Some Ideas on how to become a great hacker - <AUTHOR> http://mark-nery.github.io/software/2013/08/18/some-ideas-on-how-to-be-a-great-hacker/

<comment><USER2> Mark,

This is the second article from you that I find through HNews, and it also the second time I'm disappointed by the lack of depth and, the negative and aggressive tone of your writing.

1\. Hacker seems to be the new trendy word like rockstar programmer once was, and I think is misused to be honest.

2\. "I think I have learned the most about programming in non programming books" Really ? I find that statement ridiculous not by the fact that you can't benefit from non computer science book but for the fact that there are so many amazing books related to computer science; The art of computer programming by Donald E. Knuth comes to mind, have you at least read that one ?

3\. Yeah some online schools are gimmicky but not all of them and they are often a good step for beginners.

4\. Why not? Oh wait I forgot you are going for the whole hipster programmer vibe here. "No man, all the languages I know don't offer a certification. You probably have never heard of them" Yeah, some certifications can be a complete waste of time and useless but discard or reject a programming language just for the fact there are certifications available is just dumb.

5\. Scenester, by your own definition; you are a scenester your article hasn't provide a tiny bit of depth so far, and you are building hate towards whoever doesn't think like you do.

My intention is not to aggravate you and if I sound aggressive with my previous comments it's because I find articles with lack of depth and flashy titles infuriating .

Great hackers are not about what languages you learn or what major/minor you took in college. Being a Great hacker is about passion, about curiosity, it's about the feeling of discovery finding something completely new. You can be a hacker eve if you don't know a single line of programming.

Passion is what drive people into becoming great hackers and building amazing things, passion(and coffee) is what keep us going after hours and looking for answers to question that no one necessarily asked.

<comment><AUTHOR> First , thanks for taking the time to read and respond to my article. My intention is to start with an idea than have it evolve with dialog. Yes I do write in an aggressive and negative tone it is my style and I think it is quite effective.

1\. Yes it is, point?

2\. One of the main points in easier words is be WELL ROUNDED and not just read CS books , is it coincidence that a lot of great programmers (not using "hacker" don't want to be trendy ) are well read. Think Rich Hickey getting his ideas from Alfred Whitehead's books (you probably haven't read him , he's not a programmer). Yes I have read some of Knuth's work ( Concrete Mathematics ) and no I haven't read the Art of Programming Languages cover to cover and seriously doubt any one has (way to dry). Nice name drop by the way.

3\. Getting your hands dirty on your own project trumps any other way of learning even for beginners. You will learn things on multiple domains (ie project management , debugging , and even the "hackers" most important skill that I forgot to mention "searching google") that online code schools could not even hope to replicate. Online code schools are like letting your kids watch baby Einstein to prep them for a career in physics.

4\. Hipster hacker , really? I never said don't use mainstream languages , in fact I say the opposite you should select languages with the Lindy Effect. By definition these are languages that have been around for a while. I would never recommend to use languages no one has ever heard of or most likely will be a flop (eg elixer). I was taking a shot at C# and Java , which are pretty worthless ( I would know I developed in both for years) and are littered with shitty coders.

5\. My definition of a scenester is someone who jumps on the newest technology and does everything he can to be marketable , I have not shown any other these traits. I think your definition of depth varies from mine I think you are looking for articles of how I solved coding problem and wrote about (very scenester) , my intention of this blog is not to "show off" my coding knowledge to get a job but to think outside the box.

Yes great hackers are curious (see the top of the article) and yes there are hackers on many different domains other than programming. Maybe I should change the title from "IDEAS on how to be a great hacker" to "How not to be a fraudster"

Anyway thanks for reading and I look forward to infuriating you more in the future.</comment></comment>


Water vapour absorption in the clear atmosphere of a Neptune-sized exoplanet - <AUTHOR> http://www.nature.com/nature/journal/v513/n7519/full/nature13785.html

<comment><AUTHOR> A little more detail and an interview with Jonathan Fraine in the Washington Post, [http://www.washingtonpost.com/news/speaking-of- science/wp/20...](http://www.washingtonpost.com/news/speaking-of- science/wp/2014/09/24/scientists-hit-new-milestone-in-search-for-water-on- planets-outside-our-solar-system/)</comment>


Sirin Labs unveils luxury smartphone for security-conscious traveling executives - <AUTHOR> http://www.networkworld.com/article/3077309/mobile-wireless/sirin-labs-unveils-luxury-smartphone-for-security-conscious-traveling-executives.html#tk.twt_nww <comment><USER2> Don't know what it's like now, but their web site allowed you to sign up for email updates via plain old HTTP not so long ago -- very security-conscious!</comment>


Ask HN: Advice for a new manager whose team is fire fighting with incidents - <AUTHOR> <comment><USER2> I think more information is required here in order to get pertinent advice.

My general comments about managing a team that is engulfed in firefighting activities:

1) Don't pile on. Not everything can be a "#1 priority". An important part of the job of a manager is to guide the setting of priorities. Determine the priority ranking, and assign tasks according to it. Shield your team from pressure from other parts of the company when it comes to the items that aren't currently assigned.

2) Set proper expectations to upper management. This is part of your "protect your developers" role -- you are the firewall. Accurately and honestly keep upper management informed of what is currently being worked on, what is not, and why.

3) Don't push your team to work faster than is sustainable. Pushing for extra effort is fine when done occasionally, but it's not fine when it becomes standard operating procedure.

4) Keep track of progress. If it's taking longer than it should to put out a given fire, find out why and grease those skids if possible. If "why" is because it's a trickier job than expected, consider temporarily swapping that task out for a different task of equal priority, or reassigning that task to a different dev, and so forth.

5) Be aware that simply adding more people to a task will not necessarily speed up the completion of that task (and will often slow it down).

6) Celebrate all victories. It's very hard on a team when all they are doing is firefighting. Every time a fire is put out, celebrate that with your team. It doesn't have to be a big deal -- it can be just a department-wide email recognizing the victory, an afternoon off, a cake, or even just a short victory dance in front of the rest of the team. The idea is to provide a sense of completion and a job well done, rather than just letting the team do nothing but dwell on the raging infernos that still await them.

<comment><USER3> JohnFen's answer addresses the incident response side. The other half is that you want to fix problems upstream to prevent these incidents in the first place. A general process that you should take and edit:

1\. Run blameless post-mortems to figure out what caused the incident and more importantly what actions would have prevented the incident from occurring in the first place 2\. Prioritize doing the corrective action. This can be as simple as checklists for specific procedures or could be the addition of automated tests/static analysis/linting or automating a procedure. Focus on low-lift quick wins here if possible. You should be selling these corrective actions as required maintenance such as changing the oil in your car. 3\. Rinse and repeat.

For SAAS products some things that really make a difference are automated test suites, monitoring, and _documented_ procedures

</comment></comment><comment><USER4> In addition to the other good comments, manage firefighting as it's own activity.

Create a time tracker where anyone doing unplanned work records it as either firefighting or other unplanned non-firefighting work. Whenever doing planning take the history of these times into account.

Assign one person to be the go-to for any and all fires, have them assess the situation bringing in select other team members as necessary. Having everyone respond to every fire with only a few key people actually doing the extinguishing leads to no scheduled work getting done.

Tech-debt. In my experience a lot of fires result from the tech debt of incomplete or poorly designed/implemented features. Schedule a certain number of hours to reduce this and have a groomed backlog of tech debt prioritized when prioritizing regular schedule work.</comment>


Richard Socher, chief scientist of Salesforce AI, to depart - <AUTHOR> https://twitter.com/RichardSocher/status/1282753286269923329 <comment><USER2> What's with this puffery about C-level people "departing" from their jobs?

While the rest of us, you know, just "leave" or "quit"?</comment>


Filenames and Pathnames in Shell: How to Do It Correctly - <AUTHOR> http://www.dwheeler.com/essays/filenames-in-shell.html

<comment><USER2> Excellent article. The quick summary ([1]) is particulary good.

Note that quoting variable names is a good idea for other reasons, e.g., when a variable unexpectedly ends up empty: Not quoting such a variable can lead to termination in calls to test ([ ]), e.g., because the empty variable is replace with nothing (so that test sees the next non-whitespace token instead of the expected variable value, empty or otherwise), while quoting will at least cause the shell to correctly replace the variable with an empty string.

[1] [http://www.dwheeler.com/essays/filenames-in- shell.html#summa...](http://www.dwheeler.com/essays/filenames-in- shell.html#summary)

</comment><comment><AUTHOR> I wonder if this can cause security issues. In particular, suppose you can create an arbitrarily named file in a directory. What if there's a service running that does not handle this correctly ( interpreted bash script that is ) - what unexpected behavior might one accomplish by naming the file weirdly?

As a benign example, consider "ls". If you create a file named "-la", then an "ls *" that tries to do a 1-deep recursive listing is going to print the extended listing with permissions and including hidden files, interpreting the "-la" as a flag instead of a file name.</comment>


Security issues on ArtChain - <AUTHOR> https://shkspr.mobi/blog/2018/11/security-issues-on-artchain/ <comment><USER2> From a bit of searching, it looks like the individual responding to the disclosure emails is a patent attorney, claiming to specialize in bitcoin patents.

I'd be terrified to have him be my lawyer for anything, given his responses here. Artinfo is clearly dead in the water at this point, and I can't even tell if he is the actual owner of it, or just a legal representative.

The security issues are terrible, but it'd really suck to have your company torpedoed by your unhinged IP counsel.

