.Trashes, .fseventsd, and .Spotlight-V100 - <AUTHOR> http://blog.hostilefork.com/trashes-fseventsd-and-spotlight-v100/ <comment><USER2> A few little arguments _in favor of_ this practice:

1\. You plug a USB device into one Mac. It asks you if you want to use it for Time Machine. You say no. Now, no other Mac will ask you this question again—because the preference has been stored on the drive, instead of on the computer.

2\. You create a folder with an app you've written in it, and customize it with a cute "drag [this] onto [shortcut to Applications folder]" background, centering the icons on the background positions and sizing the window to perfectly fit the representation. You then copy this folder to another Mac (or any equivalent process, such as converting it into a DMG disk image and having someone download it.) They see exactly what you saw.

3\. You keep an external hard disk that you frequently move back-and-forth between two Macs. The first time you plugged it into one of the Macs, it was indexed. Each time you modify it on either Mac, that index gets updated. The most recently created files are the most likely to be the ones you'll want to find through Spotlight when you plug the disk into the other Mac—but if the index was machine-local rather than disk-local, the new Mac wouldn't know about the new files yet, and would have to finish re-indexing to find them. (This is, of course, what happens when you modify the disk on a Windows computer, and it sucks. We really need a "metadata index API" to start being an expected offering of a filesystem, such that all OSes interacting with the filesystem can read and update it!)

On the other hand, Windows' Thumbs.db is exactly the sort of thing you _don 't_ want cached on the media. It'd be a great innovation if, say, cameras could pre-generate Thumbs.db files so Windows could immediately show the user what was on an SD card the first time it got plugged in... but cameras don't, because Thumbs.db is a random proprietary format. So, instead, it's only useful in the same situation that the Spotlight index is: moving a drive full of photos back and forth between two computers. Which might have separate screen DPI, and thus be set to show different thumbnails, meaning new thumbnails will get generated anyway.

<comment><USER3> Or, OS X could wait until the appropriate time to offer you the option of messing with your disk.

1\. Don't ask about using the disk for Time Machine. When the user goes to Time Machine because they want to use Time Machine, then have a button in the sidebar "Use drive blah for Time Machine" for any non-time-machine external drives present.

2\. Have a button at the top of a finder window in which icons have been re- arranged saying "preserve layout in this folder" (which you only have to click the first time, of course it remembers along with the layout). (Also, make it more convenient to default all folders/finders to list-with-details view, for people who have any idea what they're doing.)

3\. When the user opens Spotlight, have a button in the sidebar "index this drive for Spotlight" for any un-indexed drives present.

In all these cases, it's still super duper easy to use all these things, without _always_ bothering people who don't want these things.

<comment><USER4> That is this kind of thinking of engineers vs. regular user.

You know why Windows users are so prone to viruses and such? Because they learned to click "OK". They learned it, because they always got the question/offer if they want to proceed or not. But a regular user don't understand those technical details and you know, they don't _want_ to understand those details. So we learned them to click "OK".

The best UX for the regular user is any UI where regular users have less choices of technical details.

I said that already the other day: as an engineer myself, I were chatting with another engineer about a product they have done (device integrated into a car for special purposes). I said to him, that something feels wrong with the interface. Yes, all the required information is present. Yes, probably I myself would have designed the UI the same way. But over the time I've got some sense in terms of UX, which a product makes it compelling or just doing its job.

The same you see with smart home. For how long there are HVAC controls out in the field by Honeywell and others? The better one are all programmable in all regards. But only Nest, which removed a lot from the interface made the big wave.

<comment><USER3> That's not a good argument against my proposal. How is

Want to use this drive for Time Machine? [OK]

better than going into the time machine app / prefpane / whatever, and seeing [use drive WD-BOOK for time machine] on the side, non-modal? so people who don't know what they're doing don't have to click or even see anything?

UI/UX designers do a lot of really stupid stuff in the name of making things "simple" and "easy". Engineers who think they're more of a people person and know some UI/UX probably do it even more. Give up the gimmicks, the ridiculous space between elements. The material design, the flat-aqua design, it's all crap.

I've seen "regular users" fail to use all these things, and need my help find a way through the increasingly hidden and opaque interfaces to what they're trying to do. Usually because things that are supposed to "just work" instead "just don't work" and there's no way to fix it. Except for me. So interfaces designed for me would probably not be a bad idea ;)

<comment><USER5> Most of the users I know wouldn't know where to go to set up a Time Machine drive. The fact that it prompts them flat out is how they even got it set up in the first place.

</comment></comment></comment></comment></comment><comment><USER6> I'd be more inclined to berate Apple for this were it not for the amount of crap that Unix-style tools dump in my home directory.

I count 50 .-prefixed files or directories at present, some of which is from Mac developers who should know better (hello, Adobe, Dropbox), some is cryptically-named gunk from other tools (.vegas, .jmf), some various command line histories (bash, fcsh, mysql, psql, pry, sqlite, irb), and so on.

OS X is nicer than traditional Unix behaviour here - it puts it all in a well- organised ~/Library directory.

<comment><USER7> On Linux things should go in xdg dirs ~/.config ~/.local and ~/.cache instead of ~ but a lot of old unix software and sadly a decent amount of new software(even guis) don't follow the standard.

</comment></comment><comment><USER8> This accomplished two things:

1\. I now know a few things I've wondered for a long time.

2\. I have just been reminded of how little I really know, even about devices I use for most of my waking hours.

</comment><comment><USER9> for the love of christ, it's OS X, not OS/X

<comment><USER10> I want to see someone come out with an OS/2 skin of sorts for OS X, just to make everyone in the world that much more confused.

</comment></comment><comment><USER11> So that .Spotlight-V100 store some kind of index, probably binary. I presume that any Mac reads it on any arbitrary USB drive it's plugged in (or, at least, when a search is triggered). By creating a specially-crafted, corrupted index I see a channel for denial of service attacks.

<comment><USER12> You can probably still abuse NSDictionary, causing HashDoS ([https://gist.github.com/dchest/4467707](https://gist.github.com/dchest/4467707)). I did it with QuickLook a few years ago; don't know if they replaced a hash function there.

</comment></comment><comment><USER13> _Hopefully users will push back; demanding to be given more options, and more control. We 've gotten to a point where the role technology plays in our lives is too integral to keep letting that control slip away, one "harmless" feature at a time._

Amen to that. Unfortunately it seems the trend is towards hiding the filesystem/concept of files completely from the user and replacing it with app-specific isolated storage in a proprietary format, which is even worse than unsolicited filesystem modifications. (On the other hand, it could be argued that these modifications would become even less noticeable in such a system... which is good or bad depending on who you ask. I'm firmly on the latter side.)

A physical write-protect is something all removable storage should have.

</comment><comment><USER14> I do this if I forget to add .DS_Store to .gitignore when working with git repos: find . -name .*DS_Store -delete

<comment><USER15>
        git config --global core.excludesfile ~/.config/git/ignore

        cat >> ~/.config/git/ignore
        .DS_Store
        .AppleDouble
        .LSOverride
        .AppleDB
        .AppleDesktop
        .apdisk
        .fseventsd
        .Trashes
        .Spotlight-V100
        ._*
        Icon
        Network Trash Folder
        Temporary Items
        Icon

<comment><USER16> Why not .* ?

I can't think of a good reason to commit hidden files.

</comment></comment></comment><comment><USER17> It seems to me, that if I insert a removable media that is formatted with one of the FAT filesystem variants, that I probably don't want those hidden files & folders created. As it's a sign that the ultimate destination probably isn't another Mac.

</comment><comment><USER18> It is annoying when copying a movie to a USB, and having to empty the entire trash bin to fit it on the USB stick. I guess it does enforce you to be a bit cleaner.

I don't really care about .DS_store etc as they're hidden, and thumbs.db is just as bad.

<comment><USER19> > I don't really care about .DS_store etc as they're hidden

They ain't if you are on Windows.

<comment><USER2> That's really just silliness on the part of Apple; if they're creating dotfiles on a FAT32/NTFS/ExtFS disk, they should be setting the Hidden attribute for those same files. This is what e.g. Samba does automatically for network-attached FAT/NTFS folders on OSX/Linux clients, if I recall.

<comment><USER15> There was a patch submitted to the Darwin project to do this:

Https://lists.apple.com/archives/Darwin-kernel/2004/Jul/msg00120.html

I don't think it ever got reviewed though.

</comment></comment></comment></comment><comment><USER20> Eject for Windows ([http://www011.upp.so- net.ne.jp/decafish/EjectForWindows/Ejec...](http://www011.upp.so- net.ne.jp/decafish/EjectForWindows/EjectForWindowsE.html))

</comment><comment><USER21> Before OSX 10.10.2, apparently there was a "heartbleed" style info leak in spotlight where it "may save unexpected information to an external hard drive", according to [http://support.apple.com/en- us/HT204244](http://support.apple.com/en-us/HT204244) (CVE-2014-8832). Probably related to this report: [https://www.f-secure.com/weblog/archives/00002752.html](https://www.f-secure.com/weblog/archives/00002752.html)

</comment><comment><USER22> What happens when the drive is shared among Macs? Why isn't this a vector for exploitation?

<comment><USER23> Well, if you find a buffer overflow that can lead to code execution in spotlight (mds) or fseventsd then it very well could be a vector. Assuming no bugs in those (hah), then I'm not sure what you could exploit…

</comment></comment><comment><USER24> Never understood why they do this. Surely they should keep junk off removable drives, as they are the _most_ likely to be used in other systems including ones that don't hide data from the user.

</comment><comment><USER25> It's just nonsense that this metadata would be dropped as files scattered across the filesystem, rather than simply held in a single location on the host machine. They're a fragment of the OS, not of each directory.

