OpenSSL site defacement involving hypervisor hack rattles nerves - <AUTHOR> http://arstechnica.com/security/2014/01/openssl-site-defacement-involving-hypervisor-hack-rattles-nerves/ <comment><USER2> _Fortunately, the attackers didn 't, or weren't able to, use their access to slip backdoor code into the OpenSSL software, which websites around the world use to provide HTTPS encryption for the pages they serve. That assurance is possible because the code is maintained and distributed through Git, a source- code management system that allows developers and users to maintain independent copies all over the Internet. Since the cryptographic hashes found on OpenSSL matched those elsewhere, there is a high degree of confidence the code hasn't been altered._

A few days ago I posed the question of whether Git's crypto is an example of dangerous amateur cryptography, since Linus isn't (AFAIK) a crypto expert: [https://news.ycombinator.com/item?id=6961683](https://news.ycombinator.com/item?id=6961683)

The general answer I got was that Git isn't really crypto, because it isn't using the hash to guarantee integrity, but simply as a checksum to detect corruption.

I didn't find this argument very convincing at the time, and I would now offer the above quotation as evidence that people do in fact treat Git's hashes as a security mechanism that can withstand an adversarial attack.

<comment><USER3> Indeed. Assuming the rest of the code is implemented without any vulnerabilities (and that's one hell of an assumption about any code), SHA1, which Git uses as its hashing algorithm, has been completely broken as early as _2005_ [1].

That said, I'm not sure how you'd go about crafting source code in such a way as to collide with a known hash without it being amazingly obvious. You could change history to make it appear as if your crocked code was always there or had been for a long time, but then you don't have to figure just one hash, then you have to figure every single hash down to the parent. Depending on the number of commits, that's a hell of a lot of work, even with an algorithm to break SHA1.

And even then if you change the hashes, since Git is distributed, the developers will quickly figure out that what's in one repo doesn't match all the others when patches start breaking..

[1] - [https://www.schneier.com/blog/archives/2005/02/cryptanalysis...](https://www.schneier.com/blog/archives/2005/02/cryptanalysis_o.html)

<comment><USER4> Your definition of "completely broken" is misleading.

While it makes complete sense to use SHA-256 and beyond, a collision of two carefully constructed plaintexts is not indicative of a general break in SHA-1. It is much more difficult to find a collision against a fixed plaintext and hash and ridiculously more difficult for that collision to produce non- gibberish, working code that compiles and creates a vulnerability.

<comment><USER5> I'm no expert, at all.

Reading your list of complications though I wonder if the last one is really a problem? Hiding a vulnerability that doesn't look suspicious on first sight? Agreed. But hiding a vulnerability at all - if compiled without reading the source? Isn't that 'just' appending /* garbage */ or even code in IFDEFs? In other words: Is the last point really an issue or is it 'just' a collection against a fixed plaintext/hash?

</comment></comment></comment></comment><comment><USER6> Have there been recent public disclosures of vulnerabilities in hypervisors?

Breaking out of virtual machines is a really interesting process but it's important to remember that a hypervisor can be attacked with pretty much the same techniques you can attack any other program. Virtual machines aren't a magic contain-all-the-hackers solution. There was an interesting talk on DEFCON 19 about breaking out of KVM: [http://www.youtube.com/watch?v=tVSVdudfF8Q](http://www.youtube.com/watch?v=tVSVdudfF8Q)

<comment><USER7> This was a pretty big deal in 2012: [http://www.vupen.com/blog/20120904.Advanced_Exploitation_of_...](http://www.vupen.com/blog/20120904.Advanced_Exploitation_of_Xen_Sysret_VM_Escape_CVE-2012-0217.php)

</comment></comment><comment><USER8> There may be some alarmism getting started here. "The attack was made via hypervisor through the hosting provider" can be interpreted in several ways and (to me) doesn't necessarily indicate a hypervisor exploit. It sounds like it could be similar to the Linode admin access hack.

<comment><USER9> i may be misunderstanding (there seem to have been at least two famous hacks on linode), but why would you use the word "hypervisor" to explain that someone had hacked your host's admin account? isn't the presence of that word (the h word) what makes this (potentially) scary?

also, will htp ever come back from exile? (not that it seems too unhappy where it is).

<comment><USER8> There have been pretty much no hypervisor exploits seen in the wild but plenty of admin hacks. (This is basically the same as Andrew Hay's argument.) I want to give the OpenSSL people the benefit of the doubt when they say they saw Bigfoot, but... are they experts in virtualization? Or are they using loose terminology (e.g. considering dom0 or vCenter to be the "hypervisor")?

(HTP is stuck in the scarcity trap, so I should probably block off a weekend to work on it.)

<comment><USER7> Here is a pretty big one from 2012 that was discovered by Rafal Wojtczuk: [http://www.vupen.com/blog/20120904.Advanced_Exploitation_of_...](http://www.vupen.com/blog/20120904.Advanced_Exploitation_of_Xen_Sysret_VM_Escape_CVE-2012-0217.php)

It didn't get a huge press release and media coverage but it was a pretty big deal. Probably because there weren't any 0day exploits floating around at the time so this flew under the radar of the mainstream.

[http://blog.xen.org/index.php/2012/06/13/the-intel-sysret- pr...](http://blog.xen.org/index.php/2012/06/13/the-intel-sysret-privilege- escalation/)

[http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2012-0...](http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2012-0217)

[http://invisiblethingslab.com/itl/About.html](http://invisiblethingslab.com/itl/About.html)

</comment></comment></comment></comment><comment><USER10> No.

Simple logic: The defacement was amature at best. If the group has a 0-day in a hypervisor they would have gone to multiple hosting companies and multiple attacks would have taken place, there are many more targets that are worth much more than openSSL.

Most likely, the administration panel of the hosting company was comprimised through malware/phishing. Seriously, if a group like this had a 0-day in hypervisor then they would be doing much much more damage.

<comment><USER11> Defacing OpenSSL's website might be low-value, but backdooring OpenSSL code (trusting-trust style!) would be about as high-value a target as I could imagine.

<comment><USER12> If they were smart enough to backdoored the code, I'd hope they were smart enough to be as stealth as possible and not deface the site too.

<comment><USER13> There's no way to know that there was only one party involved.

In other words, who's to say that the NSA (/GHCQ,etc) was the same party that ultimately defaced the website?

</comment></comment></comment></comment><comment><USER14> This doesn't surprise me one bit if its a hypervisor hack. You have to design in this stuff from day one rather than tack it on as an afterthought. To quote Theo de Raadt on virtualization, who I agree with:

 _" x86 virtualization is about basically placing another nearly full kernel, full of new bugs, on top of a nasty x86 architecture which barely has correct page protection. Then running your operating system on the other side of this brand new pile of shit.

You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes."_

</comment><comment><USER15> may as well link directly to OpenSSL's post on it (which says the same thing) [0]. Also, assuming the traceroute on www.openssl.org is correct, this[1] is their webhost.

[0] [http://www.openssl.org/news/secadv_hack.txt](http://www.openssl.org/news/secadv_hack.txt)

[1] [http://www.indithosting.se/](http://www.indithosting.se/)

</comment><comment><USER16> Related:

"Virtually Impossible: The Reality Of Virtualization Security" talk video from 30C3 a few days ago: [http://media.ccc.de/browse/congress/2013/30C3_-_5445_-_en_-_...](http://media.ccc.de/browse/congress/2013/30C3_-_5445_-_en_- _saal_6_-_201312292145_-_virtually_impossible_the_reality_of_virtualization_security_- _gal_diskin.html)

Slides from apparently same talk from Defcon Russia: [http://www.slideshare.net/DefconRussia/gal-diskin- virtually-...](http://www.slideshare.net/DefconRussia/gal-diskin-virtually- impossible)

</comment><comment><USER17> I think it's common to use "hypervisor" to refer to "hypervisor host" (and usually not "hypervisor software").

I've been hearing this usage more often these days.

</comment><comment><USER18> There is a suggestion it could be an open admin access [http://www.andrewhay.ca/archives/2343](http://www.andrewhay.ca/archives/2343)</comment>


Verizon will offer free spam protection to all of its customers - <AUTHOR> https://www.theverge.com/2019/1/18/18188140/verizon-free-spam-robocall-protection <comment><USER2> Talking about telemarketers, I think I have read a nice article about this topic at [https://www.whycall.me/news/my-4500-payday-from-a- telemarket...](https://www.whycall.me/news/my-4500-payday-from-a- telemarketer/). It's nice to see tech companies which are willing to help customers to fight against spammers. I really hope that the government will take this telemarketing call problem seriously.</comment>


How Twitter can kill the Twitter-killers - <AUTHOR> http://www.scripting.com/stories/2010/04/09/howTwitterCanKillTheTwitte.html

<comment><USER2> great insight from dave winer on the coming twitter wars</comment>


Php Inspections (EA Extended): find and fix bugs automatically on the fly - <AUTHOR> https://plugins.jetbrains.com/idea/plugin/7622-php-inspections-ea-extended- <comment><AUTHOR> Php Inspections (EA Extended) is a Static Code Analysis tool available as PhpStorm/IdeaUltimate plugin. The plugin adds a load of new customizable inspections to the IDEs.