</comment><comment><USER3> NSFW: Try to NOT visit the `artchain(dot)info` website on a work computer, it redirects to Pornhub. (With Xss).

<comment><USER4> Truly a work of art.

</comment></comment><comment><USER5> It's sad when site owners don't respect reports of security bugs. Maybe they don't care, or their trust was lost by being hacked previously...

Either way the user's suffer...

<comment><USER6> This is one reason 'tptacek any I are so militant on the "responsible disclosure" issue. People who seem to believe the onus is on security researchers to do whatever song and dance the person who are actually responsible want. That's nonsense: if you find the bug you get to do whatever you want with that information. (Including, I think, trade on it? But I'm not a lawyer and that's not legal advice.)

<comment><USER7> > _the onus is on security researchers to do whatever song and dance the > person who are actually responsible want_

It's not about bending to the will of an incompetent idiot; it's about protecting vulnerable end users from the idiot in question.

<comment><USER6> Well, it's subtle, right? That presupposes they're an incompetent idiot, and if they are, I agree: you should just publish a full disclosure.

A lot of projects/companies fortunately are not staffed by incompetent idiots. I'm also not saying "never disclose to the company/project". It's what I do 100% of the time if it's worth disclosing and I don't have prior evidence that they'll react poorly. I'm saying researchers have no moral obligation to do anything.

<comment><USER7> > _I 'm saying researchers have no moral obligation to do anything._

I don't think I agree with you, but I understand your point of view, and don't think I can really argue from any sort of objective reasoning.

<comment><USER6> Well, I'm happy to walk you through it if you're game. Let's say the company is an incompetent idiot: that also means they're unlikely to respond well to a well-written vuln report. So what protects the general public the most? The bad guys can find vulns too, and you have no idea if you're the first to find a vulnerability, and we're presupposing the company won't handle it well. The _best outcome_ for the general public is full, immediate, public disclosure in that case!

There are other arguments here, like the fact that random people putting bugs in websites are not entitled to a researcher's time.

<comment><USER8> It's a spectrum, and unfortunately a lot of security researcher just assume that developers at companies are always the bad guys.

<comment><USER6> Do you have any evidence of that claim?

Also, even if it's true, why does the company get to command the researcher's time?

Finally, as a company, you get to mitigate this by having a serious disclosure policy. It helps if you don't look like the bad guys.

<comment><USER8> > Do you have any evidence of that claim?

I'm not going to link to specific github issues but I've seen enough people dropping "vulnerabilities" and yelling at the developers. (I'm pretty sure you know what I'm talking about.) This often gets the developers worked out and gives security people a bad rap. It's a lose-lose situation imo. People need to learn empathy and stop blaming developers.

Of course there are companies that need to be shamed, and that will repeatedly act shady, but too many people use this to excuse their behavior in general.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Looks like the ArtChain site owner is a marketing genius. Get to the HN front page with a blockchain project? Bravo.

<comment><USER10> I know this is irony, but making the joke obvious to the few that might take it seriously: it's not so good to have that visibility when the cause is the author cursing security researchers away because they are trying to delay a couple days your fraudulent CPO by asking you to patch blatantly obvious and basic security holes.

<comment><USER9> Sadly, this is almost a joke - it seems like any kind of visibility works. Most of people just don't care about the context, they just remember the brand name.

</comment></comment></comment><comment><USER11> He still hasn't fixed the XSS name entry, it pops if you go to the site. Amazing.

<comment><USER12> No kidding, just going to [REDACTED] and boom there it is.

With how nasty this guy has been, it's like he's _asking_ for a bad actor to really cause trouble.

I'd be so happy to have anyone file a report like the author did, exposing possible flaws in a platform I operate.

<comment><USER13> Word of warning for anyone clicking that, it currently redirects to Pornhub.

<comment><USER12> YIKES.

I pulled the link, anyone curious can figure out how to reach artchain dot info on their own time.

<comment><USER13> Thankfully SonicWall caught it here, but hopefully nobody's looking at what sites I tried to visit :P

</comment></comment></comment></comment></comment><comment><USER14> From the looks of it, this site hasn't done much in the way of actual business. A handful of transactions 180 days ago, probably the original pieces being loaded up, and then crickets. [https://etherscan.io/address/0xc40cf3abc0166847c16f1f60f3fdf...](https://etherscan.io/address/0xc40cf3abc0166847c16f1f60f3fdf7b952b0cb41) Monograph is a fantastic blockchain art registry, made by Chris Tse, the founder of Cardstack. There are several others that actually demonstrate some of the more novel aspects of this particular use case. [https://monegraph.com](https://monegraph.com)</comment>


FreeBSD starts switch from CVS to Subversion - <AUTHOR> http://www.freebsd.org/news/newsflash.html#event20080603:01 <comment><USER2> Why Subversion? The only reason for using Subversion is that you're already using Subversion; for "new conversions" it's widely agreed that anything _but_ Subversion is the right thing to use.

I don't want to sound cynical, but could FreeBSD be avoiding Git because Linus wrote it?

<comment><USER3> _could FreeBSD be avoiding Git because Linus wrote it?_

No. FreeBSD is avoiding Git because Git isn't capable of handling a project the size of FreeBSD.

As I see it, the major reasons for choosing SVN were (a) it was possible to convert FreeBSD's 14 year old, 1.8GB src repository to SVN and have things mostly work (there are a few bits which didn't convert properly, but nothing major), (b) there are SVN gurus willing to do the work necessary to fix the bits which didn't work, and (c) SVN is the most CVS-like option available.

That last part is quite important, incidentally -- there has been an experiment with using Perforce for a while, but it has been limited by the fact that FreeBSD developers want to code, not waste time learning new VCS systems. SVN looks and acts like a better version of CVS -- for a community of experienced CVS users, it's a very easy tool to learn.

<comment><USER4> I'm not convinced about the perceived difficulty to learn git et al. You and the other FreeBSD developers are OS hackers. You're telling me it's hard for them to learn a dvcs in a few days? Look at all the Rails developers and users. They seem to have few problems switching to git.

<comment><USER5> I don't think that cperciva said that it is difficult to use it. It's not just because DVCS are in fashion that they _must_ be adopted, that's his point.

I'm a happy mercurial user, but that does not make me look down on someone who uses CVS/SVN/Perforce and is okay with it.

<comment><USER4> Neither do i. And i'm not arguing that FreeBSD should adopt git or another dvcs. But the time to learn them is imo not an argument against them.</comment></comment></comment></comment></comment>


Results of the Grand C++ Error Explosion Competition - <AUTHOR> http://tgceec.tumblr.com/post/74534916370/results-of-the-grand-c-error-explosion-competition

<comment><USER2> I am really impressed at the winner of the biggest error. It's incredible how much it produces. Right now I'm testing it and running it through pv to see how many errors it makes. Right now on my machine it's producing errors at a rate of 74MB/s. I never thought I'd look at errors in rates of bytes/time.

<comment><USER3> It errors instantly on MSVC 2013.

        fatal error C1014: too many include files : depth = 1024

<comment><USER2> That actually sounds reasonable to me. GCC producing 230GB of error messages is definitely excessive. If it ever completes I'll update here with the actual final count of the length of the error message.

<comment><USER2> Ok, it's been running all day while I've been working. I don't think it's going to ever complete. I'm at 1.32 TB of output from it. I can't overstate how impressed I am by that. If it completes before I leave then I'll start it again but run it through a compressor and hope I don't fill up my disk. It was large strings of //.//. so i think it should compress well and I'll upload it somewhere for someone to look at.

</comment></comment></comment></comment><comment><USER4> Regehr discussed his submission: [http://blog.regehr.org/archives/1088](http://blog.regehr.org/archives/1088)

</comment><comment><USER5> A dupe of [https://news.ycombinator.com/item?id=7127821](https://news.ycombinator.com/item?id=7127821).</comment>


Ask HN: "Soft" tech career options for future ex-teacher? - <AUTHOR>

I have been a high school English teacher for the last 8 years. Due to a combination of long commutes to suburban high schools, a little burnout, and a growing need for diversity in my working life, I am considering changing careers to something related to the tech sector. Based on my English degree and work experience, I think corporate training or technical writing jobs would best use my existing skill set. For those of you who have experience working in or hiring these types of positions, I would appreciate your advice on how to proceed in terms of upskilling, certification, and how / where to pitch myself.
With regard to training roles, I am already comfortable working with large groups and presenting complex information to novices. However, I don't know how much emphasis is placed on instructional ability as opposed to content / product familiarity. Similarly, both writing and editing are central to my skillset, but I would like to know what other skills may be valuable for  technical writers. For example, I've seen a number of positions calling for front-end web development skills. I have some modest HTML/CSS and LaTeX experience, but are there other specific technologies that I should invest time in learning?
Though I would love to find something before this fall, realistically I expect to start another ten month teaching contract in September. This gives me some time to consider certification programs, MOOCs, or other resources that you suggest. In addition to your thoughts on the specific jobs mentioned earlier, I'm open to suggestions for other roles that might fit my skills. Finally, I'm based in Seattle, so any Seattle-specific advice would be most welcome. <comment><USER2> Since there are many ed-tech companies looking for ex-teachers to provide a pov on their product, you could consider educational consulting or even joining a team where you can code and provide product direction. I would start by joining a meetup in Seattle for Ed-Tech link:([http://www.meetup.com/EdTechSeattle/](http://www.meetup.com/EdTechSeattle/)). This gives you the opportunity to network which you finish up your teaching contract and line up something you would love to do whether it is coding, teaching on a MOOCs platform, or consulting.

