Rethinking Static Reference Tables in GHC - <AUTHOR> https://simonmar.github.io/posts/2018-06-22-New-SRTs.html <comment><USER2> Looks like this "pays for itself" (as in [https://prog21.dadgum.com/136.html](https://prog21.dadgum.com/136.html) ), which is always nice to see for a simplification :)

The top-level `Map` example resonated with me, since I recently needed to speed up some scripts which look up data from some statically-known JSON files, which match some user-provided properties. I was using `jq`, but ended up doing an O(N^2) nested loop which was too slow. I wrote a Haskell version, which was easy enough with the Aeson library, but then I was able to speed it up massively by using Template Haskell to read the files, parse the JSON and build a `Map` from properties to data _at compile time_. This is encoded in the resulting program as a top-level definition, just like the example shown in this article. The resulting binary only needs to do an O(log N) lookup at runtime, which is more than acceptable :)

</comment><comment><USER3> Would this also benefit non-top-level thunks?

We had a ridiculous space-leak at DFINITY just last month where the workaround I found involved turning off full-laziness [1] _as well as_ using a variant of `Control.Monad.forever` defined in terms of `(>>=)` rather than `(* >)` - which is how `Control.Monad` does it, which interacted badly with how Conduit implements `(>>=)` and `(* >)`. We never got to the bottom of exactly why it leaked but I'll be sure to try it out again with GHC 8.6. However it's not clear that long-lived CAF data would have been the problem in our case.

[1] [https://www.well-typed.com/blog/2016/09/sharing- conduit/](https://www.well-typed.com/blog/2016/09/sharing-conduit/)

</comment><comment><AUTHOR> Primary takeaway, for (Haskell) programs compiled with GHC: _" Code size: overall binary sizes are reduced by ~5% for large programs, ~3% for smaller programs."_

</comment><comment><USER4> Does he define GHC anywhere in the article? Any idea what that might be?

<comment><USER5> As for why he doesn't define it: he's been one of two primary authors of GHC for over 20 years. He assumed anyone reading his blog would already be aware of that, because why else would they be reading his blog?

<comment> fake-name I dunno, maybe because people link to stuff without context?

<comment><USER6> Googling "Simon Marlow" gives the following:

> Simon Marlow is a British computer programmer, author, and co-developer of > the Glasgow Haskell Compiler. He and Simon Peyton Jones won the SIGPLAN > Programming Languages Software Award in 2011 for their work on GHC.</comment></comment></comment></comment>


New Study Aims To Crack Silicon Valley's Innovation Code  - <AUTHOR> http://huff.to/kATc71

<comment><USER2> this

Most successful founders are driven by impact rather than experience or money.</comment>


Steve Jobs' 13 Most Inspiring Quotes - <AUTHOR> http://www.entrepreneur.com/article/236526

<comment><USER2> Horrible web page.

Currently the top article is "The 5 Traits of Entrepreneurs Famous for Making All the Right Moves".

It's one of those infinite scroll pages, so presumably the Steve Jobs stuff must be there somewhere. Just keep scrolling down and down and down. I gave up. This is one of the stupidest websites I've ever seen.

It's so stupid that I wish my browser had an easy way to blackhole www.entrepreneur.com so I'd never wind up there again, even by accident.

Morons.</comment>


Ask HN: What do Google, Facebook, and Amazon have in common? - <AUTHOR>

These companies more or less eschew "graphic design" (not saying they eschew or ux or "just design") - they constist mostly of content with the tiniest bits of chrome to demarcate things.
Is this a function of catering to the lowest common denominator? Page speed? Is it what's made them successful? Is it a reflection of the fact that graphic design just interferes with app functionality or tries to obfuscate bad app functionality?
I think about all the sites that have whimsical designs, with arbitrarily chosen motifs, and think -- this is so subjective. Not everyone will like it. Some people will love it. Why risk it? White backgrounds verifiably do not not work, so why use background images?  Why have clever iconage? It's bound to confuse at least a few people.
Can graphic design only impede "transactional" websites? <comment><USER2> Google and Amazon (I'm not so sure about Facebook...) have realized that, while design is nice, usability hooks regular users.

Take Amazon; technically not a very "beautiful" interface - but it is functional. And if you read their occasional technical posts from the UX side of things you realize quite how much effort went into the placement and wording of buttons.

Certain sites require great (subtle) graphics (I think Apple have always done this very well; their graphic designs are pretty complex but still look simple and elegant) either as part of their brand or because their demographic demands it.

But Amazon is not a place people sit and read for a few hours (for example). They go on, search for something and want to see all the information presented as fast as possible. Same with Google, except you spend even shorter time on their sites.

As to Facebook; I think in the past they have displayed little consideration for design OR good UX/UI in previous incarnations. Some of the changes they've made in the past were hilarious :P but recently things have improved and I think they figured much the same thing as Google et al.

</comment><comment><USER3> Your notion of graphic design alludes to the idea that more is better, while all good designers and artists know less is more.

All the sites you mentioned do have beautiful graphic design, clean style, and usability.

</comment><comment><USER4> Because what Google and Apple have shown everyone is that a great interface is minimal, neat and efficient.

The most useful webapps i've seen where always also websites with a minimal design (soup.io and animoto.com are examples of those, love the UIs, animoto is rather simple when editing.. startpage is overly complex to advertise the features)

<comment><USER5> Is it just me or are a lot of web apps using the same layout as animoto.com?

</comment></comment><comment><USER6> See also: <http://craigslist.org/sss></comment>


Super Mario Wallpaper Maker - <AUTHOR> https://www.nintendo.co.uk/games/oms/supermariowallpapermaker/create.html?w=1920&h=1080 <comment><AUTHOR> I had previously submitted the Japanese version, which Nintendo has now translated.

The English version already has both secret items unlocked by default, but not Toad, which can still be unlocked as mentioned in the comment.

[https://news.ycombinator.com/item?id=11016646](https://news.ycombinator.com/item?id=11016646)

</comment><comment><USER2> I am always amazed by the continuous creativity around Mario after all these years. Truly amazing.</comment>


ASK HN: GREAT(non top ten) computer science departments? - <AUTHOR>

I want to learn the most with the least. I am not overly invested in name brand recognition, as I want to actually LEARN vs be hired.<p>(and yes, I use Khan academy and Courseca) I do actually want a four year degree with people who are serious about learning. <comment><AUTHOR> I am married w a young family, with 3 years of living expenses saved...if that helps</comment>


Show HN: Beyond Tabletop – An RPG Tool Built on Google Drive - <AUTHOR> http://www.beyondtabletop.com

<comment><AUTHOR> Beyond Tabletop is designed to let you use your mobile devices for in-person gaming.

A friend and I built this after we bought dry erase mat for our home game. We realized that we had a dozen mobile devices in the room and we were still using pen and paper for gaming.</comment>


News website with assets for the taking - <AUTHOR>

A local news website with valuable licenses to use content and IRS 501(c)(3) status needs a new captain.  Has potential.  Online six years. <comment><USER2> I'd like to know more, but have no way of contacting you privately. Please put your email in your bio so I can send you a message

<comment><AUTHOR> Done</comment></comment>


A New Report Shows NASA Can't Afford to Send People to Mars - <AUTHOR> http://www.rssfeeding.com/news/a-new-report-shows-nasa-can-t-afford-to-send-people-to-mars?uid=23035 <comment><USER2> actual article: [http://www.complex.com/life/2017/07/nasa- mars-2020-mission-i...](http://www.complex.com/life/2017/07/nasa- mars-2020-mission-in-jeopardy)</comment>


Show HN: Let's make something, an experiment in collaboration with strangers - <AUTHOR> https://precursorapp.com/document/17592198027411?replay=true&sleep-ms=75&min-width=100

<comment><AUTHOR> Well, that just devolved into chaos immediately. The idea is to continue the animation, not to make random scribbles! I guess that's the internet for ya.

</comment><comment><USER2> This is why we can't have nice things.</comment>


Ask HN: MySQL Tuning for Performance Suggestions/Help - <AUTHOR>

I have a LiquidWeb Storm Server running CentOS 64 bit version 6.5 with a single 8 core CPU (AMD FX-8350) and 31gb of memory with a SSD.
I'm currently running Apache 2.2.29/PHP 5.5/MySQL 5.5 and host around 30 sites, two of which are fairly high throughput WordPress sites built in WordPress.
MySQL Tuner is reporting large #'s of fragmented tables and rather high (15-25%) connections aborted. I'm looking for advice on my.cnf configuration tweaks that I can put in place to tune the system for maximum performance.
Thanks!
>>  MySQLTuner 1.3.0 - Major Hayden <firstname.lastname@example.com>
 >>  Bug reports, feature requests, and downloads at http://mysqltuner.com/
 >>  Run with '--help' for additional options and output filtering [OK] Currently running supported MySQL version 5.5.40-cll [!!] Total fragmented tables: 574
<comment>-- Security Recommendations  </comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>- [OK] All database users have passwords assigned
</comment><comment>-- Performance Metrics </comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>- [--] Up for: 1d 22h 31m 46s (15M q [93.205 qps], 222K conn, TX: 431B, RX: 11B) [--] Total buffers: 1.1G global + 16.4M per thread (300 max threads) [OK] Maximum possible memory usage: 5.9G (19% of installed RAM) [OK] Highest usage of available connections: 8% (26/300) [OK] Key buffer size / total MyISAM indexes: 384.0M/290.8M [OK] Key buffer hit rate: 99.9% (110M cached / 130K reads) [OK] Query cache efficiency: 66.5% (7M cached / 11M selects) [OK] Query cache prunes per day: 0 [OK] Sorts requiring temporary tables: 0% (16 temp sorts / 99K sorts) [!!] Joins performed without indexes: 1637 [OK] Temporary tables created on disk: 21% (68K on disk / 321K total) [OK] Thread cache hit rate: 99% (26 created / 222K connections) [!!] Table cache hit rate: 3% (3K open / 80K opened) [OK] Open file limit used: 32% (5K/16K) [OK] Table locks acquired immediately: 99% (7M immediate / 7M locks) [!!] Connections aborted: 17% </comment><comment><USER2> e-mail is in profile. shoot me a message.</comment>


Process: Words and Pictures and Walking - <AUTHOR> https://craigmod.com/roden/034/ <comment><USER2> I'm not exactly sure why this was posted here. But I'm glad it was. It introduced me to a previously unexplored trail of the internet. Craigmod writes like he walks: circumspectly. His delightful collection of stories ("diaries", he calls them; found by following his link to Ridgeline) are just like his photographs: intriguing snapshots of a foreign land that's somehow not so foreign after all. What an unexpectedly enjoyable diversion.</comment>


EU Courts; Playboy vs. GS Media: links to copyrighted work illegal if commercial - <AUTHOR> http://curia.europa.eu/juris/document/document.jsf?text=&docid=183124&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=736696 <comment><AUTHOR> TLDR; Article 3(1) of Directive 2001/29/EC of the European Parliament and of the Council of 22 May 2001 on the harmonisation of certain aspects of copyright and related rights in the information society must be interpreted as meaning that, in order to establish whether the fact of posting, on a website, hyperlinks to protected works, which are freely available on another website without the consent of the copyright holder, constitutes a 'communication to the public' within the meaning of that provision, it is to be determined _whether those links are provided without the pursuit of financial gain_ by a person who did not know or could not reasonably have known the illegal nature of the publication of those works on that other website or whether, on the contrary, those links are provided for such a purpose, a situation in which that knowledge must be presumed.

