The Anti-Human Consequences of Static Typing - <AUTHOR> http://jeapostrophe.github.io/2013-08-12-types-post.html

<comment><USER2> > Theorems and conclude that in every logic there are statements which are > true, but not provable, or provable, but not true. And this is the ultimate > problem with type systems: in their quest to reject "bad" programs, they > must reject "good" programs as well because they cannot prove their > "goodness".

This really is a gross misuse of Gödel's theorem. Taken to it's logical end his argument is that any field that has logical foundations should value human judgement over rigor and proof because of incompleteness. Should we just throw out all of mathematics as well because there are true but unprovable theorems?

<comment><USER3> We should not throw out mathematics, but we should recognize that most mathematical proofs are not based on logic, but human intuition in the first place. Human intuition and wisdom are valuable and lay the foundation for all that we do and there's no reason to ignore them when we're programming and insist that all valid programs have to follow some particular set of rules.

<comment><USER2> > mathematical proofs are not based on logic

Mathematical proofs are explicitly logical statements, if they aren't based in logic they aren't proofs by definition. Mathematical intuition is what leads us to ideas but it's only within the framework of formal reasoning that we "know" anything within mathematics. Poincare said it nicely:

"It is by logic we prove, it is by intuition that we invent."

<comment><USER3> If you really believe this, you should try to translate any contemporary (published) mathematical proof into a real logic, like Coq. It is hard and people earn PhDs doing this because most proofs are so intuition heavy in the first place.

<comment><USER2> I have spent several months doing proofs in Coq, as well as in Isabelle. I contest conflating Coq with "real logic", it is perfectly possible to do rigorous proofs without the aid of a computer-aided proof assistant, if that wasn't the case then there wouldn't be any reason to trust the authors of the proof assistant in the first place.

<comment><USER3> Certainly, but most math proofs aren't "rigorous proofs" by any stretch.

</comment></comment></comment></comment></comment></comment><comment><USER4> Static typing is pro-human; I would call it even more humane than dynamic typing.

Vastly more type errors (i.e., conditions which cause the program not to hold the property checked by the type system) are caused by programmer error than by deliberate design; a strong, static type system, checked at compile time, helps ensure that a whole class of relatively weak but trivially easy to write bugs do not find their way into the finished program. The programmer hours saved in not having to worry that some little-exercised code path will attempt to add an integer to a string, nor to write exhaustive tests covering every possible code path to make sure no integers get added to strings, adds up significantly over the program's lifecycle, from initial development through maintenance and support.

Be kind to your programmers. Use a statically-typed language.

<comment><USER5> I mostly agree, but having the ability to use a dynamic type occasionally can be very useful. I like how objective-c handles it in practice.

</comment></comment><comment><USER6> The first example of a "good" program contains an if statement that should only ever branch in one direction.

I question whether that is a "good" program.

<comment><USER7> There are only four options for removing a block of code you no longer want to use:

1\. Add a comment around the whole block. This may not always work, as comments within the block may need to be removed.

2\. Add string delimiters before and after the block, making the block an in- place string literal. This can be broken by strings within the block.

3\. Use a goto statement to skip the block. This is a pretty good method but you have to worry about the label getting moved, and fellow developers laughing at you for using goto.

4\. Wrap the block with a big if (false) { }. This is the most bullet proof method, but it violates your goodness criteria.

<comment><USER8> Delete it and refer to your version control system's history if you need to bring it back?

Edited addition to reduce the snarkiness a bit: if I see a block of dead code like that left in a file, regardless of which way it's been killed, I'm going to consider that bad unless there's a very clear comment explaining why this isn't needed anymore but was worth leaving in the code instead of fully deleting it. But if that comment's there, and the reason makes sense, it's still breaking the "rule" but becomes an example of knowing _when_ to break the rule.

<comment><USER9> Honestly, the code's probably changed enough since it was commented out to not be worth considering anymore (short of maybe leaving the comment, reworded, to explain what used to happen and why).

Large amounts (I regularly see 500+ lines in a single file) of commented out code is a huge smell and it would take an _outstanding_ justification to get me to not delete it.

</comment></comment></comment></comment><comment><USER10> Dumb. Mangles Godel.

The premise is that for real world inputs some code may never be used, and so it's an _advantage_ for late-checked types that you can have wrong code that will never cause any observed bug. I'd rather "waste" my time deleting nonsense code after it fails an early type-check. Less code = better reading/maintenance/extension.

Better to focus on the real advantages of single-type languages (usually, terser programs, although type inference can make some haskell/ML programs apparently type-less).

</comment><comment><USER11> I agree, we need to have far more human compilers. Perhaps, when I compiler runs across a type violation it just breaks out laughing at you. "HA HA HA! You idiot! You defined this variable as a string, and then you tried to do arithmetic on it, WHAT WERE YOU THINKING?"

Maybe the compiler can just complain about the user. "Seriously, this guy first gets me to make this integer, and that's cool, but then he starts to use it like it was a float, so you know, I gotta go and rearrange ALL the bits. Then you know what he does, he goes and takes another integer and tries to math them together. Screw that guy. But you want to know the kicker? After all of this, he casts it back to an int and then tries to append a string. Seriously. Make up your mind. I need a beer. What do you think I am, Javascript?"

Maybe the compiler just gets angry. "You know what? First you claim it's this structure, then you treat it like that structure. Whatever, I say it's crap. I'm deleting it. Write it again, and make sense this time."

I prefer my computers less human.

<comment><USER12> "I don't know, you asked me to divide that integer by this string. What am I supposed to do?"

</comment></comment><comment><USER13> >The logic goes that if you reject "bad" programs then only "good" programs remain, and who would want to run "bad" programs anyways?

I thought the logic was: if you reject all bad programs and some good programs, only good programs remain, is it not?

<comment><USER14> I think the logic actually goes "if you reject _upfront_ all programs with a certain type of badness as well as some programs that falsely appear to have that type of badness, you will reduce the costs associated with bad programs by catching many of them sooner, at the cost of having to rewrite some already-good programs in less-simple ways to avoid the appearance of badness."

<comment><USER3> Let's put that on a bumper sticker :)

</comment></comment></comment><comment><USER15> > A static type system is a mechanism whereby an algorithm determines if a > program exhibits a property, P, and if the property is not found to hold, > then the program is rejected.

Doesn't this definition encompass dynamically typed languages as well? e.g. P is syntactic validity?

<comment><USER3> Syntactic validity is not a property of a program, but a property of a piece of text that makes it a program. In any case, the point is that type systems purport to identify some amount of "goodness" in a program. I agree that "The compiler will produce something" is a property, although I doubt it is a property any static type proponent would defend as particularly important.

</comment></comment><comment><USER16> I don't think I've ever seen someone use such gleefully religious rhetoric to advocate dynamic types before.

<comment><USER17> When was this a non-religious issue? But I believe the problem is following: Either the type system is incomplete (there are programs out there that you might want to run but won't be able to), or it's unsound (some programs will get a pass the type checker but fail at run time), or the type system will be so complex as to being undecidable. Since people generally aren't happy with number one, you either have to rely on the programmer (number two) or force everything to pass through a potentially loopy process every time you compile something (number three)

Ot, one might go the Qi/Shen route...

</comment></comment><comment><USER9> I'm at a loss when it comes to considering something with dead code or a potentially unexpected return type to be good code, especially in something statically typed...

</comment><comment><USER18> Funny coincidence, just today I wondered if there's such a thing as a statically typed Lisp, and stumbled upon Racket with types [1]

I think another good example of a optionally static typed language would be Julia, where you _can_ add types, and if you add them, the compiler will try to leverage that information to optimize your code [2].

I've used dynamic and static languages mixed for most of my life (Javascript, Python, PHP back in the early 2000's VS. C and Objective-C). Recently I started working with Scala, which has much stricter typing than, say, Objective-C, and I have to admit that after a bit of early helplessness in the beginning, it feels strangely liberating that, once the code compiles, the program is solid. Successful compilation brings with it a sort of satisfaction.

[1] [http://docs.racket-lang.org/ts-guide/](http://docs.racket-lang.org/ts- guide/) [2] [http://docs.julialang.org/en/release-0.1-0/manual/types/](http://docs.julialang.org/en/release-0.1-0/manual/types/)

</comment><comment><USER19> > In the final analysis, we may appeal to the Gödel Incompleteness Theorems > and conclude that in every logic there are statements which are true, but > not provable, or provable, but not true.

Is this wrong?

"true but not provable" is easy.

What is an example of a statement that is "provable but not true"?

<comment><USER20> "Provable but not true" statements only arise in logical systems which are inconsistent, so it's fairly normal to not be able to come up with one.

So you need to assume two contradictory things are true, somewhere deep down in your logical system. As a trivial example, assume that both the following are true:

1\. I am a robot. 2\. I am not a robot.

And our false statement which we are going to prove is:

Pizza is made of fear.

We know that the following proposition is true:

I am a robot OR pizza is made of fear

Because we know that I am not a robot, the first term in the above must be false, and so the second term must be true. Therefore, pizza is made of fear.

That's really more an example of the principle of explosion, but the above is a tiny logical system which contains statements that are provable, but not true.

In practice, we tend to use logical systems which can't prove all true statements, but don't let you prove false ones. Much more useful, really.

</comment></comment><comment><USER21> > _Other more quaint languages like Java may have type systems that check > properties such as "The program does not add numbers and strings"_

Poor example. In Java, _number_ \+ _string_ means "convert the number to a decimal string then concatenate", and it can be invoked unintentionally.

<comment><USER22> Does it? I thought _string + number_ does that, but _number + string_ does not compile.

</comment></comment><comment><USER23> Are there any languages that have a type mismatch warning rather than a type mismatch error? Something like how gcc warns about incompatible pointer types when compiling C programs, but lets you use them if you insist, but for all types?

