How and why writing crypto is hard (2012) - <AUTHOR> http://www.acooke.org/cute/WhyandHowW0.html <comment><USER2> Excellent points!

As for the library problem, I'm teaming up with Alex Gaynor, Hynek Schlawack, Donald Stufft and Christian Heimes to write a better cryptography library for Python: [https://github.com/alex/cryptography](https://github.com/alex/cryptography)

New contributors very welcome!

On the other side of the coin, I agree that cryptography education is very lacking. That's why I presented Crypto 101 last year at PyCon, which was an attempt at teaching just enough crypto in 45 minutes. Obviously, that's pretty near trying to square the circle: it's a best-effort attempt, but that's about it. (If you're still interested, the recording is available for free: [http://pyvideo.org/video/1778/crypto-101](http://pyvideo.org/video/1778/crypto-101))

That's why I'm also writing the book version of Crypto 101. Early draft stages right now, but getting there. After listening to tptacek say it so many times, I've come to agree: if you want to teach crypto well, you probably want a bunch of exercises that teach you how to break it. As a result, both the exercises and the text-adventure game I'm adding to the book rely on breaking real-world crypto: everything from bad password storage to MITMing SSL handshakes to stream compression :)

Additionally, a significant portion of the book will be devoted to _when_ (i.e. rarely ;)) and _how_ to write crypto. I would hope that your journey would've been a lot less painful if you had had access to the book. Perhaps for future programmers? :)

If you'd like to review, there's a reviewers mailing list, feel free to shoot me an e-mail explaining why you think you'd be a good reviewer, and I'll probably sign you up :)

<comment><USER3> I'm so glad about this.

I think it's pretty ridiculous that whenever a "non crypto" person tries to use crypto the security folks go lambast them, yet there is simply not a truly usable crypto api out there! Please go out and make this the right way; I'm looking forward to it :)

<comment><USER4> There isn't one kind of "security" person. I work in security. But I don't install antivirus, I don't write hardened runtimes, I don't configure firewalls, I don't analyze malware samples, I don't design ciphers, I don't write policies, and I don't do forensic investigations.

All I do is break into software; I do vulnerability research, and that's pretty much it right now.

As a vulnerability researcher, it's not on me to provide you with a good crypto library. People like us write software in order to find vulnerabilities. We're specialized so that we can be very good at doing that by dedicating all our time and attention to that one problem.

But much more importantly: like vuln researchers, don't like vuln researchers, it doesn't matter. When vuln researchers complain about crypto libraries, they are informing you of facts. You can ignore those facts and probably be vulnerable, or accept them and act on them and not be vulnerable.

Having said all that, there _are_ in fact good crypto APIs. You can use Keyczar, which was a Google project. You can use NaCL, which is Daniel Bernstein's project; it even has a Ruby port now. You can use Peter Guttman's cryptlib.

<comment><USER3> Ok, so maybe I came off a bit harsh there. I've worked with a number of excellent security professionals who have found weaknesses and provided great prioritizations and solutions to the problems they've found.

However that's not the case whenever some project on HN claims to use cryptography. The answer usually is: "you don't know what you're doing, so don't use cryptography." While that is "safe", for many it's not actionable: sometimes we actually do need to use it and not everyone can afford a security consultant. I wish instead there was a recommendation for some library out of the box that would handle everything from key management to supporting my specific use cases.

Said a different way: I want an API that is simply giveMeANewKey() and encryptSecretMessage() and decryptSecretMessage() and the library takes care of both secrecy and integrity with strong defaults.

You can't expect it to make the whole system secure of course, but I think a better API that makes it harder to shoot yourself in the foot (both by having sane defaults and being very opinionated to the point where it affects your system design) would go a long way, no?

EDIT: looks like the stuff you linked to is more what I am looking for. I wish I had heard of them sooner!

</comment></comment></comment></comment><comment><USER5> "This was because the "iv" parameter in the pycrypto Cipher API is ignored in CTR mode. Instead, you need to provide the data to the Counter object.

I don't know if I am being muddle-headed in thinking of the initial counter value as an IV, but I was a little annoyed with pycrypto. Couldn't it throw an error if it's given an IV in CTR mode,"

THIS

API creators have to _stop this bullshit_ of putting death traps in their code.

This is not about go RTFM, or "you're incompetent".

If you allow it to be used in a wrong manner, it's _your liability_ as well.

If your IV sometimes goes into one field, but in another occasion goes in another field, THROW AN ERROR IF IT'S NOT USED CORRECTLY

<comment><USER2> See also: if someone (hi, Salt) passes in 1 as the public exponent for RSA, you API should probably not just go ahead and use that value.

(Of course, Salt had no business being anywhere near an API that had the letters R-S-A in it, but I digress...)

<comment><USER6> That seems like a case of determining what the API should check for. An explicit check for e=1 seems stupid, the reasonable check would be to make sure that e was a valid exponent, which I believe means confirming that it is primes, which can have a non-trivial overhead (although in the case of RSA, the exponents are gennerally small enough that it doesn't matter.) The real question in this case is why the API let you select the exponent in the first place.

<comment><USER2> Hence, like I said: they should not have been near an API that had the letters R-S-A in it. They should've been near a very nice API with no configurable knobs to get wrong. The entire thing was part of an authenticated encryption scheme: they could've just use NaCl's `box` API and the entire thing would be two lines of code, give or take. Oh, and not utterly pointless ;-)

</comment></comment></comment></comment><comment><USER7> Crypto library authors seem to have taken the philosophy that "it was hard for me to learn all this stuff, so it should be hard to use". Since I started working on the cryptography library that lvh mentioned I've seen some absolutely amazing APIs from crypto libraries:

* Undocumented error conditions (actually in general the documentation is atrocious for crypto libraries, "crypto is easy, why would you need docs"?) * ECB as the default mode for block ciphers * Ignoring invalid parameters * Allowing you to provide parameters which basically your cryptography a no-op (e=1) * Modes whose purpose is undocumented, merely "This mode should not be used"

And finally, absolutely NO python crypto libraries expose AES GCM. (This is all to say nothing of the myriad of other issues I have)

<comment><USER8> Crypto is hard - we should teach it better.

This book helps with teaching crypto and python at the same time... [http://inventwithpython.com/hacking/](http://inventwithpython.com/hacking/)

</comment></comment><comment><USER9> He doesn't even get to the _real_ problem with writing crypto - unless you can get some attention from experts, there's no way you can know you didn't leave a big gaping hole in your security. It's something you literally can't test yourself.

</comment><comment><USER10> Kudos to OP for trying a hard problem and be frank about the hurdles. That's the way to learn. Try it, make mistakes, so what. We learned best from mistakes and failures. Mistakes burn into our memory. We'll be better the next time.

</comment><comment><USER11> Incidentally, the PyCrypto API is considered so dangerous that I believe it's actually _banned_ from Fedora. M2Crypto is a better alternative.

<comment><USER12> I'm not sure I'd called M2Crypto a much better API. It more or less exposes the OpenSSL API which is also notoriously hard to get right. Further more it hasn't seen an update since 2011, the SSL certificate for the bug tracker expired in 2011, and it does not compile without patches against any modern OpenSSL (1.0+).

The state of crypto in Python is horrendous, hence the new library.

</comment></comment><comment><USER13> The point is: coding mistakes in crypto code are often fatal. And there are many implementation details to make mistakes on.

</comment><comment><USER14> Another problem is: I know I shouldn't roll my own, but I can't or don't know how to identify implementations that meet my needs and are written by someone sufficiently competent.

</comment><comment><USER15> I noticed this [https://news.ycombinator.com/item?id=4964720](https://news.ycombinator.com/item?id=4964720) advice is wrong. >Possible timing attack. Consider doing another HMAC of each HMAC and comparing those instead.

The time-insensitive method is to XOR every bit of HMAC_0 with HMAC_1 (keep going even if they are not of equal lengths use 0s) and then (not before) check if the lengths are equal.

<comment><USER16> either approach avoids leaking useful information, doesn't it? one does so by guaranteeing identical times. the other by passing the information through a one-way function.

the link given in the advice you point to includes a fairly detailed discussion / comparison - [https://www.isecpartners.com/blog/2011/february/double- hmac-...](https://www.isecpartners.com/blog/2011/february/double-hmac- verification.aspx)

</comment></comment><comment><USER8> Another problem with simplecrypt is the password is exposed in plain text to any other process.

