GPG is awesome; GPG is terrible - <AUTHOR> https://blog.setec.io/2015/07/12/gpg-generation.html <comment><USER2> I've seen a lot of how-to use PGP writeups, but I haven't found a single good one that helps both windows and mac users (or linux). And by good, I mean something that walks the user through the process of securely creating a key, protecting their private key, explaining the difference between a public key and a private key, explaining how to PGP sign an email, PGP encrypt an email properly, encrypt files, decrypt files, upload public keys to a key server (or why you shouldn't), how to decrypt an email... and anything else you need to know to not make any mistakes that would compromise yourself. PGP is great but there are a lot of ways you can make a mistake.

I dream of a day when secure communications is simple and usable by all.

<comment><USER3> The big huge thing GPG installs tend to gloss over is publishing your damn key. It doesn't help that the online keystores tend to be poorly supported by mail clients (why is it such a challenge to auto-lookup emails?), but the alternative of mailing your key around so other people can use it is a joke.

If you want the masses using encrypted email the key distribution needs to be as seamless as possible. Right now it is the opposite of that. Key management in GPG is a straight up nightmare of dozens of keystores and downloading text files and arcane commandlines. Public key distribution is the elephant in the room with encrypted email. Well, that and the fact that so many people use webmail now and all major webmail providers have completely given up on encryption. I've even seen arguments that since Javascript can never be fully trusted that webmail will never support encryption. Those arguments feel a bit like the "if it can't be perfect it is useless" argument you see a lot in crypto circles that keeps people using entirely unsafe technologies instead of safer partial solutions.

</comment></comment><comment><USER4> GPG has a massive "last mile" problem.

I suspect that people would gladly accept the ability to send and receive encrypted, signed emails, but the hassle factor of getting set up is simply too high.

<comment><AUTHOR> Definitely true. Even if you have a properly setup key - which less than 50k people possibly do - there's even a high maintenance cost of adding and validating new contacts.

<comment><USER5> I'm curious what you think of a project like [https://keybase.io/](https://keybase.io/)

<comment><USER6> This site promptly had me returning back to GPG again when it first came out and I got access to it. After a couple months the initial novelty of it all wore off (yet again). It's a decent idea, but when even the tech people in your circles can't be bothered with your encrypted emails it's a sign that we need to stop fooling ourselves and move on to whatever the next idea is.

<comment><USER5> In the ham radio community, they have days to practice sending messages to other hams. Perhaps we should have something similar?

<comment><USER7> This is a good idea, we have Field day, SET exercises, and weekly nets. There are always contests where hams rack up points by making contacts. We have contests that are specific days (like field day), and standing awards liked "Worked All States" (you made a contact to someone in each of the 50 states).

In the computer tech world, we do rank ourselves. We post w3c validation badges on our page, we run our sites through ssllabs.com for a security report card. We work towards being an IPv6 Sage from he.net. So why not a GPG contest? Keybase might be a good site to organize such things.

Generate a key and upload it to a keyserver is a basic level. You key can be graded based on bits (1024 vs 2048 vs 4096) and algorithm chosen. Send an encrypted email awards more points. Send a signed message for more points. Receive an encrypted message (and respond with the unencrypted text) is more points. Receive 3 emails and reply to the one that is properly signed for more points.

At some point in your journey you can start socializing. Advertise on your blog/github/keybase/social media that you are participating in a gpg contact contest. People can send you signed messages, you can send to them. You both sign and forward the message to keybase, who uses the signature to validate both of you exchanged messages with gpg. Keybase could even provide uuid/tokens to hand out (encrypted) and further validate. The more gpg contacts you accumulate, the higher your score. The "worked all states" from ham radio could be an achievement in gpg contesting as well.

</comment></comment></comment></comment></comment></comment><comment><USER8> Does anyone have a good source on what kind of keys I should make? Or what ciphers I should enable on my key (is that the right terminology?)

Should I add a small thumbnail photo of myself in my key? Or is that generally frowned upon?

Finally, are there good sources on how I would create a 4096 bit master key, and then add a 2048 bit subkeys for signing and encryption that I can add to my smart card which only allows for keys up to 2048? Would generating 2048 subkeys allow me to still decrypt gpg encrypted emails sent to me encrypted with my 4096 bit master key?

Still trying to figure this all out after picking up some YubiKeys

<comment><AUTHOR> The best document I've found for key generation (the one I turn to myself, when my memory needs refreshing) is the one on Riseup: [https://help.riseup.net/en/security/message- security/openpgp...](https://help.riseup.net/en/security/message- security/openpgp/best-practices) . If you follow that guide, you will get a keypair that avoids the common pitfalls.

The photo question is an interesting one - some people frown on it, some people like it. Personally, I lean towards not adding them, just because the number of times I've actually checked it is so low (maybe once, ever.) That being said, I don't think people feel so strongly that they'd refuse to use or sign your key over it; they might just not sign that particular uid. (The photo is stored the same way an alternate email is, basically.)

Properly setting up an offline subkey involves some rather archaic incantations; even more so when you are burning them into a smart card. Specifically, I would probably use some combination of the above instructions (to get my gpg.conf into the correct state), and then something like this guide: [https://gist.github.com/abeluck/3383449](https://gist.github.com/abeluck/3383449)

Specifically, I would look for a guide that instructs you to have a master key that is valid only for certification. I have a personal dislike for allowing your "master" key to be used for encryption, because it incentivizes you to do things that are not best-practice: specifically, using it. In the ideal world, your master key is kept, encrypted, on one (or more) USB drives that are all kept in various safes, and are never plugged into a computer that has an internet connection. Bonus points if the computer isn't used for anything else either. This is because your master key is the Thing That Must Not Be Compromised -- or you need to revoke the entire key and can never use it again. If a "working" subkey gets compromised, you can revoke it without losing all of the certification effort you've put into validating your identity in the web of trust.

</comment></comment><comment><USER9> GPG/PGP is a VERY hard tool, conceptually hard. Yes, you can run through these "quick-starts" but they give you zero understanding what exactly you are doing.

GPG requires a deep understanding of things it's based on: web of trust, public key, private key, revokation key, keys repository structure etc. And these things are really really hard.

<comment><USER10> What's so hard about GPG? People say this all the time but don't qualify it. Most people who use GPG don't use "web of trust", "revocation keys", or know anything about "key repository structure". They generate a key, give it to their peer, get a key back, and encrypt messages to each other.

It's not the easiest tool in the world, but it's not that much harder than, say, using a nonstandard compression tool.

<comment><USER11> Number one issue for common people: "I use webmail".

Another issue common people don't think about: How do you backup your key and actually restore it in such a way that you can read your old mails again?

Oh, and how long was GpgOL not working for the current Outlook version? Another big stone that lies in your way.

And I wish tech-savvy people would just "allow" the workflow you described above.

I have encountered too many discussions where people got scared off, because "the web of trust is the only acceptable way", and "check your government- issued ID cards! Yes, even if he's your best friend since kindergarten and he gave you the key in person!".

Nerds _love_ playing the key party game. They love calling some first-level support and asking to recite the key's fingerprint. They love showing how goddamn smart they are. And that puts everyone else off.

It's another expression of the "security is binary" mindset that also hinders opportunistic encryption. Because there is something better we must not use this.

Lose the web of trust (and "marginal trust" is something only techies can come up with...), have a nice UI with only four or five buttons, make it work with all Outlook versions and make it work with webmail (at least GMail) and you may have a winner.

The last one is the big one and nearly impossible for anyone else, but Google seems to be working it (end-to-end for Chrome).

<comment><USER12> _> Number one issue for common people: "I use webmail"._

Which is actually two issues. One, the interface; there's a GPG thingy for GMail, but it's kind of junk. Two, and no less important: _how do I search my archive_?

(Did you just say "download it"? You lose. Did you just say "don't use webmail"? You lose again.)

<comment><USER13> No, the webmail users lose because they have acclimated themselves to using a dumb terminal system which makes full confidentiality at least an order of magnitude more work to achieve. A user who is 100% unwilling to switch away from webmail will accomplish that security goal with just as little success as a steadfast fast-food patron pursing a healthy-eating goal.

<comment><USER12> Yeah, sorry, that's not how this works. Y'see, you're sending emails to people using webmail (I mean, if you're a nominally functional human being). So _your_ emails are insecure, too, because you are insisting on something that is fundamentally not compatible with how normal people use computers in 2015.

This is a community thing. You need to give to get them to give. And you're not giving.

</comment></comment></comment></comment></comment></comment><comment><USER14> If you are on Android, use OpenKeychain. We don't ask these questions. Instead, we have a simple wizard guiding you through the process of creating a key. We don't ask for the algorithms (RSA, DSA,...). We don't ask for User IDs. We don't mention the words private or public key.

See [http://www.openkeychain.org/](http://www.openkeychain.org/)

</comment><comment><USER15> With plugins like enigmail on Thunderbird all this stuff is basically next- next-save with best practices in mind.

If you can use Thunderbird I see no reason why you can't use GPG

<comment><USER11> That's about how much market share? Less than a percent?

(I loved EnigMail, back when I was using it)

<comment><USER16> What's the point here?

If you want secure email then use an email client that doesn't suck at it?

(That said, the key management part of GPG doesn't become easier just because you use Thunderbird)

<comment><USER11> Most mail clients "don't suck" at secure email: S/MIME is readily available, virtually everywhere.

