ISPs Improve Their DNS Hijacking And How To Stop It - <AUTHOR> http://hackercodex.com/guide/how-to-stop-isp-dns-server-hijacking/ <comment><USER2> This is also how OpenDNS makes money. Neustar does the same. And probably others too. They call this "DNS service". Anyone can run a resolver, including your next door neighbor. Unless you live next to a datacenter, your neighbour's "DNS service" will likely be faster than Google's or any commercial vendor. It's been suggested the optimum number of users for a decent cache is probably around 10 [source: IPJ]. Can you trust 10 people not to poison the cache? How many users do you think the "DNS service" providers have? Can you trust each and every one of those users? As for DNSSEC, most people running authoritative nameservers for websites do not support it, let alone most domain name registries.

Interesting to note: no rDNS for either of those IP's.

</comment><comment><USER3> I believe Comcast stopped this as of their network-wide DNSSEC deployment.

Either way, the article provides a pretty interesting way around it, but I can't expect ISPs hell-bent on false lookup spoofing to sit on their hands for long enough to make this a practical long-term solution.

<comment><USER4> That's one benefit of DNSSEC. If an ISP adopts it, including NSEC, they can't also do NXDOMAIN spoofing with their DNS servers. Mutually exclusive.

But for ISP's that insist on doing this, there are various workarounds besides the one mentioned in the blog post. It's quite easy. Tunneling inside HTTP is a last resort. At some point it's not worth the trouble for the ISP, e.g., to peek into every packet trying to stop users from getting a proper NXDOMAIN response.

</comment></comment><comment><USER5> This is one of the many problems that DNSCurve solves, by setting up encrypted and authenticated connections between you and any DNS servers you decide to trust.

<http://dnscurve.org/>

OpenDNS already supports it:

<http://blog.opendns.com/2010/02/23/opendns-dnscurve/>

<comment><USER6> Meanwhile, OpenDNS hijacked NXDOMAIN results and tried to show me ads the last time I used them. Have they stopped doing that?

<comment><USER7> I imagine typo domain suggestion/resolution is one of their key selling points for people who don't know what NXDOMAIN is (ie most of their customers), removing it seems unlikely.

<comment><USER6> Fair point, but I think it's the browser's job to decide what to do when the user types a domain that doesn't exist. Chrome gives you a search page if you enter a nonexistent domain.

</comment></comment></comment></comment><comment><USER8> I don't quite understand how the new method of hijacking gets around using 3rd party DNS servers. If I ping nonexistentdomain.tld, doesn't that lookup occur at the 3rd party server? How does my ISP inject its own IP address for that domain if the IP address is coming from (for example) Google? Are they intercepting the entire DNS query?

<comment><USER9> The claim appears to be that they are intercepting queries to 3rd-party DNS servers, yes.

<comment><USER10> > _The claim appears to be that they are intercepting queries to 3rd-party DNS > servers, yes._

[my head explodes] This is just begging to be hacked: bankofamerica can be mispelled a number of ways, and I doubt BoA has covered them all.

<comment><USER2> Yup.

This is why it's amusing to watch trademark registrants going after domain names based on confusing variations of their registered mark.

Meanwhile their trademarks are being hijacked by DNS services and ISP's, in order to show ads, probably far more often (since these services and ISP's have huge user bases).

And for the trademark registrants, ISP's are much easier to locate and take action against than evasive domain name miscreants.

Pass the popcorn.

</comment></comment></comment></comment><comment><USER4> There's a solution to all this, where you will _always_ get the right response, and it even obviates the need for DNSSEC or DNSCurve.

And that is, write your own resolver that only sends nonrecursive queries to authoritative nameservers.

If the DNS admin has configured DNS simply and sensibly, it will only take you 2 queries to get a name resolved. It's very fast.

If they are using Akamai or some other CDN, or they have a love for CNAMES and indirection, it can take many more queries. Sometimes up to 7.

<comment> X-Istence Only 2? Wouldn't you have to hit the root, then the tld server, then the name server for the domain, and if it isn't the root domain (example.net), but if it is a sub-domain (www.example.net) which could potentially return more NS records ... and the process would have to happen all over again.

net. => root (return tld)

example.net. => tld (return ns)

www.example.net. => ns (returns ns2)

www.example.net. => ns2

<comment><USER4> Someone is paying attention. ;)

The tld server ip's are "hardcoded" into the resolver application and revised as needed from the root.zone.gz file periodically- these servers do not change very often. The application is just a simple lexer that can be easily edited and recompiled. Writing this thing was a learning experience: the vast majority of cases, DNS lookups follow some very predictable patterns.

So, to answer your question: that first lookup is unnecessary. There's no need to keep hitting the root to get a relatively small number of tld server ip's that rarely change or go inactive. It's easier just to download the root zone regularly to check for changes.

As for subdomains, such as www, that's the CNAME indirection to which I alluded. Everytime someone adds indirection, whatever their reasons (e.g. load balancing, CDN, etc.), it slows down the lookup process by necessitating more lookups. It's a small tradeoff that probably few people pay attention to.

From the resolver's perspective, it is more work and it does slow things down compared to the typical 2 query resolution.

Note I still say 2 queries because even with recursive resolvers like the ones we all use, the tld server ip's for the popular tld's are almost always already in the cache. You only need to lookup a single domain.com and the com tld server ip's will be there for all future queries.

<comment> X-Istence I've thought about writing my own recursive DNS resolver that followed that exact pattern (with caching according to TTL's off course).

So yes, you may only need to hit the root once to get the tld as it will be cached, but it is still a hit. I am not sure that downloading the root.zone.gz instead is necessarily required, especially with the amount of new tld's that they are planning on adding it would amount to a lot of wasted resources.

Also, for some domains (those in the UK are the ones that popped into my mind), you have sub-domains such as co.uk.

So that is another extra lookup... and depending on whether or not you want to use ANY or not in the lookup you find that if you query ns1.nic.uk for co.uk. (A) you get an SOA record back, but no NS results, so at that point instead of just being able to continue you'd have to retry with co.uk. (ANY). At that point you get back a truncated result, and need to retry over TCP...

Now you can continue on to ns1.nic.uk for co.uk. and ask it your question mydomain.co.uk. so and and so forth.

You've piqued my interest and I am thinking I may start keeping logs from my local recursive DNS resolver and start looking at what the cost is now versus what the cost would be if recursive DNS resolvers would go step by step themselves (keeping in mind TTL's and the like).

</comment></comment></comment></comment><comment><USER11> What is so insidious about ISPs serving ads on un-occupied domains? I can't see who it hurts and seems like a rather clever way to monetize dead space.

<comment><USER12> If I have a script that is listening for a response to ping or trying to confirm an HTTP request or something, I damn well want to know when the host is unreachable.

I don't want to successfully reach your bullshit ad host. I don't want to get successfully served an ad instead of timing out. I just want to fail.

Any other behavior is wrong.

I assume you ask this honestly.

The problem isn't something like "Oh, hey, well, there's some empty space so let's setup a lemonade stand until someone buys up the property." The address is supposed to be valid, or fail fast. It is of much greater utility to everyone (except the ad farmers) to fail fast.

<comment><USER7> > _It is of much greater utility to everyone (except the ad farmers) to fail > fast._ //

No it isn't yours in an extreme minority edge case compared to most internet users. Users don't want a blank page with just a weird code on it.

They want links to click to get to the page that they meant to type in, or failing that a similar page link supplied by their ISP ...

<comment><USER13> They want to see a useful message from their browser, like:

This page does not exist. Did you mean '...'?

Which most modern browsers give them provided their ISP does not hijack the NX response to present their ads.

<comment><USER7> Except that's what the ISP, or DNS provider, is providing - a page indicating the domain isnt there and giving other options.

</comment></comment></comment></comment></comment><comment><USER14> I'm on Time Warner and just tested this. Could not reproduce.

<comment><AUTHOR> Could be region-specific. I get the impression that Time Warner Cable's management isn't highly centralized. These tests were performed on Time Warner Cable's SoCal network; I just ran them again with the exact same results, despite the fact that I have my DNS servers set to 184.108.40.206 and 188.8.131.52 (Google's DNS servers).

<comment><USER15> Time Warner must not have their acts together. Just ran a test using their default DNS (not google), was able to reproduce. Ran a test on Google DNS, could not reproduce (receive an unknown host error). Also in SoCal (TW San Diego).

Not doubting you, just wanted to add another data point.

</comment></comment></comment><comment><USER16> I want to know whether the false NXDOMAIN (saying the domain is actually present at the address of your isp) is dnssec-signed.

If it isn't, oh well.

If it is, this is an exploit and is big news.

</comment><comment><USER17> Don't bloggers have to disclose affiliate links now?

<comment><AUTHOR> No subterfuge intended. Changed the post to make it clearer.

</comment></comment><comment><USER18> Doesn't this mean ISPs themselves couldn't use their own DNS servers for a reliable DNS service?

Talk about not drinking your own Kool-Aid...

</comment><comment><USER19> Won't DNSSEC stop this, hopefully?

</comment><comment><USER20> Run your own nameserver(s)?

