Parallel Roguelike Lev-Gen Benchmarks: Rust, Go, D, Scala and Nimrod - <AUTHOR> http://togototo.wordpress.com/2013/08/23/benchmarks-round-two-parallel-go-rust-d-scala-and-nimrod/

<comment><USER2> Really nice article.

> I think there may be a more concise way to parallelise parts of the problem > in Rust, using something like (from the Rust docs): > > let result = > ports.iter().fold(0, |accum, port| accum + port.recv() );

We plan to have convenient fork/join style parallelism constructs, so that you don't have to build it yourself using message passing or unsafe code. There is a prototype in the `par.rs` module in the standard library, although it's pretty rough at this point.

I'd be interested in seeing what the benchmark looks like with Rust 0.8, which has a totally rewritten (and at this point much faster) scheduling and channel implementation.

<comment><USER3> I'd like to test it with the new Rust-coded runtime, especially if it's faster, but I won't have time to build it for a couple of days. I actually avoided building it earlier because I thought the new scheduler was slower and needed time to mature (I think I read that it doesn't yet swap tasks between threads, or something along those lines?), but I must have misread.

<comment><USER4> Yes this was a interesting benchmark, nice work. One question though, why are you using an old version of GCC (4.7)?

4.8 has been out for quite some time, I did a quick comparison using your benchmark between gcc 4.8.1 and clang 3.3 on my system and clang still won but the difference was ~3.5% on my machine.

<comment><USER3> I was using LLVM 3.2 because Rust and LLVM-D use that, so I thought it was fair. GCC 4.7 followed from this because I assumed it was of the same generation as LLVM 3.2, and that 4.8.1 was newer so less fair to compare to LLVM 3.2.

<comment><USER4> I see, personally I would prefer using the latest release available for each language as this more likely mirrors 'real world' scenarios.

But that's preferences for you, everyone has them :)

<comment><USER3> You're right that it probably makes for a better benchmark, and I tried to use recent versions for the other languages, I just didn't bother for C and C++ as I assumed they'd already be the fastest in class so there was no need to test on the latest compilers.

<comment><USER4> Well my main interest in this benchmark was actually that of Rust and Go as those are the languages tested that I'm personally most interested in (nice seeing them performing quite well), I just found the use of older compiler versions as an odd thing (though you explained your rationale).

Any chance you would consider putting the compiler version used (for all compilers, not just c/c++) next to the compiler in the column for better disclosure?

Good luck on your game!

<comment><USER3> Thanks! And sure, I'll put the compiler versions up sometime next week, along with the compile times.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> Have sent in a pull request:

[https://github.com/logicchains/Levgen-Parallel- Benchmarks/pu...](https://github.com/logicchains/Levgen-Parallel- Benchmarks/pull/9)

Go performance improves from ~470 ms to ~360 ms on my Quad core MBP 15 (Late 2011)

<comment><USER3> Thanks, that makes it faster than Scala.

<comment><USER5> Welcome! Now have a look at this: [https://github.com/logicchains/Levgen- Parallel-Benchmarks/pu...](https://github.com/logicchains/Levgen-Parallel- Benchmarks/pull/11)

<comment><USER6> I think that optimization can actually be applied to all the languages.

</comment></comment></comment></comment><comment><USER7> Cool article! One thing that might be important to people if you're looking at these languages besides just speed: Go and C will tend to have radically lower memory usage (often like 10x) than most of the other languages there, such as Scala. This can be very important depending on what your application is. For me, using Go for game world servers was my choice because I can do so much more simulation per dollar of server RAM.

<comment><USER8> What's important is the marginal memory usage. I'd rather pay 20-30MB of JVM memory tax upfront it it levels up with C/C++ for long running process and lowers the possibility of a memory leak and memory corruption.

<comment><USER9> If it was just the 20-30 MB JVM tax, I might be with you. But in applications that allocate and deallocate a lot of memory, the GC of every JVM implementation I've used also hoards memory from the system (well there are a few implementations that give it back, but they cause app performance to nosedive).

If you're building a piece of software that needs to co-exist with other memory intensive processes, the JVM's policy of taking memory and rarely giving it back can cause unnecessary swapping. Heaven forbid you need to run multiple JVMs on the same machine (like with hadoop).

Then you start having to do silly things like specifying how much memory your app is allowed to use which makes me feel like I'm on classic MacOS.

<comment><USER10> This is a big issue for me too. IIRC the next version of the JVM will allow you to specify a target memory usage as well as a max, which will encourage it to GC more after memory spikes. You should be able to return some of this to the system without too much penalty (as long as the spikes aren't too frequent...).

<comment><USER8> No need to wait for the "next gen" GC. Right now you can specify min percentage of free space in a heap that triggers giving back memory to the OS. Yes, you need to specify a few more GC parameters, but it's certainly doable to force JVM to behave this way.

I used this approach in the past to keep memory usage lean. I had some spikes in application that required a lot of memory, so had to keep Xmx high, but configured the app to trigger deallocation to the OS when there's more that 20% of free memory. Worked like a charm even on and old ere 1.5 Sun JVM.

<comment><USER10> That mostly works, but you do still run into the issue of the memory hanging around until collection - so if your JVM doesn't choose to collect (because it has a high Xmx set), it keeps a bunch of ram.

</comment></comment></comment></comment></comment></comment><comment><USER9> Odd. Why is the C version so much slower than the C++ version? The only thing I notice that's odd is the unnecessary Room/Tile structs + memcpy in MakeLevs, but that can't be responsible for that level of difference.

Also there is a small bug in the C version. When it goes to print out the level, it only compares the first 100, so it'll print a different level from the C++ version with a seed of say, 20.

<comment><USER11> Changing MakeRoom to be inline (gcc 4.6.3) turns out to be a significant speedup.

Also appears to be a small benefit from modifying the Lev struct to have Room first.

</comment></comment><comment><USER12> This is not really too relevant to the article, but that random generator makes me cringe. You can replace it with a decent quality one (xorshift) with about as many lines of code:

      uint32_t genrand(uint32_t *seed)
      {
        uint32_t x = *seed;
        x ^= x << 13;
        x ^= x >> 17;
        x ^= x << 5;
        *seed = x;
        return x;
      }

<comment><USER6> It actually was changed from stdlib RNG -> xorshift -> this RNG when the previous (non-parallel) article was posted.

</comment></comment><comment><USER13> Haskell was excluded from this benchmark because I can't figure it out.

<comment><USER3> Take the code here: [https://github.com/logicchains/levgen- benchmarks/blob/master...](https://github.com/logicchains/levgen- benchmarks/blob/master/H.hs) and run it. Then, take the same code, change the genRooms function to contain:

      where

        noFit    = genRooms (n-1) (restInts) rsDone

        tr       = Room {rPos=(x,y), rw= w, rh= h}

        x        = rem (U.unsafeHead randInts) levDim

        y        = rem (U.unsafeIndex randInts 1) levDim

        restInts = U.unsafeDrop 4 randInts

        w        = rem (U.unsafeIndex randInts 2) maxWid + minWid

        h        = rem (U.unsafeIndex randInts 3) maxWid + minWid

And change:

let rands = U.unfoldrN 10000000 (Just . next) gen

to:

let rands = U.unfoldrN 20000000 (Just . next) gen

The running time should double. Does it? Or does it increase by orders of magnitude? The latter is what happens to me.

<comment><USER14> I just changed the random number bit, not the 10000000 part, and it took ~100x longer. No idea why.

<comment><USER3> Maybe a compiler bug?

<comment><USER14> I'm a total noob to haskell and I'm not sure I understand the code well enough to ask an intelligent question about it, but I'd love to see you/someone ask on the haskell mailing list/stackoverflow/reddit-haskell or something.

<comment><USER3> I'll post a question on Stack Overflow then when I have time.

</comment></comment></comment></comment></comment></comment><comment><USER15> Although it's nice to see which compiler performs best, I'm really curious as to _why_ one compiler outperforms another for the same language. What's gcc's achilles heel for example? (it seems to consistently do worse for every language it's use for)

<comment><USER3> GCC outputs a jmp in the assembly for GenRands rather than a cmov. This involves branching, leading to branch misses, which waste time.

<comment><USER15> Thank you for clearing that up. You probably won't see this after 11 days, but I have to try: is that a missed optimisation or a deliberate design decision?

</comment></comment></comment><comment><USER16> Why are you parallelizing these in such different ways? For example, in Go you start 800 goroutines, but in others you start just 4 threads/tasks as worker pool. I would imagine indeed these would give quite different results.

<comment><USER3> It's done differently in Go because someone else wrote it, and I found it to be faster than the version I wrote using a worker pool of 4 tasks. If you look closely you'll see it doesn't actually ever run more than 4 goroutines simultaneously.

<comment><USER16> I noticed that, but you're still allocating for 800 goroutines in the end. I guess in the scope of the benchmark, that is still relatively cheap. It just was a red flag for me.

<comment><USER3> No worries. A commenter here submitted a faster version, so it uses that now instead anyway.

<comment><USER5> Thanks :P And now an even faster version for your perusal:

[https://github.com/logicchains/Levgen-Parallel- Benchmarks/pu...](https://github.com/logicchains/Levgen-Parallel- Benchmarks/pull/11)

> 120 ms improvement over the origin implementation</comment></comment></comment></comment></comment>


How Albuquerque helped its homeless population and saved money in the process - <AUTHOR> http://www.politico.com/magazine/story/2016/12/what-works-albuquerque-homeless-solution-housing-policy-214527 <comment><USER2> It is mind-boggling that one of the richest countries in the world and definitely the most powerful one has such a big problem with homeless people. My first impression when I came to US 4 years ago and in CA specifically was the amount of homeless people. I have not seen so many even in my home country that has a LOT of illegal immigrants. So far I have not seen any progress, at least in the state of CA. Does anyone know if those people are doing that by choice, is the system "punishing" the people that made a bad choice maybe in the past and lost everything, is it something else ? I have heard that it is very difficult to find a new job once you reach that level, not because you don't want to, but because of formalities (e.g. no home address, etc). Is that true ? It is not fair for people to not be able to sleep under a roof or to not be able to have food and clean water (see Africa), and at the same time to have so many technological advances and to have so many millionaires/billionaires that care only about their pockets.

