Ask HN: Web Frameworks for Perl - <AUTHOR>

Have any of you Perl programmers out there used Catalyst as a framework?  What do you like and dislike about it?  Any other frameworks you would recommend?<p>Most of the Perl programming I've done has just been gluing together modules like CGI and DBI on my own.  I've thought about using a formal framework, and Catalyst seems to be the Perl framework of choice. <comment><USER2> I've really enjoyed Catalyst when working with it in the past. I used it extensively at my previous job, and for a few personal projects.

I really like the extensibility of Catalyst. It's a very Perlish framework. It's not opinionated. There are many ways to do things, and if something doesn't work how you want it to, you can easily write a module to do it yourself. It's designed to be an extensible framework, instead of all-in-one, as many others are. For example, it was trivial to get all the appropriate ORM magic working with my existing databases with DBIx::Class. Catalyst really does keep models, views, and controllers separate. In many other frameworks I've looked at, there are things as absurd as requirements on how your DB tables are named.

Another amazing web framework for Perl that doesn't get much media attention is Jifty. Jifty is absurdly powerful and has scary dark magic, but it's negligibly documented. Jifty is really my choice for all-in-one perl web framework. It does everything for you, and then some. One feature that impressed me is that you can describe your dynamic actions in perl code, and Jifty will automatically fall back to loading a new page with the modification if your browser doesn't support javascript, but will do inplace dynamic updates if you do. Graceful degradation built in. I can competently use all of my Jifty apps from elinks or my old treo. It's still rather opinionated, though.

</comment><comment><USER3> Catalyst is certainly numero uno in the Perl web framework world. Here's a list from the Perl5 wiki... <http://www.perlfoundation.org/perl5/index.cgi?web_frameworks>

Don't think u can go wrong with any of the established ones on that list. However two new kids on the block thats worth casting your eyes over are Squatting (<http://search.cpan.org/dist/Squatting/>) and Mojolicious (<http://mojolicious.org/>).

I'm currently enjoying using/playing with Squatting. Its a Microframework (inspired by Camping by _why) and you may find it a good first step from CGI apps.

/I3az/

</comment><comment><USER4> I haven't seen Mason (<http://www.masonhq.com/>) mentioned yet. I was hoping someone else would mention it because I don't feel I can properly represent it. I only played around with it; nothing substantial. But I liked it (for what that's worth).

You'll see some names here of sites that use it that you'll recognize: <http://www.masonhq.com/?MasonPoweredSites> (Amazon.com being one of the most notable).

<comment><USER5> And of course you can use Mason with Catalyst: <http://search.cpan.org/perldoc?Catalyst::View::Mason>

In this scope it's just another view like <http://search.cpan.org/perldoc?Catalyst::View::TT> , <http://search.cpan.org/perldoc?Catalyst::View::XSLT> or others <http://search.cpan.org/search?query=Catalyst::View:>:

</comment></comment><comment><USER6> Recent post on this I bookrmarked: [http://perlbuzz.com/2008/11/the-evolution- of-perl-frameworks...](http://perlbuzz.com/2008/11/the-evolution-of-perl- frameworks.html)

Personally, I also glue together CGI, DBI, etc., and I have no desire to use a framework. Why do you? Is something in particular cumbersome?

<comment><AUTHOR> I'm developing a data analysis & visualization tool. I'm starting to really wish there was a nice way to separate out the math/statistical logic that I'm using on the backend from the logic I use to display the results in a pretty way.

<comment><USER7> Catalyst is an ideal candidate for you for this. The Controller and View code is very much separated from the Model code that you want, and agnostic to the framework code. I'm writing some text mining stuff at the moment, and Catalyst is what I'm using to keep web application logic and problem-domain logic well separated from each other. This (hopefully) makes everything much more maintainable.

</comment></comment></comment><comment><USER8> I've used Catalyst in the past, now at work I am stuck with CGI::Application and it seems rather OK, but still a little step back. At least in Catalyst it is natural to have multiple classes (each for one controller) - while the app being developed here ended up as one huge application class.

