Show HN: Supernotes – a better way to collect your thoughts - <AUTHOR> https://supernotes.app/?ref=hn <comment><USER2> Congrats on launching!

I'm curious why you decided to focus on native desktop apps before mobile apps. For me, a note taking system is a non-starter without a solid (Android) mobile app, as much of the value comes from quickly jotting down thoughts/ideas as they come to me, which is often when I'm not in front of a computer.

<comment><AUTHOR> Thanks!

So this is really just a time constraint issue. The desktop apps will initially just be Electron wrappers around the web app – I'm not a huge fan of this as it results in fairly bloated desktop apps, but we've had people say they'd like desktop apps anyway, so we're gonna do that for hopefully the next release.

Mobile apps is a bit harder, as it requires actually writing a new interface, either in something cross-platform like React-Native (probably what we will end up using, as the current web app is in React) or something else. Which is why for the time being we've tried to make the web app itself as responsive as possible on mobile.

We also plan to improve the web interface on mobile significantly in the next release to make it feel more like a native app even though it won't be one (yet).

But yes, mobile apps are definitely something we want sooner rather than later! Just need more time in the day ;)

</comment></comment><comment><USER3> It looks neat, but what differentiates you from say something like Notion [1] ?

[1] [https://www.notion.so/](https://www.notion.so/)

<comment><AUTHOR> Good question! Notion is a great product, big fan myself.

There are a couple main differences, but I think the biggest one is the way things are shared and from there the kind of workflows we are trying to accommodate. Everyone has a different way they like to organize their notes – this can make it hard for people to collaborate because they all want the final product (a collection of notes) to suit their own workflow. Notion has done a great job of building a great UX for collaborative working, but when you collaborate with someone on Notion, you still need to agree to a "structure" and then collaborate within the framework of that structure.

In contrast, we have built Supernotes to allow for many different ways to organize your notes. And more importantly, different ways that collaborators can organize _the same_ notes.

\- You can have structured hierarchies using nesting, not unlike a conventional folders + files system. Though I think our implementation is more powerful, as nesting allows you to more easily "expand" on ideas, and a single card can actually have multiple parents. This is how most existing note-taking / knowledge base apps are structured. With multi-parents though, we are fairly unique.

\- You can have _unstructured_ graphs by using our hyperlinking functionality. This is how the internet in general is structured, and now what Notion, Roam, and others are doing.

\- You can have a totally flat structure using only tags.

And of course you can mix-and-match these options as much as you want / need to. This makes it easier for people (espescially people that aren't on a "team" – think freelancers, students, etc) to collaborate in their own way, because while _you_ are organizing things with hyperlinks, _I_ could be using tags to organize the same cards, but in an entirely different way.

tl;dr – what products like Notion are striving for is "all together sharing". What we're aiming for with Supernotes is more _granulated, personalized sharing_.

</comment></comment><comment><AUTHOR> Hey Hacker News! My co-founder and I have been working on this idea for a few years now and are finally ready to show it to HN.

Supernotes, at its most simple, is a note-taking app. It's a place to take the things in your head and dump 'em for storage (and then sharing, if you like). But the approach we've taken to note-taking is slightly different than what you'll see with other solutions. Instead of opting for a long-form document format (and folders to put them in), we decided to go with a card format. So like documents, but shorter. We also decided to make the cards themselves _nestable_ , rather than having a folder system. This means that as you flesh out ideas, you can just add "child" cards to a "parent" card to keep yourself organized (plus cards can have multiple parents!). Each and every card can be edited, commented on, colored, titled, icon'd, linked to, and shared.

We did it this way because we think its a better fit for how our brains actually work. Humans don't think in terms of essays – we think in terms of a large number of interconnected thoughts.

When it comes time to share your cards, all you need to do is send a 4-word share code to your friends/family/pet and they can see that card right away.

So to summarize, on Supernotes you can:

\- easily make notecards which have their own tags, comments, colors, icons, etc.

\- cards can have parents/children, and unlike most other platforms, a child can have _multiple_ parents (yay graphs!)

\- cards can hyperlink to other cards directly in their bodies (otherwise known as wiki-style, Zettelkasten, or _the internet_ )

\- cards can be instantly shared via 4-word "share codes"

\- cards can be "published" inside other cards (i.e. published children) so that anyone who has access to the parent can see the published child

\- once shared, cards have fully-featured permission-system so you can decide exactly _how_ you want to collaborate with _whom_

\- use dark mode because who doesn't love dark mode

Anyway, I'd love for you to try it out and let us know what you think! Always open to suggestions.

If that sounds cool, sign up here! [https://my.supernotes.app/entry?signup=1&ref=hn](https://my.supernotes.app/entry?signup=1&ref=hn)

p.s. Due to the current global pandemic / work from home situation going on, we've also decided to make Supernotes completely free until July, so even more reason to try it out.</comment>


Where do you search for remote jobs? - <AUTHOR>

Pretty much all of the typical job search engines are based upon searching for a position title/description and a location.
In the age of the internet one would think that second box would be less relevant, but sadly it seems still to be so.
HNers that have been successful with working remotely - where did you find your gig? <comment><USER2> I'm building a list of remote employers at [http://www.warplife.com/jobs/computer/telecommute/](http://www.warplife.com/jobs/computer/telecommute/)

Note that that's a list of employers and consulting clients, not actual open jobs - that is, they may have filled their positions since I listed them. However it's likely they will have new open positions in the future.

I have many more to add to the list soon

</comment><comment><USER3> We're 100% remote at RealHQ. We post (and seem to get the most hits from) on: We Work Remotely, AngelList and HN.

Were hiring for a few positions now, you can also check out our jobs page at www.realhq.com/jobs

<comment><USER4> Courtney,

Thank you for posting. I sent along a cover letter, and resume, for the Account Manager position listed on your website</comment></comment>


A drug dealer on economists' theories about drug dealing  - <AUTHOR> http://www.npr.org/blogs/money/2011/04/13/135354436/the-tuesday-podcast-a-former-crack-dealer-on-the-economics-of-drugs?ft=1&f=93559255

<comment><USER2> As a student of international relations, this seems familiar to me. Liberal international relations theorists focus on economic variables as causal to a far greater degree than realists or constructivists, and have also imported a bunch of their methodologies from economics/econometrics. Realists tend to deny the primary importance of economics, going on about power and the _animus dominandi_ like old saws.

It's funny that in this NPR piece economists focus on all the monetary and financial risk aspects, while seemingly blind to the central motivation of the people on the streets:

 _What's more, he really liked being a drug kingpin.

I loved it. ... I felt like I was powerful. ... It was every man's dream to be free. ... I'd rather be doing that than anything else, almost._

Power and independence, not money, were the ultimate goal. Very realist.

<comment><USER3> I think if you dig a bit deeper into most people's motivations for wanting to be rich, you will find out that independence is the really reason. Without any evidence I think that people want to be rich, so they don't have to worry about money.

<comment><USER4> I think Aristotle Onassis' theory is a bit more accurate:

 _"If women didn't exist, all the money in the world would have no meaning."_

Furthermore, the best approximation to human behaviour I know is that human beings will do whatever it takes to maximise ... not their wealth, not their freedom, but... their status.

For nice middle-class me, going to prison for drug dealing would be a huge step down in my status. For some kid in the ghetto, though, it could easily be the opposite.

<comment><USER5> >" _Furthermore, the best approximation to human behaviour I know is that human beings will do whatever it takes to maximise ... not their wealth, not their freedom, but... their status._ "

// Many people choose to take on a lower "status" though.

Chasing "the good life" or "down-sizing" for example.

This is, to my mind at least, a hankering for something more meaningful than financial acumen or societal position.

<comment><USER4> Well of course the great part and the worst flaw of my status-maximization theory is that it can't be disproved. The guy who gives up a high-paying job in finance to go become a starving artist is arguably maximising his status ("Oooh look at that guy following his dream and not caring about money") and so is the guy who makes the reverse decision ("Being an artist is for try-hard suckers, look at my money!").

It's hard to find an example of someone unambiguously lowering their own status, since voluntarily lowering your status in order to achieve some other aim can be, in itself, a status-raising activity.

<comment><USER5> It appears you're messing with your definition of status in order to make such statements. Could you give a succinct definition of what you mean by "status"?

Status is defined by the general populus, others define your status, your place in the "pecking order". People regarding your actions as positive ('following his dream, blah blah') doesn't mean your status is increased.

"a starving artist is arguably maximising his status"

Yes, it depends on your definition of status .. so ...

</comment></comment></comment></comment></comment></comment><comment><USER6> Not just a drug dealer, but Freeway Ricky Ross, who arguably helped invent crack whose cocaine supplier was the Nicarguan Contras, the CIA-funded army of Iran-Contra fame. I love Planet Money, but I wish they'd gone a little deeper into his involvement with the contras. If you want to know more look into Gary Webb's series, Dark Alliance. The restored site is here: <http://www.narconews.com/darkalliance/drugs/start.htm>

</comment><comment><USER7> I'm sure it's great to be a kingpin, but I'd be interested to hear the perspective of the low level dealers and other rank-and-file.

<comment><USER8> That's true, the best stories come from the middle or the bottom. The top guy says he'd make less, but would the bottom guys wind up making more? It's a potentially interesting business dynamic. Would you have more horizontal than vertical management structure?</comment></comment>


SpaceX Launches 19th Rocket in a Year, a Company Record - <AUTHOR> https://www.wsj.com/articles/spacex-launches-19th-rocket-in-a-year-a-company-record-1543862707 <comment><USER2> They broke four records today:

1\. First company booster to fly three times

2\. First to launch from all SpaceX pads

3\. Now most number of SpaceX launches in a year.

4\. Highest number of spacecraft flown on a US rocket

64th Falcon 9 mission. 70th including Falcon 1 and Heavy.

