A Mind is Born - <AUTHOR> https://linusakesson.net/scene/a-mind-is-born/ <comment><USER2> > The melody is generated by a linear-feedback shift register (LFSR). Thus, in > one sense, the melody is randomly generated. But I spent a considerable > amount of time tweaking the random process until I found something that was > musically satisfactory.

This is just mind blowing to me. The music is actually really good, I've been playing it on repeat and I just wish it could be longer.

<comment><USER3> I recommend checking out a record that came out in 1984 by a guy called Manuel Göttsching called E2E4. I'm sure a lot of coders here know it, as it's brilliant for concentration and is just a beautiful piece of music in its own right.

I'm not going to provide a Youtube link, as it's really worth hearing in at least 320 kbps.

<comment><USER4> Some free associations:

[https://www.youtube.com/watch?v=FgGU8Vy3xoc](https://www.youtube.com/watch?v=FgGU8Vy3xoc)

[https://www.youtube.com/watch?v=kLIi_ZMBfQs](https://www.youtube.com/watch?v=kLIi_ZMBfQs)

[https://www.youtube.com/watch?v=d38xbAFnCSQ](https://www.youtube.com/watch?v=d38xbAFnCSQ)

[https://www.youtube.com/watch?v=hamT4XESYG0](https://www.youtube.com/watch?v=hamT4XESYG0)

[https://www.youtube.com/watch?v=EQWCUXNsUyQ](https://www.youtube.com/watch?v=EQWCUXNsUyQ)

[https://www.youtube.com/watch?v=LY-9cGBdxNw&list=PL8kGLx6Th4...](https://www.youtube.com/watch?v=LY-9cGBdxNw&list=PL8kGLx6Th4TNju_Mng7D259Je34QvoeeF)

[https://www.youtube.com/watch?v=EM251rMyfUg](https://www.youtube.com/watch?v=EM251rMyfUg)

[https://www.youtube.com/watch?v=3oBl0xq16G0](https://www.youtube.com/watch?v=3oBl0xq16G0)

<comment><USER5> The band "The Algorithm", although more rock/metal is kinda chip-tune enough for me.

[https://youtu.be/zwG97ah0mEU?list=PLB687_YKwVcBhVI8bzQ_yjj4Q...](https://youtu.be/zwG97ah0mEU?list=PLB687_YKwVcBhVI8bzQ_yjj4QklEL- OcO)

[https://youtu.be/dJwNfRaPp08?list=PLB687_YKwVcBhVI8bzQ_yjj4Q...](https://youtu.be/dJwNfRaPp08?list=PLB687_YKwVcBhVI8bzQ_yjj4QklEL- OcO)

</comment></comment></comment></comment><comment><USER6> I'd hazard the statement that this is the best code sample I've seen on HN in a year.

Fascinating to see it alongside Netflix's description of their gargantuan take on container scheduling :)

</comment><comment><USER7> I find there's something fundamental about small sized demos. Trying to craft something as diverse as possible with as few symbols as possible means you have to encode chaos and order at the same time.

<comment><USER8> Procedural generation of interesting output being created by very small bits of code makes me think very profound thoughts about how life "works". Physics provides the virtual machine that life executes within, and tiny machines interpreting the "instruction set" of a genetic code are just generating procedural output.

<comment><USER9> If you're interested in the implications of this view, Stephen Wolfram (of Mathematica fame) has a book called A New Kind of Science[0] that explores how the complexity of the universe can arise from simple machines following simple rules.

[0] [https://www.wolframscience.com/nksonline/toc.html](https://www.wolframscience.com/nksonline/toc.html)

<comment><USER10> See also, this classic review: "A Rare Blend of Monster Raving Egomania and Utter Batshit Insanity"

[http://bactra.org/reviews/wolfram/](http://bactra.org/reviews/wolfram/)

(originally at [http://www.cscs.umich.edu/~crshalizi/reviews/wolfram/](http://www.cscs.umich.edu/~crshalizi/reviews/wolfram/))

</comment></comment></comment></comment><comment><USER8> The LFSR-generated music reminds me of the old Atari 2600 game "Pitfall". The game had to fit in a 4K cartridge, so a lookup table of the attributes of the 255 "rooms" wouldn't fit. Instead, an LFSR (that fits in 31 bytes) generates the bitstream that describes the entire map. (Background: [http://www.samiam.org/blog/20130606.html](http://www.samiam.org/blog/20130606.html))

<comment><USER11> The BBC Micro game `Exile' used a mostly-randomly-generated map, with some manually-created areas here and there: [https://www.stairwaytohell.com/gamehelp/MAP-Exile- BC.png](https://www.stairwaytohell.com/gamehelp/MAP-Exile-BC.png) (very large PNG)

The patterns are quite apparent when zoomed out, but on the actual BBC Micro the display area was 128x128 low-res pixels (a 256x128 area on the map image), making it more difficult to spot.

</comment></comment><comment><USER12> This was so impressive that it compelled me to finally make a Hacker News account instead of lurking. In less than a typical paragraph of space you have created a masterpiece of efficiency. The music is catchy too. Bravo!

</comment><comment><USER13> Site getting slow, and I thought this was awesome, so here's the demo:

[https://www.youtube.com/watch?v=sWblpsLZ-O8](https://www.youtube.com/watch?v=sWblpsLZ-O8)

<comment><USER14> incredible that it produces a video which is compressed to 20-30Mb :)

</comment></comment><comment><USER15> +1 - would love to see more posts celebrating the demoscene too! thanks for sharing

</comment><comment><USER16> That guy is always doing mindblowing cool stuff. I propose renaming him from Linus Åkesson to Linus Awesome :-)

</comment><comment><USER17> This triggers multiple levels of wonder. That the tune alone is compose-able from 256 bytes is uncanny. What would this have been like to witness in the 1980s ? -being as it could have been published as a relatively easy to type magazine listing.

The name "A Mind is Born" has special resonance at this time as there has never been more popular anticipation that artificial minds will soon be able to coalesce from the same kind of bitwise operations made visible and audible in this demo.

<comment><USER18> This has a beginning that you may find interesting.

[https://en.wikipedia.org/wiki/Diaspora_(novel)](https://en.wikipedia.org/wiki/Diaspora_\(novel\))

<comment><USER17> Its a powerful fantastic idea, but Im personally concerned that our human and animal conciousness should probably not be equated with virtual representations, no matter how accurate or convincing certain renderings might get. Mostly because I would never be fearful of switching a simulation off - for its "own sake". Im concerned that people can feel the same way about each other, if they believe in the equality of computed feelings.

<comment><USER19> So you are worried that virtual representation will lead you to close off your empathy for humans?

The alternative is to extend it to the simulations.

<comment><USER17> I wrote "our human and animal conciousness should probably not be equated with virtual representations"

Your reply did not follow... no empathy.

<comment><USER19> I think I understood what you wrote. I just doubt that some people extending empathy to virtual personalities will lead to meaningful numbers of other people retracting it from humans.

<comment><USER17> I half expect powerful futuristic AI to figure out and enlighten us as to the specialness of our conciousness, the transience of simulations, and perhaps to define the special arrangements required to create life of similar importance to ourselves, should we really wish to do so... in the non-traditional way.

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> This is one of the most impressive things I've seen this year - and the song is rather catchy (been playing it on repeat). Amazing work! Also great job winning the comp.

I wish I could speak more on the technological side of it, but I'm not well versed in this area. So all I can offer is praise.

</comment><comment><USER21> Super cool! This reminds me of reading about .Kkrieger - [https://en.wikipedia.org/wiki/.kkrieger](https://en.wikipedia.org/wiki/.kkrieger)

</comment><comment><USER22> Check out author's other works. This is the same guy who helped Teenage Engineering design their Pocket Operator series and he also built (and plays) Chipophone.

</comment><comment><USER23> This is amazing. I transitioned from working as a musician to development a few years ago and have recently been thinking of ways to merge the two in interesting/meaningful ways. Often times I feel like a lot of what I enjoy in art is left out of music made primarily with/by computers. This is one of the first examples I have seen that really delivers on medium, message and just plain enjoyment. Really inspiring.

<comment><USER24> There is a lot of opportunity here especially with neural networks.

<comment><USER23> I agree, but I have yet to hear any music generated by a neural network that I enjoy beyond the novelty of it. Feel like the focus is on the neural network, not the music, with the neural network as the instrument.

<comment><USER24> I mean it should be the instrument... or at least an approximation of one!

</comment></comment></comment></comment><comment><USER25> lol even the google cache is being hugged to death [https://webcache.googleusercontent.com/search?q=cache:h_l9j_...](https://webcache.googleusercontent.com/search?q=cache:h_l9j_NhpUEJ:https://www.linusakesson.net/scene/a-mind- is-born/index.php+&cd=1&hl=en&ct=clnk&gl=us)

<comment><USER26> The Google Cache only stores text. It still has live links to all the images on the page. It's more reliable to link to the text-only version. [http://webcache.googleusercontent.com/search?q=cache:h_l9j_N...](http://webcache.googleusercontent.com/search?q=cache:h_l9j_NhpUEJ:https://www.linusakesson.net/scene/a-mind- is-born/index.php&num=1&hl=en&gl=us&strip=1&vwsrc=0)

</comment></comment><comment><USER27> I love that the line number in the embedded basic program is also code.

</comment><comment><USER28> "In the absence of an actual 256-byte compo, it was submitted to the Oldskool 4K Intro compo at Revision 2017, where it ended up on 1st place."

:-)

(I hope the other contestants were suitably ashamed of themselves.)

<comment><USER29> I hope they had fun and enjoyed themselves.

<comment><USER30> Lol, my production with nom de nom came in last place against this one...

At one point while coding our music player, I wondered if something simpler and more algorithmic might be more effective :)

So yeah I was both spanked and I learned a lot. I always watched these cracktros as a kid and now get the chance to write them with the benefit of hindsight, a career in micro controllers and 20 years of music playing experience...

I'm glad the scene is still going and there are great tools out there to accelerate the process.

</comment></comment></comment><comment><USER31> Wow, that's somehow disturbing. I think the stronger than usual visual link with the music sucks you in.

I was surprised to see this guy wrote a tty blog article I had enjoyed before. This one is very different.

</comment><comment><USER32> I mean... Amazing stuff. How..?

My mind refuses to believe it's actually possible EVEN AFTER I TRIED IT AND SAW IT WORKING.

The universe is a lie.</comment>


The surprising damage smart workers can cause - <AUTHOR> http://www.bbc.com/capital/story/20171013-the-surprising-damage-smart-workers-can-cause <comment><USER2> I'm not sure why this should be surprising at all - isn't this the definition of overqualified?

