China's Great Cannon - <AUTHOR> https://citizenlab.org/2015/04/chinas-great-cannon/ <comment><USER2> > _We remain puzzled as to why the GC's operator chose to first employ its > capabilities in such a publicly visible fashion._

This is the most important question here. I think it's fair to assume this must've been a deliberate choice by the Chinese authorities to conduct such a visible attack. The alternative, that they didn't realize what they were getting into, that they thought Github would cave quickly, seems much to simplistic and naive. And whatever else you can say about the Chinese government, you can't accuse them of being naive.

If you believe this was deliberate attack, it seems this is a parade demonstrating electronic warfare abilities. The message being sent seems to be, "don't mess with us, we can do everything you can do and possibly more."

<comment><USER3> > If you believe this was deliberate attack, it seems this is a parade > demonstrating electronic warfare abilities.

Probably deliberate with a lot of incompetence mixed in.

Most politicians have zero understanding of the Internet. They decided to do this as a demonstration of force and may not have consulted the people who built the Great Cannon. Or, the people who built it don't have the clout to say not to use it except for important reasons.

They also probably didn't realize that Github could eat the attack.

The problem with having done this is that, I suspect, that a lot of ISP's now have null routes of China on standby along with bandwidth monitors that will choke traffic spikes from China almost immediately.

So, it didn't actually succeed. And people have now analyzed the attack and deployed coutermeasures.

Not a great result for China.

<comment><USER2> I don't think DDoS is a real offensive weapon in cyber-warfare. It's just a noise-making attention-drawing machine.

What the paper calls targeted exploitation is the real weapon here. The main thing I took away from this paper is that the Chinese government now has the infrastructure to pwn anyone who visits websites hosted in China. This is pretty scary and simultaneously an amazing engineering feat.

<comment><USER4> Any advice for visitors of those websites hosted in China? As a Chinese, I am always wondering if there is a way to avoid this. Many of us are aware of the backdoors in the Chinese apps (across all the platforms). No matter how big names they are, they have to comply with the order from the ruling ones (I guess most of them cooperate with little guilty feeling). The best I can think of is to have different devices for visiting/using Chinese apps/websites. To a larger scale, I think average users have very limited resources to hide from big organizations. What average Joe could do is a more general question I have not figured out. Thanks in advance.

<comment><USER5> The ideal answer is to convince the sites you visit to use https.

<comment><USER6> If the Chinese government controls a single CA that's installed by default, couldn't they MitM any TLS connection that isn't pinning certs?

Are there any Chinese CAs in any browsers' default installs? If so, they should probably be removed immediately.

<comment><USER7> CNNIC is no longer trusted by Chrome due to recent incidents, and you can manually remove it from Firefox and IE. While you're at it, take a few minutes to browse the list and also remove anything that sounds Chinese.

If any website you visit legitimately uses a Chinese SSL certificate, you can whitelist it specifically. I actually do this for SSL certificates signed by my own country's CA (not China), and it works wonderfully.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I mentioned this as a reply in the other thread on this topic, but just to make sure it is clear to those who may not have read or reasoned about the full report:

The reason it is powerful is not this particular attack. It's a demonstration that they are willing and able to inject malicious responses to any request going to a Chinese resource (web site, analytics service, ads, etc.). Imagine if instead of returning some DoS javascript they deliver a payload to silently exploit a vulnerability in your browser/OS (and they are surely capable of finding or purchasing those) to do whatever they want with it:

\- Add it to a botnet

\- Steal your personal data

\- Infiltrate your corporate network

\- Wipe your system (punishment for those accessing or producing GFW circumvention software)

Are you confident your browser never makes HTTP requests to Chinese servers? Are there tools we can install to prevent it?

[EDIT: It looks like two separate HN stories got merged, and the comments along with them. Didn't know that could happen, but this comment now appears twice here at different places.]

<comment><USER9> > Imagine if instead of returning some DoS javascript they deliver a payload > to silently exploit a vulnerability

It would be foolish to imagine that this is still theoretical. Tools this powerful are tempting to use. Unfortunately, the first _publicly known_ use of a tool or method is often assumed to be the use in general.

Not only are you correct in that the GFW will be used for much smaller attacks that will probably go unnoticed, it almost certainly already has.

</comment></comment><comment><USER10> I hope that this drives home the need to be using HTTPS _everywhere_ we can be. It would make this kind of wide scale man-in-the-middle attack much harder to pull off and easier for users to detect. If only getting a certificate was an easier (less costly) process.

<comment><USER11> When considering the effectiveness of HTTPS everywhere, we should assume the Chinese government will have the ability to create valid certificates.

This would allow them to perform MITM attacks against anyone who visits Chinese websites, even with HTTPS.

<comment><USER12> They need to sign those certs with a CA. If they do this, they create a cryptographic proof that they're abusing their trust and are removed from the trust store quickly.

<comment><USER11> In fact that happened about a week ago:

[http://arstechnica.com/security/2015/04/google-chrome- will-b...](http://arstechnica.com/security/2015/04/google-chrome-will-banish- chinese-certificate-authority-for-breach-of-trust/)

But if China chose to, they could simply require all Chinese websites to use government-issue certificates, forcing the world to choose between allowing Chinese MITM monitoring and losing access to China.

<comment><AUTHOR> > But if China chose to, they could simply require all Chinese websites to use > government-issue certificates, forcing the world to choose between allowing > Chinese MITM monitoring and losing access to China.

The more likely outcome of that gambit would just be that the CA would be restricted to .cn domains, possibly with some sort of install-on-demand warning.

<comment><USER11> > The more likely outcome of that gambit would just be that the CA would be > restricted to .cn domains, possibly with some sort of install-on-demand > warning.

A reasonable compromise, but one which wouldn't prevent MITM snooping or alteration of communications with Chinese websites, like this attack.

And to allow snooping of outgoing communications, the Chinese could also require that all browsers used in China trust the Chinese government CA without that restriction.

<comment><AUTHOR> Agreed, although it technically would have helped against attacks like the ones we just saw where most of the parties involved – including Baidu – are using .com domains. No question, of course, that this would only result in heavy pressure on everyone doing business in China to use .cn domains.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> If China is responsible for this, it shows extreme recklessness on their part, a deep disrespect for the rule of law and the customs of the internet. The people in the chain of command responsible for this should be held criminally liable.

The lack of sophistication, ineffectiveness, and bluntness of the attack speaks toward a fundamental capability gap between China and the other "cyberpowers".

<comment><USER14> There is no rule of law of customs of the internet, however. That's been the big push for the last decade within the US: to develop an international norms framework for the internet. The problem is that many of the activities being performed by China, Russia, France, Germany, the UK, Israel, Canada, the US, etc are being performed by others - it's difficult for us to condemn China without equally condemning the others. (Those wanting to argue a straw man will suggest that the technical details of this attack are somehow above and beyond the pale of what other nations are known to do and make their argument about js injection.)

It's true that China is much more crass and less developed in their cyber capability. It isn't that much less effective however.

<comment><USER15> And that is one of the reasons it would be a good idea for the US and other Western countries to dial down some of their more aggressive actions: those actions set precedence that encourage other countries like China to match the escalation.

<comment><USER16> There does seem to be a difference, though. The US monitors communications, adds backdoors to infrastructure to monitor communications, and injects malware into Iranian nuclear reactors that could be used to make weapons.

China, on the other hand, deliberately attacks anyone who criticises their government. In the US you are perfectly free to say the government are a bunch of fuckwits who should be kicked out of office, if that is your opinion.

I'm not necessarily saying that what the US does is legal or morally acceptable, just that it is more morally acceptable than what China does. It's like the difference between a private investigator illegally breaking into someone's house to gather information, and a gangster going in and shooting everyone.

<comment><USER15> I'm not even taking a position on whether action A is more morally acceptable than action B. I'm just saying, maybe so, but at the end of the day, not only are they both ethically dodgy but A creates an environment that encourages B, so that in itself is reason to think A should be dialed back a few notches.

</comment></comment></comment></comment></comment><comment><USER17> State level injection is not new. Prior to the Tunisian revolution this was happening on HTTP Facebook pages: [http://blog.jgc.org/2011/01/code-injected- to-steal-passwords...](http://blog.jgc.org/2011/01/code-injected-to-steal- passwords-in.html)

HTTPS everything.

<comment><AUTHOR> I think the big difference here is that it's being used to launch attacks outside of the country. For too many years, the assumption was that these large scale attacks either didn't happen or were only limited to people already subject to a particular government.

> HTTPS everything

… and with HSTS, too

</comment></comment><comment><USER18> If this was meant as a demonstration of power it failed miserably. A nation state attacking a single corporation, and not even a very large one at that and all they managed to achieve was being blackholed in various spots and seeing their attack being consumed. Minor nuisance at best, and very much losing face, both in terms of goodwill and in terms of power.

If this was officially sanctioned heads will likely roll.

<comment><USER19> On the contrary, it sounds like this was just an initial test. It crippled GitHub for days, called into question the reliability of the service, and took a team of people to trace down the attack.

And if this paper's allegations are accurate, China's government did this while only targeting less than 2% of the people who pulled down only a very small subset of scripts that will only exist on a small subset of pages. Imagine what would have happened if the Great Cannon were to inject this script into the <head> of every page?