<comment><USER3> I suggest reading about progressive types:

[http://blog.brownplt.org/2012/09/01/progressive- types.html](http://blog.brownplt.org/2012/09/01/progressive-types.html)

<comment><USER23> Wow, thank you, that is exactly what I had in mind

</comment></comment></comment><comment><USER24> > (+ 1 > (if (negative? (fahrenheit->kelvin (abs some-number))) > "2" > 2))

This is inconsistent code to being with, though. You can't guarantee it "never" reaches the first branch, as much as you can't guarantee there aren't bugs in the conversion function, or on the underlying interpreter, or that machine details wouldn't make a big enough number wrap around and return negative. All in all, an inconsistent code branch hanging around is a bug even if it compiles.

This is more an evidence that "if" is evil rather than an argument about typing, really.

</comment><comment><USER25> I like the ending: "Please enable JavaScript to view the comments powered by Disqus." ;)

I know that the strengths of racket lie elsewhere, but I wish the performance would be better (at least comparable with sbcl) ;)

As for dynamic vs static typing - I don't care much about human rights, so I prefer static typing :D

Dynamic typing (and laziness) is good when you don't have to care about memory footprint nor performance of code you write e.g. when you're prototyping something.

</comment><comment><USER26> This is science. It must be true.</comment>


Sign In with Apple [video] - <AUTHOR> https://developer.apple.com/videos/play/wwdc2019/706/ <comment><USER2> I don't like that it's required for developers to include if they include any other third-party sign-in.

US competition laws are outdated with undue reliance on the concept of a monopoly.

I don't care if you're a monopoly or a third of the market or even a small company. If you run a marketplace or app store or similar platform, you should NOT be able to:

\- Force usage of a separate product of yours over/with competitors (in this case, Apple sign-in, but also Apple Pay instead of Google Pay, etc.)

\- Prevent competing products from appearing (whether Apple not allowing other browser rendering engines, Amazon not allowing Google Home or Chromecast to be sold, etc.)

\- Rank your own items higher in search results etc. if competitors can't bid to do the same e.g. sponsored results for everyone including yourself (so Amazon Basics or Google Shopping needs to be listed as a sponsored result, not as a separate feature)

This is the kind of thing 21st-century legislation for fair competition should address.

<comment><USER3> This isnt a monopoly.

As someone who has never bought an Apple product, I can safely say their monopolistic practices don't affect me.

Stop buying Apple products. Its that simple.

<comment><USER4> I don't buy Apple products (well not exactly true I have a MacBook but only because I'm forced to use that to build for iOS). But for my app which uses 1st party login or Facebook as an alternative I am now forced to provide Apple login. If Google follows suite I'll be forced to provide Google login on Android, etc. Probably I'll just end up removing all third party login too much of a hassle, although I'll definitely lose users.

<comment><USER5> I'm not trying to be a dick, I'm genuinely interested. Why would you make a product for a platform you don't support? Feels like a vegan owning a hamburger shop.

Is it the market size that keeps you in the iOS space? Are you on other platforms? What are the revenue/cost/effort ratios for each? Does it make sense to focus on non-iOS options?

<comment><USER6> probably because it's the most profitable platform. iOS easily makes more money than Android even though it has less users. In my experience, it's not close.

</comment></comment></comment></comment></comment><comment><USER7> The killer feature here is the anonymous email address forwarding. It shows Apple actively ceding an opportunity for exchanging marketing data in favour of user privacy. It does feel like Apple are taking privacy seriously and positioning it as more than just a marketing campaign.

I am tired of seeing my email address popping up on leaks and I don't want to rely on spam filters any more. The best spam filter out there is built into gmail, but they are no longer interested in actually preventing spam, instead they want to control it. Now Google shows me ads that look exactly like emails in my inbox, inside the iOS app.

I wasn't happy with this so I built [https://idbloc.co](https://idbloc.co), which is basically equivalent to the disposable email element of Sign in with Apple, now that Apple built it into their Sign In, I guess now it exists for users who don't want to or can't use Apple.

<comment><USER8> It also gives Apple far more control over the ecosystem. By not providing 3rd parties access to email, Apple makes themselves not only the controllers of the physical devices and also over the full identity of their users. My viewpoint is one of decentralization, and I don't see this move as being a long term beneficial one.

It's not a stretch of an imagination that Apple might cut a developer out of the app store for some abstract-defined violation of terms (as they do now) and now ALSO cut that developer from the identity/contact with their users. In total, this is almost the ultimate kill switch to push companies to adhere to their policies or risk a total shutout. This scenario might be considered overblown, if it wasn't that Apple already exercises pushy monopoly(esk) control on their ecosystem. The new identity system expands that control to now outside the Apple hardware ecosystem, possibly affecting platforms like Android.

I'm ranting here a little, but I think we should be cautious of accepting privacy as the sole reason Apple wants to enforce all app authentication to use.

<comment><USER9> > By not providing 3rd parties access to email, Apple makes themselves not > only the controllers of the physical devices and also over the full identity > of their users.

No they're not. They're preventing _third parties_ from accessing your data. You can communicate with your customers just fine; it's just that if you sell their data (or get hacked) the email you get is useless.

<comment><USER10> _"it 's just that if you sell their data (or get hacked) the email you get is useless."_

It's just that _whenever Apple decides so_ , the email you got becomes useless.

Apple is judge, jury and executioner, and it makes the laws. That _is_ problematic.

<comment><USER11> That sounds like a great feature. I would love for the ability to make an email address inactive after I sign up.

The percent of times I want to recieve email communication from something I have to sign up for is very close to 0.

<comment><USER12> Get your own domain through someone that has an email service that supports aliases. Every sign up can have a different address. It's like $10 per year and you're email is not at the mercy of whatever mega-corporation owns your email.

<comment><USER13> Any suggestions on which provider to use?

<comment><USER14> IMO, it depends on how many mailboxes and aliases you need. Providers like Fastmail charge by the mailbox (with up to 600 aliases for each). Same with Runbox, Mailbox.org, etc. (the number of aliases varies). Migadu provides unlimited domains, mailboxes and aliases for a fixed price that decides how many outgoing mails you can send everyday from all mailboxes in that account.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> It seems like it could be really good for users, but the fact that it's _required_ for any apps that use other 3rd-party sign-in options and that it's _required_ to be listed first among those options leaves a bad taste in my mouth.

I can't even imagine what would happen if Google did the same thing with Google Sign In and the Play store.

Disclaimer: I work for Google, not on anything related, and am speaking for myself (as always).

<comment><AUTHOR> It's not required to be first, it's "suggested" :-/

But lets look at it another way:

* I buy an app on the App Store, and then find out that I have to use FB or Google login.

* So to use the app I have purchased I am required to allow the app and/or Google or Facebook to further their abuse of my privacy.

Alternatively:

* An App is shown as "Free"

* I install it, and it require FB or Google sign in.

That isn't free. Again, signing up for abuse of my privacy is not free.

<comment><USER16> However it is _required_ that you add Sign in With Apple. I'm all for privacy but I disagree with this move because apple said "You must add Apple Sign In" rather than "You must allow one form of anonymous login" which means they are forcing developers to use their tools.

Additionally, if the app only has FB or Google login and you don't use either, you can just not use the app

<comment><AUTHOR> The problem here is very basic:

Why should an app be listed as free if using it requires sacrificing my privacy to use it? That's fundamentally not free.

If the app cost me _money_ then I've purchased an app I cannot use.

This is very simple: they're saying that you cannot require Apple's (and by extension your) users to submit to abuse of their privacy in order to use your app.

<comment><USER17> This "they're stealing my privacy!" outrage is tiresome. Someone built an app; it authenticates a certain way; if you don't like it, uninstall it. Both Google and Apple offer near immediate refunds. But really there's some due diligence required here - installing an app is not like visiting a web page, you should take a little care what you spend money on.

You're complaining that someone else is building apps in a way you don't like. That's their right; they aren't building them for you.

<comment><AUTHOR> Why should Google know what apps I'm installing?

Why should Facebook?

Why should I have to get accounts for those services just to use your app?

Why should apple list apps that can't be used by users because of they require user's to create accounts with companies that are known to abuse user privacy?

The last point I think is the most reasonable: why should I, a user, be required to use some arbitrary third party just to use your app?

If you are _solely_ using them for login support, and nothing else, then all you're doing is adding one more OAuth provider. What makes it so hard to require an Apple identity if you're already willing to accept google or facebook ones?

<comment><USER18> Besides that, I'm downloading an app from the Apple App Store. They _already_ know which apps I've downloaded. They aren't getting anymore information via "Sign in with Apple".

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> I'm thrilled about implementing this on our app so we can make registration and login even more smooth without having to be in bed with Google and Facebook. Can't wait to implement it.

I'm even more thrilled to see, that according to the Okta article linked in another thread by simonw [1], Apple uses OAuth and OpenID Connect for this, and not some home-grown protocol.

Great news all-round.

[1] [https://developer.okta.com/blog/2019/06/04/what-the-heck- is-...](https://developer.okta.com/blog/2019/06/04/what-the-heck-is-sign-in- with-apple)

<comment><USER20> Even better, this may eliminate passwords. This is only available on iOS and requires FaceID / T2 chip.

<comment><USER21> Sign In with Apple will work on any device, not just those with FaceID or the T2 chip.

</comment></comment></comment><comment><USER22> Aaron Parecki, the author of the "OAuth 2.0 Simplified" book, wrote a blog post on the misunderstandings around Sign in with Apple: [https://aaronparecki.com/2019/06/04/23/sign-in-with-apple- mi...](https://aaronparecki.com/2019/06/04/23/sign-in-with-apple- misunderstandings)

<comment><USER23> That article seems worthy of discussion on its own. I submitted it (expecting to find an existing discussion) but it turns out it hadn't been submitted yet.

[https://news.ycombinator.com/item?id=20128029](https://news.ycombinator.com/item?id=20128029)

</comment></comment><comment><AUTHOR> Just so people can watch the detailed developer introduction.

Specifically:

It verifies the "realness" of the account, so everyone claiming that they need user's real email address for "fraud detection" can't argue that nonsense anymore. We all know that argument was just a cover for "we want to be able to spam our users with impunity", but this specifically addresses that argument just to be sure.

