Rust Lifetimes - <AUTHOR> http://www.charlesetc.com/rust/2015/10/29/ <comment><USER2> This has been my problems with Rust for the last 10-12 months.

Lifetime elision seems thoroughly broken or extremely limited in functionality, and now when I'm writing (sometimes seemingly trivial) solutions in Rust I'm spending at least as much time and mental energy explicitly annotating lifetimes as I would be if I was just managing malloc and free in C.

As a result the pain vs. benefit curve doesn't bend nearly as far toward Rust as it theoretically should.

<comment><USER3> That can be a problem. Some common C/C++ idioms do not translate to Rust. In particular, a function which creates and returns an object is difficult to express in Rust. In Rust, you have to create the object before the call, then pass it to a function to be filled in. Either that, or go with a reference- counted type.

<comment><USER4> What makes you think you can't create and return an object? This is how every constructor function in rust works.

<comment><USER5> I believe this is referring to '...and keep a mutable reference to it' ie. A singleton, and many overseer style observe-and-update-on-change data binding patterns.

Basically, shared ownership is pretty central to many C++ patterns, which means they translate poorly into rust.

</comment></comment></comment></comment><comment><USER6> Note that the go exemple about returning a pointer to a stack variable is actually valid in Go: variables that escape their scope are allocated on the heap.

<comment><USER7> I _think_ the author was just trying to convey that it's no longer stack allocated in this case. Escape analysis is really nice, but when you need performance, it can get in the way. I've talked to people who ended up having to leave a ton of comments with the equivalent of "dont do this, it messes up escape analysis and performance goes south" all over their codebase.

<comment><USER8> I'm actually considering adding escape analysis to _Rust_ (as a part of clippy, that is) so that we can advise users to convert heap allocated Vec/Boxes to stack allocated thingies.

<comment><USER7> That would be super cool!

</comment></comment></comment></comment><comment><USER9> struct Sheep<'c> { age: &'c i32, }

I don't get why this is needed at all and isn't implicit? What are other possible values for a lifetime in a struct?

<comment><USER10> As the person who originally pushed extremely hard for all of the lifetime elision that we have today, I agree with you that this case is still too verbose.

That said, the reason it wasn't included in the original elision RFC ([https://github.com/rust-lang/rfcs/pull/141](https://github.com/rust- lang/rfcs/pull/141)) is that the design space here is a little bit more subtle than some of the cases that _did_ make it.

In particular, I believe that it's important to know that a particular struct contains a borrowed value somewhere.

So let's say you could leave off the `'c` on the Sheep struct, and I wrote a struct containing `Sheep`:

        struct Flock {
            sheep: Vec<Sheep>
        }

Now, we have visually lost the fact that a borrowed value is stored inside the flock. Since data structures can get very recursive, this rapidly causes useful information about ownership to get lost.

What I'd like to see personally is:

        struct Sheep<&> {
            age: &i32
        }

        struct Flock<&> {
            sheep: Vec<Sheep>
        }

What this would mean is that you can always see, by looking at a struct definition, whether it contains borrowed values (anywhere recursively), but without the grotty need to define and wire up lifetime names.

I like the fact that this maintains the strong mental notion of ownership (the meaning of the & "operator" in Rust), but, as with normal elision, it eliminates the wiring that a good compiler should be able to do for you.

<comment><USER11> There're even people that don't like the automatic moving in Rust, because they can't see where something is moved.

I can understand why people feel that way, but it's a bit irrational, because if automatic behaviour can't result into incorrect code, more ressource usage or higher work load, why should I care about?

I have pretty much the same feeling about explicit lifetimes in this example.

Again, I understand that people want the whole control, want to see every relevant information, but everything has its costs, and the relevant information in each use case isn't always the same.

<comment><USER7> We did try making moves and copies into distinct syntaxes.

      let x = foo; // <- copies
      let x = move foo; // <- moves

It was worse, or at least, was by the majority of people at the time. See [http://smallcultfollowing.com/babysteps/blog/2012/10/01/move...](http://smallcultfollowing.com/babysteps/blog/2012/10/01/moves- based-on-type/) for more of this ancient history.

</comment></comment></comment></comment><comment><USER5> cool post. what about traits and 'static?

Anyhow; Its definitely worth making two points about lifetimes very clear:

1) They don't exist at runtime.

Lifetimes are purely a compile time thing the compiler uses for formal safety.

2) 'a is not a actual lifetime, it is the minimum possible life time valid for that item; ie. a _bound_ , not a concrete value.

&'a means; this arg/trait/ref/whatever must live at least as long as 'a. That's why different objects with different lifetimes can coexist in a struct of 'a, without needing 'a, 'b, 'c etc for each reference in the struct.

<comment><USER12> It's not clear from context in your comment if you're saying this, but, for `x: &'a T`, 'a is a bound in two ways:

\- it is the maximum possible lifetime of the x variable itself,

\- it is the minimum lifetime of the `T` instance x points to.

These are 100% related of course (x can't point to something that is invalid), but it is worth being careful about which end of a reference/pointer you're talking about when talking about validity.

<comment><USER13> Thanks for this comment, that clarifies things a lot for me. I think it should be in the docs (with equal brevity) if not already.

<comment><USER7> I've made a note to check it out, thanks.

</comment></comment></comment></comment><comment><USER14>
      Rust is a unique language in that it deallocates memory on the heap
      without requiring the writer to call free,
      while at the same time having no need for a garbage collector.

Someone correct me if I'm wrong but surely this is not unique - don't Objective C and Swift have automatic reference counting which accomplishes much the same thing?

<comment><USER15> Intersection ARC, Lifetimes:

* Not having to worry about trivial memory/resource allocations

ARC - Lifetimes:

* Can blow up hilariously with refcount cycles

* Incurs a runtime overhead

Lifetimes - ARC:

* For the subset of allocation patterns it handles, it does so with zero runtime overhead (i.e. invalid programs do not compile, invalid = leaks memory)

* Use extends beyond just memory allocation/deallocation (see the concurrency docs [1] for example) (note that Mozilla wrote Rust to help write Servo [2], their prototype highly-parallel browser engine, so this use case was a target from the getgo)

* Cannot encode all data structures a GC can (hence why reference counting is part of the stdlib [3])

[1]: [https://doc.rust-lang.org/book/concurrency.html](https://doc.rust- lang.org/book/concurrency.html)

[2]: [https://github.com/servo/servo](https://github.com/servo/servo)

[3]: [https://doc.rust-lang.org/alloc/rc/](https://doc.rust- lang.org/alloc/rc/)

<comment><USER16> > invalid = leaks memory

Not quite true- invalid use of lifetimes typically means use-after-free rather than a memory leak (and if you include the standard library, then you can leak memory in safe Rust).

<comment><USER17> Its interesting to me how everyone goes to "memory leaks" as their example of memory unsafety, and then if we're talking about Rust we need to clarify that Rust allows leaks (but it makes them hard to do by accident). I guess mnemonically "memory leak" is easier to bring to mind than "dangling pointer" when talking about memory.

<comment><USER18> It's also funny because memory leaks literally aren't a memory safety issue. If they were, every garbage collected language would be memory-unsafe.

</comment></comment></comment></comment></comment><comment><USER8> [This comment is outdated, I discussed this with the author and he improved the post :)]

I feel this post confuses two different notions of lifetime. And also mixes concrete lifetimes with lifetime parameters.

There's the CS notion of liveness, and then there's the lifetime notation in Rust.

> To know when to deallocate objects

This is handled by the CS notion of liveness. Well, an approximation to it. "Things are live until they are used, or until they can no longer _be_ used".

The deallocation comes from Rust's affine type system.

In fact, Box<T> and other self-deallocating things don't have an associated "lifetime" in the Rust sense of the word, at least not one that dictates their deallocation.

The lifetime syntax is basically a form of generics which lets one put constraints on the allowed liveness of &-pointers and their ilk.

> example_function<'a> names the lifetime defined by this function, called 'a.

This isn't true. There does exist an anonymous inner lifetime for the scope of the function. It's not `'a`

What's happening here is that we're saying, "For _any_ lifetime `'a`, we can have a version of example_function which returns a pointer which can live that long.". This doesn't compile, because the compiler knows that this function can only return pointers which live as long as its scope or less, not "any" lifetime. (Which is impossible to return from anyway).

This becomes clearer when you have a function like `fn foo<'a> (x: &'a [u8]) -> &'a u8 { &x[0] }` (FWIW if you omit the lifetimes Rust will elide them and internally produce the same function). Here, what we're saying is, "For any lifetime 'a, foo can take a slice that lives as long as 'a and return a pointer that lives as long as 'a". This compiles, because the compiler can see that a reference to x will live as long as x itself.

Similarly, with structs:

> Sheep<'c> instead of Sheep > > This is not doing anything concrete. It's > just giving a name to the lifetime that Sheep structs can last for.

This is wrong, too. It's giving a _parameter_ to Sheep, saying "Every Sheep has an associated lifetime 'c, which is the lifetime of its inner reference".

In fact, it is possible to define the body of sheep in such a way that Sheep is guaranteed to live _longer_ than `'c` (instead of shorter, as in the example above). This is explained in the Rustonomicon ([http://doc.rust- lang.org/stable/nomicon/subtyping.html](http://doc.rust- lang.org/stable/nomicon/subtyping.html)). But it's an advanced topic, doesn't crop up often in actual Rust programming.

