Koding gives away 4gb per developer - <AUTHOR> https://koding.com/?c=Crazy100TBWeek

<comment><USER2> Site is non-responsive for me, I guess they are getting slammed right now.

</comment><comment><AUTHOR> What I like about Koding is that you get a real VM in the cloud to play with (the catch being that it shuts down automatically 20 mins after you stop using it). That makes it great for dev workflows.</comment>


When colleges blocked Facebook, lessons for net neutrality - <AUTHOR> https://www.nytimes.com/2017/12/08/opinion/facebook-net-neutrality.html <comment><USER2> Get VPN, forget a problem.

<comment><USER3> I was not aware VPNs are immune to traffic shaping. Thanks for solving the Net Neutrality issue.

<comment><USER4> How do you modify the traffic that goes through an SSH tunnel? You can't unless you have the private keys.

<comment><USER5> As far as I understand, ISPs can recognize that you're using a VPN and then slow all of your traffic, instead of affecting your connection to an individual site.

<comment><USER6> It's China's Great Firewall, welcome.</comment></comment></comment></comment></comment>


Who'll follow The Gap to Australia? - <AUTHOR> http://internationalbs.wordpress.com/2010/07/13/follow-me-to-oz/

<comment><USER2> And it seems Zara is definitely on their way...see [http://www.insideretailing.com.au/Latest/tabid/53/ID/8635/Za...](http://www.insideretailing.com.au/Latest/tabid/53/ID/8635/Zara- confirms-Australian-entry.aspx)</comment>


Tarski's undefinability theorem - <AUTHOR> http://en.wikipedia.org/wiki/Tarski%27s_undefinability_theorem

<comment><USER2> From that entry...

 _The indefinability theorem is conventionally attributed to Alfred Tarski. Gödel also discovered the indefinability theorem in 1930, while proving his incompleteness theorems published in 1931, and well before the 1936 publication of Tarski's work (Murawski 1998). While Gödel never published anything bearing on his independent discovery of indefinability, he did describe it in a 1931 letter to John von Neumann._

</comment><comment><USER3> I may be missing the meta-joke (an undefined result page for an undefinability theorem) and possibly there's a URL mangler at work, but here's a link including the apostrophe (%27) between Tarski and s:

[http://en.wikipedia.org/wiki/Tarski%27s_undefinability_theor...](http://en.wikipedia.org/wiki/Tarski%27s_undefinability_theorem)

<comment><AUTHOR> both the link i posted and and the link you posted open for me. the title was frack Godel where frack was spelled with multiplication operator. didnt know HN had blasphemy laws !

</comment></comment><comment><USER4> Perhaps you meant this?

      http://en.wikipedia.org/wiki/Tarski's_undefinability_theorem

EDIT: Turns out HN is stripping out the apostrophe in the URL.

<comment><AUTHOR> yes. i meant that.

the link opens for me. either wat u said is true or my opera has acquired intelligence or quantum mechanics is causing a havoc.</comment></comment>


Wikileaks: Coke and Dow hired Stratfor to monitor PETA and other activists - <AUTHOR> http://www.globalpost.com/dispatches/globalpost-blogs/the-grid/stratfor-hired-corporations-monitor-activists <comment><USER2> This is actually pretty smart. I would probably do the same thing.</comment>


How to get police out of schools - <AUTHOR> https://mashable.com/article/how-to-get-police-out-of-schools/ <comment><USER2> Certainly a nice idea, but we need to come to grips with the reason the police are there in the first place. Some kids are just plain dangerous with or without the police in the place. Getting rid of the police surrenders the place to the dangerous kids.

</comment><comment><USER3> I think at this point we should be more focused on getting our kids out of schools.

</comment><comment><USER4> why do we need to do this again?</comment>


Show HN: NoList, a To-Do List that is not a list. - <AUTHOR> http://www.joaquinllaneza.com/2013/05/nolist-to-do-list-that-is-not-list.html

<comment><USER2> i'm _really_ into this idea. However, the UI looks unpolished, and I need to try before I buy. There is so much more sexy that can go into that UI, though, you are on to something ;).

<comment><AUTHOR> thanks a lot. you're right, much work to do on the UI. this first iteration is centered on the concept. I'll keep working on the UI.</comment></comment>


The Birthday Paradox – On Jupiter, and Beyond (2012) - <AUTHOR> https://www.solipsys.co.uk/new/TheBirthdayParadox.html?sc03h <comment><USER2> For those of you who read the comments before the article, this is actually about calculating hash collisions and is pretty interesting.

<comment><AUTHOR> Thank you.

</comment></comment><comment><USER3> the authors are basically rediscovering Chen-Stein's concept of Poisson approximation... which can be used to almost trivially approximate any birthday problem variant. For example, how many people do you need to have a 50% Probability that at least 6 people were born on the same day on Jupiter? Ez w/ Poisson approximation. I first learned about this in Persi Diaconis' graduate probability class but the method is very simple

[https://projecteuclid.org/euclid.ss/1177012015](https://projecteuclid.org/euclid.ss/1177012015)

</comment><comment><USER4> >Just as a reminder, we use n! to mean n(n−1)(n−2)(n−3)...3.2.1, so that means 6!=22.214.171.124.2.1=720. The exclamation mark is sometimes pronounced "pling" and this operation is called "factorial".

I've never heard the factorial symbol called "pling" before, I think we pronounced "6!" as "six factorial" in my undergraduate math classes in the US. Is "pling" a common term that I completely overlooked? Or is it more common in the UK?

<comment><AUTHOR> In various circles it can be called pling, bang, or shriek. These are names for the symbol, whereas "factorial" is the name for the function.

In particular the opening line of a (U|Li)nix script is:

        #!<path>

and that's sometimes called the "hash bang".

From wikipedia[0]:

        In the printing world, the exclamation
        mark can be called a screamer, a gasper,
        a slammer, or a startler.

        In hacker culture, the exclamation mark
        is called "bang", "shriek", or, in the
        British slang known as Commonwealth
        Hackish, "pling".

[0] [https://en.wikipedia.org/wiki/Exclamation_mark#Slang_and_oth...](https://en.wikipedia.org/wiki/Exclamation_mark#Slang_and_other_names_for_the_exclamation_mark)

<comment><USER4> Don't forget about interrobang, aka "?!"

"Shriek" is a new one to me, however. What context is it used in?

<comment><AUTHOR> From Wikipedia[0]:

> _The name given to "!" by programmers varies according to their background. > In the UK the term pling was popular in the earlier days of computing, > whilst in the United States, the term shriek was used. It is claimed that > these word usages were invented in the US and shriek is from Stanford or > MIT; however, shriek for the ! sign is found in the Oxford English > Dictionary dating from the 1860s._

From another web site[1]:

> _It is also called an exclamation mark or tellingly, in newspaper jargon, a > shriek._

</comment></comment></comment></comment><comment></comment><comment>====

References:

[0] [https://en.wikipedia.org/wiki/Exclamation_mark#Computers](https://en.wikipedia.org/wiki/Exclamation_mark#Computers)

[1] [https://www.thoughtco.com/multiple-exclamation- points-169141...](https://www.thoughtco.com/multiple-exclamation- points-1691411)

</comment><comment><USER5> I have a question. Under the section "Where did that come from?" The author states:

>"But after a bit of futzing about I found it to be remarkably close ..."

And the number under the radicand symbol he shows "ln(4)"

What is this exactly? Why is it significant?

<comment><AUTHOR> "ln(4)" is the natural log of 4, so it's the solution to the equation e^x=4, where e ~ 2.71828... also known as Euler's number[0].

Reading further in the post will explain where that quantity comes from, and why it's significant, but if you have any questions you can ask them via the comment box on the article.

[0] The constant "e" turns up in lots of places, you can read more about it here: [https://en.wikipedia.org/wiki/E_%28mathematical_constant%29](https://en.wikipedia.org/wiki/E_%28mathematical_constant%29)

The usual examples for how Euler's number turns up are to do with calculus and compound interest, but there are many other.

<comment><USER5> Yes of course, thank you. I am so used to seeing the word "log" written out in things like time complexity/Big O analysis that I forgot about the natural log - ln. Cheers.

</comment></comment></comment><comment><USER6> Related: given a permutation of numbers 0..999, find out the position of a given number (e.g. number 5). It may seem that on average, you need 500 iterations. In fact, you need much less:

let index = 5; while (element[index] != 5) index = element[index];

<comment><USER7> > _In fact, you need much less_

How many iterations does that take on average? And why?

<comment><USER6> see [https://math.stackexchange.com/questions/1409862/average- len...](https://math.stackexchange.com/questions/1409862/average-length-of-a- cycle-in-a-n-permutation) Which gives you 1000/7.48, not 1000/2</comment></comment></comment>


Servo – Render in parallel - <AUTHOR> https://github.com/mozilla/servo/pull/2609 <comment><USER2> Note that Chromium has been doing this for a while with impl-side painting.

What is exciting about this in the context of Servo, though, is that it completes the parallel pipeline:

* Script can be parallelized through PJS or Web Workers.

* All phases of layout are fully parallelized: selector matching is performed in parallel (one micro-task per DOM node), layout is performed in parallel, and display list construction is performed in parallel (one micro-task per render object).

* Painting is now performed in parallel on a tile-by-tile basis.

* Compositing is performed in parallel thanks to the GPU.

All of these tasks can also be performed in parallel with one another.

<comment><USER3> One risk the Servo team might have is the end-user latency. I'm wondering how it will play out that having all these asynchronous waits can result in a worse end-user experience. User interaction lag can be incredibly frustrating. Every opportunity taken to perform tasks asynchronously exacts a cost in terms of synchronization latency.

I hope the Servo team is acquainted with the video game world, and the curious optimizations that have been taken in that realm to greatly improve performance in multi-threaded settings.

<comment><USER2> Our tasks can generally operate independently. For example, if the painting task is stalled, scrolling can happen in the compositor; if the layout task is stalled, painting can happen on the retained display list; if the script task is stalled, layout can still happen on the retained render object tree. This is only possible because our data structures are cleanly separated between all the tasks. I'm confident that this approach will result in good latency.

<comment><USER4> How far out is servo from being the mainline Firefox renderer? A year? More? Pie-in-the-sky?

<comment><USER5> Servo is a prototype – closest to your "Pie-in-the-sky" option.

I'm not affiliated with Mozilla or Servo but from the information on the Servo page and the number of Acid2 and other issues they're tracking, it's clear that there's still plenty of work to do. Throw in the fact that the Rust language itself is targeting the end of the year before they hit version 1.0 and you'd have to guess that Servo as a separate project likely has _minimum_ 6 months (more likely a year) before they examine whether it's successful enough to start integrating with Firefox.

