Learn C The Hard Way - <AUTHOR> http://learncodethehardway.org/ <comment><USER3> Ohloh says I've changed at least half million lines of C code (<https://www.ohloh.net/accounts/rhp/positions/total>) Play me a tiny violin ;-)

What kinda bugs me is that whenever people go to teach C, they make out like it _has_ to be a low-level exercise, as if writing in C suddenly means you can't use abstract data types or object-oriented style or name your functions properly or have Unicode support.

For example, people teach libc string APIs like scanf() and strtok(), which should almost never be used. (See <http://vsftpd.beasts.org/IMPLEMENTATION> for one take.) Instead, use <http://git.gnome.org/browse/glib/tree/glib/gstring.h> or write your own like [http://cgit.freedesktop.org/dbus/dbus/tree/dbus/dbus- string....](http://cgit.freedesktop.org/dbus/dbus/tree/dbus/dbus-string.h)

If you're going to display user-visible text, you are pretty much required to link to GLib or another Unicode library, since libc doesn't have what you need (unless you want to use the old pre-unicode multi-encoding insanity).

Don't use fgets() and other pain like that, use g_file_get_contents() perhaps, or another library. (g_file_get_contents is in [http://developer.gnome.org/glib/stable/glib-File- Utilities.h...](http://developer.gnome.org/glib/stable/glib-File- Utilities.html))

You need help from a library other than libc to deal with portability, internationalization, security, and general sanity.

Maybe more importantly, a library will show you examples that in C you can still use all the good design principles you'd use in a higher-level language.

I told someone to "use a string class" in C recently for example, and they said "C doesn't have classes" - this is confusing syntax with concepts.

C requires more typing and more worrying about memory management, that's all. It doesn't mean that all the best practices you know can be tossed.

There's a whole lot to be said about how to write large, maintainable codebases in C, and it can even be done. It's not something I would or do choose to do these days, but it can be done.

One other thought, two of the highest-profile C codebases, the Linux kernel and the C library, have extremely weird requirements that simply do not apply to most regular programs. However, a lot of people working in C or writing about C have experience with those codebases, and it shows.

<comment><USER4> I'm glad you got so much about how my book is written from a few paragraphs in an unfinished manuscript for it.

<comment><USER5> You should stop thinking everyone is attacking you. I think you'd be happier.

Really though, there's no content here. The fact it's been voted to #1 on hackernews shows just how bad things are.

Items _should_ be upvoted on their merit, rather than who did them. Someone writing _another_ book about programming C isn't newsworthy.

<comment><USER6> I don't really understand your comment.

1\. The post is about Zed's draft; is it really so far of a leap to interpret hp's remarks as a criticism of the book?

2\. Is this a fair paraphrase? "Everyone here isn't attacking you, also, your draft sucks and shouldn't have been posted on HN."

<comment><USER7> ' Is this a fair paraphrase? "Everyone here isn't attacking you, also, your draft sucks and shouldn't have been posted on HN."'

No, it's not. speckledjim is complaining that someone writing another book on C is not news, he doesn't say anything about the draft sucking.

<comment><USER6> Implied by "Really though, there's no content here." Maybe they meant the comments, though.

<comment><USER8> I think he's referring to this topic, rather than the draft.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> I always had an idea of a 'for programmers' series of books for those who know how to program in one language (say, C++, Java or PHP) and wish to pick up a new language

eg. 'python for programmers' would not need the first half of it dedicated to explaining strings, loops etc. and could get straight into it from a programmers perspective - a bit like K&R. You could then dedicate more content to explaining philosophy, design decisions, internals, history, politics (learn all the in-jokes ;)), etc.

this would also be a good format to learn new paradigms, eg. 'functional programming in scheme, for programmers'

<comment><USER10> Indeed, I currently get turned off by most books I pick up, simply because they start out on a too basic general level.

If you however dig a little deeper you can usually find stuff that isn't too tutorialish. Like <http://www.c-faq.com/top.html> which has been an extremely solid resource for me.

<comment><USER4> I'm hoping to make this book ramp up faster than LPTHW, since I'm assuming people have either read that book or know one programming language already. However, I'm also a big proponent of practicing the syntax even if you think you're an expert already. It just makes things way easier later on.

<comment><USER9> how about 'if you are proficient at another language, feel free to skip to chapter x'? and put the generalized stuff at that point

<comment><USER4> If you really are that proficient, you should be able to figure out what you can skip.

<comment><USER11> I'm not so sure about that. The devil's in the details - you might think you know something well enough to skip it, but get caught out later.

</comment></comment></comment></comment></comment></comment><comment><USER12> When I first learned C, I did so under DOS, an environment in which you could declare a pointer to video memory, make a magic call, and start drawing graphics. I found that a memorable way to learn pointers. Sadly, doing that in the modern world requires quite a bit more setup.

<comment><USER13> You can do something similar now using SDL. In fact, unless you are blitting bitmaps or using additional libraries, it is the only way to get stuff on screen. SDL gives you a pointer that corresponds to the video memory and you stick colors into it.

Here is a tutorial for using SDL for 'old school' graphics programming:

<http://sol.gfxile.net/gp/>

Of course this would require the student to install SDL and write a makefile to link it all together. I feel that is something worth covering though, since most books just do a bunch of hand waving when it comes to linking external libraries.

<comment><USER12> When I said "quite a bit more setup", I had SDL in mind. :) Yes, you can get a raw pointer to a graphics buffer via SDL, but in addition to the extra setup to get a window, you have to make extra calls (such as SDL_Flip or SDL_UpdateRect) to make your changes visible.

</comment></comment></comment><comment><USER14> Zed, your level of productivity is truly inspiring. The best of luck to you.

<comment><USER15> I think the level of self-promotion and/or other-people-promoting-him is the key factor. Not really the supposed productivity. I know many people who get a lot done, both for day jobs, for contract work, as a hobby, as entreprenurial ventures, etc. but 99.9% never hits the front page of HN on a regular basis like Zed's activity seems to. Which doesn't lessen what he does and his skills, but it does pull back the camera a bit to put it into a broader context. Not everyone self-promotes to the same extent as Mr. Shaw, or has other people promote them.

<comment><USER4> I personally have no idea why this stuff hits this site that often. Take this for instance: It is a half-finished manuscript that I announced in a tweet to people who follow me on twitter and asked for it. Already at the top of this set of comments is a dickhead saying he's such a bad ass 'cause he's changed "half a million lines of C code" and he thinks I'm not writing the book correctly because I'm being too low level. He gets all of this from three exercises and three paragraphs in the introduction.

Frankly, I consider hackernews kind of irritating and not useful as a promotional tool. It amounts to about 5% of my traffic for 1 day at best, and I only have to be here because if I'm not answering the petty little idiots who troll here then the rumors spread through my professional circles.

In other words: I could live without this kind of promotion, so it's definitely not "self-promotion".

<comment><USER16> Why is it that every comment I read by you is either you whining about being treated unfairly or you attacking someone who supposedly "attacked" you? Are you honestly that insecure? Do you read every comment as though it is in some way attempting to degrade your image?

Here you denigrate the HN community, saying it doesn't generate a significant amount of traffic for your site or whatever, and then go on to say you won't respond to the petty "idiots". I see. You're too "professional" for that. Obviously HN is so meaningless to you that you needn't bother with it. Yet you're here, commenting, making an ass out of yourself.

Woe is poor Zed Shaw; always the victim.

<comment><USER17> A quick look through Zed's comment history tells me that the % of posts he has made that could fit your description is roughly 1%.

So Im going to go with you having a selection bias.

OTOH I do appreciate your vigorous defense of the HN community, too many people just dont care about implied insults to their self identified tribal group.

Go llambda!

<comment><USER16> You're probably right. I've only seen a couple of his recent comments in threads related to his projects or site (and that thread about the GitHub community). So I no doubt have a selection bias; I suppose it's worth noting his reputation proceeds him, deserved or otherwise.

Nonetheless it's disheartening to see self-proclaimed "professionals" (I use this term loosely for while a person may be employed professionally this is not a guarantee a given individual will behave professionally: they are distinct things) who are well known throughout the community, behave like trolls. And even more so when they decide it's appropriate to take a shit on this community.

Well I will always try my best to preserve what I value. It's in my nature I guess. So thank you. :)

<comment><USER17> heh. His reputation appears to be a many faceted thing.

I, for instance, have been genuinely impressed with his productivity and his output, his choice of projects and his code and am moved by that aspect of myself that values quality to think very highly of him.

You, on the other hand, appear to feel that the most important aspect of his output is the way he achieves the standards that you have set for him - <USER2> by how he expresses himself towards those who he feels are being disrespectful or rude at him on the internet.

Just out of interest, do you believe that making a strongly negative personal judgment based on a 'fact' that is clearly incorrect and could be easily checked with just a few clicks is the act of a professional? do you meet your own high standards?

<comment><USER16> First I will call out your blatant fallacy: tu quoque. Now let's review things:

I readily admit I'm a hypocrite. But also note, I don't claim nor ever claimed to be a professional; I'm not. I'm not at the helm of projects that are useful to and used by many people. I haven't written books on the topic of computer science. Nor have I given talks or do I run a website that receives a large volume of traffic. Maybe that qualifies [him] as working in the domain of a professional, yes?

Although he may have achieved great things, this doesn't give him a license to troll HN and it doesn't excuse him of baseless personal attacks. The comments he made that I replied to were no less than that, at best. At worst, they were insight into his character. Certainly we can hope the latter is not true. Nonetheless, there's no place for that kind of bullshit; it's inexcusable, I don't care who you are. I made such a judgement because he clearly attacked the user "hp" who had done nothing more than make an observation about texts that introduce C in general. Zed's reaction was puerile, irrational, and even paranoid. I hope you aren't standing up for such behavior?

<comment><USER17> "Maybe that qualifies [him] as working in the domain of a professional, yes?"