<comment><USER12> _> Here, what we're saying is, "For any lifetime 'a, foo can take a slice that lives as long as 'a and return a pointer that lives as long as 'a"._

Another way to phrase it is: the return value of the function is guaranteed to be valid for at least as long as the argument (but may borrow from it, and hence mutations of the argument need to be outlawed as long as the return value is held).

<comment><USER8> Agreed, it's nicer to talk about "validity" than "liveness" :)

<comment><USER12> Well, my rephrasing was meant to be more than just s/validity/liveness/: I find that removing quantifiers (like for-all) often improves my understanding, as it usually gives more obvious context/motivation for what the goal is. It is then easier to understand the more formal version once I know approximately what it is trying to do.

</comment></comment></comment></comment><comment><USER19> Can someone explain what happened in the C example?

<comment><USER7> Well, it's not guaranteed to print 3, it can do anything it wants. Since you have a dangling pointer, it's not pointing to valid memory. So it depends.</comment></comment>


Windows 10 vs. Mac, what is better to avoid telemetry privacy issues? - <AUTHOR> So, I have currently a PC I built and have windows 10 Education edition. When installing, windows "tricked me" into not getting an offline account by not offering it.
After noticing this, I basically wiped my SSD and reinstalled windows 10 with the internet unplugged. This allowed me to get an offline account. However, I never entered my product key and windows basically automatically linked my previous key to my computer. This means somehow windows has linked my hardware to my Microsoft account and having an offline account is pretty much voided from a privacy perspective.
At this point, the whole thing is creepy and I don't know how I can trust windows anymore. Even if I can turn down telemetry to "security - 0".
I am just not sure how I can truly be convinced my name and online account can't be linked to any telemetry it gets or what telemetry it is pulling.
So, now, I'm considering moving over to Mac and getting a MacBook Pro. I hate this idea because when you build your own pc, you have freedom to upgrade stuff and do whatever you want without fear of voiding some warranty. But I hate telemetry more and it has pushed me over the edge to give up that for more privacy.
So, my question is, does Mac provide more privacy from telemetry than windows 10 education edition (the way I have installed it)?
I have read that you can both opt out of macs telemetry completely AND even if you are opted in, it is "anonymous" telemetry data. Meaning, while apple pulls it if you leave it on, it is not linked to you AND Apple takes extra steps to make sure it doesn't get linked to any Apple account or user. Is all this true?
Basically, I am just asking someone with knowledge on this to help me make the correct decision. <comment><USER2> MacOS keeps asking me about setting up an iCloud account but most software works without it. Tweetbot for example needs an iCloud account for syncing between devices. When you buy software via the Apple App Store of course you'll need an Apple Id. Security updates and can be installed without one. I switched off all telemetry and for a while had a software to track network connections ([https://www.obdev.at/products/littlesnitch/index.html](https://www.obdev.at/products/littlesnitch/index.html)) installed. Connections to Apple were all explainable, e.g. to sync the time (can be switch off).

<comment><AUTHOR> For the tweetbot, do you at least hace the option of not using iCloud, or is that not possible?

With the Apple store, I don't really care if they know I own a product. I just don't want them tracking what I do with it or what files I save with it. I assume Apple doesn't do this? I know Microsoft can depending on things.

Was there anything you saw with littlesnitch that hinted some telemetry stuff was being sent that could be "personal data" that a person who likes privacy would be concerned about?

I'm leaning heavily towards getting a Mac now. I find it hilarious given that windows literally could have simply not done this telemetry thing to prevent it, but i guess they couldn't help themselves.

</comment></comment><comment><USER3> Definitely Mac. They do telemetry, but three things:

(1) They do less of it, give you more control, and they do not seem to reset settings on upgrades.

(2) They have a history of actually standing up for customer privacy, and you are their customer. I trust them more in this area than Microsoft.

(3) I trust their security in general more than Microsoft.

If you want _NO_ telemetry you pretty much have to run Linux and even there be somewhat careful about what you install.

<comment><AUTHOR> When you say less of it, are there certain telemetry things that can't be turned off? If so, which ones?

I tried Linux myself and it just wasn't s polished product. Especially hiDPL, you get "normal" and "double", that isn't ok. Windows even gives you fractional options for that. I assume Mac does too?

<comment><USER3> Mac just hides DPI issues almost entirely. It's amazing. It's an area where Macs are by far the best, even significantly better than Windows.

You can disable most of Mac's telemetry in the privacy tab in the security settings, but I think it still will phone home for update checks and push notifications.

That being said I definitely trust Apple more than MS around security and privacy. MacOS also does not come by default with a bunch of crapware and ads. Last time I installed Windows 10 on a fresh machine for someone else it solidified in my mind that I would only use Mac or Linux, never Microsoft.

</comment></comment></comment><comment><USER4> Mac is absolutely more secure and has less telemetry in general. Slightly unrelated, but Apple's FileVault encryption solution has been proven effective in court while BitLocker's default behavior is to compromise your private keys by uploading them to OneDrive.

I haven't used Windows in 4 years except in VMs for IE 11 testing.

</comment><comment><USER5> I'm here to talk to you about our lord and savior Linux

<comment><AUTHOR> I've tried Linux mint and looked at a couple other distros. The customization of hiDPL is pretty much lacking in all distros I looked at or tried. You either get "normal", which is simply too small or "double" which makes everything too big. This makes Linux unusable from an OS perspective at home for me. Do to my screen size and eyesight, it doesn't work for me. I really want Linux to work btw.

I see how Linux is great for server stuff. But, the OS experience I had so far had been horrible. It feels like there are simply too many distros and not enough focus on just making a few really great ones. Instead, it feels like you have lots of just OK distros instead.

<comment><USER5> Okay, so no orvellian surveilance, but still rather have that than some UX paper cuts in unnamed distro.

Yea, good luck with that Mr Hacker dude.</comment></comment></comment>


Blind signatures for Bitcoin to secure BTC storage - <AUTHOR> http://blog.oleganza.com/post/77474860538/blind-signatures-for-bitcoin-the-ultimate-solution-to <comment><USER2> Adding another entity to rely on to hold funds "safe" just adds another link to the chain that can die, disappear, change it's mind and be broken.

I personally love how Electrum wallet does it:

You may generate and regenerate wallet using only key word phrase. Keep it safe in memory or in bank deposit box.

No backups needed. You may always regenerate wallet by keyphrase.

<comment> wes-exp _No backups needed_

Doesn't Electrum do this by backing up your wallet to "the cloud"? Even if it is 100% properly encrypted, I can't say that I feel good about this. Feels like one bug away from compromising many people's wallets.

<comment><USER3> No, it does not.

<comment> wes-exp Are you sure? Why does the restore process require a server address?

[https://electrum.org/seed.html](https://electrum.org/seed.html)

The screenshot uses ecdsa.org, which seems to be just an Electrum server of some kind.

<comment><USER4> Pretty sure that's because Electrum doesn't download the entire blockchain but relies on servers for most of it and only downloads a certain amount of recent history and trusts servers for older history. And it doesn't have to be that server, which is why app lets you change the URL, any server serving blockchain history you trust is fine. It's using your passphrase as the one and only seed for key generation, so it can reliably generate same private key every time. Someone correct me if I'm mistaken on any details.

</comment></comment></comment></comment></comment><comment><USER5> The paper is very light on details. I am not even sure what security property is being achieved here. Is it some kind of group blind signatures protocol? Some kind of threshold system? Some kind of special-purpose multiparty computation protocol?

<comment><AUTHOR> The paper only discusses blind signature algorithm: how to prepare a "blinded" public key and then produce a matching signature, also blinded from the signer. The primary motivation is to use such blinded public keys in the standard Bitcoin multisignature transactions. That is, transactions, using N public keys and requiring M signatures (M <= N). "Multiparty computation" with "threshold system" here are provided by Bitcoin automatically, paper does not discuss that. But it shows how such multiparty signing can be done absolutely privately, when neither party (except for initiator and holder of funds) can learn which transaction they allowed to spend.

<comment><USER5> "The paper only discusses blind signature algorithm"

No, it seems to discuss something else. It starts out talking about blind signatures, then veers off with claims like this:

"The novelty of the scheme is that unlike the original Chaum blind signature scheme, this one does _not allow anyone to prove that the signing party signed a particular message_ "

I am not actually sure what you are trying to say there. Does it mean that I can only narrow down the possible signers to some group? Does it mean that the signature key is ephemeral, yet somehow meaningful?

To put it another way, what differentiates your proposal from this:

[https://eprint.iacr.org/2011/402.pdf](https://eprint.iacr.org/2011/402.pdf)

""Multiparty computation" with "threshold system" here are provided by Bitcoin automatically, "

What? Where? Citation needed.

<comment><USER6> Yeah confused. If you can't tell who signed a particular message, then what are signatures for? I thought they were for authentication, which means the message was not modified, and, I know who sent it.

</comment></comment></comment></comment><comment><USER7> A "blind signature" sounds like an odd concept.

What can be done I just thought up is adding another transport layer to bitcoin. And breaking up and distributing the wallet's contents "sum" among strangers into something like a checksum. Then on transactions bringing the chunks of checksum partially back together.

How it's broken down can vary. you have to remember though, if you are buying something for $10 all that needs to be verified is that you have $10 or more for the next step.

<comment><AUTHOR> The scheme allows never holding all secret pieces in one place to make a transaction. Otherwise, if your machine is compromised, someone can send your money elsewhere. I don't quite understand your proposal, but it requires having all chunks in one place to make a transaction.

