Forcing the password gropers through a smaller hole with OpenBSD's PF queues - <AUTHOR> http://bsdly.blogspot.com/2017/04/forcing-password-gropers-through.html <comment><USER2> I used to do something similar for porn-site visitors when I worked at a school. Discipline was not well-enforced, I had zero authority as the IT guy, and when I blocked a porn-site in the proxy, they all moved to another one within minutes (it's not as though the Internet was going to run out of them anytime).

Solution was to make a squid queue with about 1KB/sec bandwidth, and dump the most-visited porn websites into that queue. Sure, you'll get your smut, after about 10 minutes per pic download time. This worked far better - it was a bit like shadow-banning the website, in that they wouldn't be notified it was blocked, it just would be (to all intents and purposes). AFAIK, they never figured it out.

<comment><USER3> I'm not sure if I understand. If they are operating through proxies, shouldn't the network admin be unable to MiTM them without a client-side cert? So, banning a list of websites should not work. What am I missing?

<comment><USER4> It sounds like OP is actually the one in control of the proxy (think enterprise-grade ones rather than proxy sites like hidemyass.com).

Even if that weren't true, one could always just throttle the proxy as if it were a porn site.

</comment></comment></comment><comment><USER5> There are a _lot_ of systems that can follow this style of approach to dealing with the baddies. Bear in mind our gear these days have huge amounts of RAM and a fair bit of CPU. We have kernel based firewalls that can handle utterly huge tables and highly sophisticated queueing mechanisms. Heading into userspace we have mailer daemons a plenty, Squid, HA Proxy and the like, all of which can be used in this way.

For example if you enter three bad usernames into a certain Exchange OWA I manage, then HAProxy sends you off to a fake login page and I hoover the data. If you enter a legitimate username but multiple incorrect passwords then the same thing happens. The fake login page runs rather slowly but not too slow. IPs that fail are fed to the firewall. I maintain a whitelist of IPs for users that have a static IP at home. If a legitimate user falls foul of that lot, they are reminded about VPNs.

Funnily enough simply ratcheting up your TLS to 1.2 minimum fixes an awful lot of cracking attempts. Older unpatched systems simply can't even connect, let alone try to login. Sadly this wont be an option for many orgs (someone will insist on owning some wanky old thing and be too stingy to upgrade it and have enough clout in the firm to foil you) but as I happen to own mine I get to lay down the law 8)

</comment><comment><USER6> I use pam_shield for something somewhat similar on Linux boxes. It's a more direct approach than something like fail2ban. Just null routing the offending IP addresses though. I suppose traffic shaping would do more to help others by keeping the bot occupied. Maybe I need to look into how /sbin/tc works.

</comment><comment><USER7> This limiting approach is new to me. Why not just drop current and block future connections?

<comment><USER8> It looks to me like the equivalent of keeping telemarketers on the phone in an inane conversation instead of immediately hanging up on them. The latter just frees them up to call the next victim.

<comment><USER7> In that case I'm not sure if it works. I fully expect the spammers to have the software to deal with similar behavior. In contrast with telemarketers the computers multitask pretty well.

<comment><USER9> there is still an upper limit to the number of TCP connections an IP can open.

sadly this does remind me of that photo of a Darth Vader with a Brita water filter in a large body of water.

you're not really going to have an impact, but you are doing _something_

<comment><USER10> Just in case you're really lazy: [https://www.google.com/search?q=Darth+Vader+with+a+Brita+wat...](https://www.google.com/search?q=Darth+Vader+with+a+Brita+water+filter+in+a+large+body+of+water&tbm=isch)

</comment></comment></comment></comment></comment><comment><USER11> I spent some time providing huge tarpits to SPAMmers also (I get about 10k SPAM delivery attempts per day on my small SMTP server), but in the end I've had to spend my time on other things...

</comment><comment><USER12> Interesting read from a great author, I can highly recommend his Book of PF if anyone is interested in knowing more.

</comment><comment><USER13> I just whitelist my ip ranges, and anything else gets dumped into a honeypot (using ipset lists).

<comment><USER14> More cynically, just block everything from China and you've covered 95% of the attacks (based on the stats reported in the article).

<comment><USER15> China, Russia, Eastern Europe,South America.

<comment><USER16> [https://securitytoday.com/articles/2017/03/03/top-5-countrie...](https://securitytoday.com/articles/2017/03/03/top-5-countries- where-cyber-attacks-originate.aspx)

The United States is the #2 top source of cyber attacks, accounting for about 10% of all malicious traffic in the world and with 17.12% of cyber attacks initiated from there.

What you need to look at is how much of the traffic that hits your servers specifically is malicious relative to the amount of traffic that is bringing you revenue. Then you decide what countries to block.

</comment></comment></comment></comment><comment><USER17> Interesting read, thanks for posting!

<comment><USER17> Did I break HN post regulations for this comment? (Just trying to figure out why I had 5 down votes in the interest of not breaking it again if I did).

<comment><USER18> Your comment looks pretty innocuous to me. Only thing I can think of is that it doesn't add much to the conversation. Members may have downvoted for lack of substance. Adding reasons you found it interesting, pointing out things in particular would make a good contribution to the discussion. It's speculation, but I hope it helps.</comment></comment></comment>


Automakers Knew of Takata Airbag Hazard for Years, Suit Says - <AUTHOR> https://www.nytimes.com/2017/02/27/business/takata-airbags-automakers-class-action.html <comment><AUTHOR> I work in healthcare patient safety and study safety in industries such as aviation, nuclear power, oil & gas, and auto and airplane design among others.

Even luxury brands such as BMW (in the article) and Lexus, Mercedes, and Audi were affected.

Not affected: Volvo and Subaru

Additional background information of how other airbag vendors refused to use the cheaper, unsafe and unstable propellant:

[https://www.nytimes.com/2016/08/27/business/takata-airbag- re...](https://www.nytimes.com/2016/08/27/business/takata-airbag-recall- crisis.html)</comment>


iOS 6 fixes bug that sent iMessages to stolen iPhones - <AUTHOR> http://arstechnica.com/apple/2012/11/ios-6-fixes-bug-that-sent-imessages-to-stolen-iphones/

<comment><USER2> From the comments:

 _Is it me or is it slightly worrying that they seem to have implemented these changes at a client level, meaning that someone could by-pass them with custom software, instead of doing it properly and having the server refuse to send out messages once the phone has been wiped / unregistered?

Surely all of this is a backend thing and should not have any client component at all._

<comment><USER3> A reasonable service would have the list of connected decices available online for you to disable any of the devices at any time (as well as obviously removing a device when it's reported stolen). However knowing apple they'd put it in iTunes instead of making it a website (super useful if you're traveling without your computer!), and more likely they just won't do it all.

<comment><USER4> You have a list of your registered devices on iCloud.com, but I don't know what effect removing a device there has on the device's connections to various Apple services.

</comment></comment></comment><comment><USER5> It's always boggled me that mobile operators (and the Police) do very little to help try and trace stolen phones, or share IMEI block lists amongst operators.

Tying stolen IMEIs to IMSIs (when the phone is sold on or reused) should lead to a large number of recovered phones as not every stolen phone will be reused with a pre-paid SIM (and therefore untraceable IMSI).

<comment><USER6> Don't they do this in the UK?

<comment><USER7> There is a central blacklist of IMEIs for stolen phones. This seems to work pretty well (anecdotally, many stolen phones are sent out of the country)

I don't think that the police do anything like this for actually tracing stolen phones though.

</comment></comment></comment><comment><USER8> Were the police able to track the stolen phone down? How did they know iMessages were being sent to the stolen device?</comment>


How I hacked Gogo inflight wireless Internet with Chrome - <AUTHOR> http://blog.andrewboni.com/how-i-hacked-gogo-inflight-wireless-internet-with-chrome/

<comment><USER2> Issue spotter: I think we've got him on trespass to a protected computer system used in interstate commerce, common law fraud, and theft of services. What _other_ crimes did he just admit to that I missed? (We'll ignore that he hacked a computer while on an airplane, a detail which I would _not expect the government to be neutral about_.)

Seriously, kids: this is an _astoundingly_ bad idea.

