Ask HN: Who needs contributors? (October 2016) - <AUTHOR> Looking for contributors to your project? Feel free to post any project that may interest HN readers, with a strong preference towards open source. Please follow this general format:
Project name
Project description
What do you hope to build this month?
What kind of skills do you need?
Link to your GitHub or somewhere else you'd like to onboard new contributors, like your project management software or chat room.
Your license(s)
Consider tagging your project's relevant issues with "ask hn". To search these issues, go to https://github.com/search?utf8=%E2%9C%93&q=state%3Aopen+label%3A%22ask+hn%22&type=Issues&ref=searchresults
You can also support DigitalOcean's Hacktoberfest by adding the label "hacktoberfest". To search these issues, go to https://github.com/search?utf8=%E2%9C%93&q=state%3Aopen+label%3Ahacktoberfest&type=Issues&ref=searchresults <comment><USER5> HospitalRun ([http://hospitalrun.io/](http://hospitalrun.io/))

HospitalRun is an offline first, Ember based, Hospital Information System for charitable hospitals in developing countries.

> What do you hope to build this month? We are focused on ongoing work toward > reaching the 1.0. For a list of outstanding issues, see this GitHub > milestone on the frontend app: [https://github.com/hospitalrun/hospitalrun- > frontend/mileston...](https://github.com/hospitalrun/hospitalrun- > frontend/milestones)

We're in need of folks with the following skills: Ember JS experience for general app development; internationalization and localization; New Relic instrumentation experience; automating deployments from GitHub; HL7 experience; product and UI design for lots of CSS and UI cleanup ([https://github.com/hospitalRun/design);](https://github.com/hospitalRun/design\);) design systems experience for working on a styleguide and pattern library; docs writing for app documentation; web and marketing design for the hospitalrun.io site ([http://github.com/hospitalRun/hospitalrun.github.io](http://github.com/hospitalRun/hospitalrun.github.io))

To contribute, check out our CONTRIBUTING.md file on GitHub ([https://github.com/hospitalrun/hospitalrun- frontend/blob/mas...](https://github.com/hospitalrun/hospitalrun- frontend/blob/master/.github/CONTRIBUTING.md)) and join our Slack team.

HospitalRun is open source under the GNU general public license.

<comment><USER6> HospitalRun loads really fast; I'm impressed.

<comment><USER5> Thanks! The demo has a relatively small data set, but keeping it fast as production data grows is one of the challenges we're working on right now.

<comment><USER7> Are you using FastBoot?

<comment><AUTHOR> Also curious about this.

</comment></comment></comment></comment></comment><comment><USER8> Borg backup ([https://borgbackup.readthedocs.io/](https://borgbackup.readthedocs.io/))

Borg is a cross-platform (linux - osx - bsd) backup tool with deduplication, encryption and compression. It's written in Python (>95 %) with some Cython and C for low-level bit bashing.

> What do you hope to build this month?

We're working towards the release of 1.1.0 which may occur at the end of this month or the next. It includes a lot of features and general improvements already, but there's always something to do!

> What kind of skills do you need?

We can always use more testers and people writing better documentation. Code contributions are always welcome as well - test improvements, bug fixes, new features and so on.

There has been initial work on a native Windows version to the point that the basic features work, but it would really benefit from an active Windows developer. Windows issues: [https://github.com/borgbackup/borg/issues?q=is%3Aopen+is%3Ai...](https://github.com/borgbackup/borg/issues?q=is%3Aopen+is%3Aissue+label%3A%22os%3A+windows%22)

License: 3-clause BSD.

Contribution guidelines: [https://borgbackup.readthedocs.io/en/latest/development.html](https://borgbackup.readthedocs.io/en/latest/development.html)

We also participate in Bountysource.

</comment><comment><USER9> Open Synthesis ([https://www.opensynthesis.org](https://www.opensynthesis.org))

Open Synthesis is an open platform for CIA-style analysis of current events. Our mission is to help the public synthesize the flood of information from the media into actionable conclusions. Examples from [https://www.opensynthesis.org/boards/](https://www.opensynthesis.org/boards/):

\- What is the relationship between WikiLeaks and Russian intelligence?

\- What caused the Space X Falcon 9 explosion?

Now that we have a basic MVP, here's what we want to accomplish this month:

\- Improve new user onboarding; reduce the learning curve of the main analysis interface

\- Design and implement a moderation system; enable public sign-ups on the site

\- Engage an initial set of journalists/analysts to get their feedback on requirements

\- Surface information about evidence quality

\- Create basic branding materials (e.g., logo)

In addition to these immediate goals, we're looking for designers to help with UI/UX design of the site, especially figuring out how to adapt the analysis tool for mobile.

Skills we need: design, UX, UI, internationalization, community design, community development, moderation, test engineering, Django, Python 3

License: GPLv3

Sandbox deployment (with no account/editing restrictions): [https://open- synthesis-sandbox.herokuapp.com](https://open-synthesis-sandbox.herokuapp.com)

Help Wanted issues: [https://github.com/twschiller/open- synthesis/labels/help%20w...](https://github.com/twschiller/open- synthesis/labels/help%20wanted)

HN-selected issues: [https://github.com/twschiller/open- synthesis/labels/ask%20hn](https://github.com/twschiller/open- synthesis/labels/ask%20hn)

Project Chat (Gitter): [https://gitter.im/open- synthesis/Lobby](https://gitter.im/open-synthesis/Lobby)

<comment><USER10> Should people know what "CIA-style analysis" means? Your short description should explain what this means, or link to an explanation -- otherwise it tells people nothing.

<comment><USER9> Thanks for the feedback, I was trying to keep the post short. There's a description of the technique in the GitHub readme and on the front-page of the site.

For reference, the site currently supports the Analysis of Competing Hypotheses (ACH) technique [1]. ACH is a structured way of determining which explanation/hypothesis is most consistent with the available evidence.

[1] [https://en.wikipedia.org/wiki/Analysis_of_competing_hypothes...](https://en.wikipedia.org/wiki/Analysis_of_competing_hypotheses)

<comment><USER11> Are there plans for any other structured analysis methodologies? Like some from this book: [https://www.amazon.com/Structured-Analytic-Techniques- Intell...](https://www.amazon.com/Structured-Analytic-Techniques-Intelligence- Analysis/dp/1452241511)

<comment><USER9> Yep, that's the plan! Any methodologies in particular you suggest? ACH seemed like a good choice to start out with because it's relatively simple and well- known

It will be interesting to see which techniques from intelligence analysis and business best lend themselves to collaborative analysis on the internet.

<comment><USER11> Well, techniques like starbursting, [cross-]impact matrix and quadrant crunching can become much easier with a proper software interface.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> National Voter File

We're building the first open source, publicly available national voter database in the United States to power grassroots campaigns, monitor voter suppression, and make door-to-door advocacy possible for anyone.

Monthly Goals:

\- Create loaders for new states

\- Enhance reliability of existing loaders

\- Create Python geocoder to tag households with lat/long

\- Develop queries to explore data quality

\- Begin work on flash API

Skills needed: PostgreSQL, GIS, Python, Pentaho Data Integration (we can help you learn)

Slack Signup: [http://goo.gl/forms/8SJRDlo7Lx2rUsan1](http://goo.gl/forms/8SJRDlo7Lx2rUsan1)

GitHub: [https://github.com/getmovement/national-voter- file](https://github.com/getmovement/national-voter-file)

Dimensional Data Model: [https://docs.google.com/document/d/169mIkiIdl4OetbGvnbVCzq9S...](https://docs.google.com/document/d/169mIkiIdl4OetbGvnbVCzq9Srw9PKCsB6U1CErTD9aI/edit?usp=sharing)

Information on state voter files to load: [http://voterlist.electproject.org/home](http://voterlist.electproject.org/home)

Pentaho Data Integration: [http://community.pentaho.com/projects/data- integration/](http://community.pentaho.com/projects/data-integration/)

License: MIT

</comment><comment><USER12> DuckDuckHack (the dev community for DuckDuckGo)

Building Instant Answers for programming languages to make DuckDuckGo the best search engine for developers.

We're just kicking off some new target languages (C, C++, HTML, Java, PHP, R, Ruby) so we hope to make new Instant Answers that can show documentation snippets, lookup libraries and packages, display cheat sheets or interactive tools.

The actual languages we use for programming are primarily Perl and JavaScript. There are many existing Instant Answers to copy/learn from.

Starting point: [https://forum.duckduckhack.com/t/duckduckhack-programming- mi...](https://forum.duckduckhack.com/t/duckduckhack-programming-mission- overview/53)

Apache License v2.0

<comment><USER13> FWIW, you can also write the documentation parsers (Fathead type Instant Answers) in Python, and Ruby

For example, here is a parser for the Python docs, written in Python: [https://github.com/duckduckgo/zeroclickinfo- fathead/blob/mas...](https://github.com/duckduckgo/zeroclickinfo- fathead/blob/master/lib/fathead/python/parse.py)

and the same for Ruby: [https://github.com/duckduckgo/zeroclickinfo- fathead/blob/mas...](https://github.com/duckduckgo/zeroclickinfo- fathead/blob/master/lib/fathead/ruby/parse.rb)

</comment></comment><comment><USER11> Project name: radare2 - [http://rada.re](http://rada.re)

Project description - Radare is a portable reversing framework that can:

      -  Disassemble (and assemble for) many different architectures
      -  Debug with local native and remote debuggers (gdb, rap, webui, r2pipe, winedbg, windbg)
      -  Run on Linux, *BSD, Windows, OSX, Android, iOS, Solaris and Haiku
      -  Perform forensics on filesystems and data carving
      -  Be scripted in Python, Javascript, Go and more

What do you hope to build this month?

       - https://github.com/radare/radare2/milestone/4 (for main project)

       - https://github.com/radare/radare2-webui/issues (for WebUI)

What kind of skills do you need?

       - C and basic understanding of reverse engineering (for main project)

       - HTML/CSS/JS (for WebUI project)

Radare2 is mostly LGPLv3 project (with portions of BSD, MIT, etc). GitHub group is [https://github.com/radare](https://github.com/radare) and [https://github.com/radare/radare2](https://github.com/radare/radare2) in particular

We have IRC channel #radare on Freenode and #radare Telegram channel ( [https://telegram.me/joinchat/ACR- FgWyg1bbu9YUzT_5pg](https://telegram.me/joinchat/ACR-FgWyg1bbu9YUzT_5pg) ). Both are connected with each other via the bridge.

