Hundreds of Facebook employees walk out as Zuckerberg plans town hall tomorrow - <AUTHOR> https://www.cnbc.com/2020/06/01/facebook-employees-stage-virtual-walkout-over-trump-post-moderation.html <comment><USER3> Walkouts will achieve nothing, but the tragic part of the story is Silicon Valley engineers are sitting on a massive amount of power to affect real change IF they collectively organize, which they have various irrational hang ups about doing. Zuckerberg does not care if 50% of his engineers skip a video meeting. He would greatly care if he found out 50%+ of his SREs were going on strike. But the word union is stigmatized even though doctors/lawyers/police/actors/teachers unions all wield massive political power, engineers accept their market based compensation and micro kitchens and decide that's enough then are shocked that on political issues they get pushed around by the execs and VCs. If you want to have any voice in what your work does in the world, step 1 is collective organization of Silicon Valley engineers, anything besides that is smoke and mirrors and a waste of time.

<comment><USER4> Some of us have been in unionized industries prior. It also lead to promotion based on years served. Pay scales. And the protection of low performers.

Right now engineers have incredible leverage. What do they gain by a union.

Don't like what Facebook is doing. Quit and work elsewhere. There's plenty of jobs available

<comment><USER5> _> Right now engineers have incredible leverage._

If the engineers' leverage is so great, why have they been unable to enact policies they support?

<comment><USER6> Policies that engineers in general truly support are rare. Many engineers - <USER2> suspect the majority - just don't feel that strongly about most causes.

<comment><USER7> Engineer distaste or at least lack of enthusiasm for open offices is near- universal. It might not be the best reason to create a union, but its prevalence is probably rooted in the lack of something like a union to tell management to back off.

<comment><USER8> Engineer who works in an open office, can confirm. Open offices suck in a large variety of ways, not the least of which my personal health has deteriorated over the years in large part because of it.

<comment><USER9> As in getting colds? I haven't heard of health as an open office gripe, but I've never worked in one.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> What's with the cynicism in this posts? They're trying to make a point and bring awareness. Who cares how hard it is. At least they're doing something.

To give them credit they're making a political statement at work when we're told not to talk politics at work.

<comment><USER11> On Reddit there were a lot of "why don't they just quit their job" comments. I am just rolling eyes really hard. To be fair, when I was younger, before I had all these adult responsibilities, that would have probably been my answer as well.

<comment><USER12> It's still true though. Engineers, specially, have had the power of voting with their CVs for a long time. The only reason Facebook is able to pay ridiculous salaries today is because engineers voted with their CVs continuously for the past 10 years.

</comment></comment></comment><comment> Lx1oG-AWb6h_ZG0 What is their end goal here? I certainly don't want Mark Zuckerberg or any of his employees making decisions on what is considered newsworthy, especially on really important stuff like this. Even if you don't personally like what is being said, the fact that it _is_ being said - and who is saying it - is an important point for people to know.

The next time, it may be your own opinions that they'll censor: Facebook has far more reach, and has much less journalistic pretensions than any of Murdoch's properties... you really really don't want them to start getting involved in politics.

<comment><USER13> Isn't the context also important for people to know?

Like, if the President of the United States is saying something that's factually incorrect and might cause people e.g. not to register to vote (because they expect every Californian will be getting a ballot), is that context not also significant?

Or, hypothetically -- but really if you think at this point that this is a stretch, come on -- if Trump claims without evidence on November 3 that he was the victim of massive voter fraud and the election was stolen, and calls for his supporters to take up arms against their state and local governments, should that be broadcast without context or commentary?

<comment><USER14> Facebook should provide the platform and stop there. When they act as publishers and start editorialising or adding "platform opinions" to the user generated content, they can rightly be asked why they endorse everything else on their site that isn't "edited" or "added to".

We need to think real hard about what we want in 5 years and beyond from now... not just what we want now. Breaching the divide of platform and publisher for anything beyond light moderation to keep the platform usable, no matter how well intentioned, is bound to have a devastating result on future political expression.

<comment><USER15> Nice idealism. But human beings have trouble managing that kind of platform. Every idiot's lies look just as legitimate as expert opinion. Other idiots can search for confirmation of their biases and find any number of hits that way.

Call it what you like; we're not coping very well with unrestricted dissemination of disinformation. Folks have gamed it at the highest levels.

<comment><USER16> Aren't zuck and his company made of humans? What magic powers do they have to suddenly curate things accurately and deem the destiny of mankind? I have trouble following what you are trying to say. Maybe you are asking for all social media to be shutdown altogether.

<comment><USER15> You made all that up. I asked for nothing. Ridicule is unnecessary and misplaced.

Funny how folks get defensive when criticism of their addiction is put forward. You can always tell.

<comment><USER16> And you still haven't told us what your solution is. It's easy to criticize. "it sucks" . ok, so?

<comment><USER15> Not smart enough to fix all mankinds ills. Just noticing, we're addicted and its not going well.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> The real protest will be to quit unless one genuinely thinks they can make a change in the ideology of a company (so somebody in upper management or with some pull). If you are a senior or lower engineer, I don't imagine this has any effect on anything. Just look on "who's hiring" every month here. Lots of local companies (and many remote) that pay good salaries and work towards great goals. If somebody disagrees with facebook's ideals, there is no shortage of jobs out there for them to apply for that pay well and have a net positive effect on the world (as far as I can tell, I could be wrong about some of these companies).

</comment><comment><USER18> Private companies must never be the arbiters of truth on the internet. Zuckerberg is doing the right thing, against huge internal resistance.

You'd think Americans, out of all countries, would understand this.

<comment><USER13> If you say something, and I say, here's some evidence that you're wrong, does that make me an arbiter of the truth on the Internet? I mean, how is what you did (saying something) any different from what I did (also saying something)?

<comment><USER18> In that scenario you're a regular participant in a discussion, presumably as another user of a platform, standing on equal footing with others. This NOT what this is about!

If you're the owner of the platform, and prominently inject your POV, thats starting to get problematic. I understand the impulse to do that, but people aren't thinking about the 2nd order effects.

<comment><USER13> So the difference is prominence, highlighting this one particular reply because it was written by the platform itself?

I'm still not seeing how this is a big deal. What are the second-order effects?

</comment></comment></comment></comment><comment><USER19> Social media is a dead end. The results are depression and misinformation.

Unless you believe truth can easily be determined, there is no tweak that Zuck and Jack can do to fix their platforms. At least Zuck is honest about it.

<comment><USER20> > Social media is a dead end. The results are depression and misinformation.

Honest question. Is Reddit any different? Hacker News? Your average bulletin board?

<comment><USER21> Reddit is better because people are more anonymous and don't have to mix their real life with their online life.

<comment><USER20> Why? Misinformation on Facebook and Twitter are spread by bots AFAIK. How does being anonymous help decrease misinformation?

</comment></comment></comment></comment><comment><USER22> "The only thing necessary for the triumph of evil is for good men to do nothing."

<comment><USER23> [https://tatianamac.com/posts/white- guyde/](https://tatianamac.com/posts/white-guyde/)

</comment></comment><comment><USER24> This is probably the wrong time for Facebook software engineers to try to flex their muscles. Most large firms have put their hiring on hold due to COVID-19. A lot of engineering talent is now on the market looking for jobs due to layoffs by startups and many other companies. Facebook is gearing up for remote work which will expand the talent pool beyond Silicon Valley.

The situation on the ground has changed a lot in the last few months.

I am not sure how much real leverage they will have from the walkout.

<comment><USER25> They'll find out how much of the rhetoric the company feeds them is true or not. They'll know for themselves when they deemed it important to draw a line.

As a matter of calculation, the timing isn't ideal. None of them seem to be saying it is a matter of calculated timing to leverage their market value though.

</comment></comment><comment><USER26> Can't imagine lower stakes than an employee making $400K not dialing in for a day and not even having to take a PTO day to do it.

<comment><USER27> Your account may be shadowbanned. I vouched for this comment though. It describes what I feel. Not that the workers perhaps aren't doing anything else. But solely this action doesn't mean much at all.

</comment></comment><comment><USER28> Hasn't FB always been the company where pragmatism and competitiveness trumps justice, moral and general decency? Why did these 600 people start working there in the first place? I'm confused. No judgement, just trying to understand.

</comment><comment><USER29> I support this walkout. As a small business owner all I've been able to do was purge my FB page profiles. I'm proud of them for taking a bigger step than I'm able to make.

Working people of all countries unite. Seize the means of production!

<comment><USER30> > Seize the means of production!

You realize that means your business too?

<comment><USER29> Obviously and eventually. Shipmate before self and all.

<comment><USER31> > Obviously and eventually.

"But please seize my business last"?

<comment><USER29> Marx makes a difference between the tradesman who has a small business employing other tradesmen and the oligarch who's salary is 300% greater than the workforce average.

You know that Marx isn't against all business right? It's the extreme inequality that's the problem.

So, like most small business owners we'd be seized well after the 1% (and even the 5%).

<comment><USER32> Marx _did_ make a (big) difference here ... unfortunately for the tradesman, no one gave a shit.

</comment></comment></comment></comment></comment></comment><comment><USER33> Some of those tweets that the article quotes sound like something straight out of the Onion.

People are asking these social media companies to put themselves in an impossible position.