[http://www.gnupg.org/faq/GnuPG-FAQ.html#why-do-i-get- gpg_war...](http://www.gnupg.org/faq/GnuPG-FAQ.html#why-do-i-get- gpg_warning_using_insecure_memory)

Also the source code looks like encrypted text. I can't figure out what much of it does, or why it does it by reading it.

Also, I think the API is not the best, because it asks for a password. Where are people storing the password? This promotes easy mistakes... like for example, saving it to a file, or reading it from a web input form.

<comment><USER16> i don't know a good way to avoid the in-memory password from within python - if that is possible, please show me how and i'll fix the code. the larger point about passwords is, i think, part of the reason for keyczar's approach. but that is not yet available in python 3 (certainly not when i wrote the code; i did check since and last time i looked there was a patch being considered).

however, i was quite proud of the source - [https://github.com/andrewcooke/simple- crypt/blob/master/src/...](https://github.com/andrewcooke/simple- crypt/blob/master/src/simplecrypt/__init__.py)

edit: i've added some warnings to the project page - [https://github.com/andrewcooke/simple- crypt#warnings](https://github.com/andrewcooke/simple-crypt#warnings)</comment></comment>


Death to Internet Explorer Long Live Internet Explorer - <AUTHOR> http://saucelabs.com/blog/index.php/2010/02/death-to-internet-explorer-long-live-internet-explorer/

<comment><USER2> I wonder why MS doesn't just build a browser around webkit and call it IE9. It's not like IE is a product that they make any money selling or anything.

<comment><USER3> it's probably a matter of pride, seeing as they were once the champions of the web-wars in the 90s.

<comment><USER2> Geeks would get to do some gloating, yes. But then they'd be happy.

The general public would not know the difference or care one bit.

</comment></comment></comment><comment><USER4> I expect IE6 to be shouting "I'm not dead." for a few more years. When I fix a windows XP system I make sure to upgrade that darn thing to get rid of IE6.

That thing can't die fast enough for me.

</comment><comment><USER5> ie6 should be dead already, period!</comment>


The bizarre history of cellphone towers disguised as trees - <AUTHOR> http://www.vox.com/2015/4/19/8445213/cell-phone-towers-trees

<comment><USER2> They might not work everywhere, but they often fit in better than a bare antenna array. Along NJ's garden state parkway is an example.</comment>


Ask HN: Resources for getting started with NoSQL / Big Data - <AUTHOR>

I've read quite a few articles posted here and else where about Data startups and some tools to work with such data.
Are there good resources out there for beginners to learn more about NoSQL data stores and use case scenarios for each solution (case studies and what not) and for data analysis using the same.
Any blogs that are recommended? I tried taking a look at MyNoSQL blog (mynosql.mypopescu.com) but that blog is nothing more than a copy=paste archive without any insight at all to justify the solutions and what not. Not really useful for someone who wants to get started with such solutions and look beyond RDBMSes ..
Thanks.. <comment><USER2> Probably the first thing to understand about nosql is that there is no standard, there are multiple paradigms to chose from.

Broad differences in storage models:

* Column Oriented Storage (e.g. HBase)

* Document Store (e.g. CouchDB, MongoDB)

* Key-Value (e.g. BerkeleyDB, TokyoCabinet, REDIS)

* Graph DB (Neo4J)

Furthermore each will have their own consistency, replication & availability models, as well as read/write optimisations.

Before choosing one you need to ensure it is adapted to your usage pattern. Here are some links that go into more detail:

A visual comparison, comparing trade-offs of each type of nosql db: <http://blog.nahurst.com/visual-guide-to-nosql-systems>

Article on appropriate use-cases for each type of nosql: <http://blog.heroku.com/archives/2010/7/20/nosql/>

NoSQL - the 'definitive guide' (apparently): <http://nosql- berlinbuzzwords2010.heroku.com/#1>

Further resources: <http://nosql-database.org/>

And here's a link on data from the top of HN today: [http://www.junauza.com/2010/11/free-data-mining- software.htm...](http://www.junauza.com/2010/11/free-data-mining- software.html)

<comment><AUTHOR> Thanks a bunch for these pointers.

I understand that there's no one size fits all approach to NoSQL but rather it has multiple paradigms and such. It's just that i hadn't come across any book or text that would explain the basis of NoSQL, why it'd be preferred in certain scenarios, different types of paradigms etc. etc.

Thanks again.</comment></comment>


BlurHash: Algorithm to generate compact representation of an image placeholder - <AUTHOR> https://blurha.sh/ <comment><USER2> For comparison, Instagram sends ~200 byte base64 thumbnails in its API responses. It's a low-res JPEG with a fixed header to save a bit more space. This is also used to blur sensitive images. You can get even better results with webp.

It requires minimal javascript support-- just enough to build an img tag with the appropriate data url, and renders just as fast as any other tiny image. Upscaling blurs away the imperfections.

[https://stackoverflow.com/q/49625771](https://stackoverflow.com/q/49625771)

<comment><USER3> Can you clarify the significance of the fixed header?

<comment><USER2> JPEGs were never meant to be <1KB, so the header can be rather large-- looking at one example, the truncated JPEG data Instagram sends is 248B, and the additional fixed header information is 607B, resulting in an 848B thumbnail (the truncated data includes dimensions).

That 607B of fixed header includes some compression settings that don't need to change between images:

\- 132B of quantization tables, saying how much to divide every coefficient by-- for subtle details the difference between "128" and "129" doesn't matter, and you can just send "2 * 64".

\- a 418B Huffman table, which stores the frequencies of different coefficient values after quantization-- small values are much more common than large ones, given the divisors. You can have smaller image data with properly tuned tables, but that only matters for large images. For 250B of image data, it's a waste.

\- Miscellaneous other details that are fixed, like the file type magic headers, the color space information, and start/end markers.

You can dig in more by putting a thumbnail like [https://i.imgur.com/M0EsJH1.jpg](https://i.imgur.com/M0EsJH1.jpg) into this site: [https://cyber.meme.tips/jpdump/](https://cyber.meme.tips/jpdump/)

</comment></comment></comment><comment><USER4> Hello, I am the main author of this. Also make sure to check out the README on Github for more technical details! [https://github.com/woltapp/blurhash](https://github.com/woltapp/blurhash)

<comment><USER5> Very nice work. Appreciate you open sourcing this

</comment></comment><comment><USER6> Judging by the example string on the website, `LEHV6nWB2yk8pyoJadR*.7kCMdnj`[0], you cannot use these hash strings as filenames because they can have disallowed characters.

You could save a step by just sending which image to download and use the filename as the hash you use to render the result, but this algorithm requires you store the relationship between the hash and the image somewhere (unless I am missing something obvious).

[0] source code: [https://github.com/woltapp/blurhash- python/blob/7469c813ea64...](https://github.com/woltapp/blurhash- python/blob/7469c813ea646ac022ca2879de76cc6e453237a1/src/encode.c#L125)

<comment><USER7> 1\. Using the hashes as principal indices seems unsafe in general (which includes image upload) anyway: it looks pretty simple to generate collisions. The suggested use case (save the hash in the database next to the original image or a reference to it) sounds fine.

2\. Which disallowed characters? The dictionary appears to be "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz#$%*+,-.:;=?@[]^_{|}~". No slashes or null bytes, which are the common disallowed characters on server platforms. It does have characters your shell cares about, but that's only a problem if you're not quoting.

<comment><USER6> `:` is disallowed on MacOS and several of those characters are disallowed on Windows. Generally I view images on a frontend, not on my servers.

<comment><USER7> Fair! I would not expect the image be saved to a Windows path when displaying a blurred image in the example use cases (mobile apps and web pages). You're thinking Electron, perhaps?

Point of order though: I don't think that's right for MacOS, though you're certainly right for Windows. HFS+ lets you use any Unicode symbol including NUL (because the filenames are encoded Pascal-style). I don't know the details how how APFS does it, but it also appears to support any Unicode code point, though it additionally mandates UTF-8. [0]

[0] [https://developer.apple.com/library/archive/documentation/Fi...](https://developer.apple.com/library/archive/documentation/FileManagement/Conceptual/APFS_Guide/FAQ/FAQ.html) grep "filenames"

<comment><USER6> Interesting, I was not aware about MacOS. If I run `touch :.:` it will run fine and create the file, but Finder disallows this for whatever reason:

        The name ":.:" can't be used.
        Try using a name with fewer characters, or with no punctuation marks.

