Small world with high risks: a study of security threats in the NPM ecosystem - <AUTHOR> https://blog.acolyer.org/2019/09/30/small-world-with-high-risks/ <comment><USER2> What the npm ecosystem really needs is something like the distinction between Ubuntu's "main" and "universe" repositories, so that you have a smaller subset of known-good packages with harmonized transitive dependencies, stronger centralized curation, a lot more direct scrutiny, tighter control over versioning, and some party that is responsible for addressing vulnerabilities and ensuring appropriate maintainership. If you could rely on that for core functionality and only needed to go outside of it for the long tail of more specialized things, it would be a lot cleaner and safer than what we do today.

Linux distros have many, many years of experience curating packages at scale. It is crazy to me that the node community just totally disregards all of the best practices learned by the Linux distros in favor of practices that are lazy and unambiguously dangerous.

<comment><USER3> Intel and Nokia were trying to add repository trust levels to rpm back in 2010/2011.

To this day, if you can add a new repository, it is fully trusted and can provide trojaned updates to any core package. Bump the version number to something higher than what the core distro would use and you can persist for quite a long time. I remember pointing this out at a Nokia project (would have been no later than early 2008) as an attack vector via apt repositories.

We wanted to prevent a rogue or compromised repository from being able to provide an update to, say, glibc or libstdc++. Never got to work on that - Elopcalypse took it all down.

<comment><USER4> > To this day, if you can add a new repository, it is fully trusted and can > provide trojaned updates to any core package.

Invent idiot-proof security and someone will invent a better idiot. Even if you have a "trusted=1" flag for repos, you can be sure people will set external repos to be just as trusted as the core ones without a second thought as soon as they stop them from doing what they want to do (whatever that is, or however in/sane it is).

It's maybe not the most elegant option, but for security-conscious sysadmins you could already today disable all repos ad hoc and run your "system wide update" only from certain whitelisted repos, while still allowing specific one-off package installs from third party repos.

By adding a third party repo you have already said you trust that repo to install software, probably as root, on your machine. It doesn't get much worse than that from a security standpoint anyway right, will "trust flags" really make much of a difference to the wider security issue?

Sorry if I'm making too many assumptions here or thinking out loud.

<comment><USER3> > _Even if you have a "trusted=1" flag for repos, you can be sure people will > set external repos to be just as trusted as the core ones_

That was the thing - you couldn't.

I don't remember which way the level hierarchy went, but the idea was that rpm could not be executed directly even by root (LSM prevented that), and all package installation logic was confined to Zypper/libzypp. Packages and repos could declare their security level. Trying to pull in an upgrade to a LEVEL(core) package from a LEVEL(media) repository would fail. Zypper simply would not allow to install a package from a lower-security repository over an installed package that had come from a higher-security origin. Manually added LEVEL(core) repos would have been ignored.

There were a few layers of applied crypto, package signatures and immutable keyrings involved too. I had a prototype Zypper/libzypp with package-level signature verification almost ready just before my vacation and planned to polish it to an RFC after coming back. Best laid plans... During those two weeks the entirety of Nokia's linux development had been axed, maemo killed and thousands of good embedded systems engineers were suddenly looking for new jobs.

Funny thing, though. Zypper's source code was almost pleasant to work with after having seen the Lovecraftian horrors that made up libapt.

</comment></comment></comment></comment><comment><USER5> Security has always been one of my biggest worries when using node. The mentality in the javascript world seems to be to simply not care.

To just use whatever libraries. On all the node.js projects I have worked on, none has had any security aspects when importing a new library. That is a bit scary since many libraries has a ton of dependencies themselves.

Not once have I even heard a discussion about a security topic or perhaps maybe vetting dependencies and similar stuff.

</comment><comment><USER6> or maybe just make a standard library (with a tool to pick only what's necessary for the web) - I think the worst thing is the incredible number of packages just replacing the node-native modules. One would suppose that in a "always-run-on-the-latest-version"-ecosystem one would try to integrate those into the mainline, but apparently some people really like a filled package.json...

Also if you look close, a lot of commonly required modules in the big projects are just used once in an act of "code"-spam by interested parties...

EDIT: just have a look at this: [https://github.com/eslint/eslint/commit/55bc35dcd2dc3987cc77...](https://github.com/eslint/eslint/commit/55bc35dcd2dc3987cc776ac1ba195c72e31d6311) \- let's use cross-spawn, if you could use this node-native function (available for about a 100 years...) [https://nodejs.org/api/child_process.html#child_process_chil...](https://nodejs.org/api/child_process.html#child_process_child_process_spawn_command_args_options)

</comment><comment><USER7> For basic JS functions, I much prefer to write my own than rely on someone else's. A low number of dependencies is a factor for me when choosing a package (if there are options).

Quite a few packages cover basic functions, such as type identification, array handling, etc... which have only a few lines of relevant JS code but are used by many other packages. That seems to unnecessarily increase the risk to my project of the module disappearing or becoming a security threat. There's something to be said for rolling your own helper functions.

</comment><comment><USER8> There is also work ongoing to isolate libraries at run time so they can't do anything see [https://www.infoq.com/presentations/npm-security-realms- ses/](https://www.infoq.com/presentations/npm-security-realms-ses/)

<comment><USER9> Unix based operating systems have pretty great file system security and almost everything is based on the file system, and you can use unix sockets for networking. So you can for example create a new user, give the user access to only the folders it needs. Then run the program as that user. You can also from within the app itself read configuration files, etc, then chroot, and setuid to continue as a non privileged user. Then you can use Apparmor or se_linux to fine tune access.

<comment><USER10> But you can't apply any of that to one particular library that a program uses, while not restricting the rest of the program.

<comment><USER9> Yeh, you could spawn new processes with different access levels, but it might add too much complexity to the app. It would be cool if we could require modules like this:

        foo = require("excitingModule", {fs: true, net: true, os: true});

It wouldn't be that hard to implement either.

<comment><USER11> The creator of Node is currently working on a runtime to enable exactly that: [https://deno.land](https://deno.land)

<comment><USER9>
        deno --allow-net https://deno.land/std/examples/echo_server.ts

This would be the same as running something with an unprivileged user:

        sudo -u otheruser node echo_server.js

Deno however takes it to a whole new level by running server code directly from the web =)

<comment><USER12> You can scope it further:

      deno --allow-net=0.0.0.0:8000 https://deno.land/std/examples/echo_server.ts

Or even provide a list of addresses:

      deno --allow-net=0.0.0.0:8000,localhost https://deno.land/std/examples/echo_server.ts

<comment><USER9> On Linux you can use namespaces

        ip netns exec networkname node script.js

Still only on the entire app though, the idea was how to restrict single modules and their dependencies, not your whole app! Something like:

        const foo = requires("bar", {fs: true, net: "0.0.0.0:8000", os: true});

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> I wonder if a system similar to the way Kosher certification might be applicable here. A company could continuously scan packages for threats and host the scanned packages which could be accessed via subscription.

<comment><USER14> Why should we trust a company over the community? And how accurate could be the scanning? What if something is missed or if there are a lot of false positives?

<comment><USER15> I do wonder how frequently and thoroughly the community is looking at the packages though. Perhaps I'm in the minority but I really only look when I'm debugging or trying to write a similar function myself to remove a dependency. But as a fairly novice and self-taught developer I'm not sure I'd recognize a security threat even if I was staring right at it.

<comment><USER13> That is exactly my point. Studying code for security exploits is hard and tedious work. If I were developing a Node.js app, I would be glad to pay someone to do that for me.