Then they'd need to integrate and test.

Think about how long the new "Australis" UI was in development (more than 2 years). It was just a user-interface change without changing programming language or other dev-tools.

The renderer is the core of the program. And integrating Servo would involve integrating and testing a new language along with the new code. I doubt a large, capable team could perform that much integration and testing in under 12 months – even after Servo itself was considered "complete" (which it isn't).

My prediction: a release of Firefox with Servo code is 2 years away or more (assuming Servo is considered a "success" in 6-12 months).

<comment><USER6> My guess is not so optimistic. # of real rust programmers is low. If integrating Firefox with Servo means having 1 small part of Firefox integrated with Servo, mabye, a month of work? But the entire Firefox render engine with Servo will probably be at least 5 years away. While 5 years seems a long time, don't forget time fly and bug blockers come up.

<comment><USER7> It's been stated before that Servo may get a Webkit-compatible interface, meaning you should be able to build a Chromium with Servo pretty easily, and far before it would take to integrate Servo into Firefox.

I'm not sure if that's still the plan, however.

<comment><USER4> Does Webkit have a very large API/ABI surface? This seems like a nightmare to implement correctly and maintain.

<comment><USER7> I have no idea.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> This is also useful as a demonstration of how the Servo developers use bots to augment the review of pull requests. See also "bors", the Rust compiler's continuous integration bot: [http://buildbot.rust- lang.org/bors/bors.html](http://buildbot.rust-lang.org/bors/bors.html)

It would be very interesting to survey the largest projects being developed on Github to determine if they've also grown bespoke ways of dealing with the platform's pain points. I know that the Rust developers aren't entirely satisfied with the tools that Github provides (which seem to be optimized for small projects at the expense of large ones), but Github's network effects are just too good to ignore for a project that relies on volunteer contributions.

<comment><USER9> I have seen many projects have little bots do things like post to third-party review services or whatever. Many projects use CI tools that have GitHub integration (e.g. travis), Rust's is just rolling their own so they needed their own GitHub integration. We should be lauding GitHub for their willingness to support integration, even if their native tools are a tad lacking.

<comment><USER10> AFAIK Bors doesn't use any github integration, it behaves as a user (and I'm pretty sure its messages are too complex to go through the statuses API and result in anything other than unreadable garbage)

<comment><USER11> Bors does have some github integration and it will automatically merge pull requests and I believe it does update the status, but yes, the details of its interactions are by posting normal comments.

</comment></comment></comment></comment><comment> mkr-hn Remember when some people said there was no point in buying a multicore system because no one used them effectively? I'm glad no one listened.

<comment><USER12> That was untrue even then. Even if no individual userspace program was multi- threaded or multiprocess, you still get a benefit from being able to run multiple programs at the same time (and not just time-shared on a single core).

<comment><USER13> I don't know about that, single core computers weren't known to be used in a multitasking kinda way. You usually had one main program open at any given time. It's not like my computer with a Packer box running on the left, a code editor in the middle, and Hacker New + 10 tabs on the right.

It was Word.

Or it was 3D Pinball.

The issue was Word and 3D Pinball didn't use multi-cores well and some people didn't see anything to gain. They thought "well it isn't going to make lag in Word disappear, or Pinball more fun." They completely missed that they could run both at the same time now.

</comment></comment></comment><comment><USER14> And, reverted: [https://github.com/mozilla/servo/pull/2685](https://github.com/mozilla/servo/pull/2685). Broken on mac. Maybe next week...

<comment><USER14> And this patch fixes on mac: [https://github.com/mozilla/servo/pull/2687](https://github.com/mozilla/servo/pull/2687)

</comment></comment><comment><USER15> Can Servo be used to automatically create screenshots of user-submitted (and untrusted) URLs?

<comment><USER7> > ./servo -co output.png ../src/test/html/about-mozilla.html

</comment></comment><comment><AUTHOR> Thanks mods for the title change. I wasn't sure how to provide context to a pretty bare-titled page. Anyway, this is exciting stuff.

</comment><comment><USER16> can servo be used to run tests sort of like how selenium does it?

<comment><USER17> No, Servo doesn't have any WebDriver support as of yet. I'm curious what your usecase is though; at this point servo is a quite a way off being even dogfood quality. It's not something that you could use to test your website.</comment></comment>


Google's 174 web fonts in one convenient downloadable tarball - <AUTHOR> http://axonflux.com/googles-174-web-fonts-in-one-convenient-downl <comment><USER2> This looks like a good thing to host on the Cloud Drive!</comment>


Rawgit is shutting down - <AUTHOR> https://rawgit.com/ <comment><USER2> Sad to read this. It's a nice tool to simply host a file on GitHub without any configuration.

Well, I think GitHub-pages improved in the last years, maybe I'll try that again.</comment>


Ask HN: Best non-cloud cross-platform CLI secret manager? - <AUTHOR> I've recently setup my Mac to dual boot Fedora/macOS, and now need to migrate Keychain data to a solution that allows access to the data on a shared localhost data partition. HashiCorp's Vault looked promising, but you can't get a list of stored keys without hacking on their API. Anyone know of a solution that isn't cloud-based, and has a Linux and macOS CLI with key search functionality? <comment><USER2> For my personal use I wrote a small credentials manager in Python. I use it daily for my non-critical secrets and am quite content with it:

[https://github.com/nieksand/pman](https://github.com/nieksand/pman)

You'll need Python 3.6 or later. (It uses f-strings and some type annotations).</comment>


Ruby 2.3.0 Released - <AUTHOR> https://www.ruby-lang.org/en/news/2015/12/25/ruby-2-3-0-released/ <comment><USER2> This is actually a really great release.

`&.` removes the really annoying (and slow) `try`.

And I think the string literals freezing is going to solve a lot of problems with memory allocations.

Check out this PR for Rails that covered a lot of similar performance problems created by too many string allocations.

[https://github.com/rails/rails/pull/21057/files](https://github.com/rails/rails/pull/21057/files)

I wish Rails 5 could go all in on Ruby 2.3.0 and frozen string literals.

<comment><USER3> How prevalent is `try` in rails/activesupport? My benchmarks show that the lonely operator is ~2x faster than `try`. I'd expect someone to create a gem that monkey patches `try` for those running 2.3.0.

<comment><USER2> `try` is bad for a number of reasons.

Because itll never throw an error, you see it hiding issues.

And I keep seeing colleagues writing `hash.try(:[], :some_key)`

`try!` is better.

But I'll stick to `&.` from now on.

<comment><USER4> Using `try` is definitely a code smell, but unfortunately it's often a necessary one in production environments that have seen some wear and tear in the integrity of their database structures.

</comment></comment></comment></comment><comment><USER5> It's really great to see that with every big release, Ruby is making the language even more pleasant to use in addition to the regular performance improvements.

Ruby just keeps getting better and better.

<comment><USER6> Agreed. Been using Ruby for a few years now and it never stops being enjoyable. Hoping it keeps going for many more years!

</comment></comment><comment><USER7> Fun fact: Ruby 1.0 was released 19 years ago on this day.

</comment><comment><USER8> Nice to see "Did You Mean" suggestions flourishing across various tools now, e.g. Git too. Error messages can be a whole lot more than indecipherable jargon, even for command-line warriors.

I'm also looking forward to never writing "if foo && foo.bar" again!

Congrats and happy holidays Ruby team :).

<comment><USER9> Well, git's "did you mean" is probably the most frustrating command line experience imaginable, but it's quite nice in a language!

<comment><USER5> It's the worst when it says something to the effect of "you made a typo, so we already ran this unrelated command for you!"

Tip: run the following to add a 1-second pause between the message and the "fixed" command being executed:

      git config --global help.autocorrect 10

</comment></comment></comment><comment><USER10> I seriously saw this and thought it might be the reason for the ruby-colored banner.

 _facepalm_

<comment><USER11> We can say it's for both Christmas and Ruby relesae. :)

<comment><USER10> The fact that Christmas is almost over where I am - and I saw the normal banner all day - might explain it :)

</comment></comment></comment><comment><USER12> Anyone knows if Ruby has accepted IBM's contribution of JIT for Cruby??

[https://news.ycombinator.com/item?id=10715610](https://news.ycombinator.com/item?id=10715610)

And below is the Presentation from Ko1 on compiling Ruby

[http://rubykaigi.org/2015/presentations/ko1](http://rubykaigi.org/2015/presentations/ko1)

<comment><USER13> (IBMer working on said JIT here)

As Chris Seaton points out as well, we're not really open source yet. Working on getting there, but it's going to take time. The important thing now is that we can start talking with the community and making it more likely that when we _do_ get open source, it can happen in a way consumable by the Ruby community.

<comment><USER14> do you have any status of the project? Or any dates when we can expect?

<comment><USER13> Unfortunately no dates. We're still working on this, but we really want to do it right, so we're taking the time we need. Sorry!

</comment></comment></comment></comment><comment> r-s Looks like some nice additions. I try to limit the use of .try in rails, however when working with legacy codebases it is much nicer then:

if @user && @user.address && @user.address.city city = @user.address.city end

Even though I write less Ruby then I once did, I still credit it as the language which shaped my career the most. I have worked so many great jobs because of Ruby.

<comment><USER15> Yup. In addition to the general purpose safe navigation operator we also have Hash#dig now which helps with those pesky nested params:

params.dig(:user, :address, :city)

</comment></comment><comment><USER16> Ah, YARV finally adds bytecode compilation and loading as an "experimental" feature. It'll be interesting to see what people do with it.

<comment><USER17> I could see it making deployment faster or nicer. Imagine being able to compile all the byte code for a Rails app locally and just shoving that up instead of waiting on bundling and all that.

Also I think this would make possible hot code upgrades which are cool but probably more work than their worth. Unless you can build smart hooks into background job and web server libraries that only change the byte code in between jobs and requests. Oh the possibilities!

<comment><USER17> After reading the patch that introduced the byte code compilation it seems what I was hoping to use it for are clearly not goals of the project: [https://bugs.ruby-lang.org/issues/11788](https://bugs.ruby- lang.org/issues/11788)

<comment><USER18> I'm not sure the prospects are so bleak. I made some tests and I could run the compiled code on another machine with a different directory structure. See [https://ilconnettivo.wordpress.com/2015/12/25/ruby-2-3-0-ins...](https://ilconnettivo.wordpress.com/2015/12/25/ruby-2-3-0-instructionsequence/)

<comment><USER17> I was curious just like you and gave this a try too. Seems that while the project is intended for this you can easily build this. Thank you for writing that up!