<comment><USER18> What will happen is simple: China will find itself in an internet black-hole.

<comment><USER19> The problem is that from GitHub's perspective, or that of GitHub's ISP, this would do little to avert the attack. That's because the "attackers" in this case appear to be users outside of China's great firewall who have accessed a service inside of China.

Consequently, it is primarily Chinese-speaking users worldwide and web services that provide Chinese language services (and would be likely to use Baidu's or another Chinese service's scripts) that end up looking like the attackers. In this case, it appears most of the requests came from Taiwan, Hong Kong, and the US.

China could of course filter this further. With only 1.75% of requests being turned into DDOS attacks, they could throttle this up to ~100% and filter the IPs they target to, say, only US IP addresses. Now the attackers appear to be regular US citizens.

What will you do then? Black-hole the US? Beg consumer ISPs to black-hole China?

</comment></comment></comment></comment><comment><USER20> It is and it isn't powerful. I was pretty impressed by _how_ they attacked GitHub (not _why_ ) and in doing so they showed the power of the tool.

However, the requests it made could have easily been turned back against Chinese business if Github so wanted. It couldn't be done because there was no reasonable _who_ to turn the traffic back against. If non-Chinese companies simply said "If China uses these tools we will redirect the traffic at a number of large Chinese businesses" then a lot of the power in the tool is immediately withdrawn.

At least that's my interpretation of it.

<comment><USER21> Yeah, if GitHub had used a 301 Moved Permanently to some Chinese website I think it would have been interesting [rather than responding with the alert message]....however that probably would be deemed "attacking" someone.

<comment><USER22> It would've been interesting if they had made the 301 point back to Baidu.

<comment><USER23> While fun, it almost certainly would have resulted in China moving to the Syn flood stage faster. That being said, I'm always a fan of the classics, and would have probably gone for a redirect to goatse or the like. Given that the script was giving github full control of the page, a bit of shock and awe would have been rather fun.

</comment></comment></comment></comment><comment><USER24> A bit far-fetched perhaps, but could it be that this attack on Github's front- end was a mere feint for a separate attack on their back-end?

If there's a repo hosted there that someone in China wanted to modify, perhaps they would use DOS as cover for a surreptitious maneuver which might otherwise get noticed.

This is likely just showing my ignorance of Git, but could an attacker having sufficient compute resources to arrange a Git hash collision and having back- end access to Github, modify sources without it being noticed by the repo owner?

<comment><USER25> This is actually a very good and interesting question. It would be good if Github started to at least show signed commits and on a per repo level block non-signed commits.

And Git should migrate to something better than SHA1.

</comment></comment><comment> mike-cardwell Pretty much any country _could_ perform this attack. The interesting thing about this, is that China thinks it can get away with openly attacking foreign companies. And it might even be right about that.

Anyone remember what happened when North Korea attacked Sony? Where are the sanctions this time?

<comment><USER26> AFAICR there is still no evidence that North Korea attacked Sony, but everybody seems to think they did.

<comment><USER14> There's tons of evidence that NK attacked SONY and the reason they did it was revealed when the Guardians of Peace leaked the Lynton emails.

</comment></comment></comment><comment><USER27> Another weird thing about the whole situation, besides the reasons for the attack and reasons for it failing, there's a question - why github?

Seems like a weird choice for a target. Github is neutral, and githib is unambiguously good. Aren't there better targets attacking which would have at least a semi-plausible excuse?

I mean attacking github is like screaming "I'm evil".

Besides if you want to "demonstrate your power", github is the worst choice for that purpose. They are likely to successfully fend off the attack, yet at the same time even if China would succeed it wouldn't have much to be proud of either(country vs a small company). It's a lose-lose....

<comment><USER16> The reason they attacked github is because github was hosting greatfire and cn-nytimes.

</comment></comment><comment><USER28> People talk of boycotting china's products, but has there ever been a real discussion about refusing to sell products in China? With the growing desire for western/external goods, cutting off the Chinese people's access to our[sic] trinkets and stuff might put real pressure on the State to back off on censorship and HRVs to forestall any popular movement...

<comment><USER29> Exactly, if we can root people to become vegan, oragnic and not by fur etc. Why not have campaigns to not support products made by countries with oppressive governments.

<comment><USER20> >Why not have campaigns to not support products made by countries with oppressive governments.

Nobody cares. It's _over there_ , it's not something we need to worry about.

It's not like the working conditions of those making our clothes, those making our smartphones, those pulling the materials for our electronics from the earth, etc. aren't unknown. They're very well known. We know damn well that there's children sewing together our shoes. We know that the people making our smart technology products are so miserable that their offices have anti- suicide nets in place around the building and throughout the stairwells.

We know this stuff and we don't care. We want our products and we want them as cheap as possible. The shareholders in these companies want the company to perform as best as they can to maximize returns, that means acting nefariously in many cases and we all know that.

People do not are and they will not care. If you gave people the choice, to be made anonymously and that nobody would ever know their choice, between paying multiple times what they pay for their technology or abolishing child labour and horrible working conditions they would choose the cheaper option. Or maybe not, maybe they would choose abolishing these things in an effort to delude themselves and make themselves feel better, but when it comes time to purchase a product they will still go for the cheaper one manufactured in horrible conditions.

People simply do not care so long as it is not them feeling the affects. That's the same damned reason nothing is being done about the NSA revelations, or the corporate corruption of the US government, or the torture allegations about the CIA and the list goes on.

<comment><USER28> _people do not care and they will not care_ you may be right, but you are painting with an immensely broad brush. you care. i care. i bet many care. does that mean anything? time will tell. _...nothing is being done about NSA, Gubniment corruption, torture allegations, etc_ Jeez. What did you expect, a revolution? This country of mine [ours?] was built to do things slowly. The original idea was to make it hard for the central government to do things quickly, thereby weakening its power. It may have worked for a while, but it also severely handicapped anyone in the government to stand up to banking and commercial interests [there are some in the government, past and present, who legitimately care about people and earnestly try to do the right thing]. things take time. understand, i have said, verbatim, everything you stated more than once in many different situations. i agree, but i guess seeing it in writing from another person rustled some optimistic feathers i had not known i had. a personal story, so take it with a grain of salt: someone i know, very personally, works for no such agency. at the time of the Snowden Revelations, _they_ were obviously mum. to date, _they_ have said nothing about it, but i have watched the bags under the eyes deepen, the gray hairs multiply, the demeanor sag. Does this mean anything to anyone, does it mean there is hope? who knows such things. i encourage you to consider two things: 1) wedding bands serve the very important function of reminding a person what they already know; the effort is the point. the building is the amalgam of the bricks put into it. 2) no one changes their mind during an argument; it is only after silent and solitary consideration that a person's mind changes.

</comment></comment></comment></comment><comment><USER30> I don't like the underlying assumption in all these articles that the Chinese government was behind the attacks, as if we had proof for anything.

Apart from the rather blurry technical analysis this particular article claims:

 _In recent public statements, China has deflected questions regarding whether they are behind the attack_

But when you follow the actual citation[1] it refers to this rather underwhelming exchange, taken place on a chinese press conference:

      QUESTION: [..] a report says that a US website was under
                hacker attack, and the source of the attack was from China.
                How do you respond?

      ANSWER: [..] it is quite odd that every time a website in
              the US or any other country is under attack, there
              will be speculation that Chinese hackers are behind it.
              I'd like to remind you that China is one of the
              major victims of cyber attacks. [..]

So the chinese press lady gave her standard boilerplate response, to a less than specific inquiry (which she probably hears on _every_ press conference), in between handling questions about illegal fishing in Somali waters and the Arab League Summit's commitment to a joint Arab military force.

And this is now "compelling evidence" for China being officially behind the Github attack?

[1] [http://www.fmprc.gov.cn/mfa_eng/xwfw_665399/s2510_665401/251...](http://www.fmprc.gov.cn/mfa_eng/xwfw_665399/s2510_665401/2511_665403/t1250354.shtml)

<comment><USER31> Your comment is thoughtful so I'll reply in kind. Is there any other plausible actor who could be carrying on this attack for so long? And is motivated to attack GreatFire? The Chinese government controls their Internet connection to the world with a firm hand. Who else could it be?

I agree that more technical evidence of the attack's source would be welcome. But the analysis published here is pretty convincing. Specifically "the GC acted on traffic between hop 17 and hop 18, the same link we observed as responsible for the GFW". There's pcap files if you want to verify for yourself.

<comment><USER30> _Is there any other plausible actor who could be carrying on this attack for so long?_

For me the more interesting question remains: Why would _China_ be carrying out this attack? I have yet to hear a plausible motive.

Other plausible actors would be the people who have an interest in creating the perception of a "cyber threat", in order to implement more "protections".

Protections like an Executive Order[1] "to target those attempting cyber attacks on US assets and infrastructure".

After all, with both China _and_ Russia[2] attacking us, who would argue against the urgent need for such measures?

And yet, technically either China _or_ the NSA (via their control over Tier1 carriers) could be responsible for this attack. Perhaps it _really_ was China. But considering we're talking about state-level secret agencies in any case it's a bit sad how reluctant many HNers seem to be to even consider any scenario other than the mainstream narrative.