Only because of some irrational dislike in the Open Source community do we even have this discussion. Self-signed X.509 certificates would have done more for the cause of "secure email" than all GnuPG advocacy ever did.

<comment><USER3> Most mail clients suck in one very fundamental way: Importing someone's published public key is a manual process, and usually a fairly obscure one.

Mail clients should automatically query keyservers for all of the addresses on the TO: line and automatically import the keys they find. Instead they assume you're going to pass keys around on USB sticks or some such nonsense and import them into GPG by hand using some arcane syntax. It's ridiculous.

</comment></comment></comment></comment></comment><comment><USER17> An alternative to GPG that is a lot easier to use (no options):

[https://github.com/Spark-Innovations/SC4](https://github.com/Spark- Innovations/SC4)

Runs in a browser. Modern crypto (elliptic curves instead of RSA). Audited code. Open source.

<comment><USER17> Downvotes? Seriously? Why?

</comment></comment><comment><USER18> I would never have my private keys leave a smart card. I'd assume your PGP private key on hard drive, located in your home directory no less, is as good as compromised.

</comment><comment><USER19> Take a look at this tutorial on setting up a proper GPG key: [http://ekaia.org/blog/2009/05/10/creating-new- gpgkey/](http://ekaia.org/blog/2009/05/10/creating-new-gpgkey/)

</comment><comment><USER20> GPG is awful; GPG is terrific.</comment>


The JavaScript Packaging Problem - <AUTHOR> http://jamie-wong.com/2014/11/29/the-js-packaging-problem/

<comment><USER2> GWT solves some of these issues via Code Splitting:

[http://www.gwtproject.org/doc/latest/DevGuideCodeSplitting.h...](http://www.gwtproject.org/doc/latest/DevGuideCodeSplitting.html)

Step 1: GWT will compile + package everything into one big giant JS and one big giant image file (CSS sprites is automagic in GWT via Java interface with annotation, no longer one needs to download bajillion tools to stich the images and write bajillion CSS coordinates to access the icons).

Step 2: Follow code splitting guide to asynchronously load your code :)

</comment><comment><USER3> This is a good writeup. We ran into some of the same issues on the smaller site I work on, compounded by use of pushState. We use require.js and a very simple client side router to determine what packages to load, and depend on require.js to pick up anything else.

[http://blogs.mpr.org/developer/2014/01/dynamically- loading-a...](http://blogs.mpr.org/developer/2014/01/dynamically-loading- assets-with-pjax-and-require-js/)</comment>


The State of the Octoverse: top programming languages of 2018 - <AUTHOR> https://blog.github.com/2018-11-15-state-of-the-octoverse-top-programming-languages/ <comment><USER2> I hate these, because they are always wrong.

Once a measurement is used for success, it stops being a good measurement.

Javascript, namely node, has a metric ton of libraries, and you think, iseven/isodd/... so god knows how many libraries are out there, _not actual projects_.

I will say, that their metric about growth of the number of contributors is a much better metric for 'best language.'</comment>


Flickr Photos Yield Tourist Trails - <AUTHOR> http://www.technologyreview.com/computing/25549/?a=f

<comment><USER2> _To inform its suggestions, it extracted tourists' movements between attractions in those cities from millions of photos uploaded to Flickr over three years._

It looks like they've invented a way to help me find the most crowded locations. Thanks, but I'd rather do it my own way.</comment>


Ask HN: Do those "sign up for our newsletter" pop-ups actually work? - <AUTHOR> Over the last few years a lot of websites have started showing pop-ups a few seconds after the visitor arrives asking them to sign up for the site's email newsletter. Often these take up the entire screen or otherwise make the site unusable until the user dismisses them.
Do these pop-ups actually lead to more sign-ups than, say, a little widget off to the side? Are the sign-ups good quality - i.e. are they people who are likely to stay engaged and/or generate revenue for the site?
I ask because I typically see these on sites I get to from a Google search. I'm usually visiting these sites for the first time and I know very little about them. I would never sign up for a newsletter   before I even know what they do and if they have useful content.
I would guess these popups are targeting repeat visitors, but even then it's still annoying and just makes me dislike the site.
So, if anyone has any experience working with these newsletter pop-ups, do they work? <comment><USER3> It's night and day.

[http://i.imgur.com/WW0uF8n.png](http://i.imgur.com/WW0uF8n.png)

<comment><USER4> Just a reminder that a marketing practise may aggressive and unwelcomed by some users while also being statistically successfully on some other users and bringing significant revenues.

</comment></comment><comment><USER5> It depends on the timing of the pop-up. If I open a site's homepage and it immediately pop-ups that form, I ignore it. If I am browsing for a few seconds or even minutes and then it pop-ups when I try to exit, I may sign up if the content was interesting.

Oh and a big pet peeve. Lot of these forms try to be cute by saying something like "No I don't want to make more money" etc for the decline option. Don't do that. Just because I am not signing up for your newsletter does not mean you need to tell me I am making a mistake.

<comment><USER6> > It depends on the timing of the pop-up.

Yes, definitely. A huge pop-up before I've even finished reading the title? Get lost. A smaller pop-up when I've read the whole article? Well, maybe I'll think about it.

The first is just plain rude. I probably won't sign up for the second either, because I don't want to give away my email address to all and sundry - <USER2> I've benefited from your content, so you have a right to at least ask.

</comment></comment><comment><USER7> Of course they work. They also provide terrible UX.

They work in a "quantitative" manner, it will grow your list but many users like me will close the entire tab at lightning speed.

I think they work mostly because of naive users who think they need to enter their email in order to view the actual website.

So, depending on your targets, you can choose to fast grow your list with random and candid users or have a sharper base of people actually interested in your content.

<comment><USER8> OTOH, if a site monetizes primarily through its email list, they may not care if people who don't sign up see their content.

There are similarities in the selection criteria used by 419 scammers.

</comment></comment><comment><USER9> Of course these work. I am using them on my website so that visitors keep getting new updates.

<comment><USER10> On the one hand, the 'subscribe' pop-ups are intrusive, and I am reluctant to clutter my inbox with notifications, but on the other hand they provide a subliminal advertisement that the website is a source of material that is actually worth signing up for, along with implicit peer pressure from the implication, justified or not, that there is already a community of people who have signed up. It is a psychological nudge, and you seem to be saying that the benefits outweigh the downsides?

</comment></comment><comment><USER11> All big companies that do these use extensive ab testing to determine if they work.

<comment><USER12> As an aside, I think the slash (or at least capital letters) is pretty important to use when writing out A/B testing. (My initial reading of the parent post gave me a different interpretation.)

</comment></comment><comment><USER13> Most of the comments here are the experiences of highly tech savvy end users, not webmasters who employ the pop-up technique on their site. They are not representative of the general population. So the feedback should be taken in perspective. That said, I have learnt a lot about usability from these discussions and that has shaped how I design my own site. Kudos to hners.

</comment><comment><USER14> Your not asking all the questions.

Do you want email list signups or customers who convert to cash.

Is your email marketing effective enough to cancel out the increase to your bounce rate?

For most people email signups aren't a direct correlation to money in the bank, you need to market to these folks. If you don't have an effective email marketing then its automatically a bad idea.

</comment><comment><USER15> It does work, I usually never ever visit them again.

They successfully lost a potential customer.

</comment><comment><USER16> As an end user of web content, popups don't work for me, but if it is a small box at end of page, article etc, and if the content is good, I usually subscribe.</comment>


SF 'Deathtrap' Excelsior laundromat landlord to pay city $620K, tenants $2.6M - <AUTHOR> https://sf.curbed.com/2018/5/18/17368608/deathtrap-laundromat-mission-excelsior-mendoza-settlement-san-francisco <comment><AUTHOR> "A spokesman for Spin, one of the electric scooter outfits, says initial reports show that 20 percent of all rides begin and end at a transit hub."

In other words, _80% of all rides do not intersect with a transit hub in any way whatsoever_.

Note that this column is Willie Brown's recurring Op-Ed column.</comment>


HG Wells's prescient visions of the future remain unsurpassed - <AUTHOR> https://www.theguardian.com/books/2016/aug/13/hg-wells-visions-of-the-future-remain-unsurpassed <comment><USER2> What a load of bollox!</comment>


How to buy a killer .com domain - <AUTHOR> http://itayadam.posterous.com/how-to-buy-a-killer-com-domain

<comment><USER2> It's a nice idea in theory, but the problem is that only one side has actual control/ownership of the domain at any one time.

If the startup owner gets control, they can decide to stop paying, and the original domain owner has to sue for their money.

If the original domain owner keeps control, and the startup does well, they can be held to ransom by the domain owner threatening to redirect the domain.

Of course in theory all of this can be prevented through contracts, but the prospect of having to use the (international) court system to enforce one's rights is not an attractive one for either side. Startups often run out of money, and domainers like to spot an opportunity, so there's just too much risk.

As an aside, names aren't actually that important, so long as you can own your namespace. Flickr? Facebook? Craigslist? These are all pretty bad names, but it didn't seem to matter.

<comment><USER3> Does this mean there's a business opportunity here, than? A 3rd party, escrow- esque middleman who holds the domain so that neither party breaks the agreement?

</comment></comment><comment><USER4> I see two issues with this approach:

1) You're relying on the current domain name holder to be convinced by your option pitch and not just playing stubborn and getting paid upfront. The kind of person that's a domain squatter to have an interesting domain in the first place is going to be the stubborn sort looking to make bank upfront.

