Robot wraps fiber optic cables around existing power lines - <AUTHOR> https://eandt.theiet.org/content/articles/2020/07/robot-wraps-fibre-optic-cables-around-existing-power-lines/ <comment><USER2> Overall, it's an interesting project and I hope they can solve all issues for a real deployment.

They don't mention the length penalty that comes from wrapping around the cable or any impact of loss to fiber itself. Given the helical pattern, I'd imagine that they are adding substantial length to any distance they need to achieve. Generally you have about 20dB of loss before you need an amplifier or a terminal node. A typical number for field installed fiber is 0.25dB/km. So there's some distance penalty needed here. I'm not clear on how you'd add amplifiers to these routes or if they are simple short hops.

Generally regular SMF-28 has a bend radius of 25mm. This is partially for loss reasons as bends below this radius induce loss and partially because bending fiber below that radius creates micro cracks in the fiber. The micro cracks can spread with time and cause the fiber to break. Given the rather large CTE mismatch between the power cable and the fiber cable, the 2 will expand at different rates with temperature, putting additional stress on the fiber, potentially leading to failure.

It's possible to have a less bend sensitive fiber but it's generally used more in specialty applications and not as transmission fiber. So it'll be more expensive per km.

Along the lines of mechanical failure, it would seem that there would be the potential for abrasion between the power cable and the fiber cable jacket.

Finally, it's a little unclear how repairs would be made. Doesn't seem very safe to have to splice the fiber on a live cable like this.

<comment><USER3> It's medium voltage lines which are up to tens of kilometers long, not high voltage hundreds of km. The spans between pylons are also much shorter than HV, so adding slack to allow for CTE mismatch seems doable without excessive abrasion.

On the illustration the winding is very sparse, it definitely does not look like running into minimal bend radius problem or adding much length.

<comment><USER2> I'm not sure what the diameter is of these cables but I found a data sheet that shows MV (33kV) cables are <50mm in diameter. If that's true then, the bend radius is <25mm.

If the winding is sparse, let's say 1 turn every 1m on a 38mm diameter cable, then the amount of length added will be ~1% of the total linear length (neglecting the cable sag). So the amount of added length due to winding it will negligible.

At 1000 bends per km, if we assume loss is 0.001dB per bend, then we'd add 1dB per km.

[http://www.prioritywire.com/brochures/Medium%20Voltage%20Pow...](http://www.prioritywire.com/brochures/Medium%20Voltage%20Power%20Cable.pdf)

<comment><USER4> Wouldn't the bend radius only be <25mm if you were winding very densely? At sparse winding, you aren't actually bending it much.

</comment></comment></comment></comment><comment><USER5> I know it's not really relevant to the meat of the article, but I can't trust any of the numbers listed in the article. They claim that "Just 28 per cent of people living in Africa are internet users and two-thirds of those are located in South Africa."

If we take the population estimates of just 4 countries: Nigeria (206 million), Ethiopia (109 million), South Africa (60 million), and Kenya (47 million) we get 422 million people. 28% of that is 118 million, and 2/3 of that is 79 million. Clearly South Africa can't have 79 million internet users if they only have a population of about 60 million.

<comment><USER6> Found a source Google cited for the 28% figure in this [1] article. Not claiming it's accurate since they only source their own "ITU estimates". I also don't see a mention of "South Africa" in the stats:

[https://www.itu.int/en/ITU-D/Statistics/Documents/facts/Fact...](https://www.itu.int/en/ITU-D/Statistics/Documents/facts/FactsFigures2019.pdf)

The same PDF mentions "3G coverage in Africa at 79.5 percent". So I guess that is not being counted as internet. Must be broadband?

[1] [https://www.nytimes.com/2020/07/07/world/africa/google- loon-...](https://www.nytimes.com/2020/07/07/world/africa/google-loon-balloon- kenya.html)

<comment><USER7> Perhaps it is an estimate of Internet users using a conventional computer. I am pretty certain that the figure must be higher than 28% these days as pretty much everyone has a smart phone, even poor people in the slums of Kenya. There are however still quite a few feature phones out there though, often with keypads nearly worn down to the circuit board!

</comment></comment></comment><comment><USER8> One thing I started to worry about and which wasn't addressed is that the technique of wrapping the cable around the power line hinders power line repair or could preclude future applications like this. Can the same robot traverse the same line with the cable already applied? Can a second cable be applied over the first?

<comment><USER9> the actual lines themselves tend to not really have any repair - nobody sees one strand of a 50 strand cable looking a bit frayed and replaces it...

You just replace the whole cable at its end-of-life.

<comment><USER10> Hah, I've never seen a utility schedule end of life for cables. They just replace them as they break, they'll replace chunks if the cable itself is looking bad, but otherwise they'll just splice it together with a coupler.

If fiber optic is in the way, they'll just cut it.

</comment></comment></comment><comment><USER11> Discussion from two days ago: [https://news.ycombinator.com/item?id=23825132](https://news.ycombinator.com/item?id=23825132)

</comment><comment><USER12> The fb engineering page has more info [0] and reddit has quite a few comments from people in the industry about its feasibility [1].

[0]: [https://engineering.fb.com/connectivity/aerial-fiber- deploym...](https://engineering.fb.com/connectivity/aerial-fiber-deployment/)

[1]: [https://old.reddit.com/r/EngineeringPorn/comments/hrb6xv/rob...](https://old.reddit.com/r/EngineeringPorn/comments/hrb6xv/robot_for_deploying_aerial_fiber_internet_that/)

</comment><comment><USER13> My first through is why is Facebook doing this? Why do they have a division that's developing Robotics?

Promising though. Much of the cost of running cable is having someone mount the cable, drive 30 feet down the road, and mount the cable. Over and Over. If they can slash the cost of last mile, that's big.

<comment><USER8> I suspect more people on the internet means more people on Facebook, means more ad money.

<comment><USER14> More data as well, considering they can use browsing data from the internet connection itself to influence ad targeting even when browsing non-Facebook properties.

</comment></comment></comment><comment><USER15> Without getting into a lot of detail I don't see this being very useful. First off it only works on wires suspended via pin or post insulators on cross arms. There are plenty of other suspension methods used for MV distribution so good luck accommodating them. Most runs are normally interrupted by strain insulator sets on poles containing switch gear or poles that make sharp turns. It also needs to accommodate a wide variety of insulator designs which have varied over the years. Some are tall and narrow, some are short and mushroom shaped. Some have clamps at the top, some are tied with wire.

Any intervention with the robot also requires a highly trained and certified linesman crew to manipulate the thing on a live conductor with a potential upward of 34.5kV line to line. So if the robot gets stuck or breaks down you need a trained crew to handle it. And how easy is it to repair a broken fiber on a downed power line?

This looks like another solar roadways.

</comment><comment><USER16> Interesting idea, but I don't see any mention on how they deal with the power line stretching. As power draw goes up, the electric company pumps more juice, which heats up the cable and in summer months it gets so hot (everyone using A/C), that the wires start to stretch and sag. The fiber would need to deal with that.

<comment><USER17> I don't think overhead power lines heat up much in normal operation, given the economics involved. They will definitely expand/contact in line with ambient conditions however, and also must be flexible enough to sway in the wind without causing excessive abrasion between the cable and fibre. Edit: the helical wrap would probably expand/contact more than the electrical cable, as it'd be "wider" overall.

</comment></comment><comment><USER18> The article mentions the main costs with deploying fibre "lie within the construction of new poles and other infrastructure". Is there any reason why fibre can't be strung between existing power poles? They aren't conductive, so you don't need to worry about distances to buildings (i.e. they could be run lower than power lines).

<comment><USER15> The costs involved have to do with labor needed to string cables. You need a crew of humans in bucket trucks moving from one set of poles to the next. Whereas this robot clamps to the conductor which acts as a rail and the little robot can string the fiber on its own for the length of the cable.

<comment><USER18> Right that's what I thought. Maybe in North America where labour costs are high this will be popular, but the article talks about developing countries where lower labour costs and less regulations make deployment of fibre a lot cheaper.

</comment></comment></comment><comment><USER19> A telco was established in the UK by the National Grid during the 1990s using the high voltage distribution network as the backbone, and wrapping fibre around the neutral conductor. They called it Energis, and it had a great slogan at one point: "dial on the pylon"

IIRC after a while they moved to integrating the fibre bundle in the neutral conductor cable.

<comment><USER20> In the early 2000s I was on a project that was planning on using the fibre that was embedded in the neutral conductor in the local grid here in eastern Australia. It was used for telemetry and power control, but they thought they could sell access to ISPs and the like. I don't think it ended up going beyond a few pilot deployments and then our National Broadband Network got the go- ahead

</comment></comment><comment><USER21> We've wrapped fiber around ground wire in the past. Though here they're doing it around the conductor. Also their robot is an advancement and pretty cool. But when I've worked in the power industry in the past the guys who had experimented with this stuff wound up really hating it for the difficulties it adds to maintenance and the like. So this may be cool but I wouldn't be surprised to see it rarely used in actual practice. Strikes me a lot like project loon and all these other things where people are trying invent unnecessary shortcuts. If you really want to get internet to people with a reasonable bandwidth/coverage/and cost trade off start building large towers dotted across the continent and use wireless access, or wait for star link.

</comment><comment><USER22> I don't see this being used other than by electrical grid operators themselves, there's no way they would let third party telecom companies do this, for grid-reliability and safety reasons.

</comment><comment><USER23> I've seen some gnarly utility line webs in south america. There's something beautiful about the chaos, like a cyberpunk puzzle box for anyone that wants to get signals from it.

<comment><USER24> In that case, you might enjoy [https://powerlinesinanime.tumblr.com/](https://powerlinesinanime.tumblr.com/)

<comment><USER23> thank you!!

serial experiment lain has some iconic shots that stick in my memory [https://powerlinesinanime.tumblr.com/tagged/lain](https://powerlinesinanime.tumblr.com/tagged/lain)

</comment></comment></comment><comment> orbital-decay How do they pass the more complex transitions between line sections? I vaguely recall that being a significant limitation of existing line-crawling robots.

