Obama's Remarks on NSA Controversy - <AUTHOR> http://blogs.wsj.com/washwire/2013/06/07/transcript-what-obama-said-on-nsa-controversy/?mod=e2tw <comment><USER2> > _And the reason that's not how it works is because we've got congressional > oversight and judicial oversight. And if people can't trust not only the > executive branch but also don't trust Congress and don't trust federal > judges to make sure that we're abiding by the Constitution, due process and > rule of law, then we're going to have some problems here._

Oh thank god, all branches are providing oversight. So it's just as harmless as all those other programs being overseen by all branches of government.

Like TSA.

<comment><USER3> I love how he says several times "we aren't listening to your phone calls". As if that suddenly makes everything better. Fuck me.

<comment><USER4> It gets worse. Moments later, he says:

"if anybody in government wanted to go further than just that top-line data and wanted to, for example, listen to Jackie Calmes's phone call, they'd have to go back to a federal judge and — and — and indicate why, in fact, they were doing further — further probing."

Great. So they can't listen to your phone call, unless they indicate why they want to listen to your phone call. I'm sure everyone involved in this program was cherry-picked to ensure that no one says "no" to any of these requests. Oh, and I'm sure all the logs (who asked who for permission, what the reasons were, which requests were granted or denied, etc.) are also conveniently "classified," which you should remember is different than "secret."

<comment><USER5> So now you're objecting to the very concept of a warrant?

<comment><USER6> Did FISC warrants suddenly start requiring probable cause? Did the court itself suddenly start scrutinizing requests (how would we even know)?

Don't conflate FISC warrants issued for criminal investigations. FISC is barely even a speedbump when it comes to this sort of surveillance.

<comment><USER5> The quote isn't talking about FISC warrants. Its talking about regular Article III warrants.

What's deeply ironic about the outrage here is that FISC was created as an extra layer to safeguard privacy. FISC warrants give law enforcement officials permission to initiate an investigation, not to access information that would otherwise require an Article III warrant.

</comment></comment></comment></comment></comment></comment><comment><USER7> I'm trying to understand one thing: what is the difference between a telephone number and a name?

This is Penn register information, that is what it's referred to as in public laws.

In aggregate it can be used to draw connections between people, such as people talking to those who are committed to doing us harm. That is what public comments on these programs have said and that is true.

But clearly telephone numbers are identifying information, unless they are hashing them prior to building their graphs, but if that is the case why not say that?

His speech also conflates "federal courts", with "FISA court", which implies review by the independent judicial branch.

<comment><USER8> He also glosses over the fact that cell tower location is included in this data. Most of the information that they would overhear in the actual call audio can be deduced from the data they're collecting. Which is kind of the whole point of the program.

<comment><USER9> So if I call you from outside 123 Main Street, Anytown on Tuesday at 6:37pm, what are we talking about? Even if one of us is known criminal or terrorist, the fact that conversation took place is merely suspicious rather than probative.

<comment><USER10> keep drinking the kool-aid. seriously, every response up to this has been you defending the ongoing actions of the government. are you a government employee?

<comment><USER9> Far from it; in fact, as a non-citizen I have _far_ fewer rights than you do, assuming you're a US citizen. Now try addressing my argument instead of attacking me personally, and try to distinguish between defending the actions of the government and pointing out factual context, such as the fact that it is not in fact illegal or unconstitional for the government to collect records of phone calls, even though it perhaps _should be_.

As it happens, I'm from Europe, and one thing I do miss about the EU is that citizens of that territory enjoy a explicit and robust constitutional right to privacy that does not exist in the US, not to mention a unilateral right of access to and control over their personal data in both governmental and commercial spheres. I have called on many occasions for an amendment to the US Constitution that would confer such rights on Americans instead of relying on the vague and implicit 'discovery' of a privacy right that did not exist before 1965 and which could be taken away as easily as it was given.

</comment></comment></comment></comment></comment><comment><USER11> Why is it that politicians think that "not listening to your phone calls" is any different than tracking everything about your phone calls.

It reminds me of little kids fighting, getting in each others face and shouting "I'm not touching you, I'm not touching you!"

<comment><USER12> _Why is it that politicians think that "not listening to your phone calls" is any different than tracking everything about your phone calls_

Because there's a huge material difference, maybe?

<comment><USER11> If I stretch my imagination I can see the argument, but I don't buy it (IMHO).

I think the spirit of why the privacy of the content of my conversation is important equally applies to any information about that conversation. If my conversation is privileged, why shouldn't my meta-data be? What's the difference?

If AT&T provided a service that cataloged and tagged my conversation for retrieval based on analysis of the content (and I opted into this) would that meta-data also be available to the government?

<comment><USER12> If you're having trouble stretching your imagination, just go back to your teenage years.

Mom: Who was that on the phone?

You: My (girl|boy)friend.

Mom: What exactly did you talk about?

<comment><USER11> First, I hear your point.

But, I think there is a "huge material difference" between a parents right to know who their kids are talking to and a governments right to know who I am talking to.

To put it another way: is this a form of blocking the assembly of people? If I meet in private with a group of people does the government have a right to know all of the meta data about the conversation such as who was present, when they arrived and left, etc? In this hypothetical, I'm assuming we are convening on private property and not a public sidewalk. If we met in private does the government have the right to compel the doorman to reveal these details indiscriminately?

<comment><USER13> "If we met in private does the government have the right to compel the doorman to reveal these details indiscriminately?"

Of course they do.

<comment><USER11> The key to the question was "indiscriminately." Does the government have the right to require to doorman to keep tabs on everyone without probable cause.

[edit typo]

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> _" Now, let — let me take the two issues separately. When it comes to telephone calls, nobody is listening to your telephone calls. That's not what this program's about. As was indicated, what the intelligence community is doing is looking at phone numbers and durations of calls. They are not looking at people's names, and they're not looking at content. But by sifting through this so-called metadata, they may identify potential leads with respect to folks who might engage in terrorism. If these folks — if the intelligence community then actually wants to listen to a phone call, they've got to go back to a federal judge, just like they would in a criminal investigation. So I want to be very clear. Some of the hype that we've been hearing over the last day or so — nobody's listening to the content of people's phone calls."_

So, this is about CDRs- Call Detail Records. They are the atomic unit of all mobile telecommunications. There's no billing, no provisioning of data or anything without them. These are the most fundamental log files of all your mobile activity. They are in a sense, the primary key needed to enumerate all of your transactions.

[https://en.wikipedia.org/wiki/Call_detail_record](https://en.wikipedia.org/wiki/Call_detail_record)

An excruciating level of detail on what a CDR can include can be found here:

[http://downloads.avaya.com/css/P8/documents/100096784](http://downloads.avaya.com/css/P8/documents/100096784)

Our president is using weasel words. Yes, obtaining CDRs isn't the same as obtaining your texts or your voicemail, but once you have them, you have everything you need for obtaining the content through subpoena. So, from here, we jump to this:

[http://www.youtube.com/watch?v=iog5IeEjR00](http://www.youtube.com/watch?v=iog5IeEjR00)

 _" We certainly have ways in national security investigations to find out exactly what was said in that conversation. Its not necessarily something that the FBI's going to want to present in court, but it may help lead the investigation or the questioning of her."_

Our political leaders are not worth defending any more. The whole system is corrupt. Everyone in office needs to be ejected, followed by the comprehensive removal of non-political government leadership. This country has beached itself.

<comment><USER5> > Yes, obtaining CDRs isn't the same as obtaining your texts or your > voicemail, but once you have them, you have everything you need for > obtaining the content through subpoena.

Hint: it's always been possible to get nearly any piece of information with a subpoena or a warrant. The 4th amendment protects against _unreasonable searches_ not searches period. And a subpoena or a warrant is by definition a reasonable search.

There is nothing weasel-y about this language.

<comment><USER15> I believe a big issue he is raising is the ability to go back in time and wiretap your phone before the subpoena has been issued.

<comment><USER5> Collecting CDR's is not wiretapping.

<comment><USER14> Watch the youtube video referenced above. There is some kind of wiretapping going on _all_ the time.

</comment></comment></comment></comment></comment><comment><USER6> Standard government nonsense -- "There is oversight, this is for your safety, trust us, we respect your privacy, whoa look at the time I have to meet someone important bye!"

</comment><comment><USER8> Let's talk a little about trusting the government to abide by the Constitution. The Constitution establishes the treaties we enter into as the law of the land. The Geneva Conventions are treaties that make torture illegal. The government has tortured people pretty recently.

We're pretty far beyond "trust, but verify" territory here.

<comment><USER9> I question your minor premise, just for starters. I also think you're committing a fallacy of composition, since the government is not a monolithic entity.

<comment><USER16> Oh, this retort again. "HN/Reddit/the Government isn't just one person with one opinion you know!" And then someone replies yadda yadda scotsman yadda yadda and then we all kill ourselves.

Make an argument!

</comment></comment></comment><comment><USER17> Here is an interesting quote from his remarks that I think could actually be a worthwhile argument that gives some indication that there is serious concern to ensure that the systems are not abused.