<comment><USER34> Social media companies have put _themselves_ there, by becoming de facto "public squares" for general communication, while still being de jure private companies with a civic responsibility to the truth and to human rights.

</comment></comment><comment><USER35> Honest question: what power does Zucherberg have with regards to allowing or not a post of the president? I mean even if he asks people to delete it, the president surely will demand him to put it back online.

<comment><USER36> His freedom to remove that post I believe would qualify as protected under the bill of rights.

</comment></comment><comment><USER37> Can I state the obvious?

People are acting just plain crazy these days. I hope it ends soon.

</comment><comment><USER38> A strike would be more effective in my opinion. Organize and take the site down. Keep it down for a few hours. That's easily a few hundred million in lost profits.

</comment><comment><USER39> It's probably time for TheFacebook to die. Or just become a zombie like Yahoo. But here's the sad thing: Nobody will be sad when it happens.

If Apple died I'd be sad. Likewise Stitchfix and Digital Ocean and Github and Airbnb. Hell, maybe even Microsoft a little bit. But not Facebook or Google.

If I started a company one of my goals would be to create a lasting culture providing enough real value that at least a few people other than the employees would be sad when it died.

</comment><comment><USER40> Anyone has the right to walk out. But FB also has the right to not promote those people.

</comment><comment><USER41> Journalists are _quoting_ Trump's statement as newsworthy. Everyone knows what he said. What's the point of censoring it ineffectually?

<comment><USER42> It's not about censoring or not censoring. It's about Facebook actually giving a shit about the state of the world it's in, and not just Mark Zuckerberg's incessant handwringing about "feeling disgust" but... doing nothing about it.

Too long have abhorrent actions by Donald Trump gone completely unchecked by major platforms and, if Facebook won't even do the token step of doing something about a clearly racist and disgusting message, then they are truly spineless and complicit.

<comment><USER43> What's the common standard then? Does it ban leaders of countries that oppress homosexuals and other minorities as policy? Leaders who actually imprison political dissenters?

Donald Trump is a bad president IMO, but there are _far_ worse people (and their spokespeople) active on social media. The inconsistent standard makes this seem more like virtue signalling, which isn't quite "giving a shit about the state of the world".

EDIT: Corrected a typo. I think Trump _is_ a bad president.

<comment><USER42> So? Flag their messages too. You and I are both agreeing what Trump is saying is horrendous.

And, for what it's worth, I'm gay and a part of a minority and I am privileged to live somewhere where there's little repression for who I am. I absolutely want to see people pushing back on countries that have terrible leaders who would repress my life: if you're going to shrug then say "well that's just policy", that honestly sucks.

I'd take "virtue signalling" any day over whatever this response from Facebook is.

<comment><USER16> > I am privileged to live somewhere where there's little repression for who I > am.

We reached here because we had complete freedom of speech. And you are against that very thing, the irony

<comment><USER42> This is a complete non-sequitur to what I said.

</comment></comment></comment></comment></comment></comment><comment><USER44> Note that this so-called walkout consists of people already at home taking a personal day and changing their autoreply email.

<comment><USER45> thanks, i always wondered how these work. so people would normally walk out of the office, and go home? Do they walk down the stairs instead of taking an elevator? How far out do they walk? What if it's raining out? Would they answer emails before leaving? would they leave after lunch? do they leave all together? Do they use corporate buses to go home? I feel these are important subtleties

<comment><USER44> The key point is that a typical walkout is a public act where you leave work and then demonstrate. It is a situation where people can see you and where you can see the other people walking out with you. You can even do things like picket or articulate demands! This is... not that.

</comment></comment></comment><comment><USER46> I think Facebook's way of handling the political messages by not interfering is much better than Twitters. I do not want some random person inserting a fact note which corresponds with their view of the world. Facts are very seldom only one sided and it should be up to the readers to comment the tweet or do a google search.</comment>


Netflix says Google Fiber is "most consistently fast ISP in America" - <AUTHOR> http://arstechnica.com/business/2012/12/netflix-says-google-fiber-is-most-consistently-fast-isp-in-america/ <comment><USER2> _Is anybody really surprised by this?_ I mean, Google has some of the best and brightest engineers working for them, a substantial budget, a purpose other than profitable retail of their service, and a tiny town outside of major populations to work with. I would be hard pressed to find a reason why they _wouldn't_ be faster than anyone else out there. Shoot, I bet you could find similarly sized cities were Verizon/Comcast/Charter handily beat Google Fiber. Don't get me wrong, I love that they are doing this, but everything breaks at scale

EDIT: Misread the part about it being Kansas City vs. a city in Kansas. I feel my point about scale still stands, as Kansas City in total (Missouri and Kansas) is in the 6-700,000 person range, and is still a fraction of total user base of the other ISPs mentioned

<comment><USER3> >Tiny Town!?

There's 2 million people in the Kansas City metro area. (I'm from Kansas City. Grumble.. grumble...)

<comment><USER4> For many people who spend most of their time in SF, anything other than SF, LA, and NYC is "flyover country".

<comment><USER5> It's absolutely hilarious to put SF in the same category as LA and NYC.

<comment><USER4> That's why I had the qualifier that it only applied to people in SF. Their view that SF is in the same category as LA and NYC shows how myopic and inward-looking many of the people in SF are.

<comment><USER6> I was wondering what the population breakdown looked like and I found this:

[http://en.wikipedia.org/wiki/Table_of_United_States_Metropol...](http://en.wikipedia.org/wiki/Table_of_United_States_Metropolitan_Statistical_Areas)

Edit: This list is also interesting - <http://en.wikipedia.org/wiki/Global_city>

</comment></comment></comment></comment></comment></comment><comment><USER7> I'd love to see more regional ISPs on this list. Kinda annoying to see Google under "Major ISPs" when they only serve a single city currently

</comment><comment><USER8> Interesting, having used Netflix and having it 'step down' from HD to not HD when something kicked in (like a Windows update) this result suggests that they are pretty good at traffic management as well. That was one of the questions I had for my sister who lives in Kansas City.

Now this also means that folks will start advertising their botnets for a premium if they have a strong contingent of 'Google' hosts. And that will be the next interesting test.

If Google can run as an ISP and effectively deal with zombie PCs (which is to say mitigate them), they will replace any other ISP out there just because operationally they are that much more efficient.

Still waiting to hear which city is #2 on the list.

</comment><comment><USER9> isn't 2.55 Megabits/s for Google Fiber a bit low? I imagine Netflix throttles the bandwidth. After all, there's no point downloading the whole movie if a person decides to switch to something else after 10 minutes.

If throttling is happening, what is Netflix testing then?

<comment><USER10> The Ars article biffed, it should be megabytes per second (MBps vs Mbps). It's kind of confusing on the Netflix graphic, because the headings are in all caps, so you just have to use context/knowledge to differentiate.

<comment><USER11> From the mention of a "variety of encodes" affecting their numbers, my interpretation of this figure is the average bandwidth used to stream a video to a subscriber, and in that case 2.55MBps sounds shockingly high for an online streaming video bitrate. 2.55MBps would put it a bit above over-the-air broadcast MPEG2 HD rates, whereas not everything on Netflix is HD, and I would assume they're using more efficient codecs than MPEG2. Especially since, from my past experience, I know that they have HD streams that are playable on sub-6Mbps connections.

EDIT: and as tedchs points out, the other provider numbers definitely reinforce the interpretation of it being Mbps: I don't think I've ever seen AT&T advertise a non-Uverse DSL speed of above 6Mbps, which wouldn't let it hit 1.5MBps.

<comment><USER12> It doesn't have to be 2.55MBps averaged over the entire stream. It could be 2.55MBps during bursts of buffering.

That being said... Listing the headers in all caps (without so much as clarifying in the accompanying post) was a mean thing to do...

<comment><USER13> I'd argue that deciding to name 8 bits a byte and making the abbreviation of the latter simply the capitalization of the former was an ill-considered choice, and has led to much confusion, consternation, and gnashing of teeth over the years.

<comment><USER14> We should adopt the telecom term octet, and just get rid of the term byte.

Then again "Megaoctet" doesn't quite flow, but there would be no confusion between a bit and an octet however you abbreviate it. We're still left with is deciding whether to multiply by 1000 or 1024 for each magnitude though.

</comment></comment></comment></comment></comment></comment><comment><USER15> And in other news, the sky is blue and Barack Obama is the president of the United States once more. Google have access to some of the best engineers money can buy, they're certainly not broke and can afford to invest into better infrastructure and the means for implementing it, not to mention they don't have a legacy customer base or legacy infrastructure to consider either.

</comment><comment><USER16> Bah. Verizon stopped installing FIOS and Google wired Kansas City. I don't care how fast your service is if you don't offer it where I live.

</comment><comment><USER17> Netflix appears capable of breaking out fiber versus DSL subscribers of the same ISP, so I wish they'd separate Frontier FiOS[0] from Frontier DSL. It would be nice to see how the ex-Verizon system is still doing in comparison to its much more prevalent cousin.

0 - Yes, it is still called FiOS even when being sold and serviced via Frontier: <http://www.frontierforhome.com/fios/triple.php>

</comment><comment><USER18> Google's objective appears to be in delivering the best quality broadband, instead of driving profits. A great comparison to this would be Apple under Steve Jobs.