<comment><USER2> Seems like it would be difficult to defend to meet both criteria, if I post a link to a picture on my blog, which carries no advertising and therefore there is no financial gain am I still liable because I know we they were not there with the copyright holders consent?</comment></comment>


Domainr - <AUTHOR> http://domai.nr/ <comment><USER2> The del.icio.us style domain names are neat for a personal site or something, but they're not very memorable (in terms of spelling and remembering where the dots are), and thus not good for a commercial site. Even Delicious ended up coughing up the hundreds of thousands or millions of dollars for delicious.com.

Edit: also, this tool isn't very accurate, it reports lots of domains as available when they really aren't.

<comment><USER3> Agree on the accuracy issue, tried 3 different domains, all showed as available and none were.

I have used instantdomainsearch.com in the past with some success for tld's, roughly similar idea but has been around for a long time.

<comment><USER4> Me too.

Just to test it out, I entered in my name (zain). It suggested <http://za.in/> and said it was available. I was ecstatic!

But, sadly, no, it was wrong. "whois za.in" says NOT FOUND, but I can't find a single .in registrar who says it is available. Bummer.

</comment></comment></comment><comment><USER5> Thanks for the kind words on the UI. We spent a lot of time on that. I guess you could say we were inspired by Google Maps—they got the UI right first, then fixed the incomplete data, bad directions and brought it up to feature parity with Yahoo and MapQuest.

</comment><comment><USER6> This is a killer interface. If it gets the behind the scenes stuff problems, others have already mentioned here, taken care of, it will get used a lot.

<comment><USER7> ^ Ditto, I was very impressed at the interface (if not at the problems with getting domain names that I couldn't register).

I'm rooting for you guys.

</comment></comment><comment><USER8> How about a more descriptive headline? You would probably get a lot more clicks if you gave people at least a hint about what is behind this link. If submitters can't take an extra few seconds to write a few descriptive words why should anyone take the time to look at what they've posted? I was tempted to flag this before I saw how many comments are here.

<comment><USER9> I don't know anyone who would be on HN and _NOT_ understand what a website called domainr does...

<comment><USER8> Fine. You could say it obviously has something to do with domain names. But, what exactly? Why should I bother using Domainr instead of searching using my preferred registrar? Surely, there must be something compelling enough to warrant such a site in the first place. It's pretty thin if it has to be sold with only a lame, cliche name. Is it too much to ask for at least a descriptive sentence fragment?

</comment></comment></comment><comment><USER10> whats <http://is.ydnar.in> ?

<comment><USER11> ydnar appears to be "randy" backwards.

</comment></comment><comment><USER12> There's really no benefit in having the message "This domain might be available". It is either available or it isn't (at the time you displayed the message anyways).

</comment><comment><USER13> Nice, but too many "This domain's availability is unknown".

<comment><AUTHOR> Yeah - I'm not sure, but that seems to be when the registrar only allows third level domains (e.g. Australia only allows .com.au/.net.au/etc - you can't register blah.au)...

</comment></comment><comment><USER14> Nice, but it kept telling me domains are available when they weren't

</comment><comment><USER15> ve/ry clev.er

</comment><comment><USER16> Wow they're really ripping the github design aren't they?

<comment><USER12> Don't really see the "rip", but as far as simple web designs go, everyone copies everyone else. How many variations of a banner/sidenav/main/footer layouts can you really do?</comment></comment>


Coke and Pepsi are getting sued for lying about recycling - <AUTHOR> https://www.vice.com/en_asia/article/qjde3p/coke-and-pepsi-are-getting-sued-for-lying-about-recycling <comment><USER2> There needs to be regulation that standardizes on container materials and shapes, optimizing for recyclability and ability to sort. Then there needs to be a financial incentive to use packaging that offers the highest reclaimation rates. I'm imagining something like the CAFE standards, encouraging ever increasing rates.

I listened to a podcast with one of the former heads of the EPA and one of the challenges is that the petroleum industry actively favors non-reuse so they can keep selling more plastic.

Edit: Here's the podcast: [https://www.kcrw.com/news/shows/to-the-point/the- high-cost-o...](https://www.kcrw.com/news/shows/to-the-point/the-high-cost-of- cheap-plastics)

<comment><USER3> If we were actually serious about saving the planet, we'd just pass laws that mandate companies _have_ to use certain specified bottles, and give them no choice.

But of course, lobbying and profits are more important.

<comment><USER4> It's not _that_ simple. Recycling doesn't care about shape, just material, and reusing has the problem of people putting random things in the bottle before sending it off - including toxic and/or corrosive materials, thus making reusing impossible.

<comment><USER3> Tons of countries throughout Latin America, Africa and Europe reuse large glass bottles for soda and beer and whatever else.

The bottles are thoroughly cleaned and sterilized between uses.

It _is_ that simple. Make it a law, get on with it.

<comment><USER5> Not only does re-use take large amounts of water in the cleaning of containers, but glass is orders or magnitude more expensive to ship product in. You're shipping a ton of glass around when you could be using that weight to ship product. It drives up cost and increases fuel burn.

It is _not_ that simple. Unfortunately.

<comment><USER6> > _glass is orders or magnitude more expensive to ship product in_

That sounds like nonsense. For a filled ~300ml container of soda, a glass bottle would be ~20% (ballpark) heavier than an aluminum can. Even if shipping costs increased by a similar proportion (actually less, but whatever) and we include the cost of cleaning bottles, it seems we would still end up ahead compared to the song-and-dance of recycling, which is incredibly resource intensive.

<comment><USER5> Not only weight, but due to the breakable nature of glass you also need more protective packaging, and you _still_ get more breakage than plastic, which drives cost up even more due to lost product.

With plastic, throw some shrinkwrap on them and you're good to go.

<comment><USER7> I'm not concerned about price for non essential items like soft drinks. Having a functioning ecosystem is far more important than whether or not you have to pay an extra dollar for your coke.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> I feel like the entire concept of recycling from the very beginning has been a lie. Now we're all paying for what we thought was being handled properly.

Edit: Plastic recycling.

<comment><USER9> Aluminum recycling still makes economic sense, right?

<comment><USER10> Pretty much anything that needs to come out of the ground in a form far less concentrated (aka "ore") than the form in which it is useful is economically recyclable because the product provides a more concentrated source of raw material for making into new things than the natural deposits in the earth do.

That's basically a long winded way of saying most metals are cheaper to recycle than to mine new.

<comment><USER11> If I recall correctly, its like 5% of the energy to use aluminum scrap vs. ore.

</comment></comment></comment></comment><comment><USER12> Overall, I think this is a good idea. a Lawsuit creates a financial incentive to behave better. However,

> It's likely that less than 5% of plastic produced today is getting recycled

I've seen this repeated elsewhere, but what I really want to know is the % of plastics sent for recycling actually being recycled. Anything that wasn't turned in for recycling just doesn't count here, in my opinion.

<comment><USER13> Recycling is such a farce. Anything where you have mixed streams going into the recycling bin is quite likely to end up buried somewhere in a developing country. Even when they are recycled they end up being turned into insulation or some other secondary product.

Growing up in Scotland we had a recycling system which was great. Irn Bru bottles were glass bottles with metal lids. The lid proudly announced that you could get 20p back for returning it (in the form of credit towards other purchases). The same trucks delivering stock took the empty bottles back to the distribution centre when they were cleaned, inspected and reused.

<comment><USER14> Glass and metal are a nightmare on the beach and in parks. Plastic sucks bad, but going back to glass isn't much better.

<comment><USER15> Glass is inert and doesn't break down; anyone can pick up glass bottles that have been on the beach for decades, wash them out, and recycle them along with new glass.

Metal degrades slowly if it's ferrous (iron/steel), but that isn't environmentally harmful. And it can all be readily recycled.

<comment><USER16> I think the implication was what if some jackass smashes the bottles and you find them with your foot.

</comment></comment></comment></comment></comment><comment><USER17> I wish this went into what the factors are that make these products not recyclable. Contaminants attached to the product, I assume?

Siggi's yogurt containers (the large ones, at least) have a paper label and a tab you can tear to completely remove the paper from the plastic so they can be recycled properly. Which, of course, made me realize that probably nothing ELSE with a label on it is recyclable in the way we think they are.

<comment><USER18> So, I wonder about these cardboard/paper containers that e.g. juice, milk, etc are being sold in. Are they biodegradable?

<comment><USER19> Nope, they have a plastic lining on the inside to make them waterproof.

<comment><USER20> Same is true of coffee cups, although there are a number of organizations (in Aus, at least) now that have processes for separating the plastic from the paper so it can be recycled.

E.g. [https://www.simplycups.com.au/how-it- works](https://www.simplycups.com.au/how-it-works)

</comment></comment></comment></comment><comment><USER21> This may be exactly the way to make change happen here in America. Corporations only understand the language of financial incentive. Coke and Pepsi and all single-use manufacturers need to be responsible for the costs of recycling the containers they create. In Germany, rulings and regulations in this vein have increased the proportion of recycled products to over 66%[1]. If corporations have no economic incentive to create recyclable products, they will act to externalize those costs as much as possible. With the worldwide economies of scale that Coke and Pepsi can leverage, we enter into a self- reinforcing plastic-industry sustaining death spiral.

1\. [https://sustainabledevelopment.un.org/content/documents/dsd/...](https://sustainabledevelopment.un.org/content/documents/dsd/dsd_aofw_ni/ni_pdfs/NationalReports/germany/waste.pdf) [pdf warning]

</comment><comment><USER22> May have been posted before, but I found it relevant that the "Georgia Recycling Coalition" put a hard stop on the suggestion of a bottle tax to help with recycling efforts.

"With the investment that Coke is getting ready to make in Atlanta and in other major cities across the U.S. with this World Without Waste (campaign), it is not going to be a part of that conversation."