What makes this tool special: it boosts up your productivity without interrupting workflow: on-the-fly analysis and quick fixes are at your service.

* Short introduction video: [https://codereviewvideos.com/course/phpstorm-shortcuts/video...](https://codereviewvideos.com/course/phpstorm-shortcuts/video/become-a-better-developer-with-php-inspections-ea-extended)

* Getting started: [https://github.com/kalessil/phpinspectionsea/blob/master/doc...](https://github.com/kalessil/phpinspectionsea/blob/master/docs/getting-started.md)</comment>


You can't get entangled without a wormhole (2013) - <AUTHOR> http://newsoffice.mit.edu/2013/you-cant-get-entangled-without-a-wormhole-1205 <comment><USER2> When I watched the Leonard Susskind lectures on quantum entanglements he said the whole "communicating faster than light" thing is a bit misleading. The analogy he gives if imagine you have two coins and you ask someone to turn them over so one is heads and the other tails then you give them to 2 people without them knowing which is which, then they go to opposite ends of the universe, and they look at their coins, they instantly know the state of the other coin purely by deduction.

<comment><USER3> From what I've read, the rub is that you don't know which side of the coin the current one is until you observe it, and only at the exact time of observation does the other coin assume the other state.

Apparently, the point at which you observe the one coin is called the collapse of the wave function, and we have ways of directly measuring that the collapse doesn't happen until one of the particles is observed. (But it's never been too clear to me how that's possible... if observing a particle collapses the wave function, how do we observe _when_ the collapse happens, without first observing the particle?)

<comment><USER4> The problem with the 'collapse' point of view is that it's easy to say "and thus only the observation we saw actually exists". But that's an extra postulate beyond asserting the wavefunction describes all of reality. By just saying the wavefunction describes all of reality, you wind up with Many- worlds: [http://en.wikipedia.org/wiki/Many- worlds_interpretation](http://en.wikipedia.org/wiki/Many- worlds_interpretation) So the coins/paper analogies do make sense, except that there's not a single outcome: there are two possible outcomes, both realized, but each version of you interacting ("observing" is a loaded term) with the system to the point of decoherence ([http://en.wikipedia.org/wiki/Quantum_decoherence](http://en.wikipedia.org/wiki/Quantum_decoherence)) only ever get to see one of the worlds, which is the one you find yourself in. This isn't that mysterious given that your brain and everything else in your body are made of the same fundamental particles as everything else.

You highlighted a problem with quantum computers and other things: how to make sure a system is in a quantum state without directly measuring it. It's hard to fight decoherence.

</comment></comment></comment><comment><USER5> The paper: [http://arxiv.org/pdf/1307.6850v3.pdf](http://arxiv.org/pdf/1307.6850v3.pdf)

</comment><comment><USER6> Stop stop stop saying "communicating at a distance." They may be formed or placed into an "entangled" state, but they aren't communicating through any physical wormhole.

It's waves all the way down. And string theory? Someone pass the arxiv...

</comment><comment><USER7> This is pointed out in the research article, but the overall idea that matter- antimatter pairs created in the vacuum are connected by a wormhole is due to Wheeler. The twist here is that the result is obtained by applying ADS-CFT duality first, so the calculation is done in a 5 dimensional gravitational theory. A more accurate statement would be that under ADS-CFT an entangled particle state in 4 dimensions probably can be modelled as a wormhole in the gravity dual, which is not entirely surprising.

</comment><comment><USER8> Like everyone else here says, entanglement doesn't give rise to FTL communication. So can someone explain to me how this paper even exists / has anything to explain via wormholes?

</comment><comment><USER9> if this is validated it might be the single most important piece of proof in our lives we just don't know it yet...</comment>


JavaScript: The First 20 Years - <AUTHOR> https://zenodo.org/record/3707008 <comment><AUTHOR> authors are Allen Wirfs-Brock, editor of ES2015, and Brendan Eich, creator of JS. Here is Allen's blogpost about it: [http://www.wirfs- brock.com/allen/posts/866](http://www.wirfs-brock.com/allen/posts/866)</comment>


Fred Wilson on why USV did not invest in Uber - <AUTHOR> http://www.cnbc.com/2017/05/17/fred-wilson-on-why-usv-did-not-invest-in-uber-at-techonomy-nyc.html <comment><USER2> that is not accurate. we did not invest in Uber because we passed on the opportunity in the Srs B.

my comments about Uber have nothing to do with that decision, which sure looks foolish in hindsight.

my comments are more about what i think is going on now.

i hope that clarifies things</comment>


Eleven Days in Verizon Hell - <AUTHOR> https://medium.com/backchannel/11-days-in-verizon-hell-74f08f9782b6

<comment><USER2> The fact that Verizon hates their copper customers is nothing new - I had a VZ tech tell me in 2008 that they were effectively abandoning their copper network in my neighborhood and they wouldn't be fixing my line in any way that would increase reliability. Only bubble gum and bailing wire for the squeakiest wheels. Nothing has changed since then. That the FCC lets Verizon get away with this abandonment of the copper network that they have to share in favor of a fiber network they can keep to themselves should be a crime punishable by having to use VZ DSL at the limit of the CO's range.

</comment><comment><USER3> It could be worse. Verizon could sell these customers to Frontier, like they did to me a while ago.

Actually I don't think Verizon wants _any_ landlines any more. It's been quite a few years since they announced they would stop new FiOS deployments. Have they changed that decision?

The end game now that Verizon owns 100% of Verizon Wireless is probably that Verizon spins off landlines altogether. Bye bye expensive union-negotiated defined benefit pension plans.</comment>


An iOS app to provide feedback on your posts before you Tweet or Facebook - <AUTHOR> https://www.imhoapp.com <comment><USER2> So this is like self-moderation? Where did the idea come from?

<comment><AUTHOR> The concept for 'imho' came about two years ago when I was watching a celebrity interview, where the difficulty of staying grounded when living within a 'hollywood bubble' was posed by the interviewer. This was the spark for the idea behind 'imho', where it was recognised that many users on social networks exist in something of an 'echo chamber' or 'social media bubble' of their own with objective feedback rarely received on posts. We all have friends who 'overshare' on Facebook, or those who post deliberately cryptic posts 'vaguebooking' with the aim of inviting friends to ask what's going on. Facebook users will get plenty of feedback on positive, funny or cute posts and pictures, but much less so for negative or offensive posts, and rarely is it objective feedback. On Twitter, the median number of followers for an average user is much less than one hundred, and with the ability to block or silence, most posts will get little or no feedback more often than not. The imho app is designed to be a lighthearted way to get objective feedback on your social networking posts outside of your usual friend circle. You can get feedback on things you've already posted to Facebook or Twitter, or write posts natively within the app with the aim of getting feedback before you post to a social network. It's a bit like quick and dirty market research, where the products being tested are your (very) public, and permanent broadcasts to the world.</comment></comment>


How Ping Might Grow - <AUTHOR> http://daringfireball.net/2010/09/how_ping_might_grow

<comment><USER2> Prize goes to RyanMcGreal: <http://news.ycombinator.com/item?id=1659802>

<comment><USER3> I chuckled, but - to be fair - Gruber's article hardly suggests that Ping is "smarter than you think" or that it will "prove the naysayers wrong".

In fact, I find the meekness of the article interesting. Maybe it's an acknowledgement of Ping's lack of current success that Gruber couldn't think of anything more exciting than "Here are some general ideas for why Ping _might_ grow some day."

</comment></comment><comment><USER4> Gruber is so predictable

 _RyanMcGreal 4 days ago_

       Next week on Daring Fireball: *Why Ping is much smarter than you think and will prove the naysayers wrong.*

<http://news.ycombinator.com/item?id=1659802>

</comment><comment><USER5> Can Ping recover from such a lame initial offering, though? Will people who checked it out now and decided it was lame ever come back?

<comment><USER6> What % of the 9-digit number of iTunes users do you think has even downloaded iTunes 10 and noticed the Ping tab on the side?

What % of users will be _extremely_ excited to know they can follow what Katy Perry and Cold Play are doing?

Which of those two numbers do you think is larger?

<comment><USER7> The answer to your first question seems to be 33% [+] but that number could be skewed because early downloaders might be well aware of the new features and more likely to try them out.

[+] <http://www.apple.com/pr/library/2010/09/03ping.html>

</comment></comment></comment><comment><USER8> My baseless suspicion is that Ping, like iTunes LP, is just something Apple did to keep the record industry happy. Someone important probably had a revelation, 5 years too late, that they need to get in on that social thing the kids like so much and Apple was more than happy to placate them. I agree with Gruber that it could turn into something more down the road but at this point Apple's heart obviously isn't in it. Maybe because all the pieces aren't in place yet. I could imagine Ping looking a lot more like Lala 6 months from now when all the right deals are signed.

</comment><comment><USER9> _But, clearly, Apple created Ping to drive the sale of additional music — and I think that's why Ping isn't a standalone app — if it were, then clicking a "Buy" link in Ping would take you from the (hypothetical) Ping app to the iTunes app. Then you'd have to remember to switch back to Ping to get back to where you were._

I don't know how iPhone users live without a back button.

edit: really folks?</comment>


Fertilizer plants emit 100 times more methane than reported - <AUTHOR> https://www.sciencedaily.com/releases/2019/06/190606183254.htm <comment><USER2> Actual paper here: [https://www.elementascience.org/article/10.1525/elementa.358...](https://www.elementascience.org/article/10.1525/elementa.358/)

My conclusions:

* A carbon tax would be nice to incentivize accountability around net- greenhouse gas contributions.