Patiently awaiting for Google's entry into the mobile broadband domain...

</comment><comment><USER19> This is a great move by Netflix. It will hopefully be visible enough that ISPs will try increasing their standing, which is ends up being good for customers.

<comment><USER20> I wish you were right.

My ISP (Time Warner Cable) is basically openly hostile towards its customers and can afford to be since it has a de facto monopoly position where I live. I'm pretty sure this Netflix report will do nothing to get them to fix their many, many problems.

I'm very hopeful that in the long term Google Fiber will make a big impact on the ISP landscape here in the United States, but I think it is going to take a very long time and the entrenched players are going to have to be dragged into the present kicking and screaming (and lobbying) and Google is going to have to expand a LOT more before the other guys start making real changes.

<comment><USER21> Is CLEAR (4G WiMax) an option for you? It works pretty well here in Austin, and by well I mean streaming video with minimal buffering.

<comment><USER22> A friend here in NYC tells me that the CLEAR service often gets terrible at peak times.

<comment><USER23> Pretty much _everything_ gets terrible at peak times in NYC.

</comment></comment></comment></comment></comment><comment><USER24> Thanks Ars, nobody could have guessed that the "super fast internet" is the "most fast" without your help!

</comment><comment><USER25> I wonder how the customer service is.

</comment><comment><USER26> Bring it to San Jose and we'll see what's up!</comment>


What does code readability mean? - <AUTHOR> http://typicalprogrammer.com/what-does-code-readability-mean <comment><USER2> > "Good code is simple" doesn't actually say anything. [...] What we call > "simple" depends on our experience, skills, interest, patience, and > curiosity.

I like Rich Hickey's stance on this: "simple" is objective (antonym: "complex"), whereas "easy" is subjective (antonym: "hard"). Easy depends on skills, interest, patience, curiosity - but simple does not. Simple is about lack of intertwining of concerns. About writing code that can be understood without "bringing in" the entire codebase into your mind. Like, you can understand a pure function just by looking at it (it's simple). If it modifies or uses a global variable, now you have to look at all the places that "touch" that global variable, in order to understand what your function does; the code is thus much more complex.

With that definition - it's absolutely correct to say that the code should be as simple as possible. And that writing simple code is typically very hard.

<comment><USER3> > With that definition - it's absolutely correct to say that the code should > be as simple as possible.

Yet, it is humans who need to read it. This is the end goal.

If you rewrite the code to satisfy a theoretical objective criteria of simplicity, but end up with something that people reading the code find harder to read, then you have failed.

It's the same when you design a UI.

<comment><USER2> But if you don't have an objective criteria of simplicity, how can you even hope to have universal agreement of what is "simpler"?

Humans are complicated beasts. Saying "people find the code harder to read" doesn't help me know what I should do. If I have no objective criteria, then it must be subjective, and then all that "simple" means is that "this is easiest for me _right now_ " \- which, from experience, I claim to be a very unlikely path to produce code that multiple people agree to be "simple". (except if the problem was trivial to begin with - but then, who cares?)

<comment><USER4> "Which is the better painting, Van Gogh's _Starry Night_ or Seurat's _La Grande Jatee_?" is a deeply subjective question.

"Which is the better painting, Van Gogh's _Starry Night_ or a kindergartener's watercolor of their family?", on the other hand, appears to have a correct answer.

There are multiple competing definitions of "simple" with respect to code and multiple kinds of simplicity that often have to be traded off against one another, and reasonable programmers can and do disagree about which compromises to make and where. Code quality (including, but not limited to legibility) is in many regards a subjective endeavor.

That doesn't mean, though, that all decisions are equally justifiable. Trust your sense of aesthetics. It's usually trying to tell you something important, even if you don't know how to put it into words yet. With subjective endeavors there is no perfect, but there is usually better. Chase that.

<comment><USER2> In your first example, both are exceptional, so really "which is better" is irrelevant.

In the second, the difference is so big that it's obvious for anyone which is better, but that still doesn't make it useful for getting better at painting. "Paint more like a Van Gogh and less like a kindergarten kid" is not useful advice.

People do have art critics and manuals that attempt to write down exactly what made Van Gogh paintings great. Those writings are useful, and many artists do indeed study them.

<comment><USER4> Maybe I read too much into your original comment, but it reminded me of a pitfall that I see too many engineering types fall into, namely that because something can't be formalized then it must be arbitrary, unimportant, or both. In particular, this seems like a counterproductive way to frame the issue:

> If I have no objective criteria, then it must be subjective, and then all > that "simple" means is that "this is easiest for me right now"

Here's a few other (actionble) things that "simple" can mean.

        * seems to reliably be easiest for me every time I look at it
        * was judged to be better by the three or four people I could get to give me an opinion
        * follows a heuristic that a bunch of smart people all seem to agree generally makes things better
        * mirrors whatever we did on this project the last time we were in this situation

Even if all it means is "easiest for me right now", that's still probably going to get better results than "the first thing that popped into my head that might work".

There is no objective definition of simple. On behalf of the maintenance programmers of the world, please don't take that to mean it's not worth trying anyway.

<comment><USER2> > There is no objective definition of simple.

Oh, I agree with that. What I meant was that "this doesn't mean there can't be objective criteria about what is simple and what is not; or that it's futile to attempt objective definitions of 'this is simple/this is not' ".

"Easiest for me right now", in my experience, only leads to simplicity in trivial cases. Simplicity requires intense thought & explorations, it's never easy (except, again, in trivial circumstances).

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> The author consistently compares code language style to literature language style, but I don't think it's a helpful comparison at all.

Literature operates by an intractably complex interaction between the words written on the page and the mind of the reader. Exchanging a single word for another may totally alter the effect of a passage, based on factors like the meaning of the word, the associations the word has for each reader, and the aesthetic appearance and sound of the word.

Moreover, we have no objective way of measuring the effect of literature. We don't have a test that can measure how much more empathetic I become after reading a novel, or how much more I understand the human experience.

Computer code typically has measurable outcomes. While "readability" may still be a relatively subjective measure, we can at least say "these two versions of this function are equivalent" if the _outcome_ is the same - the array is sorted correctly, the transaction amount is calculated correctly, the graph is rendered with the same pixels.

This means that editing computer code is nothing at all like editing literature. The cliff-notes version of Macbeth can never produce the same effect in the mind of the reader as reading Macbeth -- but a function that is _subjectively_ easier to read can be shown _objectively_ to produce the same effect as the original function.

<comment><AUTHOR> Good point, I agree with everything you wrote. I didn't intend to compare code language _style_ to literature, maybe I failed to make that clear.

I tried to make the more subtle comparison that some programmers react reflexively to code that doesn't look familiar to them and call it unreadable, the same way that a person unfamiliar with Shakespeare and unprepared (or unwilling) to make the effort to read it will dismiss _Macbeth_ as hard to read.

A person new to Shakespeare picking up _Macbeth_ will find the book challenging because of the antique language, the poetic form and dramatic devices, maybe the historical setting and allusions. A person new to a body of programming code may react the same way, for similar reasons. A reader new to Shakespeare probably knows that the problem lies in their own abilities and patience, not in the book. A programmer new to a body of code will tend to blame the code, in my experience.

<comment><USER6> Good writing is not necessarily readable writing. Shakespearean works are good writing, but they are most certainly not easily readable. There is code that is great code because for many other reasons than readability.(Like performance, correctness, robustness)

Easy to read writing is simple and concrete. Code that is easy to understand is also simple and concrete.

Complexity and abstraction push away understanding like two positive magnets. But sometimes readability is worth sacrificing to achieve a separate goal with the code.

<comment><USER7> > they are most certainly not easily readable

They would have been easy to understand by folks who were alive at the time they were written when performed on stage. The only unfamiliar words would have been the ones he coined, but most of those were easy cognates from latin. If Shakespeare wrote the same works today then he'd be a terrible writer.

</comment></comment></comment></comment><comment><USER8> This is a thought-provoking and well-written blog post about programmer biases when it comes to reading, and judging, other people's code.

The author is making the point that code readability is ultimately in the eye of the beholder. I've come to share the author's views, and I have to say I don't hear it said much in programming culture. At most places I've worked, there's this culture of constant refactoring under the guise of "continuous improvement," when really, if you look closely, it's really motivated out of disdain for the last developer's programming style, and in my opinion, a general aversion to reading code.

Reading code is about 10x as hard as writing it. It takes more concentration, it's less fun, it's harder, and it doesn't impress anyone. You have to know the language better than the person who wrote it, because not only do you have to understand why the code does what they intended it to, but you also have to understand why the code does other things they _didn 't_ intend (a.k.a. bugs). But in my experience, you save your team a lot more time and energy in the long run by preferring to read and understand existing code.

<comment><USER9> Alternatively, we refactor because the right abstraction for the previous phase of the project is not the right abstraction for the current or next phase of the project.

While I do have a respect for Chesterson's Fence as a concept, sometimes the answer to "why is it this way" is "we were learning as we went, and if we did it again, we'd do it another way."

I look at it this way: When you look at an older city built before the age of the car, they were built to be tiny to start, not more than a set of shacks. As the town built wealth, the buildings went to more sturdy, to multi-story, and to more ornate structures. Similarly, our code should start simple and dirty, then cleaned up as it has proved its worth, and then refactored to more robust patterns as the code has built the wealth (and demand) to justify it.