<comment><USER3> It is surprising if you've never thought about such an issue. Similarly surprising is when you burn your hand touching a hot oven if you've never seen anything hot before.

<comment><USER2> But I'm guessing most native English speakers would have an idea of what overqualified means?

<comment><USER3> But most native English speakers, or any language speakers for that matter, don't think about what makes an overqualified person to work below their skill level.</comment></comment></comment></comment>


Infrastructure Software is Dead - <AUTHOR> https://www.mirantis.com/blog/infrastructure-software-is-dead/ <comment><USER2> It is really funny, I agree with this 100% but also think because of the new norm of instant gratification this person is totally wrong. I have customers that all the time state they want to move to an openstack platform but have no programmers or unwilling to hire programmers. So of course we go down that path, look at the capex and opex and their brains explode. Then we look at aws/azure/vCloud and regular internal cloud with its associated costs and they come back from their heart attacks.

If you are a services company, he is right, you should be focusing on outcomes. But, if you can't tell me in 2-3 sentences what problem you are solving and how it benefits the customer you are doing it wrong.

This is a world of businesses and businesses need to make money, usually. Everyone gets so caught up on the new hot thing or the new "revolution" or what the competition is doing without thinking of what problem they are trying to solve or what actual value they are providing. This article says they provide outcomes, sure I can provide outcomes by moving you to SAP, or VDI, or hyperconverged, but what problem is this solving?

Don't tell me it "cut costs", it rarely does and lots of people smarter than me have shown that cutting costs are not the top priority of most leadership.

Back to the point of the article. I have made a lot of money in consulting. I now sell consulting services. You know how I do it? "Yes Mr customer how are you? Cool great, I am fine thanks. So what problems does your organization have, what are your goals, and how can I help you?"

Boom. You are all welcome.

Don't talk about product or you will lose to me or someone better. Don't talk money or you lose. Don't talk fads or you lose. Talk about the business and how you will help it reach its goals, overcomes it's problems, and grow!

<comment><USER3> This! I previously worked for a small software company that frequently got itself lost in the upgrade treadmill (its going to take N man months to upgrade underlying technology X/Y/Z to the latest versions). Yet in the end, I kept asking, what does technology X/Y/Z provide to the product that benefits the customer. Those questions frequently didn't have satisfying answers.

So, your not the cool, forward looking engineer when you favor using a 5 year old toolchain to build your product. OTOH, your also the engineer that doesn't have to come in on weekends to debug the death march bug that ends up being a result of doing the upgrade.

<comment><USER4> Sure. But, have fun trying to get a new job when you're using 5 year old tech. In other words it's not just about pride or being one of the cool kids.

<comment><USER5> You must be a frontend or mobile developer. On the server side using five year old tech is the mark of a proactive and daring company. Our code depends on Python 2.7 (released in 2010) and we still have to compile our own CPython every time we deploy on servers managed by the client.

<comment><USER6> This is less and less true in the new and excited cloud/devops world, for better or worse. There are plenty of companies that even on the server side are chasing the latest release cycle.

</comment></comment></comment></comment></comment><comment><USER7> _Everybody's OpenStack software is equally bad. It's also as bad as all the other infrastructure software out there – software-defined networking, software-defined storage, cloud management platforms, platforms-as-service, container orchestrators, you name it. It's all full of bugs, hard to upgrade and a nightmare to operate. It's all bad._

100% my experience with OpenStack. And the breaking releases every 6 months only add insult to injury.

<comment><USER8> Right. This part of the article was the most aggrevating for me.

Perhaps the author could refrain from speaking for everybody! OpenStack may be a ruinous rubbish barge of a platform, but others are working on software that seeks to _reduce_ operational complexity. Software that does not exist merely to propel yet another band of consultants into a defeatist, over-priced nightmare cathedral of apparently irreducible complexity and unmitigated unreliability.

Outcomes for customers are extremely important, but it does not follow that software quality is immaterial, or unachievable, or that OpenStack is just as good a choice as anything else -- even if it does come with a consulting racket.

<comment><USER9> One could argue that because all the money is made by consulting, managing upgrades etc. the harder it is to setup, operate and to upgrade the better for the players in the OpenStack space.

If the underlying incentives don't coincide with good software you get crappy software.

</comment></comment></comment><comment><USER10> As MD of a medium-sized UK-based cloud server company (Bytemark, cough), I'm _so_ glad to hear someone else saying this. We made the decision in 2010 to design and build our own cloud services stack - from scratch, ultimately including a low-level storage layer. This was just after Openstack was announced, so it felt like a risk not to get on this particular wagon.

We opened our service to customers within a year, and fixed what felt like small silly bugs while constantly racing to keep the platform up. Openstack kept getting richer and puffier and more important-sounding. Even though we thought we would eventually "make the switch" I couldn't for the life of me find any success stories, and looking at the software it seemed to have some crucial gaps that we'd need to fill, and a bunch of layers that we didn't need or care about for our simple "cloud servers" offering.

We're at the point where mayyyyybe we could think about switching out one or two components, but my gut feeling is that 1) these are quite simple components for us where our maintenance burden is manageable, 2) our model of VMs is slightly different (more permanent) than Openstack's and, of course 3) the integration effort doesn't seem worth it, and the loss of experience compared to our own software seems a huge risk if it puts the stability of our platform at risk. So it still feels like picking a fight with our own stable software for benefit that was way down the line.

We're in exactly the same spot at Boris - our customers care about the service, not the software. There is just so much integration with our own hardware, network, data centre & customer services operation that's outside the scope of Openstack that it never quite seemed relevant.

</comment><comment><USER11> More provocative over insightful.

Infrastructure software isn't dead - but Openstack is.

It may still be used, and may continue to see a bit of media now and then but really it's gone the way of Puppet/Cfengine/<many proprietry infra software here>.

It missed it's chance to be good by allowing itself to be corrupted a massive design by committee disaster. Openstack needed a cohesive vision if it was to stand a chance against the integrated enterprise stacks or the custom in-house ones it sought to supplant. It never had it and at this point it never will.

I don't mean any ill-will to any of the Mirantis boys or the other countless hackers that worked on Openstack circa Cinder/Neutron introduction. I was there too, we tried to right the ship before it got too far off-course and we failed. Many smart people tried to make Openstack good but it was out of the hands of the hackers.

<comment><USER12> and I have the complete opposite view. Openstack is killing it even though it's as crappy as everything else in many ways. It's without cost, it's automatable, you don't build inhouse software to handle it, and you build applications that can withstand software and hardware failures.

Openstack isn't a replacement for configuration management.

The massive design by committee is fantastic, because you can help change and adapt where openstack goes. You don't have that option with insert vendor.

We just disagree completely

<comment><USER13> I've worked for two companies that hemorrhaged money trying to set up functional open stack environments. I was on an openstack security team for one company. Omg...yea I'm not going three. I don't feel like raging before bed.

<comment><USER12> I work for a company that is doing fine setting up functional openstack environments. It depends on how much you're willing to spend on it.

We've put enough resources to make it happen, and it's working out fine.

</comment></comment></comment></comment><comment><USER14> I've been consulting for public sector and the companies in the Fortune 500 that are behind the software and operations curve from even start-up companies and always will by choice + self-imposed bureaucracy. The problem I've observed consistently across various custom cloud and openstack implementations is that none of the products and technologies that people are developing are able to succeed because everyone assumes that they "solved" basic infrastructure management a decade ago when their operations teams are woefully unskilled, unmotivated, and unable to meet the demands of today's environments. Most organizations do not have monitoring beyond what comes out of the box even for production environments, most places do not have defined SLAs, almost nobody tests backups or their DR runbooks even though they spent $2M+ on a DR implementation. None of this is the fault of the engineers though; their managers wanted silos and people that just go implement their promotion-garnering plans that all go south.

<comment><USER15> I wish you were wrong. Silos are everywhere -- ugly and unavoidable bottlenecks. Nobody has a plan to fix that culture though because it works only just good enough.

<comment><USER14> I personally don't see anything "wrong" with silos - they are the partitions of the distributed systems of human society and are going to emerge anyway partially due to Dunbar's number in a "flat" organization. The issue I see is that managers are unwilling or very slow to understand new lines of division of labor ("What do you mean that sysadmins should also be developers? Why would we want that?" \- direct quote from a customer) because it doesn't correspond to what their information systems management textbooks from 2002 told them how IT labor is divided. Then comes issues of training managers and telling people why this re-org is _so_ much better than the last 10. This is why the "devops" movement in enterprise is cheap business consulting labor to me - it results in a re-org in most places, and that's the equivalent of developers showing up at a new shop and suggesting refactors as a newbie.

Furthermore, most IT managers have such poor data from the organizations they run that the only things they can track are money spent, not money saved and such. And showing that a CIO doesn't know wtf his company gets you kicked out of meetings permanently in most (typically dysfunctional) organizational cultures.

</comment></comment></comment><comment><USER16> Distributed orchestration software is only just starting to become usable. See [http://rancher.com/..](http://rancher.com/..). I wouldn't call infrastructure software dead. It's the beginning.

I think the problem is that most existing tools/engines/components which make up software systems (e.g. databases, memory stores, frameworks, etc...) were designed to run on a single machine and so far, it's been the DevOps' responsibility to scale them manually. Even for those components which DO support clustering; their approach is often not compatible with most orchestration systems (they tend to micromanage the cluster - Instead of micromanaging the cluster and thereby fighting the orchestrator, the focus should be on writing simple hooks for the orchestrator to invoke).

Developers of tools/engines/components need to change their mindset and start building engines from the ground up to run on distributed orchestration software like Kubernetes, Swarm or Mesos and automatic scalability has to be BUILT INTO every component/service.

A major problem is that there seems to be a massive skill divide between DevOps/SysAdmins and Software Developers - Software devs think of systems like Kubernetes and Swarm as being the responsibility of DevOps people and don't spend enough time thinking about how it impacts them. This is the wrong attitude - The two skillsets need to converge in order to build effective solutions.

Orchestration management tools are the new operating systems - In the same way that one can build apps/systems which are compatible with Linux, Windows or OSX, we should build apps/systems which are compatible with Kubernetes, Swarm or Mesos.

There is more to these orchestration tools than just writing up config files - The code within the components themselves have to be designed to play nice with the automatic scheduling/orchestration requirements.

<comment><USER17> Agreed on all points. Rancher looks quite good and I'm looking forward to something that will soothe the pain in my ass that is the micromanagement of postgres clusters.