* This paper does quite a bit of probabilistic inference here. They conclude, for example, that the ~two orders of magnitude difference in emissions implies the model is working. ( [https://www.elementascience.org/article/10.1525/elementa.358...](https://www.elementascience.org/article/10.1525/elementa.358/elementa-7-358-g4.png?action=download) ) This isn't super surprising since they're trying to measure methane emissions ~a km away from the source, but should measure our expectations.

Also, the whole dataset is available here ([https://oneshare.cdlib.org/stash/dataset/doi:10.15146/R3WT2N](https://oneshare.cdlib.org/stash/dataset/doi:10.15146/R3WT2N)) if anyone is interested. Props to the authors for including it.

(Disclosure: My company buys quite a bit of inorganic fertilizer every year. None of it is US sourced though as we're operating in subsaharan Africa.)

<comment><USER3> If we can't have a carbon tax because of the politics, we should at least try for a ban on fracking. Every molecule of gas extracted has to go somewhere, either into the atmosphere directly or as CO2.

<comment><USER4> We shouldn't do anything in any direction without detailed comparisons.

[https://www.drawdown.org/](https://www.drawdown.org/) has a big list of things that can be done, with the benefits of each in terms of cost and carbon reduction. It would make most sense to work through the list. If you guessed what number 1 is, you're a smarter human than I am!

[https://www.drawdown.org/solutions/materials/refrigerant- man...](https://www.drawdown.org/solutions/materials/refrigerant-management)

<comment><USER5> > We shouldn't do anything in any direction without detailed comparisons.

I feel differently. We should do everything. All at the same time. We don't have the luxury of time to pick and choose anymore.

Good that you brought up the drawdown project. Even the number 1 on their list is "only" like about 5% of total ghg.

No single solution will be enough. So we need to try to do as much in as many sectors as possible. Including fracking.

<comment><USER6> >I feel differently. We should do everything. All at the same time. We don't have the luxury of time to pick and choose anymore.

As much as it would incredibly suck (for convenience and variety in life) I think we, as a species, need to completely abandon fossil fuels in the next 10 years. Sadly it'll never happen, we will be burning fossil fuels well past seeing massive deaths from starvation/drought/unpredictable weather/food wars.

Gentlemen, it has been a privilege playing with you tonight.

<comment><USER5> > As much as it would incredibly suck (for convenience and variety in life)

The good news is that it wouldn't even suck. I don't think so. We are being brainwashed (sorry, being informed about products and services via advertisement) that car ownership is the best thing since the pill, and that flying to a tech conference is a great experience. There are better (and much less polluting) ways to have fun. I believe without the fossil industry we will flourish and our quality of life will skyrocket.

<comment><USER6> >The good news is that it wouldn't even suck.

It would for me. I work in international freight, I'd be unemployed. It looks like my employer may have used 1.2 billion gallons of jet fuel alone last year, if these figures are accurate [https://www.statista.com/statistics/878539/fedex-express- tot...](https://www.statista.com/statistics/878539/fedex-express-total-jet- fuel-consumption/) \-- at 9.57kg of carbon per gallon that is 11,640,000 metric tons of carbon (again if the numbers are accurate) just from our planes last year :(

We'd also be forced back to a (largely) pre 1950s-1960sish era level of tech as devices started to die off simply because we currently don't have the means of mining and moving goods globally on renewable energy at anywhere near current levels. I'm mostly fine with this though, if I woke up tomorrow and magic had made the computers/the internet/smartphones/e-readers disappear I'd have a really rough few days then I'd be like "oh well, let's go outside or down to the library, let me show these kids how a card catalog works".

<comment><USER7> I am not sure that CO2 emissions and climate change will have any real impact on the forwarding and freight industries. Global supply chains are so specialized by now that going back to 100% local production simply isn't feasible anymore, if it ever was. I guess supply chains, now being optimized for cost, will optimize for emissions instead.

Which is also _the_ lever to go to net zero, make emissions of CO2 and such expensive enough and the world will change.

That being said, done well a global supply chain can very well be more efficient from a emissions perspective than a non-global one. The optimization knowledge needed to achieve that is already there. So, all in all I guess transportation of goods will even be more important going forward.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> I can only imagine how badly this increases the environmental impact of meat industry if this fertiliser is used to fertilise soy fed to beef cattle which is hugely inefficient in providing protein to humans

<comment><USER9> I suspect it could ironically help still - at least if compared to non- fertilized resource useage.

</comment></comment><comment><USER10> Worth noting that when you see EPA charts that show agriculture's impact on greenhouse gases, the _manufacturing_ of fertilizer is _not_ included. The _application_ of fertilizer and any evaporation into the atmosphere is what's counted as "agriculture". I get why the EPA separates things into categories, but one effect of that is that agriculture's true impact on climate change is greatly misunderstood. In fact, so much of our society is shaped by how we farm, and how food gets delivered to your plate — it's why I believe changing our agriculture is fundamental to solving climate change (practically speaking through a price on carbon).

<comment><USER11> Fewer people on earth also fixes the problem. No, I am not advocating this. However, we should be prepared for the countries with big armies and few morals who stumble upon this particular solution once the situation becomes more dire.

<comment><USER10> Thing is, we kicked off climate change a long time ago. Even if we cut our population in half, we'd still cook the planet at our 1970s levels of emissions.

</comment></comment></comment><comment><USER12> Fertilizer is a MUCH better market for clean hydrogen production than cars.

<comment><USER13> You mean we should use hydrogen to produce fertilizer? Or producing hydrogen as a by product of fertilizer?

I'm not too versed in that domain but I'm curious!

<comment><USER14> The first step making fertilizer is making ammonia. Amonia is made with the Haber-Bosch[1] process by combining nitrogen with hydrogen. The hydrogen from that is made by combining steam and natural gas to make hydrogen and carbon monoxide[2]. The carbon from the natural gas ends up as CO2 in the atmosphere. If there were more green way to produce hydrogen for a reasonable price that would knock out a significant source of global CO2 emissions.

If solar power gets cheap enough maybe it'll make sense to use the excess power at noon for electrolysis, though I don't have a good sense of the capital costs for that.

[1][https://en.wikipedia.org/wiki/Haber_process](https://en.wikipedia.org/wiki/Haber_process)

[2]h[https://en.wikipedia.org/wiki/Steam_reforming](https://en.wikipedia.org/wiki/Steam_reforming)

<comment><USER12> Indeed. Unlike cars which really want mechanical energy or electricity (with hydrogen just being one way to provide that electricity... at lower efficiency than battery-electric), fertilizer production already needs hydrogen, with methane being an indirect way to provide that hydrogen.

Instead of trying to compete one-to-one against natural gas for thermal applications or battery-electric for electric ones, you can compete on turf that requires hydrogen fundamentally, saving the investment in a steam reformer. So if you have hydrogen already, instead of needing an extra capital investment (like a fuel cell in a fuel cell car), you actually can reduce capital investment (the steam reformer).

Also, it's large and centralized (large, centralized hydrogen plants have a cheaper relative capital cost and tend to be more efficient) and there are even ammonia pipelines carrying the ammonia to the Midwest from Texas (with world-class wind AND solar potential and plenty of land), so you don't have to deal with hydrogen storage and distribution issues.

It's a way better spot for wind and solar produced hydrogen to compete than in mobile fuel cell applications where you have to solve a bunch of other problems (fuel cells, distribution, hydrogen storage cost and safety to the uninvolved public, small electrolysis facilities with requisite lower efficiency and higher specific capital cost) while simultaneously having to compete with the low price of electricity and natural gas.

</comment></comment></comment></comment><comment><USER15> Wow, it took me a while to realize that this article is about fertilizer factories and not about fertilizer (actual) plants.

The brain is funny sometimes and so is this title.

<comment><USER16> I had the same confusion. Apparently the english name for natural fertilizer plants is 'green manure'.

[https://en.wikipedia.org/wiki/Green_manure](https://en.wikipedia.org/wiki/Green_manure)

</comment></comment><comment><USER17> This is the kind of thing i expect from China, not the USA. I guess in some ways our cultures are not so different after all

<comment><USER18> i am surprised that you are surprised :)

</comment></comment><comment><USER19> Its interesting they used the google street view cars to carry the methane sensors. Anyone know what other sensors they might be carrying on street view vehicles?

Similarly to how our own phones transmit data back to Waze for traffic info, are there any other things that could be useful for us to attach to our vehicles to record?

<comment><USER20> There's probably all sorts of interesting things that could be done to weather and air quality monitoring if we had the low level local data points from every car on the road. It'd be way easier to catch smaller or intermittent polluters for example.

<comment><USER21> They don't share the raw data, but there are a number of projects/ third- parties they partner with that share sanitized/ cleaned up data: [https://www.google.com/earth/outreach/special- projects/air-q...](https://www.google.com/earth/outreach/special-projects/air- quality/)

This methane discovery was a result of this project

<comment><USER20> Yeah, I was imagining that on an even wider array of cars though, imagine the resolution and constant pollution monitoring we could get if the same sensors were on 1-10% of cars?