<comment><USER4> Finder exchanges : and / in filenames, for compatibility with classic MacOS, which used : as a directory separator and allowed / in filenames. You can create a file named / in Finder, and it will show up as : on the file system.

</comment></comment></comment></comment></comment></comment><comment><USER8> This looks great. For browsers, would have been even better if the result was an SVG or pure CSS gradient. Canvas can still have performance hit on mobiles.

The JS implementation of Gradify [1] did something similar but by using CSS linear-gradient which is even better in terms of performance. I wonder if the same could be implemented here.

[1] [https://github.com/fraser-hemp/gradify](https://github.com/fraser- hemp/gradify)

<comment><USER9> You don't have to keep it displayed on canvas given it isn't "animated". You can use temporary canvases for the initial render then convert it to a Blob (and from a Blob to an Object URL). Most browsers at that point use the GPU's transforms to quickly convert the image data to a basic compressed JPG or PNG and then the usual browser performance mechanics of an image apply (and as a URL you can use it in regular IMG tags or CSS things like background-image). Presuming you remember to revoke the Object URLs when you are done with the hashes to avoid Blob leaks, performance is improved over the "simpler" canvas techniques that just display the rendered canvases.

If code helps, here's how it looks as a React Hook in Typescript:

[https://gist.github.com/WorldMaker/a3cbe0059acd827edee568198...](https://gist.github.com/WorldMaker/a3cbe0059acd827edee568198376b95a)

(I offered the code to the react-blurhash repository in its Issues.)

<comment><USER10> The cost is in the initial render to a canvas. Once on a canvas, there is no advantage to converting it to a blob for display in an IMG tag as far as performance goes.

<comment><USER9> That's not what my testing has shown in practice. Memory use drops dramatically in the conversion from canvas to blob when the browser compresses the render buffer to JPG/PNG under the hood. GPU usage seems to drop in the browsers I had under performance tools, but it subtle enough it could be just margin of error (as memory pressure was my bigger issue, that wasn't something I was keeping that good of an eye on).

But yes the biggest performance gains aren't in pure, static IMG tag usage scenarios, the biggest performance gains I saw were in combo with CSS animations, and that was something important to what I was studying. As Blurhases are useful loading states this seems a common use case to me of having a Blurhash shown/involved in things like navigation transitions, and it seems pretty clear browsers have a lot more tricks for optimizing static images involved in CSS Animations than they do for canvas surfaces.

I was looking for a way to better amortize or skip the initial render as well. It should be possible to take the TypedArray `decode` buffer and directly construct a Blob from it, but I couldn't find a MIME Type that matched the Bitmap format Blurhash produces (and Canvas setImageData reads) in the time I've had to poke at the project so far. As I mentioned, memory pressure was a performance concern in my testing, so I'd also be curious about the performance trade-off of paying for an initial canvas render and getting what seems to be a "nearly free" compression to JPG or PNG from the GPU in converting that to blob, versus using a larger bitmap blob but no canvas render step.

</comment></comment></comment></comment><comment><USER11> Forgot to mention one important detail: How big is the JavaScript source to the BlurHash decoding algorithm?

I'm guessing that it's approximately the size of a single image, possibly quite a bit more.

<comment><USER12> 22kb

Edit: Nevermind, derp, [https://blurha.sh/blurhash.01ae00eea611ada5e9c7.js](https://blurha.sh/blurhash.01ae00eea611ada5e9c7.js) contains all of the JS of the entire website.

<comment><USER4> It is a lot smaller than that, that is probably the size of all JS code on the web page?

The algorithm itself fits into a few k.

<comment><USER12> Yeah, you're right. I found the first JS file in my network tab and judged by its blurhash.js filename that it was the algorithm: [https://blurha.sh/blurhash.01ae00eea611ada5e9c7.js](https://blurha.sh/blurhash.01ae00eea611ada5e9c7.js)

Of course, my first clue should have been that it was also the _only_ Javascript file.

</comment></comment></comment></comment><comment><USER13> I implemented something similar when I was playing around on a personal page. It's built by Jekyll and inlines a base64 version of the jpeg with a CSS blur filter, then lazyloads the real image and transitions it in via opacity 0->1\. You can see it in action here: [https://www.road-beers.com/](https://www.road- beers.com/)

<comment><USER14> I noticed that it only inlines the base64 for the first pictures/"above the fold", and then loads the rest async. Clever.

</comment></comment><comment><USER15> The examples discussed seem to assume a dynamic site where you load the images (and the blurha placeholder) from a database, but how easy would this be to use for a static site with large images, perhaps embedding the blurha directly in the HTML?

<comment><USER16> You could put the hash in a custom HTML attribute, and have the JS load it from there.

<canvas width="100px" height="100px" imgsrc="hirez.jpg" blurhash="abcd..." />

</comment></comment><comment><USER17> I'm surprised this isn't more web focused, i.e. a NodeJS library which encodes an image as a BASE64 data URL which any browser can render immediately while the real image lazy loads

<comment><USER4> It's a lot more efficient to do it once, and store it.

Also, it's really simple! Go ahead and create a library for it! The algorithm is tiny, and easily ported, so it's quite fun.

</comment></comment><comment><USER18> [https://wolt.com/blog/hq/2019/07/01/how-we-came-to- create-a-...](https://wolt.com/blog/hq/2019/07/01/how-we-came-to-create-a-new- image-placeholder-algorithm-blurhash/) is related.

Via [https://news.ycombinator.com/item?id=20339442](https://news.ycombinator.com/item?id=20339442) (1 comment).

</comment><comment><USER19> Funny coincidence that I am working on an iOS app and was looking for something similar just couple days ago. I ended up building something but your swift solution seems much better than what I have so I will switch to yours. Thank you!

<comment><USER4> Nice!

</comment></comment><comment><USER20> How did this compare with progressive JPEG ?

<comment><USER7> I think the biggest difference is in visual effect. A progressive JPEG looks pretty terrible at first, whereas a blurred image may look preferable even though it technically has less information.

<comment><USER21> Agreed, +1 for browser makers to make progressive JPEG loading not look like a dog just barfed the original image

<comment><USER4> Do modern browsers even support progressive display of JPEGs? I have not seen it happen in years and years.

<comment><USER10> In the blink rendering engine, partial rendering of a progressive jpeg is pretty much the lowest priority task for CPU time. That means unless you have a very slow network and very fast CPU, you will never see half rendered progressive jpegs.

That's the right design decision, because rendering a progressive jpeg repeatedly is rather expensive - as well as redecoding the whole jpeg, you also need to re-render any text or effects overlaying the jpeg, and recomposite the frame. And then you're gonna have to do all that work again when a few more bytes of progressive jpeg arrive from the network...

</comment></comment></comment></comment></comment><comment><USER22> It's cool, I have no use for it but it's cool.

</comment><comment><USER23> The accompanying blog post is unfortunately unreadable with an ad blocker on that blocks third-party trackers from Google Analytics, Facebook, and New Relic. It hijacks scrolling and continually scrolls back to the top. (Mac Safari + 1Blocker + PiHole.)

</comment><comment><USER24> Interesting bug on the demo page:

\- Upload any image

\- Now upload a transparent png

\- It does not clear the previous image, layering them together

\- It hashes the combination picture. Super neat!

</comment><comment> 867-5309 any ideas how this would impact on SEO/Pagespeed? if you are doubling the amount of pictures being loaded, albeit a tiny placeholder for a thumbnail - not from a size perspective, but from a network perspective surely this would double the amount of image fetches

<comment><USER4> The whole idea here is that you do not need to fetch an extra image. The image is generated in code on the client side from the short string. So there is no network connection needed, and the placeholder is there instantly.

<comment> 867-5309 then there must be some computational cost for the client

<comment><USER4> Of course. The cost is fairly small, though, since you only need to generate very tiny thumbnails, and can then just scale them up.

</comment></comment></comment></comment><comment><USER25> What's the advantage of this over using a Gaussian?

<comment><USER4> The amount of data to send is miniscule.

</comment></comment><comment><USER26> > Your client then takes the string, and decodes it into an image that it > shows while the real image is loading over the network.

That's not a "hash", that's an encoding. Hashes are one-way.

<comment><USER7> This /is/ one-way by virtue of throwing information away: you can't rebuild the original image. If you're thinking of preimage resistance (it must be hard to find an input that hashes to a given output) that's a property of cryptographic hashes, but not hashes in general (canonical example FNV).</comment></comment>


Google Music shutdown starts this month, music deleted in December - <AUTHOR> https://arstechnica.com/?p=1696302 <comment><USER2> I need to find an alternative to Google Photos.