<comment><USER24> > _...can 't argue that nonsense anymore. We all know that argument was just a > cover for "we want to be able to spam our users with impunity"_

Run a site that allows/displays user submitted content and you'll likely change your mind about that being a cover or bogus argument.

<comment><USER25> But requiring an email hardly solves that problem.

And very few apps (at least of what I use) that have 3rd party auth have features where user content is displayed to others.

<comment><USER26> It does significantly reduce the problem.

<comment><AUTHOR> How? Is it because you have "proof" that it's a real user?

If you watch the presentation or read the transcript, you'll hear that they already do a bunch of fraud prevention. I'm going to go out on a limb and say Apple is doing much more anti-fraud/fake account work that most others are able to.

<comment><USER27> I'd imagine there's a lot of criteria being used. Maybe something like the age of the account, how often it's used, of it was created from an often used IP address. Whatever it is, it's probably not in Apple's interest to disclose it.

</comment></comment></comment></comment></comment></comment><comment><USER28> ugh, this totally vendor lock-in .

1\. If my app is both in IOS and Android, and maybe Windows, would this work across platforms? The answer looks like no... Apple's definition of "multiplatform" means iOS, TVOS and WatchOS, and some javascript for the web. (given Apple's poor track record for anything web-based, good luck with that). If you want to port your app to Android or Native Windows, good luck with that. Your users are locked in.

2\. If I have an app that is a competitor to Facebook, and FB decides to cut me off, I can use the existing emails so the user are not locked out the app (i.e. they will be sent an email with a link to create a password and keep their account).

This looks impossible with the apple sign in. Basically if Apple decides to cut you off, your user's accounts are lost.

No matter what some folks believe that 'everything social is evil', some applications providers provide the social log-in just because the user that prefer using them over entering the same information over and over. Instead of entering email, authorizing/verifying it, and having a profile picture, a social log-in provides those for you.

As I am building an app that has the social login (Google and Facebook) as well as simple email sign in, this feels like an additional burden that I'd prefer not to (for the two main reasons above).

Feels very anti-competitive.... Apple should provide the log-in as an option, and compete with its own merits, but not force app makers to use it.

Also, I think apple is being totally evil now: By forcing companies like Spotify and other competitors to use their log in, they are creating an very intrusive/invasive way to monitor their competitors.

Eg. Netflix and Spotify and a myriad of other Apple's direct competitor are forced to be locked in the Apple's vendor sign in trap.

<comment><USER29> As for 1, just use a webview? That's how the iOS SDKs for Facebook/Twitter worked for the longest time.

edit: Also it looks like it's just OAuth and you could implement it directly

</comment></comment><comment><USER30> This seems to be a case of "anyone but Apple" logic by naysayers.

If Mozilla or name your blessed organization of choice came up with this system, most of them would be fine with it.

But because it's Apple, there's all this consternation about it.

Apple's huge advantage: their revenue comes from devices and services, not advertising.

It would be different if this was a one-off but they've been implementing privacy features for several years…

<comment><USER31> Not because it's Apple, but rather because Apple are exploiting their position as iOS App Store gatekeepers to require developers to add Sign In With Apple. Mozilla don't have this position / power.

I think people would have the same issue if Google required 'Sign In With Google' in play store apps that have Facebook login, and returned throwaway / proxies email addresses.

</comment></comment><comment><USER32> Does anyone else dislike when websites offer a lot of 3rd party sign-in options? Maybe it's just me, but when there's more than one option, I often forget which one I used and it ends up being a process of checking all of them. The service I run only offers email and Facebook, and now I'll have to either remove Facebook, or add both Google and Apple (I can't just add Apple because it'll look annoying for our Android users if there's Apple and no Google).

Also, when OAUTH uses the real email address, it makes it simple to switch between the different login options without much friction, which won't work anymore for people using Apple ID. Maybe I'll just have to make it a habit to use only Apple when available, and plain email otherwise.

<comment><USER21> > can't just add Apple because it'll look annoying for our Android users if > there's Apple and no Google

just like it looks annoying for your Android users that there's Facebook but no Google?

<comment><USER33> Facebook is not related to Android or iOS. But Google is related to Android and Apple is related to iOS.

<comment><USER21> Right, my point is that it's already weird to have Facebook but not Google on Android.

<comment><USER32> I agree it's a little weird, and we do get requests for it once a month or so. When we decided on just adding a single 3rd party option, FB seemed like the most platform agnostic. We'll probably be adding all of them now though.

</comment></comment></comment></comment></comment><comment><USER34> Yahoo has had disposable email for a long time. You can create upto 500 disposable email addresses (by going to Settings->More Settings->Mailboxes).

Also, you can give this email address a base name that is different from your normal email address so if your normal address is firstname.lastname@example.com, you can have "abc" as the base name of your disposable addresses, and your disposable emails will have addresses of the form abc-<your-chosen-disposable- id>@yahoo.com (firstname.lastname@example.com for example).

So unlike gmail's "plus" email addresses, it's not possible to decipher your real email id from the disposable one. Very handy.

Combine this with Firefox's ability to remember userid/passwords and sync across devices, and you have a powerful privacy toolset that is not a pain to use and is not controlled by any single entity.

<comment><USER35> I create unique email addresses per service. The pain is in autocompleting email inputs in signup forms. It will suggest a bunch of email addresses that I used on other services and not a new one to use for this service.

</comment></comment><comment><USER36> I'd love if someone could explain if the 'fake email' address that the developer gets from Apple will be the same across all apps from the same developer? Or is there some way for the developer to link a login on one app to the same user on another app from the _same_ developer?

I'm all in favour of increasing user privacy and the general direction that Apple is moving but we've got multiple Apps which allow users to log in via Game Centre, Facebook or Twitch to the same account. This allows them to access their friends, messages and support tickets from any of our Apps. We're able to do this because each of those providers gives us a unique identifier for each user (we only store that id and don't ever store the email address from them). I fear that Apple are going to make this impossible for us to do this going forward which would be a negative experience for our users.

<comment><USER37> In the presentation they talk about how the authorisation returns a stable, team-scoped (that means same developer) id.

</comment></comment><comment><USER38> Previous discussion: [https://news.ycombinator.com/item?id=20086045](https://news.ycombinator.com/item?id=20086045)

<comment><AUTHOR> The previous discussion was the _announcement_ not the developer presentation that actually goes over the full details.

That conversation has a lot of people arguing about things that this video addresses.

</comment></comment><comment><USER39> Has anyone seen a live online demo of "Sign in with Apple" anywhere on the internet?

I've seen a few tutorials - [https://developer.okta.com/blog/2019/06/04/what- the-heck-is-...](https://developer.okta.com/blog/2019/06/04/what-the-heck-is- sign-in-with-apple) is particularly good - but no one seems to have deployed a button I can click anywhere yet.

<comment><USER40> If you're using iOS 13, [https://appleid.apple.com/](https://appleid.apple.com/) now use Sign in with Apple, although obviously there's no granting flow (where you can choose whether to give them the real email).

</comment></comment><comment><USER41> JavaScript example [https://developer.apple.com/documentation/signinwithapplejs/...](https://developer.apple.com/documentation/signinwithapplejs/configuring_your_webpage_for_sign_in_with_apple)

<comment><USER42> Can you do oauth? I'm not gonna add a random script hosted by apple to my page.

<comment><USER39> Yes you can - here's some example code that uses an OAuth redirect rather than Apple's JavaScript: [https://github.com/aaronpk/sign-in-with-apple- example](https://github.com/aaronpk/sign-in-with-apple-example)

<comment><USER43> This is amazing. Am I right to conclude that this lets us use it in apps older than iOS 13 as well as it's based off of oauth redirect?

</comment></comment></comment></comment><comment><USER44> Unfortunately, Apple Sign In for the Web - insists on using HTTP POST's for the redirect_uri. This is a snippet from their official JavaScript library.

const t = { baseURI: "[https://appleid.apple.com"](https://appleid.apple.com"), path: "/auth/authorize", originURI: "", env: "prod", uxMode: "redirect", responseType: "code id_token", responseMode: "form_post", client: { clientId: "", scope: "", redirectURI: "", state: "" } };

Notice the responseMode which is set to form_post which I believe is the only supported mode.

This means you can no longer do things like localhost redirect_uri's for testing, or even use Apple Sign In on an internal web-app. Also, goes against OAuth2. :(

I submitted this feedback. Hopefully, someone takes a look.

<comment><USER45> > This means you can no longer do things like localhost redirect_uri's for > testing, or even use Apple Sign In on an internal web-app.

Seems this might provide some security benefit, e.g. no credentials showing up in web server access logs. Either way, are you sure the final POST isn't made by the client? If so, the client would resolve the address. On their JS configuration page[1], I don't see any obvious evidence that Apple will make the post. They show this line:

`AppleID.auth.signIn();`

P.S. Aghghgh the mixed camelCase and under_score makes me cringe.

      [1] https://developer.apple.com/documentation/signinwithapplejs/configuring_your_webpage_for_sign_in_with_apple

<comment><USER44> They already don't show up if you use fragment URIs. The real issue I have is that the OAuth2 spec covers all this and we don't have to rehash this every time a new IDP creates an Auth system.

No. The final post is not made by the client and a server has to handle the request. Webapps cannot handle POST requests from an Authorization server.

</comment></comment></comment><comment><USER46> Will "Sign in with Apple" be available on non Apple devices? If not how will cross device syncing etc work?

<comment><USER47> In the presentation they mentioned that it's available for JavaScript, and said that's the way to do Sign in with Apple on web and Android.

<comment><USER48> Seems like it would be less useful on a non-Apple device though. I don't know about you but my Apple login is a nightmarishly long password and 2FA. Authenticating through FaceID or TouchID is what makes it usable.

<comment><USER49> What about using a password manager?

<comment><USER48> Good point. I have an irrational paranoia putting really vital stuff in those, but it would work.

</comment></comment></comment></comment></comment><comment><USER50> Microsoft has a better decentralized approach [https://www.microsoft.com/en- us/security/technology/own-your...](https://www.microsoft.com/en- us/security/technology/own-your-identity). Things have come full circle.