2) You can't just 'lease' the domain name as suggested and build up a company around it if you don't own it outright (i.e. be the admin/technical contact/owner. Again, if you're dealing with the kind of sleezeball that squats domain names, you can't leave them the option of taking back their domain name.

<comment><USER5> For many years I've owned what I think qualifies as a "killer" .com domain (i.e. three letters, cool sounding real word in English and other languages) and I would have been open to this arrangement with the right party (i.e. depending on your business plan, backing etc.). I still might be at some point in the future but right now I've got other plans for it. It would be relatively easy to set up some kind of escrow arrangement through lawyers.

</comment></comment><comment><USER6> If I'm not mistaken, face.com did exactly that.

<comment> apa-sl Any ideas where I can advertise my great.com domain name available for fashion startups for lease? ;-)

</comment></comment><comment> momma-joe don't always assume you are smarter. Thinking the other side is stupid makes you stupid.

</comment><comment><USER7> Million dollar domain names are cool and all but to be honest I'd rather think of a cool name that doesn't exist yet and get that domain for ten dollars.</comment>


What is machine learning? - <AUTHOR>

Hello,
In the wikipedia entry on Machine learning they mention the 'explicitly programmed instructions' :
"Machine learning is a scientific discipline that explores the construction and study of algorithms that can learn from data. Such algorithms operate by building a model based on inputs and using that to make predictions or decisions, rather than following only explicitly programmed instructions."
I'm really trying to understand what do these algorithms really are and what do they mean by 'explicitly programmed instructions'.
How can you write for example a classifier using the 'explicitly programmed instructions' and how do we compare it to a ML classifier ? Does the ML classifier use heuristics where the 'explicitly programmed instructions' one will look for an optimal solution ? Aren't the 2 just 'explicitly programmed instructions' with different response time ?
I read some articles and did some MOOC on ML, what I'm looking for is what do we mean by ML. I'm not that interested in its applications.
I'd appreciate any answers, materials, ...
Thanks, <comment><USER2> Here's a classifier that uses explicitly programmed instructions:

        def classify(word):
            return word[0]

What you would do instead with supervised learning or other ML methods, is to give the algorithm some inputs and outputs, e.g. "Hello => H", "World => W" and then let the algorithm come up with a model that will know that the answer to "Sunshine" is "S" without you having explicitly coded that.

Of course, in reality you wouldn't use machine learning to alphabetize words. It's most useful when explicit or exact classification / modeling / prediction is simply not possible, as e.g. with spam detection.</comment>


Ask HN: Chinese spam-calls, anyone know what's going on? - <AUTHOR> Seems like they've massively ramped up in the past week or so. <comment><USER3> The FTC has sent out a warning about these calls targeting the Chinese community pretending to be the embassy.

"The Federal Trade Commission warned this week that mobile spam calls are now targeting the Chinese community in the US, with the robocaller pretending to be from the Chinese Embassy. The messages range from asking the recipient to pick up a package or document from a Chinese Consulate office and offering to exchange yuan to dollars, to the Embassy investigating a fraud and requiring personal information to avoid deportation.

The FTC believes these calls are targeting Chinese immigrants or callers with Chinese last names, but in recent weeks, the practice has reached numbers across the US regardless of who the number is registered to. Like other spam calls, the incoming number appear to be similar to the recipient's own phone number, or spoofs the Chinese Embassy's real phone number which begins with (212) 244. In addition to calls, the FTC warns that similar scams may also be targeting users via WeChat"

[https://www.theverge.com/2018/4/22/17267970/ftc-robot- scam-c...](https://www.theverge.com/2018/4/22/17267970/ftc-robot-scam-call- fraud-chinese-embassy-consulate-212-244)

</comment><comment><USER4> They are absolutely targeting cities with large Asian populations. It's not random.

This is the breakdown for incoming calls to the Nomorobo honeypot for 4/1/2018-4/23/18 that have called more than one line from 212-244-[0000-9999] (the last 4 digits change frequently, just like regular neighbor spoofing).

Data source: Our honeypot consists of over 300k lines from around the country that people have gotten rid of, mostly due to getting so many robocalls. It's the main weapon that we use to build our blacklist.

      to_npa	to_nxx	calls	lines	city, st
      646	233	1383	642	NEW YORK, NY
      347	218	935	783	BROOKLYN, NY
      415	965	266	266	BOLINAS, CA
      917	563	192	147	NEW YORK, NY
      718	878	176	152	FLUSHING, NY
      617	767	57	56	SOMERVILLE, MA
      562	200	56	56	LONG BEACH, CA
      626	427	50	40	LOS ANGELES, CA
      201	546	44	44	HACKENSACK, NJ
      323	203	19	19	LOS ANGELES, CA
      650	492	19	19	MOUNTAIN VIEW, CA
      832	293	15	13	HOUSTON, TX
      857	488	12	12	BOSTON, MA
      845	262	10	10	SPRING VALLEY, NY
      585	286	10	10	ROCHESTER, NY
      949	393	9	9	MISSION VIEJO, CA
      206	535	9	9	SEATTLE, WA
      267	457	8	8	PHILADELPHIA, PA
      716	989	7	7	BUFFALO, NY
      310	400	7	7	LOS ANGELES, CA
      510	250	7	7	OAKLAND, CA
      516	279	6	6	GARDEN CITY, NY
      929	200	6	5	FLUSHING, NY
      909	214	3	3	ONTARIO, CA
      315	982	3	3	UTICA, NY
      848	260	3	3	METUCHEN, NJ
      908	360	3	3	MILLINGTON, NJ
      301	825	2	2	ROCKVILLE, MD
      212	687	2	2	NEW YORK, NY
      202	813	2	2	WASHINGTON, DC

</comment><comment><USER5> Apparently, they are ramping up because they're working, unfortunately: millions of dollars have been scammed from mostly older Chinese immigrants over the past few months as a result of these calls.

</comment><comment><USER6> No Chinese calls, but I have seen robo calls on my phone which come from similar area code (906)370-xxxx Those happen to be some Bahamas Cruise ones. I wonder how they manage to spoof the number from identical area code.

Edit - <USER2>

<comment><USER7> Spoofing numbers is extremely easy. You can even download mobile apps and do it from your phone.

I'm not sure why telcos don't restrict this to at least verified numbers. But it probably has something to do with interoperability of the world's myriad of different telcos that have to be interoperable.

</comment></comment><comment><USER8> I had the fascinating experience of sitting in on a high school English class during my time in Beijing. One of the common assignments was to practice speaking by calling American phone numbers that students in the intro programming classes had scraped from the internet. With exams coming up it's possible that students are making phone calls on their own to get practice.

But seriously, what kind of question is this?

</comment><comment><USER9> Do you have a NYC number? Or is this happening across the US? I've been getting them for a couple of months now and there was just a post on the NYC subreddit the other day talking about it. I thought I was the only one, and since I don't speak Mandarin, I assumed someone just accidentally gave my number to a Chinese business of some sort.

<comment><USER4> Is it always from the same number? I bet we (Nomorobo) have some recordings that I can dig up.

<comment><USER10> I googled a number that called me and found a recording from your site: [https://www.nomorobo.com/lookup/212-244-9781](https://www.nomorobo.com/lookup/212-244-9781)

No idea what it's saying, and I'm assuming your transcription is just creating garbage by assuming the mandarin is english?

<comment><USER4> Yep. No idea either. Is this a legit message?

[https://www.nomorobo.com/lookup/212-244-9392](https://www.nomorobo.com/lookup/212-244-9392)

I'll run some stats in a few.

</comment></comment></comment></comment><comment><USER4> Got a number that they're calling from? I can check our (Nomorobo) database and see if there's anything coming through.

<comment><USER11> Try 212-244-9392 - Chinese consulate in New York, spoofed, of course. [http://newyork.china- consulate.org/eng/lqfw/lsbhyxz/t1486921...](http://newyork.china- consulate.org/eng/lqfw/lsbhyxz/t1486921.htm)

<comment><USER4> This is a recording from their number at the end of last year - [https://www.nomorobo.com/lookup/212-244-9392](https://www.nomorobo.com/lookup/212-244-9392)

I'll run some stats on 212-244 numbers in a few.

</comment></comment></comment><comment><USER12> I got one of those, and let my Chinese coworker listen to it and tell me what it was about. She got the same call, and when she called the number back (which was the Chinese Embassy in San Francisco), they got mad at her.

</comment><comment><USER13> I have a 415 number and began receiving these a few weeks ago.

<comment><USER11> This was happening in SF in November, 2017.

[https://sanfranciscopolice.org/article/sfpd-issues- warning-t...](https://sanfranciscopolice.org/article/sfpd-issues-warning- telephone-scam-targeting-chinese-residents-17-176)

Does anyone else find it troubling that scammers and spammers using spoofed calling numbers are doing to the voice phone system what spammers did to email, and before that, to NNTP? (The "Green Card" spam was 24 years ago.)</comment></comment>


C is not your friend: sizeof and side-effects - <AUTHOR> http://blog.tjd.phlegethon.org/post/159564806182/c-is-not-your-friend-sizeof-and-side-effects <comment><USER2> If you use ++ in a sizeof expression...you're probably getting what you deserve. C may not be your friend, but it is fair.

<comment><USER3> I'm not sure what a fair or unfair language would be. Is an unfair language one who's compiler output is non-deterministic? If that is the case then C fails that test with undefined behavior.

What I'm really trying to say is that as an industry we need to stop proping up C as if it's some golden god. Was it a good compromise for it's time? Of course but we can and should do better because it's clear that writing 'good' C code might be beyond the realm of man.