 _> And by the way, with respect to my concerns about privacy issues, I will leave this office at some point, sometime in the last — next 3 1/2 years, and after that, I will be a private citizen. And I suspect that, you know, on — on a list of people who might be targeted, you know, so that somebody could read their emails or — or listen to their phone calls, I'd probably be pretty high on that list. So it's not as if I don't have a personal interest in making sure my privacy is protected._

<comment><USER18> I would interpret that as Obama casting himself in the position of an average citizen to garner a feeling of connection and trust.

I'm taking a wild guess, but I doubt that presidents get bumped down to "average dude" status by intelligence agencies after they leave office.

<comment><USER19> _I doubt that presidents get bumped down to "average dude" status by intelligence agencies after they leave office._

Isn't that exactly his point? After he leaves office, he will be very high on "List of people to snoop"?

</comment></comment></comment><comment><USER20> How would you identify and disrupt terrorist cells in America that were talking with known terrorists overseas?

I'm not trying to defend the government, but genuinely ask, 'How would you do it?'

<comment><USER21> There comes a point where you just admit that you can't. Bad people do bad things and sometimes you can't stop them.

Burning the whole village to save it, cure worse than the disease, cutting noses to spite faces, and all that.

<comment><USER20> In the age of nuclear weapons doing nothing is not acceptable.

<comment><USER22> That doesn't mean doing ANYTHING becomes acceptable. There are lines that shouldn't be crossed. We can debate what those lines should be, but you're suggesting there are no lines.

</comment></comment></comment></comment><comment><USER23> > _And the reason that's not how it works is because we've got congressional > oversight and judicial oversight. And if people can't trust not only the > executive branch but also don't trust Congress and don't trust federal > judges to make sure that we're abiding by the Constitution, due process and > rule of law, then we're going to have some problems here._

The people shouldn't have to "trust" anything and surely not blindly. As is the case here. The people should KNOW about everything that is being done, and judge for themselves.

If the people have to ..."trust" their government ("Don't worry, we know what's best and we'll do it, we wont bother you with details, just trust us"), then we already have a huge problem here.

The government should represent the will of the people, transparently, openly, and under constant oversight of the citizenry -- not just of judges and congress. Trust should only come into play in very small doses into this.

<comment><USER24> It's not really my _will_ that every single intelligence gathering operation be disclosed to the public. There's a lot of value in terrorists not knowing exactly what communication mediums to avoid at any moment. I think it's a good point that hundreds of directly elected people, representing the entire country, have known about this since it's inception. You can't just put every single government action to a vote, for several reasons.

<comment><USER23> > _It 's not really my _will_ that every single intelligence gathering > operation be disclosed to the public. There's a lot of value in terrorists > not knowing exactly what communication mediums to avoid at any moment._

Really? As if skilled terrorists chat their plans over the phone like casual people. They might get some young idiots, but nobody else. And those things are black swan events.

Furthermore, if every single government action was "disclosed to the public", there wouldn't even be more terrorists. People that get to be domestic terrorists would have less reasons to mistrust that open government. And the country wouldn't be made to invade, mess with other sovereign countries and get their people to seek revenge -- at least not without consensus.

</comment></comment></comment><comment><USER25> That was remarkably well spoken and reasonable.

<comment><USER14> In the words of Jamie Kilstein:

"Honestly democrats, does Obama have to fuck your girlfriend for you to get mad?"

</comment></comment><comment><USER26> don't trust the executive branch?: √

don't trust Congress?: √

don't trust what is called "due process and rule of law"?: √

I wonder what problems he thinks people will cause? Petitions are ignored. Protests are relegated to "Free speech zones". People are taking on more debt than ever to live the "American Dream". Sounds like they have everything in control to me…

<comment><USER27> we've got a problem... stop funding the NSA, TSA, etc...

</comment></comment><comment><USER28> If voters in the US are just supposed to "trust" Congress and the executive, why even bother having elections?

<comment><USER29> Seriously?

To elect somebody you trust.

This is a republic.

<comment><USER28> OK, so you've elected representatives that you trust. Now what?

A major purpose of having new elections every 4 years (as opposed to life tenure) is to allow the people to periodically re-evaluate their trust decisions. What do you propose as the basis for that trust? Blind faith?

What's being suggested here is that elected representatives ought to be trusted by the public _without_ access to the information necessary to verify that their trust has not been misplaced.

It's not like we're talking about specific information that was leaked. The mere fact that there exists such a broad surveillance program---authorized by Congress, the White House, and the FISC---was classified "top secret" and not scheduled to be declassified until decades later. The legally-enforced lack of accountability _to the people_ for such a massive program undermines the legitimacy of a government that supposedly governs by the consent of the people.

</comment></comment></comment><comment><USER30> >Now, with respect to the Internet and emails, this does not apply to U.S. citizens, and it does not apply to people living in the United States.

For EU and rest of the world: Every message (email/IM,anything..) trough gmail, hotmail, AOL or facebook is stored by US Gov. and used as they see fit.

<comment><USER31> Your comment may be tongue in cheek however the concept of universal jurisdiction is a serious one that many have contemplated over the past century or so.

Why do you assume the 4th Amendment applies for foreign people? Is it because their data simply transits through the US (eg: to Facebook's servers)? Or is it because you expect the US Government to use that data to impose its laws and regulations selectively at its convenience (combating piracy)?

<comment><USER32> > Why do you assume the 4th Amendment applies for foreign people?

Because its a limitation on the power of the _federal government_ that has no restrictions as to nationality of targets written in to it.

</comment></comment></comment><comment><USER33> _Now, with respect to the Internet and emails, this does not apply to U.S. citizens, and it does not apply to people living in the United States._

As for those living outside the US...

<comment><USER34> I thought these programs were essentially constitutional when President Bush was in office, and I think they're essentially constitutional now (perhaps moreso with the added oversight of the FISA Amendments Act of 2008). But it's funny how much more interested President Obama is in making the distinction between purely domestic and foreign intercepts now that it's "his" program. I hope the brouhaha of the last few days has taught him some humility if nothing else.

</comment></comment><comment><USER35> We already have an established process with established safeguards designed to strike an appropriate balance between public safety and personal liberty.

This isn't it.

This is so far from it as to make a mockery of the principles that lay at the very foundations of our nation.

</comment><comment><USER36> So we're expected to trust someone that has been lying to us for 5 years?

</comment><comment><USER37> What the fuck is the "we are not reading emails of any US citizen" bullshit. I am not a US citizen, so you are reading my emails? That is _even_ more fucked up. For one second forget about US citizens and think about all the other people in the world. I don't care what US government does to it's people, it's your government after all. But what I do care is what it does to data of others (including myself), because it has no right to any of that data. So someone get the questions answered.

</comment><comment><USER38> "They are not looking at people's names, and they're not looking at content. But by sifting through this so-called metadata, they may identify potential leads with respect to folks who might engage in terrorism. If these folks — if the intelligence community then actually wants to listen to a phone call, they've got to go back to a federal judge, just like they would in a criminal investigation."

So if you're not collecting names, whose name goes on the warrant once suspicious is aroused?

<comment><USER27> they are getting the data from different sources to not look too suspicious

</comment></comment><comment><USER15> Not sure why Obama thinks he would be high on the list of people this program would abuse. Why would the people running the program punish someone that supported the program? The innocent people that have to fear from this program are the people currently opposing the surveillance state. If you are in a position of power either in private industry or the government and are not co- operating with NSLs or other surveillance requests then you are high on the list.

</comment><comment><USER39> It also mentions that the spying doesn't involve reading emails of US residents? So that means people outside US jurisdiction are being targeted?

</comment><comment><USER40> My problem with his remarks was that he was addressing the wrong issue. He was defending the need to access this data without a warrant. He then repeatedly stated that he welcomed the discussion.

But how can a national discussion take place about a secret program??

He never addressed this issue of why the program needs to be secret in the first place.

</comment><comment><USER41> I do not get why people are not using PGP more. It takes 10 minutes to setup your email client and put public certificate on web. It is just question of time until government starts using this data for "other dangerous stuff" such as tax evasion and not paying parking tickets.

<comment><USER19> People have not yet accepted the fact that in a digital age, there will always be _somebody_ snooping your information. They still believe with enough laws, it can be stopped.

</comment></comment><comment><USER42> Obama: "And I think it's interesting that there are some folks on the left, but also some folks on the right who are now worried about it who weren't very worried about it when it was a Republican president. I think that's good that we're having this discussion."

</comment><comment><USER43> "...represent only small encroachments of people's privacy."

This is pretty much how it starts. First the people accept small encroachments, then they're asked to accept slightly larger encroachments.

Eventually there is no privacy left.

</comment><comment><USER44> <quote>Obama: number one, to keep the American people safe; and number two, to uphold the Constitution.</quote>

isn't that wrong order or priorities exactly what the constitution should protect us from?

</comment><comment><USER45> It opens with "all of your duly elected officials have been aware of this program for years and have consistently voted to maintain it."

Yes, that makes it so much better.

</comment><comment><USER46> It's hard to believe anything the government says about this because a month ago they would have denied anything was being done at all.

</comment><comment><USER47> [http://youtu.be/cGKEkI8IV2o?t=7m43s](http://youtu.be/cGKEkI8IV2o?t=7m43s)

</comment><comment><USER48> "Do you welcome the leak, sir? Do you welcome the leak if you welcome the debate?"

</comment><comment><USER49> The logical fallacies in his speech are remarkable.