</comment><comment><USER51> My team has been wondering: We allow third-party login via one OAuth provider (Esri) in addition to "local" accounts. Users who log in with Esri do so to access content in their Esri account, not as a matter of convenience.

Apple's guidelines stipulate that it will be "required as an option for users in apps that support third-party sign-in".

In contrast with social logins, you cannot create an account with our app via the Esri login, and your Esri account must be set up first in the back-end to even use it at all.

We can't think of a way to feasibly support this per their requirements, unless Esri allows it via their OAuth flow as well (they do support Facebook/Google today).

<comment><USER52> > Users who log in with Esri do so to access content in their Esri account, > not as a matter of convenience.

So this is not a third-party sign in. This is access to third party data which requires signing in with them.

</comment></comment><comment><USER53> > It will be required as an option for users in apps that support third-party > sign-in when it is commercially available later this year.

This is absolutely ridiculous. What about games that allow you to sign in with Facebook specifically for the purpose of tracking your progress relative to your friends? Sign in with Apple has precisely zero purpose in this scenario.

I can sort of understand making this a requirement if sign in is required to use the app at all. I really hope that exemptions will be allowed where Sign in with Apple is 100% pointless.

<comment><USER54> If sign in with Facebook is optional and for providing specific features, then its not really using Facebook as an account management system - it's more connecting to Facebook - so I think you'll be fine.

<comment><USER53> The updated guidelines say nothing about the login being required vs. optional.

</comment></comment></comment><comment><USER55> " * You may only use the Sign In with Apple software if you are enrolled in the Apple Developer Program."

This taken directly from their JS at [https://appleid.cdn- apple.com/appleauth/static/jsapi/appleid...](https://appleid.cdn- apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js)

This seems to imply that using this for your personal site, for instance, requires the $99 "developer tax"...

</comment><comment><USER56> Will Apple be able to read all the emails that are sent to/via the forwarding address?

<comment><USER57> Yes, unless services are sending encrypted e-mails to their users via keys that are established out-of-band.

</comment></comment><comment><USER58> How will the mandatory implementation of this affect apps that rely on a third party as the data storage system? For example [https://moo.do](https://moo.do) stores everything in Google Drive, if they have to implement Sign in with Apple the app won't function

<comment><AUTHOR> My interpretation is that the rule applies to using a third party service to create the identity you use for your own service, vs. actually logging into the service.

e.g.

* You have a forum that needs a per user identity, but you recognize that managing account login information securely is challenging, and the most cost effective solution is to offload on a separate authentication service (Google, Facebook, etc)

vs

* You're a 3rd party mail client for gmail, and you app is actually signing into the third party service itself.

Of course I'm sure all of this will be clearly and unambiguously explained by release :-/

</comment></comment><comment><USER59> What I REALLY want is simpler 2 factor auth.

Love iMessage autofill on text inputs from text message codes

But... Authy (arguably more secure) is super annoying to open, click, copy, re-window over, click, and then finally paste.

Would be cool if this somehow cleaned up the whole process.

<comment><USER60> >Authy (arguably more secure)

What's the argument ?

>Would be cool if this somehow cleaned up the whole process.

Everyone, just leave 2FA alone. No sms. No custom garbage that sends a push from a cloud and uses a blob on the device. Use TOTP. It's simple and easy. If you want fancier phishing protection, optionally add the newer fido2 or whatever the newer standards end up being. Just no custom garbage.

<comment><AUTHOR> For regular users TOTP isn't simple:

* you have to install an app, but you can't tell which app you're meant to use

* you have to configure the app with whatever your signin service is

* If you ever delete the app (something that is generally not harmful) you lose the ability to sign in, and reinstalling frequently does not bring back your old authorizations.

But yeah, SMS 2fa is garbage from a security stand point (and will remain so until carriers can be held liable for costs from transferring your number without your authorization), but it is usable and is leaps and bounds better than nothing at all, which is what users will do if you make 2fa hard to set up.

</comment></comment></comment><comment><USER61> It's quite amazing that Apple is doing this at the exact time the government is investigating them for anti-trust violations.

Essentially what Apple is doing is creating a new gate as they've done before with forcing developers to use their payment processing system for digital goods that costs 30% of the total fee.

Facebook Login already supports users blocking sending sites their email, as I disable that all the time. They even have published guidelines with what a site should do when they think they need that piece of information. So I'm not sold on the privacy story here. Go on, give it a try the next time you are signing in for the first time. You can even go back and remove your email permission from the security page in FB.

Apple did do one thing though, they created a bigger market for junk email services and made it easy to send those to services you expect to get notifications from. Still, this is something Apple could have built into iOS just like they did with password managers. It's not a feature that needed to be forced on anyone for any reason. As a user of the device, I can just pick, get me a junk email and presto, it's done.

I get it though, I can imagine the scenario last year right after news broke with Cambridge Analytica. This was enabled from a shady 3rd party developer using FB single sign-on and execs at Apple were pissed. They probably hastily demanded someone at Apple create something to circumvent FB's position. However, this doesn't just affect FB, it affects Twitter, Google, GitHub, Microsoft as well.

Yes Apple has good-will in this community, and its to their competitive advantage that they continue to build out more privacy focused features. However, I still do not appreciate that Apple gets the final say. This should have been a bigger conversation across the entire industry. Why didn't Apple come out and say, we are investing in the Oauth organization and then published papers on best practices? It would have been a much bigger win to get Microsoft or Google on board from the start and launched together. Hundreds of researchers all over the world would have jumped on it. Instead now we're left with another moral authority move, shoved in developers faces at the whims of Apple Execs.

<comment><USER62> I don't see how this is an anti-trust issue at all. I don't get why people keep bringing it up.

Developers are free not to implement social login. If they do implement social login then this provides a unique user benefit (privacy) while also increasing user choice (users are still free to login how they want).

</comment></comment><comment><USER63> There's confirmation in the PDF that there's a JavaScript SDK, which is nice. Native widget in Safari, but it looks like a fairly standard OAuth flow in others.

</comment><comment><USER64> Wow, 11 years too late, it's finally here. The new ingenious invention, by Apple, to let me sign in to apps with the account I am already logged in on my device. But hey, it's Apple, let's cheer...

WOW what a great feature, you have have done it again Apple. Keep the innovations coming!! :DDD

And apparently, to make up for the 11 year delay in developing this feature, they now force everyone to show it alongside of Google & Facebook sign-in.

</comment><comment><USER65> Ideal world: Apple implements this feature the way they did to test the water. With a successful result we have open source tech to mask email addresses.

</comment><comment><USER66> How does authorization (as opposed to authentication) work with apple sign in? With Google sign in you get an actual email that can be pre-authorized on the server. With this, the server only has a phony email to work with, so how can you match that phony email to authorized users?

<comment><USER67> In this sort of login authorization is considered the severs responsibility, and in most cases that use it it amounts to: you get access to you stuff. This only handles authentication. If you need managed authorization, you are going to have to handle that yourself.

</comment></comment><comment><USER68> if its not open source, I can't trust even Apple.

</comment><comment><USER35> Google's and Microsoft's sign in PMs should be ashamed they hadn't implemented this already. Giving a stable email to all services leaks valuable information that would be more lucrative for them to keep to themselves.

</comment><comment><USER69> I'm currently using Firebase Auth to manage my logins; Wonder if I'll have to add on another authentication layer on top of it now to add this. Don't see Google adding native support for Apple Auth any time soon.

</comment><comment><USER70> Is there any word on when this is going to be enforced as a requirement (assuming you already have FB/Google etc.)?

Is it implied that as soon as iOS 13 goes out we'll start getting app updates rejected unless this is integrated?

<comment><USER71> I would expect soon after, so some people have time to update. Maybe day one. But it didn't sound like it would be long.

</comment></comment><comment><USER72> What happens if an app has iOS, web and Android versions ? Do they all have to implement apple log in now just because the iOS app needs to implement it and they want users to be able to use the app across platforms?

</comment><comment><USER73> I really hope this is the first step to them adding scopes for accessing iCloud data (mail, calendar, notes, reminders, photos, others). Being able to write better apps for them on Android & web would be amazing.

</comment><comment><USER74> Tested a sample demo and working OK

[https://github.com/nov/apple_id/issues/1](https://github.com/nov/apple_id/issues/1)

</comment><comment><USER75> Previous discussion: [https://news.ycombinator.com/item?id=20086045](https://news.ycombinator.com/item?id=20086045)

</comment><comment><USER76> Unless this becomes open for everyone, even for web devs that do not specifically have an Apple device and Apple Developer Licence, I do not see it getting far.

<comment><USER69> There's a JavaScript version that doesn't require you to have anything Apple related.

<comment><USER76> Can you please cite where it says that? OAuth requires API keys, I don't see how you could get those without anything Apple-related.

</comment></comment></comment><comment><USER77> When "@privaterelay.appleid.com" starts showing up in lists like haveibeenpwnd, you know you made the right choice.

If for no other reason, this is a great reason to use it.

</comment><comment><USER78> What's the incentive for vendors to participate? Why would they switch to a less-featured product from ones that exposes all manner of user analytics?

<comment><USER79> That your app gets rejected otherwise.

</comment></comment><comment><USER80> So, you can sign in with apple, but the app can then ask for a real email address as well if they wanted to right?

</comment><comment><USER81> So how do I benefit as a consumer?

</comment><comment><USER82> This is a classic Apple workaround to a problem THEY perpetuate.

Apple suddenly decided on the amateur-hour policy of forcing users to use an E-mail address as their user ID. And more recently they've doubled down on that stupidity by requiring that it be a WORKING E-mail address, giving you no way to specify (in your user profile) a real E-mail address at which you can be contacted.

The public at large isn't all that savvy about how this works; so when asked to set up an account with their E-mail address and password, what percentage would you guess assumes that they have to use the same password as their actual E-mail account?

I'm guessing that percentage is very high, maybe 50%.

When sites implement this asinine policy, they become responsible not just for the user's security on that one site, but the security of the user's E-mail account. Talk about a ripe opportunity for identity theft or more, if the site's database is hacked or stolen.