<comment><USER3> I'm not seeing how this is at all legally problematic. AFAICT there's no TOS violation, and if there were, TOS violations don't make it a crime. The user agent is totally discretionary on the part of the browser and price- discriminating based on one is in no way an access control mechanism.

It seems equivalent to saying "red computers get charged half price", and then objecting when someone snaps a red shell on their laptop.

<comment><USER2> Do you want me to start quoting Title 18 U.S.C Section 1030 (the Computer Fraud and Abuse Act) or can you Google it yourself? There is no _possible_ reading of these facts that does not run afoul of that law, among others.

There is no affirmative defense "But it was really easy for me to exceed my authorized privileges because their security sucked" provided for in the law.

<comment><USER4> So what? Everyone of us probably runs afoul of hundreds or thousands of bogus laws every day. It's time to start encouraging people to be bolder and violate _more_ laws, as far as I'm concerned.

Now excuse me while I go listen to some Judas Priest... \m/

<comment><USER5> The idea behind computer fraud laws, and fraud laws in general, is that tricking people to obtain valuable services at the expense of the victim is dishonest. People and companies should be able to offer services assuming that their counterparties are honest. When dishonest people abuse company offerings, they impose a cost on everyone in the market. In this specific case, the prospect of fraudulent access requires the wireless ISP to spend money strengthening their security controls; the costs associated with that are passed on to the market, as are the inconveniences associated with new controls.

In other words: the law sees it as a bad thing that ISPs should have to bulletproof their offerings so that when they make a service available to phones, it isn't easy to trick those systems into providing service to computers. The law says, "it is silly that the market should have to bear the cost of that engineering, because it's undertaken solely to prevent dishonest people from obtaining undue benefit".

The only question you really have to ask here is, "am I tricking a business into offering me something with a dollar value without paying for it?" Yes? That's fraud. It's the definition of fraud.

People probably do violate all sorts of stupid laws all the time. But that's a very different point than "people commit all sorts of frauds all the time". They do not. Fraud is invariably wrong.

<comment><USER6> > The only question you really have to ask here is, "am I tricking a business > into offering me something with a dollar value without paying for it?" Yes? > That's fraud. It's the definition of fraud.

What services did he steal? He paid for wifi services for the duration of the flight. The device by which he enjoys that service should be of no consequence.

<comment><USER5> He paid for wifi services for his computer for the duration of the flight. The fact that you do not recognize the legitimacy of a commercial offering does not give you the right to invent your own terms; you take the terms as offered, or you don't do business at all.

<comment><USER6> He received what he paid for: wifi services for that flight.

I still don't see fraud here.

<comment><USER7> He paid for a WiFi connection between a _phone_ and the internet. He received a connection between a _laptop_ and the internet.

<comment><USER6> He paid for a WiFi connection between a _device_ and the internet. He received a connection between a _device_ and the internet.

If GoGo can't tell the difference between a laptop and a mobile phone, that's their problem. And no, the UA string doesn't guarantee that and there is no law that I've heard of that prevents users from altering their UA string (or anything for that matter). They showed him a price for a service on his device, and he bought that service.

<comment><USER7> Ha, good luck trying to argue that. The Gogo website makes it clear that there are separate services for phones and laptops. Their website automatically detects what kind of device you have, if they make a mistake then it's their problem if they don't offer you the means to correct it. But if you _deliberately_ circumvent their system to save money, then you're committing a fraud.

I'd urge you to learn a little more about the law if you think that a UA string specific law is needed, or even a computer-specific law. _Intent_ and _personal gain_ are more an enough.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Not sure what's less impressive. A pricing model based on browser headers, or a 10,000 word article on "hacking gogo inflight" based on changing a browser header.

<comment><USER9> Indeed. I clicked this expecting to find an interesting description of a authentication vulnerability, or a novel way to spoof, or a hidden tunnel, or something.

tl;dr: GoGo implements price discrimination in a naive way. Author "hacks" it with equally naive mechanism to save $8US.

</comment></comment><comment><USER10> On a flight to a conference we once set up our own wifi hotspot using two laptops.

We had one company gogo subscription. They connected and shared their internet through ethernet to another laptop. That laptop shared it out through wi-fi. We had 4 people using the Internet. It was awesome but fairly impractical. At least I could tweet from the clouds.

</comment><comment><USER11> This is unbelievably lame. The whole thing could have been related in under 100 words. Plus he is defrauding a perfectly legitimate service. $15 is not a ripoff. This isn't the MPAA.

It would have been acceptable if the author was 13 or something but they appear to be an adult who works for google.

What next, spoofing referer to get into porn sites? l33t d00d!

</comment><comment><USER12> You can get internet on a flight?! We live in the future!

Oh, it's $15? Nevermind.

<comment><USER13> Never mind, you can order a $20 Pepsi.

</comment></comment><comment><USER14> TL;DR: Wifi was cheaper for mobile so he changed the User-Agent header.

<comment><USER15> Should have tried the Lynx user agent

</comment></comment><comment><USER16> Really clever. Also really stupid to post it on the internet. I hope nothing bad comes your way because of it.

</comment><comment><USER17> I understand the proof of concept is cool, but why do this? High speed Internet at 35k feet isn't worth $15 to you? You said yourself it was going to be a long flight. Why hussle them out of what is one beer on a plane?

<comment><USER18> It's basic capitalism; if this "vulnerability" wasn't built into their code, would you submit to a more expensive price on your laptop when you could just as easily get half off (for the same product) on your phone?

If there were no 'hack', and I went on that plane knowing full well that I was going to purchase internet access, I would buy the half-off solution and tether to my phone.

As a user, this is a valid set of decisions. Since they're implementing this in a stupid way, it's perfectly valid to exploit their method and pay for the cheaper item.

If you went to the supermarket and found an item at $10, but you had the option of doing 5 jumping jacks to lower the price to $5, what would you do? Is it immoral to do jumping jacks?

<comment><USER19> "Since they're implementing this in a stupid way, it's perfectly valid to exploit their method[...]"

Really?

If you went to buy something on Amazon, and found they had a "stupid" vulnerability you could exploit in order to get half off of your order—maybe some Javascript hack that made the part of their system that calculated the price you pay think you actually ordered a smaller version of the product—is that immoral?

Is leaving your house or car unlocked a sufficiently stupid vulnerability to become "perfectly valid to exploit"?

<comment><USER18> Your examples break federal law; I'm exploiting Amazon's proprietary codebase to lower my prices / someone is still breaking and entering into my home. Those aren't moral because federal laws are being broken.

If Amazon charged $20 for a book if I were to buy it on my laptop, but $10 for that same book if I buy it with my phone, why in the hell would I buy it on my laptop? How is that immoral? I'm presented with two options: $10 or $20 for the same item. The company has offered me a contract of payment and I am to choose one, or I can take my patronage elsewhere. This is not a matter of breaking into a server and SQLi'ing until you can make an item free; this is the company offering me something for cheaper, depending on how I buy it.

</comment></comment></comment></comment><comment><USER20> From September 2010: [http://lifehacker.com/5650175/how-to-get-cheap-or-free- in+fl...](http://lifehacker.com/5650175/how-to-get-cheap-or-free-in+flight- wi+fi)

</comment><comment><USER13> This explains why the Internet is more expensive everyday. I shall hack my mobile so it presents as a desktop browser so I can pay full price. Every little bit helps.

Oh, and what a seriously lame article in almost every respect. Awesome interface etc etc. This was the gentle reminder I needed to push me from these mind-numbing articles. Good luck and good night.

</comment><comment><USER21> Would it be illegal to connect to the internet with your phone (pay mobile price) then tether your phone to your laptop?

</comment><comment><USER22> I'm flying to san fran from the east coast next week and specifically booked a Gogo flight in order to get work done by mile high. I saw the pricing structure on the airlines website though and I agree that it's shady. Where I'm from the law of Shade for Shade applies, shall try your method.

</comment><comment><USER23> Discuss: How do you feel about Gogo's pricing model? According to this article they charge $9.95 if they detect you're on mobile. $15.95 otherwise.