</comment><comment><AUTHOR> It's only 1.5km - 2km, and it looks promising, but I wonder how do they splice it. I was hoping the video would tell, but unfortunately not.

<comment><USER25> They probably just attach a junction/amplifier as needed, directly to the grid.</comment></comment>


How i became a developer at age 10 - <AUTHOR> http://startupmyway.com/my-dev-story-part-1/ <comment><USER2> Part 2: [http://startupmyway.com/my-dev-story- part-2/](http://startupmyway.com/my-dev-story-part-2/)</comment>


Ask HN: Which book are you reading currently? - <AUTHOR> <comment><USER2> Good leaders ask great questions

</comment><comment><USER3> Treasure Island.</comment>


Tell/Ask HN: My Location is different on iPod touch vs Laptop Google Map - <AUTHOR>

I used the "Show my Location" feature to find out my current location using my laptop and my iPOD touch device's built in Maps. Apparently, the iPOD touch is showing that I am about 1 mile away. (It used to show the accurate location before)<p>I am using the same WiFi network for both(my home Comcast cable) and they are in the same internal private subnet effectively having the same public facing IP.  I am curious how this is possible as I thought the IP is resolved to the location. <comment><USER2> You are correct about how it works. Companies have (or buy) geo-ip data to correlate ip addresses with real world locations. These databases change frequently (IP's bought and sold, people's residential IP's changing).

There's a couple possibilities about why it is different. Maybe the maps app actually goes through Apple first, and there is a slight flaw in the most recent version of Apple's geo-IP database. Even if they both query Google for the location, it's possible that different sets of servers serve the mobile maps versus the web maps, and they are slightly out of sync with which databases they use.

</comment><comment><USER3> It's not just IPs; visible wifi base stations with known locations are also used, if that info is shared by the client (as I believe both the Google Maps app and Firefox 3.5+ offer). So any difference in the devices' signal reception could result in different location guesstimates.</comment>


Ruby's New JIT - <AUTHOR> https://medium.com/square-corner-blog/rubys-new-jit-91a5c864dd10 <comment><USER2> Can it use TinyC? TinyC compile time is about 9 times faster than GCC, so warm up time can possibly be shorter, although the JIT performance gain also be less because TinyC performs only basic optimizations.

</comment><comment><USER3> Interesting that the Jit uses GCC or Clang. And that only 1000 methods are cached by default.</comment>


Show HN: RemoteHR – Compliance and Payroll for your remote workers - <AUTHOR> https://remotehr.co/ <comment><USER2> I could not successfully sign up and the information on the site is very limited. What exactly does your service do? It implies all tax compliance, but I find that hard to believe. Perhaps you can confirm you comply with all the payroll requirements of the jurisdictions you operate in?

A US company that employs an individual resident in Canada is required to: \- Keep W-8 on file \- Register for a Canadian tax ID \- Keep a "shadow" payroll system in Canada, and report monthly the payroll to the Canada Revenue Agency \- Deduct Canada Pension Plan, Employment Insurance, and income taxes, and remit to the Crown (1) \- Issue a T4 slip at the end of the Year (W-2 equivalent)

The above process is very different for a US company that employs an individual resident in the UK or France.

There are other factors to consider: residency status, hypothetical tax and equalization payments, and treaty relief comes to mind. I ask because, what we would call "Global Mobility Services" consisting of cross-border taxation of employees, is pretty much done in Excel because of the thousands of permutations possible with the above factors and 190 odd countries of the world.

(1) See Regulation 102 and Regulation 105 withholdings

<comment><AUTHOR> There are other, more scalable ways to do this. Reach out to us if you want to talk more :)

</comment></comment><comment><USER3> How does this compare/contrast with Gusto? We use Gusto for all our remote employees and it works very well.

<comment><AUTHOR> Gusto works well for out-of-state employees. But it doesn't work for employees outside of the U.S. :) RemoteHR does.

<comment><USER3> I'm confused by your comment. We used Gusto for employees in Europe (NL and UK). It worked fine.

<comment><USER4> [https://support.gusto.com/account-setup- maintenance/product-...](https://support.gusto.com/account-setup- maintenance/product-plans-billing/unsupported- companies/1066223371/International-employees-and-contractors.htm)

</comment></comment></comment></comment><comment><USER5> You misspelled Brazil ("Brezil").

<comment><AUTHOR> My bad, it's because I'm French :D</comment></comment>


NOAA kicks off 2018 with massive supercomputer upgrade - <AUTHOR> http://www.noaa.gov/media-release/noaa-kicks-off-2018-with-massive-supercomputer-upgrade <comment><USER2> The GFS model has been embarrassingly bad in comparison to Europe's ECMWF models. Here's to hoping it will be more competitive in 2019.

<comment><USER3> embarrassingly bad according to what? At my work we use the GFS data and our customers are extremely pleased with the data we provide.

<comment><USER4> The GFS was bad at tropical weather this year. Though I have to say, the GFS has been a little less crazy in long term forecasts on the US West Coast lately.

Not sure how much processing power will improve the tropical storm forecasts, though. I had the impression that had to do more with the model's physics. Though it would be nice to catch up with the ECMWF's data assimilation prowess, that would definitely help.

</comment></comment></comment><comment><USER5> It's interesting that Dell won this one. Sadly there's not a lot of technical info about the system itself or the big storage expansion (probably more Lustre, sadly - my tax dollars at work).

<comment><USER6> But would GPFS _really_ be any better? What other competition is there for big iron hpc distributed storage?

<comment><USER5> Lustre nominally scales higher than GPFS, but GPFS is more reliable and better performing for anything having to do with metadata. It's also a lot more expensive license-wise. There's other competition, but it's not proven at these scale levels. Top 500 deals are bad business so it's not really worth it to develop/test for them thus leaving the business to the incumbents (e.g. the dumpster fire that's IBM or the Arkham Asylum that's Lustre).

<comment><USER6> FYI I work directly with the amazing guy who wrote this: [https://csc.fi/web/blog/post/-/blogs/the-largest- unplanned-o...](https://csc.fi/web/blog/post/-/blogs/the-largest-unplanned- outage-in-years-and-how-we-survived-it)

Lustre at scale is a disaster, but one you can pay for people to help you with. GPFS is unbelievably expensive, but is a lot more reliable wrt metadata, but it is also quite fragile.

In my original question, I mean other than the obvious one of Lustre.

</comment></comment></comment></comment><comment><USER7> So many acronyms in this thread...I wish I knew what any of them mean.

<comment><USER5> Feel free to ask for definitions!

</comment></comment><comment><USER8> No mention of their Gaea supercomputer at Oak Ridge. I wonder if it's still operational.

<comment><USER9> [http://knoxblogs.com/atomiccity/2016/04/28/noaas- supercomput...](http://knoxblogs.com/atomiccity/2016/04/28/noaas- supercomputer-upgraded/)

Looks like they shut it down April 2016.

<comment> t-brown Gaea is still up and running. The C? names are sub-components, so currently Gaea is C3.

[https://rdhpcs.noaa.gov/](https://rdhpcs.noaa.gov/)

[https://www.ncrc.gov/](https://www.ncrc.gov/)

<comment><USER9> D'oh. I did not even completely read my own link - extra embarrassing as I sit in the same building as this cluster...</comment></comment></comment></comment>


The World of Sports Betting in a World Without Sports - <AUTHOR> https://www.si.com/gambling/2020/05/07/how-covid-pandemic-changed-sports-gambling-present-future <comment><USER2> It is very possible to make money betting on the obscure stuff. I am not going to say what exactly but whilst it isn't possible to get the same volume down, it is possible to have a big edge.

The craziest one was an event I backed at 2.5 in to 1.2 at closing. I have never seen anything close to this before. Just crazy stuff (that is an edge of 40% i.e. you make 40c every $1 you bet)...but you do have to be willing to do the work.

The mistake in the article and that every punter makes is to assume that events with "no information" are bad...but the person setting the odds doesn't have a secret book full of "information" either...the Russian ping pong league is rigged though.

<comment><USER3> I've heard that the online betting platforms quickly stop taking your money if you have a consistent positive return. Any truth to that?

<comment><USER4> It's true. The more you win, the sooner you'll be stopped, at least at the betting company I've worked at.

</comment></comment></comment><comment><USER5> I wonder if there has been a surge in esports betting instead?

<comment><USER6> Oh shit I just realized this is probably a contributing factor to a phenomenon I noticed recently watching smaller dota tournaments: twitch chat was >50% (sometimes 90%) composed of sports bettors discussing lines and predictions instead of the games, which I'd never seen before.

Also could be that I'm just watching more small tournaments than I usually would though

<comment><USER7> Absolutely! One org (cyber tractor) was even disqualified recently for match fixing.

Dota is unique in that the professional scene is subsidized by fans through Battle Pass, however the distribution of that resource was so lopsided, betting companies are starting to take a hold onto the smaller tournaments.

</comment></comment></comment><comment><USER8> For those interested in betting on esports, there's been a lot of activity in the space recently. My startup, OkLetsPlay [1], partnered with Intel and Overwolf, takes a patented approach to providing a seamless experience from betting to playing. Note, we focus on players betting on their own skill in games, not betting on others. Legally, there's a key difference here.

1\. [https://okletsplay.com/](https://okletsplay.com/)

<comment><USER9> Have you been pitching this to investors?

What is the reaction? Do they focus on market/growth or are they all about compliance issues ?</comment></comment>


UK Surveillance State: A short film [FREE] - <AUTHOR> https://bmstudios.org/uk-surveillance-state/ <comment><AUTHOR> I'm Borja Moya, a filmmaker and privacy activist based in London. I've just released a short film about the UK's surveillance state and the live facial recognition deployments by UK police forces, where thousands have been scanned without consent, and many have been racially profiled.