You don't see banks or brokerage houses forcing people to log in with an E-mail address. Apple's ignorance of online services continues...

</comment><comment><USER83> People are very enthusiastic about this but this is actually not going to gain a lot of traction because

\- it's more difficult to implement than FB sign in and websites don't get any of the benefits

\- it works with apple devices, and it will be a nightmare to use in other devices, esp. if the user uses the private email

\- Apple would control and route the emails of the user and the app! This is a big privacy hole imho.

\- Apple drops users or apps without second thoughts from their ecosystem, and the web is not used to this (and is not going to change)

\- Maintaining new sign options is already a hassle, adding a new one that will only be accessible to a relatively small user base, with a number of hoops makes it seem less worth it.

On the plus side though, you do know that users coming from apple sign in are probably richer and better monetizable.

<comment><USER84> > but this is actually not going to gain a lot of traction

You're forgetting the part where Apple is going to mandate that app developers _must_ offer Sign In With Apple if the app offers any social logins like Facebook or Twitter, and that the Sign In With Apple option is strongly suggested to be the first one on the list.

It absolutely will gain traction.

<comment><USER85> I think the more likely scenario will be apps removing social logins and implementing their own login logic.

<comment><USER86> Huh? Add a handful of lines of code in your iOS/Mac app to add another login button or implement a whole server based authentication scheme? Maintain and keep secure the server based authentication for the lifetime of your app? That is not at all likely given the relative cost in money and time between the two choices.

<comment><USER85> A real email address is too important for businesses. Maybe indies or really small teams will use Apple sign in, but I doubt VC funded apps will.</comment></comment></comment></comment></comment>


[Giveaway] ikonic: 150 vector icons - <AUTHOR> http://thenextweb.tumblr.com/post/36143571164/enter-for-a-chance-to-win-ikonic-150-vector-icons <comment><USER2> Misleading title, not a giveaway.

<comment><USER3> Yeah there's only 10 winners and a thousand entries so far, and you have to give them your email or connect your facebook account.

There's enough free icons out there.

<comment><AUTHOR> I find the quality of most iconsets, both free and paid, wanting. Even some of Apple's own. Read this to know more [http://blog.scoutzie.com/post/36068395929/consistency-in- ico...](http://blog.scoutzie.com/post/36068395929/consistency-in-icon-design)</comment></comment></comment>


EnClose, a simpler and more powerful alternative to PhoneGap in 40 lines of code - <AUTHOR> https://github.com/fellowgeek/enClose <comment><USER2> > enClose is a HTML5 wrapper for iOS and OSX

'Simple and more powerful' at the cost of not being multi-platform.

Life is all about choices ;-)</comment>


Neutralizing Biased Text - <AUTHOR> https://github.com/rpryzant/neutralizing-bias <comment><AUTHOR> From their github page;

"This repo contains code for the paper, 'Automatically Neutralizing Subjective Bias in Text'.

Concretely this means algorithms for; \- Identifying biased words in sentences. \- Neutralizing bias in sentences.

E.g. 'John McCain _exposed_ as an unprincipled politican' -> 'John McCain _described_ as an unprincipled politican' "

This idea could have interesting applications. Imagine it being a UI option in twitter or the browser to 'unopinionate' the text, leaving users more room to form their own conclusions. This would probably reduce the emotionally driven engagement metrics of these platforms, but could it help having a healthier collective discourse?

</comment><comment><USER2> This is great! If you're interested in this kind of bias correction for writing, there's a volunteer team named "Write for All" that is seeking help here: [http://writeforall.org](http://writeforall.org) (feel free to message me about it).

</comment><comment><USER3> Woah. It seems like a great repo. How are you changing the words? I mean, is there a database of words?</comment>


Chris Hughes's Startup Jumo 'Acquired' for $0 and a Graceful Exit - <AUTHOR> http://betabeat.com/2011/08/17/0-acquisition-of-jumo-gets-chris-hughes-a-graceful-exit-great-pr-for-good/

<comment><USER2> I like the first comment:

 _There's no shame in having a failed startup. There is shame in attempting to maintain the facade of success._

<comment><USER3> I don't think there is a _facade_ in this case. Usually never that simple.

</comment></comment><comment><USER4> Jumo is a non-profit, not a startup. Using the language "acquired" and "exit" doesn't make any sense.

<comment><USER5> The submitter is a betabeat shill, so I'm guessing the phrase, "maximum click juice," should provide enough sensemaking points.

</comment></comment><comment><USER6> Legal folks, can a non-profit be acquired for more than $0?

It's a great deal for Good as they get the fruits of $3.5 Million in charity for free, but I'm not sure how they would pay unless the IP was locked up in a for-profit licensing-centric holding company.

<comment><USER7> According to the article, there is no "fruits of $3.5 million", no real IP, no nothing.

</comment></comment><comment><USER8> Hughes has already denied this on Twitter, but really, who knows.

<comment><USER9> As Betabeat wrote on Twitter in response"

"@chrishughes @techmeme @GOOD as we said to you before we published, confirm or deny on the record, and we're happy to report it. You can't decline to comment beforehand, then refuse to go on record after, then point fingers. And we included the statement from your GM in the piece."

If Jumo had a $$$ figure they were proud of, they would share it. But the first comment captures it best. If Hughes understand that failure is a badge of honor in the tech world, and came clean before this news broke, it would be a non-story, and people would respect him for trying to build such a noble start-up.

<comment><USER10> So that's how it works now, eh? When a subject won't talk to you, just run your worst suspicion. If they don't go on the record after that, you must be right!

</comment></comment></comment><comment><USER11> I'm surprised they didn't keep at it... Jumo had been live for what, like less than a year? They were entering the same space as care, change, and idealist. Those sites took YEARS to develop their community base. Not saying things need a timeline but geez....

</comment><comment><USER12> How did they burn through $3.5MM in less than a year? Curious.

<comment><USER13> 16 people, loaded costs of 100-200k each, plus facilities, legal, contractors, etc. A lot of non-profits have high costs of fundraising, too.

There's an argument that non-profit employees should take lower than market salaries to support the cause, but also there's an argument that they need above-market compensation since there's no equity or potential for an exit.

(I'd take a lower than market salary for a non-profit I really believed in, if I could, but it's not necessarily the case that the best designer or engineer for a non-profit is necessarily going to be willing or able to do so.)</comment></comment>


Low-status chimps revealed as trendsetters - <AUTHOR> https://www.sciencenews.org/article/low-status-chimps-revealed-trendsetters <comment><USER2> Past studies have shown that in ape society, males are hierarchical and females are mostly egalitarian..low status males who stay behind as the alpha male and party goes to hunt/forage sometimes end up impregnating the females. The cuckolded alpha male would never know. Female pregnant apes will also spontaneously abort if a new group of alpha males enters and ousts the prevailing alpha. This is called the Bruce effect. Pregnancy and birth is highly expensive to females and they will do their best to conserve energy and resources. Males place a high value on investing in their own offsprings and it behooves the females to hedge her bets if alpha males get killed or ousted when a new group comes in..Alphas get cuckolded all the time because they are violent and always at risk of being ousted by rival alpha ape in group or from outside...no one knows who is father except the mother. And often the lower status males are a good bet because they are less likely to get killed. And they will take care of their offsprings. Ape studies are fascinating.</comment>


How To Create A Productive Routine - <AUTHOR> http://thehackacademy.com/blog/10-Ways-To-Create-A-Productive-Routine/

<comment><AUTHOR> Can anyone actually maintain all of these? They seem easy to write down but hard to actually maintain over the long term...

<comment><USER2> I did some progress after trying and failing for 2 years. I read a lot of stuff on this issue, not blog posts but research materials. What I found is that these "tips" can hardly work as blueprint, because we are all different and have different triggers and motivation types. However, some "tips" are more universal. For example 5, 7, 10 work for me, 1 and 4 don't, 6 is not a "tip" and 9 can be a very bad advice for some people.</comment></comment>


Watch IBM's Watson AI defeat puny humans in Jeopardy (video) - <AUTHOR> http://venturebeat.com/2011/01/13/ibm-watson-ai-defeats-humans/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Venturebeat+%28VentureBeat%29 <comment><AUTHOR> But can it screw in a light bulb?</comment>


Is Success Luck or Hard Work? [video] - <AUTHOR> https://youtube.com/watch?v=3LopI4YeC4I <comment><USER2> >Is Success Luck or Hard Work?

Yes, no doubt.

The impossible thing to know is the measure of success since there has never been a proven accurate technique for that.

Not even financial success and that is truly a pure numbers game.</comment>


Suspected Anonymous Hacker Busted By FBI — Thanks To EXIF data in GF's Pics - <AUTHOR> http://houston.cbslocal.com/2012/04/13/anonymous-hacker-busted-by-fbi/

<comment><USER2> It's the little things that always get these guys (and hubris).</comment>


Apply HN: Jobinder – checkr meets match.com meets career builder - <AUTHOR> jobinder.com
Problem: The job search procedure is monotonous and job seekers are impatient, they despise the ineffectiveness of most job boards because of the fact that they spend hours on the computer searching without the assurance of a fairly good job coming their way. Employers are overwhelmed with the amount of unqualified candidates they get and look for ways to cut that number down without spending an arm and a leg because hey, they still have to spend on background checks and other essentials for the hiring process.
Solution: So we came up with Jobinder a match system to combat the time consuming employment process by utilizing resume matching and the four steps in the hiring process (Personality test, Reference verification, Interview and Background check) PRIB. Job seekers simply upload their resume and instantly get matched to employers looking for their specific skills and qualifications. They then move on to the PRIB step if they decide to, the very trusted Myers Briggs will be used for the personality test, we at Jobinder will verify references, employers can opt in to provide online video interview and lastly we have the background check. We aggregate jobs for the working class while making the employment process practical and easy for both job seekers and employers, as well as offering career services and encouraging diversity with our H1B visa filter.
Substitute: Jobseekers result to either popular job boards like indeed, career builder and monster that are over saturated or niche job boards
Competitors: We don't have any direct competitors at the moment except for the substitutes listed above that don't fulfill the needs of most job seekers. Monster recently launched their power resume search engine but decided to offer that to only employers to sift through resumes
About us: 2 founders with individual success in growing our own business and one intelligent systems programmer with a background in HR <comment><USER2> I just read something similar to this [https://news.ycombinator.com/item?id=11473426](https://news.ycombinator.com/item?id=11473426) what's so different about yours except the obvious fact that yours uses resume to match and theirs used profile? Can you expatiate on prib?