</comment></comment></comment></comment><comment> mike-cardwell This is why I wrote: [https://gitlab.com/mikecardwell/safernode](https://gitlab.com/mikecardwell/safernode)

<comment><USER6> why don't you use podman, bubblewrap or just straight namespaces?

<comment> mike-cardwell Because I'm familiar with Docker

</comment></comment></comment><comment><USER16> I wonder if it would be worth it for a set of large companies who depend on the npm ecosystem to get together and jointly fund security auditing for the top packages.

</comment><comment><USER14> "vetting the most dependent upon 1,500 packages would reduce the ITP ten fold, and vetting 4,000 packages would reduce it by a factor of 25"... I wonder how accurate could be this automated package vetting?

</comment><comment><USER17> NPM should use The Update Framework (TUF) [1] and in-toto [2] in order to protect its users from attacks against the registry itself. A notable list of adoptions include:

* Datadog is using both TUF and in-toto to defend against attacks between developers and end-users of its Agent integrations [3].

* Docker Content Trust is protecting users from a compromise of Docker Hub itself [4] using a version of TUF [5].

* Uptane is a version of TUF that is being standardized to protect software updates for automobiles [6].

* PyPI is considering adopting TUF to protect users of Python packages [7].

* Cloud Native Application Bundles is standardizing the use of TUF and in-toto to protect users of cloud-native applications [8].

Disclosure: I am a security engineer at Datadog, and am involved with both TUF and in-toto.

[1] [https://theupdateframework.com](https://theupdateframework.com)

[2] [https://in-toto.io](https://in-toto.io)

[3] [https://www.datadoghq.com/blog/engineering/secure- publicatio...](https://www.datadoghq.com/blog/engineering/secure-publication- of-datadog-agent-integrations-with-tuf-and-in-toto/)

[4] [https://success.docker.com/article/docker-hub-user- notificat...](https://success.docker.com/article/docker-hub-user-notification)

[5] [https://blog.docker.com/2015/08/content-trust- docker-1-8/](https://blog.docker.com/2015/08/content-trust-docker-1-8/)

[6] [https://uptane.github.io/](https://uptane.github.io/)

[7] [https://github.com/pypa/warehouse/issues/5247](https://github.com/pypa/warehouse/issues/5247)

[8] [https://github.com/deislabs/cnab- spec/blob/master/300-CNAB-s...](https://github.com/deislabs/cnab- spec/blob/master/300-CNAB-security.md)

</comment><comment><USER10> Who is ehsalazar? Is that actually a person publishing micro-packages, or what?

</comment><comment><USER18> How does this compare to package managers such as Maven (Java) or CPAN (Perl)?

What is the vetting process for other package managers?

</comment><comment><USER19> I thought this was written by certain company that is trying very hard on profiting creating FUD in the npm ecosystem. To my pleasant surprise it isn't and it's written by a new/different author. Scroll almost to the end and there it is, the author is a board observer in said company.

<comment><USER20> It's not FUD if the danger is real. In that case it's just everyone's responsibility to stay informed.</comment></comment>


The United States government seizes Facebook. What happens next? - <AUTHOR> https://motherboard.vice.com/amp/en_us/article/gym59j/facebook-nationalized-public-utility <comment><USER2> Late April fools joke??? This is crazy! Cant trust them with this platform and the data that comes with it.</comment>


For decades, Paul Bilzerian held off SEC efforts to collect $62M judgment - <AUTHOR> http://online.wsj.com/articles/for-decades-ex-corporate-raider-holds-off-sec-effort-to-collect-62-million-judgment-1410892550?mod=WSJ_hp_RightTopStories

<comment><AUTHOR> To get an idea of just how convoluted control of a single asset could get, here's a bit describing his Florida mansion.

"Mr. Bilzerian's wife, Ms. Steffen, made a deal in 2002, opposed by her husband, to spring him from jail. She agreed to have the partnership sell the mansion and split the proceeds with the receiver, plus turn over some securities and cash.

When the mansion sold in 2004, for $2.55 million, the buyer was another partnership. This one was controlled partly by the mother of a next-door neighbor. Mr. Bilzerian helped put together the deal.

Among the other partners was a corporation controlled by Mr. Bilzerian's wife's parents. Their involvement remained unknown to the SEC for at least two years.

The in-laws were majority partners, holding a 99% interest, at first through the corporation and then through a trust. Mr. Bilzerian's sons were named as trust beneficiaries.

In 2006, amid a dispute between the Bilzerians and the neighbor's mother, a state judge called the couple "at best…trespassers or squatters" and ordered them to leave the property. But they stayed after the partnership went into bankruptcy and the house was sold to a firm that was run by another Bilzerian acquaintance.

That firm made its purchase with financing help from a Bermuda charity, Puma Foundation Ltd., named for a Bilzerian family cat.

Just before the sale closed, a trust controlled by Mr. Bilzerian's mother-in- law acquired a majority interest in the purchasing firm. The firm paid his wife to manage the property. "</comment>


Twitter adds 'Proudly made in America by immigrants' to Periscope loading screen - <AUTHOR> http://venturebeat.com/2017/01/30/twitter-adds-proudly-made-in-america-by-immigrants-to-periscope-loading-screen/ <comment><USER2> A lot of people seem to be under the impressions that Trump has banned immigration.

<comment><AUTHOR> The lawyer that creates much of his immigration policy, Kris Kobach, has pushed to scale back immigration, specifically writing "have less of it".

</comment></comment><comment><USER3> Proudly made by high quality legal immigrants.

<comment><USER4> Iranian green card holders (I know a lot of Iranian software engineers, but it applies to all green card holders) and refugees _are_ high quality legal immigrants.

Sergey Brin was a refugee.

</comment></comment><comment><USER5> It makes me indescribably euphoric to imagine Twitler seeing this everytime he logs in.

<comment><USER6> It may well enrage him sufficiently to begin the process of nationalizing Twitter and Facebook, so as to snatch the megaphone from the SJWs who currently seek to control public discourse.

If they keep poking this bear, don't be surprised when it turns out that November 3rd, 2020 is just another day - no need to fuss about the Electoral College or the popular vote, won't need to worry about any of that.

</comment></comment><comment><USER7> Is it some kind of Easter egg? Like 15 years ago developers themself including various hidden text and graphics in software like Word 97, Excel 97, Word 2000, WinRAR, WinZIP, Nero, etc</comment>


Google bug bounties: $500-$3133.7 for security flaws in *.google.com - <AUTHOR> http://googleonlinesecurity.blogspot.com/2010/11/rewarding-web-application-security.html

<comment><AUTHOR> This is one of the better bounty programs; $500 for an XSRF is a good price, they have a large attack surface, they're OK'ing testing against production assets, you can publish your findings after they fix, and the people doing the judging work are top caliber.

Might I also add that if you're interested in doing this kind of thing, and getting _seriously_ good at it, we'd be happy to pay you to do that:

<http://news.ycombinator.com/item?id=1857212>

We're always hiring security researchers. I think it's one of the better gigs in information security: we work with a wide variety of interesting tech, from trading protocols to chipsets, and we have an sharp and diverse team.

(This appeal is gratuitous, but, hey, happy hiring-thread day).

<comment><USER2> This is an appealing program and makes it legitimate to get paid for vuln research. The other group that pays for vulnerabilities is the zero-day initiative. Here: <http://www.zerodayinitiative.com/>

That said, since we're kind of a free-market bunch of folks here, what do you think these vulnerabilities are worth on the black market? Just curious if the prices are competitive vs. selling to Russian black hats.