During 2019 and 2020 I witnessed several live facial recognition deployments by the Metropolitan police and South Wales police. And I was able to capture first hand the behind the scenes of what the police do during these deployments.

The first thing I noticed in these deployment is how the UK police forces target certain people—especially racial minorities. Which is extremely worrying. But after you deeply analyze their modus operandi, the threat of their surveillance goes much further than the already grave threat of racial profiling: it is the beginning of a state of surveillance and a roll-back on human rights and fundamental freedoms.

In this short film I show you the behind the scenes of what the police do during live facial recognition operational deployments. And I give you a sneak a peak of where the UK is heading with its surveillance state. And maybe this video will serve as an example of other countries that are also walking down this road.

(Please, let me know your thoughts about this film)</comment>


At Blind, a security lapse revealed private complaints from tech employees - <AUTHOR> https://techcrunch.com/2018/12/20/blind-anonymous-app-data-exposure/ <comment><USER2> I'd never checked out Blind before. I just went there and checked out a few of the front page posts & comments. It has some of the most toxic and destructive "advice" I've seen for people asking for help or insight. I'm a bit astounded. Is this typical?

<comment><USER3> It's pathetic, you see some of the most depraved, narcissistic members of the tech society there. The quality of the discourse you can guess is shockingly bad, and most people are from the Bay area. Is this an accurate representation of people in the Bay? Or is it just a platform for toxic folk to hang out?

<comment><USER4> I spent more time reading the threads than I should have, it's strangely addicting. I now feel naive for thinking that the people working at the big tech companies have a certain base level of "all-round" skills. In no way I expected so much cynicism, narcism and lack of empathy! Isn't this showing up in interviews? Or should it just be seen as online trolling and venting?

<comment><USER5> Sociopaths are extremly good in faking empathy or a friendly personality when in need (eg interviews). To actually recognize them you have to look very close for at least some weeks once they feel they are not risking their initial position anymore. Sadly most companies at that point have no way of managing these guys or to recognize they have to fire them (often because they are still extremly careful to keep faking their personality with the higher ups, while being toxic to those below and at the same level of them)

<comment><USER6> Most assholes aren't sociopaths. The pseudo-anonymity and "exclusivity" of Blind encourages trolls and assholes to congregate. People say things just to piss others off, and they also say "publicly" the douchebag things they'd normally only say to close friends/family (overt racism, homophobia, xenophobia, etc). None of this means they are actually sociopaths, though. Just run of the mill assholes and trolls.

</comment></comment></comment></comment></comment><comment><USER7> Anyone who believes a random startup that advertises they provide anonymity in security on their homepage is smoking something strong. No legitimate company that cares about security makes such absolute statements.

</comment><comment><USER8> Lol. I like the concept of blind but it is one of shittiest apps I have used. Their app consistently doesn't respond correctly to buttons and their redesigns just make their user interface worse.

Oh, and on the topic of security, one guy found a SQL injection exploit and demonstrated it by giving any users who commented on their post 100 likes...

</comment><comment><USER9> I have used blind. Some posts were pretty blatant. Just like Madison-Ashley, someone is going to dump all those posts in future. And somebody will create an indexable search, maybe paid access for employers - instead of open access for public. Not a good thing.

</comment><comment><USER10> Sounds like they don't give a shit and only reacted when TC was going to write a story about it. Surprising given that user trust is at the core of their business, and without it they have nothing.

<comment><USER11> Their inaction on being notified is quite damning.

<comment><USER12> If I was an evil CEO, I would purposely start an anonymous messaging platform just to collect compromising statements.

</comment></comment></comment><comment><USER13> >At its core, the app and anonymous social network allows users to sign up using their corporate email address, which is said to be linked only to Blind's member ID.

People just trusted it?

I get that to seem legitimate the users have to be confirmed in some way, but as a user... now way am I exposing myself that way.

<comment><USER14> The emails were "sitting plaintext in an exposed database."

Major things wrong: unencrypted email addresses + private messages, leaving the database without a password, database wasn't fixed until a week after knowing of the error.

I find it concerning that this kind of news seems normal now.

<comment><USER13> The scale of poor security by default these days is pretty horrifying.

</comment></comment></comment><comment><USER15> Using Blind with your company email on the company WiFi seems really dumb? Maybe I'm paranoid, but I act as though everything that goes through my company WiFi and on my company computer is being tracked and stored in some database forever under my name.

And I assume the company email is used to send you a verification email, which means your employer is now tipped off to the fact that you're using a site to anonymously criticize them.

<comment><USER16> Correct, it's very easy to find out who in the company is on Blind -- most corporations use Exchange.

Easy as this: [http://ivan.dretvic.com/2011/05/remove-specific-email- from-a...](http://ivan.dretvic.com/2011/05/remove-specific-email-from-all- mailboxes-in-exchange-2010-sp1/)

The article says "remove" but before you remove, you need to list all employees that have that email - if you just make a test account or look for the domain then you can pipe the results to a text file and that's your list of company insiders who are on the platform.

What leadership does with that info, is well, never good.

<comment><USER17> Posted above but someone at my org sent an invite to everyone. Having a list of everyone that received an invite does not mean they signed up...

<comment><USER16> No, but people who did have an email confirmation. You can search not only from domain sent, but from subject and body.

<comment><USER17> What? The invite email from blind is the email confirmation from blind...

</comment></comment></comment></comment></comment><comment><USER18> > The database also contained passwords, which were stored as an MD5 hash

!!!

<comment><USER19> > Kim denied this. "We don't use MD5 for our passwords to store them," he > said. "The MD5 keys were a log and it does not represent how we are managing > data. We use more advanced methods like salted hash and SHA2 on securing > users' data in our database."

!!!!!!

<comment><USER20> Isn't SHA2 the standard hashing algorithm? If not, what do people use now?

<comment><USER21> Back when I was a super junior php dev I stumbled across a post by Cal Henderson about using bcrypt [https://www.iamcal.com/2012-06/use- bcrypt/](https://www.iamcal.com/2012-06/use-bcrypt/)

His lib is can be dropped in to any project (that doesn't have something similar built in already) [https://github.com/iamcal/lib_bcrypt](https://github.com/iamcal/lib_bcrypt)

Anyone writing code has no excuse for not using this, it's not rocket surgery.

<comment><USER22> It's worth noting that the current standard encryption and password hashing in the php core is great, with no external dependencies added

</comment></comment></comment></comment></comment><comment><USER23> This bothers me:

> The database also contained passwords, which were stored as an MD5 hash, a > long-outdated algorithm that is nowadays easy to crack. Many of the > passwords were easily unscrambled using readily available tools when we > tried.

That's not how hash functions work...

> Kim denied this. "We don't use MD5 for our passwords to store them," he > said. "The MD5 keys were a log and it does not represent how we are managing > data. We use more advanced methods like salted hash and SHA2 on securing > users' data in our database."

This sounds much more likely.

> (Logging in with an email address and unscrambled password would be > unlawful, therefore we cannot verify this claim.)

So, they directly claim that weakly hashed passwords were available (and unscramble-able, apparently??), but they're unable to prove this and they're ignoring the company's reasonable explanation. Great reporting.

<comment><USER24> > That's not how hash functions work...

Kind of. A hash function just provides a near random set of characters of fixed length for a given set of input in a way where the output characters are reproducible for the given input. Passwords are not stored. It is the computed hash value that is stored. When a user attempts to login with a username and password the password is hashed and compared to the stored hash.

That said you don't need the actual password to login. Any input that hashes to the same hash string is acceptable, which is called a hash collision. When they say _cracking the hash_ this is likely what they mean, and its trivial to compute provided a rainbow table.

Salting provides an additional round of computation. For example let's say a user is trying to login. Their password is hashed but before the hashed are compared some additional information is added on the end of the computed hash and that new value is hashed. It is this new hash that is compared with the stored hash, which requires knowledge of the hash algorithm, the salt, and the hash value. You can generally guess the final hash algorithm in question by observing the character length of the stored hashes, but since there are two hash computations a different hash algorithm could be used for the first round of hashing.

To be secure the salt must be stored in a different location from the stored hashes and the salt value should not be statically visible in the source code provided a source code compromise. Statically expressed passwords are uploaded to code repositories all the time. Don't believe that you are protected from associated vulnerabilities merely because the code base isn't open source.

To the article's defense neither claim was verified, but both claims were reported. When the journalist cannot validate a claim themselves, or with experts, it is completely acceptable to report the claim and report the validation status.

<comment><USER25> It's cool that you jumped on the opportunity to explain how password hashing works. However, the reporter actually cracked hashes, so we can bypass all of this discussion and plainly see the hashes were insecure.

And for what it's worth:

 _> To be secure the salt must be stored in a different location from the stored hashes and the salt value should not be statically visible in the source code provided a source code compromise._

This isn't true. Your salt can be totally public if you're using a robust key derivation function. Likewise you can make e.g. the work factor (rounds) public for bcrypt and N, r and p public for scrypt (cost factor, block size and parallelization parameters).

The rest of what you said about secrets management in code is sound though.

<comment><USER24> You cannot crack a hash though. It is just a string of fixed length. Nobody says _crack a string_ because it sounds ridiculous.

> Your salt can be totally public if you're using a robust key derivation > function.

That is a deliberate strawman. If your salt is based on keys there is still information you aren't exposing even if you are exposing the salt itself.

<comment><USER25> Uh, what? You can obviously crack a hash digest, and this is standard nomenclature used in both industry and academia. It simply means you've broken preimage resistance or collision resistance in practice. What exactly do you find controversial about this?

And your second paragraph doesn't follow. What I said isn't a strawman attack, it's a basic observation. If you're not using a secure key derivation function, a private salt will not save you. If you are, the salt can be public and there is no meaningful degradation in security whatsoever - you could even prepend or append it to the digest if you'd like.