Everyone can start from the issues marked as 'easy': [https://github.com/radare/radare2/issues?q=is%3Aissue+is%3Ao...](https://github.com/radare/radare2/issues?q=is%3Aissue+is%3Aopen+label%3Aeasy)

See also our CONTRIBUTING page [https://github.com/radare/radare2/blob/master/CONTRIBUTING.m...](https://github.com/radare/radare2/blob/master/CONTRIBUTING.md)

</comment><comment><USER14> Etcher.io | node.js & frontend javascript engineers

Etcher [1][2] is an open-source project by resin.io, the only cross-platform, open-source flash drive writer. Etcher is developed with Electron, node.js, and Angular.js. We're growing Etcher to solve more IoT device problems and looking to bring on board experienced javascript engineers who love to create incredible user experiences and solve hard, cross-platform problems for hundreds of thousands of users, all while working in the open.

[1]: [https://etcher.io](https://etcher.io), [2]: [https://github.com/resin- io/etcher](https://github.com/resin-io/etcher)

<comment><USER15> I think you might have posted to the wrong thread - is this a job listing?

<comment><USER14> We're open to people who want to just contribute to the project (it's being run in the open) or people who want to do it as a full-time occupation.

</comment></comment></comment><comment><USER16> Project name: rclone - [http://rclone.org](http://rclone.org)

Project description: rsync for cloud storage

rclone aims to be an easy to use command line tool for transferring files to and from cloud storage systems. It currently support S3, Google Drive, Amazon Drive, Backblaze B2, Dropbox, Swift amongst others!

What do you hope to build this month?

Another month - another release - see the v1.34 milestone! I'd really like some help fixing some of the small bugs and features. The project is popular enough that it is using up all my hacking time and I'm not quite keeping up!

What kind of skills do you need?

      * Go (golang) is useful since rclone is written in it, though if you know C/C++ you'll pick up Go in no time at all.

      * An interest in cloud storage systems in general (or one in the list of supported systems) would be good.

Check out the github: [https://github.com/ncw/rclone/](https://github.com/ncw/rclone/) \- look at [https://github.com/ncw/rclone/blob/master/CONTRIBUTING.md](https://github.com/ncw/rclone/blob/master/CONTRIBUTING.md) and pick an issue that interests you. Feel free to email me if you want more info ( email@example.com ), or write on an issue if you are interested.

rclone is MIT licensed.

Any help most appreciated no matter how small!

Thanks

Nick

</comment><comment><USER17> OpenFarm

Learn how you can grow anything, anywhere!

We're hoping to squash some more bugs and issues this month - making our user experience even better.

Additionally, we'd love to hear how you grow some of your crops.

Angular, Ruby on Rails, Design

[https://github.com/openfarmcc/OpenFarm/issues?q=is%3Aissue+i...](https://github.com/openfarmcc/OpenFarm/issues?q=is%3Aissue+is%3Aopen+label%3Ahacktoberfest)

</comment><comment><AUTHOR> Code Corps ([https://www.codecorps.org](https://www.codecorps.org))

We're helping volunteers and donors contribute to software projects for social good.

Monthly Goals:

\- Refactoring work on both Elixir and Ember apps

\- Build out Stripe integration so projects can start raising monthly contributions

\- Redesign task UI

\- Rework CSS to use flexbox and be more responsive

\- Minor features in blog

Skills needed: Elixir, Phoenix, PostgreSQL, JavaScript, Ember.js, HTML, CSS, Sass, flexbox, UI and graphic design (Sketch a plus), dev ops (Docker, AWS)

Slack: [http://slack.codecorps.org/](http://slack.codecorps.org/)

Elixir Phoenix API: [https://github.com/code-corps/code-corps- api](https://github.com/code-corps/code-corps-api)

Ember front-end: [https://github.com/code-corps/code-corps- ember](https://github.com/code-corps/code-corps-ember)

WordPress blog: [https://github.com/code-corps/blog.codecorps.org- site](https://github.com/code-corps/blog.codecorps.org-site)

License: MIT

</comment><comment><USER18> JSData ([http://js-data.io](http://js-data.io))

JSData is an open-source JavaScript ORM for Node.js and the browser. It's adapter-based, with adapters currently available for HTTP, Firebase, localStorage, MySql/Postgres/SQLite, RethinkDB, MongoDB, Google Cloud DataStore, Microsoft Azure DocumentDB, and more.

Currently working on finishing up a 3.0.0 release (currently at 3.0.0-rc.5). With so many adapters and integrations that need to be written (and current ones that need maintenance), there are lots of contributing opportunities.

We need help with everything from documentation, tests, and benchmarking, to taking ownership of a current adapter and building new adapters/integrations.

MIT license

Get started contributing at: [http://www.js- data.io/v3.0/docs/contributing](http://www.js-data.io/v3.0/docs/contributing)

We're also on Slack: [http://slack.js-data.io](http://slack.js-data.io)

Thanks!

</comment><comment><USER19> Jazz

A fast Code Editor for the web, similar to CodeMirror, Ace, Monaco.

Goal is to be as close to Sublime Text as possible in terms of features and performance. Most major work is done, like the text buffer which outperforms anything else, can handle big files and edits with very high performance. I'd like to improve speed further, specifically view optimizations, add more syntax highlighters, reduce technical debt, extract libraries onto their own repositories with more tests, add integration tests (only unit atm), inline documentation and more. There is a small guide to get started development.

Looking for someone passionate with frontend JavaScript development that knows their way around browser bottlenecks so we can work together and move this forward.

[https://github.com/stagas/jazz](https://github.com/stagas/jazz)

MIT License.

<comment><USER20> Project looks pretty interesting.

You may want to consider converting your "Issues" file into actual GitHub issues and creating a board to track them. That way people can comment on issues and things like that whereas tracking an "Issues" file is a bit more difficult.

Also you could use Markdown or AsciiDoc for the README. It doesn't look pretty right now.

<comment><USER19> Being a lone wolf on this, I wanted to keep everything as tight and close by as possible to reduce friction and work faster, but you are absolutely right, it definitely needs polishing up and proper issue tracking. Part of the reason why I posted now is that I'm willing to prioritize this and make the effort if I see people interested in collaborating.

</comment></comment></comment><comment><USER21> Dronekit ([http://dronekit.io/](http://dronekit.io/))

We work on developer tools and apis for drone development.

Currently looking for contributors on all fields, Documentation, Python, Android, Swift, C++, Rust, and Community Management.

We are looking for iOS devs to help us create an ios-dronekit library.

You can find us on some of Gitter channels from our most notable projects. (gitter links on readme)

[https://github.com/dronekit/dronekit- python](https://github.com/dronekit/dronekit-python) [https://github.com/dronekit/dronekit- android](https://github.com/dronekit/dronekit-android)

License: mostly Apache, we <3 open source, have an opinion on license, let us know!

Thanks \- mrpollo

<comment><USER22> This sounds fun. Just clicking through the repos, DroneKit is essentially a wrapper for talking to ArduPilot via MAVLink on different platforms?

<comment><USER21> Yes, our major libraries provide a basic API to talk MAVLink back to your Flight Controller, keep basic things like Vehicle state, events, mavlink message builder.

</comment></comment></comment><comment><USER23> OpenDroneMap

A tool to postprocess drone, balloon, kite, and street view data to geographic data including orthophotos, point clouds, & textured mesh. We're hoping to expand the web interface for the application, which currently is only usable via CLI. [https://github.com/OpenDroneMap/WebODM](https://github.com/OpenDroneMap/WebODM)

Python, Django, Javascript, CSS, HTML, C++ (one or more of these). All skill levels welcome.

gitter.im/OpenDroneMap/OpenDroneMap [https://github.com/OpenDroneMap/OpenDroneMap](https://github.com/OpenDroneMap/OpenDroneMap)

GPL, MPL

</comment><comment><USER24> OpenPicker([http://gauravtiwari5050.github.io/OpenPicker/](http://gauravtiwari5050.github.io/OpenPicker/))

OpenPicker is an open source and self hosted file picker for websites.

I would like to ship Facebook image upload integration to OpenPicker this month.

To hack on this, basic experience with NodeJs/Express, CoffeeScript and Angular1.0 should be enough.

Github link: [https://github.com/gauravtiwari5050/OpenPicker](https://github.com/gauravtiwari5050/OpenPicker)

MIT License

</comment><comment><USER25> SaferCPlusPlus

Description:

SaferCPlusPlus is essentially a memory safe dialect of C++. Specifically, it is a library that provides, among other things, safe compatible substitutes for C++'s existing "unsafe" elements (i.e. native pointers and (unchecked) standard library elements). I believe it is currently the highest performing solution for making existing C/C++ code memory safe without requiring any redesigning or re-architecting of the existing code.

A motivating goal is to provide a practical solution for the reduction or elimination of "remote execution" vulnerabilities from much of the internet software infrastructure (web browsers, web servers, crypto libraries, etc.)

Q: What do you hope to build this month?

A1: Convert relevant benchmarks to SaferCPlusPlus to better quantify its performance cost.

A2: If someone's really ambitious, start work on automated conversion from C++ to SaferCPlusPlus.

Q: What kind of skills do you need?

A: C++

Link to GitHub: [https://github.com/duneroadrunner/SaferCPlusPlus](https://github.com/duneroadrunner/SaferCPlusPlus)

License(s): Boost

</comment><comment><USER26> * Name - <USER2>

* Description - Self-hosted application/module distribution and package management for all languages and operating systems

* This month - I would like to reach initial completion status thereby moving from alpha to beta releases

* Skills - JavaScript, Node, Shell Scripting, Windows, nix

* Link - [https://github.com/prettydiff/biddle](https://github.com/prettydiff/biddle)

* License - <USER4>

</comment><comment><USER27> Feel free to reach out to me directly if you're interested in participating in any of these projects, I'll help you get started. Note that I don't always have things getting done "this month" \- tell us you're interested and we'll find something for you to work on.