<comment><USER4> If we want to do that, we need to make it possible to fully harness the abilities of the computer in other languages.

Just as a litmus test: In how many languages can you cause the SIMD shuffle instruction to be used, explicitly? How many have compilers that can take advantage of it?

JVM / .NET languages don't do this (I know .NET can do SIMD, but it can't do shuffle). Rust can maybe do it? Not sure on the status. Dlang SIMD support seems only partial.

Which can do a popcnt explicitly or automatically?

There are lots of little holes in other languages just in the space of "Can I even use the instructions the cpu has". Then of course being able to control memory completely is a huge advantage in some domains. Any language that lets you do that will have most of the same danger problems as C or C++

I'm sure you could come up with something that is a little safer with as much power, but it isn't so easy for someone to just stop using C/C++ right now if they need that control.

<comment><USER3> I would answer that you can use Rust to your first question.

But I agree with your general sentiment that currently C/C++ is the only choice for certain domains. But there is nothing theoretically stopping us from creating safer system languages. (See Rust and Swift, much less so Swift. But Apple is working towards that goal with the option to disable reference counting in a future version which will give much more predictable performance.)

My argument is that we need to stop pretending that C/C++ is not worth improving. Every time someone criticizes a gotcha of C/C++ HN gets very defensive. We need to kill our gods if we want better ones and I personally think we need better system programming languages because it is far too easy to write bad C/C++ code.

<comment><USER5> >"My argument is that we need to stop pretending that C/C++ is not worth improving."

I don't think that's the sentiment of their communities though. Not sure about C, but in the case of C++ it has been continuously adding significant features in the latest three iterations (C++11,C++14 and C++17), if that is not signal of improvement I don't know what it is

</comment></comment></comment></comment></comment><comment><USER6> C is a language that gives you a very sharp laser knife that can cut everything clean off very efficiently and fast. However, without care, you'll cut your fingers off. Always wear safety goggles around dangerous equipment and don't do stupid things like i++ inside a macro call.

You're writing C, don't give me the "I might not know that what I'm calling is a macro" argument. You better know what you're calling in C. If you don't want to know what you're calling, don't write C.

<comment><USER7> >You better know what you're calling in C. If you don't want to know what you're calling, don't write C.

That puts a de-facto cap on either the speed of C development or the size of C projects.

It is definitely possible to have a project so large that no one person can understand it all. So either you can't have C projects larger than whatever that size is, lest you risk not knowing what you're calling, or you have to accept that developers working on your project will be reading and re-reading parts of source code that haven't changed in years in order to make sure they know what they're calling, rather than re-implementing common patterns in the codebase and trusting to prior diligence.

Either way, you're not selling C to me as a language to embark upon a major project with.

<comment><USER8> > Either way, you're not selling C to me as a language to embark upon a major > project with.

Sounds about right.

I dearly love C, but it's time to move on. Languages like Rust seem to solve most of the major pitfalls while not sacrificing on speed.

<comment><USER9> Is that something you are just musing out loud, or are you proselytizing?

If it is the former free to use whatever language you choose. If it is the latter, can you please keep your opinion as just that.

I believe we are all adults here and quite capable of making judgment calls.

Rust has some interesting features and lots of other languages too. No need for the drive by.

<comment><USER8> Who pissed in your cornflakes?

I'm not sure how much more diplomatically I could have phrased my previous post. If mentioning a language as one possible modern alternative ("languages like Rust") is enough to set you off, perhaps you need to reconsider who's falling short of adulthood here.

<comment><USER9> That's not actually what you said.

What you said is it is about time we moved on from C and suggested Rust.

That seems like your own subjective opinion. Which is fine of course, each to their own.

Personally I will continue to use whatever language makes sense for the job no matter what it might be.

Happy to take one for the team if that stance doesn't work for you, I'm not the one here passively aggressively proselytizing.

And thank you for confirming that by the way.

</comment></comment></comment></comment></comment></comment><comment><USER10> This feels like a rant about a language handing bad developers enough rope to hang an entire village. I'm unconvinced this represents a failing of the language.

<comment><USER11> I think in software engineering it's prudent to just assume that all developers make mistakes sometimes. Anything that can have developers make less mistakes or can catch developer mistakes saves time (and therefore money) in the long term so I think it's fair to complain that c makes mistakes easy and difficult to catch.

<comment><USER12> Complaining about C in this manner strikes me as complaining that the knife you're using is too sharp, and you don't have time to make sure you won't cut yourself.

Don't get me wrong. I prefer working in Python or its ilk, because I prefer a higher level of safeguards. But nothing I work on needs the precision of behavior that C provides. And sometimes you need sharp and precise.

<comment><USER13> C is not precise, not as a model of modern CPUs (they're very different to the PDP-11, and compiler optimisers are very invasive) nor as a precision engineering tool (too many silent footguns and landmines adding a pile of incidental complexity).

It's definitely true that it's sharp and sometimes (currently) the best tool for the job, but don't ignore the reality of its design and limitations when praising it.

<comment><USER14> I'm not sure where this meme that C is a direct translation to PDP-11 assembly came from. It's true that there were some quirks in K&R C that came from it (eg, the way that floats were widened to doubles when being passed to functions), but those largely went away with ANSI C.

Other than that, C isn't a significantly better match for PDP-11 than it is for x86 or alpha or sparc.

</comment></comment></comment></comment></comment><comment><USER15> This flaw was pointed out while C99 was under review. The idea of changing sizeof to not be evaluated at compile-time did not sit well with a lot of people. Unfortunately, the alternative (sizeof not being usable with dynamic arrays) was clearly worse.

<comment><USER16> Do you happen to know why that was perceived as worse? If I understand correctly the difference would be that you'd have to write (i * sizeof(char)) vs. (sizeof(char[i]))? Personally I'd even prefer the former.

<comment><USER17> A very common idiom is "T _p = malloc(n_ sizeof *p)". That only works if sizeof doesn't evaluate its arguments.

<comment><USER18> Why not? Suppose you have a C99 VLA object, and you want to malloc the equivalent amount of space. Couldn't you just do this:

       int vla[nparam];
       int *pcopyspace = malloc(sizeof vla);

Here _sizeof vla_ is basically just _nparam_ sizeof(int) _.

_ vla* is evaluated to the extent of calculating its run-time size.

</comment></comment></comment></comment><comment><USER19> Ah, the weekly 'C is evil' HN bit.

FYI, your mouse is also dangerous, you can easily click the wrong way and send all your money away to someone in Nigeria. Should we blame the mouse?

<comment><USER20> This seems like a bit of a knee-jerk reaction on your part. The article itself is interesting and points out an edge case which is likely to trip people up in certain situations. I don't really see the article mentioning or even hinting that "C is evil", it even includes a bit of a qualifier at the end: "C is reaching PHP-like levels of confusion here, but luckily for us this combination . . . is pretty hard to hit. I've never seen it in "real" code."

<comment><USER19> A bit yes, I have to admit this. However it's not HARD to find new&interesting way of screwing up with the language, it's been done for longer than I'm alive, and some people abused it in extraordinary ways over the years [0], so all I can think of when I see that sort of article is 'HN clickbait'. It works. It's actually borderline trolling at this rate.

[0]: [http://www.ioccc.org/](http://www.ioccc.org/)

</comment></comment></comment><comment><USER21> The beauty of C/C++ is exactly that it gives you freedom to do things. Period. There are a lot of languages designed to limit you (or make safer programs, you name it). Some might be faster / more productive / safer / environment- friendly, use what you think you should. But don't try to limit C, please.

<comment> self-diversity Then stop writing important code that can cause me harm when inevitably easily exploited because of that freedom, please.

</comment></comment><comment><USER22> You can see why VLAs were made optional in C11, even though they were mandatory in C99. There were just too many weird interactions that VLAs had with other parts of the language. (That, and it was an easy way to get a stack overflow.)

<comment><USER23> Coming from C++ VLA are one of things that I really wish I had access too. The number of times I've seen stuff created on the heap just to toss at the end of the block in production code always made me cringe.

Agreed that they're a very sharp tool and need to be used with care.

<comment><USER24> C++ has way way better ways to handle this. What you do instead is a std::vector with an allocator that has a fixed-size chunk of memory to cover your common, small case and falls back to malloc if the size becomes too large to fit into the internal allocation.

Then your VLA is stack allocated when small and heap allocated when large and works everywhere, even as a return value or other cases where alloca would fail.

Example: [https://howardhinnant.github.io/stack_alloc.html](https://howardhinnant.github.io/stack_alloc.html)

<comment><USER23> Yeah, that's a much nicer solution. In the cases where it mattered we just built a standard block/arena allocator but that's a bit more work which means it was rarely used.

</comment></comment></comment></comment><comment><USER25> Is there a kind of "linter" for C that spots stuff like the problems presented here (as opposed to just formatting)? What kinds of static analysis are available here?

<comment><USER26> There are lots of useful -W flags to gcc/clang that expose language pitfalls (examples: -Wparentheses and -Wshadow).

As far as dedicated tools, my best experience is with Coverity, which seems to have a design focus of finding errors in codebases with a minimum of false positives.