<comment><USER4> Which would mean that those meta data is only available on this host and not anywhere.

The problem is the short coming of those file systems not to allow to store arbitrary meta data to any file.

<comment><USER25> That's exactly what I want though. "Folder display preferences" are a thing that pertain to exactly one instance of one operating system. If I want to share "folder displays" to a different computer (which seems rather unnecessary), that seems like an explicit action I might take between the two computers, and all that metadata should be a single bundled file that is transferred between machines. Not per-directory metadata that is bundled into my filesystem everywhere.</comment></comment></comment>


Apple now runs on 100% green energy - <AUTHOR> https://www.fastcompany.com/40554151/how-apple-got-to-100-renewable-energy-the-right-way <comment><USER2> "Though the 100% figure covers only Apple's own operations–not those of of the suppliers and contract manufacturers which do much of the work of bringing its ideas to life–it's also convinced 23 companies in its supply chain to sign a pledge to get to 100% renewable energy for the portion of their business relating to Apple products. "

They're doing a massively good thing here. I'm a bit more glad now for choosing Apple.

</comment><comment><USER3> So, how much energy can you get from the tears of wage slaves? Oh? You're not talking about their factories?

</comment><comment><USER4> And yet you need a car to get there</comment>


Nokia's Low-End Asha Is Outselling Lumia Two to One - <AUTHOR> http://allthingsd.com/20130113/nokias-low-end-asha-is-outselling-lumia-2-to-1/ <comment><USER2> Good. Nokia's S40 based devices are awesome. They are the last bastion of sense in the mobile communications market.

I've just replaced by Lumia 710 with a Nokia C2-01 on pre-pay. It cost bugger all, last literally days to the point I don't have to carry a fucking charger on me 24/7 any more, bounces when you drop it, actually has decent call quality and I can actually type on it without smashing my face on a lamp post every few minutes because I have to spend all my time staring at it to correct mistakes. Plus the sound quality is better when playing mp3s and the alarm clock is actually audible (the Lumia one is like an ant farting). And if I break it or lose it, I will just shrug and buy another one for less than the monthly contract bill of a Lumia 920.

I have willingly traded convenient browsing, email [1], apps and all that shit for a phone that actually works properly when I need it to. In fact it's improved my life because I'm not constantly bugged and distracted by the damn thing.

I've had an iPhone 4, Galaxy Ace, Galaxy S3, HTC Desire recently and they are all just as horrible so this is not specific to the Lumia but the whole "SmartPhone" concept.

[1] It actually has a good IMAP4 client in it but I haven't bothered to use it past an initial test as email is annoying me.

<comment><USER3> _I have willingly traded convenient browsing, email [1], apps and all that shit for a phone that actually works properly when I need it to._

Wait, are you one of those fabled people who use phones as phones? :)

Jokes aside, maybe I'll have to upgrade to one of those. I've got a $20 dumbphone right now, and it is _almost_ good enough. Some good 'ol Nokia durability might be just what I need.

Can you sync a calender to it over USB? Calender sync is the only "feature" I miss about fancy-phones.

<comment><USER2> I am the fabled :)

I haven't tried it but you can sync the calendar with nokias data suite which is actually pretty damn good. I think it supports ical as well but again I haven't tried it as I don't use a calendar (other than the one in my head)

</comment></comment></comment><comment><USER4> So a cheaper device is selling more units than a more expensive one? This hardly seems newsworthy. If the Asha was making more profit then perhaps something interesting might be happening but there's no indication that this is the case. Perhaps a better headline would be "Nokia Asha sold 9.3m units in Q4".

</comment><comment><USER5> Not very surprising that there is still a market for inexpensive phones. I imagine Samsung sells far more cheap Android phones like the Galaxy Y than they do high end phones.

</comment><comment><USER6> That interface looks a lot like MeeGo, which is great. Is it just me who sees that?

Such a shame we never really got to a phone mass-marketed with it.

<comment><USER7> That's just Nokia's icon grid. Later versions of Symbian also look like that. Meebo (and the Nokia N9) was great, but it wasn't amazing. Honestly I doubt they would have sold enough units to create a reasonable ecosystem anyway, so it would have still been a dying platform, just one where hundreds of millions of marketing dollars had been spent.

At the time when the N9 came out, people just weren't interested in the N9 at all (and this is in Australia, where Nokias used to be best-regarded manufacturer). They had a few disasters with Symbian (the n97/n97 mini/C3/N8), and even Nokia die-hards weren't prepared to recontract with another Nokia handset (I was working in telco at the time).

</comment></comment><comment><USER7> Only two to one? The only phones which have sold over 100 million handsets are low end devices manufactured by Nokia, and Nokia has made EIGHT such phones [1].

Sure, the Asha series are basic smart phones, rather than the feature phones of the above models, but it wouldn't be an unreasonable assumption to think that the people in 'emerging markets' who bought basic feature phones in 2005 are now moving to basic smart phones.

[1] [http://en.wikipedia.org/wiki/List_of_best- selling_mobile_pho...](http://en.wikipedia.org/wiki/List_of_best- selling_mobile_phones#Best-selling_mobile_phone)

</comment><comment><USER8> Those little cheap Nokias are great for what they are. I had a Nokia 1800 for a long time and it did its job perfectly: good reception, battery lasted forever, screen was always easy to read, alarm was nice and loud, software was easy enough to use.

I use a Nexus S now and it's probably altered too many of my habits for me to go back, but I still miss how my little cheap Nokia just did its job and did it well.

I am considering switching my Nexus S for a Nexus 7 + cheap Nokia combo though. It seems like it would give me the best of both worlds. We'll see.

</comment><comment><USER9> Good for them, but unless this thing has a reasonable profit margin Nokia still might not live to see 2014.</comment>


HTML5 is the Future of Book Authorship - <AUTHOR> http://programming.oreilly.com/2013/09/html5-is-the-future-of-book-authorship.html?cmp=tw-na-na-article-na_sanders_article <comment><USER2> the sleight-of-hand going on here is where (x)html5 is labeled as the "source", which creates "output".

of course, writers don't really write in (x)html5.

and editors don't really want to edit in (x)html5, because dodging the brackets is a pain in the butt.

and when it comes to revision time, _nobody_ will relish digging into the guts of an (x)html5 file. (go look at their files; you will see i am right.)

this is an old story, one that has been told before. let's ask the people who "future-proofed" their stuff by putting it in (x)html2.1 how that worked for them. ("wait, there's no 'article' or 'section' tags here!")

in the last 5 years, o'reilly made a ton of money off the publishing sector, pushing "xml-first" crap, and .epub too. then they dropped their conferences, and now they're reversing to yet another magic format.

sleight-of-hand, baby. it's a beautiful thing.

if you can get away with it, that is...

-bowerbird</comment>


I'm sick of Facebook. Let's steal their users - <AUTHOR> https://userheist.com <comment><USER2> Good idea. It actually has been implemented already. You are also not very specific IMHO.

How do I know that after a million users you won't turn into another Mark Zuckerberg like czar?

I'd rather stick with the other attempts: Mastodon, Ello, Diaspora. They all offer good levels of privacy.

<comment><AUTHOR> Haha I hope I don't turn into one! It's hard to get it all on a page and still be a little concise. Would love to answer any questions. There certainly are many options, for the ones you mentioned federated or decentralized I feel like the concept while really cool isn't as accessible as just a website. Other options are also too niche. I think Facebook did a couple things well one of which was have a diverse user base.

</comment></comment><comment><USER3> I'm concerned that donations would not be enough to pay for moderation of the site when it becomes mainstream and you'd get all kinds of abuse, inappropriate/illegal content, etc.

<comment><AUTHOR> Abuse and illegal content is a huge worry of mine. Maintaining a moderation working group is a concern at scale for sure. My aim is to adopt a volunteer moderation program similar to reddit.</comment></comment>


You Can't Regulate The Internet - <AUTHOR> http://www.impressmyself.com/post/37720619744/you-cant-regulate-the-internet <comment><USER2> Silly article. I agree that regulation of the Internet is futile, but this article gives no evidence. How about some basic discussion of:

* Packet-switched network principles

* Transport-layer encryption (e.g. SSL)

* Onion routing

* Peer-to-peer software, particularly with the advent of IPv6

Blindly asserting that the Internet 'is an organism that thrives on freedom and will always grow toward it' is just preaching to the converted.

<comment><AUTHOR> That's why I wrote it, it was a preaching article. You're right though it would be great if someone wrote that article, with all the facts.

<comment><USER3> I'm sorry, but you didn't really write anything. You only wrote that you don't think the internet can be regulated then backed it up by saying other people will take care of it.

<comment><AUTHOR> I wasn't trying to to back it up, it was the marshmallow fluff in your moon pie. It's just there to make you feel good.</comment></comment></comment></comment>


To whom can a survey company sell its data? - <AUTHOR> I want to build an app that pays people to fill surveys. Where can I get companies who would pay for such surveys? <comment><USER2> A quick google search showed the following companies who buys data.

\- [http://www.bigdataexchange.com/](http://www.bigdataexchange.com/)

\- [http://www.exapik.com/](http://www.exapik.com/)

PS: I am not familiar with any of these.</comment>


Man ordered to uncover face in front of police camera and then fined £90 - <AUTHOR> https://www.mirror.co.uk/news/uk-news/man-ordered-uncover-face-front-16155463 <comment><USER2> Another report [https://metro.co.uk/2019/05/16/moment-man-fined-90-hiding- fa...](https://metro.co.uk/2019/05/16/moment-man-fined-90-hiding-face-police- facial-recognition-cameras-9571463/)

It's a little bit like saying "If she doesn't want to be tossed into the water she must be a witch!"