<comment><USER21> Still wouldn't help, I don't think. Your DNS server is likely just a caching server, which means it forwards requests to another, third party server.

<comment><USER20> Mine isn't. I would assume that if you wanted to set up a nameserver you'd be able to handle the slight change of adding a root.hints.</comment></comment></comment>


How to update U-Boot for PostmarketOS on the Pine Phone - <AUTHOR> https://bloggerbust.ca/post/how-to-update-uboot-for-postmarketos-on-the-pinephone/ <comment><USER2> The kB/KB/KiB explanation alone is worth the click. Wish someone had shown me those links the first time I saw "kibi" and did a WTF doubletake lamenting the decline of the convention I grew up with.

<comment><USER3> It's one of my pet peeves to see "b" used for bytes and "m" used for mega. Makes you have to fish out the units from context. Most of the time it's obvious, your file is not really "16 mb" or 16 thousands of a bit, but sometimes the b/B swap is not obvious as both could apply.

</comment></comment><comment><USER4> > U-Boot, or rather Das U-Boot a.k.a the Universal Boot Loader, is a small > program that is loaded into read-only memory (ROM)

This is wrong. You cannot load a binary into a ROM memory. On most SoCs, thr bootloader is loaded in some RAM (DDR, OCRAM, TCM, or similar).

<comment><USER5> > You cannot load a binary into a ROM

Nonsense. The terms to google for are "boot ROM" or "XIP". Boot Roms execute from rom because all that is available at the time. XIP binaries run from NOR or ROM happily

<comment><USER4> UBoot is not generally stored in boot ROM. The boot ROM loads the UBoot binary from somewhere (eg. eMMC, SD, etc) to some RAM, and jumps there. In case of in place execution, that is not ROM anyway. You may XIP from a NOR memory, but that is still not ROM.

<comment><USER6> There are several ARM dev boards on the desk next to me that have U-Boot in ROM.</comment></comment></comment></comment>


Comment Ranking Algorithms: Hacker News vs. YouTube vs. Reddit - <AUTHOR> http://amacfie.github.io/2020/05/21/comment-ranking/ <comment><USER2> When looking at numerical experiments like this, it's critically important to carefully think about the exact details of the simulation rather than take the result at face value. It's fairly easy to get any result you want by cherry- picking model characteristics.

Just taking a quick look at it, the utility function strikes me as suspicious. No value of freshness? Of course this will penalize youtube who does value freshness.

Another thing:

> they stop reading or keep going based on a probability that depends on the > vote they just gave (0% for upvotes, 50% for downvotes, 15% for non-votes)

how is this justified?

</comment><comment><USER3> > _So YouTube is marginally better than random, Reddit is worse than the > simple difference, and Hacker News is the only one of the three better than > Bayesian average. Disappointing but also plausible._

There used to be a lot of gold among the trash in YT comments back in the day, but for some reason YT will show you spam comments from two days ago over comments with hundreds of likes from a year ago, so it's become literally impossible to find those.

They don't allow you to sort by votes and their "best comments" sorting is complete BS.

Nowadays I just block YouTube comments out with uBlock Origin, reading through them is rarely worth the time and is usually just a pointless distraction.

<comment><USER3> Relatedly, here's a brilliant (and short) podcast episode:

 _Hunting For YouTube 's Saddest Comments_: [https://www.wnycstudios.org/podcasts/otm/articles/tldr-12-hu...](https://www.wnycstudios.org/podcasts/otm/articles/tldr-12-hunting- youtubes-saddest-comments)

</comment></comment><comment><USER4> For anybody scratching their head as to why you don't just subtract downvotes from upvotes, or similar obvious techniques, a discussion here (also linked in the article in the OP):

[https://www.evanmiller.org/how-not-to-sort-by-average- rating...](https://www.evanmiller.org/how-not-to-sort-by-average-rating.html)

</comment><comment><USER5> Just a suggestion, instead of using the average upvotes per visitor, how about something objective and not directly tied into the model itself? For example, we could look at the average Pearson correlation of the rankings over all individual trials.

That still wouldn't factor in freshness, though.

</comment><comment><USER6> Comments are universally shit. My system is to rate them all -inf.</comment>


LKML Greg Kroah-Hartman on ZFS - <AUTHOR> https://email@example.com/#t <comment><USER2> From the mailing list

"Hi Rene, please switch to FreeBSD instead of advocating to violate the copyright and licensing rule on my and others work. Thanks you!"

Given that both are relatively competitive what if an increasing share does.</comment>


Climate Change - $57B spent worldwide during 2017 because of floods damage - <AUTHOR> https://kyso.io/helenadomo/floods-crisis <comment><AUTHOR> 226 flooding event happened during 2011. Did you get affected?</comment>


Did NASA discover Earth 2.0? Maybe. Here's what we know - <AUTHOR> http://www.vox.com/2015/7/23/9026997/kepler-452b-earth-cousin <comment><USER2> Nasa, yesterday said "It appears that Earth-like (habitable) planets are quite common". "15-25% of sun like stars have Earth-like planets"</comment>


FOIA'd Email Shows French Motives for Overthrowing Libya [pdf] - <AUTHOR> https://www.foia.state.gov/searchapp/DOCUMENTS/HRCEmail_DecWebClearedMeta/31-C1/DOC_0C05779612/C05779612.pdf <comment><USER2> I find it quite disturbing that not a single allegation is properly sourced. "According to knowledgeable individuals" means absolutely nothing. Not a single journalist would dare make such accusation on such a thin basis, especially since what follows are not facts but opinions. We don't even know if those individuals are close to the french government or to some faction in libya.

I sincerely hope foreign usa foreign policy is based on more solidely grounded analysis.

<comment><USER3> To be honest, as a French person I didn't see anything new in this cable. None of this was secret, it was pretty much the official stance, except stripped of the humanitarian aspects such as the ongoing civil war and repression or the Arab Spring.

It feels like Hillary's advisor was merely watching French TV and transcribing what journalists and politicians said publicly. The mention of Bernard Henri- Levy proves it. When you sum up a geopolitical situation in a few sentence, you don't waste any explaining BHL is a "semi-joke", unless your own knowledge is cursory.

With regards to the French population, you have to put it in context (April 2011, see [https://en.wikipedia.org/wiki/Timeline_of_the_Arab_Spring](https://en.wikipedia.org/wiki/Timeline_of_the_Arab_Spring) ). The Arab Spring was still going "smoothly" elsewhere, and we were all watching Egypt, Tunisia, Morocco, Syria and Algeria where things were handled "more or less peacefully" back then, at least to the French eye. Qadaffi's repression, on the other hand, was violent from the get-go.

It was a perfect storm (1) for Sarkozy, as on top of the things mentioned in the cable, he had to prove that he was serious with his Mediterranean Union, and more importantly he had to disprove the allegations that Qadaffi financed his election.

Wether it was the right thing to do or not, I personally have no idea, but it was pretty much a no-brainer at the time for France to distance itself from Qadaffi during his civil war, and fuel the opposition.

(1): unrelated, but maybe I should have said "homerun" in this case? My English fails me.

<comment><USER2> As a french person, i beg to differ. The only publicaly stated reasons for the intervention was humanitarian, to prevent kadafi from decimating his own population. You could read other opinions on various newspapers, but nothing really based on facts, only more or less valid assumptions depending on your political background.

<comment><USER3> That's true for the most part, I mean, the government obviously didn't mention some of the things that are in the cable unless they deliberately wanted to shoot themselves in the foot, but the news would systematically feature pieces about Qadaffi's awkward presence on Bastille Day along with the oil, gold and silver.

My point is that the cable was nothing more than a short compilation of common knowledge and hearsay, like you said, "more or less valid assumptions" that you could easily get by switching radio channels a few times during your tuesday morning commute.

</comment></comment></comment></comment><comment><USER4> We shouldn't get upset. Karma is a &itch. Look how much fun France and Europe is having with all those hungry masses flowing in.

Nor should we surprised

France allowed her colonies independence (without a bloody fight she was certainly going to loose), on the condition that they used the franc (technically the convertible franc).

This would enable France and French companies cheap access to African resources, that is continue what colonialism had been doing <\- stealing African resources to subsidize France.

Also, it would prop up the franc as France continued to print money to finance her welfare state (not a judgement on the merits of a welfare state, just a fact that the French weren't taxing enough to afford it).

We shouldn't be too hard with the French though. The Americans largely do the same (see how quickly the leader of an oil producing country is deposed is he declares to ditch the dollar). The Brits gave their empire to the Americans to piggy back off this.

<comment><USER5> _" The Americans largely do the same (see how quickly the leader of an oil producing country is deposed is he declares to ditch the dollar). The Brits gave their empire to the Americans to piggy back off this."_

This petrodollar conspiracy is baffling.

Countries don't hold dollars primarily to buy oil.

The oil and gas industry is only about 4.6% to 6.5% of the global economy.

Countries hold reserve currencies to manage the exchange rate of their currency. Petrodollar conspiracists would be well served by learning about foreign exchange reserves.

See: [https://en.wikipedia.org/wiki/Foreign- exchange_reserves](https://en.wikipedia.org/wiki/Foreign-exchange_reserves)

And in any case, only 65% of foreign currency reserves are in the USD.