</comment></comment><comment><USER27> C is a very "strict" language. It do the right thing only if you write the right code. It has many undefined behaviors. One of the undefined behaviors I found when I studied the compiler course. The purposed grammar from [https://www.amazon.com/Programming-Language-Brian-W- Kernigha...](https://www.amazon.com/Programming-Language-Brian-W- Kernighan/dp/0131103628/ref=sr_1_1?ie=UTF8&qid=1492654731&sr=8-1&keywords=c+programming) allows this kind of structure, there can be statements after the switch but before the case labels. gcc also accepts this, but those statements will not be executed. Note: code modified from [https://www.tutorialspoint.com/cprogramming/switch_statement...](https://www.tutorialspoint.com/cprogramming/switch_statement_in_c.htm)

#include "stdio.h"

int main () {

       /* local variable definition */
       char grade = 'B';
       int a = 1;

       switch(grade) {
          printf("great!\n" );
          a = a + 1;

          case 'A' :
             printf("Excellent!\n" );
             break;
          case 'B' :
          case 'C' :
             printf("Well done\n" );
             printf("a: %d\n", a);
             break;
          case 'D' :
             printf("You passed\n" );
             break;
          case 'F' :
             printf("Better try again\n" );
             break;
          default :
             printf("Invalid grade\n" );
       }

       printf("Your grade is  %c\n", grade );

       return 0;
    }

</comment><comment> joatmon-snoo This comes with me not being very experienced or familiar with C, but this is... disturbing.

I mean, I totally get that this is a really poor use case, and as I just learned from looking it up (because I didn't know this before), sizeof in C isn't a function or macro, but an _operator_.

That just doesn't jibe with the mental model of C that I had in my head. And programming languages, if anything, should be _conducive_ to mental models, not hostile to them.

<comment><USER28> One could equally point out that programmers should form mental models by reading documentation, rather than relying on intuition. It's not like you have to dig through compiler sources to find out that sizeof is an operator. Even if it wasn't plainly documented in pretty much any properly-written material on the C programming language, it's pretty obvious that sizeof _can 't_ be a function, since a function doesn't have access to the sort of data required in order to retrieve this sort of information.

<comment><USER13> The reality is people form mental models by intuition. Things designed for humans to use (like programming languages) should take this reality into account.

<comment><USER28> And then people wonder why other engineers smirk when they hear the term "software engineering" :-).

We're not all fitted with the same Umbrella IntuCard Mk. II Intuition card so that, relying on intuition alone, we can all reach the same results from the same inputs. Relying on intuition to figure out how a language works is about as smart as relying on intuition to figure out the limit of a series, how a telephone work or how a transistor works -- all three of which have been definitely designed for humans to use, since there were nothing _but_ humans who could use them back when they were invented.

I don't like it any more than you do, and my life would be much easier (and probably happier) if it weren't like this, but blaming it on the language is the equivalent of the turtle blaming calculus after losing the race to Achiles.

<comment><USER13> I don't see how your series or resistor examples are particularly relevant: neither mathematical nor physical facts are human inventions. The packaging is, but I'd argue that the packaging for both _is_ relatively intuitive for someone likely to be encountering them.

For this example, there is a large amount of intuition both from C specifically and more broadly in programming (i.e. the background of people likely to be encountering this) that foo(bar) is a function call that evaluates all its various components. The syntax used for many "calls" of sizeof violate this intuition. The uniformity that leads to this corner case may indeed be the right choice (and probably actually is, IMO), but discarding intuition---and assuming everyone is a robot who's memorised all corner cases of their tools and never makes a mistake---is dumb, especially in a relatively restricted domain like programming where there is a reasonable set of common/shared assumptions to build on.

Lastly, the "a good carpenter never blames their tools" sentiment is also dumb, as a universal guideline: tooling can be objectively bad and unhelpful, and, even if someone can make it work, there will be downsides. Taking things to the limit, it's clear that "C but instead of text, just write down the UTF-8 encoding of a file as one huge base-10 number" would be an actively bad programming language and lead to all sorts of problems over normal C. The same thing holds for, say, C compared to other tools: people make objectively more of certain particularly bad classes of errors when writing C because the tool isn't helpful enough.

<comment><USER28> > I don't see how your series or resistor examples are particularly relevant: > neither mathematical nor physical facts are human inventions.

Mathematical facts are a very human invention, just like the _trans_ istor. I picked calculus precisely because intuition based on physical observation gives the wrong answer nine times out of ten.

> assuming everyone is a robot who's memorised all corner cases of their tools

But this is not a corner case! I'm not talking about an obscure quirk (God knows how many C has!), this is _literally_ syntax, the first thing you learn about a language!

<comment><USER13> _> _trans _istor_

(Whoops, but my point still stands just as much.)

 _> Mathematical facts are a very human invention, just like the transistor. I picked calculus precisely because intuition based on physical observation gives the wrong answer nine times out of ten._

I think I didn't convey my point very well: humans and their intuitions have no influence over the value of the mathematical series 1 + 1/4 + 1/9 + ... nor do we have any influence over the behaviour and interactions of certain doped (etc.) silicon. Both of these just are, outside the influence of humans.

Certainly, for the former, we have control over the syntax we use ("the packaging")/how we write it down, but, say, changing what "1" means changes the series to a different object. In any case, control over the syntax is _exactly_ like a programming language, and indeed, mathematical notation is very similar and it's great when people have sympathy for the reader's intuition (and their own) when designing new instances. (The ⌈x⌉ notation for the ceiling of x is a nice example of this working well.)

Similarly for a transistor, humans can decide how we put the bits of silicon together, and what wires we connect up, but we absolutely cannot decide the fundamental principles that make them work. This means, if we want a certain behaviour, we're limited by what physics can do.

 _> But this is not a corner case! I'm not talking about an obscure quirk (God knows how many C has!), this is literally syntax, the first thing you learn about a language! _

Yes, you're right `sizeof(foo)` is syntax... that looks a lot like `function(foo)` but behaves differently with respect to any side-effects in foo. As I said above, I do actually think this was a reasonable choice on C's part, but it seems silly to, seemingly, dismiss any possibility that it could be confusing & that maybe future languages/language designers should avoid doing this (or at least explicitly think about the choice they're making) and instead just repeat RTFM over and over.

</comment></comment></comment></comment></comment></comment></comment><comment><USER29> Many people comments can be reduced to "Yes, you can shoot yourself to the foot. Don't do that".

The problem, however, is whether we call ourselves "engineers", and not just "coders". Real world engineers take responsibility for anything related to their project, even if it's not their job.

Flying instructors often teach "everyone is stupid for 15 minutes a day". That's why every plane control is made to prevent errors, even if other prevention measures failed. Of course, we often don't need that kind of reliability in computer programming.

But in cases when we really do "engineering", and not just "programming", we want to prevent shooting to the foot, even when user points out gun to their foot and pulls the trigger. That's why they put safety switch on guns.

</comment><comment><USER9> File under:

"When I poke myself in the eye, it hurts."

I don't think in 40 years of programming in C and C++ I have ever seen an example of someone doing something with sizeof() quite that weird, and I've seen plenty of weird things.

Plus one for the happy ending that they won't be doing that again.

</comment><comment><USER30> Is this a pitfall people actually fall victim to? It's an interesting corner case, to be sure, but has anyone been bitten by it in real work?

<comment><USER31> I doubt it. Expressions like this raise all sorts of red flags in code review.

</comment></comment><comment><USER32> C is OK: it is not your friend, it is a tool.

</comment><comment><USER33> I don't understand why this would come up. When would you ever use ++ on the result of evaluating an expression.

Edit: Now I see the issue. Still, this should be easy to avoid. Don't use expressions with side effects as the input to a macro.

</comment><comment><USER34> > sizeof (char[i]) is equivalent to i * sizeof char, and will be evaluated at > run time.

Correction: _sizeof working_array_ is equivalent to...

<comment><USER34> my bad, "sizeof (char[i])" actually works!

</comment></comment><comment><USER35> Jamming `++` and `--` everywhere is bad. Don't do it. Hooray we can use C again.

</comment><comment><USER18> > _The length of the working array depends on the value of i._

Not classic C90; only the brain damaged C99 dialect.

Prior to C99, _sizeof expr_ is a constant expression, always.

You can easily program in C90. Plenty of currently maintained or even new projects are C90 only.

If using gcc, use _gcc -ansi_ or equivalently _-std=c90_ , and there you are.

There is a way to detect (albeit at run time) when a macro is given an expression which contains side effects. This:

[http://git.savannah.nongnu.org/cgit/kazlib.git/tree/sfx.h](http://git.savannah.nongnu.org/cgit/kazlib.git/tree/sfx.h)

compile the sfx.c into your code, along with the except.c and hash.c modules. Then you can use the SFX_CHECK macro in your macro bodies. For instance, the dict.h header file uses it like this:

      #ifdef KAZLIB_SIDEEFFECT_DEBUG
      #define dict_isfull(D) (SFX_CHECK(D)->dict_nodecount == (D)->dict_maxcount)
      #else
      #define dict_isfull(D) ((D)->dict_nodecount == (D)->dict_maxcount)
      #endif

If the debugging is enabled, and some place in the application calls dict_isfull(d++), then there will be a diagnostic, thanks to code generated by SFX_CHECK(D), which parses the expression (or pulls the parse out of a cache) and then diagnoses based on the results. Unfortunately, this is a run-time check: the expression has to be stepped on.

(A bit of work could turn this into a static system. E.g the macros could spit out a special annotation, then the output of gcc -E could be collected and post-processed to look for the annotated material and determine if there are side effects.)

I wrote this in around 1999 and it hasn't been maintained since.