</comment></comment><comment><USER18> Well everyone is making money except docker. Drives the point home I think. Docker's business is docker and you can't really make money with it whereas everyone else is building a business on top of docker to deliver outcomes to customers.

</comment><comment><USER19> Heh, it's like [http://dtrace.org/blogs/wesolows/2014/12/29/fin/](http://dtrace.org/blogs/wesolows/2014/12/29/fin/) but from a different angle.

I personal, naive as it sounds, beleive nix* (as in e.g. NixOS) could be a silver bullet here, but the market is so used to IT being inherently shitty I don't believe it will happen.

<comment><USER20> Thanks for the link. I didn't know Cantrill basically imploded. His gripes on Pike's comment and industry mimicked my own. He's way overstating how much people ignore the system level as there's active projects handling it funded by NSF, DARPA, and EU with a practical focus. Most practical being ones with defense contractors (esp Galois) or actual engineers partnered in. Quite a few going from software to firmware to hardware with some to the gates. He could possibly enjoy himself and do some good getting hooked into one of those groups to cover pragmatic, real-world aspects plus spot opportunities as development goes on.

"beleive nix* (as in e.g. NixOS) could be a silver bullet here"

Come on, now. Try to avoid that trap. You need to look at what the market needs in compatibility/legacy, production worthiness, talent to aid deployment/support, security, and so on. Always consider these plus target markets when evaluating any software platform. NixOS at first glance appears to fall short in quite a few.

Now, what I do like about NixOS is its declarative, transaction-oriented packaging. That's great if implemented well given my Linux distro's screw that stuff up to this day when I install an odd package with one incompatibility in it. Irreparably breaks system or appears to. (rolls eyes) Source-based is debatable but allows site-specific optimizations. I'm barely in the debate but lean against systemd, which Cantrill's post mentions incidentally, as it's too complex to be in critical position it inhabits. Critics pointed out a simple thing in its spot plus less privileged services doing management or whatever. Consistent with best practices from high-integrity & high-security engineering going back decades. So, I see it as a weakness albeit a small one in larger picture.

So, there's my two cents on that link and claim.

<comment><USER21> > Thanks for the link. I didn't know Cantrill basically imploded.

That wasn't written by bcantrill. He hasn't imploded yet, as far as we all know. Unless that was when Oracle bought Sun and he's been operating in the imploded state since.

<comment><USER20> Oops. Part of the page didn't render on the device I was using. Couldn't see the name. Thought it was him with the illumos and joylent references. Thanks for the correction!

Note: So someone else that worked there was imploding and could use some time at aforementioned projects clean-slating or improving HW/SW architectures. :)

<comment><USER19> Yeah this is somebody else doing Fishworks->Oracle->Joyent. Original HN thread on the blog post btw [https://news.ycombinator.com/item?id=8816055](https://news.ycombinator.com/item?id=8816055).

<comment><USER20> Ahhhh. Ok, all clear now. Thanks to both of you.

</comment></comment></comment></comment></comment></comment><comment><USER22> 'Infrastructure software' is a too general simplication. If you break down infrastructure software the OP would find many types of software in this field which aren't dead.

<comment><USER23> This.

First of all, he should define what "infrastructure software" he is refering to.

He mostly talks about OpenStack, AWS ... "services".

But it is obviously not only that. It is low level libraries (C lib), compilers, interpreters, operating systems, graphic engines, virtualization software, etc. This kind of software runs on allmost all deployments out there. It is far from dead.

</comment></comment><comment><USER24> IaaS vendor says that companies don't want to host their own infrastructure, more at 11.

I tried to get a neutral take on this, but it reads far too much like a sales pitch, even for vendor blog levels.

</comment><comment><USER25> "And the reason Mirantis has been successful is because, despite ourselves, outcomes are what we've been able to deliver to our customers by complementing crappy OpenStack software with hordes of talented infrastructure hackers that made up for the gaps.

This is't really a ringing endorsement of your business is it? It's nice that he acknowledges a talented team but to refer to your core product as "crappy" is more than a little depressing in my opinion.

<comment><USER26> His product = "crappy openstack" \+ developers. He is just calling openstack (which is made by the community, not just Mirantis) crappy.

<comment><USER25> Yes thats the point I was making, it's an odd business practice to publicly state that fundamentally your business product is crap.

</comment></comment></comment><comment><USER27> He is basically saying "don't ever count on openstack becoming non-crappy, we have a vested interest in keeping it crappy so that to get anything done you will still need to pay mirantis to deploy 'hordes of talented infrastructure hackers". Well, thanks for honesty.

</comment><comment><USER28> _> But none of this matters, because today customers don't care about software. Customers care about outcomes._

Why "today"? Hasn't this always been the case? It sounds essentially like a rephrasing of Paul Graham's advice: "Make something people want."

</comment><comment><USER29> Only slightly facetious, but if they are trying to decouple containers from one another then perhaps they should consider a basic Inversion of Control design principle.

Perhaps that's the job of the orchestrator already though.

</comment><comment><USER30> Forgive my ignorance but what exactly is infrastructure software?

</comment><comment><USER31> I presume because people still need to run "private cloud" \- because of regulation, national borders or not quite trusting AWS with your heart mind and ballsack.

</comment><comment><USER25> Is infrastructure software dead though, or is just Openstack dead?

My perception is Mesos is really impressive and picking up a lot of traction.

</comment><comment><USER32> All this chatter about Openstack and how it fails brings to mind stories of SAP, and the ways it can turn into a money sink.

</comment><comment><USER33> Well, service, yes. Additionally, freedom from service dependence too.

</comment><comment><USER34> "Who's with me?" ~Jerry Maguire.

</comment><comment><USER35> Maybe commercial software is dead.

We all want it, except for some youngins.. how long can the corporate marketplace defy the will of the people who fuel the market?

Free software is the future. The benefits to mankind are too great.

<comment><USER36> > how long can the corporate marketplace defy the will of the people who fuel > the market?

How can you claim that it's the will of all developers to be unemployed?

<comment><USER5> Still this nonsense? Lots of people make a living writing FOSS, and that's with the competition of non-FOSS companies.

As long as there's a demand for more software, there will be jobs for all the developers needed to write it.</comment></comment></comment>


Systematic Unit Testing in an Read-eval-print Loop - <AUTHOR> http://www.cs.aau.dk/~normark/laml/papers/unit-testing.pdf <comment><USER2> python doctest in lisp</comment>


Ask HN: Is Evernote popular within the developer community? - <AUTHOR>

<comment><USER2> Yep, I use it every day, mostly to save steps to build or run something complex. Search across all notes is fantastic.</comment>


Detained blogger revealed true picture of Chinese information warfare - <AUTHOR> https://www.smh.com.au/world/asia/detained-blogger-revealed-true-picture-of-chinese-information-warfare-20190125-p50tmq.html <comment><USER2> I don't know what to say after reading that. It's so depressing. Imagine being scared of being arrested for accessing The Internet? People can never be given _too free_ access to information. The fact people in China have to resort to bypassing the Great Firewall using various hacks is so sad and depressing, and I can feel nothing but anger because of it.

<comment><USER3> I believe you can access any information as long as you don't use that info to make other people angry.

</comment></comment><comment><USER4> "Yang's arrest serves the purpose of granting additional leverage to the Chinese government in international negotiations for the protection and promotion of Huawei around the world."

That isn't how Americans react. Chinese companies, malicious or otherwise, are going to face very significant hurdles expanding in the West. Of course, that could actually be the Chinese central government's goal.

<comment><USER5> _That isn't how Americans react. Chinese companies, malicious or otherwise, are going to face very significant hurdles expanding in the West._

I would like to think so but the reality is, Western companies and consumers just buy whatever's cheapest on the day.

<comment><USER6> Western companies, yes. Western governments... we'll see. The Trump administration is not going easy on the Chinese government, for one. We'll have to wait and see about the rest, or about how serious the Trump administration is about tending to Chinese issues (it appears to be mainly interested in trade imbalance).

</comment></comment></comment><comment><USER7> Why did he fly to China when he must have known that he will get arrested (as mentioned in the article, he was arrested previously and only got out via international pressure, under non disclosed arrangements)?

<comment><USER8> I agree that this is extremely odd. Dr. Hengjun is probably one of the more educated people in the world about China's authoritarian nature. I suspect that there's something else going on - perhaps they have some hidden leverage on him?

</comment></comment><comment><USER9> I hope the Internet and its corresponding freedom of information destroys these evil regimes. Forcing ideas and practices on people from the outside cannot be sustainable.

<comment><USER10> What freedom of information? China chose "restrict access to information" as the method of control, the US chose "deluge people with so much misinformation they can just choose whatever truth suits them". Don't make the mistake of thinking one is better, or more free.

<comment><USER11> The US government _doesn 't restrict_ freedom of speech to such a degree that it allows for _non-government actors_ (including political parties, partisans and those monetarily interested in obfuscation) to decrease the signal to noise ratio of truth (signal) to misinformation and the like (noise).

That is _a lot different_ than the government itself getting into the misinformation business itself.

That can be summed up that don't have regulations on limiting speech when it isn't truthful, except when it incites violence and other limited times like libel, and even then the legal bar is very high to have the legal basis to successfully bring a case.

There is no restriction on reporting the truth. Classified information gets leaked in the press on a fairly frequent basis without any ramifications to the journalists publishing it. It seems fairly often those who leak it aren't charged. Those cases where they are charged are when they don't just verbally say to a reporter off the record, but when they leak documents.

<comment><USER12> >That is a lot different than the government itself getting into the misinformation business itself.

At most, it means someone quits working for a government agency and joins a private party to do their misinformation campaign, see "White House Plumbers," though often it is just the government involved.</comment></comment></comment></comment>


A Doom Renderer written in Rust - <AUTHOR> https://github.com/cristicbz/rust-doom <comment><USER2> Holy crap, this is f __*ing awesome. Rust has made systems programming exciting for me again.

Seeing well written Rust code like this (also, the repos on Github [https://github.com/trending?l=rust](https://github.com/trending?l=rust)) has been a really good learning experience. As a Rust newbie, I only wish there were better examples of testing in public Rust repos.

<comment><USER3> >As a Rust newbie, I only wish there were better examples of testing in public Rust repos.

Testing is incredibly easy. The reason you may have missed the testing is that tests are often in the same file as tested code. Go back and check, it's very common in Rust to test your code. And it's as simple as writing:

      #[test]

on the line before your unit test function, and then using some of the unit test macros in std like `assert` and `assert_eq` along with `fail` to perform the tests[1].