<comment><USER3> It's just a very hard problem to deal with, and places like CA attract homeless people from other places, because they have good services. The US lacks a comprehensive national plan to deal with homelessness.

Part of the problem is that even when services exist, they're often fragmented and hard to administer. That's what led to ideas like "Housing First", where they've found just providing a home for a year fixes most homelessness problems (particularly when combined with other services). Having a home gives them a base to operate from to organize the rest of the services, finding a job, etc.

Part of the problem is that the US doesnt have a good plan for what to do with crazy people. We had a lot of problems with long-term institutions, but when we shut them down, we didn't actually start a new solution. We just left them on the streets.

Part of it is just social myth that people deserve their caste. If the homeless don't deserve their place in the increasingly vitrified social system, then perhaps the wealthy and powerful don't _either_ , and so a large amount of anti-poor propaganda has been generated in the US by the elite.

<comment><USER4> > places like CA attract homeless people from other places, because they have > good services.

California's winter weather is more survivable than most parts of the country.

> Part of the problem is that the US doesnt have a good plan for what to do > with crazy people. We had a lot of problems with long-term institutions, but > when we shut them down, we didn't actually start a new solution. We just > left them on the streets.

Institutions were replaced with drugs. In 'Anatomy of an Epidemic' [1], Robert Whitaker says that before the drugs were available, many people were able to recover enough to get out of the institutions.

The book makes the case that commonly-used psychotropic drugs take an episodic illness and make it chronic.

[1] [https://www.madinamerica.com/anatomy-of-an- epidemic/](https://www.madinamerica.com/anatomy-of-an-epidemic/)

This HN submission was from 2 days ago: _Psychiatrists Must Face Possibility That Medications Hurt More Than They Help (scientificamerican.com)_ \- [https://news.ycombinator.com/item?id=13186201](https://news.ycombinator.com/item?id=13186201)

This has been my observation of the system... My friend was doing well until they got hold of her.

<comment><USER5> Where is the data for the point about making psychotic chronic? Because there is peer-reviewed medical literature (meaning double-blind clinical trials) about their effectiveness in reducing symptoms, and "longer lasting symptoms" would have been a reportable adverse event that could/would have been seen.

Additionally: to advance this model, you have to think that the people caring for these individuals (both families and doctors) are either unable to see that the treatments make it worse, or that they see it but are motivated by something other than the patient's best interests. My uncle had schizophrenia. In my experience, neither of these were true.

Finally: these symptoms are chronic and intractable by nature, if you talk to people that have them. Look at the homeless people who are clearly mentally ill: they react to things we can't see all the time; not episodically.

Asking iconclastic questions like Whitaker does is important; we need to have a discussion about it and make sure we're not completely off base, but when you look at a persons total ability to function and their global quality of life, antipsychotic medications are helpful.

<comment><USER3> Just to comment on a case I know personally: the person had semi-regular psychotic episodes, a few per quarter, but every day meds to prevent them definitely made him less smart and... "there" on the good days (in addition to stopping episodes). That's how he was treated until about 20, when he managed to convince a doctor he should just have an as-needed supply of fast acting ones.

I know it's anecdata, but my experience is that there are a fair number of borderline cases where they can't hold it together sporadically, but the meds definitely lower the quality of the "good days" to fix that. Sometimes there's a fast acting med that can work; often there's not and patients are faced with a stark choice.

I think we see a lot more homelessness in that group of people than we should, because we basically trap them there after one or two episodes, even though if we fixed it and got them some help (usually better coping techniques; occasionally meds), we'd see a lot less homelessness.

I do think that meds have become a substitute for real coping technique teaching, and that in many of those cases, the caregiver isn't making the optimal choice for the patient, because they're optimizing cost or time invested, rather than long-term quality of life.

There are obviously things like hardcore schizophrenia where that isn't the case, but even for more sporadic delusion disorders, it can be.

<comment><USER4> Thanks for sharing your anecdata. I also replied to that comment: [https://news.ycombinator.com/item?id=13206356](https://news.ycombinator.com/item?id=13206356)

> I think we see a lot more homelessness in that group of people than we > should, because we basically trap them there after one or two episodes,

yes, this exactly: the system "traps" its patients with medications that do not address the cause of their psychotic presentations.

My friend just needed sobriety, but all she got were tranquilizers and other "bad prescriptions". She briefly escaped from her court-ordered medications, but then she got an SSRI which destroyed all the progress I'd made with her. See my comment history.

</comment></comment></comment></comment></comment></comment><comment><USER6> This and the similar initiative in Utah are the kinds of governmental problem solving I really like to see. More effective services for the populace in the form of helping people better their lives while at the same time benefitting society at large and being less expensive than traditional approaches. I count myself reasonably liberal, but these type of solutions have largely popped up in traditionally conservative places, which is a pleasant surprise and makes me take another look at my understanding of the spectrum.

<comment><USER7> I think this has more to do with the nature of Albuquerque than republican/democrat. This as someone who grew up there. I now live in Las Vegas. The two cultures are very different. There's a lot of hostility in LV in a general sense that isn't there in Alb.

<comment><USER8> I'd like to hear more about this.

<comment><USER9> Albuquerque is deeply Catholic. Catholicism, Latin American Catholicism in particular is very big on social/economic justice, charity, 'works theology'

Albuquerque (NM as a whole really) is quite poor and it's a lot easier to convince poor people to help poor people.

<comment><USER10> I lived in Albuquerque for nine years (2003-2012). The Catholicism is certainly part of it, but it's more complicated than that.

One gets the feeling that it's a more egalitarian city than other US metro areas. I didn't feel like it was that racist of a city, certainly nothing compared to Pittsburgh, where I now live.

And there are very few establishments that are designed exclusively for the wealthy. The Frontier restaurant near UNM is a great example of what I'm talking about. You would regularly see news anchors, professors, doctors, etc. dining there in the same room as people who were homeless.

<comment><USER11> > And there are very few establishments that are designed exclusively for the > wealthy.

This is an excellent description. Some people still flaunt their wealth, which is true everywhere, but I feel a sense of the city belonging to everyone that lives in it.

Of course, that's my view as a fairly well-off white male who's never experienced anything close to homelessness. People from different circumstances may have different opinions.

<comment><USER7> You can still find those places in Alb and the rest of NM. They have a hard time establishing a real presence though, as there really aren't so many people there. It still needs more industry/business. Something to pull the average income up and employ everybody.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Most problems that have hard line solutions, i.e. drugs and crime, have much cheaper alternatives which are usually much less hard line and much more humane. This also includes a lot of hard line management theories about how to get the most work out of workers. Better and more humane treatment of people usually leads to better and cheaper results... and better overall outcomes. These are usually arrived at by idealists and dismissed by rationalists and supposed realists.

</comment><comment><USER13> Hopefully next year the Federal and State money won't vanish. This is the kind of problem best solved locally, but it still requires money from somewhere.

</comment><comment><USER14> This is such a hard problem to solve and there will only be less and less money for it. It is a good approach to start helping people to help themselves, rather than saying "we'll help you AFTER you fix your hardest problems yourself.". This makes no sense and doesn't work. As shown here and in other cities ([http://gladwell.com/million-dollar- murray/](http://gladwell.com/million-dollar-murray/)), leaving homeless until they get so bad that they need ambulance and ER services is VERY expensive.

In our local town, the major hospital group did an experiment. They took a look at the top 50 patients that used the most of their ER and other services. They hired people whose job it was to make sure they stayed on track, got them to appointments (rides and public transport are big issues), made sure they stayed on their meds and followed treatment plans. It was a great success. They used ~70% of the resources that they used before. BUT, the hospital made lots of money on the use of those services, the experiment cost the hospital almost $1M!! It was not continued as hospitals exist to make money not help people.

So let's say a city takes a stance to be progressive and helps their homeless and (largely) gets them back on their feet. Pretty soon everyone in the surrounding areas hear about all the help and services and now one small town is dealing with all homeless that can get to this town. Smaller towns only have so much money to invest in an effort such as this. Additionally, what all jobs can you find to give all these people at $9/hour? There are only so many things you can have them do before you start cutting municipal jobs to create work and putting others on unemployment.

I saw a program several years ago where people that came into some of these programs, were set up with social security disability (especially those with mental issues and substance abuse issues) and give them a home base to get other program support. At least this uses federal resources and doesn't put such a strain on the local municipal budgets and resources.

This is a completely solvable problem but it takes a tremendous commitment of will. The other issue is that homeless don't vote. It is a problem that has to get fixed because it is the right thing to do, there is little political gain or public outcry in most cities. It is more expedient to work on issues like creating blue collar jobs and healthcare because of the public opinion payoff. Just my two cents.....

</comment><comment><USER15> Can we really not afford to provide very small homes (like tiny home villages) to all of the homeless (rather than just the most likely to die)? I think the biggest issue people would have with that is that people might take advantage. Certainly some would. But would there be so many that we couldn't sustain it, or that it would not match the benefit of having very few homeless?

It seems like there is just a very tiny amount of money available for these types of efforts. I really wonder why that is.

<comment><USER16> the biggest fear with some of this is that we tend to build public housing and then it turns into some sort of slum with heavy police presence. While I agree tiny housing is _usually_ better than no housing at all, I fear for what it will become in medium to larger cities.

If there is a way to mix in these small properties into an area and have mixed-sized housing, I think this would help the issue greatly - but the logistics and politics to make neighborhoods such seems too high of a bar in most places.

<comment><USER17> What I notice (since we're talking about 'Projects' it seems relevant) is that there is a very low take up of the Tiny House concept among the black population which mostly inhabits social housing schemes similar to the Projects. The next smallest group is working class whites but this group is still influential in the movement.

This is curious because a self built Tiny House is very affordable. You can build one of these for less than 10k: [https://www.tinyhomebuilders.com/images/products/simple- livi...](https://www.tinyhomebuilders.com/images/products/simple-living-tiny- house-exterior-1.jpg)

This is important because any social housing policy designed to decrease poverty requires a large amount of 'buy-in' or goodwill by the residents or it shall fail.

There is of course the question of land for THs, but that thorny issue has already been overcome by most Tiny House people in a variety of ways I won't list here, although I admit it is a serious concern.