[https://www.wypr.org/post/investigation-digs-eco- corruption-...](https://www.wypr.org/post/investigation-digs-eco-corruption- local-recycling-programs-re-air)

</comment><comment><USER23> It seems very strange to attack Coke and Pepsi for this. Shouldn't the target be recycling programs that claim to be recycling plastic bottles, but actually don't?

<comment><USER24> [https://www.earthisland.org/images/uploads/suits/2020-02-26_...](https://www.earthisland.org/images/uploads/suits/2020-02-26_Earth_Island_Complaint_FILED.PDF)

From the Table of Contents:

A. Defendants created the condition of plastic pollution, which is extraordinarily harmful to humans, animals, and the environment. 22

B. As Defendants have known for decades, recycling by itself cannot prevent plastic pollution from damaging oceans, waterways, and coasts 29

C. Defendants refuse to adopt more sustainable alternatives in order reap higher profits resulting from using virgin plastic. 37

D. Defendants' decades-long campaign of misinformation about their Products' recyclability puts the cost of plastic pollution on consumers and public entities. 39

<comment><USER25> Geez, only claim D even makes conceptual sense to try in court.

This suit is an awful idea.

<comment><USER26> While you may only be able to win on one count, you get discovery for all of them. The idea is good, if your goal is to legally investigate.

<comment><USER25> > While you may only be able to win on one count, you get discovery for all of > them.

Even if the court decides that you haven't stated a justiciable claim?

</comment></comment></comment></comment></comment><comment><USER9> It seems like this problem has only been allowed to get so bad because it's a silent failure. We throw things in the recycling, and without any feedback we assume they are recycled.

The failure should be pushed up the chain, at least to the consumer. The rules on what can be recycled should be realistic and consistently enforced, then people can make more informed choices (up to and including pushing for regulation on manufacturers).

<comment><USER27> That's the whole point of recycling, feeling good about ourselves. In reality the vast majority of the shit we throw away end up in open sky dump in Africa or China, but hey, I paid 80ct of "eco tax" on my $1k fridge so it's not my problem anymore. Just like using a paper straw at starbucks is doing absolutely nothing at all if you don't change the rest of your lifestyle.

[https://www.africanexponent.com/post/8588-the-west-is- dumpin...](https://www.africanexponent.com/post/8588-the-west-is-dumping- electronic-waste-in-africa)

[https://www.theguardian.com/global- development/2014/oct/06/s...](https://www.theguardian.com/global- development/2014/oct/06/smelly-contaminated-disease-worlds-open-dumps)

[https://www.theguardian.com/global- development/2019/apr/24/r...](https://www.theguardian.com/global- development/2019/apr/24/rotten-chicken-eggs-e-waste-from-europe-poisons-ghana- food-chain-agbogbloshie-accra)

<comment><USER28> the first city-wide recycling projects in the USA were faced with this kind of brick-wall reasoning in the 1970s, and yet have built successfully over and over.. the sideways reference to "eco-tax" shows there is an ideological driver here

<comment><USER27> > the sideways reference to "eco-tax" shows there is an ideological driver > here

Yes clearly, thinking a few cents of eco tax will outweigh your ecological impact is like thinking using paper straws makes up for taking the plane once a week. It's nice "feel good" idea but it doesn't have any real world impact. Just look at every pollution related threads on HN, there are always a lot of people blaming China and Asia for having the most polluting rivers, while the majority of the shit ending in their rivers was consumed in the EU/US. Recycling really isn't much more than "I'll put it far away and from now on act like it doesn't exist anymore".

Everything I read about recycling in the US, or anywhere else for that matter, is that it doesn't work very well and most of it is exported, so I'm not quite sure about which recycling projects you're talking about.

[https://www.plasticpollutioncoalition.org/blog/2019/3/6/1570...](https://www.plasticpollutioncoalition.org/blog/2019/3/6/157000-shipping- containers-of-us-plastic-waste-exported-to-countries-with-poor-waste- management-in-2018)

[https://www.theguardian.com/us-news/2019/jun/17/recycled- pla...](https://www.theguardian.com/us-news/2019/jun/17/recycled-plastic- america-global-crisis)

[https://www.boell.de/en/2019/11/04/waste-exports-rubbish- dum...](https://www.boell.de/en/2019/11/04/waste-exports-rubbish-dump-closed)

[https://www.statista.com/chart/18229/biggest-exporters-of- pl...](https://www.statista.com/chart/18229/biggest-exporters-of-plastic- waste-and-scrap/)

<comment><USER28> plastics is not solved, so we agree on that.. paper and aluminum can easily pay for itself when done well.. lots of dense consumer products are somewhere in the middle.. product design and materials make the difference in many cases

" so I'm not quite sure about which recycling projects you're talking about" .. there are ample business case studies of materials recycling that work, in certain markets, but they do not tend to be at the top of the web-based news

It is unduly onerous to claim "recycling doesn't work" IMO

</comment></comment></comment></comment></comment><comment><USER29> Meanwhile, Oil companies like Shell, are investing in production facilities to supersize plastic production, now that oil prices have fallen. [0]

And they are also trying to control the negative fallout [1]

[0] [https://qz.com/1689529/nurdles-are-the-biggest-pollution- dis...](https://qz.com/1689529/nurdles-are-the-biggest-pollution-disaster- youve-never-heard-of/) [1] [https://www.fastcompany.com/90295292/the-worlds- big-plastic-...](https://www.fastcompany.com/90295292/the-worlds-big-plastic- makers-want-more-recycling-so-they-can-keep-pumping-out-plastic)

</comment><comment><USER30> A few years ago I came up with the idea that instead of funding facial recognition, image-recognition technology could be used at dumps to recognize the brands associated with unrecycled trash passing through the chutes, then using that data to tax companies whose consumers create the most litter and throw away the most recyclables.

</comment><comment><USER31> Shouldn't we want this to actually end up in a landfill? That would be at least some kind of a carbon sink.

<comment><USER32> That's less of a carbon sink and more of a kick-the-can approach (no pun intended).

</comment></comment><comment><USER33> Is "somebody filed a lawsuit" really "news"? No. It's really only news if it survives motions to dismiss.

</comment><comment><USER34> shocked they aren't also getting sued for lying about having no sugar in diet/zero products

<comment><USER35> Can you explain what you mean?

<comment><USER34> artificial sweeteners just like real sugar are refined, processed, products that spike your insulin levels and cause all types of medical problems. To say that their product is zero sugar and zero calories is misleading and makes it seem as harmless as water.

<comment><USER35> I see, I wouldn't call it lying then. "Not sugar" does not imply "does not behave like sugar".

<comment><USER34> Wat

<comment><USER35> You claim that they're lying because their sweeteners behave like sugar inside the body. But they didn't claim that their products don't behave like sugar, they only claimed that they don't contain sugar, which is true.

</comment></comment></comment></comment></comment></comment><comment><USER36> What is the lie that Coke et al are being accused of making?</comment>


Organizing Large C Programs - <AUTHOR> http://www.cse.shirazu.ac.ir/~azimi/prog88/lectures/15large_programs.pdf

<comment><USER2> I'm disappointed that this isn't actually about organizing large C programs. A more apt title would be "basic introduction to C headers and linking".

How you organize million line projects is an interesting topic. Does anybody have any actual links?

<comment><USER3> > How you organize million line projects is an interesting topic. Does anybody > have any actual links?

Large Scale C++ Software Design by John Lakos is about that topic. Of course, C++ is its own special hell when it comes to physical coupling because of what tends to go (and sometimes has to go) in header files.

It's not a terrible book when considering the lack of alternative sources for the material covered, but a lot of its suggestions are showing their advanced age and were dubious and controversial even at the time of writing. Nowadays you have to take into account precompiled headers, unity builds, distributed build clusters, etc, when considering trade-offs in physical design for large code bases.

Free startup idea: Incredibuild in the cloud! Tell us how how fast you want your code base to build and you got it! You'd have to design and implement finer-grained distributed compiling and linking to overcome Amdahl's Law speed-up barriers and make it really competitive with something like Incredibuild for larger companies. But you could bootstrap it with coarser- grained distribution (distributed compiling at the file granularity but with non-distributed monolithic linking) a la earlier versions of Incredibuild while targeting smaller development shops without a lot of spare CPU cycles floating around the office. Making it dead simple to drop in and use with existing code bases would be key.

<comment><USER4> C is not C++. They have different issues, namespaces, abi linkage, libraries, various other things. They also have different application domains.

<comment><USER5> That is true, but the concepts in the Lakos book can be applied to both C and C++. Splitting units of code based upon physical dependencies and having a strong naming system are the basic underlying points. (Disclaimer: I work with John Lakos)

<comment><USER4> Thank you. The other guy appears to have been thinking I was stating that flippantly, when really a book that is about C++ file organization has to be trying to also be about C file organization.

C++ techniques don't apply to C only projects that often.

</comment></comment></comment></comment></comment><comment><USER6> I agree that this is kind of mistitled for HN - this is an intro to C - but it is actually a nice intro to C headers and linking if you have never seen that before.</comment>


Implementing Real-Time Trending Topics in Storm - <AUTHOR> http://www.michael-noll.com/blog/2013/01/18/implementing-real-time-trending-topics-in-storm/

<comment><USER2> I work on IBM InfoSphere Streams ([https://www.ibmdw.net/streamsdev/](https://www.ibmdw.net/streamsdev/)), and the language our system uses is SPL (Streams Processing Language). I was curious to see what this problem would look like implemented in SPL, so came up this this:

      composite Main {
      graph
        @parallel(width=2)
        stream<rstring word> Words = Custom() {
          logic onProcess: {
            while (true) {
              // a "word" looks like "0", "1", ..., "99"
              submit({word=(rstring)((int32)(random() * 100))}, Words);
            }
          }
        }

        @parallel(width=3, partitionBy=[{port=Words, attributes=[word]}])
        stream<rstring word, int32 rolling_count> Counts = Aggregate(Words) {
          window Words: sliding, time(9), time(3), partitioned;
          param partitionBy: word;
          output Counts: word=Any(), rolling_count=Count();
        }

        stream<rstring word, int32 rolling_count> Sorted = Sort(Words) {
          window Words: sliding, time(2), time(2);
          param sortBy: rolling_count;
        }

        stream<list<rstring word, int32 rolling_count> hist> Rankings = Aggregate(Sorted) {
          window Sorted: tumbling, punctuation;
          output Rankings: hist=Collect();
        }
      }

I did not parallelize the reduce part. I'd need to do some more thinking on how to do that, as I split it into two operators. I think it shows the flavor, though.