Either you think he is a professional, or you do not. You appear to be holding up a standard, claiming that you believe he fits the criteria needed to be judged by it, and then lambasting him for not living up to the standard you have set. Overall, I find this somewhat confusing, but possibly I dont have sufficient context to judge.

TBH Im not particularly motivated to 'stand up' for the behavior of anyone I dont know.

I am interested in what makes you so interested in casting judgment on Zed, as opposed to on yourself?

Whatever puerile, irrational and paranoid responses Zed may have produced, you seem to be matching them with a self admitted hypocrisy, a large amount of self righteous vitriol and a bewildering statement of tribal affiliation to an anonymous internet discussion forum that apparently requires your outraged protection lest it collapses completely under the weight of a misunderstanding between Zed and another participant.

Zed has, to my knowledge, done you no harm of any kind. He certainly represents absolutely no realistic threat to HN.

why do you feel justified abusing him in this fashion?

<comment><USER16> tu quoque. [1]

[1] <http://en.wikipedia.org/wiki/Tu_quoque>

<comment><USER17> dude, I heard you before.

It doesn't apply in this case. I will leave it as an exercise for the reader to discern why.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> I'll be interested to see how this compares to K&R, which not only teaches the C language but also C idioms and the reasons for using them. K&R is still one of the very best programming books. Every other C book I've read is inferior. Peter van der Linden's "Expert C Programming" is the only book on C besides K&R that I've learned anything from.

Good luck, I'm all for more programmers understanding C but I wonder if the wonderful days of programming close to the hardware are ancient history. "[P]eople are deathly afraid of C thanks to other language inventor's excellent marketing against it." Maybe, but I think the _raison d'être_ for C is not apparent to programmers who started with Java, Python, or Ruby.

<comment><USER19> K&R won't work for someone beginning programming. This book is specifically targeted towards teaching programming to programming virgins.

The examples and exercises K&R uses will be very hard for beginners. When it builds a recursive descent top down parser to read the declarations in English(and vice-versa), that will be totally lost on the beginners.

K&R wasn't written for beginners and I doubt it will work well for a programming beginner - should be fine for someone who already knows programming in some other language.

<comment><USER4> Nope, this book isn't for total beginners. I mean, it might work, but I'm actually telling the total newbs to go read <http://learnpythonthehardway.org/> first. My thought is teaching "computational thinking" is easier with a language like Python, so people should start there.

</comment></comment></comment><comment><USER20> Do people really think C is some mysterious, inscrutable language?

"To many programmers, this makes C scary and evil."

Is this actually true for people? I find C code generally very easy and straightforward to understand; there's not any magic behind the scenes, like there is in any language that's more "high level" than C.

<comment><USER21> Many of the friends I made in my CS classes were terrible with pointers. I never really understood why they didn't grasp pointers, but it was a major stumbling block for them in C/C++

<comment><USER22>
        I never really understood why they didn't grasp pointers

The root of the problem is the language designers' loose use of star. "star something" is contained in a phrase that means one thing at declaration, "star something" has a different meaning the rest of the time.

        #include <stdio.h>
        void eg(int i) {
            int *j = &i; // "huh? Put the address of i into *j?"
            *j = *j + 1;
            printf("%d\n", *j);
        }
        int main() {
            eg(4);
        }

With more detail. In the line..

        int *var = something;

.. the system assigns to the pointer. Yet in..

        *var = 6;

.. it assigns to the contents of the pointer.

Common usage creates further room for confusion:

        int *var; // <- this is what people write
        int* var; // <- instead of this

If they'd made the syntax ".int var", and then used * solely for dereferencing, people wouldn't have these problems learning pointers. Consider

        #include <stdio.h>
        void eg(int i) {
            .int j = &i;
            *j = *j + 1;
            printf("%d\n", *j);
        }
        int main() {
            eg(4);
        }

Further confusion comes from (1) special arrangements around string declaration and (2) printf use of %s to expect a string pointer when %d and %f expects (non-pointer) simple int and simple float.

        char* something = "huh? so now this does goe into *something?";

<comment><USER23> That's because of the (visually) 'wrong' use of * (wrong in the sense that it's unintuitive). The key is that * is part of the _type_ of the declaration, not of the variable; an int* is not an int. So

      int *j = &i;

is more correctly expressed and easier to understand when written like

       int* j = &i;

The only reason to put the * in front of the variable name is when declaring several pointers in one line. So the solution is to only use it that context, or not doing it at all.

<comment><USER24> This bothers me so much about C/C++ syntax. int* a, b; should clearly declare two int pointers, not one int pointer and one int.

Stroustrup wrote something somewhere where he explained that int* a; is more appropriate for use in C++ because C++ is supposed to be more focused on types, and int * a; is more appropriate for C because of something about C's philosophy, but I can't remember what. I wish they would have changed the syntax for C++, but I guess he couldn't have while still keeping C++ a superset of C.

edit: found it: <http://www2.research.att.com/~bs/bs_faq2.html#whitespace>

"A ``typical C programmer'' writes ``int _p;'' and explains it ``_ p is what is the int'' emphasizing syntax, and may point to the C (and C++) declaration grammar to argue for the correctness of the style. Indeed, the * binds to the name p in the grammar.

A ``typical C++ programmer'' writes ``int* p;'' and explains it ``p is a pointer to an int'' emphasizing type. Indeed the type of p is int*. I clearly prefer that emphasis and see it as important for using the more advanced parts of C++ well."

</comment></comment></comment></comment></comment><comment><USER25> I'm very excited to see Zed working on this. This exercise-driven tutorial format seems efficient and practical, but what makes this really stand out is Zed's approach to the overall goal.

I greatly appreciate an 'opinionated' programming book. I've probably heard more debates on formatting and style for C than any other language.

</comment><comment><USER26> Oh man, totally looking forward to this. It seems like so many programmers are kind of afraid of C because it's reputation and avoid learning it because they're language of choice is 'more productive.' Which is really unfortunate, I've found having a good amount of C is hugely beneficial to understanding what's going on under the hood when you're using a higher level language, even if you rarely actually program in C itself.

Plus even if you do primarily program in higher level languages, it's a great tool to have in your belt when you need to fix a bug in a library whose bindings you're using in higher level language, or when you legitimately do need to eak a little more performance from a particular piece of code.

Also, love that the book starts by teaching you how to use make as well, so many C books gloss over the tools.

</comment><comment><USER27> I know a fair amount of C. But I am still looking forward to this book as I hear that LPTHW taught something to even intermediate level people. Besides the exercises are usually good and would like to solve them.

</comment><comment><USER28> My wish came true. :-)

<http://apps.ycombinator.com/item?id=1727617>

</comment><comment><USER29> How about having a webpage with recommended libs for newbies to use? Sort of like NodeJS modules page.

</comment><comment><USER30> I look forward to the content. As a beginning C++ instructor I find there is something lacking between the truth of the language and the conventions for presenting it. Nobody, AFAIK save for the truly hardcore student, has nailed it.

<comment><USER4> Got any feedback on the things students get wrong? My experience is they fail to grasp memory management, pointers, functions as pointers, linkers or just how a program actually runs.

If you've got others I'd love to hear them.

<comment><USER20> As a teaching assistant for a class (<http://www.cs.cmu.edu/~410/>) where students write a whole lot of code in C, _please_ introduce the address-of (&) operator and explain how to obtain pointers without using malloc(). Do this before the concept of the heap is ever introduced at all.

Be careful when explaining the compiler and how a program actually runs. I've found that a lot of student problems come from "the compiler is magic" when it really isn't (maybe related to my other surprised comment below, about how people "don't get C"--they attribute too much magic to the compiler.) Maybe even emphasize that every piece of C code can be translated in a fairly easy fashion to a pretty small amount of assembly.

For the preprocessor, emphasize that it is a solely textual replacement, with no symbolic evaluation. Explain why:

        #define FOO BAR + BAZ

or

        #define MAX(x,y) (((x) < (y)) ?  (y) : (x))

will go horribly wrong (the first in 5*FOO, the second in MAX(x++, y++)).

<comment><USER31> I find it is much more helpful, when teaching C, to avoid the word 'address', and call (&) the pointer-to operator. Thinking of pointers as numbers (which the address-analogy does) tends to be harmful for newer C programmers because they want to treat them like numbers.

<comment><USER32> They _are_ numbers (either 32-bit or 64-bit). Nothing more, nothing less. I don't understand why you wouldn't want to think of them that way.

For example...

      const char* current = "ohai thar";
      const char* end     = current + strlen( current );

      assert( end >= current );
      size_t bytecount = (end - current);

(size_t is an unsigned type, so if 'end' is less than 'current', it will overflow. If you want to allow for that, use ptrdiff_t.)

<comment><USER31> No, they aren't numbers. The standard is quite clear on this. Consider old DOS architecture where you had a section and offset. Your code is also not well- defined C. C only lets you perform subtraction between two pointers in the same block, this code is at best implementation defined and worst undefined (I can't remember).

</comment></comment></comment></comment></comment></comment><comment><USER33> Has anyone actually used "Learn Python the Hard Way" in a beneficial way? I started it several times but never got very far and just learned Python from other sources. I didn't really care for the approach.

<comment><USER19> Was it your first book? If not, you weren't in the target audience from what I make out of the contents of the book.

For people who already know programming, the official tutorial is the fastest and the best way to start: <http://docs.python.org/tutorial/index.html>

</comment></comment><comment><USER34> Why is %d used to interpolate an integer into a format string? I don't recall seeing this done for any reason before.

I hope Zed actually covers how dangerous format strings can be if not handled properly. Format strings are still (hilariously) one of the major exploitation vectors in C-based applications today.

Edit: According to Wikipedia, %i and %d are synonymous. Sorry for the confusion.

<comment><USER4> It's not for the type, but for the output. The 'd' means "decimal" output. For example, you can do %x to "hexadecimal" output, and %o for octal. Of course, there's some complex interplay with what type you hand that function.

As for how "dangerous" it is, yeah it's not going to rape your family, it'll just crash. So I'll be showing people how to prevent it.