Furthermore, research shows that being the world's primary reserve currency affords the United States negligible advantage: 0.3 to 0.5 percent of US GDP in a normal year.

See: [http://www.mckinsey.com/insights/economic_studies/an_exorbit...](http://www.mckinsey.com/insights/economic_studies/an_exorbitant_privilege)

Compare that to the costs of "deposing the leader of an oil producing country": $6 trillion for the Iraq war or about 36% of GDP

See: [http://www.reuters.com/article/us-iraq-war-anniversary- idUSB...](http://www.reuters.com/article/us-iraq-war-anniversary- idUSBRE92D0PG20130314)

<comment><USER4> "is only about 4.6% to 6.5% of the global economy."

You think that's a trivial amount? 4 to 7 % of _all_ human activity is oil or gas? That includes agriculture, weapons consumer goods, all construction, all construction materials, all other mining, all electronics, all automotive, all other energy, all entertainment, all education, all communications, all pharmaceuticals, all illegal drugs, all human trafficking, etc.

 _just_ 4 or 7%? !

As to the Petro dollar conspiracy,i didn't talk about that (not in regards to the dollar anyway), just mentioned the longevity of those who walk away from the buck.

But you brought up some numbers...

To your point that trillions were spent on Iraq, you're confusing the time line. In 2003 we were told, the war was going to cost a few hundred billion. And that the Iraqis, so grateful to their liberators, would pay for it with their oil.

Didn't pan out, it never does, but our actions can only be based on our current beliefs, not our future ones. We thought the war would be short and free (remember Bush's "mission accomplished" photo op in 2003).

0.5% of the American GDP is 90 billion, with an NPV of 36 _trillion_ (calculated using the, admittedly the current 0.25%). Chump change indeed. That's a tremendous amount of wealth.

As to the foreign exchange, 65% are U.S. dollars, while the U.S. is less than one fifth of the world economy. Bit of an unbalance, no ?

</comment></comment></comment><comment><USER6> This only shows what someone (an analyst ?) in the State Department thought were the French Motives for Overthrowing Qaddafi (one overthrows a ruler, government, not a whole country).

Whether he was correct or not isn't very easy to establish, given the absolute lack of supporting information on most of these points.

Re-asserting the position of the French military is far fetched, for a president that cut its budget and size very significantly. Similarly, claims about influence do not seem particularly credible given the utter lack of follow up and French presence in the country after Qaddafi's death.

The only credible point really is c., a desire to improve his popularity at home.

</comment><comment><USER7> France is a democracy, but this still happened. Would the French people allow their president to go to war over reasons stated in this cable, if such a permission was needed? This is what secrecy brings.

French military didn't had to assert any position in the world. Every country's military is in a good position to give each other hell.

Did Nicolas do France any good with this decision? A little may be, by taking some of libya's oil resources. Did he do world any favour? No

<comment><USER8> > Did Nicolas do France any good with this decision? A little may be, by > taking some of libya's oil resources

Net loss. Libyan arms are destabilizing the whole Maghreb. Look at Mali.

</comment></comment><comment><USER9> Funny thing is that this document - incidentally? - says nothing about US involvement in the war in Libya.

[https://en.m.wikipedia.org/wiki/American_involvement_in_the_...](https://en.m.wikipedia.org/wiki/American_involvement_in_the_2011_Libyan_Civil_War)</comment>


Are we solving the same problem? - <AUTHOR> http://sethgodin.typepad.com/seths_blog/2009/08/are-we-solving-the-same-problem.html <comment><USER2> I've got a lot of respect for Seth Godin, but sometimes I feel like his blog posts are just regurgitating facts we already know. Yes, it's important to talk to whoever will be consuming your product. Yes, it's important to set clearly defined goals. He doesn't even mention fact that here are also drawbacks to heavy design up front. Not really anything new, but maybe it helps to be reminded every once and a while...</comment>


Ask HN: Good architecture for web single sign-on? - <AUTHOR>

I have a network of sites (each with unique top-level domains) and I'd like to share logins across. Any suggestions to support single sign-on (I'm using Rails)? <comment><USER2> Have you looked at SAML? It may be too complicated for your use case, but the basic technique could be useful. <http://en.wikipedia.org/wiki/SAML>

</comment><comment><USER3> Why don't you try the Open-ID login, users can log with their Google account.

If your user account isn't much used (the site is a blog site), you can do a simple FaceBook Connect or Google Friend Connect.

<comment><USER4> People would have to log in again on each domain independently, with separate login cookies for each.

That is not really Single Sign On.

</comment></comment><comment><AUTHOR> Thanks for the suggestions, but it sounds like there still aren't good (simple) solutions for web single sign-on (where you don't have to log in to multiple sites separately).

</comment><comment><USER5> Facebook Connect

</comment><comment><USER6> oauth

</comment><comment><USER7> Check out <http://code.google.com/p/rubycas-server/>

      sudo gem install rubycas-server

<comment><USER4> How much have you actually used CAS? <http://www.jasig.org/cas>

While it's pretty much the only game in town for true SSO auth, it can end up being a huge pain in the ass to integrate with existing software because of two glaring deficiencies:

1) It only tells your app the authenticated username -- not even group membership! A lot of off-the-shelf apps would require significant refactorings to allow you to integrate with LDAP for groups/info but not auth. What ends up happening at a lot of universities (where CAS is used) is that each app keeps it's own native user database for everything but passwords, and it's fucking awful. It's so unfortunate that OpenID recapitulated the same problem all over again with no improvement.

2) It's easy to grow a fuckton of redirects. I distinctly remember a problem where Safari would follow one-fewer redirect than IE/Moz, and the semi- competent technical staff had set up several apps at the limit (maybe 10?).

<comment><USER7> Oh, I haven't used it at all! It just sounded like he wanted some starting points, and no-one had mentioned it, so I thought it would be a good addition.

Hm. From point 1 - isn't that a design problem? Of course apps should not keep their own user databases .. I don't see that as necessarily a problem with CAS per se, more like people shooting themselves in the foot with the gun they're given. As you say, they're legacy apps, but still.

And point 2 - really? I would have thought a maximum of 2 - one to the CAS server, and one back! Any more details, out of interest?

Anyway, I looked at CAS and something about it didn't sit well with me, I don't even remember what, so I ended up rolling my own. Which, by the way, was not at all hard.</comment></comment></comment>


Ask HN: Trying to find recent blog post comparing X11/vim on OS X vs. Linux - <AUTHOR>

read this late last night, can't find it now.
an individual had a blog post comparing his experience using x11/vim on OS X vs. using what's available on Linux. He had a more favorable experience using Linux after transitioning from OS X.
Really wish I had bookmarked it, can't find it now. <comment><AUTHOR> never mind, found it - <http://oilq.org/fr/node/15240>

<comment><USER2> What's the deal? That's not the original URL. This is:

<http://cloudhead.io/2011/04/18/why-osx-doesnt-cut-it/>

Did that site get the author's permission to post it elsewhere?</comment></comment>


Why Do FM Frequencies End in an Odd Decimal? (2015) - <AUTHOR> https://www.fcc.gov/media/radio/fm-frequencies-end-odd-decimal <comment><USER2> Another interesting note about the FM frequencies is stations from 88 MHz to 92 MHz are the non-commercial part. That's why you'll find a lot of NPR and religious stations at that part of the dial rather than the other end.

(Looked up after many hours of road tripping through states with very few radio stations)

[https://en.wikipedia.org/wiki/Non- commercial_educational_sta...](https://en.wikipedia.org/wiki/Non- commercial_educational_station)

<comment><USER3> Worth noting that that's not a thing in Europe, at least in Germany I don't remember any differences across the entire band (87.5 to 108 MHz there).

Where exactly the band is and its channel spacing generally differs a lot between countries.

<comment><USER4> This article is on the website of the US telecommunications regulator. I'm don't think all the comments need to be qualified with "in the US."

<comment><USER5> I think the parent was still an interesting comment. What it said was indeed worth noting.

</comment></comment></comment></comment><comment><USER6> Norway killed its FM transmission, a perfectly functioning technology. Pure one to many distribution perfected over time, deprecated.

DAB+ radio has much lower range and the signal is unstable.

To make matters maybe even worse, HAM radio operators at work inform me the DAB+ standard isn't going anywhere and that the development has mostly stopped. Maybe somehow 5G can do some marvels for the technology, time will tell.

<comment><USER7> I'm normally pro-digital over anything analogue, but broadcast radio is one medium, possibly the only medium, where analogue is better.

Digital compression simply doesn't cope with packet loss well enough to be practical. Even with a very weak FM signal, in emergencies you can still hear through the noise.

<comment><USER8> In rural places in the US, it's terrible for television. Several years ago, it was mandated that TV stations switch from analogue to digital.

Now instead of getting a little static and being able to understand 100% of what is said and shown over the air; it's now 10% recognizable video 90% visual blocks, and 0% audio.

<comment><USER9> If the digital transition hadn't happened I think over the air television might have died by now. Analog broadcast used significantly more electricity and fewer and fewer people would be interested in the low quality signal. Stations might have decided the remaining viewers weren't worth the power cost.