Two caveats: One, I have not compiled and tested this, so errors may abound. I was just curious what the "flavor" of it would look like in our system. Two, standard disclaimer of I speak in an unofficial capacity, what I say does not represent IBM or Streams.

</comment><comment><USER3> Michael Noll has some really good introductory articles to Big Data, and I highly recommend his posts for anyone starting in this field.

His post on writing Python streaming programs in Hadoop - [http://www.michael- noll.com/tutorials/writing-an-hadoop-mapr...](http://www.michael- noll.com/tutorials/writing-an-hadoop-mapreduce-program-in-python/) \- got me started in this area two years ago, and that's what I'm still doing these days! :)

</comment><comment><USER4> I read this one a few months back & felt, like most programmers, that it was an awesome article, but I would forget all of it unless I rewrote everything from scratch all by myself :) So here's my rewrite in Scala - its not realtime, but still takes only 4 minutes on my laptop for a typical weekly dataset, so you can put it on a cron schedule & get a trending topics with a 5 min delay. Ofcourse, no storm, no hadoop etc. just a plain old scala program anybody can run on their laptop. [http://bit.ly/J82szS](http://bit.ly/J82szS)

<comment><USER5> Maybe check out Spark [1], it primarily supports Scala and they have great streaming functionality that seems to beat out Storm and others in terms of performance for some workloads [2].

[1] [http://spark.incubator.apache.org/](http://spark.incubator.apache.org/)

[2] [http://www.cs.berkeley.edu/~matei/papers/2013/sosp_spark_str...](http://www.cs.berkeley.edu/~matei/papers/2013/sosp_spark_streaming.pdf)

</comment></comment><comment><USER6> Sorry for the shameless trolling, but if you are a fan of storm and see potential in the real-time side of big data, consider applying to work on the Platform team at WebAction.

We're a well-funded company (raised an $11m Series B from a $15billion private equity firm) real-time big data analytics company for the enterprise. We're based in Palo Alto. If interested, feel free to shoot us a message!

email@example.com

</comment><comment><USER7> Storm (and Trident) are just fantastic. If you're looking for a streaming complement (or replacement!) for Hadoop, you can't go wrong here.</comment>


Sheryl Sandberg and Adam Grant on Women Doing 'Office Housework' - <AUTHOR> http://www.nytimes.com/2015/02/08/opinion/sunday/sheryl-sandberg-and-adam-grant-on-women-doing-office-housework.html <comment><USER2> Some interesting points in there, but it was tough to see them in the intense anecdote fog and non-sequitur soup.

<comment><USER2> An example: "Just as we still need to rebalance housework and child care at home"

No, we in fact, do not. The amount of time men spend on housework and their job each week is greater than the amount of time women do: [http://www.usatoday.com/story/news/nation/2013/03/14/men- wom...](http://www.usatoday.com/story/news/nation/2013/03/14/men-women-work- time/1983271/) "Work time — paid at a job and unpaid at home — is almost equal for American men and women, says a report out today that shows men clocking in at 45.6 hours a week and women at 45.2."</comment></comment>


Should we use [paywall] tag where applicable? - <AUTHOR> Idea shamelessly stolen from petercooper: https://news.ycombinator.com/item?id=16859287<p>With the grow of paywalled content getting to the first page, could we please start marking it somehow? It could help avoid disappointment when a link leads to an inaccessible content. <comment><USER2> yes. please. Better would be to just automate it because there aren't THAT many paywalls i get linked to from here. Just have a list of paywall sites and have the back end preface the the link with it.

<comment><USER3> While I would agree in theory, it seems that the people at Y Combinator are not really intending to touch the HN code base.

</comment></comment><comment><USER4> No. Support high quality journalism.

<comment><USER5> Wait, what? How would adding an indication that the article is paywalled inhibit/hamper support for high quality content?

If an article is paywalled and I don't have any indication about this, I would open the link, notice it's paywalled and then decide whether to pay or not. If a tag is present, this just moves the decision early in the process.

So, again, how would not using such a tag help support high quality journalism?

<comment><USER6> I'm not sure if your question is rhetorical or not. But if you really are wondering, it's because if we click the link, chances are that we read that first paragraph of text paywalled articles usually show. That makes us interested/curious and we might pay to view it. We also feel more invested in the content after that first click.

If we only have the title in the HN feed chances are lower that we will buy the content instead of simply scrolling by. Since the latter that takes less effort.

We humans don't always make rational choices, so nudging us in the direction of paying for content – if we want to support payed content – will of course increase the amount we spend on content.

<comment><USER7> I disagree with this line of thought.

Giving readers a fair warning is the right way to go.

</comment></comment></comment></comment><comment><USER8> How about not allowing such content?

<comment><USER9> This is the real solution. Adding a tag will just draw people to complain about paywalls.

</comment></comment><comment><USER5> In my opinion yes. It will probably just save me a couple of clicks, but it's irritating, especially on mobile.

</comment><comment><USER10> Where would that end? Would links to content that's only partially visible such as to previews on the Amazon store, or to Google books, get a tag, too?

What about geographically restricted content (parts of BBC.co.uk)?

What about pages that beg for donations, either extremely politely (theGuardian.com) or more aggressively (Wikipedia.org)?

</comment><comment><USER11> This would have been better as a poll. [https://news.ycombinator.com/newpoll](https://news.ycombinator.com/newpoll)

The people submitting the article don't always know it's paywalled. Either they have a subscription; or they haven't hit their article limit this month; or the article is free for a few days and paywalled later.

So any tagging would be inconsistent.

</comment><comment><USER12> Yes, please. It would be useful for me, especially when I browse HN on my phone.

</comment><comment><USER13> Yes.

</comment><comment><USER14> Yes, absolutely.

</comment><comment><USER15> +1 for tagging

</comment><comment><USER16> Yes, a paywall tag should be visible so the reader can know that it can't be read. Makes it much easier too.

</comment><comment><USER17> yes, please, especially when someone is liking Wall Street Journal here!

<comment><USER18> I fell into the trap of subscribing to the WSJ once. When you want to cancel your subscription, you have to call an international number where they try and stop you from canceling. There is no way to cancel online -- not only annoying but also against Dutch law.

</comment></comment><comment><USER19> Another vote for the [paywall] tag

</comment><comment><USER20> Yes Please!

I just close articles that are paywalled

</comment><comment><USER21> If it means no more tedious complaint threads about paywalled content, then yes.

But what am I saying? Tagging them will probably just draw people in faster to complain about it harder.</comment>


Free email verification API - <AUTHOR> https://trumail.io <comment><USER2> This will work really well at small scale. As you start to make large volumes of queries against major email service providers, they will start blocking you. It then becomes a cat and mouse game as you move IP address is constantly to try to avoid detection. The only long-term strategy for recipient validation that actually works is to partner with somebody who sends a great deal of legitimate email, and mine their logs.

Source: My company runs a large scale email sending service. Inquire within.

<comment><USER3> Keep in mind, this falls under GDPR regulation (data mining email addresses).

"Personal data is any piece of data that, used alone or with other data, could identify a person.

If you collect, change, transmit, erase, or otherwise use or store the personal data of EU citizens, you'll need to comply with the GDPR."

If you don't provide services to EU residents, this isn't applicable.

[https://kb.mailchimp.com/accounts/management/about-the- gener...](https://kb.mailchimp.com/accounts/management/about-the-general-data- protection-regulation)

</comment></comment><comment><USER4> Can this replace BriteVerify or Kickbox? It looks like this would have trouble scaling based on the comments. Is that at hundreds, thousands or millions of emails per month?

</comment><comment><USER5> Are all SMTP servers set to complain if the RCPT TO address doesn't exist?

<comment><USER6> No. Many SMTP servers are set to reply with "250 ok" for any provided RCPT TO address.

</comment></comment><comment><USER7> nice work man</comment>


Understanding Raft Consensus - <AUTHOR> https://www.micahlerner.com/2020/05/08/understanding-raft-consensus.html <comment><USER2> Really liked the article. Thought it provided a clear description what Raft is for, how it works, and its historical motivations.

</comment><comment><USER3> Very recent discussion of the original Raft paper: [https://news.ycombinator.com/item?id=23113419](https://news.ycombinator.com/item?id=23113419)

</comment><comment><USER4> Came here thinking this has to do with an ocean survival ordeal, then realized where I am.</comment>


Tesla is raising the price of its full self driving option - <AUTHOR> https://techcrunch.com/2019/04/13/tesla-is-raising-the-price-on-the-future/ <comment><USER2> They are acting as if this "full self driving" silicon is rather expensive...

I dont doubt that, because designing a large fully custom recent tech node ASIC is a very expensive endeavour, and the engineering cost will be huge when divided over just 100k units.</comment>


Have a few easy GitHub issues you want completed? Add them here - <AUTHOR> https://github.com/danielcgold/10-minute-tasks <comment><USER2> If the tasks only take 10 minutes, why not just do them instead of asking for someone else to do them?

<comment><USER3> to encourage others to start contributing to open source</comment></comment>


Peter Thiel and Sean Parker are financing a secretive cancer-fighting startup - <AUTHOR> https://www.cnbc.com/2017/10/04/peter-thiel-sean-parker-invest-in-3t-bioscieneces-to-fight-cancer.htmlThanks <comment><USER2> Actual URL:

[https://www.cnbc.com/2017/10/04/peter-thiel-sean-parker- inve...](https://www.cnbc.com/2017/10/04/peter-thiel-sean-parker-invest- in-3t-bioscieneces-to-fight-cancer.html)</comment>


Ask HN: What's With The Dropbox Link Fiasco? - <AUTHOR>

Is anyone else affected by this?
https://blog.dropbox.com/2014/05/web-vulnerability-affecting-shared-links/
They simply disabled all sharing of all links with no notice whatsoever - no emails - no nothing. I found out via customers emailing me telling me I have broken links everywhere.
This is a major issue that seems to be handled in a very cavalier fashion. Ridiculous. <comment><USER2> Absolutely. It was a sudden, rash, and frankly insane response to a long- standing and well-known issue with shared links. (All simple 'secret-URL' implementations of shared links have the exact same problem).

As a Dropbox for Business customer, the lack of notification was completely unacceptable. A service that costs us thousands of dollars a year cannot do this to us -- we are re-evaluating our (my, sigh) decision to go with Dropbox.

They get partial credit for quickly offering more options -- they responded to my infuriated email ("Subject: Are you insane? Turn my links back on!") on the day of the clusterfuck within 16 hours with an offer to re-enable all of our links.

But still, the damage (to their reputation, in my company's eyes) had been done.