</comment><comment><USER3> A slightly older and much more active discussion: [https://news.ycombinator.com/item?id=19928231](https://news.ycombinator.com/item?id=19928231)</comment>


KnowledgeBid v2 - looking for feedback on new design - <AUTHOR>

We got great feedback on v1 and could use some more...
http://www.knowledgebid.com
v1 feedback from YC:  http://news.ycombinator.com/item?id=65969 <comment><USER2> I remember the v1, and this definitely looks a lot better. I have one suggestion though: the 3+3 main points on either side are the ones that people will probably read first, so users should be able to easily understand how the process works. I had to read a second time slowly of the left side before I really got it, especially the first two points (more especially the second point). Maybe something like Talk to Experts in this area (I don't know if they usually can be qualified as experts, or maybe another wording for people who know these things).

If you don't get what I am saying I could try to rephrase it somehow..

<comment><AUTHOR> I agree.. Trying to put the whole process into 3 short steps is difficult though..

I think because people define (and dont define) themselves as different things like "expert", "seller", "provider", or "qualified information source".. then its like what even is a "qualified information source" - i guess it could be a book? a website? a person?

we just need an all including, short word, for this type of person.. that people can identity properly as the person providing insight to the market researchers/product managers.

</comment></comment><comment><USER3> Looks great. Any plans to provide a history of successful contracts for a specific area, to give potential users an idea of what the going market price is?

<comment><USER4> That's a very interesting idea - have to think about how we could pull that off. It definitely would be informative...but tough since there is going to be huge variance in who people are going to want to talk to.

</comment></comment><comment><USER5> I would add some listings on each side, maybe about 3 to 5 with a more link to see more. I want instant gratification, an extra click might send me away.

<comment><USER6> ditto...

</comment></comment><comment><USER7> Wow. Very nice changes since v1!

I STILL think you need to pare down the amount of text on your page. Underneath the two highlighted sections, the only text should be "How it Works".

The Provider Identity Authentication section was confusing to me. I'm sure it makes sense once you're signed up, but it's too much to have on the front page.

You guys are really going in the right direction though. Good work.

EDIT:

The two highlighted sections. You have three bullet points for each: use one.

On the left: "Talk to qualified information sources"

On the right: "Share your knowledge"

On the bottom: "How it works"

Seriously, I think if you can pare it down to that you'll have an incredibly clear message.

</comment><comment><USER8> I remember the previous version. This is much better. It's good that you pushed the listing to a second page. The overall design could be better, but it's good enough.

Now, building a community is your biggest challenge. The age-old chicken and egg problem.

<comment><USER4> Glad you think it's better than v1 - anything in particular jump out that could be better with this design?

<comment><USER8> Too much gray, and too little white space. And the white space issue applies to the listing page as well.

But again, these little details are not what makes Web sites succeed or fail. Unfortunately, most of the feedback you get here will probably focus on the design because that's the easiest thing to comment on. If you want real feedback, talk to your customers. Even better, watch what they do or not do and study their behavior.

<comment><USER4> Thanks for clarifying. We're looking for design feedback here, as well as anything else we can get.

</comment></comment></comment></comment><comment><USER9> Agreed, better than v1. Just one more design bug: avoid gradients. Just avoid it. Gradients are bad. Its very hard to create pleasant gradients. apple.com pulls it off.and thats not encouraging, because you know who designs for them. Do you really want to throw that kinda money at design. Take the easier way out. Avoid gradients.

Other than that, we just have to use this thing to give more useful feedback beyond site design. Roll on with the beta.

</comment><comment><AUTHOR> If anyone doesn't remember how v1 looked - you can check it out here: <http://www.knowledgebid.com/images/v1.gif>

</comment><comment><USER10> Looks much better than the previous version, but I wanted to ask:

What about those 16
 below the div container, why are they there?

<comment><AUTHOR> fixed - i added them in when testing low anchor links on the faq and definition pages - (ie <http://www.knowledgebid.com/definition#total_earned> )

</comment></comment><comment><USER11> the animated gifs: make it transition instead of having it disappear and reappear. at first i thought it was your server being slow at loading images then i realize it's animated. have the first frame show an image instead of starting out blank.

icons: why are they alternating between b/w and color?

featured listing needs its own call-out box. it's featured content, make it look like it.

the how it works section can use some work as well. numbers perhaps?

<comment><AUTHOR> animated gif - good call. i'll try to add in a frame of fade, and start it off with an image.

icons - we wanted the icons in color on the front page to stand out a little more - since they're key points for each side.. maybe it doesnt appear as that?

featured listings and how it works - we tried toning this down so people would focus on the main image.. might have to rethink that idea if its distracting.

thanks for the feedback.

</comment></comment><comment><USER4> hopefully we removed enough text for you guys...

<comment><USER7> Closer, but you still need to chop more out. This is what I think you need to shoot for:

<http://wufoo.com/>

</comment></comment><comment><USER12> great great</comment>


The End of Reflection - <AUTHOR> http://www.nytimes.com/2016/06/12/fashion/internet-technology-phones-introspection.html <comment><USER2> I do find myself feeling guilty on the way to work if I spend a minute not listening to a javascript podcast or an audio book. There is just such a huge queue of material to process. I once read interesting book that advised going on information diet at least one day a week, but I cherish my 5hrs at the coffee shop on sat and sun when I get to read/hack on stuff that interests me vs what needs to be done for my day job.

I think Altucher has a great idea of creative thinking every morning. He recommends starting with a blank sheet and a coming up with a list of ideas. i.e. 10 ways to create a new stream of income. I've tried this occasionally and much like meditation it is great for reflection.</comment>


Women who took on the Mafia - <AUTHOR> https://www.newyorker.com/magazine/2018/01/22/the-women-who-took-on-the-mafia <comment><USER2> It was interesting for me to read that honor killing is not an Asian or Muslim thing like it is potraid in the west. What the mafia was doing were honor killings just not being called that.

<comment><USER3> Who wasn't calling it honor killings? I've read of it being called that in Italian contexts going back a century and a half.

</comment></comment><comment><USER4> _A year earlier, Pesce had been defined by the men in her life..._

The author writes this, in between a passage describing a grandmother who mimed strangling Pesce and another that describes a mother who no longer referred to her by name.

There is an attempt to give a women's liberation angle to this story; that independence from men is somehow the cure; but being part of a criminal family is something very specific relative to the general question of women's place in society, or in Italian society, or even in Calabria.</comment>


Show HN: Vehicle Detection – using machine learning and computer vision - <AUTHOR> https://github.com/tatsuyah/vehicle-detection <comment><USER2> My friend and I did something similar using Haar Cascades for vehicle detection and Hough transforms to detect the lane lines. We used that to analyze dash cam videos and calculate following distance between the cars in the video.

The final product is here, [http://asherman.site/hazcam/](http://asherman.site/hazcam/) and I also release the trained haar classifier separately on my own GitHub in case anyone had another useful projects for it. It was a lot of work hand selecting and cropping 400+ photos of the rear ends of cars, so I figured I might as well share the result. [https://github.com/pddenhar/OpenCV-Dashcam-Car- Detection](https://github.com/pddenhar/OpenCV-Dashcam-Car-Detection)

</comment><comment><USER3> This looks like it might be exactly what I'm looking for. I am quadriplegic and use a powered wheelchair, I also live in a small town with narrow roads and can't tell how far away a car is from behind me. I can't use regular wing mirrors as it would make the wheelchair to wide and I can't quite get the angle on a mirror to see behind me, so I thought I would use a camera on the back of the headrest which with some computer type cleverness™ could tell me if about to be mown over.

I was recently hit by a Mercedes SLK, and it's not something I'm anxious to repeat.

At the moment I'm thinking a GoPro streaming wirelessly to a Raspberry Pi, which can do the visual processing and essentially warn me if something big and metal is coming up behind me too quickly. I got the hardware, but I really don't have the software chops so if someone could point me in the right direction I would really appreciate it!

Thanks!

<comment><USER4> By all means I respect wanting to roll your own version of this. But if you would like to buy something to detect vehicles from your rear, there is something that already exists and is used commonly by cyclist. You may however need a bike computer as well, so it might get a bit expensive...

[https://www.amazon.com/Garmin-Varia-Rearview-Radar- Light/dp/...](https://www.amazon.com/Garmin-Varia-Rearview-Radar- Light/dp/B0116O10SY)

<comment><USER3> You're absolutely right that that does look like it would do the job, but once I start throwing in a computer as well it may start getting a little bit prohibitively expensive as you suggest. Definitely something to keep in mind though, thanks!

<comment><USER4> Looks like you can get a dedicated display with the Varia for an additional $100. $300 total is still cheaper than a GoPro, Raspi, and all the additional stuff you will need to make it work together...

[https://buy.garmin.com/en- US/US/p/518151/pn/010-01509-10#box](https://buy.garmin.com/en- US/US/p/518151/pn/010-01509-10#box)

</comment></comment></comment></comment><comment><USER5> This is one of the projects in Udacity Self-Driving Car Nanodegree in term 1. I've done it. It's simple and does not need deep learning. But if you want to go fancy, you can use image segmentation. [http://blog.qure.ai/notes/semantic- segmentation-deep-learnin...](http://blog.qure.ai/notes/semantic-segmentation- deep-learning-review)

<comment><USER6> Good work! I did this project as well about a week ago. I will shamelessly also share my writings on this project: [https://medium.com/towards-data- science/teaching-cars-to-see...](https://medium.com/towards-data- science/teaching-cars-to-see-vehicle-detection-using-machine-learning-and- computer-vision-54628888079a) .

The HOG + SVM method is quite slow and not as accurate as a deep learning approach. Before jumping onto semantic segmentation, I recommend re- implementing this project or more generally solve this problem using a Regional Convolution Neural Network architecture (R-CNN) like Faster R-CNN[1] or YOLO[2] for instance.