That said I think streaming might kill it anyway.

<comment><USER10> What's the difference in power for analog vs digital TV broadcast?? Is that mostly because ATSC broadcasts moved towards UHF, and NTSC broadcasters preferred VHF when available? Or is there some other property of ATSC broadcasts that require lower energy?

<comment><USER7> Analogue video has to have a very high SNR at the receiver, because any noise is directly visible in the picture.

But with a digital signal, as long as you can distinguish individual bits, the picture is always perfect, so you can get away with a much lower signal strength.

</comment></comment></comment></comment></comment></comment><comment><USER11> Here in the UK you get stations ending in any decimal. Other countries have different schemes. It's a thing when you import a car from Japan for example, the FM bands are different so you have to swap the radio or buy a little band expander box to fudge it.

[https://en.m.wikipedia.org/wiki/FM_broadcasting](https://en.m.wikipedia.org/wiki/FM_broadcasting)

<comment><USER12> In the US, you only get 200kHz between stations, while other countries allocate 300kHz spacing, giving them slightly more bandwidth.

<comment><USER13> 100kHz signal bandwidth+100kHz guardband actually.

</comment></comment></comment><comment><USER14> I once had a car radio which enforced this rule. Wouldn't tune to anything except odd decimals.

And it worked fine in my home city, every single radio station was on an odd frequency.

But I don't live in the US. One day I went on holiday to another city, and in that city and 90% of radio stations were on even frequencies. The poor radio refused to tune into them. You could set it to the neighbouring frequency and get it half tuned in, but it would never lock.

<comment><USER15> In all the car radios that I've had, I can tune it to a 20'th of a MHz. So it'll go from 102.0 to 102.05 and then 102.1.

I've never had anything lock up on those .05 frequencies though. I wonder if it's every used anywhere.

<comment><USER16> You're just not going fast enough.

</comment></comment></comment><comment><USER17> If anyone is interested in amateur radio in the US, don't let the current situation dissuade you. There is at least one VEC now offering completely remote exams - I just took both my Technician and General exams with GLAARG completely remote.

<comment><USER18> Any idea if GLAARG is in need of more VEs to conduct remote tests? I'm an extra in the bay area and know a couple others who would be willing.

<comment><USER17> No clue - I barely got the chance to speak with any of the VEs; I joined the call, showed them my testing environment, took the exams, then they quickly reviewed results and next steps before leaving to start the next candidate's process. They had a day full of reservations to take exams and a pretty large waitlist of people waiting to squeeze in when they had extra time.

</comment></comment></comment><comment><USER19> The article doesn't say it explicitly, but it's because the FM band is bounded by round numbers, 88 MHz and 108 MHz, as opposed to 87.9 and 107.9.

<comment><USER20> Er, that's in the first sentence. What could be said a little more clearly is that the frequency 90.1 is actually the channel 90.0-90.2 since the convention is to tune to the center frequency. A convention of tuning to the lowest or highest frequency of the channel would be equally valid - its just not how its done.

<comment><USER21> If you tune to the lowest frequency in the channel, wouldn't that be bad because it's on the border with the channel just below it? Tuning to the center of the channel seems like the only sensible thing to do, it's not just a convention. Or am I way off here?

<comment><USER20> All I mean is that in the modern digital world, there is no difference between a channel being defined as 90.0 + 200kHz, 90.2 - 200kHz, or 90.1 +- 100kHz. "Tuning" isn't even really a thing in modern SDR receivers that can receive a huge band all at once (it is, but more as a UI convention than an analog necessity).

</comment></comment></comment></comment><comment><USER21> The article doesn't really answer why. It basically says that FM is channelized first and then the center frequencies are determined; while AM is assigned center frequencies first.

But why are AM and FM different here?

<comment><USER22> Mediumwave AM broadcast uses the center frequency as the channel identifier, same as FM.

<comment><USER23> FM channel numbers didn't really catch on, but I do remember that they were a small thing.

</comment></comment></comment><comment><USER24> its more interesting that FM stations have channel numbers, which are basically not used by anyone except the FCC.

<comment><USER25> Same with analog TV stations, I never understood why they use specific ones. Why channel 7, 9 and 10 but not 8 or 6?

<comment><USER3> By the way, in Europe, even for analog TV the channel numbers have been relatively hidden since at least the 80s. TVs would instead be "programmed" to have sequential program numbers, which behind the scenes pointed to actual channel numbers. The channel a station was on could differ widely between regions, so the channel number was just a local implementation detail. There is/was also usually some more or less common order of stations, e.g. in Germany you'd always put ARD on 1, ZDF on 2, the regional "third" station on 3...

<comment><USER26> For a long time in the US (maybe still?), the vast majority of the schedule was set by the local station. Being a member of one of the national networks brought access to a catalog of shows, and a few requirements about the scheduling of shows that the network really cared about. In almost every nationally-produced promo you got the phrase "check your local listings" in addition to the advertised time because the local station might air the show sometime other than when the network recommended.

</comment></comment></comment></comment><comment><USER27> FM stations broadcasting HD Radio are 400 kHz wide.

[http://www.w6rz.net/fmbandzoom.png](http://www.w6rz.net/fmbandzoom.png)

</comment><comment><USER28> Not in India atleast, we have fm stations at 93.8, 106.4 and so on.

<comment><USER29> Same as in New Zealand (NZ). Plenty of even frequencies here.

<comment><USER30> It haas nothing to do with quantity or scarcity of frequencies.

</comment></comment></comment><comment><USER31> When I was a kid we replaced our radio and got a fancy one that could go in .1 increments, which let us hit the even numbers.

It was nice to be able to get far away stations by hitting the even numbers as long as there wasn't a neighbor station.

</comment><comment><USER32> I suppose "frequency modulation" (FM) _would_ mean that you'd need to separate frequencies so each station can "modulate" without running into the neighbors. That's quite a satisfying thing to learn.

<comment><USER33> Well, that is an intuitive way of looking at things, but ANY signal carrying information has non-zero bandwidth. Even an AM (amplitude modulation) signal occupies a band of frequencies.

</comment></comment><comment><USER34> Something I've always wondered is where the channel "names" come from. The ones that are usually 4-6 characters, seemingly random, often starting with K or W for some reason. Like KVUE or W2XMN or KLTY.

<comment><USER35> These seem to be commonly used in the USA - are they used elsewhere?

<comment><USER3> Personally haven't seen them anywhere else at least. While the stations might or might not have call signs on paper, they are certainly not used in any way a listener would notice. (Of course I can only speak for the countries I've been to.)

<comment><USER30> In Canada, you hear them all the time. Like CFOX/Vancouver, or VOCM/Saint John.

In Japan, as well. JODW/Tokyo, and others. The only exception I've heard in Japan is Eagle 810, which operates from a U.S. military base.

</comment></comment></comment></comment><comment><USER36> Why are the AM channels spaced 9 KHz in Europe? You need to be careful when you buy a low cost car radio due to this..

</comment><comment><USER37> Not in Europe.</comment>


Professor Develops 'Brain' for Robots - Kilo-byte http://www.sciencedaily.com/releases/2013/09/130926201114.htm

<comment><AUTHOR> Always good to see research of course!

1.) But why is there a "leader" to begin with? In swarms of birds the older birds do have some specific roles, but real "leaders" seem to me a brittle approach.

2.) Reinforcement learning, and an actor-critic system is nothing new. But what is an "active critique"? Never heard about it...

<comment><USER2> > But why is there a "leader" to begin with? In swarms of birds the older > birds do have some specific roles, but real "leaders" seem to me a brittle > approach.

I agree, and it seems nature agrees. Anyone who think a leader is required should watch a flight of a thousand starlings maneuver adeptly without collisions, a swarm of bees or ants carry out their duties without any command hierarchy, or a modern government rob the people blind with nary a collision between the overwhelming number of redundant departments.

[http://www.youtube.com/watch?v=eakKfY5aHmY](http://www.youtube.com/watch?v=eakKfY5aHmY) (starlings in flight)</comment></comment>


Volkswagen rigged tests on 2.8M cars in Germany, Berlin says - <AUTHOR> http://www.reuters.com/article/2015/09/25/us-volkswagen-emissions-idUSKCN0RP14U20150925 <comment><USER3> I feel it's worth making the point that everyone talking about penalties is avoiding: Penalties are pointless.

Financial penalties applied to a company this size basically just get socialised. Either employees (generally innocent of this) lose their jobs as the company closes factories, or the price of future cars goes up, or even the company goes entirely bust in which case that doesn't actually help anyone at all. The only non-socialised effect of a penalty is to punish shareholders - who are also innocent of this (and arguably even that is socialised, since pension funds probably own large chunks of most car companies!).

The people who are guilty are the people who decided to install this software, who installed it, who kept it installed - and the people who were supposed to put in place checks to prevent this sort of fraud from happening, from the CEO on down.