<comment><USER3> Additionally, this was the first time that the fairings were recovered and are expected to be reused for a future launch:

[https://twitter.com/elonmusk/status/1069679948103847939](https://twitter.com/elonmusk/status/1069679948103847939)

The fairings currently cost a total of $6MM for each launch, or at least 10% of the physical rocket cost, so this could lead to significant savings for future launches.

<comment><USER4> > The fairings currently cost a total of $6MM for each launch

WHAAAAA?! What are they made of? I thought the fairings were just the covers for the payload. What makes them so expensive?

<comment><USER5> They're large or larger than a double decker bus. They're released well after first stage separation so they need to be as light as possible. Stupidly light. Despite being very large and very light, they need to be very resistant to vibration through hypersonic speeds and go through a huge range of temperatures. They need to separate reliably and equalize pressure during ascent. They look like a mere shell, but they're actually advanced composite structures with a fair amount of tech involved.

<comment><USER6> They also have a built in parachute deployment mechanism which can safely get them down to sea level.

<comment><USER7> I don't think it's fair to count that as part of the 6M cost that you are "saving", if you just did the typical thing and threw them away you wouldn't need parachutes.

</comment></comment></comment></comment></comment></comment><comment><USER8> This is the second rocket launch today! The earlier one was Soyuz Launch to ISS: [https://news.ycombinator.com/item?id=18587943](https://news.ycombinator.com/item?id=18587943)

I didn't know that there are so many rocket launches going on all the time. Here's a list of them: [https://spaceflightnow.com/launch- schedule/](https://spaceflightnow.com/launch-schedule/)

There a launch almost every second day.

The most interesting ones are Dec 7 Chinese launch to the far side of the moon and Jan 30 launch of India's moon rover.

<comment><USER9> If all goes according to plan, SpaceX will also be launching again tomorrow for their next CRS mission (resupplying the ISS).

</comment></comment><comment><USER10> Here is a link to the launch video (cued at T-15s): [https://youtu.be/Wq8kS6UoOrQ?t=1179](https://youtu.be/Wq8kS6UoOrQ?t=1179)

<comment><USER11> I love how the lower part of the rocket is battered and burned by repeated re- entry. It's starting to look like something from a gritty sci-fi movie.

<comment><USER12> She may not look like much, but she's got it where it counts, kid.

</comment></comment></comment><comment><USER13> So the 'steamroller' is now up to speed.

Does anyone have any ideas if Spacex will actually grow the launch market, rather than just dominate. What new things become possible with lower cost access to space.

Spacex are developing communications satellites for internet, what else?

Edit: Thanks for all the replies so far, I was thinking more down to earth (di dum ch) things rather than theoretically possible. Eg I know that certain drugs are made in space because the crystal structure requires zero g (or something), so is that something with pent up demand, or some exciting materials that are awaiting lower cost manufacture.

<comment><USER14> In addition to asteroid mining and other industrial activities, once pricing comes down, I think entertainment could be a large market.

Space tourism is one possibility, but tourists have to deal with getting sick going up.

I think entertainment produced in space but sold on Earth could be big - particularly space sports! You could design sports that are just not possible to play on a planet.

<comment><USER15> People keep say astroid mining but I've yet to see a convincing business case...

<comment><USER16> What are we proposing to mine? The business case for platinum is easy to make if there is a quantity of relatively pure ore. The business case for iron is hard to make. Unfortunately iron is common on earth and on asteroids (I'm confident in making that statement without looking it up so I guess I could be wrong). Platinum is rare on earth and in great demand, and seems to be just as rare in space.

I can come up with other cases, but there is a lot of other technology that needs to be worked on before we are ready to build generation ships heading to other star systems.

<comment><USER17> Apparently the precious metal content on asteroids is through the roof. Titanium, Nickel, Platinum, etc. One study concluded that there was more than a trillion dollars worth of metal on one asteroid alone.

[https://www.forbes.com/sites/ericmack/2015/07/19/trillion- do...](https://www.forbes.com/sites/ericmack/2015/07/19/trillion-dollar-baby- asteroid-has-wannabe-space-miners-salivating/#65a0ec30214f)

<comment><USER18> And there's 0.005 ppm / kg * 5.97219 * 10^24 KG * 29540 $/kg = ~ 1 sextillion dollars worth of platinum in the earth's crust.

</comment></comment></comment></comment></comment></comment><comment><USER19> I watched the livestream over dinner on youtube. Really good footage this time. Clear weather and they shot the first stage landing with a zoom lens from land. Including pretty much all of the landing burn.

<comment><USER20> The first stage landing footage was a total lucky break for us - this was a launch profile that _could_ have made it back to land. However, there was another rocket (ULA, I believe) on the pad at Vandenberg with some delicate payloads, so they asked SpaceX to land on the barge just far enough offshore to give themselves some distance from the pads.

</comment></comment><comment><USER21> NASA seems to be open-sourcing some interesting projects, ie. [https://github.com/nasa/openmct](https://github.com/nasa/openmct)

I wonder if SpaceX will publish some of their tools to the public in the near future.

</comment><comment><USER6> They've now flown 64 times total, and landed 32 of them.

<comment><USER22> For the sake of completeness, how many have they reflown?

<comment><USER23> This was the first time that SpaceX has launched-and-landed the same rocket on three separate missions.

[https://mashable.com/article/spacex-falcon-9-rocket- launch-r...](https://mashable.com/article/spacex-falcon-9-rocket-launch- repeat/)

<comment><USER24> From three different launchpads. A hat trick!

</comment></comment></comment></comment><comment><USER25> For IoT simplex data and things that need functionality similar to Iridium SBD, but at much lower cost and are not time sensitive, I am very optimistic about the Hiber satellite network:

[https://space.skyrocket.de/doc_sdat/hiber-1.htm](https://space.skyrocket.de/doc_sdat/hiber-1.htm)

[https://hiber.global/](https://hiber.global/)

They're claiming "a few dollars per month" for low usage volumes, per terminal.

Also, Gunter's space page is a great general reference for a lot of new small- sat/micro-sat/cubesat programs.

</comment><comment><USER26> Serious question. Why do you post WSJ articles? Either someone subscribes in which case they don't need to discover content or they don't in which case they haven't discovered anything. WSJ posts are literally just advertisements for a mediocre closed website.

Seriously why do you bother?

<comment><USER27> because people like me want to read the article, and we are happy it was posted.

It's also extremely easy to get around the paywall.

</comment></comment><comment><USER28> I think after it's first flight, the booster should get a cool nickname that is mentioned each time it flies afterwards.

</comment><comment><USER29> [https://outline.com/DXV9H2](https://outline.com/DXV9H2)

</comment><comment><USER30> At its current rate thats a rocket every ~19 days

</comment><comment><USER31> I would just like to point out that this story dropped 18 places in 5 minutes:

[http://hnrankings.info/18591766/](http://hnrankings.info/18591766/)

This is something I've seen before, but _solely_ with stories pertaining to Elon Musk. It is very clear that HN rankings are being manipulated for a specific agenda. This saddens me, as HN is otherwise a place I trust for informed and balanced commentary.

(Note: I am not necessarily accusing the moderators of HN of anything here; I almost always agree with their interventions, even when seemingly heavy- handed. I know that running a community is hard. I suspect that something else is going on here.)

<comment><USER32> > _" This is something I've seen before, but solely with stories pertaining to > Elon Musk."_

This is likely selection bias. I've seen plenty of stories on other topics sink in rank as well that had nothing to do with Elon Musk.

See the FAQ for more details on ranking:

> _" How are stories ranked?"_

> _" The basic algorithm divides points by a power of the time since a story > was submitted. Comments in comment threads are ranked the same way."_

> _" Other factors affecting rank include user flags, anti-abuse software, > software which downweights overheated discussions, and moderator > intervention._"

[https://news.ycombinator.com/newsfaq.html](https://news.ycombinator.com/newsfaq.html)

</comment></comment><comment><USER33> How much of this success is because of Elon?

<comment><USER7> How do you measure something like that?

Without Elon, SpaceX wouldn't exist (and in all likelyhood no comparable company would exist in its place), so all of it.

Without everyone but Elon, SpaceX wouldn't exist, so none of it.

<comment><USER34> A better spin on this question is probably along the lines of:

Does SpaceX still need Elon? As a figure head, maybe. As a leader? More complicated, there's probably still some risky path-finding left but the biggest moon-shots are now out of the way and as long as it doesn't become a quarterly returns focused company anyone slightly bullish could probably do a good enough job.

<comment><USER7> Does SpaceX still need Elon - compared to what - for what?

Does SpaceX still need Elon to control ownership of the company as opposed to selling to "average" investors in order to colonize mars? Almost certainly.

Does SpaceX still need Elon as the CEO as opposed to the "average" other CEO they could hire, to profitably launch satellites into space? Almost certainly not.

At least we reach theoretically answerable questions with this sort of construction, but I don't think we have enough information to answer any but the most obvious versions such as those above.

SpaceX's biggest moonshots, if they keep succeeding and Elon keeps leading, are yet to come.</comment></comment></comment></comment>


Is your product a "must have" or "nice to have"? - <AUTHOR> http://entrepreneur.venturebeat.com/2009/10/13/is-your-product-a-must-have-or-nice-to-have/

<comment><USER2> I would say even more, every product has to be first a "nice to have" and hopefully for you to become later a "must have". Nowadays in our society we already can live a very comfortable life, there is no real "must have".

I support my point here saying that we already have a product that saves you money, but not a single person that I have talked about it was impressed by this feature alone. Instead the other way round if they like the product and I tell them about the cost saving it is a serious factor for them to decide to adopt it.

</comment><comment><USER2> The article in my opinion does not say much, but the following paragraph caught my attention:

>>"In the end, the best way to test whether you have a 'must have' product is to threaten to take the prototype away from your early users," says Rakowski. "If they don't riot, start again."<<

Is this really doable? How can you threaten to take the prototype away?