The parser has to work with incomplete information and hence deal with ambiguities. For instance (a)(b) could be a function call or a cast of (b) to the type (a). We don't know and so we have to conclude that this is a "maybe side effect" (function call). In the face of ambiguities, we parse the expression multiple ways. If it parses correctly in two ways, we conclude pessimistically: if one of the ways of parsing it suggests there is a side effect we go with that. If errors are encountered in some of the parses, backtracking takes place, and this is done with the help of exception handling, which is built on setjmp/longjmp.

</comment><comment><USER36> It shouldn't be too hard for compilers to warn about this, I think.

</comment><comment><USER37> C of course is not your friend, C is always computer's friend.

</comment><comment><USER38> c is not your friend as a knife is not.</comment>


Call for acid-bath stem-cell paper to be retracted - <AUTHOR> http://blogs.nature.com/news/2014/03/call-for-acid-bath-stem-cell-paper-to-be-retracted.html

<comment><USER2> I'm uncomfortable with the sweeping-generalizations of this comment from the article, but I do think there's some insight to it concerning independent thinking and science. Science is a creative endeavor:

Steve Jackman said:

"Foreigners have an image of the Japanese as very thorough, detail-oriented, and meticulous. However, my experience in Japan over more than a decade has been just the opposite of this. Things got so bad at my Japanese company that everytime I would check my Japanese subordinates' work, for me it was never a matter of if I would find mistakes, but how many mistakes would I eventually end up finding. Many of these were due to pure sloppiness, carelessness, an inability to think independently, critically or to ask questions, a blind allegiance to protocol and heirarchy, and a fear of being perceived as a troublemaker or someone who is not a team player.

"This helped me understand why Japanese companies place such importance on manuals, rules and doing things by the book, since the Japanese are usually very good at following rules that have been written down for them. This style may work well for manufacturing industries, but not for research, STEM fileds (Science, Technology, Engineering and Maths), or in the knowledge and service industries of the future."

<comment><USER3> Isn't then the solution to write a manual that tells people precisely how and when to be creative and lays out a protocol for raising issues? One that looks like a very rigid structure, but in fact allows for good creativity.

<comment><USER4> and some would argue that you place a lot of focus on the artifact (manuels) than on creative thought.

</comment></comment></comment><comment><USER5> Here is commentary from the group blog by science journalists _Retraction Watch_ on this story, "Co-author of controversial acid STAP stem cell papers in Nature requests retraction: report":

[http://retractionwatch.com/2014/03/10/co-author-of- controver...](http://retractionwatch.com/2014/03/10/co-author-of- controversial-acid-stap-stem-cell-papers-in-nature-requests-retraction- report/)

Stem cell research is a "hot" research area, because it can be hyped as a cure-all, so we should all be especially skeptical of initial reports on new stem cell research. In general, we have to distinguish submissions to Hacker News based on press releases (there are way too many of those) from review articles by experienced researchers that digest the primary research done by a variety of researchers around the world. The latter kind of submission (a review article from a peer-reviewed journal or a book chapter from a practitioner's handbook) would be an excellent submission to Hacker News if it has a link that lives online for free reading, but it would also mean reading something longer than something that can be summed up with a one-line lt;dr summary. Otherwise, a thoughtful article by a science journalist who interviews scientists besides the scientists hyping a new discovery can be much better than a new "peer-reviewed" preliminary research finding. All too often, in our haste for "news" here about medical research, all the hackers here can be led astray about what is really established knowledge in medicine.

<comment><USER6> This isn't correct, consider that the whole scientific community was excited about this paper. And why not? It was published in a good journal and there are a few people trying similar methods.

Could be big if it works, although not sure it is HN content as opposed to some biology community.

</comment></comment><comment><USER7> Everyone gives Science, Cell and Nature way too much credit. They are flashy, but tend to have less substance than other journals. Their retraction rate is also much higher.

[http://www.ncbi.nlm.nih.gov/pmc/articles/PMC3187237/figure/F...](http://www.ncbi.nlm.nih.gov/pmc/articles/PMC3187237/figure/F1/)

<comment><USER8> I'm not even going to go into why the correlation between influence and retraction rate exists, that should be blatantly obvious to any with a background in any of the sciences. Also, we want retractions, it means science works.

<comment><USER9> Retractions _are_ good in when the original paper was the best efforts of its authors. This kind of big-news nonsense paper is far less forgivable.

</comment></comment></comment><comment><USER10> PubPeer explains how their commenters helped identify some fraud there: [http://blog.pubpeer.com/?p=117](http://blog.pubpeer.com/?p=117)

So what's the role of Nature group here? Print colourful printouts of sloppily-reviewed papers? I feel somehow these "publishers" (basically, they're just glorified PDF repositories) aren't really worth the money they're getting.

</comment><comment><USER11> Again the people who say Philosophy is dead to science I say UGH learn from history. Philosophy and Ethics are still the heart of progress.

How many Scientific papers that were "peer reviewed" have we now learned that the science behind the scientific papers have seriously been lacking.

The cost is in the suffering and deaths of patients who didn't get help needed that research would have found if they didn't have to chase all these rabbit trails.

Biased and mad

PS Theology/Philosophy Degree holder and my son is named after my favorite Philosopher.

PSS My other son died of cancer (Bone Cancer) where there has been zero progress in mortality rate over the last 30 years.

<comment><USER12> I don't understand your argument at all. What does philosophy have to do with any of this? Are you claiming that if more people were to study philosophy, this would make the world more "moral", leading to less scientific fraud?

I see things like this as part of the cost of doing more and more advanced research at a fast pace. You are bound to have a few misses, but all in all you still make progress.

<comment><USER13> Popper, Kuhn etc where laying the groundwork for how to validate phenomena and add facts to our models of the world.

The black swan is a good example of this problem (i.e. what lead to why we try to falsify things.)

Without a discussion about scientific methods no science and therefore Philosophy is important.

</comment></comment></comment><comment><USER14> This is fantastic news.

I wish more blog articles and newspapers had a similar feature: not just let the author edit, but openly retract their core affirmation. Sounds like it could have been useful to Newsweek recently.

</comment><comment><USER7> Japan has a strange culture: Their scientific funding is based largely on hanging out naked at a hot spring with the guy that controls the budget.

<comment><USER15> And in US/Europe it would be going to the same parties as the guy who controls the budget. I don't see any difference in substance.

<comment><USER7> The biggest difference that I see is that women are usually invited to parties. There is a huge gender imbalance in Japanese science research, and I think the culture around funding is responsible.

</comment></comment></comment><comment><USER16> Such jealousy in academic land...

<comment><USER10> Academics have dug their own grave here. They keep pushing for last century's publishing model and then they use this publishing model to gauge their own academic value.</comment></comment>


Show HN: Learn Texas Hold'em Math, Master the Game - <AUTHOR> https://www.pokergym.com/

<comment><AUTHOR> Hi,

We created this site after trying to learn the theory found in most Poker Math books. Rote memorization of equations didn't cut it -- so we created this interactive site instead, thinking it might be useful to others.

Let us know your thoughts!

Thanks

P.S. The site's name is _PokerGym_ \-- the HN spam-killing bot didn't seem to like stories with "Poker" in the title.

P.P.S. We use poker-eval (through its Python bindings) to dynamically generate training questions. Here's a nice intro to it on Coding the Wheel:

[http://www.codingthewheel.com/archives/a-pokersource- poker-e...](http://www.codingthewheel.com/archives/a-pokersource-poker-eval- primer)

<comment><USER2> Congrats. It looks great.

Some feedback here after doing the first demo.

I expected that every lesson would contain a practical example. In the demo, it's good to know that you have 9 outs, but the real objective is knowing that you shouldn't call a bet unless the pot odds are above certain value. Otherwise, this lesson alone doesn't quite teach much.

Also, even if you didn't prepare more lessons (I guess you'll wait to see if it picks up traction), I'd have liked to see some more lessons, even if marked with a "coming soon" sign.

<comment><AUTHOR> Thanks for the feedback. The demo linked from the home page is much more a demo of the site's "abilities" than a full course.

Once you finished the demo, did you try going through a "Learning module"? (tip: you don't really have to register... simply click the PokerGym logo in the upper-left corner). There are two courses which are fully available -- Counting Outs and Combos.

If you're signed in, you should see them on this page:

<https://www.pokergym.com/dashboard/>

</comment></comment></comment><comment><USER3> I really like the tutorial style of the lessons and the smoothness of the UX. I am not a poker player but I just recommended it to a friend who plays a lot. Nice work!

</comment><comment><USER4> This look sick and I LOVE your funnel - Quickly show how it works, register and then sell. Def. will check this out!

<comment><AUTHOR> Thank you! It seems to be working -- our conversion rate from homepage to registration is about 10% (although it's very early, and I'm basing this off a few hundred uniques). Still hoping to hit the HN homepage :-)

<comment><USER5> I felt hornswaggled when I finished the first one and saw that the next one costed $4.99. I had just signed up too. When I clicked to try it I did so because it clearly stated "You can only get better, and it's free." However this was a flat lie. I looked for a way to delete my account but could not find one. I felt deceived.

I just checked back at the site without logging in and it even says "Save your progress to unlock" for the next modules. "Save your progress" is a euphemism for "sign up" and then when you do that it doesn't actually unlock. $4.99 unlocks the module. Wow.

<comment><AUTHOR> Hi jrode,

Sorry that the site left a bad impression on you. We were trying to get across that "it's free" applied to the fact that "trying it" (the main action) was free. We'll make this clearer.