I went in search of a black person who lived in a Tiny House. She had immediately understood the nature of the question and said a bunch of things on the subject, what stood out is that you might be able to sell the idea of being frugal, minimalist, eco-friendly, outright home ownership i.e. autonomy, practicality and economy to the majority white population that makes up the Tiny House movement e.g. poor students and downsizing retirees, but selling the same ideas to the black population is a very difficult sell.

[http://tinyhousetrailblazers.com/2016/07/where-are-all- the-b...](http://tinyhousetrailblazers.com/2016/07/where-are-all-the-black- people-in-the-tiny-house-movement/)

She said while many of the whites are coming from the suburbs i.e. been there, done that, the American Dream for blacks remains to have a big house with its associated trappings. That is when they know they have 'made it'. It follows that a re-imagining of the American Dream is necessary for the black population, just as has been happening for the people in the Tiny House movement, but different.

Where I don't concur with Miss Pearson, is that I think this is regression. For individuals it is a good adaption, yes, but the net affect on a society is indeed regression. Big Questions need to be asked about why that's happening.</comment></comment></comment>


Atom 1.24 - <AUTHOR> http://blog.atom.io/2018/02/13/atom-1-24.html <comment><USER2> I think the last time I saw an Atom post on here (a blog post), it ignored VS Code, and here we've got a very minor focus on responsiveness/performance.

I'm mostly reminded of Brackets, [https://github.com/adobe/brackets](https://github.com/adobe/brackets), which I moved away from as a general-purpose text editor, but still seems solid for specifically doing frontend development.

Everyone focuses on Atom as a general-purpose editor, and its performance isn't so great in that regard, but if it focused on a specific area, it would be something I might consider using again. It feels easier to have editors for different things, than manually enabling different sets of plugins, for different projects.

</comment><comment><USER3> Tree-sitter is impressive. When it's fully implemented, no other text editor in existence today will have the parsing capabilities of Atom.

Max Brunsfeld gave a talk about Tree-Sitter at FOSDEM 2018. You can check it out here.

[https://ftp.osuosl.org/pub/fosdem/2018/UD2.119/code_tree_sit...](https://ftp.osuosl.org/pub/fosdem/2018/UD2.119/code_tree_sitter.mp4)

<comment><USER4> And if it's truly better, the rest of them will pick it up eventually.

</comment></comment><comment><USER5> Seems like everytime there's a post about Atom, people keep talking about alternatives like VS Code.

I like Atom exactly for what it is. Simple at its core, very customizable, fast enough for regular use and under active development. Maybe other editors can do the same or more, but I don't really care.

<comment><USER6> Maybe you should care, since it's the other way around - VS Code is simpler and much faster, Atom is the heavy one.

<comment><USER7> Privacy Policy for VS code makes me glad that Google doesn't own it. With so many people mentioning it here, I decided to look it up, looks nice. The privacy policy links to an actually nice and extra thoughtful, 'opens your eyes to all kinds of different scenarios where microsoft gets your data" kind of thing, which was surprising and pleasant.

However broad the policy shows people various things with different products, it basically doesn't say much of anything about vs code, and starts discussing enterprise environments are situations in which you need to talk to your enterprise admin about privacy stuff, yada yada.

Going back to the vs code page, it says they use telemetry and crash dump reporting. It does say that users can follow a link for info about turning off crash reporting.

I am not sure what the exact definition of telemetry is, and if it varies from company to company. After seeing that MSoft was sucking in every keystroke typed on a windows machine, and having a terrible experience with UN-removable one-drive with an office 201X install, I've lost faith in what Msoft has become, and trust them less than free products from google.

Maybe there is some way to run vscode in a VM that is 100% blocked from the internet and that would prevent it from sending tons of data?

Maybe I am missing something this early and no coffee yet.

<comment><USER8> > _Maybe there is some way to run vscode in a VM that is 100% blocked from the > internet and that would prevent it from sending tons of data?_

Wouldn't these user settings be enough?

        "telemetry.enableCrashReporter": false,
        "telemetry.enableTelemetry": false,

</comment></comment></comment></comment><comment><USER9> Before using VS Code, Atom was my favorite editor, but I don't think I can go back to it. VS Code is just simply amazing.

</comment><comment><USER10> I like the idea of tutorials for generating language grammars [1]. I've made a couple grammars myself for both Atom and vscode and I can never find as much info as I'd like. For instance, what labels should various tokens get in order to have them show up as the proper semantic constructs in syntax themes? Last I checked, it was difficult to find a reference of what "standard" syntax themes recognize, and I ended up just looking through the source of existing themes for labels to try.

Going beyond a tutorial, what could be really cool is a GUI where someone can paste in a code snippet of a language they want to colorize, then manually go through tokens classifying them as literals/keywords/whatever. Making a proper grammar for an entire language just to get some basic colorization gets old fast.

[1] [https://github.com/atom/flight- manual.atom.io/pull/374](https://github.com/atom/flight- manual.atom.io/pull/374)

</comment><comment><USER11> I used atom as my text editor exclusively for over a year, but when I started coding in TypeScript I reached for VS Code and haven't looked back.

</comment><comment><USER12> If only the Windows version had a normal msi installer that installed it in a normal place so it worked properly with multiple users.

<comment><USER13> It's worse than that, it generates paths so long that it sometimes fails to install with a 'path too long' exception.

</comment></comment><comment><USER14> Atom used to feel slower than VSCode, but I gave it another try and it feels more responsive today. I even wonder if it doesn't feel faster than VSCode.

One thing I like very much in Atom, and I miss in VSCode, is the ability to amend a commit: you check "Amend", your commit is displayed, you do your changes, you click "Commit", done.

</comment><comment><USER15> > Right-clicking no longer locks up the event loop!

I think I've never noticed it was blocking. Great work.

</comment><comment><USER16> Post links to the Github releases, but here's the announcement post.

[http://blog.atom.io/2018/02/13/atom-1-24.html](http://blog.atom.io/2018/02/13/atom-1-24.html)

<comment><USER17> OK, we'll change to that from [https://github.com/atom/atom/releases/tag/v1.24.0](https://github.com/atom/atom/releases/tag/v1.24.0).

</comment></comment><comment><USER18> Is it faster yet</comment>


OpenGL and Mobile Devices: Round 2 - <AUTHOR> http://www.ddj.com/mobile/209600498

<comment><USER2> John Carmack recently came out and said the iPhone 3D (PowerVR based) is as powerful as the original XBOX and PS2 generation: [http://www.joystiq.com/2008/08/01/ids-carmack-iphone- nearly-...](http://www.joystiq.com/2008/08/01/ids-carmack-iphone-nearly-as- powerful-as-xbox-ps2/2)

So a lot of potential there to tap into.</comment>


In Praise of Idleness, by Bertrand Russell - <AUTHOR> http://harpers.org/archive/1932/10/in-praise-of-idleness/?single=1 <comment><USER2> Some previous discussion on Hacker News:

[https://news.ycombinator.com/item?id=6513765](https://news.ycombinator.com/item?id=6513765)

300 points | 824 days ago | 120 comments

[https://news.ycombinator.com/item?id=9015092](https://news.ycombinator.com/item?id=9015092)

161 points | 336 days ago | 50 comments

</comment><comment><USER3> A timeless read. It is almost sad to see how people who lived in in the early part of the twentieth century were so optimistic about technology. From Russell to Keynes, they all predicted an era of surplus where no one would have to work so hard. Instead, we got draconian working hours, rampant worker insecurity, and reptiles like Greenspan making public policy who think worker insecurity is good.

<comment><USER4> Please also read accounts of people who wrote about the ordinary people's living and working conditions _at the same time_ , such as George Orwell's Wigam Pier, many essays or Down and out in Paris and London, and you'd be amazed at how far better we live now.

Compared to that time (1920s, 1930s), people today (in the developed world) really DO NOT have to work so hard and the surplus is huge.

<comment><USER5> > Compared to that time (1920s, 1930s), people today (in the developed world) > really DO NOT have to work so hard and the surplus is huge.

We could be working even less though.

[https://c4ad.files.wordpress.com/2015/08/epi-disconnect- betw...](https://c4ad.files.wordpress.com/2015/08/epi-disconnect-between- productivity-and-wages-v1.png)

[http://groups.csail.mit.edu/mac/users/rauch/worktime/](http://groups.csail.mit.edu/mac/users/rauch/worktime/)

<comment><USER4> Sure, but are you sure that we wouldn't get worse results and thus decreased living conditions?

On the other hand, who is 'we'? Some people already work even less ;)

Just to make clear, I do not argue that the situation is good as it is, I just replied to the post that complained that Russell was naive and off the mark. In my opinion, as far as predicting the future can go, Russell was fantastically right in many things. Of course not everything is right and we should work even less.

</comment></comment></comment></comment><comment><USER6> Funny fact, this is used as Lorem Ipsum in a lot of npm packages.</comment>


Women Who Code Unveils New Job Board - <AUTHOR> https://www.womenwhocode.com/jobs <comment><AUTHOR> WWCode is a 501c3 non-profit supporting over 50,000 women in technical careers. We just announced the beta launch of our Job Board.

We have taken a lot of learnings from posting jobs in our weekly newsletter, the CODE Review. Our goal is to create an experience that is catered to the way that our members actually look for jobs, while also eliminating some of the issues that traditionally cause women to avoid applying for a position, even when they are qualified.

This feature is in beta and we welcome feedback.

</comment><comment><USER2> Looks great! Love the benefits icons.</comment>


EU-commissioner Kroes: My thoughts on Aaron Swartz, and the benefits of openness - <AUTHOR> http://blogs.ec.europa.eu/neelie-kroes/aaron-swartz/

<comment><USER2> Finally someone with the power to change things, takes a realistic stance on the issue. Hopefully she will act on her words as well.</comment>


Ask HN: When does a project manager become valuable? - <AUTHOR> At what point in a startup's life does it make sense to have a dedicated project manager?<p>I've been invited to join a couple "groups of guys trying to start a business" in which one member was a professional PM. I didn't see the value (self-organizing teams anyone?) but am curious about others' experiences. <comment><USER2> It depends what resources/requirements you're working with.

If you're just a bunch of dudes in a room building simple software on your own, you don't need a PM.

If you're a bunch of dudes building more complex software (various moving parts) who need to interface with different vendors, part timers, outsourced stuff (e.g. design, copywriting) and have critical deadlines e.g. customer expecting your product on 2010/XX/XX - then you'll probably find it a lot more useful to have a PM :)

I will say though that a PM who cannot jump in and get his hands dirty coding or designing, is probably not so useful in the early stages.

