></comment></comment></comment><comment><USER11> Obviously no tour would be complete without the official tour t-shirt. I hope you have that on high priority.

<comment><AUTHOR> Haha working on it!

I was reading about bleach shirt stencils in MAKE magazine actually: [http://makezine.com/projects/bleach-shirt- stencil/](http://makezine.com/projects/bleach-shirt-stencil/)

<comment><USER12> You could use acetate, acrylic paint, plus glue to do a dyi screenprint on the run. I did this, and I have shirts that have held up 10 years :)

<comment><AUTHOR> Cool tip! I've honestly been thinking more about getting the schedule ironed out than merch but I'll take a look at this method.

</comment></comment></comment></comment><comment><USER13> Check out 'Secret House of Pancakes' based in Allston - it's an underground gig movement you may find useful.

<comment><AUTHOR> Sounds musically delicious! Thanks!

</comment></comment><comment><USER14> When are you headed to Houston? There's a community concert series [http://www.Facebook.com/carolinesessions](http://www.Facebook.com/carolinesessions) which has multiple artists, last when'd of every month, FREE, benefits a rotating non profit...

</comment><comment><USER15> You've got a great voice! Are you intending to go to SXSW, is that why your tour ends there on March 7? Joshua Tree is beautiful and so is Big Sur. Happy to connect you to some folks here in SF. Will email. Good luck and great guerrilla marketing for your startup.

</comment><comment><USER16> Best of luck dude. Unfortunately I'll be away when you're playing near me, in Chapel Hill!

<comment><AUTHOR> No worries and thank you!

</comment></comment><comment><USER17> How come you are skipping NYC?

<comment><AUTHOR> I don't have to if you think there's something I could do there :) and I do have quite a few musician friends in Brooklyn.

The goal is to get farther south as soon as I can.

</comment></comment><comment><USER18> Will you do a Slayer cover?

<comment><AUTHOR> If you pay the ASCAP blanket license!</comment></comment>


Stents, surgery show no benefit in heart disease mortality in stable patients - <AUTHOR> http://med.stanford.edu/news/all-news/2019/11/invasive-heart-treatments-not-always-needed.html <comment><AUTHOR> [https://www.ischemiatrial.org/ischemia-study- results](https://www.ischemiatrial.org/ischemia-study-results)</comment>


We've just had the best decade in human history - <AUTHOR> https://www.spectator.co.uk/2019/12/weve-just-had-the-best-decade-in-human-history-seriously/ <comment><USER2> It's a global vs local problem. Globally, there's no question that the general state of things is improving. Of course, this is in general -- there are things that are getting worse globally as well.

However, in some parts of the world (such as, in my opinion, the US), things are going a bit backwards. If you live in such an area, it can be hard to see (and appreciate) the bigger picture.</comment>


The more Starbucks a country has, the bigger its financial problems. - <AUTHOR> http://www.slate.com/id/2202707/

<comment><USER2> on another news, the more espresso machines a country has, the bigger its startup problems</comment>


Russian malware mines bitcoins through botnet - <AUTHOR> http://www.pcworld.com/article/2035749/russian-malware-mines-bitcoins-through-botnet.html

<comment><USER2> It was only a matter of time before Bitcoin botnet's appeared given the added interest in the currency by both the media and investors and anonymity of both the transactions themselves and the mining aspect.</comment>


TinyWall – A free, lightweight and non-intrusive firewall - <AUTHOR> https://tinywall.pados.hu/ <comment><AUTHOR> tl;dr: a free firewall for Windows which blocks everything by default and doesn't alert you when a program fails to go through it - instead, blocked things go into a "recently blocked" list going back up to 2 minutes, where you can explicitly whitelist them.

Windows Firewall has pretty bad defaults (e.g. unrestricted outgoing traffic among other things) and its advanced mode is a pain to work with. I've been using TinyWall for a while and it's come to be one of the first things I install on a fresh system.

Disclosure: I am not in any way involved with this software nor its author.

</comment><comment><USER2> it works very well with screen readers. Lots of firewalls and malware programs don't witch screws over blind people who want to stay safe on there computers. I use it on windows 10 with NVDA.</comment>


Some Tips for Debugging in Deep Learning - <AUTHOR> http://www.lab41.org/some-tips-for-debugging-in-deep-learning-2/ <comment><USER2> >Of course, the right choice is always to know what you're doing and never to make any mistakes. This may involve sketching your network architecture out on paper, doing a masters in machine learning, or getting someone else do either one of those for you and going to the beach instead. If you are a fallible human being, though, or you've blown through your vacation budget already, I hope these nuggets of intermittently sound advice help you iterate faster and (eventually) get your bleeping convnet to work.