<comment><USER3> _Is this really doable? How can you threaten to take the prototype away?_

Takeaway: <http://blog.tr.im/post/159369789/tr-im-r-i-p>

Riot: <http://www.google.com/search?q=tr.im+shutdown>

Giveback: <http://blog.tr.im/post/165049236/tr-im-to-be-community-owned>

</comment></comment><comment><USER4> Another way to test would be to use survey.io: [http://startup- marketing.com/free-customer-development-help-...](http://startup- marketing.com/free-customer-development-help-surveyio/)

</comment><comment><USER5> Nice to have. GODDAMMIT. _runs off and looks for a real job_

</comment><comment><USER6> Everything online is merely "nice to have" but we are still capable of becoming dependent on it. ie: google/gmail

</comment><comment><USER7> I always thought it was a mistake to position your business as if your product was a "must have", mainly because it's not.

Treat it as a "nice to have". That will force you to do everything else better.

A lot of people have learned the hard way in the past year that very little is a "must have".

<comment><USER8> It's more important as a mental exercise than as absolute advice. Some people put it another way: is your product a vitamin or a painkiller?

For a business to become successful, the product will need to become a must have at some point. If it's not right now, then you need to keep pursuing it until it is.

<comment><USER9> Vitamin vs painkiller is a better analogue. Consider Facebook, it isn't really a "must have", but seems to be doing just fine

<comment><USER10> I couldn't disagree more. When you start using Facebook, it becomes a must have. When I went about deleting all my online accounts, it was one of the two I didn't get rid of. If I got rid of that, I'd lose the most valuable communications medium I've got.</comment></comment></comment></comment>


NERSC Scales Scientific Deep Learning to 15 Petaflops - <AUTHOR> https://www.hpcwire.com/2017/08/28/nersc-scales-deep-learning15-pflops/ <comment><AUTHOR> And the paper: [https://arxiv.org/abs/1708.05256](https://arxiv.org/abs/1708.05256)</comment>


Doodle Jump Recreated in HTML5 ...with source - <AUTHOR> http://cssdeck.com/labs/html5-doodle-jump/8 <comment><USER2> It's one thing to make a Doodle Jump-like game. But this is being called the trademarked name Doodle Jump, and you've copied the artwork straight from Doodle Jump.

Seems certain this isn't an official licensed version. In which case, you should change all those items immediately. It's illegal and it's just not cool.

Here are the guys you are ripping off. Igor and his brother. Igor is a very nice guy:

[http://allthingsd.com/20120823/how-to-become-an-app-store- mi...](http://allthingsd.com/20120823/how-to-become-an-app-store-millionaire- make-a-hit-app-and-dont-make-anything-else/)

<comment><USER3> If he has created the art in photoshop himself, then no copyright is infringed even if they do look very similar.

As for the name, this will only matter if the original name was trademarked. If not, he can call it whatever he wants.

<comment><USER2> if it's not copyright infringement, it's trade dress infringement. <http://en.wikipedia.org/wiki/Trade_dress>

either way, he's in the wrong. and the name is trademarked.

</comment></comment></comment><comment> k-mcgrady "The name of the game and images are © copyrights by the respective creators and Lima Sky"

This reminds me of the fair use copyright clause people put on YouTube videos. Just because you acknowledge something is copyrighted doesn't mean you can infringe it.

It's cool that you were able to build it but ripping off the artwork (if you did create that from scratch it's very good because I couldn't tell the difference), the name, and open sourcing it is not good. The developer is still selling this and making money from it and you've just produced a free web version.

<comment><USER4> Is open sourcing it really all that bad?

I presume anyone with some skill could recreate such a simple game, and there are tons of copies on the app store.

Showing that it's possible to create the game in html5 and showing the source is amazing and very helpful for anyone wanting to create a real game with html5.

Of course, making it look exactly like Doodle Jump isn't the best of ideas, although it doesn't compete with the actual product since it doesn't work on mobile.

<comment><USER5> > Is open sourcing it really all that bad?

Your views on the ethics of open source don't really have any bearing on whether this application infringes a copyright.

> I presume anyone with some skill could recreate such a simple game, and > there are tons of copies on the app store.

An independent implementation of a similar game _engine_ would presumably be neither technically difficult nor legally problematic. The problem is that, at least according to many of the comments here, he's copying the game _assets_.

From a copyright perspective, independent implementation of the same technology is usually OK (see the Oracle/Google lawsuit, the court ruled that Google's independent implementation of Oracle's API was OK). It's direct copying of code and data that requires permission from the copyright holder, even if it's mixed with your own original work (the case here seems to be direct copying of art mixed with original code).

I'm guessing that, from a practical perspective, this whole debate doesn't matter in this particular case, since Google probably doesn't care about this one. They may even have open-sourced the doodle eventually on their own (anyone have information about whether past Google doodles have been open- sourced?)

Mandatory disclaimers:

1\. IANAL

2\. I can only speak for the situation in the USA

3\. I haven't personally seen or played the original, I'm basing my opinion of what's copied or not copied on other comments

<comment><USER6> > From a copyright perspective, independent implementation of the same > technology is usually OK (see the Oracle/Google lawsuit, the court ruled > that Google's independent implementation of Oracle's API was OK).

I am not a legal expert, but as I understand it, the Oracle/Google decision was based on the fact that APIs were not copyright-able. However, I believe you are that independent implementation is not a copyright violation, because patents protect technology while copyright protects specific works. If anyone actually knows about this, feel free to correct me.

</comment></comment></comment></comment><comment><USER7> Fun way to play the game: try just holding the right arrow key down at the beginning. Since there doesn't seem to be a limit on horizontal velocity, it's kinda like you're on multiple horizontal positions at once. You can still fall down, but you if you actually control the horizontal speed somewhat, you can make it pretty far.

</comment><comment><USER8> I'm not a legal professional but even though the author claims that the "logic and graphics" have been created by scratch, doesn't that make no difference to the fact that he's almost (the movement isn't as nice) recreated someone else's stuff verbatim and is claiming that it's now open source?

Don't get me wrong, it's a very nice job and all, but with just a few drops of creative thought the author could be on his way to creating his own ideas instead of imitating others.

<comment><USER3> Freedos is a clone of the old DOS systems -- so much so that it runs the old dos programs you may have lying around.

And nobody seems to have a problem with that.

So why should this be an issue?

<comment><USER8> Mainly because the author of the Doodle Jump clone stated that because he created "the logic and graphics"from scratch he has the legal right to release it as open source. I can't see any evidence to suggest he has the authority to do that.

Also is it possible to compare an OS with a game, isn't that like comparing a human to the Earth? On the one hand we're all made of the basic elements, but on the other we're fundamentally different things.

<comment><USER4> It's his own work. Of course he has the right to release it as open source. He should however have a nice good old fashioned disclaimer against liability.

</comment></comment></comment></comment><comment><USER9> So, as someone who's planning to implement a game using Canvas, I was annoyed to notice that there seemed to be occasional frame drops despite the extreme simplicity of this script. I went tested on Safari, Chrome, and Firefox, and although it used only a small fraction of CPU, it wasn't perfectly smooth in any of them: subjectively, Chrome was the best, Safari dropped frames a bit more often, and Firefox was quite laggy. I added a trivial FPS counter to the JavaScript and the results sort of mirrored my impression - Chrome almost always got 60 FPS but sometimes 59, Safari got 59 more often, and Firefox was sometimes lower - but I'm not sure 59 FPS adequately explains the glitchiness I experienced, especially in Firefox, which was subjectively quite awful.

Anyway, I'd like to learn where this frame dropping is coming from. I'm a real stickler about lag, and even though the effect here is pretty minor (except on Firefox), I find it unacceptable. Maybe I should try reimplementing this in WebGL or even pure HTML with image tags. Though, again, this game and mine are simple enough that all these approaches should be able to run at 60 FPS, the differences in implementation might be enough to push it over the edge and I have to make do with what exists.

</comment><comment><USER10> Oops! I didn't know the game got HN'ed. I was improving the details adding license info, you can find them there now.

<comment><USER11> "I respect the original creators Igor Pusenjak and his brother for their great work."

Uhhh no you don't. This is textbook copyright infringement. You can't copy without permission and then claim you respect them. That's not how things work.

<comment><USER12> I would argue that this is fair use.

In any case, I'll invoke the maxim "imitation is the highest form of flattery" as an argument. Why do so many people new to game development make (and are encouraged to make) Pacman clones, Snake clones, Tetris clones, Asteroids clones (one is still on the front page with no shouts of "copyright infringement!!!"), etc.? Because they're fun, respected games that are easy to clone with modern tools. This game is no different apart from not having as many people thinking it's a good game.

This platform mechanic is over a decade old (and mechanics can't be copyrighted anyway), the platforms themselves are probably too simple to qualify under copyright. (The alien sprite you might have a better argument for, but that's very easy to change and if I were the author I'd do that not to play it safe but because the standard alien doesn't look very good.) The only thing I would suggest the author really bother changing is adding the word "clone" or "recreated in HTML5" to the title of the project even though that information is already in the description.

<comment><USER11> Fair use? For your own sake I highly recommend you take a class on copyright law. I don't say that to be mean. Copyright law is both complicated and important. But if you think that's fair use then you risk fucking yourself or your employer.

<comment><USER12> I can imagine it being successfully argued the other way by a persistent prosecutor. But considering all the fair use tests I think a _reasonable_ interpretation is to let it be. Of course US law and judges are anything but reasonable a lot of the time, and if someone is looking to fuck you over there are plenty of ways to do so. I'd wager there are more than one patents being violated by this game (and the original it was cloned from) for instance.

The other consideration is that the developer is in India, which unless he's doing things on the scale of Dotcom allows him a "come at me bro" attitude if he felt like it. Fortunately he seems like a decent fellow, so it's a non- profit learning exercise of something with a lot of prior art in terms of gameplay, it's not a complete clone, and I doubt it hurts sales of the original (which he links to).

I guess you're in agreement with me otherwise?