</comment><comment><USER50> what is the reason for this being classified? so that people don't stop using Verizon?

</comment><comment><USER50> with great powers comes great responsibilities.... and I thought he could handle it...

</comment><comment><USER27> obama - bush = 0

</comment><comment><USER51> Thank you for posting this dshankar.

Is this an impromptu speech? Why is he mumbling so much?

<comment><USER52> It isn't a speech - its a reply to a question.

<comment><USER53> Well, I would call it a prepared response to an inevitable question, at an unrelated event that was already scheduled.</comment></comment></comment>


Redactable Blockchain, or Rewriting History in Bitcoin and Friends [pdf] - <AUTHOR> https://eprint.iacr.org/2016/757.pdf <comment><USER2> > there are several reasons to prefer an editable blockchain, spanning from > the necessity to remove inappropriate content

There are already blockchains that do not allow for embedding of arbitrary data, because it's all elliptic curve points and Schnorr signatures.

</comment><comment><USER3> > _Redactions can be made only by authorized entities and under specific > constraints_ ...

This makes the network essentially centralized. Why not just use a db that is cheaper?</comment>


AMD Unveils "EPYC" CPUs Featuring Up to 32 Cores and 64 Threads for the Datacenter - <AUTHOR> http://wccftech.com/amd-unveils-epyc-cpus-32-cores-64-threads-datacenter/ <comment><USER3> They also announced Threadripper, which is AMD's new HEDT platform with up to 16 cores and 32 threads, they also showed Radeon Vega Pro SSG (16 Gbyte HBM and 2 Terabyte SSD on the GPU) and DeepBench vs Nvidia P100 (with an advantage of ~30%) etc .

A good summary (with pictures) by a reddit user: [https://www.reddit.com/r/Amd/comments/6bjvy6/amd_2017_financ...](https://www.reddit.com/r/Amd/comments/6bjvy6/amd_2017_financial_analyst_day_discussion_thread/dhn6p7u/)

<comment><USER4> > _16 cores and 32 threads_

I have met software engineers who could not believe me when I pointed out that multi-threading was invented, made sense, and, in fact, was thriving - <USER2> _single-core_ computers (with no hyper-threading)!

<comment><USER5> We still haven't figured out how to parallelize most software without unreasonable effort though. Servers happen to be the happy case for it beacuse they can just run many copies of the same single threaded code that we haven't figured out how to parallelize.

<comment><USER6> In my life that matters less than you'd think, it's not about speeding up a particular program, it's more about been able to run a particulary program at full speed on one core and not drag the rest of them to a halt.

If I have an IDE, 2-3 VM's, a couple of browsers, continuous integration running in the background, webpack/ts-loader with off thread hinting I can easily have 4-5 processes running that all benefit from having a full core to play with.

It's for that reason when I had to build a new desktop for the new job I went with the Ryzen 1700, each core isn't that important (as long as it's comparable with the core in my current jobs i5-3570K which it broadly is), it's having _eight_ of them.

<comment><USER7> It's interesting that this use case of running many different programs continuously is probably quite different from the rest of the high-end desktop world, where you might be exclusively in Autocad, Photoshop, Maya or some complex engineering software.

For developers I think more cores is still better (I'd add Spotify and Slack to your list of things that are always running) and yet we still prefer shiny laptops to powerful desktops.

<comment><USER6> Not me, I develop on desktops 99% of the time.

Laptops have horrible postural positions unless you use desktop monitors at which point why not just use an actual desktop which will annihilate the laptop on performance anyway.

My laptop gets switched on maybe once a month.

</comment></comment></comment></comment></comment></comment><comment><USER8> Really not sure on the "EPYC" name for an enterprise part. It seems more enthusiast then button down enterprise. But as long as it doesn't exclusively come in servers with glowing neons and tri-colour fans, I don't exactly care...

I just imagine it will make it easier for intel's marketing to imply these are toys rather then true enterprise grade parts.

<comment><USER9> It might be completely deliberate, as the WoW generation might be coming into positions where they are now the "enterprise guys" that need to be targeted. Or maybe I'm just reading too much into a whimsical name.

<comment><USER10> I've heard of children named "Riku" and "Sora," so I think the WoW generation has definitely come of age by now...

<comment><USER11> Yeah; for some reason it's still common to think of Millennials as being teenagers despite some of the older ones _having_ teenagers.

<comment><USER6> Depending on whose definition of millenials that's certainly true, I was born 1980, I'm 37 in a couple of weeks and some would have me as a millenial..which is kind of funny since statistically I'm damn near half way through my life.

</comment></comment></comment></comment></comment><comment><USER12> I bet a 64c Zen chip would be amazing with mixed SQL Server workloads but SQL Server's per-core licensing will make it crazy cost prohibitive. $456k for one server - ouch! Here's hoping per-core licensing goes tf away.

<comment><USER13> Since we're doing more low power cores nowadays, maybe Microsoft should charge per watt? ;)

<comment><USER12> I would totally get behind that, especially if it could be actual wattage used and not just based on the tdp of the CPU. Nothing sucks more than having to pay huge money for servers that are sub 5% utilization because you're trying to have some headroom.

<comment><USER14> and from time to time a MS sales rep drops by and measures your power consumption to recalculate cost.

or maybe have a power consumption tracking dongle that sends the information back to MS for billing while the MS techs just check if those are connected to the correct machine.

<comment><USER13> Great ideas!

</comment></comment></comment></comment></comment><comment><USER15> I just boggle at the idea of a server with 1TB of RAM. I'm sure the oil&gas folks are salivating as this allows them to to put an entire high resolution 'cube' into memory and analyze it but for us mere mortals at what point is there so much stuff in memory that you need a couple hours of hold up time just to flush it out to SSD.

<comment><AUTHOR> The big headache is not 1TB but 64TB which is the maximum physical RAM limit of the Linux kernel / x86-64 architecture. Big NUMA systems could go higher but they don't. Look here: [https://www.sgi.com/products/servers/uv/](https://www.sgi.com/products/servers/uv/) "SGI UV 300 scales from 4 to 64 sockets with up to 64TB of shared memory in a single system." vs "SGI UV 3000 scales from 4 to 256 CPU sockets with up to 64TB of shared memory as a single system." see how 256 and 64 sockets both only support 64TB?

More ordinary servers typically stop at 6TB since one Xeon can support 1.5TB so an ordinary quad socket board typically with 96 DIMM slots can go up to 6TB with 64GB DIMMs. You can configure a machine like this at [http://www.thinkmate.com/system/superserver-4048b-tr4ft](http://www.thinkmate.com/system/superserver-4048b-tr4ft) and see that for the relatively low price of $110K you can get a machine with 6TB of RAM.

<comment><USER16> > The big headache is not 1TB but 64TB which is the maximum physical RAM limit > of the Linux kernel / x86-64 architecture.

It sounds like you know what you're talking about, so I'm sure it was inadvertent that you wrote "physical RAM limit of the Linux kernel". It's primarily the x86-64 architecture and 5-level paging is coming which extends the linear address space to 57 bits (128 PiB) and the physical address space up to 52 bits (4 PiB). Still, one wonders how long it will take for that to be inadequate.

[https://software.intel.com/sites/default/files/managed/2b/80...](https://software.intel.com/sites/default/files/managed/2b/80/5-level_paging_white_paper.pdf)

<comment><USER17> And Linux support for 5-level is being actively worked on since December, a quick git search shows this in 4.11:

        Merge 5-level page table prep from Kirill Shutemov:
         "Here's relatively low-risk part of 5-level paging patchset. Merging it
          now will make x86 5-level paging enabling in v4.12 easier.

</comment></comment></comment></comment><comment><USER18> AMD's put a page up for the Pro/Compute version of their new "Vega" GPU.

[http://pro.radeon.com/en-us/frontier/](http://pro.radeon.com/en-us/frontier/)

13 TF FP32, 16GB HBM2 RAM (480 GB/s).

<comment><USER19> Hopefully at the end of this month we will know more about VEGA RX.

<comment><USER3> Ideally with a message like "in stores now/tomorrow" or something along those lines.

<comment><USER20> "Paper launch coming soon!"

</comment></comment></comment></comment><comment><USER21> I wish we had more details about the on-die internconnect ( Hypertransport successor) in terms of latency and bandwidth, and even topology. We run a NUMA .. challenged .. OS, and depending on the interconnect that may or may not matter so much for our workload.

<comment><USER22> <rumor>

Initial leaks point to a PCIe 3.0 64x interconnect

</rumor>

<comment><USER21> Sure.. but I'm wondering about the on-die interconnect between the 4 different packages that share the die. Eg, everything seems like an EPYC is 4 Ryzen packages, and a "thread ripper" is 2 Ryzen packages. So it seems logical that there is something connecting those 2 or 4 packages, and that fabric as bandwidth and latency characteristics. If it is somehow infinitely fast, then that's great for me.

</comment></comment></comment><comment><USER23> I'd love to know what the "security hardware" is - It's tacked on the end as a bullet point but I want to know what they mean by that...

<comment><USER24> Probably hardware accelerated encryption

<comment><USER25> Is this pitched for SSL and HTTPS? Isn't this already done in hardware?

<comment><USER26> Maybe SHA instructions like Intel?