Good Luck!

</comment><comment><USER3> I came from teaching high school Algebra with a Political Science degree to being a full-time developer. One of the lovely things about this industry is nobody really cares about the path you took to get here; it's all about whether you understand the problems and can do the work well.

My tech career started by walking into Barnes and Nobles and buying a "for dummies" book on C++. That was a decade ago; these days you have a ton of better/interactive resources at your disposal.

The biggest determining factor is: Do you enjoy this kind of work? If you like it, just keep honing your stills. Finish one class, take another one. See if you can do some cheap work for a few clients to build up your portfolio. Before long you'll be able to look at a hiring ad and say "I can do that!"

If you'd really rather do technical writing or corporate training, those opportunities are there as well. But don't feel limited by your "current" skill-set. NOBODY is born knowing this stuff; we were all in your position once.

</comment><comment><USER4> You could teach students HTML/CSS and whatever else you know in technology. You may want to find high school students at first and see how it goes. Or find another audience if you don't want to work with kids. If it takes off, then come up with an e-book or video course. Good luck!</comment>


Intel with Radeon RX Vega Graphics: Core I7-8809G with 3.1 GHz Base, 100W TDP - <AUTHOR> https://www.anandtech.com/show/12207/intel-with-radeon-rx-vega-graphics-core-i78809g-with-31-ghz-base-100w-target-tdp-overclockable <comment><USER2> Weird how they include an HD 630 on the die. This eats up a fair chunk of die area, and eats into the thermal budget. It also means that the displays will probably be wired to the HD 630, so the Radeon can power down to save power. Taking out the HD 630 could have lowered the power usage to a level more palatable to a laptop computer at full blast.

This means that you have to pay a penalty to use the Radeon to render, but send its framebuffer result back to the HD630 for displaying. This is also the case current Nvidia Optimus or AMD Enduro systems. Draw backs from this approach are frame tear / lack of proper V-Sync and added latency.

If this ends up being used by Apple however, it is likely that a hardware demux will be used to connect the display to both graphics chips, and switch it back and forth on demand. Other vendors don't do this, because it is more expensive, and passing the display from one GPU to another requires the pixel clock rate (among other details) to be shared between the different GPUs, which is not something that the vendor driver (Intel/Nvidia/AMD) stacks support.

Note that such a hardware demux is used in previous generations of MacBook Pros, and it is not publicly documented, which means very poor and/or very late support in Open Source operating systems such as Linux.

Some system builders (Lenovo and Asus have done this, probably others) wire the internal display of laptops to the Intel GPU, and the external HDMI/DP to the discrete graphics. In the past, this allowed you to power more displays (when Intel GPUs were restricted to 2 displays max), and it still allows you to avoid the Enduro/Optimus hassle for external displays, when you are likely to be powering the laptop with the A/C adapter anyway. It also meant that vendor/OEM specific drivers needed to be used in some cases, though.

<comment><AUTHOR> In Windows 10 and Linux, this can be nearly for free without any additional hardware. Linux calls this dma-buf, and Windows 10 basically requires it for any WDDM 2.x compliant drivers: GPU to GPU direct DMA mapping without CPU involvement (directly routed over PCI-E and not through the CPU memory controller when possible).

Basically, it means Optimus style and hardware-muxer style setups are obsolete, and display framebuffer and render framebuffer are entirely disconnected naturally; and also does not require any overt cross-architecture support (ex: Nvidia Optimus support in Nvidia's driver requires explicit Intel support; dma-buf solutions don't).

Presumably, OSX also can leverage this.

<comment><USER2> Sure, but then you still don't have V-Sync, which causes terrible and easily noticeable tearing on almost anything (at least in the case of Nvidia, it seems to be much better with AMD from my annecdotal testing). I doubt Apple would find tearing acceptable on their products, honestly.

<comment><AUTHOR> That isn't related to dma-buf-type usage, though. That would be purely one of the drivers not signalling the end of the frame to the other (since all graphical APIs have suitable methods for this, and WDDM itself natively understands the concept).

Also, in Windows 10, the window manager's compositor (equivalent thereof) does all the event signaling fine; ie, you could easily have a situation where a game is rendered on one GPU, displayed on the other, and the display GPU + monitor has VESA Adaptive-sync enabled, and the game correctly triggers new sync windows as if it had been running on the same GPU.

Does this work in practice? Who knows, but its supposed to, especially with fixes that 1703 and 1709 added.

<comment><USER3> Is this intended/expected to work on desktop setups with discrete GPUs too? I believe Optimus _et al_ were always laptop-only, but some desktop users might care about heat/power/fan noise.

<comment><AUTHOR> It's expected to work. I've tested it on mine, Haswell i7's own iGPU, and a full sized GCN Radeon, with a game rendering on the Radeon but displaying on the iGPU.

Multi-monitor setup with 2 on the Radeon (normally all 3) and 1 on the iGPU, seemed to work fine. No real visible lag either, from what I could tell with limited testing.

</comment></comment></comment></comment></comment></comment><comment><USER4> I wonder if this was designed for an Apple product? Maybe a new iMac or Mac mini?

<comment><USER5> Mac Mini - TDP too high. iMac - Lots of space for CPU + GPU.

We all thought the whole reason of sticking a dGPU close to CPU was because of space, hence a Notebook type machine. But if anyone could enlighten me why I want a desktop with Integrated dGPU rather then CPU+GPU combo which is likely cheaper, and easier to cool down.

Not to mention you are stuck with KabyLake 4 Core instead of the newer Coffee Lake with 6 Core.

<comment><USER6> For the same reason companies make SoCs. It saves money. Intel's idea with EMIB (multiple dies in one package) is to save money by using older semiconductor process for things such as the southbridge (ex: USB) that don't need the latest and most expensive process. This way, they'll also get more value from their investment in previous process nodes.

Routing HBM to the GPU using PCB traces is expensive, and in the low-to-mid end, saving money on PCB and cooling matters. If EMIB is going to be used anyway, why not have the GPU in there as well. With 1024-bit 4GB HBM on package, memory bandwidth won't be a problem, and the i7-8809G will likely be faster than a PS4, which means it'll be good enough for 1080p gaming.

KabyLake was probably chosen because this design was finalized before Coffee Lake. The next iteration will likely have more cores.

<comment><USER5> It only saves money If

1\. It will only make sense if Intel were actually manufacturing the GPU themselves as well. In this case they dont. And EMIB is an Intel specific technology, AMD doesn't use it when they package HBM with their dGPU.

2\. AMD makes a profit before selling it to Intel, and Intel has to make a profits for integrating it with EMIB, i doubt the cost saving of using EMIB together with HBM, if that was true, out done the profits margin of both companies.

</comment></comment></comment></comment><comment><USER7> With a liitle more polishing over this combination, I can see the future: thinnest ultrabook with desktop grade performance and experience; packing a monstrous 4C8T top tier CPU and a high end graphics chipset in an ultrabook is definitely great for everyone. Would have been better if a Ryzen CPU is on the run for me.

This is going to be the future, no, It should have had been!

<comment><USER8> With a 100W TDP, it's going need more than just a 'little more polishing' to be viable for a mobile ultrabook product.

<comment><USER7> Agreed, I must have mistaken ultrabooks and notebooks. But rumor has it this hybrid chip will set its hold on 2018 MBPs. We might see how well it does first hand from Apple.

</comment></comment></comment><comment><USER9> Incidentally, HP is already selling an AMD Ryzen + Vega convertible laptop: [http://store.hp.com/us/en/pdp/hp-envy-x360-convertible- lapto...](http://store.hp.com/us/en/pdp/hp-envy-x360-convertible- laptop-15z-touch-1za07av-1)

I'm waiting for the reviews to come in before making any decisions, but it looks like quite a nice machine.

<comment><USER10> That's a Vega 8-compute units that's fully integrated with the CPU (and both the iGPU and CPU share a single memory controller to DDR4 RAM). The one talked about with the article is a Vega 24-compute units with extremely high-speed dedicated HBM memory. The performance difference would be night and day.

\</comment></comment><comment></comment><comment>-

With that said, I purchased that laptop you're talking about. A brief overview:

1\. Terrible screen: something like 60% sRGB coverage (maybe worse), and it shows with dithering and banding artifacts. Its also noticeably dimmer than other laptops.

2\. Horrible HP Store -- I bought the laptop during Black-Friday, and HP shipped me a bricked laptop. Then they wouldn't replace the laptop because I got a "custom" SSD drive or some bullS!@#!@ excuse. My choices were to repurchase at a "non-sales" price, or get a refund. I opted for the refund and had to wait until the next sale to get a decent price. I suggest you buy from a reputable retailer who has a decent return policy, just in case the computer is broken or some other issue comes up. You do NOT want to be dealing with HP's online store customer service.

3\. Minor default driver issues -- Fullscreen Youtube has occasional glitches and I've had the screen shutoff at least once randomly. Based on other owners: this seems to go away once you reinstall Windows and do some of HP's legwork for them. You should expect to reinstall Windows anyway because of the large number of bloatware (McAffee, Candy Crush, etc. etc.) that comes with the laptop.

4\. AMD Driver Issues -- There's no Raven Ridge version of the latest "AMD Adrenaline" driver set. AMD's driver rollout for this laptop seems to be slow. I figure that as Raven Ridge APUs become more widespread, AMD's driver situation will improve.

5\. Defaults to a Hard Drive -- Why HP? Just... why? But it has an M.2 slot, so its super easy for me to just stick a Samsung 960 Evo in there and fix that issue.