</comment></comment></comment></comment></comment><comment><USER13> Samsung lawyer: "We respect the original creator Apple for their great work." ... comes to mind.

</comment><comment><USER14> Is there a way to restart via the keyboard? From what I can tell, you need to play the game using the arrow keys on the keyboard so it loses addictiveness when you have to reach for the mouse every time you want to restart.

<comment><USER10> Press the space bar to restart / start the game :)

</comment></comment><comment><USER15> Even though you are being honest and straight forward about the creators of the game and the copyright they have does not mean you can infringe on it. You still need to ask for permission. I would suggest doing so before you release any more code or updates to this page as you could incur severe legal penalties.

That said, nice work. Hopefully the authors of this game don't mind and will support your efforts or work with you on an HTML5 version of this game. Good luck.

</comment><comment><USER16> That runs incredibly smoothly in Chrome, far better than on my iPod or phone when I had them :)

<comment><USER17> Yes it's very impressive, it's almost as smooth on my 2.53 Ghz dual core than it is on my 600 Mhz phone. HTML5 FTW.

<comment><USER16> Oh the irony.

</comment></comment></comment><comment><USER18> I don't know what "doodle jump" was, but this thing reminds me about Icy Tower game: <http://en.wikipedia.org/wiki/Icy_Tower>

<comment><USER19> Which itself is a clone of XJump from long ago..

<comment><USER18> so the whole outrage about copyright infringement is kinda...

<comment><USER2> ...still an issue. being a "clone" is far less offensive than taking someone's name and artwork.

If it was just a clone called "HTML Jump" with original graphics, but the same gameplay, there would be no outrage.

Imagine if app.net called itself "twitter.net" and copied twitter's design exactly? There would (rightfully) be outrage

<comment><USER20> Unless it used Bootstrap...

</comment></comment></comment></comment></comment><comment><USER21> Congratulations, I couldn't tell the difference to the original version of doodle jump. I read here that a lot of people are worried, because you recreated a game which is protected by copyright, but I wouldn't worry too much, because you don't earn money with the game and did it for fun. But still, it would be the better choice if you had released it under a nickname instead of your real name.

<comment><USER22> Stealing someone's name and graphics is OK if you use a nickname?

<comment><USER21> I haven't said that it's ok, i just said it would be the better choice to use a nickname, because this would help you to protect against a lawsuit if they try to sue him for any reason. His best option would be to ask the producer if he is fine, when the guy release his open source version of doodle jump. I think they would agree, because he doesn't earn money and doesn't seems to do anything else with it. Also it's a good ad for the product doodle jump and he also recommend to buy a copy of it.

</comment></comment></comment><comment><USER23> I think there are some difference with the physics.

</comment><comment><USER24> Congrats on this great exercize. It plays great.

</comment><comment><USER25> wow! congratulations on the excellent work!! I never knew that one could recreate the whole game with htmk5 and css.

</comment><comment><USER26> Cool, but it needs some music!

</comment><comment><USER27> player.isDead = "lol";

<comment><USER28> 55 comments and I had to scroll to the bottom to find a single comment on the actual code or somebody who had also read it.

</comment></comment><comment><USER29> There is a bug because I win points "standing still"...

Screenshot: <http://i.imgur.com/k6ejH.jpg>

</comment><comment><USER30> 2889 beat that!

edit: 3630 died trying to catch a spring ><

<comment><USER10> [https://twitter.com/SolitaryDesigns/status/23923144911764684...](https://twitter.com/SolitaryDesigns/status/239231449117646848)

<comment><USER30> <https://twitter.com/Franceschine/status/239280096173776896> (6560)

<comment><USER31> <https://twitter.com/dingfengquek/status/239445632832643073> (9160)

<comment><USER10> that tweet is protected but.. OH MY GOD!

<comment><USER31> <https://twitter.com/dingfengquek/status/239451710278483970> (13119) Removed tweet protection.

It's a pretty interesting game to master - the challenge isn't in hand-eye projectile-estimation/control. While that's important, it seems pretty easy to reach a satisfactory amount (as long as one doesn't need to cross the edge of the screen and wrap-around, which the human brain doesn't seem to handle well).

The parameter to optimize, at least at scores of 8k to 13k, is to quickly evaluate the best upward paths to take.

I've tried 5 games, all which ended above 6k, which ended when I hesitated on the path. Curiously, it isn't the situations where only 1 path is available where I lose. It is the situations when two somewhat equal paths exists, and I hesitate. At areas with white blocks, where the jumping height required to reach the next block is maxed, and the next block is horizontally displaced, there's very little time to think.

Hitting springs are the worst, as it changes the screen very rapidly, making it very hard to assess the situation (3 losses to this). The next worst is a series of whites at max height, which results in a high upwards speed (1 loss to this). Last loss was due to dropping a bag of chips.

<comment><USER10> [https://twitter.com/SolitaryDesigns/status/23958498854111232...](https://twitter.com/SolitaryDesigns/status/239584988541112320) __(17562) __</comment></comment></comment></comment></comment></comment></comment>


How to charge $200 for an external hard drive - <AUTHOR> http://www.indiegogo.com/projects/your-own-secured-pocket-server--2

<comment><USER2> but those royalty free images look so convincing...

</comment><comment><USER3> I'd rather say: get a 2TB hard drive for 50 USD ^^</comment>


Think Stats – Exploratory Data Analysis in Python - <AUTHOR> http://www.greenteapress.com/thinkstats2/

<comment><AUTHOR> The book is released under Creative Commons and is free to download.

Link to pdf: [http://www.greenteapress.com/thinkstats2/thinkstats2.pdf](http://www.greenteapress.com/thinkstats2/thinkstats2.pdf)</comment>


Why Does Microsoft SQL Server Exist? - <AUTHOR> I'm having trouble understanding why anyone uses Microsoft SQL Server, or still uses it now that we have open-source databases. Does it have any features that PostgreSQL or MySQL don't have? <comment><USER2> SQL Server is about environment and ease of use. It has come a long way, and while I wouldn't use it for large scale projects anymore because of cost, it is more then capable of handling the task. SQL Server does have unique features to the Microsoft environment that make it easier to develop with and make it pretty damn robust too. There are too many things to list, but I think many choose it because it is an eco-system, you get SSRS for reporting, SSIS works well for basic to moderate ETL and the basic setup for a simple database a monkey could do. Not to mention the tooling is really pretty damn robust and easy to use (sometimes too easy IMO). Performance wise, it is good when designed for like any database, but if you do stupid things, or do things how you would do them in say Oracle, then you may be asking for trouble. But the same could be said for Postgres or MySQL etc.

Also, don't forget that many companies started with it as part of the Business Server suite and so all their software was built around it for little cost of the database itself. Then they grew into it.

I have spent a long time working in and around it, and respect it overall. Personally, I have moved a lot of clients out of SQL Server into more cost effective solutions when they have grown to a point that the licensing cost will outweigh the need to re-architect their system. That usually happens when they realize they need robust replication or a distributed solution which will take some architecture work anyway, and why pay MSFT huge licensing fees and architect for it when you can move to say Postgres and save the licensing fees, just as an example.

<comment><USER3> For me the tooling is really the best out of all rdbms's for the developer tools ssdt provides a full api to query and create t-sql like rosylyn but for t-sql:

[https://the.agilesql.club/blog/Ed-Elliott/2016-01-07/What- Is...](https://the.agilesql.club/blog/Ed-Elliott/2016-01-07/What-Is-SSDT- Part-3-An-API-For-Me-An-API-For-You-An-API-For-Everyone)

</comment></comment><comment><USER4> It does have features that MySQL and Postgres don't have, and it also is missing some features that those have. It's a different product.

Enterprises use it because they sign contracts with Microsoft to use all Microsoft products, and then they get support from Microsoft when things go wrong.

Furthermore, "no one ever got fired for hiring IBM" (not sure who said that originally). Basically, when you use a big-name, enterprise vendor and the software fails, it's their fault. When you use a (F)OSS solution and the software fails, it's your fault.

You can go on and on with technology that sucks that's still used by large enterprise for the same reason.

</comment><comment><USER5> Others have covered some of the enterprisey and ecosystem reasons around SQL Server. I'll add a few thoughts, but try not to reiterate too much. Note that I am speaking about Enterprise Edition which is ~$14K/2cores (sold in 2 core units) (other editions offer subsets of these features). This is all off the top of my head.

 _Ecosystem_

As mentioned, you get core SQL Server, along with a number of integrated tools that range from adequate to best in class:

* SSIS for ETL

* SSRS for reporting - includes traditional paginated reports, Power View for visual analysis and exploration (in 2016 gets native mobile apps and major overhaul)

* SSAS - Multidimensional for traditional OLAP, data mining; Tabular for in-memory columnstore

* CLR - everything has access to CLR languages for customizability and scripting

* Azure - easy transition from on-prem to cloud either with IaaS and pre-configured DB VMs or Azure SQL and Azure DW for SaaS with syntax and feature compatibility; very strong hybrid infrastructure story

 _Features_ All of these are native

* In-memory OLTP - memory optimized tables, optionally transactionally persisted to disk or not, with sprocs compiled to native code

* Columnstore index - optionally memory-optimized tables with clustered columnstore for hybrid OLTP / OLAP workload

* HA groups for native replication and failover story

* Native R integration (coming SQL Server 2016)

* Integrated row-level security

* Encryption for data at rest and in transit (more of an Azure SQL piece)

* Native master data and data quality services

I don't know if you care much (but CIOs and IT directors of large organizations do), but SQL Server 2014 is the absolute leader in Gartner's magic quadrant for mission-critical application development, and Microsoft is in a leadership position for BI as well.

Believe it or not, TCO is one of the largest talking points for Microsoft data platform account executives and solution sellers. Especially when placed against Oracle that story is strong. We have customers (we being the company I work for - BI and analytics consultancy) coming to SQL Server from every platform you can imagine. There are also many customers leaving SQL Server for every other platform. At this point in time Microsoft is doing a pretty good job of making sure that first number is larger than the second by a healthy margin.