\- - -

Sway ([https://github.com/SirCmpwn/sway](https://github.com/SirCmpwn/sway)) - An i3-compatible Wayland compositor (MIT license)

This month: we're shipping Sway 0.10, but still accepting bug fixes and new features from our roadmap or your imagination: [http://swaywm.org/roadmap](http://swaywm.org/roadmap)

Roles for: C programming, docs writing, testing, user support

Visit us on IRC: #sway on irc.freenode.net (webchat: [https://goo.gl/nOg1X4](https://goo.gl/nOg1X4)) Feel free to stop by and get some direction for how you can help out!

\- - -

aerc ([https://github.com/SirCmpwn/aerc](https://github.com/SirCmpwn/aerc)) - An async command line email client (MIT license)

This month: someone's working on key bindings

Roles for: C programming

Ping me on the IRC network of your choice (SirCmpwn) and I'll help you get started, there's no IRC channel yet

\- - -

KnightOS ([http://knightos.org](http://knightos.org)) - An operating system for calculators (MIT license, mostly)

TODO: Too much for a HN comment, tell me what you're interested in and I'll hook you up with the right project

Roles for: Programming in C, assembly, JavaScript, Python, docs writing, marketing

Chat: #knightos on irc.freenode.net [http://www.knightos.org/irc/](http://www.knightos.org/irc/)

\- - -

TrueCraft ([https://truecraft.io](https://truecraft.io)) - An open source implementation of Minecraft beta 1.7.3 (MIT license)

This month: things are quiet, ping me and I'll set you up to contribute

Roles for: Programming in C#, Python, JavaScript, docs writing, marketing

Chat: #truecraft on irc.esper.net (webchat: [https://goo.gl/G8evBV](https://goo.gl/G8evBV))

</comment><comment><USER28> Ember CLI Mirage ([http://www.ember-cli-mirage.com/](http://www.ember-cli- mirage.com/)) A client-side mock server to develop, test and prototype your Ember app

Monthly Goals:

\- Robust relationship support (many-to-many, one-to-one, polymorphic, reflexive) \- GH project organization. Now that projects have landed, we need to move non-actionable issues into notes on an "Ideas" project, and clean up the issues backlog.

Skills needed: JavaScript, Ember.js

Slack: [https://embercommunity.slack.com/](https://embercommunity.slack.com/) channel #ec-mirage Website: [http://www.ember-cli- mirage.com/](http://www.ember-cli-mirage.com/) Source: [https://github.com/samselikoff/ember-cli- mirage](https://github.com/samselikoff/ember-cli-mirage)

License: MIT

</comment><comment><USER29> Tomatoes ([http://tomato.es](http://tomato.es))

Pomodoro technique® time tracker.

We'd like to build a public API, but there's a lot of other tasks that could be done.

Ruby, Ruby on Rails, CSS, JavaScript.

[http://github.com/potomak/tomatoes](http://github.com/potomak/tomatoes)

License: MIT

</comment><comment><USER30> Operation Code ([http://operationcode.org](http://operationcode.org))

Operation Code is an open source project that helps military, guard & reserve troops, veterans and their families get coding and building software to change the world.

We're overhauling the signup flow to make it easier for software mentors, new signups and contributors to get started.

HTML/CSS, JavaScript, Ruby on Rails

[https://github.com/operationcode/operationcode](https://github.com/operationcode/operationcode)

[https://github.com/OperationCode/operationcode/blob/master/C...](https://github.com/OperationCode/operationcode/blob/master/C..). <USER4>
</comment><comment><USER31> sabre/dav & Baikal

A popular CalDAV/CardDAV/WebDAV implementation in PHP, integrated into pretty much any PHP-based project that requires these features and sometimes even in non-PHP projects that simply don't have a solid extendable implementation.

sabre/dav is the library, baikal is a management application on top of it.

This months goal:

\- Update baikal to use Silex instead of a proprietary framework.

Next months goal:

\- A new design for Baikal

Needed skills:

\- Intermediate PHP developer.

Links:

* [http://github.com/fruux/sabre-dav](http://github.com/fruux/sabre-dav)

* [http://github.com/fruux/Baikal](http://github.com/fruux/Baikal)

* [http://sabre.io](http://sabre.io)

* irc://freenode.net/#sabredav

Licenses:

* BSD 3-Clause (for all the libraries)

* GPLv3 (for the baikal-frontend)

</comment><comment><USER32> The Lounge - <USER4>

An open-source web-based IRC Client (think opensource fork of IRCCloud)

This month: loading messages from logs[1], moving client to React (or another UI framework)[2], and so much more

Skills: CSS, JavaScript, design (need a logo!), React

[https://github.com/thelounge/lounge](https://github.com/thelounge/lounge) \- #thelounge on freenode

[1] [https://github.com/thelounge/lounge/pull/663](https://github.com/thelounge/lounge/pull/663)

[2] [https://github.com/thelounge/lounge/pull/633](https://github.com/thelounge/lounge/pull/633)

</comment><comment><USER33> Redis Cache:

A small project that provides function level caching in Python with Redis (currently only Redis but looking to add more backends).

Work has stagnated in the past few months, but there a few issues and ideas that need to be hashed out (cache invalidation, multiple backends, Django built in support, etc). Basically the project is at POC level and can be taken in many directions.

It's written in Python, and interfaces directly with Redis.

[https://github.com/alexk307/redis_cache](https://github.com/alexk307/redis_cache). I will tag issues.

License: MIT

</comment><comment><USER34> Project name: Tabist

Project description: Simple tab switcher webextension for Firefox and Chrome.

What do you hope to build this month? Some kind of history store to be able to sort the tabs by MRU or age would be a good feature to have. Anything that seems like it would be a win for usability would also be great. There are issues on the github repository as well.

What kind of skills do you need? Javascript/CSS skills.

Github: [https://github.com/fiveNinePlusR/tabist](https://github.com/fiveNinePlusR/tabist)

Your license(s): MIT

<comment><USER35> Fixed link: [https://github.com/fiveNinePlusR/tabist](https://github.com/fiveNinePlusR/tabist)

I like the no-frills approach and the embrace of functional reactive.

<comment><USER34> Thanks for catching that and the kind words.

</comment></comment></comment><comment><USER36> Project name: Nestor QA

Project description: open source test management software

What do you hope to build this month?: an authorization layer, and work on the remaining issues [https://github.com/nestor- qa/nestor/issues](https://github.com/nestor-qa/nestor/issues)

What kind of skills do you need?: PHP developers, or someone interested in testing, QA

Link to your GitHub or somewhere else you'd like to onboard new contributors, like your project management software or chat room.: [https://github.com/nestor-qa/nestor/issues](https://github.com/nestor- qa/nestor/issues)

Your license(s): MIT

\---

Project name: BioUno

Project description: best practices for life sciences software, specially continuous integration

What do you hope to build this month?: work on Jenkins plug-ins

What kind of skills do you need?: Java/Groovy developers, life science researchers with interesting use cases too

Link to your GitHub or somewhere else you'd like to onboard new contributors, like your project management software or chat room.: [https://github.com/biouno](https://github.com/biouno) then search for the plug-ins we have forked, and see what looks interesting :)

Your license(s): MIT

</comment><comment><USER37> Rsync time backup

This script offers Time Machine-style backup using rsync.

[https://github.com/laurent22/rsync-time- backup](https://github.com/laurent22/rsync-time-backup)

> What do you hope to build this month?

There are a few open issues, pull requests and todos. One example is an optimization to delete old backups faster. Another is to detect when a drive is FAT and adjust rsync parameters accordingly.

> What kind of skills do you need?

Good knowledge of Bash and Unix/Linux/Cygwin.

> Your license(s) <USER4>
</comment><comment><USER38> stack - The Haskell Tool Stack: [https://haskellstack.org](https://haskellstack.org)

Stack is a cross-platform program for developing Haskell projects. It is intended for Haskellers both new and experienced.

There are many outstanding issue at [https://github.com/commercialhaskell/stack/issues](https://github.com/commercialhaskell/stack/issues). The following issues are both important and accessible for newcomers to the project: [https://github.com/commercialhaskell/stack/issues?utf8=%E2%9...](https://github.com/commercialhaskell/stack/issues?utf8=%E2%9C%93&q=is%3Aopen%20is%3Aissue%20milestone%3A%22P2%3A%20Should%22%20label%3Anewcomer)

> What kind of skills do you need?

You'll need some Haskell experience, at minimum a basic intuition for monads.

Basic contribution guidelines: [https://github.com/commercialhaskell/stack/blob/master/CONTR...](https://github.com/commercialhaskell/stack/blob/master/CONTRIBUTING.md)

> Your license(s)

3-clause BSD

</comment><comment><USER39> TellForm ([https://tellform.com](https://tellform.com))

TellForm is the first design-focused opensource form/survey builder. We are used by small and large businesses who need self hosting and by developers who want a hackable form builder.

> What do you hope to build this month? We are looking at moving our beta > branch into our master and adding logic jump and an API to the stable > release candidate. We are also looking at redesigning the admin panel.

We're in need of contributors who are good at design as well as developers who are comfortable on the MEAN (Mongoose, ExpressJS, AngularJS, Node) stack. We are still using Angular 1.x do you should be comfortable with that.

To contribute check out our contributing guide here [https://github.com/whitef0x0/tellform/blob/master/README.md](https://github.com/whitef0x0/tellform/blob/master/README.md)

TellForm is an opensource project run under the MIT license

</comment><comment><USER40> Nanoengineer - open-source nanotech CAD - [https://github.com/kanzure/nanoengineer](https://github.com/kanzure/nanoengineer)

pdfparanoia - remove watermarks from papers (PDFs) - [https://github.com/kanzure/pdfparanoia](https://github.com/kanzure/pdfparanoia)

</comment><comment><USER41> ArchieJs ([https://github.com/archiejs/](https://github.com/archiejs/))

Langauge: NodeJS

Brief: A minimal dependency injection framework for nodejs

Details: A nodejs dependency injection framework. Main advantage - (1) forces you to think in decoupled modular logic (also follow TDD practices), (2) better reusability of modules across years

Why does nodejs need dependency injection?

I think, for above 2 points. Writing DI modules allows better injection for unit testing in other languages; same hold true for nodejs - where better defined interfaces help out in unit testing.