[1] [http://www.nationaljournal.com/tech/obama-declares-cyber- att...](http://www.nationaljournal.com/tech/obama-declares-cyber-attacks-a- national-emergency-20150401)

[2] [http://www.dailymail.co.uk/news/article-3029768/Russian- hack...](http://www.dailymail.co.uk/news/article-3029768/Russian-hackers- blamed-cyber-attack-exposed-president-s-private-schedule-Obama-aide-insists- White-House-computer-secure.html)

<comment><USER32> > Why would China be carrying out this attack? I have yet to hear a plausible > motive.

Exactly this. Not to mention the hundreds (if not thousands) of sites the government is more likely to target, that are far less known than GitHub and that they could take off-line indefinitely, with little or no outrage from anyone in the West.

</comment></comment></comment></comment><comment><USER33> They did this because they have nothing to lose and can show off their technical prowess.

What exactly is the world going to do - sanction them and stop buying nearly everything from their factories?

I fear the US is going to seriously regret building up China with all our economic business instead of building up all of Central and South America.

</comment><comment><USER34> Why would China only swap scripts for users OUTSIDE China? And why only 1.75% of the time? If they're willing to do this level of `cyber warfare`, why stop at it's own citizenry, or cap it at a number like that?

<comment><AUTHOR> In this case, the goal was to attack GitHub. If you only use clients in one country, the target would have the option of simply having their edge routers drop traffic from the entire country. Using international clients removes that option and likely makes the attack more successful because it generates more traffic closer to the target.

</comment></comment><comment><USER35> I wonder how hard it would be to take down the Great Firewall? I'd imagine that may cause some consternation within the ruling party.

</comment><comment><USER36> Is there an addon/extension for firefox/chrome that can block all the website from China?

</comment><comment><USER37> Crazy my friend Bill worked on this he's the one mention in the article

</comment><comment><USER38> Is it too late for http2 to require encryption by default?

<comment><USER39> According to [http://en.wikipedia.org/wiki/HTTP/2#Encryption](http://en.wikipedia.org/wiki/HTTP/2#Encryption) and the browser support section this is already the case, at least for server<->browser communication. If unencrypted HTTP/2 gets any use at all it will only be for server<->server communication (RPC and such).

</comment></comment><comment><USER40> Is citizenlab down for anyone else?

</comment><comment><USER41> China has an authoritarian government that produces pollution that threatens the entire world, ignores human rights and free speech, and supports dictators in Russia and Africa. If China gets anymore powerful, the world is doomed. We need to curb commerce with China.

<comment><USER42> Replace China with USA and see how it looks.

<comment><USER43> Much further from the reality. The US has huge flaws and gaping failures with these matters, but still compared to China it is objectively way less authoritan, and has a much better track record with respecting free speech and human rights.

<comment><USER11> > The US...has a much better track record with respecting free speech and > human rights.

The rights of US citizens, yes, but our track record on human rights and free speech worldwide is not so good.

<comment><USER29> But when China is at par with what US has been, China's record of human rights and free speech worldwide will be much worse than that of US.

</comment></comment></comment></comment></comment><comment><USER44> The Great Cannon is basically a proprietary WebLOIC, which of course means Web-based Low Orbit Ion Cannon. You may have heard of LOIC; a DDoS tool being used by script kiddies and activists for the past 4 or so years.

"Powerful New Weapon"? Pure clickbait.

Playing catch-up with Anonymous is neither new nor powerful.

<comment><USER45> The new part is MitM:ing a popular site to use unsuspecting peoples computers in the attack.

<comment><USER44> Watering hole attacks and MitM aren't really new either. I know people who used hacked sites to drop slowloris.js payloads to coordinate "Anonymous- related" attacks. (Not really Anonymous related; quotes are sarcasm.)

<comment><USER21> Yeah, the only new part is the scale it operates on since it can MitM any site in an entire country and use legal means to guarantee its access.

<comment><USER44> Yep. Using legal means to maintain a privileged position to do malicious things to the rest of the Internet is an innovation that few can enact.

</comment></comment></comment></comment></comment><comment><USER46> To play devil's advocate: If you had the choice between identifying all domestic users of GFW circumvention tools, rounding them up, and shooting them, or attacking some of the foreign devil peddlers of such tools, which is the more humanitarian and mild measure?

Edit: I'll try to make this a little clearer. Consider that many of the most free and civilized countries you know will identify, round up and harshly punish consumers of child pornography. Imagine a China (or another state of your choice) that sets its mind to providing the deprived and opressed western masses with as much child pornography as they can download. Is the West's only admissible choice to dutifully round up and punish its own citizens? Is it clearer now?

<comment><USER47> So you're comparing access to child pornography with access to news?

<comment><USER46> You were supposed to compare --- not the forbidden things AS SUCH, but (a) the abstract fact that they're illegal, composed with (b) SANE ways your OWN country can react to the fact of a NON-FRIENDLY FOREIGN power engages in ENABLING, ENCOURAGING and ENTICING your own citizens to breach same law.

To give yet another example: At some point in time, exporting an 128 bit symmetrical block cypher from the US may have been grounds for punishing you, the perp.

Let's counterfactually assume that China was successfully propagandizing tens of thousands of US citizens about both the ridicoulousness and the anti- freedomness of this law. Assume that thusly propagandized US citizens resisted and breached the law.

Again: Would you prefer that the US, assumed to be quite aware of the Chinese efforts, would have identified, rounded up and harshly punished US citizens having exported "munitions" in the form of 128 bit symmetrical block cyphers after having been successfully turned against perfectly patriotic (even if misguided) US policy by non-friendly Chinese propaganda, while completely not doing ANYTHING to stop that propaganda, even though PROVEN to put US CITIZENS IN JAIL??

</comment></comment></comment><comment><USER48> An irrelevant rant, but the map of China looks really, really ugly without the two southern islands, Hainan and Taiwan. It looks like a rooster without legs.

At the very least, include Hainan, over which China's sovereign rights are in no way disputed. And for aesthetics and political honesty, show Taiwan in grey.

<comment><USER49> Taiwan is a separate country and has been for many years. Both the assertions of the PRC over Taiwan and ROC over the mainland are ridiculous.

</comment></comment><comment><USER50> For a long time I wondered why China was using censorship against outside information. I thought it was inefficient and probably useless, what they had to fear ?

Then I discovered that "color revolutions" were not happening by chance and that it was a CIA "technology" to remove an unwanted leader from a target country.

Now I understand why they use censorship. I still think they'd better educate their people (like the Russians seem to do) though. Whatever wall you build there will always be cracks.

<comment><USER51> Russian TV is a great example of propaganda. Truths viewed from special angle plus subtle lies... The problem is that a lot of people still believe in everything that the see in the TV :(

<comment><USER52> Now just make the lies obvious and you have Fox News! Fascinating how a privately owned channel can be indistinguishable from propaganda in all respects except supporting its government. If the US annexed Crimea under a republican president, you can bet Fox would try to whitewash it.</comment></comment></comment>


"They Didn't Teach Us This": A Crash Course for Your First Job in Software - <AUTHOR> https://stackoverflow.blog/2019/09/05/they-didnt-teach-us-this-a-crash-course-for-your-first-job-in-software/ <comment><USER2> Author here - thanks a lot for sharing! I found myself pretty overwhelmed in my first few software jobs. I (thought I) knew how to write code, but was so overwhelmed by tools and processes, I had no idea how to effectively contribute to the codebase. This article was an attempt to sum up some things I learned transitioning from personal projects to working on a team.</comment>


Antimarket opportunities - <AUTHOR> http://blog.kenperlin.com/?p=15938

<comment><USER2> aren't these opportunities still in a 'market' of their own? If someone else thinks that what you are doing has value (even in the long range), there is a market for that to be done and you will get paid. If you are only doing it for yourself, it is just a solipsistic exercise, and it won't get done unless you're mega-rich, so you better get cracking on the marketing of your opportunity to people who 1) will agree with you and 2) are willing to pay you for the effort.

<comment><USER3> There are plenty of research opportunities that are speculative, or niche, enough that they wouldn't overcome the net present value of any third-party commercial investment. Of these, a not-insignificant number are likely to become keystone technologies at some point in the future, but rarely will it make economic sense to put cash in it early, rather than invest elsewhere and later use the returns on _that_ to get a position in any future market.

Some companies -- Google, obviously, or Bell Labs back in the day, or companies run by well-heeled visionaries like Musk -- are willing to sink cash into high-risk research, but in general Google is going to see more returns out of incrementally improving AdWords rather than developing self-driving cars.

The other thing to think about is that R&D doesn't just "skate to where the puck will be," it actually places the puck on the ice. It takes fundamental and/or high-risk research to create these kinds of opportunities, which means that, in a world where markets solely dictate research objectives, a lot of potential advancements will be left on the table as long as companies have other, profitable, avenues of investment. Which is why we need government funding, though not government control, of research -- but that's probably a discussion for another time.

<comment><USER2> "Which is why we need government funding, though not government control, of research"

Without accountability (which is what you mean by 'government control'), all you will have is crony funding, and a downward-spiraling quality of work as effort goes toward scientific rent-seeking instead of real scientific product. This problem is inextricable. In order to have accountability, you have to have benchmarks, which really means that the only type of science funding the government is consistently good at is translational, with defined goals. A good example is the moonshot.

