Study: High Speed Trading Hurts Long-Term Investors - <AUTHOR> http://online.wsj.com/article/SB10000872396390443931404577551633192136866.html

<comment><USER2> Gah what a stupid article. Consider its foundational point:

 _"Pragma measured the effect by comparing the volume in certain stocks with the time it takes to execute an order. Longer execution times typically result in poorer results, since a stock's price can swerve away from where it was when the order entered the market. Such an effect is known in the industry as a "shortfall.""_

If you are a "long term" investor you don't sell stocks to capture a few pennies here and there. You buy at price $X and hold it for a while, maybe you put in a stop order [1] so that if the shares start heading for the floor you will automatically exit. You set a value you want to see for your 'gain' and you set a limit order [2] when the stock starts getting close. The limit fires and you exit the stock. Even if it keeps rising and rising.

The basis for the claim in the article is that some HFT house might buy your stock when it hits the limit order price, because it is predicting it will go higher and then instantly resells it for a bit more than your price. You've cashed out already (closed your position) and they skimmed a bit of cream off the top. You didn't 'lose' any money at all.

For those not familiar with stock trading:

[1] A 'stop' order tells the firm holding your stock that if the stock drops below a certain price (the stop price) to automatically sell the security. So if you buy a stock at $10/share and you don't want lose more than 20% on it you might set a stop order for $8/share.

[2] A limit order goes the other way, you tell the broker that if the stock ever gets to a certain price to sell your shares. So if you are looking for a 10% return on your $10/share stock you might put a limit order in for $11/share. (or $11.25 if you want the 'net proceeds' to be $11/share).

<comment><USER3> _> If you are a "long term" investor you don't sell stocks to capture a few pennies here and there._

Yes, but I'm still certain that high frequency traders are siphoning value off long term traders when the latter have to transact.

<comment><USER2> I would be interested to hear the sequence that makes this true. Lets say I put a limit in on stock FOO at $32 and it fires and I get my $32 * n dollars. What did the HFT do to siphon value off my trade? Or off the stock for that matter?

<comment><USER4> I'm not involved in HFT, but I imagine the following scenario is plausible:

You place a limit order to buy FOO at $32

Someone else offers FOO at $31.90

A HFT algorithm buys FOO at $31.90 and immediately offers it at $32

You buy FOO at $32 from the HFT algo

So you have lost potential profit on the transaction even though you technically hit your limit price.

<comment><USER5> _You place a limit order to buy FOO at $32

Someone else offers FOO at $31.90_

At this stage, the matching engine observes that you want to buy at $32, and someone is willing to sell at less than $32. You trade directly with that person at $32.

It's actually illegal for any matching engine to match the $31.90 bid, they must cross trades at the NBBO.

</comment></comment></comment></comment></comment><comment><USER6> This comment from the article pretty much sums it up:

"This study treats correlation as though it were cause and effect. The fact that HFTs choose to trade stocks with bid-ask spreads of two cents (instead of one cent) does not mean that the HFTs have made that spread larger. The high liquidity provided by HFT has to let anyone with a market order receive a more favorable price than they would in the less-liquid market without HFT. HFT is simply improvement of the labor of market-making through the use of machines. For the past three hundred years, virtually every mechanization which improved the productivity of labor was fought by the establishment. This is no different."

</comment><comment><USER7> The Pragma report [1] that the WSJ refers to investigated when a TWAP algo would need to "cross the spread". Ie, when the order book is really deep, then it takes so long for a passive order to execute that crossing the spread becomes necessary.

This effect has nothing to do with HFT firms. In fact, the referenced white paper doesn't even mention HFT at all! So it's odd that Pragma's CEO would make such a remark to the WSJ.

It's even odder that the Pragma paper doesn't mention the numerous other ways of executing a passive order, such as pegged orders, pro-rata venues, low- rebate exchanges, or even crossing networks. The authors describe a totally out-dated view of how liquidity is accessed for a stock like BAC.

[1] <http://www.pragmatrading.com/research/research-notes>

<comment><USER8> A similar logic applied to value investing would conclude long-term investors result in under-valued stocks.

</comment></comment><comment><USER9> Not sure it still applies as I have been out the trading game for a little while now, but in the past the big HFT's had a 20 millisecond window where they were allowed to see the market orders before anyone else. Thus they could see say a big buy order coming in and pull their offers or even take out the offers themselves, knowing that the buyer would have to pay up. This has the effect of raising execution costs for the company trying to accumulate stock for their long term positions. Obviously the same techniques would apply to the long term investor trying to close a stock position by selling.

This was effectively legalised front running of the market, something that would normally get you sent to jail. In the name of liquidity, exchanges allowed this and of course they got paid big bucks by the big HFT firms.

The whole trading game is pretty corrupt. You would expect that given the amount of money sloshing around. For example we knew about market manipulation in LIBOR for many years. It was an open secret but now the regulators are "discovering" it because the political climate is such that fewer people are prepared to live with the big banks excesses.

Still there is plenty more ongoing manipulation going on in trading even as I write this. I am awaiting the day that the regulators will "discover" these. Some of the bond markets for example have proportional fill executions. So if you have the best price and are first in the queue, a big institution can come along and show an order in vast size, which they have no intention of trading, just to get a fill of the fraction they actually wanted. You of course are left high and dry with just about nothing of your order filled because proportionally it was tiny. It is an amazing sight to behold how these vast orders come along just as the market is about to move and then instantly disappear. It is clear to any trader that someone is working on inside information, but everyone (read: big money)is in on the secret so no one is telling.

<comment><USER10> >in the past the big HFT's had a 20 millisecond window where they were allowed to see the market orders before anyone else

As far as I know, flash trading was an optional feature, designed to be used by those who wished to shop around their order in a somewhat private network, before sending it to the wider market.

> This was effectively legalised front running of the market

If you say flash orders were abused, I'll take your word for it, but it wasn't designed to be a way to front-run. Its purpose was actually to help.

<comment><USER5> _If you say flash orders were abused, I'll take your word for it, but it wasn't designed to be a way to front-run. Its purpose was actually to help._

And at least 30-40% of the time, it did help. Anyone with a flash fill rate lower than that was kicked out of the ELP program.

</comment></comment></comment><comment><USER5> I don't get it.

Some long term investors are placing passive orders to squeeze out an extra penny on their investments. I.e., they are running a strategy that's a mix of long term speculation and market making.

Unfortunately for them (but fortunately for the purchasers of liquidity), they are getting crowded out of the liquidity selling market by people who focus solely on selling liquidity.

What's the problem here?

<comment><USER11> _What's the problem here?_

This is a hypothesis, but the answer is probably something like: Lots of people want to demonize free markets, and HFTs are particularly easy to demonize because it's hard to see how they add value (although they do), but easy to see that they are ethically self-interested (which people also unjustly demonize).

My recommendation to HFTs to counter this would be (a) do a better job explaining the mechanics of how you're providing a valuable service; (b) do a better job supporting capitalism in general, on a moral level, in the public sphere of debate. Otherwise, you're gonna have to pack up shop and move to a more free country pretty soon (if there is one).

<comment><USER5> _My recommendation to HFTs to counter this would be (a) do a better job explaining the mechanics of how you're providing a valuable service;_

Shameless plug:

<http://www.chrisstucchio.com/blog/2012/hft_apology.html>

<http://www.chrisstucchio.com/blog/2012/hft_apology2.html>

<http://www.chrisstucchio.com/blog/2012/hft_whats_broken.html>

</comment></comment></comment><comment><USER12> An analysis of who makes profits when HFT's trade. <http://www.nanex.net/aqck2/3519.html>

an interesting analysis - results towards the end "The Final Score"

</comment><comment><USER13> _long term traders have trouble quickly buying and selling the stocks._

If you're a long term investor, and the particular minute of the day when you make your transaction makes or breaks your strategy, then you were effectively just flipping a coin with your long term strategy.

</comment><comment><USER14> To come at this from a slightly different angle.. any situation in which an agent gains wealth without creating wealth is at the expense of the market.

Two questions, first are HFT's creating wealth? second, are HFT's gaining wealth at the expense of the investors or the producers?

<comment><USER15> Any agent who gains wealth has taken a risk (of loss) that someone else has not.

</comment></comment><comment><USER16> It seems to me that the 800lb Gorilla in room is the impact of HFT on volatility which is not really covered here.

</comment><comment><USER17> We should really tax all stock trades at .001% or something.

<comment><USER18> Definitely. Could help the economy, too.</comment></comment>


The voice from our Nest camera threatened to steal our baby - <AUTHOR> https://www.siliconvalley.com/2019/10/18/the-voice-from-our-nest-camera-threatened-to-steal-our-baby/ <comment><USER2> A lot of comments here are blaming the user for using the same username/password on multiple sites, allowing their account to be compromised. This is missing the point.

Nest cameras are a security product aimed at non-technical users, so of course this happens frequently, and of course this was foreseeable at the very earliest design stages. The designers needed to come up with a solution to this problem, and blaming the user is not an acceptable excuse.

The solution is actually pretty easy: require a pairing procedure that can't be done remotely. For example, the Nest app on a phone could display a QR code with is public key fingerprint, which you show to a camera, and the camera will only send video to phones it's been paired with. That would pretty much completely eliminate this failure mode.