[1]: [https://arxiv.org/abs/1506.01497](https://arxiv.org/abs/1506.01497) [2]: [https://arxiv.org/abs/1506.02640](https://arxiv.org/abs/1506.02640)

<comment><USER7> Totally agree with your point on HOG + SVM, I think it is obsoleted by convolutional neural networks.

I wrote a realtime human detection library [1] for a robotics project that used HOG + a simple neural net for classification. While it worked okay, I wasn't happy with the precision (around 90%) and decided to try out a simple convnet from Torch (doing the classication on depth images instead of HOG descriptors). The Torch version was slightly slower on a CPU, but both the precision and recall jumped up drastically.

[1]: [https://github.com/seemk/FastHumanDetection](https://github.com/seemk/FastHumanDetection)

</comment></comment></comment><comment><USER8> Nice! Check out mine. [https://youtu.be/l7zqSn8HCXg](https://youtu.be/l7zqSn8HCXg)

<comment><USER9> Also interested in a writeup!

</comment></comment><comment><USER10> This might be the wrong place to ask, but my search skills are failing me as I try to understand what "Space binning" (referred to in the README of the linked project) is. The top hits seem to all point back to the original article.

</comment><comment><USER11> I noticed you are standardizing your dataset before your test/train split. This is an example of information leakage which is causing your model to overfit by learning the test example distribution: [http://www.eggie5.com/97-model-evaluation-information- leakin...](http://www.eggie5.com/97-model-evaluation-information-leaking)

<comment><USER12> Noticed a couple typos:

Second paragraph - 'argures' should be 'argues', and 'resonse' should be 'response'.</comment></comment>


New Star Wars Film Based on Seven Samurai Coming from Zack Snyder - <AUTHOR> http://www.wired.com/underwire/2013/01/star-wars-samurai-zack-snyder/ <comment><USER2> Someone should update the title: "Zack Snyder Denies Report of New Star Wars Film Based on Seven Samurai"</comment>


Ubuntu Edge: how many phones were really ordered - and the mistakes - <AUTHOR> http://www.theguardian.com/technology/2013/aug/27/ubuntu-edge-phones-data

<comment><USER3> From the article:

 _The project didn 't actually _raise* any money; a total of $12.2m was pledged, but none would be charged against anyone's credit card (not even the usual few percent from a failed project) under a special arrangement with IndieGoGo.*

Not true, as far as I understand it. Certainly my bank statement showed a transaction, and a subsequent refund.

I believe the article is correct in that Canonical never saw that money - <USER2> understand Indiegogo held onto it until the refund - but it was certainly charged.

<comment><USER4> That's actually one of the things that stopped me from ordering an Edge.

I just don't have the cashflow to leave ~£500 in someone else's hands for a lengthy period of time.

Would've been happy with a deposit amount and a final bill before dispatch. But when you're paying yourself bare minimum at a startup, the funds just aren't there in my personal finances to tie up a quite significant amount for so long and at relatively short notice.

<comment><USER5> But this is misunderstanding the point of kickstarter et al - although it may feel like you are just preordering, you are not - and actually funding the development (which could go wrong, and never get anything). It's why people shouldn't be too annoyed/upset if they don't get their items first/cheapest.

<comment><USER4> The headline would suggest that everyone believed this was pre-ordering. Hence the "How many phones were ordered".

</comment></comment></comment></comment><comment><USER6> It was not campain aimed to make Edge. It was marketing and publicity stunt by Canonical to have some data to feed to vendors which supply them with stuff to make Ubuntu phone. It was something like prototype car to show off at exhibition, just to draw attention. They make numbers bigger because that is the main reason behind this campain. Now they have some point of reference, and they can show to suppliers that they are serious. Even if it was 15.000 Edges they know that they have audience. Besides IndieGoGo made couple of dollars on those pledged money as samstokes wrote, put couple of mils (specially not yours) in bank and get the percents, nice.

</comment><comment><USER7> Has anyone considered a SCRUM funding model? i.e. Similar to how Patreon's used to fund ongoing deliverables from YouTube artists (among others) the team could have patrons sign up to pay a smaller amount on a fortnightly basis, with the development team announcing their goal for that sprint, then taking funding on delivery. This gives patrons the option to back out further down the project if things go off course/change, thus reducing risk in committing to a failing project, whilst allowing other patrons to sign up down the line as the project starts to look increasingly feasible. Optionally small awards could be given per pledge, whilst larger rewards (e.g. your own phone) given to those who've given a certain amount by the end of the project / the pledged amounts could be discounted from the resulting phone's price.

</comment><comment><USER8> Apparently Richard Stallman in the comments saying that Canonical refused to make it a completetly free software platform...

<comment><USER9> I think that this is a strategic error from Canonical: a lot of people would like a truly free alternative to Android phones (with open hardware), and this could have been an opportunity to get them to support Edge. Canonical missed it IMHO.

See Mark Shuttleworth AMA: [http://www.reddit.com/r/IAmA/comments/1j166z/hi_im_mark_shut...](http://www.reddit.com/r/IAmA/comments/1j166z/hi_im_mark_shuttleworth_founder_of_ubuntu/cba2wga?context=1)

<comment><USER10> > I think that this is a strategic error from Canonical: a lot of people would > like a truly free alternative to Android phones (with open hardware), and > this could have been an opportunity to get them to support Edge. Canonical > missed it IMHO.

I think you underestimate the echo chamber effect. The number of people who care about FOSS is minuscule, and marketing the Edge to that crowd would dilute the marketing message for everyone else.

<comment><USER11> For the people who care about FOSS you wouldn't have to market that feature, just state it. Also, the people who care about FOSS are loud, and influence people who don't care about FOSS.

I think you underestimate the appealing to as many disparate influential groups as possible effect.

<comment><USER12> Yeah, that's the reason most smartphones are Android and iOS.

/sarcasm

</comment></comment></comment></comment></comment><comment><USER13> Estimations are that Jolla is going to produce a batch of 50,000 units. [http://techcrunch.com/2013/08/21/jolla-closes-first-pre- sale...](http://techcrunch.com/2013/08/21/jolla-closes-first-pre-sales/)

So I think it's strange Canonical didn't make this happen.

</comment><comment><USER14> It would have been nice if they had some graphs showing projects that reached their goals early.

What would have happened if Ubuntu had set the goal at 1 million $? Then most of the backers would have certainty when they backed the project since they knew it would succeed in getting funded!

Maybe this would have led to 32 million, maybe not.

<comment><USER15> There are significant fixed costs, you can't just divide the required goal by 32 to produce 1/32 of the number of phones. I'd guess that $1M wouldn't be enough to even produce _one_ of those phones.

<comment><USER14> That is a downside yes.

The question still remains. Would more people have pledged knowing that the project would get funded?

Essentially this would be like preordering it.

<comment><USER16> I've backed Kickstarters only after they've already reached their goal, just for the sake of preordering the product.

Yes, Kickstarter and IndieGoGo are not meant to be storefronts and I might be a bad citizen for treating it as such, but the incentive is there. If the developers are going to treat these fundraisers as a place to sell a product, I'm going to use these fundraisers as a place to buy a product. Especially in cases where the Kickstarter product is significantly less than the price of the product when it hits retail. If you tell me I can "buy" your product for $8 on Kickstarter and get the product in the mail weeks before it's officially for sale, or I could wait longer and buy it for $20, what do you expect me to do?

</comment></comment></comment></comment><comment><USER17> This is quite nitpicky. A worthless debate over semantics.</comment>


Show HN: Chapter 1 of a Sci-Fi Novel I am writing - <AUTHOR> http://levyflight.tumblr.com/post/29667192824/chapter-1-of-128-of-pseudoutopia

<comment><USER2> I've subscribed to the feed, curious how it will develop.

I believe there are two things that could be improved. First, spelling and grammar. I know it's superficial, but as a reader I always get the feeling an author doesn't value my time when they don't proof read their stuff.

The other thing that bothered me is the usage of cultural references, in this case Star Trek. It's a little patronizing to the reader and it's also superfluous to describe the renderer in this way. Just tell us what it does. You might even be better off leaving out certain specifics in science fiction, your stories will have a _much_ longer shelf life that way.

That being said: keep on writing!

<comment><AUTHOR> I took your suggestions and fixed those points.

</comment></comment><comment><USER3> I feel like there could be a really interesting story behind this. You mention interesting concepts like interplanetary colonization, destruction of the Earth ecology, fascist government and extreme reduction in population.

But the languag is difficult to read. There are lots of missing commas and bad grammar, making it difficult to parse some of the sentences. I get the feeling you are not writing idiomatic english, but translate more or less word-by-word from another language.

I suppose writing skills comes from practice, so don't give up. Write down your story and go back to refine the language later.

<comment><AUTHOR> Well, this is pretty preliminary. I will make the commas and grammar corrections. Thanks for the input.

</comment></comment><comment><USER4> Musings of an artist trying to to computer science?

I think you accidentally a word.

</comment><comment><USER5> I feel like this is sw007, just baiting us.</comment>


NYPD Kicking People Out of Their Homes, Even If They Haven't Committed a Crime - <AUTHOR> https://www.propublica.org/article/nypd-nuisance-abatement-evictions <comment><USER2> It's really not an artifact of being a minority it's an artifact of being poor and/or living in a poor neighborhood. The same thing could happen in better neighborhoods but as wealth increases so does access to better resources to combat this type of behavior by the police or by government. In that sense it's (just) no surprise another advantage of having money. What you gain is the ability to buy better "advice" (legal or otherwise) and hence get a fairer shake out of the world. In many cases (I won't comment on this one) it's perhaps not that the law is being used unfairly but rather that poor people don't have the resources to question and fight what is going on and perhaps raise the right issues with those that try to take advantage of them. Or simply to communicate and be taken seriously.