<comment><USER3> If you're interested in self hosting, I've been using Piwigo.

[https://piwigo.org/](https://piwigo.org/)</comment></comment>


PEP 8 Modernisation - <AUTHOR> http://hg.python.org/peps/rev/fb24c80e9afb <comment><USER2>
        The default wrapping in most tools disrupts the visual structure of the code,
        making it more difficult to understand.

It's 2013. Let's fix the tools.

You think we would have gotten past the point of having to manually figure out "where should I break these lines for the best readability." Code is meant to be consumed by machines, and a machine should be capable of parsing the stuff, figuring out visual structure, and wrapping dynamically to account for window width and readable line-lengths in a way that preserves the visual structure.

<comment><USER3> I upvoted you for this - I think it's a really interesting idea.

Why can't my editor tokenize my code and then show it in the format I want? Why do I, as the programmer, have to worry about whether one whitespace convention works for you versus me, when you could just come up with whatever scheme you like and view code that way?

<comment><USER4> > _Why can 't my editor tokenize my code and then show it in the format I > want?_

Because editors are written by humans. And as of now, we haven't sold a whole lot of problems with their use.

For example, you get an IDE with lots of features, but a subpar editor, crammy UI and GC pauses (3 of the five most popular are written in Java).

Or you get something like VIM, with a great editor, but subpar compatibility with the rest of your system, not very good understanding of the code (refactoring, tokenizing etc). '80s GUI capabilities etc, ad-hoc collection of plugins to fix basic pain points (like file navigation).

Or you get Emacs, with millions of configurable options, a subpar extension language, script in various stages of great and rot, '80s GUI capabilities, etc.

In general, we lack tools that run the whole gamut: great editor, fluent shortcuts (either Emacs or Vim style), 2013 GUI capabilities, refactoring and intimate knowledge of program syntax (to the level of understanding the AST, no BS regex used for syntax highlighting), embedded REPLs and terminals, etc.

Something like a Lisp Machine + Smalltalk UI + Light Table + Visual Studio + Vim/Emacs combo.

<comment> qu4z-2 Between ^Z, :<range>!, :grep, make, and other tools, vim has great compatibility with my system, thanks :)

<comment><USER4> Do it have an in-editor terminal?

An in-editor debugger?

Does it offer a REPL?

Does it work with your build system and your SCM system without some ho-hum third party plugins?

<comment> qu4z-2 In-editor terminal? ^Z or :shell (Asking for an in-editor terminal makes about as much sense as my whinging that Eclipse doesn't have an in-terminal editor)

In-editor debugger? I admit this is less than ideal.

A REPL? Languages suited to REPLs have REPLs, and a lot of them support SLIME, allowing me to interact with the REPL from vim. For everything else there's tmux.

Build system? :make and errorformat

SCM integration? ^Z. Or fugitive I guess. (a third party plugin, yes. But if you think it's ho-hum, you probably haven't used it).

</comment></comment></comment></comment></comment></comment><comment><USER5> Nice to see some movement away from the 79 character limit. I've had to make some incredibly unreadable code in the past just to comply with it.

<comment><USER6> I couldn't figure out if they have that dumb indentation rule.

[https://gist.github.com/radiosilence/6133713](https://gist.github.com/radiosilence/6133713)

I mean how can anyone say that the former is better than the latter?

<comment><USER7> Either is acceptable per PEP 8.

<comment><USER6> Oh, neat! I don't have to feel dirty now.

</comment></comment></comment></comment><comment><USER8> The only thing that makes me _really_ sad is the aversion to tab indentation

I get it, it looks nicer with 4 spaces. I'm still not convinces it's a straight win.

(Of course, you should _never_ mix tabs and spaces, and I'm glad Python 3 enforces this)

<comment><USER9> The problem is that many people and many editors conflate the 'tab key' and the ASCII TAB character.

Both Emacs and Vi correctly allow you to indent by 4 spaces rather than foolishly inserting a TAB and indenting by the standard 8. Other editors like Sublime Text stupidly insert a TAB and expect you to muck with how TABs are rendered in order to indent correctly.

Since many people don't understand that distinction, they map TAB to 4 columns which is incompatible with most formatters (including all printers and HTML). Switching to spaces is the only solution which really fixes this.

<comment><USER10> I prefer not hitting tab at all because my editor already knows how far to indent. But when it does indent, I like it to use tab characters as a way to distinguish semantic indentation from alignment indentation.

And because emacs and vim are still "dumb" editors in some ways: They still conflate the arrow keys with "move one character", when they should really mean "move one character, unless you are in non-alignment indentation, in which case move one level of indentation, which happens to correspond to four spaces since this particular file is python." They have similar problems with backspace and delete, regexes and search/replace, etc.

Further, what if you prefer 2 or 3 space indentation? If you use semantic tabs, you can have that simply by changing the display width of the tab character. It needn't be equivalent in width to 8 characters. To my knowledge, emacs and vim are both too dumb to display code indented with spaces at a different indentation width than saved in the file.

Note that when using semantic tabs, tabs _only_ represent semantic indentation. A new block adds a tab. Further indentation for the purpose of aligning multi-line statements must be done with spaces. Tabs following spaces on a line are always wrong. Tabs are not to be used to align to columns. If you want to do that, use spaces.

For example:

        def foo():
        --->if (long_named_function_that_returns_a_boolean() and
        --->....thing2() and thing3()):
        --->--->do_stuff()

And again, with your editor reconfigured to display tabs as two characters wide:

        def foo():
        ->if (long_named_function_that_returns_a_boolean() and
        ->....thing2() and thing3()):
        ->->do_stuff()

Basically, tabs get you several niceties with partially-dumb editors like emacs or vim. Indenting with spaces gives that all up and all you get in return is the ability to view code with notepad.exe.

<comment><USER11> I prefer not to have to juggle invisible characters when editing plain text.

<comment><USER12> Tabs are visible in my editor. And so are the spaces at the end of a line it's sweet: :set listchars=tab:\|·,trail:·

<comment><USER11> Isn't it a little self-defeating to make indentation visible? The whole idea is that it's easy to pick out blocks by the shape of the left margin, i.e., where the first visible character is.

If your indentation scheme only works when configuring your editor to mark whitespace, we might as well go back to MUMPS and indent with dots.

</comment></comment></comment></comment></comment></comment><comment><USER13> As pointed out to me by a friend that's forced to use the style guide at their new job, the Pet Peeves[1] section is somewhat ironic. It talks about avoiding extraneous whitespace (such as when lining up equal signs in variable declarations) and then proceeds to _use extraneous whitespace in the Yes /No tags preceding code blocks_. Apparently it does nothing for code readability, but it's useful for the information on the page...

      [1]: http://www.python.org/dev/peps/pep-0008/#pet-peeves

<comment><USER14> The Yes/No tags are not code. The PEP is not advocating their style for all text documents.

<comment><USER13> Obviously. Yet they are both presenting lists of items, with identifiers and values. I find expressing examples of a rule using a method the rule expressly outlines not to use (even if in a different language), _ironic_.

</comment></comment></comment><comment><USER15> Here is a more readable diff: [https://www.draftable.com/compare/9spTfcM](https://www.draftable.com/compare/9spTfcM)

<comment><USER16> That looks nice, but do a quick comparisson:

go to the "Maximum Line Length" section. Now try to understand the changes wit the side-by-side one.

Now go to the original article link and do the same. It's much easier. At least for me.

</comment></comment><comment><USER17> My one beef with the pep still is the one module per line recommendation:

"Imports should usually be on separate lines ... No: import sys, os"

Why not? I don't really spend a lot of time studying stdlib imports, nor need them on separate lines. Pyflakes will yell at me if something was not imported.

After all, one does (and is legal in the pep): from subprocess import Popen, PIPE, ... So how is that different conceptually than doing from stdlib import os, re, sys, ...

I certainly agree with separating stdlib, 3rd party libs, and your own modules by blank lines.. but why should usually trivial stdlib imports need so many lines?

<comment><USER11> If I see `from subprocess ...`, I know immediately that this module does something with subprocesses, and I don't much care about the rest of the line.

If I see `import os, sys, foo, bar...` then I don't get that information without actually inspecting the rest of the line.

The difference is minor, but skimming is valuable.

</comment></comment><comment><USER18> Ah crap, say it ain't so. Never noticed that before (in the "Comments" section):

        "You should use two spaces after a sentence-ending period."