</comment><comment><USER24> GoGo sucks. Their service has been unusable on recent SFO/JFK flights. At $18 a pop, you can't even get the google home page to respond. What a joke of a company...</comment>


DeckPub alpha release, simple iPad publishing - signup code HACKERNEWS - <AUTHOR> http://deckpub.com

<comment><AUTHOR> We just released the alpha version of DeckPub.com, and we'd love to get some feedback and thoughts from the Hacker News community. You can sign up with the code HACKERNEWS.

Four of us (2 front end guys, 1 back end coder and a designer) have been working on it in our spare time for the last month and a half and we think we've reached the minimal product that we can show. Lots of iterations to come and plenty to do.

The first version of the product allows people to create great looking presentations for the iPad. Users log in, create a deck using one of our pre- created templates, upload some images, add some text and then share the link. A presentation when opened on an iPad installs to the home screen and functions offline.

</comment><comment><USER2> Just what the iPad has been lacking!!!</comment>


WSJ Jumps the Shark - <AUTHOR> http://www.ritholtz.com/blog/2010/01/wsj-jumps-the-shark/ <comment><USER2> I'm surprised this actually made it to HN.

I've read Barry's blog and have met him in person. He's one of the brightest, most realistic financial commentators out there.

We've seen an increase in media politicizing market movement. The example he cites was Obama coming out and making comments about financial regulation, and then the market takes a dump.

So you'll see on Marketwatch, Y! Finance, Motley Fool and others about how the president's comments caused the market to drop. This is rubbish.

Short term noise in the market happens. We were due for a pullback and this, combined with Greek CDS spreads and China's rates, prompted some weakness.

The same thing happened during the inauguration, how the market flew further south. And then the pundits came out and proclaimed how the new administration would be terrible for equities-- and then we rallied. A lot. And those pundits who thought there was some correlation between politics and markets disappeared.

Same thing here. The WSJ has increased it's politicization of it's content, when it has been known for the best financial news source out there. It may sell more papers, but they are significantly compromising the intellectual integrity of the staff and the brand.

<comment><USER3> Without RTA, I don't think I agree with your comment. For two reasons.

First, markets move on information. Maybe one piece of big, important information, like a war, or more generally millions of bits of information. But it is a reasonable observation to note the correlation between big news stories and market moves.

Second, most times markets don't move on big news. In that case, the trend that I've seen for over a decade is for people to simply speculate on why the market moved one way or another for a particular day. It's not science, it's not news -- it's informed speculation, or entertainment.

I think serious investors let this type of entertainment roll off of them -- after all, people like to chat, and media forums like the WSJ (or HN) provide them a forum to do so.

Separating the noise from the signal is the entire purpose of becoming a good investor. Thinking it's all signal or all noise is a good way to never be one.

<comment><USER2> _First, markets move on information._

That's half true. Markets move from capital flows of institutions on much larger timeframes-- those flows are what create trends. There is an underlying auction process that facilitates trade and capital flow-- the auction process is the short term noise that is dominated by the larger money about 30% of the time.

Yesterday was a great example. Yes, the market had a big move on the news, and capital flows moved quickly out of domestic equities. But we also had rate problems coming out of China and weakness in European credit markets. To say that the brunt of the market movement was caused by a political speech does not correspond to reality.

 _it's informed speculation, or entertainment._

Yes! And the WSJ generally avoided that, until recently.

 _I think serious investors let this type of entertainment roll off of them_

That is not reality, unfortunately.

<comment><USER3> If you're saying that markets do not move on information alone and then several sentences later saying that serious investor _do_ let this type of information affect them? Looks suspiciously like self contradiction.

And I'll bet the WSJ has always done this. Pick up an issue from 1950 and see if it isn't tying current news stories to the market. It was the same then.

This seems to me to be another version of "things were so much better way back when and now it's all garbage"

But I'll bow out. I didn't RTA. Just found your comments popular yet (to me) seemingly uninformed.

<comment><USER2> * Just found your comments popular yet (to me) seemingly uninformed.*

I do this for a living, and I was watching the market movements for this particular event-- the Obama speech was not the true catalyst.

<comment><USER3> "uninformed" in the sense of failure to understand the role of media. Not uninformed in the sense of failure to read easily digestible pieces of the market.

All media (that I know of) have engaged in a mix of news, speculation, and opinion for my entire life -- and probably centuries before I was born.

This article seemed to me so much like restating the obvious that I was very underwhelmed.

</comment></comment></comment></comment></comment></comment><comment><USER4> so I guess the new york times jumped the shark too?: <http://www.nytimes.com/2010/01/22/business/22markets.html>

Almost every news organization has had the same headline today

<comment><USER5> I'm not sure NYT had quite the same reputation for reliable market reporting. While it may have been better than papers for whom this is "business as usual," NYT didn't have as far to fall as WSJ did.

</comment></comment><comment><USER6> It's not like there are alternatives. The Times has let blatant editorializing sneak onto the front page and throughout every section for as long as I've been reading it, and its the paper of record. Read The Economist.

<comment><USER7> > Read The Economist.

The Economist produces good content, but it's all editorializing, all the time. Articles aren't even attributed to their authors - they just spring fully formed from The Economist's notional forehead.

<comment><USER8> The articles likely have multiple authors that contribute to making them high quality and very concise. Nothing I read comes close to The Economist, so whatever they are doing, I works well. Also, being much more expensive than other magazines, they can afford to hang on to talent when others are shedding it.

<comment><USER7> The downside is potential for groupthink, which was clearly in evidence in the run-up to the Iraq War, which The Economist cheered on alongside the rest of the mainstream media.

</comment></comment></comment></comment><comment><USER9> In this case I really hate to say I told you so, but I cancelled my subscription the day the Murdoch deal was done precisely for this reason.

I was a daily reader since 1977. It was an awesome paper for investors and business folks with a clear line between the editorial content and the remainder. Even the editorial page always published opposing views.

It was interesting that when I cancelled, the lady I spoke with me told me that under the new ownership it was going to be free, which was irrelevant to me. She mentioned that many said the exact same thing, $100/yr. was peanuts for such a high quality tool of the trade.

I recommend Bloomberg online for reasonable quality and good numbers.

</comment><comment><USER7> This judgment comes several years after the fact.

<comment><USER8> Its only been 2.5 years since he bought it. And it was awhile after that it started changing.

<comment><USER10> I know some people who would put the date as far back as 2002, the year they unintentionally created a certain, unfortunate class-warfare neologism.

<http://en.wikipedia.org/wiki/Lucky_duckies>

<comment><USER11> But that was in an editorial op ed piece. Their op ed pieces have always been political, but they always used to do a good job to make sure the politics doesn't leak out from there.

</comment></comment></comment></comment><comment><USER12> This is just an ad hominem attack as far as I can see. He links to two things to support his point but neither actually do

1\. "Boskin's Obama Crash" But when you follow that link you find the article he was pointing to was an opinion piece so it doesn't support his point (which was that he'd always thought the OpEd page was crazy but that he now feels that's bleeding into the reporting)

2\. "New Bank Rules Sink Stocks". His problem with this article, in his own words, is "we know that day-to-day action is mostly nonsense". He goes on to say "Assigning a definitive causative factor is at best a guessing game, at worst an exercise in futility." That's just foolish. There are brokers on the trading floor, you can ask them why they're selling and every news outlet reported it was because of proposed banking regulation so the logical assumption was that there is an overall sentiment on the floor. This isn't the WSJ. ABCNews, BBC, et al. reported the same thing ([http://blogs.abcnews.com/theworldnewser/2010/01/dow- drops-20...](http://blogs.abcnews.com/theworldnewser/2010/01/dow-drops-200-on- obama-plan-to-crack-down-on-banks.html), <http://news.bbc.co.uk/2/hi/business/8473720.stm>)

<comment><USER13> This is a really, really naive response. There isn't really anyone on the trading floor anymore. ECNs have taken over, and account for 97% to 100% of trading volume on any given day. No one trades from the floor anymore. So no, there's no group of people who are "the market" whom a reporter can poll for sentiment. You are completely and utterly wrong, and the only data you cite in support of your opinion is the fact that lesser outlets--outlets of the type that Ritholz has already said he files under "infotainment"--have glommed onto the same bogus explanation and run with it.