\</comment><comment>-----

Aside from the poor quality screen (which stands out), its a good laptop overall. I think I'll be fine with it. Its got a numpad, the "360" 2-in-1 form factor definitely works, and the Stylus support is great.

The laptop is also fully expandable, with an M.2 slot, SATA slot, and easily accessible DDR4 DIMMs: [http://h10032.www1.hp.com/ctg/Manual/c05819570](http://h10032.www1.hp.com/ctg/Manual/c05819570)

So you can upgrade the laptop to your hearts content. You are going to be stuck with a dim, dithered, banding screen however. Its sufficient for office applications but holy crap the color irregularities are quite obvious. So this laptop's screen definitely can't be used for any serious art (which is a shame, since the Stylus support is so good).

Its definitely a $700ish laptop, with all of the issues that is typical in the $700 price range. (ie: Poor Screens are seriously common at this price range). You'll get very good price/performance and reasonable gaming on the go, since you get 4c / 8threads, a decent iGPU (its not as good as the MX150, but it can play the newest Doom at 720p and Rocket League at 57FPS / 720p).

I guess... the x360 as purchased isn't a very good laptop. But its actually very easy to turn it into a good laptop (aside from the screen). Reload Windows, fix up the drivers a bit, stick an M.2 SSD in there and its actually great.

<comment><USER9> Thanks a million! I've also had a mediocre experience with a previous generation x360. It is frustratingly close to being a very good machine in my opinion if just a few details were of higher quality. But I suppose it couldn't be quite as cheap that way.

</comment></comment><comment><USER6> I suppose this marks the death of low-end discrete GPUs.

<comment><USER11> That's a good thing. Low-end GPUs suck anyway, but add so much weight and power consumption.

<comment><USER12> Once someone goes to the $70 GPU the argument starts to fall off. Sure the sub $50 cards are only worth it for someone that just wants another monitor (BUT buy a display port card and monitors)The value to performance of these $50 cards is low.

Looking at a GTX 1030 this $70 card's performance to value improves greatly. It has the same performance as a AMD 480. [https://www.newegg.com/Product/Product.aspx?Item=N82E1681413...](https://www.newegg.com/Product/Product.aspx?Item=N82E16814137140&cm_re=gtx_1030-_-14-137-140-_-Product)

<comment><USER13> Did you mean something else? After a quick look a 480 has around twice the performance. Nearly bought a 1030 ;)

<comment><USER12> 460!!!! I made a mistake :(</comment></comment></comment></comment></comment>


Is this a new high or low for XKCD? - <AUTHOR> http://www.xkcd.com/591/#

<comment><USER2> Actually 4chan.org/b/ took it and changed its name to "Twilight Appreciation Station - The darkest place on the internet — for vampire compatriots."

<http://img.4chan.org/b/> :)

</comment><comment><USER3> New high, that comic is a hilarious idea.

<comment><USER4> I like the pimples on the troll. Subtle, very subtle.

</comment></comment><comment><USER5> High. Definitely a high point. ;)

</comment><comment><USER6> The ultimate revenge, wonderful.</comment>


Show HN: Sentiment analysis of Programming communities on IRC - <AUTHOR> http://ircnommer.co.uk

<comment><USER2> You might notice that data for '#Python' is not available because the python guys are mean and banned us straight away. Sadface :C

<comment><AUTHOR> "Cautious of privacy" is not really mean ;)

</comment></comment><comment><USER3> v cool.</comment>


Discovering Critical Vulnerabilities Affecting Macs, iPhones, and iPads - <AUTHOR> https://semmle.com/news/apple-xnu-kernel-icmp-nfs-vulnerabilities <comment><USER2> Isn't this just a super-vendory marketing version of the blog post Kevin himself wrote about the ICMP vulnerability earlier this week?

[https://news.ycombinator.com/item?id=18349942](https://news.ycombinator.com/item?id=18349942)

Note that Kevin himself did not claim he had managed to get code execution from this vulnerability, but rather that he'd just verified heap corruption. (In terms of evaluating the vulnerability, yes, you should assume kernel heap corruption is morally equivalent to RCE. In terms of evaluating bragging rights, which is what this Semmle post seems to be about, the difference is pretty large.)

</comment><comment><USER3> I've played with Semmle's product, which I think is called QL now, and I was very impressed. It's a way to write queries about your code, like "show me lines where the address to a non-packed struct is passed to fwrite() or send()," for example.

clang-query might be conceptually similar (and open source), but QL has some sort of graph database captured at compile time that is extremely fast to query. QL's DSL may also be more intuitive and/or sophisticated than clang's, but I haven't used either in a while.

Unless they've extended it since, QL does not actually simulate execution, so it cannot find some of the same bug patterns that other analyzers can.

<comment><USER4> The dataflow analysis libraries in QL have significantly improved since 2015, and were used to find the ICMP vulnerability mentioned in the article. See the blog post for the query used. [1]

Dataflow analysis is a form of execution simulation that estimates the flow of control and data from one part of the program to another. Of course, there are many forms of simulation, and they vary in accuracy and the expense of computing them.

[1]: [https://lgtm.com/blog/apple_xnu_icmp_error_CVE-2018-4407](https://lgtm.com/blog/apple_xnu_icmp_error_CVE-2018-4407)

</comment></comment><comment><USER5> I don't understand. Isn't Mac OSX "Secure By Design" (that's what they say on their website). How can some ICMP packet take control of every platform they make? Isn't Mach a Microkernel?

</comment><comment><USER6> Is this a static analysis engine essentially?

Does anyone have good recommendation for static analyzer focused on security specially. Any that really works for java code?

<comment><USER7> Disclosure: I'm the founder of Semmle. As noted above, this conversation is a dup but I wanted to answer the questions that came up. Semmle's core technology is an engine for variant analysis - finding all instances of a mistake that led to an incident, especially for security. Here's how Microsoft uses Semmle: [https://blogs.technet.microsoft.com/srd/2018/08/16/vulnerabi...](https://blogs.technet.microsoft.com/srd/2018/08/16/vulnerability- hunting-with-semmle-ql-part-1/) . The engine does support inter-procedural data flow analysis and simulates execution in that sense. For examples of such data flow analysis on Java, see [https://lgtm.com/blog/apache_struts_CVE-2018-11776-part2](https://lgtm.com/blog/apache_struts_CVE-2018-11776-part2).</comment></comment>


Dropbox disables ASLR on Windows - <AUTHOR> http://codeinsecurity.wordpress.com/2013/09/09/installing-dropbox-prepare-to-lose-aslr/ <comment><USER2> ASLR = Address Space Layout Randomization

[https://en.wikipedia.org/wiki/Address_space_layout_randomiza...](https://en.wikipedia.org/wiki/Address_space_layout_randomization)

<comment><USER3> Thank you! Search engines are spoiling us. Entire article about an acronym that doesn't bother decyphering or explaining it.

<comment><USER4> I'm surprised that more people don't wrap such acronyms (or abbreviations) in <ACRONYM> or <ABBR> tags (at least the first time it's used in a page or article).

<comment><USER5> Some wiki software even does that automatically! [http://wiki.php.net/rfc](http://wiki.php.net/rfc)

<comment><USER4> There are issues with doing it automatically though: [http://boston.conman.org/2003/11/19.2](http://boston.conman.org/2003/11/19.2)

</comment></comment></comment></comment></comment><comment><USER6> "Dropbox" and "Security" are pretty much opposing terms. Remember this is the same company that when faced with a login bug, chose to disable password authentication so that anyone could log in as anyone else instead of shutting the service down until it was fixed.

<comment><USER7> Name one company that's gone out of business because of a security problem, or even had their business significantly impacted. I can't. I'm sure if you dig you could find one, but I'm not aware of one off the top of my head.

Until this sort of thing matters to users, nothing will change.

<comment><USER8> Let's see...

TJ Max, UBS, Knight Capital, Heartland Payment Systems, Visa, Sony (already mentioned, but it's my fave), Stanford, Countless other hospitals, e-commerce vendors, banks, and other organizations that handle payment or personal information.

If you want to say "name a startup that's gone out of business because of a security problem" I'll let you away with that. There's still instances, and I'd love startups to pay more attention to security, but I know reality as well...

<comment><USER9> What was Knight Capital's security problem?

<comment><USER8> Last year when KC shot themselves in the face, they were running trading algos that hadn't been well tested. When dropped into production, things blew up fairly quickly.

I probably should have left it off the list, it's more of a compliance/procedural issue than purely infosec.

</comment></comment></comment></comment></comment><comment><USER10> > Update: Brad "spender" Spengler (of grsec fame) has noted that the latest > version of Dropbox has ASLR enabled for the 64-bit DLL, but still doesn't on > 32-bit.

For those particularly worried.

Still disturbing, but this seems to point to technical concerns.

<comment><USER11> Does ASLR do anything for the 32-bit address space? It seems like you could enumerate it and find libc in a few seconds. I am mostly talking out of my ass here, as I am no expert on these subjects.

<comment><USER12> If you can execute code, you could certainly do that, even on 64 bit.

The problem is executing code in the first place. There are other mechanisms in place that can prevent a crash to turn into direct code execution (NX-bit). To circumvent those, you can use Return Oriented Programming (ROP), where you prepare the stack such that you jump into a loaded library or other (completely innocent!) code in memory. The problem then is that you need to know where the code you want to jump to resides in memory, and thats where ASLR comes in. With ASLR, modules are randomly allocated in memory and an attacker can't predict where code he wants to jump to resides at.