The correct response for society, in my opinion, is not to try and apply a punishment to "the company", which is mindless and is only the product of people's decisions, but to make those people accountable. They were guilty of fraud, either directly (very serious) or by lack of diligence (somewhat less serious but still criminal). We have laws about fraud. Apply those laws, put those people in jail, and the next bunch of smartasses who think they can put fraudulent software in cars with this will think twice about it - and probably not do it.

In other words, this is a state, criminal matter. Approach this much like any other form of organised crime - investigate, offer reduced penalties for information, and put people who were guilty of this high-level organised crime in jail.

<comment><USER4> Alternatively, nationalise the company with no redress to the shareholders. They lose all their money, the company keeps on running so the jobs are kept (until the business shuts down or is sold at least), and customers aren't left without support. If the penalty for failing to ensure the company you invested in is losing your investment then perhaps shareholders would police their investments better.

<comment><USER5> As a shareholder, how are you supposed to police for this kind of situation? The shareholders were lied to as well.

<comment><USER6> I don't know, but you could ask that about _anything_ a company does. The whole _point_ of owning shares is that you share in both the successes and failures of the company. If the company has a significant downside potential that you can't control for, then you need to account for that when buying shares.

In terms of losses to shareholders, this is no different than if VW had decided to burn all their factories to the ground and go into the sausage- making business, which then failed spectacularly. The shareholders get "punished" for that, and we would expect nothing different. Why should a legal failure be treated more leniently than a financial failure?

</comment></comment></comment></comment><comment><USER7> What about the owners of VW cars that aren't affected by the consumption fraud. I would imagine the value of their cars will, regardless of the diesel engine, decrease with the saturation of people selling their cars or trying to return them. Is it possible for non-affected owners to be compensated as well for loss in market value as a result of the company's actions? Concerned Jetta owner here asking smarter people.

<comment><USER8> I hope not, that would be insane. If a car is not worth its price when you buy it, don't buy it.

<comment><USER9> "Worth" includes an estimate of the future money one might get from a sale or trade-in. That estimate is of course fuzzy.

The estimate of worth, and estimate of fuzziness, assumes that VW wasn't deliberately hiding crucial information from the market.

<comment><USER10> "its price" is also fuzzy, because total cost of ownership includes gas (affected) and maintenance (affected).

<comment><USER9> Isn't that factored into the worth, not the price? I thought "the price" was more quantifiable as the specific amount spent to get the car.

</comment></comment></comment></comment></comment><comment><USER11> What would happen if all the affected consumers demanded the full purchase price returned to them and returned their used cars? It seems clear that they would win, because they were fraudulent sales. But that would bankrupt VW, right?

<comment><USER12> Maybe. I am not sure this would be the way to go on this.

Really the car the consumer got was better (to them) than the product ordered. It had better gas mileage, and better performance than it should have had.

The net loser in the trick was the environment (/ the world). If a company does a trick to make money and hurt the environment, the government should step in and make them pay, right? Like if I run a tire shop and secretly burn all my old tires in the back yard.. my customers weren't hurt (directly), but the entire environment was.

<comment><USER13> Could the fact that lower emission was a possible selling point and may have affected customer choice have an impact here? Some customer did feel cheated by this fraud since they bought the car in part for it's lower emission and fuel usage.

<comment><USER12> Ya I can totally see this side also. As a non-legal person, it seems harder to argue:

I expected 99x and 89y, but I got 120x and 70y

vs

You lied and spewed toxins all over the environment

as the first case requires some kind of weighting. Like if a pair of shoes advertises weighing 12 ounces, but they made a silent upgrade to only weight 11 ounces.. 99.9% of people are happy for that. The .1% of people who use shoes for boat anchors are not happy.

</comment></comment></comment></comment><comment><USER14> Why does everyone seem to assume this is specific to VW in particular. They nay have been the most egregious but I would be surprised if this was isolated.

Just look a those EPA mpg estimates, everybody seems to game the system and "tune" their cars to get highest ratings. Does anybody still hope to get anywhere near the estimate when buying a new car, especially city mpg?

I would argue this sort of manipulation is done widely and was pretty well known and accepted but VW must have overdone it. Of course Diesel cars have potential for worse emssisons than gas but I bet this happens across the board, except the Germans are screwed because they are pushing Diesels.

</comment><comment><USER15> I see a lot of people posting things to the effect of "It's probably not a huge deal, just a firmware patch." That strikes me as unlikely. If that were the case, then why would VW take this risk in the first place? Clearly, there was _some_ benefit to the car that made engaging in what was clearly illegal behavior seem like a financially sound option to who knows how many people within the company. If applying a firmware patch to fix this doesn't change the value of the car that much, why wouldn't they ship it was that firmware in the first place?

<comment><AUTHOR> >I see a lot of people posting things to the effect of "It's probably not a huge deal, just a firmware patch."

Yeah if it were just a firmware patch VW would not have set aside billions to deal with the fallout and had the CEO resign.

</comment></comment><comment><USER16> I wonder if this will have an effect on Europe's appetite for diesel cars in general going forward. I know they're much more popular over there than here in the US.

<comment><USER17> The economist has an interesting article out right now, about how the discussion over diesel cars is _almost_ moot with the rapid rise of the electric car globally over the next few years:

[http://www.economist.com/news/leaders/21666226-volkswagens-f...](http://www.economist.com/news/leaders/21666226-volkswagens- falsification-pollution-tests-opens-door-very-different- car?fsrc=scn/tw/te/pe/ed/dirtysecrets)

<comment><USER18> Globally?

Electric cars will never reach that much consumers in Asia as it has in US. Very few people in Shanghai/Seoul/Tokyo own private garage to charge cars in over night.

And this is why Toyota/Hyundai are stubbornly pushing Hydrogen cars.

<comment><USER19> That's as much a technology problem as anything else. If you line the streets with chargers, then have the car and charger interface with each other to report which car is actually charging, you can bill the owner.

Whether or not the areas cars are parked have the appropriate wiring to facilitate chargers is another problem entirely. And quite frankly, I'm still skeptical our electric grid can handle everyone plugging in a car - <USER2> panels or not. It's been overcast here for 4 days straight, if I had to plug my car in, it'd be drawing from an already strained grid. If everyone in my neighborhood did the same thing, I can see a lot of rolling brownouts.

<comment><USER20> [http://www.technologyreview.com/news/518066/could- electric-c...](http://www.technologyreview.com/news/518066/could-electric- cars-threaten-the-grid/)

> Researchers ... have calculated that the grid has enough excess capacity to > support over 150 million battery-powered cars, or about 75 percent of the > cars, pickups, and SUVs on the road in the United States.

<comment><USER18> That's US. Not same situation in other places.

</comment></comment></comment></comment></comment></comment><comment><USER21> Does anybody know the specific purpose of defeating the pollution control? I never see this addressed. What positive user experience is produced? The car has faster pickup or better gas mileage or something else?

<comment><USER20> [http://www.vox.com/2015/9/21/9365667/volkswagen-clean- diesel...](http://www.vox.com/2015/9/21/9365667/volkswagen-clean-diesel- recall-passenger-cars)

</comment></comment><comment><AUTHOR> This can't really be called a bug because they did it on purpose, but what are the most costly software 'issues' in history? As VW set aside 6 billion for damages I assume this is the worst.

</comment><comment><AUTHOR> Does this mean these cars will be recalled or will the environmental laws be weakened to make them road legal?

<comment><USER22> As far as we know, all other manufactures complied with environmental regulations. Cars will have to be recalled and it will be a huge hit for VW.

<comment><USER23> I believe that Mercedes and BMW have reasonable suspicion cast on them too.

<comment><USER24> Both of those platforms use Urea systems, as do larger and more expensive VW/Audio vehicles. The issue is purely in the small, inexpensive vehicles.

The NOx problems were mostly resolved through the injection of urea into exhaust gases (e.g. AdBlue), dramatically reducing NOx emissions while leaving the efficiency and power unaffected. Urea systems add an extra cost and complexity to the vehicle though (not to mention that you need to top up your urea additive occasionally), and VW seemed to find a loophole that allowed them to make small, inexpensive cars without urea injection. They did this by injecting fuel into the exhaust in the absence of Urea, but to achieve the same effect. But this can gunk up the NOx trap if used endlessly (it is far less precise than urea, obviously), reduces fuel economy, etc, so they built this One Little Trick that only actually does that during identified tests.

<comment><USER25> I don't understand this assertion. The two VW diesel (US) automobiles I've owned have had an AdBlue system. One was a base model Jetta TDI and the other a Passat TDI (which I now want rid of).

<comment><USER24> And the vehicles in question -- the ones that are causing VW these issues -- do _not_ have any urea injection system. That's the whole point.

[http://ask.cars.com/2012/11/why-do-some-volkswagen- diesels-u...](http://ask.cars.com/2012/11/why-do-some-volkswagen-diesels-use- adblue-and-others-do-not.html)

VW claimed to have a trick that removed the need for it on their smaller, lighter cars. But that trick was a trick that only allowed them to pass EPA tests.

<comment><USER25> Ah, so come to find out, the Jetta TDI 2009-2014 did not have AdBlue (I mistakenly believed the one I owned previously did, a 2010 model).