</comment></comment><comment><USER7> Something that also just came to me, instead of having one large sum on money in one wallet. Who says it can't be distributed and broken down in max wallet sizes of $50 or so. $50 is a common number no one should really care too much about. So there goes your concern about being able to see wallet size. If something costs more than $50 group multiple wallets into the transaction.

<comment><USER8> And how do you plan to realistically manage 200 such wallet's? Realistically you would have a computer somewhere know there key's which introduces the same inherent risk as having that computer manage a single wallet.

If you really want secure storage you print out your private key's and store them in one or more vaults. If your even more paranoid you can encrypt the information such that you need more than one vault to access the data, but have some redundancy so if one storage location floods you don't lose any bit- coins. Which is where these N of M encryption schemes become useful.

<comment><USER7> The idea is less about losing coin, and more about concealing wallet size from people that don't need to know about how much money is in a bitcoin wallet.

My idea is more along the lines of instead of pulling out a wad of money you're only pulling out $50 at a time.

Me personally, I don't mind the wallet amount being public because for things lie fundraising it keeps people honest.

<comment><USER9> In the bitcoin world, this technique is known as "merge avoidance" \- read about it here: [https://medium.com/bitcoin- banter/7f95a386692f](https://medium.com/bitcoin-banter/7f95a386692f)

</comment></comment></comment></comment><comment><USER10> Why would you use this instead of a warp wallet?

[https://keybase.io/warp/](https://keybase.io/warp/)

<comment><AUTHOR> Good question. I answered it in the paper (just 8 pages) which you obviously haven't read before asking.

Keybase is a single point of failure. Or your machine that will do KDF. M-of-N multisig transactions are way safer because to sign a specific transaction you never need to have all secret material at once on a single machine. If my PC is compromised, I can still independently verify specific transaction I want to sign and send it out to my friends to sign. All their private keys are stored on independent machines which normally aren't compromised altogether by the same attacker.

On specific problem with brainwallets - low entropy. One specific problem with web apps: no code signing. Even if your SSL pubkey is pinned (which is not supported by any browser yet), the code you receive from the server is never remembered and pinned (like with installed apps). If their server is silently compromised tomorrow, someone may humbly hijack keys of 1% of the users and go undetected for quite some time.

<comment><USER11>
      > which you obviously haven't read before asking

This blew my mind; so unkind!

<comment><AUTHOR> Sorry, but the question was quite disrespectful. We are presenting a high- security solution to an important problem and the ignorant observer proposes to use something extremely unsafe and insecure as an alternative without even trying to understand the problem.

Here's the motivation, right on the first page:

"This can be viewed as an ultimate solution for secure storage of bitcoins as no individual computer system can be fully trusted (e.g. even RNG may leak information about private keys through ECDSA signatures [5]). By spreading the trust between several independently operating computers the risk is significantly reduced. The attacker not only has to compromise several computers instead of just one, but beforehand they must find out which computers are involved (which is made much harder when blind signatures are being exchanged). Therefore the scheme enables safer Bitcoin storage on conventional personal computers and smartphones without need for specialized hardware or compromising privacy."

To my excuse, I only allowed myself to be a bit arrogant while providing a respectful answer anyway. This both answers the question and signals that something can be improved in the discussion.</comment></comment></comment></comment>


China censorship leaks outside Great Firewall via root server - <AUTHOR> http://arstechnica.com/tech-policy/news/2010/03/china-censorship-leaks-outside-great-firewall-via-root-server.ars

<comment><USER2> This reminds me of the time Pakistan's AS accidentally blocked YouTube for the whole world. They accidentally published a very specific routing rule pointing YouTube's IP addressed to some machine in their network. This sucks even more than breaking DNS because you can't even get around it by hardcoding the IP.

[http://www.renesys.com/blog/2008/02/pakistan_hijacks_youtube...](http://www.renesys.com/blog/2008/02/pakistan_hijacks_youtube_1.shtml)</comment>


LizardFS is Pretty Nice - <AUTHOR> https://potatofrom.space/post/lizardfs-is-pretty-nice/ <comment><USER2> "However, it doesn't write files whole – it breaks each into 64 MB chunks and distributes them across its drives."

And what happens when the file is <= 64 MB?

Does it run on illumos / SmartOS?

<comment><AUTHOR> According to the LizardFS whitepaper [1], the chunks can be _up to_ 64 MB. So I believe if the file is smaller, the chunk is just as large as necessary.

Looking at some chunk files on my system backs this up:

      root@rem> ls -l | head
      total 11702880
      -rw-r----- 1 mfs mfs 33558528 Dec 12 18:17 chunk_ec_1_of_2_1_000000000000010C_00000001.mfs
      -rw-r----- 1 mfs mfs    69632 Dec 12 18:12 chunk_ec_1_of_2_1_0000000000000179_00000001.mfs
      -rw-r----- 1 mfs mfs    69632 Dec 12 18:11 chunk_ec_1_of_2_1_0000000000000187_00000001.mfs
      -rw-r----- 1 mfs mfs    69632 Dec 12 18:26 chunk_ec_1_of_2_1_0000000000000194_00000001.mfs
      -rw-r----- 1 mfs mfs    69632 Dec 12 18:06 chunk_ec_1_of_2_1_0000000000000197_00000001.mfs
      -rw-r----- 1 mfs mfs    69632 Dec 12 18:36 chunk_ec_1_of_2_1_00000000000001A1_00000001.mfs
      -rw-r----- 1 mfs mfs    69632 Dec 12 18:03 chunk_ec_1_of_2_1_00000000000001CE_00000001.mfs
      -rw-r----- 1 mfs mfs    69632 Dec 12 18:13 chunk_ec_1_of_2_1_00000000000001D4_00000001.mfs
      -rw-r----- 1 mfs mfs   135168 Dec 12 18:05 chunk_ec_1_of_2_1_0000000000000217_00000001.mfs

As for illumos/SmartOS -- maybe? The LizardFS cookbook [2] has a section for illumos, but there's nothing in it. It should probably work (it's C++), but there is probably going to have to be manual effort involved.

<comment><USER2> Now do a test with a file size of exactly 1 non-NULL byte and report back.

If the 1-byte file gets replicated across multiple disks, corrupt one of the chunks and report back.

<comment><USER3> Depends entirely on what replication goals you have setup. My simple cluster (not EC or XOR) mandates 2 copies per chunk at a minimum. My 1-byte file was unaffected by a single chunk corruption, even on the node in which the corruption originated.</comment></comment></comment></comment>


THE NEXT TOP 10 CITIES FOR TECH JOBS - <AUTHOR> http://www.fastcompany.com/3048391/the-future-of-work/the-next-top-10-cities-for-tech-jobs?partner=rss

<comment><USER2> Most of these locations allow employers to force non-compete agreements on employees. California is still a magnet for the best talent because of this.</comment>


Ask HN: How do you build a close support network to help achieve your goals? - <AUTHOR> At YC, groups meet every other week to discuss company goals and progress, learn from each other's experiences, and get guidance from their mentors. This system helps founders realize and adjust their goals and plans for what comes next, and helps enforce those goals by adding some amount of accountability.
Have you used a similar system for your personal life or career?
Do you have any experience forming small groups of friends or colleagues to regularly discuss goals?
What systems/tools do you use to help you achieve your goals? <comment><USER2> I have a weekly(Monday) chat session with an accountability buddy where we discuss the previous week's goals and make new goals for the coming week. It's a little bit more involved than just ticking off items, and involves being mindful about how to do things differently in the coming week. At first it was strictly work-related but morphed into including other areas such as health goals, mood/emotional goals etc. We're nearly one year into it.

My friend delivers mail for a day job and works on a fantasy novel the rest of the time. I'm sort of a code person working on a startup and various other things.

Somehow it works for us. And better than other approaches I've tried before.

<comment><USER3> I have been doing something similar with a friend. I think consistency is the biggest factor in making it work.</comment></comment>


After a short trial I've just launched bosscheck.me - <AUTHOR> http://bosscheck.me

<comment><AUTHOR> Previous HN comments here: [https://news.ycombinator.com/item?id=6437847](https://news.ycombinator.com/item?id=6437847)</comment>


Show HN: Wiretap is a tool for integrating Apps w/REST APIs - need beta testers - <AUTHOR> https://httpkit.com/wiretap

<comment><USER3> Very cool demo - there was enough in the video that I got it without feeling like you glossed over much, nor did you go too slow - pretty good pace for this type of service and audience.

</comment><comment><USER4> I upvoted at first because Kris is a friend and it looked good. Then I watched the video and:

1) This looks _great_

2) It's a fantastic demo video

Is the automatic local connection app thing going to work if I'm behind a NAT? Any plans to make the desktop app work on Windows or Linux?

<comment><AUTHOR> Thanks! Yep, the local connection will tunnel through an HTTPS connect, so it should work from behind aggressive NATs.

The goal of the desktop app is cross-platform. In its current form it's a cobbled together OSX app that shells out, but moving it to Java (or an easier- to-port language) soon.

<comment><USER3> If you're in to Java, perhaps take a look at griffon - <USER2> groovy/swing/mvc combo. <http://griffon.codehaus.org/>

</comment></comment></comment><comment><AUTHOR> Hey HN, op here. Wiretap is a weekend project of mine I've been hacking on for a few months.

It's like your browser's Network Tab, but for server-side and mobile apps. Technically, it's a hosted reverse proxy / debugger that's really easy to setup.