<comment><USER19> Most code is read in fixed-width fonts. I don't see why this is controversial. The argument to use only one space after a sentence-ending period only makes sense when reading in a variable-width font as the width of the space is corrected when rendered (and two spaces over-corrects).

<comment><USER11> Do any variable-width fonts actually do that? Looking at your comment, for example, the spaces after periods look the same width as those between words to my eye.

<comment><USER20> The em space fell out of favor when HTML got popular, because HTML renderers (ie. your browser) will strip extra spaces. So when looking at a web page, there actually is no difference between one and one hundred spaces (or two).

</comment></comment></comment></comment><comment><USER21> I really, really never understood why to indent with spaces, instead of tabs. I hoped this would've changed, but no...

I want to set for myself how much spaces represent an indentation, not someone else, it depends so much on your setup, the monitor, resolution, font settings, editor setup, if 2 spaces are fine, or 3 or 4...

</comment><comment><USER22> My personal frustration with Python's coding standards is the combination of PascalCaseNames and snake_case_names. Rust has adopted the same coding style. :(

Plenty of C++ code uses UPPERCASE_SNAKE_CASE_NAMES for macros, but that doesn't seem so bad because macros are ugly and should be used less frequently than classes and functions. (I hope!)

<comment><USER11> Curious, why's that bother you? Different things should look different, and all. :) The alternative for class names is Camel_Snake, which will get you smacked in virtually any language.

Python code does tend to use UPPERCASE_SNAKE for "constants" as well, probably inherited from C (sometimes via Perl or Ruby).

<comment><USER22> Mixing the styles just feels inconsistent. The only language I know where Camel_Snake is used is Ada.

</comment></comment></comment><comment><USER23> It would be nice to have a gofmt for python.

Or is there already a Ninja-IDE plugin that formats code?

<comment><USER24> We do have a gofmt for Python.

pip install autopep8

Just pip search pep8 to see all the tooling.

It's not a "Ninja IDE" thingjobber, just a command line tool.</comment></comment>


Show HN: Twinfluences - a Twitter influence checker - <AUTHOR>

This has been a little side project of mine for a while, spurred on by a friend who was interested to know who on his Twitter list were more influential than others
http://twinfluenc.es/
An example of a results page looks like:
http://twinfluenc.es/c4cj3gi4
It's never meant to be a money making startup, just a fun project using Twitter's API! I'd be interested to hear any constructive criticism! <comment><AUTHOR> Clickable:

<http://twinfluenc.es/>

<http://twinfluenc.es/c4cj3gi4></comment>


On Being a Senior Engineer - <AUTHOR> http://www.kitchensoap.com/2012/10/25/on-being-a-senior-engineer/ <comment><USER2> This is an oldie, but a goodie! Every point in here is golden, and it's nice to revisit this from time to time and be reminded about what's important.</comment>


I fired half my team - <AUTHOR> http://blog.close.io/i-fired-half-my-team

<comment><USER2> Bravo to the CEO for handling it this way. It really shows how treating others like humans and remaining compassionate no matter what the situation is beneficial to everyone.

</comment><comment><USER3> So who got to keep their laptops?</comment>


What happened to Google Maps? - <AUTHOR> https://www.justinobeirne.com/what-happened-to-google-maps/ <comment><USER2> This is from 2016.

There already was a discussion on HN here: [https://news.ycombinator.com/item?id=11604387](https://news.ycombinator.com/item?id=11604387)</comment>


Nine-Year Old Whiz-Kid Writes iPhone Application  - <AUTHOR> http://www.retireat21.com/new/Nine-year-old-whiz-kid-writes-iPhone-application

<comment><USER2> [http://www.retireat21.com/new/isteam-for-iphone-earns- makes-...](http://www.retireat21.com/new/isteam-for-iphone-earns-makes-young- entrepreneurs-rich) says "The iSteam application is for sale for just 99cent and has been bought over 1 million times since its launch last week! ISteam has currently experienced more than 14% daily growth, with estimated monthly revenues of $100,000 - all this just 8 days after iSteam was first released."

\--

The numbers on this site seem bogus. iSteam is currently ranked 99th in Entertainment. However, if it had been #1 last month, one million downloads in one week couldn't have been possible.

The app costs $.99. It is funny that the post talks about one million downloads in one week and then goes on to say that the monthly revenue is expected to be 100,000.</comment>


Silicon Valley's corporate culture is ageist - <AUTHOR> https://www.ft.com/content/244d22b4-9c47-11e6-a6e4-8b8e77dd083a <comment><USER2> "Subscribe to read: Silicon Valley's corporate culture is ageist"

No.</comment>


MIT Study: U.S. Has Regressed to a Third-World Nation for Most of Its Citizens - <AUTHOR> https://theintellectualist.co/study-mit-economist-u-s-regressed-third-world-nation-citizens/ <comment> tony-allan Further information link from the post...

[https://www.ineteconomics.org/perspectives/blog/america- is-r...](https://www.ineteconomics.org/perspectives/blog/america-is- regressing-into-a-developing-nation-for-most-people)</comment>


Stanford announces 16 free online courses for fall quarter - <AUTHOR> http://news.stanford.edu/news/2012/september/online-courses-fall-090712.html <comment><USER2> Plug: I maintain a list of all the MOOCs over at Class Central - <http://www.class-central.com>

Here is a list of courses(43 total, 28 new) that start in September : [https://plus.google.com/107809899089663019971/posts/4nundLE1...](https://plus.google.com/107809899089663019971/posts/4nundLE1yVB)

<comment><USER3> Cool, but:

404 <http://www.class-central.com/In-Memory%20Data%20Management>

<comment><USER2> Thanks! Fixed.

</comment></comment></comment><comment><USER4> And it's not just Stanford:

* 123 coursera courses from some of the best universities in the world in the next year: <https://www.coursera.org/courses>

* 14 Udacity classes: <http://www.udacity.com/>

* 6 edX courses from Harvard, MIT and Berkeley: <https://www.edx.org/>

Education is changing. About time.

<comment><USER5> "Education is changing."

Exactly how? So a bunch of "courses" (i.e. video lectures and PDFs and web pages) are put online. How is this a big deal? The University of Illinois offered complete courses online, for full credit, in the 1960s. By the early 80s, thousands and thousands of students were taking online courses at Illinois.

How is this throw-a-video-lecture-on-YouTube progress again?

<comment><USER6> This isn't some mail-order-MBA-translated-to-the-internet, your Illinois example is apples and oranges.

In fact it's not even about course credit. It's free. People from Africa, South America, India, China and so forth are getting access to professors at Ivy League universities.

That's a big deal in my book!

Yes, One professor can throw some videos on youtube, but this is a structured environment to bring full courses to students. And more importantly, it's a 'hot' idea right now, it seems professors left and right are coming out of the woodworks to join in.

So yes, education is certainly changing. It's hard to say where to exactly, but something is stirring - and I think it's good.

<comment><USER7>
      > People from Africa, South America, India, China and so
      > forth are getting access to professors at Ivy League
      > universities.

And?

<comment><USER8> And this: [http://chronicle.com/article/Teaching-to-the-World- From/1340...](http://chronicle.com/article/Teaching-to-the-World-From/134068/)

</comment></comment></comment></comment></comment><comment><USER9> People without a formal algorithms background should strongly consider taking Algorithms from Roughgarden. I took that class from him, and it's a great class that he teaches spectacularly. Great for the self-taught hackers whose coding skills lag their formal knowledge of some of these quite-useful techniques.

I'm probably taking Networking and Machine Learning for credit. I'm excited that McKeown is teaching networking for the first time since I've been around (not sure if he ever did). He's done some really interesting networking research and usually teaches the more advanced networking class, which I've heard great things about.

<comment><USER10> I've been taking the other algorithms class (Sedgewick and Wayne from Princeton), which has been interesting and informative so far.

I'll second your statement about the usefulness of these classes for people who are self-taught - I'd been trying to go back to school to get a CS degree, but working full-time and not being very close to any universities made it difficult. While I won't get an actual degree from these online courses, they have been really useful so far for filling in some gaps in my knowledge.

<comment><USER11> My algorithms professor is using the videos from the Sedgewick and Wayne course entirely as a way to present new material in place of lectures. He's teaching their book and his view is essentially that his time in lectures is better spent answering questions and interacting with the class than introducing new material that has been extemely well presented on the web already.