If your claim is that government will politicize science, well then, the problem is with demanding that government fund science in the first place. It is a ridiculous position of entitlement to demand money, obtained from taxpayers who have little choice to comply, with nothing in exchange.

For an excellent counterexample to your assertion, consider Peter Mitchell. He created an private, nonprofit science research organization very much dedicated to a 'basic science' question and solved a fundamental question in biochemistry: How does the cell generate energy? Although there is no way that industry would have funded this, there was also no way that government would have funded it either. He won a Nobel Prize for his work.

Do not make the mistake of conflating 'private' with 'for-profit'. This is a false dichotomy that overlooks important social efforts, such as the Polio Vaccines.

</comment></comment></comment><comment><USER4> Can somebody give a quick rundown of how university research works?

What's the motivation to work on a potentially big idea rather than something you personally find great interest in?

Wouldn't it be best to just work on whatever interests you most, or is there such a wealth of branches you could go off into, that one feels the need to narrow it down and this is one of the ways to do that?

<comment><USER5> I think I know this, because even though I haven't personally graduated from so much as high school, a lot of my friends and family are academics.

Let's start with your career as a doctoral student. If you personally find great interest in your research, but nobody else does, then you will find it very hard to get published (except in bullshit fake conferences and fake journals that accept any author who pays the fee) and you will not be able to persuade your committee to accept your dissertation, so you will not get a doctorate and will not graduate. Also, if no PIs at your institution think your research is interesting, you will not get funded as an RA, and you will have to devote a lot of your time to teaching instead of research, or you will have to pay tuition. If your research is in a field that requires access to equipment (e.g. chemicals, supercomputers, nuclear reactors, oscilloscopes, pencils) then not getting funded as an RA also likely means you don't get access to the university's equipment, so you have to buy your own, which may completely stop your research or just slightly annoy you, depending. If your research involves experimentation on animals or humans, the IRB or AEC is not going to approve your application just because you personally find great interest in the research; you have to convince them that it's worth the potential harm to the experimental subjects. Finally, and perhaps worst of all, if you personally find great interest in your research, but nobody else does, then only your ideas are going to go into it; nobody else will contribute, and so you will progress maybe 1% as fast as if you were surrounded by a community of like-minded peers.

But suppose you work on stuff your advisor likes until you graduate in seven years, and then another four years in postdocs, and then you publish a bunch of papers as an assistant professor (on subjects that referees find so interesting that they recommend publication) and lots of other people find your ideas so interesting that they cite your papers so much that you are eligible for tenure, and then you actually get tenure because you didn't grab any students' asses or fail to actually physically be present when you were suppposed to be teaching or anything like that. So now, after 7+4+6=17 years of working on ideas that other people thought were interesting, you have tenure and you can, if you so choose, work only on things that you personally find great interest in.

At least in theory, and modulo the concerns about IRBs and AECs above. But your department is going to be a lot happier with you if you are working on things that you can find funding for, and if your ideas are attracting brilliant applicants to the department's doctoral program, so that they can then admit those applicants and coerce them into working on the ideas _they_ (your colleagues) find great interest in, in exchange for a lottery ticket that might pay off with tenure. In practice, though, tenured faculty tend to spend a great deal of time writing grant applications to persuade grantmakers that they will work on ideas that the grantmakers find interesting, giving talks to persuade their colleagues to be interested in their work, and teaching classes with at least the ostensible objective of persuading students to be interested in their work. Also, sometimes you have to ask grantmakers and grantmaker-like agencies not only for money but also for permission; nuclear research in the US, for example, requires that your research reactor be overseen by the DoE.

So, those are some of the structural incentives in the US academic system to work on things that other people in your field think are potentially big ideas, instead of just things you personally find great interest in. You know all this bullshit about how the web is an "attention economy"? Academics have been desperately struggling for attention for centuries.

And, yes, you need to be interested in what you're investigating, too; not least because, if you aren't, you're going to have a hell of a time getting anybody else to pay attention, and you almost certainly aren't going to make it through grad school.

<comment><USER4> Thank you for the response, very informative.

</comment></comment></comment><comment><USER6> Think backward. What _could_ you have started working on twenty years ago that would make you fabulously wealthy now?

I can't think of much, offhand. It's even harder to skate where the proverbial puck will be twenty years in the future.

<comment><USER7> The biggest tech market opportunity 20 years ago, with hindsight, was probably one of the simplest: .com domain names. Generic ones...no reason to mess with trademarked names. Many of those simple, "dictionary word" .com names have fetched well into 8 figures.

[http://en.wikipedia.org/wiki/List_of_most_expensive_domain_n...](http://en.wikipedia.org/wiki/List_of_most_expensive_domain_names)

<comment><USER5> If you're going to eliminate ethics as a consideration (and you are, by advocating domainsquatting) there were a wealth of other opportunities out there. Spammers, for example, made a lot of money for a while. DoubleClick cashed out for US$3B, which makes "well into 8 figures" sound pretty small. Maybe you could run literal extortion rackets, the kind where you threaten people with violence, but it's hard to know how much money the biggest people made in that business: was it US$1M or US$10B? Or you could go lower and found a patent troll, or a law firm catering to patent trolls.

<comment><USER8> None of those are where the market is going to be in 20 years, that's where the market is now. Spamming is AIUI very competitive; likewise literal extortion and patent trolling.

<comment><USER5> I was talking about 20 years ago, when spamming, like the domain-name extortion Erica was advocating, was restrained by norms of behavior that considered it antisocial. I don't know enough about the private-violence extortion market to comment intelligently, but patent trolling isn't competitive at all — except in very unusual circumstances, the extortion victims do not have the option of buying protection from you from a competing patent troll.

<comment><USER8> The practising entities selling the patents to you have plenty of trolls to choose from though.

<comment><USER5> 20 years ago they didn't, but I'm not sure it matters that much, because you have plenty of fire-sale worthless patents to choose from among the various bankruptcies and then file frivolous lawsuits over.

<comment><USER8> Presumably if it's a profitable business then the bankruptcy auction prices for patents will rise to the point that they're only barely profitable.

20 years ago they didn't, but the more interesting question is what's the thing that's available cheaply today that people will be buying in 20 years. If you have some ideas for this in the unethical space I am genuinely interested.

<comment><USER5> I do, but I'd prefer not to tell people whose interest in them is too genuine. :)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Ya, I sort of did this, but my option was a 10 year post doc, making a little over $32,000/year working 80 hour weeks.

</comment><comment><USER10> Very nice observations. I was offered an RA position in the mid 90's to work on a document oriented database. In retrospect, I wish I would have taken it. Although I haven't seen any of the people involved anywhere near the Forbes Richest list :(

<comment><USER5> Maybe that's only because they lacked the contributions you would have made?

<comment><USER10> In academia providing concrete implementation is often not valued highly; hence I would have probably fallen into the same trap (which I did anyways, but in a different area).

p.s. thanks for the vote of confidence though :)</comment></comment></comment>


The iPod? It's bound to fail (and the other predictions the experts would rather forget) - <AUTHOR> http://www.independent.co.uk/news/science/the-ipod-its-bound-to-fail-and-the-other-predictions-the-experts-would-rather-forget-1061286.html

<comment><USER2> _"What Bill Gates can't deny is providing the following nugget of perspicacity to the 2004 World Economic Forum. "Two years from now," the father of modern information technology said, "spam will be solved". As anyone with an email account can testify, the avalanche shows no sign of receding."_

Spam may not be solved... but in some ways - and for me - it is. I don't think I've seen a single spam message in the two or three years since I've started using gMail, and I am always quite amused when my family talks about how much spam it gets... (Nor do gmail filters mark things I want as spam).

<comment><USER3> 1 spam a month in my inbox with gmail (if that). (maybe about the same in a corporate Lotus/Domino environment) Gmail does very occasionally mark some random email list I sign up for as spam - this isn't a concern - as to be honest - it's usually the stuff that I don't want anyway.

To me that's solved in terms of email.</comment></comment>


Aaron's email to the FOAF list offering his help (2000) - <AUTHOR> http://lists.foaf-project.org/pipermail/foaf-dev/2000-August/004214.html

<comment><USER2> I just realized he's only 13 when he wrote that email, and 13 years later the same brilliant kid with a bright future would be dead for some pretty messed up reasons. Such a tragic loss.</comment>


Introducing AppMake: An AppEngine Makefile - <AUTHOR> http://geewax.org/introducing-appmake

<comment><USER2> It's nice to be able to type something short for such common actions as running a development server. I'd rather use Rake, or something similar in Python, though. I tried porting part of it to Rake, and found the syntax to be much clearer afterward to me. My guess is that more Python programmers would be comfortable modifying Ruby than would be comfortable editing Makefiles.

<http://gist.github.com/543235>

There are also some Rake-like python tools, but I need to investigate more.