Looking for beta testers as well as feedback from HN on the demo and landing page content. Thanks for your help and input!

</comment><comment><USER5> Ooh, this is really neat. :) I'd love to test - would be incredibly useful for my project right now. I'll PM you :)

</comment><comment><USER6> Looks very cool. Excited to try it out.</comment>


The Producing-Consumer Paradox - <AUTHOR> http://pulpertank.com/the-producing-consumer-paradox

<comment><USER2> So where's the paradox?

<comment><USER3> There's no paradox. Some of my favourite apps on my iPad/iPhone: Garageband, Brushes, Camera+, TabToolkit. That is just what I use personally. If you have the skills you can produce high quality results.

Certainly you cannot do as much as a regular PC. But I don't know why some people think these devices are 'just for consumption'. Maybe they just have no imagination.</comment></comment>


Pandora raises $35 million - <AUTHOR> http://www.pehub.com/44380/pandora-tunes-into-35-million/

<comment><USER2> Don't get me wrong, I'm fond of Pandora's service, but isn't it strange that our society loves to throw money at sinking ships.

Pandora has now been funded over $55MM and cannot possibly be profitable if it boasts 70% of it's revenue goes to royalties.

Personally I'd also argue that these guys are hardly revolutionary. They have not developed any different business model from radio, but still gripe about lowering royalties. I'm not saying there's an obvious new way to distribute music, but historically a company should succeed because of innovative technology or an innovative business model, and their song attributes rated by-hand by "music professionals" should not be considered innovative technology.

But like I said, I'm fond of the service. They're pervasive and I'm personally a daily user.

<comment><USER3> 70% was under the old deal and they admit they weren't profitable under that. The new deal is 25% of revenue or a song fee that increases each year (as you'd have seen if you'd read the article's 4th paragraph)

As for revolutionary, I don't care. It's a good service. I show it to normal, non-tech people and they almost universally start using it themselves. That says it all for me.

<comment><USER4> > I show it to normal, non-tech people and they almost universally start using > it themselves.

I have to quote this. The non-revolutionary stuff that nobody has for some reason yet created is just as worthwhile as using the most newfangled tech for some crazy application. Hell, I think I know more Pandora users than Twitter users...

<comment><USER2> That is an absurd comparison.

Twitter series A: July, 2007

Pandora series A: March, 2000 (!)

Everyone's _thought of_ radio. Although, no one thought to brute force categorization. I'm a daily user today, I fully expect to look back on pandora in 4 years as an epic failure.

</comment></comment></comment></comment><comment><USER5> Is the assertion that terrestrial radio "pays zilch" accurate? I've never heard that and it actually surprises me.

<comment><USER6> Before it was made illegal, music companies used to pay Radio Stations in order to get their music on the air!

When Pandora/etc argue that it adds popularity to music, they aren't lying- You can see this effect in the national music sales numbers-

Music used to be primarily local- A DJ in a regional market would start playing songs, and they'd catch on in that area. You can track songs such as Louie Louie, which started on the west coast and moved east.

</comment></comment><comment><USER7> Is it me or has Pandora completely surpassed Last.Fm in terms of popularity?

<comment><USER8> Not in Canada, where we can't listen to Pandora, but we can listen to (the now limited) Last.Fm.</comment></comment>


Without a GUI: How to Live Entirely in a Terminal - <AUTHOR> https://www.linuxjournal.com/content/without-gui-how-live-entirely-terminal <comment><USER2> It's odd to me that Emacs wasn't mentioned at all. I use it for most of my computing (email, music, file management, etc.) and it works well enough in the terminal if the Meta-key works properly, as opposed to needing to use Escape.

>Luckily, people were emailing each other from UNIX/Linux machines long before modern graphical email clients (or webmail) even existed.

I suppose this is technically true, due to the use of ''modern'' here, but I find it important to note that graphical interfaces for things such as email have existed for decades. Using terminals shouldn't be an ideal.

I find the native terminal emulation provided by the Linux kernel and OpenBSD to be lacking. There's not much of a good reason to query terminfo or termcap when every terminal you're reasonably going to use supports a superset of ECMA-48. However, I've found that even basic sequences such as SCROLL UP and SCROLL DOWN aren't supported in the native terminals. So, you get the choice between your program not working in those, making it inefficient and jittery for every terminal, or building a querying infrastructure; the first option is what I've chosen. If I'm wrong or anyone has any advice for this, I'd be interested in it.

I wouldn't be writing a terminal program in this age if the GUI facilities of modern systems were decent and I could build up my own abstraction for that, but the terminal, with all of its added faults, is at least the simpler option. It would be nice to have facilities GUIs enjoy that let me express simple concepts such as ''The interface must be at least this large.'', though.

<comment><USER3> > It's odd to me that Emacs wasn't mentioned at all. I use it for most of my > computing (email, music, file management, etc.) and it works well enough in > the terminal if the Meta-key works properly, as opposed to needing to use > Escape.

Yes, and literally every point on his list has something in Emacs to handle it -- it is my favorite operating system, just needs a good text editor, as the old joke goes.

Sure, not all of the in-emacs tools are as nice as some of things like `w3m` and `w3m-image`... but they are all there, for every facet listed, and some of them are even _better_ in Emacs.

Old joke aside, I bet Emacs' text editing and word processing abilities (with some packages installed) are as good as or better than those found in WordGrinder.

Emacs plays nice with `tmux`, but also provides its own in-emacs windowing.

You can even run full ANSI terminals within Emacs and then run anything (such as `cmus`) that might not have a direct in-emacs integration within an Emacs terminal buffer.

<comment><USER4> > _and some of them are even better in Emacs._

Even if not, interoperability is the killer feature of Emacs as a platform. Just try to shuttle data between spreadsheet, e-mail and web-browser with the tools mentioned above. In Emacs it's trivial - and not only that, it's also trivial to write snippets of elisp that shuttle the data for you or otherwise automate whatever workflow you have.

<comment><USER5> "Just try to shuttle data between spreadsheet, e-mail and web-browser with the tools mentioned above"

Have you ever tried MS Office + VBA for comparison purposes?

<comment><USER4> I did! Elisp is a better language :).

Microsoft does understand interoperability; Office suite integrates well together and applications respect power users. I like them for that.

</comment></comment></comment></comment></comment><comment><USER6> > Alt-N goes to the next "window", Alt-P to the previous and so forth

Thanks to this sentence, it dawned on me that even if you're a l33t hax0r, GUI and mouse-based interfaces have the advantage of not requiring you to remember how to use a program. How many program interfaces can you keep in your long term memory? Is it even worth it to waste your precious (human) memory space in such a thing?

Sure, TUIs and UNIX commands can be really useful and efficient once you learn them, but GUIs are useful even if you've never used the program. They give you an acceptable level of productivity right off the bat, and most of the time it's not worth it to waste your time learning the superior UNIX/terminal version.

<comment><USER7> While I agree that a GUI can be a bit more discoverable in general, I don't think CLIs (and more generally, terminal-based programs) are necessarily for the l33t crowd. We've just been conditioned that way by the fact that most user-facing applications these days are GUI based.

But think of the DOS-based programs of yore, like WordPerfect 5, and the Turbo C/Pascal IDEs... they had menus on screen, easy-to-access help screens, etc. to guide the novice. (What's the Web-app equivalent to the F1 key?) History shows that WordPerfect was fine to use as a non-technical person. (I wish our modern word processors were so simple to use as WP 5, actually -- modern app- design trends have bloated the word processor into a confusing mess, IMO, and I think the average office worker who has worked in both generations might agree.)

I really like the approach taken by the 'which-key' extension for Emacs, which is particularly well used in the Spacemacs distribution. Pressing the space bar pulls up a very nicely organized menu of actions, including access to help. It's extremely helpful both as a memory aid, and also for discovering new features.

Obviously a nice menu doesn't get the user fully past the initial Emacs learning curve, which supports your argument. But for the next level of user -- from novice to initiate -- it's a tremendous productivity boost.

\- [https://github.com/justbur/emacs-which- key](https://github.com/justbur/emacs-which-key) \- [http://spacemacs.org/](http://spacemacs.org/)

<comment><USER4> > _I really like the approach taken by the 'which-key' extension for Emacs, > which is particularly well used in the Spacemacs distribution. Pressing the > space bar pulls up a very nicely organized menu of actions, including access > to help. It's extremely helpful both as a memory aid, and also for > discovering new features._

It's even nicer than that (in particular, when you're _not_ using Spacemacs): Emacs has a lot of multi-key commands (just like Vim). Whenever you pause in the middle of such command for a brief while (0.5 second by default), it'll pop up a sidebar listing you keys you can press to continue along with the command they execute. So e.g. there's a command you want to invoke, you remember it was under C-c something, but don't remember the exact combination. With which-key enabled, you just press C-c and wait until a list of available continuations shows itself. It's also useful for command discovery (what's there under C-c? what's under C-c C-v?).

Speaking of similar techniques, I like the way Magit works even better. Most commands involve several key presses, like "d d" for diffing against the thing you're pointing at, or "l l" to show current log. So whenever you press "d", a popup like this appears (bottom 2/3 of the screenshot):

[https://magit.vc/screenshots/popup- diff.png](https://magit.vc/screenshots/popup-diff.png)

It immediately shows you all the different keys related to [d]iffing, including some sequences that set flags (like e.g. -f). It disappears as soon as you press the key. The principle here is that you'll quickly memorize most frequently used commands and type them so fast you won't even notice the popup, but whenever you don't remember something or want to explore, there's always something showing you the next steps.