Ritholtz knows more than you will ever forget about what moves markets. He is spot-on, here.

<comment><USER12> Well first, and I mean this with minimal disrespect, but you clearly have a hero worship thing going here (see your last sentence). So you really have a bias of your own.

On your point, there are still people on the floor if you don't believe me turn on CNBC and you can see them. But even in a virtual floor it isn't like people don't keep in contact. The market lives and dies by social interactions and it always has. That's why the guy on his computer using e*trade isn't as effective as the guy in the brokerage house.

The point still remains that every news institution I can find reported this the same way (Dow drops because of Bank Regulation). So using it to attack the WSJ individually is ridiculous.

<comment><USER14> The point remains that the WSJ was unique in providing rock solid objective financial journalism, and now it is sliding down to the same level as "every other news institution".

<comment><USER12> But that's only true if the facts aren't true. If the Dow did really fall because people are worried by the new regulations than the title isn't sensationalist it's just factual reporting. So the question is this: Was it impossible to find out the motivation of investors? I don't think it is (especially when you have big time investors like Warren Buffett coming out against it)

</comment></comment></comment></comment></comment><comment><USER15> The author basically retracts his point here:

<http://www.ritholtz.com/blog/2010/01/wsj-another-view/>

<comment><USER14> No he doesn't. He provides nuance, as follows:

<blockquote> This isn't a politicization of the Journal, it is more accurately described as a tabloidization of it.

....

I am willing to give the Marketplace and Money & Investing sections the benefit of the doubt. But it seems weird to me to say that I am now sequestering the OpEd pages AND much of the A section. Once the political motivations of the owner leave the Opinion pages, it is a slippery slope down towards yellow journalism. </blockquote>

</comment></comment><comment><USER16> As a long time reader of the WSJ, it definitely has become a Fox-ish paper under Murdoch. What's tragic is that right now the investing public's need for objective, non-politicized, long-term financial information has never been higher, but now the primary journalist institution is no longer providing it.

<comment><USER17> I cancelled my subscription a year ago because of this. It's really a shame too, as it was one of the best papers out there. The frontpage always had one really interesting article and the rest(barring the op-ed) was really solid reporting.

<comment><USER18> I think people are dramatically overstating the degree to which the WSJ has increased its political content. There's a slight swing, but I believe people's perceptions are exaggerated because of what they expect from Murdoch.

I also think it's rare to talk about economics in a way that's free of political bias. I think most of the time the bias is just subliminal, and people are more likely to notice on WSJ at the moment due to Murdoch.

The bigger problem for me with the WSJ is that it seems to include more and more "soft" economic news (lifestyle, human interest, etc) and less "hard" news. I don't have hard data on it, but it feels that way. Could be my own version of Murdoch awareness.

<comment><USER19> The reason I canceled my WSJ subscription had nothing to do with ideology. I used to read the WSJ for the in-depth stories about topics that aren't necessarily in the headlines right now or that are otherwise not especially mainstream. After the Murdoch acquisition, the WSJ has increasingly focused on shorter stories about more populist topics. I can get that anywhere, so I no longer have a reason to read the WSJ rather than any other paper out there. I'm sure many others feel the same way.

</comment></comment></comment></comment><comment><USER15> The article boils down to one thing: "Obama is floating a bill the author likes. The general consensus is that the reason the market is down is BECAUSE of Obama's bill. The WSJ dares to report that the market is down BECAUSE of Obama's bill. Therefore the WSJ is are a bunch of no-good right-wing authoritarian fascists, and I'm going to stick my fingers in my ears and pretend that they don't exist".

<comment><USER15> My comment (above) has gotten three down votes in 5 minutes.

Has anyone READ the article?

I think that my summary is dead-on accurate.

If you disagree, please post WHY you disagree.

<comment><USER15> Nice.

Two calm comments of mine, both down voted to 0 or lower.

...and yet someone making no points and calling names (below) still has a positive score.

You down voters ought to be ashamed of yourselves - this is a marketplace of IDEAS, and yet you're just lashing out. Very mature. Very much in the spirit of HN.

<comment><USER20> Your comments are not calm, they are flamebait; and your opinions don't appear to have any connection to the actual article, in which the author describes specific reasons why he thought the Journal's coverage was poor (e.g. their failure to distinguish between financial and commodity markets, their failure to mention China's announcement.)</comment></comment></comment></comment>


Ask HN: How long need to wait for accepted to producthunt - <AUTHOR>

İ have a new app "Newsie-Your Social Life and want to ask how long need to wait for accept to producthunt after applied <comment><USER2> (tech @ producthunt here - hope i can help a bit)

our moderators receive several hundred submissions per day.

only a handful of those make it to the frontpage daily.

the whole process is at the moment not yet where we want it to be. we are working on making it more transparent.

<comment><USER3> Is there a process for getting an approved account without knowing anyone for an invite at the moment?

</comment></comment><comment><USER4> Your best bet would be to get an existing contributor to post for you, then you ask to get added as the Maker (green M icon) & get permissions to comment.

Do you know anyone that likes your app and has posted before?

<comment><AUTHOR> no there isnt anyone like that i just want to take some reviews for app but dont know except producthunt any other ways

</comment></comment><comment><USER5> I'm interested in this, too. Will be wauting for answers.</comment>


Ask HN: Where do you buy logos for your MVP? - <AUTHOR>

I'm looking for a cheap logo for my MVP. I'd be more than happy to pay a professional designer for a logo, but only after I have validated my MVP. Right now, I'd like something that looks good enough but does not cost a lot. I know about 99designs where the minimum cost is $299. Are there any other websites for cheaper logos, say around the $100 mark? <comment><USER2> "looks good enough" for your MVP is not bothering with a logo and just getting the damn thing out there in front of people. Seriously, at this stage the logo is wholly unimportant - smashing down every barrier to feedback is critical.

Just move forward without a logo and stop wasting time.

<comment><AUTHOR> With my design skills the best I can come up with is a text logo in Gimp which looks really really bad. I've seen a lot of sites that show up with such a logo and it does not look good. Maybe to the technical HN crowd a logo doesn't matter, but a lot of people would be put off with a bad looking logo and that would definitely affect feedback and validation.

<comment><USER2> What is a logo? It's an aide-mémoire - a convenient shortcut for users to recognise and remember your company's image. When you have a strong brand a logo can be a phenomenal tool to keep your products in the public consciousness - but at the stage you're at now, a logo is just a small picture to put in the corner of a website. That's it.

Your company cannot survive without validation, and a logo (or lack of) is not stopping you getting that.

</comment></comment></comment><comment><USER3> Try this person. He's done a reasonable job on work I have seen:

[http://fiverr.com/experthq](http://fiverr.com/experthq)

I would try others on fiverr.com. Spend your $5 bucks on 3-4 different designers and you're still ahead and likely to get something good out of it.

Note that, if you want the raw files (psd, etc.) you'll pay a little extra ($10 extra for the person above).

</comment><comment><USER4> I design my own. As for recommendations, I'd first like to request you avoid sites like Fiverr because it devaluates design work.

Forums/reddit are your best bet. Try /r/forhire, or your nearest forum that has a buy/sell board. Frequently tech boards do; I used to design logos for $50-100 on neowin.net. You can give their graphic exchange board a shot if you like.

<comment><USER3> I see fiverr as an opportunity for people to make a little money where the US dollar translates to something a lot better than $5 bucks in their currency.

Also note that $5 bucks is a starting point. I think for $5 bucks its a win/win to see if someone is "good enough". Usually, the good ones will tack on more money if you want the raw files or additional work done.

I get that $5 is nothing for work done in North America but in the rest of the world where the currency isn't US, it's likely to be worth it.

</comment></comment><comment><USER5> For $100 you can hire 20 designers from fiverr.com to make you a logo. I'm sure one of them will come up with something useful.

<comment><USER6> Wow, that's way cheaper than 99designs. Is the quality similar?

<comment><USER7> As in most areas of life, you get what you pay for.

