IE9 Leads Pack in HTML5 Support? Not Exactly - <AUTHOR> http://www.wired.com/epicenter/2010/11/ie9-leads-pack-in-html5-support-not-exactly/

<comment><USER2> A while ago there was a thread on HN asking why so many programmers hate Microsoft. This episode explains a lot.

[http://www.appleinsider.com/articles/10/11/03/w3c_publishes_...](http://www.appleinsider.com/articles/10/11/03/w3c_publishes_extremely_silly_html5_test_results_suggesting_win_for_internet_explorer_9.html)

</comment><comment><USER3> "IE 9 has some support for CSS 3, but it lags behind other browsers"

Which isn't really relevant to whether it is better at supporting HTML5. Totally different specs.</comment>


Looking for a cool job? Forget job boards, talk to angel investors - <AUTHOR> http://shazow.posterous.com/protip-for-ambitious-engineers-looking-for-a

<comment><USER2> Yep. I've invested in 40 or so companies and many are hiring. Job boards are hard for early startups because the early employees are so formative that it really is about hiring exceptional people rather than filling headcount.

</comment><comment><USER3> If they are "desperately hiring," why aren't they promoting the positions? Even mentioning them on their own websites? Putting the word out to recruitment agents etc. Just seems strange, that's all.

<comment><AUTHOR> They do. Many institutional angel investors have their own job boards, especially since they hold dozens of companies in their portfolios:

<http://www.ventureloop.com/foundersfund/> <http://www.felicisvc.com/jobs.aspx>

Smaller individual angel investors have more ad-hoc operations and haven't bothered with streamlining hiring for their investments. This may change.

<comment><USER3> Interesting links, thanks. Start-ups interest me, but given where I live, the development work is nearly always from new media agencies.

</comment></comment></comment><comment><USER4> I find a decent number of the companies that I cover (I write about companies that are hiring) by following investors. Their job is to be up on what's next. The only quibble that I have is that it may be tough to get an angel investor's attention. That doesn't mean that you can't follow them on Twitter, read their blog, and stalk them in myriad other ways.

</comment><comment><USER5> If you're looking for a challenging engineering job, the Contagion Health team is truly awesome. They think big, and with Andrey you will learn _a lot_.

<comment><USER6> Aww shucks. Thanks shykes.

<comment><USER7> Out of curiosity, how did you pick the name? The word "contagion" gives me the chills and I imagine boils on my skin. Although now, imagining this, I'm motivated to exercise to keep myself in good health =)

</comment></comment></comment><comment><USER8> Second this. Most of the VC backed and Seed funded startup CEO's I know are desperate for good engineers/developers/designers.

It's a good time now if you are in the job market.

</comment><comment><USER9> I would say the only startup worth working on is your own.

Working at someone else's startup is a recipe for getting exploited - overworked and underpaid. And the worst thing about it is that it's all couched in an atmosphere of guilt trips and taking-it-for-the-team.

I'm sure there are exceptions. I just haven't seen any.

I'd rather work for The Man in my day job in a cold corporate environment where everything is explicit from the get-go, get well paid for it and crank out code for my own startup in my free time.

<comment><USER10> I've read this complaint many times on HN, but my real world experience just doesn't match. All the employees from startups in our YC round, that I've met at parties, meetups and other events seem to be pretty amped about what they're working on.

Our engineers are free to work however many hours they choose; all I care about is that we get stuff done. My co-founder and I certainly put in long weeks, but I would be deeply concerned in any of our engineers put in as many hours as we do. In fact, I am constantly reminding our engineers that they need to maintain work/life balance because I don't want them to burn out. To put in another way, they volunteer to work long hours and I tell them to work less.

It doesn't makes sense to overwork engineers. Talent is hard to acquire in Silicon Valley, so I (and most other startup founders I've met) put effort into retaining it.

(By the way, we're hiring Ruby hackers, learn more at [http://seeinginteractive.com/company/jobs/software- engineers...](http://seeinginteractive.com/company/jobs/software-engineers/))

<comment><AUTHOR> Completely agree. I totally think this is the right way to do it, and I really hope we can sustain that model. At the very least, it'll be awesome while it lasts. :)</comment></comment></comment>


Show HN: Certmon – Monitor and track TLS endpoints for certificate expiry - <AUTHOR> https://github.com/turbobytes/certmon <comment><USER2> So many open source projects being submitted lately without even having a screenshot. Would it kill these maintainers to spend 5 seconds uploading a screenshot? Or do they really expect a bunch of people to clone and try out a repo based on a one line description?

<comment><AUTHOR> The main goal of this project is as a helper for monitoring/alerting, a very basic UI is present and is optional.

I made this tool for our internal use, and posted it here just in case anyone else has similar issues.

Edit: Added screenshot [https://github.com/turbobytes/certmon#screenshot](https://github.com/turbobytes/certmon#screenshot)

<comment><USER2> Perfect. Sorry if I came across as negative, this was just the last of several projects I had seen submitted today without screenshots, thought I'd bring it up.

Looks like a very useful project. Here is a similar one I have been using: [https://github.com/cmrunton/tls-dashboard](https://github.com/cmrunton/tls- dashboard)

<comment><AUTHOR> Looks cool, but it appears to have the same problem I have with all other similar tools, i.e. I can't specify which IP(or hostname) I want to test against. This is not an issue if your service is behind a single server(or loadbalancer)

Check out the "endpoints" portion in example config : [https://github.com/turbobytes/certmon/blob/master/example_co...](https://github.com/turbobytes/certmon/blob/master/example_config.yaml)</comment></comment></comment></comment>


Why Ben Rooney is wrong. A response to "How Entrepreneurial is Europe?" - <AUTHOR> http://www.geektime.com/2013/11/13/why-ben-rooney-is-wrong-a-response-to-how-entrepreneurial-is-europe/

<comment><USER2> I wouldn't say he is wrong, it's just that the analyses is not based on good data.

</comment><comment><USER3> Ben Rooney is wrong :-)</comment>


The Hitchhiker's Guide to Concurrency - <AUTHOR> http://learnyousomeerlang.com/the-hitchhikers-guide-to-concurrency? <comment><USER2> Hi, author here. Let me know if you have any comments or feedback. It's always appreciated and I hope you enjoy the read.

<comment><USER3> "Sending messages that nobody will read is as useful as writing emo poetry."

Loved it. I'd like to see a PDF version. I see that you mentioned in an earlier post that you're not that familiar with generating PDF files. I'm not that familiar, either, but from what I've gathered most authors use TeX markup with their writing and then use the TeX source to generate PDFs via pdfTeX.

Anyways, enjoyed the writing and the pictures. Great job on the formatting, too. Really liked the "don't drink too much kool-aid" segments. I did find some of the code samples a little confusing, but I'm, admittedly, an amateur programmer and I've never dealt with Erlang before. I didn't really grasp what an Erlang module is or the specifics of using spawn. I gather that these are probably basics that you may expect a reader to already be familiar with, maybe covered in an earlier chapter, but maybe you could add a sentence here and there explaining the code samples a little more in depth.

<comment><USER2> I don't know TeX either and it could be a way to force myself to learn, thanks for the suggestion.

I did assume previous knowledge for this chapter, but everything you need has been shown in the ~10 previous chapters. So far, the book is still meant to be read in a linear manner, but this could change once enough material is covered. I could add a few more links in a wiki-like manner.

Thanks for the positive comments, too. Much appreciated.</comment></comment></comment>


Why I stopped wearing a smartwatch - <AUTHOR> http://www.computerworld.com/article/3147429/wearables/why-i-stopped-wearing-a-smartwatch.html <comment><USER2> Its literally so simple to fix this problem. The watch needs to be self sufficient.

Apple Watch already has GPS. Perfect it by adding 3G/Wifi functionality. A standalone system will bring back the watch market.