</comment><comment><USER3> Hi, I replied this idea with my thoughts: [https://news.ycombinator.com/item?id=11441183](https://news.ycombinator.com/item?id=11441183) Basically I believe the solution you are proposing here is the cure. And I also believe this is something we can use to replace and unemploy recruiters. BTW, I have applied for YC fellowship this batch and was rejected. So...Let me know if you're interested in working together or just talk.

<comment><AUTHOR> Great and I concur your idea about replacing recruiters, they cost more and aren't very efficient. I am open to dialogue about this idea.

<comment><USER3> Glad you replied. My email is in my HN profile. Just shoot me an email, and let's talk.

<comment><AUTHOR> my co founder just emailed you.

<comment><USER3> Thanks!

</comment></comment></comment></comment></comment><comment><USER4> Is there any sort of study or resources comparing MBTI types with culture fit?

I'm not sure I'm confident in a personality test to be something that can be suitably automated at that level. I'm a pretty solid introvert, but I perform well at a job that's often more customer service focused than actual technical aptitude. Would I have ended up not matched with my (fantastic) job with your service?

<comment><AUTHOR> the personality test does not play a part in getting matched with jobs only your resume. Because most employers require you to take an assessment test before being granted an interview we have made it in a way that you take the personality test once and your result can be sent to the employers you were matched with. I hope that answers your question.

</comment></comment><comment><USER5> Why did you pick this idea? I mean what's so different about yours compared to other job boards or even job apps like jobr?

<comment><USER3> I can reply you. I do not know whether their product will be any different, what I know for sure is Jobr sucks. I was researching all startups working on recruiting in bay area, and tried Jobr personally. The jobs there are few, low-quality, simply-matched with user's profile. After I deleted my profile and account, I kept receiving emails showing interests in referring me to be a Uber driver, which is impossible considering my visa status.

</comment></comment><comment><USER6> this sounds like a really good idea, other job sites have not worked in my favor so i am ready for something new and differnt.

<comment><AUTHOR> thank you very much

</comment></comment><comment><USER7> how do you plan on making money?

<comment><AUTHOR> we want to utilize a transparent pricing model that is one of our many incentives for employers to use us. We're going to use the traditional job posting fee and sponsored job ads in addition to our pay-per-match and PRIB feature. Employers can pick and choose what feature they want to opt in for.</comment></comment>


The AWS EC2 Windows Secret Sauce - <AUTHOR> https://technodrone.blogspot.com/2019/03/the-aws-ec2-windows-secret-sauce.html <comment><USER2> I've been a Microsoft developer for over two decades. But once I started architecting solutions on AWS and seeing the Windows Tax first hand - in terms of resource requirements and licensing costs - I started trying to avoid Windows like the plague.

Also the true costs of infrastructure became my problem - accounting can see exactly what a solution costs - instead of some amorphous cost in the IT budget.

<comment><USER3> I really like the better visibility into the true costs. Too many times in the past, a team had a budget for the software they needed to deploy a project, but the Virtualization software, storage array, etc, were all out of the IT budget. that makes the IT budget look bloated, and hard to explain, and ripe for being seen as a 'cost center'.

<comment><USER4> That's too bad and unfortunate of some companies who see IT as a black hole. Imagine having an R&D dept which could incur lots of costs and little result individually but as a group produce good licensable IP. Sometimes you have to realize some things are a cost of doing business.

<comment><USER2> It's not that they don't realize it. The R&D department doesn't have to be accountable for costs. The R&D department isn't incentivized to control costs because it isn't our problem. Proper tagging of resources shines a light on the R&D department and the business knows exactly what our projects' infrastructure cost is.

</comment></comment></comment></comment><comment><USER5> > Seriously though - Windows images are big - absolutely massive compared to a > Linux image - we are talking 30 times larger (on the best of days) so > copying these large images to the hypervisor nodes takes time.

No... just no. Disks aren't local to hypervisors. There's no copying going to be taking place. EC2 instances are provisioned using EBS volumes, which aren't going to be local to the instance itself. EBS is likely doing a disk clone operation, and those are relatively cheap in standard filer operations. Even large images you're talking a drop in the ocean in terms of the overall time.

The main issues with Windows in a cloud environment comes from that first boot scenario. You could get past some of that by keeping a pool of warm instances around, but it'd require a lot of work on the Windows side to handle the provisioning use case.

On Linux the instance boots, init processes kick off, and right at the end cloud-init creates and configures accounts with ssh keys etc. and away you go. Typically anywhere between 30-60 seconds boot time depending on the distribution.

Windows isn't that accommodating. Images that are used in cloud environments have to be "generalized". You install it on specific hardware, and then tell it that it's not to give a crap about hardware specifics, but oh you must have these specific drivers etc. in you. It also tells it to clear up after yourself while it is at it.

First boot happens, and Windows goes through a mandatory process whereby it identifies hardware, installs and configures drivers etc. etc. etc. You can inject a script to carry out the process of things like setting up a user, and generating a password, but that's fairly minor on the scale of things. This first process _requires_ a reboot. There's no escaping it.

That's really the reason why Windows provisioning takes long.

There's unavoidable reboots, and unavoidable Windows driver installation and configuration, where the Linux distribution approach to the kernel makes life easier (every driver you're likely to need is a module and available on boot... unless you've got dracut running in the default host-only mode and it has made you a totally stripped down initramfs.)

Add on that Windows booting takes longer than Linux even under optimal conditions and you end up with a slower launch.

<comment><USER6> > Windows goes through a mandatory process whereby it identifies hardware, > installs and configures drivers etc. etc. etc. You can inject a script to > carry out the process of things like setting up a user, and generating a > password, but that's fairly minor on the scale of things. This first process > requires a reboot. There's no escaping it.

This is the "OOBE" (out of box experience) phase. I'd have thought they'd just skip it and provision you a pre-warmed image .. but I guess because there's a license/activation dependency they can't do that?

I wonder how many MWh could be saved by Microsoft adding a "acquire cloud volume license at boot" mode. Or shoving the licensing/uniquification requirements into the platform TPM.

<comment><USER7> Disclosure and claim to authority: I work on the Windows team at Microsoft, sometimes on performance and OS installation stuff.

There's definitely some cruft that chews up time on first boot. But it's not everybody's favorite punching-bag, licensing. That stuff doesn't happen in the critical boot path.

It might be installation of device drivers, but that too is unlikely. If you generalize Windows in a VM, you can use the `sysprep.exe /mode:vm` flag, which essentially tells sysprep to retain most of the device tree, since you expect to run the thing on similar hardware. I would assume that AWS is clever enough to have found that flag; certainly we have Azure use it. When the flag is used, there's very little device- and driver-related work to do on first boot after generalization.

The reality is that software is complicated and hard, and anything punchy enough to fit into a comment on a website is going to be a vast simplification of reality. So let the simplification begin :)

One reason first boot is slow is the component that orchestrates startup of usermode services, which on Windows is called SCM. SCM is very old. At the time SCM was created, it was _much_ better than the SysV-style init scripts of other OSes. But since then, other OSes leapfrogged Windows with systemd/launchd, which are a generation ahead of SCM. SCM starts services in serial, while systemd maximizes parallelization. SCM has a "push" model: it basically starts all the services that it can find, while systemd has a "pull" model: it starts just the dependency cone you need to get the system you want. (This is a simplification.)

Another performance issue is that Windows doesn't have a way to notify code that the hostname has changed. Obviously it'd be easy to add one, but then the hard part would be updating the whole OS to do something reasonable with that notification. So instead, Windows requires a reboot to change the hostname. Except first boot: to avoid a reboot as soon as you power on your shiny new computer, there's a clumsy dance where the OS holds back most usermode processes until the hostname is set, then it sort of tries booting usermode again. (Huge simplification!)

Thirdly, the footprint of Windows is just bigger than that of an expertly hand-tuned Linux installation. Much of this problem was solved with Nano Server... but are you actually using Nano Server? It turns out that people like Windows because Windows runs Windows programs. Take away compatibility with many Windows programs, like Nano Server did, and you get a much faster and more secure OS that nobody's heard of.

We take both perf and cloud hosting seriously, and we're working on problems in this space. You should expect Windows to get better with each release. But to close this off, I don't want to hog all the blame. It's always possible that AWS is doing something silly in their guest agent or paravirtualization stack that measurably degrades boot perf. We've previously caught Azure doing silly things -- now fixed -- that seriously delayed the amount of time before the guest reported itself as ready. If you want to see Windows hosting done well, try Azure.

<comment><USER5> > you can use the `sysprep.exe /mode:vm` flag, which essentially tells sysprep > to retain most of the device tree, since you expect to run the thing on > similar hardware

In my experience that only really works with full paravirtualized environments. If you start mixing in SR-IOV things can get a little messy. Given customers actually crave high performing networks, that then presents you with a choice:

1) Make two images. One for full paravirtualized environments.

2) Ignore it and let Windows first boot time take longer.

Of course most clouds already end up with what are effectively multiple images for the same setup/configuration of Windows, one per hardware type anyway, because even with full PV things can get a bit strange, and you're often ending up with blue screens during first boot.

They're not going to want to _double_ that number. Even with full automation that's a bunch more things that can go wrong, more operational burden etc. etc. Where's the value proposition? Windows provisions a little faster?

Linux images rarely need to be produced for different hardware types / environments. They just spin up and away you go. As to your systemd/sysv comment.. even sysv based instances have a time-to-login on first boot of under a minute.