It would be great to join hands with any independent contributors or small orgs; people who can evaluate if this approach holds a promise compared to other DI frameworks in nodejs.

Personal note: Its not easy to do it myself, because I don't have any financial plans with the particular project - it was mainly done to show my expertise and learn something new while doing it.

</comment><comment><USER42> Project Name: HRCloud2

Project Description: An open-source, fully featured home Cloud platform & personal assistant. Perform your favorite Bash commands on your files from anywhere, using your own home server! Keep private files private. No snooping, deactivated Cloud accounts, or restrictions. Make user accounts for friends and family. Your Cloud, your rules.

This months goals: I would like to have the media player/playlist player fully functional, as well as have the settings for user color selection at least partially functional.

This project needs: Skilled Jscript and CSS magicians!

Project URL: [https://github.com/zelon88/HRCloud2](https://github.com/zelon88/HRCloud2)

Project Development Video Playlist: [https://www.youtube.com/watch?v=6v--nu- wp1k&list=PLVbKN4o8V_...](https://www.youtube.com/watch?v=6v--nu- wp1k&list=PLVbKN4o8V_4OSXI0SGGBMxRvXTZJT3YM_)

Project License: GPLv3

Thanks a bunch, guys!

</comment><comment><USER43> Appirater

Description: A library for your iOS app that gently reminds your best users to review the app. The project has over 4000 stars on GitHub and is widely used in lots of popular apps, however, I don't have much time to devote to maintenance/improvement.

It's a small library, so it's easy to jump into. The functionality is limited (but very useful), so there's not a lot of need for constant changes to it either.

What to do this month: Fix compiler warnings brought on by the release of Xcode 8.

Skills: Objective-C

GitHub: [https://github.com/arashpayan/appirater/issues/242](https://github.com/arashpayan/appirater/issues/242)

How to help: Send me (Arash) an email (arash -at- ara.sh) and let me know you want to help out. I'm looking for a long term maintainer for the project, so if you can provide a couple good pull requests, I'd be happy to give commit access.

License: MIT/X11

Thanks for your consideration. :-)

</comment><comment><USER44> * Project name: Lynis ([https://github.com/CISOfy/lynis/](https://github.com/CISOfy/lynis/)), GPLv3

* Project description: security auditing tool for Linux, macOS, and UNIX-derivatives. The primary goal is to assist in security assessments and help with system hardening. Written in shell script and project is mature (almost 9 years).

* Upcoming goals: More application specific tests (like MongoDB, Redis, Tomcat, nginx), so we can provide more value as a project.

* Needed skills: application knowledge and able to write some basic shell script.

* Contributors link: [https://github.com/CISOfy/lynis/blob/master/CONTRIBUTIONS.md](https://github.com/CISOfy/lynis/blob/master/CONTRIBUTIONS.md)

* Your license(s): GPLv3

</comment><comment><USER45> Botmetrics ([https://www.getbotmetrics.com](https://www.getbotmetrics.com))

Botmetrics is an open-source, secure, private conversational analytics platform ([https://github.com/botmetrics/botmetrics](https://github.com/botmetrics/botmetrics))

If you build a Slack/FB Messenger/Kik bot and want to measure and grow your bot's audience in a secure, private way, Botmetrics is the answer.

We are a young open-source project but we have some interesting issues to work on: [https://github.com/botmetrics/botmetrics/issues](https://github.com/botmetrics/botmetrics/issues)

We're also on slack: [https://slack.getbotmetrics.com](https://slack.getbotmetrics.com)

</comment><comment><USER46> CMS Airship ([https://github.com/paragonie/airship](https://github.com/paragonie/airship))

CMS Airship is a secure-by-default content management system, blog engine, and application development framework written in PHP 7. We want to move the overton window of PHP applications towards being secure out-of-the-box.

Despite our focus on security, there are a lot of ways to contribute _even if you 're not a security expert_: [https://cspr.ng/blog/2016/09/contribute- airship-non-expert-s...](https://cspr.ng/blog/2016/09/contribute-airship-non- expert-security)

> What do you hope to build this month?

This is what I'll be doing this month:

      - Facilitate data import from WordPress, etc.
      - Create a workflow for deleting user accounts.
      - Make the extension development tools easier to use.

In the slightly-longer term, I'm building an extension that adds e-commerce capabilities, in case anyone wants to migrate from WooCommerce, Magento, or OpenCart.

> What kind of skills do you need?

I'm pretty terrible at UI/design work. If anyone has front-end chops, I'd greatly appreciate any actionable feedback you can offer.

The documentation ([https://github.com/paragonie/airship- docs](https://github.com/paragonie/airship-docs)) isn't complete, and I need to find time to work on that. If anyone can, please help here.

> Links

      IRC: #airship on irc.freenode.net
      Reddit: /r/cmsAirship
      Github:
      - https://github.com/paragonie/airship
      - https://github.com/paragonie/airship-docs

Example website: [https://cspr.ng](https://cspr.ng)

License: GPL 3

</comment><comment><USER47> [https://github.com/thewhitetulip/web-dev-golang-anti- textboo...](https://github.com/thewhitetulip/web-dev-golang-anti- textbook/issues)

This is a simple, example based introductory book for teaching newbies how to write webapps in Go. I have added the tags to the issue.

[http://github.com/thewhitetulip/Tasks/](http://github.com/thewhitetulip/Tasks/)

This is a simplistic todo list manager written in Go. Tags have been added to the issues.

Tasks is MIT licensed and the book is CC licensed

Any and all help is appreciated, feel free to reach me via email any time, I would respond as soon as possible. Email is in my github page.

</comment><comment><USER48> L2L ([http://github.com/meric/l2l](http://github.com/meric/l2l))

A new programming language that is a superset of Lua and Lisp. You can write code in Lua or Lisp syntax and quasiquote/unquote both Lua and Lisp expressions.

The presentation of the project is minimal and off-putting to new contributors. It would be great to change this.

A lot of work needs to be done to make it more attractive to contributors, and to make it easy for people to contribute. It requires more documentation, improved documentation, more comments in existing code. I would love some advice as to where and when that documentation and comments be most useful.

Can you help?

</comment><comment><USER49> Wordo Dictionary ([https://wordo.co/@aminozuur](https://wordo.co/@aminozuur))

Wordo is a minimally designed, and social dictionary. You can follow your friends and see which words they like.

There are some tiny bugs in the regular expressions, which sometimes incorrectly display definitions that are fetched from Wiktionary.

[https://github.com/aminozuur/wordo/](https://github.com/aminozuur/wordo/) (MIT license)

</comment><comment><USER50> SocketStream: [https://github.com/socketstream/socketstream/issues/608](https://github.com/socketstream/socketstream/issues/608)

It's a fantastic real time framework that's been pretty solid over the years. It's advantage is that it borrows from other libraries to get the job done, and is very plug and play (deliberately not in the manner of Meteor.js).

I'd love to see it revived, but it's sort of languished for want of decent documentation and a steady stream of contributions.

</comment><comment><USER51> Nextgen ([https://github.com/hbowden/nextgen](https://github.com/hbowden/nextgen))

A genetic file, syscall and network fuzzer for unix operating systems.

I hope to finish implementing the memory reclamation scheme and do some bug squashing this month.

I need C programmers and anyone who is interested in building fuzzers.

The project is under an ISC license.

</comment><comment><USER52> siimplytech - [https://siimplytech.com](https://siimplytech.com)

a simple tech blog built by tech enthusiasts

hope to build: a better design + more reader base

we need: writers, web developers

we're looking for people who are interested in writing about tech and designing for the web! :)

if you'd like to contribute shoot an email to: email@example.com

</comment><comment><USER53> I have a few semi-active projects that could use some love. I'm struggling with RSI right now and have way more creative energy than I can channel, so I'd also be interested in pair programming on my projects via video or in person (Bay Area).

All of these projects are MIT-licensed, and I'm pretty good about filing GitHub issues for things that need to happen.

Email/Twitter in profile.

\- - -

Usercorn - [https://github.com/lunixbochs/usercorn](https://github.com/lunixbochs/usercorn)

Skills: Go, C, Syscall ABI

Usercorn is a sort of debugging tool, kernel API emulator, and CPU emulator (powered by Unicorn Engine) rolled into one. It's hard to simply explain the vision but it can do things like run a MIPS Linux binary on x86_64 OS X (kinda like a more powerful qemu-user).

Plenty of GitHub issues here, but the main work needed right now:

Fixing up bugs related to glibc, dyld, and other runtimes. x86_64 Linux is the best supported loader right now, so the rest could use some love. There's progress being made on OS X / iOS + dyld startup right now.

Support for issuing signals to the guest CPU (need a signal handler table on a process's kernel structure, a syscall handler for `signal` and `sigaction`, and code that can jump the guest CPU into a signal handler and do a `sigreturn`)

More syscall emulation (~50/350 syscalls are implemented for Linux and OS X), but it's pretty easy to add new ones.

Support for guest threading and fork/clone (these will likely need a virtual process/thread table, then each thread/process can run on a Goroutine and take advantage of Go's existing scheduler).

Virtual filesystem layer, so syscalls like open/read/write don't go directly to the host OS and can be intercepted/overlaid in a more general sense.

\- - -

lib43 - [https://github.com/lunixbochs/lib43](https://github.com/lunixbochs/lib43)

Skills: C, ASM, Syscall ABI

Yet another libc, created as a result of this blog post: [http://ryanhileman.info/posts/lib43](http://ryanhileman.info/posts/lib43) \- mostly just has string, memory, number, and basic IO functions right now.

Ways to contribute: Pick a man page for any missing libc function and implement it in a simple/readable manner, or dive into an architecture syscall ABI (like ARM/NetBSD) and write the assembly backend for it.

[https://github.com/lunixbochs/lib43](https://github.com/lunixbochs/lib43)

\- - -

glshim - [https://github.com/lunixbochs/glshim](https://github.com/lunixbochs/glshim)

Skills: C, OpenGL

This provides desktop OpenGL ~1.5 sans shaders to any mobile device implementing OpenGL ES 1.0. It has been used to port dozens of open and closed-source games to the Pandora and other mobile platforms. It was also used for the Android real-Minecraft launcher (called Boardwalk I think).