</comment><comment><USER6> It is tightly integrated into the entire Microsoft development toolchain. There are free versions given to developers. And then there's the persistent myth of "Nobody ever got fired for buying Microsoft". They used to say that about IBM. They don't anymore.

A lot of it is inertia, as well. People who have been writing software for MS SQL server for the past couple of decades probably aren't going to change any time soon.

Plus with MS Azure, MS SQL server is easy for a non DBA to setup, add failover and scale.

</comment><comment><USER7> Setting aside the feature comparison, there's the matter of inertia. There are tons of enterprise-quality software packages that already work happily with Microsoft SQL Server, and the cost of switching the application to use another database is too high. (Especially in enterprises where you may have dozens of different applications all talking to the same database simultaneously, and switching them all at the exact same time would be incredibly expensive.)

</comment><comment><USER8> I suppose you could ask the same question about any software category where commercial and FOSS options exist. The short answer is that SQL Server is "the right answer" for some companies, after analyzing the long list of technical, financial, and support pros and cons.

</comment><comment><USER9> MS SQL Server's text search is far superior to PostgreSQL's. Otherwise, not a huge difference.

Also, if you're a Microsoft shop, it's easier to deal with than learning Postgres's unixy ways. And you can program sprocs using .Net

</comment><comment><USER10> Vendor partnership, commercial support, legacy app support, .NET drivers and optimizations not available elsewhere, developer knowledge...

Why does Oracle, DB2, Sybase, or any other commercial RDBMS still exist?

</comment><comment><USER11> Trustworthy SQL Server is need of every org/est.

</comment><comment><USER12> Why does anyone use XXX since there's an OS version of it?

* Different capabilities

* Different levels of support

* Previous lock-in

* Non-technical reasons</comment>


Ask HN: ARM Based Single Board Computer with M.2 Support for Small Server - <AUTHOR> I am looking for a small ARM based single board computer with at least one but preferably 2 M.2 sockets for SSD drives. I want to make a super small, RAID1 capable, portable server. Does such a thing exist? <comment><USER2> Start here: [https://www.hackerboards.com/search.php?q=&ram_min=&cpu_spee...](https://www.hackerboards.com/search.php?q=&ram_min=&cpu_speed_min=&cpu_cores=&cpu_arch=arm&price_min=&price_max=&storage_min=&m2=on&lan_speed=0&usb_min=&gpio_min=&type=&dim_max_1=&dim_max_2=&weight=&order=price&order_d=a)</comment>


Ask YC: Should I believe the Rails hype? - <AUTHOR>

I'm a php developper and have been for a good 7-8 years now. I took the time a year ago to learn cakePHP and yes, the documentation was lacking, but I hung out with the devs in #cakephp and can now safely say I know it almost inside out and can whip out applications like it's nobody's business.
Thing is, in university I learned C, assembly, C++, java, PERL, in various environments, so I know I can pick up RoR in a couple of months, especially when I leave my company this month to start coding my web application ideas.
My question is the following: I'm drowning in RoR propaganda and consequently am actually considering learning it. Is this a wise move or is my time better spent taking what I know (cakePHP) and developping my ideas now? I'm curious what you all think. <comment><USER2> sit down and build a small app with it that _doesnt_ rely on the crud framework. something like an events calendar should give worthwhile insight on setting up an application, working with the database orm, controllers, templates, etc. you could even sprinkle in some web service consumption on top afterwords to play around with web api interaction with your application.

by this time, you should have a pretty clear of how it feels to work with rails. more importantly, you'll be able to determine whether you want to take a deep breath and inhale the hype or try something else.

if you don't care for it, go back to cakephp. or codeigniter. or phreeze. or, give django a try. i tried rails when it first came out, didn't care for it, and went with django because i enjoyed python and liked how django was shaping up.

<comment><AUTHOR> I guess it's because I'm still working that I feel that there's no time for that. Maybe when I free myself up completely I'll be able to sacrifice a bit of time towards learning rails.

Thanks for the advice.

</comment></comment><comment><USER3> Ruby, as a language, is reasonably compact, and certainly not a big jump for someone with any amount of Perl and OO experience. Rails, on the other hand, is a big framework. You can learn the basics in a few days, but much like PHP, you really can't master the ins-and-outs of the full stack without (at least) several months of regular use.

It's also a moving target: new APIs fade in and out of existence with pretty much every release, and many "best practices" (early RESTful routing, anyone?) are picked up and dropped pretty much according to the whims of DHH and the other core committers.

That's not to say that it isn't worth learning, of course; if you're willing to commit to using Rails pretty much full-time (and work within its limitations) for the bulk of your projects, it offers a lot of great infrastructure to build on. Since it sounds like you want to focus on solo development of web applications, Rails may be just about perfect for your needs.

</comment><comment><USER4> Just watch the screencasts and spend a day or two giving it a go :) It's incredibly simple to get a webapp up and running, then you can judge for yourself. Judging by your experience I doubt it would even take you a couple of months, most probably it would only take you a couple of weeks to have the basics you need to write a webapp.

<comment><AUTHOR> This is the thing.. My experience dictates that I'll pick up RoR pretty quickly, but what really makes or breaks a framework is what happens when you try to do things outside of basic CRUD administrative interface stuff. I find it takes at least a couple of months of serious coding before you REALLY get to know what a framework's about.

... or is that just because cakePHP is badly documented? :)

</comment></comment><comment><USER5> I think it's better to stick with what you're familiar with.

To use books and written languages as an example, can anyone name a writer who suddenly wrote better books when he switched to a different language?

<comment><USER3> That attitude would guarantees that you'll never pick up new skills, or stretch yourself enough to discover what you're really capable of.

Learning new programming languages and frameworks is incredibly important, if your goal is actually to be a well-rounded developer.

<comment><USER5> You didn't address my point. Can you think of any writer who improved his skills by learning a different language? Can you think of a mathematician who improved his skills by learning a different notational system? Did Michael Jordan become a better basketball player after playing minor league baseball?

</comment></comment></comment><comment><USER6> If you want to be a better programmer -- Learn Rails

If you want to spend your time creating a new business -- Stick with PHP</comment>


Why Companies Won't Learn from the T-Mobile/Experian Hack - <AUTHOR> http://www.newyorker.com/business/currency/why-companies-wont-learn-from-the-t-mobileexperian-hack <comment><USER2> > Why Companies Won't Learn from the T-Mobile/Experian Hack

Because they don't have to. Yet.</comment>


The Real History Of Twitter - <AUTHOR> http://www.businessinsider.com/how-twitter-was-founded-2011-4

<comment><USER2> I think it's useful to see and read this story. It goes in to how tough a real pivot can be. Twitter grew out of Odeo, but the process by which it happened was a complicated mess. I'm glad that Noah Glass is finally getting included in the story.</comment>


Show HN: Left Buzzfeed to launch this - <AUTHOR> http://getrather.com/ <comment><USER2> Using an ordinary English word with no capitalization for your product's name makes the marketing copy hard to read.

I first parsed "Why rather kicks ass" as "Why rather kick ass" and thought "yeah, why not go kick some ass (?) instead of sitting behind my computer like I've been doing all day".

Then I realized you meant "Why our product (which is named "rather") kicks ass".

<comment><USER3> This might also be a sign the copy is focusing too much on themselves, and why they kick ass... rather than why you can kick ass if you use it. A subtle difference.

<comment><USER4> A subtle but crucial difference. Kathy Sierra gave the canonical presentation on this in 2009

[http://businessofsoftware.org/2010/05/kathy-sierra-at- busine...](http://businessofsoftware.org/2010/05/kathy-sierra-at-business-of- software-2009/)

</comment></comment></comment><comment><USER5> I'm sure people can find the team page fun, but I saw it as uninformative; I see three co-founders and all I know at a glance is that one guy used to be with BuzzFeed. The front page of the site is also fun, but it's also informative.

I was also a little confused about why the LinkedIn URLs don't point to the public page but rather the URL used by those already logged into LinkedIn. I'm thinking this was probably just overlooked. I happened to be logged out, clicked on one of the icons, was required to log in, and because I use the 2-step authentication I wanted to just get back to browsing HN because all I had was just a low level of curiosity about the people behind the product.

Example: The icon for Peter Marquis links to [http://www.linkedin.com/profile/view?id=32333289](http://www.linkedin.com/profile/view?id=32333289) while it could have been linking to [http://www.linkedin.com/pub/pete- marquis/a/9b3/489](http://www.linkedin.com/pub/pete-marquis/a/9b3/489) (or better yet the /in/ URL which would give all users the information, whether they're logged in or not.)

Bookmarked the site. I'll check it out soon enough. Good luck!

</comment><comment><USER6> Not to downplay the OP's product (the launch page is very well done, btw), but this reminded me of the well-publicized winning TV-themed hackathon entry earlier this year by a teenager:

[http://www.motherjones.com/media/2013/05/meet-17-year-old- sa...](http://www.motherjones.com/media/2013/05/meet-17-year-old-saving-you- game-thrones-twitter-spoilers)

Again, it's not a downplay of the OP's achievement, but a remark on how such a seemingly simple service is in high demand, such that a total underdog could win a hackathon with it. With some more work and thought to its features, this could be a real product for highly-social-networked people, and obviously not the kind of thing that the social networks will themselves create.

<comment><AUTHOR> Yeah. Rather is based off this, which we made EVEN before the 17 year old awesome spoiler chick. [http://ilovechrisbaker.com/unbaby- me/](http://ilovechrisbaker.com/unbaby-me/)

</comment></comment><comment><USER7> A few suggestions and issues:

I can't figure out how to add my own keywords. All I can do is choose from the predefined lists like "popular" etc.

The scroll bar is very faint, almost to the point where I didn't realize I could scroll and thought the UI had broken when the "replace content" box was pushed off screen by kill list selections.