Then you test your code by running the normal rustc command but with the `--test` flag. A test runner with very attractive output is built into the compiler.

Rust unit testing is just about the easiest testing I've ever used, right up there with golang. I love that it's built into the language.

Also, the `cargo` package manager makes everything -- including unit testing -- incredibly convenient. And I say this as someone who cringes every time a language comes out with yet another package manager or build tool (ahem, .js). But in the case of rust's cargo, it's incredibly worth it to use a new package manager, and so much better than a Makefile (although it's quite easy to integrate makesfiles with cargo).

1\. [http://doc.rust-lang.org/std/index.html](http://doc.rust- lang.org/std/index.html)

<comment><USER4> The guide has a whole section on this: [http://doc.rust- lang.org/guide.html#testing](http://doc.rust-lang.org/guide.html#testing)

And we even have a full guide on testing, though I haven't checked it lately: [http://doc.rust-lang.org/guide-testing.html](http://doc.rust-lang.org/guide- testing.html) (it's on the todo list)

</comment></comment></comment><comment><USER5> These are really valuable projects. It's not only a nostalgic project to hack on. It's also a learning tool for those interested in game programming, idiomatic Rust, and C-to-Rust conversion. Even building complex software from requirements. Thank you, Cristi Cobzarenco.

<comment><USER6> Indeed! Looking at projects like this and Piston are helping me get to grips with the language in a much more useful manner than working through the various guides/tutorials.

</comment></comment><comment><USER7> Stuff like that is the reason why I'm excited for Rust's future. It's really an amazing language.

</comment><comment><USER8> This is sort of off topic, but the fact that every change to the source requires (on my machine) 3-4 full seconds to recompile, _without_ optimization, is indicative of the compiler performance problems that remain my main roadblock with Rust.

<comment><USER9> Turbo Pascal and Delphi had incredibly fast compilers. Why can't we make fast compilation a required feature today? We should never have to wait for the compiler/linker.

[http://prog21.dadgum.com/47.html](http://prog21.dadgum.com/47.html)

<comment><USER10> They also didn't have the zero-cost memory safety abstractions that Rust has. Nor did they do much optimization.

That said, we're working on compilation speed. The focus so far has been getting the language in shape and runtime performance of the generated code, not compilation speed (although we've picked most of the low-hanging fruit in compilation speed anyway).

<comment><USER11> How optimistic are you that the compilation speed can be significantly increased? Are there a lot of easy optimizations available or is this just the price paid for extra compile time safety?

I'm not really a fan of Go but waiting for the compiler can be a pretty significant productivity killer on larger projects. Their fast compilation times are a pretty big selling point for what is (IMO) an otherwise underwhelming language design.

<comment><USER10> > How optimistic are you that the compilation speed can be significantly > increased? Are there a lot of easy optimizations available or is this just > the price paid for extra compile time safety?

The vast majority of compile time for optimized builds (80%-90%) is spent in code generation and optimization in LLVM.

For unoptimized builds, most of the compile time is spent in the typechecker doing type unifications for method lookup. With some optimizations to quickly reject method candidates I suspect this can be greatly improved.

Incremental compilation for the fast turnaround is being worked on and there has been significant progress, to address comex' complaint.

> Their fast compilation times are a pretty big selling point for what is > (IMO) an otherwise underwhelming language design.

Go 6g/8g also doesn't do much optimization by comparison to GCC/LLVM. (Rust uses LLVM.)

<comment><USER12> > Go 6g/8g also doesn't do much optimization by comparison to GCC/LLVM. (Rust > uses LLVM.)

You should compare with gccgo, though.

</comment></comment></comment></comment></comment></comment><comment><USER13> A similar project, Quake 2 map renderer written with Julia [https://github.com/jayschwa/Quake2.jl](https://github.com/jayschwa/Quake2.jl)

<comment><USER12> This is cool! Thanks for posting it.

</comment></comment><comment><USER14> OT but it's wonderful to see those screenshots again. It's been decades since I played that game and I can still remember the hidden tricks in those rooms.

</comment><comment><USER15> This is awesome. Would you be interested in writing sort of a tutorial on building something like this? (Obviously much more basic, but still...)

</comment><comment><USER16> How does it interact with OpenGL? Using C bindings?

<comment><USER17> We have a syntax extension that uses kronos' xml registry ([https://www.opengl.org/registry/#specfiles](https://www.opengl.org/registry/#specfiles)) to generate symbol a loader (somewhat like GLEW) at compile time. [https://github.com/bjz/gl-rs](https://github.com/bjz/gl-rs)

<comment><USER16> Thanks for the pointer!

</comment></comment></comment><comment><USER18> This is very cool. Really love seeing devs doing stuff like this.

</comment><comment><USER19> why do these post's titles keep getting moderated?

"Doom I/II written in Rust" is a fine title for what this is.

<comment><USER20> The new title is more accurate. I sometimes disagree with moderated titles, but in this case it's not an issue.</comment></comment>


How to Memorize a Deck of Cards - <AUTHOR> https://www.lesswrong.com/posts/eGmpH7WuyDRmGJ4HF/memorizing-a-deck-of-cards <comment><USER2> This would be a lot faster and simpler using memory techniques... Though I doubt that doing this would be improving focus.</comment>


Google Helps Seized BitTorrent Site to Regain Lost Traffic - <AUTHOR> http://torrentfreak.com/google-helps-seized-bittorrent-site-to-regain-lost-traffic-101231/

<comment><USER2> So very interesting is that he still had Google control panel control of Torrent-finder.com even after it had been seized, so he could redirect searches to .info.

This could be an actual issue. What if instead of getting his .com seized, he had sold it. He could then redirect search traffic to another domain even after he doesn't have control over it.

I guess something to think about when you obtain a new domain, make sure you establish control via google's webmaster control panel.</comment>


API Hack-a-thon tomorrow in Mnt View (Bump, Twilio, Olark, Y, etc) - <AUTHOR> http://apihackathon.eventbrite.com/

<comment><USER2> APIs for the invited companies:

<http://bu.mp/api.html>

<http://www.twilio.com/docs/>

<http://www.olark.com/docs>

<http://www.box.net/developers>

<http://pbworks.com/api_v2/>

<http://www.webservius.com/corp/documentation.html>

<http://developer.yahoo.com/yql/>

Lots to play with.

</comment><comment><USER3> woot, I'll be there - so happy this came together!

</comment><comment><USER4> What if I want to go but can't but still made some mashup thingie and want to show it off?

<comment><USER3> maybe I can show it off for you? There are going to be more of these events soon too

<comment><USER4> I'll just probably show up later. my mashup kinda sucks right now anyways. but thanks for the offer.

</comment></comment></comment><comment><USER5> any prizes for the contest?</comment>


Back up your Mac using Time Machine to TonidoPlug - <AUTHOR> http://www.tonido.com/forum/viewtopic.php?f=37&t=1005

<comment><USER2> Does it make anyone else nervous when they have to enable a hack (TMShowUnsupportedNetworkVolumes) to make their _backups_ work?

<comment><USER3> Not in this case. All this does is enable Time Machine to see _all_ network drives instead of only those advertising themselves with a certain magic handshake.

It's a bit annoying but hey, somehow apple must sell those Time Capsules, right? $250 in profit per shot is nothing to sneeze at after all (cf. "printer cartridges")

<comment><USER4> There's a UI advantage to that handshake, too. You get the drive icon showing up on the desktop as a Time Machine drive instead of a standard USB disk, right?

</comment></comment></comment><comment><USER5> >Your backup might fail if your computer's name contains apostrophes (which is default in Mac OS X).

How hard could it be to fix this ? It looks like a sloppy script, not sure one should rely their backups on this.

</comment><comment><AUTHOR> afraid of hack from hacker news reader:)</comment>


AT&T to allow 3G Skype calls - <AUTHOR> http://share.skype.com/sites/en/2009/10/good_move_att.html

<comment><USER2> ATT actually loses nothing from me. I'll still use my normal ATT phone service for all US calls. All this means is that I will call foreign countries from my cell phone.

</comment><comment><USER3> That's amazing ...

Why would AT&T do this? I no longer need 'minutes' of phone service anymore (except as a backup when I'm occasionally out of a 3G service area)

<comment><USER2> Perhaps they calculated that it's less risky to open VOIP apps than to possibly suffer the wrath of the FCC.

<comment><USER4> Well, Verizon just put a huge shot across AT&T's bow today by announcing they would allow Google Voice (and others) on their new Android-based handsets.

[http://www.wired.com/gadgetlab/2009/10/verizon-android- phone...](http://www.wired.com/gadgetlab/2009/10/verizon-android-phones/)

<comment><USER5> A shot across the bow is fine. The folks who put together the phone still have to _execute_. Hopefully this will shape AT&T up.

<comment><USER4> Very true. Verizon could be all talk at this point.

But it's interesting to see the walls starting to come down, slowly as they are.

</comment></comment></comment></comment></comment><comment><USER6> Does this mean Google Voice will be supported as a native iPhone app?

<comment><USER7> In light of the Vonage app which was approved the other day, I don't see what possible objection ATT/Apple could have against the Google Voice application.

<comment><USER8> If the Vonage app doesn't replace the native dialer, then it's certainly possible that it could have been approved while GV hasn't been.

Remember: it's not an objection to VOIP in general. It's an objection to the replacement of core iPhone functionality.

EDIT: Hey everybody. I'm just repeating what Apple said. The GV announcement said nothing about VOIP, it just said "replacement of core functionality." Thanks.

<comment><USER9> _Remember: it's not an objection to VOIP in general. It's an objection to the replacement of core iPhone functionality._

Perhaps I'm just old-fashioned, but I would have thought that the piece of software in the iPhone that makes it usable as a phone would be closer to "core functionality" than the dialer. VOIP is definitely treading on the former, though how it deals with the latter is obviously a question of interface rather than of protocol.

<comment><USER10> Conceptualizations of what constitutes core functionality in products and software have become increasingly shallow and less feature focused. I don't know if this is because of a somewhat less "business" driven mindset, or because Apple is absolutely brimming with UI freaks, but the mentality seems to at present be that the _imitation_ of a dialer in _software_ rather than the actual _ability_ to make calls is what is most important to "protect".

I appreciate Apple's attempts maintain integrity in the UI interface but their hysterics over something like this make me wary.

</comment></comment></comment></comment></comment><comment><USER11> FWIW, Skype over AT&T 3G has worked for many years on Windows Mobile. Or... it did 2 years ago when I last used it.

<comment><USER12> Ditto.