Current goals include testing/improving the remote rendering (which allows software like emulators to easily serialize and remotely render OpenGL), increasing compatibility (testing games + filing/fixing issues on GitHub), adding WINE support (will be a trial/error process of running WINE, debugging/fixing the thing that prevents initialization, repeat), and writing more feature tests (which are actually pretty easy. You write a simple program to make OpenGL calls and assert which OpenGL ES calls should be emitted from the other end).

\- - -

patchkit - [https://github.com/lunixbochs/patchkit](https://github.com/lunixbochs/patchkit)

Skills: Python, C, ASM

This project allows you to reproducibly patch compiled binaries with one or more short Python scripts. It includes an assembler (Keystone), disassembler (Capstone), basic linker, basic static recompilation/code transformation engine, control flow graph, and C compiler integrations... all in about 700 lines of Python. It was mostly created for use in attack-defense Capture The Flag competitions.

These are both working patches:

        def patch(pt): pt.patch(0x800400a, asm='mov eax, 1')
        def patch(pt): pt.patch(pt.entry, c='void f() { printf("hi\n"); }')

It mainly needs glue code written for more architectures, support for PE/MachO formats, and improvements to the C compiler/linker. The provided symbols are mostly specific to Darpa's DECREE environment, so support should be added for yanking/calling symbols from the binary itself as well as integrating something like lib43 to provide a basic libc and syscall support on many platforms.

\- - -

ActualVim - [https://github.com/lunixbochs/actualvim](https://github.com/lunixbochs/actualvim)

Skills: Python

This project is a massive hack to sneakily jam a Vim instance into a Sublime Text buffer. This gives you surprisingly good Vim keybinding support, and even works with your Vim plugins, but it totally breaks Sublime Text plugins and commands (as text changes won't be propagated back to Vim). As a result, the project is mostly a joke right now (just a pretty UI around Vim that breaks most interactive Vim plugins).

I do think NeoVim is mature enough to take this the rest of the way into being a serious project, and there's a fair bit of interest. The Sublime Text side of the interface works very well, so the main tasks here would be (1) swapping out Vim for NeoVim (which I seem to remember having a very simple remote control API), and a (2) handler to propagate text changes back from Sublime plugins into the NeoVim buffer.</comment>


No Big Bang? Quantum equation predicts universe has no beginning - <AUTHOR> http://phys.org/news/2015-02-big-quantum-equation-universe.html

<comment><USER2> This is a news article.

For the research itself, see [http://arxiv.org/abs/1404.3093v3](http://arxiv.org/abs/1404.3093v3) (PDF link: [http://arxiv.org/pdf/1404.3093v3.pdf](http://arxiv.org/pdf/1404.3093v3.pdf))</comment>


Pixel art for your Github contribution calendar - <AUTHOR> https://github.com/gelstudios/gitfiti#readme

<comment><USER2> At this point I'll point out my recreation of the GitHub t-shirt: <https://github.com/contrigraph>

And the write-up: <http://kivikakk.ee/2013/05/07/contrigraph.html>

</comment><comment><USER3> Started a couple months ago: <https://github.com/contributions>

</comment><comment><USER4> Genius. Stupid. And Genius.

</comment><comment><USER5> Nice. a video game pixel art take on github profile art. I first saw a proof of concept on Will Leinweber's profile ( <https://github.com/will/> ) The downside is the top place in your 'Contributions' feed gets heavily polluted..

</comment><comment><USER6> Is the left mushroom a 1-up mushroom while the right one a power-up mushroom? I _must_ know! :P

</comment><comment><USER7> This is fantastic, sorry. For newb question but how do you do inject into guy history like this?

<comment><USER8> Haven't done so myself - But you can edit a git commit's information (Such as author and date):

[http://stackoverflow.com/questions/454734/how-can-one- change...](http://stackoverflow.com/questions/454734/how-can-one-change-the- timestamp-of-an-old-commit-in-git)

Edit: Haven't looked at the repo - But I'm assuming this is what's being done.

</comment></comment><comment><USER9> Ok, it has nothing to do with git but this is my personal contribution to pixel art movement: <http://drawbang.com>

</comment><comment><USER10> Brilliant.

Doubly useful seeing as I hardly ever contribute to everything.

</comment><comment><USER11> Purely awesome.

I found that doing this manually was a pain; I knew someone would eventually write a script for it.

</comment><comment><USER12> tl;dr it makes your contributions calendar look like this:

<https://github.com/gelstudios>

great little hack imho

</comment><comment><USER13> Doesn't your other contributions mess with the pattern ?

<comment><USER14> I'd expect the script to account for other past contributions. Shouldn't be too hard?!

edit: Well, except of course that it'd be impossible to change past pixels to have less colour. So you're right.

</comment></comment><comment><USER15> very cute :-)</comment>


"Why was Rust chosen for Libra?" in congressional hearing [video] - <AUTHOR> https://www.c-span.org/video/?c4808083/rust-language-chosen <comment><USER2> Congressman: I was really surprised about the Rust language. So my first question is, why was the Rust language chosen as the implementation language for Libra? Do you believe it's mature enough to handle the security challenges that will affect these large cryptocurrency transactions?

Facebook: [We will own & control the code.]

Congressman: It looks like Libra was built on the nightly build of the Rust programming language. It's interesting because that's not how we did releases at the DoD. What features of Rust are only available in the nightly build that aren't in the official releases of Rust? Does Facebook see it as a concern that they are dependent on unofficially released features of the Rust language? Why the nightly releases? Do you see this as a function of the prototyping phase of this?

Facebook: [No answer]

<comment><USER3> The first question summary is … poor. Congressman's biggest concern after poking around on github seemed to be about international committers and a "native Nigerian" committing a lot of the code. (based on looking around the github-generated contributors pages for the libra and rust repos, I have no idea who he's talking about).

The second answer was: "This is a very technical question. We'll get back to you." Which is to be expected; there's no reason for Mr. Marcus to risk a felony by bullshitting in front of Congress about technical decisions.

<comment><USER4> > I have no idea who he's talking about

This comment buried below: [https://news.ycombinator.com/item?id=20467750](https://news.ycombinator.com/item?id=20467750)

points to this repo "A javascript client for libra": [https://github.com/perfectmak/libra- core](https://github.com/perfectmak/libra-core)

@perfectmak is in Lagos.

</comment></comment></comment><comment><USER5> I don't think I've ever heard of a Congressman going to GitHub, poking around in some open source code, and then asking very cogent and relevant questions about it. This video is incredible if only because of that.

<comment><USER6> Probably an intern on his staff did the research.

<comment><USER7> No it sounds like he was either an engineer or engineering manager somewhere in the DoD.

<comment><USER8> [https://en.wikipedia.org/wiki/Denver_Riggleman](https://en.wikipedia.org/wiki/Denver_Riggleman)

Associate of Science (AS) in Avionics Systems from the Community College of the Air Force in 1996.

Graduate Certificate (GradCert) in Project Managment from Villanova University in 2007.

Air Force for eleven years, serving as an intelligence officer. He then worked as a contractor for the National Security Agency

</comment></comment></comment></comment><comment><USER9> This congressman (or his aides) is surprisingly knowledgeable. I'm impressed with whoever thought to ask about nightly builds.

Edit: for reference, this is the congressman who was accused of writing "Bigfoot erotica" during his campaign.

<comment><USER10> That edit took a real turn.

<comment><USER8> He's a bigfoot nerd. He posted a stupid book on his instagram feed and his opponent tried to make him out like a weirdo. It would be like a candidate posting the cover of star wars fan fiction and their opponent accusing them of being a alien conspiracy theorist.

</comment></comment></comment><comment><USER11> This is a good question to ask, especially about the nightly builds from upstream. There have been NPM exploits targeted at crypto currency developers (e.g. the event-stream breach), so it seems FB would be placing a lot of trust in the Rust developers. This is not to say Rust maintainers are dishonest, but all it takes is one person who's authentication credentials gets comprised.

<comment><USER12> Wouldn't the same apply to practically any programming language and development tools? What if they'd chosen Microsoft Visual C++? Would that be less exploitable?

<comment><USER13> With nightly builds, there's more of a chance that a piece of malware could sneak in and get used to build a release of Libra. I'm sure the Rust maintainers would find it fairly quickly, but even within a few days there would be tons of Libra users with compromised wallets.

More scrutiny goes into stable release builds than nightly builds, and more mature languages and tools have more experienced maintainers who are often (but of course, not always) better at scrutinizing releases. It's not that MSVC++ can't be compromised, but it's pretty unlikely that it would be.

<comment><USER14> I don't think anyone actually runs nightly against what's on the latest / master. I know at work, we use nightly rust, but we pin to a specific date release, usually when the around latest stable is cut.

</comment></comment></comment></comment><comment><USER15> I just tried to build libra on stable rust. At least the first thing that failed is that it's depending on futures 0.3. So it's almost certainly using async/await.

</comment><comment><USER16> [https://github.com/perfectmak/libra- core](https://github.com/perfectmak/libra-core)

It seems the Congressman mistook an unofficial 3rd-party js repo whose author is Nigerian as an official Libra project...

</comment><comment><USER17> I feel like this is blindly upvoted. The video is underwhelming, and doesn't come close to answering the question.

That said, I'm very impressed by the congressman in the video, as it sounds like he knows what he's talking about. Wikipedia doesn't mention much about programming in his bio...

<comment><USER18> The title is misleading although technically correct. They did respond just not with anything more than a "we'll get back to you".

I do like the basics of his questions "who is committing code to Libra" and "why are using nightly build of Rust". I get the feeling he is not happy with it given his mention of "not how we usually did releases in the DOD" and pointing out the non-US coder. It will be interesting to see the technical response and his response to that.

<comment><USER19> Of course Rust is international. Windows is international; Linux is international; VMS might possibly not be international. You'd think DoD would be buying Talos systems as fast as Raptor could spit them out, given all the talk about wanting things to be made in the USA, but even those will likely have parts from dozens of countries.

I don't want to knock Rep. Riggleman too hard, since knowing what Github is (let alone how to use it) puts him in the top one or two percent of Congress; but DoD is by no means a paragon of software development practice. It cares far too much about compliance for the sake of compliance and far too little about whether that compliance enables business objectives such as security or reliability. (And waivers are easy to obtain when compliance makes things better, but difficult when compliance makes things worse.)