</comment></comment></comment><comment><USER8> Can try [http://www.reddit.com/r/freedesign/](http://www.reddit.com/r/freedesign/) , I got some interesting submissions for my project, when I submitted a logo design brief as an experiment. In general, though, logos are not important when you are not even sure what will your project turn into.

</comment><comment><USER9> The noun project also has some decent art you could convert to a logo.

</comment><comment><USER10> If its an MVP, why care to spend on a logo? Just create a text one with a nice font and bg color. Segoe UI or Open Sans look good. There are also some websites which can generate logos for you.

If you want someone to do it, put it up on freelancer.com and get it done for 10-15 bucks or fiverr as someone already mentioned.

</comment><comment><USER7> As an alternative to spending on a logo, consider buying a really nice theme at themeforest.net or somewhere similar. This will rapidly give you a slick- looking design for the overall site/app, and then you can get away with some text in a nice font for a "logo."

</comment><comment> atom-morgan For a project I just recently did, I purchased a font from www.myfonts.com and cleaned it up to the point of looking like a "good enough" custom made text logo. Path's font is on there as well: Coquette.

</comment><comment><USER6> Students looking to fill out portfolios. Flat rate $200 for wordmark, logo, etc. It is student work so I've had mixed results with sometimes stuff being awesome and other times stuff being just OK.

</comment><comment><USER11> I post the job on freelancer, and let people bid. Sure, it takes more time than fiver and friends - but at least I can see an artist's portfolio.

</comment><comment><USER12> There is [http://www.12designer.com/en/](http://www.12designer.com/en/). Which is similar to 99Designs.

</comment><comment><USER13> [http://graphicriver.net](http://graphicriver.net) has a lot of decent vector images to buy for quite cheap.

</comment><comment><USER14> I've had pretty good luck with Envato's Microlancer site. A good number of people are offering decent logos for under $100.

</comment><comment><USER15> I can recommend Logoturn.com, great logos and great support. You can also find very nice domains.

</comment><comment><USER16> Check out [http://brandbucket.com](http://brandbucket.com)

</comment><comment><USER17> Reach out if you're still looking, I'd be happy to help out.

</comment><comment><USER18> Fiverr and Google Web Fonts are your best friends.

</comment><comment><USER19> If its an MVP, why not use a text logo?

</comment><comment><USER20> try fiverr.com. I've used the service a few times for a logo. Decent results for 5 bucks.

</comment><comment><USER21> crowdspring.com is around $100 minimum IIRC</comment>


Turntable.fm raising $5-10 M. at $40 M. Valuation - <AUTHOR> http://www.betabeat.com/2011/07/07/turntable-fm-and-the-siren-song-of-the-start-up-pivot/ <comment><USER2> Its not a pivot, its a completely different business with the same founders.

<comment><USER3> Closest off the top of my head: Odeo > Obvious > Twitter. As in this case, investors who didn't want to continue were offered the opportunity to get their money back.

</comment></comment><comment><USER4> I'd like to see Google implement a similar feature for Google+ by integrating it with Google Music. They could implement it in Hangout somehow.

<comment><USER5> I was thinking Google Hangouts may be the thing that prevents Turntable.fm from gaining more traction, you can essentially already "ghetto dj" in a hangout by playing YouTube videos of music.

<comment><USER6> I don't see it that way. Turntable has its focus on turning people into DJs and finding rooms (genres) of music suitable to your tastes. The DJ queue system works well, and the feedback system too, as does finding a track to play. I wouldn't last long if I had to sort through a YT results page.

</comment></comment></comment><comment><USER7> Am I crazy for thinking that it's inevitable they get sued by the recording industry?

<comment><USER8> They're using MediaNet (<http://www.mndigital.com/>) as their primary content/license provider, so they're likely fine esp if they comply with takedown notices of user-uploaded content.

<comment><USER7> Didn't it take months of license negotiations for Google to offer the ability to store and stream music you _already own_ to your _own device_? Turntable seems a fair bit more ambitious than that.

<comment><USER9> They seem just as ambitious as Grooveshark which seems to be doing fine.

</comment></comment></comment></comment><comment><USER10> Really interested to see who ends up funding their round. So many investors have told me that they want nothing to do with the music industry (streaming rights especially are not too attractive a proposition) and won't fund anything. On the other hand, they don't want to be the ones to miss a gold mine because they are stuck in thinking from 10 years ago about an evolving industry. If Turntable can do one thing, I would hope it would be to help foster a more creative community around music application creation. Having that community have the blessing of the music industry themselves would be the ultimate goal along with changing the licensing structure for developers (David Isrealite of the NMPA talked about this here: [http://www.billboard.biz/bbbiz/others/president-of-nmpa- call...](http://www.billboard.biz/bbbiz/others/president-of-nmpa-calls-for- blanket-licensing-1005238782.story)). The amazing innovation I have seen at 2 MusicHackday.org events lets me know that there is so much that will be done with music in the future, if developers and entrepreneurs are given the ability to pursue these dreams without fear of prosecution.

</comment><comment><USER11> It's not a Pivot when you do something completely new.

<comment><AUTHOR> Same team, same investors, same capital.

New code, new idea.

Uber-Pivot?

<comment><USER12> Restart, redo

</comment></comment></comment><comment><USER13> I'll be interested in seeing how turntable.fm evolves. I love the idea, but if I'm interested in background music, I find it can often be inconsistent. It'd be cool if more rooms had a single DJ, so at least you knew what to expect.

<comment><USER14> Go to tha "Ambient Chillout & Trip-hop" station, that's all u ever need

</comment></comment><comment><USER15> I expect they'll get more, but that was quick!

<comment><AUTHOR> They may end up raising more, but from what I hear, they are choosing VCs based on who can secure them top engineering talent for critical positions, not who cuts the biggest check.

That's the lay of the land in Silicon Alley right now. Tech talent is worth its weight in gold.

<comment><USER16> _they are choosing VCs based on who can secure them top engineering talent for critical positions_

I hear all this talk about top engineering talent. What is the difference between these guys and the rest of the engineers in the valley? Most startups do not do anything specially intelligent so what difference does it make?

Note:I am not being sarcastic. I am just curious.

<comment><USER17> This is the best explanation to your question that I know of.

[http://www.quora.com/LikeALittle-startup/Why-do-you-need- gol...](http://www.quora.com/LikeALittle-startup/Why-do-you-need-gold- medalist-programmers-in-your-team-to-build-something-like-LikeALittle)

<comment><USER16> Thanks. Great comments, but I doubt they answer the question.

<comment><USER17> The question was why do you need top engineering talent to build a website whose technology is not that complex. The point is that building technology that has to scale at the rate that Turntable (and LikeALittle) is growing is a very serious challenge that you can't afford to screw up. It takes serious tech chops, even if the app is not that complex.

</comment></comment></comment></comment></comment></comment><comment><USER18> Needs: \- Pro interface (just a list of users, not all this animated nonsense) \- Embeddable images in chat \- Sponsored rooms

<comment><USER19> so like IRC + shoutcast?

something about the way turntable presents things makes it a lot more fun.

edit: for perspective, think of it as farmville for music/dj nerds. my dj friends are loving turntable for the 'test out a playlist on a group' factor.

</comment></comment><comment><USER20> [http://www.businessinsider.com/turntablefm-rumored-to-be- rai...](http://www.businessinsider.com/turntablefm-rumored-to-be- raising-5-10-million-at-a-40-million-valuation-2011-7)

Confirmed: 7.5M at 37.5M valuation.

I'd be very interested in seeing how this played out for the investors in StickyBits.

</comment><comment><USER21> Wow, I don't even know what Turntable _is_ from their website because I'm Canadian.

<comment><USER22> I'm from the US and don't know what it is because it uses Facebook login. Oh well.

<comment><USER23> I was in the same boat. Especially since they request the offline data access permission. I finally relented by creating a crap Facebook account. I'd have been happier just giving them my email address and setting up a login in a more traditional manner.

</comment></comment></comment><comment><USER14> I am talking to one of the tt devs right now, he says it's just a rumor and this article is bogus.

</comment><comment><USER24> _100 days and $100,000 to get a company into beta, a working product that can be released to users for feedback._

In this day and age, do you really need $100,000 to get a company into beta? What are they spending all that money on, apart from a swanky office?