<comment><USER34> It'll crash and potentially allow code execution if the rest of the args are user coercible. Check out the first few chapters of The Shellcoder's Handbook for examples.

Thanks for the explanation. I've never seen/had to use %d with integers. I've only used it with %.Nd for floats/doubles.

<comment><USER4> code/ex3.c:6: warning: format '%d' expects type 'int', but argument 2 has type 'double'

You should probably read this book. :-)

<comment><USER34> Hmm, I don't recall MSVC++ ever warning about that! Unfortunately, I did use Windows at one point in my career.

I'll pass on reading it since I don't intend to write C ever again, but I hope the book works out well for you. :)

Edit: Just dug up some of my old C code. It is indeed %.2f that I was thinking of. Sorry for the confusion once again.

</comment></comment></comment></comment></comment><comment><USER35> I hope this book will show lots of new C programmers the beauty of pointers in hand-holdy detail ('cause that's the level needed, I feel). Maybe basic stuff about VM, so all the pointer operations make sense (everything is a byte at some offset etc.).

At least I didn't fully appreciate C until I understood some of the underlying concepts.

Looking forward to reading this!

</comment><comment><USER36> Having read a fair bit of LPTHW (though I had no actual interest in the language), I am really excited about this.

One of the best things about LPTHW was the context it was written in, and if LCTHW is written in the same way, it should be a really awesome read!

<comment><USER4> That's the idea, although I'm going to assume you know how to use at least one programming language, and probably redirect total newbies to LPTHW if they don't. That should make it easier to ramp up in C and then do cool useful stuff with it.

<comment><USER36> That's awesome to hear. I actually know a bit of C, but it has been years since I used it - so this book seems like a good one to read to 'reboot' my C skills.

I'll definitely be waiting anxiously for you to finish.

Good luck!

</comment></comment></comment><comment><USER37> I jokingly made this suggestion to him on twitter. He posted a few "assignments" and we (I assume it was more than myself participating) posted pics of our console output.

This guy loves to program

</comment><comment><USER38> I asked and Zed delivers: <https://twitter.com/#!/megamark16/status/71183280287920128>

</comment><comment><USER39> Nice! Where's the rest?

</comment><comment><USER40> The biggest problem with C is not the language C, for it is a small and mostly simple language with a few warts (I'm looking at you, pointer syntax), it is the ecosystem into which you are thrust when you first use it.

That is, the ecosystem of, "What can I include without dicking around with compiler and linker settings, which I do not care to learn very well because I am just starting?", and the ecosystem of, "Why are all these standard libraries full of functions that all the documentation tells me not to use?", and most importantly, the ecosystem of, "Oh, this looks like a nice library that would make my life easy, (and later), wait, why isn't my program working on this other machine? I copied the binary over? Wait, what's this about a missing so? Oh, that's the library I installed, wait, how do I put it the same directory? Oh my god so many configuration settings! Wait, why can it still not find the library? It's right there now! What's LD_LIBRARY_PATH? LD_LIBRARY_PATH is bad? Why doesn't -R work? Oh, that's only for Solaris? What's the equivalent for friggin' Linux?! Ah, rpath, wait... it's trying to find the ABSOLUTE path? UGGARRHGHGHAAHHHH! Okay, finally, $ORIGIN... now let me just put that in the make file like they said I should.... _AHGHGHGHGHGHGHHHHHHHHHHHHHHH!!!!!!!_ "

Which is to say, the ecosystem of fucking ratholes that have built up over 40 years of poor tool design that cannot be corrected now due to historical precedent.

<comment><USER41> C++ has the same issues.

To add another example, binary only distributions (e.g. some commercial software) bring their dependencies with them, meaning that you have to use roughly the same environment (compiler version, stl) to use them.

Libraries work a lot better in VM languages.

<comment><USER42> It doesn't take a VM language or an interpreted lanugage to get libraries working well. Take a look at Haskell's Cabal system and Hackage package library. It works pretty good and doesn't use a VM.

With C and C++, you'll have to use your operating system's package management to get all the important libraries (or build them by hand from Git sources, etc), then have a build system that configures the build environment and searches for all the libraries and other dependencies. It's not as nice as using a dedicated tool for this, like Gem and Bundler in Ruby but usually you get the job done - unless you work on Windows and don't have a package manager.

</comment></comment></comment><comment><USER43> I have the "learncthehardway.com" domain, waiting for Zed to stop being so insanely busy so that I can do the hand-off. :)

</comment><comment><USER44> I'm skeptical that it will be an alternative to K&R 2nd ed but nonetheless I'm interested in the result.

</comment><comment><USER45> Isn't "C For Programmers" essentially "HOWTO Use Pointers"? Is there another really complicated idea that C has which most of its heirs do not have?

<comment><USER32> Strings, and why strlen(s) != the number of letters in a string (UTF-8).

Why a string must end with a 0 byte.

Binary shifting numbers, especially signed numbers.

Memory management; it's fun for the whole family, and more than just knowing how to allocate memory and store a pointer to it.

Some other points that I'm sure I'm missing.

<comment><USER46> > Why a string must end with a 0 byte.

Unless it's a pstring or you're working with assembly, other language, etc.

But yes there is a lot to learn with C you don't necessarily get with higher level languages in most cases.

</comment></comment></comment><comment><USER47> It should say "Learn C and make the hard way".

<comment><USER4> Oh, there's a _lot_ more tools on the way. C is one language that you could spend whole books on just the tools.

<comment><USER19> May be a good idea to mention some of them. `valgrind` and `lint` comes to mind. On second thoughts, `lint` can be dropped; compiler warnings are good enough for a beginner(in fact, good enough for experienced programmers; subjective).

<comment><USER12> The original lint tools seem entirely superseded by modern compiler warnings. On the other hand, a whole new class of static analysis tools exist now, such as Sparse, Coccinelle, Frama-C, and in the proprietary world Coverity.

</comment></comment></comment></comment><comment><USER48> The problem with C isn't C. It's shitty C programmers.

Learn how the language works, follow good patterns, and expect some bumps in the road.

Most of the time, though, you can use a different higher level language, and be a happier and less stressed programmer

</comment><comment><USER49> Go Zed! I'll buy this when it's ready for payment!

</comment><comment><USER50> I learned C the hard way by taking this course, motherfucker <http://www.cs.columbia.edu/~jae/cs3157/2009-1/syllabus.html> [http://www.cs.columbia.edu/~jae/papers/3157-paper-v2.2-camer...](http://www.cs.columbia.edu/~jae/papers/3157-paper-v2.2-camera- final.pdf)

<comment><USER51> Actually, that looks like a pretty easy way to learn C; a whole semester on it, beginning with things like using ssh? With instructors and TAs?

But ooh, Columbia, so you know it's hardkore.</comment></comment>


CryptoKitties is causing ethereum network congestion - <AUTHOR> https://qz.com/1145833/cryptokitties-is-causing-ethereum-network-congestion/ <comment><USER2> The timing of this dApp is perfect since the Neopet generation has just enough income to buy a few Eth.

<comment><USER3> I loved neopets and I do believe it piqued my interest in markets

</comment></comment><comment><USER4> Real life is indeed stranger than fiction. If Neil Stephenson had written this .. people would have laughed at the absurdity.

</comment><comment><USER5> I know some people who already made x60 off this... It's ridiculous. There has to be something behind it. A money laundering front?</comment>


Ask HN: How to Successfully Handle Fortune 500 Companies? - <AUTHOR>

My team and I have been working on our start-up for about 20 months.  Our strengths lie in tech and creativity and ATM we severely lack business acumen.
I wonder if others here have dealt with massive companies who were extremely eager to work with you and your technology, but the deal fell through.  Specifically, because your contact( for us a VP of Tech) you were working with did not want to be bothered by any legal document that protected years of work.  His company would greatly benefit from our non-public patent-pending technology at the event and overall their entire bottom line.
Though now this great opportunity is gone, I'm wondering maybe we should have rolled the dice and just RAN with it.  Is business more important, then protecting your IP and not having any legal contract between you and a Fortune 500 company?  We thought a short page & half legal document was fair, but overall it killed the deal.
This would have been our first real customer and a massive one at that.  The VP was going to use our event technology an upcoming conference full of the CEOs of this massive company.  Our technology is currently in private closed beta.
What has your experience been?  All our advisers said they must sign the document. <comment><USER2> My experience as an observer is that people at big and small companies will try to get free stuff as long as possible, then they'll negotiate forever, then they will never pay until threatened. Some big companies have as part of their business plan to put their smaller partners out of business just as a product is delivered or project finished.

I feel you made the right move wrt the VP. Working with F500 companies requires a long time commitment and your company needs some weight. You need something that forces the F500 to re-engage and pay up after their first attempt to screw you.

Secondly VPs don't typically go looking for technology to buy. They tell people below them to do that and then just sign off. In your case the VP literally wanted some free tech to show off at a conference. You need to sell to someone lower level who is not going to be a man child. Imagine someone who went through childhood and then just...kept going. Next time offer some free on-site consulting and then get the low level managers you meet to buy in to the project and actually pay (to impress their vp, of course!)

</comment><comment><USER3> The bad news is that they're probably not as interested in you as they made it seem, and you never had a real opportunity with them. I know it's disappointing to hear, and I assure you everyone has made that mistake themselves -- myself included.

Big companies do a lot of outbound R&D -- conversations, PoC's (proof of concepts), and so on. Sometimes these conversations are a 30 minute call. Sometimes they're a series of meetings. Sometimes they even try your product. In almost all cases, when they become serious about trying your product (e.g. outside of a sandbox), they'll want a legal agreement.

NDAs don't count here, they're generally vanilla.