We should consider rewrites, then, as a sign of value, rather than as a sign of the previous programmer's failure.

<comment><USER10> > sometimes the answer to "why is it this way" is "we were learning as we > went, and if we did it again, we'd do it another way."

This is true! In fact there's a lot of that, in my own experience. Rewrites are probably most useful on code you wrote, rather than on someone else's, and right when you realize what went wrong, while you're still intimately familiar with the old code.

I've watched two different companies follow the "things will be so much better if we rewrite" logic and rationalize large scale rewrites that cost millions, and years, and failed to achieve the aims of doing it better the second time.

Rewrites should be considered a sign of value only if we actually learned from out mistakes, _only_ if both everything wrong with the old code _and_ everything right with the old code are well understood. If you rewrite anything substantial before that, you're just guessing, and you're most likely (in my experience) going to suffer taking longer than you want and making the same mistakes again. I've seen that happen to many very smart people.

So there's a balance. Rewrites are sometimes valuable, but not automatically valuable. Sometimes rewrites are very harmful. The best chance you have of knowing which one is to read lots and lots of code before you start, to make absolutely sure that the code you're replacing is never being replaced only because the readers didn't understand it or didn't like it's patterns.

OTOH, if you have complete test coverage in place before a rewrite, you can freely annihilate and redo large portions of code without having to study too hard.

<comment><USER8> I've seen smart people fall into the following trap:

1\. Previous developers did X and X is bad, therefore, their code needs to be rewritten without doing X.

2\. Oh crap - turns out, the new code has all these requirements to match the old code's functionality in ways we didn't expect (letters A-W).

3\. Okay, so we're doing Y and Z in the rewrite, knowing it's pretty bad, because we didn't know we'd have to do A-W and now we're short on time. Oh, and parts of the code still do X.

Now, wait a year for one third of the team to leave because they're rushed, overworked, burnt out, going in a different direction... and another third to get laid off because the project went way over time and budget...

4\. Previous developers did X, Y, and Z, and X, Y, and Z are bad, therefore, their code must be rewritten...

</comment></comment></comment></comment><comment><USER11> This reminds me of the discussion of "quality" in _Zen and the Art of Motorcycle Maintenance_ , where the class finds that while nobody can exactly define quality, when confronted with high and low quality writing everybody could recognize which was which.

As OP realizes, nobody thinks Knuth's ACP is poorly written even though it's hard. The elegance is obvious, even if the algorithm is hard to understand. On the opposite end, I've come across FizzBuzz implementations from job candidates that I've struggled to follow. I've often seen a 10-1 difference in code sizes for different implementations of the same problem, and while there's edge cases where smaller code can start to become confusing, generally every dev on the team recognizes which of the two is more readable.

I have no problem with the idea that there can be subjectivity in discussions of readability. But the idea that readability is _purely_ subjective, or only has to do with differing styles is ridiculous. In fact, I don't believe for a second that OP really believes this. He wants to make a point about subjectivity, which is fine, but for some reason has chosen to write it in this exaggerated clickbait style.

<comment><AUTHOR> I had _Zen and the Art of Motorcycle Maintenance_ in mind when thinking about readability, because that describes one kind of quality we care about.

I don't think I wrote that "readability is purely subjective," I certainly didn't mean to imply that. I did mean to make a point about subjectivity.

Sorry you didn't like the style. I write articles because I enjoy writing and I think I have ideas worth sharing. I don't have ads or affiliate links on my site, so I have no incentive to post clickbait.

</comment></comment><comment><USER12> I once had a developer who consistently wrote unreadable code while trying to be clever. To give him useful feedback I needed to come up with a black and white heuristic for knowing if code is readable or not.

The heuristic is this: Readable code can be explained in English sentences in one pass.

Your code tells a story. When you read it do you introduce the characters in the right order? Halfway through a complex passage do you reference something out of context without explaining it? Give concepts valid names to help the reader build context on your intent.

The best part of this heuristic is that you can get the code author to attempt to read back their own code, and trip over their own convolutions, and realize where there is opportunity to simplify.

We all worked on the same codebase so a reasonable shared understanding of the concepts was assumed.

This blog post throws various situations into the mix to try to be contentious or something but misses the point.

<comment><AUTHOR> That's called the telephone test. From _The Elements of Programming Style_ (referenced in my article):

"Use the telephone test for readability. If someone could understand your code when read aloud over the telephone, it's clear enough. If not, then it needs rewriting."

I agree that the telephone test heuristic gives you an idea of readability, but in 1974 Kernighan and Plauger assumed someone one the other end of the phone who knew Fortran or PL/I.

Trying to explain a moderately complex class hierarchy or a factory function or a closure over the phone would prove challenging. I could explain the _purpose_ of the code at a level someone else could understand, but they might not recognize the implementation when looking at the code.

A few years ago, doing maintenance on an abandoned production system, I came across a function with the comment "Produce a unique six-digit identifier that doesn't start with 0". The original programmer could have explained that to me over the phone, but his implementation (in PHP) was not clear at first or second glance. I expected this:

      $id = rand(100000, 999999);

Instead the function started with a loop to get the first digit:

      while (true) {
          $first = rand(0, 9);
          if ($first != 0) break;
      }

I'm not making this up.

Then another loop to pick five more digits in the range 0..9. Then a database query to see if that ID was used, and if it was the function called itself recursively. I'm not kidding.

So while I would have understood the problem _described_ over the phone, I didn't recognize the implementation at first sight. If the programmer had read the code to me over the phone I might have assumed I was missing some requirement that led to this overly-complicated implementation. Not all of the code looked like this so I don't know how the original programmer got wound around the axle on this function.

</comment></comment><comment><USER13> > By analogy, plenty of people find reading Homer, Shakespeare, or Nabokov > difficult and challenging, but we don't say "Macbeth is unreadable."

What of Joyce's _Ulysses_?

The thing is, most authors _do_ put considerable effort into readability, because it helps you get read, published and paid. There's an interesting parallel with this article - writer:programmer :: critique group:code review.

> Programmers, prone to investing their ego in their code, worry about > criticism from a lot of people they don't know. Slurs about competency > abound in programmer forums. Code samples out of context get critiqued and > subjected to stylistic nit-picking. That process can prove helpful for > programmers with thick skins who can interpret criticism as either useful > mentoring or useless insults. Less experienced programmers can get misled > and brow-beaten. Public code reviews create a kind of programmer performance > art, when programmers write code to impress other programmers, or to avoid > withering criticism from self-appointed experts

s/programmer/author and it still holds. As does much of the rest of the article.

I would say that programmer education really does underplay reading code. Students are taught to write small pieces and may never be shown a large novel-sized lump of code unless they go looking for it.

<comment><USER14> Ulysses is not unreadable, it just takes a lot of effort. For programming, the criteria is not if it is hard to read, but whether the same thing could be expressed in way that would be simpler and easier to read. But I not sure to what extent this could be applied to poetry, since the expression in language is in itself "the thing".

<comment><USER13> "Unreadable" in this whole discussion should be taken as meaning "requires effort that the reader is not willing to expend", not an absolute. There are very few things that are impossible to read at all, even the notoriously and deliberately unintelligible stunt languages like INTERCAL and brainf __k.

<comment><USER15> I'd even go so far to say that the only way something can be _literally_ unreadable is if it is physically impossible to do so (e.g. unrecoverable data) or there is not yet any known way of determining the meaning of a given text (e.g. the Voynich manuscript).

But of course that isn't what is meant when we say something is unreadable because humans don't deal in absolutes (though programmers sometimes do, which is why programmers are so fond of using overly noncommital language like "should" and "most likely").

</comment></comment></comment></comment><comment><USER16> This is a fantastic post that asks a question that I think many people just jump over on their way to "being right".

What exactly does the thing we are talking about mean?

In this case "code readability".

I would add to this that "code readability" only means something to me in the context of it's intended audience. Code is readable when it is simple to decipher by the people that the author intended to decipher it. For anyone else to hold it to standards outside of those agreed upon by the author and the intended audience seems silly.

<comment><USER17> A problem arises, if there exists no group of people that the author had in mind when writing the code. Some programmers really just code "so that it works" and don't care about readability at all. That's why we have code reviews - a code review is an attempt to read the code. If at least one reviewer understood the code, then we can assume it was not completely unreadable.

</comment></comment><comment><USER18> I often refactor code as a way to understand it; working through the logic and rewriting it in my own style helps me get a good grasp of what the original code was doing.

Sometimes I throw away that refactoring if I realise that the code I was having trouble understanding was actually fairly well written and I just need to sprinkle in some comments.

</comment><comment><USER19> Doing a lot of code maintenance what is the worst is most "smart" things. Every time I get to some indirection to be smart and I can't just ctrl-click on some line to get to the definition I'm angry.

I don't want to check what is there at runtime once the configuration has been loaded. I don't like going through 10 get("serviceName")->handleSomething() and having to check where those services are defined. I really don't like having to go through 20 abstractions trying to find who fucked some data on the way in my debugger.

I know, your 3 loc per method codebase felt good to write. The added useless junk around the code (function definition and {} on their line) means even with a 4k monitor I can't see your full algo in one page.

Using reflection magic? Please don't. I like dumb code which shows what it does and can easily be followed.