</comment></comment></comment></comment></comment><comment><USER19> Here are two bash functions so that you can compile and execute the bytecode in the terminal:

i.e.

rubyc test.rb

ruby-do test.rbc

in .bashrc:

function rubyc() {

ruby -e "File.open('$1c', 'wb').write(RubyVM::InstructionSequence.compile_file('$1').to_binary)"

}

function ruby-do() {

ruby -e "RubyVM::InstructionSequence.load_from_binary(File.open('$1', 'rb').read).eval"

}

</comment><comment><USER20> with the existence of Perl6, Clojure, F#, Rust, Go, and few others ...

For someone who doesn't know Ruby, why learn it today?

<comment><USER21> For me: because nothing else approaches it in terms of linguistic flexibility. I learned Ruby about two years ago, after learning...a dozen-ish languages? Something like that. I don't write web applications in it, because Rails grinds my gears for a whole host of reasons, but for my money it is _the_ can- opener language. If I have a problem, I feel like I can generally explore it faster in Ruby (holla, Pry) and build a solution iteratively without really burning a lot of mental effort on it.

The second part, aside from Ruby's general applicability and ease of exploration, is that I think Ruby scales, in terms of application design, from that garbage-y first-cut code to really elegant, really clean code that's fun to work in and easy to maintain. That first solution, borne mostly out of dumping my REPL history, may not be great, but that's okay: with the help of the excellent ecosystem around the language I can reify my expectations in tests and swap out the original exploratory system for good, easy-to-work-with code that's clear in its behaviors. Of course you can do that with other languages, too--but I've never found one that makes it as easy to stretch in both directions, from noodling around to code I'd trust with my business (and I'm doing exactly that), other than Ruby.

But as for the languages you namedropped:

\- Perl 6 is great, but it's a decade late and it isn't sufficiently compatible with Perl 5, so it's starting miles and miles behind where Ruby is right now. It's not dead out of the gate, but it keeps lurching toward the green and making everybody nervous. Practically nobody knows Perl 6 _now_ , I don't know why somebody would pick it over Ruby if they're lining both languages up side by side.

\- Clojure is super interesting and Rich Hickey is a supergenius and we're all lucky he didn't go into supervillaining because I think he'd be really good at it. And Leiningen is an amazing build system. But Clojure suffers from what I view are the usual problems a Lisp has around readability and the hands-on- keyboard experience (and I like Lisp, I've got DrRacket installed on my laptop for a reason, but I've been writing Lisps for a decade or more now and grinding out Clojure code is slow). Love the people, love the community...would rather write Ruby.

\- Rust doesn't do nearly the same thing as Ruby. They're useful for different things. I feel like Rust inherited the good parts of the Ruby ethos from the participation of folks like Steve Klabnik. Big fan of the language and the community, but it's not incompatible with Ruby where it matters anyway so who cares?

\- F# is a great language and, like Rust, also has little overlap with what I use Ruby for. If I cared about Ruby for the web, maybe there would be more overlap, but F#-for-web is swimming upstream anyway. (Doable, but harder than C#.)

\- Go, while it as a language deserves some small credit for introducing co- routines to people who come from Python (he said, only somewhat snarking while he makes Lua gang signs), is close to an unmitigated disaster of an ecosystem that tries to be prescriptive when it should be hands-off and hands-off when it should be prescriptive. It is also a _tremendously limited_ language in terms of syntactic flexibility and ability to do stuff like "second-order" metaprogramming; this is a design decision that can be debated, or could be debated if I hadn't been convinced long ago by better languages that crippling a programmer to make writing an execution environment easier to always be the wrong thing. Do not want.

<comment><USER22> What about Elixir?

<comment><USER21> Never used it. Looks nice enough? But never looked like something I'd open in a REPL to hash out a problem. Could be wrong.

</comment></comment></comment></comment><comment><USER23> I couldn't find any actual examples on how to use the new frozen string literals. Lots of discussion in the link provided, but that's it.

<comment><USER24> The NEWS file defines what the pragma actually is,[1], but you'd use it like so:

        # frozen_string_literal: true
        str = 'foo'
        str << 'bar'

This will now produce an error:

        # main.rb:3:in `<main>': can't modify frozen String (RuntimeError)

It's equivalent to Ruby 2.1's String#freeze:[2]

        str = 'foo'.freeze
        str << 'bar'

        # main.rb:2:in `<main>': can't modify frozen String (RuntimeError)

Except that it will affect all strings created after the pragma mark.

You can also trigger this behavior globally with the --enable=frozen-string- literal option.

[1]: [https://github.com/ruby/ruby/blob/v2_3_0/NEWS#L17-L26](https://github.com/ruby/ruby/blob/v2_3_0/NEWS#L17-L26)

[2]: [http://ruby-doc.org/core-2.2.3/Object.html#method-i-freeze](http://ruby- doc.org/core-2.2.3/Object.html#method-i-freeze)

</comment></comment><comment><USER25> Interested to see how people start using safe navigation! I personally tend to avoid `try` in Rails in favor of other `nil` handling patterns.

<comment><USER26> Why? Genuinely curious.

<comment><USER27> 'try' is relatively slow compared to other control logic, as allowing an exception to be thrown involves constructing an exception stack trace. This is slow in all VMs I know. Theoretically you could detect that the trace isn't used and remove it through escape analysis, but this is not easy, or you could do some crazy thing with lazily creating the stack trace, but that's a research project.

<comment><USER28> I think you are confused, `try` is not raise/rescue. The ActiveSupport `try` implementation does not involve allowing an exception to be raised.

[https://github.com/rails/rails/blob/v4.2.5/activesupport/lib...](https://github.com/rails/rails/blob/v4.2.5/activesupport/lib/active_support/core_ext/object/try.rb#L69-L80)

It should be as performant as other ways of checking for nil/empty.

<comment><USER27> Ah yes you're right - I was confusing this with raise/rescue.

</comment></comment></comment></comment></comment><comment><USER29> I love '&.'

I really missed this feature from C# 6.0

</comment><comment><USER30> Does lonely operator support safe navigation in case of method calls with params too?

        obj&.foo(1)&.bar(2)&.zoo

<comment><USER31> this is working just fine:

      nil&.+(3)&.+(5)&.-(7)

</comment></comment><comment><USER32> nobody noticed the bytecode section?

<comment><USER33> yes. care to elaborate? first thing that came to mind was "APC-style" ([https://secure.php.net/manual/en/intro.apc.php](https://secure.php.net/manual/en/intro.apc.php)) caches. but im not super up on deployment, i thought YARV was already supposed to achieve this.

<comment><USER34> APC exists because PHP reloaded source files each time a script was executed through your webserver. No such parallel exists in Ruby; once source files are loaded in a process, they stay loaded for that process.

In theory it might allow for faster loading of Ruby code (more analogous to Python's .pyc files), but IIRC early experiments (in the early 2.0 days) showed it to be counterproductive in many cases.

</comment></comment></comment><comment><USER35> ruby-2.3.0.tar.bz2 does not seem to have

        /ruby-2.3.0/bin/ruby

    ?

<comment><USER36> Its the source, you have to compile it yourself. Checkout the readme :)

<comment><USER35> Thanks for the reminder.</comment></comment></comment>


Ask HN: Do you consider the mentioning of SCRUM in a job ad to be a red-flag? - <AUTHOR> <comment><USER2> Not at all. Scrum is a fine process when done right. And I'd probably rather deal with a half-assed implementation of Scrum, than deal with using somebody's home-baked, "cowboy coding with no controls at all", "inmates are running the asylum" process.

Now if an ad mentions SAFE (Scaled Agile Framework) then I'd say run screaming for the hills as fast as your feet can carry you. SAFE is the biggest clusterfuck / abomination I've ever had the misfortune to stumble across in my life. It's like the mutant child of the worst parts of Scrum, the worst parts of Waterfall, some syphilitic sewage sucked out of the Potomac, parts from a 1973 AMC Pacer, some rotting fish-heads, and a barrel full of shards of broken glass and old rusty nails.

</comment><comment><USER3> Yes, but absence of red flags won't really save you from having cargo-culted fake agile shoved down your throat later. I would pay more attention to culture than specific practices.

</comment><comment><USER4> Not necessarily, but if you have time I'd ask about their specific implementation of Scrum. I've now worked at 2 companies where the director will take all of the "reporting" aspects of Scrum and get rid of all of the "protect the developers and their time" aspects. It makes for a very demoralizing workplace.

</comment><comment><USER5> Why would this be a red flag? Agile development is important for iterative updates.

</comment><comment><USER6> not if they pay me enough</comment>


Ask HN: Sewing - <AUTHOR> Are there HNers who sew?
I don't really mean "I try to fix a button if it gets loose", but making whole shirts, trousers, and so?
How did you get started? Can you reasonably learn to sew from books and YouTube videos, or is an experienced teacher the way to go?
What cool things can you reasonably make manually, and which things need a sewing machine? <comment><USER2> I sew machine only, picked it up as a "get off of the screen" some winter. I wanted to get into bag making. Picked up an entry range machine, learned the initial technique from a bunch of YouTube videos, some written tutorials that came with free patterns for a bit more specialised stuff. The rest felt similar to getting into electronics, buy ridiculous amounts of fabric and stuff you might want for future projects, stumble through early failures and eventually I ended up with bags good enough to carry out myself or give away.

If you can get somebody experienced to show you the mechanical moves for an hour that's great but I wouldn't call it necessary. With manual sewing it helps to see them in the real world for the weirder stitches but you can mostly get the same from pausing and rewinding a few videos.

If you're willing to spend a bit of money to get started and know what kind of project you want to do you can get kits that contain all the fabric/zippers/... you would need. That takes away a bit of the initial guesswork.

<comment><USER3> Hi Tastroder :) I see we have quite different "takes" on how to learn sewing. Of course you are quite right but there are different strokes for different folks (a clothing designer I once knew told me that)

<comment><USER2> Haha, definitely. Just thought I'd share what worked for me :) maybe to add: For more complex constructions than bags I occasionally would have loved to attend a formal course and from time to time I absolutely notice areas where I lack that formal training. That just never happened because it didn't fit my day to day.

</comment></comment></comment><comment><USER3> Depending entirely on how good a worker you are, almost anything can be sewn by hand. Designers often start with a picture, so they can calculate the required dimensions from measurements. There is a lot to learn about different cloths, their orientation in a garment and the way the garment "falls". There are often courses in garment design and construction available at technical colleges. These run anything up to 3 years (in New Zealand, my country) and end in a degree level qualification.