On Facebook, when you replace content I see the rather logo and an "undo" button. I'd like to see a "why?" link or text description explaining what kill list was matched for that particular content to be replaced. I had a friends post, seemingly about nothing, replaced and I couldn't figure out why.

<comment><AUTHOR> 1\. type in the large box what you want to block. The box says, "What do you want to block?"

2\. We're rolling out that feature soon.

<comment><USER7> Thanks for number 1. I read that box several times over and just assumed it was a header. I never saw the cursor blinking until you told me I could type there.

</comment></comment></comment><comment><USER8> What is the eventual revenue model for this? It seems this is going to take quite a bit of computing to remain a free chrome extension for too long.

<comment><USER9> Revenue? What are you talking about? Big Exit™ is where it is at these days.

<comment><USER10> Big ExitTM's Big ExitTM will come from suing everyone who says Big ExitTM. I have no idea how to superscript

<comment><USER11> Unicode 0x2122 ⇒ ™

</comment></comment></comment></comment><comment><USER12> I sent this to someone who complained on Facebook about not being able to block Buzzfeed posts. I then made a joke that I now am seriously disappointed in the Buzzfeed/Bleacher Report SEO team about: How is there not a Buzzfeed about blocking Buzzfeed? Even if it's just something like "1500 Reasons Blocking Buzzfeed Won't Make Your Facebook Better."

</comment><comment><USER13> I'd like to see something that makes people more comfortable with the idea of unfriending folks that overpost annoying things, rather than covering up and hiding content over and over.

That said, the technology behind this looks like it could have a lot of practical uses. I especially like the example with TV show spoilers.

<comment><USER14> I have a pretty unusual spoiler avoidance routine for which this would be great. I live outside the US and have an account for NFL Gamepass and love football. There's essentially no spoilers here at all which is great but my US bound friends on Facebook tend to spoil stuff.

I typically watch the early games on Redzone live and then all the late games on Monday (as 30 Minute cuts) and the SNF+MNF game on Tuesday (+Thursday game on Friday)..basically I avoid FB on Mondays (and sometimes Tuesdays)

</comment></comment><comment><USER15> The writing on the site is creative and funny and the tag line at the top is to the point which is great:

"Replace anything you want in your social feeds with things you'd rather see, like cats."

Rarely do you see something like that which is so easy to understand.

One thing I would do (in addition to [1] below) is to have other words quickly replace "cats" perhaps by striking the word "cats" and overwriting with the new word. People get the joke with cats but it's probably not a bad idea to intersperse some serious stuff (right their in the tag line) as well.

[1] The word "rather" as others have mentioned needs to be distinct in typography so people understand it's the branding. Bold, different typeface, different weight, a graphic etc.

</comment><comment><USER16> Cool concept. I toyed with a similar concept on Pinterest when my wife got sick of seeing things for workouts, abs, core excercises, and the like. It's only a proof of concept bookmarklet and they may have changed up their source since I created it, but feel free to check it out and run with it:

[https://github.com/cballou/Pinterest-Keyword-Removal- Tool](https://github.com/cballou/Pinterest-Keyword-Removal-Tool)

It searches for cards containing specific keywords and removes/hides the entirety of the card from the DOM so you don't have to look at it. It worked seamlessly with their infinite scrolling from my initial testing.

</comment><comment><USER17> So much for changing the world, making a dent in the universe and all that, eh? How can someone build a COMPANY around a feature that does something so inconsequential and is basically "cute" at best? This is neither revolutionary nor innovative in my book.

I don't get it. No offense, but if this gets funding, then the Silicon Valley echo chamber has officially spread east and legitimate tech companies are doomed.

There are too many of these fly-by-night half-baked apps out there that people think they can become a millionaire from.

I can't wait until all this hype ends so people working on REAL problems can get back to doing REAL work.

<comment><USER18> Well that was a pretty mean thing to say. Not everything needs to be a cure for cancer or fix peak oil. We need some room for leisure. If the author had fun making something that provides him with some cash, I don't see what the harm is. That just leaves more easy "real" problems for people like you to go out and solve.

<comment><USER17> It's not mean, it's the truth. How many of you are going to pay for this? Honestly. This is a feature, not a COMPANY. Plain and simple.

</comment></comment></comment><comment><USER19> Just a note. Im using a large browser window and your main container width being 1158px is really big for a non responsive site. I opened the window and both ends were cut off.

Other than that, cool concept. I'll install.

</comment><comment><USER20> Interesting project, which might help serve to mute my Twitter feed the same way Tweetbot does.

Unfortunately, its filters make a really obvious mistake, which is to include very normal queries; I mean, c'mon, I hate baseball and everything, but does it seriously make sense to filter tweets with the words "yankees, tigers, indians(!), pirates, and giants"?

I'd really love a way to save and export filters, so I could use them in, say Tweetbot. Maybe you could set up a platform that allows user-created filters.

<comment><AUTHOR> We currently allow you to add any keywords you want. We'd like to eventually allow rather to communicate with things like tweetbot, so tweetbot can just pull from what you hate, etc.

<comment><USER21> I think what he's suggesting is that a topic-based filtering system would be more ideal than a key work based one. I don't want to have to spell out "block yankee's, tigers, indians, pirates, and giants". I just want to say "block all baseball", or "block all sports", and have the system know that posts about the yankee's, tigeers, indians, pirates, or giants are inclusive in these categories.

</comment></comment></comment><comment><USER22> Great idea! How much of my data are you mining?

EDIT: Not much, it seems! [http://getrather.com/privacy- policy.php](http://getrather.com/privacy-policy.php)

<comment><USER23> If it's just "some of it", they're doing something wrong.

</comment></comment><comment><USER24> I think it's a great start. Some immediate thoughts that struck (you prolly already know these anyway):

\- more suggestions! let me just click to make the list longer or look for suggestions related to other things I've picked

\- suggest replacement content too (e.g. themed image rss feeds that you know will generate good replacement content)

\- allow me to right click on a word or piece of content or something and add it to my 'replace' list

</comment><comment><USER25> One of your product quotes is "Whoever made this deserves the friggin nobel prize" which is a response to a person who said "what will these azn's think of next" and linked to [http://www.geekstudent.com/index.php?tag=bubble- wrap](http://www.geekstudent.com/index.php?tag=bubble-wrap)

Are you sure "some chick" on twitter actually said that?

<comment><AUTHOR> hmmm. Maybe I got my links screwed up. I'll fix that. Anyway, here's another one: [https://twitter.com/CLAYMOORE/status/306965801494257664](https://twitter.com/CLAYMOORE/status/306965801494257664)

</comment></comment><comment><USER26> Nice extension! Small suggestion to get more installs: [https://developers.google.com/chrome/web- store/docs/inline_i...](https://developers.google.com/chrome/web- store/docs/inline_installation) \- We use it on [http://www.synergyse.com](http://www.synergyse.com)

</comment><comment><USER27> Congrats on taking the leap.

One quick thought though: A fun side-project does not a company make.

Good luck, and let us know how we can help. But I'd start thinking real hard about how to make money (companies that want to block porn, but not all of tumblr (or reddit))

<comment><USER28> Replace spoilers with ads like:

"Don't get SPOILED. Use ziplock bags for freshness".

<comment><AUTHOR> Replace breaking bad spoilers with low winter sun. AMC would eat that up.

<comment><USER28> Yes, context driven adverts. Not sure how much that's worth, but it's worth pitching to someone like Fox Sports or AMC.

</comment></comment></comment></comment><comment><USER29> Love the concept. Good luck :)

<comment><USER14> +1 there is some pretty annoying stuff I'd like to zap (annoying "go pray now", "Jesus 4 the win" etc. stuff mostly)

<comment><USER9> Atheism. So edgy.

<comment><USER21> It has nothing to do with being "edgy". It has everything to do with not wanting to be flooded with Bible verses, prayer requests, and mindless proselytizing. It's obnoxious.

</comment></comment></comment></comment><comment><USER30> I rarely browse social media on browsers, but if I did I'd use this to help block spoilers. I turned my phone off the night of the Breaking Bad finale because I wasn't able to watch it live.

</comment><comment><USER31> interesting but why is this a remote service that needs to parse in-browser content? if filtering is keyword based (as opposed to ml based), why not filter locally instead ?

</comment><comment><USER32> Very similar to Jeter Filter ([http://www.jeterfilter.com/](http://www.jeterfilter.com/)), but more general! I like it.

</comment><comment><USER33> Seems similar to a concept something i helped work on in 2009: [http://mymentalspace.com](http://mymentalspace.com)

</comment><comment><USER34> You had me at "Left Buzzfeed".

<comment><USER35> That's where he lost me.

He didn't leave because he could no longer live with himself for working for those bottom-feeders, he did so because he saw a profit opportunity elsewhere.

<comment><USER21> What's wrong with Buzzfeed?

<comment><USER34> "43 Things That Are Colossally Stupid But That We've Gussied Up With Click- Bait Headlines To Trick You Into Viewing Them"

</comment></comment></comment></comment><comment><USER36> Is this a company or a fun side project?

</comment><comment><USER12> The team page is enjoyable.

</comment><comment><USER37> you had me at leaving buzzfeed</comment>


How I Recovered a "Dead" Twitter Handle for $69 - <AUTHOR> http://impossiblehq.com/recovered-dead-twitter-handle/ <comment><AUTHOR> Author here: happy to answer any questions you might have.</comment>


What are the top programming languages? The fastest growing? - <AUTHOR> http://radar.oreilly.com/archives/2007/05/state_of_the_co_10.html <comment> A-Merchant What I found most interesting there is that, if the 100% annual growth continues, Ruby will overtake Java in a little over a year, and become the most popular language (based on books sold) shortly after that.

Of course, it looks like ruby is slowing down, so that might not ever happen.

<comment><USER2> Also, since Groovy came from nowhere, it's growth rate is basically infinite. If that trend continues, by next month every atom in the universe will have bought a Groovy book...