<comment><USER7> Totally agreed. Magit's interface feels like the "curated" approach -- they laid out all the options precisely to optimize your use of the tool. This is great to have in small, task-dedicated parts of Emacs. But then we also get complete, "uncurated" discoverability such as in your C-c example.

I think that Spacemacs is a decent compromise between the two, covering a large swath of functions with a loosely organized menu structure. Although they occasionally clobber some key bindings in an annoying way (org-mode and magit come to mind), it's nice to be able to find "text" things under the text menu, even when you don't remember the key-binding at all. It's surprising how well the three modalities (curated magit, general which-key, and semi-curated Spacemacs) work together, and stay out of each other's way (for the most part!).

</comment></comment></comment></comment><comment><USER8> These realizations are humorous to software folks of my generation who started on Punch Cards, then IBM 3270s, then VT100s and/or teletypes and Decwriters.

I see kids look at my two screen setup, which is on Windows 10, but basically a bunch of terminal windows open and think I'm some sort of l337 h4x0r when really I'm just an old coot who can't deal with change.

Even on Windows, I do everything in Powershell. Even things like installing Windows Updates. (Get-WindowsUpdate)

<comment><USER9> > These realizations are humorous to software folks of my generation who > started on Punch Cards, then IBM 3270s, then VT100s and/or teletypes and > Decwriters.

As someone who is also old enough to have used all these ancient technologies, I'm mystified as to why people today would want to go back to doing everything from a command line interface. Some things are really better done in GUIs. For example, why should I use diff if I can use kdiff3 instead?

<comment><USER10> I think a lot my nimbleness comes from avoiding the mouse...which can also be done fairly well in most GUIs.

In the case you mention, I'd reach for vimdiff. Maybe it's a career thing, but I've been shifted to enough different environments that I couldn't consistently learn and use the same GUI diff tool (commandline servers, Windows, macOS, Linuxes where I can only install new things to my homedir). It's also very nice to have your editor right there.

I work in VFX. Obviously all of the tools effectively require a GUI, but when dealing with large projects requiring a lot of files and servers I can't imagine only having a GUI.

Here are a bunch of use-cases that come to mind: \- We deal with a lot of image sequences; numbered files for each frame of video. Each piece of software has their own interface for "squishing" them down so you're looking at a list of file sequences instead of 1000s of individual files. Renumbering, renaming, or even sorting through them sucks in Windows Explorer, Finder, etc. A few simple commandline tools, many of which ship with any Linux terminal, make that easier. Although, I have found it much easier to use the GUI to pick out outliers (random frames that are 0-size, a grouping with a similar timestamp, random frames that are solid black). It's faster than building up a `ls -l | sort | grep | head` \- Remoting into servers. Just logging into 10 servers to see if a local file was installed or what Nvidia driver they're running. Remote desktop would be miserable or you'd need special tools. ssh in a for loop does this trivially--if you have more than a handful use GNU parallel or a flavor of ssh that does it concurrently. \- Most project files are ascii and there are a lot of situations where tweaking one or more of them saves a lot of time. For 1 file you can use a gui, if it's like 3 files you can use a macro in your IDE, 10-100 files you /can/ probably use an IDE but setting up a project and confirming it worked has more overhead than commandline tools. \- I still don't like any GUI file search tools in practice. I think it's because of the guardrails and optimizations? `find`, `grep`, and `locate` work way more predictably on system files, network paths, and USB drives, where GUI tools seem to have way more limitations.

But I'm the fist to admit I don't think it's the best way to work for everybody.

</comment></comment></comment><comment><USER11> Why do we assume that there has to be this separation? Yes, we're used to it on Unix because Unix perpetuated the mistakes from OS/360 and had a special job control language as the user interface shell and made no attempt to really integrate a graphical environment when it came along.

But imagine someone whose programming career was spent on Smalltalk, who would feel quite confused by this. Or even someone who is truly proficient with NeXT or MacOS and able to use the object APIs that applications expose to script their environments efficiently. This would seem rather nonsensical to such a person.

<comment><USER4> > _Why do we assume that there has to be this separation?_

Because the GUIs of Smalltalk/Lisp era have mostly gone the way of the dodo. Unless you're writing software in Smalltalk or Common Lisp, you're unlikely to see truly powerful GUI principles any time soon.

<comment><USER12> What would those principles be, that don't exist in current UIs?

<comment><USER13> One principle is that text/command interface and graphical user interface aren't separated.

As in: what if.. you could use a GUI _and_ type commands?

Some software, like CAD programs (AutoCAD, 3DS MAX) and games (HalfLife, Quake, etc) have been doing it forever, but all these solutions are ad-hoc.

We could have had this as a default.

<comment><USER4> Close, but this is still but a shadow.

The kind of UIs I think about have text commands and GUI commands being essentially the same; your clicking issues commands, but you can also start typing and then use mouse to select GUI elements as arguments - because things drawn on screen are first-class objects, not just their rendering.

Think e.g. of typing "ls" (or pressing a button) to be shown directory listing, on which now you can click, drag&drop, etc. You start typing "rm", and now all entries can be clicked to add as arguments. Or, you start typing "find -mtime" and now you can click on any of the visible timestamps, etc.

</comment></comment></comment></comment></comment><comment><USER14> > Wouldn't it be great if there was something like Pidgin, but entirely > command-line based? [...] It turns out there is. It's called Finch, and it's > made by the Pidgin folks.

Finch is not "command-line based"!

Finch is terminal-based, but it takes over your terminal and you interact with it like a mini windowed environment. These are not the same thing.

Software is "command-line based" if it's driven from a command line (gdb, ed, mail) or driven from the shell (nmh, git's cli).

Years back I actually threw together a libpurple client that decomposed the various actions into utilities that could be run from the shell, to experiment with some UI thoughts. Code is on github ([https://github.com/dlthomas/genies/tree/master/msgg](https://github.com/dlthomas/genies/tree/master/msgg)) but I don't remember what state it's in. Happy to dig in enough to answer any questions posed.

</comment><comment><USER15> Elinks was still quite active[1] until 2 years ago any contributions were stopped.

For spreadsheets there is sc-im. For presentations in terminal there are termimad (in Rust)[3], mdp[4], and patat[5]. For files management vifm[6] is the best one, if you got used to Vim already.

And one more important thing - don't forget to setup true colors[7] in your terminal.

[1] [https://repo.or.cz/elinks.git/shortlog](https://repo.or.cz/elinks.git/shortlog)

[2] [https://github.com/andmarti1424/sc- im](https://github.com/andmarti1424/sc-im)

[3] [https://github.com/Canop/termimad](https://github.com/Canop/termimad)

[4] [https://github.com/visit1985/mdp](https://github.com/visit1985/mdp)

[5] [https://github.com/jaspervdj/patat](https://github.com/jaspervdj/patat)

[6] [https://github.com/vifm/vifm](https://github.com/vifm/vifm)

[7] [https://github.com/termstandard/colors/](https://github.com/termstandard/colors/)

<comment><USER16> And Emacs (can work in console mode) offer alternatives for nearly everything you mentioned :)

Spreadheets[0], presentation[1], files management[2], true colors.

[0] [https://www.gnu.org/software/emacs/manual/html_mono/ses.html](https://www.gnu.org/software/emacs/manual/html_mono/ses.html)

[1] [https://orgmode.org/worg/org-tutorials/non-beamer- presentati...](https://orgmode.org/worg/org-tutorials/non-beamer- presentations.html)

[2] [https://www.gnu.org/software/emacs/manual/html_node/emacs/Di...](https://www.gnu.org/software/emacs/manual/html_node/emacs/Dired.html)

<comment><USER17> wow ses really blew my mind. I didnt know that emacs has a spreadsheet buitin. where do you find all those hidden goodies? is there a lost manual of emacs where they are listed?

<comment><USER4> See also Org Mode, which has basic[0] spreadsheet capabilities[1].

> _is there a lost manual of emacs where they are listed?_

That first link GP posted is literally a link to _the_ Emacs manual[2]. Emacs and its info pages are something I also ignored for years, but one day I finally realized that I'm doing a disservice to myself by not reading manuals. Nowadays, I try to always read whatever official documentation there is for anything I work with more frequently; in some cases cover to cover. It's worth it.

\--

[0] - by basic I mean basic, until you learn enough Emacs to supercharge them; then there aren't so basic anymore.

[1] - [https://orgmode.org/worg/org-tutorials/org-spreadsheet- intro...](https://orgmode.org/worg/org-tutorials/org-spreadsheet-intro.html)

[2] - [https://www.gnu.org/software/emacs/manual/;](https://www.gnu.org/software/emacs/manual/;) it also ships with Emacs, so you can read it off-line; just use M-x info.

</comment></comment></comment></comment><comment><USER18> I've been a minimalist since my college days. Spent most of my time in college in the terminal and my first several jobs were mostly terminal (DNS, bash/perl scripting, firewalls/proxies). I lived on Sun Solaris using Netscape Navigator as my only real GUI product. I then moved to Linux running FVWM and Firefox.

Fortunately I can use Linux at my job and do so, using Remmina RDP to get into the Windows Servers when I do have to touch them. Still favor vim for config files and nano for personal notes. My wife walks by my laptop at home and wonders, "What's all that grey text in the black windows?" "That's work getting done, girl!" She rolls her eyes and walks away...

