Javascript Constructors and Prototypes - <AUTHOR> http://tobyho.com/2010/11/22/javascript-constructors-and/

<comment><USER3> This article does two things that are very dangerous, and never mentions the reasons why they're dangerous.

* Messing with Function's prototype is very strongly frowned upon. It's tantamount to setting global variables. At the very least, give that definition an if (!Function.new) guard to prevent redefining another implementation that another script (or the browser!) has already given.

* Adding methods in the constructor is awful even if you're not using inheritance, because it burns memory like crazy. If you define sayHi on Person.prototype, then every Person gets a reference to the _same_ sayHi method. If you define this.sayHi in the constructor, then each Person you create gets _its own copy_ of the function, making every Person heavier in memory. Not a big deal for a simple console.log, but if you have more complicated objects with a few dozen methods that you're using a bunch of you can really make things chug.

<comment><USER4> > If you define this.sayHi in the constructor, then each Person you create > gets its own copy of the function, making every Person heavier in memory.

Does anyone know whether this is true for more sophisticated JS engines like v8? I seem to recall reading something like that, that it detects that it is the same function, but I might be misremembering it.

<comment><USER3> I don't know, but I would suspect it's still the case, because doing anything else would require a lot of analysis of the code's behavior. In order to safely merge all those definitions into one, the engine would have to know:

* That the function in question never accesses anything in its closure that could be different for each construction

* That hasOwnProperty() is never called on the object to check which way the method is declared (alternatively, remember that it had done this optimization, and spoof the return value)

* That the function is never used as a constructor. Otherwise, Person could update sayHi's prototype and wind up changing its effects for all Persons, where it was supposed to create a customized inner class.

And if you think any of these are easy, remember that you can get a pointer to that function via the following:

      var a = 'say', b = 'hi'
      var sayHi = (new Person)[a + b]

</comment></comment></comment><comment><USER5> I wanted to read this because I believe it's a great article, but the fact that he doesn't use semicolons pretty much turned me off.

While I was looking at the JavaScript code my brain almost exploded.

<comment><USER6> Did you see the article he linked about why he doesn't use them?

[http://mislav.uniqpath.com/2010/05/semicolons/](http://mislav.uniqpath.com/2010/05/semicolons/)

Not reading an article because of that would be like not reading other code because it uses 2 spaces for tabs instead of 4. Makes no difference to the language, only to you.

<comment><USER7> The thing is, semicolons _do_ make a difference with JavaScript.

It's now 404ing, but there was a pretty well-known argument on one of Twitter Bootstrap's GitHub issues[1]. The Bootstrap guys didn't use semicolons, and it caused problems when minifying the code. It's an edge case, I know, but it _was_ a problem.

I never understood the whole anti-semicolon thing anyway. It just seems really hipster to me. Use CoffeeScript, if you don't want semicolons.

      [1] https://github.com/twitter/bootstrap/issues/3057

<comment><USER8> Why does it seem hipster to use a language feature? Is it hipster to use null coalesce as well?

The article linked above explains the reasons to omit semi-colons very well. I would personally prefer if JS forced you to terminate all statements with a semi-colon to avoid any ambiguity, but there you go.

Speaking of ambiguity caused by whitespace, Coffeescript is a 1st degree offender for this. All you have to do is indent the wrong block of code, and you completely change the scope of a nested function, and you have no visual indication of your mistake whatsoever.

<comment><USER9> CoffeeScript certainly has its syntax quirks, but after some forced time using it I've found I can't go back to happily writing plain old JavaScript.

The first week or two you'll regularly need to peek at the compiled source to be sure it's doing what you want, but you'll quickly get a feel for it.

Also, a lot of the weird ambiguous cases are disambiguated by including parenthesis, so if you're unsure just include the parens and you should be ok.

<comment><USER10> Oddly,

> Also, a lot of the weird ambiguous cases are disambiguated by including > parenthesis, so if you're unsure just include the parens and you should be > ok.

this is _exactly_ the parallel I was going to make to the discussion we're currently having here. People who want semicolons on every line, even when they don't matter, are the same people who want to parenthesize every infix operation, even when the natural precedence the expression has without parentheses is already correct. I'm not sure I understand it in either case-- are you afraid that someone might edit the code without understanding the "implicit defaults" of the language's syntax? Why are you letting that person near your codebase?

<comment><USER11> Some programmers are good at remembering large numbers of arbitrary rules. Others aren't, and I've worked with good and bad programmers of both kinds.

So yes, I'm worried that a colleague might read the code and not know what the precedence is, and they will have to waste their time looking it up (thankfully some IDEs now have an command to add parentheses quickly, but it's still a distraction from their actual task).

Pretty much all languages have some features that are more confusing than helpful, and good codebases avoid using those features (whether via formal policy or not). IMO most precedence rules fall into that category; it would be better if e.g. "a && b || c" were a syntax error until bracketed properly.

<comment><USER10> Why would they be looking up the precedence?

If the code currently works, then they can _read_ it, and infer that whatever precedence the operators have is the _correct_ one for producing the result the code produces. If "a + b * c" is producing 17 where (a=2,b=3,c=5), then you know that your language makes multiplication precede addition.

If the code doesn't currently work, then they'll have to figure out via some external method (looking up the original formula used in the code, say) what the precedence _needs_ to be, in order to parenthesize to _make_ it work.

On a separate note,

> it would be better if e.g. "a && b || c" were a syntax error until bracketed > properly.

this reminds me of the horribly-confusing practice of using "a && b || c" to mean "a ? b : c" in shell-scripting. It _almost_ works, too... unless (a=true,b=false), in which case you unintentionally get the side-effects of c.

<comment><USER11> >If the code currently works, then they can read it, and infer that whatever precedence the operators have is the correct one for producing the result the code produces. If "a + b * c" is producing 17 where (a=2,b=3,c=5), then you know that your language makes multiplication precede addition.

By that logic why bother using a font in which * and + look like different symbols? Heck, why read the code at all? If the code is working you can infer what it must be doing by observing what comes out when you feed it different inputs.

You read code precisely because you don't know what it does for every input, or don't know how it implements the algorithm; you want to be able to look at a line and see what it does, without having to fire up a repl and run through several examples. I mean, the idea that code should be readable - i.e. that you should be able to tell what a given line of code does without having to run it or look it up - is about as fundamental a good coding principle as it gets.

<comment><USER10> There is a fundamental difference.

When you _read_ "a + b * c"\--and then test your assumption of what it does in a REPL--the result is a _learning moment_ where that knowledge now sticks to you; from then on, you _know_ which of the two operators come first. You only have to do it once.

On the other hand, "using a font in which * and + look like [the same symbol]" means never being able to recognize the pattern, which means never learning anything and having to check every time.

Also,

> the idea that code should be readable - i.e. that you should be able to tell > what a given line of code does without having to run it or look it up - <USER2> > about as fundamental a good coding principle as it gets.

I would agree that that is a good coding principle _for low-level C /C++/Java code_; in these languages, you can't separate the abstract meaning of code from its implementation, so it's better to just keep the two things together.

But on the other hand, the equivalent coding principle for Lisp is "create a set of macros which form a DSL to perfectly articulate your problem domain-- and then specify your solution in that DSL." The equivalent for Haskell is "find a Mathematical domain isomorphic to your problem domain; import a set of new operators which match the known Mathematical syntax of that domain; and then state your problem in terms of that Mathematical domain by using those operators." In either of _these_ cases, nobody can really be expected to just jump in and read the code without looking something, or a lot of somethings, up.

This isn't because the code is "objectively bad", but rather that it has externalized abstractions which in a lower-level language like C would have to be written explicitly into the boilerplate-structure of your code. These are just two different cultures.

<comment><USER11> >When you read "a + b * c"\--and then test your assumption of what it does in a REPL--the result is a learning moment where that knowledge now sticks to you; from then on, you know which of the two operators come first. You only have to do it once.

If you're good at memorizing essentially arbitrary rules then you only have to do it once. For +/* you can argue that the precedence is standard in the domain language (mathematics), but in C-like languages there are often a dozen operators with their order, and there's no natural reason why >> should be higher or lower than /.

>The equivalent for Haskell is "find a Mathematical domain isomorphic to your problem domain; import a set of new operators which match the known Mathematical syntax of that domain; and then state your problem in terms of that Mathematical domain by using those operators." In either of these cases, nobody can really be expected to just jump in and read the code without looking something, or a lot of somethings, up.

Sure - code is written in the language of the domain. If you don't know what an interest rate calculation is then even the best-written implementation won't be readable to you. But that domain terminology should make sense (indeed a large part of understanding a field is understanding its terminology), whereas many language precedence rules don't - they're completely arbitrary, there's no way to derive them from first principles if you forget.

I'd argue that a language where you don't have to memorize a precedence list (such as Lisp - the precedence is always explicit from the syntax, one simply can't write (+ a b * c - so I'm kind of surprised you mention it). I'm surprised if Haskell is different in this regard) is, all other things being equal, better than a language where you do have to memorize a precedence list. But rather than having to write a whole new language, it's more lightweight to form a "dialect" by declaring "we will write C (or whatever), but only use constructs that do not require memorizing the precedence table".