<comment><AUTHOR> > There are often courses in garment design and construction available

I was thinking about a different kind of teacher. There are seamstresses in my town and adjacent towns that offer sewing lessons.

(Also, thanks to tastroder for his advice)

</comment></comment><comment><USER4> This post I made yesterday a seemed like good gateway project for learning to sew. In this case, thoughtfully designed masks much better than what's available to buy.

[https://news.ycombinator.com/item?id=23050986](https://news.ycombinator.com/item?id=23050986)</comment>


Why Didn't Saturn Eat Titan, Its Biggest Moon? - <AUTHOR> https://www.nytimes.com/2020/03/10/science/saturn-titan-moon.html <comment><USER2> I'm inclined to agree with the [dead] post here. The sentence structure and cadence are so similarn that I think there's a good chance that the reference is intentional

</comment><comment><USER3> Why didn't it eat it's sun? It's like a Roman dad joke.</comment>


UNIX V6 vs. Windows 7 - <AUTHOR> http://aiju.phicode.de/b/windows7-vs-v6 <comment><USER2> On what was "Startup time" benchmarked?

I've never seen a PC take 2 min to start Windows 7. Unix would be seconds.

<comment><USER3> I got a new laptop a couple months back. It came with Windows 7, and I thought, ok, what the hell, I might as well fire it up and see what this is like.

It took somewhere upwards of 15 minutes to finish some final installation step, and the first thing it presented me with was a notification dialog explaining that Explorer had crashed.

I haven't actually booted Windows since, which leaves me with a personal average boot time considerably over 2 minutes...

<comment><USER4> I've had a similar experience with a HP machine. However, don't blame Windows for this, Windows 7 by himself is a pretty decent OS, as long as you do a clean install. The version that cames preloaded on new machines is usually full of crappy applications that have nothing to do with Windows, these are installed by the provider (HP in my case). The same machine with a clean copy of Windows 7 Pro 64 bits boots in about 1 minute.

<comment><USER2> I agree with you. Microsoft itself said (some time ago) that many of Windows' crashes were caused by third-party software or drivers, and I believe that. Even so, they reduced the number of crashes that occur, and greatly improved crash-recovery (you rarely see a BSOD happening these days).

My PC has never had a crash with Windows 7, but then, I chose the hardware by hand.

</comment></comment></comment></comment><comment><USER5> I'd like to point out the disclaimer of that webpage (<http://aiju.phicode.de/b/>), just in case:

> HOLY SHIT DON'T TAKE ANYTHING IN THIS SECTION SERIOUSLY

(emphasis as in original)</comment>


How to Optimize GMAIL APP 4.5 for Android OS - <AUTHOR> https://www.rebelmouse.com/contacternst/how_to_optimize_gmail_45_app_f-180699788-s0.html

<comment><USER2> Thanks for this, I found it helpful</comment>


Ask HN: What incentivizes patent clerks to verify claims? - <AUTHOR>

It would seem to me these government workers, no matter how bright, would still be most fundamentally rewarded for number of patents reviewed, and challenging a claim seems like it must be more difficult than accepting it, as a challenge requires the patent clerk to 1) claim understanding and 2) possibly cause more strain in the office if the applicant fires back. And I suspect most of these clerks have moved on and are well clear of any repercussions by the time their decisions get invalidated in court.<p>Is there any way to validate their decision-making outside the courts? Preferably much earlier? <comment><USER2> You'd be better off asking what incentivizes the Patent Office to do careful review. The answer, when they get paid by the patent seekers, is that every incentive aligns with giving out patents freely.

Is it any wonder that they have settled for being generous in handing out patents, and are content to let the courts do the bulk of the real review? (Ignoring the costs to society of having so many invalid patents available as threats.)

<comment><AUTHOR> Makes me think of the rating agencies that facilitated the latest bubble: paid by the applicants. What sorts of inflation could exist within the patent market and how could one burst the respective bubbles?

</comment></comment><comment><USER3> I have a friend who works for the patent office reviewing patents, and I've asked her a bit about the process. Overall, they are incentivized to verify claims because they want to do a good job. Same as any other employee at any other job. I don't think they're penalized for rejecting claims and rewarded for letting things through. Their goal is to act appropriately to each case.

Where any problems occur due to bad patents being approved seems to be due to time constraints in reviewing patents. My friend didn't think that the patent system is "broken" by any means. Her opinion was that they just need more qualified reviewers. They are hiring like crazy, or at least they were a few years ago.</comment>


Proof of burn: An alternative method for distributed consensus - <AUTHOR> https://en.bitcoin.it/wiki/Proof_of_burn <comment><USER2>
        (regarding the true randomness source) I believe there
        would be no trouble propagating this to all nodes, by
        out-of-band means if necessary.

Similarly, surviving on a deserted island is easy - I believe you'll have no trouble finding a can opener and plenty of canned food.

If your solution to a distributed consensus problem _starts_ with "assume all parties cooperate and agree on a continually-updating feed of data", it's not exactly compelling.

Also, there's no need to make up words like "remurrage" \- economics already has "deflation" for when HODLing currency returns a positive amount.

<comment><USER3> Similarly they write:

>There are in fact some further issues, to do with making sure it's not cheap for a miner to re-exhibit their proof (of having performed a suitably substantial burn a suitably long time ago) on multiple competing chains. Details to follow.

which kind of seems like a major omission, as this is the _one thing_ a proof of X should protect against.

<comment><USER4> Seems like that could be defended with Casper's approach: use security deposits, slash them for burn reuse, and reward anyone who provides proof of reuse.

<comment><USER5> The problem is that the miners -- whose fraud is proven with a transaction -- have the responsibility of including this transaction in the chain they control. Which means the only solution is to fork: now we have two or more chains (any number of valid chains which includes this proof can exist) -- how do we reach consensus on which to follow?

Before the fraud, the miners were allegedly responsible for reaching consensus. And when they commit fraud, it's assumed that the network can reach consensus without the miners (on a single, valid chain which includes the proof of miner fraud). If everyone except the miners were able to reach consensus on a single chain in the first place, why did we need the miners?

<comment><USER4> Aren't you assuming the miners are all working together in a coalition? You're pretty much screwed anyway if that's the case.

</comment></comment></comment></comment></comment><comment><USER6> I did a bunch of analysis on proof of burn, and came to the conclusion that it cannot work in practice because it relies on transactions in order to burn, which themselves are subject to consensus.

You can read my detailed analysis here: [https://bitcointalk.org/index.php?topic=1182677.0](https://bitcointalk.org/index.php?topic=1182677.0)

Cheers, Paul.

<comment><USER7> And the same applies to proof of stake. You need some form of external randomness to give you security. Of course many people have tried to come up with schemes where randomness can be created fairly by a group of people who don't necessarily trust each other [1]. Unfortunately all these schemes require at least half the participants to be honest so are vulnerable to trivial Sybil attacks. And the only way we know how to prevent Sybil attacks is to use proof of work or some sort of centralised system: leaving us back where we started.

I am convinced it can be mathematically proven that Proof of Stake/Burn algorithms don't work (without some sort of external randomness) but I don't have the mathematical skill to produce the proof.

[1] [https://eprint.iacr.org/2017/216.pdf](https://eprint.iacr.org/2017/216.pdf)

<comment><USER8> Doesn't the Proof of Stake algorithm protect against Sybil attacks by trusting participants based on how much they are staking?

<comment><USER9> The issue is in a lower level than that. A proof of stake system will want to randomly choose who gets to mine the next block, weighted by how much everyone is staking. But making this choice depends on everyone agreeing on a source of randomness, which is what the previous posts were talking about.

</comment></comment></comment></comment><comment><USER10> I'm not entirely convinced that cryptocurrencies require fee incentives to stay secure. Most people using a currency aren't interested in the 'value' of a transaction, but rather, they want to perhaps pay a vendor or simply hold a balance. The miners (or stakeholders, in proof of stake) act in order to earn a profit, and may not actually act in the best interests of currency users (including holders and vendors). Miners and stakers are, in a way, just siphoning off profits, and it might be true that actors in the system would still behave honestly without the mining/staking incentives.

I wrote a blog post about this: [https://medium.com/@brndnmtthws/questioning- assumptions-do-c...](https://medium.com/@brndnmtthws/questioning-assumptions- do-cryptocurrencies-need-fees-827c8f825e34)

<comment><USER11> You can't have a decentralized, secure network without fees.

PoS doesn't work by itself, anyone who tells you otherwise doesn't understand the underlying security of a decentralized blockchain.

A saw a nice rant on twitter the other day about this very subject: [https://twitter.com/hugohanoi/status/951762596255838209](https://twitter.com/hugohanoi/status/951762596255838209)

You CAN have a PoS network built on top of a PoW network(LN) but there will still be fees.

<comment><USER12> This is not a useful rant. 90% of it is bad and completely unconvincing argument by analogy.

> Everything in our world ultimately translates back to energy, at the lowest > level. You are energy. I am energy. Blockchain is energy.

The remaining 10% could plausibly be gesturing at a real argument, but it's way too vague and hand-wavy. It repeatedly says PoS is impossible, but then ends up admitting that it boils down to complicated questions about the stability of certain equilibrium.

<comment><USER11> >90% of it is bad and completely unconvincing argument by analogy.

What analogy?

<comment><USER13> The idea that somehow the law of conservation of energy applies to the security of block chains, or computing in general. The fact that tweets 1-20 come from a cryptocurrency developer is terrifying, because it reads like a speculator trying to drive down Ethereum. I get what the developer is trying to say, but it all falls apart once they tie "electricity expended in Proof of X directly maps to amount of ledger security".

Tweets 21+ are actually reasonable and well thought out. It's that whole nonsense in the first 20 that just poisons the whole thread.

I completely agree that PoS assumes that bad actors are at best a group of Chaotic Evil backstabbers and that there'd never be a massive organization of Lawful Evil people rewriting the block chain. Furthermore, it doesn't account for a group of possibly Chaotic Good miners "correcting" a coin heist by rewriting the block chain. It is the stance of a majority of cryptocurrency participants that such a power is corrupting and that no matter what, the block chain must stand immutable.

<comment><USER11> >"electricity expended in Proof of X directly maps to amount of ledger security"

That is absolutely true, this subtlety seems to be lost amongst all the hype.

Try to manipulate the BTC ledger, it's technically possible but not really affordable/feasible.

<comment><USER13> Reduced, the assertion made is: Because Proof of Stake requires less energy and is less secure than Proof of Work, all block chains are secure if and only if computing blocks requires a large investment of energy.