<comment><USER3> Former co-founder & CEO of Dropcam (Nest cam) here.

There's no way to say this humbly, but imo stuff like this is _the_ reason that companies lose their way when they lose an empowered "buck stops here" product-oriented CEO with enough engineering chops to modulate product decisions.

I had an endless to-do list of improvements, including security enhancements like the one you suggest (but done in a way that would not impair usability, like anything with QR codes :-)).

The problem is, a string of well-meaning but amazingly risk-averse managers came in and killed the soul of the company by introducing enough bureaucracy that the team and I no longer cared to bang our heads against brick walls anymore.

If the leadership doesn't a) understand product, b) understand business, c) know/respect good engineering, or d) have "fuck you, we're doing this" authority ... it will fail in spectacular ways through a series of seemingly good short-term decisions, it's just a matter of time.

Combine product, business, engineering, and authority to lead, sprinkle in some ethics and respect for your customers/employees, and baby you've got a stew going.

This whole privacy mess in home & so-called "IoT" is a result of people who don't even know what would be required to operate ethically with such powerful technology in the first place. I believe they are mostly good people, they just don't have the mindset or philosophy to know what to do. It kinda makes me misty-eyed. They know where to find me if it sounds like some of this could help... I'd be happy to try and get the band back together again.

<comment><USER4> The fact that this was on your list of "improvements" rather than being a minimal requirement before being willing to launch, sell, etc, is pretty damning on it's own. No need to get misty-eyed.

<comment><USER3> Sorry, but that shows a fundamental misunderstanding of the problem space. We entered the "IP camera" market in 2010, when all the competitor products booted a 7-year old Linux kernel with busybox and UPnP'd a port to the public internet. Admin/admin, no string escaping, buffer overflows, inadvertently indexable by Google, rooted and/or turned into botnets.

Dropcam v1.0 eliminated _all_ of those security problems.

The only gotcha is that we required cloud storage. However, my plan for v2.0 Dropcam was to go with open-source verified builds + kill the cloud-storage requirement (but offer it optionally with e2e crypto).

If I had required that at v1, the company wouldn't exist today, and worse stuff would have taken its place. Good product engineering requires prioritization and stepwise problem-solving, not ivory tower ethics.

<comment><USER5> With all respect, just because the state of the market was terrible doesn't make a more secure insecure product good for the end user. And more than take market share away from less secure cameras, nest created a great ux helping expand use to unsophisticated consumers.

<comment><USER6> > _With all respect, just because the state of the market was terrible doesn't > make a more secure insecure product good for the end user._

With all respect, let us know when you (or anyone else) releases a perfect version of a product. Nobody has unlimited money and time in which to polish a product to perfection.

I'm in the throes of this right now, trying to beat a once-miserable codebase into something that that improves our customers' lives, is stable, is secure, etc. on a shoestring budget. It's a hard, wretched slog but we're doing it, one point release at a time.

<comment><USER3> This is exactly right, and way better than my reply.

Your polish can improve as you scale and get more resources. That doesn't mean there isn't a min-bar of basic security practices and ethics, but if min-bar is perfection on all counts, get ready for a long and fruitless existence...!

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> I had the same response from Google when my mom got hacked and she paid off hackers $6000 in Google Play cards. Why does Google allow people to be scammed via their gift cards when they could easily fix this by putting in basic checks? Crickets.

Its easy to say 'my mom should know better', but like most users in the world she is not technical. She grew up on a farm, how is she supposed to understand this stuff. It should be on these companies that make enormous profits to protect all users. This includes users who are not technical.

<comment><USER8> > She grew up on a farm, how is she supposed to understand this stuff.

I'm sure it wasn't your intention but that's quite insulting. Just because someone didn't grow up with technology doesn't mean they can't learn and understand it. Farmers especially since they're very DIY and resourceful.

<comment><USER9> It's part of the authoritarian bend.

"She needs to be protected. She's not a real adult like I am. I, as a real adult, will decide for those who I consider aren't real adults."

It's dripping with patronizing authoritarianism. And they just don't see it.

I will say, people who have IQs below 80-70 are in a terrible place. Our modern world assumes the ability to understand concepts at a certain level. Some people at some IQ levels just will never be able to do so. How to classify such people and what to do about it is something we need to recon with as a society.

But a discussion of a CEO who is lazy and can't be bothered to engage in minimum cyber security (the FA) that even clerks are required to do and thus got hacked... is probably not the place.

<comment><USER10> > "She needs to be protected. She's not a real adult like I am. I, as a real > adult, will decide for those who I consider aren't real adults."

I don't see the similarity between that, and what was actually say. It seems you are making assumptions and taking it way out of context.

</comment></comment></comment></comment><comment><USER11> > It is not evil to bring a product to market before the privacy has been > completely figured out, but it is evil to let someone threaten to kidnap an > 18-month-old and have no real response.

I have to disagree with the first part here. Privacy is a pretty central (and I would say _obvious_) concern, especially given the function of this particular product. I get that some people care less about privacy than others but the fact that this tech is being misused like this doesn't seem surprising to me at all.

<comment><USER12> True. Otherwise the "Internet of Things" becomes the "Botnet of Things" as time has already shown. However, once a botnet is used for sex trafficking, it's sure to be taken much more seriously.

</comment></comment><comment><USER13> Why are so many people here trying to reinvent the wheel? We already invented the wheel that fixes this particular problem, it's called 2FA.

If users decide not to use it, then there's nobody to blame but them.

Thinking up ever more complex schemes, to offload all the responsibility on the services, won't solve any of this.

At the end of the day user error overrides it all and massive database breaches even affect those that should know how to properly secure their stuff [0].

2FA is not perfect, it's not convenient but it's one of the last remaining effective defenses when massive breaches have become so normalized that known pwned accounts outnumber people alive on the planet [1].

[0] [https://krebsonsecurity.com/2019/10/briansclub-hack- rescues-...](https://krebsonsecurity.com/2019/10/briansclub-hack- rescues-26m-stolen-cards/)

[1] [https://haveibeenpwned.com/](https://haveibeenpwned.com/)

<comment><USER14> or how about just don't re-use passwords accross accounts. If they had used a unique password they would've been fine right? I don't understand what users want google to do: it's the house equivalent of taking your key and leaving it at the grocery store.

<comment><USER15> It's not so sure, in some cases, passwords can be compromised by other ways directly from the source, or accesses can be derived from misimplemented APIs.

No matter how big the company is, this is really realistic.

Facebook, Google and others all used to leave some passwords in clear-text during very long time for anyone to check in the logs.

Google even got their central password system compromised and source-code stolen (Gaia).

It can also be a password recovery process that can have glitches (Steam), or just not checking password properly due to deployment errors (Dropbox) or just compromised servers (my unique EA Origin password was compromised like this, my LinkedIn password as well, my Twitter password...) etc

many possibilities

<comment><USER15> Sources: Google Gaia: [https://www.itnews.com.au/news/insider-reveals-details- of-go...](https://www.itnews.com.au/news/insider-reveals-details-of-google- hacks-172661)

LinkedIn: [https://en.wikipedia.org/wiki/2012_LinkedIn_hack](https://en.wikipedia.org/wiki/2012_LinkedIn_hack)

Facebook: [https://www.theguardian.com/technology/2018/sep/28/facebook-...](https://www.theguardian.com/technology/2018/sep/28/facebook-50-million- user-accounts-security-berach) (fun fact, it happened TWICE)

Dropbox: [https://www.troyhunt.com/the-dropbox-hack-is- real/](https://www.troyhunt.com/the-dropbox-hack-is-real/)

Another Dropbox: [https://techcrunch.com/2011/06/20/dropbox-security-bug- made-...](https://techcrunch.com/2011/06/20/dropbox-security-bug-made- passwords-optional-for-four-hours/)

</comment></comment></comment></comment><comment><USER16> > Essentially, an email and a password are compromised somewhere across the > internet. They join millions of other email addresses and passwords, which > are then cross-referenced with other websites, including Nest.

This doesn't sound like a Nest vulnerability? Does Nest offer MFA?

<comment><USER17> Yeah, this has absolutely nothing to do with Nest and everything to do with people using the same passwords for different sites.

<comment><USER18> Does Google/Nest partner with haveibeenpwned to invalidate leaked creds and force a reset by the user? Forcing MFA would also not be unreasonable considering the sensitivity of the data collected (ie video in your home), although I get this is up for vigorous debate between product, security, and engineering.

Google defends Gmail users from malicious nation state actors [1]. Isn't Nest part of the Google identity ecosystem now?

[1] [https://security.googleblog.com/2012/06/security-warnings- fo...](https://security.googleblog.com/2012/06/security-warnings-for- suspected-state.html)

<comment><USER19> I didn't think HIBP did password hash sharing?

<comment><USER20> They sure do and in fact offer an API for sites to validate sha-1 hashes against their cracked password DB[0]. The hashes are shared.

Thank you to Troy Hunt

[0] [https://haveibeenpwned.com/API/v3#PwnedPasswords](https://haveibeenpwned.com/API/v3#PwnedPasswords)

<comment><USER19> That's not really what I was getting at. I've implemented the password lookup before. That protects users from setting passwords that have already been compromised.

The scenario I was looking at was..

User signs up with Site A with Password 1.

User signs up with Nest with Password 1.

Site A gets compromised.