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> I used the prototype mechanism several times when debugging a script that I couldn't easily change source code for. I just typed:

SomeClass.prototype.someMethod

Which outputs the methods source. Then you can add some debug code like console.log(xxx) or even fix a simple bug, copy the whole thing and set it again:

SomeClass.prototype.someMethod = function ...

Voila! Hot code push without an IDE. While that's obviously not ideal, it certainly works in some cases.

<comment><USER3> My favorite trick along those lines:

      var cache = SomeClass.prototype.someMethod;
      SomeClass.prototype.someMethod = function () {
        debugger; // or `throw "stacktrace"`
        cache.apply(this, arguments)
      }

Inserts a stack trace right in the middle of executing someone else's code, which is nice for tracking down why/when that function gets called if documentation is poor, without changing functionality.

</comment></comment><comment><USER13> I'm bracing for the downvote, but I'm going to say this anyway: are we all taking crazy pills?

I understand that we're more or less stuck with JavaScript, but this is nuts. JS has got to be one of the least intuitive, cobbled together languages I've ever had to work with. In what other language are people still having holy wars over how to separate statements?

Why the heck would a constructor be a regular function if calling it without new pollutes the global namespace? JS gives us prototypes so that we can have inheritance! Great, but that doesn't actually give us a simple ability to call super. Using functions as everything is fine and good, until you have to shoehorn all the functionality you actually need into mysterious constructs like prototype, new, and apply. When the symmetries are so half-assed, at some point, it seems to me to make way more since to stop overloading the same language construct and make separate constructs for separate uses.

And don't even get me started on implicit variable declaration, function hoisting, the double-equals, for...in, the necessity of self-calling functions, etc.

Thank God we have libraries and alternative syntaxes now that more or less smooth over these issues and coerce the programmer into writing reasonable JS code, because green field JS is a complete quagmire. Are we seriously incapable of doing better?

<comment><USER14> > In what other language are people still having holy wars over how to > separate statements?

Probably most of the languages in popular use. It's just that the fight is usually directed towards another language.

JS happens to be one of the minority where the standard allows some flexibility and debate about usage.

> mysterious constructs like prototype, new, and apply

They're well-defined, so they're not particularly mysterious if you take the time.

> Are we seriously incapable of doing better?

Really depends on how much effort you're willing to invest in learning JavaScript, instead of trying to write the code you're used to from $OTHER_OO_LANGUAGE. Everyone unwilling to do that is probably never going to be capable of doing better.

This isn't to say there's anything wrong with finding another familiar set of abstractions friendly or personally productive, but personally, I find greenfield JS is pretty fun, flexible, and capable.

Then again, I think the same thing about Perl (which everyone _knows_ is one of the worst languages ever), so YMMV.

<comment><USER13> Maybe mysterious wasn't the best choice of word, but my point is that it's quite possible for something to be well-defined and yet poorly usable.

I long since gave up on trying to write the code I'm used to in other OO languages in JS. When I'm in JS Land, I put a lot of effort into using best practices. I just find it frustrating that so many of those best practices do not at all seem to adhere to any sort of principle of least surprise. And I wouldn't say that my problem is being too tightly bound to a particular OO paradigm; I've had great fun programming in functional styles and Prolog.

</comment></comment></comment><comment><USER14> "Someone pointed out though, that you can prevent this polluting of the namespace (those are just big words for creating global variables) by using this trick:

         function Person(name){
            if (!(this instanceof Person))
                return new Person(name)
            this.name = name
         }"

This is useful for situations where you might want to be able to create anonymous objects and call a series of methods on them, which can be a nice API as any user of jQuery knows.

It's also an arguably cleaner way of achieving the constructor+apply thing he does later -- no global modification of the Function prototype.

A lot of the time, though, I'll just consider this my default "class" definition:

        function Person (args) { this.init(args); }

If you want to be warned (or want others to be warned) when Person is called w/o new, this will do it (unless someone has defined init on the global namespace, so avoid that).

This also makes it easier to hand around the method that does the actual construction, which is helpful for cases like constructor + apply:

        var p = new Person;
        p.init.apply(p,args);

(again, without global modification of the Function prototype) or for cases where you want to refer to "superclass" methods down an inheritance hierarchy.

</comment><comment><USER15> >>Cat.prototype = new Mammal()

This is only useful if Mamaml has only methods and no properties which does not happen that often.

>> Cat.prototype.constructor = Cat

I never saw a practical usage of this one :-)

I think these days the standard way of doing inheritance should be -> MyClass.prototype = Object.create(baseClass.prototype)

</comment><comment><USER16> I wrote a similar (2 series) article a while back that attempts to explain the same thing, but with a few diagrams. I know sketching out what was going on really helped me ...

[http://www.looselytyped.com/blog/2012/08/18/on-prototypal- in...](http://www.looselytyped.com/blog/2012/08/18/on-prototypal-inheritance/)

[http://www.looselytyped.com/blog/2012/08/22/on-prototypal- in...](http://www.looselytyped.com/blog/2012/08/22/on-prototypal-inheritance- part-ii/)

</comment><comment><USER17> oh God!! why do some people have problem with adding semicolon?

</comment><comment><USER18> I wrote an interactive guide to javascript that covers a lot of the same material.

[http://caplin.github.io/new2JS/](http://caplin.github.io/new2JS/)

<comment><USER19> Looks nice and it helpful, thanks. Maybe you could change the output so the latest output is on top instead on the bottom (more blog style). Also it would be nice to reset the output altogether

</comment></comment><comment><USER20> If the arguments you wanted to pass to a constructor were variable in length, why not just send them in an array normally instead of having to jury-rig this? Are there benefits I'm missing?

</comment><comment><USER21> The article could have addressed overriding methods and calling the super method. Because that isn't simple.

</comment><comment><USER22> It's breathe not breath...</comment>


American Conservative: Don't Whitewash the Hiroshima Bombing - <AUTHOR> http://www.theamericanconservative.com/articles/dont-whitewash-the-hiroshima-bombing/ <comment><USER2> I don't have any comment on Mosul or what we are doing in the Middle East because it simply doesn't connect.

But there is no chance in hell that the two bombings killed more Japanese civilians than the invasion of Japan would have. And an invasion was very likely. Most likely Hiroshima and Nagasaki saved a million Japanese lives.

<comment><AUTHOR> The idea that the USA bombed Japan to spare Japanese civilians from a worse fate is just absurd.

The underlying logic is extremely controversial, and relies a lot in "othering" the Japanese, and talking about them in terms like "they would fight to the last man, woman, and child" like they were wild dogs or something.

A much stronger theory is that Japanese were sacrificed in order to flex muscle against the Soviet Union.

<comment><USER3> Another way to think about it is this. How many American soldiers would be killed in the invasion? The American soldiers who would invade are every bit as innocent as the women and children killed in the A-bomb attacks. Estimates are that Around 500,000 American soldiers would be killed or seriously wounded in an invasion. Every American soldier was an innocent man, defending his country from the Japanese who brutally attacked st Pearl Harbor. Do the lives of these innocent men not matter to you? This perfectly demonstrates what's so screwed up about liberals in America. They would literally rather send many more of their own countrymen to get their arms and legs blown off and killed, rather than kill the enemy. It's sickening, awful and evil how they would gladly sacrifice more of their own innocent fellow Americans to save the wives and children of attackers. Send 500k Americans to get murdered by the japanese, plus their dead, or kill 250k with the a bomb.

The choice is clear once you have the facts. Of course maybe you don't think it matters if American soldiers die. Maybe you think it's better that they die than the enemy. Try telling that to the wife of a soldier lost in battle. Try explaining that to a kid who wonders where his dad is. "The Japanese who attacked us at Pearl Harbor and want to kill us are more important to keep alive than your daddy".

You see think pictures of the a bomb with horror. And rightly so. But you forget the horrors of Okinawa. The terror of Kamikaze pilots literally suicide bombing the Americans.

The a bomb was not only better from a military and casualty standpoint, it was better for Japan in the long run. It completely broke the back of their military empire in a way that not even an invasion could. It was complete and utter defeat that crushed their delusions that they would gain greatness through military strength. That enabled them to move on and rebuild focusing on the right thing, economic power

<comment><AUTHOR> I definitely don't think terrorism is more justified if it saves your own peers' lives.

The narrative that it saved Japanese lives is based on wrong premises (they'd never surrender, etc.), but tries to build a persuasive argument that it was for their own good.

I can't understand why you think "the american military saved their own lives by killing foreign civlians" is at all a more persuasive justification.

<comment><USER3> Ok so you literally think that it's better to have 500k Americans killed than 250k Japanese, when the Japanese attacked us. And you consider defending yourself terrori sm???

How are the Japanese civilians any more innocent than the Americans? Can you answer this?? No you can't. You are just confused and have no comprehension of how evil Pearl Harbor and the Japanese rulers were. You have obviously never heard of the Bataan death march.

I literally think you are a horrible human being. You would rather sacrifice _more_ of your own countrymen to save the wives and children of the attakcers. You are a straight up evil human being. There are no other words to describe it.

Thank you for proving to me beyond a doubt that liberals hate this country and would gladly see it burn.