</comment></comment></comment></comment><comment> Joe-Z So, how does this relate to our predictions about global warming? Anyone here who has insights on that?

<comment><USER3> I think this is both good news and bad news.

Most of the global warming work is based off the amount of methane estimated to be in the atmosphere, which can be determined with sampling and spectroscopy. This particular piece of research tells us where some of that is coming from, and fortunately it's from a few concentrated sites that are under human control. We could lean on them to fix it. Chemical processing sites already try to control methane leakage because it's explosive in air.

The bad news is that we probably won't. We have enough trouble with flaring: [https://www.bbc.co.uk/news/uk-scotland-edinburgh-east- fife-4...](https://www.bbc.co.uk/news/uk-scotland-edinburgh-east- fife-48051005) (my pet complaint, not only because it's a nuisance but because they've wasted in a year as much gas as I personally will use in 50,000 years, which makes reducing my personal consumption seem a bit pointless)

( [https://www.wolframalpha.com/input/?i=((38747+tonnes+*+50MJ%...](https://www.wolframalpha.com/input/?i=\(\(38747+tonnes+*+50MJ%2Fkg\)+in+kwh\)+%2F+10000kwh)) )

<comment> Joe-Z Thank you for taking the time to write up some conclusions!

>... makes reducing my personal consumption seem a bit pointless

Although I try to not to be wasteful also I get this feeling a lot that in climate change matters the actions that individuals can set are far outweighed by consistently applied systemic changes. Makes it kind of frustrating to try to save the earth :)

<comment><USER5> Apart from absolute emission reductions, we shouldn't underestimate the cultural and political impacts of individual actions. Individual actions are also a form of political pressure. Don't get frustrated.

<comment><USER22> Right! And let's all consider this karma. The more you waste the more the world heats up. The more effecient you become the more ideas you have on how to make market decisions towards efficiency.

</comment></comment></comment></comment></comment><comment><USER23> All the incentives are in all the wrong places. No surprise, self-regulation isn't working. (But still very disappointing.)</comment>


Torvalds and Theo harsh quote battle - <AUTHOR> http://torvaldsortheo.com/

<comment><USER2> Cute. I did better than one might have expected considering I don't know either of them well. But once it started recycling questions I got bored. (What? No score?)

And why not "Linus and Theo"?</comment>


Humans Dominated Earth Earlier Than Previously Thought - <AUTHOR> https://www.nytimes.com/2019/08/29/science/archaeology-earth-anthropocene.html <comment><USER2> Fire was used by early humans at least 200,000 years ago, perhaps as long as 1.2m years ago. Given how forest/bush fires are generally an effective hunting strategy today (e.g., by indigenous Australian), I'd expect that the first major effect of the anthropocene would be from large scale deforestation events. But, I can't find any evidence for it.

[https://en.m.wikipedia.org/wiki/Control_of_fire_by_early_hum...](https://en.m.wikipedia.org/wiki/Control_of_fire_by_early_humans)

<comment><USER2> Oh, here is more recent (20,000 BP) evidence: [https://journals.plos.org/plosone/article?id=10.1371/journal...](https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0166726)

</comment></comment><comment><USER3> >> A Himba homestead in the Kunene Region of Namibia.

It looks like there are two homesteads in the picture- one in the lower right half of the picture and one diagonally above it and to the left, at the top of the clearing.

The Himba are a beautiful people, probably best known for covering themselves in ochre and colouring their braided hair with it.

[https://en.wikipedia.org/wiki/Himba_people](https://en.wikipedia.org/wiki/Himba_people)

</comment><comment><USER4> Google Graham Hancock. He does a bunch of research concerning ice age civilizations I'm the Americas. Really interested work.

<comment><USER5> Erich von Däniken is also famous for similar "research".

<comment><USER6> I start to think more and more that those things he finds are not from aliens but from former failed civilizations... Which all failed für the same /similar reason line us (climate change, atom bombs etc) just millions of years back not just a few thousend... Like a cycle which continues until either we survive and we don't kill us self or the sun burns out... Very weird thought, no? :)

<comment><USER7> I don't think it's a weird thought, but earlier humans wouldn't have been able to cause climate change as we understand it today or destroy themselves with nuclear weapons because the evidence would be readily available in the geographic record. I am a fan of the line of reasoning from people such as Hancock because I think he's scratching on the surface of lost human history, but I think it's something we have to look at scientifically and skeptically (in general). I find the work he's discussed with the pacific north west in the United States to be particularly interesting.

</comment></comment></comment></comment><comment><USER8> Full article not accessible because of soft paywall, but: I feel we're surprised by these revelations because our current timeline of civilization is constructed using surviving artifacts and fossils, both of which are exception, not norm. The vast majority of evidence of ancient civilizations probably got completely buried. It's not outside the realm of possibility that there were early civilizations over 100,000 years old, whose artifacts have now been wiped away by plate tectonics and the ocean.

<comment><USER9> Not "buried" but "drowned". The oceans have risen almost 50 meters since the peak of the last Ice Age. Assuming the biggest human settlements, then as now, were near large bodies of water, then they are drowned.

<comment><USER10> So they built cities on the coast, but not along river valleys? How did they feed the cities without agriculture? If they had agriculture, we'd see the selection process in the genetic history of the plants, and the geographic spread of plants, and again they'd definitely have colonised river valleys that are better suited to agriculture than the coast.

Then of course their tools and other artefacts would have been traded all over the place. Stone tools from 100k years ago and more got traded or carried thousands of miles and all we see are implements for the hunter gatherer lifestyle.

It doesn't make any sense.

<comment><USER11> You might want to read up on Doggerland: [https://www.nationalgeographic.org/maps/doggerland/](https://www.nationalgeographic.org/maps/doggerland/)

The TLDR is that a huge low-lying basin of fertile land around what is now the British Isles was inundated at the end of the last interglacial. (What is now the North Sea/English Channel was one of those river valleys you alude to.) The British Isles today would have been the relatively cold, arid, mountainous uplands survivors migrated into when their fertile, low-lying territory got flooded out. Assuming population density in the chilly uplands (glaciers, remember!) was low, then you'd expect the frequency of surviving stone tools to be lower, reflecting that. People don't leave stuff lying around in places where people don't live!

<comment><USER10> I'm fully aware of doggerland, but so what? Given all of Africa and Eurasia, doggerland was a tiny benighted patch of lowland in a cold remote corner. I'm sure some people called it home, but I don't see any compelling reason to put a lost civilization on it 100k years ago.

There are plenty of very fertile, habitable areas in the same region that would have been just as attractive. So settlements? Sure. But surely a civilization is more than just a settlement?

</comment></comment></comment></comment></comment><comment><USER12> Old structures (pics, no commentary): [https://www.youtube.com/watch?v=eaLo0gqPzNc](https://www.youtube.com/watch?v=eaLo0gqPzNc)</comment>


Scott Forstall tells story about Steve Jobs, Microsoft, and a dead fish [video] - <AUTHOR> https://www.loopinsight.com/2020/05/21/scott-forstall-tells-story-about-steve-jobs-microsoft-and-a-dead-fish/ <comment><USER2> If you want the gist of the story:

Scott Forstall interviews at Apple.

During one of the many interviews onsite, Steve Jobs pulls the interviewer out of the room then eventually replaces the interviewer and begins peppering Forstall with questions. They have a connection and Jobs offers him a job on the spot (but also tells him to go through with the rest of the interviews).

Scott calls up his contact at Microsoft and turns down the offer he had from there.

The next day he gets a package at his doorstep. He opens it up and it's a huge dead fish. Forstall, thinking maybe it is a threat from Microsoft, calls up his contact and asks what the meaning of this was. His contact explains that they went down to Pike's Market, bought the largest King Salmon from there, packed it up with ice and shipped it down to him.

He ate it that night but still ended up going to Apple.

<comment><USER3> > bought the largest King Salmon from there

That's easily a few hundred dollars just for the salmon. Maybe over $1000 depending on the size of the salmon.

> He ate it that night but still ended up going to Apple.

No way he ate it all that night. Family friend brought us a whole king salmon from a fishing trip. Lasted a few meals. The best salmon I've ever had. Nothing like the farmed atlantic salmon you get from the supermarket.

<comment><USER4> >> He at it that night...

> No way he ate it all that night.

He ate it does not necessarily imply he ate it all. I ate chili last night, but that doesn't mean I ate _all_ the chili.

But, anyway, those weren't the actual words of Forstall in the video.

<comment><USER5> Hopefully a professional chimes in but I believe it does imply that he ate it all. Your example isn't one to one because you refer to it as "I ate chili" instead of "I ate it". Same way people wouldn't be confused if he had said, "He ate Salmon that night but" .

Similar examples: I painted it last night. (Painted a painting) I beat it last night. (Beat a game) I ran it last year. (Ran a marathon)

"Where's the chili?" "Oh, I ate it last night, sorry." (Ate the chili)

"Mmm, this chili is good, isn't it?" "Sure is, I had some last night." (Ate some of the chili)

<comment><USER4> "Half my chili is gone!"

"Sorry, I ate it."

Edit:

"This chili is no good!"

"What's wrong with it, I ate it?"