But really the more imporatant part of the decision is what templating and ORM to use. I have a blog post on that: <http://perlalchemy.blogspot.com/2008/10/progress.html> .

</comment><comment><USER9> From my (admitedly limited) web frameworks experience (django, grails and catayst), catalyst indeed shines by the extreme level of freedom in the choice it leaves up to you. If you're willing to invest the time necessary, it is indeed a great way to get separation of concerns without commiting to a specific way of programming your webapps. If you're used to glueing together modules in your apps, you should fit right in.

</comment><comment><USER10> Sites using Catalyst: <http://www.catalystsites.org/sites/all> and <http://dev.catalyst.perl.org/wiki/SitesRunningCatalyst>

</comment><comment><USER5> All of our recent projects use Catalyst (commercial and personal). The best thing is that it prevents us to repeat each and every simple functionality that we previously had to write with CGI or CGI::Simple. We can totally concentrate on the actual work we want to do without spending much time on groundwork.

From time to time we factor out common code into modules on top of Catalyst. Everything else is just application code.

Catalyst is super nice for fast development and/or prototyping of web applications and has all the flexibility you need.

</comment><comment><USER11> It's probably not even considered a framework, but I had done a lot of web programming a while ago and I loved the Template Toolkit <http://template- toolkit.org/>

</comment><comment><USER12> I don't use Perl but one of my favorite sites (jisho.org) use Catalyst.

<comment><USER13> Yeah, I don't use much Perl, but the only not-legacy framework I ever hear about for Perl is Catalyst (<http://www.catalystframework.org/>)

</comment></comment><comment><USER14> Slashcode uses <http://www.slashcode.com/docs/INSTALL.html#requirements>

</comment><comment><USER15> Catalyst and CGI::Application (or Titanium) are pretty much where it's at with perl web development. CGI.pm is a relic at this point. There are better, smaller, faster core CGI modules if that's all you want. Likewise, consider using a more modern wrapper like SQL::Abstract rather than straight-up DBI.

Catalyst has a somewhat steep learning curve and perhaps invites you to waste time evaluating alternative modules for functionality. It's not "opinionated" and you can choose very different subsystems to get the same job done. The upside is that Catalyst is probably the most powerful web framework out there. DBIx::Class is the most feature-full ORM out there, for one point (trounces ActiveRecord).

Titanium is much, much simpler and has the advantages that entails. You'll be up and running with Titanium in a day. It's a better option for the rare/occasional web app developer (like me).

<comment><USER16> Agreed, Titanium seems really useful. It bundles a lot of the modules that I usually use with CGI::Application and is logically put together.

I have about 12 years of Perl CGI stuff for different projects (most of which is still running) but I started to feel geek envy a few years ago when the world decided that you were not cool without AJAX. I looked into Java EE and realized I just was not an "enterprise" person and then at the different PHP frameworks before doing by first Rails app using Hobo. I have to say that was remarkably fun and easy to put together but I'm still not completely happy about having to run a cluster of mongrels and having to coordinate them with Apache. (That might not be the cool way to deploy Rails apps now, mea culpa.)

CGI::Appplication and Titanium (including modules like HTML::Template and HTML::FillInForm) are simple to use, work with all of the authentication stuff that I interface with, and scale perfectly for the number of users that I typically have.

</comment></comment><comment><USER17> concur: catalyst gets the job done.

I'm using a homebrew haskell framework now, happs with StringTemplate for the view.

</comment><comment><USER18> if you're looking to do any perl development, use: strawberry perl and perl moose.

<http://strawberryperl.com/> <http://search.cpan.org/~drolsky/Moose-0.61/lib/Moose.pm>

forget catalyst at least for a little while. perl moose makes oop perl a little bit easier, however it should go without saying; understand perl oop first.

<http://www.p3rl.org/OOP>

if you're using perl cgi and dbi, these are two the best modules written i think. lots to learn in there, keep looking.

<comment><USER15> > forget catalyst at least for a little while

Uh, why?