<comment><USER3> It's an artifact of The War on Drugs.

<comment><USER4> Which was instituted to criminalize minorities.

</comment></comment></comment><comment><USER5> >>In partnership with ProPublica, the Daily News reviewed 516 residential nuisance abatement actions filed in the Supreme Courts from Jan. 1, 2013 through June 30, 2014

This does seem like an evil program, or at least a well-meaning program that is being abused. But 516 actions across a state over an 18-month period? Even if there is a disproportionate impact upon minorities, if there was systemic racism behind this I would expect far far more given the number of potential victims.</comment>


1/10 of OpenSSL lines of code "it should be easier to spot bugs" - <AUTHOR> http://www.theregister.co.uk/2015/07/01/amazon_s2n_tls_library/

<comment><AUTHOR> I really like the "should":)</comment>


Every Byte of a TLS Connection Explained and Reproduced - <AUTHOR> https://tls.ulfheim.net/ <comment><USER2> Author here - I was going to publish this today but it leaked out ahead of time. Enjoy!

EDIT: I'm putting a CDN in place.

<comment><USER3> very nice! first thing I noticed is that at [https://github.com/syncsynchalt/illustrated- tls/blob/master/...](https://github.com/syncsynchalt/illustrated- tls/blob/master/site/index.html) the content and samples are hardcoded into HTML - might it be nice if this was generated from some kind of JSON file or similar such that the approach you have here could be generalized to support any network protocol someone might want to annotate with descriptions?

<comment><USER2> Yes, if I do this again I will definitely generalize it into a content generator.

(Isn't that what every site turns into eventually, a custom CMS?)

As it is it's all tcpflow, hexdump, and vim.

</comment></comment></comment><comment><USER4> This is wonderful!

I may make a version where the bytes used for lengths are highlighted, since it feels like so many bytes are lengths; look at the SNI extension, which has three 16-bit lengths, I know why they're there, but SNI probably shouldn't be a list, and even if it was a list, an extension that consists solely of a list has a list of the length of the extension, you shouldn't need two bytes for that, and if we recast sni into just a type and a string, the string is clearly going to take the rest of the extension length, so it doesn't need a two byte length either.

<comment><USER5> Moreover, from a security perspective since we're talking about TLS, "overspecified" and/or "redundant" lengths are just begging to be made inconsistent and a source of vulnerabilities.

<comment><USER6> Usually if you mess up something there your implementation just doesn't work.

<comment><USER7> Vulnerabilities often arise from implementation bugs, no?

<comment><USER6> Yeah, but not every implementation details will equally lead to the same vulnerabilities. Having said that, heartbleed was a length issue.

</comment></comment></comment></comment></comment><comment><USER8> Beautiful.

I recently had to implement two way auth over 1.2 and this would have saved much hair pulling. (and who does TWO way auth over an MPLS connection. Turns out, us).

<comment><USER9> I feel your pain. Two-way TLS is a funny thing, it's supported by the standards and even most implementations but its actual use is minuscule compared to "normal" one-way TLS, so much so that it's hard to find documentation even acknowledging two-way TLS exists, let alone how to use it.

And don't get me started about the hassles of obtaining signed certificates that are actually usable for client auth...

<comment><USER10> > And don't get me started about the hassles of obtaining signed certificates > that are actually usable for client auth...

What sort of clients were you authenticating? The Web PKI needs to be trusted by random people from the whole world, but most mutually authenticated systems have a relatively small number of clients which are known to the server operator out-of-band. So probably the Web PKI is not the right choice. Instead you (the server operator or some neutral facilitator if it's a group of providers operating services for the same clients) should operate a CA for this purpose, not piggyback on the Web PKI.

One reason not to use the Web PKI if you aren't actually part of the public Internet is that we, to put it bluntly, don't give a shit about people who do that. Running a PKI is expensive (not just in dollar terms, it needs a bunch of smart, motivated people who are morally upright or it's worthless), and this one is ours, so it obeys our rules.

If you have your own PKI (or just one CA) you set the rules. Fifty year certificates for 1024-bit RSA? Why not. A current passport photograph baked into every certificate? Sure. Want the issuer to mint the keys and keep a copy? Do as you please. All those things are prohibited in the Web PKI.

<comment><USER11> Ignoring the Web PKI defaults though is probably a silly idea - e.g. long lived certificates with rubbish hash algorithms, huge certificates, and issuer kept keys are all really bad ideas, in almost any scenario.

</comment></comment></comment></comment><comment><USER12> Has anyone of you seen _such beautiful_ explanation for other protocols (TCP, 4-way handshake)?

<comment><USER13> You can usually use Wireshark to find out the meaning of each byte for internet connections (and images), it works great.

<comment><USER10> However, Wireshark can mislead you if you don't understand what you're looking at.

It's a bit like having a low-level debugger. If you're happy with low-level C, and you're looking at a debugger and it says variable 'k' which you know is a uint8_t which loops from 0 to 5, currently has the value 65 you should say to yourself. "Hmm, I bet that the compiler used the same place to store variable 'c' that's a single byte from a text string, so this is just the capital letter A and the compiler has realised it doesn't need to store the value of k even if it's technically in scope..." rather than "OMG my loop variable somehow massively exceeded its expected range, maybe cosmic rays have damaged the RAM".

With TLS for example if you give it a whole TLS 1.2 sesssion, Wireshark will say oh, this is TLS 1.2. Fine. But if you show it only a TLS 1.2 connection that failed, Wireshark will say "Oh, this is TLS 1.0". Why? Well, the low- level protocol has been bodged over the years because of crappy middleboxes, so Wireshark doesn't actually know for sure, and rather than say "I don't know yet, I need to see more of the connection" it says TLS 1.0

This can be a problem because you'll get amateurs saying "Our system can't talk to your server because you only do TLS 1.0" and you say "No. You are wrong" and they say "Look, here's a Wireshark trace" and sure enough Wireshark is telling them it's TLS 1.0 because their system has disconnected early (e.g. because they disabled all the crypto algorithms you allow), and so Wireshark wasn't sure and labels it TLS 1.0 rather than TLS 1.2

This is going to happen again with TLS 1.3. TLS 1.3 deliberately says "Hi I'm TLS 1.2" (middleboxes again) and so that's what Wireshark will report (until you get a newer version that knows to look inside the supported_versions extension field for the version) and so you can bet that amateurs are going to say "Your service only does TLS 1.2" when actually their connection failed for some reason and they don't understand how to read the Wireshark trace.

</comment></comment></comment><comment><USER14> Beautiful. A few years ago, were implementing some TLS handshake stuff at Spotify ([https://github.com/spotify/ssh-agent- tls](https://github.com/spotify/ssh-agent-tls)) to be able to use your SSH key as a client-side cert for HTTPS connections.

The first couple drafts took forever to figure out, and I got a bunch of stuff wrong. This guide would've saved a ton of time back then.

</comment><comment><USER15> There's a lot of practicality I learned from reading the Go source and implementing my own (e.g. always an array of a single value of 0 for compression method).

Now do a version with DTLS (one more message type, couple more fields on existing types, and logic concerning retries). Also, now do a TLS 1.3 one.

<comment><USER2> Yep, reading the Go source is what inspired me to do this, it's still very compact and readable.

I originally used an AEAD cipher but found it was impossible to demonstrate on the command line (openssl enc refuses to do AEAD because it can't confirm the authentication in a streaming context).

A friend asked me to demonstrate ALPN in this but as I looked into it I found it was distracting, as there's already so much going on and any new feature required digression. Maybe next time!

As for 1.3 my next project was going to be implementing it rather than documenting it. Just a throwaway implementation, nothing you'd want to use.

<comment><USER15> > As for 1.3 my next project was going to be implementing it rather than > documenting it. Just a throwaway implementation, nothing you'd want to use.

Since you read the Go source, you might like [0]. I will say I personally think Go could have done better. I think it's too compact, too hidden, too disorganized, too underdocumented, and too inflexible/non-extensible. I began to pick some of it apart for a DTLS impl I started at [1], but have put on temporary hold yesterday due to other work obligations.

0 - [https://github.com/cloudflare/tls- tris](https://github.com/cloudflare/tls-tris) 1 - [https://github.com/cretz/go-dtls](https://github.com/cretz/go-dtls)

<comment><USER2> I've also had [https://github.com/h2o/picotls](https://github.com/h2o/picotls) suggested.

</comment></comment></comment></comment><comment><USER16> I have no need to look at that page at length ... but I am. This is very well made and interesting.

</comment><comment><USER17> I remember implementing ssl in java when I worked for Netscape back in the day. Nostalgia rush looking at this. Great stuff

</comment><comment><USER18> The irony is: I get "Your connection is not secure" when trying to open the link.

<comment><USER2> I've uncapped MaxRequestWorkers while I wait for the Cloudflare queue, it should work now (I believe you were seeing an error related to TLS timeout).

</comment></comment><comment><USER19> I love the way you present the data (where clicking on the hex values of the bytes gives their explanation). At work I work on software that communicates via RS-232 serial packets; I should make something that turns logs of the packet data into HTML files with an interface like this!

</comment><comment><USER20> [http://www.networksorcery.com/enp/Protocol.htm](http://www.networksorcery.com/enp/Protocol.htm) has a bunch of network diagrams for various protocols.

This website lays things out really nicely, would love to have more protocols :)

</comment><comment><USER21> So the record header has 2 bytes for the payload size, and the handshake header has 3 bytes. Am I correct in thinking that the 3 bytes of the handshake header is superfluous? Isn't payload size limited to 2^16 bytes

<comment><USER22> I think this is explained by the optional compression which is handled at the record layer.