<comment><AUTHOR> Other companies will pay for bugs. Mozilla has a bug bounty too; a 12 year old kid just took $3000 for finding a stack overflow in document.write(). There are also other 3rd-party bug buying organizations; iDefense is one of them.

The prices are not competitive versus finding illicit markets for vulnerabilities (as I understand it, it's not that there's one "Russian mafia" that will pay you 3x what Mozilla will, but rather than exploits can be repackaged for multiple illicit buyers). Selling to Google or Mozilla doesn't require a reliable exploit, though.

These figures are also a pittance compared to what companies pay for professional assessment work.

</comment></comment></comment><comment><USER3> I wonder what is the rationale behind setting the bounty so (ridiculously) low?

If they want to attract the best crackers to pen-test their apps _and_ convince them to sell their findings to google instead of someone else, then why not declare "up to 1 million" for a serious vulnerability?

It's not like they couldn't afford that, nor that they would have to actually pay it out very often. Surely a mainstream headline "Google pays $1mio bounty to protect user security" is generally more welcome than "Russian phishing gang paid $1mio for the exploit that was used to steal from thousands of google users"?

<comment><AUTHOR> I am skeptical that any Russian phishing gang is paying 7 figures for XSS vulnerabilities on random Google properties.

I am equally skeptical that there has ever been a "million dollar" vulnerability sale; that's an order of magnitude higher than the most inflated claim I've heard for reliable remote code execution flaws on Windows.

Note that for $500,000 --- half your bounty --- Google could get any security team in the business to find horrible things in any of their platforms. $500k buys a meaningful project from anyone from Cryptography Research to iSec Partners to Mark Dowd or Dino Dai Zovi.

<comment><USER3> Well, as said, it's about the message and not like google would actually have to pay out such a high amount very often.

The question remains: If they care to set a bounty at all then why so low?

$3k feels more like a smack in the face than a reward. One can probably make more on google ads just by blogging about the incident...

<comment><AUTHOR> I think you're just throwing drama-spaghetti at the wall. It's not going to stick. While it's true that most pro vuln researchers aren't going to stop everything to go after $500 XSS vulnerabilities, I'd challenge you to find _one_ of them that thinks a $500 XSRF is a "slap in the face".

(I can only speak for myself, my friends, and my team members when I say that nobody I know thinks this).

A million dollars for a web app flaw is a wildly inappropriate number. I think you missed the part of my response where I said that half that amount gets you many, many weeks of Mark Dowd and Dino Dai Zovi. How much do you think Michal Zalewski and Neel Mehta make? I bet it's less than $500k. So: why would they be offering six figures for _individual flaws_ again?

The market for app security research is hopping, but it's not _that_ hopping.

<comment><USER3> _So: why would they be offering six figures for individual flaws again?_

And it seems you missed the part where I said that I'm naturally not expecting them to pay out six figures for just any minor flaw.

The idea is to convince anyone who finds an actionable flaw that it's more worthwhile to sell that to google, rather than thinking of more creative ways to turn it into money.

I believe this kind of crowd-sourcing would be more effective than any security team could possibly get. I'd venture the guess that the large majority of people who are pen-testing google properties every day is _not_ employed at some security firm.

<comment><AUTHOR> You're right. Criminals will not find $3000 attractive enough to turn over lucrative vulnerabilities to Google instead of exploiting them.

</comment></comment></comment></comment></comment></comment><comment><USER4> One of the advantages of this is that it gets you feedback, I've reported security flaws to a number of companies before (including Google) and one of the most frustrating things I've found is if the report just goes into a blackhole and you hear nothing back. Even if they fix it quietly, it's nice if a company gets back to you even just with a thank-you note.

<comment><USER5> I've found that if you are going to report a security flaw to a large company that doesn't have a security team that monitors security@ your best bet for a response is to find the email of an employee, the higher up the better, and email them directly. Rather than emailing a support@ address.

</comment></comment><comment><USER6> It's interesting that they include Blackhat SEO techniques on the list. I'm fairly certain that you could get more than $3133.7 for interesting vulnerabilities on the Blackhat side.

What is interesting is that the base value is higher than what I've seen for XSS vulnerabilities being traded in the past. It'd be interesting to see what effect this has on the vulnerability marketplace.

<comment><USER7> I think you're misreading the list -- black-hat SEO is on the list of vulnerabilities that are specifically not included.

<comment><USER6> Doh, you're right. It's late and I'm being daft. Thanks for that :)

</comment></comment></comment><comment><USER8> Hmm, I'm guessing that sidejacking attacks don't count. Orkut is vulnerable.

</comment><comment><USER9> How did they arrive at the figure 3313.7?

<comment><USER10> 3133.7 = eleet

<comment><USER11> Elite ain't that cheap. 0 day goes for 50K on the black market.

<comment><AUTHOR> That depends entirely on what the "0 day" is, and how it's packaged. Again: do you really think anyone's getting 5 figures for XSRFs in random Google properties? These are flaws that have instantaneously ZERO value once Google finds out they're being exploited --- unlike remote code execution flaws, which have a half-life.</comment></comment></comment></comment>


Simplicity and Michelson - <AUTHOR> http://homepages.inf.ed.ac.uk/wadler/simplicity-and-michelson.html <comment><USER2> Wadler's criticisms of jets are pretty common and not super hard to respond to.

Nothing at all stops any jet-based interpreter from using normal standards practices to specify a standard jet profile. We can even expect aggressive vendors to "embrace and extend" that profile.

But, in practice as well as theory, this isn't going to cause incompatibilities, monopolies, etc. Your semantic compatibility is perfect.

In fact, jet competition should have excellent effects on performance across a healthy market. If Google hosts a jet-propelled interpreter, it's natural for it to both offer a tensor processing library, and hook that library up to a jet that talks to a hardware TPU. Your code will work the same if you move off Google -- you're not physically locked in.

What we just got rid of: the bureaucratic overhead of standardizing a TPU opcode. Look at all the crypto algorithms you have to run in JS on the browser, when half the time there's a hardware instruction on the chip. It's technically trivial to connect these two things -- but not politically. Politically, you need a committee to standardize the builtin.

It's true that performance disparities are absurd if you don't jet-propel basic arithmetic. But no one would do that. If a system works both in theory and in practice, it works. You can't really say that in theory, it doesn't work in practice.

(Disclaimer: jet inventor here. But Simplicity's jets are much more badass because of the Coq equivalency proofs.)

</comment><comment><USER3> I believe this ([https://github.com/input-output-hk/plutus- prototype/blob/mas...](https://github.com/input-output-hk/plutus- prototype/blob/master/docs/spec/Formal%20Specification%20of%20the%20Plutus%20Language%20-%20McAdams.pdf)) is the smart contract scripting language he's working on. Far from an expert on formal methods and language design, but, it does seem to be more fleshed out than the public information on Simplicity.

</comment><comment><USER4> who coined the inl, inr terms .. I see them often in denotational semantics but never found the origin of it.</comment>


Teh Intarwebulatorz Aren't For Real Developerz. Srsly. - <AUTHOR> http://fourthprotocol.wordpress.com/2011/11/11/teh-intarwebulatorz-aren%e2%80%99t-for-real-developerz-srsly/

<comment><USER2> A much more balanced approach to the issue, well done. I would have liked to see a little more discussion about the web vs. not-web topic as I don't think it quite hits the point that "web is just a UI" as hard as it could.

But it at least gets the discussion going. "Atwood's law" is almost a straw man. Just because the UI is written in javascript doesn't mean the entire stack is going to be.</comment>


Arduino-based backyard aquaponics (2013) [video] - <AUTHOR> https://www.youtube.com/watch?v=X2wWTadsBDA <comment><USER3> I have performed aquaponics experiments in my own apartment, parts of which were automated. The first thing I would say here is that anything like the setup you see in this video is a mammoth amount of work and is impressive from the sheer amount of investment done.