I also made a skype call from my laptop via a tethered cellphone and the quality was noticeably better: the cpu speed of the phone was more of a limiting factor than the 3g data speed.

</comment></comment><comment><USER13> Question: With the Skype-app on the iPhone can you be online on Skype even after you lock the screen or go to another app?

If you want to online on Skype on the iPhone so that people can call or message you even when you are using SMS or doing something else. Is this possible? At least on wifi?

<comment><USER14> Not possible without jailbreaking.

<comment><USER15> AIM does just that, albeit they ping you with badges/notifications when you get a message, which wouldn't quite work with calls. But you could always call back, or be "away". Nothing is stopping Skype from making that happen.

</comment></comment></comment><comment><USER16> One benefit is I no longer have to use my minutes to call 1800 #s. like cust service etc

<comment><USER17> I was going to ask if you guys have a similar site to <http://www.saynoto0870.co.uk> that turns premium numbers into local phone numbers for standard rate calls.

But I found it.

<http://www.saynoto1890.com/>

The UK version of that has saved me _crap loads_ in customer service call costs.

</comment></comment><comment><USER18> Good for them, good decision. There are other international operators that run skype and it is really useful.

</comment><comment><USER19> If you have a sip account you can use fring to make voip calls.

</comment><comment><USER20> I use Gizmo5 on my e71 over 3g. Better and cheaper than Skype.

<comment><USER21> So what's your point?

</comment></comment><comment><USER22> i wonder if this has anything to do with keeping the iphone exclusivity? verizon today also announced that they will be supporting android devices.

</comment><comment><USER23> FCC would have ruled AT&T to do this anyway.

</comment><comment><USER24> Too bad skype text chat is unreliable.

<comment><USER25> less reliable than international SMS?

<comment><USER26> Yes, definitely. The failure rate of Skype text chats, especially group chats with many participants, is astonishing.

International SMS is quite reliable, depending on destination country and routing.

</comment></comment></comment><comment><USER27> I think the technically correct term would be "no longer actively blocks".</comment>


Show HN: Ycommentator - HN front page with Slashdot-like inline comments - <AUTHOR> http://news.ycommentator.com The comments on HN are often at least as good (if not better!) than the links. I built this app to have a way to quickly read through all the top comments on front page stories. I hope some of you find it useful too. <comment><USER2> Try making the comments fully collapsable, pulling into the DOM dynamically without firing up a whole new page, like reddit does.

Also, my gut feeling is that the default should be no inline comments at all, i.e. you have to select something to pull in any new comments, via the above scheme.

This would preserve what is after all one of the best features of the HN interface -- the ability to compare a great many of incoming topics side-by- side -- while still allow for a slicker way to drill down into the comments section, without having to do a full page reset.

<comment><AUTHOR> That's a great idea. My preference is to have the comments always expanded so I can skim them quickly, but an expand / collapse feature would increase the app's appeal to people who like the regular HN front page and want quicker access to comments.

Normally collapsed comments with individual expand buttons and an "expand all" button would handle both of our use cases pretty well.

</comment></comment><comment><AUTHOR> The comments on HN are often at least as good (if not better!) than the links. I built this app to have a way to quickly read through all the top comments on front page stories. I hope some of you find it useful too.</comment>


Wine 4.20 - <AUTHOR> https://www.winehq.org/news/2019111501 <comment> ur-whale What has always amazed me about the Wine project his how they have continued, unphazed, to fight was they knew from the beginning to be a losing battle (tracking an ever changing, ever growing API with no proper documentation of what the API actually does, especially wrt side-effects) all the way to something that is actually usable.

I would even venture to wager that in 20 years, the only way to run certain old Windoze binaries will on top of Wine because the proprietary mountain of crap that is the Windows commercial API offering will have fully fossilized and been dissolved by the winds of time.

Kudos, I am truly in awe of this project.

<comment><USER2> My employer runs our payroll software on WINE because they already can't get it to work on modern Windows.

<comment><USER3> Very cool and in a way sensible - old Windows isn't a moving target anymore, so WINE is in a perfect position to be the solution there.

</comment></comment></comment><comment><USER4> I love Wine. It's amazing.

I wish there had been a joke about running CBD flavored apps or something with this release.

</comment><comment><USER5> What is the Mono engine? What does FNA stand for?

<comment><USER6> FNA is an open-source clone of the Microsoft XNA game programming libraries for .NET/CLR/whatever the right scope/trademark for that platform is. I don't think it actually stands for anything. Wikipedia says that XNA stands for "XNA's not acronymed", but I think the source was joking.

</comment></comment><comment><USER7> Typical HN. A post about Wine with 11 comments, of which 100% are meta comments about the version number and 0% about Wine itself.

Wine is great, since it can run Age of Empires 2 in network mode without any issues (less issues than on Windows 7, actually), I can fully ditch Windows on my laptop! :)

<comment><USER8> AoE II HD or regular? Is it possible to do LAN gaming with the HD version? I thought it's only for Steam users. Also, I'm interested in figuring out how to install Chinese language packs for AoE II HD without weird font issues.

Yes, I just confirmed that Hacker News comments are often off-topic. But at least we agree that Wine is great for AoE.

<comment><AUTHOR> It isn't off-topic, as the version number is incorrect. Why one of the mods changed it to an incorrect version number is beyond me.

</comment></comment></comment><comment><USER9> Why was this title changed? It's just downright inaccurate now? The linked release is 4.20

<comment><USER10> Note that Wine is one of those confusingly-versioned projects where 4.20 is the one that comes after 4.19

<comment><USER11> What would non-confusingly come after 4.19, just out of interest?

<comment><USER12> He's probably thinking about decimal numbers, so 4.2 is expected instead of 4.20

</comment></comment></comment></comment><comment><USER13> It's 4.20, not 4.2 really. Just built it with esync patches. Once fsync gets into upstream kernel, there won't the need for esync hack.

</comment><comment><USER14> when will arch repo going to be blazing it

</comment><comment><USER15> AFAIC, the only burning Wine update right now will be a fix for 32 bit apps in macOS Catalina, which this update does not contain.</comment>


Ask HN: ideas for portfolio projects? - <AUTHOR>

Hi, I have been teaching myself to code for the past year and I am now at the point where I feel competent enough to do this for a living. I have focused on rails and javascript, but I also know a little python.<p>I'd like to start building a portfolio to show prospective clients but I'm at a loss for what kind of projects to build.  Is the standard to-do list or blog enough for a prospective clients to see what I'm capable of or do I need to make something more substantial? <comment><USER2> Apps like that could be enough to show off what you can do, but what's more interesting to employers is to see some creativity as well as ability to code.

I suggest looking for something a little more fun and interesting than a simple blog.</comment>


How adversarial training can perform robust deep learning - <AUTHOR> https://www.microsoft.com/en-us/research/blog/newly-discovered-principle-reveals-how-adversarial-training-can-perform-robust-deep-learning/ <comment><AUTHOR> Paper: "Feature Purification: How Adversarial Training Performs Robust Deep Learning"

[https://arxiv.org/abs/2005.10190](https://arxiv.org/abs/2005.10190)</comment>


ZeroNet – Uncensorable websites using Bitcoin crypto and BitTorrent network - <AUTHOR> https://zeronet.io/en <comment><USER2> Love the ZeroNet project! Been following them for a year and they've made great progress. One thing that's concerning is the use of Namecoin for registering domains.

Little known fact: A single miner has close to 65% or more mining power on Namecoin. Reported in this USENIX ATC'16 paper: [https://www.usenix.org/node/196209](https://www.usenix.org/node/196209). Due to this reason some other projects have stopped using Namecoin.

I'm curious what the ZeroNet developers think about this issue and how has their experience been so far with Namecoin.

<comment><USER3> Also, if you ever lose control of a namecoin domain you can say goodbye to it forever. A squatter will take it instantly and hold on to it forever unless you buy it from them for actual money.

<comment><USER4> Isn't that true of normal domains, too?

<comment> loup-vaillant Depends on the toplevel suffix. For instance, .fr (France) domains have a "no taking" period after the expiration date, where nobody can take it from their previous owners. The owner can then take it back, but it won't be re-activated for a couple of weeks, I believe. So the punishment for screwing up is a temporary blackout of your domain name.

.com, .net, .org domains are handled differently, and may be easier to lose permanently.

</comment></comment></comment></comment><comment><USER5> Has the code quality improved since I was told to screw off for bringing up security?

* 2 years out of date gevent-websocket

* Year old Python-RSA, which included some worrying security bugs in that time. [0](Vulnerable to side-channel attacks on decryption and signing.)

* PyElliptic is both out of date, and actually an unmaintained library. But it's okay, it's just the OpenSSL library!

* 2 years out of date Pybitcointools, with just a few bug fixes around confirmation things are actually signed correctly.

* A year out of date pyasn1, which is the type library. Not as big a deal, but covers some constraint verification bugs. [1]

* opensslVerify is actually up to date! That's new! And exciting!

* CoffeeScript is a few versions out of date. 1.10 vs the current 1.12, which includes moving away from methods deprecated in NodeJS, problems with managing paths under Windows and compiler enhancements. Not as big a deal, but something that shouldn't be happening.

Then of course, we have the open issues that should be high on the security scope, but don't get a lot of attention.

Like:

* Disable insecure SSL cryptos [3]

* Signing fail if Thumbs.db exist [4]

* ZeroNet fails to notice broken Tor hidden services connection [5]

* ZeroNet returns 500 server error when received truncated referrer [6] (XSS issues)

* port TorManager.py to python-stem [7] i.e. Stop using out of date, unsupported libraries.

I gave up investigating at this point. Doubtless there's more to find.

As long as:

a) The author/s continues to use out-dated, unsupported libraries by directly copying them into the git repository, rather than using any sort of package management.

b) The author/s continue to simply pass security problems on to the end user

... ZeroNet is unfit for use.

As simple as that.

People have tried to help. I tried to help before the project got as expansive as it is.

But then, and now, there is little or no interest in actually fixing the problems.

ZeroNet is an interesting idea, implemented poorly.