<comment><USER3> It's need to be self sufficient to sell more too. Watches are jewelry, so you want more than one. Right now it's painful to have more than one wearable. They could boost sales with a smaller market by just letting the niche be able to do multiple devices.</comment></comment>


FullContact expands to India with aquisition of email intelligence startup - <AUTHOR> https://techcrunch.com/2016/08/23/fullcontact-profoundis/ <comment><AUTHOR> Related:

[https://news.ycombinator.com/item?id=12342048](https://news.ycombinator.com/item?id=12342048)

[https://news.ycombinator.com/item?id=12343049](https://news.ycombinator.com/item?id=12343049)</comment>


FBI says Russian FaceApp is 'potential counterintelligence threat' - <AUTHOR> https://www.reuters.com/article/us-usa-tech-russia/fbi-says-russian-faceapp-is-potential-counterintelligence-threat-idUSKBN1Y62D4 <comment><USER2> "The Federal Bureau of Investigation considers any mobile app developed in Russia to be a "potential counterintelligence threat,"

Seems like kind of a non-story to me - Russians develop apps, FBI considers any Russian app a security risk. Ok.

<comment><USER3> Not sure if it is just because people don't understand biometrics, or what; but here goes.

It's a counterintelligence tool since it effectively funnels biometric info to the Russian government. All of those users can now be identified if they are ever engaged in any meaningful capacity of intelligence gathering.

China, and the U.S. even, are pushing to build the same types of databases. The shit has hit the fan, because ingrate couldn't leave well enough alone and uncorked the Holy grail of pervasive automayed mass surveillance/identification.

Combine the pictures with information from a certain OPM leak, and now foreign agents can now identify American assets on their home turf or while operating in America.

The first time I read about that app, I NOPED out loud and made sure no one in my immediate circles had anything to do with it. Data is precious, and there are more ways than ever for people to Hoover it up.</comment></comment>


Missile launch over San Francisco - <AUTHOR> https://vimeo.com/145029572 <comment><USER2> I believe the blue is the second stage igniting. Heavy nitrogen content in the Titan II's solid fuel, which lends it that color. There is a prima facie decent analysis and a different, good video over on Reddit: [https://np.reddit.com/r/LosAngeles/comments/3s06dt/op_delive...](https://np.reddit.com/r/LosAngeles/comments/3s06dt/op_delivers_best_footage_of_ufo_missile_test/cwt4682?context=3)

Interestingly you can see 'flip turns' in the video, a maneuver the missile repeats 14 times to disperse its MIRV payload.

</comment><comment><USER3> I'm guessing it's high enough that the exhaust is catching the sunlight. It's an amazing sight certainly.

I'd love to find out what makes the blue portion of the trail. I note that it does not disperse as much.

<comment><USER4> I think that's the sonic boom as the missile goes supersonic. Pressure wave changes the vapor point of water; water condenses in the shockwave left behind; moonlight reflects off the fog.

[https://en.wikipedia.org/wiki/Vapor_cone](https://en.wikipedia.org/wiki/Vapor_cone)

Notice that the missile is a pinprick of light until it reaches a certain altitude & speed.</comment></comment>


93% of Paint Splatters Are Valid Perl Programs - <AUTHOR> http://colinm.org/sigbovik/ <comment><USER2> > Also, ImageNet's website was down on the day that we decided to perform this > research. We therefore paid an unemployed person to download 100 examples of > paint-splatter artwork by searching Pinterest using the query "paint > splatter wallpaper".

Such brutal honesty would be welcome in other papers.

<comment><USER3> The author recently quit Google[0], so I believe he's unemployed. I think that's the joke (also, he really likes his memes).

[0] [https://mobile.twitter.com/mcmillen/status/10863837264504053...](https://mobile.twitter.com/mcmillen/status/1086383726450405376)

<comment><USER4> There's a footnote on "unemployed person" with the text "the first author."

</comment></comment></comment><comment><USER5> I love this footnote so much:

> This feature does enable a neat quine: the Perl program "Illegal division by > zero at /tmp/quine.pl line 1.", when saved in the appropriate location, > outputs "Illegal division by zero at /tmp/quine.pl line 1." The reason for > this behavior is left as an exercise for the reader.

<comment><USER6> It's trying to divide "Illegal division by zero at /" by "tmp/quine.pl line 1." and "tmp/quine.pl line 1." evaluates to 0?

<comment><USER7> Or "quine.pl line 1." Evaluates to 0?

Or should that be 0.0???

<comment><USER8> Yeah, I think it's both divisions. Both 'perl -e "in /tmp"' and 'perl -e "tmp/quine"' result in the same division-by-zero error.

</comment></comment></comment></comment><comment><USER9> Because of the frequency I see undecipherable strings like this in actual Perl code, I don't like Perl the programming language. However, I love Perl the project. Take a look at the config file for Perl and how many systems and architectures it accommodates: [https://github.com/Perl/perl5/blob/blead/Configure](https://github.com/Perl/perl5/blob/blead/Configure)

It's clearly such an incredible labor of love by Larry Wall et al. that I'm sad for them it isn't more popular. Just a mammoth amount of work by nice, passionate people.

In my world (bioinformatics), it was initially the go-to language. Even today I very occasionally run across something using BioPerl, requiring me to stumble through CPAN again. I get pretty nostalgic thinking about it.

<comment><USER10> Perl gives you as much rope as you want to hang yourself. If you can develop a style, and try to avoid being too clever, it can be just as readable as any other language.

<comment><USER11> And then someone else tries to read your code. One of the things I love about ruby dev is its not about providing 10000 ways to do the same thing but about making sure that given a simple problem, every developer will solve it in pretty much the same way.

<comment><USER12> What? With ruby, there are at least 4 ways to find out how big something is (.size, .length, et al). You want to loop over something? You can use python style for in loops, .each, and several other ways. Your block could be a block, or it could be a symbol with an & in front. Want a bit of code without a name? You have blocks, procs, and lambda. Want a string? You have string and symbol, and ne'er the two shall cross paths.

Ruby is specifically designed as a replacement for perl, and keeps a lot of the same warts ($igils, and globals like $?, $1, etc). While I agree it's better than perl for readability, it's not because there's only one way to do any given thing.

</comment></comment></comment></comment><comment><USER13> I recently wrote a little program that will create a Markov Chain from on our perl codebase, generate a few sentences and check against `perl -c`. It takes less than 10 attempts to generate a bunch of lines of [very funny] valid Perl code.

<comment><USER14> Hey! I did that too! Except my version ran the Markov chain against its own source code, which was padded with a bunch of meaningless subs that did were never called but were valid code. It also ran in an infinite loop, which worked well. I had to kill it after a few minutes because I was afraid it would start running shell commands.

<comment><USER15> And the terrible truth is this is how we got skynet.

</comment></comment></comment><comment><USER16> Perl can return the favor. [https://metacpan.org/pod/Acme::EyeDrops](https://metacpan.org/pod/Acme::EyeDrops)

</comment><comment><USER17> 93% of random OCR outputs are valid Perl programs. The paint splatters are a distraction.

<comment><USER18> There's at least an infinite number of infinitely long inputs to Perl. Which proportion of these will terminate without an error?

<comment><USER7> Trick question.

An infinitely long input will never finishing reading, so we'll never find out :)

</comment></comment></comment><comment><USER8> > We manually filtered out all images with any form of overlaid or watermarked > synthetic text, because the Perl program (?) "iStock by Getty Images" is not > particularly interesting.

It's also not a valid Perl program:

        bash-4.3$ perl -e "iStock by Getty Images"
        Can't locate object method "Getty" via package "Images" (perhaps you forgot to load
        "Images"?) at -e line 1.

</comment><comment><USER19> I miss Perl. Why did PHP win again, in the late 90s? (though I'm mostly Python these days and shan't complain, there was a good 10 year stretch of PHP there I'm not proud of).

<comment><USER20> PHP won because it was easy to install and restrict (by memory usage) on shared servers, as well as the fact that writing a PHP script was as simple as renaming an .html file to .php so web designers who wanted some dynamic functionality could use it really easily.