<comment><AUTHOR> It's gonna be great busting out this comment next time dang or another mod is crying that I'm being too mean and hostile to some duped liberal or conservative.

</comment></comment></comment></comment></comment></comment><comment><USER4> Hmm... from a cursory glance American conservative seems like a good website, any readers care to comment on the quality of the site?

<comment><AUTHOR> I'm very left wing, with my favourite publication being Current Affairs, and American Conservative often has decent stuff.

Best takes on the Hamilton musical, curiously enough.</comment></comment>


The PVS-Studio team couldn't get past the C++ source code of the VVVVVVV game - <AUTHOR> https://www.viva64.com/en/b/0707/ <comment><USER2> [Warning 1] nothing will happen because oldDirectory already contained "?.vvvvvv" file in the first place, and in windows both combined couldnt be longer than 260 anyway. [https://stackoverflow.com/questions/1880321/why-does- the-260...](https://stackoverflow.com/questions/1880321/why-does- the-260-character-path-length-limit-exist-in-windows) Unsurprisingly this piece of code sits behind #if defined(_WIN32)

[Warning 2] "variable assigned values twice successively" "vivid examples of this error" remnants of prior debugging at best, no error there.

[Warning 3] "Overlapping names is a rather rough error" in reality variable not used past that point anyway.

[Warning 4] "Decreased performance." oh no, our one call per run to getOSDirectory will have degraded performance by around 100 cpu cycles .. in debug build :-)

[Warning 5] finally something which potentially could be bad, if those werent "oldxp, oldyp", irrelevant for new entity.

[Warning 6] bad habit

[Warning 7] "integer type is implicitly cast to the char type" actual bug

[Warning 8] "pretty serious mistake" is a harmless printf leftover from debugging

[Warning 9] "redundant checks" meh

[Warning 10] "cyclomatic complexity" reminder, Its a sole dev indie game. "if I made it any nicer you couldnt afford it" [https://www.youtube.com/watch?v=4T_Ubrys7vE](https://www.youtube.com/watch?v=4T_Ubrys7vE)

[Conclusion] "above errors" Single actual bug, and even that one is not manifesting in any way during usage. All in all if I was trying to sell static code analyzer I would pick something with actual harmful bugs for marketing material.</comment>


Ask HN: Could we please not bury our heads in the sand? - Kepler-125c During the news blackout, this deeply disturbing piece of news got overlooked:
http://www.zerohedge.com/news/2016-12-10/senate-quietly-passes-countering-disinformation-and-propaganda-act
I'm trying to resubmit it but it says "Link has already been submitted". But the link is not viewable because of the blackout.
You are blacking out people complaining about the loss of freedom of speech. <comment><AUTHOR> Most purely-political sites are banned on HN because pure politics are off topic here. zerohedge.com has been in that category here since August 2010. That doesn't mean it's a bad site or (heaven forbid) that we disagree with it. It just means it's reliably a source of off-topic content for HN, as described at [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html).

If you think an article there is particularly substantive you're welcome to email email@example.com and ask us to take a look, but please distinguish between particularly _substantive_ and particularly good at riling up the reader. Sites that specialize in the latter are just what we don't want on HN, regardless of their politics.

If the story itself is important but the article not particularly substantive (or at least not enough to justify unbanning an entire site), I'm sure you can find another article reporting on the same thing.

</comment><comment><USER2> For real. The word "hacker", and the spirit it implies, is quickly losing its meaning here.

"Yes, I am a criminal. My crime is that of curiosity. My crime is that of judging people by what they say and think, not what they look like. My crime is that of outsmarting you, something that you will never forgive me for." \-- The Hacker Manifesto

</comment><comment><USER3> Here's a link to a submission from a non-ZH source:

[https://news.ycombinator.com/item?id=13163941](https://news.ycombinator.com/item?id=13163941)

Now that dang's temporary "no politics, please" request has expired, the content matter seems to fit perfectly within HN guidelines (to wit: not "pure politics", and from a reliable, non-political source).

</comment><comment><USER4> And it's law...

I submitted the Wikipedia article about it today, and it got 3 points.

Instead of discussing this, there's a lively discussion on the front page about the US retaliating militarily against Russia for supposed election hacking and plenty of "hackers" engaging in cold war style saber-rattling.

</comment><comment><USER5> Ask dang or scott to remove the block. Measures involving law and information are definitely in our domain.

It didn't just slip under HN's radar because of the temp ban on politics, my search results show Congress website, Wikipedia, Infowars and some forums. "Quiet" is understatement.

That there is jack shit from any media outlets hints that maybe a state order has gone out.

Otherwise I have to believe the major media has no interest in a law explicitly about #fakenews when they've been bitching about little else for the past two weeks.</comment>


Compiler Writers Gone Wild: ARC Madness - <AUTHOR> http://blog.metaobject.com/2014/06/compiler-writers-gone-wild-arc-madness.html

<comment><USER2> The complaints about clang optimizations are misplaced; the example relies on undefined behavior; regardless of what you think about it, all compilers are free to do such things.

This is also a classic case of optimizing for the wrong and uncommon things (billions of objc_msgsend calls in a tight loop), instead of the really common stuff (like leaks/crashes due to a mistake in memory management, lower productivity across your entire team due to time wasted thinking about retain/release or tracking down aforementioned leaks, etc).

<comment><AUTHOR> Two points.

1\. Breaking reflexivity is not OK. Ever. a==a should hold.

2\. The compiler knows that this is undefined behavior, and uses this to "optimize" to a wrong result.

However, it does _not_ warn me about the use of undefined behavior. Not with -Wall, not with -Wpedantic.

       marcel@localhost[tmp]cc -Wall -Wpedantic -Os -o undefined-realloc undefined-realloc.c
       marcel@localhost[tmp]./undefined-realloc
       1 2

I can't think of any reason for this to be OK. Either warn me, or don't use it. Silently breaking reflexivity...did I mention "not OK"?

Of course, that's only a minor point in the article, but it does capture the theme that's explored in the main point.

<comment><USER3> 1\. a==a is false for NaN, so it's not quite "Ever"

2\. The compiler does not know this is undefined behavior. Dereferencing a pointer that has been previously passed to realloc is not necessarily undefined behavior. realloc may fail and return NULL; in that case the passed- in pointer remains valid.

<comment><USER4> Just a note: "a==a is false for NaN" is only true if compiled with precise or strict floating point mode. It will return true in fast mode, which is often what is used. Do not rely on this behavior for checking NaNs, use isnan instead.

</comment></comment></comment></comment><comment><USER5> For anyone like me who wonders what ARC is (my first thought was "pg's Lisp dialect?") it sounds like they are talking about Objective-C Automatic Reference Counting:

[http://clang.llvm.org/docs/AutomaticReferenceCounting.html](http://clang.llvm.org/docs/AutomaticReferenceCounting.html)

Tip to writers: Even if you think your audience knows what an acronym stands for, spell it out or provide a link the first time you use it. You never know when other people will see your article who are interested in the general area but unfamiliar with your specific topic.

<comment><USER6> It's kind of ironic that you use "pg" just a few words after the acronym you're complaining about, although I understand that a blog post and a comment aren't quite the same. Still, is it really necessary to define acronyms when they're easy to find and pretty fundamental to the language? A Google search for "objective-c arc" turns up nothing but hits that discuss Automatic Reference Counting. Should he also expand shorthand like "x86" or "WWDC"?

<comment><USER5> Ah, but how would I know that I need to search for "objective-c arc"? There's no mention of Objective-C until well past the midway point of the article.

And of course a search for "ARC" turns up all kinds of unrelated topics. In fact, the only software-related reference on the first page of a Google search is Paul Graham's Arc.

It would have been fine if the first mention of ARC in the article was more specific: "Objective-C ARC".

This is different from x86 or WWDC, where the very first match on a Google search is exactly what you'd be looking for.

(FWIW, I upvoted your comment because I always appreciate interesting feedback.)

<comment><USER6> Fair point. But on the other hand, Objective-C is pretty much all he writes about. Is it really necessary to mention it every time? I understand that it makes life harder if you come in for the first time, but you did figure it out, and I imagine he writes for his usual audience. Personally, I would say that this is a good case for making the HN title different from (more explicit than) the page title, although I know that that way often lies madness.

Really, I think this is just another example of how we should name everything using UUIDs rather than pronounceable chains of letters.

</comment></comment></comment></comment><comment><USER7> _Turn on the "standard" optimization -Os and we get the following, much more reasonable result_

That's still 250% more instructions than the necessary "xor eax, eax; ret". I find it a bit disappointing that the compiler would miss this trivial optimisation opportunity, while at the same time doing subtle and often unwanted things with undefined behaviour. C was conceived as a "portable assembly language", and as much as the language lawyers, theoreticists, and compiler writers love to exercise their "undefined behaviour" rights and try to dissuade others from thinking of it that way, that's what people use it for and that's what they'll expect.

Rather, undefined behaviour should be interpreted as "do the obvious thing, the results may differ on different platforms, and turn off all optimisations exploiting it because it's either intentional or the programmer has made a mistake so the compiler should also generate obviously wrong code." A warning would be nice too. Instead of blind adherence to the standard, consider what behaviour programmers actually expect, and write compilers accordingly. One example of this is casting integers to pointers of various types, and using them to access hardware. Device drivers would be impossible to write if the compiler decided that such undefined behaviour meant it could remove the accesses completely (which is completely legal according to the standard.)