My experience with aquaponics was just that. High cost, where cost is time, worry and cash. The idea is that the costs are fixed, but that's never quite right. Creeping costs include tools needed, fixtures to make small changes, replacement parts, redundancy, pest management and surprises like HVAC.

After doing aquaponics for close to two years I moved on. It is expensive to do if you don't already live in a tropical area and can't work at scale. Even if there weren't planting, maintance, months to years of time to appropriately cycle and balance an ecosystem, labor to move and replace water, catch and feed fish and plant, replace bulbs, check water conditions, remove sick fish, etc, etc - the labor to merely deal with removing plants was startling.

I learned a ton and had even more fun - but boy are there decades of progress to be made on homestead style scale AP.

</comment><comment><USER4> This project is a great example of harnessing one of the most powerful techniques for bringing down costs: multiplexing.

His idea is to build intelligent, networked, automated, mobile machines for the production of food. His goal is to be able to gain cheap access to land by striking deals with vacant lot owners that have costs associated with weed control/landscaping.

Thats the same kind of multiplexing that has let airbnb harness so much value in the form of unused real estate space.

I've been able to harness a lot of value through multiplexing as well. I rented a beach house for 8 months for the off season, and the owners are happy to have a responsible tenant that protects their house from the cold and would be there in case a pipe breaks. A pipe break while the owners were away destroyed the house next door.

By taking advantage of multiplexing I was able to have an entire waterfront house for less than the cost of just the property taxes on the home.

</comment><comment><USER5> I'd love to have a good book or instruction manuals on how to do this stuff - I'd jump on it right away, although I already have a pretty decent garden, producing food for a family of 4 every year - salads and radishes galore at the moment, lots of great stuff (20 types of vegetables and fruits) on its way. Gardening is a lot of work - its true - but its also very rewarding work, and one thing I've noticed over the years is that the more you do it, the less you have to do. We have a full cycle going - kitchen scraps to the compost, new healthy soil from the compost into our beds, seedlings (heritage at this point) started at the start of season, beds in process and daily maintained, and so on.

But the point is: the more work you do, the less you end up having to do .. and this is where it pays to work smarter, not harder. So I really think this is a growth industry (pun!) for the near future: having the computer keep an eye on things, providing data and feedback, and eventually control over the key inputs into this complex system.

Anyone know where this gentleman in the video is getting his knowledge? I'd love to have some references to start getting our garden automated.

<comment><USER6> Here are some google queries that will keep you reading for literally weeks on end:

      * 'diy hydrophonics'
      * 'arduino garden automation'
      * 'computerized garden controller'
      * 'build aquaphonics system'

I live in the Netherlands and around my corner is a growshop - <USER2> selling all sorts of technology for growing plants indoors, with the main intended audience being marihuana growers. The demo setup they have, contains chili peppers though, for legal reasons. Anyway, their book sales section has 3-4 meters of books on the subject (not marihuana specifically, just all sorts of automated/high-yield/indoor plant growing). Spending, say, 100$ on books from this result page [http://www.abebooks.com/servlet/SearchResults?kn=hydrophonic...](http://www.abebooks.com/servlet/SearchResults?kn=hydrophonics&sts=t) will get you 50 cms of reading, yourself (I see there's even a book called 'Chemical Gardening for the Amateur' from _1939_ on there - I'm tempted to buy that one myself...)

<comment><USER7> "hydrophonics"? "aquaphonics"? might you not want "-ponics"? as opposed to something associated with sound? [shrug]

i was curious what the distinction was between hydroponics and aquaponics and here's what one source had to say on the matter: "Aquaponic and hydroponic systems both use water and share a few common parts, but that's where the similarities end. Hydroponic systems focus solely on plant growth, while aquaponic systems attempt to achieve a healthy life balance between both plants and fish." [http://homeguides.sfgate.com/aquaponic-vs- hydroponic-31311.h...](http://homeguides.sfgate.com/aquaponic-vs- hydroponic-31311.html)

<comment><USER6> ""hydrophonics"? "aquaphonics"? might you not want "-ponics"? as opposed to something associated with sound? [shrug]"

Yes, that was a brain fart :)

</comment></comment></comment></comment><comment><AUTHOR> In looking over this person's (Kirsten Dirksen) YouTube channel, it appears she has produced a large inventory of videos of interesting projects.

<comment><USER8> Yep, I just subscribed to her not too long ago. Mostly, it seems to focus on alternative and minimal housing solutions. It's wonderfully refreshing to see the unusual and simple ways in which people decide to live, in a world so often focused on financial success and extravagance.

</comment></comment><comment><USER9> there needs to be a wiki with a design for indoor systems in the living room areas that are aesthetically pleasing as a first principle, in addition to producing plants / fish for eating.

If good looking fish tank(s) and a facade for the other equipment are designed, this allows the living room to be very green and people can start individualizing it.

This will encourage a whole bunch of apartment dwellers to try it out.

Also, the custom towers need to be designed such that they can be fabricated by easily available 3d printers and stackable.</comment>


Ask.fm advertisers to quit site in cyber bullying row - k-mcgrady http://www.bbc.co.uk/news/uk-23612544

<comment><AUTHOR> This whole debate centers on the fact that the website is at fault, and that is something everyone has pretty much already decided. The father of the victim has claimed the owners of ask.fm should be charged with murder, which is just ridiculous.

Any website which promotes, glorifies, or encourages bullying should be punished (definitely not with a charge of murder), but it would be fair game for a boycott or loss of advertising revenue. Ask.fm does in fairness provide a fairly easy platform for people to bully you, since it is all anonymous, but then so does any other social media site. The website has a duty to do as much as they can to stop abuse, but then so do the users themselves. No one is forcing you to have an ask.fm profile, or indeed engage with it.

If we look to Lawrence Lessig's four modalities of regulation, up until this point, ask.fm has relied on the social norm of users not making hurtful comments to other users. Advertisers pulling out is a form of regulation by the market, but it will hurt the site, not the offending users, and I believe the site does as much as it can to stop bullying. Removing some of their revenue won't stop the problem unless they shut the whole site down because they run out of money.

<comment> k-mcgrady I completely agree with you. but while I do find it strange that people being bullied on it don't just delete their accounts the people involved are usually young teenagers not thinking as rationally. Cyber bullying seems to becoming more of a problem. Logically it seems that it's easier to stop than regular bullying (if you're being attacked online delete the account/stop using the service/report the users) but the reality for younger people is clearly more complex.</comment></comment>


XKCD has an undocumented feature - <AUTHOR>

This URL http://xkcd.com/test/ directs you to the "Undocumented Feature" strip <comment><USER2> Just submit a link and let us work it out.

<comment><AUTHOR> I felt that it might be too easy to miss. I'll repost it.

<comment><USER3> Still missed it. What's going on here?

</comment></comment></comment><comment><USER4> Am I missing something?

<comment><AUTHOR> The URL is xkcd.com/test, this is an undocumented URL. The original strip URL is xkcd.com/1305.