If I was on a free 2GB personal account, I would be like 'urrrgh, but whatever', but on a $3600/year 'business' account, you can't just unilaterally do shit like that with no opt-out or workaround available.

</comment><comment><USER3> Consider how this would have played out if they didn't shut down the links and then someone hacked an "important" document? It would have been way worse overall.

Not notifying the customers was not a good move however.

<comment><USER4> I believe some important documents were accessed via this loophole -

[http://grahamcluley.com/2014/05/dropbox-vulnerability- privac...](http://grahamcluley.com/2014/05/dropbox-vulnerability-privacy/)

</comment></comment><comment><USER5> I wonder if this had anything to do with it? Interesting application that would carry a few links...

[http://www.droptalk.us/](http://www.droptalk.us/)

<comment><AUTHOR> What does this have to do with it at all?</comment></comment>


Windows Terminal Preview v0.3 Release - <AUTHOR> https://devblogs.microsoft.com/commandline/windows-terminal-preview-v0-3-release/ <comment><USER2> With WSL and this Microsoft is really doing good work to make developers happy. I'm pretty optimistic about the state of development on Windows.

</comment><comment><USER3> Unix style copy and paste (select on copy, right click on paste) seems to be working in this release too.</comment>


Is chroot a security feature? - <AUTHOR> https://access.redhat.com/blogs/766093/posts/1975883 <comment><USER2> So the basic argument is that if you can become root you can escape the jail. So if you have access to a vulnerable program you can become root and escape.

This might be true, but it's still a good practice for defense in depth and _does_ offer a security benefit. It helps protect you when there are non-root flaws in software. For example a web server that lets clients get to directories with '..' notation. Even with that compromised software, they wouldn't be able to get to /etc or /home if they are in a proper chroot.

<comment><USER3> There are several more ways you can escape chroot(2) through VFS attacks (nd->root protections are very minimal).

However, the more important point should be that there is a similar syscall which doesn't have the same flaws as chroot(2) because the protection is based on mount namespaces -- pivot_root(2). The problem with chroot(2) is that the mountpoints above "/" are still accessible by the VFS internally. pivot_root(2) gets rid of the mounts and so VFS won't reach them anymore.

<comment><USER4> I see there's a similar wrapper binary - but apparently you need to both pivot and chroot?

[https://linux.die.net/man/8/pivot_root](https://linux.die.net/man/8/pivot_root)

<comment><USER3> The man page is out-dated (and Michael Kerrisk has posted on LKML that he plans to rewrite it). You don't need to do chroot("/") -- that operation makes no sense because there is no semantic difference between chroot("/") and doing nothing (even the kernel can't distinguish the two cases).

What you need to do is the following:

      mkdir newroot/oldroot
      mount --rbind newroot newroot # if newroot isn't a mountpoint
      pivot_root newroot oldroot
      cd /
      # and now get rid of the old root's mounts
      mount --make-rslave oldroot
      umount -lR oldroot

At least, approximately. There is a more clever way to do it by doing "pivot_root . ."[1] but posting that here just makes it more confusing. As a complete aside, this is what container runtimes do when switching to the container rootfs -- and is the main reason why --no-pivot-root is _incredibly_ insecure (because it uses chroot).

[1]: [https://github.com/opencontainers/runc/blob/v1.0.0-rc8/libco...](https://github.com/opencontainers/runc/blob/v1.0.0-rc8/libcontainer/rootfs_linux.go#L700-L757)

</comment></comment></comment></comment><comment><USER5> Many comments in this thread are bashing the article for saying that _chroot_ is useless or shouldn't be used. However the article itself takes a more nuanced approach.

From the conclusion:

>It is not hard to consider the chroot() system call a security feature. In theory, it sounds great, but if you really take the time to understand what is going on, it is not really a security feature, it is closer to what we would call a hardening feature. It might slow down an attacker, but in most situations it is not going to stop them. We are dealing with a situation where calling this a security feature is likely more damaging than not because it creates a false sense of security. It is human nature to let our guard down if we believe we are safe. Using chroot is no safer than not using a chroot. You would be far better off investing your resources into a custom SELinux policy and ensuring your system is properly hardened. Good security has no shortcuts.

I think the point is that you shouldn't consider _chroot_ the only or best option for securing your system. It's just one tool in the toolbox and needs to be understood properly and not trusted blindly as the solution for all security vulnerabilities.

<comment><USER6> > the article itself takes a more nuanced approach

Let's see what the article says:

> Using chroot is no safer than not using a chroot.

Not very nuanced in my opinion.

Few people argue we should replace chroot calls with SELinux these days. The article is interesting from a historical perspective but clearly needs a "(2013)" context.

<comment><USER7> The article is inconsistent about chroot, but regarding SELinux, it has a point. SELinux looks like an old and solid mechanism to isolate processes from each other. Nowadays we have lxc to do that as well, but it does not make SELinux useless.

</comment></comment></comment><comment><USER8> How can this even be a question 20 years after FreeBSD Jails ?

[https://papers.freebsd.org/2000/phk- jails/](https://papers.freebsd.org/2000/phk-jails/)

</comment><comment><USER9> _Nothing would prevent root from just modifying the process memory directly to change the chroot() location back to '/'._

Huh? The chroot root directory is stored in the kernel, in the task structure, not in process memory. For that matter, every process can modify its own memory, not just root.

It is in fact a bug, or at least a design flaw, that root can break out of chroot. For instance, the Unix filesystem, historically, at the VFS layer (or whatever Linux calls it), has a simple tree structure, Unix allows nested chroots, and chroot(2) doesn't chdir(2) you into the new root. If you chroot to a subdirectory of your root and don't chdir into it, Unix is too dumb to know you're "above" your current root.

<comment><USER10> Yeah, I assume the author meant to write "kernel memory" there. I think what they were getting at is that root could theoretically mknod a /dev/mem device inside the chroot jail and then modify kernel data structures through it. Or root could issue an init_module(2) syscall to install a kernel module that breaks out of the jail.

<comment><USER9> Right, but on modern Linux, you're a seccomp call away from blocking those vectors. The inadequacy of chroot was a more coherent story to tell 10 years ago, but now, it seems silly to suggest that chroot isn't a security feature; it is, it's just part of an ensemble of related features that need to be deployed in concert.

<comment><USER11> This isn't true. For example containers use pivot_root instead of chroot or MS_MOVE because there are specific security issues with keeping a reference to the parents mount table.

If you care about security there is no reason to use chroot on Linux, there are better approaches.

<comment><USER9> Is there a vulnerability pivot_root breaks that applies to unprivileged users? I wrote quickly and imprecisely and agree that in general chroot isn't especially helpful against the superuser (for a bunch of reasons).

</comment></comment></comment></comment></comment><comment><USER12> I can't believe this guy works for redhat.

> you are no safer inside a chroot than relying on system permissions to keep > a user in check

But how may systems lock down every executable in /bin and /usr/bin?

Chroot is about denying an attacker a hackers toolkit when they get access.

It's not just about hacking the current system, but the network.

No gcc? No netcat or ssh or netstat? Or even bash? The first thing hackers look for is what tools are available on the system, and denying them any is a form of security. This had been known for _decades_.

</comment><comment><USER13> chroot() started out as just a chdir() operating on root directory instead of current directory.

[https://utcc.utoronto.ca/~cks/space/blog/unix/ChrootHistory](https://utcc.utoronto.ca/~cks/space/blog/unix/ChrootHistory)

</comment><comment><USER6> > Using chroot is no safer than not using a chroot.

This is terrible advice. Software should drop privileges early, and chroot is as important as it has ever been. Other useful things include seccomp-bpf and pledge.

OpenSSH and Postfix is absolutely safer because they drop privileges after reading configuration and binding ports.

<comment><USER3> The problem is that there are many well-known ways to get around chroot(2) (which don't require privileges). This includes /proc-related escapes as well as more general VFS attacks.

Really, tools should have switched to using pivot_root(2) a decade ago instead of continuing to use chroot(2). Unfortunately this article completely ignores the existence of pivot_root(2) -- which makes it read as though they are trying to convince people to stop using root-switching a security feature (which is definitely bad advice).

<comment><USER14> I've never seen this advice, would you mind elaborating or citing a more elaborate source?

Since pivot_root requires the old root to be a child of the new root, traversing back to the full system seems trivial. Actually, I don't see why this syscall isn't worse than chroot due to this.

<comment><USER3> > Actually, I don't see why this syscall isn't worse than chroot due to this.

You can (and everyone does) unmount the oldroot. Then in your mount namespace the old root is not reachable through the VFS alone. You need to make use of procfs's magic-links or other such tricks.

</comment></comment></comment></comment><comment><USER15> chroot is a layer in the security onion.

Like every other layer it adds security but isn't perfect. Security will never be 100%. If you want more security, then likely you want another layer in the onion.

<comment><USER3> Yes, but pivot_root(2) is a far more robust and secure way of doing the same thing. There really is no reason to use chroot(2) instead of pivot_root(2) (unless you are running code on initramfs -- and even then you should do the tmpfs trick that everyone else uses).

<comment><USER16> > There really is no reason to use chroot(2)

You mentioned intiramfs yourself, but there are other uses of chroot where security doesn't play a role. Deterministic build environments are an example.

</comment></comment></comment><comment><USER17> This article is entirely FUD.

chroots are useful when running software which we don't necessarily know is secure. It reduces the impact of flaws in software we don't control.

The point is taken that proper permissions would effectively be no different from a chroot, but this is disingenuous, particularly if considered with the statement, "but note that setting up a chroot can be far more complex than configuring a system".

This is pure hyperbole and deserves to be called ridiculous. Compare configuring a chroot, which is easy, straightforward, common and well understood with configuring a user to exclude access to everything in a system except what the chroot would allow, and try to reasonably suggest that the chroot is more complex.

You can do lots with login.conf, but hang on - systemd does things differently. So instead of decades of well understood chroot history, now you have to figure out how login.conf works with systemd. Then you have to figure out what version of systemd it is, and whether behavior has changed, and whether documentation even matches your system's systemd...

In other words, this whole article has no purpose aside from trying to disparage chroot without any actual, meaningful information.

So how does Red Hat benefit? Of course Red Hat doesn't want people running lots of processes in a single installation. They want people to run a ton of system images in huge VM environments and have people become accustomed to needing lots of resources to do the simplest of things. This makes paying Red Hat for "support" easier to swallow. One instance with lots of tasks? Insecure, according to them. A separate VM for each program? Much better, if you believe them :P

<comment><USER18> Nonsense. Red Hat supports containerization in more ways than I can count. Also, most businesses running RHEL in a VM environment (like ESX) are using per host licensing where you can run an unlimited number of RHEL VMs on a single physical host.