More examples: dereferencing a null pointer should generate code that accesses address 0. Signed integers should wrap around on overflow. Shifts should do whatever the shift instruction of the architecture does. Trying to access beyond the end of the array should try to access memory there. Division by zero will do what the machine instruction would do. Etc.

<comment><USER8> The 250% more instructions are the frame pointer, which is how your debugger figures out the stack trace when you happen to break execution at the "xor eax, eax". Use -fomit-frame-pointer to get rid of that. That has nothing to do with optimization.

<comment><USER7> Those extra instructions shouldn't be necessary even when debugging, since that's what the -g option is for; to generate information the debugger can use: [http://yosefk.com/blog/getting-the-call-stack-without-a- fram...](http://yosefk.com/blog/getting-the-call-stack-without-a-frame- pointer.html)

When optimisation is enabled, all extraneous instructions should disappear.

</comment></comment></comment><comment><USER9> The author's surprise at the size of the ARC code seems to have led him astray from the actual bug in his code. The unoptimized version performs refcount manipulation of 'id' and crashes. The optimized version avoids refcount mucking and does not crash. Seems to me this strongly implies that an invalid 'id' is being passed into the function!

</comment><comment><USER10> I was a little disappointed that we didn't get a resolution here, but it's interesting to see a little more of ARC under the hood:

"It isn't clear why those retains/releases were crashing, all the objects involved looked OK in the debugger, but at least we will no longer be puzzled by code that can't possibly crash...crashing, and therefore have a better chance of actually debugging it."

<comment><USER11> I'd be surprised if suppressing the crash actually makes this easier to debug. I'd much prefer to debug with the crash in place, than to try to determine what's wrong _later_ in the execution of the program when the bug has had the opportunity to spread.

I'm also not very impressed with trotting out the assembly without using it to diagnose the crash. Particularly not if it's being used to disparage ARC (wrongly, I believe).

<comment><USER6> It's pretty weak. He doesn't tell us which line of assembly actually crashes, nor (presuming it's one of the calls to objc_storeStrong) what object is being manipulated when it crashes. There's no point in looking at your assembly code unless you're going to actually use it to investigate what's going on.

</comment></comment></comment><comment><USER12> Why were they compiling without the optimizer (-Oo) in the first place?

<comment><USER13> Presumably to aid in debugging- that's why _I_ do it with native languages...

</comment></comment><comment><USER14> It's annoying when people write things like "13" MBPR" and not concrete CPU model...

</comment><comment><USER15> I was really thinking it'll be about arc lisp</comment>


GitLab 11.1 released with security dashboards and enhanced code search - <AUTHOR> https://about.gitlab.com/2018/07/22/gitlab-11-1-released/ <comment><USER2> A month of nothing but performance tweaks and bugfixes would be great though.

<comment><USER3> We have to balance shipping new features [https://about.gitlab.com/handbook/ceo/#how-do-we-keep- shippi...](https://about.gitlab.com/handbook/ceo/#how-do-we-keep-shipping) with performance tweaks and bugfixes.

If we would not have shipped new features and still did just just version control GitLab the company would not be viable. We're committed to shipping a single application for the whole DevOps lifecycle this year [https://about.gitlab.com/2017/10/11/from-dev-to- devops/](https://about.gitlab.com/2017/10/11/from-dev-to-devops/)

But there are multiple performance tweaks en bugfixes going out every month, including this one.

The big performance tweak in this release is the merge request view refactor [https://about.gitlab.com/2018/07/22/gitlab-11-1-released/#me...](https://about.gitlab.com/2018/07/22/gitlab-11-1-released/#merge- request-comments-vuejs-refactor) which makes loading merge requests much faster but there are 35 other performance improvements [https://gitlab.com/groups/gitlab- org/-/merge_requests?scope=...](https://gitlab.com/groups/gitlab- org/-/merge_requests?scope=all&utf8=%E2%9C%93&state=merged&label_name%5B%5D=performance&milestone_title=11.1)

There were 141 bugs closed in this release [https://gitlab.com/groups/gitlab- org/-/issues?scope=all&utf8...](https://gitlab.com/groups/gitlab- org/-/issues?scope=all&utf8=%E2%9C%93&state=closed&milestone_title=11.1&label_name\[\]=bug)

<comment><USER4> Well, there's definitely a difference between periodically slowing down the new features for a month of additional focus on stability/performance improvements and 'just doing version control forever'.

Keep your fingers on the pulse of your customers. If the top comments in posts about your releases say "I wish they'd focus on quality more" even in a place where 'move fast and break things' is considered sage advice, then think of this as an indicator. If the performance improvements that have been going out every month are sufficient, the discussion would not focus on them as much.

<comment><USER3> I hope you see that I actively engage with our users and customers. We want to get the balance right. I think currently GitLab.com should be much more reliable and the RAM usage with should be lower. I'm happy with the improvements we are making in UX, polish, navigation, and loading times. They should all improve from today but we're making the right amount of progress.

Maybe a bit off-topic but some of our reliability improvements like Gitaly cause GitLab to use more memory. So improving non-functional requirements is not a single dimension.

</comment></comment></comment></comment><comment><USER5> I'm about to switch my team to Gitlab hosted for one reason: it's the only CI product I can find which has any notion of allowing the feature-branch/shared- repo model to have secrets protected from regular committers during builds.

Now if they could implement branch-specific secrets so I could manage ACLs amongst devs, senior devs, ops etc. then it would be near-perfect.

<comment><USER6> Secret variables are NOT output to Gitlab CI job logs... but if someone echos them, they WILL appear in the log. This may be obvious to some, but, I like to point it out nonetheless.

<comment><USER7> I think it would be a good feature to hide secrets from the log by searching for them and replacing them with something like [removed]. It would be best if it were done by a component that had the security locked down (maybe a process that you pipe it through) and it wouldn't prevent users from encrypting it to bypass the filter, but it would make it harder for misbehaving users to deny that they circumvented the security. It could also detect JSON stringified or base64'd secrets.

<comment><USER8> Wouldn't this be an unwinnable battle? If you can't print out the whole secret, you can print out each half of it, or one character at a time, each on a different line.

There's probably no way around the reality that users who have the ability to run arbitrary code on the CI server have access to the secrets.

<comment><USER7> Yeah. Maybe I shouldn't have suggested scrubbing base64'd secrets. What I have in mind is a usability feature, making it so users can't accidentally print out a secret that they're not supposed to print out.

<comment><USER8> I would have to admit that's useful as I've accidentally printed a secret key or two to publicly accessible jobs on TravisCI, and then had to scramble to rotate them :)

</comment></comment></comment></comment></comment></comment><comment><USER9> My favorite part of GitLab is the .gitlab-ci.yml and gitlab-runner workflow. My least favorite is how much RAM is required to run GitLab. You can't host your own on a $5 DigitalOcean vps. Does anyone know of any work being done on gitea/gogs, or other alternatives, that would support .gitlab-ci.yml and gitlab-runner?

@gitlab It would be awesome if you would split out GitLab-CI into something you can host separately as a direct competitor to Jenkins. Or maybe a stripped down "lite" version that could be hosted on small vps's. I know that doesn't fit your overall vision, or really help your bottom line, but it would help a lot of individuals and small organizations that need to self host for some reason (as in, there's a reason they can't use GitLab.com).

<comment><USER10> isn't `.gitlab-ci.yml` just the same as a jenkins pipeline?

<comment><USER9> I haven't looked into Jenkin's in a couple years, so I'm not sure. My experience as the sysadmin of our Jenkin's server was decidedly negative. I was pretty happy when I was able to move to GitLab-CI instead of Jenkin's. It has it's issues, but at least I can upgrade it without breaking the entire instance....

</comment></comment></comment><comment><USER11> Does anyone know if Gitlab is now on a monthly release schedule?

Today is exactly one month after Gitlab 11.0 release.

It seems Gitlab is finally on Rails 5.0, hopefully they move to Rails 5.2 soon. It seems the whole Rails Ecosystem, Shopify, Zendesk, Gitlab, AirBnb, Discourse is now catching up to the latest release.

<comment><USER12> Yeah, GitLab has been on a monthly release schedule since October 2011: [https://about.gitlab.com/2015/12/17/gitlab-release- process/](https://about.gitlab.com/2015/12/17/gitlab-release-process/)

</comment></comment><comment><USER13> This is neat, but the pricing tiers are a bit extreme. I'd like to use static code analysis, but this is only available in platinum ($99/month/user [0]) or ultimate (unknown price - call sales).

I currently use Core for free and going from $0 to $100k seems pretty steep for a fairly simple feature that Github has partially implemented in their free tier.

[0] [https://about.gitlab.com/pricing/#gitlab- com](https://about.gitlab.com/pricing/#gitlab-com)

<comment><USER3> Good point. We're thinking about making security open source at the merge request level but charging for project, group, and instance level metrics. What would you think of that?