</comment></comment><comment><USER23> Good work on the illustration.

Using Diffie-Hellman to generate a shared key with each party's private key and the other party's public key is the part that amazed me most when I was trying to understand the handshake back then.

</comment><comment><USER5> _The parties had agreed on a cipher suite using ECDHE, meaning the keypairs will be based on a selected Elliptic Curve, Diffie-Hellman will be used, and the keypairs will be Ephemeral rather than using the public /private key from the certificate._

I think it's important to mention that even with ephemeral cipher suites, the server's ephemeral public key is signed using the server's certificate private key and verified by the client, since otherwise one would be able to MITM the key exchange.

<comment><USER2> It's in the Server Key Exchange record (from memory) but i probably didn't explain it well.

</comment></comment><comment><USER24> Nice, could have really used this a few years ago when I was making my own HTTP server implementation. Could someone make a PDF of this? Any C++ and C# examples of this?

<comment><USER2> I might post a PDF later (as the content becomes final), or make a printable view. In the meantime try this:

        # in your javascript console, paste this:
        [].forEach.call(document.querySelectorAll(".record, .calculation"), function(el){el.classList.add("selected")});
        [].forEach.call(document.querySelectorAll(".record, .calculation"), function(el){el.classList.add("annotate")});
        [].forEach.call(document.querySelectorAll("codesample"), function(el){el.classList.add("show")});

Then you can print the page to PDF.

</comment></comment><comment><USER25> As a crypto ignoramus - Why is the random data from each side necessary? Why can't things just be encrypted with the PreMasterSecret directly ?

<comment><USER10> Involving random data gives everybody who gets to pick the random data (so in TLS that's both client and server) a freshness guarantee.

Because the other party needed to know you'd picked this particular random data to make the keys, the messages from them encrypted with those keys couldn't possibly have been pre-recorded / replayed.

In the ephemeral Diffie Hellman modes both parties contribute to the key anyway so this isn't as important, but with old school RSA the random values are the only thing preventing Replay attacks.

TLS 1.3 capable servers also scribble "DOWNGRD" in part of the random field if a client message says it can't do TLS 1.3. If a TLS 1.3 client sees that unusual "random" choice it knows bad guys tampered with the connection (attempted a downgrade attack). If bad guys just change the values, they won't match between client and server and the connection aborts. Older clients think nothing of the unusual random value and carry on as before.

<comment><USER5> _TLS 1.3 capable servers also scribble "DOWNGRD" in part of the random field if a client message says it can't do TLS 1.3. If a TLS 1.3 client sees that unusual "random" choice it knows bad guys tampered with the connection (attempted a downgrade attack). If bad guys just change the values, they won't match between client and server and the connection aborts. Older clients think nothing of the unusual random value and carry on as before._

I haven't looked at the spec in detail, but does this mean that random generation has to specifically exclude that "sentinel value", lest it accidentally occur?

<comment><USER25> The probability of a particular seven bytes occurring by chance is less than one in a billion billion billion billion.

<comment><USER26> 256⁷ ≈ 7.2E16, which is much less than billion⁴ = 1E36.

Still, the likelihood of this happening by chance is miniscule.

<comment><USER10> The actual feature uses an 8-byte value, it's just that the DOWNGRD part (the first 7 bytes) is intuitively easy to follow so why spell it all out in hexadecimal or whatever.

So it's one in 2^64 random connections

Also the client isn't even checking for possible downgrade if it got the protocol version it wanted (if I wanted TLS 1.3 and I got TLS 1.3 that is not a downgrade). So if "One in every 16 billion billion connections fails" is unacceptable, upgrade your servers and the problem vanishes.

</comment></comment></comment></comment></comment></comment><comment><USER27> There's a typo in the server keys calculation. It should read "server" and not "client" IMO.

</comment><comment><USER28> This is very nice. I think the green on green and blue on blue highlight are a little hard to see.

<comment><USER2> Agreed - the color choice is one of the things I never really felt happy with (I'm not a frontend guy).

</comment></comment><comment><USER29> [https://www.reddit.com/r/netsec/comments/9nk764/the_illustra...](https://www.reddit.com/r/netsec/comments/9nk764/the_illustrated_tls_connection_every_byte/)

</comment><comment><USER30> As someone that frequently deals with large scale integration failures I greatly appreciate this site. Thanks syncsyncchalt!

</comment><comment><USER31> I love this. Excellent work. Would be cool to see a step-by-step niblets of client/server implementation of each step.

</comment><comment><USER32> So does this happen for every single request? or is this based on a single session.

<comment><USER33> This is what happens under the hood of every ping request.

<comment><USER34> A ping is very much different. A ping is (typically) simply an ICMP Echo Request, (not TCP, thus no TLS, etc). The receiving device, if accepting echo requests and configured to reply with echo replies, then responds with an ICMP Echo Reply - or some device in the middle (or the device itself could respond with an ICMP unreachable, or some other response - or quite simply drop the ICMP Echo Request entirely and silently).

 __*Edited an incorrect UDP reference out based on the below comment.

<comment><USER35> If I'm not mistaken, its not UDP, it's ICMP, like you said

<comment><USER34> Ahh yeah - good call. Totally different protocol. I guess ICMP more closely resembles UDP at the end of the day, but you're absolutely right. I edited out the incorrect UDP reference so that a person reading for the first time will not get misled. Thanks!

<comment><USER36> Which is also why some poorly configured network devices firewalls will eat pings - if they for example whitelist tcp and udp protocols and drop everything else (yes, that's a bad idea).

[https://security.stackexchange.com/questions/22711/is-it- a-b...](https://security.stackexchange.com/questions/22711/is-it-a-bad-idea- for-a-firewall-to-block-icmp)

</comment></comment></comment></comment></comment></comment><comment><USER37> very fine work. the data flow and annotation are clear and concise. good job

</comment><comment><USER38> Site's timing out and google cache is giving me a 404...

</comment><comment><USER39> Cool! Would you be able to add a ascii view beside it?

<comment><USER15> Not trying to come off trite, but the RFC [0] has a simple ASCII diagram of the message flow and the structures that follow are fairly easy to read. Granted you have to hop to a couple of other RFCs to understand extensions and maybe even real world impls to understand some changes (e.g. no time in the random block of client hello), but it's worth perusing if you're interested.

0 - [https://tools.ietf.org/html/rfc5246#section-7.3](https://tools.ietf.org/html/rfc5246#section-7.3)

<comment><USER2> I think they mean a side-by-side ASCII interpretation like that supplied by `hexdump -C` - where any alphanumeric character is printed as itself and every other character is printed as a "."

It gives a nice strings-like view of raw data.

</comment></comment></comment><comment><USER40> Explained in detail, also the web page is well-built.

Thank you.

</comment><comment><USER41> Yes very useful. Thanks for your effort.

</comment><comment><USER42> HN hug of death ? Page is timeouting

</comment><comment><USER43> tls.ulfheim.net - "This site is blocked due to a security threat."

ulfheim.net - no problem

At least according to my megacorp threat filter. I have never actually seen something blocked before, and it's a shame because the page would be great to share with my team.

<comment><USER2> Wonder why that would be, tls.ulfheim.net is a CNAME to ulfheim.net, they're just different apache vhosts. Same cert (using SAN).

The only things I can think of:

      - it doesn't like the hostname (tls?)
      - the hostname is new, and has no reputation
      - too much h4cking content

</comment></comment><comment><USER44> Kind of ironic that their website is using an invalid security certificate?

<comment><USER10> The site is currently presenting a Let's Encrypt certificate issued just under 24 hours ago. There have historically always (for reasonable definitions of always) been valid certs for this site, although of course I can't tell from here that they were always properly installed.

Likely explanations for your experience:

1\. Your clock is wrong. If your system currently thinks this is Thursday 11 October for example, that's a problem, 'cos this is Friday 12 October.

2\. There's some subtle configuration error on their server (seems unlikely as it looks to be just a generic AWS setup) that results in the wrong certificate being presented.

3\. Your OS or browser trust store lacks the root CA "DST Root CA X3" operated by IdenTrust. If you didn't deliberately choose to do this, you should investigate as most likely you aren't getting important security updates.

All three causes can often by diagnosed by closely examining the detailed error reported in a browser e.g. SEC_ERROR_EXPIRED_CERTIFICATE

</comment></comment><comment><USER45> Thanks, very useful.

</comment><comment><USER46> Thank you for sharing.

</comment><comment><USER47> nice (y)

</comment><comment><USER48> nice work!

<comment><USER49> Very detailed explanation. Useful even for a refresher on the mechanics. Well done!</comment></comment>


How to Work and Travel Around the World for One Year? - <AUTHOR> http://blog.mobilejazz.com/how-to-work-travel-around-the-world-for-one-year/ <comment><USER2> It maybe the wrong time to travel around the world my friend!

At least I would tread carefully around Europe and the Middle East.

<comment><AUTHOR> I won't be travelling to Middle East however, in a more general sense, there have always been problems in the world and we shouldn't let them drive the course of our lives, in my humble opinion, that is.</comment></comment>


Dawn, a Docker based PaaS in Ruby - <AUTHOR> https://github.com/dawn/dawn

<comment><USER2> Looks interesting. How would you say it compares with Deis.io?

<comment><AUTHOR> One of the authors here. Deis is better at the moment, supporting clusters, as well as being coreOS based (which is one of our goals as well). Back in october/november, when the project was started, we were ahead for some time, but I ran out of time to work on it. So recently, I found more time and ended up open-sourcing it, hoping to get more contributors onboard.

<comment><USER3> Have you considered joining forces with Deis or is there a difference in philosophy for the projects?