Nest couldn't know if you'd used the same password on each site. The only way they could know is if they used the same hashing algo with the same salt or SHA-1 with no salt. Highly unlikely.

I suppose Nest could check the Pwned Passwords API every time they logged in, but I haven't seen anyone deploy that yet, IIRC all solutions I've seen check Pwned Passwords API when the set the password. Setting a password and checking a password are often different systems.

<comment><USER20> you can also download the passwords

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> Well, this is a case of stolen credentials...but the behavior behind this is just a sample of how fucked is this world. Who in their right mind enjoys distressing others in that way? I try to convince myself that there's hope for the world but when I hear about this type of things I lose that hope. There are legit evil people in this world.

<comment><USER22> > There are legit evil people in this world.

There's 8 billions people in the world. There's every kinds of them.

The commons one aren't interesting, they are commons, they aren't the one that we want to talk about. Thus what you see are only the best or the worst.

Please don't lose hope because of that.

</comment></comment><comment><USER23> If you leave your front door unlocked and someone robs your house, is it the door manufacturer's fault? Genuine question, it is interesting that one product has certain expectations while another doesn't.

<comment><USER24> People generally have an intuitive understanding of the security properties of doors. On the other hand, my mid-70s in-laws still have not internalized the idea that the threat model for bad / reused passwords is not "some guy sitting at a computer randomly trying passwords". A better example for the door analogy would be that you leave it unlocked so you can grab something out of the car in your driveway, and by the time you get back someone from Russia has taken all your stuff.

</comment></comment><comment><USER25> How could Google have prevented this except by requiring MFA? Even that isn't guaranteed to prevent 100%.

I'm no Google apologist, just a pragmatist.

<comment><USER26> A couple things just off the top of my head ...

* Detect that a login occurred from an unrecognized IP and email the account holder to tip them off.

* More stringent password requirements and a check against public leaked database registries to alert the user that the password they're using has been leaked.

But it seems like the bigger frustration is not that they did not prevent it, but that when it occurred it was difficult to raise the issue, and the response was tremendously inadequate.

<comment><USER27> The issue with your first suggestion is the whole idea of signing into your Nest account is that you are away from home, therefore your IP would be different. Not saying they can't do it, but accessing your device from a different IP is kind of the point.

<comment><USER28> Sure, but then you just log into your email and click a link and then you are in. Lots of sites do this and it would prevent this kind of attack in most cases. (assuming the leaked password was not also reused in email, but then you are in for an entirely different level of hurt anyways)

</comment></comment></comment></comment><comment><USER29> Who would ever in their wildest dreams have devices from a huge data collections company, watching and listening in your home?

It's beyond uintelligent, i you really think about it.

<comment><USER30> Sure, to the average HN user, if even that. As a thought experiment, you know the inner-workings of G. Take one step back, and consider if your parents have that same understanding. Sure, you may have talked about it with them at dinner once/twice/often, but do they really understand it? Now, multiply that by the greater majority of people that have no-tech understanding nor friends/family to enlighten them. To them tech might as well be magic. Everything is "push a button, get a prize" mentality for end-user tech now.

<comment><USER31> Arthur C Clarke's Third Law: "Any sufficiently advanced technology is indistinguishable from magic."

My in-laws are firmly in the "computers are magic" camp. Say what you like about they should learn etc, but they're in their 80s, have already lived through multiple technological revolutions, and at this point don't have the energy or interest to work through another one.

<comment><USER22> Would your in-laws would let a kid play with power tool too?

They are aware that someone not able to understands the danger of power tools and how to use them safely shouldn't use them. That's nothing new. Yet they still do...

</comment></comment></comment></comment><comment><USER27> CanadaPost is resetting _all_ user passwords now due to a similar breach [1].

"The cause appears to be that login and password credentials stolen in external privacy breaches unrelated to Canada Post were used to access individual Canada Post accounts. This is possible when users reuse their credentials on several websites to avoid having to remember different passwords."

I'm not sure how they plan to prevent users from just reusing another password, however perhaps this education will help.

1\. [https://www.canadapost.ca/cpc/en/our-company/news-and- media/...](https://www.canadapost.ca/cpc/en/our-company/news-and- media/corporate-news/closures-and-service-interruptions- details.page?article=2019/10/16/canada_post_is_reset&cattype=announcements&cat=updates)

<comment><USER32> Canada Post doesn't sanitize user input very well.

Username/password is reflected unchanged in JS. Got a console error because my password has a single quote in it.

</comment></comment><comment><USER33> > In every email, they remind me of two-step authentication. They act as if I > am going to continue to use Nest cameras.

Well, isn't that's exactly what the customer support team is suppose to do? They'd be a terrible customer support representative if they didn't encourage good security practices and didn't try to maintain customer relationships.

Not having 2FA is unacceptable in 2019. The best form of security is a combination of these 3 things:

\- "Something you know — Password, security questions, personal information, etc.

\- "Something you have" — Security key (Yubikey, Smartcard, Ledger Nano, etc.), software key (HOTP/TOTP), ̶S̶M̶S̶, email, etc.

\- "Something you are" — Biometrics (Touch ID, Face ID, etc.)

</comment><comment><USER34> > it was the user's fault for using a compromised password and not > implementing two-step authentication

Very low technical skill for someone writing for a website called siliconvalley.com.

</comment><comment><USER35> Its in google / Nest's best interest to put in common place security measures like MFA or notifications like detecting an unknown device accessing the camera. If I'm paying this much $ for a product, i don't want to have to deal with having to understand the 100 different ways it could be compromised and having to deal with that.

</comment><comment><USER36> Many services send you an email when someone logs in from a new device. Does Nest not do that?

</comment><comment><USER37> Perhaps I'm silly but wasn't it obvious that things like that would happen with Nest, Alexa and the like when devices like these first came out?

</comment><comment><USER38> [https://www.youtube.com/watch?v=coPevaETtnM](https://www.youtube.com/watch?v=coPevaETtnM)

</comment><comment><USER39> Reminds me of this:

[https://i.imgur.com/ZtacKhz.jpg](https://i.imgur.com/ZtacKhz.jpg)

</comment><comment><USER40> Putting it on the company to stop you from not doing things that make you prone to the most common and low-barrier password stuffing attacks?

People reusing passwords is risky and frankly stupid behavior.

The same way you are responsible for your financial identity and can be taken to court over these disputes, you are also responsible for your cyber identity.

The longer you avoid being held responsible, the worse the pain will be.

</comment><comment> _-___________-_ User used same credentials for multiple sites. User did not use multi-factor authentication. Another site was hacked and the credentials exposed. Someone used those credentials to log into user's Nest account and access the speaker. User is upset at Google for some reason.

<comment><USER41> Would it be possible to do something like this:

1\. user Initially creates login and password for Nest device

2\. Before Nest accepts your password, it checks HaveIBeenPwned.com to see if that password has already been used before for this email address. If so, the password is rejected.

<comment><USER42> It's not only possible to do this, but should be expected for any _security_ product. Nest is equally at fault here for allowing a user to use a known- breached password.

</comment></comment></comment><comment><USER43> I wonder if Google execs are regretting the original "don't be evil" slogan yet.

<comment><USER44> They dropped it long time ago.

<comment><USER43> I realize they dropped it but it's not stopping everyone from referencing it every time there's negative publicity.

</comment></comment></comment><comment><USER45> On top of having to fail password/2FA security basics for your kid to be subjected to this you have to:

\- Have both parents decide the child is not a high enough priority for one of them to stay home

\- Decide it's too much hassle to take the kid to a professional style day care where there are multiple adults watching each other to make sure none of the adults are badly behaved with the kids

\- Also too much of a hassle to go to a home day care where less professional adults could watch the kid, but at least there are more than one of them working there in case one of them starts to mistreat the kids

\- Hire a nanny, but not trust the nanny, cause sometimes nannies are badly behaved too

\- Decide you trust the IoT company more than the nanny or any of the above

First world 1%er problem for sure.

<comment><USER46> I hate to break it to you, but nannies and nest cams do not automatically place anyone in the 1%, or 10%, or 50%.</comment></comment>


WTF is Clickbait? - <AUTHOR> https://techcrunch.com/2016/09/25/wtf-is-clickbait/ <comment><USER2> Interesting that it's posted by a person who I've got tagged as "Bad Ad Poster", who kept spamming links indirectly promoting that one static site project.

</comment><comment><USER3> "WTF is Clickbait?" IS clickbait.

</comment><comment><USER4> its a Publishers Fev</comment>


Thank HN: Claim your personal Screenleap handle until April 30 - <AUTHOR>

Hey Hacker News,
You have been really good to Screenleap since our soft launch here back in February and we would like to give back to you. We are launching user accounts with handles next week and wanted to give the Hacker News community first dibs on claiming their handles.
For a limited time only (until midnight on April 30, 2012), you can claim your free user handle by signing up using our Hacker News promo at http://www.screenleap.com/signup?referer=hn
A handle is a username link that can be provided to friends (i.e., http://www.screenleap.com/pg) as an easy way to initiate a screen session with someone. We only support public sharing (broadcasting) right now with handles but will be adding private sharing soon too. In addition, in the coming weeks we will be adding support for creating a friends list with the ability to quickly share your screen with a friend by clicking on their names (like instant messaging).
Thanks! The Screenleap Team <comment><USER2> I'm a new HN reader, so while I signed up (thanks!), I must admit this is the first time I'm hearing of Screenleap.