<comment><USER13> That's better. I actually don't necessarily mind paying or jumping through hoops, but it's such a massive jump for what I see as a feature that I'll likely have to buy a 3rd part product for much less than that.

I'd like some way to use it manually as a low cost project and then pay for convenience.

There's a group in my org looking at MicroFocus at $1200/build seat.

<comment><USER3> If you want to use it manually consider looking at the .gitlab-ci.yml template included in GitLab EE. If you do it manually you'll probably have to send the results to an artifact to see them.

<comment><USER13> Thanks, I'll check it out. Keep up the good work, it's a tough business model- but admirable.

<comment><USER3> Thank you!

</comment></comment></comment></comment></comment></comment><comment><USER14> My biggest issue with GitLab is that it's core 95% use case UX is just significantly weaker than GitHub's.

This may seem subjective, and it certainly is to some extent, but I've used both platforms pretty extensively and I find GitHub's UX so much cleaner and more usable every time.

<comment><USER15> I use both GL and GH every day. And I find GH's UX is much weaker, e.g. it doesn't remember last used sort options on the issues page which is huge annoying.

So this is subjective.

</comment></comment><comment><USER16> It would help if gitlab's web interface could make it possible to renew letsencrypt security certificates more easily than running local commands and cutting and pasting the certbot handshake string, then the SSL public and private keys. I have to do this every 3 months for the website for an open source project. Or if gitlab could sell ssh access to a VM host (for this purpose, not to use do any other significant computing) at reasonable cost.

<comment><USER3> GitLab now uses Let's Encrypt for self-hosted installations. We plan to start using it for GitLab pages sites with custom domains and applications deployed with Auto DevOps. The issue for the latter is at [https://gitlab.com/gitlab- org/gitlab-ce/issues/41355](https://gitlab.com/gitlab-org/gitlab- ce/issues/41355)

</comment></comment><comment><USER17> Does anyone find it annoying that both Github and Gitlab have their own flavor of markdown which they both call GFM?

<comment><USER18> I guess you didn't read the 11.1 release notes where they stated they were standardising on [http://commonmark.org/](http://commonmark.org/) right?

<comment><USER17> Yeah, but they're still calling it "Gitlab Flavored Markdown". The release was just about how they're changing the renderer. This does nothing to reduce the confusion with the fact that there are still two "flavors" of Markdown called different things but referred to with the same acronym, but I guess now both rendered by the same backend? This makes no sense to me.

<comment><USER19> The additions GitLab has expand on Markdown. For example, if you comment with a string of hexidecimals larger than 8 characters, GitLab will try to link to the commit if it finds one. For issue 1, the reference pattern in #1. This is convenient in cases where you want to cross reference merge requests, snippets, and others, without copy pasting the links. The docs explain it better than I could: [https://docs.gitlab.com/ce/user/markdown.html](https://docs.gitlab.com/ce/user/markdown.html)

But in general, GitLab supports Markdown, with a few extensions.

</comment></comment></comment></comment><comment><USER20> I wished this update came with gitlab.com-wide project search. But looks like the "improved search" still didn't include that.

Github-wide search is great! I wish Gitlab had something like that. That's one of the things that's stopping me from switching 100% to Gitlab.

The site-wide search on GitHub allows me to explore code snippets, learn how someone else uses the "foo" syntax, see the trending repos in a given language, and so much more.

</comment><comment><USER21> All my issues (on gitlab.com) now have an "Epic" field, but I can't find anywhere to actually create an epic. Am I missing it somewhere?

<comment><USER22> That's an Enterprise feature, depends on what subscription you have.

<comment><USER23> Note, it's only a paid feature for private projects on GitLab.com. Public projects get all features of Gold for free: [https://about.gitlab.com/open- source/](https://about.gitlab.com/open-source/)

</comment></comment></comment><comment><USER24> I just do not understand what they spend their time on. No ones giving out points for more checkmarks in a feature list, folks.

<comment><USER25> Same issue, it seems to have become an "eierlegende Wollmilchsau" (German for Swiss Army knife, but with a negative conotation).

I recently move to gittea[1] for the very reason that I dont need 90%+ of Gitlabs features. Also Gitlab chews up RAM and IO, while gittea is barely noticeable even on a low end server. [1] [https://gitea.io/](https://gitea.io/)

<comment><USER26> I have to agree a bit on the "Eierlegende Wollmilchsau". Features are not everything, regressions and degraded core functionality impact current users, which will impact whether you are getting new users in the long run.

For example, recently the number of characters before line-wraps in the MR diff view changed. Not sure if this was intentional or accidental. I know two companies using Gitlab, both based the max-line length in their style-guide on what fit the diff-viewer. I guess Gitlab became a worse tool for code-reviews for them with that change.

"You need to optimize for the people not using your product yet because it is missing features." doesn't sound very fair to current users, and I don't think that will work long term.

<comment><USER27> I'm not aware that we intentionally changed anything with the line wraps.

But if you go to User Settings > Preferences, you can select between Fixed vs Fluid layout width. Do you recall making any changes here recently?

Here's an issue with some discussion on the design of fixed vs fluid options. [https://gitlab.com/gitlab-org/gitlab- ce/issues/27347](https://gitlab.com/gitlab-org/gitlab-ce/issues/27347)

<comment><USER26> Thanks for replying to this. The fluid settings will help, although it is not quite the same on small laptop screens as before the change.

At the same time I think the issue you link really highlights what some people have been saying: stable quality of the core product hasn't had the focus that customers would like it to have. Apparently you changed the line-wrapping behaviour twice in a year, without even realising that 1) you changed it, and 2) that some of your customers rely on this being stable. Of course you could argue that it was silly to rely on this behaviour, and that the new behaviour is in fact an improvement. But personally I think functional stability is important to all customers, and the fact that this was not a deliberate change is odd.

Obviously such a small change will never drive away customers, but I do think quality is the difference between having users and having users that are also ambassadors that will recommend your product.

</comment></comment></comment></comment></comment><comment><USER28> How does the code search compare to best-in-class search tools like SourceGraph? Looks like GitLab is still missing a lot of important utilities like informative tooltips, jump-to-definition, etc.

<comment><USER3> GitLab code search is not on the same level as SourceGraph that has much more language dependent features.

<comment><USER29> Sourcegraph CEO here. :) Sourcegraph works really well with GitLab so you can search and browse code (with IDE-like code intelligence) across all of your GitLab EE/CE/.com repositories efficiently. See [https://about.sourcegraph.com/docs/config/repositories#gitla...](https://about.sourcegraph.com/docs/config/repositories#gitlab- configuration) or just set it up with the one-command installation instructions on the homepage.

</comment></comment></comment><comment><USER30> Anyone using their OIDC integration should carefully read the release notes. Some form of migration action will be required.

<comment><USER3> This is about OpenID Connect, see [https://about.gitlab.com/2018/07/22/gitlab-11-1-released/#st...](https://about.gitlab.com/2018/07/22/gitlab-11-1-released/#store- user-id-in-openid-connect-sub-claim)

</comment></comment><comment> dorian-graph > external systems can no access all merge requests reliably

Typo? Should it be "now"?

</comment><comment><USER31> The most innovative source control product in the market just got even better. :)</comment>


Limits to Growth was right. New research shows we're nearing collapse (2014) - <AUTHOR> https://www.theguardian.com/commentisfree/2014/sep/02/limits-to-growth-was-right-new-research-shows-were-nearing-collapse <comment><USER2> Peak oil is not a good indicator of eg lithium or rare earth or helium. Simons win would be a win again rerun from now. Name your at limit scarce resource and name an endpoint and go to the long bet website

</comment><comment><AUTHOR> > _As pollution mounts and industrial input into agriculture falls, food > production per capita falls. Health and education services are cut back, and > that combines to bring about a rise in the death rate from about 2020. > Global population begins to fall from about 2030, by about half a billion > people per decade. Living conditions fall to levels similar to the early > 1900s._

This article is from 2014, so the 2020 bit struck me.</comment>


Wireless devices go battery-free with new communication technique - <AUTHOR> http://www.washington.edu/news/2013/08/13/wireless-devices-go-battery-free-with-new-communication-technique/ <comment><USER2> Backscatter is (indeed) phenomenally interesting. We used it to build "cyborg" dragonflies [1] and to build battery-free tags capable of transmitting video and audio [2]. We've demonstrated fully-passive tags (at 915MHz UHF) capable of 100Mbps communications. Using ambient signals as the carrier is a pretty cool extension.

[1] [http://www.wired.com/wiredscience/2013/06/dragonfly- backpack...](http://www.wired.com/wiredscience/2013/06/dragonfly-backpack- neuron/)

[2] [http://www.travisdeyle.com/publications/pdf/2013_rfid_rich_m...](http://www.travisdeyle.com/publications/pdf/2013_rfid_rich_media_tags.pdf)

<comment><USER3> It seems like this would work over extremely short distances since the carrier signals at tags A and B are basically the same.

If ambient backscatter is going to be implemented over a larger area, the multipath or modulation of the carrier seems like it will be problematic.

Also: From measurements we have seen, the ambient RF power levels vary _drastically_ with location from TV transmitters.

<comment><USER2> I believe you re:ambient signals (or rather, no reason to disbelieve you).