<comment><USER20> In the video, Rep. Riggleman doesn't find issue with Rust being international; he instead notes that one of the primary committers to _Libra Core_ (not Rust) is Nigerian.

I had a similar response to yours when I read the top-level comment, but watching the video it's clear that his issue is very much _not_ with Rust having an international development team.

<comment><USER18> His issue is Libra having a international development (or more specifically random international development), and his issue with Rust is using the nightly builds instead of a stable release.

</comment></comment></comment></comment></comment><comment><USER21> For those wondering the Congressman in question is Denver Riggleman, (R) representing VA's 5th district.

</comment><comment><USER22> There's hope for Congress after all. We can now be sure we have at least one congressman there who can tell a nightly build from a hole in the ground. It's very unusual to see congressional inquiry where the person _asking_ questions is more competent than the person(s) answering them. Most congress(men|women) struggle to complete coherent sentences, let alone talk about anything technically sophisticated.

</comment><comment><USER23> Didn't expect a congressman to be so technical

</comment><comment><USER24> I spent several minutes looking at the video for signs of editing, believing that's a joke do demonstrate some new kind of deepfake AI. I have no idea who those guys are, but it is astonishing to see politicians being competent in technology outside of MS-Word power user level

</comment><comment><USER25> Even if it was well-rehearsed, he's earned my respect for bringing about questions that are pointedly relevant, both materially and topically.

</comment><comment><USER26> I was dispointed by the facebook side, they should answer the question in details.

</comment><comment><USER27> Is there a reason that it matters what the _reference implementation_ of Libra is written in?

A blockchain network is usually not considered healthy until it has multiple implementations of nodes running non-negligible parts of the network. I would say that Libra having such alternate impls is almost inevitable.

Exploiting any flaw in a particular blockchain node impl, when there are multiple such impls, would then require either finding the same vulnerability in all other clients; or else, attacking that one client, forcing a hard fork, and then having that client's version of events "win" such that other node software choose to adopt it by hardcoding a switchover. Neither is ever very likely.

<comment><USER28> > Is there a reason that it matters what the reference implementation of Libra > is written in?

If a language implementation is new, then it is (in the pragmatic sense) more susceptible to security issues.

<comment><USER29> Two counters:

1\. You entirely ignored the thesis of the comment you responded to. Which is that other nodes can be implemented in more "mature" languages.

2\. I don't buy for a second that new languages are more susceptible. You can attach pragmatic all you want to the sentiment but it's not an argument.

</comment></comment></comment><comment><USER30> the rust nightly build has the ECC curve functionality. Most of the crypto related prototyping on rust requires the nightly atm. Heres hoping integration onto wide release for the sake of the crypto dev community

</comment><comment><USER31> This is a deeply technical and insightful question to ask. However, is this question on implementation detail the best question he could ask to determine the impact of Libra on the people he represents, or does it serve to satisfy his curiosity?

<comment><USER32> I agree that unless the point of the question was more of a power move to show he's not an idiot and that they shouldn't try jerking him around, the question doesn't seem particularly useful.

The action of creating Libra could be interpreted as an attempt to undermine US federal currency. Facebook is the first company with enough clout to actually succeed at widespread cryptocurrency adoption to attempt something like this. I think there are bigger issues to deal with than quibbling about languages and release cycles. I know that the congressman's unspoken question is really whether Facebook has considered the security ramifications of allowing foreign nation-states to meddle directly with our system of currency like they were able to meddle with our news media, etc. But we all know that great programs can be written in terrible languages and terrible programs can be written in great languages. If the congressman is thinking what I think he's thinking, I wish he'd come out and say it instead of beating around the bush.</comment></comment>


When a bad day gets worse – getting hacked twice in one day - <AUTHOR> http://chrishateswriting.com/post/84931829578/when-a-bad-day-gets-worse-getting-hacked-twice-in-one <comment><USER2> Having been through open sourcing an app platform repo ([https://github.com/documentcloud/documentcloud](https://github.com/documentcloud/documentcloud) ) that wasn't explicitly created w/ open sourcing in mind, moot has my deepest sympathies.

Moot left out the most sensible response to Mistake #5:

I went through a rushed 8hr rebase to remove all of our keys, certificates, cookie secrets and the like before DocumentCloud's platform was opened. Two days after, a friend asked me why I hadn't simply revoked and replaced all of our secrets to the sound of me facepalming repeatedly.

It is always much easier just to revoke and replace your secrets. Doing so should always be relatively easy for you to execute, and having a chance to practice that is also always good.

<comment><USER3> Good point -- frankly I'd suggest doing both (clean repo and revoke/replace the secrets). The developer in question simply overlooked the issue, and since we were busy spinning down the company, nobody else caught it.

<comment><USER4> Also, just swear of ever committing secrets to a repo to begin with. It's a bad idea, period.

<comment><USER5> There are many times when that isn't doable. Fortunately, you can swear off ever committing _plaintext_ secrets to a repo. I use git-crypt:

[https://github.com/AGWA/git-crypt](https://github.com/AGWA/git-crypt)

</comment></comment></comment></comment><comment><USER6> Of related interest to HNers: Admin consoles getting owned up is a fairly frequent way that even security-conscious shops lose their web apps / databases / networks, because one often does not code defensively against malicious actions executed by "trusted" users. You can mitigate this quite a bit by putting them on a private network interface and requiring the admins VPN in to use them.

<comment><USER5> As an easier alternative to set up, you can require SSL client certificates.

<comment><USER7> Speaking as someone who got owned even when using SSL client certificates (made mistakes setting things up, long story), I think patio11's suggestion is better. Put it on a private network, seriously it isn't that hard.

<comment><USER5> That's too bad. It's not hard to set up, it's just harder to use.

</comment></comment></comment></comment><comment><USER8> > "Mistake #3: Unescaped SQL query..."

This should be "failure to use parameterised queries." The term 'unescaped' may lead some to think that simply escaping characters is sufficient.

<comment><USER9> Are you implying that there's a way to get past escaping...? That's a new one to me. I thought escaping was precisely so you can put _any_ value in a string and have it still work.

<comment><USER10> Yes, but you had better be 100% sure that your escaping function is completely reliable, and the server hasn't introduced some new syntax since you wrote it that you aren't escaping properly.

I would trust parameters much more (although I have used proper escaping in the past).

<comment><USER11> A few popular database drivers use escaping under the hood for parameterized query arguments. mysql2 ruby gem (and any rails stack on top of it) for example.

<comment><USER12> They probably do a better job of it than you do, so let them handle it.

</comment></comment></comment></comment></comment><comment><USER13> The disclosure of these mistakes is both kind of relieving, in that the errors were obvious in _nature_ , and terrifying, in that even though they seem "basic", they were still committed by a dev as experienced as moot. This would be a good post to create a checklist from, if nothing else.

I wonder how old the code was for "Mistake 2"? SQL injection is something most sites have patterns/frameworks to prevent, but unless the site started out with such practices...the code that was written when the site was just a fun side-project might go unchecked even as the site becomes a well-run project in its later years.

<comment><USER3> > they were still committed by a dev as experienced as moot

I'm not a terribly good programmer, and have been very hands-off with 4chan's code for quite some time. I still direct development and am responsible for the servers/sysadmin tasks, but there are far more talented developers out there than I. In the case of Canvas/DrawQuest, I was 100% uninvolved on the tech side.

But again, in both cases I accept full responsibility for the breaches since ultimately it's up to the project leader to ensure these things don't happen -- even if not active on the technical side.

> I wonder how old the code was for "Mistake 2"?

Very new. It was in a once-off file that we used to quickly pull stats about reported posts, which a) shouldn't have been on a domain without HTTP auth, b) should have been deleted long ago, c) shouldn't have had a bugged auth check or injection vuln to begin with.

<comment><USER14> one-off files have a habit of hanging around and temporary often becomes permanent.

This isn't to say that you should treat all one-off's and temporary solutions _as_ permanenent but it is a good idea to audit them periodically.

Storing that kind of metadata about code is something I've often pondered we could do better, putting it in comments is a nasty hack, storing it away from the code means it instantly gets out of date, commit messages are not a good place to put that stuff either.

I've never come up with an elegant solution even in my head but it would be something I'd love to have for my own uses.

<comment><USER15> Agreed.

Someone once came into my office and asked why the email export feature had stopped working. Once they described going to test.php, I realized that about a month ago, I had migrated our version control system to a new deployment system, and hadn't included test.php, what I thought to be an insecure relic left hanging around by a predecessor.

Things that end up on a live web server are one offs much less than the people who make them think.

<comment><USER14> nice and eerily familiar.

Codebase I once worked on, I found a /csv route that dropped the _entire customer database in CSV format_ and /route_csv that enumerated all the routes the application had including admin and cron routes :| (denial of service by spamming the cron routes that did no access checking was the _least of it_ ).

When I checked the commit date it was 19 months ago..and in production for 17 months :|

The midden and the windmill fully hit each other that day.

</comment></comment></comment></comment></comment><comment><USER16> Thanks for this Moot, I love the fact that people are being more and more open with how they were hacked. These post-mortems help others identify areas where they may be vulnerable which in turn helps the community as a whole.

Sorry about you getting hacked twice in one day though. I hope things have been better since then!

</comment><comment><USER17> I'm not familiar with DrawQuest, but why not sell it "as is" instead of shutting it down completely? Especially when you have 100k monthly actives?

<comment><USER18> If I'm not mistaken, they took on $3.6 million in venture capital, and that might be the complication in deciding exactly what to do with the product (that is, their partners in it may disagree with selling it for $500k or whatever it might fetch).

<comment><USER3> Our investors have been incredibly supportive -- especially these past few [rough] months.

The biggest concern I have is not so much the price it would fetch (which is probably not much given recent events), but rather finding a suitable steward for the community.

<comment><USER19> I'm pretty sure there was someone who could step up. Product owners usually over value their involvement and thus never give up the reigns, going down with the ship instead of letting someone else take over.

<comment><USER20> I don't know. Community members usually undervalue the product owner's involvement as well.

Stewarding a community is a difficult job. You need more than just passion and I imagine finding one and feeling confident that they'll do a good job is quite difficult.