What they'll want is a trial agreement (sometimes called a Pilot Agreement, Software Evaluation Agreement, and so on). This agreement will almost certainly protect them more than it will protect you, but it can be negotiated. They're quite easy to generate, particularly for larger Fortune 500 companies that generally have entire procurement departments dedicated to this process. The agreement will cover your IP, situations where you might infringe on IP, general indemnification, and so on. Sometimes the procurement guys really won't want to negotiate it -- their job is to protect the interest of the company, and they almost act adversarial to the person trying to bring you into the company as a "check-and-balance" since the person bringing you in may have already fallen in love. In those cases the person requesting the evaluation can sometimes apply pressure as well.

So, when a VP at a large Fortune 500 company tells you they won't do a trial agreement with you, or won't be bothered to discuss it at all, it largely tells you that they're just not that interested in it. We've dealt with companies where even a non-manager can generate software evals.

There IS one caveat here: They haven't seen/tried/etc. your product. If you're over-protecting by, for example, expecting them to sign an NDA or a software eval agreement without them first seeing a demo/trial, it's quite likely they'll usually just turn away. It doesn't sound like that was the case here, but something to keep in mind.

<comment><AUTHOR> So at a recent hackathon we used our framework that syncs up all devices in a room and created another/new audience engagement app. We pitched the app and immediately after a VP of X company said I have to use this at my year end board meeting. For the next week and half he was sending us resources (images and other documents) and during that time we were speaking with our advisers/lawyers creating a Beta Evaluation document. The VP was extremely eager all the way until he received the document where his excitement waned. Thereafter he sent two emails end of last week and then today said he was going in a different direction :-(

Overall this isn't our first encounter with a massive company. But our experiences and efforts thus far have not yielded any such clients.

Do you mind if I ask how you and your company finally sealed your first big deal and was it with a mid to large sized company?

Really appreciate your insight. Thanks!

<comment><USER3> Sure, I have two separate stories here that might be relevant:

The first company we dealt with was a massive Fortune 50 company early in our existence. They were very interested in our technology, and we were both young and naive. Still, we've been warned so often about dealing with large companies that pretty early into the process we insisted on signing a paid Software Eval agreement. In retrospect, it was a pretty small amount of money (five digits), but at the time it felt like a huge win. From the moment they said "we'd like to try your software", the procurement department was involved -- NDA, software eval docs, etc.

The software eval was "successful" (in fact, we even presented to the CTO, the President, and VP of Engineering of the company), but it wasn't truly an eval. It was a very custom-tailored version of our product for their deployment. And yet it still didn't really go anywhere. Things fizzled out with them for a while and then about 12 months later they came back once again asking to do another evaluation. This time we insisted on success criteria that required them to commit to a set number of seats if the evaluation was successful. The evaluation was successful, and they bought the seats, but even now the deployment is in a state of "proof of concept" \-- they bought ~1,000 seats from us, but at their organization size it's just not that material yet. Seriously.

Another company we dealt with was a ~15,000 employee company. They too were very interested in our technology. They emailed us and convinced us to come and do a demo in person. Having liked the demo they told us they wanted to pilot the software. This immediately kicked off the conversation with the procurement department. NDA, software eval, success criteria, etc. This time, we did need to do some additional work, but we were very diligent in making sure that _any_ custom work that we do was applicable to all customers. They too have now bought ~1,000 seats, and are now in the process of rolling AeroFS out to the rest of their company, but as a benchmark, it has been ~12 months since they bought their initial 1,000 seat license. In some ways, even for them the 1,000 seat license was a continuation of their PoC.

Enterprise sales are slow, but the resulting contracts can be quite lucrative. Just make sure you qualify your customers. It sounds like you only lost ~2 weeks on this deal, and that's really not the end of the world :)

<comment><AUTHOR> As east coasters with a small size network finding advisers who have dealt with Fortune 500 companies(they surreptitiously reach out to us) has proven challenging. Two months into building our Bluetooth over the web type framework we were invited out to the valley to demo to an entity. Unfortunately, we had no one to turn to who may have said, "Ummm, you might not want to go as they are just fishing," as we learned they were. It would have been great to have heard the same warning you received via your network.

I do wonder if maybe YC and or some founders could write a joint post about their stories and pitfalls in dealing with large to massive companies? I would think this would be extremely helpful to those not in the Valley or within YC.

Well I really appreciate you sharing your experiences in this regards (helpful) and if interested in the app that prompted this post I've sent you a link to your email :-)</comment></comment></comment></comment>


Show HN: From a "hello world" project to a complex messenger - <AUTHOR> https://github.com/realpaliy/mChat <comment><AUTHOR> My journey of becoming an iOS developer begins in the summer of 2019. Back these days, I did not know anything about programming at all, so it was hard for me even to understand the most straightforward code. As a big fan of Apple, I decided to learn something related to iOS; therefore, I chose to learn Swift. Since there were a lot of tutorials on YouTube, I decided to start learning there. After a week of intense studying, I gained fundamental skills, which allowed me to enroll in Udacity Nanodegree program. With every new project, the difficulty increased. Luckily, my motivation allowed me to complete it successfully in less than three months. With all the experience that I got from this program, I decided to build my first complex app. Since I've always wanted to build my own messenger, I decided to create it as my portfolio app. Due to the fast speed and flexibility of Firebase Database, I was able to create a complex friend network for messenger users. Besides that, users receive data almost instantly, which makes a messaging process more enjoyable. Also, mChat uses a Mapbox API, which allows users to choose custom- designed maps. Overall, this messenger presents a modern design with lots of animations and custom chat color designs.

<comment><USER2> This is a very impressive story and equally impressive work! Keep it up!

<comment><AUTHOR> Thanks!

</comment></comment></comment><comment><USER3> Also really impressed by your contributions history on GitHub. From the graph, you've literally worked every days (including Saturday and Sunday) in the last 12 months - except two days in Feb.

If this is true, you deserve some holiday!

<comment><AUTHOR> Thanks! I try to work every day to develop a habit of coding.

</comment></comment><comment><USER4> It looks quite nice. Sadly the backend seems kinda limited in terms of federation (everybody can host his own server and they all communicate with each other). But you seem to have the skills to bring some real value to software projects.

How about supporting one of the open-source messengers like ChatSecure or Monal? I would love to see those chat apps have a similar user experience as your chat app has.

<comment><AUTHOR> Thank you. I heard Go language is a good idea for the backend.

<comment><USER4> Well, it is. I am a huge Go fan, but one of the most common XMPP servers (ejabberd) is written in Erlang and I think it probably is an even better choice for that purpose.

However, more important than the implementation language is the protocol you are using. So far, this is probably something you didn't spend much time on since you had just one client and the server was more or less just Firebase. But as soon as you want to allow others to run their own servers (they might want to because they trust only themselves), you need at least some kind of server-to-server (s2s) protocol. If you want other developers to build clients for your network, you will also have to define a client-to-server protocol (c2s).

A well-known standard in this regard is XMPP and another competing is Matrix. XMPP is much older and part of the 'official' standards by the Internet Engineering Task Force, while Matrix is younger and setting a stronger focus on what the server should do.

<comment><USER5> > _A well-known standard in this regard is XMPP and another competing is > Matrix. XMPP is much older and part of the 'official' standards by the > Internet Engineering Task Force, while Matrix is younger and setting a > stronger focus on what the server should do._

It's a bit disingenuous to sell XMPP as a single IETF standard (RFC 6120 only covers core) when it is not. It is many standards known as XEPs (XMPP Extension Protocols) [https://xmpp.org/extensions/](https://xmpp.org/extensions/)

They are hugely fragmented and many many clients support some but not others. (Just take a look at the case of E2EE on XMPP), some support OTR, some support OMEMO, some do both, and neither work for other channels like VOIP. If you ever do any kind of federation you're going to want strong E2EE for privacy reasons.

It's also worth noting that the Matrix developers had quite a bit of experience developing XMPP software before they undertook the Matrix project. The specification [https://matrix.org/docs/spec](https://matrix.org/docs/spec) is an maintained document with a reference client (Riot) which has helped third party developers with implementation and example.

</comment></comment></comment></comment><comment><USER6> Wicked stuff, looks like an excellent candidate for matrix synapse front end

<comment><AUTHOR> Thanks!</comment></comment>


This Is The Internal Grading System Google Uses For Its Employees - <AUTHOR> http://www.businessinsider.com/googles-ranking-system-okr-2014-1

<comment><USER2> Interesting post...though more for what someone at Blogger is trying to do to improve its reputation, including improving the DMCA process.</comment>


Facebook security chief reportedly leaving the company - <AUTHOR> https://www.cnet.com/news/facebook-security-chief-reportedly-leaving-company/?ftag=COS-05-10aaa0b&linkId=49453160 <comment><AUTHOR> "Stamos responded to the report on Twitter, saying, "Despite the rumors, I'm still fully engaged with my work at Facebook."</comment>


Julie Ann Horvath names the GitHub employees involved in harassment - <AUTHOR> https://twitter.com/nrrrdcore/status/459358875213238272

<comment><USER2> This was posted yesterday and repeatedly flag-killed. We actually turned flagging off on the post so that the discussion (such as it was) could continue. Reposts, though, are clearly off-topic.

</comment><comment><USER3> Reading her other tweets, it appears she is making an appeal to her followers to start a witch hunt.

</comment><comment><USER4> attention whore

</comment><comment><USER5> hell hath no fury...</comment>


Climate Activist Greta Thunberg Has Established a Foundation - <AUTHOR> https://www.zeit.de/wirtschaft/2020-01/greta-thunberg-fridays-for-future-foundation-climate-protection <comment><USER2> It's very easy to point out the world's problems and not provide an actual, realistic, solution.</comment>


GitHub – Creality3DPrinting/Ender-3: A fully Open Source 3D printer - <AUTHOR> https://github.com/Creality3DPrinting/Ender-3 <comment><USER2> The title is slightly misleading, the Ender-3 (touted as the new best cheap printed) is not the first open source 3D printer.

Nearly every printer is based on a type of RepRap printer which kind of started the original boom. You can find a ton of open source printers on their site: [https://reprap.org/wiki/RepRap_Options](https://reprap.org/wiki/RepRap_Options)

</comment><comment><USER3> I'm thinking about buying the Ender 2 since it seems to give a good bang for the buck. Print quality and price seem to be ok.