I don't think Proof of Stake is sufficient evidence to make that assertion. The source makes me even more skeptical, as they are invested in Proof of Work's continued dominance.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> Aha.

When I was thinking of how to set up a distributed marketplace, I came up with Proof of Burn myself.

The idea would be that you want sellers to pay something to participate in the market, but it's not fair for them to pay it to a central authority. So the solution is to burn some coins.

I should really put together the rest of the ideas into a whitepaper or something... There's a way to do a distributed marketplace in a fair and reliable way. There are a few people trying to do that currently, but most of them seem hung up on some weird design decisions.

Mainly you want to be able to see how many orders a seller has "in flight" at any given time. If 30 orders are placed, and the seller hasn't processed any of them, it's a good sign they're going to welch with the coins. The fact that certain currencies are publicly viewable (BTC for example) allows buyers to have those insights into sellers' activities in a distributed fashion.

<comment><USER15> > The idea would be that you want sellers to pay something to participate in > the market

What? Why would you want to do that beyond covering expenses for scam prevention?

<comment><USER14> Trust level. If you see a seller advertise 1 teddybear for sale, and you know they burned 3 teddybears worth of coins just to offer you that first teddybear, you can be pretty certain they're not going to run off with your money.

On the other hand, if a new seller didn't spend anything, they could run off with your coins on the first transaction.

This isn't just theoretical; it's the central problem in most darknet markets.

<comment><USER16> And if they are participating just to build a sufficient level of trust before doing a runner, then you are saying there must be a ratio of "trust to stake" \- maybe 1:1 at first maybe increasing - it would be interesting to know what market makers in stock exchanges run at - 1:10 or more?

</comment></comment></comment></comment><comment><USER17> Another green method for distributed consensus: [https://en.wikipedia.org/wiki/Proof-of- space](https://en.wikipedia.org/wiki/Proof-of-space)

Basically anything which is cheap to verify but costly to prove could be used.

Proof of burn and proof of stake both ultimately destroy resources. But what if the proof is something that can be used by humanity? Like proof of charity? So instead of sending the coins to an unspendable address, you send the coins to an address which is a charity, such as the Pineapple Fund? Of course such a charity would need to have strict controls on it such that it doesn't funnel misuse the money (such as mining for itself), but actually performs charity.

<comment><USER17> Brainstorming about ways to prevent misuse of the coins used for mining. Having the charity be operated by humans might be problematic (cause as we all know humans are corruptible). So might be better to have the charity be operated algorithmically, ideally via a smart contract. And dumber algorithms might be better since complexity provides more opportunities to exploit.

Since people seem to like the idea of basic income, what if the charity address was exactly that...a basic income provider, which would evenly send out received coins to every real human who registered their own basic income address?

</comment></comment><comment><USER18> Proof of burn is leveraged by Counterparty [1]. Counterparty is a colored-coin system that uses Bitcoin. You can create tokens in it just like Ethereum.

Bitcoin's enormous popularity and ensuing transaction fee growth has made counterparty much less useful IMO.

[1] [https://en.wikipedia.org/wiki/Counterparty_(technology)#Use-...](https://en.wikipedia.org/wiki/Counterparty_\(technology\)#Use- cases)

</comment><comment><USER19> I think proof of burn could work in case of 2 blockchains - first is powered by good old proof of work, second is using proof of stake. Proof of stake validators could burn coins in 1st blockchain and reference these transactions from the 2nd. Actually, there could be > 1 proof of stake blockchain parasitising on a shared proof of work blockchain. Oh ok, seems like a white paper just born...

<comment><USER20> But if your good blockchain depends on a bad one (i.e. burning real-world resources), how is it ever going to require burning less real-world resources than only having a bad one? If you propose to just burn less, then any attacker is going to attack the weaker chain.

<comment><USER19> Yes, there is still burning of electricity, in this scheme, but the number of dependent PoS blockchain can be many times > 1\. So that we burn real energy once and build many energy efficient blockchains on top of it.

</comment></comment></comment><comment><USER21> Such a currency would destroy PoW coins, putting an end to the environment impact of mining.

</comment><comment><USER22> Does this have any benefits whatsoever over Proof of Stake?

(I admit, I couldn't finish reading. The writing style was awful and seemed technically incompetent, though that's probably an unfair assessment from the _style_.)

</comment><comment><USER23> I m confused why would burn your proof of work coin? Proof of work is slow energy ineficient, does it changes that?

<comment><USER17> > "why would burn your proof of work coin?"

You burn your coin to prove that you endured some cost.

Why do you have to prove that you endured some cost? So there is a cost to mining. Why does there need to be a cost to mining? To disincentivize dishonest mining.

> "Proof of work is slow energy ineficient, does it changes that?"

While it doesn't change the proof of work, it does allow that wasted money to be shared by multiple proof-of-burn chains. Remember, it is not the individual coins which are energy inefficient, it is mining which is energy inefficient. There isn't a limit to the number of coins which can be stored in a block, though, so there isn't really a large energy cost of an individual coin.

</comment></comment><comment><USER24> > ...that is, sent them to a verifiably unspendable address.

How would you accomplish something like this?

<comment><USER17> maybe by sending to an address which couldn't be possibly generated. Such as maybe address 0 (or another address which could be provable to not be able to be generated).</comment></comment>


Using a Yubikey as smartcard for SSH public key authentication - <AUTHOR> http://undeadly.org/cgi?action=article;sid=20190302235509 <comment><USER2> If you own a MacBook Pro with Touch Id I highly recommend [https://github.com/sekey/sekey](https://github.com/sekey/sekey). It generates ssh keys in the secure enclave (mini HSM chip) and allows you to login to remote machines with Touch Id. The key can never leave the secure enclave.

<comment><USER3> That sounds awesome, but isn't that risky? Doesn't that mean you could never make a backup of the key, so if your macbook broke then you'd permanently lose access to whatever the key was protecting?

<comment><USER4> The solution is not to make backups _of_ a key, but to make backup keys and enroll more than one in authorization lists.

This also helps immensely when you want to retire a key, whether due to loss of control or concerns about its strength in the future. Being in the practice of having a set of authorized keys, you can safely remove older ones from authorization lists without locking yourself out.

<comment><USER5> I should make a patch instead of wishing, but it'd be nice if there was a ~/.ssh/authorized_keys.d/ directory where you _could_ drop lists of keys, instead of trying to merge in changes to the one file ...

<comment> yjftsjthsd-h It's kinda ugly, but you could do this by putting `Include config.d/*` at the top of your ~/.ssh/config in order to make ~/.ssh/config.d a thing (LPT: do this anyways; it's a huge quality of life improvement), then dropping in config files to point at keys.

</comment></comment></comment></comment></comment><comment><USER6> I added SSH agent on ChromeOS support to my CAC/PIV middleware (which supports many platforms), but I have not yet released it. Is anyone interested in testing it out ?

[https://cackey.rkeene.org/fossil/artifact?ln=on&name=f9156a5...](https://cackey.rkeene.org/fossil/artifact?ln=on&name=f9156a50f9f6eebf)

<comment><USER7> love to see that added into [https://github.com/rpwoodbu/mosh- chrome/](https://github.com/rpwoodbu/mosh-chrome/)

</comment></comment><comment><USER8> For a different approach (this approach is mentioned briefly at the beginning of the post, and dismissed with "I did not like that very much"), see also drduh's Yubikey guide: [https://github.com/drduh/YubiKey- Guide#ssh](https://github.com/drduh/YubiKey-Guide#ssh)

Note that the PIV approach used in the OP does not support RSA4096, while the OpenPGP approach does (since Yubikeys support RSA4096 in OpenPGP mode but not in PIV mode).

<comment><USER9> One upside of PIV-for-SSH rather than GPG-for-SSH is that the Yubikey support for PIV touch requirements / PIN lockouts is more powerful. You can set the PIN to lock after $n fails, and require reset after $n admin PIN fails, and you can set it to require physical touch to auth/sign/etc.

That carries over for SSH: in the most strict touch-mode, a separate touch is required for each authentication attempt. This requirement holds true even if you were to forward your SSH agent to the remote host: SSHing from there to another system would require another physical touch.

<comment><USER8> I also have configured my Yubikey 4 to require a physical touch for every SSH auth attempt even in GPG-for-SSH. The PIN stuff also carries over to my knowledge -- at least, I need to use my user PIN to unlock my SSH key for the first attempt (subsequent ones require a touch). It's possible that the configuration I am using is not well-known, but it appears to match exactly the PIV case you describe. Except perhaps the n=3 is fixed for GPG-for-SSH (not sure about this) and you think n=/=3 is a valuable configuration option?

(not sure about the SSH agent forwarding as I haven't tested that, would be surprised if it worked without a physical touch)

Basically I don't see the differences you describe in day to day usage at all.

<comment><USER10> Independent and out of curiosity, do you ever have to run things like a cmd over ssh in parallel across multiple servers? Just curious to understand if a "long touch" or something that "unlocks" your private key temporarily would be interesting.

Disclaimer: I work on Solo key, we're thinking to what's the best way to support ssh.

<comment><USER8> I don't do that and it wouldn't be useful for me personally, but I'm just a single data point.

What's much more important for me is the underlying capabilities -- a key which supports rsa4096 is great, a key which supports curve25519 in some fashion would be incredible.

<comment><USER10> Getting there, dependency's in: [https://github.com/solokeys/solo/pull/120](https://github.com/solokeys/solo/pull/120)

</comment></comment></comment></comment></comment></comment><comment><USER11> Here is the official documentation: [https://developers.yubico.com/PIV/](https://developers.yubico.com/PIV/)

<comment><USER12> Was going to post this, less steps needed than op.

I use my yubikeys as ssh keys and it's awesome, id suggest anyone who does should use the "cached" touch policy as you can then connect to many servers within the 15 seconds without having to keep tapping (good for ansible runs!)

Mac users can just brew install opensc but you'll need to link/copy opensc- pkcs11.so into /usr/local/lib

On Windows you can use the pageant agent from [https://risacher.org/putty- cac/](https://risacher.org/putty-cac/) and combine with weasel-pageant if you wish to use it as your ssh-agent in WSL [https://github.com/vuori/weasel- pageant](https://github.com/vuori/weasel-pageant)

<comment><USER13> Do you happen to have any tutorial handy that explain the steps needed for a mac os user to set that up?

I have a U2F key from NXP that works very well as a 2nd factor auth for my email account, however, I'm having a really hard time finding documentation on how to use it to store my ssh private key.