For those who are unfamiliar with backscatter modulation / passive UHF RFID... most systems are forward-link limited: the limitation on range is dictated by the ability to harvest enough energy to powerup the tag.

At a fundamental level, backscatter modulation is little more than a reflector that modulates its radar cross section. You could imagine building massive spinning reflectors to serve the same purpose at very low datarates. As for conventional tags, I've seen read ranges on the order of 30-100 meters using directional antennas.

You can build systems that are limited by receiver sensitivity, eg. by using different RX-TX antennas or by using a battery (not for transmission, but for _very_ low power load-modulating the antenna). This is a classic radar problem -- but you can get pretty substantial ranges.

</comment></comment></comment><comment><USER4> This is very cool. There was an interesting project at a former employer which used ambient light to power conference room schedule displays, attached to the outside of conference rooms.

Something like that with e-ink would be even nicer (you can save up energy for changing things rather than keeping an LCD on)

There was also some interesting robotics work out of Mark Tilden's lab called BEAM which was primarily solar powered things but it would be really cool to do those things with backscatter powered energy harvesting devices.

<comment><USER5> Radish? [https://developers.google.com/gdata/articles/radish](https://developers.google.com/gdata/articles/radish)

<comment><USER6> Radish is cool. Is there an open source or commercial implementation of the idea elsewhere?

<comment><USER5> Not that I'm aware of but it would be quite useful. Components are getting better so you might design it differently these days.

</comment></comment></comment></comment><comment><USER7> [http://www.spybusters.com/Great_Seal_Bug.html](http://www.spybusters.com/Great_Seal_Bug.html)

</comment><comment><USER8> What kind of havoc does backscatter/reflection wreak on normal tv/radio signals? Do I want this noise in my house?

<comment><USER9> My mom would ask: "Does it give me cancer?" (she has the same doubts about microwave ovens)

Does anyone know, with certainty, what to answer to that?

<comment><USER10> Well, I don't know your Mom, but the answer is 'yes, but 0.0001% less risk than either the sun or time'.

Of course, I'm going by the moto here that 93% of statistics are made up on the spot.

<comment><USER11> To be slightly pedantic, 0.0001% less risk than the sun is actually a fair bit of risk. 0.0001% of the sun's risk is not much risk.

</comment></comment></comment></comment><comment><USER3> For anyone else interested, the full paper is available here:

[http://conferences.sigcomm.org/sigcomm/2013/papers/sigcomm/p...](http://conferences.sigcomm.org/sigcomm/2013/papers/sigcomm/p39.pdf)

</comment><comment><USER12> duplicate: [http://news.ycombinator.com/item?id=6004470](http://news.ycombinator.com/item?id=6004470)

</comment><comment><USER13> Am I the only concerned that once a few billion of these energy parasites are deployed everyone will have to have to use more energy to broadcast the same signal the same distance?

<comment><USER14> Does the increase in radio receivers require an increase in the energy to broadcast to the same area?

<comment><USER15> Nope. If it were inductive or capacitive transmission, this would be the case, but for far-field radiation, it's generally not.

</comment></comment></comment><comment><USER16> I did an experiment a while ago on whether I could use a crystal radio to light up an LED. Short answer, yes. Long answer, only in very short pulses and that still required a fairly strong AM signal. I guess, this absorbs frequencies of a much wider range.

</comment><comment><USER17> There was a time when battery-less electronics might have excited me, but these days dis-connectable batteries/power supplies and real, hardware off switches seem like important, useful features for just about anything.

<comment><USER18> Just put a Faraday cage around it by wrapping it in tin foil. </sarcasm>

<comment><USER19> I know, its a joke, but just the other day, I was thinking about faraday cages and how maybe it wouldn't be terrible to have one around the house and if I could pull it off with tin foil...

I was seriously considering tin foil to stop snooping from government rays. What. A. World.

<comment><USER20> I live in a house with aluminum siding and foil wrapped sheathing.

</comment></comment></comment></comment><comment><USER21> Will this destroy signal integrity for everybody in the vicinity?

<comment><USER22> It's roughly as small of a perturbation to the radiation field as, say, a tinfoil hat.

</comment></comment><comment><USER23> also harnessing the power from sound: [http://www.instructables.com/id/Harnessing-sound- power/](http://www.instructables.com/id/Harnessing-sound-power/)

When lose an item in house, shout loudly and it will appear on radar ;)

</comment><comment><USER24> This would be awesome for home automation devices (sensors, actuators and stuff). It's a pain to have a battery for each little button and sensor.

</comment><comment><USER25> As a human this fascinates and excites me because of the possibilities for innovation.

As a hacker this fascinates and excites me because of the potential for abuse and, well, hacking.

This is really cool stuff. I can't wait to see what is built with this technology and how it will get broken.

<comment><USER26> Indeed. This reminds me of "Larson Localizers" [1] from Vernor Vinge's "A Deepness in the Sky":

      "Among the unsuspecting, they are an espionage miracle.
       Abused, they lead to ubiquitous law enforcement, and a
       quick end to civilization."

1: [http://en.wikipedia.org/wiki/A_Deepness_in_the_Sky#Localizer...](http://en.wikipedia.org/wiki/A_Deepness_in_the_Sky#Localizers)

</comment></comment><comment><USER27> This is a very interesting development. Kudos to the UW folks for this great piece of research.

Few questions :-

\- Would there be a problem if the devices were inside an enclosed/shielded area (I assume there would be) ?

\- Isn't the data rate dependent on the kind of ambient wavelengths available ?

</comment><comment><USER28> Isn't this something like what Tesla proposed earlier? Can someone elaborate how this is different from Tesla's proposition?

Thanks!

</comment><comment><USER29> Would anyone be willing to explain the proposed benefits of an "Internet of Things"?

<comment><USER30> Logistics is a multi trillion dollar industry. I doubt there's a larger sector of the economy than moving things around.

<comment><USER31> Yeah, let's kill it off!

</comment></comment></comment><comment><USER32> From my first read it seems that I will not be able to pay with my "backscsatter creditcard" in a Faraday cage or anywhere, where background radiation is strongly shielded. But from a general stand point, I really like the idea.

</comment><comment><USER33> I remember, as a small child, building a powerless radio that vibrated the speaker using the strength of the radio transmission itself. Is ambient backscatter is the same thing, except across much wider frequencies ranges?

<comment><USER34> You're talking about Crystal Radios[0], right?

[0] [https://en.wikipedia.org/wiki/Crystal_radio](https://en.wikipedia.org/wiki/Crystal_radio)

<comment><USER33> :) Yes, I am. It was part of an electronics kit my father bought for me. I remember carefully placing the pieces between spring-end contacts to construct the basic circuits.

Building electronics from scratch is very satisfying. I think I may get into DIY drones soon to scratch that itch.

</comment></comment></comment><comment><USER35> This needs to be in any 2013 year in review article. The implications for this with existing and new technologies is unique and doesn't happen often enough, presuming my understanding is correct :)

</comment><comment><USER14> There are those times when the device you're powering isn't supposed to be visible and would benefit greatly by the reduction in size from shucking the battery.

</comment><comment><USER36> wouldn't deploying this in big numbers work against the solution itself? you would have so much noise in the existing signals that the main signal, as well as the bounced signals, would be useless?

Also, can we just say this is a cat's whisker receiver[1] that instead of powering a speaker/headphone powers another transmitter?

[1] [http://en.wikipedia.org/wiki/Crystal_radio](http://en.wikipedia.org/wiki/Crystal_radio)

<comment><USER2> This is the same principle as long-range UHF RFID tags. There is a communications protocol (Gen2) that deals with collision detection and multiple access to allow for hundreds (thousands?) of tags in the same space. Part of the protocol involves a tunable value for "the probability that an individual tag should respond."

</comment></comment><comment><USER37> Obligatory Tesla Post.

<comment><USER31> Yeah, I hear The Hyperloop pods have been designed to fit the Model S.

<comment><USER37> Nikola Tesla... Wireless transfer of energ...--nevermind.

<comment><USER31> ;-)

</comment></comment></comment></comment><comment><USER38> I was just reading the Wikipedia article about crystal radios yesterday. Does this have anything to do with them?

</comment><comment><USER39> i imagine the signal would have to be reflected in a highly directional manner or at very close distances. it's cool nevertheless, but i think storing some solar power in a capacitor/coil would produce more powerful rf communication bursts at least for outdoors applications.

</comment><comment><USER40> Hmm, imagine a massive array of those like solar panels that work at night.

</comment><comment><USER41> This reminds me of a spark-gap transmitter but without the spark.

</comment><comment><USER42> This non-sense has been posted a number of times and concluded that it is RFID redux.</comment>


Human rights activist risks prison over refusal to disclose password to police - <AUTHOR> http://www.middleeasteye.net/news/cage-director-faces-jail-over-refusal-disclose-password-during-airport-interrogation-681177289 <comment> k-mcgrady 28,000 people stopped using these powers - less than 56 people charged (no specific number for that so it could be significantly less than 56 as that's the number of arrests). When the authorities are given such a powerful tool (and such a violating tool) it should have to prove significantly useful to continue to exist. Schedule 7 clearly hasn't. Also quite shocking that only 0.2% of people stopped are arrested and non-compliance == arrest. That's a lot of people just handing over data and passwords without a fight.