<comment><AUTHOR> Yes, we technically could collaborate with Deis, though they a different programming language (python). I also have a few concerns doing major contributions, since Deis developers' company basically makes money off of Deis via consulting -- I'd probably prefer to join the Flynn camp ([https://flynn.io/](https://flynn.io/)).

<comment><USER4> Flynn raised money, so I guess it could be considered as making money, too? :)

</comment></comment></comment></comment></comment><comment><USER4> How does it compare to another PaaS in Ruby: [https://github.com/tombh/peas](https://github.com/tombh/peas) ?

Just curious :)

<comment><AUTHOR> Peas seems to be less feature complete. We use Heroku's logplex for storing the logs (something peas doesn't do yet, they do have a development branch that uses mongodb for that), and we also store the github repositories on the server, like Heroku does, while peas requires you to use a separate repository. We also work as a multi-tenant system (although admittedly, accounts need to be pre-seeded right now), while peas has no notion of users. I like tombh's work though, I just wanted to release my own system, since it predates peas.

tl;dr: Peas offers a few less features, but is more lightweight.

<comment><USER5> Hey thanks, I like your work too :)</comment></comment></comment>


(Posted by Brad Feld) Being Human in Biz Dev - <AUTHOR> http://www.chetkittleson.com/the-power-of-being-human-in-business-development/

<comment><USER2> It's great to think about biz dev from this perspective. Great post.</comment>


The Final Pivot: A Funeral for Failed Startups - <AUTHOR> http://nymag.com/daily/intel/2012/09/final-pivot-a-funeral-for-failed-start-ups.html

<comment><USER2> That sounds like a great event to learn at.</comment>


Write Your Own Virtual Machine - <AUTHOR> https://justinmeiners.github.io/lc3-vm/ <comment><USER2> I was tricked into writing a VM while doing Advent of Code last year and it really deepened my understanding of programming (e.g., on how to implement simple coroutines).

Advent of Code is supposed to be 25 daily programming puzzles leading up to christmas. I went in thinking they were going to be algo/datastructure tasks but half of them were actually about implementing and using a VM for a made up assembly language! The difficulty ramp was gradual enough that I did it with no background in compilers and it was lots of fun.

If you want to experience it, in last year's version [https://adventofcode.com/2019](https://adventofcode.com/2019) you write the VM in Days 2, 5, 7, 9 then apply it to solving problems in Days 11, 13, 15, 17, 19, 21, 23, 25.

I ended up loving the VM puzzles and ended up doing the AoC author's other challenges which have a similar theme: [https://challenge.synacor.com/](https://challenge.synacor.com/)

<comment><USER3> Funny that VM related days are all prime numbers :).

EDIT: No they're not, I wasn't fully awake, sorry.

<comment><USER4> Not all of them, but a lot seem to be.

<comment><USER5> A mathematician, physicist, and engineer are taking a math test. One question asks "Are all odd numbers prime?"

The mathematician thinks, "3 is prime, 5 is prime, 7 is prime, 9 is not prime -- nope, not all odd numbers are prime."

The physicist thinks, " 3 is prime, 5 is prime, 7 is prime, 9 is not prime -- that could be experimental error -- 11 is prime, 13 is prime, yes, they're all prime."

The engineer thinks, " 3 is prime, 5 is prime, 7 is prime, 9 is prime, 11 is prime, ..."

[https://users.cs.northwestern.edu/~riesbeck/mathphyseng.html](https://users.cs.northwestern.edu/~riesbeck/mathphyseng.html)

</comment></comment></comment></comment><comment><USER6> I have written a virtual CPU from very simple building blocks and highly recommend doing it.

I started with class Wire (which just wraps a bool) and class Transistor (which accepts two input Wire& and has an output Wire). It has an Update() function which sets the output state.

From those I built up gates, then flipflops, registers, mux/demuxes, counters, an ALU, and memory banks. Then I wrote a machine language, connected the cpu together, wrote a loader to load machine language files into ROM, then an assembler to allow me to write assembly code.

I then added VRAM, async buses, and wrote a working implementation of Game of Life.

It has 32bit instructions and runs about 10kHz with 8KB of RAM.

<comment><USER7> I did something similar, but with a LogicGate and a Wire class. I would recommend Morris Mano for those who would like to try.

<comment><USER8> It looks like those authors have a handful of computer engineering books. Is there one particular title you would recommend?

<comment><USER7> sure, I think what I've used translates to the title "digital design"

</comment></comment></comment></comment><comment><USER9> I once wrote my own virtual machine in college, complete with compiler and assembler, and I cannot recommend doing this enough. Especially the virtual machine part is not nearly as difficult as you would imagine, and to this day (15 years later) I still rely on the things i learned here.

The knowledge you gain from implementing a virtual machine translates reasonably well to inner workings of a CPU, and you'll have a much better understanding of things like stacks, frame pointers and the overhead of calling a function. It will be completely obvious to you why "i++" is slower than "++i".

Thanks for sharing this article.

<comment><USER10> > It will be completely obvious to you why "i++" is slower than "++i"

...but it's not!

All you have to do is perform the most basic of optimizations: check, before generating code for an expression, if that expression is used. If not, then don't bother generating an intermediate for the result. Source: making a c compiler, just implemented this optimization today. (In an 'industrial-grade compiler', you probably want to elide this optimization, but do super complex control flow analysis on the resulting SSA to see that the intermediate is dead code. But for a toy compiler/vm, little tricks can save you a lot in codegen quality for little effort.)

> inner workings of a CPU

...if only. Lots of crazy stuff going on in a CPU that doesn't even start to come up in most VMs.

<comment><USER11> Technically, that's a bit off topic because this is about compilers and code generation, while a VM defines the basic semantics compilers work with.

For VMs, what is relevant is whether you implement an "inc (reg)" or not, that is if you choose to take the RISC path (small set of mostly orthogonal instructions) or the CISC path (lots of microcode, things like "repnz scasb" in x86 assembly or elaborate addressing schemes).

This actually somewhat a false dichotomy, as you can have a RISC-style instruction set _plus_ a few "high level" instructions for things you expect to do a lot - like, for instance, array operators _à la_ APL/J.

</comment></comment></comment><comment> jon-wood If you want to go really deep on this I highly recommend NAND To Tetris, a book which starts from the basics of combining NAND gates to build basic logic. You'll gradually work through building a CPU from those components, building an assembler to program it, and finally putting a virtual machine on top of that.

<comment><USER12> Haha, I came here just to encourage people to check out www.nand2tetris.org too. It's extremely educational.

It's also realllllly satisfying to play Tetris on something you "built" all the way up from basic logic gates.

It's a great (and free) course during a pandemic lockdown or a fun project over a holiday break.

</comment></comment><comment><USER13> If you want a really in-depth intro into the topic (with video lectures and guest appearances from legendary VM implementers!), check out CS294 from UC Berkeley that has been made available under a Creative Commons license: [http://www.wolczko.com/CS294/](http://www.wolczko.com/CS294/)

It's great for following along self-paced and has hands-on exercises for each topic. You should be a bit familiar with compilers already though.

</comment><comment><USER14> I've just about finished writing a VM for the ZMachine (the VM that Zork was written for to make it portable). It's been tremendously enjoyable and I've learnt a lot.

I'm planning a series of how-to videos out of the project and will definitely be referencing this article to ensure my presentation of concepts is accurate. Thanks for sharing this.

</comment><comment><USER15> VMs have so much utility, so +1 to the author on the nerd nugget for compartimentalizing the use as a game cartridge.

VMs and VEs (environments) have gotten so portable that IOT and 5G will have to compete with raw storage (TB's) for the best user experience in a post- filtered world.

Possibly OT (or use case), but I've demod LTSP [0] to run multiple environments on a single server (PXE menu) and clustered multiple LTSP servers (bouncing to other LTSP menus by manually adding a server list to boot menu(s)) and treated them as books with chapters (each LTSP being a book).

Customizing each chapter by OS needs and media/content/apps has so many uses (immersive news,learning,entertainment) and paves the way for offnet productivity/entertainment that currently doesn't exist in the market (ala Home Library/Encyclopedia Server).

LTSP was not as PnP as it needs to be for consumer use (and external PCIe form factors were pricey), but anyone writing a VM (or decorating the interior) is already riding the next wave of physical data subscriptions/refills that bypass metered networks (SDCs or SSDs in TB capacities with OS agnostic data) for 8k video, VR and compilation/mixedtape datasets.

Portable VMs are a trend waiting to happen, so anything you can learn about it (inside-out) is not a waste.

[0] [https://ltsp.org](https://ltsp.org)

</comment><comment><USER16> For those who haven't read the post yet, I would definitely recommend doing so if only to understand the striped instruction set implementation using C++ generics at the end.

I rarely run into solutions that fundamentally expand my perspective these days but this one did.

</comment><comment><USER17> Virtual machines are definitely fun, and can be useful things to know about if you ever design/implement a scripting language or an emulator.

I wrote a toy system a few years ago, a simple interpreter (C) along with a compiler/decompiler (Perl) to match it. Unfortunately my system didn't have a terribly well-designed instruction set. If I were to start over I'd probably implement 8086 instruction-set, or similar.

That said even a toy system is fun, the biggest issue with writing your own instruction-set is that you have to write the actual programs too. Which is often less fun! I rewrote my interpreter in golang recently, keeping the same instruction-set but adding a better trap-system. Of course re-implementing it meant that I still have the problem of no real programs being written for the machine!

[https://github.com/skx/go.vm/](https://github.com/skx/go.vm/)

</comment><comment><USER18> FYI, Edouard Bugnion one of co-founders of VMware has written a book on VM technology "Hardware and Software Support for Virtualization"[1].