As bad as some aspects of PHP were, making it so trivial to install and make available on a server was a brilliant move that lots of languages could still learn from today.

If you have a project you want to become popular putting real work in to the initial onboarding is vital.

<comment><USER21> The parent nailed it. It's easy to complain about PHP from various standpoints both pragmatic and PL-centric, but it has an amazing superpower which might be summed as "serverless for the web, v0".

<comment><USER22> No deployment setup will ever match the pure joy of dragging a .php file into WinFTP, watching the little blue progress bar, and refreshing your browser.

<comment><USER23> Yes! But not exactly relevant: this deployment technology is supported by Perl/CGI just as well.

<comment><USER22> Definitely. I wasn't trying to be relevant so much as I got nostalgic at the mention :)

</comment></comment></comment></comment></comment></comment><comment><USER24> Do any of the splatters generate a "use strict;" at the beginning?

<comment><AUTHOR> It would be interesting to reverse-engineer this to figure out which paint splatters reliably produced "use strict;".

<comment><USER25> Presumably one could have AFL fuzz determine the input needed to generate any desired outcome if splatter generation is automated.

</comment></comment></comment><comment><USER26> Quite against my better judgment, I've made the transition from Perl-hater to Perl- er... -tolerator.

I found myself arguing yesterday with another person in the team about the proper use of Perl references, which I cursed and spat on for 2 days when I first had to use them.

I once read that my current position mirrors that of most Perl users.

(my boss has a self-confessed "irrational" hatred of Python because of semantic whitespace. Which is ironic, because they're the one who pushed for using YAML, which also relies on semantic whitespace (at least in the way we use it))

<comment><USER27> I kinda agree with you boss. I don't hate python, but I find semantic whitespace both tyrannical and error prone. Interestingly, Makefiles also have semantic whitespace, which seems to be much more commonly despised than python's.

<comment><USER28> What do you find error prone in it? As I just posted above, it solves the problem of loosing braces when moving code blocks around.

</comment></comment></comment><comment><USER29> So who's going to write the app we can carry on our phones into MOMA and evaluate the Jackson Pollocks?

</comment><comment><USER30> > source code not available yet because i am bad at GitHub

I had to chuckle at that. The whole this is so ridiculous and it's wonderful :D

<comment><USER31> The paper is part of the SIGBOVIK "conference" that takes intentionally funny computer science papers (of varying degrees of rigor) every year. This paper is in good company alongside "Aumann agreement by combat", "Survival in chessland" (an investigation of what chess piece you want to be to minimize your chance of being captured in a game), "NaN gates and flip FLOPS" (re- representing binary operations as valid floating-point logic on NaN and inf, then building a hardware implementation of a machine that computes on that logic using standards-compatible floating-point representations of those values), and "Need more RAM? Just invent time travel!"

Full proceedings document for this year: [http://sigbovik.org/2019/proceedings.pdf](http://sigbovik.org/2019/proceedings.pdf)

</comment></comment><comment><USER32> 100% of TECO [https://en.wikipedia.org/wiki/TECO_(text_editor)](https://en.wikipedia.org/wiki/TECO_\(text_editor\)) inputs are valid programs, or so the story goes.

<comment><USER33> "a common game for TECO fans was to enter their name as a command sequence, and then try to work out what would happen"

</comment></comment><comment><USER34> I wonder how much of Perl's decline can be attributed to the Duke-Nukem- Forever-tier delay in releasing perl6.

It seemed like so much of the web ran on it in the late 90s and early 2000s that it would have at least as much traction as PHP does today.

<comment><USER35> Perl6 was a reaction to Perl's loss of mindshare, not its cause.

One can speculate what might have happened if focus had been put on evolving Perl5, or getting Rakudo production-ready as-is instead of going through yet another round of 'tinkering' (eg making the compiler backend-independent, the New Object Model refactor, creation of MoarVM, the Great List Refactor, ...) - however my crystal ball seems to be broken and just continues to display 42 no matter the question...

<comment><USER36> > The design process for Perl 6 began in 2000

I don't remember Perl losing mindshare around that time; quite the opposite.

<comment><USER37> Perl6 wasn't _released_ until 2016, though.

<comment><USER38> You mean, 1.0 of the _spec_ was released then. Don't pretend it wasn't perfectly possible to write and run useful Perl6 programs for a good ten years prior.

[https://en.wikipedia.org/wiki/Pugs_(programming)](https://en.wikipedia.org/wiki/Pugs_\(programming\))

[https://github.com/viklund/november/](https://github.com/viklund/november/)

<comment><USER37> For some definition of 'perl6'. I have a perl6 book from o'reilly from 2006, and I flipped through it recently. It bears almost no resemblance to modern perl6. There were a _couple_ of things that were still the same (and not just vestiges from perl5 like sigils and function calls looking like function calls), but by and large it was something completely different.

</comment></comment></comment></comment></comment></comment><comment><USER39> Still my favorite language.

<comment><USER8> This has, in fact, reinforced my sincere belief that Perl is God's chosen language.

<comment><USER35> [https://xkcd.com/224/](https://xkcd.com/224/)

<comment><USER8> There it is.

</comment></comment></comment></comment><comment><USER40> I strongly recommend that you read the linked paper also.

</comment><comment><USER41> Interpreting a Banksy as Perl should hack the DNC and GOP to give all their money to charities.

<comment><USER42> Or it should output an [https://en.wikipedia.org/wiki/Illegal_prime](https://en.wikipedia.org/wiki/Illegal_prime)

</comment></comment><comment><USER43> I like Perl. It is magic.

<comment><USER44> It's by far my preferred method of turning thoughts into code quickly, though I don't know what that says about my thoughts.

The free form nature is amazing to spec out an idea and see what happens. Where it falls short for me is static analysis - a simple question like 'if we change this module, how many scripts will be affected?' is very difficult or impossible to answer due to the number of ways you can abuse Perl. Though in most cases, we get by.

</comment></comment><comment><USER8> For additional fun, try piping random characters into perl:

        $ chars='A-Za-z0-9!"#$%&'\''()*+,-./:;<=>?@[\]^_`{|}~'
        $ </dev/urandom tr -dc $chars | head -c 10 | tee random.pl | perl

Usually you'll encounter a syntax error, but sometimes it does execute without errors. Usually the successful ones are successful only because Perl finds an errant octothorpe and skips over all the other literal line noise after it.

Regardless, fun to know that

        L8vw>@ksSU

is a valid - useless, but valid - Perl program.

</comment><comment><USER45> The irony is that the readability of 93% of actual Perl code is equivalent to the paint splatters

<comment><USER46> The logic doesn't follow the other direction. It isn't a necessary condition. We're doing (93% paint splatter -> perl code) but that isn't equivalent to (93% perl code -> paint splatter). The first could be valid AND the following can be valid (0.1% perl code -> paint splatter)

<comment><USER47> Aren't 100% perl code -> paint splatters. For each code there exists a paint splatter i.e. image of the code itself.

<comment><USER46> I'm just saying the logic doesn't follow. Given the claim does not necessarily require the opposite to be true. I don't actually know much about this perl being paint splatter and why that even makes sense.

Your statement might make sense, but what I'm saying is that the claim in the title doesn't equate to the claim you made. That's all I'm saying.

<comment><USER45> You're super fun at parties I bet

</comment></comment></comment></comment></comment><comment><USER48> My first programming was done with Perl. Those first attempts at programming definitely resembled a monkey throwing paint at a wall, so this does not surprise me.

</comment><comment><USER49> No way. I've been known to joke to people around me for a decade that 90% of speech bubbles of cursing comic characters contained valid Perl code. I don't believe someone actually set out to prove it (or something very similar at least). Things like these are why I love HN.

</comment><comment><USER50> ah, a nice and absurd sigbovik presentation. everything I hear from that convention has been simultaneously silly and amazing (especially the stuff that Tom7 did like having a printed program with only printable characters that is a valid and compiling c program)

<comment><USER51> Um. He made an _executable_ using only printable characters.