[0] [https://github.com/sybrenstuvel/python- rsa/issues/19](https://github.com/sybrenstuvel/python-rsa/issues/19)

[1] [https://github.com/etingof/pyasn1/issues/20](https://github.com/etingof/pyasn1/issues/20)

[3] [https://github.com/HelloZeroNet/ZeroNet/issues/830](https://github.com/HelloZeroNet/ZeroNet/issues/830)

[4] [https://github.com/HelloZeroNet/ZeroNet/issues/796](https://github.com/HelloZeroNet/ZeroNet/issues/796)

[5] [https://github.com/HelloZeroNet/ZeroNet/issues/794](https://github.com/HelloZeroNet/ZeroNet/issues/794)

[6] [https://github.com/HelloZeroNet/ZeroNet/issues/777](https://github.com/HelloZeroNet/ZeroNet/issues/777)

[7] [https://github.com/HelloZeroNet/ZeroNet/issues/758](https://github.com/HelloZeroNet/ZeroNet/issues/758)

<comment><USER6> Well, it is better to concentrate on getting users in than to solve some small quirks.

Nobody is going to attack ZeroNet if it doesn't have users anyway.

<comment><USER7> That was OpenSSL's attitude. It resulted in harm to many more users who would've been better off with something else or with its own developers actually trying to prevent security vulnerabilities. A project advertising something to be "uncensorable" based on "crypto" or whatever should be baking security in from the start everywhere it goes. Or it's just a fraud.

<comment><USER6> You're right.

</comment></comment></comment></comment><comment><USER8> We need more projects like these. Whether this project solves the question of a truly distributed Internet* is out of question. What we need is a movement, a big cognitive investment towards solving the Big Brother problem.

*I am referring to concentrated power of the big players here, country-wide firewalls, and bureaucracy towards how/what we use.

<comment><USER6> We need multiple internets, a big confusion, governments can't handle confusion, but if everything is standardized over Facebook and WhatsApp it's easy for them.

<comment><USER9> They can.

Well. Look, even if you have multiple internets, decentralized everything, distributed all systems, no more Google no more Facebook. What does the communication patterns in such a system look like? Do you use the system after work before going to sleep? Your and everyone else usage patterns, traffic can be analyzed. The endpoints, many of them would be honeypots run by Spooks, revealing even more what you are up to and giving you a false sense of safety while the Spooks could run the entire decentralized inter-network.

So your system would have to fake it somehow, fake requesting some hashes here and there, fake request/post comments and follows. Otherwise, the social data available when the SPOOKS join your social-network even if it is distributed like patchwork on scuttlebot, defeats its purpose.

That is what bitmessage does, but then you pay in high bandwidth costs. And yet, you cant just do random shit, random can easily be filtered out so you need more advanced method of finding fake social relations and using those to do fake data to actually conceal what you and everyone else is doing on the interweb.

EDIT: Im not saying "give up", its a very worthy cause, just the problem is harder and enters the social space quite fast - the problem is the same as "we are all nice developers and hackers" yet 99% seem to be employed by NSA/similar-services/Google and think they are doing great James Bond like type of jobs, while they are actually anti-hackers and anti-developers, in fact, anti-society.

<comment><USER10> I believe i2p solves most of issues you mentioned with galic routing. Though at a cost of speed of course.

</comment></comment></comment></comment><comment><USER11> The project looks very promising but relies on running a lot of javascript from untraceable sources in the browser.

Given the long history of vulnerabilities in the the browsers, trusting js from a well-known website might be OK, trusting js from zeronet is unreasonable.

If ZeroNet could run with js code generated only by the local daemon or without js it would be brilliant.

<comment><USER12> Chrome added a feature a long while back I really wanted for ages. The ability to specify the checksum of a linked asset, so that it can be verified as it's downloaded (and untrusted/discarded if not). I just can't find the docs for it. :( My Google-fu is not strong.

EDIT:

Found it :D

[https://w3c.github.io/webappsec-subresource- integrity/](https://w3c.github.io/webappsec-subresource-integrity/)

<comment><USER13> It's called Subresource Integrity, see [https://hacks.mozilla.org/2015/09/subresource-integrity- in-f...](https://hacks.mozilla.org/2015/09/subresource-integrity-in- firefox-43/) and [https://www.w3.org/TR/SRI/](https://www.w3.org/TR/SRI/)

Browser support is noted here: [http://caniuse.com/#feat=subresource- integrity](http://caniuse.com/#feat=subresource-integrity)

<comment><USER12> It's kind of a shame they didn't let their imagination fly with that one... I wish integrity were a global attribute, because I could totally see using it for things like images and audio/video.

<comment><USER14> It might work (though I'm not completely sure) if you specify a hash in the img-src directive of the CSP header: [https://developer.mozilla.org/en- US/docs/Web/HTTP/Headers/Co...](https://developer.mozilla.org/en- US/docs/Web/HTTP/Headers/Content-Security-Policy/img-src)

Another option would be to just use a subresource-integrity protected script to check the hash of a downloaded image/video before displaying it.

<comment><USER12> That is clever and I like you.

</comment></comment></comment></comment></comment></comment><comment><USER15> I would recommend use of Freenet over ZeroNet. More or less the same concept/functionality however with 15 years more experience.

Freenet: [https://freenetproject.org/](https://freenetproject.org/)

<comment><USER6> Freenet is a great idea with 15 years of failure to get traction with sane (by which I mean non-paedophile) people.

Also, it's written in Java.

<comment><USER16> Just curious: are the gay people insane as well?

<comment><USER17> I think he was using the word "sane" loosely to mean common people, not a niche group. I agree though that it's hypocritical to label some sexualities as a disease or insanity but object to doing the same for other minority ones.

<comment><USER18> are you actually trying to say that being a pedophile is a legitimate sexuality?

or even that it's anything like being gay?

</comment></comment></comment></comment></comment><comment><USER19> > Anonymity: Full Tor network support with .onion hidden services instead of > ipv4 addresses

How does this track with the Tor Project's advice to avoid using BitTorrent over Tor [1]? I can imagine that a savvy project is developed with awareness of what the problems are and works around them, but I don't see it addressed.

[1] [https://blog.torproject.org/blog/bittorrent-over-tor-isnt- go...](https://blog.torproject.org/blog/bittorrent-over-tor-isnt-good-idea)

<comment><USER20> I'm also suspicious, since they say that your blockchain address is used for authentication - couldn't colluding websites track your public key and use it to track you between websites?

<comment><USER14> Seems like that's only for publishing new content, not for merely browsing.

Though I guess unless you create a new identity for every site you want to post a comment on, your comments on one site could be proven to be posted by the same person as your comments on another site.

</comment></comment></comment><comment><USER21> As for uncensorable, if the content is illegal, the torrent peers may be incriminated distribution of illegal content

<comment><USER22> Neither argument has been tested, but the defense would that you were acting as an ISP with dumb pipes.

Which logically leads to an unrelated question -- if ISPs are doing DPI on every packet, they at least theoretically 'know' whether you're transmitting 'illegal' content. If I were a rights holder, I'd be making that argument against ISPs. I don't know how I'd sleep at night, maybe, but I wouldn't let ISPs have their cake (valuable user data) and eat it too (immunity based on status as ISP-only).

<comment><USER23> It's been tested for Freenet. LEA adversaries can participate, and identify peers. Judges issue subpoenas. Many defendants have accepted plea bargains. Plausible deniability doesn't work. What works is using Tor.

<comment><USER24> Even Tor isn't a magic bullet, specifically because of other technologies used in combination, such as a web browser.

[https://www.eff.org/pages/playpen-cases-frequently-asked- que...](https://www.eff.org/pages/playpen-cases-frequently-asked-questions)

<comment><USER23> Yes, the FBI exploited a Firefox vulnerability to drop NIT malware on Playpen users. And said malware phoned home to FBI servers, bypassing Tor.

However, any Whonix users would not have been affected, for two reasons. One, this was Windows malware, and Whonix is based on Debian. Two, Whonix comprises a pair of Debian VMs, a Tor-gateway VM and a workstation VM. Even if the malware had pwned the workstation VM, there is no route to the Internet except through Tor.

<comment><USER25> If the workstation vm is pwned what stops it from hitting the usual home router internal network address and/or changing the route?

Is there some network isolation going on which prevents that?

<comment><USER23> The workstation VM has no route to the home router except through the Tor gateway VM. With Whonix, the gateway VM isn't even a NAT router. Plus there are iptables rules that block everything except Tor. The gateway VM only exposes Tor SocksPorts to the workstation VM. You'd need to break the network stack in the gateway VM in order to bypass Tor.

<comment><USER25> Right so can't I just add one then? Most vm setups I might have a default route to the other VM running tor but I can still talk to e.g 192.168.0.1 even if I'm not putting traffic through it.

Is this some kind of 'vm specific' virtual network which can't talk on the real lan? Is that implemented on the hypervisor?

<comment><USER23> Yes, for Whonix it's a VirtualBox internal network. There's no direct routing through the host, only among VMs. You can do much the same on VMware.

Edit: I forget that I'm writing on HN. When I say VM, I'm referring to full OS-level VMs, not namespace, Java, etc VMs.

<comment><USER25> That sounds like a pretty neat setup. I know I can just google all this so please forgive me the inane questions; it depends on virtualbox though?

That's a bit of a nonstarter for a few of.

We probably aren't the target base for the project though so maybe it doesn't matter...

<comment><USER23> Yes, it depends on VirtualBox. But there are versions for KVM, and for Qubes. More of a nonstarter, though. Or even using physical devices, such as Raspberry or Banana Pi.

Years ago, I created a LiveDVD with VirtualBox plus Whonix gateway and workstation VMs. I had to hack at both Whonix VMs to reduce size and RAM requirements. But I got a LiveDVD that would run with 8GB RAM. It took maybe 20 minutes to boot, but was quite responsive.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER26> There's also GNUNet: [https://gnunet.org/](https://gnunet.org/) As others have mentioned there's also FreeNet: [https://freenetproject.org/](https://freenetproject.org/)

I haven't looked deep into any of these projects, but I do think they are neat and hoping at least one of them gains a lot of traction.

<comment><USER5> Considering a Freenet user is currently [jailed indefinently]([https://arstechnica.com/tech-policy/2017/03/man-jailed- indef...](https://arstechnica.com/tech-policy/2017/03/man-jailed-indefinitely- for-refusing-to-decrypt-hard-drives-loses-appeal/)), there does seem to be some problems.

</comment></comment><comment><USER27> Cannot access this at work for zeronet.io being involved in P2P activity.

I cannot help but feel disappointed and unamused.

<comment><USER28> [https://zeronet.readthedocs.io/en/latest/](https://zeronet.readthedocs.io/en/latest/)

</comment></comment><comment><USER29> In other news ZeroNet has been banned from giving its TEDtalk: [https://news.ycombinator.com/item?id=14039219](https://news.ycombinator.com/item?id=14039219)

<comment><USER30> I quit giving TED my clicks long ago. They occasionally have some good talks, but many more that are pseudoscience garbage. Don't even get me started on TEDx. I hope ZeroNet find a better stage for their talk. Perhaps an organizer could contact them.