Right now I use the micro3d (which doesn't work that well for me). If the Ender2 gets cheaper soon (not flash sale, but coupon cheap) I will probably buy one

</comment><comment><USER4> All of the hardware files are SolidWorks. Last time I checked SolidWorks still had a pretty bummery access model for hobbyist users. Anyone know if that has changed?

<comment><USER5> Autodesk has Fusion 360 which can import Solidworks files.

Fusion 360 is free and full featured for hobbyists.

<comment><USER6> RMS would argue that it's gratis not libre</comment></comment></comment>


People are averse to machines making moral decisions - <AUTHOR> https://www.sciencedirect.com/science/article/pii/S0010027718302087 <comment><USER2> No shit. Because it's not the machine making them, its whoever programmed the machine, and THAT person (or people) I don't know or trust.</comment>


Status - Redefining social networking - <AUTHOR> http://sttus.com

<comment><AUTHOR> Read a little more here. <http://betali.st/startups/status></comment>


How to do cheap backups - <AUTHOR> http://code.mixpanel.com/2012/02/21/how-to-do-cheap-backups/ <comment><USER2> The quoted numbers per GB are honest calculations, but they can be a little misleading because they don't reflect the REAL costs you are going to end up paying PER MONTH and UP FRONT. As with anything, you always have to run the calculations first.

An illustrative example: My co-founders and I recently looked at a bunch of new office spaces and were doing similar comparisons with costs per square foot for each space. We ended up in a situation where option A (a much larger space) looked MUCH cheeper at $17/sq.ft, but we ended up going with option B (a small space) at nearly $40/sq.ft. because we just didn't need all the space in option A, and option B was in an office facility where we wouldn't have to buy any additional furniture or appliances like couches, chairs, a coffee maker, fridge, etc. (they were supplied to all tenants in a large common area as part of the cost). So the REAL cost difference to us PER MONTH was about $400 LESS with option B (the smaller more "expensive" space) and came with a lot of extra conveniences to boot.

So in the example given in the article, if you're not using the full 45TB of backup storage space (24 x 2TB in RAID-6), you could actually end up paying significantly more per GB for what you have stored (what you're actually using) - ESPECIALLY when you include the UP FRONT costs of buying and co- locating the server and the maintenance costs that go along with it.

Moral of the story: Just because something LOOKS more expensive per unit doesn't mean it's actually GOING TO BE when it comes to cashflow. ALWAYS do the math for your own situation before making decisions like these.

<comment><USER3> Not sure how honest these calculations are because I couldn't repeat them and the article gives no REAL detail.

Cheapest matching configuration I could find at SoftLayer was $559 for a dual processor Xeon 5504 with 12GB RAM ("Speciality: Mass Storage"). Each 2TB drive costs an additional $60. I'm assuming the raid controllers come free if you can plug in that many drives so not adding that onto the build. Total for build with 24 drives: $1999. (Assuming a free OS, and that you don't need to upgrade the network port speed.)

24x2TB in RAID-6 gives you 45TB usable capacity (all 24 drives, madness) or 20TB usable capacity (12 drives in mirrored RAID-6 configuration, probably more sane).

45TB @ $1999/mo is ~$0.045/GB, but if more than 2 disks fail you're screwed (quite likely to happen in a 24 disk configuration!)

20TB @ $1999/mo is ~$0.1/GB, and you can stand to lose at most 4 disks (at most 2 in each of the mirrored array).

Compare with the $0.11/GB Amazon S3 is charging you to store data in the TB range (excluding data transfer costs, which are free for incoming data, which ought to be the bulk of data) and I'm not really sure I follow their argument given that maintaining this backup system is going to be a PITA and the risks don't seem worth it.

</comment></comment><comment><USER4> You need to hire a sysadmin (or operations engineer or whatever they're called these days). You're talking about developers spending time on implementing backup, which is wrong. That's not what developers should be doing. Sysadmins may occasionally write software to solve a problem, but they're not software developers. Software developers may occasionally do sysadmin type work, but in my experience most of them are notoriously bad it it (setting up mod_python because they have a blog post with step-by-step instructions from 2004 bookmarked where that was the best way to do stuff - or leaving gigantic virtualenv turds with complete python binaries in your SCM because they don't understand what virtualenv is for).

Sysadmins also have toolkits (you know, screwdrivers, torx bits, zip-ties) and have scars on their arms that prove they aren't afraid of sharp-edged hardware stuff that sometimes starts smoking for no discernible reason and doesn't turn on any blinkenlights when you push the button (many software developers panic at this point). This comes in very handy when you just "left the cloud" and you're experiencing first-hand the reasons why people moved into the cloud in the first place (hardware sucks).

Sysadmins also know about this backup stuff and will tell you to shut up when you start talking about doing it with cobbled together shell scripts. They'll probably recommend using something like Amanda (or a commercial equivalent), that makes sure your backups happen regularly, are complete and actually contain the stuff you needed to backup. Good ones may even know to test the backup occasionally by restoring a server just to see if it actually works afterwards.

(Apologies to any software developers who know their sysadmin stuff.)

</comment><comment><USER5> Cheap backups? _Use de-duplication._

I have cronjob with daily dumps of several MySQL databases, in the usual textual format. One day woth of dumps takes about 470MB now. Two years ago, we started at about 20MB/day and it was growing ever since.

Each dump is committed into one common Git repo. After two years (that's just over 700 dumps), this whole Git repo is about 180MB.

Yep, much less that one daily dump. Git performs thorough de-duplication and delta-compression.

Cheap backups? _Use de-duplication._

<comment><USER6> Very cool. What options do you pass to `mysqldump' for best diffability?

<comment><USER5> Straight from the dump scripts:

      --complete-insert --hex-blob --skip-add-drop-table --single-transaction --order-by-primary --skip-dump-date
      --force # so mysqldump does not bail out on invalid view
      --no-create-info # do not emit CREATE TABLE, because its AUTO_INCREMENT changes often, and would create unnecessary differences

where the `order-by-primary' is probably the most important, and `skip-dump- date' sure helps.

Also, I make a big deal out of spreading every large table into a set of smaller dumps, each with fixed number of rows, sorted by record ID. For various reasons, most of our tables are usually appended-to, and changes (UPDATE, DELETE) are less common. Thanks to this, changes are usually confined to the last file of a set (with newes records), and other files stay mostly unchanged -- and so they pack the best.

      --where="_rowid >= $FROM AND < $TO"

I try to keep individual files down to about 8...16MB, 32MB max, so git's repack (upon pull/push/automatic gc) doesn't take too much of time nor RAM.

<comment><USER7> How do you split the files? Is that part of mysqldump (if so, how), or is it a handrolled thing?

<comment><USER5> For now, handrolled. The idea is to be able to do either `cat * .sql' or just `cat LAST-PART.sql'. I run mysqldump once per each large table with _\--where="_rowid >= $FROM AND < $TO"_ argument to mysqldump, and call mysqldump in loop with consecutive _$FROM_ and _$TO_. It works, it gets the job done, but it's not transaction safe.

That `_rowid' is a reserved symbol in MySQL. Refers to table's PRIMARY KEY (but only if it's single INT). In the usual case, the script doesn't have to know table's PRIMARY KEY.

Another way would be to use `rolling checksum' to split files; the concept described in <http://beeznest.wordpress.com/2005/02/03/rsyncable-gzip/> But you could end up with dump files split in the middle of SQL statement, not very cool.

</comment></comment></comment></comment></comment><comment><USER8> I looked into backup options for my company and ended up rolling our own solution using an open-source program called Duplicity: <http://duplicity.nongnu.org/> . I've been really impressed with Duplicity. Incremental backups are fast, the data is encrypted and you can target many different source/destination types (local file system, ssh, Amazon S3, ftp).

<comment><USER9> The main reasons for me to choose duplicity is the multiple protocol support. I've had so much issues in the past switching to other storage facilities only to have to completely change the backup process. Plus I'm using multiple storage sites for really important data.

Duplicity can be a bit finicky though, especially when it comes to cleaning up after itself, even more so if the backup was somehow interrupted.

<comment><USER10> Duplicity is also unable to incrementally remove old backups.

A backup set starts with a full backup, then has incrementals after that. You can remove the incrementals, but if you remove the (old) full backup, you have to do a full backup again.

A typically strategy is incrementals every day, and a full once a week. However this is really hard on home connections - it's just too much data to do a full backup every week.

One of its pros is that everything is completely encrypted from when it leaves your machine - so you can backup to a completely untrusted repository without worry.

However, in order to do that it locally stores block-checksums of every file it backs up. (So it can detect differences.) These files can get large.

Another option from the same source is rdiff-backup. This has none of those limitations - it uses a CVS style reverse diff (so old incrementals can simply be deleted, and the most current is simply stored as a file, which makes restores very easy). However it's not encrypted from the source - so you have to trust the repository at least enough to create a local encrypted volume on it.

</comment></comment></comment><comment><USER10> Security reminder:

The live server should not have write access to the backup machine.

Instead the backup machine should have read access to the live server.

This prevents disaster in case of hacks.

<comment><USER11> That's one option, but I prefer doing it the opposite way around: Have the live server push data to the backup server via an append-only interface. This is much simpler in terms of access control if you want to back up some of the live server's data but not all of it.

<comment><USER12> I think you missed his point. He meant its safer to give the live server no access because if it gets hacked/virus then it can not impact the backup server.

<comment><USER11> I think you missed my point. I was suggesting that the live server should access the backup server _via an append-only interface_ , i.e., one which doesn't allow it to delete backups or modify them.

<comment><USER13> Now the security of your backups is completely dependent on the construction of the append-only interface. Are you 100% certain it can't be compromised or permission-escalated?

<comment><USER11> It's much easier to build an append-only interface than a read-only-and-only- read-some-files-not-others interface.