</comment><comment><USER3> The role of a project manager primarily filled the gaps in the Review and Monitor processes, I dun quite see the need for such a role in a startup environment where it's not part of the core stuffs. - a PRINCE2 pm.

</comment><comment><USER4> From what I've been told, you might want a PM once you start using systems engineering processes.</comment>


Show HN: A stupid simple note app - <AUTHOR> http://www.txtbox.co/

<comment><USER2> How long until an enterprising scumbag tries to use this to communicate with their botnet?

It's already been done with Twitter/Tumblr[1] -- anyone know if it's been done with pastebin or any other login-free online note app not protected by a decent CAPTCHA? I'm genuinely curious!

[1][http://ddos.arbornetworks.com/2009/08/twitter-based- botnet-c...](http://ddos.arbornetworks.com/2009/08/twitter-based-botnet- command-channel/)

<comment><AUTHOR> I hadn't really thought about it. Threw this together in an evening.

Right now I'm not concerned just because it's not very popular. May have to think about adding some kind of check in the future.

<comment><USER3> I guess you could use a CAPTCHA in lieu of a login when someone first creates a note.

<comment><AUTHOR> Not really a fan of CAPTCHA. May have some kind of "How many kittens are in the picture"

<comment><USER2> That would be [http://research.microsoft.com/en- us/um/redmond/projects/asir...](http://research.microsoft.com/en- us/um/redmond/projects/asirra/)

There is also one where you assemble a puzzle: <https://www.keycaptcha.com/>

They have varying levels of handicapped accessibility though.

<comment><AUTHOR> Thanks. Honestly I'm not that concerned about it. If there is a sudden mysterious spike in traffic I may look into it.

</comment></comment></comment></comment></comment></comment><comment><USER3> Interestingly enough, Macgasm just posted something similar to TXTBox.co [http://www.macgasm.net/2013/01/29/tip-turn-browser-tab- into-...](http://www.macgasm.net/2013/01/29/tip-turn-browser-tab-into- temporary-note-pad-with-this-line-text/)

<comment><USER3> Handy in-browser text box...but it's not as nice to use. You know better than me how it works differently.

</comment></comment><comment><USER3> Just created <http://www.txtbox.co/default>

What could go wrong?

</comment><comment><USER3> Nice!</comment>


Ask HN: What will happen when Windows is open sourced? - <AUTHOR> As we know, Microsoft recently opensourced MS-DOS under MIT. I expect them to opensource Windows soon. Windows will get more than 300 thousands of developers for free by open-sourcing the current version. <comment><USER2> Well, DOS is very old and incomparable to modern systems in regard of comfort and program availability. Therefore Microsoft has little value from it. On the other hand, Windows has lots of value. Because even when most private customers get recent versions as free upgrades, the corporate site looks very different. Just think about different server versions of Windows, which most possibly share huge parts with the Windows 10 kernel. They cost real money + user access licenses. Therefore - although I hope you are right - I don't believe that Windows will get open sourced anytime soon. I like the idea very much, but I'm trying to be realistic about this.

<comment><AUTHOR> Is there any info on how much revenue is extracted per software item? Windows is most widely used one, but I am sure it is not one that extracts money the most.

</comment></comment><comment><USER3> MSDOS v2.0 is about 52,000 lines of assembler code.

Windows is in the order of 40,000,000 lines of mostly C++ code.

It is very unlikely that MS would release intellectual property that is approx 3000 times the size and possibly a several million times the value of MSDOS.

Even assuming that they did, it will take developers a long time to come up to speed with understanding the code base sufficiently to make useful changes. In the meantime MS won't be standing still.

<comment><AUTHOR> There are ReactOS developers who do understand Windows. They would be happy with increased user base and community support.</comment></comment>


7 Ways to Get Backlinks to Boost Your Traffic - <AUTHOR> http://inboundrocket.co/blog/7-ways-to-get-backlinks-to-boost-your-traffic/ <comment><USER2> 7 great tips - thanks for posting</comment>


Why do bankers make so much money? - <AUTHOR> http://rick.bookstaber.com/2009/10/why-do-bankers-make-so-much-money.html

<comment><USER2> There is a lot of confusion as to what is called a 'bank', so it is difficult to understand the author's analysis. I believe there are several business models in place:

1\. Traditional deposit/lending.

Essentially, banks fund themselves short-term through deposits and then lend long and medium term to businesses. This duration mismatch is always risky (think of 'run on a bank'), but one can argue that banks perform essential function in the economy by analyzing credits and channeling savings to small/medium business.

2\. Transaction business

It is common for a major bank to have a lock-in onto most of day-to-day transactions that people conduct. Salaries get paid by wire, then get withdrawn through many of cash machines, letters of credit are written for international trade transactions etc. For large corporate business, an international bank can arrange financing for a new oil field, then distribute this funds through its international branch network. This business is not particularly high-risk and it is not 'immoral' however you look at it. It is simply passing money around.

3\. Securities and derivatives trading

A broker firm who sits between the issuer of securities (or derivatives like swaps etc.) and the buyer of securities/derivatives is not supposed to expose itself to much risk. That's why they are called a 'broker'. Godlman Sachs is a broker, and so was Lehman Brothers. They don't do deposit/lending business of any significance. Of course, in real life they do proprietary trading as well and can get hurt (like Lehman did, who carried a lot of unsold junk in its books). These institutions can also can hurt others, stuffing their clients' books with crap assets (like sub-prime mortgages etc.). But then... buyer beware, isn't it?

Actually, even through the public lumps all three above business models into 'banks' category, I would stick to orthodox definition and separate them into 'commercial banks' (doing (1/2) above) and 'investment banks' (doing (3)).

So why so many 'banks' gone bust recently and why there is so much pain around?

It is because 'commercial banks' from category (1/2) above took the easy path and stuffed their balance sheets with securities/derivatives with embedded nonlinear risk. They were supposed to do straightforward lending to businesses, yet they went into buying 'AA' rated securitized junk. The same applies to insurance companies who also have to carry assets on their balance sheets to off-set their promises to policy-holders.

And now populist press are blaming traders/brokers for greed and irresponsible behaviour of commercial banks managers.

As to the questions 'why do they make money', we need first to define which 'banks' are we talking about. Investment banks? Commercial banks? There could be another post altogether.

</comment><comment><USER3> Some bankers make a lot of money for the same reason some football players and CEO's make a lot of money. If you have a lot of money to invest you don't don't need 50 people looking at your money. But, you want "the best" because finance is something of a zero sum game. So you bid up.

Another option is to use leverage to take huge risks with other peoples money. When a billionaire bankrolls you to bet in Las Vegas and you get to keep 20% of the winnings plus a transaction fee, and they keep all the downside you could make a tun of money. The secret is being good enough at math where it's no obvious that this is what you are doing.

The other way finance people make a lot of money is the high end watch maker concept where it's profitable to sell to rich people if you know how. The might not get better returns than a well managed 401K but there is someone on the other end of the phone to yell at when the stock goes down. Mix in some confirmation bias and it's hard for people to notice when they are getting fleeced.

PS: Another limiting factor is the number of people with the right pedigree. There is only so many people that graduate the top of their class from MIT, Harvard etc. Or who have a long history of flipping a large number of heads.

<comment><USER4> > The other way finance people make a lot of money is the high end watch maker > concept where it's profitable to sell to rich people if you know how.

"How to Sell a $35,000 Watch in a Recession"

<http://news.ycombinator.com/item?id=720719>

</comment></comment><comment><USER5> I think bankers are an early example of a knowledge-worker occupation where the amount of economic value produced by one's labor scales in relation to deployed capital, rather than in relation to hours worked, and therefore they command stupidly high salaries because (when performing properly) they should.

Bad news for anyone who enjoys income equality: I think they're not the last occupation that will see this decoupling of returns from hours worked (which, since everyone has a roughly similar cap at some fraction of 24 in the day, is the ultimate thing keeping wages in the relatively narrow band people associate with "normal" folks).

Many people take it as an article of faith that there is a 10x difference in productivity between the best programmers and (take your pick) either average programmers or the worst programmer in their organization. Almost no programmers, however, are compensated at 10x the compensation of the average or lowest performing member of their organization.

This is a sign of economic inefficiency. The market abhors economic inefficiency. And the market generally gets what it wants.

I mentally consider myself in the middle of two engineers at the day job. One of them is literally incapable of programming Java, and earns _to the yen_ what I do because our seniorities are equivalent. The other is the 10x engineer -- 10x in relation to me, easily. He is older but his premium on my wage is, hmm, 15%? 25%? Something like that.

One thing I have learned recently is that my skillset generates more value than my salary quite literally while I am sleeping. That number is going to keep increasing at a rate faster than my salary, and at some point the essential conflict is going to deprive my company of my services. Honestly, that won't be the world's biggest loss to them. What should worry them is when math becomes inescapable to the 10x engineer, too.

<comment><USER6> _Many people take it as an article of faith that there is a 10x difference in productivity between the best programmers and (take your pick) either average programmers or the worst programmer in their organization. Almost no programmers, however, are compensated at 10x the compensation of the average or lowest performing member of their organization._

That's not an article of faith. It is a repeatedly measured fact. Pick up a copy of _Peopleware_ for an explanation of how that was measured.

That said, in comparisons of programmers from different organizations the single biggest factor in determining performance was the productivity of other programmers at your organization. Part of that is that productivity is highly environment driven. Part is that good programmers like to congregate together. Either way you are very unlikely to see 10 to 1 ratios within an organization. A ratio of 3 or 4 to 1 is much more realistic. (See _Software Estimation: Demystifying the Black Art_ by Steve McConnell for a cite.)

Going back to the theme of the article, there is another reason for high salaries, which is to provide a disincentive for bribery. You see this in an obvious way with traders. Imagine that you're bargaining over the exact price of a $10 million bond. Wouldn't you be tempted to offer $10,000 under the table to the other guy if he'll agree that the bond is worth $100,000 more? If the other guy was receiving a normal salary, wouldn't this offer be hard to resist?

However are you going to risk the outrageous salaries that traders get offered for a small bribe like that? And if you began taking bribes, you can be sure that news would get around. (If for no other reason than that traders trade that kind of valuable information around.) Which would make it hard to ever get another job at that outrageous salary.