On the front page I noticed "As Seen In" ... Lifehacker. I happen to read Lifehacker so I tried to see if the logo was a link to where it was mentioned - no dice.

After a quick Google search, I found the article devoted to Screenleap (but it doesn't show up on the homepage yet, odd). I really wish websites would make those "As Seen On" logos actual links to where they were featured, otherwise, I generally don't give them much credibility.

Is there a reason why they can't be links?

EDIT: I think this is the first time I've ever signed up for an online service and _didn't_ get an e-mail after signing up. I don't know whether to thank you, or think that people might forget they signed up or something if they don't have an e-mail about it in their inbox.

</comment><comment><USER3> Thanks, got mine. It said "handle taken" in red text briefly before I signed up, but I ended up with the handle that I wanted.

</comment><comment><USER4> try to find a more obvious thing than the little "inactive plugin" at the bottom... just ignore "click enable" stuff these days, and wait for prompts (like up near the address bar).

hit people upside the face with it

</comment><comment><USER5> Thanks, cool product! Just got my handle!

</comment><comment><USER6> sweet! got mine! :-)

</comment><comment><USER7> Claimed, thanks!

</comment><comment><USER8> I get to finally actually be "Michele" which is usually not available (or that would be my HN handle as well).

Thanks.

</comment><comment><USER9> thanks!</comment>


Journalists, Bloggers Have a Sorry History at Startups - <AUTHOR> http://www.pbs.org/mediashift/2007/12/startup_feverjournalists_blogg.html <comment><USER2> Another fatuous attempt at scorekeeping. Everyone has a sorry history at startups. It's a simple bias that focuses your memory on the rare successes.

</comment><comment><USER3> Then again, there's people like Michael Moritz and Nick Denton out there.

Whether or not you like those guys, they're pretty successful.</comment>


NASA Finds Perfectly Rectangular Iceberg In Antarctica - <AUTHOR> https://www.forbes.com/sites/trevornace/2018/10/22/nasa-finds-perfectly-rectangular-iceberg-in-antarctica-as-if-it-was-deliberately-cut/amp/ <comment><AUTHOR> There is something weird going on. Check this too:

[https://www.express.co.uk/news/weird/1016610/weird-news- yout...](https://www.express.co.uk/news/weird/1016610/weird-news-youtube- alien-bunker-Antarctica-secret-military-base)</comment>


Thinking Like a Mountain: On Nature Writing - <AUTHOR> https://nplusonemag.com/issue-29/reviews/thinking-like-a-mountain/ <comment><USER2> I live in southeast Alaska, where bears are still well-established. Bears come into town on a regular basis, and they can be anywhere in the woods. I was high on a steep rocky mountain once, and heard a loud breathing sound in front of me. I thought I'd turn a corner and see a big mountain goat, but when I got around a large boulder I saw a giant cinnamon-colored bear. It turned and ran up the neighboring ridgeline to the summit of a 4000' mountain. That was when I learned bears really can be anywhere here.

It's a different feeling walking in a woods where you are not the apex predator. It's humbling, but it also tunes you in to your surroundings. I don't wear headphones in the woods; I watch and listen to the forest. I don't romanticize the experience, but I sure appreciate having the chance to experience the woods largely as our ancestors have, aside from the modern clothes we wear and communication devices we carry.

When I visit other places and walk in the woods or climb a mountain, it's an entirely different feeling. The woods feel empty, and I feel a little more dull. I don't know where to go with that; it's a sad state that I don't see any way back from, outside of pockets of wilderness being preserved.

<comment><USER3> Trust me. In Alaska you are still the apex predator. That bear has far more reason to fear you than you do it. The bear doesn't know that you aren't carrying your rifle.

<comment><USER4> If you think a rifle/pistol is going to save you from a bear then you have a lot to learn about being out in the woods.

<comment><USER2> You might also be surprised at how effective bear spray is. You have to know how to use it; you have to wait until the bear is close enough to you, you have to not run, you have to pay attention to wind, and you need to know a few things about bear behavior.

The nice thing about bear spray is that if you know how to use it, most or all of your bear encounters will end with the bear running away from you long before you could use the bear spray anyway.

<comment><USER4> Yup, totally agree. There always seems to be some yahoos who think that strapping a 454 Casull to their hip is going to keep them safe from bears/wildlife.

Watching your surroundings, knowing common behaviors and keeping a cool head will help mitigate your chances. Acting like you can take on a bear head-to- head single handed won't.

</comment></comment></comment></comment></comment><comment><USER5> Very enjoyable book reviews. Loved his critique of The Secret Life of Trees, I couldn't even finish that book.</comment>


How Short Can You Write Fizz Buzz? - <AUTHOR> http://hungtran.co/more-than-one-way-to-fizzbuzz/

<comment><USER2> For me personally, the sweet spot between readability and compactness would be one of the first examples:

      for(var i = 0; i <= 100; i++){
        var out = ''
        if (i % 3 == 0) out += 'fizz'
        if (i % 5 == 0) out += 'buzz'
        if (out.length == 0) out = i
        console.log(out)
      }

<comment><USER3> Can you do it in js without using conditionals.

</comment></comment><comment><USER4> I liked my 4 (non boilerplate), readable lines in nemerle -

[https://gist.github.com/vai/4647768](https://gist.github.com/vai/4647768)</comment>


Turning Google Assistant into a 'Star Trek' Computer - <AUTHOR> http://www.nytimes.com/2016/09/29/technology/google-assistant.html <comment><USER2> > where apps have supplanted the web

No. (Thank God.)

<comment><USER3> apps would silo it. also it's nice they didn't call it a moon shot program (even though google uses that term internally)

</comment></comment><comment><USER4> You mean like this?

[https://www.youtube.com/watch?v=RHaIjAk0X7Y](https://www.youtube.com/watch?v=RHaIjAk0X7Y)</comment>


GOP asks FCC to kill plan for helping customers avoid cable box rentals - <AUTHOR> https://arstechnica.com/tech-policy/2017/01/house-republicans-seek-permanent-end-of-fccs-set-top-box-reform-plan/ <comment><USER2> I never thought that forcing cable companies to create apps for other devices was right. Forcing a company to develop software felt wrong.

The issue is not that cable companies have a monopoly on delivering live tv to consumers. A consumer can get live tv from Sling, PS Vue, DirectTv Now and soon Hulu. They can purchase a $59 Roku stick for each tv and get all of the channels they want over the internet.

The real issue is lack of competition when it comes to delivering internet that allows the cable company to have unreasonable data caps. There are also plenty of states that are passing laws that won't let cities build their own internet service. If more people had access to reasonable data limits they wouldn't need cable or the Sergio boxes.

Luckily, I live in area served by Comcast and AT&T. I pay $70 a month for symmetrical 1Gbps internet and my house is wired for Gig E. I subscribed to Hulu, Sling, CBS All Access, Netflix (which I had when I had cable) and Amazon Prime. I also have a Plex Server. All six of our TVs have either Roku boxes or AppleTVs.

If I had cable, I would be paying $50 extra per month just for box rentals and that doesn't include another $25 in HD Technology fees, Sports Access Fees, Network Access Fees, and other fees.

<comment><USER3> They were going to be required to essentially provide an API. It said nothing about forcing them to create client apps.

"The original plan would have required pay-TV providers to make video programming available to the makers of third-party devices and software without the need for a CableCard."

</comment></comment><comment><USER4> Good news. What in the world is the government doing in the cable box business?

<comment><USER5> Trying to protect people (does Google count as people?) from shitty monopolies. Not that it had a chance of working after the previous N attempts failed.

<comment><USER6> That was kind of my first thought... cablecard sucked so badly, most of the devices to make it more usable didn't work with restricted content, and in the end it failed.

All I could see happening is a weird convoluted standard that was so full of holes that even supporting various cable providers wouldn't allow much more freedom and would fail in the end. As much as I'd like to see a singular pvr option to rule them all rise up, I don't think I'd be happy with it even then.

I still find it far easier to pay the cable/netflix etc tax (guilt, you know), and just torrent almost everything I watch.

<comment><USER3> I think you mean major companies support of cablecard sucked so badly because they wanted it to fail. I actually had a TiVo with CableCard and it wasn't awesome, just didn't support on-demand.

<comment><USER6> I tried it, so many channels (pretty much all HD) were tagged cannot record, so I returned the cablecard the next day.

<comment><USER3> I had issues with several channels, but overall loved TiVo at that point. The cable companies purposely crippled CableCard though, and crap like that is why we need consumer protection groups.

<comment><USER6> The issue is, that the proposed plan, like tfa and cablecard come from govt requirements... I don't see the plan in the article necessarily working out better for the consumers.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> > "Without a clear indication that the Commission rejects this current > proposal, content creators will be hesitant to invest in high-quality video > programs," they wrote to Pai

Well if they're not willing to produce quality content, the Netflixes of the world will. Feel free to keep digging your own grave, cable companies.

</comment><comment><USER8> I know a lot of older people who will continue to be hyperconsumers until their dying day. They are in constant battles with the cable/phone/etc. companies over fine-print terms they signed without reading. They are also overwhelmingly pro-Trump republicans.