</comment></comment><comment><USER52> If you never worked in perl, you might think people are being a bit mean and want to take a contrarian position. It really was that bad. You'd come back from lunch and need to pull out a notepad and start diagramming to understand the code you are written an hour earlier. The only language I've ever seen, outside of joke languages like brainfuck, where the typical program was less readable is APL.

<comment><USER53> > You'd come back from lunch and need to pull out a notepad and start > diagramming to understand the code you are written an hour earlier.

I think this says more about your skill level in programming Perl or programming in general at that time than it does about Perl. Or at least the influences that you learned Perl from.

It's possible to write nearly unreadable code in any language. It's easier to do so in Perl, since it's pretty freeform. It's also not that hard to write very clear code. But you're complaining about your _own_ code. I think perhaps blaming the tool at that point is looking in the wrong place.

<comment><USER52> I was certainly not a good programmer back then. But when I started writing java (1.1!) instead my bad code was a lot less bad.

While I'm sure it's _possible_ to write maintainable perl I've never heard anyone say "we had 10,000 lines of perl and it was a joy to work with." Ever.

<comment><USER53> The Java version puts the prior comment in perspective. I agree even most Perl programmers would not want to work on a codebase from this Era. The problem is that Perl was the de-facto web programming language at the time, and large swaths of the internet was written by Perl neophytes and programming amateurs. The code generated by this population was necessarily problematic.

By the same token, PHP codebase of the early 2000's were a horrible mess. There is a downside to being among the popular and accessible languages of a period. It takes a while for the general community skill level to increase and best practices to trickle down to new people. Javascript of a few years ago wasn't all that different, except for a large amount of experienced programmers from other languages also being involved because of its privileged place as the language of web browsers.

These days, I wouldn't imagine most codebasse of 10k lines in Perl being noticeably worse than in Python or Ruby.

</comment></comment></comment></comment><comment><USER54> But what I want to know is what percentage of perl programs could be represented as paint splatters?

</comment><comment><USER55> Wonder what it would take to transform, as an one to one function, any random text into a syntactically correct program of any language. Off the top of my head, enclosing the text in a string literal would work, but are there more interesting methods out there?

</comment><comment><USER47> Why not just generate random strings and then see how many of them are valid Perl programs. Pretty sure it will land around the same number. The image ->OCR->Perl is making a boring statement fancy for no reason.

</comment><comment><USER56> How can one grab the output? The following (first line) saves nothing to the file as is seen in the second line and with the program in the third line:

~$ ./perltest | tee output.txt

~$ cat output.txt

~$ cat perltest

#!/usr/bin/perl

eval(";i;c;;#\\\?z{;?;;fn':.;");

</comment><comment><USER57> Not surprising, I often felt you could roll your face across the keyboard and it'd be a valid perl program.

</comment><comment><USER58> is it true with all OCR engines

</comment><comment><USER59> I LOL'd at "TLDR: read the paper and view the gallery of pretty Perl programs."

</comment><comment><USER60> Perl is a mess.

<comment><USER8> Perl is art.

<comment><USER61> Art is Perl.

<comment><USER62> Well, about 93% of it at least.

<comment><USER56> 93% of a sample space of 100 splatter artworks is.</comment></comment></comment></comment></comment>


NY's Telecommuting Tax Penalty - <AUTHOR> https://www.biglawinvestor.com/new-york-telecommuting-tax-penalty/ <comment><AUTHOR> With all the talk of remote work lately due to Coronavirus, stuff like this and other employment stuff to think about.

Then if say you had a startup in San Francisco and wanted to hire someone remotely from say Cincinnati. Then you are creating obligations in Ohio for your business too (Same as if you owned a brick and mortar office even if you aren't locally there) and then if you don't own an office there since they work from home that probably would complicate things too when it comes to paperwork and taxes. So if you wanted to let people be remote from any location, that's extra stuff for your HR, Accounting, Legal people to handle if in a larger startup and some large companies even write their own custom software to handle the complexities of dealing with multi-jurisdictions and tracking things, while a small startup probably just pays for a HR SaaS that assumes only a single office... So if you hired just anyone remotely instead of targeting specific cities then that could pile up especially if there's only a single employee in a location.

Then since some stuff is city by city or county by county since some places require home occupation permits (which depending on the area you need to get signed off by the fire department and your landlord if you rent since they consider you operating a business from your house) and business TPP taxes where you have to pay a property tax on business assets, so if you sent a employee new monitors and a MacBook to their house which they'd return upon leaving the company as the company retains ownership, so if they lived in an area with this (Seems most county and cities have this in Florida and have to file with both at the same time if they both have it. Since they don't have some taxes other states have, this seems like one way they make up for it), wonder if that'd consider every employees house as being an office for the business then? Seems like the whole remote thing opens up a can of worms unless you only hired people remotely in the same city as your business maybe where you have an office. Then I know some of that stuff is public too...

Not sure if people challenge home occupation permits, some seem to apply even if you are just sitting on your computer in your bedroom while some are aimed at clients visiting your house, meetings, etc... Some seem to have a list, so like programming at home without clients visiting or extra vehicles, noise, etc would be exempt while other cities apply it to all regardless. I doubt they'd know if someone was programming in their bedroom anyways though. Sounds like Portland, OR has a more reasonable one compared to other cities i n a random search. I know some non-profit ended up getting some permit to be a tour guide struck down, so wonder if a similar thing they could fight... Don't see how someone dabbling in programming and working remotely should have to pay a $200 a year fee, looks like some random city in California wants that. Probably could argue writing source code is speech! I think that's what Apple used to get around backdooring iOS...

Seems like remote work kinda reminds me of full time RV or Van life challenges since you have to pretend you live with someone and trust them to handle your mail since most states don't allow mail forwarders. Seems like RV people pick South Dakota, Texas and Florida (however it's county by county as some counties won't allow it) to change their domicile too. Was reading somewhere was from Michigan, decided to sell everything they own to live in a RV and didn't want to deal with changing domicile so they just got a mail forwarder in MI and updated their address online but later the Michigan DMV sent them a letter saying the address wasn't residential and giving them a short amount of time like 10 days to correct it or be suspended. Then remember some RVer used a parents address in IOWA and got Jury Duty so they called the number while they were across the country in like Texas or Arizona and was told living in a RV wasn't an excuse (while Texas and South Dakota will excuse full time RVers if you call the clerk, Polk County, Texas where the city of Livingston is in, is supposed to be very friendly to establish yourself as a full time traveler.

Just seems like laws wasn't really written considering you could have people working remotely or living mobile traveling full time. I'd imagine less than maybe 10% of people work remotely or less than maybe a few percent living in a RV or Van. Seems like they assume everyone lives in a house and commutes to a nearby office. Just seems like the gov being so outdated with the times, they are hurting and artificially limiting innovation, but maybe it's done on purpose. If people lives in RVs or vans they lose out on property taxes. If they allow people to work remotely from home, businesses purchase less office space so they also lose out on property taxes. So maybe it's not worth to encourage remote work for these people.</comment>


Need 5 minutes of help-will pay - <AUTHOR>

I need to send out an html email through mailchimp, I have the html code and images loaded, but I don't know how to modify the code so that the links send people to the correct place. (the people who produced the creative did not code in the links)<p>I can pay $50 via paypal for someone to help with this, I need to get this done asap. My email is in my profile, please email me if you can help. Thanks <comment><USER2> I'm interested but no email in your profile. I'm (my username) at gmail.

Curious, are there better sites for posting quick help requests like these?</comment>


Ask HN: How do I make programming my job? - <AUTHOR>

I have introduced myself to programming with MATLAB, Python, and Java at work but my job doesn't require me to advance my skills in programming.  I want a job that challenges me to program constantly and continue learning.  What can I do to get in the field and build my resume?<p>If I know basic programming and have a BS in physics/astronomy would it be possible to find a 60k+ job?  Thanks for any advice. <comment><USER2> Build something and start contributing to the open source community. Once you have some work out there, I bet you will be able to find a programming job. A lot of great companies don't pay attention to your degree, they will just want good problem solvers who can learn quickly.