[http://stackoverflow.com/questions/1407837/is-there-an- rake-...](http://stackoverflow.com/questions/1407837/is-there-an-rake- equivalent-in-python)</comment>


Ask HN: An interesting idea that I wont build. You like? - <AUTHOR>

I call this Site Sounds.
Visiting a website is interpreted as audible music (could be a plugin that plays the music while you visit sites).
Colors within an html document represents different tones.
The types of content being transmitted represent different instruments. html, css, javascipt, images, flash, pdf, etc.
The bandwidth speed represents the metronome/speed of the music.
Javascript libraries represent different rhythm patterns: jquery, mootools, etc.
CDNs represent different instruments: amazon, akamai, limelight.
External resources and APIs represent sounds.
As traffic is brought through the network adapter, a listener passes the type of information to the synthesizer that analyzes the type of traffic then outputs the appropriate music.
I assume at first it will all sound like garbled non-sense, so there would be some need to map each entity to a certain type of instrument/sound to make it somewhat musical.
Worth building? <comment><USER2> A couple of thoughts...

1) I hate when websites play music when you load them, why would I want this?

2) I usually keep at least a dozen tabs open, and I have a feeling I'm on the low-end of the tabs-open curve. How would this work with multiple tabs and browsers being open?

<comment><AUTHOR> It would be more user driven than automated. When you visit a site that you want to hear what it "sounds like" you press a button and it refreshes the page and runs the little app.

Might be interesting to hear what your own work sounds like.</comment></comment>


Show HN: 3d printer weaver - <AUTHOR> https://github.com/GistNoesis/3d-printer-weaver <comment><AUTHOR> Happy new year, HN. This recent hack [https://news.ycombinator.com/item?id=13254029](https://news.ycombinator.com/item?id=13254029) (Threadtone) inspired me to do a little week-end project.</comment>


Introduction to spintronics - <AUTHOR> http://www.physics.umd.edu/rgroups/spin/intro.html <comment><USER2> Layman questions:

\- What are the potential benefits of spintronics to technology? Would it make electronics cheaper, smaller, more efficient, ...? Would it allow something that we currently couldn't do?

\- "For example, whether placing a semiconductor in contact with another material would impede spin transport across the interface is far from well- understood." ...This seems like an eminently testable thing- just take a semiconductor, put it in contact with something else, put a, uh, spin current (layman!) through them and check for impedance. What hilariously ignorant mistake am I making? : )

<comment><USER3> > Would it make electronics cheaper, smaller, more efficient

As the name implies, it uses transport of spin rather than electrons themselves. The electrons may not move at all (you can have a spin current with no electric current at all). So it'd no longer be electronics.

The current premise is more dense memory devices with lower power consumption.

> This seems like an eminently testable thing- just take a semiconductor, put > it in contact with something else, put a, uh, spin current (layman!) through > them and check for impedance. What hilariously ignorant mistake am I making?

Well, where do I start?

Think about these: how do you generate a spin current? How much is it? How do you measure it? (hint: no, there is no such thing as spinmeter) How do you store/switch/manipulate bits? How does it effect magnetization, temperature, electric current, chemical potential? (these are all intricately coupled things) What kind of spin waves is it going to generate? Can you treat them as quasi particles? (magnons) Will there be a flow of magnons? What are the transport properties and how does an interface affect it (it's not easy to isolate and measure only a single transport coefficient in practice)? What is your order parameter? Are we talking about a ferromagnet, antiferromagnet or ferrimagnet? Are they interfaced? What are the transport properties of your interface? What is your Landau free energy (from which you can calculate effective field or ground state)? Which phase of matter are you in? Helical phase? Skyrmion crystal phase? Canted/polarized phase? What is your geometry? What kind of stray field does it generate? What are your anisotropies? Does your system have a strong spin-orbit copuling? What is your overall spin transfer torque? How do all these depend of temperature / thermal fluctuations? etc etc etc.

And keep in mind that almost all the physical observables we're talking about are really really _really_ tiny. We're talking about quantum mechanical effects.

I hope by now it is clear that you have to come up with an "impedance" on your own tailored to your system, taking all the relevant physical aspects of your system into account (which requires a good background in condensed matter physics). There is no generic "impedance" of "spinmeter" that will work in any situation.

And generally, the issue is not measuring spin current or transport properties in an existing system. And you certain don't want to make devices randomly and measure its properties until something nice comes out miraculously: you have to "engineer" the desired properties (which typically requires very specific conditions), from ground up.

So it's a little different from connecting a lamp and a resistor to a battery and see whether it lights up or not. Suffice it to say that it's more complicated than your average high school science experiments.

<comment><USER2> Your paragraph after "where do I start" is so incomprehensible that I'm not entirely sure you're not simply spouting random technobabble at me. But I get the idea. :D

</comment></comment></comment><comment><USER4> [deleted]

<comment><USER3> > "Spin" in quantum physics is more of an artistic interpretation of the term. > It's similar to how Autism and other disorders have a "spectrum", but aren't > divided into colors.

> With wave-particle duality, spin signifies how in-phase one particle's wave > part is with the wave part of other particles.

What? Is this a joke? (I'm serious, because it's not even wrong)

Edit: Since I wrote my reply, the parent was fist deleted, and then edited into a quote from a blog post which tries to explain spin to layman. Well, whatever.

<comment><USER5> Arrived too late to see the post you're replying to, but isn't it fair to say that an electron's spin, though it corresponds to a notion of angular momentum mathematically, is a little different to everyday ideas of spin? Not least in that spin-half particles like the electron must "rotate" 720 rather than 360 degrees before they get back where they started.

<comment><USER3> There's an accidental similarity between the groups SO(3) and SU(2), which works for spin. There are other quantum numbers such as flavor SU(3) for there is no mathematical coincidence and such analogies won't work.

The differences between SU(2) and SO(3) go beyond just "rotate 720 rather than 360 and you're back where you started".

While I understand the urge of expressing new things in terms of what you know, sometimes, analogies aren't helpful and distort reality, and you just need to accept that there can be things in the nature that doesn't correspond to anything in your daily life in the real sense of the word.

That being said, the original parent post (which I quoted, so it's actually there) is total nonsense.

<comment><USER4> Could you recommend a good entry point for understanding group theory? It's always been particularly impenetrable, and the wiki page doubly so. Book or video or blog post or even private college course - anything would be appreciated.

Is spin the _exact_ same physical phenomena as 'macroscopic' spin, but on a quantum scale? If not, just curious, why use the same word?

<comment><USER3> I can recommend Howards Georgi's Lie Algebras in Particle Physics which is a good introduction in the context of particle physics (yes, it covers both Lie algebras and groups).

No, it is nothing like the angular momentum of a spinning object. The name is rooted in a historical misconception. It is a form on angular momentum, which caused the misunderstanding. As of today, we still do not have a deeper understanding of spin in quantum mechanics: it's just some intrinsic angular momentum with SU(2) symmetry, and the value of angular momentum is in general different between particles (corresponding to the irreducible representations of SU(2), and the angular momentum is mostly 1/2 or 1 in units of reduced Planck constant except for some exotic/composite particles).</comment></comment></comment></comment></comment></comment>


Reserved-usernames: Usernames to prevent url collision with resource paths - <AUTHOR> https://github.com/shouldbee/reserved-usernames <comment><USER3> I'm confused. What is the purpose for this? Is this for sites that have exmaple.com/username so you know ahead of time what paths you most likely want to reserve?

Seems silly. You should either put users at example.com/user/{username} or you should put all non-user profiles under a reserved base like example.com/res/settings.

<comment><USER4> I guess if you have usernames in a shared namespace with system components this'd make sense - it's not something I'd consider a feature.

consider:

website.org/aloha

website.org/contact

website.org/u/aloha

website.org/users/aloha

users.website.org/aloha

u.website.org/aloha

aloha.website.org

with the first two examples, yes, there is a potential for collision - <USER2> you'd want something like this.

I consider the next four examples to be best - the final example I consider potentially administratively painful depending on implementation.

<comment><USER5> Don't forget the ancient classic: website.org/~aloha

Mastodon's interesting approach: website.org/@aloha

<comment><USER4> yeah, I neglected those.

I still use ~ on a couple web servers I administer, easy way for me to give people a sandbox attached to their user.

</comment></comment></comment></comment><comment><USER6> I could see a profanity list being more useful. How many people really try to register with the username "projects"?

As other people have mentioned, namespaces for user URLs solves this better.

</comment><comment><USER7> There used to be sane times where usernames were prefixed by a tilde in profile URLs...

</comment><comment><USER8> Or: Why you should not put things like usernames at the top level of your domain. sheesh...

<comment><USER9> Look at reddit.

        reddit.com/r/subreddit

        reddit.com/user/my_user_name   (Why not u? I don't know.)

Pretty straight forward. There are also ones like subreddit statistics and they're all... after the name.

        reddit.com/r/subreddit/about/traffic

(Note: Public viewable stats are only turned on if the mods turn it on.)

[edit] Wait. Reddit removed user access site-wide to those pages? Morons. Well, the URL point still stands.

<comment><USER10> Oddly

      reddit.com/u/foo

does work, but it just redirects to

      reddit.com/user/foo

</comment></comment></comment><comment><USER11> The CSV version (with one field per line) is identical to the plain text version.

<comment><USER12> Interesting. I assumed it was just a generic parser, and the url fragments don't contain anything that'd require any effort - but adding quoting, commas, tabs resulted in identical output too.</comment></comment>


Corporate America Is Conspiring to Keep Your Chocolate Shitty - <AUTHOR> https://splinternews.com/corporate-america-is-conspiring-to-keep-your-chocolate-1825514264 <comment><USER2> Title should be "I like UK Dairy Milk". Nothing wrong with that if you love powdered milk.