And that's coming from someone who likes the ${whatever returns a string} method of defining dynamically named variables in php: it feels always fun to write. But it is a hindrance when debugging. And when debugging the less "small shit" you have to deal with, the more brainpower you have to focus on finding the problem.

</comment><comment><USER20> I think it's necessary to expand on the authors definition of "complex" vs "simple"... Things can be "complex" and thus hard to read for many difference reasons:

At one extreme the reader is definitely responsible for things like understanding an underlying algorithm - the algorithm chosen might be a good choice, but it might also be very complex. It's not always possible to clearly convey an efficient implementation of a complex algorithm in code - It could be argued at the most that the author should name the algo in a comment, but litering the implementation with comments describing the algorithm would make it harder to read for someone who is familiar with the algorithm.

At the other extreme there are all kinds of unnecessary complexity that make it hard to read, some by poorly suited forced design patterns, some by cruft that accumulates and some by un-refactored growth (big ball of mud).

One of my pet hates is highly layered object oriented code where someone has gone to painful ends to generalise and modularise the fuck out of every single routine to the point that the overhead of traversing the hierarchy to determine what actually happens in what order with what side effects when you call one of the outer layers of that ginormous onion is humanly impractical. I'd call that unreadable code due to complexity that the authors are responsible for.

</comment><comment><USER21> Readablility is definitely not similar to understanding. The problem I have with reading code from other codebases is not understanding the coherence. Naming of variables is a great deal here, one poorly chosen name can totally confuse me. And still it is highly subjective because an other developer might instantly see the relation just by chance.

If you're unfortunate enough to code full-stack web apps then you'll likely be dealing with hundreds of npm libraries you've never heard of! How can you know all possible effects and side effects of 1 simple call to a method in some library? That alone would be a quite a study in some/most cases.

It would be great if for any project you can find at least an overview and explanation of the coherence that the files and used modules have in relation to each other. But unfortunately that is often missing already to start with, so you end up with a vast and often unsolvable puzzle.

Programming computers is still in its infancy. We definitely need better tools and structures to understand what's going on IMHO. It makes me laugh when people tell me they solve this with a linter.

</comment><comment><USER22> I work on a system where arbitrary property access results in database round- trips. So the following code:

foreach(var b in a.Bs) { if(b.Data != null) { ThisIsInteresting(b); } }

results in a.Bs.Count + 1 round-trips to the server and then database if these fields have not been accessed before. (a.Bs is one and b.Data != null is one as well).

This is a fine example of what I'd call "unreadable" code because there is so much activity that is implied by actions that in other systems are completely innocent and well isolated.

Also there is the point of cognitive load. If your entire application was simply one function it is technically "readable" but the cognitive load of trying to work out what is in scope and what might change a given variable is too high to read without extraordinary effort. When working in such systems (as I have before) you HAVE to rewrite it to even start reading it because a human memory cannot hold all that information at one time.

I think brushing it all of this off as "the reader isn't reading well enough" is disingenuous.

</comment><comment><USER23> To read code is to understand it. It has little to do with style but more to do with program structure and abstraction layers. I've maintained a PHP codebase with some of the worst code I've ever seen. For Example:

1\. A function with a few thousand lines of code, accepting dozens of parameter. The body is made up of some nested switch-case and if-else.

2\. Instead of using constructors, every class has a static method that does nothing but initialize itself.

3\. A class which queries DB and generate HTML, with nearly a hundred public variable. A few levels of sub classes with functions to update those variables.

When a piece of code is not obvious in what it's doing, I'll call it unreadable. In some cases this is acceptable, for example in some clever algorithm ([https://en.wikipedia.org/wiki/Fast_inverse_square_root](https://en.wikipedia.org/wiki/Fast_inverse_square_root)), but it is still what it is, unreadable.

</comment><comment><USER17> There is often a world of a difference between code hard to read because it tries to solve a complex problem or is written in a paradigm I haven't learned yet, and code hard to read, because its author was just plain sloppy, and didn't properly care about naming or decomposition. Distinguishing between these two cases is a matter of enough experience.

</comment><comment><USER24> "Greg Jorgenson is a typical programmer."

Then who are all these commenters in mailing lists, forums, blog posts and source control systems who are proclaiming code they cannot read as "unreadable" or 'unmaintainable"?

Clearly the author is aware these comments fall into the categories he mentions; they are reframing "I can't read this code" into some sort of pseudo-objectivity.

If typical programmers are aware of this practice, then who are these commenters labelling things they cannot read as "unreadable" or "unmaintainable"?

Are they "typical programmers"?

Can we respond to those labelling code as "unreadable" or "unmaintable" by pointing out that they really mean "I cannot read this code"?

Will they acknowledge, "Yes, what I meant was I do not know the language well- enough to understand that code, but others might be able to read and edit it."

</comment><comment><USER25> The article hints at it, but your sense of the readability of a codebase changes the longer you are exposed to it. Patterns that make it easier to become moderately competent in a particular codebase can actually make it harder to become expert. So if you want to maximize readability, you need to estimate how long future maintainers will live with your code.

Will they drop in and do a single commit and never look at it again? Then make sure everything you need to understand a piece of code is right there next to it.

Will they work on it for a long time, changing many parts? Then be very consistent with the patterns and idioms you use across the project, so that their previous experience changing other parts of it helps them understand how to make the next change.

</comment><comment><USER26> I don't like the shakespeare analogy because not every written piece of code is supposed to be a work of art. You wouldn't write an instruction manual like you would write Macbeth. Most of the time there's really no value in writing cryptic code

<comment><USER27> You are saying that programming is the same as an instruction manual? Programming is art. Nearly every objective in programming will have over a million potential implementations. Personality, wisdom, and mood are in every program (obviously there are some Hello World exceptions) just like artistic writing and nothing like an instruction manual. Machine code is an instruction manual compiled by a computer, a program is a piece of art created by humans.

<comment><USER26> well no. You can write artistic code, people do that in coding all the time (in programming contests, sample code, your own code etc) but the real goal of writing code is to perform a certain task. The execution of those instructions is what matters, not the style of how the code written.

So yea not all code is art.

</comment></comment></comment><comment><USER28> There's a sense of "unreadable" that I sometimes use that means "the code does not contain the information that you need to understand how it will typically function". E.g. things that have internal control flow determined by complex input processing where the input is ill-specified. It can be essentially impossible to put together a mental picture of the operation of the program, because key parts are essentially unspecified.

And there's a related sense that I occasionally use to describe code that's so difficult to follow (in the sense that the control flow or structure is needless obfuscated) that the process of trying to understand it doesn't really resemble simply "reading".

Some examples:

A function is called in many places in es6 code. I want to see its definition, my editor can't figure it out. I look at the import statement, it's imported from a file. I open that file, and all it does is export * from a dozen other files - so now all I know is that it's in one of these dozen files. I am reduced to doing something like grepping for the function name and looking for the case that looks more like a definition than a call. At one point I was reading the code, now I'm doing something related and more involved than just reading.

Or, in this system components emit message objects with a "title" field. The messages are dispatched to dozens of functions across files that inspect the title field to determine if they do anything with it. Only they don't just do a simple comparison against a string literal, they check if the title meets a regex. There are many of these different regexes. I read the code that emits the message and I want to know what behaviors the message being sent out triggers - how do I track that down? I can't even grep for the message title. In order to make a list of things this message might do, I have to look through everything that might possibly handle the message and try to figure out which regexes are triggered.

In this case, reading is involved in the same way that reading through a math book and solving the exercises does involve reading - that's not where most of the work comes from.

</comment><comment><USER29> The biggest helper for me when trying to read other peoples' code is having a document (or documents) which describe what the heck the code is supposed to be doing in human terms. This is especially true when I'm not super familiar with the business history, long forgotten bug fixes, and nuance which was previously worked around or implemented.

Software documentation almost always sucks, in my experience. When I do find well written documentation that reflects the code, it becomes much easier to understand the code quickly so that I can make the changes I want to make.

But nobody likes writing documentation.

</comment><comment><USER30> Clean Code I think is the best resource on readability. Your code self- documenting while following simple software principles is difficult but ideal.

</comment><comment><USER31> Time is a commodity. The extra time spent reviewing or maintaining code that is difficult to read would be better spent writing the code well the first time.

In open source development, a maintainer's time is often extremely limited. If you can't make your code easily readable for that maintainer, then your contribution is worthless. You have created an asset with a transaction fee that prices you out of the market.

</comment><comment><USER32> The author is spot on for 'standard' code styles. However when you enter the realm of crazy code styles (say, all code of the program in one single line, obfuscated code not meant for humans to read and so on), wouldn't we all agree that is in fact, objectively, unreadable? Beacuse actually reading it is simply too hard no matter how skilled and knowledgable you are? (note none of the OP's points cover this, except for 'The code offends my sense of aesthetics' maybe, but by a stretch).

And extending this somewhat further, I have already seen code written by humans which I am confident the vast majority of programmers would consider unreadable. Unfortunately including the guy who wrote it.. We're talking mixing indent witdhs/seemingly mixing all known code styles/complete lack of consistency/lines of hundreds of characters/big chunks of >20 newlines/... I think there is a point where this becomes unredable and it's not the reader who is to be 'blamed'.