From digging in the js I think that this has something to do with ab-testing for xkcd store.</comment></comment>


Surface Book review: The hybrid that really does replace your laptop - <AUTHOR> http://arstechnica.com/gadgets/2015/10/surface-book-review-the-laptop-that-replaces-your-tablet/ <comment><USER2> If I'm already in the market for a MacBook Pro with retina, is this comparatively cheap or expensive?</comment>


Show HN: Infstream – We're trying to fix video monetization for creators - <AUTHOR> TL;DR: https://infstream.com/?code=HN
Hi HN – we're Ben & Callum from Infstream. We've always been heavy users of YouTube, for entertainment, education and sharing. Towards the end of last year, we saw more and more horror stories of YouTubers losing their livelihood to the ad algorithm.
We decided to build a content-first video platform, which aims to reduce issues by removing advertisers from the equation. Instead, we charge for the content you watch – bold, I know.
Instead of paying in advertising and data, users on Infstream build their own streaming package, a channel at a time. Anyone can start a channel (US & UK now, Europe soon) and earn directly from their subscribers.
Subscribers pay $1 per month per channel, of which the channel receives $0.75. This all begins from the first subscriber, there are no minimums to start monetization.
Channels have total control, and can publish on a daily, weekly or monthly schedule – whatever is working for them and their subscribers. They're free to keep publishing on other sites (we recommend it), and can promote exclusive content to their existing audience, quickly growing an ad-independent revenue stream.
We're getting ready to launch, and are inviting creators to sign up beforehand to get their channel ready. If you or a connection has had issues with publishing on YouTube we'd love to hear from you, and learn some more about the pain points.
The platform is stocked with demo content, it would be great to get some feedback.
https://infstream.com/?code=HN
This was also my first production project using Hasura (super positive), so can share my experience if you're considering trying it.
Stack:
- Hasura (GraphQL)
- Lambda + S3
- Mux
- Cube.js
- Stripe Connect / Atlas
- Vue 2
Callum and I will be hanging out in the comments to answer any questions. Feel free to drop me an email at firstname.lastname@example.com if you've got questions or want to chat. <comment><USER2> Hi - Callum here. Feel free to drop me an email at email@example.com if you have any questions or would like to discuss anything further.

</comment><comment><USER3> How do I discover content without paying? If I have to subscribe to watch then it seems I won't be spending time browsing around watching content like YouTube. Can the creator choose to publish free videos?

IMO YouTube has massive audience and watch time because it's free to watch.

<comment><AUTHOR> Hi Alex! Channels can set a full-length public intro video, displayed on their homepage. Each video also has the option of a free preview at the beginning, or can be made completely public.

We're not seeing this as a replacement (yet!), just another option for content creators to monetize. Some sell merch, but that requires dealing with physical products and areas they're not familiar. Infstream allows them to easily charge for behind-the-scenes/directors cut/mini series.

We're not expecting users to browse in the same way as YouTube initially, rather come to a specific channel directly from that creators social media.</comment></comment>


Mac and Cheese Maze Mystery Resolved - <AUTHOR> http://krazydad.com/blog/2014/07/18/about-that-mac-cheese-maze/

<comment><USER2> They're surprisingly forgiving. If someone stole my IP and then utilised it in a commercial product I might not be so forgiving.

That being said, it is a very happy outcome, $4K to food banks and the author seems happy. Plus I'm sure Kraft's design company can write off the charitable donation anyway.

<comment><USER3> >If someone stole my IP

They didn't steal anything. They only infringed on the exclusive right granted under copyright law.

Actually stealing IP is near impossible to do.

<comment><USER4> But, was there an exclusive right granted? Copyright comes from creating something, and not just the output of some computer program.

</comment></comment></comment><comment><USER5> I wonder how enforceable that indemnity is. It seems to me that Kraft wouldn't be able to protect their big pockets by passing off liability to a company with relatively little in the way of assets.

<comment><USER6> Indemnification clauses have been enforceable in contract law for a very long time. (And contract law never takes one's assets into account when determining whether a clause is enforceable, unless the agreement is deemed unconscionable or contrary to public policy, which to my knowledge an indemnification clause never has been.)

The clause in the contract doesn't mean that Kraft is immune to suit. But it does give Kraft the ability to file a cross-claim against the design firm if it is sued so that damages can be assigned to the design firm if necessary. See Fed. R. Civ. Proc. 13(g).

</comment></comment><comment><USER7> Good form, sir!</comment>


Why OSNews is no Longer OSNews - <AUTHOR> http://www.osnews.com/story/23301/Why_OSNews_Is_No_Longer_OSNews Interesting article about how the desktop OS market has settled itself out over the past decade, and the interesting things are now all happening in the mobile space. <comment><USER2> When your brand no longer represents what you are doing then maybe you should change the brand. Luckily, http redirects exist.

</comment><comment><USER3> more OS going into end-users hands than ever before, what is he smoking?

Android, iPhoneOS, Maemo/Meego, Ubuntu, WebOS

itd be nice to have a single source for important developments in each of the above. i might even cal the site OSNews. are they relinquishing the domain?</comment>


Investment in Spanish startups to surpass $500M in 2015 for the first time - <AUTHOR> http://novobrief.com/spanish-startups-funding-q1q3-2015/ <comment><USER2> This just scratches the surface of what could really be. Spain still is in general a hostile country for entrepreneurs with an anti-innovation government famous for awful decisions like:

\- Regulating heavily crowdfunding rendering it unusable

\- Eliminating stock options' fiscal incentives [0]

\- Taxing the sun in order to protect energy lobbies from solar energy. [1]

\- Trying to get a cut from Google News because _they 're worth it_, pass a law for it, and then trying to retract in only few weeks once they saw the page views metrics go south...

etc..

Hopefully things will get better once the current ruling party leaves the government in the upcoming December elections. _Hopefully..._

[0] [http://novobrief.com/stock-options-in-spain- startups/](http://novobrief.com/stock-options-in-spain-startups/)

[1] [http://www.forbes.com/sites/kellyphillipserb/2013/08/19/out-...](http://www.forbes.com/sites/kellyphillipserb/2013/08/19/out- of-ideas-and-in-debt-spain-sets-sights-on-taxing-the-sun/)

<comment><USER3> Also I think the autonomo fee is pretty crippling to entrepreneurs starting out, essentially you have to pay around 250 euros every month regardless of your income if you want to be freelance. It is so short sighted and means many people from different fields choose to conduct their business on the black market.

</comment></comment><comment><USER4> It's very anecdotal but at Spreedly (my company) we are integrated to around 90 different payment gateways globally and are payments infrastructure. So we have a lot of startup interest. In Europe Spain is second only to the UK in terms of prospects and customers. Sadly I've been told this is may partially because youth unemployment is so high that you might as well start something vs wait around. But either way a headline like this doesn't surprise me as we've clearly seen a large amount of entrepreneurial activity out of Spain.

<comment><USER5> _...youth unemployment is so high that you might as well start something vs wait around_

Not only youth. And there's the figure of the fake _autónomo_ : companies force their employees to act as a provider to save taxes and regulations, threatening with firing them.

The worst cases are those in which the company first do this, then "fire" them anyway, avoiding the severance pay and letting the fired without unemployment rights.

</comment></comment><comment><AUTHOR> For those interested, here's another article with average salary for engineering jobs in Barcelona: [http://novobrief.com/tech-developer-jobs- salaries-barcelona/](http://novobrief.com/tech-developer-jobs-salaries- barcelona/)

<comment><USER6> I might need to change my title from Software Engineer to Back End Developer.

</comment></comment><comment><USER3> I think the startup scene is growing quite rapidly here (Barcelona) however from my perspective it seems that a lot of founders are from abroad and it saddens me a little as there is a great wealth of talented people here that could be founders or technical founders they just don't seem to realise it!

<comment><USER7> Many of us just left, when we saw the difference in salaries between Spain and the alternatives, and the difficulty of marketing products for Spaniards: For instance, I'd not touch the B2B business in Spain, given the way people choose vendors.