By the way, the connection between Hershey's and Cadbury goes way back to the founding days. There's a fascinating book called "Chocolate Wars" by Deborah Cadbury that chronicles that time.

</comment><comment><USER3> The whole problem is that in the US chocolate goes through a huge transport chain instead of being made and sold by local chocolatiers.

If you have to go through a supply chain, you value stability and not melting more than you value taste.

<comment><USER4> Nope, I don't buy it. I can get Ritter Sport, Kinder Eggs, and other imported Chocolates from my grocery stores that taste just like they do in Europe. That chocolate was shipped over the atlantic in addition to taking the same transport routes as Hershey's does. Conclusion: Hershey's just sucks.

</comment></comment><comment><USER5> Not really true. American chocolate is an acquired taste, but it's supposed to taste like that. Companies deliberately add butyric acid to make it taste like Americans expect.

A lot of people don't like it. A lot of people do.

<comment><USER6> I was recently in London and decided to try a non-US KitKat as there had recently been a ruckus on reddit about how much better they were supposed to be.

It tasted like a chocolate-covered cracker. Nothing wrong with that, but chocolate covered crackers are a crowded space in the confections market and without the "malted milk" taste, which I suppose must come from the butyric acid, I found the non-US KitKat to be a completely uninspired contender. That taste is _the_ thing that makes KitKat bars unique and exciting to me.

To each their own, but I hope the one-sided nature of the media frenzy (US BAD! FOREIGN GOOD!) doesn't end in the mediocritization of a wonderful candy bar.

</comment></comment><comment><USER7> The best milk chocolate I have ever tasted is the one they give you on Swiss Air flights. It is utterly perfect, just the right mix of sweetness and richness, without being cloying. And the snap when you bite it is a thing of singular beauty.

</comment><comment><USER8> As a French expat in London, who's actually just back from the shop to get some chocolate : let me tell you how I burst into uncontrollable laughter when I clicked through the link, and understood by the end of the first paragraph that the author's point of reference was going to be "superior British chocolate". Followed by a long love letter to Cadbury's.

In distressing disbelief, I glanced at the URL looking for theonion.com, before collecting myself.

This is a photo of the chocolate aisle in an average Parisian supermarket:

[https://imgur.com/a/s3I2o7g](https://imgur.com/a/s3I2o7g)

It was sent to me the other day as a cheeky taunt, by my brother who lives there and asked if I needed anything. Of course I do.

You can see here at least 7 different varieties of exquisite, melting praline chocolate. Fine, pure darks of varying strength. The usual pistachio, roasted almond, rice, hazelnut, vanilla, mint, and the more creative (and let's face it : less authentic) pear, apricot, citrus, macaron, crème brûlée (!), raspberry, blueberry, even grapefruit !

I'll never forget the shock when I first moved to the UK, browsing through the aisles and naively looking for my standard French/Belgian/Swiss fare of dark chocolate with roasted almonds, hazelnut, or rice.

I found nothing of the sort, instead on offer was potentially very fine chocolate laced with Wasabi, of all things ! Wasabi, I repeated in horror, taking a snapshot to immediately report the outrage back home. And chilli, yes of course chilli : the ubiquitous alibi in British cuisine, akin to gratuitous violence in action movies. The favourite lazy fix of bland meals that otherwise wouldn't stand on their own feet. A smokescreen of burnt tastebuds to hide behind. A pain that I'm aware (but still to this day can't understand why) many people enjoy inflicting unto themselves.

I suppose this sinking feeling of mixed embarrassment, pity and smug sympathy I had reading the article, must be similar to the one British or American expats in France experience the first time they tune into the radio and hear the French try, and fail hard, at rock'n'roll or hip-hop.

To each their strengths. The Swiss and Belgians are the unrivalled masters of chocolate, and the French at least worthy connoisseurs of the art.

Now, I can't even begin to imagine how American chocolate tastes, having just witnessed someone actually put British Cadbury's at the apex of cocoa achievement.

<comment><USER9> "how American chocolate tastes" \- I believe that I recognise most of the brands in your picture, and I can buy them at Wal-Mart. IOW, we can get it here if we want, I suppose.

</comment></comment><comment><USER10> Talk all you want about taste preferences, but just like we have restrictions on what you can call "chicken wings" and "Champagne" (as compared to "chicken wyngz" and "sparkling wine"), so too should there be restrictions on what you can call chocolate.

You can still have your American Hershey bar, it's just not chocolate, it's candy. It's too bad the Swiss or whoever didn't secure "chocolate" like France did for champagne.

<comment><USER11> Except the Swiss didnt invent chocolate. South Americans did.

</comment></comment><comment><USER12> The best chocolate I ever had was from a small chocolatier in a tiny one room building in Elm Springs, Arkansas. He had been a Christian missionary in eastern Africa, and ended up helping to build and develop cacao farming there.

He came back to the states and started ordering beans from the farms he helped start and making bean to bar chocolate here.

The point is that big factory Chocolate is a different thing entirely. Cadbury, Hershey's, it is all shit.

</comment><comment><USER2> Ritter-Sport FTW! I grew up not too far from the factory and luckily now I can buy it in every super market in the US.

</comment><comment><USER13> Here is often what is found in candies and cookies nowadays.

* High fructose corn syrup glycemic index 100 vs normal sugar glycemic index 70. The higher the glycemic index the sweeter the product tastes. High fructose corn sugar is a biproduct from subsidized corn production. [https://en.wikipedia.org/wiki/Fructose](https://en.wikipedia.org/wiki/Fructose)

* Palm oil(Cancergenic) [https://www.efsa.europa.eu/en/press/news/160503-0](https://www.efsa.europa.eu/en/press/news/160503-0). Palm oil is cheap so manufacturers use it everywhere but it is cancergenic.

The next time you are in the supermaket, twist the label and read the contents. You will be surprised how hard its to find good products. When I surved the local online super market store only about 3 candys out of 100 had ok content ie not High fructose corn syrup or Palm oil.

<comment><USER14> > High fructose corn syrup glycemic index 100 vs normal sugar glycemic index > 70

This is just plain false. Fructose has a glycemic index of 25 (1/4 that of glucose), hence HFCS-55 (55% fructose, 45% glucose) has a lower glycemic index at 58 than "normal sugar" (which is 50-50 fructose-glucose) at 65.

> The higher the glycemic index the sweeter the product tastes

Glycemic index has nothing to do with sweetness. Fructose is twice as sweet as glucose with a quarter of the glycemic index; aspartame is 200x as sweet with basically 0 GI.

Candy or chocolate made with sucrose rather than corn syrup tastes different (and I would agree, better), but don't delude yourself that it is in any way better for your health.

</comment></comment><comment><USER15> "Your Oreos are too sweet and your Chips Ahoy are too dry; the offerings at your local CVS are no good. You have been lied to. These candies do not suffice as guilty pleasures, and you did not choose them freely. You chose them under the duress of false consciousness. Perhaps Mondelez realizes that the sweet taste of Proper Cadbury would awaken in American consumers the knowledge that capitalism doesn't provide everyone those ideals of choice and excellence, but merely a veneer of freedom and indulgence. Hershey's sued the major importers of British Cadbury not just because it wanted to continue selling substandard chocolate to the masses, but because it wants to maintain the lie that Americans are empowered by individualistic capitalism to choose whatever chocolate they want, when in fact it crushes their taste buds to the point that they cannot even imagine a better, sweeter world."

People might have different tastes.

Hershey's lawsuit against Cadbury was due to intellectual property rights being violated.

Please stop this communist nonsense.

<comment><USER16> This is really an incredible kind of communism. Corporate America makes bad chocolate, which proves that capitalism is a lie, so buy corporate British chocolate.

</comment></comment><comment><USER17> What do choco connoisseurs think of Theo chocolate?

<comment><USER18> The chocolate is pretty good and I love the smell as I bike past the factory on my ride home every day.

<comment><USER17> what a useless reply

</comment></comment></comment><comment><USER19> If you like Cadbury chocolate, you'll probably like KitKat bars. Similar taste and texture to the chocolate.

<comment><USER19> Y'all are haters. Haters I say!

</comment></comment><comment><USER20> Does this really belong on the front page of HN (or HN at all)? It's a diatribe about how one guy likes UK chocolate more than US chocolate. Super curious how it wound up on the front page too.

<comment><USER21> Downvote and move on then, brah

<comment><USER20> You can't downvote submissions. Also curious that an account with 1 karma point is protesting someone pointing out that this doesn't belong here.

<comment><USER22> You can flag submissions.

<comment><USER20> Yes, you can, and I did. But that's not what he suggested. Interesting that my comment itself is now flagged too. My guess is bot accounts.

</comment></comment></comment></comment></comment><comment><USER23> Bringing up cadbury as the gold standard tells more about her bad taste in chocolate than any inherent flaws of capitalism.

Even at walmart you can get a ghirardelli dark, or a lindt 90%. Cadbury--even UK cadbury--is a chunk of sugared grease by comparison.