<comment><USER33> > _wouldn 't we all agree that is in fact, objectively, unreadable_

No, because there's a rich body of counterexamples in the array-oriented languages (APL, K, J). Everyone who doesn't know these languages immediately dismisses programs written in them as unreadable, but that is far from the truth.

If you spend some time in the alternate programming universe that such languages inhabit, you'll get into your bones the knowledge that readability is relative both to language and to reader, and you'll start to think about simplicity in a deeper way. (By "you" I don't mean you personally, of course, I mean everyhacker.)

</comment></comment><comment><USER34> Some good points. I think code-readability should be measured by people who are as accustomed as possible to the code base. IE, if you wrote all the code, how quickly can you refresh your memory ( 6 months later ), as well as trace down bugs.

</comment><comment><USER35> There is a difference between reading legacy code without empathy (sympathy? pretty sure it's empathy) and calling code equivalent of Macbeth as unreadable when Cliff's Notes would do...

</comment><comment><USER36> Code readability is when you are able to pick up the source of a program that you haven't looked at in 10 years and instantly understand it without having to study it intently.

</comment><comment><USER37> public class A

{

       private int exid;

       private string M;

       public A()

       {

          M = "The result is:";

       }

       public string y(int u, int v)

       {

          return M + (u+v).ToString();

       }

}

public static void Main()

{

       Console.WriteLine(new A().y(1,3));

}

Now add hundreds of lines of such code and you'll get unreadable code. It is not in the eyes of the reader, some code is just unreadable.

This is an extreme example though.

</comment><comment><USER38> For me code readability means that the code I write today makes sense to me next week :p

<comment><USER39> Totally agree with thus one :-)

</comment></comment><comment><USER40> You'll know it when you see it.

</comment><comment><USER41> Over time the first thing I've come to desire more than 'intrinsic' readability when joining a new project is a decent, up to date, hyperlinked glossary with all of the relevant acronyms and terms that will be used in the code. I've had variations on this conversation many times before:

* New coworker (me): What's an XYZ? (some core thing in the system)

* Coworker 1: An XYZ is [blah blah blah].

* Coworker 2: Actually, an XYZ may not be [blah blah] it could be [blah].

* Coworker 1: No! That's not right!

* Me: ugh...</comment>


Ask HN:  What is your main everyday computer? - <AUTHOR>

Macbook? Dell Workstation?... <comment><USER2> Dell here.</comment>


Show HN: Exertit- personalized workout list app - <AUTHOR> https://itunes.apple.com/us/app/exertit/id908885162?mt=8

<comment><USER2> A couple quick things without running the app (at work right now):

1) "tit" really jumps out at me in the name. The name makes sense once you get it, but you might want to play with hyphenation or capitalization (ie, exert- it, exertIT) 2) The red writing on your screenshots is illegible. 3) The app itself looks really nice.

<comment><AUTHOR> Thanks for the comment xauronx

1) lol, I'm sure 98% of people noticed that! Yeah, I guess I can change it to what you suggested (exert-it) but it just didn't look as clean. Or I might change it entirely to something else. Not sure... 2) Yes, I was really disappointed once my app got published. The same images in the app itself have legible fonts. I need to change that in the next update. 3) Thanks! The app design and icons was one of my top priorities.

</comment></comment><comment><USER3> Love the design! Only thing that irritates me is the screen shots; can't read the red writing.

</comment><comment><AUTHOR> My first app, please write feedback and suggestions in comment! Thanks!</comment>


Sergey Brin, Please Pick up your Paychecks - <AUTHOR> http://angrystatistician.blogspot.com/2013/02/sergey-brin-please-pick-up-your.html <comment><USER2> I wrote most of this app on a contract nearly 10 years ago. We used it as a mentorship exercise to train state worker programmers in the SCO department on the (then new) ASP.NET Framework and SQL Server 2000. The DBA was familiar with Oracle and mainframes, but not SQL Server. It was written in ASP.NET 1.1 and used SQL Server 2000. From what I can tell it hasn't changed much at all.

"Programmer and database types will notice one problem immediately - no fuzzy string matching."

Yeah, I really wanted to implement that. The problem was we had to use Microsoft SQL Server and no third party database/indexing systems. SQL Server's Full Text Indexing run took too long during the nightly import job on year 2000 commodity hardware. We also had to do all of this within the constraints of training state workers and handing off something they could actually maintain.

Ah, the joys of state contracting.

<comment><USER3> It is really nice to have the original author show up and comment on something like this.

After looking at this site I started thinking about ways of crawling the whole database. The 500-record limit would make an alphabet tree crawl a bit more challenging but not too bad. Do you think the state agency would be amenable to requests for bulk download?

[edit] just saw your post which answered most of my questions while I was typing them.

</comment></comment><comment><USER4> [http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRe...](http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRecID=5460540)

[http://articles.chicagotribune.com/2002-03-08/news/020308001...](http://articles.chicagotribune.com/2002-03-08/news/0203080017_1_web- sites-recording-academy-music-files)

Ahhh, memories! Almost worth leaving the money unclaimed.

<comment><AUTHOR> My new employer was owed nearly $23000. Hopefully that gains me some good karma.

</comment></comment><comment><USER5> I have lived in several states including CA and found four claims for myself in the CA system due to forgotten accounts from prior addresses, here are a few that might be typical examples of what is being held in this program:

1\. Pacific Bell Telephone Company $72.24

2\. Verisign (SSL or domain payments) $73.50

3\. 20 shares of TravelZoo stock ~$400.00 value?

That TravelZoo stock was from back in the crazy/genius dotcom days when they gave out free stock for email referrals and sign ups. :) They did something right since they are still in business.

I do appreciate this program as these were my oversight/losses, things I had forgotten. However the process to place claims is a bit of a hassle: I need to physically print out forms, include copies of ID, etc. I'll write up a blog post of the process of claiming it when it's all said and done.

<comment><USER6> I cannot believe the "SEC has not asserted any violation of law by Travelzoo" for "the first offering of 'free shares' over the Internet" [1]. Technically, only a registered broker-dealer agent is allowed to transact shares, and never at a price unrelated to the market.

[1] [http://www.sec.gov/Archives/edgar/data/1133311/0000950138010...](http://www.sec.gov/Archives/edgar/data/1133311/000095013801000034/0000950138-01-000034-0007.pdf)

</comment></comment><comment><USER7> A very interesting blog post. The key idea is here: "Programmer and database types will notice one problem immediately - no fuzzy string matching. If your name or address was misspelled on the assets, or munged in the recording process, tracking down any assets belonging to you could become a difficult to impossible process. Given that this database has at most 18 million rows, there's no excuse for such a basic (and important) feature to be missing." A lot of government databases could improve usability enormously by implementing that suggestion.

</comment><comment><USER8> When I was in college I spent a summer going through Alaska's database (it was downloadable), cross referencing with a people search engine, and then mailing letters to people to tell them that they had missing money and how to claim it (and asking for a 5% cut). Made a decent summer's wage. Pretty sure I could have made a ton more money but it was pretty boring work so I just focused on school and more professional internships after that.

Still, an opportunity for someone feeling entrepreneurial out there.

<comment><USER9> Only 5%? That's cheap... you should have taken the fee model from collection agencies, and taken 20%+.

<comment><USER10> Except for the fact that the receiver is getting a letter in the mail from someone they've never met informing them that they are owed money. Pretty much screams scam, even though it isn't in this instance.

</comment></comment></comment><comment><AUTHOR> I'm guessing this person doesn't want the money back: [http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRe...](http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRecID=19287386)

<comment><USER11> And you found that how?

<comment><USER12> might be related to [http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRe...](http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRecID=19287382)

</comment></comment></comment><comment><USER13> A "Steven [P] Jobs", of Palo Alto and Woodside, has a bunch of small insurance, share, and dividend amounts due, including for example:

[http://scoweb.sco.ca.gov/UCP/NoticeDetails.aspx?propertyRecI...](http://scoweb.sco.ca.gov/UCP/NoticeDetails.aspx?propertyRecID=180364)

I suppose Oracle Shareowner Services has had a hard time reaching this reclusive character since their last reported contact date of "10/2/2008".

<comment><USER14> The address, 2101 WAVERLY ST PALO ALTO, does indeed confirm this is the late Steve Jobs.

<comment><AUTHOR> Linus Torvalds is owed about $250, e.g. [http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRe...](http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRecID=9787749)

<comment><USER15> I live by Linus, want me to walk over there and let him know?

</comment></comment></comment></comment><comment><USER16> I really have no idea why my cat is owed $5.98 by Ace Hardware:

[http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRe...](http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRecID=23168305)

The address they have is correct.

</comment><comment><USER17> Apparently, Barack Obama has $250 in unclaimed cashier's checks from First Republic Bank: [http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRe...](http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRecID=22491183)

Also, looks like Woz hasn't claimed his $5.61 from Apple yet: [http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRe...](http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRecID=6139496)

Edit: Related to an article posted earlier about John Draper/Cap'n Crunch, looks like he has some property to claim too:

[http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRe...](http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRecID=18967064)

[http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRe...](http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRecID=10016961)

Edit 2: Hmm, looks like Jesus Christ has some unclaimed property too: [http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRe...](http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRecID=22644738), [http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRe...](http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRecID=20802355), [http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRe...](http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRecID=7485039)

So I guess some of this is people using fake names.