In my case, I realized that US salaries were on a different level, for a very similar cost of living when outside of NY and the Bay area, and left. Every time I go back home, people try to recruit me, and then quickly give up when I mention what I make, salary, in the American Midwest.

But still, when I was still back in Spain, it seemed to me that the labor market was set up in such a way as to reward founders, and not so much their engineers. It's just that many of the successes I know started by having B2B customers before a single line of code was written. Very different from the idea of companies with venture capital that try to take off before running out of runway that you see in the US.

<comment><USER8> I am in the same situation as you but what keeps me from going back to Barcelona are not the salaries, but the kind of uninteresting jobs that are offered.

I would go back home for the quality of life, not for the salary. But only if I could join a company that is actually creating something, instead of just using products created by others.

<comment><USER9> Have you taken a look at www.jobsbcn.com ? More than 250 startups are "creating something" right now in Barcelona.

<comment><USER8> I didn't know about this site. Thanks! Definitively, is a really good place to research about interesting startups.

King are hiring like crazy! I am curious to know how good must be working with them.

</comment></comment></comment></comment></comment><comment><USER10> Can anybody comment on the impact the abysmal economy over there has had on the startup scene?

My hypothesis is that the absolute lack of jobs for young people would lead to more startups as necessity is the mother of invention, but it could be that the more immediate day-to-day of putting food on the table might distract from that.

<comment><AUTHOR> It's an interesting question, and one that has not been quantified yet. However, here are a couple of thougts:

\- I think there's no doubt that the financial crisis and lack of jobs has led many to start their own companies (tech or not).

\- Simply starting a business in Spain is not as hard as many portray it to be (it's definitely _harder_ than in the UK, for example), but taxes, lack of stock option plans (most companies here use what's often referred to as phantom options) and, in general a not-entrepreneur-friendly mindset from many in society, can make it hard to grow and scale. That said, many relatively successful startups like CartoDB, Typeform or even peerTransfer and Alienvault follow the m.o. of building engineering teams here and move marketing and sales to the US.

\- Spain's current government has passed several pro-entrepreneur laws that, in essence, are just PR moves. Except, maybe, the launch of a new and simple entrepreneur visa. [0]

\- This significant increase in VC financing has yet to reflect the more than €1.5 billion of public money that's being poured into VCs and private equity firms to invest locally, trying to mimic Israel Yozma's. [1]

\- Barcelona has many interesting public and private initiatives going, and the city's good image all around the world benefits it when it comes to recruiting foreign talent. [2]

\- It's not all fine and dandy, and there're definitely some hard challenges for the country and startups to tackle over the next few years.

\- Hopefully (what looks like) success stories such as Scytl, will spark the next generation of tech companies in Spain. [4]

0: [http://tech.eu/news/spain-fondico-fond-ico-spanish- vc/](http://tech.eu/news/spain-fondico-fond-ico-spanish-vc/)

1: [http://tech.eu/features/5155/rules-entrepreneur-visa- spain/](http://tech.eu/features/5155/rules-entrepreneur-visa-spain/)

2: [http://novobrief.com/barcelona-madrid-startup- ecosystem/](http://novobrief.com/barcelona-madrid-startup-ecosystem/)

3: [http://tech.eu/features/6139/9-spanish-entrepreneur- challeng...](http://tech.eu/features/6139/9-spanish-entrepreneur-challenges/)

4: [http://novobrief.com/scytl-pere-valles- interview/](http://novobrief.com/scytl-pere-valles-interview/)

<comment><USER10> Thanks for the thoughtful response and citations.

When you mention moving "marketing and sales to the US" is that simply so they can better target the US market? I imagine there is simply a larger opportunity in targeting the US, and in this day and age, there's no reason you need to start a locally-targeted business if your economy is in the crapper when there are other nations with much healthier economies.

Also, can you elaborate a bit further on the "not-entrepreneur-friendly mindset" you referenced?

<comment><AUTHOR> Yup, mostly so they can target a bigger market and be closer to large clients. This does not apply to every company, but for SaaS and software companies, I think it is often the case.

I think running a business in Spain, what we call here being an 'empresario', can have some small-but-negative connotations for part of the population, who see the rich as a mere consequence of corruption forces instead of the financial result of providing value to customers. It's not like we haven't had our fair share of large cases of corruption over the last few yours, though.

I think this is also the case in other European countries.</comment></comment></comment></comment>


I created an interactive budget planner - <AUTHOR> https://moneydo-budget-planner.netlify.com/ <comment><AUTHOR> I would appreciate your feedback if those calculations are somehow helpful</comment>


John Hennessy named chairman of Alphabet/Google - <AUTHOR> https://www.spectrum.ieee.org/view-from-the-valley/at-work/tech-careers/from-stanford-university-president-to-chairman-of-alphabetgoogle <comment><USER2> This guy is one of my heroes, I could not be happier. Go him. The H&P book on computer architecture is a book that changed my life. He is like Knuth except that I understand what he says. The Knuth stuff, I get it, it's profound, but I never got it. It was too hard. H&P, they laid it out in ways that I could understand. I'm not stupid but I'm not that smart, I really loved that book, it was written in a way that not so smart people get it.

If there was a way I could say "go you", yeah, I want to do that. He's a great guy, has done great work, go him.

And all that said, I bet this is not a "go him" job, I bet he makes a difference, maybe a huge one, maybe not so huge, but I bet he makes a difference. Let's come back in 5 years, I bet he will have made stuff better.

<comment><USER3> I too loved "Computer Architecture: A Quantitative Approach", and read it all the way through before the semester even started.

Each chapter had a pithy quote at the start, and my favorite was the excerpt from the EDSAC instruction set:

Z -- Halt and Ring Bell: Stop the machine and ring the warning bell

<comment><USER4> Can you recommend a book that would serve as a useful prerequisite to CA: AQA? Based on your recommendation, I flipped through the first few pages on Amazon, but it felt a lot like Algebra 2 without knowing Algebra 1.

<comment><USER5> At my university CA: AQA was used as the text for the second course in computer architecture. The first course in computer architecture used this book: [https://www.amazon.com/Computer-Organization-Design- Fourth-A...](https://www.amazon.com/Computer-Organization-Design-Fourth- Architecture/dp/0123747503/ref=pd_lpo_sbs_14_t_2?_encoding=UTF8&psc=1&refRID=E214BA3CMPK44D3AAGXQ).

If you do get around to reading CA: AQA, you can follow along with this Coursera course (it's taught by the professor I had when I took it at Princeton, and he does a great job teaching it): [https://www.coursera.org/learn/comparch](https://www.coursera.org/learn/comparch)

<comment><USER4> I don't have enough patience for courses. I sort of scan the material for what I really need or want to learn and ignore what's not interesting to me. I can make consistent A's with the benefit of Adderall, but I don't feel comfortable with that.

Your recommendation was very useful and interesting to me, and I bought the paperback. I was surprised that it was cheaper to buy a used paperback than to rent it via Kindle for a month.

</comment></comment></comment></comment></comment><comment><USER6> Hennessy was an incredible steward at Stanford, and I'm 100% sure that he will be a difference maker at Alphabet. I don't see him taking the position if he didn't have an incredible vision for the future that he could drive.

The intro to this video talks a bit about his accomplishments as president.