<comment><AUTHOR> Thanks johnnyn. Any more advice of where I can go to contribute to the open source community?

<comment><USER2> Github is your friend. Create an account and put some of your code on there (outside of work of course ;) ). I'm sure you could come up some a neat Matlab or Python tool to build.

</comment></comment></comment><comment><USER3> What do you mean by "basic programming"? What do you know already? What are you capable of building? I ask for more details because you may already have enough skills for find an entry-level engineering gig. A physics degree, in particular, bodes very well.

<comment><AUTHOR> I have completed two undergrad Intro to Programming courses with Java. I am able to perform 3D data processing in MATLAB, and so far I've used Python to make a wrapper which controls another program as a subprocess. I'm not sure if that gives you an idea of my abilities/knowledge.

<comment><USER3> Shoot me an email (contact info in profile) if you think you'd like to give interviewing a shot. Who knows, you might know more than you think!

</comment></comment></comment><comment><USER4> For every one line of code you type, write 10 lines about how, why, and where you wrote it.

Rinse and repeat.</comment>


Australian Defence conducts OpenOffice.org trial | Delimiter - <AUTHOR> http://delimiter.com.au/2011/08/29/defence-conducts-openoffice-org-trial/ <comment><USER2> As the article states, "However, realistically, it is unlikely Defence's OpenOffice.org trial will really get anywhere in the long term."

Why do I agree? Let's not even get into the whole OpenOffice/ LibreOffice/ Sun-Oracle thing (- which should have led to them evaluating LibreOffice). I personally tried working with OpenOffice, but the MS Office 2000-inspired UI/ UX just made working with it as unpleasurable as the "original" MS Office. (Only that MS recognized this and introduced the Ribbon UI, which I really like in its 2010 incarnation.) I never got why OpenOffice didn't at least make the (admittedly intricate) switch to a web-integrated product, which would have provided a solid reason for SMEs to choose it over an expensive and cumbersome MS Office+Sharepoint solution. The way it stands now, I wouldn't be surprised if Google seized the opportunity to move in pitching Google Apps to the Aussies.

<comment><AUTHOR> I am not sure about particular situation about OOo/Libre Office in Australia, but I have gut feeling that Defence and Cloud are not much compatible. Unless Australian Defence wants to create their own Cloud infrastructure.</comment></comment>


Compression algorithms used by Google - <AUTHOR> http://feedblog.org/2008/10/12/google-bigtable-compression-zippy-and-bmdiff/

<comment><USER2> In-memory compression is another technique not to be forgotten. If you can efficiently compress your in-memory representations of data you would otherwise have to hit disk or network for, you can dramatically increase the amount of data you can cache in memory, especially if you're aware of the structure and general patterns of the data.

Once I had to cache file paths, millions of them. I got a fairly easy 6x improvement by storing them in a Patricia trie, with each node's string stored as a range of UTF-8 encoded bytes, and indexed by arrays of bitfields - i.e. bit-packed arrays. Child nodes were similarly indexed using bitfield arrays. Turning what would be a 32-bit (or worse, 64-bit) pointer into (e.g.) a 28-bit integer really starts to add up when you have millions of them.

</comment><comment><USER3> db2 and oracle both implement similar compression algorithms. There's nothing terribly special about google's compression algos.

<comment><USER4> That they are used by Google makes them somewhat special, in that one would assume they have put some thought and experimentation into choosing them. Also, that would make for pretty good field-testing of them.

<comment><USER3> Any company building enterprise level products puts thought and experimentation into choosing their algorithms. Google just advertises their research publicly as part of their branding.

</comment></comment></comment><comment><USER5> A few months ago I extracted bmdiff from hypertable to use standalone. Give it a try: <http://bitbucket.org/mattsta/bmz/src>

<comment><USER6> Thanks for extracting bmz into a standalone. I actually went searching for it after reading the article's comments last night and came across your link. One question I have is how up-to-date is this version of bmz? It says that it's from a Hypertable commit dated Jan 25, 2009. Would I be able to find a newer version in Hypertable's source?</comment></comment>


Researchers show that memories reside in specific brain cells (2012) - <AUTHOR> http://news.mit.edu/2012/conjuring-memories-artificially-0322 <comment><USER2> Could we please ban MIT news and instead link to the actual articles. [http://www.nature.com/nature/journal/v484/n7394/abs/nature11...](http://www.nature.com/nature/journal/v484/n7394/abs/nature11028.html)

The reporting on MIT news is usually pretty vague and it lacks short overviews.

</comment><comment><USER3> So, I guess all that drinking finally succeeded in killing off that one memory I had about... something...

Too bad I have no idea what else got taken down in the process.</comment>


Apple's note is a great rallying call for startups - <AUTHOR> http://blog.derrickko.com/a-rallying-call

<comment><USER2> Anybody know what blog that is? I've read 3 articles today on different domains and they all use that blog engine/theme.

<comment><USER3> <http://svbtle.com/>

<comment><USER2> Thank you</comment></comment></comment>


Buxfer for Beer. Built on Twitter - <AUTHOR> http://foamee.com/

<comment><USER2> Cool.

Although I thought it was going to track how much money you spent on beer, which would mean I would have to ignore it just as hard as Rescuetime to avoid painful self-knowledge . . .

<comment><AUTHOR> Knowing the truth hurts, but beer makes the hurt go away.. Oh, the dilemma.

;)</comment></comment>


Fun with e2fsck and debugfs - <AUTHOR> http://giis.co.in/fun_with_e2fsck_debugfs.html <comment><USER2> more fun: make a filename have '/' in it

<comment><AUTHOR> that's interesting...let me explore :)</comment></comment>


The No More Ransom Project - <AUTHOR> https://www.nomoreransom.org/ <comment><USER2> So this is what a ransom note looks like:

[https://d1b10bmlvqabco.cloudfront.net/attach/is23h8nx8ff3jw/...](https://d1b10bmlvqabco.cloudfront.net/attach/is23h8nx8ff3jw/hktxrml0e933lw/iuogsulv5ns4/20161024123233.jpg)

Short, blunt, helpful, clear. Pretty much what you'd like every memo you've ever gotten to be. Me, I'm a huge fan of ransom notes and Nigerian scam emails. We can learn a lot from them.

I'm pretty sure that when you get one of these that you're dealing with a script. You pay .65880 BTC into its wallet, period. There is no negotiation with a script. What I've also heard is that you can trust the script because these guys want a good reputation. If it gets out that you paid and you didn't get unlocked then no one would pay.

If you don't want to pay on the backend then you have to back up on the front end. You should do that already. You should be able to take a sledge hammer to your laptop, buy another and not miss a beat. If you could do that then you could just reformat and reinstall.

Prevention is worth it. Protection is worth it. Paying? Well if you did the first two you wouldn't be asking that question. But .65880 Bitcoin equals about 463.97 USD. So you might want to get on the prevention+protection train.

Prevention will help you against viruses, keyloggers, etc that can cause a lot more economic harm.

Protection, backing up, will also help you in the case of theft or dropping your MPB out of its sleeve when you get out the car. Done both.

<comment><USER3> That's great until the ransomware gets clever and encrypts your backups too.

I'm extremely skeptical of the people that say ransomware is good for the economy or whatever. Broken window fallacy. Sure it creates an incentive to protect against hackers. But isn't that a bit circular? Hackers are good because they create inventive to protect against hackers? Ransomware is by far the most economically damaging kind (and personally damaging, for all the people that lose their family photos...)