(ROP is a pretty fascinating topic in itself. The problem is essentially that you are given a bunch of assembly, and your task is to figure out how to use, combine it into _gadgets_ that emulate generic computing functionality (pop a value from the stack, push a value to the stack, call a function, ..) such that you can build your shellcode from those gadgets)

</comment></comment></comment><comment><USER13> That's very bad. It's been a long battle to stomp out ASLR-breaking modules from browsers. Vendors who do this undermine all of that.

</comment><comment><AUTHOR> Comments from /r/netsec thread here: [http://www.reddit.com/r/netsec/comments/1m25gi/installing_dr...](http://www.reddit.com/r/netsec/comments/1m25gi/installing_dropbox_prepare_to_lose_aslr/)

</comment><comment><USER14> I know very little about ASLR. Anyone care to comment on possible reasons why Dropbox would disable it?

I find it hard to believe that this is a deliberate attempt to weaken client- side security, so its more likely that they are using some legacy code that is somehow incompatible with ASLR. But ASLR has been in Windows since 2007, pre- dating Dropbox by about a year, so they either developed ASLR-incompatible code after the feature was live or the problem is in a third-part component.

Any other explanations? What problems can ASLR cause?

<comment><USER15> if a single dll loaded by dropbox hasn't been compiled with /DYNAMICBASE to instruct the OS to allow ASLR, Dropbox will have some reliable memory addresses available to an attacker, often defeating the purpose of using it on anything.

Perhaps they're using an old or unusual linker?

<comment><USER14> I understand about the /DYNAMICBASE flag, but I has hoping to understand why they would choose to not set it.

My assumption is that they disabled it for stability/reliability reasons that are specific to their application, and I was further hoping to understand what kind of bugs could be triggered by having ASLR enabled. I've written plenty of C and C++ over many years and can't think of any bugs that I've introduced or found where assumptions about address place layout were involved.

Since we're talking about Windows, I assume they're using Visual Studio and its linker.

</comment></comment></comment><comment><USER16> Why is it even possible for DLLs/applications to disable ASLR by themselves, shouldn't that be decision for the OS or admin?

<comment><USER17> > Why is it even possible for DLLs/applications to disable ASLR by themselves

Compatibility with old apps. There is software out there in the world that relies on the address space not changing, either deliberately or due to bugs. You could argue that they shouldn't do that, but people get pissed when their stuff doesn't work with the new Windows. The most cautious thing they can do for these apps is make it opt-in. (I believe the default may be different for amd64? Not sure..)

> decision for the ... admin

I believe the policy is also a system setting, and maybe even you can override the value in the PE header this way.

</comment></comment><comment><USER18> Interesting. The option /DYNAMICBASE seems to be the default (to support ASLR). Which means they explicitly disabled it. Wonder why? Are they doing something that needed ASLR to be off?

<comment><USER19> We have an application that builds with a variety of misconfigured options (by modern standards). We fix 'em when we see 'em.

It's a result of upgrading from VC++4, to VC++5, to VC++6, to VS2003, to VS2005, to VS2008. They're set by the project upgrade wizard, for compatibility reasons.

Which is not to say that Dropbox didn't manually set the flag, I'm unsure if /DYNAMICBASE is set or unset for the sake of compatibility.

</comment></comment><comment><USER20> So it doesn't disable ASLR outside of this dll, right? The process is already loaded; it can't un-randomize.

<comment><USER13> It doesn't need to. The attacker can just target the dropbox DLL now, which is more than enough to execute a payload. Having 1 module inject itself without ASLR means you may as well not be running ASLR on the process at all.

<comment><USER20> Not everything is equally exploitable.

<comment><USER13> It is when the non-ASLR Dropbox dll is injected. That's the point.

<comment><USER21> I think the point was that the attack surface of the Dropbox DLL is not necessarily the same as the attack surface of an entire web browser running without ASLR. Do you have reason to state otherwise, or are you just trying to say that you think the Dropbox DLL is so full of vulnerabilities that it would always be the easiest attack vector even for a process that didn't use ASLR at all?

<comment><USER22> I think the idea is to still find your vulnerability in the browser as usual, but abuse the unrandomized Dropbox DLL for executing the payload.

So, the DLL isn't directly attacked. It's simply used to circumvent ASLR.

<comment><USER20> Abusing it _how_ , though? Trying to piggyback on a return opcode is one method that would work, certainly, but if you're using a narrow exploit you don't get to be very choosy, and there are many attacks that require very specific known-address code. Losing ASLR on a single DLL is not nearly as bad as losing it on all DLLs.

<comment><USER23> Losing ASLR on a single DLL does provide that very specific known-address code.

<comment><USER20> >Losing ASLR on a single DLL does provide that very specific known-address code.

I don't know how to respond to this. The word 'specific' means something. If your exploit needs a certain sequence of code, and the little dropbox hook doesn't have it, then the exploit's not going to work.

<comment><USER23> Yes, you are right - if dropbox doesn't have it then it won't work. But you imply that it most likely won't have it. And what myself and perhaps others are saying is it most likely will.

The DLL in the blog post is listed as 128KB, out of interest I looked at it separately and I see a .text section with a size of 0x132df bytes. That section will be mapped as executable and every byte in it is potentially useful. Intel doesn't require instruction alignment, has variable length instructions, and several different opcodes map to the same instruction in some cases. The probability of not finding the instruction sequences you need to successfully land an exploit is almost nil.

Additionally, this is loaded in a browser. The hardest part about browser exploits these days is defeating ASLR. Finding DLLs that aren't compatible with ASLR that can be loaded has been one of the main methods of defeating it.

Successful exploitation often requires chaining several vulnerabilities together to get what a single vulnerability would even a few years ago. Anything that can easily be leveraged in that chain is a problem and needs to be addressed.

<comment><USER20> >The probability of not finding the instruction sequences you need to successfully land an exploit is almost nil.

I don't know about that. Ignoring the mapping of opcodes for a moment, 128K random bytes will probably not have any particular three-byte sequence, and almost definitely won't have anything longer. And opening the DLL it appears to have vast quantities of 00, FF, and CC. There is a lot of repetition, lowering the attack surface.

I'm willing to bet that if you restrict yourself to attacks that need specific instruction sequences, and not just a return opcode, a healthy majority will fail on this dll.

I agree that this is a problem, but that's largely because some attacks can work with nearly any function. It's still a lot less of a problem than turning off ASLR entirely.

<comment><USER24> Well, it's not 128k random bytes, a large chunk of that is compiled executable code. That weights things very much towards sequences of opcodes that achieve something when executed.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER25> It seems like git-cheetah and the 7-Zip shell extension exhibit the same problem. MinGW doesn't enable ASLR by default, which might be the reason for that.

</comment><comment><USER26> how about less acronyms?

<comment><USER27> >how about less acronyms?

Or, better, how about _fewer_ acronyms?

<comment><USER28> That's a rather US-centric remark.

'less' is an acceptable comparative for both countable and uncountable nouns in all modern dialects of English _except_ for US-English, where it's strictly expected that fewer be used for countables.

Perhaps caiob is from the UK, Australia, India, South Africa, New Zealand...

<comment><USER29> It's not acceptable in the UK: [http://www.telegraph.co.uk/news/uknews/2659948/Tesco-to- ditc...](http://www.telegraph.co.uk/news/uknews/2659948/Tesco-to-ditch-ten- items-or-less-sign-after-good-grammar-campaign.html)

<comment><USER28> Hardly sounds definitive. From your link:

"There is a debate about whether the word should be 'less' or 'fewer'," a campaign spokesman said. "Saying 'up to ten items' is easy to understand and avoids any debate."

and

A Tesco spokesman said: "The debate about what is right has been going on for years now, and I still don't think we know if 'less' or 'fewer' is correct."

</comment></comment></comment></comment></comment><comment><USER30> I have always suspected dropbox was a rootkit trojan. Ever since the founder said that it was open to sifting through users data for copyright violations.

<comment><USER31> Citation Needed.

<comment><USER32> This is the closest thing I could find googling for 45 seconds:

[http://www.pcworld.com/article/226280/dropbox_a_file_sharers...](http://www.pcworld.com/article/226280/dropbox_a_file_sharers_dream_tool.html)

[https://news.ycombinator.com/item?id=2483053](https://news.ycombinator.com/item?id=2483053)

</comment></comment></comment><comment><USER33> What's most worrying about this is that Dropbox is injecting itself into processes like NotePad++ and Firefox that have nothing to do with shell extensions.

Either this is lazy coding, or there is some malicious intent to spy.

<comment><USER34> They use the standard file open dialog, which in turn supports shell extensions.</comment></comment>


Recycle That Headquarters - <AUTHOR> http://www.newyorker.com/culture/culture-desk/recycle-headquarters

<comment><USER2> The drone video of Apple's new headquarters is impressive. Apple will be annoyed about that; they put up 10 foot high chain link and green cloth fences around the whole project so people couldn't look in.

The project, which is in its excavation, foundation, and retaining wall stage, is amusing. They have a really tidy excavation contractor. There's an excavated area under the whole building about three stories deep. It's mostly for parking, but one can speculate about secret underground labs.</comment>


Air transparent soundproof window, paper in comments - <AUTHOR> https://www.youtube.com/watch?v=VZ36PqHT9iw <comment><AUTHOR> paper: [http://aip.scitation.org/doi/pdf/10.1063/1.4902155](http://aip.scitation.org/doi/pdf/10.1063/1.4902155)

</comment><comment><USER2> awesome!</comment>


The Olognion – Exquisite tech news - <AUTHOR> https://www.theolognion.com/ <comment><USER2> The one thing every "the Onion, but for X" site ends up demonstrating is just how talented the people who write for the Onion are.