<comment><USER2> > _When the authorities are given such a powerful tool (and such a violating > tool) it should have to prove significantly useful to continue to exist_

Unfortunately, the only real constrain for it to not continue to exist would be to cost some people their political career due to media/public backlash and such.

<comment><USER3> Who is the last person (or any people, really) at this level who experienced an adverse effect on their political career due to "media/public backlash?"

<comment> white-flame I think it's more that if politician A did such a thing, it would give opposing politician/party B ammo to mount a campaign to incite backlash, not that the public cares enough to backlash themselves.

</comment></comment></comment></comment><comment><USER4> Id like to be able to configure 2 passwords on my devices, one that logs me in, and another "destruct password" that when entered as password, wipes the device clean and overwrites the drive.

preferably I'd be able to configure certain directories that should be wiped, so only confidential data is destroyed.

then it would log in normally. I doubt silly borderguards would realize the pwnage

<comment><USER5> Clever, but would likely add "obstruction of justice" to the charges against you, and reduce your chances at beating the original point of suspicion, should it ever result in charges, due to spoliation of evidence.

Why not instead just refuse, and use the technicality of violation of privacy, to beat the authorities by making anything they find inadmissible in the first place?

(I'm assuming US-centric here, of course.)

<comment><USER6> But this is a request made prior to any charges being laid. I'm actually curious what the legal situation would be: if you had been charged on other evidence it would likely be obstruction, but is that a charge that can be laid without any reason to suspect a crime has occurred?

<comment><USER5> IANAL, but I have had the pleasure of having several in my family. One of the things I've come to learn is (again, U.S. centric) that you don't typically get out of legal trouble once you're in the authorities' clutches by "technical cleverness". You don't know at the time described by the parent poster what other evidence might exist, and that includes faulty witness statements. If you mislead the prosecutors to destroy harmless data that could have gotten the whole case dismissed through a technicality, the act could be used in the worst way against you. Don't help the prosecution. Keep your mouth shut and your data expressedly off-limits until you get your legal representation.

<comment><USER7> > _that you don 't typically get out of legal trouble once you're in the > authorities' clutches by "technical cleverness"._

Right, technical cleverness is the lawyer's job. If you get arrested on any serious charges in the US politely tell the police that you need to speak to a lawyer.

<comment><USER8> In the US you should almost always tell police, no matter what the question, that you decline to answer any questions without your lawyer. Don't talk to the police, they aren't your friends. They are trying to build a case to convict someone, and not necessarily a guilty person.

<comment><USER9> I feel like this advice, though not bad, always needs to have some sort of follow-up about how you procure "your" lawyer. Is it best to do it in advance (by having a list of local names and areas of expertise) or at the time of arrest (will you have access to Google?)? Should you take your chances with either a court-appointed one or whoever has the flashiest advertisements made available to you? Most of us don't have someone to call "my lawyer", so the prospect of invoking a non-existent figure makes it all the more tempting to simply answer the police's questioning.

<comment><USER8> If you are talking about the US, If you don't have a lawyer, one will be appointed for you.

You still don't have to answer questions and should never answer questions until you can consult with a lawyer.

The classic video from a law professor and former criminal defense attorney, with a response from an active police detective.

[https://www.youtube.com/watch?v=d-7o9xYp7eE](https://www.youtube.com/watch?v=d-7o9xYp7eE)

"I will never talk to a police officer under any circumstances"

<comment><USER9> Yes, I know, I watched that around when it was first posted. But how effective is a court-appointed lawyer going to be, controlled for various types of legal hassle, controlled for (in the case of an accusation) actual guilt and innocence? In a case of refusing to disclose a password (or even admit the existence of a password, saying literally nothing), are you going to trust the court appointed lawyer or (if you could procure them) someone at the EFF to better represent you? All lawyers have to meet certain obligations but that doesn't mean they're all equal.

Given that most people talk too much to the police most of the time without dire consequences (police have a lot of flexibility in what they can do with your volunteered information, it's a two-edged sword) a more careful cost- benefit analysis of saying nothing or saying certain things is irresistible to smart tech people. If you're going to take the principled 'never talk under any circumstances' approach you need to have thought of various situations so you can make that principle work the most for you and not let it become an unnecessary cost.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> I understand these powers are often used to intimidate and pressure minorities on their way out of the UK too.

For example, a traveller will be questioned about his family in Pakistan. It's a criminal offence not to answer. However the threat that is used is that the person will be detained for long enough that they miss their flight. They'll need to rebook it at 4X the cost with no guarantee they'll be allowed to board the next flight either. These powers are being abused to coerce and haven't been properly tested in court.

The UK should restore the right to silence.

<comment><USER11> The current government (Conservatives) that has so far championed snoopers charter bill, is contemplating the removal of EU human rights protections and proposing reforming workers rights making families financially worse off.

I really doubt they care in the slightest about that.

But perhaps this is the government we deserve as we vote them in, they reflect what is within ourselves.

</comment></comment><comment><USER12> First time I've heard of Cage. Given the entirely reasonable reasons Mr Rabbani gave for non-compliance I hope he wins his case. He is surely in the right?

The awful treatment of non-white UK citizens at our borders is another problem again, quite possibly due in part to the institutional racism that still exists in our police forces.

<comment><USER13> It's worth pointing out that while some outlets (Guardian etc) report it as just another NGO, Cage is an Islamist pressure group.

<comment><USER14> So? Cage could be a straight up terrorist group and this incident would still be wrong. There's a reason why due process exists.

<comment><USER15> Arresting a member of a terorist group would be wrong? What are you smoking?!

<comment><USER16> You arrest people for committing actual crimes, not just for associating with groups of people that you don't like.

<comment><USER13> No, you arrest people _suspected_ of having committed crimes and give them due process of law

<comment><USER17> Love your enthusiasm. You're close, but not quite right. From Wikipedia ([https://en.wikipedia.org/wiki/Due_process](https://en.wikipedia.org/wiki/Due_process))

"Due process is the legal requirement that the state must respect all legal rights that are owed to a person. Due process balances the power of law of the land and protects the individual person from it. When a government harms a person without following the exact course of the law, this constitutes a due process violation, which offends the rule of law."

I think the important point to note is that the 'digital strip search' mentioned is used in an arbitrary way and is a great power in the hands of folks not particularly careful about abusing it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> I don't think the police should be able to compel people to disclose their passwords. However, there's a possibility that 'human rights activist' should be taken with a pinch of salt here. CAGE is a pretty shady organization in some respects. For example see this interview with its 'research director' Asim Qureshi (who to be clear, is not the guy featured in the article):

[https://www.youtube.com/watch?v=R0n-08I3P8s](https://www.youtube.com/watch?v=R0n-08I3P8s)

<comment><USER19> I don't know much about CAGE, and my Googling isn't proving to be terribly enlightening (yet), but:

        The trouble with fighting for human freedom is that one spends most
        of one's time defending scoundrels. For it is against scoundrels that
        oppressive laws are first aimed, and oppression must be stopped at
        the beginning if it is to be stopped at all.

<comment><USER18> That's true but not really relevant to the video that I linked to. The issue is that CAGE has at times crossed the line into offering support for what the scoundrels are doing, rather than just defending their legal rights. For example, Asim Qureshi still has kind words for Mohammed Emwazi even after he committed beheadings. As I said, I am not in favour of the security services having these powers. However, from the fact that the powers are excessive and unjust, it does not follow that all of the people targeted are innocent victims.

<comment><USER19> They may well have. After watching the video you linked, it seems that there is a very blurry, very nuanced line between supporting the rights of the offender and supporting the offenses, and listening to that interview with a blank-slate understanding of the matter, it seemed as though they were mostly talking past each other.

Again though, my knowledge is short on the subject, but the Mencken quote felt an appropriate addenda to the video you linked, from a variety of ways. Remember that even if CAGE organizers _are_ sympathetic to the goals of those they defend, once they've defended them, they're still defending civil rights.

<comment> k-mcgrady That interview was a shambles. It's true that in order to protect rights in general you have to defend shady people - however when asked if you agree with FGM/stoning for adultery/homosexuality is evil/etc. your answer should be a point blank, "No". He had valid points at the beginning of the interview but when pressed he doesn't make himself look very good.

>> Remember that even if CAGE organizers are sympathetic to the goals of those they defend, once they've defended them, they're still defending civil rights.

While this is a valid point in general, it is not in this context of showing schedule 7 to be overreaching. If the man in the article works for the CAGE and they actually are known as sympathetic to the goals of terrorists it makes perfect sense to detain him after he returns from a 'work' trip as there are likely valid, evidence based suspicions for it.

</comment></comment></comment></comment></comment><comment><USER20> We're heading towards needing to travel sans devices if we want any kind of privacy, but then doing so in itself could be seen as cause for suspicion.

</comment><comment><USER21> if MRI would be sensible enough to read memories and thoughts, how long would you think it would take before there would be a law allowing them to dump your brain at an airport...? The sad part is - the only defense is dying of old age or accident before this miracle of science is developed...