<comment><USER7> Well, do you need to hire any design or development or bizdev or legal help? Are the founders all willing to work without a paycheck and benefits for 100 days?

$100,000 isn't really very much money.</comment></comment>


PostgreSQL support is now live on AppFog - <AUTHOR> http://blog.appfog.com/postgresql-support-is-now-live-on-appfog/

<comment><USER2> Please, please, Redis next? =)

<comment><USER3> from the blog post... "For us, this is just the beginning. In the coming months, we are planning on adding support to a number of other data storage technologies, including Redis (which is now one of our very highest priorities)..."

<comment><AUTHOR> It's true! We're working very, very hard on Redis support. No ETA just yet, but there will surely be an announcement from us.</comment></comment></comment>


Show HN: Collaborative text editing with unobtrusive markdown and code highlighting - <AUTHOR> http://www.bluedocs.io/ <comment><USER2> Add an easy way to link to other pages without having to type the full URL, and you've got a radical improvement on a wiki.

Perhaps you could use double-bracket links like GitHub wikis use, so this would be a [[ubpdk|link to another document]].

</comment><comment><USER3> Why markdown everywhere, don't we have better markup languages?

<comment><USER4> Do we? Recently looked into that and it didn't seem like there is something clear-cut superior, sadly...

<comment><USER3> Asciidoc seems superior to me at least.

IIRC Dokuwiki wasn't too bad either.

Standard Markdown used to lack some important constructs, again IIRC.

</comment></comment></comment><comment><USER5> Very cool, but what's the issue with mobile? I use Swype and it only inputs the first letter of each word.

</comment><comment><USER6> What is the stack?

<comment><AUTHOR> It's almost pure front-end using Firebase + Firepad ([https://firepad.io/](https://firepad.io/)). The editor uses CodeMirror ([http://codemirror.net/](http://codemirror.net/)) and custom highlighting rules. The backend (what little of it exists) is in Flask :)

</comment></comment><comment><USER7> Very cool!</comment>


Microsoft: Join Developer Design - <AUTHOR> https://microsoft.github.io/join-dev-design/ <comment><USER3> > We use PCs, Macs, Figma, Sketch, GitHub, JavaScript, ZEIT, and other modern > tools to design, prototype, and build the future of software development.

This is some incredible self-awareness. I've encountered more than a few people who casually brush off applying to Microsoft because they prefer developing on unix machines.

<comment><USER4> Perhaps you have more insight into this ?

For the outside it still feels like unix is seen as a necessary evil.

It will be used extensively, devs are welcome and MS platform need to be compatible at the lowest level. But at every term ther is this tingling feeling of "you know we would have preferes if everyone was on windows and coded on VisualCode for .Net"

I think MS changed a lot in the last decades, but it still doesn't feel like the best place to work in for people who fundamentally don't care about windows ecosystem. Is this undue prejudice nowadays ?

<comment><USER5> >"you know we would have preferes if everyone was on windows and coded on VisualCode for .Net"

If you mean VisualStudioCode it's cross platform and you can program .NET in it with .NET Core on Linux.

If you mean Visual Studio then that's only good on Windows.

<comment> james-skemp Technically there's Visual Studio for Mac as well, but that's still limited to .NET Core instead of full .NET.

<comment><USER5> True, not a Mac user, but I've seen it and it isn't the real thing.

</comment></comment></comment></comment></comment><comment><USER6> Fresh. Love how this 1 short simple page brings together so much of what defines modern Microsoft. Got me interested!

I'm a designer who codes, a coder who writes, and a writer who designs. Will send something soon...

<comment><USER7> Modern Microsoft... God you guys are falling so much for PR it's not even funny.

It's the same company with another coat of paint, designed to get you to react exactly how you are reacting now. And you don't even realize.

<comment><USER8> "Let the past die. Kill it if you have to."

Why can't people be excited by something from Microsoft?

<comment><USER9> Because they keep churning out garbage. And the only "good" stuff they do make, they don't open source, or even release it on multiple platforms.

Not to mention the fact that they are extremely user hostile. Putting ads in a paid for OS? And mining private data. If their OS was free I'd at least say they had an excuse to do that.

<comment><USER10> > Because they keep churning out garbage. And the only "good" stuff they do > make, they don't open source, or even release it on multiple platforms.

.NET Core runs on Mac, Windows and Linux and is BSD licensed, and totally not all garbage (though I'm guessing you will disagree with me here with no backing facts because what defines garbage is mostly opinionated views). VS Code is the same scenario. Wow it astounds me the lack of understanding coming from you.

<comment><USER9> Yes I will concede that .net is not garbage. I have written code with it before and it's pretty average. It doesn't really give me anything that I can't do with Java or C++ (or other programming languages)

So what I'm saying is that it doesn't really bring anything worthwhile to the table.

VS Code. Yeah, I am not at all interested in an electron based code editor. And yet again, there is nothing new or novel here. There are dozens of other code editors that are free, cross platform, and very powerful.

If they open sourced (or even released on multiple platforms) Visual Studio, then I'd take notice. Same for Office.

> Wow it astounds me the lack of understanding coming from you.

And I'm likewise astounded at all the people falling for microsoft's brainwashing PR bullshit.

<comment><USER11> > VS Code. Yeah, I am not at all interested in an electron based code editor.

Have you tried VS Code and decided it's bad or are you just being prejudiced?

<comment><USER9> Yes. I've tried VSCode. It's better than atom, but I still prefer vim (neovim specifically) by a large margin.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Wow,

Designed in Figma. Built in Code. Open sourced on GitHub.

Code and GitHub is now Microsoft's, I wonder Figma would be acquired too, Figma is a great software and really useful for me who doesn't have a Mac.

<comment><USER13> Code was always Microsoft's.

<comment><USER14> Maybe they were thinking of Atom?

</comment></comment></comment><comment><USER15> Is having 21 contributors for a single static page something worth bragging about?

<comment><AUTHOR> For a fun, artistic experiment, yes, it's worth showing off the amount of people involved.

I assume there will be hundreds in a week or two and the site will be something completely different.

For example, a PR just came in, containing a time-travel functionality so that you can travel between commits, on the fly!

If that isn't cool and something worth celebrating, I don't know what is.

</comment></comment><comment><USER16> It sucks that the reactions to this are so close-minded and negative. It definitely makes me feel that the HN community is becoming a toxic and insular echo chamber.

<comment><USER10> Software developers get religious about their OS like they do their choice of a text editor. :)

<comment><USER17> young developers and really senior do that. Young are just naive, really senior are no longer interested in new technologies. You have to aim for the middle, when the developer is interested to learn. Thats where you find agnostic developers

<comment><USER10> Funny I consider myself agnostic but I'm usually seen as a "young developer" despite having been doing programming as a hobby for at least 10 years now. I guess professional experience is worth more to be fair.

I'm in the camp that uses Windows, Linux and Mac. Whatever laptop is nearest to me and gets whatever task done the quickest is the one I'll use, and these days it's my Surface Book 2 which has replaced even my iPad from being my media consumption device.

</comment></comment></comment></comment><comment><USER18> This team at Microsoft say they use Zeit. That's weird? - isn't Zeit a direct competitor with Azure?

<comment><USER19> That's probably to copy someone else ideas without doing their own research?

<comment><USER20> Everyone copies. Heck, you're probably part of those who mocked Microsoft for its abysmal returns on its $10+ billion per year research expenditure.

They contrasted this with Apple who spent less than $3B (at the time) on research with crazy returns on investment.

Immediate profit from research isn't guaranteed. The rule is copy where necessary or die.

</comment></comment></comment><comment><USER21> Looks to requires signing CLA to participate, though email was the other option. Ex [https://github.com/Microsoft/join-dev- design/pull/40](https://github.com/Microsoft/join-dev-design/pull/40)

</comment><comment><USER22> This is a cool way to do/start hiring. "collaborative" hiring process.

</comment><comment><USER23> Be sure to checkout the cute message in your browser's console :)

<comment><USER24> Interestingly, it doesn't work in Safari

<comment><USER25> It's also broken in Firefox Nightly (on Windows), and on Microsoft's own Edge.