<comment><USER27> Zen has SHA1/2 extensions compatible to the Intel SHA extensions, yes. These are kinda new on desktops, but since they existed for some years some software already supports them out of the box (like OpenSSL and cryptopp); so applications will automatically profit.

With this extension Zen does SHA1 @ 2 cpb, SHA-256 @ 3 cpb and SHA-512 @ 2 cpb (off the top of my head). (All of which are faster than the fastest BLAKE2 implementation I know on Haswell).

<comment><USER26> Do you by chance have hard numbers about SHA2 with/without hardware instructions and BLAKE2 on a specific Intel CPU?

I've wondered about trade off between SHA256 vs BLAKE2. In the future there'll be no debate since more and more computers will have SHA instructions. But right now I'm wondering about the speedup of BLAKE2 vs SHA256 with hardware. On the other hand, many computers, especially servers don't have SHA2 instructions for the foreseeable future which will make BLAKE2 a very good option.

<comment><USER27> Here are a some benchmarks across a wide range of CPUs: [https://github.com/borgbackup/borg/issues/45#issuecomment-22...](https://github.com/borgbackup/borg/issues/45#issuecomment-221234832)

However, none with SHAEXT; they just weren't there yet. But the Zen numbers should give you a good idea.

Note that these benchmarks are made using a plain C implementation of BLAKE2 (the reference one), which is not vectorized by any compiler. The fastest (AVX2) BLAKE2 implementation is about 40 % faster than the scalar C implementation (on Haswell).

As far as I'm aware no mainstream crypto library ships optimized BLAKE2 versions. I believe some Go packages do/did make up their own version (not the one from Samuel Neves), but at least one of them mixed SSE and VEX/AVX insns with the predictably bad results (60 MB/s or so) - perhaps this is fixed by now.

So in summary, BLAKE2b is imho the best candidate on perf, and if you use a good implementation it should be within ~30% of SHA2 (512) with SHAEXT — with the numbers we have so far. I understand that Zen's aggressive (=good) power mgt makes it somewhat difficult to benchmark hot loops consistently, so we'll have to wait and see for practical results, I guess.

</comment></comment></comment></comment></comment></comment></comment><comment><USER28> Given how much these types of processors are used for virtualization, wouldn't a lower core count at a higher clock speed be just as useful? 32 cores at 1.4Ghz only seems useful if you need to use a lot of processor affinity, but assigning faster vCPUs to your VMs doesn't seem to have a downside. Just not sure what advantage this would have over a 16core 2.8ghz chip as a comparison.

<comment><USER29> Switching tasks is expensive [1]. Twice as many cores running at half the speed can be considerably faster in the real world because you're not constantly stopping to flush the cache, save the kilobytes of register a modern CPU has, etc. Honestly, I'm surprised that x86 has kept with just two virtual threads for this long. Architectures like Sparc and Power have 4+ threads per core because so many modern jobs are built around hurrying up and waiting.

[1] [http://www.cs.rochester.edu/u/cli/research/switch.pdf](http://www.cs.rochester.edu/u/cli/research/switch.pdf)

<comment><USER30> A core at twice the frequency is better than two at half the frequency every time. The problem is usually the trade-off is not that clear (either the slower cores consume significantly less or they are faster than just half as slow).

Regarding HT, 2 threads is really a sweet spot for a 4-wide CPU. More than that and the competition for cache resources, execution units and register file become significant.

POWER8 is special because a factor of x2 is because each power 'core; is pretty much two distinct smaller cores that can gang together to speed up one thread (it also helps on per core software licensing), while the other x2 factor is for very specialized loads (this is also true, or used to be, for SPARC).

IIRC XeonPhi which is also a specialized cpu has 4xHT.

</comment></comment></comment><comment><USER31> So, presently, this is what I've been able to gather:

\</comment><comment></comment><comment>--

Xeon E5 2699 v5

32C/64T @ 2.30 GHz

L1 Instruction Cache: 32 KB x 32

L1 Data Cache: 32 KB x 32

L2 Cache: 256 KB x 32

L3 Cache: 46080 KB

\</comment><comment></comment><comment>--

AMD EPYC

32C/64T @ 1.4 GHz

L1 Instruction Cache: 32 KB x 32

L1 Data Cache: 64 KB x 32

L2 Cache: 512 KB x 32

L3 Cache: TBA

\</comment><comment></comment><comment>--

It's going to be interesting to see what the performance per dollar amounts to on both sides.

I'm guessing the Xeon will land somewhere around $4K. Although, I have no idea about the EPYC.

<comment><USER3> The EPYC is 4 dies connected by AMD's Infinity Fabric. I wonder how much cheaper that makes the chip to produce.

Regarding the L3 cache: if nothing changed from Ryzen it will be 64 MByte.

</comment></comment><comment><USER32> Are they secure? Do they have undocumented PSP arm cores with dma access?

</comment><comment><USER33> Will these be available for workstations in two or more configs? Also, what's the situation with AMD and Thunderbolt? Does that exist at all?

<comment><USER34> Threadripper (16c/32t, quad channel memory, 44? PCIe 3.0 lanes) will probably be the Workstation platform.

Wouldn't AMD need to license Thunderbolt from Intel? There are repeatedly rumors about a license agreement between Intel and AMD regarding AMDs GPU IP, if that is true maybe they get access to Thunderbolt.

<comment><USER35> Do you need to license Thunderbolt to use it? I thought you just had to buy their transceiver chips (which just hang off a PCIe3 x4 interconnect).

<comment><USER36> Intel is refusing to sell the chips unless you swear undying loyalty to Intel.

<comment><USER37> That's not at all anticompetitive

<comment><USER38> It's pretty terrible. You're just unable to make certain kinds of devices on what _should_ be a super generic pci-e extender.

</comment></comment></comment></comment></comment></comment><comment><USER39> is it AM4 and can you create a workstation with it?

<comment><USER40> Nope, it is a new socket "SP3" \- LGA and 4094 pins.

AM4 is PGA and 1331 pins. :)

<comment><USER41> And about half of those pins are purely dedicated to PCI-E.</comment></comment></comment>


Blippar finds life after death; former investor buys assets to relaunch - <AUTHOR> https://techcrunch.com/2019/01/23/blippar-finds-life-after-death-as-former-investor-buys-assets-to-relaunch-ar-startup/ <comment><USER2> This is actually a viable exit strategy for a founder, if you can believe it. The first startup I worked at blew up _3 times_. The initial investors gave up and sold their losses. The assets were sold to a large company. The large company agreed to keep the company separate with the founders on the cap table in exchange for keeping the team together. Ran through all _that_ money and then sold the company again, though abandoning the tech and really just selling the team. Each round everybody got non-trivial retention bonuses. The founders were careful to negotiate a non-preferential cap table (how they did that is beyond me -- amazing sales people) and made a tidy profit on each sale. It's not "unicorn money", but it's definitely "living well" money. And the funny thing is that running the same company in the ground 3 times is _not_ a strike against you in the VC world it seems.

I was young and stupid at the time. I should have stuck around and rode their coat tails for a while -- I would have made at least "house money" off it. But I was a bit too focused on doing "real work" and ended up embarking on a career that made many people very wealthy, not including myself ;-) No regrets really, but I may have some when I retire...

</comment><comment><USER3> > "After it failed to pull together an emergency funding deal ... One of the > AR startup's main investors, Candy Ventures, has acquired the company's > assets and will be keeping the brand alive underneath the leadership of > [the] founder"

I'm no investing expert, but this indicates to me that Candy Ventures intentionally allowed the Blippar to fall into this state of shambles so that Candy Ventures could somehow get a better deal. Seems like an absolutely brutal business strategy.

<comment><USER4> > intentionally allowed the Blippar to fall into this state of shambles so

To take this as a strategy you'd have to assume none of the other investors nor anyone else would out bid you. It wouldn't make a lot of sense. Throw away an X% stake in something in order to bid on a 100% stake in it in bankrupcy court?

If you had some kind of secret knowledge that none of the other original investors had and that you knew wouldn't be disclosed in the auction I guess it could work.

</comment></comment><comment><USER5> > Blippar may have blown up in dramatic fashion, burning through more than > $130 million in funding for its dream of building an augmented reality > empire...

Wow

> At one point, the startup had more than 300 employees and claimed a $1.5 > billion valuation.

Somewhat surprised I hadn't heard of them. Lots of posts about them [0], but it seems this is the first time they're being upvoted. I would have loved to see more of these posts than the common posts about Tesla, Uber, Apple, and Google, and cryptocurrencies that get so many upvotes. I generally just scroll through the "new" page now.

[0] [https://hn.algolia.com/?query=blippar&sort=byPopularity&pref...](https://hn.algolia.com/?query=blippar&sort=byPopularity&prefix&page=0&dateRange=all&type=story)

</comment><comment> brian-armstrong To follow up on the recent HN post about Glassdoor fraud, it's amusing to see how many people were apparently happily bopping along at Blippar as recently as 6 months ago

[https://www.glassdoor.com/Reviews/Blippar- Reviews-E810640.ht...](https://www.glassdoor.com/Reviews/Blippar- Reviews-E810640.htm)

</comment><comment><USER6> Maybe this is a case of too soon for the market?

Plus being in the UK instead of the US.