</comment></comment><comment><USER3> Interesting data. My first reaction was that lisp and scheme are still underutilized and underappreciated.

But then, the metrics he's using wouldn't count downloads of the PLT books, or Shriram Krishnamurthi's Programming Languages: Application and Interpretation, and it's not clear SICP or EOPL would be counted as Scheme books in their reckoning. And that's assuming you accept popularity as a useful metric.

<comment><USER4> Every time I hear someone mention shriram's book I regret not taking his class when I had the chance.

</comment></comment><comment><AUTHOR> Oops, it looks like this is a dupe - URL threw me off:

<http://news.ycombinator.com/comments?id=22647></comment>


Sequential Consequences - <AUTHOR> https://stuartsierra.com/2020/08/19/sequential-consequences <comment><USER2> > There comes a point in a programming career — at least one as peripatetic as > mine — at which learning a new programming language barely registers as an > obstacle

weeell, maybe. I'm relearning a language I haven't touched for years, and while I can apply the high-level stuff to it (I know what an object is, how to declare a class is almost universal, functional stuff is same but renamed, generics are fine) I keep tripping over the small stuff. So yes, "off you go", but rather slowly.

<comment><USER3> The author thinks that "picking up" a language is just learning the syntax and then goes on to prove that actually learning the language is all about knowing of these "quirks" they don't know how to deal with and thus whine that "it is so much better in X"

</comment></comment><comment><USER4>
      things, also_things = itertools.tee(things)
      next(things), list(also_things)
      => (0, [0, 1, 2, 3, 4, 5, 6, 7, 8, 9])

<comment><USER5> Nice, idiomatically!

But if the original `things` is gigabytes in size and streamed from elsewhere, isn't it queueing those all up, as they're read from `also_things`, in case they're ever read from new `things` - even if they're not?

<comment><USER4> Oops, you're right. more-itertools has `peekable`, that's probably the most readable

</comment></comment></comment><comment><USER6> May be I don't know Python that well, but in any language that has generators, wouldn't it be pretty straightforward to create a generic memoizator that would cache items of provided generator after they are requested at least once? Nothing would stop you from implementing __getitem__() on it, and the initial version of Python code would still work.

Update: googled up memoizator that almost imlements exactly what I'm talking about: [http://code.activestate.com/recipes/577992-memoize- generator...](http://code.activestate.com/recipes/577992-memoize-generator/)

Just add __getitem__() to it that would access __cache, and you're done.

</comment><comment><USER7> Of course C# (and friends) has the similar problem using LINQ -- referencing what looks like the same thing, but possibly re-creating the underlying lazy IEnumerable each time. To fix this you typically do a .ToList() but that materializes the whole thing which you may not want.

F# has Seq.Cache so the the seq stays lazy but only remembers what has come in the "past", mimicking the Clojure behavior if you want to opt-in -- I'm not sure there's a corresponding BCL fn yet for C#.

</comment><comment><USER8> I've actually gotten this question in a google interview before: [https://leetcode.com/problems/peeking- iterator/](https://leetcode.com/problems/peeking-iterator/)

</comment><comment><USER9> "I found learning a new language was easy" Proceeds to explain why a language that was designed to be easy to learn, is easy to learn.

</comment><comment><USER10> I prefer the Python behavior here. Otherwise I'd always been uncertain about how much of the iterator has been held in memory.</comment>


Container Metrics with Ctop - <AUTHOR> https://thorsten-hans.com/docker-container-metrics-ctop <comment><AUTHOR> Get Docker container metrics with ctop. Get direct access to log streams and fundamental container interactions. Get super efficient using ctop and its keybindings</comment>


Remote code execution vulnerability in SQLite - <AUTHOR> https://blade.tencent.com/magellan/index_en.html <comment><USER2> It is _very_ likely that this bug only affects systems which accept and run arbitrary SQLite3 queries. This includes Chromium, because Chromium ships with WebSQL. The Google Home is probably vulnerable because it can be coerced to load a webpage. I doubt that this bug affects systems that merely use SQLite as a database without providing external query access.

My best guess for the bug is that arbitrary SQLite queries, prior to 3.26.0, were permitted to write to the shadow tables used by various plugins to implement features. fts3/4, prior to 3.25.3, appear to contain an integer overflow bug which can be triggered by manually modifying the fts index data. A careful application of this integer overflow appears to make it possible to truncate a writable buffer, leading to a nice heap overflow condition that can be exploited by further crafted SQL queries.

The primary integer overflow bug was fixed in [https://sqlite.org/src/info/940f2adc8541a838](https://sqlite.org/src/info/940f2adc8541a838) "Add extra defenses against strategically corrupt databases to fts3/4.", committed as part of the 3.25.3 update (which is what Chromium updated to). Later, in 3.26.0, they further secure it by making shadow tables _optionally_ read-only.

The worrying thing here is that SQLite3, in its default configuration, is still not convincingly secure. Being able to write arbitrary data to the shadow tables has the potential to break all sorts of assumed invariants, and it's pretty clear that the SQLite3 developers did not necessarily anticipate all the ways in which this could break. The "SQLITE_DBCONFIG_DEFENSIVE" option which was added does not appear to be on by default, and it breaks backwards compatibility (setting it causes SQL imports from .dump to fail because .dump assumes shadow tables are writable during import).

There may be more bugs lurking in this area - this would be an _excellent_ opportunity to fuzz all the plugins in SQLite to see if any of them barf when their shadow tables are corrupted.

<comment><USER3> Excellent summary, nneonneo. I think everything you said here is correct.

The vulnerability only exists in applications that allow a potential attacker to run arbitrary SQL. If an application allows that, it is usually called an "SQL Injection" vulnerability and is the fault of the application, not the database engine. The one notable exception to this rule is WebSQL in Chrome.

I put up [https://www.sqlite.org/security.html](https://www.sqlite.org/security.html) recently to serve as guidance for people who want to live on the edge and give unrestricted SQL access (or unrestricted database file access) to potentially hostile attackers. That page is a work in progress. More could be said. For example, it is probably also a good idea to use various obscure APIs to limit the length of SQL statements or the amount of memory that can be used, to avoid DOS attacks. I'll keep improving the document as I have time.

Our intent is that SQLite _should_ be secure against these kinds of attacks. We have spent years fuzzing it to try to find these problems. But the thing is, we never configured a fuzzer in such a way that it might start modifying the shadow tables of FTS3, and so we missed this one. Moral: never underestimate the ingenuity of a motivated gray-hat.

The Chrome people have recently starting fuzzing SQLite database files on Google's infrastructure. We had previously only fuzzed database files on our own workstations. It's amazing the number of new problems you can find when you run a fuzzer at scale. :-) A few more problems have been fixed. We are not aware of any exploits. And in particular, if you follow the advice of the article above and "PRAGMA quick_check" untrusted database files or set "PRAGMA cell_size_check=ON" then none of the recently found and fixed issues are reachable.

<comment><USER4> If giving unrestricted database file access is "living on the edge," maybe [https://www.sqlite.org/appfileformat.html](https://www.sqlite.org/appfileformat.html) should be updated to reflect that?

<comment><USER5> I agree. If the file is one you might get elsewhere rather than only being your own files, then it is untrusted.

To me, "trusted" is: queries entered by the local user (or, for setuid programs, by the local system administrator instead of the local user), or that are built in to the program. Others are untrusted.

And yet, I have already considered these kind of vulnerability before even knowing about it.

</comment></comment></comment></comment><comment><USER6> SQLite is the most thoroughly tested codebase I'm aware of [1]. It has seven times more test code than non-test code. 100% branch coverage. If even SQLite can have a RCE vulnerability, I'm convinced that it is not feasible for _anybody_ to write safe C code.

[1] [https://www.sqlite.org/testing.html](https://www.sqlite.org/testing.html)

<comment><USER7> 100% branch, line coverage means nothing. It's about logical coverage. What are you testing for? You are not testing lines of code, but logic.

<comment><USER8> Isn't that the definition of branch testing, to test all possible branches within code and also testing the logic in all of those branches?

<comment><USER9> Consider a line like:

        value = 1 / input;

You can get "100% coverage" if you test that with `input = 1`, but unless you check with `input = 0` you're missing a quite important logical check.

<comment><USER10> Can't you just have a NonZeroInt type?

<comment><USER11> Only if your language supports dependent types.

<comment><USER12> It's perfectly possible in languages with ordinary ADTs.

      data Nat = Z | S Nat
      data NonZeroNat = OnePlus Nat
      data NonZeroInt = Negative NonZeroNat | Positive NonZeroNat

<comment><USER13> C isn't one of those languages, though.

<comment><USER12> The analogous would be the Go-style represent-a-sum-badly-as-a-product,

      struct nonzero_t {
        int is_negative;
        unsigned int one_less_than_the_absolute_value;
      };

which, under interpretation, ranges from -(2^32) to -1 and +1 to +(2^32).

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> An RCE in a non-networked component is interesting (in other words, obvious hyperbole). Either this is your usual corruption bug/vuln triggerable in some/many programs using SQLite, or an actual bug in SQLite itself, e.g. query preparation (a fix/workaround being committed to SQLite doesn't necessarily imply one or the other). Whether the RCE hyperbole is justified remains to be seen.

Edit: Apparently the exploit vector is due to WebSQL.

And my guess as for the vulnerability area are "strategically corrupt databases", because there have been numerous commits related to this in the relevant SQLite releases and some seem like they were added relatively late in the process (e.g. after changing the VERSION file but before releasing).

<comment><USER15> They mention the example of browsing to a web page. Not quite a fully fledged remote execution bug but close enough. I think what they're really saying is they're aware of remote execution cases. An example of that might be a web services that's backed by a SQLite query.

<comment><USER16> Drive-by code execution from a page in a web browser is almost the textbook example of "RCE" in its modern sense.

<comment><USER17> Yeah, of the browser or plugin. SQLite is neither although does have a local exploit.