<comment><USER5> "Half my chili is gone!" "Sorry, I ate it."

"it" in that construction means "half my chili". Just as in "My southern, three-day-cooked chili is gone", "it" is "(their) southern, three-day-cooked chili".

"This chili is no good!" "What's wrong with it, I ate (some of) it?"

The parenthetical is omitted but implied. Unless they're referring to the chili that is inside your digestive tract?

</comment></comment></comment></comment></comment></comment><comment><USER6> Unfortunately, I was only an intern then new-grad during those early aughts of Forstall's reign. He was quite a brilliant man, very quick-witted and always one step ahead of you. Steve Jobs entrusted all of Apple's coolest projects with him for that reason. So all the biggest demos you saw on stage were under Forstall's leadership at one point or another.

However, if you wanted to work on those cool projects, it meant you had to work with Forstall and he was intimidating to say the least. A mini-SJ people internally would call him. Any feature you were working on that needed SJ approval went through Forstall's monocle eye first.

On the one hand, he was one of the few leads that would remember my name and say hi to me when passing in the hall. On the other, I was scared to look him in the eye lol. I do think he held his reports to unreasonably high bars by expecting long hours of work and he seemed to find joy in seeing people squirm. It was weird.

<comment><USER7> For some reason it's always the people who you try to avoid that end up learning your name the quickest. I knew a VP known to encourage harsh working conditions that I tried to steer clear of, but he always took the effort of remembering my name and coming over to my desk to say hi lol

</comment></comment><comment><USER8> I worked in Scott's group. He was on top of everything and was passionately involved. We would get in a room and pitch all (yes, all) ideas/changes to him and sometimes Steve. He had no tolerance for bugs, and quality was number one. He was like that coach you thought hated you, then you realized he cared.

<comment><USER9> I wish Scott was running Apple today not Tim Cook. I love skeuomorphic interfaces. Tim Cook is a failure in my opinion. There have been no interesting products under him, nor any compelling features added to existing products. He is simply coasting on the trajectory set by Steve Jobs.

<comment><USER10> Uh, the apple watch? Airpods?

While I personally hate skeuomorphic interfaces, I'll mostly agree with your analysis on Tim Cook. He's an amazing supply chain whiz, but he's not a product guy. The software quality at apple has also plummeted.

<comment><USER11> >mid-spec smartwatch that took three iterations to get to the level of polish its competitors were at during its first one

>bluetooth headphones

I don't think these count as interesting. I'm glad they exist, but they're pretty dull.

</comment></comment></comment></comment><comment><USER12> I think software quality has gone way down at Apple since Scott Forstall left.

Side note, I still have fond memories of working at 2XL Games and on ESPN X-Games Snocross and it was one of the first games shown on the iPad on stage by Scott Forstall that highlighted the ability to run on iPhone and scale up to iPad [1]. We had made the game in 9 weeks which was very fast from ATV Offroad, adding snowmobiles for the "slednecks" as they are called. The game launched and while we were working on our next game, we tuned into the keynote as all devs did in 2010, it was Jan 27, 2010, we saw our game come up on stage and no one knew it was happening. It was one of those killer moments that made the work worth it. Turns out it was largely because Steve Jobs was on the board at ABC/Disney and ESPN properties got promoted.

We later made the first game on Apple GameCenter matchup/networking in Ricky Carmichael's Motocross Matchup. The early versions of the Apple systems were actually quite solid for matchup/networking. This was before Android had Google Game Play Services so we eventually swapped it for a platform agnostic networking system but still lots of fun.

I was lucky enough to be lead game dev on both and got to help with the direction/game design as well especially on Ricky Carmichael's Motocross Matchup which is still pretty high up in racing on iOS.

Overall, I really feel iOS was a more solid/robust platform back then and trailed off after iOS 6 in terms of speed/quality, I think that has alot to do with Scott Forstall.

I think Scott Forstall was required for Steve Jobs to really make NeXT and iPhone happen. The way he was let go after the Apple Maps push, which I am sure was pushed out early, was disheartening.

[1] [https://web.archive.org/web/20100130175713/http://wireless.i...](https://web.archive.org/web/20100130175713/http://wireless.ign.com/articles/106/1064149p1.html)

</comment><comment><USER13> I'm a little shocked to hear this, but I've had a similar fish story with Microsoft!

I interned at Microsoft my junior year of college. Toward the end, I interviewed with Google and got a competing offer.

But during the negotiation process, the recruiters had Chris Jones (Windows Live VP at the time) call me to try talking me into joining Microsoft. He told me his story about how at the start of his career, when he was comparing offers from a few companies, Microsoft (relatively unknown at the time) sent him a salmon from Pike Place Market --- and that gesture convinced him to accept Microsoft's offer.

Two days later, a package of smoked salmon on ice from Pike Place Market showed up at my door in Tucson, AZ.

(I went to Google for non-salmon-related reasons, but sending me food mostly became a reminder that Google was offering free food as a perk!)

<comment><USER14> The series of Microsoft fish stories here is truely bizarre. Surely there is a more universally agreeable gift food?

<comment><USER15> Who doesn't like Salmon?

<comment><USER16> Vegan applicants would not find it funny.

<comment><USER17> [https://www.forbes.com/sites/niallmccarthy/2018/08/06/who- ar...](https://www.forbes.com/sites/niallmccarthy/2018/08/06/who-are-americas- vegans-and-vegetarians-infographic/)

Vegans at most account for 3% of the population. In a corporate entity that large, it doesn't matter if you miss a hire or not. So if a vegan was offended, I'm sure no one cared and was happy to offer the job to someone else.

<comment><USER18> A large portion of MS employees are vegetarian because many Hindus are vegetarian. At MS Build they always have both vegetarian and Indian vegetarian options.

<comment><USER19> Yea, but ... due to the visa situation the vast majority of those folks are not getting the maximal courtship, so to speak.

<comment><USER18> You are aware that there are many, many Hindus who are US citizens, yes? Who have been in the country since birth or early childhood?

<comment><USER19> There are, but I suspect they are not as prevalent in the software engineering profession? Even the CEOs of Google and Microsoft took that track.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> I have to wonder about the competence of a hiring manager who thinks that sending a candidate (who just rejected their offer) a dead fish in a package, without any other context, is a good idea.

But then again, we are talking about tech recruiting, so it's probably not all that surprising.

<comment><USER21> I start to wonder if he might be loosely summarizing the story in a way that makes it more amusing.

Like maybe there was a card explaining it and he either threw it away without reading or left it out of the story. Maybe the parallels to The Godfather are something he thought of later.

Or maybe you're right, and whoever sent it was kinda dopey and thought a fellow Washington State person would immediately get the reference, and he didn't.

<comment><USER22> Like when you say dead fish, it sounds bad. But consider the alternative—a gift of live salmon would be far more annoying and less convenient for most people.

<comment><USER23> That is a fascinating and disturbingly abusive prank - make someone responsible for killing a huge fish. What would they do - take it to a vet or a fishmonger or find a hammer? Call wildlife services for what you would buy in the supermarket the next day? It would be a pretty weird position to be in.

</comment></comment></comment></comment><comment><USER24> I wish Forstall would do a long form oral history with the Computer History Museum (usually around 2-3 hours) even if there was that shorter interview on stage there in 2017. He has a gift for storytelling.

<comment><USER25> Totally agree. The one with Jon Rubinstein [0] was illuminating in a way none of the biographies have been.

[0] Part 1: [https://www.youtube.com/watch?v=PJxElfc0N9E](https://www.youtube.com/watch?v=PJxElfc0N9E) Part 2: [https://www.youtube.com/watch?v=47bNpIbCaL8](https://www.youtube.com/watch?v=47bNpIbCaL8)

<comment><USER24> Also if you want to learn about the NeXT days (which live on in many ways!) check out the ones with Blaine Garst and Steve Naroff.

</comment></comment></comment><comment><USER26> He also related this story in his interview with the Computer History Museum: [https://youtu.be/IiuVggWNqSA?t=662](https://youtu.be/IiuVggWNqSA?t=662)

I'm still upset that, at 48:36, Forstall offered to give his thoughts on what we could be doing with AI that we're not, but Markoff decided to move on.

<comment><USER27> Why don't you just ask him directly?

<comment><USER26> How?

<comment><USER28> He's on Twitter!

[https://twitter.com/forstall](https://twitter.com/forstall)

<comment><USER24> Zero replies to any tweets.

</comment></comment></comment></comment></comment><comment><USER29> I was interviewed by Forstall (many many years ago, back when that was actually sane) and he asked me one of those annoying puzzle questions - don't get me wrong I love those questions, they're just useless as interview questions.

He was personable enough, but I feel that question also coloured my opinion for many years.

<comment><USER30> Care to share question any way?

<comment><USER29> IIRC it is as follows:

You are given two bags, and 10 marbles, 5 are black, 5 are white. You have to put the marbles into the two bags, and then the interviewer (I guess?) shuffles the bags and lets you pick a a bag to select a marble from. You "win" if you get a black marble (or white).

The problem is essentially: how do you distribute the ten marbles between the two bags to maximize you probability of getting a specific color.

My first answer was to point out the window behind him and say "look a zeppelin!" and he turned :D

Like all such problems the actual answer is obvious once you realize it or if you already know it.