By the way, we will have more free courses (there are two which are completely free right now). It's just a matter of time.

Sorry also about not having a way to delete your account -- it was an oversight, and it will be corrected.

Finally, you're right that the "Save your progress to unlock" copy is, in fact, incorrect. We'll make sure to get it right.

Thank you for your feedback!

<comment><USER5> Hey, thanks. I really liked the site by the way, it is very nicely done. I also understand why you would charge for the modules, and you should. Just thought it could be more clear. Again, thanks for responding.

</comment></comment></comment></comment></comment><comment><USER6> Good job ! It is an awesome website to learn and practice, I will become a pro in a matter of time :D

A.

</comment><comment><USER7> I've been waiting to learn Poker for some years. I've no reason to didn't start right now with this!

<comment><AUTHOR> We'll have more beginner courses as well in the future, although the Counting Outs course (the first one) shouldn't be too hard. Let us know what you think! Thanks

</comment></comment><comment><USER8> Even though I know Greg I dont think I'm biased in saying that it is a pretty awesome way to get better at poker! I've completed the first two modules and learned a lot of cool tricks (like rapidly calculating your outs)!

</comment><comment><USER9> Awesome! Great UX. It is like <http://duolingo.com> or <http://www.memrise.com> for Poker. :)

<comment><AUTHOR> Thank you! Shout outs as well to <https://www.shortcutfoo.com/> and <http://www.codecademy.com/>

</comment></comment><comment><USER10> Great job on that HTML table.

</comment><comment><USER11> Just in time for CES :)</comment>


Middle-Aged Users' Declining Web Performance - <AUTHOR> http://www.useit.com/alertbox/middle-aged-users.html

<comment><AUTHOR> Nielson raises an important problem but completely misses the single most important issue: font size. As resolutions get tighter and fonts get smaller, who suffers? Those with far sightedness. It must be a pain in the butt to put your glasses on or off depending on how well that web page designer understands the problem.

Guy Kawasaki deals with this here:

<http://blog.guykawasaki.com/2005/12/the_102030_rule.html></comment>


Fred Wilson: The Quandary - <AUTHOR> http://www.avc.com/a_vc/2010/01/the-quandry.html <comment><USER2> I think smartphone users, particularly those on Android, need to give Voice Recognition a serious look. It's one of those technologies that has quietly gotten better and better in the background even after a lot of people wrote it off.

I use Voice Text ([http://androinica.com/2009/07/29/voice-text-turns-your- speec...](http://androinica.com/2009/07/29/voice-text-turns-your-speech-into- text-in-android-apps/)) and couldn't be happier (Yes there are still errors but you can dictate a full paragraph and then just fix the 3 or 4 wrong words)

<comment><USER3> I agree about voice recognition getting _much_ better.

My business partner's wife is visually impaired, and he wired up his house with a whole-house stereo, mics in each room, and a speech recognition daemon, attached to each mic. He then wrote a huge pile of scripts for things his wife might need to do.

Now she can ask the house about the weather, control the thermostat, check the status of the garage doors and locks, turn on/off lights, open/close blinds, make phone calls, change the music, and a few other things I can't remember.

It's all a tad too expensive to be a commodity, but overall I believe it cost him something in the $40k neighborhood, which is _incredibly_ reasonable for something that makes his wife far more autonomous.

</comment></comment><comment><AUTHOR> A business opportunity - an efficient input device/method for mobile devices?

<comment><USER4> I often take photos of textual signs for use later. Take it to the next level: OCR text from the built-in cameras. A friend suggested OCR from live video was even possible (on an iPhone!) My vision was being able to enter text by scribbling something on a napkin, and OCR'ing the text in.

Another cool method is Dan Bricklin's Note Taker (<http://news.ycombinator.com/item?id=997264>) Just need to add OCR.

Now, my experiments with OCR algorithms didn't work too well. Apparently the training data is the most important component.

Handwriting recognition is also possible, but still images lack the very useful stroke info.</comment></comment>


ShowHN:(my weekend hack): SafariShot: Screenshots like it's running on a mac - <AUTHOR> http://ksat.me/safarishot-your-webpage-on-safari-on-osx/

<comment><USER2> Even though the intent is to make the screenshot look more professional, there is a flaw that makes the result look unprofessional. The flaw is that the text in the title bar and the location bar isn't rendered as it would be on a Mac. See the difference in this reference screenshot I found: [http://macamour.com/blog/wp- content/uploads/2008/06/safari4_...](http://macamour.com/blog/wp- content/uploads/2008/06/safari4_screenshot.png).

Here are the problems with the text rendering that I could spot:

• The current text has too much hinting and not enough anti-aliasing. Use different font smoothing settings in whatever code you're using to overlay the text.

• The font appears to be Aktiv Grotesk, but should be Lucida Grande.

• The baseline of the URL text is not aligned with the baseline of "Google" in the search bar.

On the other hand, the light-gray-shadow embedding effect of the title looks good.

As a side note, the explanatory text has very many small grammar and capitalization errors. Getting the text revised by a friend might help. But it's not too bad, because the controls are really all you need to use the site, and the controls are explained pretty clearly.

Also, I like the fact that you give default values for everything, so you can see exactly how the app works without digging around for an image.

<comment><USER3> Would the average person who prefers "professional" screenshots be able to tell the difference between Aktiv Grotesk and Lucida Grande? You have a sharp eye, but I would think 99.9% of the population looking at these screenshots would not complain about Aktiv Grotesk.

<comment><USER2> Actually, from looking at the generated image, I was only able to tell that the font looked vaguely "wrong". I found out it was specifically Aktiv Grotesk only by going through many steps on Identifont: [http://www.identifont.com/identify?22+%20+9J+39+1R6+26RB+4PW...](http://www.identifont.com/identify?22+%20+9J+39+1R6+26RB+4PW+2L+G39+8W+30D+2BT+42+1U9+1KU+53K+4A+19+6X5+1R0+1KK+1T+9Z).

But still, I agree that most people would probably not notice the font being off at all. And the font smoothing difference jumps out at me the most; if the use of Aktiv Grotesk was the only difference from real Safari, I might not have noticed anything.

</comment></comment></comment><comment><USER4> The reason Safari screenshots may be considered more "professional" looking may also be the reason it is my preferred browser - the interface chrome is minimal and monochrome, making it easier for me to focus on the content.

<comment><AUTHOR> Yeah thats true. But frankly I never got why practically "everybody" takes their screenshots on a mac - It's almost like I've to go buy a mac just to take the screenshots and do my screencasts.

P.s: I did buy a mac last year.

<comment><USER5> One of the reasons is that type looks much better on a mac.

<comment><USER6> In general, I agree that Helvetica looks much prettier on a Mac than on Windows (one of the main reasons I despise seeing font- family:Helvetica,Arial,sans-serif; on pages). Some other fonts don't look too bad on Windows, though.

I don't know much about font rendering; this is just what I've noticed. For what it's worth, some screenshots of the same text with font-family set to Helvetica [0], Myriad Pro, and Segoe UI on Windows 7, Firefox.

Helvetica(/Arial): <http://snag.gy/Jneor.jpg> Myriad Pro: <http://snag.gy/f2IJx.jpg> Segoe UI: <http://snag.gy/ujvpX.jpg>

[0] This actually defaults to Arial, I believe, because afaik Helvetica is not bundled with Windows. (Is there no way to use asterisks on HN?)

</comment></comment></comment></comment><comment><AUTHOR> Hi OP Here: Safarishot is a Js tool that will wrap your screenshots (taken on any os) in a nice safari window running on a mac.

<comment><USER7> add the ability to go grab the screenshot (just give it the url) and you've got a winner

<comment><AUTHOR> :), thanks, that'll cost server resource. I don't know if I can run it for free. I'll try though

</comment></comment></comment><comment><USER8> Neat idea. But cannot save my image on chrome

<comment><AUTHOR> Hi. Thanks. Yeah noticed that too. Seems like bug in chrome? Can you try on firefox. That's the one where everything seems to be working just fine. reading localfiles, canvas and save image.

</comment></comment><comment><AUTHOR> Why was this article removed from HN home page?</comment>


William Gibson reads Neuromancer, from tape to mp3 - <AUTHOR> http://www.bearcave.com/bookrev/neuromancer/neuromancer_audio.html <comment><USER2> for x in 1 2 3 4 ; do for y in a b ; do

wget [http://www.bearcave.com/bookrev/neuromancer/Tape$x$y.mp3](http://www.bearcave.com/bookrev/neuromancer/Tape$x$y.mp3)

done ; done

</comment><comment><USER3> Nice work, thank you.

Well except for the comment about The Difference Engine. That's a great book! :)

<comment><AUTHOR> I can't take the credit, I'm merely a finder, not the author :)</comment></comment>


Flickr ditches Yahoo requirement and 1TB free storage, makes Pro unlimited - <AUTHOR> https://venturebeat.com/2018/11/01/flickr-is-ditching-yahoo-account-requirement-and-giving-pro-subscribers-unlimited-storage/ <comment><USER2> front page: [https://news.ycombinator.com/item?id=18354066](https://news.ycombinator.com/item?id=18354066)

</comment><comment><AUTHOR> Original title: _Flickr ditches Yahoo account requirement and 1TB free storage, makes Pro plan unlimited_ (7 characters too long).</comment>


On California, Don't Believe the Hype - <AUTHOR> http://online.wsj.com/article/SB10001424052748704586504574654673186751100.html?mod=WSJ_hps_sections_personalfinance <comment><USER2> What's with this silly idea that states "deserve" to get back whatever money they pay in federal taxes? Federal taxes aren't levied against states, they're levied against people. And even personally, there's no guarantee that you will get back in benefits every dollar you've paid in taxes. Sorry, it just doesn't always work that way.