I just did `brew install opensc` and though it'd probably magiically work form there, but no luck.

<comment><USER14> A U2F key isn't enough, it needs to support smartcard PIV. The Yubikey does both, I'm not sure what other options there are.

<comment><USER15> (Editing to point out that this is an elaboration, not a correction. ie here is why this doesn't work)

The things a FIDO token / Security Key knows how to do are not really sufficient to authenticate with SSH public key Auth mode.

Specifically FIDO tokens know how to magically create a new public key and a cookie and promise they can subsequently sign specific messages that prove they know the private key if given back the cookie.

This is a very narrow feature set, deliberately to support the U2F / WebAuthn process only.

Someone could add a completely new SSH Auth method that works with this but the existing SSH public key method requires that you start by claiming "Hey, I know this key, can that work?". Whereas a FIDO token may not (and yours doesn't) even be able to tell anyone which keys it "knows" (because in fact it doesn't really know them at all, they are effectively encrypted inside the cookies it relies on, but only it knows how to decrypt those!).

<comment><USER13> Thanks, that was useful

</comment></comment></comment></comment></comment></comment><comment><USER16> Question for those who have been using authentication hardware (nitrokeys, yubikeys, titan): are you typically buying in pairs in order to insure against loss/damage, or do you envisage that you would be able to continue to function without significant disruption of the workflow to which use of the hardware has accustomed you?

<comment><USER17> i recently bought a backup yubikey for this exact reason. I really don't want to go through the pain of having accidentally locked myself out, just because I damaged my keyfob

</comment></comment><comment><USER18> Feels like a lot of moving parts but from this base things can get better. Competent scripted wrappers for instance.

I would like to understand the 'remove device and computer locks' hooks. And OSX integration.

Happy it works. Definitely want to try it myself.

<comment><USER12> OSX has native smart card support

When you have opensc installed it will detect your yubikey as a smartcard and ask if you want to unlock your computer with it

:edit: you also need to go to System Preferences > Security & Privacy > Advanced > Turn on screen saver when login token is removed

<comment><USER18> w00t! thanks. Last tried this 4+ years ago on a kickstarter yubilike device, it didn't work well.</comment></comment></comment>


Google Has Stored Some Passwords in Plaintext Since 2005 - <AUTHOR> https://www.wired.com/story/google-stored-gsuite-passwords-plaintext/ <comment><USER2> I submitted this yesterday and it never got much attention - Google seems to commonly get a free pass when it comes to security and privacy violations here. ([https://news.ycombinator.com/item?id=19977324](https://news.ycombinator.com/item?id=19977324)).

Hope your post rises to raise awareness - would this be Facebook everyone would be all over it.

<comment><USER3> I see lots of people downvoting everything that criticize Google in the comments especially Golang or Kubernetes, it's like half of the community works at Google. It's really frustrating but that's what HN is all about.</comment></comment>


When crisis hits - <AUTHOR> http://jacquesmattheij.com/when+crisis+hits

<comment><USER2> We run a big online restaurant guide in The Netherlands.

At the beginning of 2009, our income from AdSense (our main source of income) halved overnight and later dropped to about 25%. We had a little bit of money in the bank, but not enough to survive for more than a few months.

We immediately focussed on finding and developing alternative sources of income and those sources have now become our main sources of income and have enabled us to grow a lot.

Without that crisis, we probably wouldn't have grown as much as we have.

<comment><USER3> _"At the beginning of 2009, our income from AdSense (our main source of income) halved overnight"_

Did you ever find out why this happened? I'm also curious which alternative way of income you eventually found.

<comment><USER2> We think it was because of the economic crisis. The restaurant sector was hit pretty hard and that probably caused a lot of companies to stop advertising.

The revenue is now back to it's old levels, but it stayed that way for 6-7 months.

We started a program that allowed restaurants to advertise directly with us. Made it very easy to try by not having any contracts and being a lot cheaper than our competitors. We got someone to do sales on a commission-only basis. He was so good (~ 70% of the restaurants he calls become a customer) that he is now a partner.

We also added affiliate links to sites where you can order food online, make reservations, etc.

</comment></comment></comment><comment><USER4> How does one trace money through "connections"?</comment>


Ask HN: What's the best documentation you have ever read? - <AUTHOR> Consider the documentation of all the languages, frameworks, libraries, editors, extensions, etc you have ever read.
What're the most well written and structured you can recall?
Personally, it would be Laravel docs for me. <comment><USER2> Algolia doc is very nice, and done by a team of people very passionate about what they're doing.

[https://www.algolia.com/doc/](https://www.algolia.com/doc/)

Full disclosure: I work there.

<comment><AUTHOR> They also have a great side-project "Search for HN" [https://hn.algolia.com/](https://hn.algolia.com/)

Kudos guys!

</comment></comment><comment><USER3> Rust docs is decent. Elixir's is pretty good too! OpenBSD man pages.

And of course, ArchWiki has saved my life a few hundred times so far. It's really comprehensive.

<comment><USER4> Good to see Rust in there, as it's on a list due to WA and Deno

</comment></comment><comment><USER4> I double on Rust as @throwaway8879

</comment><comment><USER5> Vue docs for me is the best!

</comment><comment><USER6> jQuery documentation is awesome!!! try to change my mind [meme]</comment>


Zed finishes Learn Python The Hard Way - <AUTHOR> http://sheddingbikes.com/posts/1285754959.html <comment><USER3> Mongrel 2 and now a book on Python. The man is a machine.

<comment><USER4> If I remember correctly, he's also currently unemployed. This may be relevant :-)

<comment><USER5> I am, but to be honest, I got more done when I had a job. See all those sites? I did all of those, wrote for them, worked on LPTHW, wrote mulletdb.com, hacked on lamson, a few other projects, and still played guitar about 4 hours a day.

Now that I'm just working on Mongrel2 it feels like I do less. Weird.

<comment><USER6> Geez, man. Do you ever sleep? :-)

Oh, and just out of curiosity, what guitar music are you spending the most time on? Is it mostly your own stuff, or are you learning a lot of things written by others?

<comment><USER5> I work on Jazz mostly, but older Jazz. Which means I play a lot of scales. :-)

</comment></comment></comment></comment></comment><comment><USER7> Unless I'm mistaken there's no chapter about functional programming in Python (lambda functions, filter(), map() and reduce()).

I really think it's acceptable to introduce these function to newbies, I'll go as far as saying it's actually a good thing.

I like the chapter on automated testing.

<comment><USER8> He didn't cover defining first-class functions that I could see in a quick check, didn't cover generators, and I think most disappointingly, didn't cover __metaclass__. That's some critical stuff for Python programming right there, everybody needs __metaclass__.

Ahem.

You have to pick what to cover. For a _beginning Python_ book, I'm underwhelmed by the need to drag an entirely new and foreign(-to-Python) paradigm into the beginning Python. I say this as someone who does a lot of functional programming, someone who is using a lot of lambda, filter, map, and reduce is someone who is stubbornly refusing to program with the native idioms, which are named functions (defined inline is fine), list comprehension or loop, list comprehension or loop, and loop respectively. It is not that enormous a gain, and will lose from Python fighting you all the way. (Plus you'll probably miss some opportunities to use generators, overload the special methods, and the other things you can do with native idioms, if you're trying to program Haskell in Python.)

<comment><USER9> I have programmed literally hundreds of thousands of lines of python without using classes or __metaclass__, as a counter example.

When dealing in industry, we can't always hire the best talent, so there is no need to make things overly complex. Simple solutions work best for a lot of scenarios, and I haven't been limited by it yet.

Not to bash Perl, but the whole reason we write in Python is because there were too many people on our team writing in Perl using too many obscure constructs that took too long to review / revise (especially years later when team members changed and code was forgotten in parts)

<comment><USER10> Don't blame Perl. Blame the programmers and your methodology that allowed them to do that.

<comment><USER11> You can always delay fixing a social problem by switching technologies.

<comment><USER12> You're implying that language syntax is primarily technical rather than social. I'm not sure I can agree. The reason that Python code uses standard idioms most places you go is that the larger-scale Python community is committed to quite a different set of social norms than the Perl community.

Pulling in that language-community momentum can definitely make a difference to the social/technical dynamics inside a smaller group.

<comment><USER11> _You're implying that..._

... if you have multiple developers who cannot or will not find some way to write maintainable code, you have a problem independent of language.

I've maintained some hideous code written by people who had no business being professional programmers. In every case, adhering to a handful of very simple rules would have improved their code dramatically. Only one case needed a language change, and that one was away from a proprietary 4GL.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> I am learning python through this book at the moment. It is my first attempt at learning to code, so I have nothing to compare it with, but I must say that this book is very good.

My only gripe is that he poses certain questions/exercises that he fully expects us to solve, one way or another. But if we cannot; we're screwed. He does not give the answer. It has only happened once so far, but that was enough for me to miss out on what seems like a pretty crucial part of the book.

<comment><USER14> _He does not give the answer._

Welcome to graduate school! (And, for that matter, real life.)

As in grad school, the secret is: If you can't figure it out, ask around. Form teams that stay up until 3am waving their hands and sketching on chalkboards. If nothing else, it's a bonding experience that you'll treasure for life.

<comment><USER13> I get your message, but the problem is this is not grad school. This is a book; one way communication. I have no one to ask, as I am the only one I know who has an interest in coding.

Of course I can always ask on the web, but having to break off from coding, pose a question, and then wait for it to get answered before I can continue really breaks up my learning curve.

<comment><USER15> Asking clear questions _will_ help you learn. You can ask on Stack Overflow (or #python) - make sure to credit the source of your question[0] and at what point you are stuck. Often by trying to explain the precise thing that you don't understand, you will have a moment of zen.

[0] People will be a lot more helpful if they know you are trying to learn, rather than posting a "send me teh codes plz" request. Also they will hopefully give you just enough of a hint and not spoil the whole thing for you.

<comment><USER16> _Often by trying to explain the precise thing that you don't understand, you will have a moment of zen._

This.

I often find that I run into a problem, try to solve it on my own, then bring someone unfamiliar in to get a fresh set of eyes on it. It usually goes like this

Me: "Hey, I honestly can't figure out why this is doing this particular thing, can you take a look? <start explaining problem here in detail> ...FUCK! Nevermind, I know exactly whats going on. Thanks for your help"

Person I asked: "Huh?Uh sure? I can solve problems with my presence alone"

<comment><USER17> One of my professors in college would bring a small teddy-bear to the lab. Whenever one student wanted to ask a question, he would just put the teddy bear on top of the monitor, and you'd have to talk to the teddy bear first.