</comment></comment><comment><USER7> Because banks make a lot of money?

Banks probably pay higher because the kind of people attracted to wealth are the kind of people motivated by wealth and in turn these people become managers and hire other people purely with wealth.

</comment><comment><USER8> Client relationships primarily. Bankers make money because clients don't have a relationship with an bank, they have it with an individual. Hence the individual is worth a lot of money, hire the individual and get their clients.

Some individuals are paid a lot for individual specialist skills (analysis, prop trading, etc.) - but these tend to be in the minority.

</comment><comment><USER9> I tend to phrase the question a little more humorously:

Why do bankers _have_ all the money?

</comment><comment><USER10> In my experience, there is a strong positive correlation between people in an organization that are empowered to write checks on the company account, and their wealth. Cause and effect I cannot attest to.

</comment><comment><USER11> Because they can "legally" commit fraud by lending 9x more (in the US) than they have and the central bank will print money (devaluing everyone elses money) in order to cover their losses if needed.

</comment><comment><USER12> Because they get to gamble with Other People's Money.

</comment><comment><USER13> Because they are risk-takers. Low risk - low reward.

<comment><USER14> When you are a banker, what is the risk? Are you quietly taken out back to the shed and shot whenever you don't meet your quarterly target?

(Unemployment, you say? But that's the same risk my garbageman takes...)

<comment><USER15> The risk is losing a lot of _someone else's_ money, of course!

Of course, the financial sector in general is still a risk-taking operation, even if the individual employees bear little to none of that risk (leaving aside, for the moment, the whole "fail badly enough and the government will save you using everyone's money").</comment></comment></comment>


O API Marketplace, Where Art Thou? - <AUTHOR> http://martinatsunset.com/post/5504384798/o-api-marketplace-where-art-thou <comment><USER2> My personal opinion is that the authors concerns are well thought out from the API developer perspective, but that the scenario on the seller side needs a bit of critical reality checking. After all, we can assume that Mashape and Mashery and the rest did not set out to create crappy API services. At the same time, we shouldn't assume that just because Factual and InfoChimps exist that they have a well defined business model that stands a chance of making significant amounts of money in the long term. It's important not to confuse motion with action.

Anyhow, my biggest problem with the idea of an iTunes for APIs or an iTunes for data is that there's little evidence to suggest that this is the correct metaphor for anything except small impulse consumables like music, books and apps.

After all, nobody impulse purchases a complex API license. There's rather profound difference between:

buying the right to query an API 10 million times for non-pornographic uses in the USA (but not Hawaii or Alaska) that expire in March 2012 and count as credit towards a more expensive volume license as long as the upgrade happens by July 2011 and then building an application and launching it as a startup to recoup your investment....

vs.

buying the new Strokes album on your iPod and going for a run.

Otherwise, we'd already see people buying cars and houses and vacations through iTunes or something like it. I mean, hey — if you can make it work, I'll be a customer. I just suspect that it's a thankless, low-margin sales- centric middle man company with highly opinionated and price conscious developers as your primary customer. No thanks!

</comment><comment><USER3> the fact that this link has been posted by Mashape's founder just makes the whole thing even more ambiguous.

<comment><USER2> I don't think that there's anything strange about posting an article like this. It's clearly not written by him, and most founders are hyper-aware of everything written about them or their competitors.</comment></comment>


How a researcher hacked his own computer and found 'worst' chip flaw - <AUTHOR> https://www.reuters.com/article/us-cyber-intel-researcher/how-a-researcher-hacked-his-own-computer-and-found-worst-chip-flaw-idUSKBN1ET1ZR <comment><USER2> This is so deep and complex that I don't expect to be at ease using computer in the future. There can only be more flaws that easily open this can every time somebody wants to open it.

The only half secure way I see is to carefully pick what I install and forget running any JS code in browser, ever. Typing this in w3m/vim btw. Makes sense?

FreeBSD I am using just issued news about not being ready yet to fix this vulnerability. Fun.

[https://www.FreeBSD.org/news/newsflash.html#event20180104:01](https://www.FreeBSD.org/news/newsflash.html#event20180104:01)

<comment><USER3> That might be a bit of an overreaction. But I will concede this is a close as I've ever seen this get to reality: [http://ansible.uk/writing/c-b- faq.html](http://ansible.uk/writing/c-b-faq.html)

Which is really sequel to the short story: [http://www.infinityplus.co.uk/stories/blit.htm](http://www.infinityplus.co.uk/stories/blit.htm) , and which is followed up with [http://www.lightspeedmagazine.com/fiction/different-kinds- of...](http://www.lightspeedmagazine.com/fiction/different-kinds-of-darkness/) (the "FAQ" I linked above is in between those two things).

<comment><USER4> I think the parallel's a bit of a stretch, but I really enjoyed the story, so thanks for sharing.

<comment><USER3> I agree it's a stretch, but it's a fun link.

The parallel I see is that this is as close to anything I've ever seen in this industry to having to start so far back again. I very much suspect that we're going to be playing cat and mouse with timing attacks for the next 10 years, while pie-in-the-sky research projects just get started more-or-less today that will finally fix it.

The Mill CPU people have popped up a few times today... they seem to have an interesting opportunity here.

</comment></comment></comment></comment><comment><USER5> > "When I saw my private website addresses from Firefox being dumped by the > tool I wrote, I was really shocked," Gruss told Reuters in an email > interview, describing how he had unlocked personal data that should be > secured.

I wish I knew how to interpret this comment. Did he manage to output his own firefox memory using client side javascript? Or perhaps a local script running in terminal? or is it totally different and hes describing running a process on his own webhost that broke the vm container and printed out other hosted websites ip addresses?

<comment><USER6> I'm pretty sure he's running an unprivileged binary on his local machine, that shouldn't be able to see Firefox's memory, but can with this attack. I don't know of any js exploit - this attack relies on specific machine code instructions that would be very difficult to get a js engine to generate.

<comment><USER7> >I don't know of any js exploit - this attack relies on specific machine code instructions that would be very difficult to get a js engine to generate.

The Spectre paper outlines that this is not only possible to do in javascript, but they included a Proof-of-concept of it working in javascript to read anything from that process's memory.

<comment><USER8> Their proof-of-concept only reads memory from the browser it's running within, right? Violating browser sandboxing, yes, but does that mean it would also (theoretically) be able to access the memory of other programs?

<comment><USER7> As far as I understand it, the JavaScript PoC only allows you to read memory from the same process. Meaning if all processes are isolated, you can't read anything other than your own tab's memory. However many browsers don't do process isolation, and just about none of them do it completely (Even Chrome won't have mitigations to this that prevent iframes from other origins doing this attack for a week or 2).

And while that alone might seem pretty innocuous, think of things that are kept in memory for a specific tab. This could make XSS attacks able to grab HTTP-Only cookies, or be able to read some autofill data or potentially password autofill information. I don't know enough about the architecture of those things to know if they are kept in the same process, but if they are it's possible.

That being said, I didn't read any specific reason why that JavaScript PoC couldn't be expanded to work on other processes just like the rest of the Spectre attack. And personally I'm assuming it's only a matter of time before it is figured out.

<comment><USER9> > Even Chrome won't have mitigations to this that prevent iframes from other > origins doing this attack for a week or 2

You can enable (experimental) Chrome process separation here:

chrome://flags/#enable-site-per-process

</comment></comment></comment></comment></comment></comment><comment><USER10> Okay, one thing I don't get: Fundamentally, the Meltdown problem comes from a process getting to inspect the wreckage after the the CPU _tried_ to clean up access of protected memory, but failed to properly account for a fun trick of caching.

That is, the process tried to read some data from protected memory A and did some fancy stuff with it such that left enough breadcrumbs that after the CPU responds to the illegal read, the process still has enough info to piece together what was in A, at least from timing of reads, right?

Why not kill the process instantly on a prohibited read, then? Do these prohibited reads happen too often to switch from "oh, that's okay, you can try again and do other stuff" to "the punishment is death"?

<comment><USER11> My understanding:

Because it may not be known whether or not the read will have ended up being prohibited at the time it's speculatively executed. Think of a simple for loop over the contents of an array: usually at the end of each loop iteration you jump back to the beginning of the loop, until the last time you don't, when i > array.length or whatever. The branch predictor will likely predict that the last time you'll jump back again (you always have before, and it doesn't know the actual value of array.length yet since that takes hundreds of cycles to come back from memory) and try to speculatively execute the contents of the loop body on what turns out to be out-of-bounds data. That's not typically malicious; it's at the end of pretty much every iteration over an array ever.

So then, if we can reliably get our loop to operate on a bit of data that might turn out to be out of bounds, the trick is then to have a loop body like this:

if (potentially_illegal_bit == 1) { load_legal_location_1() } else { load_legal_location_2() }

After the branch misprediction occurs, the state of the program gets rolled back so we don't know what potentially_illegal_bit itself was anymore, but we don't have to, we can surmise it from the cache contents. The program isn't going to do an illegal read, it's going to do a legal one, to either legal location 1 or legal location 2, and see which is faster (as only one of them should be cached). Both reads are legal and will succeed, so the only difference is the speed. We've now exfiltrated one bit of data from outside of your array bounds, but the only actually illegal read was speculative, which, as far as the CPU is concerned, is par for the course (predictions are wrong all the time), so no harm, no foul.

<comment><USER10> Ahhh, that's what I missed. I thought the "speculative execution" people were talking about was executing the tricks on the copied data after the illegal read.

But not only that, the entire illegal operation can be fenced behind a speculative execution with a simple "if" branch. And illegal reads happen in that kind of context all the time because (for example) that's how every FOR loop ends.

There's really two places where pipelining and speculative execution are causing this problem - the obvious one where the CPU is allowed to manipulate protected data before everything gets blown away (except cache loads of legal data, hence the problem), but a second one that means that reads of protected data happen _all the time_ in normal branch prediction misses.

When it happens in normal flow, you can't punish it by killing the process. Reading protected memory in a speculative branch isn't some digital "attempted breaking an entering" that you can clamp down hard on, it's totally normal behavior.

I get it now, thanks.

<comment><USER12> The other thing is that it is not necessary to be in the same process for this: you could in theory have one process do the access (which gets killed) and then observe the cache result in another process.

<comment><USER10> Daaang, I hadn't even thought of that.