<comment><USER31> This is quite good question with an intuitive answer (at least to me): 50%/50% marble distribution maximizes the chances of getting specific color with a random selection.

<comment><USER32> Hmm, I think 50/50 is the worst you could do. What if you put 1 black marble in 1 bag and the other marbles in the other bag. Then even a random choice would get you .5 * 100% + .5 * 4/9 = 72.2%

And also, if you can look at or touch the bag before picking it, then just pick the one the looks like it has only 1 vs. 9 marbles!

<comment><USER33> You can definitely do worse than 50/50: just flip your solution and put a single white marble in one of the bags. By the way, your solution--single black marble in one bag, all other marbles in the other bag--is optimal; do you know of a way to prove it? Besides just exhaustive enumeration, that is.

<comment><USER34> Exhaustive enumeration is a proof even if it's not very satisfying :-). For example, a big part of the Four colour theorem is a big enumeration of all configurations.

</comment></comment></comment></comment></comment></comment></comment><comment><USER35> I always wonder if Forstall will ever return to Apple to save it, just like Jobs once did. Surely cash is not a problem right now, to say the least, but I feel the spirit is fading. While there is Apple University and all that, he's probably the closest to a true Jobs replacement that is—or might ever be—around (for better or for worse).

<comment><USER36> Save it? Apple gets more profitable each day. last year it has 1-year returns of 70%

<comment><USER35> It's not so much saving the company from bankruptcy, but saving what they stand/stood for. Other than for shareholders, profitability isn't that exciting. If Apple becomes the new old Microsoft, or the next IBM, they're essentially dead to me. When was the last time you felt really inspired by one of their keynotes?

<comment><USER36> Apple is still the only big tech that is consumer centric.

Microsoft revolves around enterprise. Consumer stuff is just getting the users familiar with they tech.

Amazon is logistics.

Google and Facebook is Ad Tech, they don't add or polish experience if it doesn't make their ads better.

Apple has stayed true in providing excellent products for individuals, not marketing agencies or enterprise. That's what they show every update. Sure you miss an Ipod or Iphone reveal, but they are still showing new things (TouchId, card, watch, and the AirPods that everyone even non apple fans, love), and polishing old one( even listening to feedback like the keyboard stuff).

</comment></comment></comment></comment><comment><USER37> Tried to save it to my watch later list and apparently it's disabled because it's a kids video. Interesting.

<comment><USER38> Why does it prevent you from saving a kids video when you presumably are not a kid?

<comment><USER39> Because Google clamped all different concerns about kids on YouTube into the one feature without differentiating between videos with kids and videos for kids, and there was concern about recontextualisation of videos with kids as pedophilic erotic by including them into public playlists with inappropriate names and descriptions.

</comment></comment></comment><comment><USER40> A few years ago, oh hang on, more than a few years ago, Jobs was still alive - I was training at a muay thai gym south of bangkok and I met the executive chef on Larry Ellison's yacht. He was training to get fit, because a wealthy couple had told him if he could lose weight they'd set him up with a cooking show. Jobs often borrowed Larry's yacht, and he had galley stocked with everything Jobs wanted, except that Jobs wanted fresh fish from a particular Hawaiian fishing company, fresh every day. So there was a young, beautiful woman who flew to meet them every day that Jobs was on board, wherever they were in the world, who would charm her way through customs with a big dead fish packed in ice.

Guess he liked fish.

</comment><comment><USER41> So he interviewed at two really competitive companies. One CEO offered him to skip the entire interview chain after chatting to him for a few minutes. The other sent him a desperate gift by mail after he turned down their offer.

Scott must be __really __good at interviews! :P

</comment><comment><USER42> Scott starts speaking around minute 32.

</comment><comment><USER43> Actual video starts at 2:06.

I heard no sound but saw his mouth moving, thought something was wrong with my Airpods Bluetooth connection, so I kept disconnect and reconnect it lol.</comment>


Did the octopus come from space? - <AUTHOR> https://www.sciencedirect.com/science/article/pii/S0079610718300798?via%3Dihub <comment><USER2> An interesting article which has been getting lots of attention recently (among humanoids at least). But wouldn't the original title be better?</comment>


How to design a mobile application - <AUTHOR> http://blog.aparicio.org/2009/12/17/9-steps-to-design-a-mobile-application/

<comment><USER2> Apart from using your finger as the 'pointer' (which is only really true on touch screen enabled devices, which is definitely not all of them) how is this any different from developing any other application ?

<comment><AUTHOR> The main difference I see, is that when you design a web or desktop application on a computer screen, the designer is seeing, more or less, the pixels at the same size than the end user. When you design a mobile app, if you design it on a desktop, and that's where you mostly look at it, you end up having a built-in 2x magnification, and when you finally put it on the device, things are much more scrunched up and less usable than you thought.

The idea in the post is to play with the design, in the device, for a while, and get design feedback much earlier than when you give the app to a developer.

<comment><USER2> Wouldn't it be best to take your mock-ups directly to a mobile screen for verification ? That seems to be the most natural thing to me, to wait until it's 'built' before you see it on the device seems to be a bit late.

I'd try to get it displayed on the actual device as early as possible on way or another.

<comment><AUTHOR> I agree with that. That's step 4 in the article. It's probably not enough, in the sense that just looking at the mock screens doesn't tell you much about navigation and widget selection.

What came as a breakthrough for me was to actually mix screenshots and statically implemented screens in a real mobile app, then play a lot with that.</comment></comment></comment></comment>


BuzzFeed Trained a Computer to Search for Spy Planes. This Is What We Found - <AUTHOR> https://www.buzzfeed.com/peteraldhous/hidden-spy-planes <comment><USER2> This is both a good article, and a wonderful example of quantitative analysis applied for a news-worthy cause.

I especially like that they have the full data processing code available: [https://buzzfeednews.github.io/2017-08-spy-plane- finder/](https://buzzfeednews.github.io/2017-08-spy-plane-finder/)

</comment><comment><USER3> I for one was really pleasantly surprised to be reading this great article — from Buzzfeed of all places!

<comment><USER4> Buzzfeed has a lot of good journalism, apparently. I never go to their site and seek it out, but when it's linked it's very good like this piece.

It shouldn't be so surprising; if CNN and NYT can fill their sites with clickbait, why can't Buzzfeed step in to fill the gap of investigative journalism? Hell, I trust Buzzfeed more than the other two; at least with Buzzfeed you can tell right away whether you're reading clickbait or real journalism.

<comment><USER5> Buzzfeed mostly is (or was; I pretty much stopped reading it) clickbait but every once in a while they have great in-depth, high-quality articles like this. I suppose it takes much longer to investigate and write these articles than it does to churn out the clickbait.

<comment><USER6> If you look at the top of this article, you'll see it's actually branded as BuzzFeed News. The BuzzFeed brand itself is still clickbait, BuzzFeed News is the journalism side of things.</comment></comment></comment></comment>


Anonymous Brings Down Facebook? - <AUTHOR> https://twitter.com/YourAnonNews/status/208348526248337408 <comment><AUTHOR> I must add that I haven't gotten any confirmation, but many people on Twitter believe it's Anonymous now: <https://twitter.com/#!/search/realtime/facebook%20anonymous>

That's some rep to have!

Update: <https://twitter.com/YourAnonNews/status/208362262421962752></comment>


Stop Creating Bad Forms - <AUTHOR> https://medium.com/nextux/form-design-best-practices-9525c321d759 <comment><USER2> Automatically focusing the first input on your form is usually not a good idea [1]. Pretty much any- and everything that moves focus around without user interaction is hell to use on a screenreader.

The other recommendations are generally applicable and good advice.

[1] [https://stackoverflow.com/a/2180699/1470607](https://stackoverflow.com/a/2180699/1470607)</comment>


Oracle: China's internet is designed more like an intranet - <AUTHOR> https://www.zdnet.com/article/oracle-chinas-internet-is-designed-more-like-an-intranet/ <comment><USER2> This is not unexpected.

<comment><USER3> This is China.jpg</comment></comment>


The Clean Architecture (2012) - <AUTHOR> https://8thlight.com/blog/uncle-bob/2012/08/13/the-clean-architecture.html <comment><USER2> Prudent to remember that Robert Martin is a consultant and it's lucrative to sell enterprises a story where their domain logic is a billion dollar asset and following his very particular design pattern will enable them to seamlessly evolve this asset with new technology.

Here's where the story breaks:

\- Most app's domain objects and rules are small. You could describe them on a few sheets of notebook paper. The technology implementation (e.g. database or http logic) is a much larger portion of the codebase.

\- In most teams, especially startups, the domain rapidly evolves. The technology stacks (databases, SQL, etc) are quite stable and have already been heavily abstracted for reuse over the years. Using these proven technologies and excellent existing interfaces is how you go fast.

\- Technology choice isn't just about code interface. Each comes with its own assumptions of system behavior and theory of operation. Plugging a different implementation into your storage adapter interface is the least piece of work you need to think about unless it's nearly a 1:1 swap like postgres -> mysql.

So following a strict clean architecture approach will probably pour concrete around something changing all the time and create friction and extra work in using excellent available technologies.