</comment></comment><comment><USER19> "it is not really a security feature, it is closer to what we would call a hardening feature. It might slow down an attacker, but in most situations it is not going to stop them."

Does his argument boil down to this? If so this seems like a silly argument over semantics. Is there anything in existence that can "stop" an attack?

</comment><comment><USER20> If you forget to setuid after chroot it's much less secure :P I have a free online service where anyone can run any code on a fairly powerful dedicated server. And it uses chroot, setuid, iptables and Apparmor. It has not yet got pwned, knock on wood.

</comment><comment><USER21> I don't understand why the article recommends pivot_root. Its man page says that it _may or may not change the current root and the current working directory of any processes or threads which use the old root directory,_ which means it can change the root _of other processes!_ Also, it says that its typical use is for switching from the boot RAM disk to the actual root filesystem. This is an entirely different use case than chroot, and doesn't seem to have any security benefits either.

</comment><comment><USER22> That's why FreeBSD created jails, the idea was to actually make a secure chroot.

The original purpose of chroot was nothing more than control where an installer installs its files.

</comment><comment><USER23> IMO, chroot is good for changing root :) but not for security. Example: zfs clone your current root, chroot there, experiment / test /etc.

</comment><comment><USER24> > Putting a regular user in a chroot() will prevent them from having access to > the rest of the system. This means using a chroot is not less secure, but it > is not more secure either. If you have proper permissions configured on your > system, you are no safer inside a chroot than relying on system permissions > to keep a user in check

Lol. So, all security mitigations ever are pointless.

</comment><comment><USER25> Wait, are there people who really think chroot offers security?

I mean, at least read the man page before making assumptions?

[http://man7.org/linux/man- pages/man2/chroot.2.html](http://man7.org/linux/man-pages/man2/chroot.2.html)

> This call changes an ingredient in the pathname resolution process and does > nothing else.

> It is not intended to be used for any kind of security purpose, neither to > fully sandbox a process nor to restrict filesystem system calls.

> In particular, the superuser can escape from a "chroot jail" by doing: mkdir > foo; chroot foo; cd ..

> However, if a folder is moved out of the chroot directory, an attacker can > exploit that to get out of the chroot directory as well. The easiest way to > do that is to chdir(2) to the to-be-moved directory, wait for it to be moved > out, then open a path like ../../../etc/passwd.

EDIT: Fixed link to a more up-to-date man page. They explicitly call this out as not being a security feature in the updated man page.

<comment><USER26> But isn't chroot typically used by normal users anyway ?

<comment><USER27> Maybe were you thinking about fakeroot ?

"fakeroot runs a command in an environment wherein it appears to have root privileges for file manipulation. This is useful for allowing users to create archives (tar, ar, .deb etc.) with files in them with root permissions/ownership."

[https://man.cx/fakeroot(1)](https://man.cx/fakeroot\(1\))

</comment></comment></comment><comment><USER28> If an unprivileged process can gain super user privileges, you have a problem. This applies to both situations with chroot and those without chroot.

</comment><comment><USER11> To understand just how trivial it is to escape a chroot with root, just run "nsenter -m -t $$" and your out.

<comment><USER29> That doesn't work for an unprivileged user, does it?

</comment></comment><comment><USER30> Is systemd-nspawn more secure?

<comment><USER31> cyphar made a lot of comments here on usage of mount namespaces and pivot_root.

</comment></comment><comment><USER32> Not really.</comment>


Caporal.js: Build Awesome CLI Apps with Node.js - <AUTHOR> https://github.com/mattallty/Caporal.js <comment><USER2> Hey Matthias, I often build CLI programs using Commander [1]. Caporal seems very similar. Can you tell me why I'd choose your library over the alternative? Thanks and congrats on the work so far.

1\. [https://github.com/tj/commander.js](https://github.com/tj/commander.js)</comment>


VMware Photon and dnf - <AUTHOR> http://lists.rpm.org/pipermail/rpm-ecosystem/Week-of-Mon-20150420/000011.html

<comment><AUTHOR> GitHub repo: [https://github.com/vmware/tdnf](https://github.com/vmware/tdnf)</comment>


The Future of Dart Is Dim: Another Failed Experiment? - <AUTHOR> https://medium.com/@richardeng/the-future-of-dart-is-dim-51756c0346f

<comment><USER2> I think what hurts the adoption of Dart most are articles like these which advise to stay away from it.

The language itself is really good and nice to work with, the libraries are well designed and quite feature-complete and theres a good amount of tooling available.

Regarding the server (or general application development) comparison: I think the real opponent is node and not Go, because both use a singlethreaded model with lots of async functionalities (callbacks, futures). For some types of applications this is much easier than handling real threads/goroutines, for others you might want real parallelism.

</comment><comment><USER3> These posts are really dumb IMHO, Dart has a long road ahead of it.</comment>


Note from Don Knuth – bug(s) in MetaPost? - <AUTHOR> https://www.tug.org/pipermail/tex-k/2014-January/thread.html

<comment><USER2> OK, so Dr. Knuth is alive and well, and reporting a bug. Is there more to this that I'm not seeing?

<comment><USER3> MetaFont and TeX are both known for being bug-free because Knuth offered cash rewards for finding them—famously, he no longer does this because he had issues with people not cashing his checks. So it's highly unusual to find bugs, and is generally considered newsworthy these days.

EDIT: MetaPost -> MetaFont

<comment><USER4> > he no longer does this because he had issues with people not cashing his > checks.

Slight correction - he had issues with people attacking his checking accounts: [http://www-cs-faculty.stanford.edu/~knuth/news08.html](http://www-cs- faculty.stanford.edu/~knuth/news08.html)

</comment></comment></comment><comment><USER5> How does one yawn into the abyss knowing that Dr Knuth himself produced "MULTIPLE errors" in writing code to ... draw a dot.

<comment><USER6> MetaPost is not by Knuth, it is based on his own (presumably correct) code from Metafont.

[http://en.wikipedia.org/wiki/MetaPost](http://en.wikipedia.org/wiki/MetaPost)

</comment></comment><comment><USER7> He doesn't even have his own email anymore and has to borrow someone else's?

<comment><USER2> Dr. Knuth doesn't do email quite like you might expect.

"My goal is to do this communication efficiently, in batch mode --- like, one day every three months."

[http://www-cs-faculty.stanford.edu/~knuth/email.html](http://www-cs- faculty.stanford.edu/~knuth/email.html)

<comment><USER8> "Email is a wonderful thing for people whose role in life is to be on top of things. But not for me; my role is to be on the bottom of things."

So I think we all read that and think we want to be a bit more like Don Knuth, eh?

I've met Dr Knuth a couple of times. He's a lovely man, rather modest and just a little nervous. There are some in the industry I've met who know of their infamy and carry it less well.

Last time I spoke to Don, he was stood on a low/wide window ledge of Manchester (UK) Town Hall watching the Olympic flame make it's arrival there in the Spring of 2012.

We were both attending a conference held there in honour of Alan Turing's 100th birthday. Also in the room were Fred Brooks, Vint Cerf, Tony Hoare, Samuel Klein and various other amazing names from computer science and a few other names of note who aren't quite so "classic" yet (David Ferrucci of IBM Watson project, Gary Kasparov, etc.).

This is the first and last time I will ever name drop, and I swear I have no idea how I ended up in that room with that company. But it was pretty cool.

And Don did not fall out of the window, and I was relieved I did not witness same. That would have scarred me for life.

Anyway, he's got the right idea. We should all be more like Don.

<comment><USER9> Surely you mean "fame" and not "infamy".

<comment><USER10> Perhaps both words could be equally applicable in this respect. :-)

</comment></comment></comment></comment></comment><comment><USER11> > I ran this with newly installed MacTeX from the TeX Collection 2013.

Then this:

>Unfortunately the Ubuntu engine that converts PostScript to my

So Mr. Knuth's using a Macbook and Ubuntu at the same time.

<comment><USER3> Yup—he's spoken about it[1]:

> I currently use Ubuntu Linux, on a standalone laptop—it has no Internet > connection. I occasionally carry flash memory drives between this machine > and the Macs that I use for network surfing and graphics; but I trust my > family jewels only to Linux. Incidentally, with Linux I much prefer the > keyboard focus that I can get with classic FVWM to the GNOME and KDE > environments that other people seem to like better. To each their own.

[1]: [http://www.informit.com/articles/article.aspx?p=1193856](http://www.informit.com/articles/article.aspx?p=1193856)</comment></comment>


Ask HN: Stripe-alike Payment gateway which allows creating product on the fly? - <AUTHOR>

Is there any payment service that provide something like Strpe's create charge API which allows website to create orders on the fly, instead of having to set up the product in advance ?
ps. we love stripe but not in the US :(
thanks. <comment><USER2> something like <https://gumroad.com> ?</comment>


Active P0f Inside Kernel - <AUTHOR> https://github.com/xpahos/p0f_ebpf <comment><USER2> Is this p0f or the later p0f3?

Does anybody have an p0f3 fingerprint files later than those that Zalewski put in the distribution? They're 3+ years out of date at this point,

<comment><AUTHOR> No, it's not full implementation. The main difference between this and Zalewski implementation is using direct mapping data between kernel space and userspace. Zalewski implementation uses pcap for capturing packets. If you have huge workloads you can try this [https://gist.github.com/xpahos/4bc215aa5fe237161bc076f247643...](https://gist.github.com/xpahos/4bc215aa5fe237161bc076f24764304f) to try multithreaded capturing packets([https://github.com/the-tcpdump- group/libpcap/pull/674](https://github.com/the-tcpdump- group/libpcap/pull/674)).

My implementation creates a hash map between kernel space and userspace where eBPF(kernel space, directly from sk_buff) code stores parsed data in this map. After accepting a connection in userspace application could check this hash map and get data from kernel space to userspace. So it's possible to add p0f extra data to request headers directly inside load balancer/web server and pass it to underlying levels.

> Does anybody have an p0f3 fingerprint files later than those that Zalewski > put in the distribution? They're 3+ years out of date at this point,

I don't know. Another team uses fingerprinting to check if it's a robot.

</comment></comment><comment><AUTHOR> Hope someone will find this code useful in his project. This is a proof-of- concept, full code can't be published.

</comment><comment><USER3> I thought the typing was ageing out. Can this still reliably detect client platform/architecture?