Theres a lot of blame to go around for this situation. Shitty anti virus companies that sell a false sense of security and barely work. The broken security model of windows and most software. How inconvenient and expensive it is to actually do backups, so because of most basic human psychology most people put it off... If they are even technically minded enough to know they should, and most people aren't. Programs that pollute my home folder and documents with garbage that increases the space necessary to backup (OK that's just my personal issue.)

<comment><USER4> I saved my dad from ransomware using the Crashplan backups I set up. Ransomware can't retroactively encrypt remote (incremental) backups (unless they hack the service). Admittedly, I now realize they could have deleted them, so I need to enable the password protection in the app, so nothing can be changed without the password. However, I don't think it's worth it for the builders to invest in that: the number of people that could rescue themselves in such a way is probably negligible.

<comment><USER3> The problem is once enough users start using services like that, then it becomes rational for them to invest in that. It's sort of like security through obscurity. There is no solution for the general population.

<comment><USER5> It's not so hard for backup service to ensure users can undo any changes (XX days back) no matter what way files are removed/overwriten.

</comment></comment></comment></comment></comment><comment><USER6> > When [you are infected with ransomware], you can't get to the data unless > you pay a ransom. However this is not guaranteed and you should never pay!

What bothers me about their advice is that it is only correct macroeconomically. For your particular case it could be the best solution to just pay - as even police departments have done before.

It also ignores that it is in cybercriminals' best interest to let you decrypt after you paid: They need their victims to trust them, and they have nothing to gain from keeping the files encrypted after payment.

<comment><USER7> In a twisted sort of way, a person could destroy trust that paying the ransom will actually get your data back. Someone could create ransomware that will never decrypt, even after the ransom is paid. Once the victims know the dishonest ransomware is out there, that may ruin the revenue towards the "honest" ransomware.

<comment><USER8> > _Someone could create ransomware that will never decrypt, even after the > ransom is paid._

This already exists: [http://arstechnica.com/security/2016/07/posing-as- ransomware...](http://arstechnica.com/security/2016/07/posing-as-ransomware- windows-malware-just-deletes-victims-files/)

> "Once it executes it, it pops up a ransom message looking like any other > ransomware," Earl Carter, security research engineer at Cisco Talos, told > Ars. "But then what happens is it forces a reboot, and it just deletes all > the files. It doesn't try to encrypt anything—it just deletes them all."

<comment><USER9> Makes me wonder if it's just buggy or intentional.

<comment><USER10> Considering that the operators must actively keep the backend alive and support the users, it's more likely they abandoned it for whatever reason.

</comment></comment></comment></comment></comment><comment><USER11> About prevention there is something more that I am not sure has been mentioned, some tools are taking a new, broader approach to the problem, which is to constantly monitor for encrypted files and stop the associated processes, this way often limiting the loss to a few files, these are the links:

Criptostalker [https://github.com/unixist/cryptostalker](https://github.com/unixist/cryptostalker)

Ransomwhere (macOS) [https://objective- see.com/products/ransomwhere.html](https://objective- see.com/products/ransomwhere.html)

Some theoretical information on this approach:

[http://www.cise.ufl.edu/~traynor/papers/scaife- icdcs16.pdf](http://www.cise.ufl.edu/~traynor/papers/scaife-icdcs16.pdf)

<comment><USER3> In principle it's super easy to detect, encrypted files look like random data and it's unlikely users would be replacing every file with random data on purpose. Its a never ending war though. If you got enough users to do this, the hackers would then switch to encryption that mimics what normal files look like to fool the detector.

<comment><USER12> Most users never start writing to all the files on their disk, why can't a rate limiter and warning kick in if that happens?

</comment></comment></comment><comment><USER13> I've had plenty of people lose vital files on borked hard disks and pay _thousands_ to get those files back via drive recovery firms. I've only had one person ask me about ransomed files whom I advised to pay the $400-ish demanded.

I told him that most of my clients pay 10x as much to learn how important backups are.

 _All_ data storage devices _will fail_. What will you do when yours does?

<comment><USER14> The worst place I have seen this is in scientific labs. Professors and graduate students are terrible about keeping backups, making data easy to understand to others, and maintaining data.

My old professor lost more than 2 years of work when one grad student in our had a car crash and his laptop was destroyed in the crash.

<comment><USER15> I've observed the same. It's baffling, and I don't understand why. Maybe they are in a nasty spot of workers who are non-techie but 100% reliant on tech?

</comment></comment></comment><comment><USER16> The guy that made HaveIBeenPwned.com (which I'd urge everybody to use) has a solid free course on Ransomware essentials at: [https://www.varonis.com/learn/introduction-to- ransomware/](https://www.varonis.com/learn/introduction-to-ransomware/)

It's not the ideal thing for people here on HN, but it's pretty much the ideal thing to send to your non/semi-technical boss or stakeholder at your company who isn't taking ransomware seriously.

</comment><comment><USER17> Is there any case where versioned backups wouldn't completely solve a ransomware situation?

Assuming, of course, that the ransomware doesn't somehow spider out and compromise all your past backups as well. Let's assume your past backup versions are safe.

<comment><USER3> Are the versioned backups physically separated from the infected machine? Otherwise what stops it from just encrypting your backups hard drives as well, everytime you connect them?

<comment><USER18> What about a versioned filesystem (like ZFS)?

<comment><USER19> If they had root access they could probably encrypt the whole drive, filesystem and all.

</comment></comment></comment></comment><comment><USER20> For protection, I put all my files I care about on Dropbox. Is that enough? It's enough for backup for most things, but I worry attackers would be smart enough to kill it and also the old revisions that Dropbox stores.

<comment><USER21> Dropbox has a help article on ransomware: [https://www.dropbox.com/help/8408](https://www.dropbox.com/help/8408)

For mass deletes that are cumbersome to recover using Dropbox's interface, that article mentions you can contact customer support to get assistance recovering from mass deletion events.

<comment><USER20> Great thank you.

</comment></comment></comment><comment><USER22> I like the message but it ticked me off that the prevention methods they introduce (backup to cloud and/or use physical media) is coincidentally somewhat related to the sponsors: AWS and Barracuda.

</comment><comment><USER23> Is using a VM to surf the web a reasonable answer? Are there any VMs (for my MBP for example) that are reasonably fast, don't take a lot of battery, and not clumsy?

Can't this be built into the OS so I don't actually have to do it?

<comment><USER24> Something like this is built into Android and iPhone. As all major desktop OSes are only good in protecting one user from another mobile OSes run every application under its own user account. So vulnerability in an image viewer would not give an attacker access to other apps' data. But the system is not perfect, for example the kernel can still be attacked (and as we know a lot of vulnerabilities were found in Linux in recent years) and on Android the files on sdcard partition are not protected at all.

But desktop OSes don't do anything at all to protect the user. They allow the user to run a program by just clicking a link in email or web browser and this program has full access to all their data as does the PDF viewer or Java plugin in a browser. The desktop operating systems still use security models from mainframe era.

<comment><USER25> > So vulnerability in an image viewer would not give an attacker access to > other apps' data.

By having separate user's per app, apps can't read each others' files by default. If one app has a vulnerability that can be used to acquire root, that app can read all files after disabling SELinux.

<comment><USER24> > If one app has a vulnerability that can be used to acquire root

To get root privileges you need to attack the kernel (or the application that has those privileges). Having a bug in an image viewer is not enough.

You can try to make obtaining root privileges more complicated only by reducing the attack surface with restricting system calls each application is allowed to make or with redesigning the kernel so that less code is executed in ring 0 (microkernel architecture).

But recent vulnerabilities like Dirty COW or rowhammer could work even in this case.

</comment></comment></comment></comment><comment><USER26> Remember if your backup solution is a USB drive, you actually need at least two USB drives, with at least one of them disconnected from your computer at all times. If you only have one, the virus will encrypt that one along with your computer. That needs to be spelled out, because people intuitively think backing up to a single USB drive is sufficient.

</comment><comment><USER27> If you are willing to pay the ransomware demands who are you going to pay when your HDD fails? I'm not saying ransomware isn't a problem in itself but from a user's perspective it's indistinguishable from HDD failure and should be dealt with by using backups.