</comment><comment><USER19> All CLI browsers I know are out of date, just don't work well, they contain unfixed vulnerabilities, or they're called Browsh.

Terminal: Alacritty

Browser: Browsh

Email: Mutt, Aerc

Remote SSH: Mosh

Discord: 6cord

IM: Bitlbee

IRC: Irssi, Weechat

Package manager:

Reverse engineering: Radare2

Network client: Netcat

Vim and Tmux with plugins are insanely powerful and customizable. I guess what I miss is a video player which just works in the terminal (without using ascii/ansi).

PS: I like Bash, never used Zsh, but I prefer Fish.

<comment><USER20> mplayer works in the framebuffer

<comment><USER21> Also mpv, which has (generally) greater capabilities, and is what mplayer is increasingly mapped to on systems.

</comment></comment></comment><comment><USER22> When I was in college several years back, the NVidia card on my only computer, a Dell laptop, failed. X stopped working but framebuffer driver still works. I was not tech competent back then and didn't know exactly what went wrong. I spent more than 1 month with only CLI.

Perspective from a CJK user:

\- To show and type Chinese, you need tools like zhcon/fbterm. \- You'll need to deal with encoding issues when ssh to remote server, or telnet to a terminal based BBS. luit is a good tool for that. GNU screen also have this built-in and in some cases better than luit.

</comment><comment><USER23> tmux is a godsend, but there are a lot of things broken by default.

I've been collecting a minimal set of nicities for a while now, if anyone is interested:

[https://github.com/ohazi/dotfiles](https://github.com/ohazi/dotfiles)

Giving the man page a cursory skim is recommended.

<comment><USER24> I see you're using the default prefix (C-b), with C-a being the 'recommended' alternative. I don't understand why it's so popular, as it breaks emacs-style navigation in readline applications, which is great for fixing typos/changing something in one of the previous commands.

I remapped my prefix to C-q. It's a relatively useless key (who needs flow control these days?) and it's close to the number row — you can press it and then quickly get to a number key.

<comment><USER4> C-a also breaks Emacs-style navigation in readline applications (jump to beginning of line, a pretty useful function). And of course it breaks navigation in Emacs too (which I frequently use over SSH). C-q is also useful in Emacs, so my tmux is remapped to use C-^ as the prefix key. Nothing useful sits there for other programs, and I personally don't need the tmux prefix often (I do 90% of things straight from Emacs, and it has its own windowing capability).

</comment></comment></comment><comment><USER21> A few other mentions:

* ranger is vim-inspired file manager with built-in viewers and extensive capabilities. In addition to POB (plain old bash) and mc, it's a go-to for me. [https://github.com/ranger/ranger](https://github.com/ranger/ranger)

* TWIN is the Text WINdowing environment. Yes, it's a full-on windowmanager for console. Somewhat rusty, but if nothing else, a novelty. [https://sourceforge.net/projects/twin/](https://sourceforge.net/projects/twin/)

* mutt: email, 'nuf said

* irssi: IRC

* surfraw; "elvi" providing CLI access to online tools and an Ecuadorian connection. [https://wiki.archlinux.org/index.php/Surfraw](https://wiki.archlinux.org/index.php/Surfraw)

* wikipedia2text: Wikipedia on the command line. [https://packages.debian.org/stretch/wikipedia2text](https://packages.debian.org/stretch/wikipedia2text)

* tootstream: CLI Mastodon client. [https://github.com/magicalraccoon/tootstream](https://github.com/magicalraccoon/tootstream)

* mpv and mps-youtube: play media (audio and video) in console. mpv supports many sites and formats, while mps-youtube specialises in everyone's favourite video monopoly. Both offer numerous compelling advantages over Web UIs, starting with no comments or recommendations. mpsyt's search and locally-managed playlist features are a real treat. [https://mpv.io](https://mpv.io) [https://github.com/mps-youtube/mps-youtube](https://github.com/mps-youtube/mps-youtube)

* xine and mpv framebuffer and ascii-art (aalib) modes. Play full-screen video in console, either as framebuffer graphics, or rendered as text characters (not great, though novel). Bonus: try the 'bb' aalib demo.

* bc, dc, units, and ipcalc; all forms of calculators, from general to RPN to units-aware to IP functions.

* BSD Games. Because.

</comment><comment><USER25> Might I suggest some alternatives:

* Window manager: i3 or i3-gaps

* File manager: ranger or nnn

* Documents/Presentation: vim + markdown + pandoc. You can use pandoc to create both documents and slide presentations!

* PDF viewer: zathura

<comment><USER26> Here's the setup I like to use. A little complicated for some but I really like it:

* Window manager: emacs

* File manager: emacs

* Documents/Presentation: emacs + latex mode

* PDF viewer: emacs

<comment><USER25> I tried emacs for about a week, but ended up just going back to vim because I'm comfortable with it.

However - over the years, I've realized that its not vim that I want, its really vim keybindings that I want. I have them built into pretty much everything (file manager, browsers, PDF navigation, etc). I like the workflow.

Can you recommend any good 'vim to emacs' conversion guides that keep the same vim keybinding workflow?

<comment><USER27> Give Doom Emacs [0] a try. Lighter than Spacemacs.

[0]: [https://github.com/hlissner/doom- emacs](https://github.com/hlissner/doom-emacs)

</comment></comment></comment></comment><comment><USER28> My first Linux computer was a 386 "laptop" with 4 megs of memory. It did not run X.

Now get off my lawn!

</comment><comment><USER29> > _About three years back_ , I attempted to live entirely on the command line > for 30 days

> I lasted all of ten days

> What follows are the applications I found myself relying upon the most > _during those fateful ten days_

Why is this a new article now? What has changed since the original article series? [https://www.networkworld.com/article/3085139/30-days-in-a- te...](https://www.networkworld.com/article/3085139/30-days-in-a-terminal- day-1-the-essentials.html)

Considering that his experiment failed, I'm not sure how he can still claim "Quite honestly, it is entirely possible to live completely without a GUI (more or less)—even today, in 2019". Maybe it is true, but he hasn't demonstrated it.

I would have found it more interesting if he had focused more on how you could efficiently use cli etc, instead of finding most gui-like ncurses clones of popular applications.

</comment><comment><USER30> I think terminal usage should be maximized, but certain tasks are done more efficiently with a GUI

<comment><USER14> > I think terminal usage should be maximized

I don't have a problem if people want to use terminals in smaller windows.

</comment></comment><comment><USER31> That screenshot of Wikipedia as rendered by w3m makes that browser look like it has some serious problems with Unicode text -- note how all the accented characters in the name "Slobodan Milošević" are rendered as question marks.

I assume there are ways to fix this?

<comment><USER32> I just visited the Wikipedia page of "Slobodan Milošević" on w3m and it rendered fine. I imagine the terminal problem is that either the font that was used didn't support those characters, that the system locale encoding wasn't setup to support those characters, or that the terminal emulator didn't have support for the encoding used.

</comment></comment><comment><USER33> In the 1990's, I did some contract work while "in between computers". I had an amber-screened WYSE WY-50 terminal (library discard freebie), a US Robotics 14.4 kbps modem, and a phone line. That was the extent of my data-processing equipment.

</comment><comment><USER34> WordGrinder and Finch are user interfaces though? How is that "Without a GUI"?

<comment><USER35> Keyword being graphical.

<comment><USER34> The user interfaces have graphical components and menus if you bothered opening the link.

<comment><USER25> There may be a general misconception of GUI[1] vs TUI[2] nowadays.

The requirement for a Graphical UI (GUI) is that the user interacts with it via graphical icons and visual indicators. These can exist within a terminal. So, personally I would say WordGrinder and Finch are GUIs in this literal sense. However, your typical lay user may not interpret it this way.

TUI is a sort of abstract term. Sometimes people mean Text UI and sometimes people mean Terminal UI. I don't think these are mutual exclusive. I would understand a text-only UI to be without any visual indicators, whereas terminal UI could be either text or visual. I guess its also worth noting that the phrase 'TUI' was coined after 'GUI'. Perhaps TUI was coined to differentiate the traditional GUI application (a window drawn on a screen with sliders/buttons) from the traditional terminal application (text-only commands). But nowadays, we have libraries like ncurses, that allow us to draw things within a terminal.

1: [https://en.wikipedia.org/wiki/Graphical_user_interface](https://en.wikipedia.org/wiki/Graphical_user_interface)

2: [https://en.wikipedia.org/wiki/Text- based_user_interface](https://en.wikipedia.org/wiki/Text-based_user_interface)

<comment><USER4> There are also at least two "types" of TUI; one is exemplified by ncurses- based apps - they're essentially GUIs that render to ASCII instead of bitmaps. Another is exemplified by everything that runs on Emacs as a platform - there, all[0] text in TUI is bona-fide data; you can search for it, jump to it, copy it, read it from other programs running on Emacs, etc. The latter style enables levels of interoperability unseen in GUIs and regular TUIs of today.

\--

[0] - Almost; some modes use "graphical" indicators like horizontal lines which are really just decorations. You can mess with them if you try hard enough, but by default they'll be ignored by usual operations like navigation, search or copy/paste.

<comment><USER36> What exactly is stopping Emacs from improving its rendering and bringing it on par with "GUI"-like ncurses apps? They already support multiple on-screen windows, a global menubar and all sorts of "widgets" for interactive use.