</comment><comment><USER18> Is it just me, or is it really creepy that anyone can dig up this sort of info about your income/pension/insurance/etc?

Illinois' search is no better, but it does not display dollar amount details: <https://icash.illinois.gov/>

<comment><USER19> Property tax searches are a great way to DOX someone, btw.

<comment><USER20> DOX?

<comment><USER21> To find and release publicly personal information about someone -- name, address, phone number, and even SSN and credit card numbers -- in such away that they become identifiable to just about anyone online.

This was a hot topic a few months back when reddit had to deal with it: [http://www.wired.com/opinion/2012/10/truth-lies-doxxing- inte...](http://www.wired.com/opinion/2012/10/truth-lies-doxxing-internet- vigilanteism/)

<comment><USER22> Doxing is one of the forms of protected free speech that reddit bans.

<comment><USER23> Protected speech?

<comment><USER24> It's not actually illegal in the United States. As opposed to child porn that does not have 1st amendment protections.

<comment><USER22> It would not be legal (in general) in EU. Data Protection etc.

Yes, child porn is banned on reddit. But things that are protected free speech, but not child porn ("sexually suggestive images of minors") are also banned on reddit.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER25> A couple of states seemed to have outsourced this (Ohio, most notably) to another site - missingmoney.com. When searching for first and last names it returned likely matches as well, so perhaps they've implemented some fuzzy string matching along the way that will help citizens find what's owed.

Side note: As a result of this article I found >100 bucks owed to family members which will be a great boon to them. Thanks for posting.

</comment><comment><USER26> [http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRe...](http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRecID=13165179)

I bet this guy made keyboards.

</comment><comment><USER27> My nephew has $0.26 coming to him. I wonder if he'll track down a notary for the form that will charge less. Next question is: drive in the form or mail it? ;)

</comment><comment><USER28> Haha, Mark Zuckerberg (and Randi too) have a couple on there as well.

</comment><comment><USER29> Yahoo and Google are both owed pretty large amounts, e.g.:

[http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRe...](http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRecID=23031627)

[http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRe...](http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRecID=22521713)

</comment><comment><AUTHOR> I just found someone who has over $50000 coming to them. Unusual name, so they were easy to locate on LinkedIn and Facebook.

</comment><comment><USER30> I wonder what kinds of safeguards they have in place to prevent people with the same name from claiming each other's things.

<comment><USER31> You need to enter in your SSN/Tax ID/FEIN.

<comment><USER32> Well are their fake SSNs or other ID numbers because I'd doubt that Ms. Asdf Asdf (of CA 90210) has a genuine government ID number, [http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRe...](http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRecID=13165179).

 _Could_ you just claim that against your own ID?

</comment></comment></comment><comment><USER33> @Author: Thanks buddy, I didn't find anything for myself but some of my family members need to collect their check :)

</comment><comment><USER34> Hah, I looked up the Florida equivalent of this unclaimed property lookup/site, and it's humorously located at <https://www.fltreasurehunt.org>

Looks like I had some unclaimed cash in lieu of shares from a previous employer. Claimed!

<comment><USER35> that site seems sketchy as all get out...

<comment><USER34> Yeah, I agree it looks that way ... I thought it was a scammy site at first, but you can find it referenced on other sites (<http://www.fltreasury.org/>), and even in the local media as legit (ie. [http://articles.orlandosentinel.com/2003-07-11/news/03071003...](http://articles.orlandosentinel.com/2003-07-11/news/0307100370_1_sharon- richardson-dear-greg-whirlpool)). So unless this is a really well orchestrated scam, it's real as far as I can tell.

</comment></comment></comment><comment><USER36> Are there any companies that will monitor states unclaimed property and retrieve it for a commission?

<comment><USER37> I had a small amount of money in a bank account that I found in the Australian version; not long after I claimed it, I received a letter from 2 solicitors saying that I had unclaimed money (although they wouldn't say where from) that they could help me retrieve for a fee.

</comment></comment><comment><USER37> The Australian version - [https://www.moneysmart.gov.au/tools-and- resources/find-uncla...](https://www.moneysmart.gov.au/tools-and- resources/find-unclaimed-money/unclaimed-money-search)

</comment><comment><USER38> Maybe they could enact a law that allows them to take ownership of unclaimed property after a certain amount of time? It seems to work that way for abandoned storage units, lost property at airports, etc.

<comment><USER39> California does have escheat[1] laws which deal with unclaimed property and how the state handles situations where no rightful owner comes forward to claim.[2]

[1] <http://en.wikipedia.org/wiki/Escheat>

[2] [http://www.leginfo.ca.gov/cgi- bin/displaycode?section=ccp...](http://www.leginfo.ca.gov/cgi- bin/displaycode?section=ccp&group=01001-02000&file=1300-1301)

</comment></comment><comment><USER40> New York state has $12 Billion in unclaimed money! None of it belongs to me though. <http://www.osc.state.ny.us/ouf/index.htm>

</comment><comment><USER41> Arnie has yet to claim $0.15 [http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRe...](http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRecID=19234458)

<comment><AUTHOR> Netzero owes OJ Simpson $10: [http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRe...](http://scoweb.sco.ca.gov/UCP/PropertyDetails.aspx?propertyRecID=22965850)

</comment></comment><comment><USER33> For the State of Michigan: [http://www.michigan.gov/treasury/0,1607,7-121-44435_57506---...](http://www.michigan.gov/treasury/0,1607,7-121-44435_57506---,00.html)

</comment><comment><USER42> There are plenty of businesses out there that find money for people on commission. I just always thought they were some sort of dodge, sounds like there is some merit to it.

</comment><comment><AUTHOR> The results of mining the first 3.5 million records - <http://news.ycombinator.com/item?id=5255962>

</comment><comment><USER43> @_@ I just found a check for my self from a former employer.

</comment><comment><USER44> Ha, 99 stores owes me 39 dollars. I'd rather them send it to the red cross or something. I wasn't even expecting there to be anything either. _shrugs_

</comment><comment><USER45> This might be a goldmine for genealogical research...

</comment><comment><USER46> Heh. $24 from a Washington Mutual free checking account. Surely would have paid that in fees had I agreed to become a Chase member.

</comment><comment> jack-r-abbit I have $0.11 to claim. But since I would have to mail the signed documents in, at a cost of $0.45, I think I'll just let it go. :)

</comment><comment><AUTHOR> The state of California is holding over $6 billion in unclaimed property. The search engine doesn't even do fuzzy string matching.

<comment><USER47> Also note that:

        Due to the large volume of claims we receive and process,
        it may take up to 180 days to process your claim.

<comment><AUTHOR> Wow, that's insane. Spending $50m/year to notify people and process these claims could easily be justified given the sheer size of the assets being held.

<comment><USER13> Much of it will never be claimed (no matter how much effort is exerted). What is your reasoning for why that much expense would be justified?

The average per potential claimant ($6B / 17.6MM) is only about $340.

</comment></comment></comment></comment><comment><AUTHOR> I'm scraping the entire database. The largest amount I've found so far is $1.4m - I've sent her a message on Facebook.

</comment><comment><USER48> State of New York search: <https://ouf.osc.state.ny.us/>

<comment><USER43> seems to be down/

</comment></comment><comment><USER49> No joke I just found 100 bucks, thanks!

</comment><comment><USER50> I skimmed a few other states for relatives and found several hundred dollars. Thanks!

</comment><comment><USER51> Funny, just found out that distant family overseas is owed over $1000, not bad :)

</comment><comment><USER52> Haha, found $7.66 for a friend on the first search. :)

</comment><comment><USER53> Surprised this is the #1 story on HN...

<comment><USER54> There's a lot of data in there. Some of it is going to be interesting. Some might even be useful!

</comment></comment><comment><USER55> I'm owed $60! First round's on me.</comment>


Objc.io - periodical about best practices and advanced techniques in Objective-C - <AUTHOR> http://objc.io

<comment><USER2> This is a great idea ! There is no lack of content on Mac/iOS topics on the web, but I found it very hard to find in depth topics on good practices, architectures etc. Question though : where's the RSS ?

<comment><AUTHOR> Thanks a lot. We focused on shipping the first issue, and now have time to think about things like RSS feeds =)

</comment></comment><comment><USER3> I can't seem to find this story on the main part of the site?</comment>


Reversing the Petya ransomware with constraint solvers - <AUTHOR> http://0xec.blogspot.com/2016/04/reversing-petya-ransomware-with.html <comment><USER2> Well, since we're talking about 16 bit software ...

In 1991, my company was sandboxing commercial software. This was for try- before-you-buy. Except, instead of recompiling a crippled version, we would take a retail SKU, encipher the executables and then deliver with a device driver: a VxD. The VxD would hook the low level Int13 IO calls to pass all disk IO through a write-through cache. The installed app could read from anywhere on the disk. But, all attempts to write would copy the changed sectors to the cache. This would allow a perfect uninstall; simply remove the cache and the disk reverts back to its preinstalled state. This was because most software, back in 1991, assumed that you'd never want to uninstall. So, it would scatter its junk all over the place.

Now imagine if the VxD was part of the OS. Any downloaded exe could access the HD, but all writes would write-through to a separate cache. That was 25 years ago. This is a roundabout way of asking: how feasible is sandboxing to avoid malware?