As a broader point, what you're saying about fixed-length strings is incorrect. Hash functions need not output strings of fixed length. The formal definition of a hash function also admits functions of the form:

        H: {0, 1}^* -> {0, 1}^*

not just functions of the form:

        H: {0, 1}^* -> {0, 1}^n.

Or in other words, the codomain need not be finite, and the range can be variable. Keccak (SHA-3) is an example of a hash function which provides variable-length output instead of fixed-length output (i.e. via the sponge construction).

</comment></comment></comment></comment></comment><comment><USER26> They made a big mistake, but generally I love reading Blind. There are a lot of interesting things on it about which I couldn't talk even to my own colleagues.

<comment><USER27> As many others, I had heard about it and never actually took a look until now. Seems like a waste of time to me. Make a throw away account on Reddit like everyone else, and you'll probably get more well thought out and measured replies.

<comment><USER26> On Reddit I have no idea where a person who replies really works.

You either haven't found the interesting threads or the interesting replies from internal people that make Blind different.

<comment><USER27> Obviously your mind is made up, but I don't think you've considered that you don't _really_ know that someone is a VP at X company on Blind, either. They _could_ be a janitor.

People are welcome to enjoy whatever fiction they want to read. I'm just saying you'll probably find more useful and reliable information elsewhere.

</comment></comment></comment></comment><comment><USER28> > Blind claims on its website that its email verification "is safe, as our > patented infrastructure is set up so that all user account and activity > information is completely disconnected from the email verification process."

Wow a patented infrastructure! Dope!

I wonder if it's open source so that can be validated objectively?

<comment><USER29> I guess you can at least look up the patent and validate the idea.

</comment></comment><comment><USER30> "Blind claims on its website that its email verification "is safe, as our patented infrastructure is set up so that all user account and activity information is completely disconnected from the email verification process."

"Patented infrastructure"? It smells like BS to me.

</comment><comment><USER31> "Uber — which later blocked the app on its corporate network."

Reason enough not to work there if you ask me.

<comment><USER32> I don't think this claim is true. Friends who work there clarified they can use Blind at the corp network.

<comment> uber-employee No, it's true. This was right after the Susan Fowler event when Uber's Blind channel blew up in membership. They blocked it, people just laughed and turned off wifi, and then they unblocked it a few weeks later.

<comment><USER32> Alright. Sorry, I took it as it's banned at the moment too.

</comment></comment></comment></comment><comment><USER33> Use 4chan as 'anonymous' instead. Or better, a throwaway account on HN. Remember your VPN.

</comment><comment><USER34> I enjoyed blind during their early days, now all threads are the same: "HEY, starting at company XYZ at level N, with total comp of YYYY. Is that good" "No, that's not possible you are lying!" "Hell yeah, well done mate" ...

</comment><comment><USER35> Their core functionality is to keep the confidentiality of its users.

There is widespread available technology and know-how on how to do this successfully and consistently.

Blind failed miserably at this fundamental task.

Yet... >>Blind last month secured another $10 million in new funding after a $6 million raise in 2017

So the VCs are perfectly happy to dump millions into a company that is dishonest and incompetent (see also Uber, Theranos), while thousands of competent honest startups go begging.

Provides a bit of background into why most VC funds struggle to outperform the market

</comment><comment><USER36> Like any anonymous forums, Blind is toxic. Hope it dies a quick death

<comment><USER37> For all the toxicity blind is one of the best resources to discover comp info online, since sharing salary is still a bit taboo. Some of it is e-statting but I've found it to be useful for when you negotiate comp.

<comment><USER38> There's so much misinformation on it I find it hard to trust. I prefer to go with H1B salary databases.

<comment><USER39> H1B databases tend to underestimate. My entry in the database lists my starting salary from a few years ago, with no bonuses, options/rsus, or promotion/raises.

<comment><USER37> levels.fyi is pretty good since it has the bonuses and rsus, but sometimes it doesn't have everything if it doesn't fit into that structure

<comment><USER40> levels.fyi only really works for companies that have large numbers of reports. The raw data has so many reporting inconsistencies that it's really hard to interpret for most companies.

</comment></comment></comment></comment></comment></comment><comment><USER41> They say "anonymous" but right after signing up with my work email they followed me on Twitter. The two are only connected by my name. Could be coincidence, but probably not.

Also, the community there is pretty toxic. I understand it's mostly the design of the app to be a place where people can say what they want, but I think it attracts a certain type that I'm not terribly interested in getting close with.

</comment><comment><USER42> [https://www.teamblind.com/faqs](https://www.teamblind.com/faqs)

> Email verification is safe, as our patented infrastructure is set up so that > all user account and activity information is completely disconnected from > the email verification process.

[https://patents.google.com/patent/US9439072B2/en?oq=9%2c439%...](https://patents.google.com/patent/US9439072B2/en?oq=9%2c439%2c072)

> Certain embodiments herein also provides a system and method for > authentication, which can prevent service users' identities from being > exposed even by hacking of a terminal or server side of a service provider, > negligence in information management or a manager's misconduct.

impossible.

> Certain embodiments herein also provides a system and method for > authentication, which can store information provided by a service user > during subscription and authentication procedures in such a manner that the > information cannot be decoded from a side of a service provider's server.

Impossible without a trusted 3rd party to perform the authentication and return a token to the service provider. Which is a well known and well deployed, not novel technique.

Patents are hard to read, and this one is no exception. Unfortunately I don't have enough interest to invest the time required, but at a glance it seems that the technique is to have an authentication server that can hide the user identity from the relying service, basically by replacing it with a token. Too obvious.

But there's some kind of dedup exchange mentioned; it might be that the auth server doesn't itself store a list of the identities that it has authenticated previously so it has to interact with the service (in a blind way) to dedup. Perhaps the novelty here is that the service itself cannot uniquely identify users; ie each post could be coming from _any_ user in a group. All the service knows is that the post is from a user in that group. On its face, that seems false -- for the first time ever I actually looked at blind and each post has a user pseudonym as metadata. There would be no point to that pseudonym if it didn't represent a uniquely identified individual user.

Anyway, all this is meaningless protection unless there is adequate SoD between the auth server and the service provider, which for teamblind it is obvious there is not.

</comment><comment><USER43> How incredibly convenient for an anonymous social networking dedicated to complaining about your employer.

</conspiracy>

<comment><USER44> I keep saying this as well, it's not an anonymous forum. It's an HR tool. You sign up with your company email ffs.

</comment></comment><comment><USER45> I stopped reading after reading a thread of grown men throw hissy fits because they thought they were screwed over by their $300k salary when they felt they "deserved" $400k+

<comment><USER46> It never fails to amuse me how a worker desiring a better wage is something frequently and deeply mocked here.

</comment></comment><comment><USER47> When I deleted my account it said "you will be unable to recover your password through Blind"

Heh, guess I could just use this table of hashed passwords that they exposed and figure it out myself ;-)

</comment><comment><USER48> Love Blind - it has been great help during my job search

</comment><comment><USER49> I'm glad to hear at least they don't seem to be storing ip addresses.

</comment><comment><USER42> the whole concept of blind is faulty! there is no way you could trust them to maintain your privacy. and of course _they_ can read all the dirt on everything. it's a guarantee they have no meaningful controls in place.

<comment><USER42> too late to edit.

wanted to add, with all the recent (and we know to be continuously ongoing) talk about chinese espionage ... who needs high-cost espionage when you can get employees to air dirty laundry at zero-cost?

</comment></comment><comment><USER50> Wait, Blind doesn't use end-to-end encryption?

<comment><USER51> How to use end-to-end encryption on a forum?

</comment></comment><comment><USER52> It's all about TC this TC that tho occasionally one might be able to glean some Leetcoding tips. But generally degenerate.</comment>


Show HN: Emoji Bombs (send fun bursts of emoji) - <AUTHOR> https://emojibombs.com/ <comment><AUTHOR> Hey Hacker News, this is a fun side project that I built while learning vue.js and Progressive Web Apps (PWAs).

No two emoji bombs are alike: there are factorial 15 combinations for Happy Birthday - that's 1,307,674,368,000 - and factorial 31 combinations for Christmas, etc.

I personally use it to wish team mates a happy birthday, or send the a "get well" note when they call in sick.

It's a fun project that I wanted to share - I appreciate any and all feedback!

<comment><USER2> On firefox, I see nothing unless i shrink my sizing (ctrl- a few times) to under 90%. Otherwise the emojis don't render.

and "ok to paste" never goes away.

<comment><AUTHOR> Great feedback @mgkimsal, thanks. I'll test & fix FF.</comment></comment></comment>


Why Do We Need So Many Different Messaging Apps? - <AUTHOR> https://motherboard.vice.com/en_us/article/zma735/why-do-we-need-so-many-different-messaging-apps <comment><USER2> i have been making this argument for a long time now, everyone seems to have a different app these days and no one seems to be able to explain why, for a long time ive used hangouts which seemed the sensible choice, its pre- installed on almost all android pones and most anyone with an android phone has a google account automatically giving you an IM service that isnt tied to a mobile number you may change at any time

yet for some reason people suddenly started telling me i needed to switch to whatsapp "its much better" only it really isnt, in fact it does pretty much the same thing only its tied to your phone number which in many peoples cases can regularly change and since then any number of other apps that all do the same thing

but i think i may just be getting old, people sing the praises of discord like its something new and amazing but to me it looks to do almost exactly what IRC has been doing for decades

but that sees to be the direction were moving in now, lots of apps to do the same thing, until recently if i wanted to play a PC game i opened up steam and played, but now things are changing and you have to have 3 or 4 store apps (increasingly the utterly abysmal Epic store)</comment>


Of Containers, Dockers, Rockets, and Daemons - <AUTHOR> http://3ofcoins.net/2014/12/06/of-containers-dockers-rockets-and-daemons/ <comment><USER5> It seems like it ought to be easier to document Docker than to rewrite it from scratch, but maybe I'm wrong.

Likewise if Docker is already one big binary it shouldn't be impossible to create a daemonless mode (Doxorcism?).