</comment></comment></comment></comment></comment><comment><USER13> How was this bug independently discovered by three research teams (Graz University of Technology, Google's Project Zero, Cyberus Technology)? Was it known beforehand that such an attack or a similar one could be possible in theory such that all teams came up the same idea?

<comment><USER14> The article suggests that all the research teams were inspired by one source: _The team quickly got in touch with Intel and learned that other researchers - inspired in part by Fogh's blog - had made similar discoveries._

<comment><USER13> This is the blog article: [https://cyber.wtf/2017/07/28/negative-result- reading-kernel-...](https://cyber.wtf/2017/07/28/negative-result-reading- kernel-memory-from-user-mode/)

<comment> oh-kumudo But this blog is written in 07/28 last year, Google reports this bug back in 06/01, right?

<comment><USER15> Yes. The timeline mentioned is the timeline for others, not Google.

</comment></comment></comment></comment></comment><comment> forgot-my-pw "Jann Horn developed all of this independently - that's incredibly impressive," he said. "We developed very similar attacks, but we were a team of 10 researchers."

That is very impressive.

</comment><comment><USER16> NSA?

<comment><USER17> Hubris.

I've been trying to wrap my head around for over a decade how these side channel attacks between L1 caches and branch prediction caches don't happen.

Wish I had published my November 2016 research into function call leaks. CPU registers leaking information between function calls is still a huge unmitigated issue.

You want to shit yourself, goose GCC or LLVM to instrument your function calls with a dump of everything in CPU registers before they start. Do this with libraries that people blindly link in dynamically.

<comment><USER18> > _CPU registers leaking information between function calls is still a huge > unmitigated issue._

How is that a security issue? It's in the same process.

<comment><USER17> Say you have a memory pointer to sensitive info in a CPU register.

Could the subroutine troll through memory and find it? Yes, but it would be orders of magnitude harder than having that pointer in a register.

Better example is if you are using 64 bit ints in registers as security tokens. Those should be zeroed after use and the compiler needs to not accidentally optimize away zeroing them.

<comment><USER18> Do you have a proof of concept you can share for this type of attack?

I don't quite see how an attacker would take advantage of this is a real-world scenario.

<comment><USER17> Yes, John Deere tractor running Windriver Linux; heavy use of dbus and Qt. Any compromised tractor app vendor could inject it.

Could probably reproduce from upstream Yocto distro and the free version of Qt.

Much larger attack surfaces to worry about like their craptastic security around USBs that farmers stick in to read maps.

</comment></comment></comment></comment></comment></comment><comment><USER19> I'm surprised practically nobody cares about this. NPR was running a story about meditation this morning. Here at HN, we're all excited about a new Linux laptop with defective Intel chip included. [https://news.ycombinator.com/item?id=16073039](https://news.ycombinator.com/item?id=16073039)

I guess this is why Intel can get away with it. Nobody cares.</comment>


Show HN: Really fast webserver for kdb - <AUTHOR> https://github.com/geocar/dash <comment><AUTHOR> I've also put together a writeup of how to make fast network servers[1].

[1]: [http://geocar.sdf1.org/fast-servers.html](http://geocar.sdf1.org/fast- servers.html)

<comment><USER2> Did you intentionally obfuscate your code?

<comment><USER3> It's idiomatic style in the K community, e.g. here's a random source file from kdb itself - [http://code.kx.com/wsvn/code/kx/kdb%2B/c/c/odbc.c](http://code.kx.com/wsvn/code/kx/kdb%2B/c/c/odbc.c)

Some members of that community prefer this style because they find it _more_ readable.

<comment> the-tomster Some people like to have big monitors so that they can fit more code on their screen at once. Instead of getting a bigger screen why not shrink the code?

As a side project I implemented a small text editor in this style. I had a working text editor with the ability to load a file, insert and delete text, scroll around a large file, and save changes. It fit within about 100 lines of concise (but I wouldn't say obfuscated) C.

In the end I decided to reformat it and use my usual style before implementing more features. But it was a good experiment and I now understand the appeal of the ultra-condensed style you see in J, K, some Forth, and some Perl code.

</comment></comment></comment></comment><comment><USER4> Can you tell me where I may find more info on KDB or how this may compare to more traditional serving options for static resources, HLLs or anything that might fit well in a large tree.

I'm trying to understand exactly what its limitations are though, both in terms of what it can do and when it may be a poor candidate (when lower req/s is ok and greater flexibility is needed).

<comment><AUTHOR> In kdb, GET requests are normally mapped to .z.ph[1] which synchronously returns the HTTP response. dash supports this as well (sync mode) when it doesn't understand the query string parameters, and then dash works just like a faster .z.ph for KDB.

Async mode is designed when dash knows what the HTTP response _will be_ and can send it immediately. It then relies on kernel queueing to send the same message to kdb which allows for logging (or other processing, like HLL or anything else). This gives a significant performance boost so it's worth optimising.

[1]: [http://code.kx.com/wiki/Reference/dotzdotph](http://code.kx.com/wiki/Reference/dotzdotph)

</comment></comment><comment><USER5> Is there comparison with, for example, nginx?

</comment><comment><USER6> Haha. poop()

</comment><comment><USER7> I'm sure that C code is maintainable.</comment>


Samsung starts shipping the world's largest capacity SSD - <AUTHOR> http://www.engadget.com/2016/03/03/samsung-16tb-ssd-shipping/ <comment><USER2> > Since you'd probably have to try very, very hard to use up all that space if > you only need a drive for personal use

I'd fill it as fast as fast as the SATA 3 interface allows. And I would need another (admittedly smaller) disk to fit the rest of my data.

Not everybody has a fiber connection and lives in the cloud.

<comment><USER3> Hosting 16TB of data in the cloud would cost you mucho mucho dollars anyway. And not counting a fast enough internet connection to _upload_ that much data.

<comment><USER4> The bandwidth to _transfer_ that volume of data is available for the cost of shipping the drive to wherever it needs to be. Higher transfer rates, e.g. overnight shipping, cost a bit more than lower rates, e.g. USPS Priority Mail's three days. But the difference between rates for transferring the atoms is rounding error relative to the cost of a wire that can transfer the bits. Sneakernet is still relevant at the bleeding edge.</comment></comment></comment>


Number Crunching vs. Number Theory: Computers and Fermats Last Theorem 1850-1960 - <AUTHOR> https://www.tau.ac.il/~corry/publications/articles/Computers%20and%20FLT.html <comment><USER2> Not to be confused with his little Theorem.

<comment><USER3> I actually wonder how well-known the little theorem is outside of math departments. Or Wilson's theorem, product of all nonzero elements mod p is negative one iff p is prime.

<comment><USER2> If you think of CS as a distinct area (outside of math) then it is used there a lot. Especially in cryptography (RSA, etc.).</comment></comment></comment>


BadBarcode: Start a shell by scanning a boarding pass - <AUTHOR> http://motherboard.vice.com/read/badbarcode-project-shows-customized-boarding-passes-can-hack-computers <comment><USER2> Am is missing something or is the presented "attack" really trivial? They use a barcode scanner connected as a virtual keyboard to directly enter keystrokes into the windows shell - I imagine the barcode simply reads "CTRL, T, S, O, M, E, C, O, M, M, A, N, D".

It's not surprising that it works to me -- I think it's the intended behaviour.

The article suggests the fact that barcodes can contain arbitrary (non- printable) ascii characters is the discovery of a new vulnerability which can be used to attack a large number of real-world POS/airport check-in systems, but doesn't give a single example or proof for that. This seems like complete speculation on the presence of input handling bugs in systems connected to barcode scanners presented as a fact.

<comment><USER3> How do you know that FooBar (TM) Barcode Scanner isn't presenting as a HID to the underlying system? The keyboard's not accessible so the kiosk mode probably isn't protected against alt-F4, ctrl-alt-delete etc.

<comment><USER2> I could only speculate how specific applications (e.g. at airports) are built.

However, if some specific vendor was susceptible to this attack, it would just be a stupid, obvious and easily fixable input handling bug in their product.

But the linked article doesn't even demonstrate such an attack against an actual application ("BadBarcode is not a vulnerability of a certain product"). Just a trivial "demo" where they use a virtual keyboard device to enter commands directly into a windows shell and then get excited that it works...

<comment><USER3> Well yes, but it's a new application of a HID attack, and it's nicely wrapped up for the media/public (who just got done watching CSI Cyber and Mr Robot)

Also, just because it's trivial doesn't mean it'll get patched quickly (wasn't it France's airports that were still running Windows 3.11?) or even be acknowledged by the vendor.

I'd try this on my local self-serve supermarket checkout if I were feeling brave...

<comment><USER2> Agreed on all points.

Still the "airports can be hacked using this ninja barcode trick" spin that they put on the story pushes my buttons. -- The "trick" is absolutely trivial and they haven't even bothered to try and confirm it on _any_ real world device.

This doesn't stop them from framing it in a way that makes it look like a significant discovery of a new vulnerability which "affects the entire barcode scanner-related industries" and then try to insinuate fear of the possible consequences of that "new discovery": "[It's] really a serious problem, not just a bug people could use to get free beer". Even though it's all based on complete speculation in the first place.

In all likelihood, the people building those systems have thought of and closed the attack vector a long time ago (if it was ever there). But of course vice apparently hasn't even asked a single vendor for comment -- maybe the answer would've been "no, it's not a problem in our product".

I find it a typical case of vice reporting. They take something that isn't exactly true/new to begin with and then blow it extremely out of proportion. This creates the illusion that only vice has the hottest, rawest and most uncensored stories abut sex, drugs and crime which nobody else reports about like they do (because they are mostly made up by vice). IMO vice is classic yellow press packaged for the hip and trendy geeks of my/our generation.

</rant>

</comment></comment></comment></comment></comment><comment><AUTHOR> Demo: [https://twitter.com/tombkeeper/status/664723564717715456](https://twitter.com/tombkeeper/status/664723564717715456)

</comment><comment><AUTHOR> Defcon presentation about barcodes: [https://www.youtube.com/watch?v=qT_gwl1drhc](https://www.youtube.com/watch?v=qT_gwl1drhc)

</comment><comment><USER4> What is special about this?

<comment><USER3> >"General speaking, we can make [a barcode scanner] to 'type' any keys to the host system, not only the 0-9 and a-z," Yu said. He claims this lets someone create a boarding pass to "execute any command on computer."