However, VW added the AdBlue system to the 2015 Jetta TDI -- perhaps because they knew that this was a problem:

[http://www.bimmerfest.com/forums/showthread.php?t=765593](http://www.bimmerfest.com/forums/showthread.php?t=765593)

On top of that, even though the Passat has an AdBlue urea system, it's still affected:

      On the open road, a Volkswagen Jetta TDI blew through the
      U.S. nitrogen oxide (NOx) emissions limit by 15 to 35
      times. A VW Passat TDI (with urea aftertreatment) was 5
      to 20 times the maximum.

[http://www.greencarreports.com/news/1100125_vw-diesel- emissi...](http://www.greencarreports.com/news/1100125_vw-diesel-emissions- recall-what-you-need-to-know-in-10-questions/page-2)

So yeah, I'm not a happy owner right now.</comment></comment></comment></comment></comment></comment></comment>


Why Michael Arrington will lose his "war" with Arianna Huffington - <AUTHOR> http://borasky-research.net/2011/09/06/hows-that-again-mr-arrington/#.Tme6X-rWsV8.hackernews <comment><USER2> Pretty convincing argument. :-)

<comment><USER3> Only if you believe that indirectly measured traffic metrics mean anything in the real world.</comment></comment>


Apache OpenOffice vs LibreOffice: Make love, not war. - <AUTHOR> http://www.grobmeier.de/apache-openoffice-vs-libreoffice-make-love-not-war-06112012.html <comment><USER2> Except that's not true. Open source _is_ about marketing and mindshare and brandnames and winners and losers, for a variety of reasons.

The primary one that the LibreOffice folks complain about (and I agree with, as someone completely uninvolved with both projects) is that a lot of mindshare was built up over the last several years for the name "open office", and your average _end user_ is going to remember that and not have heard about the fork, and certainly not going to have any opinion as to who's right. Both groups, I'd assume, want end users to have the best product. So the LibreOffice folks can justifiably complain that if Apache OpenOffice is using the "open office" name but not releasing the best product, they're doing users a disservice.

More than that is that the LibreOffice folks contributed to that mindshare. I'd bet a good fraction of Windows and Mac users know of OpenOfffice.org because their Linux-using friends recommended it, but all major Linux distros had for years been collaborating on patches via <http://go-oo.org/>. That community turned into the LibreOffice community and started marketing. They had _tried_ collaborating and sharing the name, but decided that didn't work out. (In fact, if you look at <http://go-oo.org/> , one noticeable feature of the site is how little marketing they were doing. The creation of LibreOffice/The Document Foundation was a considered decision based on years of experience of attempting to focus on software alone.)

Even if you put aside the end users and pretend that writing open-source software is worth it just to produce the software, mindshare and marketing still comes into play when attracting contributors and doing releases. I've never contributed to either, but if I were to, it's my impression that LibreOffice is doing better and that the community there is more vibrant, and so that's what I'll prefer to participate in. If that impression changes and I gather that LibreOffice is dying, I'll work on Apache OpenOffice. So I trust both organizations to tell me how well they're doing and not misrepresent the other as doing worse than it is.

Finally, all the major free software projects -- Firefox, Linux, Debian, Ubuntu, Red Hat, etc. -- aggressively protect their name and their trademark, because brand identity is important both for users and for contributors. Even GNU releases its licenses and philosophies under a no-modifications copyright license. There's no reason the office suites should be different, and not protect their identities and image.

I would be as happy as anyone to see the fork resolved, but I don't think it can be done by telling people to focus on writing code and not focus on things essential to the process of collaborating on code, releasing a product, and getting users -- all the reasons to write code in the first place.

<comment><AUTHOR> There is much more than "end user" open source software. While it is true that brands need to be protected, open source software gets mostly popular because it is good, not because they have shiny numbers. Protecting the brand is ok. Marketing is a different beast.

You wrote you have the impression LibreOffice is "doing better". What does that mean? Have you observed what OpenOffice is doing? What is your metric? If you have not looked into both projects and if you have not tried both products you simply cannot say that. You are a victim of marketing, probably. "Doing better" is too broad to say. Even when you say "i like LO more" you can't say "doing better" in general, because both project are not really merge-able codewise and cannot be compared. You just can give your own impression, like when you say "Windows" is doing better than "OS X".

You also miss one important point before you choose for which organization you are working. The license. Apache licensed code can be used in commercial products. GPL licensed (as with LO) cannot be used without becoming Open Source itself. This is important, because OpenOffice is the one you would take when you are working on a product which needs to include for example spreadsheet features.

That all said, Open Source has different point of views, but for many of us unpaid developers it is not about marketing. It is about fun of coding. Exploring new things. Make big things happen. I even agree when you say: collaborating on code, releasing and getting users is cool to have. But: nobody needs marketing for that. I have worked on many open source projects without a "marketing division".

What you said about GNU: they do not have a no-modification copyright license.

However in this blog post I outlined that wrong marketing is doing harm to a project. Flames against projects is doing that too. Having media with an opinion when they should make up news in a mostly objective way is bad too.

Still i don't get why there is dicussion. A group of people want to do project A, a group of people want to do project B. Nobody is forced to stick with a project. Everybody can switch project like he wants. I don't get why people are so emotional with these two projects. Again: calm down, let people have their fun.

<comment><USER2> > open source software gets mostly popular because it is good, not because > they have shiny numbers

I want there to be a good, free office suite. This would work better if there were a single large group of developers working together on the same thing and a single community of users, instead of two splintered groups of developers who can't share their own code.

> The license. Apache licensed code can be used in commercial products. GPL > licensed (as with LO) cannot be used without becoming Open Source itself. > This is important, because OpenOffice is the one you would take when you are > working on a product which needs to include for example spreadsheet > features.

I work for a company that sells GPLed software to large enterprises and makes quite a bit of money doing so. I don't see a problem with LibreOffice's licensing. (I don't see a problem with Apache OpenOffice's licensing either, to be clear.)

> What you said about GNU: they do not have a no-modification copyright > license.

Sorry if I was unclear. GNU licenses _its own marketing materials_, including its website and the text of the software licenses it promotes, under a no- derivatives license. The bottom of the FSF website says the site is licensed under CC-BY-ND, and the first sentence of the GPL is "Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed."

> Again: calm down, let people have their fun.

I don't want to have "fun". If I were to work on LibreOffice, it would be because I wanted the world to have a good office suite, not because it is my own enjoyment to develop an office suite for myself. When I work on projects at work, it is primarily because I want my customers to have good products, not because I want to develop enterprise software for my own personal use (and it's certainly not for the money, because I could do a hundred other things instead).

Not all developers have the same motivation, and it's unfair to shut down people who are motivated to release a good product by telling them that they're only allowed to do things for the "fun of coding".</comment></comment></comment>


Cheap Countries to Live in While Building Your Startup - <AUTHOR> http://tech.co/cheap-countries-to-live-in-2013-08

<comment><USER2> China blocks lots of western web sites.

</comment><comment><USER3> Good information! ;)</comment>


Gitcoin Grants Round 5 Retrospective - <AUTHOR> https://vitalik.ca/general/2020/04/30/round5.html <comment><USER2> It's quite disappointing that Vitalik keeps pushing something that fundamentally doesn't work in a decentralized setting.

The proposed mechanism "assumes" identity, otherwise the mechanism is gamed easily. Which is what has been happening.

<comment><USER3> AFAIK there's nothing mutually exclusive about using a service that requires identity (in this case, proof of unique human-ness) on a decentralized blockchain. In fact there are services that are actively working to create DIDs (like brightID, 3box, etc).

<comment><USER2> "working on it" vs "works today"...

<comment><USER4> Curious if you believe that because it's not working today it means we shouldn't talk about it as a path forward?

<comment><USER2> A decentralized identity system that works will be a very significant component to the dweb stack.

But people that have experience building decentralized protocols will tell you that it's a _very hard_ problem to solve, for many reasons.

This is an engineering community, so I believe that it's important to focus on things that exist today. Not on speculative solutions.

<comment><USER3> I agree it's a hard problem to solve, and we've got no illusions about that.

This post (also, coincidentally by Vitalik) talks about different levels of collusion (from unsophisticated to sophisticated) [https://vitalik.ca/general/2019/04/03/collusion.html](https://vitalik.ca/general/2019/04/03/collusion.html)

Gitcoin's approach thus far has been to stop collusion from unsophisticated actors, then progressively get more organized (as more money gets involved, and as we learn from each round) about stopping collusion from more sophisticated actors.

This thread talks about some collusion that we founnd in Round 5. [https://twitter.com/owocki/status/1250097472694702080](https://twitter.com/owocki/status/1250097472694702080)

</comment></comment></comment></comment></comment></comment><comment><USER3> Hi all, I'm the founder of Gitcoin Kevin Owocki ([https://twitter.com/owocki](https://twitter.com/owocki))

Happy to answer any questions. Its Saturday so will be AFK for a bit here & there, but will keep an eye on this thread.

<comment><USER5> You have done great for the community. You have helped programmers in Africa to get involved and exposed into something serious. You have helped to bridge the digital divide and also increase social mobility.