<comment><USER22> We're not at that juncture, and, I wouldn't assume there isn't a way around it. You could still obfuscate information in your brain such that it's hard to decode.

<comment><USER2> > _You could still obfuscate information in your brain such that it 's hard to > decode._

And that would made you unemployable, subject to arrest, etc.

Political and legal issues don't get solved with technical workarounds (unless they can force the law to change -- which I guess would count as a legal change, not a technical workaround).

<comment><USER22> Well, I don't think we need to be dogmatic about saying politics is the only solution. I think technology often moves forward when policy fails. But, that doesn't mean we shouldn't fight with everything we have for policy we believe is right.

</comment></comment></comment></comment><comment><USER23> _...despite being told by police that he had "nothing to worry about" and was not suspected of any wrongdoing..._

Never talk to the police. Doesn't matter what they say, never, ever talk to the police, about anything, for any reason. Talk to your lawyer. The police are not on your side.

</comment><comment><USER24> I knew without checking this was going to be about the UK. Expect May to drive through harsher legislation; as she repeats, chanting to us like a one-woman rally, strong and stable, strong and stable, strong and stable...

</comment><comment><USER25> It's fascinating how Britain seems to have a need to be at the forefront of despicable surveillance and censorship amongst western countries, beating out even the US with their horrific laws. I wonder if it's jealousy over losing their position as head of empire to the US and wanting to one up them in one of the few areas--digital oppression--that they still can. Seems like such school-yard, childish rivalries are often employed to get really nasty atrocities done like the Iraq war and total surveillance. Playing catch-up to US atrocities is a losing game for almost any country, but I have to commend Britain. They have done a decent job keeping up generally, and a _superior_ job beating the US digitally.

</comment><comment><USER26> New Zealand is planning to implement such powers. Fortunately for us there's only a 5k fine in it for non-compliance. It's scary to see how competent governments (read: dangerous) have implemented their laws.

<comment><USER27> A 5k fine is still significant, especially if they can apply it for each act of non-compliance. So if they ask you to disclose information that you don't want several times in a single day (and slightly changing what exact information they want to access), you could be hit several times with a 5k fine.

At that stage it should be affordable enough to hire a lawyer to deal with it.

</comment></comment><comment><USER28> About CAGE from Wikipedia: "The organisation has been criticised as "apologists for terrorism",[7] as a "terrorism advocacy group" and of "propagating the myth of Muslim persecution".[8] While others deny this and claim they are doing "vital work".[7]" and "The journalist Terry Glavin in The National Post described the organisation as "a front for Taliban enthusiasts and al Qaida devotees that fraudulently presents itself a human rights group".[16]".

<comment> k-mcgrady Also from Wikipedia:

"CAGE, formerly Cageprisoners Ltd, is a London-based advocacy organisation which aims to "empower communities impacted by the War on Terror" and "highlight and campaign against state policies pertaining to the War on Terror".[2][3] The organisation was formed to raise awareness of the plight of the detainees held at Guantánamo Bay and elsewhere as a result of the War on Terror and has worked closely with former detainees held by the United States and campaigns on behalf of current detainees held without trial.[2][4][5]"

</comment></comment><comment><USER29> He has now been actually charged under the Terrorism Act: [https://www.theguardian.com/uk-news/2017/may/17/cage- campaig...](https://www.theguardian.com/uk-news/2017/may/17/cage-campaign- group-director-muhammed-rabbani-charged-under-terrorism-act)

</comment><comment><USER30> Not disclosing a password that you allegedly know corresponds to what George Orwell called _" thoughtcrime"_ in _Nineteen Eighty-Four_.

</comment><comment><USER31> This site is blocked in the middle east.

<comment><USER32> which country? Do you have an idea why?

<comment><USER33> In Qatar, it is illegal to criticize the ruling family, for example. It is also illegal to promote methods of circumventing the various internet laws, such as VPNs. Sites that are perceived to fall foul of this, get blocked. It is very irritating; I got in the habit of using Tor for everything.

The block looks like this: [https://dohanews.co/wp- content/uploads/2014/09/qatar-block.p...](https://dohanews.co/wp- content/uploads/2014/09/qatar-block.png)

</comment></comment></comment><comment><USER34> Can we get a (UK) in the title?

</comment><comment><USER35> what if you don't want some law enforcement chump to know a password you potentially use elsewhere such as website, and will have to change after they've had a look.

couldn't you unlock, and change the password to "changeme" for them.

I suggest using [https://www.passwordcard.org/en](https://www.passwordcard.org/en) and telling them where the passwords stop and start and make a new card once they release you.

<comment><USER36> Or maybe you shouldn't have to give up a password without a subpoena. Or at all. They can seize it, let them try to decrypt it.

</comment></comment><comment><USER37> It'd be helpful if HN headlines for such news, where law & enforcement varies a lot, mentioned the jurisdictions involved.

This is in the UK.

</comment><comment><USER38> I'd say the terrorists are winning.

<comment><USER39> I can't speak for the UK, but here in the US it should have been evident as soon as the PATRIOT Act was passed.

</comment></comment><comment><USER40> Just say you forgot. Honestly, you can't convict someone for forgetting something.

</comment><comment><USER41> Cage is a terrorist sympathizing group, and this asshole is an enabler. I hope he spends time in jail and is forces to give up his passwords before being released.</comment>


Wanna Federate the Web? Stop Using Silos for Signing In - <AUTHOR> https://v2.jacky.wtf/post/use-indieauth-more <comment><USER2> I like the idea of federated identity management. I hope trends swing back from massive centralized services to more decentralized services as in the earlier days of the internet.</comment>


Ubuntu 9.04 to be called Jaunty Jackalope - <AUTHOR> http://arstechnica.com/news.ars/post/20080908-ubuntu-9-04-to-be-called-jaunty-jackalope.html <comment><USER2> Oh... Come on. It´s April´s release.

I am all in for some light-hearted names.

And, while we are at it, why would anyone take seriously a computer company named after a fruit that was incorporated on April 1st?

The lesson here is that you _can_ get creative with names.

<comment><USER3> Seriously. Since when have coders adhered to "serious" naming conventions for their creations.

</comment></comment><comment><USER4> Oh, for crying out loud.

I respect Mark Shuttleworth for putting his money where his mouth is; desktop Linux has come on leaps and bounds in the past few years and it's thanks in no small part to Canonical.

But you can't compare yourself to MS and Apple and, in the same breath, name your new OS "Jaunty Jackalope". What is this, one of those Words and Pictures videos they show to primary school children?! If it was an actual release codename, fair enough, but unlike other software these names seem to stick. What's wrong with "Ubuntu 9.04" or even "Ubuntu, Spring 2009"?

(I'm using, erm, Hardy.)

<comment><USER5> I'm waiting for Sassy Sasquatch.

But I agree, the names are too silly for a serious operating system.

<comment><USER6> Who said it had to be serious? A sense of humor is always something I enjoy in products I use. a Unix system just isn't a Unix system without the bsd-games package! Silly easter eggs just make programs more fun to use; it gives them a bit of personality.

So long as they don't get in the way of using the software, I don't see the harm.

</comment></comment></comment><comment><USER7> I had to read this twice before I realized it wasn't a joke.

</comment><comment><USER8> What happens when they get past Z? I for one am looking forward to that release

<comment><USER9> They double-up: Always Alluring Alligator

</comment></comment><comment><USER10> Jumpin' Jehosaphat!

</comment><comment><USER11> These names are great for memory (vivid, matched letters) and search (rare enough that partnered with 'ubuntu', as in 'ubuntu jaunty', they make great narrowing query terms).

That they proceed in alpha order is also useful -- as noted by a previous commenter, moreso than Apple's confusing mix of cat names.

</comment><comment><USER12> Anyone have numbers on the Ubuntu install base and if it's steadily growing?

</comment><comment><USER13> Better than "masturbating monkey" :D

<comment><USER14> That's Octobers release 2010.

* See here for context: <http://article.gmane.org/gmane.linux.kernel/706950>

</comment></comment><comment><USER15> Fantastic operating system, horrible release name conventions.</comment>


Fine tuning full text search with PostgreSQL 12 - <AUTHOR> https://rob.conery.io/2019/10/29/fine-tuning-full-text-search-with-postgresql-12/ <comment><USER2> It's only offhandedly mentioned at the bottom of the post, but the websearch_to_tsquery() function added in PostgreSQL 11 is extremely useful and lets you create a pretty decent search system immediately without having to implement any sort of query-parsing yourself.

It supports searching for alternatives with "or", phrases in quotes, and excluding terms with a minus sign, which is all syntax that a lot of people are already used to. For example it can handle a query like:

        blizzard or overwatch -"hong kong"

That would find anything with "blizzard" or "overwatch" in it, but exclude anything with "hong kong" (if you wanted to avoid results about that recent controversy).

It's a great addition, and made it even easier to implement reasonable search functionality with PostgreSQL.

</comment><comment><USER3> be sure to investigate the new "rum" index for text search, which is not in pg core. rum is written by the same folks who wrote the core fts. stunningly fast and flexible. also, a query is a first class data type, allowing for a simple, elegant classification: find all queries which match a certain document.

[https://github.com/postgrespro/rum](https://github.com/postgrespro/rum)</comment>