It's like arguing that I shouldn't have to pay school tax because I'm not in school (hint: then it's not a school tax, it's tuition). Or that the people who have never had a house catch on fire got ripped off because their tax dollars funded the fire department anyway.

<comment><USER3> One big argument for why you should have to pay school tax even if you don't have kids is the positive externalities of public education; you benefit from other people's kids getting an education, so you should pay for that.

There's a similar externalities-based argument for why some states should be net tax donors to the federal government, but I think it's a little weaker. How much does California benefit from New Mexico or Virginia being a net tax recipient?

<comment><USER4> <http://www.taxfoundation.org/research/show/22685.html>

In 2005, Californians paid out $35.9 billion and received back $31.2 billion. That's a gap of $4.7 billion. That's a lot.

Do you think the amount of money the state receives indirectly from tech companies run by Americans educated in out-of-state colleges exceeds this amount? The figures for this are much harder to come by, but I suspect that the state makes back at least a same-order-of-magnitude amount of what it pays out.

According to wikipedia, there were 386,000 tech workers in the Bay Area in '08. If we assume that half of them are Americans from out of state, then they'd have to pay about $5000 in taxes a year to make it worth it, assuming that there's also a multiplier of 4 due to workers in other industries being hired to serve them.

Of course, all this assumes we're running on a "we pay you taxes in exchange for your nerds" model, and it may be more complicated than that.

<comment><USER5> California actually paid out $289 billion and received $242 billion for a net outflow of $47B.

[EDIT] Colorado was the state the paid out $35.9 billion and received $31.2 billion.

</comment></comment></comment></comment><comment><AUTHOR> California _does_ have tremendous wealth and vast continuing productive capacity, given the talent, resources, and opportunities extant within the state, and the author correctly characterizes any doomsday scenario as lacking credibility.

The problem, though, as seen from the view of one who has lived here for 40+ years, is that the powers that be in Sacramento had too much of a good thing during the boom years and, having raised public spending by large amounts when the tax coffers were full and exploding, don't want to make any systemic changes to spending levels now that receipts are way down in fear that this will short-change their pet programs when good times return.

That is why spending is strained to the limit even though fundamentals are still pretty good. The assumption all along, though, is that nothing can kill the golden goose and, while I agree with the author of this piece that extreme problems aren't imminent, that doesn't mean that the state can't ultimately wear itself down through fiscal irresponsibility. Only time will tell in the long term on this point.

<comment><USER6> I always wonder why state spending isn't limited to, say, the average of the last 10 years receipts.

Of course, if there was surplus, it'd go into a fund, and politicians would vote to spend the surplus.

</comment></comment><comment><USER7> The problem with California is not that it is taxing too much, but that' it's spending too much. The fact that it's taxing isn't much above average indicates the huge disparity between the two which caused the debt.

<comment><USER8> Care to back that statement up? Does California get more services for its money than lower tax states? Do workers get better protection?

Maybe the problem really is that the costs of these services have gone up but the taxes haven't been adjusted to deal with that.

</comment></comment><comment><USER9> That's because Kazakhstan is sitting on top of a known twenty billion barrel oil field controlled by a government monopoly. At $70/barrel that gives them 1.4 trillion dollars of liquid assets (literally). Between that at 100 trillion known cubic feet of gas (at $5-$10/1000 cubic feet, do the math) I wouldn't be too worried about them defaulting on their debts. California, on the other hand...

</comment><comment><USER10> It's not just the size of the debt that's worrying, it's the reasons why we have the debt.

<comment><USER11> I propose an amendment to the state constitution mandating...

</comment></comment><comment><USER12> This article scares me.

Why?

Because looking at a few samples of Mr. Arends's work, and comments on it, he seems to be way out of touch.

see these examples: Who's paying Brett Arends to malign Apple? July 21st, 2009 [http://www.roughlydrafted.com/2009/07/21/whos-paying- brett-a...](http://www.roughlydrafted.com/2009/07/21/whos-paying-brett-arends- to-malign-apple/)

Load Up the Pantry by Brett Arends Wednesday, April 23, 2008 [http://finance.yahoo.com/banking- budgeting/article/104914/Lo...](http://finance.yahoo.com/banking- budgeting/article/104914/Load-Up-the-Pantry)

Why Apple Shouldn't Pay a Dividend January 11, 2010 by Felix Salmon [http://seekingalpha.com/article/181974-why-apple-shouldn- t-p...](http://seekingalpha.com/article/181974-why-apple-shouldn-t-pay-a- dividend?source=feed)

I could undoubtedly find a few more, possibly even some in favor of his thinking - these are just from the first page of a Google search on brett arends.

</comment><comment><USER13> is anyone actually under the impression that ruling people (read: the ability to tax them) isn't insanely profitable? just because the books aren't balanced? california is one of the most productive places in the world per capita wise.

</comment><comment><USER14> Wow. The last sentence made the author sound like a liberal Rick Perry!</comment>


Startups with offices: what about phones? - <AUTHOR>

So there are all these expensive business-plan phone systems with all kinds of features. Do you actually end up needing all that crap? What kind of phone system does a small web startup really need? <comment><USER2> Mobile plan.

Free nights and weekends.

</comment><comment><USER3> VoIP + Asterisk is the way forward. With a cheap linux server and cheap SIP phones or adapters you can easily do nearly everything an expensive phone system can do if you really need it.

Asterisk does need a bit of setup but it's not that hard for someone technically minded.

BTW, If you do any kind of conference calls get a proper conferencing phone, they are kinda expensive but so much better quality than speakerphone on a normal phone.

</comment><comment><USER4> No need for fancy phones unless you are a heavy telephone sales operation. A web startup ought to be able to get away with mobile phones or a Vonage line (well until they die anyway). At Triggit we use vonage.

</comment><comment><USER5> Previously employer used Cisco VoIP phones over SpeakEasy service. Phones themselves were ok; the service sucked. We had several outages and recurring problems with sound quality.

</comment><comment><USER6> We're just using Skype for conference calls. The cost of SkypeOut and SkypeIn is something like $20/year or something. Works fine for us.

</comment><comment><USER7> getjive.com - $30/month/phone, all the big-business looking features you'll need. We use them and they've been great.

</comment><comment><USER8> Why bother with a fancy phone system? Who calls you? Do you call each other in the office? Do you want to appear as if you all have extensions?

This is kind of pointless. A mobile phone is fine. Get GrandCentral or an online fax/voicemail number to set up a layer of control.</comment>


Is Enlightenment Compatible with Sex Scandals? - <AUTHOR> https://slatestarcodex.com/2019/10/16/is-enlightenment-compatible-with-sex-scandals/ <comment><USER2> Not according to the Pali suttas.

<comment><USER3> Which texts exactly?

<comment><USER2> Theravada [https://www.dhammatalks.org/suttas/SN/SN35_127.html](https://www.dhammatalks.org/suttas/SN/SN35_127.html) [https://www.accesstoinsight.org/tipitaka/mn/mn.060.than.html](https://www.accesstoinsight.org/tipitaka/mn/mn.060.than.html)

Mahayana [https://www.buddhismuskunde.uni- hamburg.de/pdf/5-personen/an...](https://www.buddhismuskunde.uni- hamburg.de/pdf/5-personen/analayo/sixfold-purity.pdf)

<comment><USER3> I appreciate the links. Thank you! But can you point me to what they say about enlightenment being incompatible with sex scandals? I looked, but didn't see it.

In case it helps, I'm genuinely interested. It seems to me that if enlightenment is a thing, there's no reason to assume that it necessarily goes along with conformity to conventional morality. In fact it seems likely that such a person would be less constrained, because less subject to fear of social pressure. But I don't know.

<comment><USER2> Enlightenment, in the Buddhist definition is not the abandonment of morality, it follows its perfection. Thats why monks are required to be celibate.

From the second link above;

"Abandoning uncelibacy, he lives a celibate life, aloof, refraining from the sexual act that is the villager's way."

Also, see this sutta, as per point 9:

[https://www.accesstoinsight.org/tipitaka/mn/mn.022.nypo.html...](https://www.accesstoinsight.org/tipitaka/mn/mn.022.nypo.html#fnt-6)

Enlightenment is the abandonment of sense desire, among other things.</comment></comment></comment></comment></comment>


Show HN: Make your Shelter at Home more Delicious - <AUTHOR> https://www.wfhcave.com/ <comment><AUTHOR> This is a v2.

For the first version, I made this for people to share wfh desks. After 1 week and around 70 visits, not a single person shared their desk picture.

Now pivoting to sharing recipes / what people cooked during shelter at home. Idea is to keep pivoting until I find something that sticks.

Any ideas or suggestions would be appreciated!

</comment><comment><USER2> Maybe you can expand the theme to include interesting things folks are doing at home (in addition to cooking). You could also pull in interesting posts automatically from the social sites like twitter and instagram. Looking forward to more updates!

</comment><comment><USER3> Teaspoon is one word.

<comment><AUTHOR> :-) my friend (and also myself) are non native english speakers. lemme fix it. thanks for pointing that out.

i do similar mistakes around "every day" kinda words. spell suggest helps a lot!</comment></comment>