<comment><USER3> The Linux machines in MIT's computer labs do essentially the same thing. Right after you log in, there's a wrapper around your entire X session that union- mounts a tmpfs on top of the root filesystem, puts you in that chroot, and gives you root. It's not secure against active malice (and not intended to be, since you have physical access to the machine), but it lets people run `sudo pip install` or `sudo npm install -g` or `sudo make install` or whatever, and it only stays around until they log out.

The trouble with root access is that there's always a way for active malice to get in. For instance, our approach is trivially vulnerable to loading a kernel module. It's possible that something like user namespaces would solve that today.

<comment><USER4> Are you sure it's not even more trivially vulnerable than that? From man 2 chroot:

 _This call does not change the current working directory, so that after the call '.' can be outside the tree rooted at '/'. In particular, the superuser can escape from a "chroot jail" by doing:_

 _mkdir foo; chroot foo; cd .._

<comment><USER5> you have misunderstood what you are reading. man 2 is the library doc not the chroot program, this page is just reminding people to cd into the root otherwise they will be vulnerable.

<comment><USER4> You're right insofar as you can't use the chroot command to escape a "chroot jail" because it automatically calls chdir() for you, but any root user can escape one by invoking the following linux system calls:

      chdir("/"); /* go to / of "chroot jail" */
      mkdir("foo", ...); /* create directory in jail */
      chroot("foo"); /* change / to foo */
      /* fail to chdir("foo"); */
      chdir(".."); /* instead go up parent (there is nothing preventing you since you are no longer in the "chroot jail" since the jail is now foo and you never entered it) */
      chdir("..");
      /* ... */
      chdir(".."); /* . is now the real root */
      chroot("."); /* change / to the real root */

This is why the man pages for the linux system call rightfully put "chroot jail" in scare quotes. They are trivially escaped by a root user making basic linux system calls, and the man pages even sketch out how for you. Some operating systems attempt to provide more secure chroot jails, but linux chroot() does not provide this.

<comment><USER6> > Some operating systems attempt to provide more secure chroot jails, but > linux chroot() does not provide this.

Note that this includes Linux itself with CLONE_NEWNS + pivot_root (which is what Docker does).

<comment><USER3> Oh! I didn't know Docker used pivot_root, and I was always curious why that call and chroot() both existed. This makes some sense.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Maybe I am too old school, but I can't understand how all these fancy 'constraint solvers' (and in another solution, definitions akin to genes and chromosomes (hair raising) [https://news.ycombinator.com/item?id=11474613](https://news.ycombinator.com/item?id=11474613)) are helping to write a standard brute-forcer for the flawed algorithm? Are these solvers doing anything more intelligent??

<comment><USER8> Solvers don't do brute force at all. Otherwise you wouldn't come up with ways to crack crypto. Solvers work with SAT and SMT languages, which means purely logical and extended to simple words and bitarrays, and the solvers mentioned there (cbmc is also in this league), can solve normal programming logic backwards.

Means you assert a result on a variable at the end, specify which variables and states will affect the wanted result, and the framework and solver will efficiently backtrack all the possible solutions of input variables to come up to your desired endstate, by filtering out impossible paths and values. Like in a game.

Z3 is very popular, because you can write your problem in python. Ages ago lisp was very popular, and some of the very first lisp programs from the 60ies were such solvers (general planner) leading to AI. And recently with the implementation of efficient simple open-source SMT solvers (minisat, ...) implemented within gcc or llvm you can now even use normal C programs and backtrack results, optimize and check types, do bounds checking, generate tests from bugs and so on. This is not comparable to simple fuzzing or brute- forcing, it knows the program flow, and works the flow backwards.

<comment><USER7> Thanks for explaining! I just can't understand how such 'solvers' can help with crypto, when strong crypto-algos are not reversible and hence there is no point to approach them backwards?

If any algorithm can be weakened by such 'problem solvers', it wouldn't be considered strong? For instance, can SHA256 be reversed (i.e. collision found) faster with such a solver? I guess not..

I realize that with crypto, solvers can optimize the flow of the algorithm, make it more efficient and omit repeating some code parts, but a good bruteforcer written in assembly can be as optimized..?

<comment><USER9> Crypto algorithms are deterministic, and therefore reversible. Solvers would work with any crypto, it's just that with normal crypto your computer would degrade to dust before they had time to finish. This was breakable because the Salsa algorithm was processing 16 bits instead of 32, which makes the set of possible earlier states astronomically smaller.

<comment> floodyberry- A "properly" implemented 16 bit Salsa20 would have 64/128 bits of key, which would still take a very long time to break. The reason _this_ implementation was broken (assuming the referenced snippet [1] is accurate) is the rotl function and the rotation values. The shifts are being calculated for 32 bits but are being used with 16 bit values. Instead of all 16 bits being rotated and used, half the shifts result in 0 while the others affect only a handful of high bits, which means there is very little diffusion going on.

[1]: [https://gist.githubusercontent.com/extremecoders- re/499d4617...](https://gist.githubusercontent.com/extremecoders- re/499d461753b50998f81c9011895f10fe/raw/49cd11f2e82767ab0df04f04506feb60c63d919b/borkedsalsasnip.c)

</comment></comment></comment></comment></comment><comment><USER10> _Searching for "expand 32-byte k" would directly lead you to Salsa. The exact code used in the malware can be found here. I am using the word exact in a broad sense. If it had been a ditto copy, we would have no chance of breaking it. The original Salsa implementation uses 32 bit (uint32_t) variables. This salsa implementation uses 16 bit variables for the same purpose borking it badly._

:)

The author made it look so easy to reverse this. Kudos, and thanks for the community service.

</comment><comment><USER11> [https://news.ycombinator.com/item?id=11474613](https://news.ycombinator.com/item?id=11474613)

<comment><USER12> Yes, thought of this too. Wonder if there's a difference in the versions they analysed (and broke).

</comment></comment><comment><USER13> This is awesome; funny that having Windows XP actually protects you from ransomeware in this case.

<comment><USER14> So does not having Windows at all (at least for this ransomware).

<comment><USER13> Yes, but that's not explicitly mentioned in the article and is expected given that it's targeting a specific platform. You could say the same of OSX.

fwiw I've been using various flavors of linux for years(CentOS/Arch/FreeBSD lately) for everything but a single dev laptop I keep Windows for testing/native apps.

My comment wasn't meant to be advocating Windows, let alone XP, I just thought it was funny.

</comment></comment></comment><comment><USER15> So is this a case of 16-bit keys being easy to bruteforce and even easier to use a symbolic solver on, or is there something more subtle going on?

<comment><USER16> This is not bruteforce. The flaw is the attackers used the same crypto algorithm but with smaller width variables. This rendered some of the crypto useless. Half of the total bytes in the keystream are always null and correspondingly half of total bytes in the ciphertext retain their original value. always Even with 16-bit variables proper implementation would have made this a lot tougher.

As they say, Don't' roll your own crypto.

<comment><USER17> _As they say, Don 't' roll your own crypto._

I have a feeling the malware author, working in 16-bit realmode, forgot that ints are usually 16 bits wide in that environment. A "typedef unsigned int uint32_t" behaves as expected in the usual 32/64-bit environment, but not in 16-bit. It's unlikely the author invented the 16-bit Salsa20 variant, but rather copied existing code and just compiled it wrongly.

</comment></comment></comment><comment><USER17> _Instead it encrypts the MFT (Master Partition Table) on NTFS volumes_

I wonder what happens with FAT32, or does it just do a stupidly simple "encrypt the first _n_ sectors of the disk"?

</comment><comment><USER18> I find it extremely amusing that after going through all the trouble of building the malware+infrastructure to sell keys, the authors couldn't be troubled to write the 5 lines of assembly code to enter protected mode. You can even leave paging off!

<comment><USER19> You don't even need to be in protected mode to use 32-bit registers. You can sort of bounce in and out just enough to use them with the 66 prefix. I used to do that but it's been so long I forgot how.

<comment><USER20> I think you're talking about unreal mode.

[http://wiki.osdev.org/Unreal_Mode](http://wiki.osdev.org/Unreal_Mode)

<comment><USER19> That's right, I was, but on further reflection you don't need to do anything special in this case since it's just doing 32 bit math, not 32 bit addressing. EAX/EBX/etc should just work in real mode IIRC.

</comment></comment></comment></comment><comment><USER21> Regarding the 'expand 32-byte k' part: I've seen other malware that obfuscates its strings that way, by writing them into a buffer using one instruction per character, so you can't retrieve them with a simple 'strings' command. The thing that bugs me is they've gone to that length to hide the string, but they didn't randomize the order of the instructions, and as a result you can trivially retrieve the string with your disassembler.</comment>


Spotify Stole My Dream - <AUTHOR> http://songandfilm.com/wp-content/uploads/2014/09/SA-SP-Comparison.png

<comment><AUTHOR> What would you do if Spotify stole your most prized idea. Your dent in the universe. I have loads of proof that their new site: www.thatsongwhen.com is a ripoff of my idea.

Patent pending // email chain // financial statements //

They've even ripped off my tag line: "Every Song has a Memory" theirs: "Every Song has a Story"

<comment><USER2> Do you have a link to your site? [http://songafter.com/](http://songafter.com/) is a blank white page which appears to be parked by GoDaddy.</comment></comment>