</comment></comment></comment></comment><comment><USER18> Ancient and long dead Opera 12.xx let you set all HTML5 Offline Storage quotas/features globally and per domain.

Afaik Chrome and its derivatives lack any form of user control over local storage. No Quota mechanisms, no domain black/white listing, no feature toggle. localStorage, webSql, IndexedDB, Filesystem API, all forced on with no limits under user control.

In a better world this would be an easy fix for Chrome users unable to upgrade their browser, flip one config setting to disable webSql and you are done, alas Google wont let you do that. Cant wait for first worm using this vuln.

</comment><comment><USER19> I casually thumbed through a few of the commits they posted and came across this

[https://chromium.googlesource.com/chromium/src/+/c368e30ae55...](https://chromium.googlesource.com/chromium/src/+/c368e30ae55600a1c3c9cb1710a54f9c55de786e%5E%21/#F48)

       for(i=0; i<nChar; i++){
         if( n>=nByte ) return 0;      /* Input contains fewer than nChar chars */
         if( (unsigned char)p[n++]>=0xc0 ){
       -      while( (p[n] & 0xc0)==0x80 ) n++;
       +      while( (p[n] & 0xc0)==0x80 ){
       +        n++;
       +        if( n>=nByte ) break;
       +      }
         }
       }
       return n;

Looks like there may have been an issue in parsing malformed multibyte unicode characters properly.

<comment><USER19>
       const secondStatements = [
       "SELECT quote(root) from ft_segdir;",
       "UPDATE ft_segdir SET root = X'0005616261636B03010200FFFFFFFF070266740302020003046E646F6E03030200';",
       "SELECT * FROM ft WHERE ft MATCH 'abandon';"
       ];

Just saw the proof of concept page. Looks like they are building quite the usual string in hex... Starting with a null terminator? Mmmhmmm

</comment></comment><comment><USER20> Unfortunately this announcement is light on details; does anybody know what the actual vulnerability was?

<comment><USER21> Maybe related to [https://www.sqlite.org/src/info/8576ccb479fc4b76](https://www.sqlite.org/src/info/8576ccb479fc4b76) ?

Edit: Yes, this is probably it.

<comment><USER22> That commit seems to imply that it's a bug when running on Windows, but the Tencent Blade folks have said they've exploited this on Google Home devices. My guess is that this commit is one of many that helped resolve the vulnerability.

<comment><USER23> "Google Home" is either:

the app installed on your phone to control say a Chromecast,

or a smart speaker.

</comment></comment></comment></comment><comment><USER24> Remote implies it can be accessed remotely, is that true, or did they mean "remote if an attacker can remotely send data to SQLite"?

<comment><USER25> Sounds like they mean "remote" because chromium uses SQLite and JavaScript loaded into your machine comes from a remote source. So because a website can run JS that can exploit chromium they're calling it an RCE.

<comment><USER24> Yeah it seems like RCE in the context of Chromium, but not SQLite? I know it's pedantic but if this is RCE in SQLite because it's exposed to the network via other software, every vulnerability is "remote" because you may expose it via other software.

</comment></comment></comment><comment><USER26> This is surprising considering that SQLite is very heavily tested. It shows that ridiculous amounts of testing with 100% coverage of every code path and "millions and millions" of test cases still doesn't guarantee that the program always works as intended.

I think that this is an important lesson about testing. We should have fewer tests but we should try to get the most value possible out of each one and for developers that means actively seeking out unusual edge cases that are likely to break things.

Source: [https://www.sqlite.org/testing.html](https://www.sqlite.org/testing.html)

<comment><USER3> Two points:

(1) The coverage testing used by SQLite is very good at finding problems that occur when the system is used as it was intended. Fuzz testing is better for finding vulnerabilities that can be exploited by a hacker. The 100% MC/DC testing in SQLite is very useful in ensuring that the code does what is intended for sane inputs. And 100% MC/DC helps prevent us from breaking things as we evolve and enhance the code. But the MC/DC testing is less useful at fending off attackers.

(2) The magellan vulnerability exploits a bug in an SQLite extension, FTS3, which while very well tested, is not testing to 100% MC/DC. (See the second sentence at [https://www.sqlite.org/testing.html#test_coverage](https://www.sqlite.org/testing.html#test_coverage))

Hence my takeaways from this episode include that I need to extend 100% MC/DC testing to all commonly used extensions in SQLite, including FTS3, FTS5, and RTREE, and I need to improve fuzz testing throughout SQLite but especially in extensions.

Advocates of "safe" language correctly observe that this particular problem would not have happened if SQLite were written in (say) Rust. Rewriting SQLite in Rust in not (yet) a viable solution. (See [https://www.sqlite.org/whyc.html](https://www.sqlite.org/whyc.html)) But I can start moving SQLite in that direction, and perhaps make use of techniques taken from safe languages to improve its resistance to attack.

<comment><USER27> Hopefully soon, "moving in that direction" can be done by slowly porting to Checked C, while always retaining an executable artifact. [https://github.com/Microsoft/checkedc](https://github.com/Microsoft/checkedc)

</comment></comment></comment><comment><USER28> Zhuowei Zhang (@zhuowei) published a proof of concept that crashes Chrome 70: [https://worthdoingbadly.com/sqlitebug/](https://worthdoingbadly.com/sqlitebug/)

</comment><comment><USER29> Python ships with a sqlite3 module in the standard library.

Does this mean Python needs to ship a security path? What should Python users be doing about this?

<comment><USER30> But does the sqlite3 module actually contain SQLite with it, or just a library to interface with it? The fix does not change any interface library code.

<comment><USER31> On Windows, a complete sqlite3 DLL (~1MB) is included with the Python distribution.

On Linux/macos, the Python extension (usually) links dynamically to a shared sqlite3 system library.

</comment></comment></comment><comment><USER32> "If you use a device or software that uses SQLite or Chromium, it will be affected."

If I write a hello world C program that does some sort of IO with SQLite, it will be vulnerable to remote code execution? (if this turns out to be true, that will be quite impressive!)

Guessing something was lost in translation there. Sounds more like someone found a way to get code execution if you can inject certain data into SQLite, then found various applications that expose this functionality remotely?

<comment><USER33> Probably they found the vulnerability through Chromium, then extended that to "everything that uses SQLite". Hard to tell anything without more details though.

But if that is the case this is _huge_. SQLite is used in many places nowadays: Websites, browsers (Chromium and Firefox, I know of), various software including some Android apps. That also probably means the attack vector is some procedure where input is sanitized (assuming SQLite provides that, I never programmed against the C API).

<comment><USER34> WebKit; worse off, WebKit and Chromium expose SQLite almost directly through WebSQL! Drive-by malware!

<comment><USER35> If I understand correctly, it requires JS to be enabled (which it is usually).

(Edit: wrong term, it's not "HTML5 Local Storage", it's "HTML5 Database" thanks):

Chromium (EDIT: idk yet)

Webkit2: [https://webkitgtk.org/reference/webkit2gtk/stable/WebKitSett...](https://webkitgtk.org/reference/webkit2gtk/stable/WebKitSettings.html#WebKitSettings --enable-html5-database)

<comment><USER34> Drive-by malware used to require Flash or Java... which used to always be enabled.

Edit: don't disable local storage! you'll break lots of things that way, and I don't think that includes WebSQL.

</comment></comment></comment></comment></comment><comment><USER5> The question are: Where is the vulnerability? By executing user-specified SQL statements (with or without setting an authorizer callback; I have once reported a bug causing SQLite to segfault in some cases when the authorizer callback denies something)? By downloading a corrupt database? In some extension (if so, in what extension)? In the VFS? What circumstances are needed to exploit this?

</comment><comment><USER36> Huh, so Tencent Blade is like Google Project Zero? Ideally all companies would start attacking each other, and improve everyone's security.

</comment><comment><USER37> Pretty sparse on details. I presume local SQLite files for backend systems are unaffected, can anyone confirm?

</comment><comment><USER38> Any news about Firefox? Are they also impacted?

<comment><USER39> Apparently not since they resisted implementing WebSQL.

</comment></comment><comment><USER40> Pretty light on the details here.

</comment><comment><USER41> My guess, for what it's worth, is that chromium is vulnerable because it exposes sqlite to web applications, which can then execute queries in such a way as to achieve code execution.

I highly doubt this would affect, say, a blog running with a sqlite database. From the alarmist nature of this post, though, it's unclear.

I see chromium, in their patch, switched to using new flags when opening the DB. There are also some sqlite changes that seem to prevent meddling with virtual table shadow tables (eg inverted index for the fts3 extension).

The question I think everyone is asking is how much sqlite needs to be exposed by an application in order to be vulnerable?

Just my thoughts. Eager to learn more.

<comment><USER16> Not so much as a guess as a documented fact:

[https://chromereleases.googleblog.com/2018/12/stable- channel...](https://chromereleases.googleblog.com/2018/12/stable-channel- update-for-desktop.html)

The Chromium exposure is through Web SQL.

<comment><USER42> That doesn't really answer the question about other applications. What SQLite function do I need to not call with network input?

<comment><USER43> See [https://news.ycombinator.com/item?id=18687184](https://news.ycombinator.com/item?id=18687184)

</comment></comment></comment></comment><comment><USER44> When people will start realizing how fragile is actually every project from Google. In the end it's built by humans, remember past week about kubernetes and consider the fact that Google pays thousands of dollars to white hackers who helped them in the past.</comment>


Non-Blocking Doubly-Linked Lists with Good Amortized Complexity - <AUTHOR> http://arxiv.org/abs/1408.1935 <comment><USER2> Lines 18 and 32 of the pseudo clearly show a "while(true)" which blocks... so how can this be called "non-blocking"? Isn't looping until we get lucky pretty much like a "spin lock"? And because the number of loops is not deterministic then surely starvation can occur? For example, if all the threads try to push or pull at the same time to the head or tail of the double linked list?</comment>