<comment><USER26> IIRC, Edge Dev Tools is supposed to support more of it on Insider Builds. I'm not on an Insider build at work to verify, though.

</comment></comment></comment></comment><comment><USER27> Did not know you could put emojis in git commit messages: [https://github.com/Microsoft/join-dev- design/commit/db8133c7...](https://github.com/Microsoft/join-dev- design/commit/db8133c7d8c7d6e1ba77e21d09b345c383c920b1)

<comment><USER26> Full Unicode is supported nearly everywhere but HN these days. ;P

Also GitHub has long supported :emoji-name: expansions for those that want to limit UTF-8 in their git commits, and for those on operating systems without dedicated emoji soft keyboards. (In recent Windows 10, Windows+. and Windows+; bring up the emoji keyboard. It's great.)

I've seen projects require emoji as prefixed commit type descriptors: a bug emoji like ant is more interesting than FIX:, a wrench more interesting than TOOLING/SUPPORT:, etc. A neat benefit of that is it leaves the commit types as one character width lining things up nicely and leaving more room for meaningful text in the commit header.

I tend to do something similar with my personal repositories though not nearly as systematic.

</comment></comment><comment><USER28> I wonder if they are hiring dev tool designers for devdiv in general, or is this a new project?

</comment><comment> w-m Are they going to immediately hire whoever submits the loveliest bike-shed?

</comment><comment><USER29> > We use PCs, Macs,

Huh, Mac is not a PC?

> We believe in diversity, openness,

We know, with Windows 10 openness of your private data is a core feature

> Send a PR with any improvement to microsoft/join-dev-design

Short of ideas and creative people? Or just want it for free?

<comment><USER30> > Huh, Mac is not a PC?

Only if you do uncertified repairs on it :^)

</comment></comment><comment><USER31> Not sure if it's just me, but I can scroll down by 5 pixels on my device. Is there content below the Call-To-Action or is it suppose to fit the entire screen?

</comment><comment><USER32> Sort of unrelated, but I feel like Microsoft's behavior lately has been kind of fishy. I don't understand all the self-promotion, and I don't see it nearly as much for other tech companies.

Is repeating 'intelligent cloud' over and over again helpful in getting customers? Or is this all just a big stock pump?

</comment><comment><USER33> I guess buying LinkedIn didn't give them enough connections to convince people to work at that shitfactory

</comment><comment><USER34> eat your competition _cough_ i mean beat your competition

</comment><comment><USER19> No love for Linux? Good luck finding devs that actually work instead of hanging around Starbucks boasting their leased £6000 Macs.

<comment><USER3> Don't most devs prefer writing code on Macs? I haven't met many developers who use linux as their main development machine, and it makes sense. If you are productive on Linux, you will most likely be immediately productive on a Mac.

<comment><USER35> I used to think the same before my work company issued us macs. The fact that you have to purchase and install third party software for things which are either inbuilt in modern Linux DEs or come as simple small plug ins is crazy.

The lack of a frecency based app launcher, fuzzy findable window switcher, auto hide and scrolling of menu bar items when an apps menu is too long are all things that can be done in a pinch on GNOME or on something like bspwm, i3 etc. but need me to shell out around ₹2000 to buy third party software on the Mac is appalling.

Finder is shit compared to Nautilus, their spaces implementation leaves a lot to be desired etc.

<comment><USER36> If you're spending 2000 <what currency?> for "scrolling of menu bar items when an apps menu is too long" you should maybe reconsider priorities. You could possibly feed a few families in <what currency?-country> with that.

Plus spotlight works well as a "frecency based app launcher".

</comment></comment></comment></comment><comment><USER37> I wish they'd look at fixing the UI of their core product - Windows 10 - <USER2> before anything else. It's a huge downgrade from Windows 7 and they still haven't picked up the ball. Quite shocking really.

<comment><USER38> If you still think that Windows is their core product you should fast-forward to 2018.

<comment><USER37> I don't see why it would not be their core product. It's still huge in the enterprise, it's the one thing that can't be easily replicated by a competitor and so guarantees them a long term revenue stream. Everything else has successful competition (PS4 for the Xbox, Google Docs & G-Suite for Office 365, AWS & Google Cloud for Azure, etc).</comment></comment></comment>


Show HN: Whowantstobehired.com – Search "who wants to be hired?" post - <AUTHOR> https://whowantstobehired.com/ <comment><AUTHOR> Hi all, as a weekend project I created a searchable "Who wants to be hired?" post. You can search by text and also filter based on remote and relocate.</comment>


How to Write Safe Verilog: Become a PL Troll - <AUTHOR> http://danluu.com/pl-troll/ <comment><USER2> This is a fascinating glimpse into a world I know less than nothing about. I don't anticipate ever needing to code in Verilog, but I'll try to keep this in mind and look for other places where a little effort can save a lot of time.

I wonder what this has to say about type systems in general. Projects like Clojure's core.typed let you add static typing as a library where you feel like you need it, but then you don't get the benefit of statically checking everyone's code, all of the time. Perhaps a company policy on what functions need to be typed would do the trick, but at that point the compiler might as well enforce it for you.

<comment><USER3> Hardware programming is THE area where you need static types _always on_.

Basically, you have to write everything in goto statements, no while's or for's. You also have to check that size always match, otherwise you will have errors. You also have to check that you do not accidentally drive one input from two outputs, otherwise you will also get errors.

As you discover errors through very slow simulation (small circuit takes about 4 days of simulation for measly 2 seconds and it stays about 60% of time idle, e.g., not doing much), you really need to face any possible errors ASAP.

Another option is code generation from some high level model, but then you can miss something important like critical path delay or latency (in clock ticks) and you have to bring that information into the model. While this can be done in Clojure or Python or something alike, it is not a panacea, not even close to that.

<comment><USER4> > Hardware programming is THE area where you need static types always on.

It's not "hardware programming". It's hardware design. It's no different from connecting raw gates and chips on a breadboard. This is a very important distinction that is often glossed-over in HN conversations.

Verilog is a tool with which you explicitly or by inference DESCRIBE hardware. You are not programming hardware. That's software.

At some level this concept of static types is nonsensical. You have registers made up of flip-flops that move data around from circuit block to circuit block. That's it. Data types, in many ways, are software constructs, they don't really exist in hardware.

One would not look at a breadboard full of chips or an old-school PCB with latch and flip-flop chips and discuss static data types. Maybe you'll talk about fixed with data busses that implement this or that encoding, but that's about it.

One could argue that a specialized floating point processor has a data type. That's one way to interpret it. Another way is to say that it has a, say, 64 bit architecture that, by convention, is interpreted in order to be able to represent floating point numbers within certain constraints. If by that we mean "static data type" then, well, I suppose I can go with that.

<comment><USER3> Take, for example, Avalon streaming interfaces: [http://www.altera.com/literature/manual/mnl_avalon_spec.pdf](http://www.altera.com/literature/manual/mnl_avalon_spec.pdf)

Yes, it is a bunch of flip-flops and gates, but in the end the interface with "empty" signal is different from interface without it. The same is for error signal.

To connect those sinks and sources properly you have to match types. E.g., you have to deal with the absence of "empty" on one end.

Otherwise you will surely make some obvious mistake.

And, finally, Avalon streaming interface is a tuple: type ASI a = (SOP, EOP, a) data SOP = NoSOP | SOP -- SOP and EOP equivalent to boolean data EOP = NoEOP | EOP

And parameter "a" can be anything - raw value without empty or error, tuple of value and empty, tuple of value and error, triple of value, empty and error. They all are different. Even if their connection is no-op, like inventing "always good" value for error field, this no-op should be specified.

Otherwise, you make discovery of the error very distant.

</comment></comment></comment></comment><comment><USER5> As someone who spends 40 hours a week (and 60 - 70 lately) coding Verilog for FPGAs I'm always excited when something domain-specific hits the front page. I have no idea what a PL Troll is, though, so I think I missed the point of the entire post. Anyone care to elaborate? Google is not helpful.

<comment><USER6> A programming languages troll would be someone who suggests using obscure programming languages or techniques (you should use Agda here, you should write a type checker) to solve systems problems "because it's safer" regardless of practicality.