</comment><comment><USER3> If there's one thing we need, it's more satire about tech hotness and the relentless chase for the bleeding edge (yeah, just don't mind that you're bleeding).

The headlines on this site right now look good. I'd need to see more content to decide how good it'll stay or how much better it can get. I hope the publisher is able to continue this and also get contributions from many other people.

</comment><comment><USER4> "DevOps is a conspiracy by major tech companies. The goal was to save money by transferring the tasks of system administrators and network specialists into the area of responsibility of common software developers"

...I thought this was meant to be satire!

</comment><comment><USER5> To save people the effort of clicking the link: it's satire.

It's as though The Babylon Bee or The Onion were to focus on tech and startup news.

</comment><comment><USER6> That name is incredible.</comment>


Ask HN: Why does YouTube not offer a download button? - <AUTHOR> Obviously there are many ways to do it (third party web services, plugins, etc.), but I guess the outcome is a bigger attack vector for users that download questionable stuff to do it anyway. <comment><USER2> If someone downloads a video, they won't go back to YouTube to re watch it, thus not seeing more ads.

</comment><comment><USER3> Ads, most probably.

</comment><comment><USER4> They allow download of videos in their apps in selected countries. I don't think you can share the actual files though. But the feature is great.

</comment><comment><USER5> And licenses, and lawsuits, and headaches and...

</comment><comment><USER6> Because musicians still get paid by the sale or play (like radio).

It was far cheaper to treat streaming like radio, so YouTube scans uploads for music and pays money to musicians for each play.

If youtube encouraged downloading, there would be no easy way to count the number of plays of music or pay musicians, which would lead to lawsuits galore.

</comment><comment><USER7> Just use youtube-dl, mpv even integrates with it nicely.

</comment><comment><USER8> Because you wouldn't need to visit the site, view ads, etc.

</comment><comment><USER9> As others said, there would be no need to go back to Youtube.

</comment><comment><USER10> It does, in countries that have poor internet connections.I did have the option to download videos, when in India.

</comment><comment><USER11> They want to monetise your eye balls.

</comment><comment><USER12> [https://support.google.com/youtube/answer/6308116?hl=en](https://support.google.com/youtube/answer/6308116?hl=en)

 _Download videos and playlists to watch offline for up to 30 days when you aren't connected to the internet._

<comment><USER13> ... for _Red_ (paying) members only.

</comment></comment><comment><USER14> Youtube is constantly on the knife-edge of being sued en masse by large media owners, as they were by Viacom. It's why their copyright strike system seems "broken," when it's really operating as intended, giving copyright holders arbitrary power to remove content they feel is infringing (without regards to fair use) because anything less would probably lead to those companies to simply prefer to sue Youtube into oblivion.

Technically speaking, of course Youtube could have a download button, but if they did, as far as the Viacoms of the world are concerned, they're just enabling piracy, and taking control away from content owners.

<comment><USER15> YouTube might be owned by someone that could keep them from being sued to oblivion though.

<comment><USER14> But it worth the money for Google to alienate media companies and potentially lose revenue from licensed content to give non-paying[0] users a slightly more convenient way to do something they could already do?

[0] As mentioned elsewhere, Youtube Red subscribers get the option to download content for 30 days.

</comment></comment></comment><comment><USER16> Aside from what is already mentioned in other posts, there would be logistic concerns to enable downloading in a large scale.

By assuming the content will be watched by a human, they can throttle buffering to transfer only what's needed for human consumption, thus spreading out the network load.

<comment><USER17> That's much more easily done client-side. And having downloaded videos from them at full speed, this appears to be how it's implemented as well.

<comment><USER16> The throttling is done client-side, yes. But it's a numbers game - if you enable "official" direct unthrottled downloading, this would bypass the client throttling, effectively increasing network requirements.

Of course, this is just a side point - the strongest reason is likely to be either that YT has a strong incentive to keep users in the site/apps for ad display and engagement (related videos, etc), or that they are unable to do so due to some sort of business deal.

My opinion is that - even if they're not bound by any deal that would forbid them to do so - they would not officially support (much less encourage at any level) direct downloading, because the ads/engagement reason alone is strong enough.</comment></comment></comment>


Bitcoin is teaching libertarians everything they don't know about economics - <AUTHOR> https://www.washingtonpost.com/news/wonk/wp/2018/01/08/bitcoin-is-the-new-middle-ages/ <comment><USER2> Not a libertarian nor a bitcoin fan, but I have to disagree with OP. First, he postulates a gedankenexperiment where bitcoin replaces the dollar, but since it tends to appreciate in value, no one actually spends their money, so the economy halts. This train of though obviously neglects the fact that, if it actually replaced the dollar, people would _need_ to use and spend their bitcoins, so its price action would be very different to what we have seen.

Then he goes and mocks the idea of having a trustless currency system but IMO he misunderstands the idea. If you use the currency for exchange you still have to trust other people, for instance if I use bitcoin on Amazon, I'd still need to trust Amazon and possibly some other merchant. The part of trust you are taking away is not between people, but towards the ability of the State to issue money and regulate its value. But then libertarians may come up with some other ways to achieve this that do not involve cryptocurrencies. Furthermore, you don't need to be a libertarian to agree on that principle. One example of this is Chilean Central Bank, which -unlike the FED and by the Chilean constitution- cannot buy the government's debt, so the government can't just keep printing money for political reasons, like many countries in the region have been doing for decades.

So whatever lesson he is trying to teach seems a bit farfetched. Bitcoin may die and not mean a single thing for libertarianism, because IMO it's success depends on technical implementation, not ideological barriers.

<comment><USER3> > he part of trust you are taking away is not between people, but towards the > ability of the State to issue money and regulate its value.

Not 100% complete. You are also taking away the requirement that the seller trust the buyer. Assuming of course that both the buyer and the seller are willing to wait for the transaction to clear before delivering the product.

You are correct though, that it does not take away the need for the buyer to trust the seller.

<comment><USER4> Unless and until the asset and entire supply chain you are using is also somehow trustless, which I admit is contrived, but also interesting to think about.</comment></comment></comment>


How to win friends and influence people - summary - <AUTHOR> http://www.notesofintelligence.com/influence/basic-summary.html

<comment><USER2> Why, why, WHY does it seem that everyone wants to boil life's little gems into soulless powerpoint slides???

[<http://www.edwardtufte.com/tufte/powerpoint>]

The boiled down life's lessons in a minute essentially suck the nectar, the subtle and gentle breeze of a late spring reading out and leave us with a husk, a shallow shell.

Trying to extract real context out of a summary of "How to win friends and influence people" is like saying Michelangelo was this artist dude who made a naked man statue he called David. and leaving it at that.

Go read the book. I did. It changed how I interact with people. The book is genuine, its not a quick fix instant gratification job. It is about how other people do matter and how we can help them help us by understanding their needs, their desires. Dale's book is about recognizing how you interact with others and how to make fundamental changes in yourself to be stronger socially.</comment>


The complicated Kafka release process - <AUTHOR> https://cwiki.apache.org/confluence/display/KAFKA/Release+Process <comment><AUTHOR> I post this as an example of a major project's release process in hopes of spurring some discussion about what should and should not be a good release process.

Please note that my goal is not to criticize Kafka - which has a lot of history and accumulated technical debt - but rather to get some perspective on what should be best practices for managing releases in our new and shiny age of DevOps.

For the record Kafka is great and I've used it in production, so they are clearly doing a lot of things right.</comment>


The Swift Algorithm Club - <AUTHOR> https://github.com/raywenderlich/swift-algorithm-club#welcome-to-the-swift-algorithm-club <comment><USER2> This seems to have gained a lot of traction and it's getting more support:

[https://www.raywenderlich.com/135533/join-swift-algorithm- cl...](https://www.raywenderlich.com/135533/join-swift-algorithm-club)

</comment><comment><USER3> Shameluss plug. Here's a Scala one I try to maintain: [https://github.com/pathikrit/scalgos](https://github.com/pathikrit/scalgos)</comment>


X86-64 machine level programming [pdf] (2005) - <AUTHOR> http://ecee.colorado.edu/ecen4553/fall12/asm64-handout.pdf <comment><USER2> Having taken up x86 assembly coding again after many, many years (last time was on a 486, really), I find 64-bit assembly _much_ easier to get started with compared to 32-bit: Simpler calling convention (on UNIX, at least), no segments, more registers, etc. If anyone is starting out, this is a pretty good time to do so.

<comment><USER3> Learning x86 (Intel) assembly is definitely something I've been interested in, as someone who inexplicably enjoys writing C code. But PDFs like this one are all I can really find, which are a bit daunting and intimidating.

<comment><USER4> It's not that bad. I usually start small:

\- Write a program that just returns, or halts;

\- Write a program that prints something or blinks an LED;

\- Print numbers 1-10;

\- Handle some input, using function calls.

\- Write some data structure (binary tree or hash table). Or maybe get an MMU working, and handle a system trap.

... working your way up to writing a context switch handler, for a coroutine or threading system, of course :-)

... at that point, you're off to the races. Mostly I try to get the toolchain a debugger working reliably in the first step, and everything just builds on that.

</comment></comment></comment><comment><USER5> Man. First with x64 assembly did Intel catch up with where Motorola was over 2 decades ago with their 68k series.