</comment></comment></comment></comment></comment></comment><comment><USER14> Tarsnap pricing is for deduplicated data. You need to divide it by orders of magnitude for a proper comparison.

Apples and oranges - what you are doing is on site backup, Tarsnap is offsite. Both are needed.

<comment><USER15> Dedupe isn't magic. If your data isn't duplicated on the block level, it isn't going to do anything for you. It does wonders on backing up 10,000 windows machines, it doesn't do anything at all for a server's data store.

<comment><USER16> I disagree. The deduping enables low-cost snapshot semantics which has drastically simplified my life.

Every 24 hours, I dump a database and let tarsnap work out what to actually send to S3. And it does such a good job, for such a low price, that it boggles the mind.

<comment><USER15> Fair enough, but I'm reacting to the unbased claim that you can just divide it by "orders of magnitude" when the original post does not contain enough information to claim that, and indeed enough information that it's probably not true. If you have 100GB of server-type service data, you're not looking at "orders [plural] of magnitude" less space taken up on the backup service. The huge multipliers that dedupe is sometimes cited as giving are for certain datasets, you do not get "orders of magnitude" shrinking in the general case.

<comment><USER14> The claim is based on personal experience.

With Mixpanel I'd expect even better results since their data is append-only by nature. I.e. think about deduplication when backing up a large append-only log file on a daily basis.

Tarsnap has weaknesses but cost of storage for Mixpanel type of workload is not one of them.

</comment></comment></comment></comment></comment><comment><USER17> Anybody else disappointed that an article "How to do cheap backups" didn't at ALL describe how they, well, actually do the backups? I was expecting some smart copy algorithm, not a post about the price of hardware. Also, they compare their hardware when at full capacity, to AWS and others scaling pricing model. Their first GB will cost a lot more than stated here in price / GB.

</comment><comment><USER18> Takes about 25 lines in bash to do rotating, encrypted, s3 backups with Timkay's awesome aws script

I actually had to throttle our servers when sending to amazon as they seem to be able to receive at impossible maximum speeds and eat the whole pipe!

<comment><USER19> Is this the one? <http://timkay.com/aws/>

I somehow hadn't seen it before; thanks!

</comment></comment><comment><USER20> I hope the backup machine is connecting to the live machine and they're sealed off from each other. I've heard of cases where hackers have managed to get into a machine and then access backup machines to completely wipe all copies of a database.

<comment><USER21> I think there's an argument for periodic off-line, "hold it in your hands" backups.

Good luck wiping that...

</comment></comment><comment><USER7> If all your servers are on Amazon EC2, and your backups are in S3, then you have all your eggs in one basket. One billing dispute with Amazon and your servers _and_ backups are gone.

Backups are there to protect you in case the worst happens.

<comment><USER3> Make a second account?

<comment><USER7> Does the Amazon EC2 terms allow that? If not, you might give Amazon (or a zealous front line fraud watcher) an excuse to lock out both your accounts, before you get into any dispute.

<comment><USER11> Yes, you can have multiple AWS accounts, as long as you're not doing so for bad reasons. According to the AWS Service Terms, _"You may not access or use the Services in a way intended to avoid any additional terms, restrictions, or limitations (e.g., establishing multiple AWS accounts in order to receive additional benefits under a Special Pricing Program)"_ but that's really just a "don't try to cheat" clause.

Prior to the creation of IAM, the standard way of creating restricted- privilege access keys was to have multiple accounts; I have at least 5 AWS accounts (I say "at least" because it's possible I've forgotten some which I'm not using any more...), lots of people at Amazon know about this, and nobody has ever suggested that there is anything wrong with it.

On the other hand, if Amazon decided to close your account, they would probably look to see if there were any other accounts owned by the same person. On the gripping hand, I've _never_ heard about anyone _ever_ having a billing dispute with Amazon Web Services, which at their scale tells me that they're very reasonable people and not prone to Paypalesque random account closing.

</comment></comment></comment></comment><comment><USER22> I use a nice OS X app called Arq which does encrypted backups to my own S3 bucket. Since I only have a few GB of stuff that warrants offline backup (git repos, etc) the ~$0.25 storage fees per month is well worth the convenience.

<comment><USER23> Any good Windows/Linux alternatives?

<comment><USER8> For Windows, Duplicati is a good option: <http://code.google.com/p/duplicati/>

For Linux, try Duplicity (which I mentioned in another comment): <http://duplicity.nongnu.org/>

Both are open source and have similar features to Arq (including Amazon S3 support).

</comment></comment></comment><comment><USER24> It's nice, but they still need someone to keep an eye on the backup machine.

Also S3 is expensive because it keeps many copies of your data (though they appear as one) and check them for corruption, so it would be more reliable than a single backup machine.

</comment><comment><USER25> One important feature they didn't mention: if you have a decently powerful backup server hosting all of your data, it may be relatively easy in case of an emergency to use it to serve production data directly. For instance, you could start a mysql instance with the backup data directly from the backup server, if your production server (or datacenter) is fried.

There is no easy way to achieve that from S3 or tarsnap.

<comment><USER11> Mirroring is not backup. If you keep your "backup" server in sync with your live server so that you can promote it to production quickly, it's also going to be in sync with any loss which occurs through sysadmin error or deliberate attack.

Ideally you should have both a mirror on standby and a backup server with multiple earlier copies of your data.

<comment><USER26> What they said doesn't necessarily have anything to do with mirroring.

When we take a backup of MySQL to our backup server, we also create a my.cnf file configured to use said backup. As in, we have multiple config files, each created at time of backup, specifically referencing that individual backup. Each can be easily used to start MySQL up using that X day old backup. Then I can shut it down, and start it up again using a completely different backup just by specifying that backup's my.cnf file, all without modifying either backup.

This is also nice because it makes it simple to make sure your backup actually works.

</comment></comment></comment><comment><AUTHOR> Small plug but we're always looking for awesome people to join our ops team! Link: [http://mixpanel.theresumator.com/apply/Xm0tLy/Software- Engin...](http://mixpanel.theresumator.com/apply/Xm0tLy/Software-Engineer- Operations.html)

</comment><comment><USER27> And softlayer is by no means the cheapest provider of dedicated hosting in the US (though, there are few comparable providers (in terms of price and quality) with multiple regions).</comment>


Isn't our code just the *BEST* - <AUTHOR> https://medium.com/bumpers/isnt-our-code-just-the-best-f028a78f33a9#.7xksz09un <comment><USER2> ReactJS is made complex by Redux.

You probably don't need it.

Don't use it.</comment>


The richer the 1% get, the more miserable you get - <AUTHOR> https://finance.yahoo.com/news/richer-1-more-miserable-141809912.html <comment><AUTHOR> Relevantly, the data presented in this article indicate that the USA is more unequal than South Africa.

</comment><comment><USER2> Now what if there weren't outrage profiteers telling me that I'm supposed to be angry at people who have more than me all the time? Oh damn it, I'm not angry with the 1%, I'm angry at the people who are annoying in their jealousy of the 1%, and the richer the 1% gets, the more insufferable their outrage gets, which makes me less happy...</comment>


Ask HN: Why doesn't Apple sell servers? - <AUTHOR> <comment><USER2> Ignoring the old XServes:

Why would they?

OSX is positioned as a desktop, consumer platform. There's little reason to try to unseat cheaper Unix-like platforms. It's a market saturated with a gazillion performant alternatives.

The amount of support and sales required to make it a profitable line would remove Apple's focus from their core products (let's be honest, it's iOS, and to a lesser extent, OSX).

</comment><comment><USER3> It does. [http://www.apple.com/lae/osx/server/](http://www.apple.com/lae/osx/server/)

</comment><comment><USER4> They sell the Mac Mini and the Mac Pro. They used to sell a rackmount XServe but they stopped. The Mac Mini fits in datacenter racks quite well, and the Mac Pro works for when you have the space for it.

Presumably not enough people wanted to buy rackmount XServes to make it worthwhile to produce them.

<comment><AUTHOR> Maybe low business strategy? I don't think that large companies are using Mac OS X Server.. or?

<comment><USER5> Some services are built around racks of Minis and Pros. Online tests for iOS apps and I don't remember what image processing service that needs to use OSX.</comment></comment></comment>


Building an Open Source Laptop - <AUTHOR> http://makezine.com/magazine/building-an-open-source-laptop/

<comment><USER2> I love that he reused a ThinkPad keyboard. I think I'd use this without real casing.</comment>


Why we built VisualData to aggregate open datasets for computer vision - <AUTHOR> https://medium.com/eyestyle-stories/introducing-visualdata-eaadc87b4afc <comment><USER2> These are not "open" in the sense of being free/libre to use. Many of these data sets have Non-Commercial licenses attached to them.

At least some of the datasets look to be open in the sense of free/libre to use (e.g. [1], [2]) while others are not (e.g. [3]). As with many of these resources, there is no option to filter on license.

[1] [https://github.com/googlecreativelab/quickdraw- dataset/blob/...](https://github.com/googlecreativelab/quickdraw- dataset/blob/master/LICENSE)

[2] [https://github.com/nightrome/cocostuff](https://github.com/nightrome/cocostuff)

[3] [http://robotcar-dataset.robots.ox.ac.uk/](http://robotcar- dataset.robots.ox.ac.uk/)</comment>


Ask HN: Is Music Bad For Concentration? - <AUTHOR>

As a homeschooling dad I am trying to weigh the pros and cons for allowing the kids to listen to music while working. Any thoughts? <comment><USER2> I was homeschooled. I listened to tons of music. I have found it probably decreased my ability to concentrate. However, I have a friend (also homeschooled) who swore by the "Batman Begins" soundtrack to accomplish his math studies. So I think it depends purely on the person.

And, on another note, _music_ is the least of your worries as far as distractions go.

(And on a purely suggestive note, let your kids explore anything and everything. That is how I am what I am today. I took way too many breaks in English to go learn about this, that and the other [especially programming and computers]. I still turned out okay—A's on all my college english papers so far.)