[https://www.youtube.com/watch?v=ApTQ1bfKXyY](https://www.youtube.com/watch?v=ApTQ1bfKXyY)

This video is probably more in line with the interests of the community here (Stanford Seminar - Entrepreneurial Thought Leaders: John Hennessy of Stanford University):

[https://www.youtube.com/watch?v=tB3oAg0wuYg](https://www.youtube.com/watch?v=tB3oAg0wuYg)

I was in the audience when he announced the launching of the Knight-Hennessey scholarship. It was an incredible speech. He was always an incredible fundraiser, but putting together a $750M fully endowed scholarship program is a heck of a way to say goodbye to the university.

<comment><USER7> > I don't see him taking the position if he didn't have an incredible vision > for the future that he could drive.

How much influence does a chairman really have on the the vision though? Isn't that more of the CEO's business?

I suppose the board picks the CEO, but that spot doesn't appear to be changing anytime soon.

<comment><USER8> "How much influence does a chairman really have on the the vision though? Isn't that more of the CEO's business?"

In an ideal situation the chairman can function as the intellectual sparring partner of the CEO. Not many can do that, as some things cannot be discussed outside of the company personnel, and going downwards in the chain of command always has this gradient of authority which can function as an intellectual inhibitor.

<comment><USER9> The Chair also acts in the last resort to sack the CEO if the company is going off the rails - soothing which the Chair at HP should have done a few years ago.

</comment></comment></comment></comment><comment><USER10> His CV page [1] is clean and quite up-to-date. Not sure if he handles the edit himself or not, but I find the page's design clean compared to a lot of the professors' out there. I just think it's interesting to mention here.

[1]: [https://web.stanford.edu/~hennessy/cv.html](https://web.stanford.edu/~hennessy/cv.html)

<comment><USER11>
        <html xmlns:v="urn:schemas-microsoft-com:vml"
        xmlns:o="urn:schemas-microsoft-com:office:office"
        xmlns:w="urn:schemas-microsoft-com:office:word"
        xmlns:m="http://schemas.microsoft.com/office/2004/12/omml"
        xmlns:mv="http://macVmlSchemaUri" xmlns="http://www.w3.org/TR/REC-html40">

        <head>
        <meta name=Title content=cv.html>
        <meta name=Keywords content="">
        <meta http-equiv=Content-Type content="text/html; charset=unicode">
        <meta name=ProgId content=Word.Document>
        <meta name=Generator content="Microsoft Word 14">
        <meta name=Originator content="Microsoft Word 14">
        <link rel=File-List href="cv_files/filelist.xml">
        <link rel=Edit-Time-Data href="cv_files/editdata.mso">
        <!--[if !mso]>
        ...

<comment><USER12> I wonder if Google is going to offer incentives for him to switch to Google docs, like free 100mb quota upgrade on his Google account

<comment><USER13> Whoa, pump the brakes there. Nooglers need to earn that upgrade.

</comment></comment></comment></comment><comment><USER14> So now both H & P working at Google? (Though I don't know enough about corporate board stuff to tell if chairman is "working for")

<comment><USER15> Pretty crazy! Hopefully they get Patterson to work on some novel computer architectures. TPUs are very cool but they are not for consumers.

<comment><USER16> I know what you mean, but e.g. every time the Google Assistant talks to you, the consumer, you're using TPUs.

[https://deepmind.com/blog/wavenet-launches-google- assistant/](https://deepmind.com/blog/wavenet-launches-google-assistant/)

</comment></comment></comment><comment><USER17> Weird.. In a time when people are extra tuned to the relationship between technology and society and whether just because we can build something, should we (information bubbles, etc), it's strange that Alphabet would pick someone so out of touch with their impact to the long tail of humanity.

At least that's the impression I got of Hennessey from Malcolm Gladwell's podcast [http://revisionisthistory.com/episodes/06-my-little- hundred-...](http://revisionisthistory.com/episodes/06-my-little-hundred- million)

</comment><comment><USER18> I'm glad he got his books updated with the RISC-V editions before this

<comment><USER19> Haha, while I'm happy for him and excited for what this means for Alphabet, I had the same thought. Something tells me this guy would be able to juggle a new edition nonetheless

</comment></comment><comment><USER20> >>RISC pioneer John Hennessy's side hustle gets serious

I couldn't help but get a chuckle out of the subtitle.

One day I hope my side hustles involve helping to run an $800B company.

</comment><comment><USER21> I have no issues with John Hennessy, but I'm surprised they didn't give the chairman position to Larry Page, who's CEO and a Co-Founder. I wonder what's preventing him from taking over full control...

<comment><USER22> Paige and Brin have enough voting power to pretty much make any major decision.

<comment><USER23> How much power exactly? Or do they own some special shares that don't need majority to rule?

<comment><USER24> Together they control over 50% of the voting power. They both own substantial amounts of Class B shares, which aren't available to the public and carry 10 votes per share.

</comment></comment></comment></comment><comment><USER25> What's going on with Schmidt? Was this planned?

<comment><USER26> Most likely he was cast aside so Google can cozy up better with the Trump administration. Schmidt was close with the Clinton campaign, which Trump himself noted when they met:

[http://www.siliconbeat.com/2017/12/22/time-right-eric- schmid...](http://www.siliconbeat.com/2017/12/22/time-right-eric-schmidt- leave-alphabet-chairman/)

<comment><USER27> I think this conceptually holds as much water as a colander.

Schmidt has been on his way out for a couple years - it appeared to have been part of a planned transition.

<comment><USER28> For some context, this article in the New York Times presents essentially the same theories/discussion: [https://nytimes.com/2017/12/21/technology/eric- schmidt-googl...](https://nytimes.com/2017/12/21/technology/eric-schmidt- google-alphabet.html)

</comment></comment></comment></comment><comment><USER29> Does this mean good things for RISC-V?

<comment><USER30> Nope. That's Patterson.

<comment><USER15> Yep. And as someone engaged in the RISC-V community, I've seen zero evidence of Google involvement outside of Patterson. Normally if they had something brewing, you would start to see signs on the forums, email, or Github.

</comment></comment></comment><comment><USER31> Amazing and Awesome. Congrats.

</comment><comment><USER32> Great choice.

</comment><comment><USER33> Is this a conflict of interest?

</comment><comment><USER34> Correct me if I'm wrong but didnt Hennessy, while President of Stanford, agree to give away university-owned page rank IP to Google for $1mm (a company he was conveniently personally invested in) thereby lining himself up for massive personal gains at the expense of the University?

<comment><USER35> It was reported that Standford made more than $300M off their shares and they get yearly royalties. I think they did ok on that deal.

[https://www.mercurynews.com/2010/12/21/stanfords-ideas- gener...](https://www.mercurynews.com/2010/12/21/stanfords-ideas- generate-65-1-million-in-revenues/)

<comment><USER36> That makes it "only" the second most profitable Stanford patent ever. If they had only waited a little longer before cashing out...

<comment><USER37> Create more value than you capture.

</comment></comment></comment></comment><comment><USER38> Is he not the author of the famous book - Computer Architecture : A Quantitative Approach by Hennessy Patterson?

<comment><USER39> Indeed the same.

</comment></comment><comment><USER40> victory of the meritocracy! if only this principle was applied to politics (no flags please)</comment>


Keep Your Day Job but Everyone Needs a Side Project - <AUTHOR> https://www.entrepreneur.com/article/315209 <comment><USER2> No, they don't. For some people, that time is better spent on their "main project" \-- family, relationships, etc. Your entire life shouldn't be slavishly devoted to work.</comment>


Password Hashing in the Browser - <AUTHOR> https://shkspr.mobi/blog/2016/11/password-hashing-in-the-browser/ <comment><USER2> This is one of those ideas that a lot of inexperienced developers come up with at some point. I did it myself ten year ago (with SHA-256) for a simple home- brew website, and recently a colleague of mine brought it up. Sometimes the argument represents a holdover from pre-HTTPS times, and sometimes the reasoning is something along the lines that the user's password should be private.