<comment><AUTHOR> We use fingerprinting to detect unusual activity from clients. I think for platform detection it will be better to check JavaScript + User-agent + fingerprint.</comment></comment>


Follow-up Case Study to "Need For Speed" Ad CTRs - <AUTHOR> http://blog.ads.pof.com/2012/04/05/follow-up-case-study-with-your-suggestions-implemented/

<comment><USER2> This depends _hugely_ on the audience and what's around them on the page, but I'd guess the most noticeable and therefore most clicked ad would be the Microsoft Paint, No Logo, Gold Car.

OTOH, I'd guess the 1st or 2nd ones in the list would be near the top for downloads resulting in paid conversion.

But I find these produced ones generally poor, so it's hard to predict.

<comment><USER3> That's the fun part of it all, being surprised by the end result and back tracking to speculate as to why it happened. I'm targeting US, Men, 18-23, loves/likes games and puzzles and excluding mobile traffic (as this is a computer game).

</comment></comment><comment><USER4> [http://blog.hubspot.com/blog/tabid/6307/bid/20566/The- Button...](http://blog.hubspot.com/blog/tabid/6307/bid/20566/The-Button-Color- A-B-Test-Red-Beats-Green.aspx)

"The red button outperformed the green button by 21%."

Be interesting to see the tests with/without the EA logo, but using a red button instead of a green one.

</comment><comment><USER5> The _real_ lesson from the last article was "test everything." Likewise, the _real_ lesson from this article is "iterate and improve."

I'm totally banking on MS Paint being the most significant variable. The professional-looking ads have a bunch of tiny text in a font/style with poor readability. MS Paint "text" is legible from orbit.

</comment><comment><USER3> Cheers Tyler :D Hope everyone enjoys it.

</comment><comment><USER6> Does he ever say what his sample size is for these ads?</comment>


Russian Hackers Reach US Utility Control Rooms, Homeland Security Officials Say - <AUTHOR> https://www.wsj.com/articles/russian-hackers-reach-u-s-utility-control-rooms-homeland-security-officials-say-1532388110 <comment><USER2> Here's some previous research by Homeland Security [1] showing that generators can be destroyed remotely, from 2007.

[1] [http://www.cnn.com/2007/US/09/26/power.at.risk/index.html](http://www.cnn.com/2007/US/09/26/power.at.risk/index.html)

</comment><comment><USER3> Just imagine how may U.S. companies they have back doored in India.</comment>


ZumoDrive announces pricing (and it's cheaper than it seemed) - <AUTHOR> http://blog.zumodrive.com/being-transparent/

<comment><USER2> So that's roughly the same as storing everything on S3 and downloading almost all of it once per month. Of course it has functionality as well, so the pricing appears reasonable to me if used for data that is actually used and not just archived.

<comment><USER3> Interesting - I wonder if they can/do detect identical files and store them once?

One of the storage solutions I worked on did this - EMC Centera - mostly to handle email archive (in corporates you can end up with the same attachment duplicated many times over - it's a bit of a pain).

<comment><USER4> I built a file storage web system several years ago (very popular when free, but when the free beta ended not many people wanted to pay). We computed the hash of each uploaded file, and only stored one copy of the file based on the hash. The database based filesystem simply recorded the hash of the file as basically a pointer to the actual file. This allowed multiple people to have the same file, with different file names (stored in the db), but only actually store the file once. Very simple.

</comment></comment></comment><comment><USER5> Looks good, but I can't stand the cheesy fake-bubbly voiceover on the video. I keep expecting her to tell me it's only 3 easy payments of $19.95 and if I order in the next 10 minutes I'll get a free [something... ]

Anyway, good work, but please rethink the video.

<comment><USER6> The video is cheesy, but I thought that it was entertaining.

</comment></comment><comment><USER3> Does anyone know - Do you sign up for an account of size "X", or do you just get an account and they bill based upon how much you use?

<comment><USER7> When you sign up, they ask you what size you want. I haven't gotten an account yet, I just saw an image of it from:

[http://www.mobileindustryreview.com/2009/01/zumodrive_is_goi...](http://www.mobileindustryreview.com/2009/01/zumodrive_is_going_to_change_everything.html)

<comment><USER3> Ah ok - think a usage based account with a cap would be a good option too.

</comment></comment></comment><comment><USER8> $2.99/month for 10gig is not too shabby!

<comment><USER9> How about $2.25 a month for 250gig instead?

<comment><USER10> Where?

<comment><USER9> Buy a 250gig Buffalo TurboUSB 2.0 external drive for $80 and it works out to less than $2.25 a month assuming a 3 year life span -- the duration of the manufacturer's warranty.

Then you'll have all your data with you all time time so you'll never have to be online to access it, and you'll never have to worry about some 'service company' losing your data or allowing it to get into the wrong hands, and you'll never be subject to the company going out of business.

In other words, take responsibility for storing your own data -- on your own hardware -- instead of trying to find excuses to pay someone else to store it in the cloud for you.

:)

<comment><USER11> There is cost in overhead, too. Beyond getting the drive:

      - Connecting it to the internet so you can access it from anywhere
      - Setting up iTunes to stream properly
      - Setting up a mechanism that caches recent/popular files locally
      - Develop an iPhone app to access the drive</comment></comment></comment></comment></comment>


OpenVPN Unprivileged User Guide Allows Exec as Root - <AUTHOR> https://community.openvpn.net/openvpn/wiki/UnprivilegedUser <comment><USER2> The warning tells people not to follow the guide, but leaves the dangerous steps in place / doesn't recommend any alternate course of action.

<comment><AUTHOR> You are right, that should be done. As I did not place the warning nor know what a fix could be we can just hope someone is up for the task.

</comment></comment><comment><AUTHOR> Do not use this guide as it allows everyone with access to the process to run _any_ command as root. A warning message has been added yesterday.</comment>


Ferguson and reverse racism - <AUTHOR> https://www.truthmapping.com/map/1394/

<comment><USER2> "Reverse racism" is like "political correctness" in that anybody who uses it in seriousness is going to have shitty opinions.</comment>


Judge Calls His Own Expert at Oracle/Google Patent Trial - <AUTHOR> http://www.law.com/jsp/cc/PubArticleCC.jsp?id=1202513513207&Judge_Calls_His_Own_Expert_at_OracleGoogle_Patent_Trial

<comment><AUTHOR> I once clerked for a federal judge who was part of the old-style "hands off" school of judging - let the parties fashion their own cases and let the court operate around the edges to make sure they stay in bounds. That style of judging had its advantages but it was horrible for case management. My judge wound up with nearly 400 active cases on his docket on average while judges who more actively managed their cases trended toward the low 200s. Litigants in any given case, then, might have a sense of having more control over their cases but the overall pattern was one of interminable delays as dockets and calendars got clogged with more and more situations where lawyers played out their antics without too much supervision.

Judge Alsup is of a different school. He is definitely "hands on" and handles cases in ways that put the parties under significant pressure to trim their marginal claims and defenses, to scale back on wild discovery forays, and to give serious consideration to getting to an expeditious trial (or settling) rather than potentially be steamrolled by the judge (for example, as he has impliedly threatened to do to Oracle, if it otherwise did not trim its wilder claims, by sending it packing while he stays the litigation pending patent reexaminations). One can agree or not with such a style and it can sometimes border on judicial abuse but it definitely leads to leaner dockets and calendars that are far less cluttered with marginal garbage than one would find on the docket of a more latitudinarian judge. A good (but strict and tough) judge will only play this out in areas where the judge has lawful discretion to make such calls because trying to force things that are plainly against the rules _is_ abusive, leads to injustice, and makes for hack judging. When a judge is tough in the right sense, however, it is amazing to watch how this can trim the excesses of the adversary system and lead to better justice than would otherwise be the case if the parties were simply allowed to run wild.

The arm-twisting that is evident in the appointment of the court's own expert on damages is a direct message to both parties that they should refrain from going to wildly speculative extremes and focus on credible claims of damages only. Since there is Ninth Circuit authority for such an appointment, this is not overtly out-of-bounds for the judge to do but it is definitely aggressive and does pose a risk of prejudicing jurors if not properly handled. Reasonable minds can differ on this one but, in terms of case handling, this is one more in a series of examples of a judge suffering no nonsense in his courtroom and is at that level quite admirable.

</comment><comment><USER2>
      "The risk is, it turns into a one-witness trial,"

The solution is to hire a jury of expert witnesses. That should have happened a long time ago, in fact; letting a judge or jury make decisions about a specialist subject if they don't have a corresponding degree will only cause trouble.

The counterargument is that the government can't recognize technical competence. The answer there is to let the technically competent people select their own juries, given that they're the ones that can recognize competence. Just hand jury selection over to, say, the ACM or the IEEE.

I suspect that, as this proposal goes on, you'll converge to a technocracy. Whether that's good or bad is up to you.

<comment> Tuna-Fish The primary problem with that isn't that it would turn into a technocracy, it's that it would instantly make influence over ACM or IEEE extremely valuable. In a few short years the organizations would degrade into paid shills.

The various laws mandating standard-compliance already did this to the standards bodies.

<comment><USER2> One possibility: spread things out to the point where there are too many groups to influence and personal relations between engineers overpower what remains. Instead of calling in the ACM for an audio compression patent case, ask the Audio Engineering Society and they'll send you six guys that have known each other for twenty years and have shared beers with every other person involved in the case.

</comment></comment></comment><comment><USER3> _It's a clever strategy for being reasonable and rational when it comes to damage awards," Baum said. "But I think that if we start going down the road where we're going to let court-appointed fact finders testify at trial, we really are giving up some of our belief in the jury system._

It's a pity that the choice is so often between "reasonable and rationale" and "jury system", especially when it comes down to technical legal decisions like damages in technical fields like patent law. But it seems that dichotomy does exist. Being a blow against the jury system in this type of trial is no argument against the judge's move.

<comment><USER4> _Being a blow against the jury system in this type of trial is no argument against the judge's move._

Yes it totally is. He is explaining why someone might think hiring an expert seems reasonable in this one case, and then extrapolating how that precedent might get interpreted to undermine the legal system in general.

I also think his fear is pretty understandable: the jury system, although obviously far from perfect, is a hallmark of our culture's concept of justice, and allowing a court to appoint an expert, especially in a technology related case, is a big step towards consolidating power into the judge's hands.

<comment><USER5> As you know, other countries do not have juries, and while I've seen some abuse by judges, overall, in my (limited) experience I haven't seen them be worse than juries.

</comment></comment></comment><comment><USER6> But isn't the job here just to testify toward damages, not toward who actually wins the case.

This seems very reasonable, especially since most criminal cases already have recommended or mandatory sentencing. They're not using this witness to decide who is right or wrong, just if there was wrong doing, what would the cost be. It's like saying that murder is 25 years to life. It's not saying you are guilty of murder, but if you are, this is what we have determined the penalty to be.