I can attest to the quality of Sedgewick and Wayne's lectures, and I have a lot of respect for my professor's humble and novel approach to teaching this course.

<comment><USER12> You are damn lucky. It's a rare professor who focuses on the needs of the student at the expense of his own ego inflation.

</comment></comment></comment></comment><comment><USER13> As a man of 48 years who does not have the time to "head" back to class I LOVE all these courses. The receptionist in our office (she's 52) is taking the Sustainability course on Coursera. That's a wonderful thing. I've already taken the Cryptography course.

You may think it's only the younger generations benefiting from this trend in education. I assure you, it is not. :)

</comment><comment><USER14> I highly recommend crypto & machine learning. Tina Seelig can also be quite phenomenal but I only attended seminars of hers so can't speak about her full course.

<comment> at-fates-hands I was eyeing the up the class on cryptography so thanks for the recommendation. The Human-Computer Interaction class looks really interesting as well.

This is just another great resource to supplement my experience. I also love taking a deeper dive on topics I think will really help in my day-to-day programming.

</comment></comment><comment><USER15> I'm sure some folks here did the Technology Entrepreneurship course the first time it was offered.

What was your experience like?

<comment><USER16> I took it. It was pretty good, I learned a lot from all the lectures and exercises, etc., but a lot of it is group work. Unless you go into it with a team of people you know beforehand and actually have the time to put into it every week, you might not find the experience that great. I was put into a team of other people from my country and we had probably around 10 team members at the start and that dropped to 2 by the end.

Also, in a class like this you really need that feedback from experienced people like professors, but the majority on feedback is just handled by other people in the class. We never got any professor feedback on our final demo and weren't invited to the demo day, so felt a bit left out by the end, even though we thought our idea and presentation was a lot better than some of the other teams.

</comment></comment><comment><USER17> Are there any decent projects created so far by the 'udacity / OCW' generation? It seems like they should be out in the wild now.

<comment><USER18> I also wonder this. Being self taught through online platforms such as this I spend a lot of time wondering how to prove their success at scale. In particular for less tangible learning (i.e. things I cannot point to my github account for)

</comment></comment><comment><USER19> I've been wondering what's the point of online courses, at least in disciplines, where there are good books available? E.g. you could very well get the same (or deeper) knowledge of AI by reading Russell & Norwig book, or algorithms from D. Knuth books. And text is mostly always is a better format than video lectures.

As I understand, participating in a course will put some pressure to complete most exercises and actually finish the course. You would also get some automated submission checks and could extend CV in the end. Also courses might mention recent discoveries that didn't find their way in books yet. Is that all or I'm missing something?

<comment><USER20> I think the experience of taking the classes is far richer than just reading a good text book. Advantages: video lectures with "pay attention" embedded quizes (that you can re-watch parts of as required), tests that you learn from by taking repetitively until you get a good/perfect score on, class forums, and homework that is automatically graded.

Really, no comparison.

</comment></comment><comment><USER21> I love that Stanford, MIT and others make their education available for everyone online. Unfortunately, I'm finding it really hard these days to follow along with a course, as opposed to following my own pace using whatever other materials. So it's kind of annoying because the courses are pretty current/relevant, but working full-time, etc doesn't always allow for following along with a course.

<comment><USER22> Check <http://www.saylor.org> . IIRC their courses allow you to go at your own pace. They offer many courses including but not limited to CS ones, and seem to use Khan Academy / OCW material.

<comment><USER21> That looks great. Thanks a lot!

</comment></comment></comment><comment><USER23> Does anyone know of similar courses for designers?

<comment><USER24> There is a Coursera course on design from UPenn (starting Oct 22): <https://www.coursera.org/course/design>

</comment></comment><comment><USER25> This is great. Looking forward to more advanced topics in Electrical and Computer Engineering. To my knowledge only Coursera provides some of this, with Computer Architecture coming up.

It would be sweet to get some serious Digital Electronics/VLSI and Integrated Circuits courses!

<comment><USER26> edX offer a course on Circuits and Eletronics. <https://www.edx.org/courses/MITx/6.002x/2012_Fall/about> I started last spring, but didn't finished because was a bit hard and time demanding.

</comment></comment><comment><USER27> A question for someone in the know that see this.

Are these qualifications the sort of thing you could include in a CV?

Being only 9 months in my first IT job it looks pretty bare right now, in need of padding.

<comment><USER28> Yes

</comment></comment><comment><USER29> Direct link to the set of courses: <http://www.stanford.edu/online/courses/index.html>

</comment><comment><USER30> How are those with full time jobs managing to find time to take part in these courses?

</comment><comment><USER31> Sweet. Signed up for Startup Boards: Advanced Entrepreneurship

</comment><comment><USER32> just as a caution, comic sans should not be used on a resume. LOL. nice stuff.fonts sure do have a personality.</comment>


$45k ARR in 10 months: Optimizations as a company of one - <AUTHOR> https://lunchbag.ca/company-of-one <comment><AUTHOR> Hi HN! OP here. Been working on my product, Lunch Money ([https://lunchmoney.app](https://lunchmoney.app)), full-time since I launched it roughly 10 months ago. Sharing my learnings and thoughts along the way as it can be pretty lonely and daunting as a solo founder out there. Let me know if you have any questions and thanks for reading!

<comment><USER2> Hi Jen, great post! As you continue to grow Lunch Money even further, have you thought about when will it make sense to bring outside help, and if so, will this be hiring our outsourcing to freelance?

<comment><AUTHOR> Hey, thanks! Honestly my thinking right now is that I want to continue growing Lunch Money on my own up until a certain ARR- I feel there's no reason to think I can't at this point. Past that, I may start to think about hiring outside help though I have no idea what that would look like. It would also heavily depend on where I'm at in my personal life as well!</comment></comment></comment>


Soon You Won't Have to Say 'Hey Google' to Launch Google Assistant - <AUTHOR> https://lifehacker.com/soon-you-wont-have-to-say-hey-google-to-launch-google-a-1822563826 <comment><USER2> Soon I will be able to be monitored by Google without my consent. Since now it will be hard to know what word will trigger it or even if I will hear the result of the trigger word.

<comment><USER3> Huh? I don't disagree that devices like GH might listen in on you more than you are aware of, but how does customizing the trigger word change anything beyond which word summons an interaction?

I mean why would changing it from 'hey google' to 'hey alfred' or even simply 'alfred' make GH more likely to monitor you without consent? Why would it be harder to know what will trigger it, or make the results less likely to be heard?

<comment><USER4> In theory, the device could only listen for its trigger word using local processing, which then and only then would trigger a cloud upload to process the following phrase. The user has implicitly indicated "I'd like a cloud lookup on this please, and I understand what I say next is going somewhere out of my control."

If you go with continuous recognition and upload, you then have everything you say being removed from your control. You'll see situations where cloud providers' records are subpoena'ed like that murder case with Alexa. [1] You'll also see cloud providers say "if you want to hav a private conversation, you best leave the room." [2] That's terribad for everyone.

1\. [https://www.engadget.com/2017/03/07/amazon-hands-over- alexa-...](https://www.engadget.com/2017/03/07/amazon-hands-over-alexa-data- after-murder-suspect-gives-the-okay/)

2\. [https://www.cnet.com/news/samsungs-warning-our-smart-tvs- rec...](https://www.cnet.com/news/samsungs-warning-our-smart-tvs-record-your- living-room-chatter/)

<comment><USER5> I don't think they would move to continuous recognition and upload. I think it would simply be listening for a different keyword, which it would recognize on-device, and then upload the audio following that.

It would be pretty insane if every android smartphone was continuous uploading audio to Google's servers for processing. Can you imagine the processing requirements, the bandwidth load, the battery drain?

<comment><USER4> Mobile, yeah, but going by the above two references, both the Alexa and Samsung examples _are_ doing something with continuous upload or they wouldn't be in the news.

<comment><USER6> If you had bothered to read the article...

>While Alexa is constantly listening, it only records data after the "Alexa" or "Amazon" commands are given. However, the Echo speaker was reportedly streaming music near the tub, and investigators believe it could have been awakened intentionally or accidentally. If so,the presence of a recording could tell them if Bates was awake when he said he was sleeping, for instance.

It only sends data after hearing its wake up words, just like everything else. If it were constantly streaming they would be caught as soon as someone decided to fire up wireshark (i.e. very soon after release.)

<comment><USER7> I even ripped apart an Echo dot a little while ago, de-soldered the NAND from the device and dumped the FireOS-based ROM to take a peek myself. It is indeed performing audio processing for the wake-up word entirely locally.