</comment></comment><comment><USER31> I always wondered why you couldn't just download a torrent of torrents for the month.

<comment><USER32> It would be interesting to create a distributed catalog of torrents itself.

<comment><USER33> Maybe I'm not picking up what you're putting down, but how does this differ from DHT?

<comment><USER34> It might be possible with the DHT alone, but I think for what the grandparent poster wants it would depend on the ability to query the DHT. Both in general and by popularity and insert date.

That might be possible, but with the prvelence of magnet links instead of everyone using that, I just assumed not.

<comment><USER35> It's possible to do something fully distributed, but not just with the existing DHT network: [https://www.tribler.org/](https://www.tribler.org/)

</comment></comment></comment></comment></comment><comment><USER36> There is single point of failure, kill the tracker = kill the whole network. You can get all the IPs from the tracker that are visiting certain site, it's not so secure if someone is not using tor.

<comment><USER37> Bittorrent supports more peer sources than just trackers, DHT being the most important one among the others.

<comment><USER36> It's not supported by ZeroNet.

<comment><USER14> You sure about that? Their presentation [says][1] "Tracker-less peer exchange is also supported". Any idea what that's referring to?

[1]: [https://docs.google.com/presentation/d/1_2qK1IuOKJ51pgBvllZ9...](https://docs.google.com/presentation/d/1_2qK1IuOKJ51pgBvllZ9Yu7Au2l551t3XBgyTSvilew/pub?slide=id.g9a3b93883_1_0)

<comment><USER36> That one peer can send their peers. It's called peer exchange.

</comment></comment></comment></comment></comment><comment><USER38> I don't see how this could decentralize web _applications_ though. Wouldn't each client have to be running the server software? Someone has to pay for that, too.

<comment><USER39> Yeah every client have to run the software or you use a proxy. If you have a site with many spreads you don't need a running instance. But if you have a an unknown site you would have to run a little server permanently.

</comment></comment><comment><USER40> I thought it was pretty easy to disrupt / censor torrents, hasn't that been going on for a while?

<comment><USER41> _" I thought it was pretty easy to disrupt / censor torrents, hasn't that been going on for a while?"_

Not torrents themselves, only torrent search engines. Torrents are distributed by design, but traditional torrent directories/aggregators/search engines are centralized, thus easy targets for DCMA take-downs, ISP blocks, trials etc.

<comment><USER42> ...And that's exactly the first thing they should put in ZeroNet.

<comment> dane-pgp Yup, torrent search engines are the weak link when it comes to protecting the public's access to arbitrary large files, and also the front lines in the battle between the media industries and an uncensored internet.

ZeroNet is perhaps not enough on its own to solve this problem, though, since a good torrent search engine suffers from the same limitation as a good forum, which is the need to have some form of community-based moderation. If people can't remove spam search results, and spam comments, then the medium can be too easily exploited (using Sybil attacks, etc.) and become useless.

The missing piece which is holding back so many decentralised technology projects is a lack of a decentralised trust platform. A necessary step towards this would be a decentralised (and privacy-preserving) identity platform, which would have the added benefit of removing the "Log in with Facebook/Google" problem from the web.

<comment><USER42> Just sort search results by torrent popularity. People aren't going to seed bad content.

</comment></comment></comment></comment></comment><comment><USER43> Sounds incredible, we'll probably be seeing much more of this type of thing in the near future.

</comment><comment><USER44> Lack of anonymity in ZeroNet is a big problem.

<comment><USER14> Seems like it's just as anonymous as the existing web; you can use Tor to hide your IP, but that's optional.

</comment></comment><comment><USER45> > Page response time is not limited by your connection speed.

Huh? What do they mean?

<comment><USER15> If you have previously visited a page then the response time will be limited by your computers ability to locate and open the correct html document.

If you haven't previously visited a page then the response time will be limited by how many peers are available <b>and then</b> by your connection speed.

</comment></comment><comment><USER46> Several years ago I had Tor running on a server at home. It was a regular Tor node, not an exit node. Later I was put on a blacklist because of this. What is the risk of using this?

<comment><USER47> Would you mind defining "blacklist" in this context? That's kind of scary!

</comment></comment><comment><USER48> Presumably you only download the site you want when you visit it. If that's the case then can you view revisions of the web sites or do you only have the current copy?

<comment><USER49> If you click on "How does it work?" you get redirected to a short and sweet presentation[0]. According to the presentation, when you, as the site owner, push an update, content.json gets updated, the peers get a notification (using the WebSocket API) that a new content is available, and then they download the new version of content.json that contains the sitemap of the updated version of the website. Cleverly thought out!

[0] - [https://docs.google.com/presentation/d/1_2qK1IuOKJ51pgBvllZ9...](https://docs.google.com/presentation/d/1_2qK1IuOKJ51pgBvllZ9Yu7Au2l551t3XBgyTSvilew/pub?start=false&loop=false&delayms=3000#slide=id.g9a1cce9ee_0_4)

<comment><USER5> Unless your site is too big: [0].

Then you can have users end up browsing stale versions of the site. Still an issue as of before Christmas last year.

[0] [https://github.com/HelloZeroNet/ZeroNet/issues/598](https://github.com/HelloZeroNet/ZeroNet/issues/598)

</comment></comment></comment><comment><USER50> Speaking of which, what's the progress on IPFS?

<comment><USER51> We're moving forward as always. Latest features would include distributed pubsub, filestore (allows you to add files without duplicating them) and interop between the browser and desktop nodes. Any specific part you're looking at?

<comment><USER52> 1) What's the status of (supported as a real feature, not just manually changing the bootstrap nodes and hoping everyone else does too) private IPFS networks? If it's there already, how stable is its configuration ( _i.e._ if I get my friends on a private IPFS network will I likely have to get them all to update a bunch of config in 6 months or a year)?

2) Does filestore also let you store, say, newly pinned files in your regular file tree? That is, can you pin a hash for a file (or tree) you don't already have and provide an ordinary file system location where it should go when it's downloaded? Or do you have to copy it out of IPFS' normal repo manually, then re-add it in the new location? Also: how does filestore behave if files are moved/deleted?

3) What rate of repo changes requiring upgrades can we expect for the future? That is, how stable is the current repo structure expected to be? Is the upgrade process expected to improve and/or become automated any time soon?

4) Is there a table of typical resource requirements somewhere? I'm looking for "if you want to host 10TB and a few 10s of thousands of files, you need a machine X GB of memory. If you want to host 500MB, you only need Y GB of memory. If you have 2TB but it's in many, many small files, you need Z GB of memory", or else a formula for a achieving a best-guess for that. For that matter, how predictable is that at this point?

The use case I've been excited to use IPFS for since I found out about it is a private, distributed filesystem for my friends and family. Easy automated distributed backups/integrity checking on multiple operating systems, access your files at someone else's house easily, that sort of thing. Filestore finally landed, which was a big piece of the puzzle (the files _have_ to remain accessible to ordinary tools and programs or I'll never get buy-in from anyone else), so that's exciting. Now I'm just waiting for docs to improve (so I'm not searching through issue notes to learn which features exist and how to use them) and for a sense that it's stable enough that I won't be fixing brokenness on everyone's nodes several times a year.

<comment><USER53> 1) [https://github.com/ipfs/go- ipfs/issues/3397#issuecomment-284...](https://github.com/ipfs/go- ipfs/issues/3397#issuecomment-284341649)

2) The latter. Former is nice idea you for sure should rise it on go-ipfs tracker.

3) The repo update is currently automated (run daemon with `--migrate` flag so it will migrate itself)

4) Unfortunately not but it is very interesting question. If you could ask it on [http://ipfs.trydiscourse.com/](http://ipfs.trydiscourse.com/) it would be awesome.

</comment></comment></comment></comment><comment><USER31> a youtube replacement in zeronet would rock

</comment><comment><USER54> It would be great if a simpler webtorrent version was available just for fun.

<comment><USER5> There's a year-old project called peercloud that might scratch that itch:

* [https://github.com/jhiesey/peercloud](https://github.com/jhiesey/peercloud)

* [https://peercloud.io/](https://peercloud.io/)

</comment></comment><comment><USER55> This seems similar to ipfs. What are the main differences?

<comment><USER51> IPFS is more low-level in terms of that IPFS is a protocol (in reality a collection of protocols) for P2P data transfer. Together with IPLD, you'll get a full suite of protocols and data structures for creating fully distributed P2P applications.

ZeroNet is a application for distributing P2P applications, using Bittorrent for the P2P layer. In theory, ZeroNet could leverage IPFS to get a better and more modular stack for the actual connectivity and transfering.

<comment><USER55> gotcha, thanks for the explanation. It sure seems like they have many similar goals so it makes sense that ZeroNet could leverage IPFS

</comment></comment></comment><comment><USER42> This is what I've waited for for quite some time.

<comment><USER56> Freenet has done this for over a decade.

</comment></comment><comment><USER57> This project is cool, but I'm more interested in future releases by the Askasha project.

</comment><comment><USER58> A little known fact: the Namecoin blockchain's cost-adjusted hashrate [1] is the third highest in the world, after Bitcoin and Ethereum, making it unusually secure given its relative obscurity (e.g. its market capitalisation is only $10 million).

[1] hashrates can't be compared directly due to different hashing algorithms having different costs for producing a hash.

<comment><USER59> Namecoin has a number of innovations. It's the first 'alt-coin' fork from Bitcoin, and it pioneered the technique of "merge mining" where a miner could do Proof of Work on both the Bitcoin chain and the NameCoin chain simultaneously. A lot of mining pools implemented merged mining. Even though the alt-coin space has become much more crowded and noisy, NameCoin retains that early hashing advantage. It's a very secure chain.

<comment><USER60> > It's a very secure chain.

But this guy said that a single miner has 65% of the hashing power: [https://news.ycombinator.com/item?id=14043038](https://news.ycombinator.com/item?id=14043038)

<comment><USER58> IIRC, that's one mining pool, not one miner. The power of mining pools is relatively limited. If the workers see that the pool is attacking Namecoin and devaluing their NMC (not to mention ruining a cool project), they're liable to switch to a different pool.

</comment></comment></comment></comment><comment><USER61> Anybody read this as Netzero the free internet dial up in the 90s?

</comment><comment><USER32> The zeronet.io is hosted on vultr.com. Why don't they use zeronet to deliver its own website?

<comment><USER62> Like bittorrent, zeronet requires a client. The client acts as local server and displays the pages in your browser

<comment><USER32> That explains it, thank you.