Instead I'd rather follow pragmatic design guidelines:

\- The concept of each component should be clear

\- Sensible responsibilities for each component

\- Abstractions should serve the composability of your existing design; introduce adapter layers if you truly have more than one implementation

\- Keep it simple; optimize for reading the code end-to-end and easier refactoring

These aren't inconsistent with Clean Architecture but probably more productive than adding religious rules.

<comment><USER3> The design pattern in question is not that much special in the global sense. It is special in the J2EE/.NET/Enterprise world because it should allow you to automatically generate most of the UI in same way what eg. Flask-Admin does while also taking all the bussiness rules into account. One of the things I'd like to do is implement subset of Apache Isis (which is implementation of essentially this pattern for J2EE) in Python on top of Flask.

<comment><USER2> Automatically generating a UI from a domain may please a programmer but isn't likely to please a user. That's how you get UIs like the one Salesforce has.

That could be the right choice in some situations -- it certainly worked out well for Salesforce and allowing extensibility in their model. However if you want to build an app with consumer usability you'll be putting a lot of unique development effort into your view layer.

<comment><USER3> Reasonable UX for consumer facing application is something completely different from what you want for the back office. And these architectures target applications where the back office part is majority of the UI.

</comment></comment></comment></comment><comment><USER4> Has anyone ever done this in practice before without it mattering:

> _4\. Independent of Database. You can swap out Oracle or SQL Server, for > Mongo, BigTable, CouchDB, or something else. Your business rules are not > bound to the database._

MongoDB vs Oracle.. Ok architecture astronaut, you're gonna have a real bad time when you swap those out for each other.

<comment><USER5> Your business is the database. Models matter.

Anyone who wants "database neutrality" (least useful common denominator), vs leveraging the awesomeness of pgsql, mssql, oracle, should just use flat files. Or mysql.

<comment> UK-AL You can leverage whatever database feature you want, just a long as you do it in the database adapter/gateway.

I write mine in raw sql normally.

<comment><USER5> Versus in situ (eg stored procedures)?

I currently agree.

There was a time when the database engine was the "app server". Before client/server & ODBC.

I miss those days. That strategy is overdue for a comeback.

<comment> UK-AL My raw sql can call out to stored procedure if that's the best tool for the job.

A database is a perfectly good application core, if you application primary about creating/updating/deleting records.

If your application is business workflows, and complicated business logic. Then this is something to be considered.

<comment><USER6> Good to see I'm not crazy! I think this can be easier than maintain, and with tools like Datagrip now, seems to make a lot of sense. Coming from the data science side, I observed many talented people spending time on projects like [https://github.com/cloudera/ibis](https://github.com/cloudera/ibis) to abstract SQL into something that I often thought was more verbose, less literal and less portible in reality.

</comment></comment></comment></comment></comment></comment><comment><USER5> Turgid.

Most applications copy a string from here and paste it over there. Input, processing, output. What we used to call data processing.

Add some defensive programming for sanity. Validation rules, "schemas", type systems.

Favor composition over inheritance, a useful programming language over "dynamic typing" (aka type hostile).

Extra credit for logging, monitoring, auditing, alerts, rolling deployments.

Life time victory achievement bonus award for setting breakpoints (debuggable) and easy reproduction steps.

\---

Instafail if you use mappings (eg ORM), observer/listener, factories, singletons.

<comment><USER7> > Instafail if you use mappings (eg ORM), observer/listener, factories, > singletons.

Wait, why?

<comment><USER8> What I've seen many times with ORM tools is blind interaction with the in- memory object graph abstraction over the data store which results in many un- needed queries. It's like the option of making one DB query which returns a flat result set isn't even on the radar.

As far as I can tell Factories have been replaced with DI frameworks or just hand rolled DI.

Singletons aren't so bad if you're working with an object oriented language and the singleton is just an instance of a service which holds no state and has methods that operate on a limited number of data types. At that point it's essentially just a namespace for a functional library.

Observer/Listeners ... Not sure here unless the commenter is advocating message queues or eventing.

</comment></comment></comment><comment><USER9> One thing I would note is that it's not _always_ necessary to abstract away your database layer. It is if you are developing software for installation into an existing infrastructure at a customer's datacenter. It's not necessary if you're building your own application on your own infrastructure.

In my experience I've never seen an enterprise company change databases over night. Uber perhaps being the exception to the rule. If you're choosing the target platform that your software runs on you should exploit that platform for all it's worth to get the best benefit from it. Yet I've seen plenty of software shops that insist on writing/running heaps of code to abstract away the database server on some imagined future point where someone decides they're going to run it on Mongo now instead of MySQL.

<comment><USER10> Abstracting the database has another benefit you are neglecting. It is easy to mock the database and test your application use cases if the database layer is abstracted. This is nearly impossible if database access is baked into the app.

<comment><USER11> But do you really need to mock the database when you can just deploy a containerized one for testing?

<comment><USER12> We used a real database for testing. In the short term it was less work than architecting the application in a way that allowed the DB to be mocked.

Long term, the result was a 45-minute test suite which spent most of its time setting up records in the DB, and which could not be parallelized except by adding more instances of the real DB (otherwise the tests would interfere with one-another's assertions about the DB state).

<comment><USER11> but now with containers you can have a snapshot that's already set up in the right state. A separate build.

<comment><USER13> This is a powerful technique, though I'd say it's more useful for the build pipeline than for developers running UTs while coding (since the schema can change more frequently while doing so).

To provide a counterpoint though, an advantage touted by advocates of complete decoupling from the DB is that your UT suite can run in O(one minute), rather than O(ten minutes). E.g. see [https://www.youtube.com/watch?v=tg5RFeSfBM4](https://www.youtube.com/watch?v=tg5RFeSfBM4).

I'm not 100% sold on this approach yet (separating your domain objects entirely from the ORM wrapper is an uphill struggle), but it's interesting.

<comment><USER11> We run our tests on databases and it's on the order of one minute. Maybe it's a hardware issue? We all have beefy computers with fast SSDs.

Also since we strive to make our databases upgradable, it's important that the actual schema update scripts themselves are tested and used directly.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> > The overriding rule that makes this architecture work is The Dependency > Rule. This rule says that source code dependencies can only point inwards. > Nothing in an inner circle can know anything at all about something in an > outer circle.

You can get pretty far just worrying about this part.

I tend not to find these acronym names and the diagrams very helpful in terms of actually creating code. Separating concerns, as we all already know, is crucial, as is being careful about where knowledge is located. But I've found that if you buy in to these architecture patterns, you quickly become confused about which part of the pattern a given class or module or area of responsibility falls under. Like, is my `BazFrobber` a Gateway, or a Presenter, or a Controller... ?

</comment><comment><USER15> This is a very similar idea to Gary Bernhardt's: Functional Core, Functional Core, Imperative Shell: [https://www.destroyallsoftware.com/screencasts/catalog/funct...](https://www.destroyallsoftware.com/screencasts/catalog/functional- core-imperative-shell).

I prefer Gary's explanation of it because he jumps right into the meat of the problem and shows code that models this architecture. The video doesn't require you to know Ruby to understand what he is saying, just as long as you know some basic testing phrases; Mocking, Stubbing, Etc, you should be able to follow along.

<comment><USER13> I like Bernhardt's rendition of this concept too. His talk "Boundaries" is my favourite summary:

[https://www.destroyallsoftware.com/talks/boundaries](https://www.destroyallsoftware.com/talks/boundaries)

Note that the Functional Core architecture makes an additional restriction on top of the Clean/Hexagonal architecture, namely that the core should be functional; the OP doesn't make such prescriptions on how you implement the Entities and business logic (though it doesn't discourage you from doing so either of course).

<comment><USER15> You are right that the above article doesn't specifically mention the core being functional. I merely interpreted that from one of the stated properties of his and the other architectures he showcases:

"2\. Testable. The business rules can be tested without the UI, Database, Web Server, or any other external element."

If that doesn't scream functional, then I don't know what does. :)

</comment></comment></comment><comment><USER16> The thing to follow is that you shouldn't build a tower of babel abstraction stack but a limited number of clearly defined abstractions. It's ok if you go deeper than 4 in some cases but these things should then already be pretty low level.

Too deep a stack will lead to code "scavenger hunts" when you want to figure out what something does.

</comment><comment><USER17> These things are always nice in theory but I would really appreciate a small sample app following the architecture.

<comment><USER18> Android devs "(re)discovered" clean architecture around 1-2 years ago so there are plenty of sample apps there you can understand with very little android experience.

<comment><USER19> And as always happen it ends misapplied to mobile apps that only paint on screen the JSON received from the server.

Not everything is black or white (no architecture vs clean architecture). You have to think about what you are doing (having fucked up on previous projects help) and don't follow anything you've read blindly.

Silver bullets, yadda yadda

<comment> UK-AL Clean architecture in this case is just the name of the architecture. There are many others.

<comment><USER20> Agreed. Also, there is no such thing as clean architecture. Every architecture has holes and limitations

</comment></comment></comment></comment></comment><comment><USER21> The article doesn't mention it, but this architecture is good for functional programming as well. If you model those three inner circles as pure functions operating on input and returning results + effects, your app becomes easy to test and easily maintained by a good type system.

</comment><comment><USER22> [http://retromocha.com/obvious/](http://retromocha.com/obvious/) is an implementation of these ideas.