</comment><comment><USER3> According to several studies in cognitive psychology, introverts and heavy multitaskers perform less well in the presence of music (especially 'pop music') than extraverts. Music seems to be especially distracting for introverts involved in reading comprehension activities. Coding tasks are slightly less affected.

<comment><USER4> I'm an introvert, and you stated my experience exactly. If I need something to drown out external noise like a TV in the next room, I find that Gregorian Chant is less distracting because it is not rhythmic, and I can't understand most of the Latin words.

</comment></comment><comment><USER5> Depends what I'm doing.

When I'm feeling a bit too tired, I generally like listening to music to wake me up and get me through what I'm trying to do, usually lets me focus a little harder.

When I'm energetic and at full focus, I will sing along to the music I'm listening to, obliterating all my productivity.

Either way, also depends on the person. Have plenty of friends who can't deal with any audible distractions, and have plenty who can't work without it.

</comment><comment><USER6> I think it really depends on both the music and the person. For me personally, I can only really concentrate with music on, preferably on headphones. This way I can really close down from stuff happening around me. On the other hand, if the music is very lyrics-based, I'll usually start focussing on that instead.

So for me, the amount of lyrics in the music I listen at a given moment is inversely proportional to the level of concentration I need ;)

</comment><comment><USER7> For me personally, I couldn't work without music. It blocks out environment noise. In a silent area it's like every small sound is amplified tenfold. It could be I'm different, but I had very productive weeks, while on the other monitor Farscape was playing for the nth time.

So I would say, let them choose for themselves what works best. Loosing concentration once in a while because of the music might be a natural stopping point, and listening to music for a short time gets the brain rested enough for a next period of concentration.

</comment><comment><USER8> For me, music that I'm listening to for the first time is very distracting because I want to consciously analyze what I'm listening to—what genre is this, who sings this, what rating would I give it in iTunes, etc.

Songs I've listened to for months or years have the opposite effect and if I'm working in a noisy environment find it hard to get into flow unless I have something to drown out the noise, and music I'm used to already fits the bill without being distracting.

</comment><comment><USER9> I can only speak personally of course, but...

Is music bad for concentration? Yes. But is music bad for WORKING? God no.

It really depends on what I'm doing. Playing music makes work (and made school work) far more pleasant (and thus easier) to do. But there are time when I need to concentrate, and for that I turned down the music. So, the answer? "It depends."

</comment><comment><USER10> Music with lyrics is distracting; classical instrumental music is usually ok, and techno (at low volume) actually helps me work.

Also important: music that you change often (e.g. youtube videos) is more distracting than music you turn on and leave alone (e.g. radio).</comment>


After 20 years in IT –. I finally discovered this - <AUTHOR> http://sqlservercode.blogspot.com/2019/02/after-20-years-in-it-i-finally-discovered-this.html <comment><USER2> It seems like Windows developers never embraced drag and drop wholeheartedly. On Gnome and macOS you can just drag a file or a folder to a terminal. Not to mention, you can also drag one to a file (open or save) dialog. The fact that Windows doesn't allow this causes me immense frustration.</comment>


1K colours on CGA: How it's done - <AUTHOR> http://www.reenigne.org/blog/1k-colours-on-cga-how-its-done/

<comment><USER2> The reason it has taken the demoscene so long to pull this off is the same reason that the PC beat its competitors in the early 1980's.

From the beginning the PC wasn't defined by a single hardware implementation, but by a set of capabilities and interfaces. There were always "compatible" PC knockoffs and "compatible" extension cards that weren't really 100% bug-for- bug compatible. That meant that software writers had to stick pretty much to the approved interfaces. There was no sense trying to push the hardware beyond the intended capabilities because even if you succeeded it probably wouldn't work on the bulk of the machines out there with different variations of the hardware.

It took a long time even to see things like scrolling games on EGA cards, even though the scroll registers were designed right into the chip and documented as such. Why? Because there were no BIOS calls to implement this, and most developers took the limits of BIOS as the limits of what they could count on working. It took risky shareware developers (Carmack and Romero) to prove to everyone that really the EGA chip-level interface was a usable target.

So because of the prevalence of the mostly-compatible compatibles, the PC software market had another layer of abstraction built in. Software should work on any machine providing the documented capabilities and interfaces, not just on one exact hardware setup. This allowed for a cycle of compatible upgrades where software could be used across hardware generations, and hardware could upgrade with sufficient backward compatibility.

That upgrade cycle was missing for machines like the Commodore 64, which were defined by a single hardware implementation. For the Commodore, developers always felt free to push beyond the intended limitations of the hardware, with confidence that if it would work it would work everywhere. That fed a vibrant demoscene, but closed off any possibility of a hardware/software upgrade cycle and eventually led to the death of the computer line.

<comment><USER3> Why didn't this work out for high-end Android handsets? They are in a similar situation.

<comment><USER4> By 'this' do you mean why didn't Android completely beat iPhone? Similar reason to why the Mac is making a comeback. The hardware market has changed.

In the 80s / 90s, computers were very expensive and it was common to only buy exactly what you needed. PCs excelled at this. Everything was an option: Video card (MDA, CGA, EGA, VGA), ram, hard drive, hard drive controller, serial port controller, sound card. If you later needed more capabilities you upgraded whatever was necessary.

As computers became cheaper, upgrading began to make less financial sense. Upgrading a component and paying for it to be installed became almost equal to the cost of a new computer. There also became less to upgrade, onboard sound, network, etc was good enough. The only thing left to upgrade was CPU (but usually required a new motherboard) and video card. Upgradability which was originally a huge selling point became a niche feature.

As integration continued, size, weight, power consumption all became more important than upgradability / customization. Hardware wise, all Android phones and the iPhone are pretty much the same.

<comment><USER5> I wonder how long throwing away 'computers' after a year or two of use will remain common for us in the first world.

Does technology get the credit for the difference between the 80s, or is it some mix of the current balance of geo-politics, interconnected global trade, wage arbitrage that still allows slavery in the supply chain, and free interest rates (in the case of Europe, negative)?

May be in the end game biodegradable 'computanium' that is killed and reborn daily right before it becomes obsolete?

It still feels very strange and disturbing to throw away something less than a decade old much less two years.

<comment> bjelkeman-again I tend to retire my machines to less demanding or suitable tasks. A Mac Pro 2006 (with a Cinema Display from 2000) is still going strong as a studio music computer running Logic Pro X (essentially a Hackintosh on Mac hardware, as Apple stopped supporting them). A MacBook from 2005 drives a TV with streaming video (although it needs retiring now).

It is harder with smartphones, but I have older phones being guest map and GPS devices.

</comment></comment></comment></comment></comment><comment><USER6> It's impressive they got this many colors out of it! I still remember the classic CGA Pink+Cyan color scheme[1]; those always seemed like a particularly garish choice for "default" colors.

[1] Example screenshot: [http://s.uvlist.net/l/y2008/04/49443.jpg](http://s.uvlist.net/l/y2008/04/49443.jpg)

<comment><USER7> I just got a tattoo done in CGA magenta/cyan/green (a composite frame from Sierra's Black Cauldron). This turns my whole world, or at least arm, upside down!

<comment><USER8> Very cool! Got a link to a pic? I also have some oldschool "pixelated" tattoos, though in greyscale only.

</comment></comment></comment><comment><USER9> I am utterly amazed at the amount of hard work and programming mindshare expended on, let's face it, a very unimportant technology.

Bravo to you all for showing us that old-school hacking is alive and well!

<comment><USER10> What's boggles my mind is the fact that it took the enthusiasts up until now to uncover the potential of the platform, as compared to, say early 1980's when people were paid to produce entertainment software for the IBM PC.

Makes one wonder what kinds of fantastic things we might achieve with todays' technology, but probably never will, moving on to build tomorrow's technology instead.

<comment><USER11> IIRC there was a post by Steve Wozniak here a few months ago where he stated he still occasionally gets ideas for how he could have improved the code for the original Apple computers.

Edit: Found one article that quotes Woz on that: [http://www.cultofmac.com/302087/38-years-later-woz-still- thi...](http://www.cultofmac.com/302087/38-years-later-woz-still-thinks-ways- improve-apple-ii/)

</comment></comment></comment><comment><USER12> Pushing those old systems to their limit (and beyond) was a lot of fun and very instructional for those of us just getting into programming. On my Atari 800, I recall using 6502 assembly to hook the horizontal and vertical blank interrupts to change the color lookup tables and character definition maps on the fly giving me the ability to greatly increase the number of colors displayed and do crude character-set animation.

</comment><comment><USER13> Reminds me of this demo that uses a single microcontroller to generate a PAL composite signal, with a few tricks to increase the colours available:

[http://www.linusakesson.net/scene/phasor/](http://www.linusakesson.net/scene/phasor/)

</comment><comment><USER14> Strange question; why didn't many games in this era exploit this? I'd guess that the knowledge just wasn't as easily shared? Seems these systems were capable of pretty amazing things, but those things were frequently overlooked.

<comment><USER15> If I'm reading correctly between the lines, they are pouring a _ton_ of CPU into this effect. I wouldn't be surprised if you told me what we saw in the demo is literally almost all this effect can do, and there's not a lot of power left over for actually running a game.

Same thing for all the things you see Commodore 64 demos do... by the time you're creating the awesome graphical effect there's often not a lot left over for the game itself. (Though there are some interesting exceptions... there appear to be some surprisingly high-quality side-scrolling platformers now based on "bad lines", which are both explained and then the platformers shown at [https://www.youtube.com/watch?feature=player_detailpage&v=fe...](https://www.youtube.com/watch?feature=player_detailpage&v=fe1-VVXIEh4#t=2900) . Though the entire presentation is fascinating and shows a few other demoscene effects in real programs.)

<comment><USER16> The CPU usage isn't _that_ bad compared to some of the other things we did in the demo - with some help from interrupts it could be done with maybe 20% of CPU. There is also a much easier ~500 colour variant which doesn't take any CPU time at all once set up.