The systemd developers were obsessed with the idea that parallelism would speed up the boot process, but it doesn't make as significant a performance impact as they'd have you believe, especially when you're talking about cloud images that rarely have many services running on first boot. Even if you go trawling down the systemd boot time reporting, you'll see that most components start in fractions of a second, and the same was true under SysV too.

</comment></comment></comment></comment><comment><USER8> >Now that I have got your attention with a catchy title - let me share with some of my thoughts regarding how AWS shines and how much your experience as a customer matters.

This is the one guaranteed way to turn me off to whatever you're going to talk about in the article.

</comment><comment><USER9> I don't think they have a pool of instances at all.

It's a generalized image which they boot up for you. Cloning the image, even though it is many gigabytes, takes milliseconds since the underlying storage (EBS) will be some log-based storage.

If they really wanted to optimize boot time, they would freeze the fully booted machine (keeping all the RAM contents) and then clone the frozen instance. That should be able to get running in just ~10 seconds (enough time to copy enough of the RAM contents to be able to log you in). They probably won't do that because having every user running from a fork of the same image could have some weird repercussions - for example the kASLR would be the same for all machines, making designing exploits much easier.

<comment><USER10> Windows licensing mechanism prevents this scenario

<comment><USER9> Amazon are big enough they could get Microsoft to rework how the technicals of licensing work.

</comment></comment></comment><comment><USER11> I used Windows instances a few years ago. Beyond the slow start, once started, frequently the CPU would stay stuck at very low %, and my tasks would run very slowly.

Eventually I would get to 100%, but it could often take 10 minutes.

What I learned from those pains is how to use Linux in the Cloud.

<comment><USER12> Seems like you were using T2 instances which have a low baseline performance and burst credits. I would imagine that you quickly run out of credits on some of the smaller instance types after creation, given how lengthy and costly (in terms of CPU usage) the instance creation and boot process is.

<comment><USER11> I was typically using c3.xlarge for CPU-intensive tasks (video processing).

Boot time was OK. I would log in on the machine with RDP, because sometimes my processes were almost frozen for a while. It felt like my neighbours were stealing my CPU, but I did not know how to prove it.

Once I moved to Ubuntu, same instance type, I never experienced this.

</comment></comment></comment><comment><USER13> AWS might as well apply any Windows Update changes so that they deliver a fully-patched and secure instance, instead of an insecure image from a few months ago. It isn't just AWS, all Windows cloud servers seem to be delivered unpatched.

<comment><USER14> Customers probably wouldn't appreciate getting a Windows instance with an inconsistent patch level, you want to know that when you start a specific AMI ID you tested in your staging environment that it will be the same AMI you launch in production.

Also they ship a new Windows instance approximately every 3-4 weeks with the most recent updates merged in. They don't make a big enough thing of it but you can subscribe to update announcements.

</comment></comment><comment><USER14> This is an interesting thought; I use Windows instances myself but I use a custom AMI built using Packer on our CI server. Presumably Amazon doesn't have a pool of my custom AMI images lying around.

So I wonder if the custom AMI is actually stored as a layer on top of the source Windows AMI and applied to the instance from the pool before it is made available to me.

Alternatively, it means I'm missing out on an optimisation and I could get a faster start-up time by using a vanilla Windows AMI and installing dependencies in the user data.

Does anyone know or have an educated guess?

<comment><USER15> A couple of jobs ago I have spent plenty of time optimizing a Packer-based AMI pipeline that was similar in spirit to that which you've described. It was all quite frustrating, but then the job got yanked from underneath me, so I never finished solving the problem.

The article contains a screenshot[1] of a response from AWS support indicating that only EC2's own AMIs benefit from this pooling optimization. It follows that custom AMIs must take the startup time hit all the way.

[1]: [https://maishsk.com/blog/images/20190307_aws_ec2_secret/foru...](https://maishsk.com/blog/images/20190307_aws_ec2_secret/forum_post_slow.png)

<comment><USER14> Ah, I had missed that! Thank you, that's very helpful to know. I always learn something new every day here.

</comment></comment></comment><comment><USER16> Does AWS have to pay a license fee to maintain a pool of Windows instances? Who foots the cost of the license if a prepared/pooled instance is never allocated to a customer?

<comment><USER17> There has to be a custom deal in place, but it could be similar in spirit to a hot standby MS SQL Server instance where you only pay for one license but have a mirror of the machine ready to go if the first one goes down (my knowledge of licensing was only tangential to my dev work and could be several years out of date now).

</comment></comment><comment><USER18> It would make sense to apply these optimizations to any kind of startup since presumably anticipating resource allocation ends up as a cost savings and improvement in user experience regardless of the base OS. There are plenty of Linux AMI images that are bloated and slow to start.

<comment><USER19> It would only be practical to do this for very commonly used AMIs that AWS create and provision themselves. Commonly used because you don't want unused AMIs languishing in the instance pool long term. Only their own, because these AMIs are heavily manipulated and then customised for the user so you have to be positive the AMI is compatible with the manipulations.

I wonder if Azure does something similar.

<comment><USER20> From my limited use of Azure I'd guess yes, because it also was hot-n'ready in under 5 minutes any time I needed a new instance.

</comment></comment></comment><comment><USER21> I'm pretty sure GCE does the same, just last week I had a need to test something and with 1vCPU instance was ready in about 3-4 mins. Next time will check logs to confirm it. But seems the reasanoble thing to do.

</comment><comment><USER22> Also note AWS Windows is not plain vanilla. It comes with an x64 Python 2.7 build built in, and the x64 python27.dll is on the standard path. Bit of a gotcha if you're deploying x86 Python 2.7 to AWS Windows!

</comment><comment><USER23> I'm curious why the author does not think AWS will confirm his analysis. He seems to have hard evidence of how the system works and communications from staff.

<comment><USER24> I could see them declining to comment to avoid creating the expectation that the system works in a particular way. Being a black box means they can make changes without breaking expectations. Documenting internals, even informally, means folks may come to expect that behavior.

</comment></comment><comment><USER25> Safe to say this is only possible with default/official AMIs?

</comment><comment><USER26> Very interesting. Now that 4 minute wait time makes sense now.

</comment><comment><USER27> Shared windows instances? What could go wrong?

<comment><USER28> My assumption is that they're not shared. Once you request an instance from the pool, if the desired number of pooled instances is still the same, another one would immediately begin the imaging process to take its place.</comment></comment>


On naming a startup: Practical advice and (embarassing) first names. - <AUTHOR> http://blog.happystuffapp.com/

<comment><AUTHOR> Any questions/comments ?

If you're in the Montreal area we're also looking for people to participate in our beta test.</comment>


An Open Letter from Tink to European National Competent Authorities - <AUTHOR> https://blog.tink.com/blog/2019/08/21/tink-open-letter <comment><USER2> "Yet not a single [bank] meets the [PSD2] requirements and standards to be compliant [as of August 2019]."

PSD2 went into effect on 14 September 2019. I thought it's an open secret every European country and bank is behind on implementing. Every country extended the deadline or added grace period.

[https://support.stripe.com/questions/strong-customer- authent...](https://support.stripe.com/questions/strong-customer- authentication-sca-enforcement-date)

"On 16 October 2019, the European Banking Authority further announced that the new SCA requirements should be fully enforced by 31 December 2020."

The open letter from August 2019 was correct at the time but needs an update.

</comment><comment><AUTHOR> Banking is facing its biggest remake in history. Technological developments, changing consumer expectations and new regulations are forcing the industry to open up.</comment>


Detecting debuggers by abusing a bad assumption within Windows - <AUTHOR> http://www.triplefault.io/2017/08/detecting-debuggers-by-abusing-bad.html <comment><USER2> This is really cool. You can also detect a debugger on windows by using one of the apis provided, such as IsDebuggerAttached, or is debuggerpresent. [https://msdn.microsoft.com/en- us/library/windows/desktop/ms6...](https://msdn.microsoft.com/en- us/library/windows/desktop/ms680345\(v=vs.85\).aspx)

<comment><USER3> Debugger can trap calls into that and return whatever it wants, also this API only returns true for user-mode debuggers.

Point of most anti-debugging measures is to detect debuggers that are actively trying to hide their presence.

<comment><USER4> Even with a user mode debugger, those APIs aren't hard to thwart in x86 Windows. I don't know if that's really still the case with newer architectures; the last version of Windows I used was Windows 7.

[https://stackoverflow.com/questions/10330147/how-do-i- bypass...](https://stackoverflow.com/questions/10330147/how-do-i-bypass- isdebuggerpresent-with-ollydbg)

Even if that weren't the case, it's not a big feat to run a Windows program with a version of Kernel32.dll that has isdebuggerpresent as a no-op.

If I recall correctly, you only needed to take those measures if you were trying to modify a program that extracted itself into memory where it would be particularly difficult to "debug". Otherwise you could create bypasses for those API calls using just a disassembler. My memory on this is pretty rusty, though.

My guess is that API doesn't exist so much to discourage reverse engineering as it is to prevent certain code from executing if a debugger is being used legitimately, or to provide extra data to a debugger. It is(or at least was) used as a way to make reverse engineering difficult, but it's very ineffective.

<comment><USER2> Yes, there are a bunch of legitimate use cases for large scale development where you want inline tools to assist QA and diagnostic issues.

The Visual Studio codebase had (may have changed now) a dialog for debug asserts allowing you to suppress a single instance, suppress repeat instances of just that assert, or suppress all asserts, as well as a bunch of other features. I believe later versions of that macro made use of IsDebuggerPresent to change behavior when the process was being debugged or not. (I believe previous versions made use of a -different- hack to implement IsDebuggerPresent.)</comment></comment></comment></comment>


In Mathematics, Mistakes Aren't What They Used to Be (2015) - <AUTHOR> http://nautil.us/issue/24/error/in-mathematics-mistakes-arent-what-they-used-to-be <comment><USER2> I work professionally as an applied mathematician and I'd love if more people were to embrace proof assistant tools. That being said, I've worked with Coq a fair amount in the past and I find it _really_ hard to prove things related to my primary field, optimization. Some of it is getting more practice with the tools. However, how proofs are generated in these tools is different than how I was trained to produce proofs and I don't find it to be a simple process to just learn how. If anyone is curious about these tools, I recommend the Coq'Art book ([https://www.springer.com/us/book/9783540208549](https://www.springer.com/us/book/9783540208549))

As an additional, somewhat controversial comment, I think these tools are important because there's quite a bit of corruption with publishing. In short, if you're well known and liked author, you often get a pass on your papers and they're not well checked for errors. I've been yelled at by editors for questioning proofs of famous people. I'm not the only one. No. I will not name names or publications. Also, although it's not universal, when some journals say communicated by so-and-so, that means that so-and-so vouched for the paper, so they published it immediately without other peer review. Is the paper right? Maybe. However, I find the practice unsettling.