Source: being a PL troll :)

</comment></comment><comment><USER7>
      EDA tools vary in license costs, from a few thousand
      dollars per machine license per year, to half a million
      per core license per year. Timing tools aren't all the way
      at the top end, but they're not cheap.

I have never in my life _touched_ software this expensive. It's interesting to me how this warps workflows - e.g. automated testing tools can only test one build every two days, not because running in parallel is computationally expensive, but because licensing is too expensive in cash terms. Given the zero marginal costs (to software vendors) of existing customers running extra copies, this sounds completely insane to me.

<comment><USER8> I use these types of software day to day. The true price is veiled behind multi milkion dollar contract negotiations. You should see the inverse relationship between price and lack of bugs.

What's more of a challenge is trying to use techniques like continuous integration when your compile time is a week!

<comment><USER4> > What's more of a challenge is trying to use techniques like continuous > integration when your compile time is a week!

And your simulation time is another week.

And interpreting the results could be another week.

I've worked on designs where you can only do one iteration per day to on iteration per week. It really slows down development to a crawl.

You learn very quickly to segment designs and validate everything as far as humanly possible before even dreaming of simulating/compiling larger functional blocks.

These are ways in which modern hardware design is vastly different and vastly more expensive than any comparable software development workflow.

The cost of hardware tools is pretty much insignificant when you consider the entire process. Buying a $50,000 signal analyzer might save you weeks or months of development and debug time. You can't launch into these kinds of startups with a $15K investment over a summer.

</comment></comment></comment><comment> iso-8859-1 Anyone who needs a Verilog with proper typing should check out Bluespec. It has the Haskell type system and it transpiles to Verilog. Due to type inference, it doesn't need to be verbose. Don't let my refernce to "Haskell" scare you, you decide yourself how general your code is. If you don't want to worry about monads, you don't need to.

<comment><USER9> His previous post mentioned that.

</comment></comment><comment><USER10> "In high speed designs, it's an error to use a signal that's sourced from another module"

How else are you supposed to get I/O from one module to another, say a 32bit data bus? Also, what's the definition of high speed here?

"unless you like random errors"

And very hard to diagnose errors until you realize that you messed up your clock domains.

<comment><USER11> Spent the last 2 years doing high-speed comm designs on FPGAs. (I don't know if 5 Gbps currently count as high speed though). The tools are quite mature and will mostly prevent you from doing stupid things.

Somewhere here I saw a comment saying that you must time your design taking in account the logic delay or will get weird errors, but that's impossible. The tool chain (both quartus and Xilinx ISE) will report the max clock speed with a big bold red font if you try to go faster.

There's a step in every design flow called DRC (Design rule-checker), basically a bunch of warnings if you do dumb things with anything including the high-speed transcievers. You must pay attention to the warnings.

Neverd did any ASIC but I know they have about 10X the testing and simulation that FPGA have. I would believe you don't get random errors if you follow the standard design flow and tests.

<comment><USER12> _Neverd did any ASIC but I know they have about 10X the testing and simulation that FPGA have._

My spouse designs CPUs for a major CPU manufacturer (you've used them). She is responsible for physical design for one tile (there are many tiles, each of which has other physical designers). Her single tile, by itself, is substantially larger than almost all ASIC designs in the world today. At that scale, most of the standard FPGA design tools don't even work. Designing in that space is substantially different than FPGA or even ASIC design.

<comment><USER13> The third type after FPGA and ASIC, sometimes called "full custom". Related to ASIC, but distinct.

[http://en.wikipedia.org/wiki/Full_custom](http://en.wikipedia.org/wiki/Full_custom)

</comment></comment></comment></comment><comment><USER4> Being that HN is permeated by software developers it might be important to point out that Verilog code is not software but rather hardware description. The developer --in this case typically an EE-- either explicitly or through inference describes circuit structures with something that looks like a C-like programming language.

Concepts such as modules don't translate directly into the software world. A module is a grouping of circuit elements. The criterial for grouping them can be varied. One typically creates modules for functional blocks that are easy to plug into the overall circuit. And, much like a subroutine, the other motivation is when one must use the circuitry multiple times. The difference is that a subroutine is called and exited. A module instantiation creates real and permanent circuitry on the chip (ignoring FPGA reconfiguration techniques).

I've been working with HDL's for quite some time. Frankly, every attempt I've seen to get away from hardware development and making it look like software development is crippled in some way or another. I equate this to the idea of, for example, tools that allow you to write mobile apps using something other than the native language and framework of the platform. It works. Until it doesn't.

As far as the article is concerned, no issues with any of it. It's an interesting approach. That said, I've never used anything similar to this and can't remember the last time I had such problems. This isn't criticism. Just one data point.

<comment><USER14> Three minor additions to what should become a HN FAQ every time there's a vaguely FPGA/ASIC article:

This is hardly official and not a perfect analogy but github is to software devs as opencores.org is to FPGA devs. Thats why when you go to github and search for Verilog and only get 259 hits for stuff written in Verilog you're going to the wrong place.

The other FAQ is verilog looks like C because C looks like the incredibly orthogonal PDP-11 addressing modes chart. So pretty much if you can imagine it as an addressing mode, the PDP-11 could do it, so thats explains the weird compatibility between something that looks like C and something that can define the hardware of a CPU. Its not a perfect analogy but it kind of describes why the HDL look very C like rather than Ruby like, for example. If you could build it out of basic logic gates in 1970 using TTL chips, its probably supported by the old PDP-11 and therefore in C.

Finally you need a FAQ for old timers that home-scale FPGA / CPLD stuff has collapsed in price over the last decade or two. Yes, in 1990 you needed four figures to do anything so no one did anything at home. Now you need at minimum a $50 board and a (multi-gig) free download. Its maybe 3dB more expensive than fooling around with arduino stuff. The small scale stuff doesn't scale well to larger stuff; I think its "weird" when a simple gray code decoder or quadrature decoder takes a minute to synth, so yes doing a complete CPU does take a long time to synth even on fairly high end hardware. Back to the old days of batch computing, sorta.

<comment><USER4> Over the years I've accumulated a pile of dev/reference boards. In my world you eventually have to migrate to application specific hardware. This is where it quickly leaves the home/hobby domain, the tools get more expensive and the required knowledge-base expands. I am mostly talking about the challenges of high speed design.

The minute you get into the hundreds of MHz and into GHz and thousand pin devices you've entered a domain that is far away from what casual hackers can handle.

Yet, I do agree with you. Today, free compilers from Xilinx and Altera support devices that ten years ago required their multi-thousand dollar suites. Free or low-cost PCB design tools are out there. All of this of course, comes with compromises. Free simulation tools don't compare to paid tools. Free and low cost EDA software packages don't have all the tools you really need to efficiently manage high speed design of complex boards with larger devices. Signal integrity alone has dedicated (and very expensive) tools that you almost can't do without in certain domains.

None of this is to say that it is impossible for someone to play with the technology but it certainly ain't like playing with software.

<comment><USER14> Yes good point. Probably add another one to the standard HN FPGA FAQ that doing / learning X at home is pretty easy, as long as its not prefixed by "GHz" or "really fast".

</comment></comment></comment></comment><comment><USER15> This reads more like a succession of notes rather than a coherent article to me, I had some trouble understanding what the author was getting at. It's still worth reading IMO, but I doubt people who have no background on hardware design understood what TFA was talking about.

Also, I really don't understand what the author meant by "PL troll". Writing static code checkers is trolling nowadays?

</comment><comment><USER13> _In high speed designs, it's an error to use a signal that's sourced from another module_

Not sure if I agree here, at least in these absolute terms. Sometimes you cannot afford to unnecessarily capture every I/O signal, and it is indeed not always necessary.

</comment><comment><USER16> In ASIC RTL, two really important things should be considered. DFT implementable and synthesis friendly. Verilog with those two can only compete. In that sense, ARM is one of the best at it.

I am not sure if a static checker meant 'lint' but Verilog writer can be better being good at static check and static checker at next end.

</comment><comment><USER17> Most of the typechecking described in the article is now done by standard off the shelf linters e.g. Atrenta Spyglass</comment>