I fully expect all of them to be burned by this at some point in time, and I also expect about half of them to _still_ find some way to blame it on Obama-- even in the year 2020!

I'd also like to second spectrum1234's comment. None of those things are really necessities. There are not enough hours in the day or enough gold in the world to sustain a government that attempts to protect people from their own stupidity.</comment>


What is ProjectHermes - <AUTHOR> http://danie.lt/blog/2013/08/13/what-is-projecthermes/

<comment><USER2> We already know that there are some dreadful things online. What does this tool accomplish beyond "raising awareness" of a fact that we're already aware of?

<comment><AUTHOR> A lot of people aren't, and a lot goes unnoticed, this hopes to help those who otherwise would not speak out.

<comment><USER2> I suppose a lot of it goes unnoticed because there is so much of it. Who are these people who are not speaking out?</comment></comment></comment>


Why Facebook needs to build a browser - <AUTHOR> http://news.cnet.com/8301-33617_3-57414140-276/why-facebook-needs-to-build-a-browser/

<comment><USER2> "The next battle in the war for dominance over the Web is going to be waged at the browser level." -> Nah. This has been tried before, what's different now that would make it suddenly work?

Google's plan with G+ isn't to overtake Facebook. It's to commoditize social.

</comment><comment><USER3> The Google+ App, like the other Google ecosystem apps are just linked to the website. Aside from that, the other extensions only really compete with Facebook to the extent that Facebook extensions exist. I believe Facebook might build an OS in the future, but reception might take a while for those security conscious individuals who'll be hesitant to adopt a browser that presumably harvests more data for the Facebook machine.</comment>


Servo: The Countdown Continues - <AUTHOR> http://blogs.s-osg.org/servo-the-countdown-to-your-next-browser-continues/

<comment><USER2> Servo becoming part of a modern browser gives me a serious boner. Chrome and Firefox are both significantly working on trying to make sane multi-threaded models, and they often either end up with insane ones, or end up with sane ones that don't perform usefully any better than having left it single threaded in the first place.

I just wish that Chrome would fix performance on OSX. I have no issues on Windows or Android (of course), but OSX it just seems way slower than it should be on a lot of normal tasks.

I mean, literally, the only reason I use Chrome is because of synced tabs, history, and bookmarks built into the browser and having access to that on Android too, purely all the integration into the phone features (I have a Nexus 5).

To hijack my own reply here, where Microsoft is going with Windows 10, if they really hit off, I'd consider a future Lumia model to replace my Nexus 5, because Project Spartan seems to be catching MSIE up to what Firefox+FirefoxOS and Chrome+Android do now.

Edit: Not sure why I'm getting downvoted here. I'm pro-Servo.

<comment><USER3> If you're an Android user, you're missing out on Firefox Mobile.

I'm using Firefox on my Android, it's quite good and it's the only mobile browser I know that does extensions, so you can have AdBlock Plus or uBlock with it. If you're using Firefox on your desktop as well, it will sync your history and bookmarks:

[https://www.mozilla.org/en-US/firefox/android/](https://www.mozilla.org/en- US/firefox/android/)

Android is the only mobile OS that Firefox supports and this is because Firefox has been impossible to distribute on both iOS and Windows Phone, due to either marketplace or technical restrictions. Out of the popular mobile OSes, Android has been the only one that isn't _defective by design_. And unfortunately I'm not seeing Microsoft follow suit, as they are going in the opposite direction and sorry to be grim, but I view project spartan to be just a marketing stunt.

<comment><USER2> I'm aware Firefox can do tab, bookmark, and history sync.

However, Firefox on Android cannot be deeply integrated like Chrome is on my Nexus 5, and last time I tried Firefox Android it had a weird UI and didn't look like a native Android app either.

Also, the lack of Chromecast support in Firefox is also making it difficult to use on the desktop.

<comment><USER4> Deeply integrated how? Am I missing things by using FF instead of Chrome? (not a Nexus device)

EDIT: I see that Chrome is "deeply integrated" with my phone in the sense that it can't be uninstalled, but I'm sure that's not what you mean...

<comment><USER2> Tabs now appear in the recent apps list (which can be shut off and turn back into normal tabs in Chrome), and it seems to be tied heavily into Google Now (though I'm not sure which parts are which).

Chrome on a Nexus device is a lot like Firefox on a FirefoxOS device, if that makes any sense.

<comment><USER3> I also have a Nexus 6 device and personally I don't find the integration with the recent apps list useful. Unless we are talking about apps, otherwise for browsing I much prefer to have those tabs grouped together in one app. Plus Chrome's "normal" tabs where more annoying to use than Firefox (continuing the tradition from the desktop).

The thing that bothers me about Firefox is the broken behavior of " _Add to Home Screen_ ", which doesn't listen to the website's Manifest.json. There are issues raised in Firefox's issue tracker for this and this will get fixed, but currently if you want to pretend that a website is an application, then Chrome is better.

I'm doing that for a small utility I've built for myself: [https://parolamea.org/manifest.json](https://parolamea.org/manifest.json) ... funny thing is that even though Chrome is sexier to use for this use-case, I'm still using that website in Firefox because Chrome doesn't offer to save passwords for "ajax logins", a known limitation.

But either way, I end up using both. I'm using Chrome for apps (e.g. I prefer to access Facebook and Twitter through Chrome, as it's better for privacy and I don't want notifications and all that crap). I'm using Firefox for browsing, as the default.

Here are some reasons for why I like it ... it has the Awesome Bar (e.g. much better search capabilities in your own history), it has the Reader View + Reading List (i.e. I don't need Pocket or Readability, although if you like Pocket, then it has the best integration available), it has AdBlock Plus, uBlock and an alpha but functional version of NoScript and really, many websites are simply unusable on mobile without an ad blocker.

On Chromecast support, I don't know about the desktop, but if it's not supported on Firefox desktop already, then it will probably be supported pretty soon. Other mobile features have leaked into the desktop version as well, for example Reader View.

<comment><USER4> Ah, none of the tab stuff or app-saving from Chrome are features I would use. And I believe my phone just supports Chromecast screen sharing at the OS level (alongside DLNA and Miracast). Is that an addition from Sony that isn't in stock Android?

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> It's worth mentioning that getting Servo to build and run on OS X is very straight forward and worked for me the first time.

Here is the github repo: [https://github.com/servo/servo](https://github.com/servo/servo)

Here is this HackerNews thread rendered in Servo: [http://i.imgur.com/6yvrr3V.png](http://i.imgur.com/6yvrr3V.png)

<comment><AUTHOR> You should also try [https://github.com/glennw/servo- shell](https://github.com/glennw/servo-shell) (it's a webpage, and you don't need to rebuild servo or anything though building it in release mode is preferred), which gives you a browser experience.

</comment></comment><comment><USER6> > servo = !!dlsym(NULL, "servo_test");

I just cry when I see something like this.

<comment><USER7> May I ask why? It doesn't look quite terrible to me (as much as I can judge out of context).

<comment><USER6> It doesn't express the real intention of the code.

Uses C implicit conversions between pointers, integral and boolean operators for something that would be clearly better expressed with an if ().

This type of code wouldn't survive the type of code reviews I used to do.

<comment><USER8> except it is actually fairly common and once you have seen it once it is really clear.

<comment><USER6> Fairly common by developers that don't have to maintain code from others.

Clarity trumps clever tricks.

EDIT: To make it clear, if I am reviewing someone's C code, I'll be applying MISRA and Code Complete style rules.

<comment><USER8> I first saw this trick in the qemu source code.

<comment><USER6> So what?! How is qemu an example of C code quality?

<comment><USER8> I didn't say it was quality, but it is someone else's.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I'm just hoping someone will create a new Electron (used in Atom), but based on Servo instead of Chromium.

<comment><USER10> I wonder if Electron will evolve to permit different engines? blink, Edge?, servo? Whilst this offers options, my concern would be over complicating Electron with a plethora of abstractions some of which maybe leaky as engines innovate and diverge.

<comment><USER11> Wouldn't Microsoft have interest in doing that, though, for Visual Studio Code?

<comment><USER10> Perhaps. Or perhaps they're satisfied that the Chromium engine is sufficient. As I understand it the goal of Visual Studio Code is to be cross platform and bring .NET to a wider audience. The engine is immaterial? WE shall see though. Perhaps Full Fat Windows only Visual Studio will borrow from Visual Studio Code and require a different engine, to play nice with Direct X, or other Windows proprietary tech?

</comment></comment></comment></comment><comment><USER12> How will developer tools work with servo? A plugin?

<comment><USER13> Servo currently has a (partial) implementation of the Firefox developer tools protocol. This means that you can use Firefox devtools to inspect a servo instance in the same way that you would a mobile device.

In the long term if and when Servo is incorporated into actual products this story will likely change somewhat.</comment></comment>


GNU make insanity: finding the value of the -j parameter - <AUTHOR> http://blog.jgc.org/2015/03/gnu-make-insanity-finding-value-of-j.html <comment><USER2> I don't know how many hours the author has spent/wasted on this topic (and how many people are now wasting their time coming up with other solutions that in the end do NOT fix the real problem), but...

Quite frankly, I find this whole "look i did a horrible hack and let's see who can make the best worst horrible hack" thing quite stupid and silly.