</comment><comment><USER7> Is AR inherently vaporware? I've been very underwhelmed by both HoloDeck and MagicLeap. Is this basically a promise that can't be delivered?

<comment><USER8> I very much agree. We recently did a dive into this business model to see if it solves a problem people would genuinely pay for. [https://medium.com/lean- canvas-takedown/why-ar-fails-blippar...](https://medium.com/lean-canvas- takedown/why-ar-fails-blippar-case-study-6bd5507cb2ca)

Short answer: no it doesn't.</comment></comment>


Masterminding the largest lottery scam in American history - <AUTHOR> https://www.nytimes.com/interactive/2018/05/03/magazine/money-issue-iowa-lottery-fraud-mystery.html <comment><USER2> I'm amazed at how brazen/obvious of a cheat the code here is:

 _Tipton's extra lines of code first checked to see if the coming lottery drawing fulfilled Tipton's narrow circumstances. It had to be on a Wednesday or a Saturday evening, and one of three dates in a nonleap year: the 147th day of the year (May 27), the 327th day (Nov. 23) or the 363rd day (Dec. 29). Investigators noticed those dates generally fell around holidays — Memorial Day, Thanksgiving and Christmas — when Tipton was often on vacation. If those criteria were satisfied, the random-number generator was diverted to a different track. Instead, the algorithm would use a predetermined seed number that restricted the pool of potential winning numbers to a much smaller, predictable set of numbers._

Admittedly, this is based only on the description from the article, which says it is describing pseudocode. But obviously, once this code is found, it's game over. Apparently the audit process for lotteries is terrible enough that this didn't matter.

Compare this with the auto emissions cheating scandal, where the algorithm was complicated in order to hide what was happening, so that the code would not be obvious as a defeat device: [http://cseweb.ucsd.edu/~klevchen/diesel- sp17.pdf](http://cseweb.ucsd.edu/~klevchen/diesel-sp17.pdf) (see pages 6-8).

<comment><USER3> From the DEFCON presentation I mentioned elsewhere, it also seems like if he hadn't flubbed up and tried to claim the 16.5 million dollar prize, he (and his friends/family) wouldn't have been caught at all.

I can't believe he put the code in when he knew it would be audited, but then I doubly can't believe he would poke them to take a second look by suggesting something odd was involved at all.

<comment><USER4> From the original article here, it sounds like if he hadn't talked with the cashier at the Qwikstop he would be fine.

<comment><USER5> Or if the intermediary had simply said they forgot what they were wearing.

<comment><USER4> Ya I don't know why they would have tried to guess (unless Eddie told him the wrong info by mistake). It was nearly 1 year prior and no one would expect someone to remember what they were wearing when they walked into a gas station on a random Wednesday.

</comment></comment></comment></comment></comment><comment><USER6> Way worse than NYT uncovers. The Iowa Attorney General conspired with the Iowa Lotto to charge the Iowa Lotto VP of Security with an "annoying speech" simple misdemeanor in retaliation for him blowing the whistle to Iowa Citizens Aide Ombuds investigator Bert Dalmer. Unfortunately for Iowa AG Tom Miller, the criminal complaint affidavit is still available for public records request at Des Moines Police Department even though the court records are sealed due to a deferred prosecution.

See [https://en.wikipedia.org/wiki/Coates_v._City_of_Cincinnati](https://en.wikipedia.org/wiki/Coates_v._City_of_Cincinnati) , but Iowa still has "annoying" speech criminalized under Iowa Code 708.7; the ultimate whistleblower retaliation tool.

<comment><USER6> [https://ialottery.com/PDF/Legal/BoardMaterials/2011/BoardPac...](https://ialottery.com/PDF/Legal/BoardMaterials/2011/BoardPacket_062011.pdf) \- Last minutes citing some of Diaz's whistleblower concerns.

</comment></comment><comment><USER7> This reminded of a famous fraud in the Mexican Lottery. It was low-tech, basically the company that transmits the draw managed to record it minutes before, tell insiders the numbers and later transmit the video as if it was real-time. $12 million USD were stolen, only $8 million were recovered.

The lotteries here (besides the statistical argument) are not trustworthy. I urge people who buy tickets to save their money, but the dream of getting rich instantly is too alluring.

<comment><USER8> >$12 million USD were stolen, only $8 million were recovered

>only $8 million

isn't a 75% recovery rate pretty good for cases like this?

edit: 67%

<comment><USER9> maybe, but 8/12 isn't 75%

<comment><USER8> thanks, updated.

</comment></comment></comment></comment><comment><USER3> > From Tipton's point of view, it was complicated. He had done something to > see if he could do it. To his surprise, it worked. He said he inserted that > code only once; after the code was approved by Gaming Laboratories > International, machines containing it were shipped all over the country.

The article skips right over this. HTH was this code, which the article reports wasn't even hidden, approved by a third party?

Trying to find out, I found this:

[https://www.desmoinesregister.com/story/news/investigations/...](https://www.desmoinesregister.com/story/news/investigations/2018/03/16/iowa- mastermind-who-scammed-lotteries-5-states-he-says-problems-he-exploited-arent- fixed-should-you/399257002/)

Which mentions:

"Tipton designed his rigged coding so that it wasn't detected in the company's random tests, according to a report Fritschie helped present last year."

...as well as: "Toyne said the association does not have any ongoing contractual relations with Gaming Labs."

The "report" mentioned earlier is a DEFCON presentation about gambling fraud in general, pretty interesting read: [https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20pre...](https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20presentations/DEFCON-25-Gus- Frischie-and-Evan-Teitelman-Backdooring-the-Lottery.pdf)

In it mentions "The method of rigging the RNG could have been more discrete" and gave the breakdown of reverse engineering the binary to find(?) the source code. It also said the labs tested the RNG for statistical bias (which would pass) and audited the source code (it only gives the Picard Facepalm pic, so I assume the auditors likely relied solely/mostly on the automated test.

<comment><USER10> it sounds like they would have to run their tests with mock dates for every date out of the year to discover anything, unless they happened to run their tests on one of the 3 days mentioned in the code, they wouldn't find it. how many tests would they need to run to really tell if there is any bias?

<comment><USER11> Why would it even be okay at all for a piece of code that determines the seed for a pseudo RNG via observation of hardware events (a Geiger counter measurement, according to the article) to even access the date and time on a given system? It should have no use for that information, and with a piece of code of that criticality, one would expect auditors to scrutinize any and all syscalls that it performs. This way it should have been fairly obvious that it's requesting the time from the OS, which it shouldn't do in the first place. Mocking date/time info is unnecessary if your code under test is entirely unable to get time information from the system in the first place.

<comment><USER12> All of the brightest minds were building Facebook ;)

</comment></comment></comment></comment><comment><USER13> Before he even backdoored it, the lottery was using a Mersenne Twister?

 _The random number is called the seed, and the seed is plugged into the algorithm, a pseudorandom number generator called the Mersenne Twister. At the end, the computer spits out the winning lottery numbers._

<comment><USER14> Mersenne Twister, with a seed based on the amount of Americum-241 detected by a Geiger counter.

[https://en.m.wikipedia.org/wiki/Americium#Occurrence](https://en.m.wikipedia.org/wiki/Americium#Occurrence) if you're curious how much there generally is and how much it might fluctuate.

<comment><USER15> There's no excuse for using MT for anything important this century.

<comment><USER16> Fortuna w/ AES as the block cipher.

</comment></comment></comment></comment><comment><USER17> "It was a simple piece of code, partly copied from an internet source, inserted by the one man responsible for information security at an organization that runs three dozen United States lotteries."

"Tipton's extra lines of code first checked to see if the coming lottery drawing fulfilled Tipton's narrow circumstances. It had to be on a Wednesday or a Saturday evening, and one of three dates in a nonleap year: the 147th day of the year (May 27), the 327th day (Nov. 23) or the 363rd day (Dec. 29). If those criteria were satisfied, the random-number generator was diverted to a different track. Instead, the algorithm would use a predetermined seed number that restricted the pool of potential winning numbers to a much smaller, predictable set of numbers."

<comment><USER18> > partly copied from an internet source

Ah the ol' stackoverflow copy/paste.

</comment></comment><comment><USER19> Facebook non-sequitur:

"Tommy Tipton had three Facebook friends named Conn." How did they get this data, was it available due to warrant or probable crime?

Yet another reason to not use FB. Like, at all. I doubt the police could ask FB for their "dossier" on you if you're not signed up (or does FB provide shadow profile access to law enforcement?)

<comment><USER20> You can view a person's friends on Facebook

</comment></comment><comment><USER21> Mind boggling that one or two people (the perp and the cop) and their separate strains of attention to details + curiosity could impacts so many.

Maybe luck is real after all ;)

Great story.

</comment><comment><USER22> "...inserted by the one man responsible for information security at an organization that runs three dozen United States lotteries."

That's the entire problem, right there. He could have been much more brazen and still succeeded.

</comment><comment><USER23> I guess if you are going to go bad, hacking a lottery is not the most terrible thing you can do. Reducing public confidence in what is basically the numbers racket might even be considered a public good...

</comment><comment><USER24> If the recent Zuckerberg testimony is an example, we need more public officials who can understand the complexity of code, technology, and the law.