<comment><USER4> This is the most important comment here. Some independent verification.

Worthy of a blog post?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Trigger words have their place, but come on Google, Amazon, and Apple...the obviously correct primary way to tell the device you are about to speak a command or query should be by tapping a replica of a Star Trek combadge worn on the front of your shirt.

At its simplest, all this needs to be is a Bluetooth button paired with the device. Higher end badges could also be available that include microphone and speaker and can communicate with the device over something longer range than Bluetooth, such as WiFi, to provide access to the device when outside of voice range.

Such badges already exist for hands-free calling with cell phones [1], so its not like there is some technological limit to building such things.

[1] [http://www.thinkgeek.com/product/jmgi/](http://www.thinkgeek.com/product/jmgi/)

</comment><comment><USER9> Great. Can't wait for the day when I can selectively summon Google Home without having to awake every single Android device within an earshot.

<comment><USER10> There's actually a support page for this, outlining the steps to make sure that this doesn't happen (basically: have Google Home installed on your phone). It doesn't work.

</comment></comment><comment><USER11> Really looking forward to this feature! I've had Google Home since the first day it became available in the UK and it's proven to be really useful. I love how I can ask Google random questions and it gives me very accurate answers, play my favourite songs or let Google surprise me by suggesting a music genre. Depending on my mood I might ask Google to play anything from classical music to heavy metal.

The best thing about Google is that the more I use it the more I discover how useful it can be. For example last week I was running up and down through my flat packing some stuff and I quickly had to go to a grocery store at 10PM and I thought instead of opening my Google maps and check all nearby stores manually I thought I'll try to ask Google which grocery store is still open near me and it gave me a perfectly matching answer. I was really impressed!

<comment><USER12> I had the opposite experience. I asked Google:

"Hey Google:, whatis the score of [University] basketball game?"

Even though the game was going on, Google told me about the women's basketball game the following day. It took about 5 min before I could get Google to give me the results I wanted.

I have had a lot of results like this--Google becomes useless. It's faster for me to search for it by hand.

</comment></comment><comment><USER13> Various Android phones have had that for ages. Shouldn't be very hard.

<comment><USER5> My 2014 Moto X did this. When I switched to a Nexus 6P I was bewildered why I could no longer pick my own phrase.</comment></comment>


Ways Jetpack Has Helped Android Leapfrog iOS for Developers - <AUTHOR> https://spin.atomicobject.com/2019/01/14/android-vs-ios-development/#.XDyNSgMSpJY.hackernews <comment><USER2> I vastly prefer Swift to Kotlin, the latter of which feels like a knee jerk reaction to Java.

Like someone who was upset they had to write Java for years decided to make a language as overly sweetened as possible and more syntax thank you can shake a stick at (and bringing back gotos as "return@")

<comment><USER3> You say "overly sweetened" as a pejorative but I'm curious what is wrong with a language being "too sweet"? Is it because it becomes too complex, too hard to learn? This is definitely what I feel with Groovy, which looks simple on the surface but is actually quite hard to teach to people because there is so much implicit behavior. But then, we're not in kindergarten here, every tool I use is a long term investment so I don't mind that too much if there is payback in the long run.</comment></comment>


10 Steps to Being an Ex-CEO - <AUTHOR> https://medium.com/what-i-learned-building/b65676446097

<comment><AUTHOR> Some pretty high-EQ insights here, I'd say, from a founder passing the buck onto a hired pro.</comment>


[video] Boston Dynamics Atlas robot video commented by selected tweets - <AUTHOR> http://www.subtubing.com/play/rVlhMGQgDkY/ <comment><AUTHOR> Probably the most commented video in the geek-world last week. Now with selected tweets.</comment>


Ask PG: Is there a "startup success recipe"? - <AUTHOR>

I'm sure that everyone here is reading mountains of material stating "startups should be doing this!" and it's easy to get drowned in all of those TODOs and fail because we haven't placed our focus on the correct TODOs.<p>Are you able to summarize, into perhaps a (very) short paragraph for each of "If startups focus constantly on perfecting these things, they are almost ensured success" based upon your experience of startups? <comment><USER2> Start with two or three founders who are determined, sufficiently smart, and work well together. Work on an idea that grows organically out of your own experience. Launch fast and iterate, using growth rate as a guide. Don't be dismayed when it turns out to be hard.

<comment><AUTHOR> Thankyou. That's perfect.

</comment></comment><comment><USER3> The first adjective that pg used was "determined". It's also essentially saying the same thing as his last sentence. I'm guessing that's not an accident.

<comment><AUTHOR> Agreed. However I managed to spend 5 years being determined on a startup that ultimately failed, so I need to focus more on the other aspects he mentions.

</comment></comment><comment><USER4> I'm going to expand this blog post into a book: [http://www.layeredthoughts.com/startups/12-rules-for- buildin...](http://www.layeredthoughts.com/startups/12-rules-for-building- your-first-profitable-startup)

The goal is to create essentially a framework for startup ideas that can set you up for success in the best way possible.

</comment><comment><USER5> <http://www.paulgraham.com/die.html>

<comment><USER6> I was going to post this, so instead I'll post what I think is the paragraph OP was hoping for:

And however tough things get for the Octoparts, I predict they'll succeed. They may have to morph themselves into something totally different, but they won't just crawl off and die. They're smart; they're working in a promising field; and they just cannot give up.

EDIT: I am not reading "mountains of material". I am mostly trying to shorten the list of things we need to do before shipping.

</comment></comment><comment><USER7> I think the simplest recipe for success is set deadlines and meet them asap, the faster the start up meets deadlines the faster they grow and the faster they grow the faster they can succeed, booya

</comment><comment><USER8> There is a very precise recipe necessary for success. These are the exact steps you need to take, pay special attention to the order because it's very important you follow it exactly.

1\. Succeed

Unfortunately most funded, incubated, accelerated, bootstrapped, unfunded, unincubated, unaccelerated and other startups fail to follow these very simple instructions.

</comment><comment><USER9> Learn everyday

</comment><comment><USER10> Profitability.

</comment><comment><USER11> Up Up, Down Down, Left Right Left Right.

Works every time.

</comment><comment><USER12> 1\. Have luck.

2\. Or: Pivot. Have luck.

3\. Or: Pivot. Have luck.

(This assumes you know how to build a startup)</comment>


Linux VS open source UNIX - <AUTHOR> https://www.adminbyaccident.com/politics/linux-vs-open-source-unix/ <comment><USER2> This weekend I started digging into OpenBSD. I'd never used a BSD - been a Linux user for the past decade. While the table linked might show OpenBSD as the "least complete", what seems to be the case is that they pick one tool to fit a use case and then use that one. There aren't 400 different shells installed by default or 5 different process monitoring/inspection programs, because they have the one they like and use/improve upon it.

OpenBSD is a fascinating operating system. I'm only a few chapters into Absolute OpenBSD ([https://en.wikipedia.org/wiki/Absolute_OpenBSD](https://en.wikipedia.org/wiki/Absolute_OpenBSD)) by Michael W. Lucas, but from a Linux user/admin perspective it is enthralling. I can't wait to learn more about it.

<comment><USER3> The systemd debacle is what led me down a rabbit hole toward the BSD's. Don't get me wrong, systemd actually adds a lot of needed functionality, but I really feel like it is a major philosophical branch away from the conventional Unix thinking of 'make a tool that does one thing really well'.

That mindset has such a strength in that such tools form reliable building blocks for other tools and system components in a way that is really approachable for amateur/volunteer developers. It takes no time to parse through the man page of a simple tool. And only a bit longer to parse the code. That makes it easy to build improvements, or build on top of it.

But trying to wrap your head around systemd in even a few hours isn't reasonable. And binary log files? Wtf. It also seems like relying on certain aspects of it's behavior is a good way to end up breaking your system.

BSD still has that old school Unix mindset that made Linux great in the first place. Especially up against Microsoft's products.

The proof in the pudding for me is to look at the running processes of a default system between BSD and Linux with systemd. Yikes.

<comment><USER4> > The systemd debacle is what led me down a rabbit hole toward the BSD's.

Like most, you could have simply moved to a distribution without systemd. Unlike Linux, the BSDs offer less choice when it comes to both init, service supervision and service management options. It is also evidenced in the comparison table in the OP. If anything the _debacle_ resulted in creating more awareness and leaving people open to more choice.