GNU Make is free software released under a free license, my opinion is that instead of doing that crazy thing, the author could have just written a patch for GNU Make in order to make it export a "JOBS" environment variable to all its child processes.

Oh but yes, "I felt this feature was missing so I added it" is way way way less cool than "geez the gnu make folks are insane lollerplex they have no way to know how many jobs they're running".

ALSO: [http://www.catb.org/esr/faqs/hacker- howto.html#believe2](http://www.catb.org/esr/faqs/hacker-howto.html#believe2)

Here it is a patched version of GNU Make, providing a #J variable that holds the number of jobs as passed via -j/\--jobs:

        http://santoro.tk/~manu/gnumake.png

As can be seen in the screenshot, it can be passed as environment variable to programs called by make

Source: [https://github.com/esantoro/make](https://github.com/esantoro/make)

<comment><USER3>
        > I don't know how many hours the author has spent/wasted
        > on this topic

The author, John Graham-Cumming, has been extremely active on the GNU Make mailing list, is the author of the "GNU Make Standard Library" of supplemental functions for Make, has written at least 2 books on GNU Make, and has developed commercial products that integrate with GNU Make (namely, "Electric Make").

That is to say: He is one of the world experts on GNU Make.

I'm confident that he did this more "for fun" than because he actually wanted to get the number of jobs.

<comment><AUTHOR> Yes. It was 'for fun'. Someone at CloudFlare asked me how to get the value of -j and I figured there must be _some_ way :-)

<comment><USER4> Do you know if this person hangs out in IRC? I asked this precise question 10 days ago in #emacs, and I was curious to see my precise question answered, almost the way I phrased it.

<comment><AUTHOR> Too funny. I think it's just random chance. Although he is an emacs user.

</comment></comment></comment></comment></comment><comment><USER5> Those who don't learn make are doomed to reimplement it. Poorly.

Also: never, ever, build a make system that relies on recursive make invocations.

Automake is a particularly egregious violator is this rule (and other sanity rules) and has probably hurt make more than anything else.

<comment><USER6> Someone should implement make without the silly tabs.

<comment><USER7> And I thought I was the only one burned by this ;)

<comment><USER8> At least every 2nd C programmer working on a non-unix platform has been burned by this at least once. It's like a 10ft deep pothole on Broadway that won't get fixed because traditionalists see it as a 'national monument'.

</comment></comment></comment></comment><comment><USER9> Okay, I'll bite. This is my attempt at it:

\</comment><comment></comment><comment></comment><comment>----

PID := $(shell cat /proc/$$$$/status | grep PPid | awk '{print $$2}')

JOBS := $(shell ps -p ${PID} -f | tail -n1 | grep -oP '\\-j *\d+' | sed 's/-j//')

ifeq "${JOBS}" ""

JOBS := 1

endif

all:

echo ${JOBS}

\</comment><comment></comment><comment></comment><comment>----

quanticles@glados $ make -j8

8

quanticles@glados $ make

1

\</comment><comment>----

edit: for silly mistake

<comment><USER10> Note: you can forego the ps and simply read /proc/$PID/cmdline, which is a \0-delimited list of strings. So,

        grep -oP '\-j\x00\d+' /proc/$PID/cmdline

Edit: and no need for sed when a simple cut -b4- does the same job.

<comment><USER11> Does that work on anything other than Linux?

<comment><USER12> Not in exactly the same way, but every unixy system has some way of finding the parent pid and looking up its command line.

<comment><USER11> Is Quanticles's code portable to the other unix systems?

<comment><USER12> It should work on most systems that have a /proc filesystem: [http://en.wikipedia.org/wiki/Procfs](http://en.wikipedia.org/wiki/Procfs)

If you don't have /proc but do have ps (1), you could get the parent pid like this:

        PID := $(ps -p $$$$ -o ppid=)

</comment></comment></comment></comment></comment></comment><comment><USER13> It's an amusing exercise, but for actual practical use, the right solution is to share make's jobserver. If you have a build rule that wants to run multiple things in parallel, put + in front of the command, and then your command will receive the file descriptors for the jobserver pipe on the command line. Then, when you want to start a parallel job, do a blocking read of a byte from the read fd, and when you're done with that job, write a byte to the write fd.

<comment><USER14> This does not generalize to arbitrary purposes. If you just want to detect that the user has run more jobs than your build system can possibly benefit from and print a warning, there is no reason to start messing with the jobserver. This is not the Ockham solution :)

<comment><USER13> Why print such a warning? For most projects, make -j65536 will be effectively equivalent to make -j, both of which are perfectly fine. Suppose you're on a system with more CPUs than you have build rules in your build system; you shouldn't print a warning just because someone does make -j$(nproc).

</comment></comment></comment><comment><USER15> Carp all you want about make, I'll take it over any of its ostensible "replacements".

<comment><USER16> I don't think anyone has a problem with make. The thing you need to replace is autotools.

<comment><USER17> As crufty as autotools is, nothing comes close to being a more robust build system. It does everything. Learning to use the autotools is difficult, but what's most frustrating is trying to build software that uses clever Makefiles with a bunch of hardcoded assumptions about the platform you are building on that you have to hack to get to work.

<comment><USER18> "As crufty as autotools is, nothing comes close to being a more robust build system."

.. CMake? [http://www.cmake.org/](http://www.cmake.org/)

<comment><USER19> I wish this were true. Getting cmake to do something off the wall like building static executable binaries is...frustrating.

I had high hopes for scons, but that turned into a quagmire. Any build system that's going to unseat autotools will need to obviate the need for almost all custom scripts. AKA, specify the 'what', and let the user apply a 'recipe' for the 'how'. Or something...if I knew what it was supposed to look like I'd build it.

<comment><USER20> Out of curiosity, what are the quagmire-ish aspects of scons? I've been using it for a while, and it hasn't seemed too bad, which probably means that I haven't run into them yet.

<comment><USER19> Scons itself isn't bad, but it's power is also it's downfall: the build script is an unrestricted Python file. I almost always find that something 'clever' has been stashed in the SConscript. Plus, everybody writes wrapper functions for the env.* stuff - meaning just about every project has a second, hidden codebase that you need to learn first.

<comment><USER20> Ah, got it. I'll admit that I tend to make build scripts that are a bit too complicated, due to the freedom of having a full language, but it is quite nice to have when needed. It does end up with build scripts that are far more flexible, though, not having read build scripts that others have written, I don't know how much of a cost there is to it.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> i think the true insanity lies within the mind of the developer whose build system depends on the number of jobs being ran in parallel..!

interesting academic exercise though. unless i'm mistaken, this will only detect up to 32 build jobs? i'd hate to see the Makefile that works for arbitrary values..

<comment><USER14> It makes some sense to want to know this. You might know that your build process doesn't benefit from more than 4 jobs, and want to alert this to the developer who tries to use more.

<comment><USER15> Not all problems need a solution in code.

<comment><USER22> Awesome! This goes in my fortune file :D

</comment></comment></comment></comment><comment><USER23> Reading this only pops one question: What is the best replacement of make in 2015? :)

<comment> vezzy-fnord tup [1], redo [2] and ninja [3] are probably the build systems with the most potential.

redo is the simplest, which is unsurprising given that it was originally proposed by djb. Alternatively, you could look into mk, which is the make replacement used by Plan 9, Inferno and derivatives.

[1] [http://gittup.org/tup/](http://gittup.org/tup/)

[2] [http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/int...](http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/introduction- to-redo.html)

[3] [https://martine.github.io/ninja/](https://martine.github.io/ninja/)

<comment><USER23> Are any of these cross-platform like make?

<comment><USER22> mk has been ported to UNIX-likes, see plan9port.

<comment><USER24> mk originated on Unix, and so did almost everything else in Plan 9.

</comment></comment></comment></comment></comment><comment><USER25> I need more information as to why it's required to get the value of that parameter. Can't it be simultaneously be passed in as an environment variable?

<comment><USER26> There is no reason your makefile should ever depend on the parallelism level, with the possible exception of requiring no parallelism at all (i.e. "-j1"). That's why make doesn't bother to expose it. This little hack is just for fun.

<comment><USER4> I was the one who asked the original question. My purpose was so that Mercurial's test suite could specify the amount of parallelism from the Makefile. The "test" rule in the Makefile invokes "run-tests.py". This latter script itself accepts a -j option. It's possible to invoke it directly, but this misses the second part of the "test" rule in the Makefile, which executes some tests that run-tests.py can't do.

</comment></comment></comment><comment><USER14> This probably won't work if you just pass -j. If I needed to solve this problem, I would have just grepped the output of `ps' to get the make invocation. If I wasn't sure which invocation was correct, I would have used heuristics like the output of `pstree' to figure it out.

<comment><USER27> I would think a process launched by make can easily obtain the process ID of its parent process. If so, no heuristics are needed to find the correct instance of make.

On the other hand, reading the command line isn't sufficient. The _-j_ argument does not require a job count, defaulting to "as many as possible".

Also, you would have to check your OS, too since the -j argument is ignored on MS-DOS ([https://www.gnu.org/software/make/manual/make.html#Options-S...](https://www.gnu.org/software/make/manual/make.html#Options- Summary))

</comment></comment><comment><USER28> For FreeBSD users: FreeBSD's make provides the value of -j through ${.MAKE.JOBS}

</comment><comment><USER29> The real insanity with make is that it has no interface to check whether a Makefile contains a given target.