<comment><USER3> Thank you! But honestly its the gitcoin team/community that is doing it, I'm just helping the team/community coordinate at this point :)

Hopefully this ([https://gitcoin.co/results](https://gitcoin.co/results)) is just a start and we can build information age native institutions that support all sorts of public goods (Open Source Software being the focal point right now) at 100x this scale one day.

</comment></comment></comment><comment><USER6> Can someone explain what this is to me please? Is it a coin where work on the coin/it's promotion is rewarded with more coin?

<comment><USER3> > Is it a coin where work on the coin/it's promotion is rewarded with more > coin?

Gitcoin never did an ICO and doesnt have a token. During the 2017 ICO craze, we opted instead to just focus on product/community.

Our network supports any ERC20 token or ETH. Here are the top ones on the Gitcoin network [https://gitcoin.co/leaderboard/tokens?cadence=all&keyword=al...](https://gitcoin.co/leaderboard/tokens?cadence=all&keyword=all&product=all)

More on why we didnt do an ICO at [https://gitcoin.co/not_a_token](https://gitcoin.co/not_a_token)</comment></comment>


C is Truth - <AUTHOR> http://bunsch.pl/2015/05/03/c-is-truth/

<comment><USER2> Except that C isn't really the truth - Assembly is the truth. You can easily write code that is a huge abstraction from what the CPU is actually doing - for example, writing `float y = 1.5 * x` on a processor without a hardware FPU will generate a ton of instructions that one wouldn't normally think of.

Now, the abstraction layer that C provides is valuable, and C is indeed much more practical than assembly for most purposes, if only due to portability - but if the only reason for using C is to gain an understanding of the inner workings of the computer, without regard to portability or reuse of code, assembly serves that purpose even better.

<comment><USER3> _" Assembly is the truth"_

Not even assembly is truth. In modern CPU architectures, your machine instructions are getting scheduled and parallelized in all sorts of weird ways that makes it hard to reason about the performance of your code. The instruction set architecture that assembler language maps to is an abstraction running on top of the microcode architecture. Perhaps microcode is truth, but nobody really wants to program at that level.

C is close enough to the truth that you can use it write an operating system that controls the CPU and its attached devices.</comment></comment>


Ford recalls 1.5M Focuses for faulty fuel tank purge valves - <AUTHOR> https://arstechnica.com/?p=1400149 <comment><USER2> Just bought one from 2014. Has horrible transmission that has a recall, and I was just thinking about taking it to the dealer.Why not go for 2 recalls instead of 1.</comment>


Tutorial: Get Google search terms and rank from HTTP referrer - <AUTHOR> http://coding.pressbin.com/59/Get-Google-search-terms-and-rank-from-HTTP-referrer/

<comment><USER2> Sorry to moan.. but it makes me quite angry that this is getting so many points.

Not only is it a pretty dull code snippet for which a combination of Google Analytics and Google Webmaster Tools would do a better job, but also the code has many flaws.

Even with the blatant SQL injection fixed there's still redundancy in the database - why store results_url separately when you can just use something like

        echo 'results url';

and save storing all that duplicate data for every referral?

There's also no error handling - what if you get a referral from example.com/google/page.html? Boom! undefined index 'q' on line 5.

Why's $refer being stored on line 1 only to switch back to using $_SERVER['HTTP_REFERER'] again on line 3?

Why copy $vars into three separate variables at all?

And even if all this was fixed and the code was perfect, what's the _point_ of this submission? Why's it interesting? What do we learn from this?

Again, I know complaining like this is frowned upon, but now and then I think it's useful to have some discussion about what's a good submission and what's not. If this faded out at 10 points then the system would be working. As it is it's been highly ranked for hours.

<comment><AUTHOR> Hi user24,

As the author of the post, I'd like to respond.

When I wrote the code for this example, my main point was simply to illustrate how to extract certain useful bits of data from Google's referrer URL, and explain what they mean.

I was not intending it to be production-ready code -- that's why there's no error handling.

Indeed, as one other commenter noted, the storing of the values in a database could have been left off entirely.

What's the point of the submission, you ask? Well, Google's referrer URL uses variables that are not very intuitive. Who would know, just by looking at it, that the "cd" value represented the position at which a link appears on the Google search results page?

So I wrote this post for people who might see this referrer in their logs and want to know what it means. And while Google Analytics and Google Webmaster Tools do provide essentially the same information (and more!) there may be limited cases in which a person might want to use the information contained in the referrer URL within their script, e.g. "Hey, you searched for such-and- such. Here are some other posts you might like."

<comment><USER2> Hey,

I didn't mean to offend. And I've also been guilty of releasing non- production-ready code.

And if you'd just included that kind of disclaimer clearly up front I don't think I'd have felt so compelled to comment on this.

As far as the point of the submission. Yes, I found it interesting to learn about Google's referers, but I think I'd rather have just read about that, rather than seeing the code too. It was unclear whether the article was "Hey lets deconstruct google referers" or "Hey lets play with some PHP". The former is interesting, the latter not.

Thanks for the reply.

</comment></comment></comment><comment><USER3> PHP has methods for URL parsing. There's no need to approximate them with regexes:

      $query_string = parse_url($_SERVER["HTTP_REFERER"], PHP_URL_QUERY);
      parse_str($query_string, $vars);
      $term = $vars['q'];
      $rank = $vars['cd'];
      $url = $vars['url'];

Correct code is even shorter.

<comment><AUTHOR> That's awesome! Definitely gonna update the post with your code.

<comment><USER3> And please, please fix the SQL code. It isn't helping noobs (it's not even valid SQL), and it's an eye-sore for people who know how to insert 3 variables into the DB.

</comment></comment></comment><comment><USER4> nice to see people are still oblivious to sql injection and using string interpolation instead of prepared statements.

<comment><AUTHOR> Good point. I should note that I'm not oblivious, but I wanted the example to be as readable as possible. I've added a note at the bottom of the post to make it clear that the code should be modified before using it in a live appplication.

<comment><USER5> Simple code examples with glaring security holes are a great way to teach people how to write insecure code. If you show usable code in a tutorial it _will_ make it into a production environment somewhere.

<comment><USER6> Is that really a concern, though? People ignoring warnings like the one at the bottom of the post are probably going to write insecure code anyway. From a purely selfish standpoint, there is no advantage to _me_ from not posting insecure code examples. In fact, the more people copy-paste such bad code and make sites that get hacked, the more opportunities I have for work when they get fired.

<comment><USER7> That really is pretty selfish.

I'm thinking there are two sides to this, the first is that just like you added the 'don't use this' as an after thought the majority of the people that find your code will cut and paste it without actually reading the article, the second is that if this is your 'first approach' to keep it readable you probably have at least a few instances where you forgot to update to more solid code at a later stage because you thought 'x' or 'y' is not facing the web at the moment. And then one day someone bridges two systems and bang, security hole.

<comment><USER6> I know it's selfish, I just thought it was a direction of thought worth exploring. Personally I wouldn't post insecure code without a lot more warnings, closer to (or commented in) the code itself. At the same time I would have absolutely no sympathy for a "programmer" that would copy paste code without even reading the entire blog post it's from, let alone make an effort to understand it. They don't deserve their job.

Your point on 'first approach' security holes accidentally being persisted is a good one, and I can certainly think of a few bits of code I wrote that were never meant to be secure, but could potentially be used in a larger, web- facing project at some point. Some food for thought there on perhaps never writing insecure code, even if it's just a test.

Tangential addendum: If security is Done Right, then there shouldn't be a choice between "easy to write, read and follow" and "secure".

</comment></comment></comment></comment></comment></comment><comment><USER8> As an aside, did anyone read the second post, about turning extensions of the URLs from .php to .html? That's trading "wrong" for "more wrong". Just rewrite your URLs to have a reasonable hierarchy and you're done, no need to add any cruft like extensions.

</comment><comment><USER9> hm, old? saw that first time in 2009 :)

here is a tutorial how to track these data directly in analytics: <http://yoast.com/track-seo-rankings-google-analytics/>

</comment><comment><USER10> Surprised this isn't yet in Google Analytics.

<comment><USER11> You can write a custom filter in GA to pull this data out into a report in a separate profile:

[http://www.seomoz.org/blog/tracking-organic-ranking-in- googl...](http://www.seomoz.org/blog/tracking-organic-ranking-in-google- analytics-with-custom-variables)

</comment></comment><comment><USER12> Wait, Google has been passing rank in the referrer? Doesn't this completely kill the business model of SERP monitoring services like GinzaMetrics?

</comment><comment><USER13> As far as I know, this won't work if the user came from <https://> \- the referrer will be empty, won't it?

<comment><USER14> That's right, but the article is about Google search, so the referrer will be hidden only if the user comes from <https://encrypted.google.com>

</comment></comment><comment><USER15> You need something a bit more complex to parse the referrer from a Google Image search, due to the way Google links images to another page on their site instead of directly to your page. You end up with a nested URL within the referrer that needs to be double-decoded to get back the original search term, or something along those lines.

</comment><comment><USER16> I am looking at my apache access logs, and clicking to my site from a search query and I can't see the 'cd' / rank parameter. Does this work for other people?