Lack of registers (and a logical organisation of those) and the boilerplate load/unload pain that caused when trying to write any non-trivial code was why I just stopped doing assembly when I moved to the Intel platform.

Such a shame they didn't address this earlier.

<comment><USER6> The "x64" instruction set was produced by AMD, not Intel. This is why you frequently see the architecture referred to as "amd64".

</comment></comment><comment><USER7> This 2005 PDF is supplemental material for an old edition of "Computer Systems: A Programmer's Perspective" by Randal E. Bryant and David R. O'Hallaron. The 2015 edition of the book includes an updated version of this x86-64 content in Chapter 3, replacing the IA32 content and no longer a just a supplement. I strongly recommend owning a copy of this book if you have any interest in systems programming or just want to be exploit hardware characteristics for better performance in your userspace applications.

I took the class this book is written for, taught by the authors. They don't place emphasis on being able to write assembly, since this is not a useful skill for the majority of programmers. Instead, the goal of this material is to get you to understand assembly and compilation well enough to 1) reverse engineer it if you need to for debugging or security reasons, and 2) be able to write compiler-friendly code, meaning code that can be safely translated into efficient assembly instructions (compilers are conservative, they only optimize when it's certain there's no repercussions).

</comment><comment><USER8> That started out fairly nice, but then they used AT&T assembly syntax, which made it worthless.

But opinions aside, it does look like a nice reference and exercise piece.

<comment><USER9> > they used AT&T assembly syntax, which made it worthless

This is so silly. The two assembly syntaxes are equivalent and include just as much information. It doesn't make much to mentally flick between the two.

<comment><AUTHOR> While they are the same, Intel is much easier to read.

<comment><USER10> this is an older version -- the actual book this is excerpted from uses Intel mostly now (the canonical CSPP book) and also has many revisions to 'modernize' it, such as reducing the x86 sections in favor of x64</comment></comment></comment></comment>


The Best Pieces of Advice for Entrepreneurs in 2015 - <AUTHOR> http://firstround.com/review/the-30-best-pieces-of-advice-for-entrepreneurs-in-2015/ <comment><USER2> As a start up founder, all these points are correct, but this list is pointless. These are things that you need to experience to understand. Just reading them has zero impact.

</comment><comment><USER3> I haven't worked my way through the entire list yet, I might do that later but I would like to comment on the first "practise" if you don't mind:

>> Radical Candor. Basically, bosses need to tell their employees when they're screwing up, but it very rarely happens.

You know what. I have seen many instances of "bosses" screwing up big time, but somehow we seem to think that the "creative work place" is a one way street where only "bosses" seem to be capable of advising their employees. Silly.

<comment><USER4> Bosses don't make mistakes. Only patterns of mistakes.

</comment></comment><comment><USER5> "I would argue that criticizing your employees when they screw up is not just your job, it's actually your moral obligation."

This idea lacks wisdom. It's well known that you can criticize the behavior but if you criticise the person then you destroy the relationship. So, wrong. Very.

</comment><comment><USER6> I am still mystified every time I see one of these totally content-free word salad[0] buzzword explosions from First Round on the front page.

[0] [https://en.m.wikipedia.org/wiki/Word_salad](https://en.m.wikipedia.org/wiki/Word_salad)</comment>


A Vim Primer - <AUTHOR> http://danielmiessler.com/study/vim/

<comment><USER2> Nice link. Since switching back to Linux recently, I have started playing with Vim, and this is a helpful article.

</comment><comment><USER3> This is super useful! Thanks.</comment>


Ask HN: Thoughts on side-project? - <AUTHOR>

My wife and I have been working on it for a few months in our spare time and have ironed out a lot of the last-minute changes/bug-fixes recently.  The website is www.realityblock.com and we actually have not shown this to anyone just yet.
We both are huge reality TV fans, but we noticed there truly wasn't one major community or site that drives social discussion and news content for reality shows.  We figured we could try and create one and give a unique experience.  After looking at Wordpress and test-driving Drupal for a while, we decided to start from scratch and build our own custom system.  The idea was to apply it to a niche subject that caters to both of our interests for a testing ground.  The whole idea behind it was to try and create something new and original, learn a full technology stack, and just get to work and create it.
The major thing that sets apart our site from any other random social-news site is probably our live-commenting system.  It's engineered to be single-threaded in order to handle incoming new comments properly.  This allows a reader to not have to refresh the page in order to get the latest comments.  The other goal of this also is to have seamless episode discussions as its being aired on TV.  Also, at the moment we prefer to not have any ads.
There are a lot of features that are left to be developed down the road, but we wanted to get the basics complete.  I'm not a professional web developer or freelancer, so this is truly my first website.  If you have any questions about the technology stack or anything at all, let me know.  Thanks for any thoughts or suggestions. <comment><USER2> Question:

 _we actually have not shown this to anyone just yet_

Did you at least iterate this with people before going out to build it?

Feedback:

The site design could use improvements. I'm at a lost on what the site is about if I didn't actually read what you wrote here. That said, not only is the messaging not clear, it doesn't indicate to me why I would register an account (no visible discussion forums, etc) or what I can even do on the site.

And launching with potentially tacking multiple shows (assumption base on what is written above) is very scattered and unfocused. I would recommend focusing with a handful (maybe even one) show, and capturing the community with that and then expanding. There are fan sites (not exactly your angle) that do this and do extremely well.

EDIT: I noticed the dropdown only covers two shows for now but I strongly recommend starting with one.

<comment><AUTHOR> Thanks for the feedback. No, we havent taken this yet to any particular fansite or community yet. The building it was primarily driven from noticing scattered communities all still on traditional style forums.

I do agree it would play best if we go with one or a few shows initially and try and attract some of its currently existing communities. I definitely agree also that the site needs a better indication as to what its all about and why someone should register/login.

The dropdown on the main page is driven off of what topics exist for shows currently.

Thanks again for the feedback and gives a general direction on where to focus my efforts this next week. Cheers!

</comment></comment><comment><USER3> I'm interested in the technology stack. What are you using?

You're not a developer at all or you're not a web developer?

</comment><comment><USER4> Nice work on your first website. What kind of feedback are you looking for? There's a ton to discuss :)

<comment><AUTHOR> Thanks! Feedback of any kind is great to hear honestly. Overall, the concept of a news/live-comment system is what we were focusing on. I believe content- driven sites are a great way to get into web development, but also wanted to introduce something new that wasnt just another blog built on a free template. The subject matter is merely a product of being within our interest and we can drive content enough until the site gains traction.

Overall, I realize its tough to gauge with no activity and a wealth of articles/comments to review. I plan to spend some time trying to gain interest in this from active communities as well as make the sites message, intent, and value clearer on the front page.</comment></comment>


What Is 10 Trillion Times More Powerful Than A Heartbeat? - <AUTHOR> http://www.npr.org/blogs/krulwich/2013/07/17/202939390/what-is-ten-trillion-times-more-powerful-than-a-heartbeat

<comment><USER2> "The Hitch Hiker's Guide to the Galaxy notes that Disaster Area, a plutonium rock band from the Gagrakacka Mind Zones, are generally held to be not only the loudest rock band in the Galaxy, but in fact the loudest noise of any kind at all. Regular concert-goers judge that the best sound balance is usually to be heard from within large concrete bunkers some thirty-seven miles from the stage, whilst the musicians themselves play their instruments by remote control from within a heavily insulated spaceship which stays in orbit around the planet - or more frequently around a completely different planet.

Their songs are on the whole very simple and mostly follow the familiar theme of boy-being meets girl-being beneath a silvery moon, which then explodes for no adequately explored reason.

Many worlds have now banned their act altogether, sometimes for artistic reasons, but most commonly because the band's public address system contravenes local strategic arms limitation treaties."

</comment><comment><USER3> >The Kiss concert in Ottawa was, says David, "17,000 times louder and ten trillion times more powerful than a heartbeat."

Can anybody convert this to libraries of congress for me? Or perhaps elephants standing on a postage stamp?

<comment><USER4> [http://futureboy.us/frinkdocs/index.html](http://futureboy.us/frinkdocs/index.html)

Try this.

</comment></comment><comment><USER5> "that's roughly the sound of the volcano that erupted in Karakatau, Indonesia in 1883 and was heard 3,000 miles away. In these drag races, the sound is trapped in the automobile."

Wrong. This all depends on how far are you standing from the sound source. Probably the car audio is much less powerful than the volcano, only the mic is closer.

</comment><comment><USER6> Now I want to go and find one of these drag events, so I can experience it. Further curious I was searching and found this chart...not sure of the accuracy. [http://www.makeitlouder.com/Decibel%20Level%20Chart.txt](http://www.makeitlouder.com/Decibel%20Level%20Chart.txt)

<comment><USER7> The world's 'Quietest Room' is omitted:

[http://minnesota.publicradio.org/display/web/2012/04/03/dail...](http://minnesota.publicradio.org/display/web/2012/04/03/daily- circuit-quiet-room)

</comment></comment><comment><USER8> I have an associate who's big into these competitions. I've never checked one out, a mutual friend did though. He said it freaked him out, that the force of sound was so powerful he felt like he couldn't breath.

<comment><USER9> Yeah, breathing difficulty is listed as one of the effects of sonic weapons:

[http://en.wikipedia.org/wiki/Sonic_weapon](http://en.wikipedia.org/wiki/Sonic_weapon)

</comment></comment><comment><USER10> I was at kiss within the last two weeks and you didn't hear the music, you felt it as your hearing slowly failed. I forgot to bring earplugs, something I would never recommend, and I could hear not a thing at the end of the concert.