Best you can do is to run make -n target to probe, but it's possible to write Makefiles that run code even though -n is used, which will defeat such probes at distribution scale. It quickly becomes an exercise in heuristics and output parsing.

<comment><USER14> Write a target that greps the Makefile itself and extracts the targets.

<comment><USER30> As shown in the post, targets are not always grep-able. The post's makefile contained the target "par-30" even though that string appears nowhere on the page or in the makefile.

You need to write a full parser to discover all the targets.

<comment><USER31>
        $ make -pqrf <(curl https://gist.githubusercontent.com/jgrahamc/2cc6df7fd5cd61c4d93f/raw/parallel) | grep '^[^ ]*:' | cut -d : -f 1
        par-%
        par-22
        par-30
        par-5
        par-27
        par-31
        all
        FORCE
        /proc/self/fd/13
        par-13
        par-9
        par-23
        par-19
        .SUFFIXES
        par-15
        par-7
        parallel
        par-29
        par-28
        .parallel
        par-4
        par-25
        par-6
        par-14
        .DEFAULT
        par-24
        par-0
        par
        par-1
        par-10
        par-16
        par-2
        par-11
        par-17
        par-20
        par-8
        par-21
        par-12
        par-26
        par-18
        par-3

<comment><USER30> Right, you used 'make' as the parser. He said "grep the makefile". You're not grepping the makefile. Nice solution though!

<comment><USER31> > You need to write a full parser to discover all the targets.

I don't think grep '^[^ ]*:' really counts as writing a parser.

<comment><USER30> Running "make -p" is running a full parser which someone else wrote. Grep is not extracting the targets from a makefile there, it's extracting the targets from an intermediate representation of a makefile.

<comment><USER31> > The real insanity with make is that it has no interface to check whether a > Makefile contains a given target.

>

> Best you can do is to run make -n target to probe, but it's possible to > write Makefiles that run code even though -n is used, which will defeat such > probes at distribution scale. It quickly becomes an exercise in heuristics > and output parsing.

<comment><USER30> We're arguing different things.

The comment I replied to, chaosfactors, specifically specified grepping the makefile. You're arguing that you can find all the targets and I never said you can't. I simply said you can't find them all by only grepping the makefile.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER32> If you change the maximum value (I put 1024) on line 10 it prints:

319 on Mac OS X 10.8

337 on Centos 6

</comment><comment><USER33> On a semi-related note... do any of the make gurus out there know if there's anything similar to "-j" that instead sends parallel jobs off to a cluster, e.g. Sun Grid?

<comment><USER34> That wouldn't be appropriate as a specialized component of make. You could write a script that sends a command off to a cluster and just set

        CC=script/send_to_cluster gcc

Then specify the number of jobs you'd like to run simultaneously on your cluster with the "-j" flag.

<comment><USER33> Thanks for the thought. That sounds fine for simple compiler makefiles, although I'm using it for general purpose work (data analysis and visualization). I'm hoping for something that wouldn't require each command to be wrapped up, as there are many.

<comment><USER35> For that sort of thing, maybe roll your own script using something like Fabric ([http://www.fabfile.org/](http://www.fabfile.org/)) for doing all the communication with the remote hosts?

<comment><USER33> Thanks, I'll check it out

</comment></comment></comment></comment></comment><comment><USER36> GNU make is free software. If you are a capable programmer, you can make a change and send a patch.

</comment><comment><USER37> Why do you need to know the value of the -j parameter in a makefile?

<comment><USER18> It will reduce total compile times for large projects by running make in parallel. Files dont compile faster, but make will act (compile) on N files at the same time together.

<comment><USER7> I didn't downvote you, but I assume why it happened: What you wrote is correct, but does not answer the question.</comment></comment></comment>


Ransomware as a Service - <AUTHOR> https://isc.sans.edu/forums/diary/Ransomware+as+a+Service/23277/ <comment><USER2> >Communications with the C2 server are performed via HTTPS: kdvm5fd6tn6jsbwh[.]onion[.]to (185[.]100[.]85[.]150) located in Romania.

That's just a tor tunnel, IP and location doesn't matter.

<comment><USER3> They also posted a bunch of hashes for a file which was customized for them, and then remarked that virustotal hadn't seen it.

Though it does make me think that it would be a good trick to offer this 'service', but then keep all the proceeds (everyone gets the same ransomware download). Maybe less profitable on the long term though.

<comment><USER4> > They also posted a bunch of hashes for a file which was customized for them, > and then remarked that virustotal hadn't seen it.

Surely antivirus are not just trying to match the SHA1 of executables with SHA1 of known virus/malware, otherwise it would be trivial to bypass them.

<comment><USER5> No, AV has capabilities much more sophisticated then that, however from what I understand, within the malware analysis community specific samples are generally identified with their hash. In addition, if the hash of a file is known-bad, you can skip all the binary pattern matching and heuristics and stuff.

</comment></comment></comment></comment><comment><USER6> > "Based on the strings present in the PE file, it has been written in Go"

I find this kind of interesting. I've seen reports on other malware/virus stuff written in Go recently. I wonder if this is because the ability to cross compile with Go is pretty painless? Or is it because the language is fairly approachable but still allows you to dig a bit "deeper" if you need to?

<comment><USER7> Maybe it's a social reason and not a technical one… like, maybe Go is more popular in… some… country… and maybe that country happens to be over represented in… I mean, obviously not. Of course.

But maybe…

<comment><USER8> This sort of comment is pretty frustrating for people who don't already know what you're talking about. What are you trying to say?

<comment><USER9> [https://trends.google.com/trends/explore?q=golang#GEO_MAP](https://trends.google.com/trends/explore?q=golang#GEO_MAP)

<comment><USER6> That is very interesting, thanks for providing the link.

<comment><USER10> Keep in mind that you get the same results for python, javascript, Java, Kotlin and even lisp

<comment><USER11> Yep, you're right:

[https://trends.google.com/trends/explore?q=python#GEO_MAP](https://trends.google.com/trends/explore?q=python#GEO_MAP)

[https://trends.google.com/trends/explore?q=java#GEO_MAP](https://trends.google.com/trends/explore?q=java#GEO_MAP)

[https://trends.google.com/trends/explore?q=javascript#GEO_MA...](https://trends.google.com/trends/explore?q=javascript#GEO_MAP)

[https://trends.google.com/trends/explore?q=Kotlin#GEO_MAP](https://trends.google.com/trends/explore?q=Kotlin#GEO_MAP)

[https://trends.google.com/trends/explore?q=lisp#GEO_MAP](https://trends.google.com/trends/explore?q=lisp#GEO_MAP)

My guess is that:

1\. China blocks Google

2\. Technical users in China use VPN to circumvent said block, while non- technical users switch to something else

3\. Technical users search for programming language terms a lot

4\. Thus the normalized ratio of (programming language search queries) / (total search queries) is a lot higher in China compared to other countries where Google isn't blocked

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> > The business model behind the service is simple: the bad guys keep 10% of > the ransom.

Creating a ransomware is indeed not a very nice thing to do, but IMO the ones that deserve the most to be called "bad guys" are the ones that actually spread the binary (so, the ones that keep the other 90%)

<comment><USER13> They're all bad guys, brent.

<comment><USER14> Nooooooo........

We just like the marching, and the boots, and the hats.

</comment></comment></comment><comment><USER15> I find it somewhat ironic they include a captcha to protect against malicious users.

<comment><USER16> When you're evil, the first thing you lose is trust in everyone else. After all, if you can stab in the back, what stops others from stabbing you?

</comment></comment><comment><USER17> I'm waiting for something like this to take the form of an Ethereum smart contract.

<comment><USER18> Yes. Automated trading is going to bring about many terrifying things, unfortunately.

</comment></comment><comment><USER19> Interestingly it does not seem to be a new concept: [https://www.reddit.com/r/netsec/comments/37ko5v/introducing_...](https://www.reddit.com/r/netsec/comments/37ko5v/introducing_raas_ransomware_as_a_service/) [https://securingtomorrow.mcafee.com/mcafee-labs/meet-tox- ran...](https://securingtomorrow.mcafee.com/mcafee-labs/meet-tox-ransomware- for-the-rest-of-us)

They used to take 20% 'commission'.</comment>


Google ran out of instances on App engine? - <AUTHOR> Our instance count dropped to 0.
Deploying the new version of the app isn't helping either.
Instance count is still at zero. <comment><USER2> Using flex or standard environment?</comment>


Solve the right problem - <AUTHOR> http://www.neilmix.com/2009/11/15/solve-the-right-problem/

<comment><USER2> I like this because it breaks binary, false dichotomies that developers usually put themselves in. We can understand why we do this - and its because things are usually right or wrong, one or zero. We usually end up getting it right in the end and thus the "geekgo" (geek-ego).

The tone of this article is great - yes the app store process probably isn't the greatest but it serves its purpose and what can we do to change it beyond opening it up completely to make 'everyone' happy?

Maybe in the future a developer will have to prove themselves worthy of being above the slow, error prone approval process by demonstrating a history of thought through code drops and minimal bugs.

Maybe the current process is suppose to give developers an incentive to get it as close to "right" as they can the first time.