I think the real reason it wasn't discovered earlier is that most CGA PCs were not connected to composite monitors or TVs (people who could afford the big expensive IBM machine could generally afford a dedicated digital monitor as well). A few games used 160x200x16 composite but even those generally had modes for RGBI monitors as well (which wouldn't work so well with the 500/1K colour modes, though I guess there are the dithering characters 0xb0 and 0xb1 which might have worked). These +HRES modes also suffer from CGA snow, which might have been a deal-breaker.

<comment><USER15> Cool, thanks for the details!

</comment></comment></comment></comment><comment><USER17> Interesting, but it would be nice to see a picture of the resulting palette.

<comment><USER16> Here you go: [http://www.reenigne.org/misc/cga_1k_colours.png](http://www.reenigne.org/misc/cga_1k_colours.png)

</comment></comment><comment><USER18> The writer of this piece is a genius. Amazing hackery.

</comment><comment><USER19> Reminded me of the Doom/Keen days

</comment><comment><USER20> two pictures of waveforms would be much better than text here ...

<comment><USER16> I wanted to make some pictures to go with the article, but I didn't have time (I wanted to get the article out quickly as there was so much curiosity and speculation about the methods we used). I just tried adding a quick hack to cga2ntsc to output the waveforms and viewed them in an audio package, but the result wasn't terribly elucidating. Perhaps I will redo the article with more pictures at a later date.</comment></comment>


TSA Agents Outwitted by Cory Doctorow's Unlocked, 'TSA-Safe' Suitcase - <AUTHOR> https://www.techdirt.com/articles/20150414/10471430654/tsa-agents-outwitted-cory-doctorows-unlocked-tsa-safe-suitcase.shtml

<comment><USER2> One thing that concerns me: I have sitting next to me a 23 year old US citizen traveler and her comments on this sum to a few "mmmeh" sort of noises. She says "yeah, I always get the slip in my luggage, I know it's checked so I don't lock it". Ask her if she knows who Edward Snowden is and the response is "no". This person doesn't even know what the Stasi is.

As someone who recently had the DPP drop a case against me because the judge ruled the police search illegal and struck the evidence, all this abuse-of- power stuff is close to my heart. Australia still seems to have some some separation of power.

The worrying thing is that the current generation of TSOs are setting the work-place culture, and young Americans appear to be accepting the consequences, or just oblivious to it completely.

I start to hyperventilate a bit over this scenario. Where does all this lead?

<comment><USER3> My generation, I am 23 as well, do not understand this at all, it is really sad.

I am working with a group for a project in our business ethics class and one of the topics that I wanted to cover was encryption and how to protect yourself and keep the government out. I know the chances of the FBI knocking on my door is slim to none, but I want to keep my self protected. Especially if I have an encounter with the police I know my rights with my technology and I do not want anyone in my information.

We ended up doing a different topic because one of the kids argued with me saying there's no reason to encrypt, the FBI wont come for you, and why wouldn't you just comply with their demands it makes you look guilty if you don't. He does not understand the fact that it is our personal right to protect ourselves, and that it does not matter if you are guilty or not you have rights to keep yourself protected.

I come from a police officer family and respect the police, but if a cop tells me to give him my phone or laptop they will never get into it.

I went on a rant, but it seems people do not understand security or personal privacy and they let others exploit this.

</comment></comment><comment><USER4> Seems like because the case was unlocked, the officers could not use the keys. The keys are only to be used when the locks are locked. This means that the TSA were unable to unlock the suitcase, which logically allows them to break into the object using a crowbar. (/kafka)

</comment><comment><USER5> > stealing your valuables

> So, to recap: the TSA can break your stuff

A simple, free solution to this issue: check a firearm in your luggage.

It's a federal issue (violation of 14 CFR 108.11 [1]) for anyone to have access to said luggage except yourself. This includes the use of TSA locks - you are the only one who legally may retain firearm-containing-baggage keys.

I have never had an issue with lost, tampered, or stolen luggage. I routinely fly with tens of thousands of dollars in electronics and equipment, plus at least one handgun/ammunition. No problems.

In the event of an alarm, you're required to be present for any manual screening. Manual screening is often not necessary (depends on the airport/equipment/experience of the screener).

I should note: this only works if your "luggage" is one solid, hard case. I use a large, undivided Pelican case. [http://www.amazon.com/gp/product/B002E6R7NG](http://www.amazon.com/gp/product/B002E6R7NG)

[1] [http://www.gpo.gov/fdsys/pkg/CFR-1999-title14-vol2/xml/CFR-1...](http://www.gpo.gov/fdsys/pkg/CFR-1999-title14-vol2/xml/CFR-1999-title14-vol2-sec108-11.xml)

</comment><comment><USER6> Oh, the TSA is searching hot air balloons now?

</comment><comment><USER7> Perhaps because it's metal they couldn't x-ray it properly?

<comment><USER5> It isn't lead - I doubt this was an issue.

</comment></comment><comment><USER8> Here is the TSA claim form: [http://www.tsa.gov/sites/default/files/assets/pdf/sf95_cover...](http://www.tsa.gov/sites/default/files/assets/pdf/sf95_cover_package_rev6_28.pdf)

I have not made a claim myself, but I found the form because TSA derps made my skis miss the plane because they ALWAYS open ski bags, which seems like the stupidest damn thing imaginable. Skis would be extremely hard to modify for any nefarious purpose, and can't be used to conceal anything. And of course saying "...the stupidest damn thing imaginable" about things the TSA does just demonstrates a lack of imagination about stupidity and the TSA.

<comment><USER9> I think somebody has a lack of imagination about what can be used to conceal explosives etc. The IED class my son taught in the Army stressed how almost any ordinary object can be weaponized e.g. made out of explosives or incorporate explosives.

<comment><USER10> Like, say, a toner cartridge?

But yeah. Explosives can and have been shaped into many interesting forms. Usually this is done to create a blast wave that applies force to a focused area for extra penetrating power, but it's also used to conceal HE into novel and difficult to detect forms.

That said: I regularly check luggage and ONLY put clothes and toiletries into the case. Everything else rides with me. It's always fun pulling two laptops and assorted electronics into the bins.

<comment><USER9> Of course a toner cartridge! Or was that meant sarcastically?

<comment><USER10> My point was that a surprisingly small amount of explosives is a risky bet for nearly anything as vulnerable to decompression as the pressurized hull of an airliner.

You could construct skis that incorporated a very thin layer of HE sandwiched in the material and/or had a few drilled channels of HE through the actual ski that could make some poor bird fall right out of the sky.

Believe me, the red teamers in the government have thought of this and done their best to try and make the front-line workers at least aware of how THEY would sneak a bomb on a plane.

I know someone who regularly carries two weapons in the cabin on every flight he's on and has since 9/11\. His trick was to make them look like ordinary things you'd never suspect.

Don't worry though. He's one of the good guys. :-)

<comment><USER8> > _Believe me, the red teamers in the government have thought of this and done > their best to try and make the front-line workers at least aware of how THEY > would sneak a bomb on a plane._

Skis are made in a heated press at hundreds of PSI. I'd like to meet the TSA consultant who put HE in a ski press, but I suspect he has gone to the great departure lounge in the sky.

<comment><USER10> You're talking about the process by which you make a ski that will be used for skiing.

I'm talking about something that LOOKS like a ski, but will never be used to ski.

I wouldn't make the mistake of confusing the two.</comment></comment></comment></comment></comment></comment></comment>


An Analysis of Godlua Backdoor - <AUTHOR> https://blog.netlab.360.com/an-analysis-of-godlua-backdoor-en/ <comment><USER2> after a quick review of this brief (aqrtb?):

Lua-based binaries are being delivered via a Metasploit module for Atlassian Confluence Server CVE-2019-3396. other vulnerable servers can also be targeted with this payload, though it's mostly Linux servers now. active news sources include #godlua

[https://www.atlassian.com/software/confluence](https://www.atlassian.com/software/confluence)

[https://www.cvedetails.com/cve/CVE-2019-3396/](https://www.cvedetails.com/cve/CVE-2019-3396/)

[https://twitter.com/hashtag/godlua?f=tweets&vertical=default](https://twitter.com/hashtag/godlua?f=tweets&vertical=default)

</comment><comment><USER3> It's interesting this malware uses DNS over HTTPS to avoid detection.

<comment> ga-vu The first, according to Cisco Talos: [https://twitter.com/infosec_nick/status/1146069799899938816](https://twitter.com/infosec_nick/status/1146069799899938816)

</comment></comment><comment><USER4> my eye homed in on these excerpts from the article:

\--The file itself is a Lua-based Backdoor, we named it Godlua Backdoor as the Lua byte-code file loaded by this sample has a magic number of "God"

\--Godlua Backdoor has a redundant communication mechanism for Command and Control [C2] connection, a combination of hardcoded dns name, Pastebin.com, GitHub.com as well as DNS TXT are used to store the C2 address, which is not something we see often. At the same time, it uses HTTPS to download Lua byte- code files, and uses DNS over HTTPS to get the C2 name to ensure secure communication between the bots, the Web Server and the C2.</comment>


Smart glass can do neural computing all by itself - <AUTHOR> https://bigthink.com/technology-innovation/ai-sheet-of-glass <comment><USER2> Fake news, and repost. The glass is a _result_ of neural computing.

About as smart as a printed page - because hey, the text generator used AI! #buzzwordspam

(Clever, for sure; possibly an engineering breakthrough in various ways, but there's no "neural computing" once the AI is done crafting the glass blueprint.)</comment>


Your Opinions On: Why Self Regulation is  better than Legislative Regulation? - <AUTHOR> https://techcrunch.com/2018/07/19/why-self-regulation-is-better-than-legislative-regulation/ <comment><AUTHOR> What are the disadvantages of this? If this is feasible, why aren't companies pursuing this and in the process, avoid all those billion dollar fines?</comment>