<comment><USER4> What do you mean? Emacs way is strictly superior to ncurses here.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> Another piece of software worth mentioning in this space is pianobar, which is a terminal based client for Pandora.

<comment><USER37> Similarly, tizonia[1] which is amazing for Spotify and Google Music and much more.

[1][http://tizonia.org/](http://tizonia.org/)

<comment><USER14> Neat! Do you know offhand whether tizonia can read from a fifo? (or otherwise easily have commands thrown at it from the shell / my wm)

</comment></comment></comment><comment><USER14> My favorite mail experience, by some margin, was using nmh ([https://www.nongnu.org/nmh/](https://www.nongnu.org/nmh/)). I recall it taking some doing to set up and then some aliases and such to make it usable - but then it was very usable.

<comment><USER21> Larry Peek's book and tutorials on mh and nmh, as well as his shell wizardry generally, are very highly recommended.

<comment><USER14> I'm not familiar - I'll definitely check it out :)

<comment><USER21> Correction: Jerry, not Larry.

 _mh and xmh_

[http://shop.oreilly.com/product/9781565920934.do](http://shop.oreilly.com/product/9781565920934.do)

He's a co-author of the classic _UNIX Power Tools_

[http://shop.oreilly.com/product/9780596003302.do](http://shop.oreilly.com/product/9780596003302.do)

Add'l ORA pubs:

[https://www.oreilly.com/pub/au/28#Books](https://www.oreilly.com/pub/au/28#Books)

"Power Tools" columns for _Linux Magazine_ :

[http://www.jpeek.com/articles/linuxmag/](http://www.jpeek.com/articles/linuxmag/)

Though I've not read it specifically, _From Bash to Z Shell_ seems likely to focus on shell art and arcana most closely.

[https://www.apress.com/us/book/9781590593769](https://www.apress.com/us/book/9781590593769)

His 1999 SVLUG talk was a classic, the slides don't give it justice, though there are some nuggets there for many users.

[http://www.jpeek.com/talks/svlug_19991103/](http://www.jpeek.com/talks/svlug_19991103/)

</comment></comment></comment></comment><comment><USER38> I did that for about 7 years [1] and don't want to do it again.

[1]: including a few years on an actual terminal, not a computer running an application emulating a terminal, (connected to a modem, which in turn connected to a Unix computer on which I had an account, which in turn was connected to the internet).

</comment><comment><USER39> > w3m supports inline images (...)—seriously, a web browser with image > support, inside the terminal. The future is now.

Why not go a little further and support variable width/pitch fonts?

</comment><comment><USER40> Easy to VPN from another location. Just ssh to your remote Virtual Machine in another country.

</comment><comment><USER41> Can you? Yes

Do you need to? Most likely no</comment>


Gitlab – Important Updates to Our Terms of Service and Telemetry Services - <AUTHOR> https://gitlab.com/gitlab-org/gitaly/issues/2113 <comment><USER2> Comments moved to [https://news.ycombinator.com/item?id=21337594](https://news.ycombinator.com/item?id=21337594).</comment>


This a valid email address: t AT lk. - <AUTHOR> https://gist.github.com/1445736

<comment><USER2> a@b is also a valid email address.

It is also a valid SMTP address, assuming you have defined "b" as a FQDN in your DNS.

What we have here is a list of TLDs which have MX records, but an MX record is not even required to send mail to a FQDN. An A record will suffice, for any RFC compliant SMTP server.

</comment><comment><USER3> A TLD does not need an MX record to receive mail. If the MX record does not exist, it will use the A record instead.

<comment><USER4> Do you know of a TLD with an A-record ?

<comment><USER3> Yes, the very first one on this list, .ac

[http://en.wikipedia.org/wiki/List_of_Internet_top- level_doma...](http://en.wikipedia.org/wiki/List_of_Internet_top- level_domains#Country_code_top-level_domains)

      # dig ac.

      ; <<>> DiG 9.3.6-P1-RedHat-9.3.6-16.P1.el5_7.1 <<>> ac.
      ;; global options:  printcmd
      ;; Got answer:
      ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37041
      ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

      ;; QUESTION SECTION:
      ;ac.                            IN      A

      ;; ANSWER SECTION:
      ac.                     86400   IN      A       220.127.116.11

      ;; Query time: 173 msec
      ;; SERVER: 10.0.80.11#53(10.0.80.11)
      ;; WHEN: Thu Dec  8 11:37:09 2011
      ;; MSG SIZE  rcvd: 36

I'm not going to go down the list and try the rest.

</comment></comment></comment><comment><USER5> I used to have r@ai. (Anguilla; my neighbor, Vince Cate, was the registrar, and we had a 10base2 coax feed to the national root server (and his ISP).)

Ian Goldberg had n@ai, which was even better.

</comment><comment><USER6> Last week I got into a discussion with a client over email validation rules; they wanted "contains an '@' and a '.'". Even after explaining that the '.' was optional they insisted n these rules.

Which made be wonder just how many problems will be seen once companies can use vanity top level domains; if I buy the "doug" TLD how long before I give up on lost email and switch from me@doug back to email@example.com?

</comment><comment><USER7> Interesting that Guatemala is using GMail. And Trinidad is using RoadRunner? hahaha

</comment><comment><USER8> Not that I pay that much attention to TLDs but I never knew the Vatican City got its own.

<comment><USER9> They're a sovereign state. They even have their own passports.

<http://en.wikipedia.org/wiki/Vatican_City>

<comment><USER10> And the smallest at 44 hectares (110 acres)!

<comment><USER11> And it has one of the lowest age of consent in Europe: 14 years!

<comment><USER4> They are also one of two states with a 100% IPv6 provider deployment.

</comment></comment></comment></comment></comment><comment><USER12> This works for Martinique. Cool. I'll try and ask the same @mq :-)

</comment><comment><USER13> Not on my servers. This regexp is time-honored and catches more silly mistakes than it rejects valid ones.

      function isValidEmail(email) {
        return (/^[-a-z0-9\~\!\$\%\^\&\*_\=\+\}\{\'\?]+(\.[-a-z0-9\~\!\$\%\^\&\*_\=\+\}\{\'\?]+)*@([a-z0-9_][-a-z0-9_]*(\.[-a-z0-9_]+)*\.(aero|arpa|biz|com|coop|edu|gov|info|int|mil|museum|name|net|org|pro|travel|mobi|xxx|[a-z][a-z])|([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}))$/i.test(email));
      }

<comment><USER3> >Not on my servers.

Sorry but "your servers" do not set the specifications for what is and what is not a valid email address. It always amazes me why people waste time with regular expressions to try and determine if an email address is valid or not before sending an email.

The best and by far easiest way to determine if an email address is valid is to just send an email to it. Your regular expression matches invalid email addresses (like anything@____.com) and misses things like "This is valid"@example.com.

<comment><USER14> Sure you can validate emails by regex! :D <http://ex-parrot.com/~pdw/Mail- RFC822-Address.html>

<comment><USER15> Except RFC822 has been updated by RFC2822, which itself has been updated by RFC5322…</comment></comment></comment></comment>


Coronavirus Innovation - <AUTHOR> https://hiex.startupblink.com/ <comment><AUTHOR> This week we have released the COVID-19 innovation report with! Take a look at our latest blog post [http://ow.ly/2K2O50AnTCn](http://ow.ly/2K2O50AnTCn) about the collaboration and download the report here - [https://hiex.startupblink.com/](https://hiex.startupblink.com/)</comment>


Companies that support remote workers win against those that don't - <AUTHOR> http://blog.davidtate.org/2013/01/companies-that-support-remote-workers-win-against-those-that-dont/

<comment><USER2> The use of the word "support" in the title is critical.

I've witnessed second hand the anti-pattern where a company has lots of remote workers, and fails to support them. You quickly get a 2-tier system where only the workers who are in the office actually know what is going on. This can seem to work for a while, but there is no shortage of problems.

One of my current contracts is different. One of the founders has been remote since the beginning, so they pay close attention to this type of issue. They have a number of remote workers (including me, very much part time) and it seems to be working out quite well for them - because they have the necessary support infrastructure in place.

<comment><USER3> What kind of support infrastructure are you talking about? I work remotely a couple days a week and we have several full-time remote workers on my team. We setup a Webex meetings for every meeting and we all have webcams. Besides that, we will informally use Google Hangouts to chat with each other.

I'm just curious what we could do beyond that to support the remote people.

<comment><USER2> Have a ticketing system. Use it religiously. Have online chat options (gmail is good). Use it religiously. Include remotes in conference calls. Do it religiously. Have key discussions in email, or at least summarized there, instead of just in person. Do it religiously.

In short, make sure that everything is accessible for people who weren't there. And keep the habit going always.

<comment><USER4> Gmail is good but it is not sufficient

Learn with the open source people, they've been doing this for "centuries" (ok, for decades)

Use irc

The biggest advantage that no other (common) system has mimicked is simple: chat rooms.

But it's not chat rooms, it's because they are:

Easy to identify

Free to create

Easy to participate in several rooms

Irc can be used by bots easily (this is _very useful_ )

<comment><USER2> Jabber can serve the same purpose as irc. But my experience is that irc tends to not like people sitting behind certain kinds of firewalls, and I personally avoid it.

Anyways the point is moot - I don't use either. Gmail is good enough for my purposes.