It seemed ridiculous, but it worked wonders. Most of the time said professor didn't have to open his mouth. It was just a matter of organizing your thoughts in a coherent way.

</comment></comment></comment></comment></comment></comment><comment><USER18> The last chapter (Advice From An Old Programmer) is very thought-provoking and slightly unnerving for someone who is studying CS

<comment><USER19> It's a lovely chapter! Thanks for pointing it out.

 _Programming as an intellectual activity is the only art form that allows you to create interactive art. ... . The world needs more weird people who know how things work and who love to figure it all out._

It's inspiring to see him talking about the beauty of (software) engineering as a means of making which has the quality of an art.

<comment><USER18> The chilling part is

 _Programming as a profession is only moderately interesting. It can be a good job, but if you want to make about the same money and be happier you could actually just go run a fast food joint. You are much better off using code as your secret weapon in another profession.

People who can code in the world of technology companies are a dime a dozen and get no respect. People who can code in biology, medicine, government, sociology, physics, history, and mathematics are respected and can do amazing things to advance those disciplines._

I have always had the suspicion that this is the case but now I have some validation

<comment><USER20> Yes. As a physician (pathologist) who is also a hobby-hacker that is particularly inspiring.

</comment></comment></comment></comment><comment><USER21> Zed,

May I suggest making it available in other formats, assuming that it is possible, once it is finished? Perhaps as text or HTML files in a tarball? Or even as an epub (for Nooks and iPad)?

<comment><USER22> The source files are written in rst(ReStructured Text) format, the standard documentation format for Python. Specifically using [Sphinx](<http://sphinx.pocoo.org>).

One of the default output formats IS HTML.

Build instructions on *nix:

        $ fossil clone http://learnpythonthehardway.org lpthw.fossil
        $ mkdir lpthw
        $ cd lpthw
        $ fossil open ../lpthw.fossil
        $ make html
        $ open _build/html/index.html

To install sphinx:

        $ easy_install sphinx

or

        $ pip install sphinx

Here you go: a zipped file containing HTML files on google docs. [https://docs.google.com/leaf?id=0BzdipdlNhpRrNWNmYjFlNmMtZTl...](https://docs.google.com/leaf?id=0BzdipdlNhpRrNWNmYjFlNmMtZTlhNC00NTk2LWE1NmItNzYyYTgwZDY1NzEx&sort=name&layout=list&num=50)

<comment><USER5> Please don't put it online in HTML just yet. I need to get it edited, and I'm afraid people will put versions of the book up in HTML format with errors and problems. Once the book is 1.0 then I'll have it online and anyone else can put it online. Can you take your link down please?

<comment><USER22> I've taken down the doc.

<comment><USER5> Thanks. I appreciate it.

</comment></comment></comment></comment></comment><comment><USER23> Nice, but that's an annoying license. I'm tempted into porting his assignments to Ruby, but do to licensing I'll need to do them completely separately - <USER2> can't make a cohesive document out of it.

Ah well. His prerogative I suppose. Just makes me feel like "teaching people to program" isn't his primary goal.

<comment><USER5> Don't copy, imitate. The book was very easy to write. Just lay out 52 exercises, 26 for super basic stuff, 26 for progressively more advanced stuff. Take about an hour or two every night and write a couple. Pretty simple really. You may not have my style in your writing, but you'll definitely get a book that is more Ruby than what I've written.

One warning though, if you think it'll be better to have the book crowdsourced, think again. Programmers seem to be pretty bad at teaching programming, so it's best to just write your book and have people give you feedback as you go.

</comment></comment><comment><USER24> I have read the first 20 pages. Excellent! Very well done. Great advice. Fun / proven way to learn. Thanks Zed!!

<comment><USER5> You're welcome. Remember if you run into errors, just submit a ticket for it on the learnpythonthehardway.org web site and I'll fix them up.

</comment></comment><comment><USER25> Very nice. I just randomly choose to view the arguments unpacking section and found a defect (no example given on pg 36 for passing in only two args instead of all three, but later cited as "see how I passed in two args"). Created a ticket.

<comment><USER5> Thanks, I think I fixed it but the ticket is kind of vague:

[http://learnpythonthehardway.org/tktview/08a86ff3098eae91d8c...](http://learnpythonthehardway.org/tktview/08a86ff3098eae91d8c3f9d562200cd6a8b7ab48)

Update it for me if I didn't understand what you think should be done.

<comment><USER25> Yeah that's it exactly. You never show

        python script.py only two_args

Just the traceback. It might be confusing to a newbie.

</comment></comment></comment><comment><USER26> I am training myself in Python with this book from a week or so.

I know how to code in other languages and programming basic so I am not a first time coder... yet this little book is absolutely useful and I am enjoying it exercise after exercise.

Learning trough practice FTW!

Thank you Zed.

<comment><USER5> Fantastic. Keep on plugging through and if you hit any problems just ask me. I'm on twitter @zedshaw so just ask and I'll help.

</comment></comment><comment><USER27> Loved the final chapter.

At the end of the day, it's not about functions or closures or monads. It's about building something interesting or useful. Whether you used php or arc is not relevant.

</comment><comment><USER28> Thankyou Zed, I'm going to give this a proper read-through before probably using it to help teach a friend how to learn to program.

</comment><comment><USER29> I recommended this to a new hire (frontend HTML/JS guy, but wants to learn Python). He really found it easy to get into, and appreciated the exercises. Thanks for publishing it.

</comment><comment><USER30> Cool. Why isn't it 1.0?

<comment><USER31> Because he "…will now be editing it and doing the index," presumably.

<comment><USER30> Good point. Thank you.

</comment></comment></comment><comment><USER32> I was looking forward to reading through this until I found out that I will go insane.

\-- It was a joke.</comment>


Postmedia Ad Blocker - <AUTHOR> https://github.com/gpitfield/postmedia-ad-blocker <comment><AUTHOR> Postmedia owns the leading daily newspapers in most Canadian cities. They required the papers' editorial boards to endorse the Harper government in our current federal election. Given the scope of their ownership and reach, this is a remarkable perversion of the press in favor of a couple of hedge funds who own Postmedia. I built an ad (and paywall script) blocker targeted only at their properties, and plan to submit to Apple later today. Pull requests welcome.

<comment><AUTHOR> Should also add that it can be installed directly via [https://github.com/gpitfield/postmedia-ad- blocker/blob/maste...](https://github.com/gpitfield/postmedia-ad- blocker/blob/master/postmedia.safariextz?raw=true)</comment></comment>


Ask HN: Tips about selling software to management consulting firms? - <AUTHOR>

Do any HN readers have insights about selling software to large management consulting firms like McKinsey? We realised that the tool our team is building could also be useful for management consulting firms, but we don't really have experience in that area.
Do they try and buy new software regularly? It would make sense that they are a more forward-looking than their clients.
Can you sell to a team inside the company and expand from there, or do they have a global IT department with a strict rules?
Do they expected a lot of polish from the product, or are they willing to try a beta product, if it solves a real problem for them? <comment><USER2> I have worked for Accenture & Deloitte as a consultant and for many years and have implemented software used for internal teams.

It surprisngly works very similar to any other industry company. The software to be used internally comes from the top of the food chain and then pushed on to projects below it.

The goal is standardization across projects, so I think it would be extremely tough to use an "un-tested" or un-authorized tool at a project level without it coming from the top of the chain first.

Especially McKinsey where the process & methodologies are very defined. It would start from the top and then maybe use a "pilot" project for a small engagement.

They are often forward looking for their clients, but not forward looking internally if that makes sense.

Usually there is a "Tools & Methodology" team that is an internal team and that is who you should be selling to. This is the team that defines the tools that are used for projects.

I hope that helps.

<comment><AUTHOR> Thanks a lot, very valuable. I'm going to interview a few people that have a background in these companies, good to have a realistic base line.

</comment></comment><comment><USER3> In my experience (selling to management consultancies interested in proprietary data rather more than the SaaS wrapper for it) management consulting firms' software needs and budgets are often very driven by specific projects, and if it solves a project-specific need they'll be very happy with an unpolished product so long as it can be budgeted for. The way they organise themselves also varies a lot, but if impressing partners or senior consultants with a need to solve a specific problem is probably a better route in than their back office IT purchasing function.

They're also perhaps less respectful of license agreements than you might expect...

<comment><AUTHOR> Thanks a lot! any war stories to tell about those license agreements?</comment></comment>


Pharmaceutical Coding (Writing more code to fix problems your code caused) - <AUTHOR> https://maddie.today/pharmaceutical-coding/ <comment><USER2> I once worked on a component so badly designed that I described the process of testing and fixing it as "software medicine" instead of "software engineering". The slightest change impacted a seemingly infinite amounts of variables in unseen ways, that the entire application would need to be restudied if only one part of it was changed. It was almost like testing the effects of a pill on a human.</comment>


Forbes won't let you in with AdBlock on - <AUTHOR> http://www.forbes.com/forbes/welcome/ <comment><USER2> Then I guess they will loose me as an audience.</comment>


Privacy is tech's latest marketing strategy - <AUTHOR> http://www.washingtonpost.com/blogs/the-switch/wp/2014/09/26/privacy-is-techs-latest-marketing-strategy/ <comment><USER2> The picture of FBI Director James Comey alone is worth the click. I assume it is a wildly popular meme on reddit right now.</comment>


Wrongfully convicted Isaac Wright Jr returns to courtroom as an attorney (2017) - <AUTHOR> https://medium.com/@tjbdaily/wrongfully-convicted-isaac-wright-jr-returns-to-the-same-courtroom-as-an-attorney-985b40c96ed8 <comment><USER2> >Wright then passed the New Jersey Bar in 2008, but spent the next nine years being investigated by the New Jersey Bar's Committee on character before being granted admission to the bar by the New Jersey Supreme Court on September 27, 2017, where he was officially sworn in as a licensed attorney

What the hell? Seven years to overturn his false conviction, seven years to get a law degree, and nine years for the Bar to recognize him?

<comment><USER3> This is just to give you an idea of how corrupt to the core the system is before you get your hopes up.

</comment></comment><comment><USER4> Reading this gives me hope. It also makes me angry. That he had to fight at all. That for every Isaac there are many unknown innocent that were wrongfully convicted.

</comment><comment><USER3> If I saw thins in a movie I'd this "Oh come on!". And yet here it is, in real life. A story that beats any movie...

<comment><USER5> Right, I just read the article and wow!! What a story. How has this not been turned into a movie or book yet? Amazing!!