</comment><comment><USER3> how can they have numbers on a counter factual (loosen up review app -> more revenue)?

<comment><USER4> They don't need them. If you were making as much money as Apple, would you rock the boat?

<comment><AUTHOR> Well, Apple does have a culture of replacing a good thing with an even better thing (e.g., they killed the iPod mini when it was still the most top music player on the market, to replace it with the iPod nano). But more importantly, they're in a position where they can set their own schedule for decision- making. They can take a good long time to think about (or test) changes internally before making them public.

</comment></comment></comment><comment><USER5> The is really another anti-anti-iPhone appstore article.</comment>


Ask HN: Consult a lawyer/accountant? - <AUTHOR> All along the forums, and here on HN, the terminal advice is always, "consult a lawyer/accountant". This seems to be advice given, but what exactly does that mean? How does one "consult" a lawyer for their project? How does one learn how to contract a lawyer for consultations?<p>Why isn't there a public resource that can put people in the right direction? <comment><USER2> > "contract a lawyer for consultations."

This is a strikingly formal mental idea of how professional relationships begin. It's not quite so formal. You can ponder about "contracting a doctor for consultations," but most people just say "go to the doctor."

When people say "consult with a lawyer," they typically mean you should ask a lawyer for professional advice about this situation. If you don't have a relationship already, you would typically call their office and set an initial appointment of 30 to 60 minutes. If you know you have a problem, you should expect to receive legal advice during that appointment, and to pay something for it.

Yes, some lawyers offer free consultations -- typically lawyers who work on contingent fees. They are paid out of a substantial recovery, and offer to talk to people who are unsure their injury is worth pursuing legal action. If your legal situation doesn't involve a lump sum recovery, you should expect to pay for the time spent by the lawyer unless you have some other agreement (flat fee, etc.)

Still, most of the lawyers I know are willing to write off some time so that the potential client can decide whether to engage the lawyer for further advice. It is perfectly acceptable to tell the receptionist or lawyer that you're considering several people, and would like to talk about whether this lawyer or firm has relevant experience. But understand you're unlikely to receive much legal advice during that kind of meeting.

</comment><comment><USER3> You can find lawyers in the phone book or with a search engine. They usually take out advertisements indicating their specialty -- business law and/or contracts is generally what you want. Call one up and ask for an appointment.

Typically, the initial interview is to find out if you've found an appropriate lawyer and if they have the time to sell to you. If either of these things are misaligned, the lawyer will almost certainly offer you a referral to another lawyer who is more appropriate or available for you.

After a successful interview, you generally pay some money as a retainer. It may or may not be applied to your billed hours.

A business lawyer's function is to tell you how to accomplish your goals without violating laws, or that your goals are fundamentally illegal, or how to accomplish a goal in a law-abiding fashion that will minimize legal risk. If you are about to enter into a contract, a lawyer will review it for you and point out areas of higher risk, and possibly suggest ways to mitigate those risks. If you have a particular intention for the contract, the lawyer will help your phrase it so that a court of law will understand what you are intending.

Almost all of the above is true for accountants, as well, except that instead of advising you on legal matters, they will advise you on accounting matters (which have a strong overlap with legal matters). Accountants figure out which paperwork you need to file, and can complete most of it for you.

</comment><comment><USER4> Great lawyers who know this (startups, consultancies, M&A, compensation, etc.) space well are few and far between, especially if you don't want to work with a giant firm. A good specialist will take your call to discuss your situation and present some options for you, though.

Call Gabe: [https://groundworklegal.com/](https://groundworklegal.com/)

</comment><comment><USER5> You might actually have to pick up a phone and call someone. The horror!

<comment><AUTHOR> Hey, even though you might be trolling let me be clear. I've called an accountant. But how am I supposed to know if he actually knows what he's doing?

<comment><USER5> Call a couple. Ask some questions about their experience working with startups / dealing with your particular situation. Make a judgment call once you've talked to a few. Or get a recommendation from someone you trust.</comment></comment></comment>


Ask HN: What should I know before I invest fully in CSS grid? - <AUTHOR> I've been keeping my eye on CSS grid, paying attention to its benefits and advantages. From what I see, it will only make my life a lot easier. What should I know before I dive in and adjust my existing layouts to use CSS grid? <comment><USER2> If you have an existing site, then you have a really great advantage (versus building something new): existing site traffic and analytics!

Look at which browsers your users are actually using, and check [https://caniuse.com](https://caniuse.com) for which versions of which browsers support the new feature. Make a business decision on what percentage of visitors you're okay with getting a page without a nice layout.

If the number of visitors with non-supporting browsers is tiny, then go for it! But make sure at the very least your pages fall back to something where the content is visible and accessible... like make sure it is at least somewhat usable as a single-column list of things.

If the number of visitors with non-supporting browsers is higher than you're willing to lose out on, then still use CSS grid but spend more time on a fallback that looks okay (but doesn't have to be perfect). Perhaps this could be using flexbox (if your users are mostly on kind-of-new-but-not-super-old browsers), otherwise go old-school and use either floats or display:table. (I personally would go with display:table since it's the most grid-like... but depending on your layout it might fall apart under certain circumstances).

Key things to keep in mind are:

1) There are still plenty of people using browsers that don't support CSS Grid. But this may or may not be plenty of _YOUR_ users, so check your actual traffic.

2) You definitely want a fallback of some kind, but the fallback does NOT need to be exactly perfect! "Good enough" is probably good enough.

And hopefully in 3 or 4 years we can forget about a time when CSS didn't actually have any tools intended for page layout :)

</comment><comment><USER3> IE is the big hurdle. It can be done - Sascha Fuchs wrote some SASS mixins that take the place of IE's missing grid-gap, and I wrote a mixin recently to take the place of grid-autoflow. I'll publish it somewhere if anyone would find it useful.

<comment><USER4> I would love to see it (I think it will be more instructional than anything)

<comment><USER3> [https://gist.github.com/ksenzee/276d60f3e251b1dfafaf52ed8dbd...](https://gist.github.com/ksenzee/276d60f3e251b1dfafaf52ed8dbdb0de), which is based on mixins at [https://medium.com/@gisugosu/css-grid-layout- spec-2-to-spec-...](https://medium.com/@gisugosu/css-grid-layout-spec-2-to- spec-1-transpiler-with-sass-415dff4dd31b). The @gisugosu article lets you use named areas, which my gist doesn't support; my gist lets you use autoflow, which the mixins in the article don't support. If you're using both methods, you'll need a combination of the two.

</comment></comment></comment><comment><USER5> If you have to support IE - their implementation is different from the rest. And by different, I mean they are compliant with an earlier spec of CSS Grid. It is very likely not to work.

The evergreen browsers (chrome, ff, edge, safari, etc...) were well supported.

</comment><comment><USER6> To help keep up to date, follow Rachel Andrew on Twitter (@rachelandrew). She's behind the spec and usually posts lots of handy updates and tutorials. Her feed should provide some good resources.

<comment><USER7> I second that, she also has a great site full of examples and video tutorials with grid [https://gridbyexample.com](https://gridbyexample.com).

</comment></comment><comment><USER8> I have found it is really easy to create good fallbacks. If your content still makes sense when stacked vertically, you're good to go. (and it should make sense in this format, as screen-readers don't follow your grid)

This of it this way: If your mobile view is also your <IE11 view, you shouldn't have to do much overriding.

<comment><USER9> Could you elaborate on how you achieve this?

</comment></comment><comment><USER10> Support between browsers can be iffy. I had a grid implementation on cole.codes and it looked perfect on Chrome but disappeared entirely from Firefox. It wasn't supported at all in Safari at the time.

You will need fallbacks. Flexbox isn't going anywhere.

<comment><USER11> Flexbox is actually complementary to CSS grids: you use it to controller vertical/horizontal spacing within a cell.

</comment></comment><comment><USER12> I personally found that, without subgrid support yet, you really can't do many of the things that you'd logically want to use a grid for (e.g. aligning sub- elements of a modules with those of the same module in a row or column). I'd try doing a quick prototype to ensure that grid even is an improvement over flexbox for your specific use case.

</comment><comment><USER13> My biggest concern would be browser support. However, with many browsers on desktop and phone getting regular updates, this might be less of an issue than it use to be.

</comment><comment><USER14> If you need to support IE11 or older, it's probably a no-go. IE will claim that it's supported, but uses an older, obsolete and frankly useless implementation of the grid system.

</comment><comment><USER15> Don't waste three hours trying to create masonry layout.

<comment><USER7> Here's a masonry like layout with grid from Rachel Andrew [https://gridbyexample.com/video/series-auto-placement- span/](https://gridbyexample.com/video/series-auto-placement-span/).

</comment></comment><comment><USER16> grid fights with other css. For instance, shading every other row of a grid has to be done on each cell, not on a row, and becomes problematic if you set css order, or if you fill a row with fewer columns, etc.</comment>


Ask HN: Lisp interactive tutorials? - <AUTHOR>

Hi, i was wondering if there are any interactive lisp tutorials like rubymonk or codecademy style tutoral/lesson based primers for the LISP language. <comment><USER2> For Common Lisp, Google has a set of Lisp Koans hosted on Github: [https://github.com/google/lisp-koans](https://github.com/google/lisp-koans)

</comment><comment><AUTHOR> this is absolutely perfect. thank you</comment>