I've known the young assistant attorney general in this story for more than ten years. Rob Sand is a great guy and is running to be a state auditor of Iowa - you can support him at robsand.com. Also, if you're interested in meeting him in person, I'm also happy to facilitate an introduction (friends across the country like to house him from time to time).

</comment><comment><USER25> They would have never figured this out had the idiot just had someone else claim the 16.5M prize, or simply picked a state that allows winners to be anonymous.

<comment><USER4> I wonder why he tried to go through lawyer and offshore companies this time, rather than have a friend claim the ticket.

I wonder if he found out they had video recording of the person buying the ticket.

</comment></comment><comment><USER26> I don't know if it is hubris, but the investigation only started because no one claimed the 16 millions jackpot. He could probably have keep winning smaller sums forever.

<comment><USER27> And he seriously bought the ticket himself, that's amateur level incompetence.

<comment><USER28> I think having hundreds of people buy the tickets would have upped the complexity too much. He didn't deterministically have the exact number. He was playing hundreds of tickets per win still.

</comment></comment></comment><comment><USER29> This was written well. A fun read!

<comment><USER30> I enjoyed it, but the reveal was a little disappointing.

<comment><USER31> Why disappointing? Because it seemed so simple? To me, that is the appeal, since the complexity of the hack has an inverse relation to the level of incompetency of the bureaucratic oversight.

<comment><USER30> I mean, yeah. It just felt anticlimactic.

</comment></comment></comment></comment><comment><USER32> Now imagine what a diligent and clever thief could do and extrapolate to how many other lotteries must be rigged...

</comment><comment><USER16> You gotta be an 18th c. French philosopher/writer to game lotteries these days.

</comment><comment><USER27> Uh... I really, really dislike this title, its inaccurate and (intentionally?) misleading.

The title is "The Man Who Cracked the Lottery" but it's not about someone actually _cracking_ the lottery, that is, figuring out how to mathematically win the lottery or figuring out existing flaws; its just about straight up insider fraud. A better title is "The Man Who Rigged the Lottery." Or the TL;DR version: "Man Inserted Logic Bomb Into Lottery Draw Code Because There Was No Controls To Stop Him."

Its still somewhat of an interesting read but the title really ruined it for me; I was expecting an entirely different story.

Examples of people actually cracking the lottery/gambling site:

[https://highline.huffingtonpost.com/articles/en/lotto- winner...](https://highline.huffingtonpost.com/articles/en/lotto-winners/)

[https://www.developer.com/tech/article.php/616221/How-We- Lea...](https://www.developer.com/tech/article.php/616221/How-We-Learned-to- Cheat-at-Online-Poker-A-Study-in-Software-Security.htm)

<comment><USER30> The article suggests there was an audit that he had to get past, at least.

> From Tipton's point of view, it was complicated. He had done something to > see if he could do it. To his surprise, it worked. He said he inserted that > code only once; after the code was approved by Gaming Laboratories > International, machines containing it were shipped all over the country.

<comment><USER27> What good is an "audit" if it doesn't even catch the simplest of simple malicious code?

<comment><USER33> The auditors did only this:

\- ran the RNG through statistical tests (which of course passed flawlessly)

\- audited the source code (but the backdoor was in binaries…)

Source: DEFCON presentation linked elsewhere in comments.

</comment></comment></comment></comment><comment><USER34> Jumping ahead of the conversation a bit, insert blockchain thread here. (=

<comment><USER7> Only if it includes a lightweight and fast electron client.

</comment></comment><comment><USER35> By looking only at the title, I actually thought for a brief moment that this would be a story about Ethereum.

</comment><comment><USER36> Why is there a tone of respect/admiration around scams like this but when a small startup founder makes a less-than-criminal mistake (eg lendedu) HN users want their heads on a stake?

<comment><USER31> The current top-voted comment [0] expresses amazement -- not admiration -- that the hack was so stupidly simple. Can't read the author's mind, but I share a similar sentiment: it's amazing that this crime was possible, and it reveals the incompetence/complacency of the Iowa Lottery's IT.

[https://news.ycombinator.com/item?id=16995374](https://news.ycombinator.com/item?id=16995374)</comment></comment>


Aspiring entrepreneur here, built programmatic breadboards, need advice - <AUTHOR> I have built a device that augments the common breadboard to replace peripheral components with programmatic internal components. But I need advice as to navigating the running of a business. I have recently won a pitching contest and been accepted into the Interview stage of an accelerator program. I am quite overwhelmed, considering my lack of experience. <comment><AUTHOR> Here is the project: [https://www.reddit.com/r/metaboard/](https://www.reddit.com/r/metaboard/)</comment>


Giving.github.com - <AUTHOR> http://giving.github.com/ <comment><USER2> Seems a bit dangerous to be using the automatic third level domain of github in this way. This is not the first time I've thought a project was endorsed by github when it was not.

<comment><USER3> You can tell just by looking at the website. No designer at Github would have approved this.

<comment><USER4> By including ".github.com" in the name, the project is, to me, trying to parade itself as being part of github or affiliated in some way. They're using github's name as an appeal to authority. It's a neat project, but needs a better name.

<comment><USER5> You must be confused by _every_ blog on Github then.

<comment><USER4> Yeah, not particularly. Most of the ones I've seen (again, casual Github user) are not trying to use .github.com in the name of their site (regardless of address). Here, the project is named, "giving.github.com," implying Github affiliation. <http://square.github.com/cubism> is clearly branded as Square, not square.github.com. There's a big difference.

</comment></comment></comment></comment></comment><comment><USER6> (author)

Thank you all for looking; I hope you come back occasionally, take a look at the open issues and such!

I was really surprised by the whole complaints about name thing, and I've made changes as explained here: [http://williamedwardscoder.tumblr.com/post/23092615385/givin...](http://williamedwardscoder.tumblr.com/post/23092615385/giving- code)

</comment><comment><USER7> Issues of the domain name aside, I think the entire project is a bit 'fuzzy' in that the kinds of problems that will be posted here aren't easily lent to this sort of 'spare time' coding.

Working on someone else's project is something that eats a LOT of time. Even small projects inevitably end up taking weeks, months, or years.

If you're getting paid or if it's a personal passion then it tends to get done very quickly. Anything else tends to be regulated to release-date-pushing hell.

</comment><comment><USER8> I love the idea, but why restrict it to only contributions of MIT or Aferro GPL licensed code? This prevents potential contributions, which goes against the ultimate goal of helping charities, scientists, and engineers.

<comment><USER6> You get the suggested two licenses at opposite ends of the spectrum. And if you go name something in-between, I'm sure nobody will blink.

So what is being stopped?

</comment></comment><comment><USER9> Original Discussion from it's first appearance on HN: <http://news.ycombinator.com/item?id=3906143>

Also, blog post from presumably the author about how the idea hadn't really taken off: [http://williamedwardscoder.tumblr.com/post/21266287229/givin...](http://williamedwardscoder.tumblr.com/post/21266287229/giving- up-on-giving-github-com)

and discussion of said post: <http://news.ycombinator.com/item?id=3852413>

<comment><USER6> and then this happened: [http://williamedwardscoder.tumblr.com/post/22130068036/givin...](http://williamedwardscoder.tumblr.com/post/22130068036/giving- github-com) :)

</comment></comment><comment><USER10> I'm all for the idea of giving away programming time to charity.

I build one website for a charity each year.

But instead of using a market place like this to find a charity, I find it's a bit more rewarding to network through family and friends to find a charity you can help that you have a more personal connection to.

</comment><comment><USER11> If a tenth of the cool projects on github were endorsed by Github, github would be a failure.

Or at least it would be a mere shadow of its insane awesomeness.

</comment><comment><USER5> Awesome idea but I'm interested in the execution, have you or anyone done any of these projects before and can speak on how it works with these charities?

</comment><comment><USER12> @kneath would have never let that page design fly.</comment>


The Human Animal - The Language of the Body (1994, Part One) - <AUTHOR> http://video.google.com/videoplay?docid=3723678050599653349#docid=-3323021761394989726 <comment><USER2> That was a very good watch.

Part II

<http://video.google.com/videoplay?docid=3759901256066398161#></comment>


Going crazy with CSS3 - Creating inputs with perfect borders and shadows - <AUTHOR> http://ivomynttinen.com/blog/going-crazy-with-css3-issue-2-creating-inputs-with-perfect-borders-and-shadows/

<comment><USER2> These are the types of CSS articles we need more of on HN; functional, simple and UX-friendly. Thanks for your awesome write-ups Ivo.

<comment><AUTHOR> Glad you like it! More articles on similar topics will come for sure :)</comment></comment>


Avegant: Fastest Crowdfunded Kickstarter Ever? - <AUTHOR> http://wearableworldnews.com/2014/01/22/avegant-fastest-growing-kickstarter-ever/

<comment><USER2> no idea, but after <4.5 hours, already past its $250,000 target by $10k and growing...</comment>


Cisco's disastrous quarter shows impact of NSA spying on US companies - <AUTHOR> http://qz.com/147313/ciscos-disastrous-quarter-shows-how-nsa-spying-could-freeze-us-companies-out-of-a-trillion-dollar-opportunity/

<comment><USER2> So far Cisco is just whining about how the government is being unhelpful. I wonder when technology vendors will start offering truly secure systems that have no back doors and are highly resistant to snooping.</comment>


Ask HN: Job Scheduling as a service - mani-smhack 	Is there any product that will allow us to schedule via an api , and then if the time is triggered then it should call the destination via webhook(with payload preferably ) Right now we are using quartz scheduler which has more configuration (Including Mysql Connection ) .
Cons are 1) Does not have an admin UI 2) No reporting or history of jobs
Thanks <comment><AUTHOR> Nomad by Hashicorp. You have to do just a little legwork to get it to call an API - just schedule a job that calls the appropriate curl command. When I'm explaining it to people, I explain it is a "distributed cron". You schedule a job either using the command line or via an API to the Nomad server and then it runs the job on any box that has the Nomad agent running and registered to the server. If you combine Nomad with Consul, configuration is dead simple.