<comment><AUTHOR> Docker is not static. If much of it is implementation-defined, and implementation is evolving, then documenting a particular version of Docker is as valuable as I'd be willing to stay locked down to that particular version. And the APIs are not stable: just look at [https://github.com/jenkinsci/docker- plugin/issues/115](https://github.com/jenkinsci/docker-plugin/issues/115) to see how a Docker upgrade can break a project that uses its APIs (and if the plugin used CLI rather than HTTP API, it would still break: the cause was a change in formatting information that was not available anywhere in a parseable form, and as far as I know is still available only as "pretty text" to be parsed by a regexp)

<comment><USER5> Yes, documentation would need to be an ongoing process combined with a policy that code changes need to also update the relevant documentation. This may make development slower but revolutions aren't exactly efficient either (or I've just been playing too much Unity).

<comment><AUTHOR> What good is of updated documentation if change breaks my code? The good way would be to first define and stabilize interfaces, and work from there - <USER2> this would require stopping for a while to think, and refrain from adding new features in the meantime, which doesn't seem likely with Docker.

And while I don't support "revolution" (or even think that Rocket is necessarily better than Docker, or that Better One Should Win), I really appreciate break from monoculture. Having one large player in any area is harmful. Even if Rocket stays a niche project, its existence on the market will influence Docker's strategy.

<comment><USER6> Is there a particular feature you wish Docker had not added? 1.4 RC had 2 months worth of stabilization and basically no new features.

<comment><AUTHOR> It's less about particular features (none of these is individually harmful, but I personally find the monolithic architecture a bit of an issue), and more about taking time to actually define stable and complete APIs and boundaries. Stabilization (from technical reliability POV) is all good and fine, but - <USER3> instance - is there a way to easily find out containers' names and links, and exact forwarded ports, from the API without regexping `docker ps` output and "tcp/1234"-like strings that should be meant for human eyes only? Is it still Docker's official position that CLI is only official interface, and using HTTP API is frowned upon? Is all information about a container available in `docker inspect` or API equivalent, or do I still need to parse `docker ps` to find out about names and links? Does the registry/index mess ever going to go away, did it even make sense (other than vendor lock-in) at some point? Since Docker and registry API is HTTP, why can't I use http auth (even implemented by an nignx proxy) instead of certs (which are fairly new) or centralized index for authentication? It should be as simple as using `[https://user:pass@IP/…`](https://user:pass@IP/…`) URLs, what's the problem with it? While we're at it, why on Earth is HTTP Docker endpoint specified as `tcp://IP:PORT` rather than `[https://IP:PORT`](https://IP:PORT`), which would make it possible and easy to proxy, use http auth in an intuitive way, and _generally reflect how it works rather than obscure it_? Should I go on?

<comment><USER6> > _(none of these is individually harmful, but I personally find the > monolithic architecture a bit of an issue)_

The architecture is not monolithic. I want to break down Docker into the most discrete and composable parts possible. But I want to do that without hurting the user experience. If you can point out a way to do that, I will implement it. And if you are available to help, it will happen faster.

> _is there a way to easily find out containers ' names and links, and exact > forwarded ports, from the API without regexping `docker ps` output and > "tcp/1234"-like strings that should be meant for human eyes only?_

You are not expected to parse 'docker ps' output programatically. That is not and has never been the recommended way to interact with Docker programatically.

Yes, the current API expects clients to parse strings like tcp/1234\. A string of the form [PROTO/]PORT seemed like a pretty reasonable thing to parse. But if you would prefer a json object like {"proto":"tcp", "port":1234}, I don't have a fundamental problem with that. Feel free to open a github issue to suggest it. In general we frown upon randomly breaking things but if it improves the situation for clients we will consider it. It could also make for a nice first patch if you're interested in that :)

> * Is it still Docker's official position that CLI is only official > interface, and using HTTP API is frowned upon?*

That was never true. I'm not sure how you got that idea. The HTTP API has existed forever, the official client uses it for 100% of its functionality, and I definitely recommend using that as the primary mode of interaction with Docker. I acknowledge that the API itself is not perfect, and will welcome any suggestions for improving it (we are discussing quite a few improvements already on #docker-dev).

> _Since Docker and registry API is HTTP, why can 't I use http auth (even > implemented by an nignx proxy) instead of certs (which are fairly new) or > centralized index for authentication?_

You can use all these things with the registry API. The centralized index is completely optional for authentication.

I'm curious where you got all these incorrect notions? If you read it somewhere in the docs, then it's a documentation bug and I would appreciate it if you could point it out so we can fix it.

> _It should be as simple as using > `[https://user:pass@IP/…`](https://user:pass@IP/…`) URLs, what's the problem > with it?_

I don't understand that part. I believe Docker registry auth today uses basic auth over TLS by default, which has security issues (ie storing your password in clear in your home directory). We are working to add a more secure token- based auth. But you should always be able to use basic auth if you prefer that.

> _While we 're at it, why on Earth is HTTP Docker endpoint specified as > `tcp://IP:PORT` rather than `[https://IP:PORT`](https://IP:PORT`), which > would make it possible and easy to proxy, use http auth in an intuitive way, > and generally reflect how it works rather than obscure it?_

I don't understand your question here either. Are you saying you would like the format of the command-line option _docker -H_ to start with _[https://*](https://*) instead of _tcp:// _? If so, I think that 's a good idea, but it also seems like a ridiculously small and cosmetic problem. I also don't understand how it affects http proxying or auth in any way. Regardless of the command-line flag, the API _actually uses https*. So auth and proxying should work completely as expected (with the exception of `attach` which drops to the raw TCP socket to allow bi-directional streams. But we have a websockets endpoint for that and I would really like to deprecate the "drop to tcp" mode soon.

<comment><USER7> > If you can point out a way to do that, I will implement it. And if you are > available to help, it will happen faster.

> It could also make for a nice first patch if you're interested in that

> I'm curious where you got all these incorrect notions?

> it also seems like a ridiculously small and cosmetic problem

A lot of your comments come across snarky and backhandedly hostile.

Regarding the tcp:// vs [https://](https://) \-- I think the parent comment is pointing out that Docker seems to have just made up a new address prefix which is used nowhere else and certainly is not standard. Even if it's a "ridiculously small and cosmetic problem", it should be fixed, and probably never should of been (perhaps hinting at the comment about slowing down to think instead of focusing constantly on new features and rapid fire). If it's the only small cosmetic problem, probably wouldn't be an issue... but add up many, and well...

Regarding the constant comments to commit -- I completely understand wanting others to put their ideas and critiques into PR's... but you have to see where it can come off a little condescending. Your users, of which not all are engineers, are offering critiques which will make your platform better for all, and your responses imply you will not consider any of them as valid unless they are in code, and even then, it's only a maybe.

<comment><USER6> The flag is _tcp: //_ for historical reasons. In earlier versions Docker did not use an http api, but a simple custom rpc protocol. Therefore it would have not made sense to use [http://](http://) . Then, when we introduced the http api, we decided to keep the flag for reverse compatibility (after all, as far as the user is concerned the functionality is the same: point to this network address, and you can control the daemon). We never really thought about it after that. I believe you're the first to complain about it. So, again - <USER4> you open an issue we will address it.

On suggesting commits: my intention is really not to be condescending, but to seek opportunity to recruit new contributors :) I even specified "if not, that's ok" to emphasize that. I have found that frustration about something in Docker has been the best source of new, valuable contributions. I'm just trying to catalyze that. And yes, I absolutely agree that non-code contributions are just as valuable as code contributions. Even taking the time to file a bug report, or suggest an improvement, is a contribution of your time and hugely appreciated. If you got anything else from my message, it was not intended.

<comment><USER7> > I believe you're the first to complain about it

I did not complain about it, the Parent post did, I simply clarified a point you seemed to not understand. But now that makes it twice it's been brought up.

> So, again - if you open an issue we will address it.

I do believe it's been brought to your attention here sufficiently for it to be addressed without my involvement.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> I hate to be that guy, but Slackware has been around for longer than FreeBSD, it beats it by a few months. One of Slackware's goals is to be Unix-like, and that decision is definitely evident in the distribution.

<comment><AUTHOR> Thanks for pointing that out! Post updated. Slackware was first distro I ever used seriously, after getting hooked up on Linux with a Red Hat 5.0 or 5.1 CD that was attached to a (printed) IT monthly newspaper. I have to tell, FreeBSD feels kind of similar to Slackware.

</comment></comment><comment><USER9> Check out CBSD([http://www.bsdstore.ru/en/about.html](http://www.bsdstore.ru/en/about.html)). Seems as a viable management tool for jails.</comment>


Ignore sunk costs - <AUTHOR> http://sethgodin.typepad.com/seths_blog/2009/05/ignore-sunk-costs.html <comment><USER2> I disagree with the internet-famous business writer and speaker. You can't blindly ignore sunk costs. You need to consider them to determine your ultimate return on investment, and you should consider them when opportunity- cost doesn't give you more appropriate answer, such as in this example:

"Or say you make a mistake and go to the concert instead of selling (those seats are $500 seats now). But Bruce is sick and Manfred Mann is substituting for him. You don't like him so much. But you paid $500 for the seats! Should you stay?"

Do you hate Manfred Mann? Will staying improve your feeling of happiness and satisfaction rather than leaving, when you look back on the night in two weeks?

I think what Seth is actually tying to say is: "When calculating the opportunity-cost of a decision, your emotional attachment to the money you have previously invested is not generally part of the equation", and "Base your decisions on opportunity-cost, not on sunk costs", which is sound.

Finally, will spelling the word on the sign correctly actually help the convenience store owner? Do people visit convenience stores based upon branding and proper lettering, or do they visit them because they are available or convenient? Your sunk cost has gotten you a sign. Is there another investment with a greater return than redoing the sign?</comment>


How to Wake Up at 5 A.M. Every Day - <AUTHOR> https://medium.com/better-humans/how-to-wake-up-at-5-a-m-every-day-ceb02e29c802 <comment><USER2> When i drink coffee, i can wake up easy at 5am. When i don't -> 8am. Explain that.