</comment></comment></comment></comment></comment><comment><USER5> I would have thought "Have access to the entire world of smart talented people" would have cropped up but it didn't. I see why, that's not quite the direction the article was going in, but it's another benefit. In my company we had a pretty talented front ender who had to go back to germany but since we support remote workers we've been able to keep him which is cool.

<comment><USER6> I've noticed an interesting paradox at companies where I've worked. They are very flexible about remote workers when they are far away (e.g. office is in Los Angeles, and one programmer is in Oregon and one customer service rep is in Colorado), but they are more resistant when someone local wants to work remotely (e.g. to avoid a 1.5 hour commute each way in Los Angeles traffic).

<comment><USER7> I've had a similar experience. Most of remote my work has been between 4-10 hours drive away (I'm in the UK, so thats pretty far) and anyone within an hour wants me to commute.

I generally don't take them up on the offer as driving for 2 hours (and much longer on bad traffic days) on a regular basis feels like a waste of time when I don't need to do it.

It's funny because I'd much rather work for the companies in drivable distances if given the straight choice. I love to be able to get on site for meetings of if I need something physical done with hardware but alas its not to be. :)

</comment></comment></comment><comment><USER8> It almost sounds like sexual selection in the way that the natural logic is turned on its head. A male bird with such a cumbersome and visible plumage could only survive if its genes were awesome in all other respects, so it gets more favor from the female birds.

A company that had many remote workers would crash and burn if it didn't have many other qualities (good management, processes and developers) to support the remote workers.

</comment><comment><USER9> Today I am reminded of reason number #37 to telecommute: influenza.

<comment><USER10> That reminds me of my favorite book, "How to lose friends and influenza people"

<comment><USER11> I rarely upvote jokes on HN, but sometimes laughter is just infectious.

</comment></comment></comment><comment><USER12> The reinforcing lesson I take away from the post is that you should know your company's weaknesses. Don't support remote workers if you don't have the culture or structure to support remote workers. Otherwise, you'll end up as a company that _allows_ remote workers but doesn't truly _support_ them, which is worse than not having remote workers at all.

</comment><comment><USER13> Where are you all finding remoting contracts? I'd really love to but I have no idea where to look. The two places people told me about had about 5 jobs between them.

</comment><comment><USER14> > All our knowledge transfer was done in person using heavy sarcasm and > obscure hand waving

Choice quote and very true in my exp.

</comment><comment><USER15> I've been working remotely for 10 years. Good ticketing system (Atlassian - JIRA and Wiki). Centralised source code repository and daily stand-up over Skype, otherwise known as a "Skype-up". Constant chatter on skype group chat. Shared screen sessions using Join.me.

The biggest issue for most employers is trust. "Is my employee just watching the TV?", is the first thought that pops into the employer's mind. As a programmer, the work is largely quantifiable, so the issue of trust is muted. My employer can see exactly what I produce. It is plain to see in every check- in to source control.

I have actually started renting my own office just round the corner from my home, so that I don't have to work from home anymore. I prefer the distinct separation of work and home life. My employer is in a different country if you were starting to wonder why I didn't just go to their office.

</comment><comment><USER7> Replace remote worker with new starts and you could have written a very similar article.

I've been remote working for about 5-6 years and I use that same argument to get jobs. Hiring, supporting and listening to your remote workers is a great way to validate you have sufficient processes in place that all new staff who come in can get up and running with minimal fuss.

I've never looked at figures, but I'm willing to bet this'll reflect on churn rates too.

</comment><comment><USER16> My peers often work from home. Personally, I rarely do it because I like the different environment for productivity. At home there is always distraction.

While it certainly is a good thing to allow and support working remote, I cannot deny heavy disadvantages. We discuss many important thing over lunch and especially long-term goals for our project are discussed over a coffee.

Additionally I find it seriously annoying to communicate over Skype / Phone / Messenger / whatever if a peer needs help with something. I love moving my chair to the next table and think about something together. I do not get that feeling at all when I'm communicating over distance. I am NEVER annoyed by someone asking for help on a tricky problem. Instead, I LOVE thinking about it. However, being ask for help via Skype messaging always annoys me. I dislike typing but most of all I can't stand waiting for a response because the other side is doing something besides our conversation.

I'm fine with my peers working from home, but I am incredibly glad it's usually about 1-2days a week and not all the time.

</comment><comment><USER17> I wonder if 20 years from now, programmers will see working in an office as a luxury, rather than working from home.

<comment><USER18> "Your business success will depend on the extent to which programmers essentially live at your office. For this to be a common choice, your office had better be nicer than the average programmer's home." - Philip Greenspun

<comment><USER13> Well wouldn't having them work _from_ their home accomplish this?

</comment></comment></comment><comment><USER19> I'm curious how workers in different time zones get on with the rest of the team.

I work remotely most of the time but it has always been within the UK, I'd like to broaden my horizons internationally but keeping different hours to the rest of the team has always put me off.

</comment><comment><USER20> Have been working remotely for over 6 years and all of our team are remote. I think there is a massive change coming as businesses start to adapt to the idea of working remotely. It's just the beginning of the trend.

<comment><USER21> I've been working remotely about 2 years and I guess that if company and peoples really want to work remotely they will do it (in my case many team members located in different countries). At now it's very easy, if you have clear mind - we have skype and other tools for day to day meetings, many project tracking/documentations systems like redmine or basecamp that could be started from scratch in few hours, github, bitbucket, dropbox, aws etc. But not all peoples ready to deal with this, mostly because they can live without it and don't have enough motivation to change something in their current corporative systems.

</comment></comment><comment><USER22> Actually, I think the "chromosomal difference" that will pull some companies ahead and leave some in the dust is open allocation. See: [http://www.quora.com/Software-Development- Methodologies/What...](http://www.quora.com/Software-Development- Methodologies/What-is-Open-Allocation) . This is related to telework because project allocation is one of the first things to fail in a badly-designed distributed company (the main hub takes all the interesting work for itself).

Remote work I have mixed views of, because it's obviously a good thing in the abstract, but I also think there are major benefits to having people eat lunch together and discuss ideas through informal channels. Also, having a culture where some people cannot participate in those benefits, but others do, is, I think, problematic. I wouldn't be surprised to hear that completely distributed companies do better than semi-distributed ones. I'm glad to see it becoming more common, though.</comment>


Ask HN: Create http or https server for Node.js on Heroku - <AUTHOR> I can't find out if I'm supposed to create an http or https server for node.js hosted on heroku. Apparently, paid heroku apps now handle ssl and receives over https by default. When the app receives an https request, the heroku load balancers convert the request to http and then send the request to your app. So it seems that heroku handles https/ssl for you, and all we have to do is set up a http app.
If the request is sent from the client as http, the following code should be added to ensure encryption on data sent.
/* Redirect http to https / app.get('', function(req,res,next) {
  if(req.headers['x-forwarded-proto'] != 'https' && process.env.NODE_ENV === 'production')
    res.redirect('https://'+req.hostname+req.url)
  else
    next() /* Continue to other routes if we're not redirecting */ });
Am I incorrect that that we should use an http app over https because heroku handles encryption? <comment><USER2> This seems more appropriate for Stackoverflow

<comment><AUTHOR> Yes, I agree. I posted the question here too because the last time I asked a question, the responses provided excellent answers and related conversations. Should I remove it from HN?</comment></comment>


IPhone 5 vs. Canon 5D Mark III - <AUTHOR> http://dcurt.is/iphone-5-vs-5d-mark-iii <comment><USER2> Stacks up? What I'm seeing from the iPhone image is a lot of noise reduction, despite the shot being taken in daylight.

In anything but daylight, there's no way this would be any comparison.

The color, contrast, sharpness and noise from the iPhone is so far behind the SLR it's not funny.

<comment><USER3> Predictably DSLR's image has much narrower depth of field, essentially producing non-interchangeable photos. For comparison to be interesting he had to set diaphragm to the same value as iPhone.

But iPhone's camera is impressive nonetheless. I haven't seen 5, but even 4S has very impressive (i.e. "smart") metering system, it just guesses correctly on so many occasions, and sometimes I wish that 5D Mark 3 would have something similar.

And this new panorama feature in iOS 6 works on 4S as well, and, while simplistic, is very nice.

<comment><USER4> Setting the aperture on a DSLR to match the aperture of the iPhone won't make the depths of field equal. In fact, the iPhone was at f/2.4, while the DSLR was at f/2.8, which would give the iPhone the shallower depth of field if aperture were the only factor. (The biggest other factor here is sensor size.)

</comment></comment></comment><comment><USER5> Stacks up as in "it's crap compared to"? If you know how a digital sensor works (and photography for that matter), you know damn well that the sensor in an iPhone is small, which has a direct impact on the dynamic range of light coming in.

In its category (phone cameras) the iPhone is decent enough (though not even the best) but comparing it to a high-end full-frame DSLR is really rotten apples to freshly picked Jaffa oranges.

</comment><comment><USER6> Hmm, the iPhone's photo is so far from "stacking up" to the 5D's photo.

I wonder if he meant to say how far the quality has come from the 4s?

On a scale of 1-10, if the 5D is a 10, I would put the iphone 5 at a 6. So maybe the 4s is at a 4 according to DC?

To illustrate this DC should also put an image taken with a 4s. But to put a 6 next to a 10 and say it "stacks up". Thats like saying a honda civic stacks up against a porche 911. It doesn't.

However, you could say today's civic stacks up much better than the 1980 civic to todays porche 911...

</comment><comment><USER7> if that guy can't spot the difference, what is he doing with a $4k camera?</comment>