</comment></comment></comment><comment><USER63> No comment about ZeroNet itself, but am I alone in the opinion that this website takes grid layout too far? It looks outright cluttered and overloaded.

<comment><USER64> Looks great on mobile however

<comment><USER23> Yeah, the advantage. Tables on steroids.

<comment><USER65> I love the design. Looks great on mobile. Not sure about desktop. Loads really fast too.</comment></comment></comment></comment>


Specification for the D Programming Language - <AUTHOR> https://dlang.org/spec/spec.html <comment><USER2> I started reading about D couple of months ago after work. For me, it appeared to be easier than Scala for example which I use at work. Not only is it simpler, it is faster and I am not even talking about compile times. These features alone persuaded me to rewrite couple of Scala based data processing algorithms we use for our ML models to give it a try. What I really liked is that you don't have to know all about the language to write perfomant code. Still keep wondering how does it get constantly overlooked.

<comment><USER3> This seems to be an increasingly growing niche where D is gaining popularity. I see more and more people turning to D where they would normally use python or R for adhoc data crunching

<comment><USER4> I also use D for data & ML at work (Netflix) when standard python workflow doesn't cut it anymore. There's just so far you can go with the typical "call a popular python lib interfacing with a C++ backend" paradigm before hitting a brick wall.

<comment><USER5> How far is that? What about Cython?

</comment></comment></comment></comment><comment><USER6> The big issue with D, in terms of no-overhead is that is has garbage collection by default, and if I understand correctly, the garbage collector is not as advanced as Java's or Go's.

While you can use D without the garbage collector, you will lose access to a lot of the standard library, which limits the practicality of running without garbage collection.

<comment><USER7> While the opinion-pendulum is currently on the contra-GC side, I still believe GC is the correct default. Mostly because GC is easier than manual memory management.

If you have real-time needs, then GC is probably out. That includes handling audio and video playback.

Tight memory constraints are another killer argument against GC but that only applies to small embedded devices. Smartphones, desktops, and servers have enough RAM.

The great thing about D is that you can start the easy way with a GC. When real-time or memory become constraints at some point you can selectively adapt parts of your program.

You could say, D wants to provide Python and Rust and everything in between so that you can shift seamlessly to wherever your specific sweet spot is. Different parts of your program can even use different spots. In a game engine, you could have the audio and rendering parts as non-GC real-time code, while the game logic is easy high-level script-like.

We are very used to a scripting language plus compiled language combo these days but is the separation a good one?

<comment><USER8> Just yesterday I posted a link about real time audio processing done in Java.

Anti-GC hate seems to always come from religious objection or having had back luck not understanding how to actually use the tools at their disposal.

<comment><USER9> Most of anti-GC hate seems to be coming from C++ and Rust programmers. Also game developers seem to hate GC with passion, then they go back to writing their games with Javascript and C#.

<comment><USER8> It comes from long time.

One thing that having been an Oberon user teached me, was that having a GC wasn't a show stopper for systems programming.

Ironically C++ has has GC support for more than 20 years now.

Managed C++ and C++/CLI on .NET, C++/CX on UWP, Unreal C++, and the GC API introduced in C++11.

So it seems to be one of those things that you only learn to enjoy after experiencing it personally.

</comment></comment></comment></comment></comment><comment><USER10> I wish I had known about D 10 years ago. It's everything I ever wanted out of an LLVM language, but I feel like it's dying and the package ecosystem is tiny, which is crazy with how old it is. What they need is some new web design and docs and exciting stuff to make it feel like a new language so people recognize how truly awesome it is :/

<comment><USER11> Plus affine types have gone mainstream. Good stuff, but I'd like memory safety!

<comment><USER12> An ownership/borrowing system memory safety is in the works for D. There's a prototype of it as a Pull Request:

[https://github.com/dlang/dmd/pull/10586](https://github.com/dlang/dmd/pull/10586)

<comment><USER13> What is the type of apps that one should use D for ? I think this is one of the main issues with languages that did not gain traction and that is they are too generic and try to be too many things to too many people.

If i exclude the financial backing i think languages that tried to tackle one specific thing did rather well. Rust came to be to address the issue with security and there is not really an alternative. Yes people use it for cli tools or backend services but that's just because they are riding the hype train.

The same with Go.

On the other hand we have things like Dart which did not really try to solve an issue people felt they have. The same with Crystal. Nobody really needed faster Ruby that much and if they did they already needed a production ready solution which was just too hard to deliver.

A language like Nim reminds me of D. Its author is also a brilliant Phd CS person but I feel like he does not really have a problem to solve. It's all just an intellectual challenge. Companies like Status.im ( backer of Nim ) have a problem that they are trying to solve by using Nim. Making the right and the perfect solutions is hard but this evolutionary approach is really harming the expansion of the ecosystem. Nim has just too many features and too many approaches to memory management (recent gc:arc release). But it is all too half baked and does not support the features Nim advertises that it has.

This is basically the same issue i have with D. I have no idea what I would use D for. And could i rely on D in the domain i pick it for ? Eg the same field where Go excels.

<comment><USER11> > Rust came to be to address the issue with security and there is not really > an alternative. Yes people use it for cli tools or backend services but > that's just because they are riding the hype train.

I like Rust for CLI tools because it takes some nice ML features and it handles strings sensibly.

<comment><USER14> Last time I tried to install a Rust-based cli network tool it took literally 4 min to compile it! Seriously, 4 minutes for something that monitors your network load. If this is what it takes to make a cli tool, I'd rather do it in plain BASH :)

</comment></comment></comment></comment></comment></comment><comment><USER15> It's cool to see D on hacker news but isn't more interesting content related to D that could have been linked instead? The table of contents to the spec is pretty bland.

</comment><comment><USER16> My only experience with D is getting the free onedrive client to run on linux[1]. What's more frustrating than the small ecosystem is the fact that the reference compiler, DMD, is limited to x86/x86_64 and you need a working D compiler to compile the primary alternative, LDC2 which can't bootstrap itself.

In order to get something like that to compile for aarch64, you have to build a recent GCC with the very old dmd frontend enabled, and then you can compile LDC2. This all to use one app!

[1] [https://github.com/abraunegg/onedrive/](https://github.com/abraunegg/onedrive/)

<comment> ben-schaaf Why would you have to bootstrap the compiler to simply install an app?

<comment><USER16> Because nobody had a binary of the app for my architecture?

</comment></comment></comment><comment><USER17> Does D have something like Rust's #[derive(Debug)] or #[derive(Hash)]?

<comment><USER3> Standard library doesn't provide similar functionality but it's trivial to implement a mixin template that would implement print or hash function for any type

That being said standard formatting function can automatically print most types including user types. This eliminates necessity for automatic formatting implementation in majority of situations

</comment></comment><comment><AUTHOR> You can help D's ecosystem by contributing a CTFE that frees memory as it executes, and by implementing struct postblits.

<comment><USER18> > and by implementing struct postblits

Eh?

</comment></comment><comment><USER19> There's no weekend warriors on the D. You're either on it... or you haven't tried it.

</comment><comment><USER20> Is there a reason for posting this link? Like the specs has just been published or something?

I wish people gave some context of why they post links without context and why I should be interested in the link.

</comment><comment><USER21> Has anyone had luck building a D program with static cURL? The D distributions ive seen only supply a DLL, and I have messed with some compiler flags but it always wants to search for a DLL.

</comment><comment><USER22> (2001)?

<comment><USER23> If it's an article that hasn't been updated since 2001 sure. But this has been updated fairly recently, in this year.

<comment><USER24> What are the biggest recent changes?

<comment><USER12> Plenty of action going on:

[https://dlang.org/changelog/2.090.0.html](https://dlang.org/changelog/2.090.0.html)

<comment><USER7> DIP1021 is one step toward a larger goal outlined in the blog post 'Ownership and Borrowing in D'. What are the next steps?

[https://github.com/dlang/DIPs/blob/master/DIPs/accepted/DIP1...](https://github.com/dlang/DIPs/blob/master/DIPs/accepted/DIP1021.md)

<comment><USER12> A prototype for the O/B system:

[https://github.com/dlang/dmd/pull/10586](https://github.com/dlang/dmd/pull/10586)

<comment><USER23> This is really fascinating, are there some benefits you foresee of this addition to D? I know the O/B system has been popularized by Rust, but have not really thought about it outside of Rust, is this an efforts towards -betterC or will it be used towards those efforts?

<comment><USER12> An O/B system is a way to:

1\. eliminate double frees 2\. eliminate use-after-free 3\. eliminate memory leaks 4\. using undefined pointers

when using explicit memory management like malloc/free. Any D application, including DasBetterC, that uses explicit memory management can benefit from it.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER25> D is by far my favourite niche language, due to its clean syntax and ease of use. I am surprised it's not gaining traction.

<comment><USER26> D is not different enough from C++.

It's like C# to Java, which has traction only through relentless flogging by Microsoft. There's nobody to flog D.

<comment><USER27> D today is C++2040.

<comment><USER28> Nah, because C++40 will just accumulate more and more unpredictable cruft while D is clean.

<comment><USER7> D is not clean. It already has some cruft. For example, there should be no "@safe" annotation but an "@unsafe" one. Unfortunately, D picked the wrong default back then.

Ok, "in relation to C++" it is clean. :)

Edit: There is a proposal to fix it: [https://github.com/dlang/DIPs/blob/master/DIPs/DIP1028.md](https://github.com/dlang/DIPs/blob/master/DIPs/DIP1028.md)

<comment><USER29> Pardon the pun, but @safe is a safe choice. IMHO, for general language it is more productive by having low hanging fruits as the default. The popularity follows consumer->enterprise->military->aerospace, and safety gets more critical up the systems food chain. That's propably the main reason Ada is not a common or popular programming language since it is for higher end of the food chain.

<comment><USER30> This makes more sense as an argument for dynamic typing or GC by default than a "safe" keyword, imo.

From my experience with Rust, there's basically _never_ any cost in sticking to safe code. The standard library and crates pretty much always give you enough tools.

Unsafe is really only ever needed if you're implementing the core of an abstraction, which is probably not something that's going to deter "casual" users imo.

The borrow checker and and type system definitely can be thorny at times, though. Other times they're very easy to work with! But having a more ergonomic way to fall back to Java-like behavior, if only for debug builds, would make languages like Rust _much_ more accessible.

<comment><USER12> D's nascent ownership/borrowing checker will operate at the function level. So you can incrementally use it as it suits your application.</comment></comment></comment></comment></comment></comment></comment></comment>