[https://www.cadbury.co.uk/products/cadbury-dairy- milk-11294](https://www.cadbury.co.uk/products/cadbury-dairy-milk-11294)

<comment><USER24> Everyone has their personal preferences. But you're comparing a milk chocolate with very dark chocoloate. Cadbury bournville is the dark variety, but I bet its not close to 90%. So if you like 90% chocolate, sure you will hate dairy milk. As far as milk chocolate goes though, cadbury is one of the best IMO. Usually people are split between dove/galaxy and dairy milk (as far as mass produced chocolate goes)

<comment><USER23> She wasn't just talking chocolate. She was getting into economics.

Brought up the dark chocolate because it is the more costly product to manufacture. Cocoa solids and cocoa butter are expensive. Sugar and vegetable oil aren't. If this is a corporate ploy to acclimate people to trash chocolate for profits, she was already on trash chocolate. But even in the low-rent grocers, the premium product is available. Doesn't jive with her thesis.

<comment><USER24> I agree in part. But why did she say "is a chunk of sugared grease by comparison". Seems like that clearly shows she was comparing the two in taste as well...

<comment><USER23> "sugared grease" was from me, not the author.

I wrote that because cadbury has gotten heat in the past for substituting vegetable fats for cocoa butter, and the #2 ingredient in her favorite is sugar. Cocoa products make their first appearance at #3: [https://www.cadbury.co.uk/products/cadbury-dairy- milk-11294](https://www.cadbury.co.uk/products/cadbury-dairy-milk-11294)

Compare with the Lindt 90%: [https://www.lindtusa.com/wcsstore/LindtCatalogAssetStore/Att...](https://www.lindtusa.com/wcsstore/LindtCatalogAssetStore/Attachment/products/nutritional/nutritional- information-SKU-392977.pdf)

<comment><USER24> I assumed the "she" was you as I hadn't read the article yet. So I was referring to you in my comment. As for the comparisons with Lindt 90%, just stop. Choose a lindt product that's a similar % to dairy milk. Here you go: [https://www.lindtusa.com/wcsstore/LindtStorefrontAssetStore/...](https://www.lindtusa.com/wcsstore/LindtStorefrontAssetStore/Attachment/products/nutritional- information-SKU-4852.pdf)

<comment><USER23> If you read the article, her thesis is that we are under an illusion of consumer choice. That we have several dark and milk varieties of differing qualities and compositions undermines that thesis. Pedantic reminders of apples-to-apples are unwarranted.

From the HN guidelines:

" _Please respond to the strongest plausible interpretation of what someone says, not a weaker one that 's easier to criticize. Assume good faith._"

<comment><USER24> I don't disagree with your comment here. Next time lead with a comment like this that gets to what you're trying to say. If you feel I was being pedantic, then you've missed my points</comment></comment></comment></comment></comment></comment></comment></comment>


Show HN: React Virtualized Pivot – A pivot table component for React - <AUTHOR> https://turnerniles.github.io/react-virtualized-pivot <comment><USER2> Very cool. How does this compare to established products like OpenFin?

<comment><USER3> I think it's competitive in the amount of data it can handle although we achieve this in a different manner than OpenFin (pure virtualization with limited DOM rendering as opposed to canvas rendering). This also makes it easier to play around with event handlers and perform other DOM manipulation. OpenFin does allow for plain table view while we focus only on pivot table, but that is something we could easily add if people would find it useful.</comment></comment>


Borders stalls book payments, doubts survival in e-book era - <AUTHOR> http://www.electronista.com/articles/10/12/31/borders.delays.book.payments.in.financial.deals/ <comment><USER3> The problem is that bookstores charge too much money.

Borders will sell my book for $49 when it comes out, whereas you can preorder it from Amazon for around $22 which is about what it costs to buy the ebook copy right from the publisher. Then my book won't sell because it's too expensive, so we'll have to buy it _back_ from Borders and I'll get charged against my royalties for a "return".

It's not e-books, it's that the prices are too high. Amazon has every book Borders has, and if I ship the thing overnight I still end up with a cheaper copy than it would cost to buy it across town.

Going out of business is the result of not meeting customer demand, either in terms of relevance, quality, or in this case, price.

<comment><USER4> > The problem is that bookstores charge too much money.

What exactly do you expect them to do? Do you have any idea of the overhead of running a bookstore? It's easy to say that Borders should match Amazon's price, but if you take one look at an Amazon fulfillment center, you'll see a gap that simply can't be closed.

<comment><USER5> _What exactly do you expect them to do? Do you have any idea of the overhead of running a bookstore?_

I suppose he expects them to go out of business. The cost of operating a bookstore is irrelevant to the buyer - if the overhead is such that they can't either compete on price or otherwise differentiate their product or experience to justify the cost difference, then abandoning the business model seems like the only choice.

</comment></comment></comment><comment><USER6> I still buy printed books. I almost never buy any books at a major book retail store like Borders or BN because they carry very very little that I am interested in buying. They used to stock more that I was interested in, but their stock has changed over the years. I suppose they were aiming for a more middle-of-the-road, palatable-to-all sort of stock selection, but I for one have basically been driven away.

I initially reason, well, I must be a very unusual shopper. I buy a lot of books on programming topics, math, science, etc., and I eschew with passion anything written for dummies, idiots, fools, or morons.

But then I wonder, am I really so unusual? I'm not an expert historian, but I enjoy studying history, and I'm disappointed with the local store's selection of history books about as much as I am with their technology books. I enjoy studying linguistics, and have watched the store's linguistics section melt away into nothingness. I enjoy science fiction, but am dismayed to see shelves of fantasy displace books by my favorite authors.

I can't really speak for every subject matter, but for pretty much every topic I want to read about, the big chain bookstores seem to be dwindling their stock, and smoothing out what little they do carry to appeal to some unknown typical readership.

If this is indeed true of all (or even most) of the subjects of books they carry, then I find it hard to believe that anyone who truly enjoys reading books is content with what they carry. Which leaves... people who really aren't very fond of books to peruse the shelves? I don't know. It doesn't make any sense to me.

I would greatly enjoy doing more book shopping in person. I seem to be good enough at searching Amazon to come up with good books sight unseen, but I'd like to go browse in the store, if only the store had books in stock that I'd want to browse.

<comment><USER7> Not to mention, even if Borders had it, Amazon would be cheaper anyway, and Amazon's reviews are a huge source of book information to me.

<comment><USER8> Amazon reviews are seriously broken. I'm surprised anyone would want to defend them other than Amazon employees or partners.

Sure, there are some good reviews on Amazon by credible critics and book lovers, but they have increasingly become like searching for a needle in a stack of needles. Most reviews I read, even on academic books that the hoi polloi don't read much, variate a great deal and swing wildly between 5 star ratings and 0. They are also filled with petty invective, academic flame wars that have no place on a good review site, and authors faking reviews for their own books (or those of their scholastic rivals).

<comment><USER9> I find them generally informative, it depends on the book I guess. If something has 20+ reviews you can easily get a pretty good feel for it. I'd agree with you on obscure stuff with only a handful of reviews. As long as you don't have to trust any single reviewer there is a lot of good information to be had, same with IMDB really, every popular movie has reviews at each extreme, but given enough choice in reviews you can get a decent feel for it.

</comment></comment></comment></comment><comment><USER10> The Barnes and Noble I used to go to all the time in Manhattan will be closing January 3rd. It's really sad. The economics are fairly straightforward: _physical stores cannot compete with the internet for goods sold._ However, I'd only buy something on perhaps one-fifth of my visits. What they really had was an atmosphere, and the coffeeshop / bookstore experience is something Amazon can never sell.

They need to make a pivot into selling an experience, which is obviously harder to monetize than sold goods. But it's certainly possible (see: Starbucks) and it's something a lot of people are willing to pay for.

</comment><comment><USER11> What is the future of bookselling? As much as I understand the efficiencies of Amazon, browsing through a bookstore can't be replaced by online; it's a different experience.

<comment><USER12> I'm under thirty, but I can't stand e-books and will be reading from dead trees until they stop printing on them.

<comment><USER8> Voted you up because I like the sentiment behind your comment and love printed books, but I still am eco-friendly enough to think it's better to not cut down the trees if we don't have to.

<comment><USER13> Books are kept, usually. Magazines are a far greater waste of paper - <USER2> that said, most paper is from farmed wood nowadays.

</comment></comment></comment></comment><comment><USER14> Sometime I wonder what would happen in the near-future?

Many brick-n-mortar stores (musics/cd, books, video-rental) where people used to sort of hang-out are now closing their doors and filing bankruptcy. Many young people are losing their jobs.

A few days ago I saw Amazon selling video games about $10 cheaper than EBGames (this particular game: Call of Duty Black Ops).

These are places where kids and teenagers used to hang out or even work during the summer.

Automation is replacing humans. Not sure if that's good or bad.

As much as I'd like to buy items cheaper, I'm a bit worried with the repercussion of my action.

</comment><comment><USER15> I haven't bought a book in a store since probably 1999. I remember buying from bookpool.com when they were around and had the cheapest tech books.

Recently Amazon has basically dominated this market and has eaten the B&M stores lunches, as far as I am concerned. The best thing Amazon ever did was launch the ratings and reviews and get tons of people to add valuable content to their site and augment the one huge disadvantage they had over B&M; you can't tell if the book was any good. I find the ratings and reviews are as valuable, if not more, than me briefly looking through the book myself.