At a guess, they encoded Win+R cmd <enter> into a barcode. It's a neat trick with big potential.

<comment><USER4> I'm still confused. This seems completely trivial.

<comment><USER5> The point being that it assuredly is trivial, but also potentially a gaping hole left open across a wide array of software.

In these sorts of situations, as with the Y2K bug, the problem is more often the product of social circumstances than technical circumstances.

Nonetheless, this doesn't prevent technical adversaries from preying upon the flaw, and taking advantage of social patterns of behavior, such as the casual tendency to presume barcodes are intrinsically safe.

</comment></comment></comment></comment><comment><USER6> We changed the URL from [http://www.slideshare.net/PacSecJP/hyperchem-ma- badbarcode-e...](http://www.slideshare.net/PacSecJP/hyperchem-ma-badbarcode- en1109nocommentfinal) which appears not to render correctly.</comment>


Top Technologies Used By YC Companies - <AUTHOR> http://trends.builtwith.com/tech-usage/Y-Combinator

<comment><USER2> The pie chart indicates that only 15% of companies use CSS? That's clearly the wrong way to display this data. Very few of the technologies covered are mutually exclusive.

<comment><USER3> Also, noone uses Java and only one company uses Perl. Interesting or misleading? You be the judge.

<comment><USER4> I'm more amazed by the fact that PHP tops there. I expected something like Python or Ruby there.

<comment><USER5> And if that's true, why aren't there more php articles and comments on HN? Are php developers that uninterested and apathetic about their own language?

<comment><USER6> The PHP community isn't terribly vocal. Probably because it's been around for ages and the dos and don't are very well understood by people who care to know.

I personally don't read many PHP related articles because, well, there isn't much new to learn. It's an old/stable language with well understood constructs.

Part of the problem is that the Rails community being as vocal as they are make it seem like everyone is using rails. In this case perception is not reality.

<comment><USER4> You do have a point. Pretty same is the case with perl I think. Libararies are already there for ages and matured.

I'm not into web development stuff, but I thought currently big projects prefer not to use PHP. People say PHP helps them to find cheap programmers, but I dont think good PHP guys can be hired at low rate anyway.

</comment></comment></comment></comment></comment></comment><comment><USER7> Interesting to see which companies are savvy enough to sign up for Google's free webmaster tools: [http://trends.builtwith.com/tech- usage/Y-Combinator/Google-W...](http://trends.builtwith.com/tech- usage/Y-Combinator/Google-Webmaster)

The list includes Dropbox, Scribd, WePay, OMGPOP, Loopt, and Weebly, but a lot of sites are missing out on potentially useful information--only 18% of 136 sites were detected as signed up with webmaster tools.

<comment><USER8> I used to sign up for webmaster tools but after a while I just didn't find the utility in it anymore. I'm able to control which domain Google sees as canonical (bare vs. www) without using webmaster tools. That was why I started using it in the first place. Though it's nice to see crawl errors or other potential issues.

From what I understand GA isn't showing search keywords now for users that are logged into their Google account (totally frustrating change as more of your users seem to be logged in now). Webmaster tools does kind of show this information but without any of the neat metrics that go along with a GA report.

I've also heard horror stories. There was an article (or possibly just a commenter) on here not too long ago that was describing how their position on the SERPs dropped dramatically just a week after signing up for webmaster tools. That kind of thing sticks with you, even if it's not true (and I do suspect there were other variables involved that he wasn't telling us).

So, it's not all about whether someone is savvy or not. ;)

Edit: Almost forgot! A killer feature of WT that I think no one should do without is that it shows you what pages on the web are linking to your site. I'd forgotten how awesome that is.

<comment><USER9> > A killer feature of WT that I think no one should do without is that it > shows you what pages on the web are linking to your site.

You can get the same information by simply googling for "link:example.com" (of course with your domain instead of example.com).

<comment><USER8> That information is not even close to being as complete as what they report to you in webmaster tools. There might be 2000 pages pointing back to your site and that query will return 50 (just an example, not hard numbers).

</comment></comment></comment></comment><comment><USER10> It's nice to see builtwith on the HN homepage, thanks for submitting this page Alex. I'm reading through everyone's feedback and will make changes accordingly, thanks everyone for commenting.

A few notes and things I will clean up -

* The pie charts I admit appear misleading thanks for affirming this, for widgets and technologies they show the leading tool but for document based technologies like CSS/JS they don't look right. 15% of sites aren't using CSS, > 85% are, and I suspect the rest are either dead sites or some other issue. I'll look at swapping to bar graphs which some of you have mentioned might be a good alternative

* PHP usage is based on server side implementation so a server might support PHP it doesn't necessarily mean the site is written in PHP

* The source of the list is yclist.com from about 3 months ago

You can lookup individual sites at <http://builtwith.com> such as <http://builtwith.com/lanyrd.com>

Thanks again!

Gary

<comment><USER11> I think the pie charts aren't just broken for document based technologies, they are wrong for anything where a user can have more than one of the tools. For example on our site we are using multiple types of advertising (including our own), multiple types of widgets, etc.

That being said, very cool that you were able to pull this together - the raw data here is very neat and it would be cool if we could even dive in more and end users could play with it in different charts, etc.

<comment><USER10> Thanks I've added a link to a CSV with the domains and technologies found in the run (Which was a few months ago now).

<http://trends.builtwith.com/Y-Combinator.txt>

</comment></comment></comment><comment><USER12> Adobe Dreamweaver is a framework now? News to me!

Seriously though: There is really too much noise in some of these diagrams to get much out of them. What surprised me most was nginx overtaking Apache in this sample group.

</comment><comment><USER13> I thought it was very telling that out of the 136 companies surveyed, only 2 had a payment system. Speaks volumes about the sort of companies YC is trying to incubate/build.

<comment><USER14> Only 2 were using a payment system that the reporting site tracks. That doesn't mean only two were accepting payments.

Notice that both that showed up were intrusive payment systems. What I mean by "intrusive" is that they take you away from the site you are shopping on to enter your payment and shipping information on the payment system site. My guess is that this is the only kind of system the reporting site detects, because you can find it by noting the links to the payment system site.

If a site were using a transparent system, where the payment and shipping information are posted back to their own server and they deal with it on their own backend, it probably would not show up.

For instance, if your cart checkout just posts back to your PHP or Ruby code, and that code uses Braintree's PHP or Ruby API to process the payment through Braintree, there is no way the reporting site is going to know that you are using Braintree. Same if you are using Merchant e-Solutions, PayPal's PayFlow Pro, or something similar.

</comment></comment><comment><USER15> "detected using at least one of the technologies we track in this group" - does this mean some technology usage could be higher but it's absent because they're not tracking it?

Frameworks - How the hell do they "track" some of these frameworks here because the produced html/css/js could look exactly the same coming from say flask on python and jersey/jax-rs on java?

</comment><comment><USER16> What baffles me is how this site users themselves seem to dislike PHP a lot, yet it's the most used language of these companies... So why the hate?

<comment><USER8> A couple reasons come to mind:

\- PHP might be the most practical choice for some of these companies. The founder or lead tech might be most proficient in PHP for real-world applications (even if he adores Python or Ruby).

\- PHP might be the language that everyone on the team knows so they choose it to keep everyone equally involved in the production of the site.

\- The people commenting on HN aren't necessarily people who start companies (truer now than it ever was).

Edit: Also, it might be the case that some of these servers purposely lie about what language is used on the backend to thwart script kiddies.

<comment><USER17> Ruby on Rails Token =~ Rails 3/whenever the csrf token was introduced? (2.3ish?)

<comment><USER8> Yeah, they're splitting hairs on the Ruby count (not sure why). But I'm assuming that at least the number of PHP installs is somewhat accurate which is still a good number of the sites. Once you add the two Ruby counts together it does win out over PHP (which is more in line with what people would expect from SV types).

</comment></comment></comment></comment><comment><USER18> The pie charts seem like an odd way of counting some of these; for example, one site could use Facebook Like, Google +1 and a Tweet button all at once, but showing them as slices in a pie chart implies to me that the options are mutually exclusive.

<comment><USER19> The pie charts also don't match the percentages in the tables. Took me a second to notice, but the pie chart shows the relative percentage of usage by sites using a particular category, while the table shows % sties out of total # of sites.

</comment></comment><comment><USER20> You missed our site, lanyrd.com (W2011) - out of interest, what was your soure for the list of YC companies?

</comment><comment><USER21> Obviously this analysis is meaningless if the company isn't building an internet-facing web application. And even if they are it isn't that interesting, as it doesn't capture anything about the back-end. Stick a nginx caching reverse proxy and change a few HTTP headers and you've got something that looks completely different as well.

</comment><comment><USER22> Two observations:

\- X-FRAME-OPTIONS: IMO, more people should know about and use this.

\- Adroll: Would be much more effective if it didn't keep showing me ads for products that I already use. I wish it had an opt-out so I'd quit seeing the same ads over and over again everywhere I go online.

P.S. I know others balk at the pie charts (for good reason), but for me it's irrelevant. I go straight for the numbers and the charts add a nice visual break so that it doesn't look like a wall of text. So at least they have that going for them. :-)

<comment><USER23> AdRoll does have an opt out, through the adchoices links on ads and through, <http://www.adroll.com/about/privacy>

Most advertisers that do display retarget attempt to build segments and suppress ads to buyers/logins from potential new customers. this can be difficult though with cookie deletion and people using multiple devices/browsers.

</comment></comment><comment><USER24> Its interesting to note that nginx is overtaking apache.

Some data is highly misinterpreted. (mod_ssl as Operating system, Dreamweaver as framework etc).

</comment><comment><USER25> Interesting information that I'm genuinely interested in but the execution and delivery leave me scratching my head.

The operating system and web server graphs make no sense.

mod_ssl? varnish? Makes me question what was asked and who was answering.

I'd also contend pie charts aren't the best way to represent this information, especially in the categories where there are only a small number of responses.

<comment><USER26> Most likely all information was gathered automatically. According to their FAQ (on the right side of the page) they check the homepage and attempt to detect the presence of any of the listed technologies.

I agree pie charts are probably the worst way to visualise the statistics. For example, it gives no sense at all of the ubiquity of any technology.