That said, adopting one monolith instead of another sounds more like a knee jerk reaction than anything else.

> The proof in the pudding for me is to look at the running processes of a > default system between BSD and Linux with systemd. Yikes.

This only scratches the surface. Daemons running under systemd have their PIDs supervised instead of using unreliable hacks like pidfiles. This is one of the reasons why systemd is preferred in large deployments and professional environments.

<comment><USER5> BSDs aren't a "monolith", but the system and tools are developed together and parts can be replaced wholesale if you choose to do so.

Also, there's what, Gentoo and GUIX that don't use systemd? Gentoo still prefers building all source on the system which is a non-starter for most, and GUIX I didn't think was ready for a daily-driver role yet.

<comment><USER6> [https://nosystemd.org/](https://nosystemd.org/)

The most popular non-systemd distro I hear about is Void linux, which is a rolling release style distro that's pretty comparable to(though not based on) Arch.

As a tangent because you brought up distro's and difficulty, I know Arch has a reputation with some as being too difficult for regular skilled users, but as a regular skill level user myself, I find that the Arch/Void style rolling release paradigm of doing stuff makes things easier for noobs like me, not harder.

Once you get past the initial hurdle that is the first hour or two of install and setup(which you can do just by copying youtube tutorial instructions line by line) then everything after that is much simpler.

For me, I find that the majority of everyday linux problems all boil down to trying to install or update some kind of software. Either software you already have has a bugfix or feature you want in the newest update, or you have some new software you want to install. And because developers like new shiny things, often times the newest version of whatever has a dependency of some other new shiny thing.

Installing new software in a fixed release distro often quickly gets too hairy for me, but in Arch I can almost always a simple install directly from the main or user repositories. This has so far eliminated 95% of everyday problems for me defying the usual narrative I hear of it being "harder" to use for normal Joe's like me.

<comment><USER7> > For me, I find that the majority of everyday linux problems all boil down to > trying to install or update some kind of software. Either software you > already have has a bugfix or feature you want in the newest update, or you > have some new software you want to install.

And yet the Linux Desktop community insists on sticking with the package manager/repo model that makes stuff like this such a pain. Worse, it's actively hostile to the concept of portable applications in general.

</comment></comment></comment></comment></comment></comment><comment><USER8> This guy has a real knack for complaining about an issue, and than admitting it was actually fixed a while ago.

Complains about a certain guy's benchmarks being affected by using different compilers, but of course that guy switched to using the same compilers already

Than he does the same thing with epoll- complaining about something being broken, but then admits it was fixed in 2016

I wasn't really able to pull anything material out of this article. I guess this is why people like benchmarks- it's hard to write an opinion piece about performance.

</comment><comment><USER9> IIRC the "features" that Linux has over the _BSDs are usually just referring to driver support and ported software. Since drivers are part of the kernel, BSD licensed drivers can be easily ported from a_ BSD to Linux, but Linux drivers are GPL and have to be rewritten for use in a *BSD.

Also FreeBSD usage is smaller so there is not as much effort to get software working on it, like Steam or obscure/specialized software. In practice Linux packaging efforts are fragmented among distros so the gap is not huge, but it's still present.

</comment><comment><USER10> What is the situation for "reproduce a currently-installed system from a list of packages (including version/release if relevant) and a tarball/git checkout/package-deployment/puppet run etc. of configs"?

As far as I know, on most BSDs, unless you happen to have a complete source tree snapshot for said system (becoming more difficult to maintain if you build multiple systems without special tricks to retain binary artifacts), you're out of luck, you'll get today's STABLE or RELEASE, not the one from 17 days ago when your current production box was built that works perfectly unlike the one today that is broken.

This is trivial to accomplish on all Linux distros.

(I would say this kind of issue should be listed in the table in the article).

<comment><USER11> Which BSD?

the "preferred" way to do this in a datacenter context with FreeBSD is to run a repo yourself with poudriere; this has the downside of causing you to build all your dependencies (via ports), but the upside of having everything built with your exact specifications in mind and in a way which ensures that they are rolled out in the way you prefer and that they are consistent amongt all instances.

For "old school sysadmins" who like controlling the versions of things in a very well defined way and running their own repositories it is absolutely ideal.

However, it affects developer velocity of course.

</comment></comment><comment><USER12> The author is pretty inconsistent here. They make good points when mentioning all the problems with benchmarking and how it's a bad idea to fixate on a specific, narrow problem - but then, go on to complain about specific, narrow problems, using them to build a narrative about how linux/whatever is flawed.

A specific example: the part about how epoll() is broken because of its design, and how it causes 'thundering herd' issues when using multiple threads/processes. I had plenty of experience with epoll from over ten years ago, and it wasn't a problem even back then. Multiple processes listening on the same socket did _not_ all wake up when a new connection came in. Sure, why not bring up specific issues with Apache, but there are plenty of other web servers that work very well (nginx, etc) and have existed for over a decade.

<comment><USER13> gunicorn (Python, in case you're lucky enough to not have run across it) forks after creating listener socket(s). Every child does the epoll thing. When awakened, they all call accept4 and then all but one gets -1.

This happens right now and "powers" a stupid amount of the economy. And it's wasteful.

<comment><USER12> Our old mechanism was a parent process that created the listen sockets, and then sent the FDs to the previously-created child processes. (The children would be registering their FDs with epoll and then calling accept() themselves) That never seemed to trigger the problem.

</comment></comment></comment><comment><USER14> Meta/mods: please shorten the title, to remove the needless duplication of the site's name. Thanks.

</comment><comment><USER15> >Linux receives much more investment from companies and therefore more paid developers are in it, plus BSD's feature parity with that of Linux doesn't hold.

I would say that is actually true ... and is the root cause of the complexity crisis Linux is experiencing these days. There is a strong financial incentive to add things but no financial incentive to take things out. Every time you add a feature to a complex system you take something away from everything else.

</comment><comment><USER16> Not sure why Linux gets 'Partial' in Container Security whereas FreeBSD gets a 'Yes'. Both provide mechanisms that can equally be misconfigured.

</comment><comment><USER17> How come OpenBSD has no containers other than _chroot_?

Is there anything similar to _firejail_ [1] for OpenBSD?

[1] Firejail is an easy to use SUID sandbox program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces, seccomp-bpf and Linux capabilities.

</comment><comment><USER18> It would be fair to mention that Linux actually includes two other schedulers in addition to CFQ: Deadline and Kyber.

Firewalls: Linux, and no mention of bpfilter?

<comment><USER19> It's clear that he's biased, trying to prove to the world that *BSD is better than Linux, Linux should not had the success it had etc. I remember the same people, 20 years ago too. They are probably the only type of geek worse then the typical Linux fanboy saying that Windows is bad.

</comment></comment><comment><USER20> Linux supports eBPF since 3.18.

<comment><USER21> right

</comment></comment><comment><USER21> I like Linux. But what about Unix?</comment>


Show HN: Write Qt for WebAssembly Applications Entirely in Go And/or JavaScript - <AUTHOR> https://therecipe.github.io/widgets_playground/ <comment><AUTHOR> If you are on mobile, here is the direct link to the repo: [https://github.com/therecipe/widgets_playground](https://github.com/therecipe/widgets_playground) Sorry, the widgets playground isn't really meant to be used on mobile devices. The next playground will be made with QML instead and should be better suited for mobile usage.</comment>


Pick: The simplest way to schedule a time to meet - <AUTHOR> http://www.pick.co/

<comment><AUTHOR> Pick is a free scheduling product that simplifies the process of finding time to meet with your colleagues and friends. We eliminate the 'back and forth' that often occurs when trying to find a mutual time to meet with your contacts. In addition, we streamlined and simplified the event creation process through our mobile app to make it a far less cumbersome experience compared to doing this via desktop. Check us out at [http://www.pick.co/](http://www.pick.co/) and let me know what you think!

Download app here: [https://appsto.re/us/6im83.i](https://appsto.re/us/6im83.i)

</comment><comment><AUTHOR> [http://www.producthunt.com/posts/pick](http://www.producthunt.com/posts/pick)</comment>


Tesla Vs Top Gear: Telsa loses libel case - <AUTHOR> http://venturebeat.com/2011/10/19/tesla-vs-top-gear-telsa-loses-libel-case/ <comment><USER2> This is the streisand effect at it's best. Most who are fans of the show likely forgot about this episode, while those who aren't are now aware of some potential downside. What was tesla is thinking in this one, besides annoying a popular car show and it's fans?</comment>