Now, I don't think ebooks have much to do with this at all as I don't see ebooks selling nearly as well as people think they will sell. I personally hate reading in that format and will continue to buy books to read as I find the experience much more enjoyable and maintainable. Thinks like Safari online are just AWFUL ways to consume material, IMO. The only reason I have ebooks is if I travel and want to have something to read on my iPad instead of carrying 4-6 books with me.

Oh yeah, and don't get me started on the price of most technical ebooks!

All in all...B&M stores like Borders are dying b/c they couldn't or wouldn't adapt in the face of someone like Amazon who is better at the modern game than they are. This is very much like Netflix v Blockbuster...

</comment><comment><USER16> Our local bookstore (part of a regional chain) has three times the shelf space for Manga than they do for computer books.

I used to like browsing in bookstores but now its like they don't want my business. Why should I have the bookstore order something for me? I pay more than Amazon and they add no value - that's why they're failing.

<comment><USER17> "Why should I have the bookstore order something for me? I pay more than Amazon and they add no value ..."

They add value by allowing you to physically browse through books to see what they're like.

I buy some books based on author or recommendation, but otherwise I'd prefer to be able to flip through a book (a, no, "Look Inside!" isn't the same) to get a feel for it.

There's also the serendipity factor you get just from wandering around a book store, picking stuff up because the cover caught your eye or whatever.

The problem for the bookstore is all of that is available to people whether they make a purchase or not, so they end up being the display room for Amazon.

</comment></comment><comment><USER18> Starbucks should sell more books, and find the right size for their "mega store"...which would basically be the size of the old small neighborhood bookstores. They have the atmosphere similar to what people loved about old small neighborhood bookstores.

</comment><comment><USER19> I was just telling my wife this morning that the book business has changed radically -- there's been a seismic shift in the last year.

I don't see how the brick-and-mortar guys are going to do it. Even if you charged more and offered a high-touch experience, folks will just come in, browse the books, then scan them on their iPhone and buy them on the net.

Ebooks throws an even bigger monkey wrench into the works.

Major changes are coming.

<comment><USER20> Some bricks and mortar stores are doing fine, the local shops that stock local books and local authors and sell used books are doing great. Amazon gives them a global market for their used stock.

The chains that campaigned against net price agreements and talked about business and not being sentimental are no complaining about ebooks, Amazon and supermarkets - well tough</comment></comment>


Common accessibility problems, and how to fix them - <AUTHOR> https://blog.scottlogic.com/2020/07/02/6-most-common-accessibility-problems.html <comment><USER2> This page about common accessibility problems actually has an accessibility problem of its own; the text is too thin, as it applies a font-weight of 300. The increased size helps but doesn't fully compensate. It's not just the mentioned color contrast that matters.

(Notably, many OSX-based designers will apply this lighter font weight because OSX increases the stroke thickness of all fonts, on display. So you'll not see the problem if you're using a Mac and you'll probably only see it on a hi-dpi display.)

<comment><USER3> [https://wave.webaim.org/report#/https://blog.scottlogic.com/...](https://wave.webaim.org/report#/https://blog.scottlogic.com/2020/07/02/6-most- common-accessibility-problems.html)

An empty link error and several contrast errors. This alone was enough to get my company sued.

<comment><USER4> Very common; ironic examples abound. [https://wave.webaim.org/report#/https://developer.mozilla.or...](https://wave.webaim.org/report#/https://developer.mozilla.org/en- US/docs/Web/Accessibility/Understanding_WCAG/Perceivable)

</comment></comment></comment><comment><USER5> 1\. Low Contrast Text: use Google Lighthouse [1]

2\. Missing Alternative Text for Images: use attributes alt=, aria-label=, aria-labelledby=

3\. Empty Links: use attributes aria-label=, aria-labelledby=

4\. Empty Buttons: use attributes aria-label=, aria-labelledby=

5\. Missing Form Input Labels: use s

6\. Missing Document Language: use lang=

Like many problems with the modern web, the solution is to use well formed HTML5 with the aria-label* attributes used to address edge cases.

[1] [https://developers.google.com/web/tools/lighthouse](https://developers.google.com/web/tools/lighthouse)

</comment><comment><USER6> Most problems I've seen there stem from "but the outdated screenreaders everyone uses cannot parse this". So after of course doing what the original article recommends, you also need to think long and hard about what kinds of new markup or _gasp_ javascript you want to allow. Because the average screenreader out there will beat IE6 in crappyness.

<comment><USER7> Related, is there any consensus as to which are the best screen readers?

<comment><USER2> Jaws (for Windows) in the most popular and widely regarded as the best, though it can be a bit costly (like $200-$300 per year).

On windows, NVDA is also widely used and is free, but you will need to buy a good vocaliser/voice for it. Windows has a built-in Narrator, but the voice is not clearly audible at high speed, so people tend to move on.

On phones, iOS and Android both have built-in, capable screen readers, but they lack flexibility for internet usage.

On OSX, the built-in VoiceOver technology is apparently good, and widely used.

If you're wanting to test what the screen-reader experience might be like, you could do worse than trying the one built in to your operating system (Windows Narrator or iOS VoiceOver). Increase the voice speed for a better experience.

<comment><USER8> NVDA has surpassed JAWS as the most popular SR. [https://webaim.org/projects/screenreadersurvey8/#primary](https://webaim.org/projects/screenreadersurvey8/#primary)

</comment></comment></comment></comment><comment><USER9> According to this, if I have

label

should the img have aria-labeled-by as well?

<comment><USER2> It depends. Essentially, the label of the image should be what you would read out to someone in place of the image if you were reading the page out loud.

So if the image is of Jerry running away from Tom and the nearby label is "Classic mayhem", then you should instead use an alt-text like "Classic cartoon with Jerry running away from Tom". But if the image is of Tom Hanks accepting an Emmy and the nearby label is "Tom Hanks accepting an Emmy" then an aria-labeled-by with the span's id is fine.

Note that this is why an alt-text of "Company logo" is almost never what you want; it isn't what you'd read when reading the page out to someone.

<comment><USER9> I see. I'm using Markdown ![alt text](/src/of/image.jpg "title")

So I suppose I can put the title in the  and the alt text in the img alt tag, then only use aria-labelledby if no alt text is provided.</comment></comment></comment>


John Carmack surprises fans (and his CEO) with Wolfenstein 3D for the iPhone  - <AUTHOR> http://venturebeat.com/2009/04/03/john-carmack-surprises-fans-and-his-ceo-with-wolfenstein-3d-for-the-iphone/ <comment><USER3> Not only does Wolf3d run beautifully on the iPhone, the controls (and options for modifying them) actually make the iPhone a viable platform for 2.5 dimensional FPS games.

I'd like to see what he can come up with for Quake (a fully 3D shooter - <USER2> adds aiming up and down)

<comment> daniel-cussen You'd need some kind of giro for the z-axis. Right now the iphone can only tell if it's facing uyp or facing down, but can't tell by what degree. Maybe in later edititons they will make the z-axis giro like the others. Alternatively, you could make a device you can attach to the iphone that tells it its position along the median plane.

</comment></comment><comment><USER4> Great interview, this guy makes a good publicity person. Watch how he stays on his point throughout the questions, the list of products you (the consumer) should be watching out for at the end is superb.

</comment><comment><USER5> _People thought you couldn't do 3D games on the iPhone but here it is running._

Who thought that? Todd never looked at Apple's App Store.

PS: Wolfenstein 3D doesn't have a real 3D engine anyway.

<comment><USER6> 3D is not "real". The output of 3D apps are projected onto a 2D screen (VR goggles not withstanding, but even then, there are simply two outputs projected onto two 2D screens).

Wolfenstein has rasterization, just like a "real" 3D engine does. Its engine happens to be optimized for certain viewpoints, which makes it "2.5D", but it still gives a crude approximation of 3D, just like every other "3D" game.

<comment><USER7> I think your comment underestimates developments in 3d hardware and software in the last 15 years or so.

<comment><USER8> Woosh

</comment></comment></comment></comment><comment><USER9> How is this a surprise? He's been blogging about it for months...

<comment><USER10> Do you have a source on that? Carmack rarely updates his blog. The only info I've seen about Wolf3d on the iPhone are the development notes released a little over a week ago.

Edit: The dev notes are here: [http://www.idsoftware.com/wolfenstein3dclassic/wolfdevelopme...](http://www.idsoftware.com/wolfenstein3dclassic/wolfdevelopment.htm)

</comment></comment><comment><USER11> Later in the interview: "How did the launch for Quake Live [the free browser- based version of the circa 1995 ID Software game]..."

Way to do your research; Quake 3 came out in 1999.</comment>


Every Permission 0000 to 0777 - <AUTHOR> https://packetfactory.wordpress.com/2012/03/02/every-permission-0000-to-0777/ <comment><USER2> much easier to remember the letter form for most things.

chmod a+x

chmod o-rw

<comment><USER3> Don't forget about "=" and ",". 0644 would be u=rw,go=r.

Also worth pointing out that this syntax isn't an extension; it's defined by POSIX and widely supported.[1] People like to add a positional syntax as described in the article (e.g. "rw-r--r--") to their ad hoc utilities, but it's not nearly as powerful.

[1] [https://pubs.opengroup.org/onlinepubs/9699919799/utilities/c...](https://pubs.opengroup.org/onlinepubs/9699919799/utilities/chmod.html#tag_20_17_13)</comment></comment>