</comment></comment></comment></comment></comment><comment><USER21> Security is a usability nightmare. All the instinctive and usually lazy things people do are just bombs waiting to explode. I don't know why this continues to be the case. Most platforms for web development should have taint checking turned on to the highest setting by default. SQL access points should scream in your face every time you use a bare query. With a bit more you could even get developers to do the right thing in terms of salts, passwords, and hashes. I think it is clear that pointing people to OWASP and asking them to read their security articles before bedtime is not as useful as it could be. Library writers also need to be involved and use safe options by default instead of opt-in.

</comment><comment><USER22> Shows you that strict controls over your AWS credentials are worth whatever hassle they might be. 100 huge instances spun up can cost you big time.

<comment><USER23> AWS also lets you put in billing alerts, letting you know when you hit the threshold.

<comment><USER24> (Not an AWS user, so don't know how this works)

Can someone with the leaked credentials turn off the billing alerts?

</comment></comment></comment><comment><USER25> The list of vulnerabilities in 4chan read like a standard web hack CTF. I'm surprised a site as big as 4chan has multiple OWASP top 10 issues, especially after the source was leaked. Storing credentials in client side cookies? Who wrote that shit?

<comment><USER26> 4chan has always operated on a shoestring budget. When you have a single dev, there's nobody around to catch stupid mistakes. I just spent two days trying to track down a bug only to realize I'd been adding elements to an array in a braindead manner. Stupid happens.

</comment></comment><comment><USER27> Nobody mentioned the fact that _you don't put secrets in a versioning system_. .gitignore the configuration files and have example files available, or use configuration files that can import the missing parts (the secrets) from an ignored file. Another way is to put the secrets in environment variables outside the project. In any way, if they're missing provide a meaningful message to the developer. I do understand that you must keep some of these secrets available somewhere: just don't version them.

<comment><USER28> I can understand the desire to version control your secrets.

The bad idea was not to maintain the source in a separate repo that could easily be released.

If you want to keep the checkout process simple for your developers, maybe use git subtree for the overall project.

</comment></comment><comment><USER29> Some security bad practices, but it happens to the best of us. Glad you got that figured out though.

I always tell my devs on the first day, "leaving AWS keys in a public repository is as bad as showing up drunk to work". Mainly because the last guy to leave our AWS keys in the open was drunk at work.

<comment><USER19> its really sad to see how many AWS Keys are public in github right now. A quick github search reveals many, many key pairs that were checking as recently as this week.

<comment><USER30> Amazon are apparently scanning themselves. If they are doing this then they might figure that the quantity of exposed keys will undermine their reputation. That is quite something in itself.

<comment><USER31> Amazon AWS support have (at least on here) a reputation for refunding fraudulent usage that stemmed from compromised keys. If that is in fact a policy they follow, it's in their best interests to cut down on leaked AWS credentials.

</comment></comment></comment></comment><comment><USER32> This makes me wonder what kind of practice change would be best to help avoid this sort of thing. Maybe anytime you put in something that you know is hacky and insecure as a one-off, you should put a note in wherever you would look regularly, and maybe some kind of reminder too, to make sure that your one-off is either removed or properly secured reasonably quickly.

Or maybe just a rant on PHP and/or frameworks that make it easy to do the wrong thing, and hard or time-consuming to do the right thing.

<comment><USER33> Looks like a good opportunity for an open source tool that scans a git repository for interesting/private information. Obviously it could be used for nefarious purposes, but it would be helpful for anyone looking to open source an existing repo.

Another alternative is to store credentials in environment variables :)

<comment><USER3> > Looks like a good opportunity for an open source tool that scans a git > repository for interesting/private information.

These already exist in droves, which is exactly how our Amazon credentials were found.

[http://www.itnews.com.au/News/375785,aws-urges-developers- to...](http://www.itnews.com.au/News/375785,aws-urges-developers-to-scrub- github-of-secret-keys.aspx)

<comment><USER34> I wasn't cognizant of the need to include a step in which you scan your own repo, just as a fail safe. So thanks for posting this.

</comment></comment></comment></comment><comment><USER35> I actually think this is something GitHub should help with. When you flip a repo from private to public, it should prompt you asking if you want to wipe out all the version history first.(essentially create a brand new repo in the background)

Seems like far too common a mistake and something they could help fix once and for all.

</comment><comment><USER36> So Mistake #4 is something you hear over and over again is bad but I don't understand why it's so bad. If you have the password you can just login anyway and I don't see how it affected this particular case either. Please enlighten me.

<comment><USER37> Because he didn't have the password, he had a hash of the password.

So if the auth system wouldn't have let him login directly with the hash by changing his cookie, he wouldn't have been able to login as an admin.

<comment><USER9> Am I right to say this would've been easily prevented by putting the hash(salt + password + client IP) in the cookie, instead of just hash(password)?

<comment><USER38> Normally, if I understand right, the point of hashed passwords, is what is sent from client to server to auth is the ACTUAL password.

Then the actual password is hashed, and the hash of the input password is compared to the previously stored hash, to see if it matches.

This way, you need the actual password to auth, but the actual password is stored nowhere by the app, only the hash is -- so the actual password can't be stolen by getting access to the db or the file system or anything else, because it's simply not there. But it's what you need to auth.

This is really the whole point of storing hashes rather than original passwords. Right?

Now, I guess that would mean you'd store the _actual_ password in the cookie. But that does sound risky, even if the cookies are https only. Which is why usually you store a _session id_ in the cookie, and auth the session with a single auth action, not store the password in a cookie.

<comment><USER10> If I could upvote you multiple times I would. I see a lot of confusion on this matter, even on HN.

When authenticating, _the server_ needs to do a hashing step to compare against the password database. Otherwise, it isn't a hashed password database - it's a plaintext password database.

</comment></comment></comment></comment></comment><comment><USER39> moot, why do you refuse to speak to us on 4chan while go happy hand-in-hand with all these web 3.5 cloud entrepreneurs here? Want to find some investor friends? Thanks for ignoring your actual friends.

<comment><USER40> I strongly suspect moot posts anonymously on 4chan. Posting under moot would result in his dominating the conversation.

</comment></comment><comment><USER41> > Boneheaded cookie auth—we simply stored the bcrypted password from the > database in a cookie, which was all that was required to pass PHP auth.

Wh... Why... Who...

How was that ever OK?

<comment><USER42> Okay, so I'm guessing this is an example of "feigned surprise" that is supposed to be considered bad?

I've been on a few sites (very recently) that just stick the password right in an auth cookie, served via HTTP no less. Luckily they're sweet enough to base64 encode it for extra security.

<comment><USER41> Not even feigned.

I would have expected a site like 4chan, the source of all sorts of script kiddie idiocy, would know better by this time than to stick a password, even hashed, in a cookie.

But sometimes you piss off the HN bees nest, and downvotes come streaming in. Reminds me of Reddit.

<comment><USER43> I think the original script it was based on didn't even have login per se. You just occasionally stuck in an admin password hard coded in the PHP to do a one time post delete or whatnot. It's mostly an anonymous forum after all. As more moderation functions grew a real login was needed and grafted on. Users still didn't have a login for a long time and instead had a special part of their username that was hashed when displayed to prove identity.

</comment></comment></comment></comment><comment><USER44> Putting the hashed password directly in the cookie? That's shameful. A hack was well deserved.

<comment><USER45> >> A hack was well deserved.

That's a despicable thing to say. No one deserves to have bad things thrust upon them.

</comment></comment><comment><USER46> So simple. Could have been much more painful.

<comment><USER46> I think people who are downvoting this comment are projecting what I meant by "so simple." There was no judgement on that statement. It was more an observation relating to that it could happen to anyone, and that they were "lucky" the person who got into their system wasn't really malicious.

<comment><USER47> IMO they more likely consider your initial comment to add nothing to the thread.

<comment><USER46> So I suppose that's worth the effort of downvoting vs. upvoting comments that are worthy..

<comment><USER48> Yes; upvoting just puts the better comments nearer to the top. Downvoting the fluff comments (with the minimal "effort" of a click while you read past) actually greys them out, which both discourages people from posting fluff in the future (with a minor karma hit), and makes it obvious to other readers that they've made it to the end of the real comments.</comment></comment></comment></comment></comment>


How Big is a Yottabyte? [Infographic] - <AUTHOR> http://www.readwriteweb.com/solution-series/2011/05/how-big-is-a-yottabyte-infographic.php <comment><USER2> A PetaByte in 16 BackBlaze PODS in 2 racks? That seems a little "distributed". a POD holds, say, 45 drives. I suppose they weren't using 3tb drives either!

45 drives at 3tb each would be like 1.4 petabytes?</comment>


ASk HN: Whats your favorite startup quote? - <AUTHOR>

Some new ones have come in. Care to share what resonated with you the most and why?<p>http://startupquote.com/ <comment><USER2> "If you want to build a ship don't herd people together to collect wood and don't assign them tasks and work, but rather teach them to long for the endless immensity of the sea." — Antoine-Marie-Roger de Saint-Exupery

didn't wanna click thru :-)

</comment><comment><USER3> 21 of the Greatest Rules for the Entrepreneurs of this World [http://bighow.com/news/21-of-the-greatest-rules-for-the- entr...](http://bighow.com/news/21-of-the-greatest-rules-for-the- entrepreneurs-of-this-world)

</comment><comment><USER4> "Law of Inverse Focus" - "The more items on a priority list, the less change of implementation" - Tim Berry in "Hurdle: The Book on Business Planning"

<comment><USER4> "A great attitude is not the result of success; success is the result of a great attitude" Earl Nightingale

</comment></comment><comment><USER5> hey nice website with very good collection!</comment>


Encrypted messaging app Signal adds facial recognition protection for protesters - <AUTHOR> https://www.cnet.com/news/popular-encrypted-messaging-app-signal-adds-facial-recognition-protection-for-protesters/ <comment><USER2> Much larger discussion around this:

[https://news.ycombinator.com/item?id=23414556](https://news.ycombinator.com/item?id=23414556)

</comment><comment><USER3> Though if the messages and photos therein are end-to-end encrypted this is protecting against infiltrators into a group chat or someone forwarding photos or law enforcement cracking one's phone for evidence? Seems like selling an invisibility ring to someone who already has a cloak of invisibility. Defense in depth, I suppose.