</comment><comment><USER3> Go to bed at 9pm every day. There, I just saved you a 15 minute read.</comment>


Took me 2 days to find this OpenSSL/Ruby solution - <AUTHOR> https://gist.github.com/davidpaulhunt/1b78697e4f69c56a210cd9017ed198ad <comment><AUTHOR> Usually, I'm pretty good at finding docs, posts, solutions, tutorials, etc. and reading through them to find a decent solution.

This time, however, it took me much, much longer; probably because it involved brew, ruby, and openssl without me realizing it. Before anyone says it, I understand it's probably pretty simple, but it wasn't to me and wouldn't be to everyone else, either.

Cheers!</comment>


The creator of Ruby explains why Ruby sucks - <AUTHOR> http://www.rubyist.net/~matz/slides/rc2003/index.html <comment><USER2> Having the creator of Ruby give a presentation outlining the shortcomings and planning for future fixes points more to something 'good' about Ruby than to something sucky.

<comment><USER3> How so? Aren't presentations about a current project's shortcomings/roadmap for improvements pretty standard?

I do agree that it speaks well about the developer, but your opinion about whether Ruby currently sucks or not should be informed by the content of the slides.

[edit] I can show you a shoe box and call it a car. I can candidly explain to you how it falls short of current cars, and how I will remedy these problems. All of that does not hide the fact that my shoe box is currently a sucky car.

<comment><USER4> "Aren't presentations about a current project's shortcomings/roadmap for improvements pretty standard?"

no. for instance, presentations about Rails are often about why other things suck (PHP, Java, VC-funded startups, etc.)

<comment><USER5> That's because most of the Rails fanbois are just that, fanbois. They like Rails, so that means that it's obviously the best thing in the world, and is totally unflawed.

But, in reality, all software sucks. If they can't see the suckage, it's just because of their ignorance.

</comment></comment></comment></comment><comment><USER6> The latest relevant update I found was this talk he gave at google

<http://www.youtube.com/watch?v=oEkJvvGEtB4>

I think most of you stumbled upon it, I also believe it was even mentioned on hacker news before

</comment><comment><AUTHOR> Although the slides date back to 2003, I wonder how much of it is still relevant?

<comment><USER7> read the slides, its still relevant.

1.8.x and 1.9 are just experimentation and intermediate steps to ruby 2.0 which is a "start from scratch" project

<comment><USER8> Ruby 2.0 is a not a "start from scratch" project. It's an evolution of the language (which will be done mostly in the experimental 1.9 releases) with a new interpreter. Once 1.9 is stable it will turn into the 2.0 release. The actual effect on Ruby users will be noticeable, but minimal.

See <http://eigenclass.org/hiki/Changes+in+Ruby+1.9> for some of the changes that are coming up.

<comment><USER9> with one clarification... (last I checked) 1.9.1 will be the stable, it won't be incremented to 2.0. Matz decided against the even/odd = stable/dev versioning scheme.

</comment></comment></comment></comment><comment><USER10> I only looked at the first few slides. Don't understand the problem with the block variables? The current version seems clearer to me than the new proposal. Variables are visible in the block they have been defined in, what could be easier to understand? Probably I am missing something, though...

<comment><USER11> The major problem with block variables in ruby is that if you do something like

        x = 4
        1.upto(5) do |x|
          puts x
        end
        puts "after the block x is #{x}"

It will print:

        1
        2
        3
        4
        5
       after the block x is 5

That is probably not what you would expect!

<comment><USER10> true, but for this it would be fine(?):

        x = 4
        1.upto(5) do |y|
          x = y
          puts x
        end
        puts "after the block x is #{x}

So the problem is only the parameter to the block?

<comment><USER12> The problem is that Ruby's scoping rules aren't consistent. Sometimes it appears lexically scoped, but sometimes it acts dynamically scoped.

Sometimes this leads to funny looking code (if you know to avoid it) or truly inscrutable bugs (if you don't).</comment></comment></comment></comment>


Show HN: ansiart2utf8, tidies BBS-style ANSI art for the terminal - <AUTHOR> https://github.com/BourgeoisBear/ansiart2utf8 <comment><AUTHOR> If you have any old ANSI art you'd like to use for MOTDs and the like, try this out, and let me know if you find any bugs.

Also, if you know of something that already does this, please let me know.

<comment><USER2> Yes, my python bbs has done this for many years, [http://x84.readthedocs.io/en/latest/api/userland.html#x84.bb...](http://x84.readthedocs.io/en/latest/api/userland.html#x84.bbs.output.showart)</comment></comment>


First Gigabit Wi-Fi Routers Ready to Launch - <AUTHOR> http://www.macrumors.com/2012/04/26/first-gigabit-wi-fi-routers-ready-to-launch/

<comment><USER2> This is great news, but probably not for the reasons you think. Gigabit WiFi doesn't mean you can throw away your gigabit ethernet switches for a couple of reasons:

1) WiFi is shared throughput, which means that all clients must share 1 gbit of throughput; a decent ethernet switch has enough backplane bandwidth to simultaneously serve all ports their full throughput.

2) WiFi latency will still suck, regardless of maximum theoretical throughput, and latency can make a "fast" connection appear dog slow [1] if latency values are high enough.

What's great about this news is that you have more throughput to share amongst your clients. Because your actual throughput is affected by RTT, you'll eventually bump in to a ceiling, but when you start to get in to the 1 gbps range, you can serve more clients at max throughput than you can with 400 mbps (802.11n).

1 - [http://routerjockey.com/2009/05/07/how-does-latency- effect-t...](http://routerjockey.com/2009/05/07/how-does-latency-effect- throughput/)

<comment><USER3> Every switch uses shared throughput and load balancing. This is no different from a Ethernet gigabit switch unless your switch has a > gigabit Up-link. Think about it - how are 2 clients hard wired to a gigabit Ethernet switch going to exceed 500 megabits of downstream simultaneously.

The Up-link to the switch is the limiting factor.

<comment><USER2> Your comments only apply to traffic on a separate layer-2 broadcast domain (uplink). Who has a gigabit uplink anyway?

This statement is absolutely false for LAN traffic: "This is no different from a Ethernet gigabit switch".

Even inexpensive gigabit switches are non-blocking these days. This means that they have enough bandwidth for all devices on the LAN to talk to each other at full throughput. This is where the real value of gigabit ethernet comes in. If you need to transfer large files over your LAN, a wired gigabit switch is going to far outperform gigabit wireless.

</comment></comment></comment><comment><USER4> 802.11ac also hasn't been ratified yet, so it's a pre-standard and not guaranteed to work with the final version. This happened with some of the earlier standards but lately it hasn't been much of a problem.

<http://www.ieee802.org/11/Reports/802.11_Timelines.htm>

</comment><comment><USER5> Why did they call it 802.11ac when there are already specs for 802.11a and 802.11c? This is only going to confuse people.

<comment><USER6> When they get to z the next standard is aa, then ab, ac, ad, etc. IEEE has never cared about human-readable names, so why start now.

<comment><USER7> It sounds like IEEE was in charge of naming drive letters in DOS/Windows :)</comment></comment></comment>


How can I overcome envy of people who are my age but are far more successful? - <AUTHOR> http://www.quora.com/Psychology/How-can-I-overcome-envy-of-people-who-are-my-age-but-are-far-more-successful-than-I-am

<comment><USER2> 1\. Convince yourself that success is a lottery and they were just mostly lucky.

2\. Embrace your envy and let it push you to strive harder.

3\. Stop thinking about others and use your mental energy to focus on what you're doing yourself.

4\. Accept that you aren't up to their level and live with your limitations. Not everyone is that capable. Do you spend much time envying olympic athletes your age?

5\. [insert another cliche here]

</comment><comment><USER3> How about envy of people who are much younger than me but are far more successful ... damn kids!</comment>


A Sour Surprise for Public Pensions: Two Sets of Books - <AUTHOR> http://www.nytimes.com/2016/09/18/business/dealbook/a-sour-surprise-for-public-pensions-two-sets-of-books.html <comment><USER2> Scary.

The absolute most important datum is "How long will I live?" not 90 for sure (like the article says).

Ten years more is my guess for me. Makes living now much easier.

If your $ is not in your bank or mattress don't count on it.

My state wants a constitutional amendment to guarantee teachers pensions.

Having a math mind and reading this brings back the "magic" of money. Some dude fixed my roof magically for money. But pension magic is black magic. Nothing but a trick,Bullwinkle. "Again, wrong hat!"</comment>


Remotely Change the Display on an HP Printer to ascii art with telnet. - <AUTHOR> http://deandunbar.tumblr.com/post/86285691921/remotely-change-the-display-on-an-hp-printer-to-ascii

<comment><USER2> Does this work on all hp printers?</comment>


North Korea's Hacker Army - <AUTHOR> https://www.bloomberg.com/news/features/2018-02-07/inside-kim-jong-un-s-hacker-army <comment><USER3> It's almost comical the different ways that North Korea tries to make money. Kim Jong Un is almost like a comic supervillain with his own country.

Among other things, they engage in:

* Manufacturing methamphetamine [https://www.talkingdrugs.org/north-korea-increasing-crystal-...](https://www.talkingdrugs.org/north-korea-increasing-crystal-meth-production-to-economic-sanctions)

* Fake money [https://news.vice.com/article/north-koreas-counterfeit-benja...](https://news.vice.com/article/north-koreas-counterfeit-benjamins-have-vanished)

* Counterfeit cigarettes and pharmaceuticals

* People trafficking

* A restaurant chain: [https://en.wikipedia.org/wiki/Pyongyang_(restaurant_chain)](https://en.wikipedia.org/wiki/Pyongyang_\(restaurant_chain\))

* Statues for African dictators: [http://www.bbc.com/news/magazine-35569277](http://www.bbc.com/news/magazine-35569277)

Their embassies are also expected to make a profit and sustain themselves, while sending money home.