[1][https://research.vmware.com/publications/hardware-and- softwa...](https://research.vmware.com/publications/hardware-and-software- support-for-virtualization)

</comment><comment><USER19> Slight tangent. To learn a bit of Zig, I've been doing the usual PDP-8 simulator task I do for systems languages. Zig allows arbitrary fixed width integers, from 1 to 2^16 bits long, signed and unsigned. It is /delightful/ to have those data types when doing an emulator. I'm convinced more languages should have them.

</comment><comment> Const-me Never wrote virtual machines, because I know why Sun (now Oracle) and Microsoft both spent a billion each to create theirs. You can write something that works over a weekend, but the performance won't be good without JIT, generational GC, and many other extremely complicated optimizations.

If you think you need to develop a VM, I recommend to reconsider, and think how you can reuse something that's already there. For instance, modern .NET VM is open source with MIT license, the code quality is more or less OK, and it's relatively easy to generate .NET bytecode from something else, Reflection.Emit from the inside, or Mono.Cecil from outside.

<comment><USER20> The point of writing your own vm isn't to come up something that is on par with Sun's or Microsoft's vm, but rather have a hands on learning experience of the inner workings of a vm.

<comment> Const-me Real-life VMs don't interpret, they JIT compile. The code in the article has nothing common with inner workings of real-life VMs.

Even VMs which do interpret don't do the way written in the article, take a look: [https://github.com/python/cpython/blob/v3.9.0rc1/Python/ceva...](https://github.com/python/cpython/blob/v3.9.0rc1/Python/ceval.c#L930-L952)

What exactly it is you're learning then?

<comment><USER21> > Real-life VMs don't interpret, they JIT compile.

Pretty much every real-life JavaScript VM is tiered, and has an interpreter, which gathers data about expected usage which the JIT will use to inform its optimizations when it goes to generate machine code.

Still, you'd be surprised about the performance you can get out of a basic interpreter. Games have used Lua for years. I've written and reverse engineered plenty of custom bytecode for various reasons in the games space. It's a useful tool to have, and there are a lot of situations where performance either isn't the goal, or the large amount of tricks used by JITting VMs isn't helpful.

The dispatch loop you point to is just about using a C extension (computed gotos) to gain a few extra performance points. You can learn about it in about 30 minutes after knowing what a VM is.

</comment></comment></comment></comment><comment><USER22> Extra credit: implement OP_HCF

</comment><comment><USER23> Note that this is _just_ a virtual machine.

You can only run the already compiled binary files for it.

If you want to write something new you will need to do it in binary. If you want to write in assembly you will need to write an assembler, or find one online.</comment>


A Massive Breach of Trust - <AUTHOR> Today I received an email back from CrashPlan customer support. CrashPlan is a data backup company that recently decided to shut down their consumer business. I have tons of data there, and I've been trying to download it before they close my account. I say trying because their client mostly sits idle while in recovery mode, not actually transferring files, which is why I have been working with their support team. However, what I received was appalling, and an outrageous breach of trust.
I found that some files of mine seemed to be missing from my backup archive, and the response I got on this topic was the following (copied verbatim):
> What are some examples of subfolders you are not seeing? For instance, I am seeing that your zstorage contents are marked as "deleted". This doesn't mean they are removed, but that CrashPlan doesn't see them present on the current device. ... I am seeing multiple sub-directories marked the same, and they should be visible if you select "Include Deleted Files" from the three-dot button in the upper right.
Seriously, CrashPlan? You can view the contents of my archive? According to the technical documentation, my archive is encrypted with my account password. This is documented here: https://support.code42.com/CrashPlan/4/Configuring/Archive_encryption_key_security (I never set my own encryption key, thus it should be my account password used in the encryption).
I can't even wrap my head around what kind of "security" allows for customer support to access my files. Thought you all should know. I hope you don't store anything in CrashPlan. <comment><USER2> What's unclear is if data blocks and indexing is a separate thing. Perhaps all they can see is the filenames & directories and can't retrieve the data. I've known some backup systems that work like this. It gives an admin visible in to what's there but can't do anything with it. This isn't consistent with their description.

That being said, based on your description of your support interaction, if they weren't using your computer to determine this information, then it seems they are outright lying about their encryption.

From their page. "Code42's Customer Champions cannot assist with recovery of an archive key password or your archive question."

Clearly they were able to assist with your archive question.

</comment><comment><USER3> From a 2013 tweet from crashplan - @paultcook Yes, filenames are encrypted, though by default visible to support. To obscure, select Pvt pw or pvt key security

[https://twitter.com/PaulTMaker/status/301722468018704384](https://twitter.com/PaulTMaker/status/301722468018704384)

</comment><comment><USER3> I haven't used CrashPlan in a while, but wasn't there an option to also encrypt filenames (it may have been cloudberry that has this, can't remember)? Maybe they are just able to see metadata concerning filenames, not the content?</comment>


Set the title of a bash terminal on OS X - <AUTHOR> http://datasyndrome.com/post/15102113013/set-the-title-on-bash-terminals

<comment><USER2> Note that the "beep" terminator is antiquated; xterm relies on a universal string terminator of an escaped backslash, i.e. "\033\\\" in this syntax instead of "\007". (Also nicer since it won't beep in terminals that don't support it.)

The "0;" means "set both icon and window title"; you can also make this "1;" to set the icon title only (i.e. when minimized) and "2;" to set the window title only (i.e. when not minimized). For example:

      printf "\033]1;icon title\033\\"
      printf "\033]2;window title\033\\"

If your terminal supports this, you'll see "icon title" when the window is minimized (e.g. in the Dock on Mac OS X) and "window title" otherwise.

If you want to do this in any Bourne-compatible shell and not just "bash", try omitting the "function" word. And if your system does not have an "echo" that supports these options, see if the "printf" command is available and use that instead. For example:

      settitle() {
        printf "\033]0;$1\033\\"
      }

There are other tricks, e.g. I use "zsh" and in my ".zshrc" this causes the window title to show the hostname and current directory path any time "cd" is used:

      chpwd () {
        printf "\033]0;[${HOST}] ${PWD}\033\\"
      }</comment>


Ask HN: What forum software are people using? - <AUTHOR> I'm looking to setup a community forum but have no idea what is available/secure these days. I'm open to self-hosting but a SaaS offering would be cool.<p>I'm not a huge fan of Discourse, I'm aware of the "older" types like phpbb and what not and I've even checked out Orange forum (https://github.com/s-gv/orangeforum). None of them quite feel right so I thought I'd ask HN what they are using :) <comment><USER2> There's Talkyard, [https://www.talkyard.io](https://www.talkyard.io) (I'm developing it). It's a forum-software & Slack & StackOverflow hybrid.

It's free & open source for installation on one's own server. There's SaaS hosting too.

It'd be interesting to hear if there's something you like about Talkyard, and don't like about it? And maybe features & integrations you need, that are missing?

What will your community be about, if I may ask?

</comment><comment><USER3> Discourse, Flarum are two that I can recall.</comment>


A huge WhatsApp leak reveals the full fury of the Tories' Brexit split - <AUTHOR> https://www.buzzfeed.com/alexspence/this-huge-leak-of-whatsapp-chats-reveals-the-full-fury-of <comment><USER2> This is nothing to do with a protocol breach: it was an intentional disclosure by one of the ~100 members of the party's WhatsApp group.</comment>


Comparison of different SQL implementations - <AUTHOR> http://troels.arvin.dk/db/rdbms

<comment><USER2> Sybase ASE is actually a really decent RDBMS. What always amazes me is how they managed to completely screw things up to such an extent that they don't even get a mention when people do these sorts of articles and comparisons.

Agree with wicknicks that this is a great document.

<comment><USER3> Yeah, their blunders were always in the realm of business strategy, their technology has always been sound. For many years they styled themselves as a mobile apps company, while their database business languished. A real shame.

</comment></comment><comment><USER4> I thought I had seen it all until I used Sybase for the first time the other day. It complained about a syntax error near INTEGER in "CREATE TABLE foo (id INTEGER)". Turns out that INTEGER is not a type it understands.

...!

<comment><USER3> But why would you even try to do that? You should be using an IDENTITY in that case.

[http://manuals.sybase.com/onlinebooks/group- as/asg1250e/sqlu...](http://manuals.sybase.com/onlinebooks/group- as/asg1250e/sqlug/@Generic__BookTextView/19681;pt=19681;uf=0)

<comment><USER4> Amazingly, integers are used for more than just primary keys. ("This is just an example. It could also be something... much better.")

<comment><USER3> Equally amazingly, generations of Sybase programmers and DBAs have managed, somehow. Perhaps it's you?

<comment><USER4> Yes. That would be the entire point of my comment.

</comment></comment></comment></comment></comment><comment><USER5> Very good document. You might consider making this a wiki, So others can add to it?

<comment><USER3> Well, not really. Anyone who has ever ported a significant application between databases will tell you, the issues you encounter are little to do with SQL syntax, and everything to do with different locking strategies, the query optimizers making different decisions, etc.

I worked on one such project recently, it flew on SQL Server and ran like a dog on Oracle 10, until we used query rewriting and stored outlines to force behavior similar to the Oracle 7's rule-based optimizer. Or in SQL server, it's normal to create temporary tables on the fly - in Oracle it's normal to have a permanent temporary table structure and only the contents are local to your session and automatically deleted when you disconnect. I don't see any of that here.

<comment><USER5> What I was trying to say had nothing to do with the exact content of the document. The diversity in database implementations is so large that everyone has their two cents to contribute. A wiki provides such an environment.

I totally agree with your points on query optimization, and since you wrote it here, probably no one but me would ever read what you said. On his wiki, more people would read and perhaps refine your statement. As you'd notice, there's already a large incentive for one to go look there to know very specific details of a DB.

The documentation about databases out there are very high level and don't really give very specific details. This page seemed like an excellent start to that.</comment></comment></comment>