Bringing the comment back to proof assistant tools, I believe they would remedy some, but not all of the problems described above. We don't have to worry if a paper got a pass because the author was well liked. When can just run the proof through the tool and check that it's correct.

Anyway, if someone has some references or tutorials for people using proof assistant tools for applied math kinds of results, I'd love to read them. Things like stability regions for ODE solvers or convergence results for stuff like Newton's method. Or, honestly, anything that helps understand the tools and methodology more easily.

<comment><USER3> I really think that proof assistants like Coq are going to eventually be the future of math. Once they are less painful to use :(

I spent a term working as a research assistant on Coq, proving a new induction scheme for Featherweight Java classes. I came into the term quite hopeful, and already with some Coq experience, but I really don't feel like these tools are good enough to expect regular people to use. Even mathematicians.

I'm hopeful that in the distant future, we can get some AI assistance going on, so that the proof assistant can actually _assist_ , not just check and impede.

I would like my month spent on transitivity of subclassing back :( It's really hard to use these tools as they are now.

<comment><USER4> >I would like my month spent on transitivity of subclassing back :(

Oh God, that gave me flashbacks. I've done at least one transitivity of subtyping proof where I actually got the right theorem, then found later in the module that I had to rewrite the whole thing with a graph-theory library supplying some theorems about DAGs/finite posets. It's horrible, and that piece of work _still_ isn't done!

</comment></comment></comment><comment><USER5> I'm no mathematician and this might be way out of my league, but I've wondered how Gödel's incompleteness theorems come into play if Mathematicians are using proof assistants to verify their mathematics.

<comment><USER6> The incompleteness theorem says that there exist some (paradoxical and self referencing) true theorems that you can't prove (i.e. "this sentence is unprovable".) Neither humans nor proof assistants should be able to prove them.

<comment><USER7> > there exist some _true_ theorems that you can't prove.

Emphasis mine.

Are all unprovable theorems true? I googled "are all Gödel sentences true", but came up with nothing. Also: Are all unprovable theorems Gödel sentences or are there other kinds?

EDIT: Lots of good answers to my first question, thanks a lot to everyone. For the second one I think I also found an answer:

According to the Wikipedia article about the incompleteness theorems [1]: "The Gödel sentence is designed to refer, indirectly, to itself." So the question really is if there are non self-referential unprovable statements, and the answer seems to be yes[2].

[1] [https://en.wikipedia.org/wiki/G%C3%B6del%27s_incompleteness_...](https://en.wikipedia.org/wiki/G%C3%B6del%27s_incompleteness_theorems#Syntactic_form_of_the_G.C3.B6del_sentence)

[2] [https://www.quora.com/Are-there-true-but-unprovable- statemen...](https://www.quora.com/Are-there-true-but-unprovable-statements- that-arent-self-referential)

<comment><USER8> I'm not a logician, but I think the question (a good one) is not quite well- posed. As I understand, in mathematical logic, a statement being _provable_ means one can deduce it from a set of axioms. If you have a set of axioms _A_ sufficiently powerful for Godel's construction to go through, the resulting Godel sentence _s_ is (by construction) not provable from _A_ , but one can always make it provable by appending _s_ to the axioms _A_.

For a statement to be _true_ , on the other hand, has a technical meaning: it means that there is a model (in the sense of model theory, see [https://en.wikipedia.org/wiki/Model_theory](https://en.wikipedia.org/wiki/Model_theory) ) in which both the axioms _A_ and the sentence _s_ are true. Godel's completeness theorem ([https://en.wikipedia.org/wiki/G%C3%B6del%27s_completeness_th...](https://en.wikipedia.org/wiki/G%C3%B6del%27s_completeness_theorem)) asserts that _s_ is provable from _A_ if and only if _s_ is true in every model in which _A_ holds.

<comment><USER9> It's a bit confusing to say that about the Completeness theorem without noting that it only applies to first order logic. It's not generally true.

<comment><USER10> Yet first order logic encompasses 99.9% of the mathematics anyone ever does, even professional mathematicians. The only people who consider anything but first order logic are people who have gone out of their way to make a point to study it just for its own sake. When the general subject of discussion is proof assistants and proofs in normal mathematics, I don't think it's necessary to constantly mention "only in first order logic". It's like discussing structural integrity of a building and constantly mentioning that all the calculations only hold on in our reality, but if we were living in an alternate dimension and the physical constants of the universe were different then the results wouldn't be applicable.

<comment><USER11> >Yet first order logic encompasses 99.9% of the mathematics anyone ever does, even professional mathematicians.

I'm way out of my depth here, but I'm curious about this statement. In first order logic you can't even assert that the natural numbers cannot be put into a one-to-one correspondence with the real numbers, which seems like a fairly basic mathematical fact.

<comment><USER12> You can, as long as your first-order statement is in the language of set theory, by translating "there does not exist a bijective function f: N->R".

<comment><USER11> Right, but you can't ensure that the only models of 'bijective functions' are actually bijective functions. To switch to a slightly simpler example, you can translate statements such as "x is finite" into a first order language (for example, set theory), but you can't ensure that x actually is finite in the models of this statement.

<comment><USER12> To your first point: yeah, some discomfort around it is valid, but I see it as a non-issue. Informally/philosophically, because a model's job is to capture everything a first-order theory can see about your object of study - so it's fine for (say) an "actually" countable set to model the reals, and not be up to the task of "actually being" the reals. Formally, you differentiate between internal and external statements and don't expect them to be the same (a rigorous version of my pretentious use of scare quotes above :).

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Nice article. Two incidental notes: (1) Siobhan Roberts is an engaging speaker, if you get the chance to hear her speak, it's worthwhile. (2) This reminds me of [http://calteches.library.caltech.edu/51/2/CargoCult.htm](http://calteches.library.caltech.edu/51/2/CargoCult.htm) .

</comment><comment><USER13> >> Acknowledging something as true because the computer says so is not the same as knowing why it is true. One might reckon it's analogous to relying on an Internet mash-up of reviews about the mysteries of Venice, rather than going there and splurging on the water taxi and experiencing the magic for oneself.

Water taxis are not a very efficient way to explore Venice. You need to get off at some point and walk around the streets. There are a thousand little nooks and crannies to investigate, that a water taxi can't reach. When you need a boat you can get by most of the time with the vaporeto, which can be quite cheaper especially if you get a day ticket. There's lines for most of the islands around the city (Murano, Burano, St Michele, Torcello etc).

Er. That's all to be taken entirely literally, from my experience as a frequent visitor to Venice. I'm not sure how it applies as a metaphor to mathematics research.

</comment><comment><USER14> I like this quote:</comment>


Rise of the bromance threatens heterosexual relationships - <AUTHOR> http://www.telegraph.co.uk/science/2017/10/12/rise-bromance-threatens-heterosexual-relationships-warn-social/ <comment><USER2> This seems incredibly silly, plus the actual story is that casual sex is allowing people to forestall or forego relationships.

Even with all that- if more people are opting out of those relationships, then maybe they're not all they're cracked up to be.</comment>


Re-implementing an old DOS game in C++ 17 - <AUTHOR> https://lethalguitar.wordpress.com/2019/05/28/re-implementing-an-old-dos-game-in-c-17/ <comment><USER2> It has always amazed me how modern tools and languages can empower a single developer to do what large teams used to spend years building a few decades ago.

<comment><USER3> If we're talking about something like Unity or Game Maker, perhaps, but someone who has enough knowledge to make a project in C++17 like a game, has enough knowledge to make the same project in C89 with little difference in time spent (if anything it might be faster in C89 since it enforces simplicity and has much faster compilation times whereas C++17 often creates architecture astronauts).

Non-programming tools like 3D model editors are another case though as outside of very expensive suites like Mirai, things have progressed much better nowadays. But again this doesn't apply everywhere: for example Deluxe Paint was an easy and popular tool to use for 2D games in the 80s and early to mid 90s and a modern pixel art editor doesn't provide that much more functionality outside of what you can get with modern resources (e.g. unlimited undo).

<comment><USER4> "Architecture astronaut" refers to ivory tower architects not developers using particular languages, get your vocabulary right.

And secondly, C is probably the least productive programming language still in use, because of the huge overhead of working with memory. Don't even bother claiming this is not so, I spend enough time reviewing C code to know that this language should be banned for any new project.

<comment><USER3> I wrote "creates architecture astronauts" meaning that C++, like Java (although Java does it to a greater extent), pushes people to create unnecessarily convoluted architectures.

> Don't even bother claiming this is not so, I spend enough time reviewing C > code to know that this language should be banned for any new project.

Yeah whatever.

<comment><USER4> I know what you wrote, that's why I pointed out that it's incorrect. And now I have a feeling that you're confusing architecture with design, because neither C++ nor Java pushes people to create convoluted "architectures".

While programming languages can nudge architects in certain directions, this is only true for rather special languages, such as Erlang. Both Java and C++ support standard programming paradigms, can and are used to create many types of architectures.

</comment></comment></comment></comment></comment><comment><USER5> Huh, does the free version of Ida now support dos4gw binaries or is the game too old to use that? A couple years ago I wanted to start a similar project but stopped at that hurdle.

Very cool project!

</comment><comment><USER6> Unittests !

<comment><USER7> I was shocked to see mention of unit tests as well.</comment></comment>