</comment><comment><USER17> Wow, I saved every referrer for each visitor to BitBuffet.com, I had no idea that it contains the rank! Very neat, now I will peruse my database...</comment>


Show HN: Koody – On demand financial guidance in the UK - <AUTHOR> https://community.koody.co/ <comment><AUTHOR> Hi everyone! I have just launched a community to support my initial website. Users can ask money-related questions and receive opinions from verified financial experts and the general public. I'd appreciate your thoughts!</comment>


Multi-Gmail Goodness on OS X - <AUTHOR> http://whatcodecraves.com/articles/2009/02/11/multiple_gmail_accounts_on_osx_done_right/index.html

<comment><USER2> Might want to also check out Mailplane: <http://mailplaneapp.com/>

It brings a few desktop app niceties to Gmail.

<comment><AUTHOR> I really like the idea of the drag/drop attachments. I'd use that for attaching screenshots and files I have on my desktop.

my friend also recommended: <http://www.postbox-inc.com/></comment></comment>


Android Market Search is broken...for developers  - <AUTHOR>

 for the last few months the Android Market search facility has been broken. When you search for an app why name/description you are shown the number of possible results (usually in the thousands) but when you scroll down you are only ever allowed to see about 20 results. eg: search for ringtones it shows 25479 results but only the top 20 are ever shown in the results list.
Google have listed this error as a known bug and have it up on their "known issues" page (http://www.google.com/support/androidmarket/bin/static.py?page=known_issues.cs)
but it's not fixed in the latest version of the market (from your article: http://www.engadget.com/2011/11/01/android-market-v3-3-11-apk-now-available-adds-auto-update-by-de/) and has been evident for months - at least since August (http://www.google.com/support/forum/p/Android+Market/thread?tid=0fe7684aaf99d3cc&hl=en)
The issue here is that it's really hurting app developers - unless you're being favoured by Google and have your app featured, or is a top selling app it's very difficult to be found anywhere on the market. This hurts new, smaller developers who have no way of making their new app visible, unless they're willing to fork out a healthy chunk of change to get their app advertised - usually forked over to Google themselves via their Ad network purchase Admob. I'm not saying these facts are related just very aware that this is a problem which needs to be fixed. <comment><USER2> I think this bug was also mentioned at the android developer lab in paris. But beside the point that this should be fixed: Do you expect your app to become more visible if your customers can browse through the whole search list?

As far as I know, most people never look beyond the first 10 or so results in a Google web search result. So why should that be different here?

IMHO there are so many apps in all the app markets right now, that a search without page rank is as useful to the customer as altavista was in the early days.</comment>


A Taipei-Torrent postmortem: Writing a BitTorrent client in Go  - <AUTHOR> http://grammerjack.blogspot.com/2010/01/writing-bittorrent-client-in-go.html

<comment><USER2> The sample code is pretty interesting from a return value vs exception perspective: despite being forced to look at return values, the code still silently ignores all errors

<comment><USER3> Hey, good point!

I think the best thing to do would be to send a message to an error channel before returning. I'll add that.

For what it's worth I don't think exceptions would help here -- this is the top level function of a goroutine. That means there's no other function that's going to catch any exception that might be thrown (or error that might be returned) from this function.

<comment><USER2> sorry for the late reply:

yeah, that's even more interesting that because its inside a goroutine, there would be nothing to catch it. in this case, i think erlang got some things right with process linking

</comment></comment></comment><comment><USER4> bencode serialization is 800 lines!? I wrote under 50 in Smalltalk. In fact, I think it was less than half that. (To be fair, you can do this by adding recursive methods to Streams, which already have infrastructure to deal with the external environment.)

<comment><USER3> A go bencode serialization library could be smaller if it just serialized the bencode data to and from a generic dictionary container. I think another go BitTorrent client, gobit, takes this approach.

But it's convenient to be able to serialize arbitrary application types. That makes the bencode library larger because of the need to use go's reflection APIs to analyze and access the application types. Go's reflection APIs are pretty verbose, which is why the line count is so high.

To make things even more complicated, the BitTorrent protocol has a funny "compute-the-sha1-of-the-info-dictionary" requirement that forces BitTorrent clients to parse that particular part of the BitTorrent protocol using a generic parser.

So in the end, the go bencode serializer supports both a generic dictionary parser and an application type parser, which makes it even larger.</comment></comment>


PostgreSQL 9.5 will have native sharding - <AUTHOR> http://www.depesz.com/2015/04/02/waiting-for-9-5-allow-foreign-tables-to-participate-in-inheritance/

<comment><USER2> So, it will be web scale?

<comment><AUTHOR> I don't know about "web" scale, but it will definitely scale horizontally without using any external tools/extensions.

There's still a somewhat annoying limitation that is related to the status of table partitioning in postgresql.

In fact the planner automatically choose the right child table, be it on the same db or into another server, for UPDATE and SELECT statements but not for INSERTs. This is a known limitation and there's active work to fix it but don't hold your breath though.</comment></comment>


Command Lines: Alive & Kicking - <AUTHOR> http://uxmag.com/technology/command-lines-alive-kicking <comment><USER2> There has to be a blend between the command line and the GUI. Even keyboard shortcuts in applications are included in it, without which its impossible to work for power users.</comment>


Plundervolt: An Attack on Intel's SGX - <AUTHOR> https://www.plundervolt.com <comment><USER2> All important caveats, for the lazy:

\- SGX is disabled by default, it has to be enabled for this exploit to be relevant

\- POC requires privileged execution, at which point you can safely assume all is already lost

A side note: anyone who has spent time around digital logic circuits will know that messing with voltages will cause errors. If the power lines are too low some transistors will not be able to switch their load. Or too high and you will cause parasitic losses or capacitance in unexpected places. This is actually a really nice attack to show off to people with an interest in computer/electrical engineering because it demonstrates how a basic design constraint can cascade in unexpected ways.</comment>


The Writer Automaton, Switzerland [video] - <AUTHOR> http://www.chonday.com/Videos/the-writer-automaton <comment><USER2> 1770ies. Wow. That's still in the so-called 'Ancien Regime', before Napoleon took Switzerland for a few years. Switzerland was a relatively loose confederacy back then, a bunch of city states, small republics and subject territories. Very poor, except maybe for the watchmakers in Neuchatel. Even getting the supplies for such a machine must have been tough back then. All the more impressive.

</comment><comment><USER3> Often when one of these ingenuously conceived & impeccably crafted devices is unearthed [1], one wonders about not only the provenance, the period and the relative brilliance of such contraptions but also the initial impetus for the actual making of the device.

One cannot help themselves from wondering

      * what prevailing mores - and pressures - led to the devising
       of such relatively complex gadgets.
      * what the availability of skilled labor was in those times
      * how expensive or cheap such (bonded ?) labor was
      * how freely or sparsely knowledge was shared in those times
      * how guilds & ancestral orders controlled the dissemination
      of such knowledge & trade-craft, often limiting it to very few
      trusted members outside the immediate family or clan, after
      decades of indentured internship and servitude.
      * what other existential pressures the inventor faced in the
      making of the contraption Eg. Sedition laws, Canon law etc.

I tend to think that most of the inventors of these devices made them under _some_ form of extreme duress or state sanction - _not very unlike_ say the much-debated working conditions that prevailed during the construction of the Pyramids [2].

I am somehow inclined to believe that they did not enjoy the same somewhat lofty treatment bestowed on painters, architects and sculptors.

This is semi-informed speculation.

I'd love to read more on the topic from scholarly sources.

[1] The Antikythera Mechanism

[http://en.wikipedia.org/wiki/Antikythera_mechanism](http://en.wikipedia.org/wiki/Antikythera_mechanism)

[https://www.youtube.com/watch?v=UpLcnAIpVRA](https://www.youtube.com/watch?v=UpLcnAIpVRA)

[https://www.youtube.com/watch?v=4eUibFQKJqI](https://www.youtube.com/watch?v=4eUibFQKJqI)

[2] Who Built the Pyramids?

[http://harvardmagazine.com/2003/07/who-built-the-pyramids- ht...](http://harvardmagazine.com/2003/07/who-built-the-pyramids-html)

Edit: formatting

<comment><USER4> Yes its strange to think, under guild systems of suspicion and secrecy, that anything like these amazing contrivances could be designed and built. Were these Newton-grade geniuses? Skilled mechanics? Nerds of another age?

Just saw a so-so documentary on glass, which included the insight that Venice has had glass guilds for 500 years. During the whole time they've flourished under a system of knowledge sharing, where the old masters taught anyone (in the guild) who would listen, their techniques. Made Venice an amazing place, for glassmaking and lensmaking.

</comment></comment><comment><USER5> There are Automatons on display at the Museum of Art and History in Neuchâtel, Switzerland. Totally worth a visit.

</comment><comment><USER6> We also have one in China, in the Forbidden City. It was a present by certain western diplomat in 1700s/1800s. I'm pretty sure this kind of thing was actually quite popular back at that time.

</comment><comment><USER7> Is that a wind-up?

</comment><comment><USER8> Really amazing. Previous discussion on HN [https://news.ycombinator.com/item?id=6678947](https://news.ycombinator.com/item?id=6678947)</comment>