[https://www.nomadproject.io](https://www.nomadproject.io)

<comment><USER2> Nomad is probably a bit overkill for cron. It's a whole k8s alternative isn't it?

<comment><AUTHOR> It can be. But if you just need a distributed cron, you can just use the raw_exec or exec driver type and run a shell command.

</comment></comment></comment><comment><USER3> You want cron, as a service?

Shit on a stick doesn't anyone actually host _anything_ themselves anymore?

<comment> mani-smhack I need a scheduler where i can dynamically ( via api ) schedule a job , with the admin UI to manage the jobs .

I Think these are not part of application development and it can be offloaded to hosted services .

<comment><USER4> Jenkins has scheduled jobs and an UI. It can also be accessed via API. [https://jenkins.io/](https://jenkins.io/)

<comment> mani-smhack This is not with respect to devops or build .

My app has schedule functionality for example a scheduled report , so if it where like a webhook call then i dont want to waste the cpu cycle ,now i am using quartz scheduler in my java app .

<comment><USER5> Jenkins isn't just for devops or build.

</comment></comment></comment></comment></comment><comment><USER6> There are a few online tools, such as:

[https://www.easycron.com/](https://www.easycron.com/)

[https://www.setcronjob.com/](https://www.setcronjob.com/)

etc. You might be as well writing your own though, since it shouldn't be a difficult task.

<comment><AUTHOR> I couldn't agree more, I am a Dev lead with a mandate to "outsource everything possible" When it comes to infrastructure type stuff, but even he would look at me crazy for outsourcing job scheduling.

</comment></comment><comment><USER7> I'm surprised no one's mentioned Chronos - it takes a butt load of setup because it runs on top of Mesos (which requires Zookeeper) etc - but if you already have these tools in your stack it's a pretty tidy clustered scheduler: [https://medium.com/airbnb-engineering/chronos-a- replacement-...](https://medium.com/airbnb-engineering/chronos-a-replacement- for-cron-f05d7d986a9d)

Edit: if you haven't got this stack around though i'd second calls to use a build tool like Jenkins or Rundeck - of course you probably don't want this on the same Jenkins that builds your jobs... so you'd have to set all that up

</comment><comment><USER8> [https://github.com/flipkart- incubator/simpleJobScheduler](https://github.com/flipkart- incubator/simpleJobScheduler)

</comment><comment><USER9> Google app engine has a cron service:

[https://cloud.google.com/appengine/docs/standard/python/conf...](https://cloud.google.com/appengine/docs/standard/python/config/cronref)

You'll have to create an app handler for the URL which can then make the outbound http request. It's inexpensive, reliable and has an admin interface and logs.

<comment> mani-smhack Yeah this works for cron jobs . Let me explain my requirement , say i have social media platform and users will schedule their post , and i need to schedule it in my scheduler and i have to persist in the databsae too . Because if the server is restarted all my scheduled jobs will be gone ..

So i am looking for a hosted scheduler where i can send a rest API request with a webhook and a small payload . During the execution time the hosted scheduler will call the webhook with the payload , so that i will publish the post .

Pros is that i dont want to worry about the scheduled jobs .Right now i am unable to find a scheduler with the good admin UI ( to pause all the jobs ) to delete the trial users post .

<comment><USER3> This sounds like a terrible way to achieve your goal.

Save the future posts to the database with the required publish date/time.

Run cron every $X minutes where $X is the smallest interval you allow (ie if you force publish date to be rounded to 5 minutes, run cron every 5 minutes) and check for "future posts" where the publish date <= now(), and take action.

This is pretty basic stuff and that you want to offload it to a 3rd party by capturing _all_ the details into a request to be made back to your app is a huge red flag IMO.

<comment><AUTHOR> He's posting an example. He mentioned multiple jobs.

</comment></comment></comment></comment><comment><USER10> Apache Airflow? It's not SaaS but is easily self-hosted, and I'm aware of a few initiatives to make it into a service.

</comment><comment><USER11> Operated by my coworker: [https://crontron.com](https://crontron.com)

</comment><comment><USER12> Something like Azure Storage Queues and Functions may be what you're looking for

[https://aaron-hoffman.blogspot.com/2017/01/replace-azure- sch...](https://aaron-hoffman.blogspot.com/2017/01/replace-azure-scheduler- with-azure.html)

</comment><comment><USER13> [https://azure.microsoft.com/en- gb/services/scheduler/](https://azure.microsoft.com/en-gb/services/scheduler/)

</comment><comment><USER14> I agree that Nomad is a GREAT solution for this... but another thing to look at is Rundeck [http://rundeck.org/](http://rundeck.org/)

</comment><comment><USER15> I would use Jenkins, although marketed as CI tool, can do what you asked. And has a lot of customization.

[https://jenkins.io/](https://jenkins.io/)

</comment><comment><USER16> Redwood software RunMyJob: [https://www.redwood.com/runmyjobs/](https://www.redwood.com/runmyjobs/)

</comment><comment> mani-smhack Basically what i am looking is a quartz scheduler alternative with monitoring and admin UI(preferrably hosted)

More like sendgrid.com for scheduling

</comment><comment><USER17> I think hook.io can do this.

see: [http://hook.io/cron](http://hook.io/cron)

</comment><comment><USER18> with a friend we did : [https://www.jobscheduler.xyz/](https://www.jobscheduler.xyz/) it's an MVP but it works well for our projects (chatbot, emailing service...)

</comment><comment><USER19> webhook.io works great for me. they also have a great free plan

<comment><USER20> webhook.io is now defunct. They either shut it already down or will soon shut it down.

I think webtask.io is somewhat similar.

Also, iron.io lets you schedule functions using docker, has full API.

AWS Lambda also lets you schedule Lambda and has full API.

<comment><USER19> sorry i meant webtask.io!

</comment></comment></comment><comment><USER5> You can use Jenkins.

</comment><comment><USER21> Rundeck</comment>


Sam Odio: Real Person or Anybots (robot) prototype? ;) - <AUTHOR>

<comment><USER2> Most of us just submit and post under the shared Sam_Odio account.

</comment><comment><USER3> Haha, I have actually met Sam several times, slept on the floor of his apartment once or twice, almost crashed his Segway, took his money playing poker, and got drunk with him, so I can vouch for his existence. At one point he actually wrote one or two lines of code for Wamily, but was always on YC news all the time we had to let him go.

(kidding about that last part)

</comment><comment><AUTHOR> I'm in awe (in a good way) that every time I check into News.YC, I see that Sam Odio has just submitted several links and commented on many more...

Is Sam a real person or is anybots about to release something amazing?

 _Actually, I think it's the former, but can't resist a bit of good-natured ribbing... now close that browser and do something productive!_ ;)

<comment><USER4> all your base are belong to us.

<comment><USER5> you have no chance to survive make your time.

</comment></comment></comment><comment><USER6> _You know you've been on news.yc too long when...someone submits a question asking if you're an automaton -- and other curious users mod it up._

</comment><comment><USER7> Alas, Sam is real. He mooched off my couch for three days last month. Although, my electric bill was rather high that month. Maybe he wasn't sleeping, he was recharging. ;-)

</comment><comment><USER8> <http://entrepreneur.meetup.com/1077/members/3290974/> <http://bluwiki.com/go/Sam_Odio>

Google says Sam is real.

<comment><USER4> Bah. Fooling google into my existence is AI 101. It only took a week for trevor to program lifelike profile creation capabilities into me.

Programming my witty sense of humor, however, is taking longer. He's been working on it for the last 6 years; and my jokes still fall flat.

</comment></comment><comment><USER9> Sam is the best submitter of front page TechCrunch articles I have ever seen.

</comment><comment><USER10> I can confirm that Sam is indeed mostly metal. When he walks, you can hear his balls of steel clanking.

</comment><comment><USER11> Less posting, more coding! ;)</comment>


A 3D Interactive Map of AWS Infrastructure - <AUTHOR> https://infrastructure.aws <comment><USER2> Kind of promotional material.