Thinking of something so loud that it makes objects move.... nope.

<comment><USER11> Well, it's not hard to make things move with sound. I'll bet there was a good amount of wind being generated by the speakers at that concert, and indeed every concert. My home stereo system can blow papers around if I set those papers right in front of the subwoofer. The speakers in my car and blow papers around if they're laying on the floor.

Speakers move air. That's what they do. Making objects move is a simple as them being light enough to blow in the breeze or vibrations created.

<comment><USER12> There's a subjective jump between "this is loud" and "I can feel the music rattle my chest."

</comment></comment></comment><comment><USER13> This seems... hazardous.

</comment><comment><USER14> Odd sport the "dB drag racing". Made me remember of this Gavras video [http://vimeo.com/9357434](http://vimeo.com/9357434)

</comment><comment><USER15> First thought was: "10 trillion heartbeats?"

</comment><comment><USER16> My first thought when I saw that headline:

Prejudice

</comment><comment><USER17> Doesn't that permanently damage the hearing?

<comment><USER18> It's permanently damaged in the sense that a bridge is permanently damaged by people walking over it -- simply put, hearing sound erodes your ear drums regardless of how minute it is. Now, whether listening to really loud things _escalates_ the hearing loss is probably what you were asking.

If a million people were shuffling along a bridge and they all walked gently then the bridge will be damaged minimally, but if a hundred trucks that weigh several tons drive across the bridge then that damage would be quite severe. A million people regularly shuffling every day would be quite damaging over a long period of time, but the effect of a thousand large trucks is far more damaging.

My point is, listening to really loud _low frequency_ sounds isn't as damaging as listening to really loud _high frequency_ sounds.

Now, my comparison is really poor and heavy trucks cause far more damage than people, but the comparison between 'low frequency' and 'high frequency' is apt -- high damage to roads comes from high weight concentrated on a small point of impact in the same way that high damage to hearing comes from high frequency sound.

<comment><USER19> I stopped reading at "Sound erodes your ear drums", you obviously wrote all this but have no clue about how the ear actually works. Its not the ear drum that gets damaged over time, its the hair cells inside the cochlea that eventually die.

<comment><USER18> Yeah I tried to keep domain-specific terminology to a minimum, most people don't know their sense of hearing comes from sensitive hairs in their ears. Good catch though, and sorry if it made you cringe.</comment></comment></comment></comment>


Analyse Asia 83: The Five Major Events in Asia 2015 with Sameer Singh - <AUTHOR> https://analyse.asia/2015/12/30/episode-83-5-events-that-shook-asia-in-2015-with-sameer-singh/ <comment><AUTHOR> Synopsis: Sameer Singh, author of Tech-Thoughts.net and senior industry analysis manager of App Annie, joined our host in a two episodes arc discussion on the five major events that shook Asia for the year of 2015 and the predictions for the year of 2016. In the first part, we discuss the five major events in Asia this year: (a) the surge of venture capital financing in Asia and its implications, (b) SoftBank's Pepper with Alibaba and Foxconn, (c) the Nintendo-DeNA deal, (d) Xiaomi's challenging year and (e) global recognition of Wechat's messaging platform and why Facebook is learning from them to build their messaging app. We also added a short discussion on the upcoming dawn of self-driving cars and examine its implications across Asia from the on-demand taxi-hailing apps, the investors such as SoftBank, Tiger Global and the car makers.</comment>


Join the system and do good: why govt jobs are a top way to have a positive impact - <AUTHOR> https://80000hours.org/career-reviews/policy-oriented-civil-service-uk/ <comment><AUTHOR> Before someone complains that this isn't the title on the article, this is the social share title shrunk to fit the HN character limit. These articles don't have proper titles in the design.</comment>


Back In - <AUTHOR> http://speirs.org/blog/2010/5/3/back-in.html

<comment><USER2> The TL;dr version: Developer who quit developing for the iPhone platform in 2008 due to issues with the App Store's policies decides to come back because a) he sees nothing better coming along, b) doesn't wish to turn into an angry, bearded open source zealot in 10 years, and c) realizes that his gesture didn't make Apple change its mind. Further, he suggests that Apple's levels of control are a natural evolution of platform development.

<comment><USER3> _...that Apple's levels of control are a natural evolution of platform development._

That makes me a sad panda.

</comment></comment><comment><USER4> The author's original "I'm out" post: <http://speirs.org/blog/2008/9/12/app- store-im-out.html>

What I find sad is that every issue he had with Apple is still just as bad. The only thing that has changed positively is the app store approval time. Everything else is either the same or worse. And so basically he's just saying, "Fine, you're just going to keep doing the things I find reprehensible, but consumers love you, so I'll play your game." It's an understandable position to take, it just makes me sad to see developers feeling like they're forced to cede their strongly held beliefs because Apple has gotten too big and the momentum is too great to ignore.

And yes, I realize nobody is _actually_ forcing him to act against his beliefs, but he clearly _feels_ that way.

<comment><USER5> He's a indie Mac developer. And as an indie Mac developer, you can afford to ignore iPhones and iPod touch. But it's hard to ignore the iPad.</comment></comment>


David Pogue trashes the HTC EVO 4G's battery life and video calling feature - <AUTHOR> http://www.nytimes.com/2010/06/17/technology/personaltech/17pogue.html

<comment><AUTHOR> Original title is "A Bold Phone Fades a Bit in the Details" - copied that link from Alley Insider . . .</comment>


Polybius Arcade Game - <AUTHOR> http://en.wikipedia.org/wiki/Polybius_(video_game)

<comment><USER2> Apparently needs additional reliable sources</comment>


Are there teams considering using ZeroMQ for new projects in 2017/2018? - <AUTHOR> I am considering using ZeroMQ for a project that I am working on.
I am learning my way through the example documentation on the website (ZeroMQ - the guide) and the ZeroMQ O'Reilly book (copyright 2013). The book mirrors the website in terms of C examples. I have to say that this is some of the best documentation I have seen in a while.
However on using the examples now in 2017 I notice that some of them are using deprecated APIs and I am having a hard time refactoring them to use the current APIs. It doesn't help that I am just learning and using ZeroMQ for the first time.
In compiling sample code I find that I have to refactor it to use v4.2 APIs since the code refers to pre v3.0 code in some case.
Finding out how I can find the right substitute for say the deprecated zframe_t or zframe API methods and what I should use instead is getting hard. How can I replace all references to zthread_* in the sample code to use the zactor model instead? etc.
All my googling is just bringing back the same 2013/2014 samples or others referring to the old deprecated samples.
I know the code is being updated but the example documentation seems to be from the 2013/2014 time period. <comment><USER2> I just wrote and open sourced pile of code with ZeroMQ ([https://github.com/rantydave/messidge](https://github.com/rantydave/messidge)) and found it to be a mixed bag. In short:

* The encryption/authentication stuff is bordering on pointless - once a client has authenticated you cannot then be sure that a particular message is coming from that client. I binned it and used libnacl in a "by the book" implementation. It's not ideal.

* The routing, fanning etc. etc. stuff always made me uncomfortable - it's difficult to understand, introspect, debug, whatever.

* It's attitude to threading is idealist but a PITA - I got over it, eventually, by creating a sort of per-thread socket factory. Recent ZMQ's deal with both this and the above by introducing gloriously plain "server" and "client" sockets that are thread safe.

* The event monitoring sockets are cool but IMHO are a sign of things going pear shaped. In short, if you're monitoring connections then you're using messages to do a connection's job. I got this just, completely, wrong.

But: it works. It's reliable. It seems fast. In terms of basically doing what it promises, it delivers, and I think that counts for a lot.

</comment><comment><USER3> Why not [https://nats.io/](https://nats.io/) ? It is imho simpler and livelier (as in people are still working/using it)

What's your use case?

</comment><comment><USER4> Development has slowed down over the past year unfortunately. One of the most notable contributions recently was the addition of GSS API support. Overall the API is pretty small and easy to learn. The biggest advantage is that it takes care of reconnect logic for you and buffer management. It's also async by default which is nice. It's also pretty fast and can easily process 1M msg/s if you need that. I would ignore the czmq API entirely and only use the core API and roll your own stuff around it

</comment><comment><USER5> We use it extensively at work to connect multiple apps/blocks together. It's great because you don't need to really worry about all the network management. It just works. We can even deploy across multiple ips and its transparent to our code. We work in c++ and python mostly.

FYI we combine it with protobuf. Protobuf handles the data formatting. ZMQ handles the communication.

</comment><comment><USER6> Would you consider Go? Have a look at the net library. [https://golang.org/pkg/net/](https://golang.org/pkg/net/)

ZeroMQ is not popular among Go developers, because the language and standard library subsume its functionality.

<comment><USER7> Most use gRPC. Easier setup. And becoming part of a lot of modules. ZMQ can probably handle more traffic though

[https://grpc.io/](https://grpc.io/)

<comment><USER8> I've lately seen some interest in RSocket: [http://rsocket.io/](http://rsocket.io/)

The Java and C++ implementations seem to be the most active. Which makes sense, coming out of Facebook-land.

</comment></comment></comment><comment><USER9> Write to firstname.lastname@example.com, you might find some of your answers there.

</comment><comment><USER10> Maybe WAMP[0] meets your needs?

[0]: [http://wamp-proto.org/](http://wamp-proto.org/)</comment>