If you are developing (now, in 2016) a public HTTP API that allows logging in with a password, then you can simply discard the notion of not having a secured channel between the browser and the server. Of course you are using HTTPS, and of course you are securing your API in such a way that plain HTTP requests will fail.

The second argument appears valid to some extent at first glance. Users tend to reuse passwords, despite being advised not to do so. But if you are the developer of the API, then why should you go out of your way to make sure the password never reaches your server at all? That is, you can (usually, if you have the necessary access clearance) already access all the data protected by that password! Furthermore, not seeing the password when it is being set by the user means a malicious/misguided user can simply work around your client- side minimum requirement checks, and send you a hash for '12345' (or do you want to maintain a database of all possible hashed representations of passwords containing less than the minimum required character count?).

As a developer you hash passwords, and never store the plaintext password anyway. Check that it is not getting logged anywhere (so always HTTP POST passwords, never GET). You provide only HTTPS (assuming this is a public API).

If you need more security, use two-factor authentication.

As a user you should assume that a password is a shared secret between you and the service you secure with it. Assume that the service could store it plaintext, and that malicious employees of that service could try to gain access to any other service you use. In short, use a password manager and do not reuse passwords for anything you care about.</comment>


Novel Optimization Technique - <AUTHOR> http://swapped.tumblr.com/post/39656947625/novel-optimization-technique

<comment><USER2> Seeing the actual x86 or x64 code here would be insightful. It's hard to guess (though not impossible, I suppose) why this might be happening given just the code, but seeing the emitted assembly would clearly show what improves. It's possible that adding that assignment changes the register allocation/stack spill just enough to be slightly more optimal.

Is there any code before or after that has been omitted that might be contributing to the 5% speedup?

<comment><AUTHOR> No, no changes before or after or anywhere else. Just that one line.

I have written my share of hand-optimized assembly, but this is just an optimizer peculiarity. I am not after trying to understand why it happened, and I was making a joke calling it a "technique". That said, here's an assembly dump of both versions, just in case :) -

Slower version - <https://gist.github.com/4454234>

Faster version - <https://gist.github.com/4454238>

</comment></comment><comment><AUTHOR> I guess everyone has ran into something like this at some point in time. Care to share? What's the most bizarre optimization quirks you've seen?

</comment><comment><USER3> Hm, there are already some comments about possible optimizations kicking in and asking for assembly code (which is _always_ a good idea to look for changes). However, before doing all of these things, I would want to know how these results were measured? How many repetitions, which machine configuration, standard deviation, etc. It could very well be that this behavior is due to some pre-caching in Windows or some other external factor.

<comment><AUTHOR> This is a part of a custom malloc(). The test involves running

      p = malloc(); free(p);

in a tight loop for 5 seconds, generating about 60,000,000 traversals of the code in question. The slower version yields a loop count of around 67,... and the faster version bumps it to over 70,... Not quite 5%, but in thereabouts.

</comment></comment><comment><USER4> My guess here is that either the Partial Redundancy Elimination or Loop Invariant Code Motion (or some interaction between the two) in MSVC2010 needed a helping hand, but I agree with mmastrac, it's hard to know exactly what's going on without seeing the assembler.

</comment><comment><USER5> yeah, it would be nice to see what code is actually generated that makes it faster...

... also, have you considered pointer arithmetic? your style of for loop is nothing i would ever write to begin with. perhaps this is why the compiler has a hard time with it - it is quite unusual - the extra loop counter seems pointless and can be removed by a single pre-calculation

<comment><AUTHOR> > _... also, have you considered pointer arithmetic?_

Good point. Tried it and makes no difference. Looking at the assembly, it appears that the difference in performance lies in the prolog code for the loop rather than in the loop itself.</comment></comment>


Ask HN: Validate my idea - mock phone interviews - <AUTHOR>

Idea: Programmers book a time for me to call them up and hold a mock phone interview.
I'm using youcanbook.me to take bookings, and I will use skype or one of the cheap international providers to call people outside of the UK.
The interview will be 10-15 minutes. Just a taste of a programming interview, but enough that I can provide actual feedback, hopefully helpful.
Funding? I'm paying costs myself to see if the idea works. I'm going to give it a few weeks and then make a decision about what next.
http://cvmountain.com/2013/09/you-can-book-me-for-a-mock-phone-interview/ <comment><USER2> There was recently a thread about this. I was looking into a good way to provide this service and tested the idea by booking mock interviews on Fiverr. There was little interest and most was from young people with heavy accents who wanted to practice being understood.

However, that does not mean you should give up on your idea. Just be sure you're basing your decision on popularity with paying customers.

<comment><AUTHOR> I would be interested to read that thread!

Right now I'm on day 2 of promoting the idea. I have 5 bookings. If the idea is doomed I'm trying to fail fast.

Update: 6 bookings

<comment><USER3> You may need to read these threads.

[https://news.ycombinator.com/item?id=6320089](https://news.ycombinator.com/item?id=6320089) [https://news.ycombinator.com/item?id=6320089](https://news.ycombinator.com/item?id=6320089)

</comment></comment></comment><comment><USER4> Hah, I guess the old saying of "if you think of an idea, chances are someone else in the world is already working on it", is true. I've been mulling over a concept which is 99% similar that I'm hoping to validate. Please get in touch if interested.

<comment><AUTHOR> You don't have any contact info in your profile.

</comment></comment><comment><USER5> You could monetize pretty nicely just by offering a job board too in the future. There's a ton of cash in the recruiting business... just wish the signal to noise ratio wasn't so awful.

</comment><comment><USER6> I was working on a similar idea, but didn't have much luck. How much are you charging for the service?

<comment><AUTHOR> Nothing. I'm validating the idea.

<comment><USER2> That's a mistake. You should charge a little money. People will sign up for anything if it's free.</comment></comment></comment>


Drinkify: powered by Last.fm and The Echo Nest - <AUTHOR> http://drinkify.org/

<comment><USER2> Nice lookin', but the drink recommendations are terrible:

Hawkwind: 2-Buck Chuck (should be lager)

Martin Denny: 1 bottle Metaxa, neat (should be a Mai Tai or something)

Combustible Edison: A drink called the Combustible Edison that is most assuredly not the real Combustible Edison: <http://www.food.com/recipe/combustible-edison-279922>

Motorhead: Rum and Cranberry (should be Jack Daniels and a boot in the face of anyone who suggests otherwise)

etc.

<comment><USER3> Amusingly, it also gives terrible results for bands named after drinks...

""The Dirty Martini" - 1 bottle Pinot Noir. Serve at room temperature. Garnish with maraschino cherry."

And searching for 'vodka martini' just gives a blank page.

'James Bond' gives an amusing warning from Last.fm - the 'artist picture' is a sticker saying "Put only the correct artist name in your file's ID3 Artist tag to avoid incorrect or duplicate results."

</comment></comment><comment><USER3> ""The Gary Numan" - 1 oz. Cocaine. Serve on rocks. Garnish with fire."

""The Cradle of Filth" - 8 oz. Blood, 8 oz. Cough syrup. Combine in highball glass and serve. Stir quickly."

Made me laugh :) Although the 'Brahms' recommends 10oz of ecstasy, which seems improbable!

</comment><comment><USER4> i always welcome drinks suggestions so upvoted... but if i'm already listening to something, why the hell do i need to listen to more of it?

i ended up with two musics playing on my headphones... and i wasn't even drunk yet.

update: i actually stopped pandora as this one keeps playing the same band</comment>