</comment><comment><USER7> Maybe this should be a new litmus test for patents. If you can't explain what your patent is, its value, and how its being infringed to a reasonably intelligent person (a judge) then its not patentable.

I mean if the judge needs an expert to explain it to him, who the heck is reviewing these things for approval.

</comment><comment><USER8> > _"The risk is, it turns into a one-witness trial," said Henry Bunsow, an IP > litigator at Dewey & LeBoeuf in San Francisco._

So like, maybe justice will actually be served? Litigators amaze me.

<comment><USER7> Our's is an adversarial system. Its one of the cornerstones of our legal system and its a pretty big deal. This becomes more of an inquisitorial system which is not what we have.

I think in this case the judge will likely try very hard not to have the witness provide findings, instead his job may be more explanatory over some of the more technical aspects.

<http://en.wikipedia.org/wiki/Adversarial_system> <http://en.wikipedia.org/wiki/Inquisitorial_system>

</comment></comment><comment><USER9> Why is the obvious solution being missed here? In an adversarial trial, there are usually a minimum of three parties: defendant, complaintant, and court. As is often the case in criminal and civil trials, both non-court parties bring their own witnesses and experts to testify. It seems wise to me to also regularly have a court appointed neutral expert(s) along with experts for the other parties.</comment>


The end of personal finance - <AUTHOR> http://www.thebigmoney.com/articles/judgments/2009/05/03/end-personal-finance

<comment><USER2> it's easy to look like you know what you're talking about when your boat is rising. and all boats are rising when the tide is coming in. It's during the lean times that you can tell the good from the bullshit.

</comment><comment><USER3> Linkbait title, lots of empty facts, no meaningful conclusions...skip this one.</comment>


At least 76 Popular iOS Apps Confirmed Vulnerable to TLS MitM Attack - <AUTHOR> https://medium.com/@chronic_9612/76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-2c9a2409dd1 <comment><USER2> Might be titled, "Sketchy Sounding iOS apps confirmed Sketchy."

<comment><USER3> Except he also mentions banks and health data apps as being vulnerable.

<comment><USER4> Yeah, this was tough because it seemed like it might not be good to call out apps which can have sensitive data intercepted, yet listing the "low risk" ones only would make folks think this is not a concern.

I will do a follow up in the near future with the more sensitive ones and vendor responses.</comment></comment></comment>


Programming language syntax that I don't like - <AUTHOR> https://maniagnosis.crsr.net/2017/08/programming-language-syntax-complaints.html <comment><USER2> Now I have to lookup COBOL alter after reading the comments. Why is it an evil function

<comment><USER3> From [https://www.ibm.com/support/knowledgecenter/en/SSAE4W_7.1.0/...](https://www.ibm.com/support/knowledgecenter/en/SSAE4W_7.1.0/com.ibm.etools.iseries.langref.doc/c0925395347.htm) :

 _> The ALTER statement changes the transfer point specified in a GO TO statement._

 _> ALTER procedure-name-1 TO PROCEED TO procedure-name-2_

 _> Before the ALTER statement is executed, when control reaches the paragraph specified in procedure-name-1, the GO TO statement transfers control to the paragraph specified in the GO TO statement. After execution of the ALTER statement, however, the next time control reaches the paragraph specified in procedure-name-1, the GO TO statement transfers control to the paragraph specified in procedure-name-2._

Yikes.

<comment><USER4> I started my career in a COBOL environment where legacy code could be riddled with GOTOs... but never a single ALTER.</comment></comment></comment>


Pam-ussh may be tricked into using another logged in user's ssh-agent - <AUTHOR> https://hackerone.com/reports/204802 <comment><USER2> The bounty amount seems exceptionally low in light of the experience of the reporter, the security budget of the reportee, and the severity of the bug.

It seems to me another zero on the end would be appropriate.

<comment><USER3> Not to mention his extremely well founded comments on their patch.

High level consulting basically.

<comment><USER4> Fifteen thousand dollars to report a bug in a PAM module that you need a local account to exploit? That is excessive. I don't think a professional would get paid that much for an audit of the project (and they didn't hire one, this just one bug report)

<comment><USER5> The actual bounty was $1,500, not $15,000: [https://hackerone.com/reports/204802#activity-1513764](https://hackerone.com/reports/204802#activity-1513764)

<comment><USER4> Yes. The parent-parent said "It seems to me another zero on the end would be appropriate. "

<comment><USER5> Perhaps one day I'll learn to read. Sorry 'bout that.

</comment></comment></comment></comment></comment></comment><comment><USER6> Funny, one of our engineers at ScaleFT reported the same issue 24 hours later.

He'd solved the same problem before:

[https://github.com/jbeverly/pam_ssh_agent_auth/blob/master/a...](https://github.com/jbeverly/pam_ssh_agent_auth/blob/master/authfd.c#L105-L159)

<comment><USER7> Apropos whatevs, that is some wild indentation. The block at the bottom, that actually does the connect, none of the code after the if is what it looks like it is. If you know the author, might mention this.

</comment></comment><comment><USER8> Wow! That bug report and follow-up is absolutely amazing!! If anyone is ever trying to convince a company to release code as open source, this is the best possible example to give.

</comment><comment><USER4> I highly recommend avoiding PAM if you care about security.

Also, was this written because pam_ssh_agent_auth does not support certificates specifically? If so, why wouldn't they just modify the existing module? Another example of "Hey let's re-engineer the wheel for fun" ?

</comment><comment><USER9> Then OpenSSL environment variables are security vulnerabilities too? [https://news.ycombinator.com/item?id=13558750](https://news.ycombinator.com/item?id=13558750)

<comment><USER10> Not by themselves, but they could be part of one in a specific scenario.

</comment></comment><comment><USER11> js; dr

<comment><USER12> I copied the content here for anyone in a similar situation to the parent commenter: [https://justpaste.it/14pz7](https://justpaste.it/14pz7)

The HTML hidden in that mountain of div tags is remarkably well formed for the standard I see around on the "modern web".

<comment><USER13> True. But it is ironic for a site named "hackerone.com" to serve _nothing_ with Javascript blocked. Or maybe just a bad joke ;)</comment></comment></comment>


Reddit CEO explains what a CEO does - <AUTHOR> http://www.reddit.com/r/explainlikeimfive/comments/210to8/eli5_what_does_a_ceo_of_a_large_company_do_in_a/cg8pycf

<comment><USER2> My all time favorite post on this topic [http://avc.com/2010/08/what-a-ceo- does/](http://avc.com/2010/08/what-a-ceo-does/) A CEO does only three things. 1) Sets the overall vision and strategy of the company and communicates it to all stakeholders. 2) Recruits, hires, and retains the very best talent for the company. 3) Makes sure there is always enough cash in the bank.

great CEOs can and often will do a lot more than these three things. And that is OK.

But if you cannot do these three things well, you will not be a great CEO.</comment>


LWJGL – Lightweight Java Game Library - <AUTHOR> http://www.lwjgl.org/ <comment><USER2> Minecraft runs on this. Minecraft players have been updating the in-jar version of LWJGL with the latest upstream libraries for years.

</comment><comment><USER3> I used this for a course project 5 years ago back in college. Had a fun run with it. Glad to see it's still under development and got a new homepage.

<comment><USER4> Hah, same here 9 or 10 years ago. University of Kansas recommended it for their intro to software engineering class (I think) game project. My project team created a shitty RTS that used pirated starcraft sprites. All I remember was that implementing that fog of war was a CPU hog.

<comment><USER5> Not sure if it has support for shaders but fog of war seems like an easy thing to parallelise with textures and whatnot</comment></comment></comment>


How To Earn Your First Love Dollar - <AUTHOR> http://www.stevepavlina.com/blog/2008/07/how-to-earn-your-first-love-dollar/

<comment><USER2> blah blah blah. this is barely a step up from the meta-blogging about blogging about blogging that gets posted every day. although very good writers, I'm getting sort of sick of the general platitudes coupled with anecdotes that I read from guys like pavlina, godin, et al.

</comment><comment><USER3> Dollars talking to each other... the universe talking to us (in great detail, no less)... psychics charging $395/hr. over the phone...

It's pretty hard to take anything seriously when it's presented as such fluff and reads like it's written for a five-year-old. It leaves me feeling like I'm in a bad dream stuck between my first grade teacher and Rhonda Byrne.

<comment><USER4> You realize that psychic is his wife, right? Makes the whole thing even weirder.

</comment></comment><comment><USER5> One-line summary: If people offer you money for doing something you love, and you take it, you can earn money; if you don't take it, you won't earn money; therefore: take the money.

</comment><comment><USER6> Does it involve standing on a street corner?

'Cause if it doesn't, I'm not interested.

</comment><comment><USER2> I would also add that one of the worst aspects of this post is that it encourages people to bug/annoy other people to pay you for things in awkward contexts.

</comment><comment><USER7> "Love dollar." Wow.

>>I earned a whopping $2.36 from ad clicks. ... Twenty months later my daily income from this website had increased by more than 500 times.<<

He really makes $1180/day == $430,700/year? Dang. I need to get into self-help love-dollar blogging.

</comment><comment><USER4> I didn't really how new-agey Steve was back when I used to read his stuff more often, but lately it all seems kind of hokey. Hopefully his ad revenue will go down a little bit and force him to come back to the real world.

</comment><comment><USER8> Steve Pavlina started out as a pretty smart, credible sort of guy, but now he's always posting this kind of blather.</comment>


Common Robots. Txt Pitfalls and How to Avoid Them - <AUTHOR> https://jetoctopus.com/tech-problem/a50-robots-txt-pitfalls-and-how-to-avoid.html <comment><USER2> I never have seen a good use-case for allowing one search engine not to index the page while not allowing another one. Neither today, nor 20yrs ago. For the Google and As(sense?) related stuff, using robots.txt for controlling their behaviour seems to me like a bad API. Given that Google offers fancy webmaster consoles to change the appearing on their site since years.

Really, the only use case for distinguishing robots I ever stumbled upon was, as a client, blacklisting wget (looking at you, ArXiv.org). But then we just switch to curl or let wget ignore robots.txt, but with being nice to the server/network load.

</comment><comment><AUTHOR> 1\. Ignoring disallow directives for specific user-agent block; 2\. One robots.txt file for different subdomains; 3\. Listing of secure directories; 4\. Blocking relevant pages; 5\. Forgetting to add directives for specific bots where it's needed; 6\. Adding the relative path to sitemap; 7\. Ignoring Slash in a Disallow field; 8\. Forgetting about case sensitivity.</comment>