<comment><USER6> The article mentioned his story will be made into a TV series produced by 50 cent.</comment></comment></comment>


Nocturnal bottleneck - <AUTHOR> https://en.wikipedia.org/wiki/Nocturnal_bottleneck <comment><AUTHOR> > The nocturnal bottleneck hypothesis is a hypothesis to explain several > mammal traits. The hypothesis states that mammals were mainly or even > exclusively nocturnal through most of their evolutionary story, starting > with their origin 225 million years ago, and only ending with the demise of > the dinosaurs 66 million years ago.</comment>


How the Promise of a $120B Uber IPO Evaporated - <AUTHOR> https://www.nytimes.com/2019/05/15/technology/uber-ipo-price.html <comment><USER2> Interesting read for sure. On the one hand when it comes to wall street it is considered a failed IPO, however if you look at the amount of money that Uber raised and the valuations at which it did it, it seems like it was able to raise at over $50B for the past couple of years with promises of a larger valuation in the future. Then when it IPO'd below $80B still raising another large financing it basically equated to the smallest amount of dilution to the company and the largest amount of capital raised.

So from a money raising perspective it's been great. From a retention package for employees it's definitely a rocky start.

However, people put too much emphasis on the IPO anyway. Square IPO'd at $6B, went to $3B, and now is above $30B.</comment>


Show HN: HN Demetricator – An extension that removes upvote and comment counts - <AUTHOR> https://github.com/brian-yu/hn-demetricator <comment><USER2> I'm curious, do others perceive undeserved upvotes as an issue? As far as communities like this go, I think HN is pretty fair about what kind of content is valuable.

Sure, maybe some high-quality niche articles don't get a ton of attention, but that's the nature of writing about niche topics.

<comment><USER3> I have a problem with people down voting things that they disagree with and up voting things they agree with. I had always assumed that voting was for "quality of post" and not for agreement.

I see this same scenario played out in many forums where a very good, high quality comment is made which quotes what "someone" said and subsequently heavily down voted because of the person that said it. In other words, the message is quashed because of the person that said it, and not because of the message itself... this is a sad testament to online dialogue.

<comment><USER4> Apparently that's their intended function according to mods[0] I just prefer downvoted comments don't turn grey just because some may disagree with it, it's an annoying UX personally, as I've actually found some interesting information I hadn't previously been exposed to from comments a few people decided they disagreed with.

[0] [https://news.ycombinator.com/item?id=17996858](https://news.ycombinator.com/item?id=17996858)

<comment><USER3> I have a problem with the greyed out posts because they are difficult to read with my poor eyesight. I usually select them with the mouse so they are highlighted, which makes them easier to read.

<comment><USER5> I always assumed that's what you were supposed to do anyway. If it's just slightly downvoted it is still somewhat readable but after that it gets hard to read quick. I don't think this has much to do with eyesight, it's by design. I guess poor eyesight might make it hard to distinguish between normal and slightly downvoted comments, but that's not too important a distinction anyway.

</comment></comment></comment></comment></comment><comment><USER6> Great idea. I have been having this idea for years of doing a little stream editing to change the color of the grey text to match the other comments. But I use a text-only browser so I cannot see text colors anyway.

I think what happens is we learn to "play to the crowd" when posting comments, knowing certain "inside the box" ruminations will garner support. This seems almost like a form of self-censorship that we are doing, sometimes without even realising it.

Is there really any definition of a "vote"? It is ambiguous. Better that we ask commenters "Is this what you mean?" Many times voters are probably misinterpreting comments. It is quite challenging to write comments where every single reader gleans the same meaning.

Another idea is you could pull new comments from the Firebase endpoint and insert them into their respective threads, randomising the order, or maybe just have chronological order. It would be an interesting experiment, if nothing else.

The web today has seemingly become a series of filtered, ordered "lists" where the top spots are the only content that is deemed to matter (and, for the vast majority, the only content that is seen). Not saying this is necessarily ill- advised, but one has to consider the effects, which are becoming more difficult to understand as we lose _the ability to choose_ non-opinionated ordering (alpha, chronological, etc.).

<comment><USER4> _Better that we ask commenters "Is this what you mean?" Many times voters are probably misinterpreting comments._

I've observed two interesting outcomes from this, even as someone who has challenged himself to seek clarity and understanding by asking more questions:

\- People who ask for clarification are downvoted heavily for reasons that I can't assume (this happened a few weeks ago, it was a positive interaction with the person who inquired of me, and I enjoyed the back and forth: their questions were relevant, they sought clarity and they were polite and deferential, I told them as much-yet all of their posts in our conversational bivouac were heavily downvoted by parties never revealed themselves or what their problems with the questions were)

\- People who are asked _for_ clarification take it as a sneaky and underhanded attack (this happened two days ago, I asked someone if they could expand on a one-line comment because I was having trouble understanding the intention of the comment, someone else came along and called me a troll).

Both of these are anecdotes, but not isolated ones, if you'll permit the examples as far as pleasant conversation here will allow. I don't have solutions, it's just...there's an awful lot of _assuming_ going on even _when_ people ask questions is my observation.

<comment><USER6> Always strikes me as somewhat bizarre than there can be "bystanders" to "1-to-1" conversations had on HN and then these folks cast "votes" on the conversation. Yet they are not taking part in the conversation.

</comment></comment></comment><comment><USER7> To offer a different perspective, I find upvote counts useful.

Part of why I'm on HN is to follow the community and understand what the community finds important.

In practice I read submissions that look interesting to me and I also read those that received an unusually high number of votes, even if I find them uninteresting or disagree with them.

</comment><comment><USER8> I've worked on some rules for this in my similarly motivated extension Disengaged[0].

Another thing it does which I think helps a lot is automatically collapses subreplies.

[0] [https://github.com/a13o/disengaged](https://github.com/a13o/disengaged)

<comment><USER9> This looks incredibly interesting. Going to give it a try.

</comment></comment><comment><USER10> Everything that's on the front page is massively upvoted already anyway. I'd suggest checking the 'new' tab from time to time instead.

<comment><USER11> You can get on the front page with a handful (~5) upvotes, as long as they come in fast enough.

<comment><USER10> Sure, I'm not arguing the front page is useless or anything. In general I find it very useful for getting a quick overview of what's up. However, it's still a tiny fraction of all posts on HN. It's a bit like hiding the relative wealth among the 30 richest people worldwide in order to not let the information about their wealth affect what you think about each of them.

</comment></comment></comment><comment><USER12> I have a similar script, except that it removes posts that link to domains that I've found to frequently be non-interesting or low-quality.

[https://gist.github.com/scott113341/56c03bc7f285eefbea0a6146...](https://gist.github.com/scott113341/56c03bc7f285eefbea0a6146bcb59134)

</comment><comment><USER13> I actually kind of miss being able to see comment vote counts.

Now you can only see that a comment is voted higher or lower than its siblings, if any. The vote count could show you that HN thought a comment was 50 times better than a sibling, or whatever. Of course it's subjected to biases, but rank-order voting is as well in basically the same ways, but the absolute count just gives you more information.

(re: a bias towards first-mover advantage specifically, we should obviously have an exponentially weighted moving average of the votes over time decayed to the current timestamp rather than an absolute vote count, of course.)

</comment><comment><USER14> Great. I think that social media concept is awesome. I want to follow people in my feed, I want to create discussions with them.

But how those main social networks did it, with likes or other shallow simplifications of human response, with not showing stuff from those I follow in a linear order, instead pushing "engaging" content to my face, is just terrible.

</comment><comment><USER15> I personally rely on frontpage and comment count as an indicator as to weather I should spend anymore time to read that article/comments. I do read all titles though so metrics are not the only factor.

I do realize that in using HN in this way I'm "leeching" off of hn curators work rather than contributing to curating new things myself...

<comment><USER16> Personally, I place more weight on comment count than vote count. If I'm here for interesting articles, people discussing a topic is more interesting than votes. The only use votes have is for seeing how controversial a submission is.

</comment></comment><comment><USER17> I wouldn't see a good point for this. HN is focused on these counts, because only they allow you to identify the "importance" and "discussion size". Would be like twitter without a like and retweet counter. How do I know its important? Is it something I support and give a like, to boost its rank?

Something like [1] is more useful than hiding information.

1: [https://news.ycombinator.com/item?id=23804469](https://news.ycombinator.com/item?id=23804469)

<comment><USER18> > how do I know it's important?

This is an interesting topic. I'm working on a new discussion site (sqwok.im) and I explicitly opted to exclude voting. Instead to determine importance I'm using a combination of signals like live activity, publish date, etc, with plans to include further ones at a later time. I echo the sentiments from other commenters and even pg himself in regards to groupthink, and I feel that there's room for exploration on other alternatives.

<comment><AUTHOR> That's a really interesting premise! I'm going to keep an eye on sqwok.

<comment><USER18> Thanks I appreciate it, and hope to chat with you on sqwok! It's amazing how much the state of online discussion is being surfaced on HN and elsewhere lately... I don't have all the answers, but I believe we need more options and different perspectives to hopefully open the door to a better state of discussion online. cheers!

</comment></comment></comment></comment><comment><USER19> Upvoting this, ironically enough.

</comment><comment><USER20> i use ublock rules to hide scores and disable downvoted comment fading, but i haven't blocked comment count. HN has been much better for me since making these changes.

<comment><USER21> Mind sharing your code?

<comment><USER20> this is what i use:

      news.ycombinator.com##html .pagetop:style(color: rgba(0,0,0,0) !important;)
      news.ycombinator.com##html .score
      news.ycombinator.com##html .default .commtext:style(color: black !important)

</comment></comment></comment><comment><USER22> I tried to build a similar extension for Stack Overflow that would remove the downvote button and close button, but it got rejected by the Chrome Web Store :(

<comment><USER23> do it as a greasemonkey script

</comment></comment><comment><USER24> I'd really like a bigger hide button.</comment>


Ten bucks left, no place to go - <AUTHOR> https://www.washingtonpost.com/local/coronavirus-unemployment-delays-dc/2020/08/01/50016264-c522-11ea-8ffe-372be8d82298_story.html <comment><USER2> how much does a person like him earn in a normal month? and what is the expenditure? can someone give a breakdown</comment>


Ex-AWS engineer does an AMA - <AUTHOR> http://www.reddit.com/r/IAmA/comments/1e5o4p/iaman_exaws_engineer_ask_me_anything_about_the/

<comment><USER2> Kudos.

I got more info about AWS internal here than following jeff bar and other AWS evangelists in last 5 years.

<comment><AUTHOR> Yes that is what I was thinking..</comment></comment>