Or you could do a master's in computer science.

Grad school is not trade school</comment>


A Better ImageMagick Gem - <AUTHOR> http://blog.ericrafaloff.com/2012/06/14/a-better-imagemagick-gem/

<comment><USER2> Why did MiniMagick not work for you? It does exactly this type of manipulation using the command line, and is working great for a large number of existing web sites</comment>


Fifth Google worker-activist fired says company is targeting the vulnerable - <AUTHOR> https://www.theguardian.com/us-news/2019/dec/17/fifth-google-worker-activist-fired-in-a-month-says-company-is-targeting-the-vulnerable <comment><USER2> "Of the five people that were fired, three of us are trans women," Spiers said. "That is either an unbelievable coincidence or Google is targeting the most vulnerable."

Wow. I've read a few other articles and HN comment threads about Spiers being fired, and this is the first time I've heard of this. It adds needed context to the article title.</comment>


Dual Bagpipes - <AUTHOR> https://www.jefftk.com/p/dual-bagpipes <comment><USER2> Interesting to see this pop up here. I play a lot of traditional music, and one thing I'm more exposed to than most people is variations in bagpipes. The Highland Bagpipes of Scotland are a bit of an anomaly; Scotland obviously has a great piping tradition now, but historically there's not as much evidence of it as there is, for example, in England. However the English tradition died out almost entirely, with the exception of the Northumbrian tradition.

The Highland Pipes are also extremely loud and they're built for marching. They're not particularly designed for soft expression, as a lot of other pipes are. And honestly attaching two bags to the highland pipes would require such a ridiculous amount of pressure/air that you'd likely die from exhaustion :D

As mrob has already said, the pressure could vary the tuning, but it may be more possible to vary the sound using pressure when using a single-reeded instrument rather than the double-reed that most modern pipes use.

Probably the most amazing design of pipes is the Uilleann pipes, which have an insane range (3 octaves I think?), bellows for feeding the bag instead of a mouth pipe (not uncommon on other pipes as well), and something particularly interesting called the "regulators". These essentially let you play chords, or single notes, on the drones by using your wrist. This allows you to add accompaniment or rhythm into the playing. Here's an example of someone playing the regulators: [https://www.youtube.com/watch?v=nZTHs7eQSKc](https://www.youtube.com/watch?v=nZTHs7eQSKc)

There are other interesting pipes that use multiple chanters, or combined chanter/drone systems that let you vary things more effectively. Some of my favourites are the Zampogna of Italy: [https://www.youtube.com/watch?v=CU_xR_mS9YI](https://www.youtube.com/watch?v=CU_xR_mS9YI), and particularly the odd Boha from Gascogne in France: [https://www.youtube.com/watch?v=MKyXn2dqg9s](https://www.youtube.com/watch?v=MKyXn2dqg9s). The Boha that the guy in that video makes are really interesting; he makes them with additional holes that you can move corks between to vary the scale, and he makes some with two chanters and a drone all together, which allow you to play simple harmonies. A technique which a guy I know has turned into a pretty phenomenal playing style (on some English-made pipes here): [https://www.youtube.com/watch?v=fJisKPjCEXA](https://www.youtube.com/watch?v=fJisKPjCEXA)

<comment><USER3> Thanks for the fantastic links. The Uilleann pipes are amazing, I don't think I'd ever seen their like!

I've discovered that my 5-month-old really loves the sound, he wanted to get up and dance a jig. Unexpected and heartwarming.

<comment><USER2> I finally found a wonderful performance video of a player on the Uilleann pipes that I saved ages ago! It's unfortunately on Facebook, but this is beautiful playing (particularly on the regulators): [https://www.facebook.com/UCDChoralScholars/videos/7786129522...](https://www.facebook.com/UCDChoralScholars/videos/778612952215487/)

And yeah, sometimes the sound just gets you going! The drones in particular have a peculiar effect and for some people they just get right inside your head. There's really only two historic instruments that implement proper drones; the pipes, and the hurdy gurdy. There's something really ancient and stirring about drones in music!

</comment></comment></comment><comment><USER4> I assume it's not done because the tuning is affected by the pressure. Bagpipes typically play melodies over constantly sounding drones, and different sized pipes are affected differently by changes in air pressure, so bagpipes will sound out of tune if the air pressure varies too much (tuning errors are much more obvious in harmony than in monophonic melodies).

</comment><comment><USER5> How would you couple the bags such that the pressure in them could vary independently?

<comment><USER6> The chanter would be under relatively constant pressure, and there could be a one-way valve to the drone bag.</comment></comment>