Also the accuracy seems to be lacking. I was surprised by seeing their (automated) claim that only 85% of the sites use CSS. That seems strange since I can't actually remember having seen a site recently that _doesn't_ use CSS on its homepage. Checking some of the unlisted sites confirmed my suspicion; they just failed to detect CSS on those pages.

Finally, these statistics only give insight into what is used on the home page of the given domain. The home page may just be part of a (separate) marketing website, so don't be fooled into thinking these statistics represent the products/services built by these companies.

Disregarding all the problems with these stats, it is indeed interesting to see a comprehensive list like this. I find their list of technology trends [1] even more interesting, though.

[1]: <http://trends.builtwith.com/>

</comment></comment><comment><USER27> Great having statistics like this, but for most of the statistics the pie chart is rubbish. It only makes sense in the case where the companies really only uses one of the technologies posible. Bar graphs would have been better.

EDIT: Seems like I need to refresh the comments before i post my own, archangel_one beat me to it.

</comment><comment><USER28> I wish that they had also shown what hosting they were using. That would have been the most interesting to me.

<comment><USER7> I think <http://jpf.github.com/domain-profiler/ycombinator.html?2010> might be close to what you want?

</comment></comment><comment><USER29> IIS took a roughly 5% share on web servers but Windows doesn't appear on the OS breakdown at all...

<comment><USER30> These are startups. IIS may have taken some of the market for more stable companies but it's not really practical for cash-strapped startups to use IIS. Also, college talent typically has greater affinity for Linux.

<comment><USER31> Cash-strapped startups can get the software for free (for a few years) via BizSpark (<http://www.microsoft.com/bizspark>).

</comment></comment></comment><comment><USER32> A visualization of this YC data as compared to technologies used across the top million sites. [http://slice-publish.s3-website-us- east-1.amazonaws.com/rnkj...](http://slice-publish.s3-website-us- east-1.amazonaws.com/rnkjSHj873J/#)

</comment><comment><USER33> I find it hard to believe that 15% of these sites don't use CSS?

</comment><comment><USER34> Its kind of surprising for me that PHP is popular among YC companies. I thought RoR/Python is more demanding than PHP but I was wrong.

</comment><comment><USER35> Pretty interesting stuff - one thing that stood out for me was that the Google+1 was more common than the Twitter Tweet.

</comment><comment><USER36> Stripe's suspiciously missing from this list. I think there should be at least one YC company using Stripe at least?

</comment><comment><USER37> Only 15% of them are using advertising tools? Are YC startups averse to this type of marketing?

</comment><comment><USER38> I'd love to see the breakdown of hosting providers -- Heroku, EC2, AppFog, Rackspace, etc.

</comment><comment><USER39> I am the only one surprised with the Django representation?

<comment><USER40> The way it's detecting Django (checking for the Django CSRF cookie) is false- negative prone. For example, our site (crocodoc.com) uses Django but is not registering for it; probably because we don't have any forms on our homepage so no CSRF cookie.

</comment></comment><comment><USER41> 3 using FrontPage?!

<comment><USER42> Frontpage Server Extensions != Frontpage

That said, I too am horrified. Maybe some of the newer ASP.net deployment stuff appears to be plain vanilla FPSE from the outside.

</comment></comment><comment> mck- Interesting that NO ONE uses Windows.

</comment><comment><USER43> Really nice collections

</comment><comment><USER44> BOGUS!!!</comment>


PubSubHubbub vs. RSSCloud : market shares - <AUTHOR> http://blog.superfeedr.com/Real-time/market/statistics/state-of-realtime-feeds/

<comment><USER2> I just get a 404 from github when I try to visit this page.

<comment><USER3> Me too -- saw issues previously with other github links posted here. Is github having issues with a portion of its app servers?</comment></comment>


How Not to Die of Botulism (2013) - <AUTHOR> http://www.theatlantic.com/health/archive/2013/12/how-not-to-die-of-botulism/281649/?single_page=true <comment><USER2> This article doesn't talk about "wound botulism". This is most often found with injecting heroin users who inject into muscle not a vein.

For example, in the UK between 1980 and 2013 there were only 36 cases of food borne botulism, but 147 cases of wound botulism between 2000 and 2013.

[http://www.nhs.uk/Conditions/Botulism/Pages/Introduction.asp...](http://www.nhs.uk/Conditions/Botulism/Pages/Introduction.aspx)

</comment><comment><USER3> _" Brazenly, he sampled a few drops of this extract himself"_[1]

These days if a researcher dared confess that he tried some research compound on himself he'd be charged with loss of objectivity, or be considered crazy or just plain weird. But not too long ago self-experimentation by researchers was quite a common and accepted practice. It could even be considered the ethical thing to do: before letting the compound be tried by others you should of course try it yourself.

There's a book on the history of self-experimentation in medicine, called "Who Goes First?"[2]

[1] - "he" being Justinus Kerner, "the first scientist to publish an accurate and comprehensive description of the disease"

[2] - [https://www.amazon.com/Who-Goes-First-Self- Experimentation-M...](https://www.amazon.com/Who-Goes-First-Self- Experimentation-Medicine/dp/0520212819/)

<comment><USER4> Another example is Werner Forssmann, the inventor of cardiac catheterization

""" In 1929, while working in Eberswalde, he performed the first human cardiac catheterisation. He ignored his department chief and persuaded the operating- room nurse in charge of the sterile supplies, Gerda Ditzen, to assist him. She agreed, but only on the promise that he would do it on her rather than on himself. However, Forssmann tricked her by restraining her to the operating table and pretending to locally anaesthetise and cut her arm whilst actually doing it on himself.[3] He anesthetized his own lower arm in the cubital region and inserted a uretic catheter into his antecubital vein, threading it partly along before releasing Ditzen (who at this point realised the catheter was not in her arm) and telling her to call the X-ray department. They walked some distance to the X-ray department on the floor below where under the guidance of a fluoroscope he advanced the catheter the full 60 cm into his right ventricular cavity. This was then recorded on X-Ray film showing the catheter lying in his right atrium. """ [https://en.wikipedia.org/wiki/Werner_Forssmann#Life](https://en.wikipedia.org/wiki/Werner_Forssmann#Life)

</comment></comment><comment><USER5> Wow, didn't know that "nitrate free" really isn't nitrate free.

I use to make kimchi a lot. I wonder of the lactic acid produced by the bacteria on cabbage inhibits botulism growth?

<comment><USER6> Both the acid and the salt inhibit botulinum growth.

</comment></comment><comment><USER7> I was curious about pruno, and found this poem on the way:

[http://www.pen.org/poetry/recipe-prison- pruno](http://www.pen.org/poetry/recipe-prison-pruno)

</comment><comment><USER8> The article doesn't mention a "big" commercial botulism case. [https://en.wikipedia.org/wiki/1971_Bon_Vivant_botulism_case](https://en.wikipedia.org/wiki/1971_Bon_Vivant_botulism_case)

I put "big" in quotes because only one person died. But it caused quite the scare, people were afraid of eating canned soup. The company went bankrupt.

Not nearly as deadly as E. coli. E.g. in 1993, 732 people were infected and four died from undercooked hamburger at Jack In The Box.[1] And it continues. A quick google found an article that claims[2]

       approximately 100,000 illnesses,
       3,000 hospitalizations,
       and 90 deaths annually in the United States

[1] [https://en.wikipedia.org/wiki/1993_Jack_in_the_Box_E._coli_o...](https://en.wikipedia.org/wiki/1993_Jack_in_the_Box_E._coli_outbreak) [2] [http://www.about-ecoli.com/](http://www.about-ecoli.com/)

</comment><comment><USER9> Dave Arnold's "Cooking Issues"[0] podcast is an excellent source of high quality information about all sorts of related food and kitchen equipment hacking.

He had a very interesting segment about the open source HACCP plan discussed in this article a couple of weeks ago. I highly recommend his stuff!

[0] [http://www.cookingissues.com/index.html%3Fp=4532.html](http://www.cookingissues.com/index.html%3Fp=4532.html)

</comment><comment><USER10> Hmmm just made some sauerkraut; I used the potato masher to mash it down, after mashing some potatoes. This article didn't help me not die of botulism if I do.

<comment><USER11> There's a critical difference between home fermenting and home canning.

In home fermenting, you have living lactic acid bacteria of various kinds, and they out-compete the bad bacteria. You may help them along with some salt and acid. In home canning, you kill most of the living bacteria in the sample and seal it. If you get the acidity wrong, clostridium and other spores then come to life and poison your food product. They can do this easily, because there's nothing to compete with them and because the environment is anaerobic. Safe canning requires other specific acidity and salinity, or pressure canning at a high enough temperature to kill bacterial spores.

If you follow some basic rules about salinity and only ferment raw vegetables, the practice is very safe. Half-ass canning, on the other hand, or mess with cooked foods and meats, and you're walking a dangerous line.

<comment><USER10> So if I test the compound (sauerkraut) with PH test strips, and find it acidic then I'll be safe?

<comment><USER12> Most of the food is acid anyway, so it's not enough to get and acid mixture, it has to be acid enough to kill the spores. And the acidity varies with time, so I'm not sure how much acidity the initial mixture must have, IAMAFSE.

From Wikipedia: [https://en.wikipedia.org/wiki/Clostridium_botulinum](https://en.wikipedia.org/wiki/Clostridium_botulinum)

> [...] _type-B strains were isolated from slightly acidic soils (average pH > 6.25)._

> _C. botulinum is a lipase-positive microorganism that grows between pH of > 4.8 and 7.0_ [...]

</comment></comment></comment></comment><comment><USER13> I'm not clicking the link since it's The Atlantic but and may they mentioned this in the article botulinum toxin is the most lethal thing in earth. It's staggering to know even plutonium or some nerve gas are not as powerful per gram as that little bacterium.

<comment><USER14> The Atlantic is on your no-go list? I'm actually interested to know why.

<comment><USER13> Spammy, click-bait titles they've been banned from reddit many times I'm not sure about HN.

Physorg is also on my list (I don't really have a list).</comment></comment></comment>


Apple – losing out on talent and in need of a killer new device - <AUTHOR> http://www.theguardian.com/technology/2016/jan/28/apple-quarterly-results-iphone-silicon-valley-developers <comment><USER2> 2 slightly different things \- working for a huge corporation \- product innovation</comment>