<comment><USER3> True, but it's also kind of cool, and it's not trivial to wrap your head around what a "cloud" is. This could be quite useful in selling the concept of doing something on any cloud provider's service to others, especially higher ups who aren't techies. For example, making it clear what points of presence, availability zones and regions mean, and what you get when you pay to take advantage of them.</comment></comment>


Ask HN: Where's the best place or best way to learn JavaScript syntax? - <AUTHOR> I did computer science at university but due to many external life pressures, couldn't keep up the pace with the programming modules. After university i went into IT support instead of coding. So I haven't had much practice but I understand fundamentals well (at least i feel).
Im trying to get myself back into coding as i often need it for work (front end only).
I find i can grasp coding concepts really well but when it comes to implementation i always get it wrong on syntax.
Today i had 6 lines of code and even with the help of JSHint, it took me 1hr to debug. My syntax was wrong.
I've read a 2 books on js already but still the JS syntax rules don't seem to be sticking.
I realise much of this comes down to practice but i'd love if there was something to help me up my game? <comment><USER2> [https://www.codecademy.com](https://www.codecademy.com) and [http://www.w3schools.com/js/default.asp](http://www.w3schools.com/js/default.asp) can get you started out.

</comment><comment><USER3> Build a small product, and look at big open source projects like backbone, underscore, react, etc.</comment>


Reasons to hate any programming language - <AUTHOR> http://stackoverflow.com/questions/282329/what-are-five-things-you-hate-about-your-favorite-language/282436

<comment><USER2> It seems like the good ones about Clojure and Scala are buried beneath the pile of whining about Java and Ruby.

Anyway, here's my 5 for Haskell.

1\. Sometimes the type system feels backwards. What if I don't want the compiler to infer types for my variables? What if I want the opposite, where it does constraint checking on said variables? For example, instead of inferring the type of the elements of a list, it instead makes sure that they all belong to a particular typeclass. This is a subtle but huge difference that makes it difficult for me to program UIs. It can be done, but it seems to take more effort than it does in some other languages.

2\. Allowing the construction of infinite values leads to some really frustrating errors sometimes. Sometimes you make mistakes of the form "let x = f x", which is valid in some situations and not others.

3\. Monad should imply Applicative should imply Functor.

4\. Bytestring handling bites you in the ass sometimes and you don't know it until your program crashes because you mixed things up improperly. Something is wrong here, when we are losing type information that should have prevented this.

5\. Typeclasses should be automatically derived for trivial cases, like witness types, but there's a strong potential for abuse there.

<comment><USER3> Accidentally downvoted this while intending to upvote, and now I can't undo - HN is not very mobile-friendly.

<comment><USER2> Yea that happens to me too. =/

</comment></comment></comment><comment><USER4> 5 Reasons to hate any programming language:

1\. It doesn't _just know_ what I want it to do.

2\. It doesn't accept ambiguous syntax.

3\. I still have to type stuff, even if I use an IDE.

4\. It's not fast enough (for any value of "fast").

5\. It's either too verbose or else unintelligible.

<comment><USER5> Re. 3: It seems you haven't worked with LabView. On the other hand -- you're lucky, you haven't worked with LabView.

<comment> X-Istence Labview, why did you have to remind me of that abomination? It is a real shame that US FIRST (FIRST Robotics) has decided for the FRC division to use LabView to have people program their cRio controllers to control their robots.

</comment></comment></comment><comment><USER6> OCaml:

5) Polymorphic comparison is an ugly hack and land you in an infinite loop when accidentally used on a circular imperative structure. Type classes (specifically, an Ord type class) would fix this problem.

4) Arbitrary gaps and inconsistencies in the standard library. Extlib and Batteries go a long way to fix this, but the language really just needs a standard library overhaul.

3) Inefficient data representation and wonky hacks to optimize a few special cases (e.g. 31/63 bit integers).

2) Absolutely terribly C interface which requires deep knowledge of the runtime data layout.

1) Too many languages in one: OCaml is the awkward synthesis of an awesome module system (functors, first class modules, etc...), a slightly confusing but cool object system, the classic ML core, and some random fancy features (such as polymorphic variants). The interaction of these parts ends up being pretty confusing.

All that said, it's still my favourite language.

</comment><comment><USER7> This question made me realize I don't have a favorite programming language anymore. I am most experienced in C++, but I've spent enough time with Python and Haskell to know what I'm missing.

<comment><USER5> I feel the same... but I have a clear area->language mapping now: networking - erlang; random quick tools - bash/python; utilities which should work for a longer time - haskell; anything with gui - c#; stuff that still doesn't quite fit anywhere - c/python; own experiments - ooc.

However, I have clear "hated" languages: perl, ruby and java.

</comment></comment><comment><USER8> These issues apply to my favorite language and also to the rest. Surely I'm cheating, but I don't believe it's against the spirit of the question.

I hate the fact that we have to program using plain text. A program is not really a sequential structure. I'm old, I do know the reasons that this anachronism has perpetuated. It's been a pain in the ass to deal with proprietary formats using not quite right tools. But in 2010? Seriously? How hard is to define a simple format that can be understood by simple editors?

Just an example: comments need to fit the syntax. So there's a need to delimite them, so some characters or characters combination are not allowed, or you need to use escape sequences, alternating delimiters or something. Think of code blocks that are commented out. I absolutely hate the time that I need to spend "formating" comments. It'd be trivial to create an editor that used certain special character (one that's < ASCII 32) to delimite comments, so we would not have to deal with this.

In general, the editor should be syntax-aware, in a more thorough sense (the editor would perform a first step of compilation), not in the patchy "syntax highlighting" way in which a quick and dirty scan of text is used. That would also speed compilation and "intellisense".

It would also eliminate syntax and the artificial differences among languages. Instead of curly braces vs, indentation vs. begin-end pairs vs. whatever, the program structure would be recognized by the editor and presented graphically.

The editor should only accept legal constructions (the rest would be considered comments or incomplete senteces) instead of the distracting red understrike of Eclipse.

In general, what I most hate is the fact that most languages use the very same constructs, while still are written differently and you need to learn the quirks of each of them. A while loop is the same in most languages. What's the point of learning stupid syntax for a dozen languages. I feel I'm working for the compiler. It should be the other way around.

I hate languages that do now allow me to do something, just because the language "designer" decided so. I feel the languages should be construction kits, not a set of rules to constrain what I can do with them. Why can't I have garbage collections in some languages and at the same time I can't have manual memory management in others? Why can't I have a language that accepts new constructs like Lisp, but not having to be Lisp with all its constraints?

So to summarize, I hate syntax. I hate a = b vs. a := b vs. b -> a vs. let a = b vs. ... Languages have become walled gardens, bigotry and us vs. them. Of course some tasks _are_ different. But I think there's no real reason not to have all the features in the same language and define "sections" of code that use certains "modes", except the competition.

<comment><USER5> I agree with many things... especially the editor complaint. I wanted to create a syntax-aware editor one day and it's considerably harder than creating a standard one. It's also almost useless in case of dynamic languages, since you cannot verify that much at the editing stage. But this seems just wrong:

> _I hate languages that do now allow me to do something, just because the > language "designer" decided so._

In many cases it's not about "designer decided so", but rather about tradeoffs. We cannot do X, because that would make Y considerably more difficult / fragile / slower. It also helps create some coding standards and common constructs. For example it's easier to read someone else's python code where the syntax is pretty much minimal and uses the same concepts over and over again (decorators are just functions in functions, decorators with parameters just call another wrapping function to get the decorator, etc.), rather than reading some haskell code, where someone decided to build own DSL which implements everything. Limits can be good.

<comment><USER8> But limits don't need to be in the language itself. It should be possible to define subsets.

Maybe it seems the same thing to be limited by the language or by a requirement imposed by the boss or the customer. But it's not quite the same. I've worked for companies with very strict code conventions and revisions, and I was happy with them.

It's not the individual freedom what I'm requesting. It's more like having the possibilty of exceptionally resorting to powerful features when it's seen as the best option with the consensus of the team.

IOW: the limits can be good, but I don't think a single person should decide for all the users.

</comment></comment></comment><comment><USER9> Didn't see anyone mention this little gem about Ruby:

a = [1,2,3]

x = :foo

puts x

a = a.map do |x|

      x+1

end

See anything wrong here? (hint: what is the value of x?)

<comment><USER10> Yes, thats surprising behavior. Fortunately its fixed in 1.9. :)

Spoiler alert:

.

.

.

1.8.x produces 3 while 1.9 produces :foo

<comment><USER11> Why was this broken in the first place? (What abomination of semantics would cause this behaviour)?

<comment><USER12> Closure variables not having their own scope and shadowing method level vars. They're simply implemented as method level vars, so not true closures.

<comment><USER11> I got that, but I don't understand why it should gain the value 3 before a single execution of the loop.

<comment><USER13> It's only at the end that the value of x is 3. The puts x immediately after x = :foo does print :foo

</comment></comment></comment></comment></comment></comment><comment><USER14> C#/.Net:

1) Collection classes.

2) Collection classes.

3) Collection classes.

4) Collection classes.

5) Collection classes.

<comment><USER15> I'm guessing I'm not the only one who wonders why all the Remove(index) methods are void instead of returning the removed element.

</comment></comment><comment><USER16> I'm just pleased to see that the complaints/rants against python are few, and without much import (at least for me).

<comment><USER17> One that I didn't see mentioned: why do I have to import a separate module and call a weirdly named function to get a stack trace? Why isn't it just a method on Exception? Not a major issue but it just feels wrong, along the same lines as __init__ and "if __name__=='__main__'".

<comment><USER5> At some level it makes sense probably... It's not a very common operation, so don't load it unless needed. It looks like an arbitrary choice, rather than good/bad design.</comment></comment></comment>