<comment><USER3> Ransomware can infect your backups to though. HDD failures aren't contagious.

<comment><USER5> Ever heard about bitrot?

</comment></comment></comment><comment><USER28> How can a ransomware infect my computer when I visit a website? This site claims it can happen. I understand how the attachment version works but not this one. I'm a security newb.

<comment><USER29> Some websites can use security vulnerabilities in different parts of the browser (rendering, image format parsers, Javascript, PDF, fonts, and everything else supported by the browser) to run code on your machine.

<comment><USER30> For a concrete example of what exploitation of a JS engine bug looks like, PlaidCTF2016 had a challenge that allowed people to run JS in a patched version of V8 that deliberately introduced a bug in array index checking, with the goal being to run x86 machine code.

The patch to v8: [http://lpaste.net/317342](http://lpaste.net/317342)

An exploit: [https://gist.github.com/sroettger/d077d3907999aaa0f89d11d956...](https://gist.github.com/sroettger/d077d3907999aaa0f89d11d956b438ea)

While this bug was artificial, there were (and can still be) bugs with similar consequences in actual engines (see [https://www.cvedetails.com/vulnerability- list/vendor_id-1224...](https://www.cvedetails.com/vulnerability- list/vendor_id-1224/product_id-17734/Google-V8.html) or [https://cve.mitre.org/cgi- bin/cvekey.cgi?keyword=spidermonke...](https://cve.mitre.org/cgi- bin/cvekey.cgi?keyword=spidermonkey) for historical examples).

While a bug in most of the components you mention are bad by themselves, their impact is magnified by the presence of javascript, which allows an attacker to interleave calculations and interactions with the buggy components, bypassing many mitigations.

</comment></comment></comment><comment> happy-go-lucky My mini Ask HN:

Do you trust makers of security software?

<comment><USER31> Not the big ones that are well-known names in the PC market. There are quite some shady security software vendors out there, and a handful very competent ones that I trust if I have to.

<comment><USER32> Can you expand on that? Who are the good ones, and the bad ones?

<comment><USER31> The bad ones are typically well-known desktop anti virus scanners that try to score by showing you a high number of threats they allegedly defeated. If you look at those threats in detail, they turn out to be browser cookies, or bookmarks, or something similarly trivial.

Identifying good vendors and products is generally harder. I've heard good things about canary.tools and bromium, for example. Both explain what they do in terms that don't make a techie roll their eyes (too much at least): [https://canary.tools/#how-it-works](https://canary.tools/#how-it-works) and [https://www.bromium.com/advanced-endpoint-security/our- techn...](https://www.bromium.com/advanced-endpoint-security/our- technology.html)

A good (but not exhaustive) test is to look at what the vendors promise. If they promise you full protection of your machine or network, you know they are full of shit. If they talk only about one aspect (identifying attackers, reducing the attack surface on a browser), things start to look better.

</comment></comment></comment></comment><comment><USER33> OT question: is there no way to flag that bitcoin address in any way (so it gets locked / they cannot withdraw anything)?

<comment><USER34> The original purpose of Bitcoin was to create digital cash. It is possible to track the transaction history of funds in a bitcoin address, but there is currently no central authority who can blacklist/lock addresses, and most of the major participants in the bitcoin system (users, miners, exchange operators, darknet drug markets) are not interested in changing that.

</comment></comment><comment><USER35> So a thought on why attackers make "flawed" ransomware. They want to get paid as soon as possible, and a target pays a potentially heavy opportunity cost for noncompliance (waiting for someone to break the rw). The opt-outs are already not going to be "customers", and the "customers" you do get would pay even if they were only going to be locked out for 3 months. You get no extra money for making unbreakable ransomware

Edit: this may be similar economically to the Nigerian prices' aversion to English class.

</comment><comment><USER36> How likely are you to be infected with randsomware if you run a rolling- release Linux distro and update almost daily?

I also use uBlock Origin, but I don't disable javascript for any websites.

</comment><comment><USER37> Do Google Drive / Dropbox cloud backups help in this situation? Or do the encrypted versions propagate into the cloud and irreversibly overwrite the plaintext versions?

<comment><USER38> Google Drive keeps old versions of every file for 30 days. Enough time to recover the plaintext versions.

<comment><USER39> I recently had to help someone out, and the randsomware was smart enough to be able to mess wit gDrive revisions :/

</comment></comment></comment><comment><USER40> I started writing about this but just a personal safeward. Yesterday I dropped my phone by accident, it cracked and doesn't work anymore. But besides the monetary loss, everything was backed-up from the day before so no problem.

</comment><comment><USER41> Hm. I first thought it was an effort to pool resources to repeal patent trolls.

</comment><comment><USER42> Would a NAS like QNAP/Synology be sufficient, with proper maintenance (updates, antivirus scanning, credentials)? Trying to think of what I could be mindful of here.

</comment><comment><USER43> Seems more like a way for the involved parties to collect data on new ransomware popping up on the web than a genuine effort to help victims.

</comment><comment><USER44> I had no idear this was such a massive problem. How often are nefarious purps holding people's private data hostage?

Seems overblown.

<comment><USER45> It's a very big problem, Cryptolocker in 2013 was able to score it's creators around $27 million. That was 3 years ago, it's a pretty dangerous and persistent threat.

</comment></comment><comment><USER46> This is a Windows phenomenon only right? I'd just restore from Time Machine and go along on my way.

<comment><USER47> I don't know of any Mac specific variants off the top of my head, but there is no reason why Mac would be immune to it.

And the "good" versions of these do things like encrypt or outright delete things like time machine before encrypting the rest.

<comment><USER48> You may remember an incident with Transmission recently. That was a bundled mac ransomware.

[https://blog.malwarebytes.com/cybercrime/2016/03/first- mac-r...](https://blog.malwarebytes.com/cybercrime/2016/03/first-mac- ransomware-spotted/)

</comment></comment></comment><comment><USER49> I'm afraid to click the link. Anyone care to provide a tl;dr?

<comment><USER50> Anytime you're in a similar dilemma just disable JavaScript. There are even plugins that allow you to do that with one click.

<comment><USER51> The better advice is imo to keep your browser up-to-date. JS exploits have been come increasingly rare these days, mostly due to Chrome's excellent example of patching quickly and paying good money for exploits (e.g. Pwn2Own). JS 0days are imo far too valuable now to waste them on normal users. So no, disabling JS wouldn't make much sense, if your have an evergreen browser. Disable Flash & Java and try to minimize downloads is the security advice I give nowadays. Also don't install anything unless you absolutely have to (there are plenty of good in-browser options for programs we used to install, e.g. for file conversion).

<comment><USER52> What do the JS 0days get used for nowadays?

<comment><USER53> Attacking high-value dissidents: [https://blog.lookout.com/blog/2016/08/25/trident- pegasus/](https://blog.lookout.com/blog/2016/08/25/trident-pegasus/)

</comment></comment></comment></comment></comment><comment><USER54> Anyone else wants to do the static-site server-less dance with me? Or you rather keep playing cat and mouse on a broken Internet?</comment>


Ask HN: Can I get my Twitter handle back? - <AUTHOR> For a few years I was very active on twitter. It's a fantastic resource and I had made so many connections.
I also suffer from crippling anxiety. It has stiffled my educational and professional programming career.
At the end of 2017 I had a severe anxiety attack and I closed my account (amoung other things).
Over the years I stalked twitter-search for my industry news fix.
Eventually I got my anxiety under control and registered for a new handle, to get back to my connections, but it was taken. It has been taken for over a year and is inactive.
Twitter's own policy states:
To keep your account active, be sure to log in and Tweet at least every 6 months. Accounts may be permanently removed due to prolonged inactivity.[1]
I made another handle on a different email address but i feel like a fraud using another handle like that. It feels off since all my other accounts and my website use the old handle.
One ray of hope is that twitter was said to wipe inactive accounts [2] but I don't know when this will happen.
Should I reach out to this inactive account and ask for it if they are no longer using it?
[1] - https://help.twitter.com/en/rules-and-policies/inactive-twitter-accounts [2] - https://www.theverge.com/2019/11/27/20986084/twitter-inactive-accounts-usernames-memorialize-deceased-users-not-removing <comment><USER2> Just choose a new nickname you like, dude. Call it some kind of renewal, born again, or reneiisance, please just be careful, as Twitter is a caustic place. Best rigeurds.</comment>


How to Knock Off a Bag - <AUTHOR> https://www.youtube.com/watch?v=a11wlngpuSY

<comment><USER2> Best quote from this, hands down is: "You can even nickle plate your crack pipe".</comment>


Ask HN | How to answer customer queries - <AUTHOR>

For guys out there who are running own one or more products, what do you use to answer customer queries. Simply via email? A help-desk to raise and answer tickets?  twitter ? Facebook ? any other online app or platform ? <comment><USER2> It depends on how much time you are willing to invest in it.