The North Korean Embassy in Pakistan was suspected to be bootlegging alcohol: [https://www.reuters.com/article/us-pakistan-northkorea- insig...](https://www.reuters.com/article/us-pakistan-northkorea-insight/in- pakistan-north-korean-diplomats-alcohol-stash-raises-bootlegging-suspicions- idUSKBN1D80XG)

They rent out embassy owned land for a youth hostel in Berlin: [https://www.washingtonpost.com/news/worldviews/wp/2017/10/05...](https://www.washingtonpost.com/news/worldviews/wp/2017/10/05/germany- is-struggling-to-shut-down-a-hostel-funding-north-korea-the-hostel-is- fighting-back/)

They also smuggle ivory in Africa: [https://www.economist.com/news/middle- east-and-africa/217295...](https://www.economist.com/news/middle-east-and- africa/21729543-rhino-horn-and-ivory-smuggling-help-fund-regime-pyongyang- africa)

It's almost comical. The North Korean regime is completely morally bankrupt.

<comment><USER4> Sanctions shut them out of the legitimate economy. Probably easiest make money in the black market for illegal goods than in the black market for goods everyone else can sell legally.

</comment></comment><comment><USER5> This article to me is just more evidence that North Korea was not behind the Sony hack and possibly other high-profile attacks attributed to them.

I mean on the Sony end you have something requiring extreme sophistication and technical knowledge to pull something like that off.. and this article depicts North Korean hackers exactly how you picture them. Barely owning computers, not having enough to survive themselves, poorly organized, and grinding video games and selling pirated software as a means to make ends meet.

These two parallel depictions of the same group never seem to cross except in the opening paragraphs of articles where the reader is meant to assume that these groups are one in the same.

<comment><USER6> What about the Sony hack required extreme sophistication? The GoP's original emails were ignored _because_ they seemed like people who didn't know what they were doing. The source IPs were from a North Korean business in China. The malware matched what had previously only been used against South Korean banks, also from North Korean IPs. The reason the North Korean source IPs were seen accessing GoP's Facebook page and the compromised systems was due to sloppiness on the part of the attacker.

What motive does anyone else have to demand either that The Interview not be released or that the ending be modified so that Kim's death wasn't "too happy?"

<comment><USER7> >What other motive do you have for a Sony hack where the perpetrators demand either that The Interview not be released or that the ending be modified so that Kim's death wasn't "too happy?"

That Lulzsec are engaged in a game of misdirection?

I've never found "Malware X was used in attack Y" or "it came from these IP addresses owned by Z" to _ever_ be a convincing argument for attribution.

Whereas I'm fairly easily convinced that the party responsible for the hack would prefer it if the FBI believes that the real attacker is outside of their jurisdiction so they don't come knocking on their door.

The fact that North Korea is everybody's favourite bogeyman from the CIA down makes them a convenient mark.

North Korea also has a habit of admitting to and _bragging_ about military attacks whereas this time they just said "wasn't us, good job though guys". I'm not entirely sure what motive they'd have for denying the fact that they revealed a bunch of movie star salaries when most people think it was them anyhow.

<comment><USER6> > North Korea also has a habit of admitting to and bragging about military > attacks

They still claim no involvement in the death of Kim Jong Nam and the destruction of Korean Air Flight 858. You're confusing overt military actions with covert actions against civilian targets. Of course they will loudly boast about the former. Boasting about computer attacks that can help attribute other covert attacks is too stupid even for DPRK.

> I've never found "Malware X was used in attack Y" or "it came from these IP > addresses owned by Z" to ever be a convincing argument for attribution.

That's just the publicly released evidence, which is enough to draw a conclusion. You think somebody who is doing it for the lulz wouldn't then brag about doing it for the lulz on IRC? That happens every other time, which is one reason why your explanation is less plausible.

<comment><USER7> >They still claim they didn't destroy Korean Air Flight 858.

North Korea maintains that it was a false flag attack. The awkward timing (it occurred during the last throes of South Korean military dictatorship - <USER2> was a power struggle going on), the fact that the North Korean agent convicted of the attack was weirdly pardoned and the fact that North Korea had nothing really to gain from this attack lends some credence to this view.

But, in any case, if it _was_ them I can kind of see why they wouldn't want to admit to or approve of the wholesale murder of a bunch of civilians.

Revealing a bunch of movie star salaries, approving of it and not admitting to it? Can't see the what the point would be.

>That's just the publicly released evidence, which is enough to draw a conclusion. You think somebody who is doing it for the lulz wouldn't then brag about doing it for the lulz on IRC?

If they don't want the FBI kicking their door in, yeah.

>That happens every other time

...after which they got their doors kicked down.

> why your explanation is less plausible.

Because why would they learn from experience, right?

<comment><USER6> > Because why would they learn from experience, right?

You realize it isn't the same kid every time, right? The whole point of doing something for lulz is to laugh about it within a group of like-minded people who share techniques and hacks.

> Revealing a bunch of movie star salaries, approving of it and not admitting > to it? Can't see the what the point would be.

See GP post for reason. That it was really about not showing a film making fun of the leader makes them look silly. If it really were the case that their leader is so beloved all over the world that non-Koreans did it of their own volition as they claim, that would not reflect poorly on Kim, but then these supposed non-Koreans messed up by having so much evidence point to DPRK.

> North Korea maintains that it was a false flag attack.

The bomb was put on the flight by a pair of North Koreans. You believe that they were turned prior to planting the bomb? And what do you believe about the Kim Jong-Nam killers?

<comment><USER7> >You realize it isn't the same kid every time, right? The whole point of doing something for lulz is to laugh about it within a group of like-minded people who share techniques and hacks.

Yes. I both realize this and posited the admittedly _outrageous_ notion that rest may have reacted to one or two of them getting arrested by the FBI by developing better opsec and engaging in a bit of misdirection.

>See GP post for reason. That it was really about not showing a film making fun of the leader makes them look silly.

It was a film made by a foreign enemy that has threatened them countless times about the assassination of their leader. They were pretty open that they took it plenty seriously - if they didn't fear being made to look silly by complaining about it at the UN why would they fear looking silly because of the hack?

FWIW, if you made a similar film endorsing the assassination of a sitting US president the secret service would treat it as a national security threat.

>then these supposed non-Koreans messed up by having so much evidence point to DPRK.

As far as I'm aware there was no evidence that wouldn't have been easy enough to fake by hackers who had the skills to breach Sony's security. When I hear the word "sloppy" I can't help but think "deliberately placed in order to deceive".

<comment><USER6> > I both realize this and posited the admittedly outrageous notion

You apparently skipped why it is outrageous. There are no lulz if nobody knows about it.

> They were pretty open that they took it plenty seriously - if they didn't > fear being made to look silly by complaining about it at the UN why would > they fear looking silly because of the hack?

Complaining about how a country's leadership is depicted is one thing. If a President is depicted as a fool who gets assassinated by other countries, the US has every right to take offense. Retaliating with an illegal hack shows thin skin and (what you somehow have kept forgetting to address since GGGP post) exposes other hacks.

> As far as I'm aware there was no evidence that wouldn't have been easy > enough to fake by hackers who had the skills to breach Sony's security.

And you have yet to give a plausible reason for anybody to go through that trouble. In the meantime, we have lots of public evidence that says that DPRK has done similar hacks in the past, and the agencies claim to have additional bulletproof private evidence that they don't want to burn their sources for.

<comment><USER7> >You apparently skipped why it is outrageous. There are no lulz if nobody knows about it.

I'm sure there were plenty of "lulz" to be had among their little group and while they'd like the admiration of joe bloggs as well as their peers, joe bloggs' admiration can be ceded if it means the FBI isn't kicking their door in.

>Retaliating with an illegal hack shows thin skin

This is how your cultural lens filters it but it is not how they would see it. From their perspective, this hack would demonstrate North Korean technological superiority (important, because they have an insecurity surrounding this), while the outcome would demonstrate the moral decrepitude, hypocrisy and incompetence of the American and Japanese "imperialist aggressors". This is the nature of both their mindset and propaganda and it is very consistent.

No innocent life was taken. There was nothing really immoral about the act from their perspective (or in general).

The simplest explanation is just that they didn't do it.

I can well imagine that they erroneously believed (and probably reported in pyongyang newspapers) that the hack was performed by a secretive admiring ally.

>If a President is depicted as a fool who gets assassinated by other countries, the US has every right to take offense.

I like how when the tables are turned you somehow see it as something more serious. Your cultural filter is on display.

>And you have yet to give a plausible reason for anybody to go through that trouble.

Trying to prevent your door from getting kicked in by the FBI is more than a plausible reason.

>In the meantime, we have lots of public evidence

Yeah, like "here are some IP addresses in a log that ended up there because they were 'sloppy'". No potential for fakery there.

>the agencies claim to have additional bulletproof private evidence

I trust that about as much as I trusted the CIA's claim that they had bulletproof unseen evidence of WMDs in Iraq. It wasn't put on display because of national security concerns. It wasn't put on display because it doesn't exist.

The CIA goes to Congress every so often with their cap in hand asking for more money. This is the exact kind of thing they use to justify their budget increase. I typically bear this in mind when I hear them cite evidence that we are being protected from seeing for our own good.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Who are those programmers's handler? Is it Bureau 121 of the Reconnaissance General Bureau?</comment>


"We're doing emergency maintenance to recover the site" - <AUTHOR> https://status.github.com/messages/2015-05-06 <comment><USER2> 12:20 UTCEverything operating normally.

11:54 UTCWe've finished emergency maintenance and are monitoring closely.

11:40 UTCWe're doing emergency maintenance to recover the site.

11:32 UTCWe're seeing high error rates on github.com and are investigating.</comment>


Show HN: Re:Schedule – A calendar that helps you manage meeting overload - <AUTHOR> https://www.reschedule.app <comment><AUTHOR> The idea for Re:Schedule from oberving how teams got work done at meetings. The information used in meetings is typically spread out between different tools and organized separately in each tool. In effect, the team's collaboration is distributed across multiple tools, making it inefficient.