<comment><USER4> Your analogy makes no sense. This isn't being sold, it doesn't hide the users, and the users were never invisible to begin with. Everything else you said makes sense though, and I would say that the larger a group chat is, the more useful (like how public Matrix rooms aren't E2E encrypted since that's useless). And just generally useful considering how often images get shared these days.</comment></comment>


Databases Should be Dynamically Typed - <AUTHOR> http://blog.mongodb.org/post/215738382/databases-should-be-dynamically-typed

<comment><USER2> (I also commented on the article, but nobody seems to be commenting over there, so reposting...)

The advantage of statically typed RDBMS that he's leaving out here are (a) storage optimization (b) query optimization (as jawngee has already noted).

You could get halfway to simulating a dynamically-typed RDBMS by declaring all your columns as, say, VARCHAR(5000). You could store strings, integers, floats, dates, etc. all in there pretty simply. However, they would use a lot more storage space as strings than they would as native data types (e.g. integer 1000 is one byte, string '1000' is 4). Over a large data set that would really add up.

Secondly, when doing queries, your comparison operators (e.g. WHERE date > 2009-07-06) would be way less efficient as string comparisons than native type comparisons.

I don't want to be dismissive and curmudgeonly about this, but over and over what I hear from people enthusiastic about NoSQL solutions is that they solve the current problems of RDBMS, while forgetting all the great features that we have spent the last 30 years building _into_ database systems.

The current "limitations" of SQL-based systems are often in fact age-old trade-offs that we made, but people have forgotten the positive benefits of those trade-offs. The reason databases are statically typed is because that saves storage space and processing time. The reason there's a standardized, domain-specific language that you have to learn is because having to learn a completely new API and mental model every time you want to access a data store from a new vendor is inefficient. Oh, and the reason SQL is so complicated is because _relational algebra is complicated_.

Sure, SQL and RDBMS have their limitations. They're not the right tool for every job, and they are not even 100% perfect at the jobs where they are the right tool. But too often I hear people saying "fuck SQL!" simply because they don't want to learn it, and because they're too early on in their little pet project to realize the scalability problems a NoSQL system is going to run into that RDBMS solved 20+ years ago.

<comment><USER3> > The reason databases are statically typed is because that saves storage > space and processing time

The problem with this argument is that when I can slap several TB into every node in my db cluster the storage cost issue is basically moot. When it is cheaper to buy ten small boxes than one beefy server the processing time and query optimization issue also starts to come into question. At some point soon, and we may have already passed that point, the cost of centralizing db queries through a small number of expensive, highly tuned servers necessary to maintain the pillars of the RDBMS model will be outpaced by the benefits of abandoning both optimizations in favor of being able to use a small, cheap fleet of boxes running a distributed database.

The tradeoffs that were made several decades ago when the RDBMS and SQL ascended to their current dominance may have made sense at the time, but a lot has changed since then. You may try to delude yourself into thinking that there are "scalability problems a NoSQL system is going to run into that RDBMS solved 20+ years ago" but given the fact that almost all of these systems were designed with an eye on under what conditions RDBMS failed and in light of decades of research into distributed systems and scalability that did not exist when SQL/RDBMS emerged I find it hard to believe that there are scalability problems that RDBMS solved that NoSQL systems will run into. Hell, most of them were designed to solve specific scalability failures in big data systems where RDBMS fell over and died.

<comment><USER4> You're putting a lot of faith into this. The fact is that performance, scalability, features, and correctness are a trade-off. RDBMS is optimized for certain conditions and these NoSQL databases are optimized for other conditions. NoSQL databases are horrible at things that RDBMS's do extremely well and vice-versa. NoSQL isn't some magic discovery -- of course they're going to run into problems that RDBMS solved years ago!

Your argument for small boxes seems to be the same argument for one large box. My (extremely average) desktop has a terabyte of storage in it -- why do I need a bunch of boxes running a distributed database? One big server is a hell of a lot easier to manage than a fleet (a fleet!) of small boxes.

</comment></comment></comment><comment><USER5> <sarcasm> Yeah that would be totally awesome! Now our databases can't optimize our query plans and any aggregate functions will be doing super cheap type conversions between strings and number types!

And, really, who cares about data consistency? Sure that stupid little script is inserting strings into what should be a numeric column, but I'm sure that won't cause any problems at all when the monthly reports run, or the batch processes that charge our customers run, because the database will know how to handle such cases because the DB developers have written all that extra logic in it for such cases. </sarcasm>

<reality> Stop being lazy. </reality>

<comment><USER6> Data consistency could be maintained through stronger runtime input verification which in turn nulls everything you said.

I don't think that it would be a bad idea to have dynamically typed databases although it would put a little more strain on developing the actual application instead of having to spend time on making the database.

<comment><USER7> This works really well for embedded applications since the code logic _should_ be doing some type checking and verification before insert.

SQLite is a very well known relational database with dynamic typing, it's quite possible the most deployed relational dB in the world since it runs in everything from browsers to mp3 players and if the data inserts are well controlled, don't really result in any particular problems.

<comment><USER8> > logic should be doing some type checking and verification before insert

There are a minority of coders who are actually anal enough to get that right 100% of the time in every version of every app that touches the database. But those are not the people who are reckless enough to want to omit types from the schema. If you think doing it the easy and reliable way isn't worth the hassle, you are not actually going to do it the hard way, even if you can convince yourself you will.

<comment><USER7> Dunno why you replied to me, but I agree. In single app usage, in a well controlled and well defined situation, it's probably "okay" and you can get away from it. There are _some_ environments like this. But I agree that in the general sense, especially with lots of apps banging on the same set of data, it's bad form.

<comment><USER8> I just try to counter the argument "the database doesn't need to validate because the app can do it" wherever I see it, because it just doesn't happen that way even though it's technically possible.

</comment></comment></comment></comment></comment></comment><comment><USER9> _even with a statically typed database, type matching errors storing data are only reported at runtime! (That is, our java compiler doesn't check our MySQL schema.)_

That isn't necessary the case: for example, PG'Ocaml allows Ocaml programs that access a PostgreSQL database to have their type consistency checked at compile-time.

<http://developer.berlios.de/projects/pgocaml/>

</comment><comment><USER10> How does he get from the the text of the article, which approximately says "It would be useful in some cases for a database to be dynamically typed" to the sweeping statement "Databases Should be Dynamically Typed".

As others have noted, relational databases have a rigorous theoretical foundation that is not consistent with what he describes as dynamic typing. He should consider looking at a graph database. Many of these are billed as "RDF Stores" or "Triple Stores". Franz's AllegroGraph is an excellent example.

</comment><comment><USER11> SQLite is: <http://www.sqlite.org/datatype3.html>

<comment><USER4> Hey, is there anyone out there that uses SQLite and actually uses it's "duck typing" feature to some effect?

I'm using it, but I still declare my "column affinity" and store values with the proper types. I don't put strings in my number columns, for example. I can't even imagine a good reason for that.

</comment></comment><comment><USER12> One situation that calls for a typeless database is when the system _must_ accept data from a source that's unwilling or unable to adhere to a well- defined static schema.

<comment><USER13> Perhaps, but then perhaps a database is not the proper store for that at all, and a relational database almost certainly isn't.

If you really must do it via a relational database, you could use something equivalent to varbinary(max) to accept whatever stream of bits is sent in and then parse them out into something meaningful later (or just store it for the applications retrieval).

<comment><USER12> X ∈ { database } does not imply X ∈ { sql database } or X ∈ { relational database }.

Even if your data is not a good fit for the relational model, it's often a good idea to rely on a database system offering features such as transactions, an ad-hoc query facility, enforcement of access permissions and update policies, replication/recovery, efficient I/O, etc.

<comment><USER13> All true and good points, but if you feel the need to say that perhaps I was not being clear enough.

1\. In the situation described so far, a relational database is almost certainly not the optimum solution.

2\. If you must use a relational database, you can mimic the ability to accept arbitrary input using something equivalent to Varbinary(max) columns.

3\. A non-relational database may be the optimum solution in your particular case, but perhaps it is not. Before using some form of key-value store or object oriented database etc, think about non-database solutions. Depending on precise circumstances perhaps simply writing the input out to a file or into an ordered file directory structure is a better fit. It may or may not be depending on further details.

</comment></comment></comment></comment><comment><USER14> you can use SYS.ANYDATA and SYS.ANYDATASET if you use Oracle. I'm sure other databases support similar feature.</comment>


55% of net users use the same password for most, if not all, websites. - <AUTHOR> http://nakedsecurity.sophos.com/2013/04/23/users-same-password-most-websites/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+nakedsecurity+%28Naked+Security+-+Sophos%29 <comment><USER2> I'm not at all surprised by this. I mean, I use the same dictionary-word password for 98% of websites I visit. You know why? Cause for the most part, it doesn't matter. If someone manages to log in to my Hackernews account and accounts on random forums and accounts on pages I had to sign up for once and never returned to again, I couldn't care less.

My bank/Facebook/Twitter/Amazon/etc are all unique because I actually want to keep people out. Other than those, I'm more than willing to trade security for the convenience of knowing I can visit a site I haven't logged into for two years and have a really good chance of knowing my password.</comment>


Over 80% of students unlikely to scan a QR code - <AUTHOR> http://www.archrival.com/ideas/13/qr-codes-go-to-college

<comment><USER2> There really is too much friction in your average use-case for a QR code for it to work, in my opinion.

See code, decide to look at it, fire up app on phone, take picture, wait, oh a boring website link guess I won't use this again in the future.

For things like the Korean subway shopping experiment (<http://www.youtube.com/watch?v=nJVoYsBym88>) it works because you can shape people's interaction much better.

</comment><comment><USER3> Making these useful is what will help adoption. Right now, they're only being used for marketing purposes. I really like coffee, but I'm not so passionate about it that I will take out my phone, perform seven taps, and watch a bad marketing video about it.

One can imagine useful scenarios though. A microwave which scans the QR and sets the desired cooking time. A little magnet on your fridge which, when you hold up a product to it (empty milk carton) adds that product to the shopping list on your smartphone. Things like this could be useful to the end-user _and_ to marketers.

</comment><comment><USER4> Most QR codes are tied to advertisement. I assume most students ignore them so they will probably not bother with all the energy required to read a code. Engagement will probably be higher for more valuable information.</comment>