Simple email is easy for one or two people to handle, but from what I've seen Twitter/Facebook interaction (which also doubles as an advertising route) requires dedicated staff, and some companies even outsource the handling of PR through those just because it is expensive and difficult.

For everything small, a help desk tracker is great if your service is technical and your users are technical, it keeps tracking of issues much easier.

However, if you go the route of email, you would still need a tracker internally, and some companies have even plugged their email system into their internal tracker to make this easier.

</comment><comment><USER3> I highly recommend olark or a similar onsite live chat feature.

olark is great because its much lower barrier of effort than email, so your customers often come with questions they might not have bothered with via email. You can get some great insights into how people use your site, and you'll learn about bugs much faster.

</comment><comment><USER4> Facebook has the benefit of showing that you are the type of company that engages with its customers and users. It is also scalable in the sense that you can answer a question once and many people can read it. Email is quick, and most people are comfortable with using email.

</comment><comment><USER5> Just use email, it's easy to set up and if you grow out of it then it's easy to move over to something else.</comment>


An Unusual Proof of the Doodle Theorem - <AUTHOR> http://www.solipsys.co.uk/new/AnotherProofOfTheDoodleTheorem.html?HN_20151219 <comment><USER2> You provide a bit of context but if you could explain even more terms it would be great for someone like me that is only vaguely familiar with graph theory. I can follow the general argument and some extra pointers would be greatly appreciated.

<comment><AUTHOR> Can you be a little more specific about what you need more details on? I'd be happy to write a little more, put some extra links or text boxes to clarify, but I'm not sure what people need explaining.

Does this help?

[http://www.solipsys.co.uk/new/GraphThreeColouring.html?HN2](http://www.solipsys.co.uk/new/GraphThreeColouring.html?HN2)

Feel free to email if you'd prefer, I'll go and start reviewing it.

Thanks!

 _Edit: I 've now added a side-box with that link._

<comment><USER3> Not the original poster, but one thing that confused me was that I can clearly draw a graph that cannot be two coloured with a single pen stroke if I am allowed to reverse direction and keep drawing back over the same line again (indeed it is of course possible to draw any connected graph this way). I wasn't sure which part of the conditions forbid this.

Perhaps it is no longer a graph if I have a bidirectional edge? Or perhaps it is not considered planar if two edges coincide?

<comment><AUTHOR> Ah, it's not allowed to go back exactly over the same line, so you can't reverse direction. You can go back and revisit the same node, but it will require a separate edge, and the two parts of the stroke will then encompass another area.

I'll add that - thanks!

 _Edit: now added - it will go live when the page updates._

</comment></comment></comment></comment><comment><AUTHOR> I'd really appreciate comments on this - anything you feel like saying about it.

<comment><USER4> I'd love some background on the problem - I'm a big fan of well-explained proofs like this, but I'm not a mathematician by trade and I like hearing a little bit about why anyone is thinking about this stuff in the first place.

<comment><AUTHOR> This isn't a big theorem - to some extent it's just a trivial observation. But it is a gateway into talking about graph theory.

Why should it be that a doodle is always two-colorable? It's a question a child could ask, but it leads to the whole area of graph theory. Personally, I find it a much better introduction to Graph Theory than the usual question about the Bridges of Königsberg:

[https://en.wikipedia.org/wiki/Seven_Bridges_of_Königsberg](https://en.wikipedia.org/wiki/Seven_Bridges_of_Königsberg)

But there is a progression.

* A doodle is two-colorable

* A doodle is a planar, connected, Eulerian graph

* The dual of a planar, connected, Eulerian graph is bi-partite

* Bi-partite graphs are trivial to identify, and trivial to colour.

* What about tri-partite graphs?

* Identifying whether a given graph is tri-partite is NP-Complete.</comment></comment></comment>


SidekickCRM.com - Our bootstrapped startup looking for feedback - <AUTHOR> http://www.sidekickcrm.com/

<comment><USER2> I am missing two things on the front page:

* a video demonstrating the product (here's your chance to tell the world what's so great about your product!)

* an easier way to test drive the product. I don't want to sign up or any of that, I want a big button that I can click and get immediate access to a demo account.

Is the "Why SidekickCRM" button really necessary? You can place a summarized version of the "Why SidekickCRM" page on the front page itself; there's plenty of space and there are no other products or services that's competition for attention. You could also add a text link to the "Why SidekickCRM?" page.

Is the screenshot thumbnail on the front page supposed to be clickable? Nothing happens when I click on it. I think you should redesign it so it looks like a video player and, on click, launch a demo video.

/register: Why have you named one of your plans "Superhero"? Because I don't see how it fits the rest of the branding and it sound unprofessional. Also, I'm interested in why your plans are free and Superhero, i.e. what you base your pricing on and why you have a freemium option. Also, you should add Support as one of the comparison factors: free should only have self-support whereas the paying option has better support channels.

<comment><USER3> I wonder if a bunch of screenshots explaining the different functionality may be just as advantageous as an actual demo?

<comment><USER2> I guess that depends on the complexity of your product and how much you want to demo. Also, if your product's competitive advantage is made up of many subtle features, you might want to have a video to better demonstrate them.

</comment></comment></comment><comment><AUTHOR> We think we've got a really innovative UI and we're looking for some feedback.

<comment><USER4> I like your website, but I was looking for a features/benefits page that would show me why I should pick SidekickCRM instead of the other tools out there.

I skimmed the video and I noticed this bit: <http://i.imgur.com/tLJdT.png>

Those bullet points listed under "What Sets Sidekick Apart" could be applied to most CRM products.

A small business owner won't say , "We should go with Sidekick because it's powerful and robust!". You want them to say, "We should go with Sidekick, it has a great reporting tool for opportunities and we can easily assign leads to sales people".

Keep iterating and refining your benefits. Good luck! It looks like you put a ton of work in to it and you should show off what _really_ makes it powerful.

<comment><AUTHOR> Thanks for the input! I see you mean about why a small business would choose us. Our advantage is our dead-simple UI, so we should push that more.</comment></comment></comment>


Ask HN: Is NJ12bot a well-known rogue spider? - <AUTHOR>

Since a few days they are causing easily 80% of my (usually really really low) traffic. hitting my myths-about-urandom article every three seconds.
Their reply: Oh, with this entry in robots.txt you can slow it down to five seconds.
Yeah, right. "Disallow: /" it is.
Are people really putting up with this? <comment><USER2> _N_ J12bot or _M_ J12bot?

I get occasional hits from MJ12bot, but not to the extent you say.

I'd like to advocate for sandbagging disliked bots. Using Apache and mod_rewrite on user agent string, I condemn Ahrefs, Ezooms, Dotbot and a few others to the largest website full of gibberish about last year's celebrities.

Try: [http://stratigery.com/bork.php](http://stratigery.com/bork.php) to see what Ahrefs might see.</comment>