Re:Schedule's approach is to bring the information into your calendar, so that it because not only a tool for organizing meeting logistics but also a meeting workspace.</comment>


Exploring memcmp - <AUTHOR> http://justin.harmonize.fm/index.php/2009/05/exploring-memcmp/ <comment><USER2> memcmp is not the way to do it.

A much faster solution would be the same approach rsync takes with its "rolling checksum." To calculate the weak checksum of each block as you roll along the length of the file, you only have to do a calculation involving the bytes rolling out and in. <http://samba.anu.edu.au/rsync/tech_report/node3.html>

Then, for only the blocks that match this weak checksum, do memcmp or a strong digest check.

<comment><USER3> _memcmp is not the way to do it._

Absolutely. The right way to do it is to use the memmem library call.

 _A much faster solution would be the same approach rsync takes with its "rolling checksum."_

That's one way to improve performance, yes. (But it far predates rsync -- I think it might even predate Tridge.)

In many cases, a "look and skip" algorithm like KMP or BM will outperform a rolling checksum search; but of course if you've got 328MB of data on disk, nothing will make the search faster than the time it takes to read the data into RAM.

<comment><USER4> """ A much faster solution would be the same approach rsync takes with its "rolling checksum." """

I know this function is attributed to Bernstein and it's called Bernstein hash [0]. You're describing the Rabin-Karp string matching algorithm [1].

[0] [http://fr.wikipedia.org/wiki/Table_de_hachage#Fonction_de_Ha...](http://fr.wikipedia.org/wiki/Table_de_hachage#Fonction_de_Hachage)

[1] [http://en.wikipedia.org/wiki/Rabin- Karp_string_search_algori...](http://en.wikipedia.org/wiki/Rabin- Karp_string_search_algorithm)

</comment></comment></comment><comment><USER5> I don't have the time or energy to make a valuable comment about this, but my hunch is that in the real world, cache effects dominate instruction selection in how fast in-memory searching is.

<comment><USER6> 7% speedup by going with SIMD instructions. I think I'd have guarded the memcmp() call with a check of the first byte and saved the call overhead on 99.5% of the bytes instead (insert assumptions on data).

<comment><AUTHOR> memcmp returns as soon as it finds a byte that doesn't match.

<comment><USER7> The point is that calling a function is much more expensive than comparing a single byte. You'll have to fix your stack, jump to another location, check the first byte, unwind the stack, and continue your program.

EDIT: A quick test shows adding comparison of the first byte reducing execution time here from 2.6 seconds to 0.6 seconds.

(this is in reply to tptacek, I can't reply to his post?)

<comment><USER5> You're right, but this is such a "meh" microoptimization. Compared to the cost of a real memcmp(), a simple function call is below the noise floor.

<comment><USER6> I, and my data, disagree. Most memcmp() calls look at a single byte and return.

Let us consider five test cases:

memcmp0 - Calling memcmp() at each byte in the file looking ofr a match, as the original article.

memcmp1 - As above, but optimize by checking the first character and only calling if it matches.

memmem0 - A single call to the glibc memmem() function. Not portable.

kmp0 - The Knuth-Morris-Pratt algorithm as implemented at "Exact String Matching Algorithms", <http://www-igm.univ-mlv.fr/~lecroq/string/index.html>

bm0 - The Boyer Moore algorithm, also from above

Looking for a 1k needle which lies at the end of a 100MB haystack of random bytes, with the data in file system buffers on a 1.6GHz Atom processor running Linux 2.6.29:

      algorithm  milliseconds
        memcmp0      2400     </comment></comment></comment></comment></comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>====
        memcmp1       530     </comment><comment>==
        memmem0       460     </comment><comment>=
        kmp0          970     </comment><comment></comment><comment>==
        bm0            70     =

On the whole codesink1 wins with the Boyer Moore suggestion. In broader terms, algorithm selection beats optimization and all is right with the CS universe. (KMP's poor showing surprises me, but I've not used it before and don't know what to expect.)

If we assume the data is out on a hard drive, then we get these numbers (same machine, a WD Green Power HD which is an evil thing to benchmark with because it has variable spindle and seek speeds, but suffice it to say it is not terribly fast). All OS caches flushed before each test.

      algorithm  milliseconds
        memcmp0      3500     </comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>=====
        memcmp1      1300     </comment><comment></comment><comment>=
        memmem0      1200     </comment><comment></comment><comment>
        kmp0         1700     </comment><comment></comment><comment>=====
        bm0          1100     </comment><comment>=====

Here disk read time sets a lower bound, algorithm is still important, but not so much as before. I have a sneaky suspicion that mmap() is a poor choice here. There doesn't seem to be much overlap between the IO and compute when looking at the memcmp0 times.

Testing on a beefier machine, with a Core 2 Duo 2.8GHz, OS X gives this:

      algorithm  milliseconds
        memcmp0      1100     </comment><comment></comment><comment></comment><comment></comment><comment>=
        memcmp1       180     ====
        memmem0       not portable
        kmp0          360     </comment><comment>==
        bm0            88     ==

The processor is several times faster, but bringing pages in from the OS is slightly slower. I don't know how to flush OS buffers on this machine so I can't do the disk reading tests.

Update: well crap. this fell of the front page before I finished testing. No one will see these results, but I enjoyed the tests anyway. It is useful to update my rules of thumb and preconceived notions.

<comment><USER5> I'm impressed with the benchmark, but it seems to me like using the right algorithm for the job (in this case, Boyer-Moore or memmem) beats hacking memcmp to do a job it shouldn't be employed to do.

</comment></comment><comment><USER8> the boyer-moore algorithm should have been used. it would probably outperform any other given implementation for this kind of problems.</comment>


Databases: relational vs object vs graph vs document - <AUTHOR> http://www.cbsolution.net/roller/ontarget/entry/databases_relational_vs_object_vs <comment><USER2> Finally, someone on the Internet that has heard of object databases.

Too bad there is that whole management consulting thing in there, and that every _other_ word _is_ bolded.</comment>


ShowHN: Integrating PubNub with freeboard - <AUTHOR> https://www.youtube.com/watch?v=_hFpSQnPYXg

<comment><AUTHOR> Blog post tells more about it: [http://buglabs.tumblr.com/](http://buglabs.tumblr.com/)</comment>


Node.js v0.8 around the corner - nodejs-news http://www.nodejs-news.com/news/Nodejs-v0.8 <comment><AUTHOR> The text is copied _verbatim_ without attribution from Node's wiki; I think they should at least link back to it:

"API changes between v0.6 and v0.8" : [https://github.com/joyent/node/wiki/API-changes- between-v0.6...](https://github.com/joyent/node/wiki/API-changes- between-v0.6-and-v0.8)

<comment><AUTHOR> Oh, and I don't know where Joyent _announced_ this news - it certainly wasn't on their blog... and the article doesn't provide any source. The only time I saw anyone mention anything about 0.8's release date, was here: [https://groups.google.com/d/msg/nodejs/aRC2pbFN8NU/YXpB_vuCT...](https://groups.google.com/d/msg/nodejs/aRC2pbFN8NU/YXpB_vuCT9YJ)

There are (at least) 7 more open issues before 0.8: [https://github.com/joyent/node/issues?milestone=10&state...](https://github.com/joyent/node/issues?milestone=10&state=open)

\--

I feel guilty upvoting this story; specially given that submitter is just a dummy account promoting this blog.

<comment><USER2> izs mentioned @tacoconf that he wanted to get people to switch to 0.8.x @nodeconf

</comment></comment></comment><comment><USER3> Node.js 0.8 sounds great, though I'm afraid there will again be a long period where many of your NPM dependencies are simply broken, especially with the new build tool for native modules:

<https://github.com/TooTallNate/node-gyp>

We had a bit of a similar situation with the transition from 0.4 to 0.6 because of some API changes, especially the removal of EventEmitters from the C++ module API: [https://groups.google.com/d/topic/nodejs/rmvA434u3Dk/discuss...](https://groups.google.com/d/topic/nodejs/rmvA434u3Dk/discussion)

Hopefully this time it will happen more smoothly.

<comment><USER4> compiling & debugging native libs in node 0.7 is vastly easier, so I'm happy that 0.8 will be here soon. Previously you'd get a pretty generic hardcoded error message about failure to compile/link and it wouldn't be obvious what was the underlying issue. Also, gyp is a lot easier to use than waf -- it just generates the makefiles that are used to do the compilation.

The solution was to compile in 0.7 to see the error, then go back to 0.6 to make the module.

(I'll also mention I haven't run into any native compatibility issues between 0.6 & 0.7 yet)</comment></comment>


Online Event Processing - <AUTHOR> https://queue.acm.org/detail.cfm?id=3321612 <comment><AUTHOR> Recently saw Martin Kleppman's talk, "Is Kafka a Database" [1]. He pointed out this article on the ideas he and his colleagues have been exploring on distributed data stores. The talk and the article are great and I thought it was worth sharing! This [2] talk also goes into more details of the thinking behind all this.

[1] [https://www.youtube.com/watch?v=BuE6JvQE_CY](https://www.youtube.com/watch?v=BuE6JvQE_CY)

[2] [https://www.confluent.io/blog/turning-the-database-inside- ou...](https://www.confluent.io/blog/turning-the-database-inside-out-with- apache-samza/)</comment>


Google sponsors climate change deniers - <AUTHOR> https://mashable.com/video/google-sponsors-climate-change-deniers/ <comment><USER2> Mashable now uses the phrase "climate deniers" as if there are people running around denying that climate exists.</comment>


The Hanukkah Dreidel game scales in O(n^2) with the number of tokens per player - <AUTHOR> https://www.sciencedirect.com/science/article/pii/S0196885805000886 <comment><USER2> (2005)</comment>