</comment><comment><USER23> Thought this was an article about [https://en.wikipedia.org/wiki/Clean_(programming_language)](https://en.wikipedia.org/wiki/Clean_\(programming_language\))

Disappointing.

</comment><comment><USER24> The title should mention it's a 2012 article.

</comment><comment><USER20> Shouldn't DB be part of Entity - right in the middle? Why it is on the edge of the circle outside gateway?

<comment> UK-AL A lot of these architectures assumes DDD. (I'm not sure if clean architecture does)

Domain driven design. You model you business problem using plain objects and methods. The domain should do nothing else other than modeling the domain, and solving the business problem you app is designed to solve. It should be persistence ignorant.

Then everything else simply has adapters for interfacing with the domain. Including a persistence adapter.

This is basically ports & adapters, and a lot of these architectures are basically variations on that.

<comment><USER20> Thanks. I think I see this reference in the article - [http://jeffreypalermo.com/blog/the-onion-architecture- part-1...](http://jeffreypalermo.com/blog/the-onion-architecture-part-1/) which explains why DB should be outside. It makes sense in the services and NoSQL world, but i would not put at the edge. Feels like we are doing something wrong & insecure. It could be my mindset issue :)

<comment> UK-AL I don't why it would be insecure...

<comment><USER20> I mean from block diagram perspective, we are always used to keep data in the center secured by all other layers. But that pattern is changing in the days of AWS & Google Cloud, where data can be anywhere. If data is a service, it doesn't matter where it is located. But if Data is a layer within the application, we need to surround it by protective layers such as app, gateway etc.,

<comment> UK-AL Well those layers are really protecting the domain.

</comment></comment></comment></comment></comment></comment><comment><USER25> This kind of thinking bothers me, but I'm not sure how to put my finger on what exactly it is that bothers me, or how to put it into words.

The thing with these abstract architecture principles is they are not always practical if you try to be puristic about enforcing them.

I get where these ideals come from. I've seen novice programmers take a stab at writing mildly complicated apps, and the code is a nightmare to read because everything is jumbled up together. This is bad and we can all agree on that.

But I've also seen projects where everything is split into a tiny little function or object that don't seem to be doing anything meaningful. Presumably these projects are following the principles of "single responsibility" and "loose coupling", but it's so loose that it's hard to put the pieces together in your mind and nearly impossible to follow the flow of the program.

I consider generic rules of the form: "<X> related objects should not be doing <Y> related stuff" to be harmful. (An example of such "bad rules" can be found in the article under the heading "Use Cases")

Instead I prefer practical rules that make the code easy to read, understand, and updated, without making it any more complicated that it needs to be.

* If a piece of logic can be contained in a function, let it be contained in one function without splitting it across 10 different objects and factories and coordinators. Even if that function is slightly long, there's no need to split it apart just because it's over the arbitrary threshold of say, 25 lines.

* Create abstractions around a set of vocabulary that you can use to describe the problem domain and the process of doing things within the application. Make sure to document your vocabulary well and try to keep it as small as possible (but not smaller)

A good example of this is git's vocabulary for commits, trees, and blobs.

Every operation doesn't need to be a class (or worse, a series of classes and factories). Operations can be functions that operate on the structure's (objects) you've defined.

* Keep related files and functions together.

If you have a server side module implementing an json API, and an html page designed to display the API, and a javascript module designed to drive the UI on the html file, and a sql file describing the data you're displaying, then let's put all those files together in the same directory, instead of spreading them thin across separate folders

        app/controllers/api/X/X.py
        app/templates/X/X.html
        app/js/views/X/X.js
        app/css/X/X.css

Why not put them all under:

        app/X/X.py
        app/X/X.html
        app/X/X.js
        app/X/X.css

Related material:

Object-Oriented Programming is Garbage: 3800 SLOC example

[https://www.youtube.com/watch?v=V6VP-2aIcSc](https://www.youtube.com/watch?v=V6VP-2aIcSc)

<comment><USER26> I think you're conflating clean architecture with a bunch of other things. All it is is a set of rules about how different layers of your app can depend on one another. It doesn't say too much, if anything, about code organization or design patterns like SRP or loose coupling or whatever.

I say this because we follow it pretty religiously at my work and it never feels impractical nor does it really feel like it adds too much extra work to anything we do, nor does it feel like related code is far apart nor are our functions too small.

In practice, following the clean architecture means, for example, that my business logic can't explicitly depend on some database related code. If we have business logic that needs do stuff in the database, it defines an interface of some methods that it expect the database repository to implement that it can use. It then has an implementation that satisfies that interface passed to it using dependency inversion (as pointed out in the article).

So it really means that if some business logic related to, say, tweets needs to retrieve some from the database, it calls something like "tweetRepository.findAllTweets()", which returns a bunch of "Tweet" domain objects. It never sees database rows, it knows nothing about which database we use, etc. Our business logic is focused _solely_ on dealing with the use case, and nothing to do with the nitty gritty of how we interact with the database or how we eventually return that data to a user that needs it.

Which is great, because it means if we ever change how our database layer works, we only need to change our database repository code. We don't need to worry about changing business code if we can satisfy the same interface as before.</comment></comment>


"We should all follow Linus' example" - <AUTHOR> http://blog.erratasec.com/2015/11/we-should-all-follow-linuss-example.html?m=1 <comment><USER2> Linus is a treasure. He is a Beethoven-tier genius with zero filter, and not an ounce of psychopathy, who gave away his life's work for free.

Your average entertainment figure, politician or fortune 500 C-Suiter is a thousand times bigger asshole than Linus is, they (or their handlers) just cover it up.

</comment><comment><USER3> Linus: "You can disagree with me as much as you want, but during this talk, by definition, anybody who disagrees is stupid and ugly."

Just a cheeky cherry-picked quote :).

</comment><comment><USER4> >"his use of power demonstrates extreme humility"

Well perhaps, but isn't that just like saying "it could always be worse"?

Personally, I think he could be just a _little bit_ nicer. But then again, as a Linux only user, I am glad "crap" code is kept out...

<comment><USER5> I'm mostly ambivalent on the issue though I like watching the drama created around his statements. I wonder what exactly would you want him to change to be nicer? Stop swearing, drop the shit into crap, fuck into something else?

<comment><USER6> Isn't it obvious? Simply drop the ad hominem and swearing.

<comment><USER7> He doesn't do ad hominems tho.

</comment></comment></comment></comment><comment><USER6> Linus is honest and doesn't try to deceive or paint anyone in bad light. He will however use strong language; which could be very easily avoided, making his comments example worthy.

Currently I think the community consensus is to not take the comments too seriously, which diminishes their effect, the opposite of what Linus is trying to do with his strong language. If only he did, he would avoid the negative online press, which preys on clicks, and the target audience could focus on the arguments made in the comments.

</comment><comment><USER8> I've often wondered if, other than a cultural difference (see "management by perkele"), there wasn't also a linguistic aspect to it.

I mean, not being a native speaker can warp one's perception of how strong some expressions are.

<comment><USER9> As can being a sailor, a typographer or, if I've understood matters correctly, Australian. Poor foreigners ;)

Linus' real fault is that he's not a committee person. He doesn't accept the sort of watered-down polite mediocrity that professionals like you and me do accept. Installing mongodb because some fool in a meeting wants to and bickering about it would be unprofessional, buying IBM to not get fired (it's called "hosting at AWS" these days), etc.

</comment></comment><comment><USER10> I'm okay with tolerating verbal abuse as a gesture of compassion but no fucking way should we characterize this as an ideal. I say it that way to prove I'm not talking about offensive language, if someone said any of my code was brain damaged, I would take it as a personal attack. It's not emphasis, it's cruelty.

<comment><USER11> Well, at least he gets his infos in the news quick.</comment></comment>


Google executives stopped employees discussing diversity and hiring - <AUTHOR> https://www.theverge.com/2018/1/12/16882270/google-diversity-hiring-executives-cory-altheide <comment><USER2> Absolutely the right decision. If a topic has many smart people arguing both sides, then there is probably some merit for both, and you should not antagonize your coworkers over it.

Also:

> Altheide's account provides a counterpoint to the description of Google by > former engineers James Damore and David Gudeman

Damore's memo got leaked within weeks (days?), he got bullied internally, threatened publicly and eventually fired, while Altheide's memo is made public only now, apparently by himself.</comment>


Type-safe enums in JavaScript - <AUTHOR> https://github.com/vivin/enumjs <comment><AUTHOR> Comments are appreciated. It seems to work like you would expect, but I'd like to know if there's anything I'm missing in particular, or if the whole approach is just completely wrong.</comment>


Rolling Out Public Key Pinning with HPKP Reporting - <AUTHOR> https://developers.google.com/web/updates/2015/09/HPKP-reporting-with-chrome-46 <comment><USER2> > _When your site sends such a header, Chrome will verify if the current > connection matches the pins, and sends a report to the report-uri if not._

Huh. I wonder if this can be used for exploits?</comment>


DDoS Attack: What It Is and How to Trace a DDoS Attack? - <AUTHOR> https://utopia.fans/networks/ddos-attack-what-it-is-and-how-to-trace-a-ddos-attack/ <comment><AUTHOR> Is it possible to prevent a DDoS attack?</comment>