> using perl cgi and dbi, these are two the best modules written i think

No. CGI.pm is universally regarded as bloated.

<comment><USER18> Oh why, b/c obviously as someone mentioned before it has a steep learning curve. Who cares about the "bloat" or whatever you think is wrong with it. my $p = CGI->new is elegantly simple whatever method you're calling. it's opinion dur!

<comment><USER6> CGI::Simple</comment></comment></comment></comment>


Ask HN: Are you interested in "reading" podcasts? - <AUTHOR> I am an avid podcast listener. I do a lot of freelance translation as well (english to french). I was wondering if people found value in reading translated transcription of famous podcasts. If yes, are you willing to pay for it? Thanks. <comment><USER2> Forget translated, I'm just interested in reading transcripts.

I find the podcast culture incredibly frustrating. There's so much great discussion and information being shared, but in order to absorb it I either have to multi-task (aka ruin both tasks) or take a truly ridiculous amount of time per podcast compared with my reading speed.

I get that they're great for people with commutes or people who like running / walking and listening as a form of exercise, but I don't fit into either of those camps.

So just a podcast transcription service would be something I'd pay for!

<comment><USER3> I have a similar problem. I can't listen to podcasts while doing anything important and I don't have a long commute. However, I've found that listening to news podcasts at an extremely low volume immediately before sleeping to be useful. This allows me to listen to the podcast if I concentrate, and zone out and fall asleep if I don't.

</comment></comment><comment><USER4> Here's something I thought about recently for English speaking people who want to learn French:

Sharing a screencast of me browsing the French side of the internet. Many people don't pick up a new language because they think it's difficult, but in this case they'd be able to connect a written word (since it's a screen-cast) to a pronunciation. They'd also see how many words are shared and just pronounced differently, etc. (I'd be explaining what I'm reading).

They'd also see where I go when "I stumble on a word I don't understand", what I type into Google to get the information, etc.

Think lemonde.fr, latribune.fr, lesechos.fr. Mainly Politics/Economics, but one can also find "lighter" stuff for people to learn idioms and expressions.

</comment><comment><USER5> I think having samples would get more accurate feedback...I don't know enough about French language podcasts to make an informed guess. I also think targeting institutions rather than individuals is a better gauge of the potential market. If there are people who would value such a service, those people probably cluster.

Good luck.

</comment><comment><USER6> Not really. It's not exactly a "need" for me -- generally I can get insights off the podcast just by listening to it.

A close analogy would be a radio show -- no one over teh course of a few decades has ever paid for a transcribed radio show

</comment><comment><USER7> I wouldn't find enough value in this to pay.

The podcasts I listen to have "show notes" and many of them are beginning to post a "table of contents" for each episode, eg "Discussion about $foo, 2:57."

Just my two cents

</comment><comment><USER8> I listen to podcasts besause have no time for reading , not other way around.

</comment><comment><USER9> I never heard podcasts, i would actually prefer to read them

</comment><comment><USER10> I would not pay, but I would really like some written podcasts, simply because I can read faster.</comment>


TSA randomly took over and searched an Amtrak station in February - <AUTHOR> http://cs.trains.com/TRCCS/forums/p/188504/2059127.aspx#2059120

<comment><AUTHOR> _[the TSA] has been far more active than imagined. Teams have searched bus passengers all over the country, have done similar things at train stations, and have even blocked traffic on bridges to search trucks and cars._</comment>


Explanation of DAICOs - <AUTHOR> https://ethresear.ch/t/explanation-of-daicos/465 <comment><USER2> So that 51% attack seems pretty critical if you don't know who owns the coins:

"Dishonest" developers could start with 100% of coin and then sell 49% of coins. As long as the developers retain 51% they can control the entire voting process.

This makes me think you should have a clear accounting of real people to each coin for something like this to work. Otherwise you're vulnerable to devs using shells to scam or bribing holders to increase tap. You're better off cutting out the middle man and just sending your coins to the "honest" developer directly because you really don't have any recourse when that happens.

Vitalik's assumption that developers will always be "honest" seems kind of silly because if developers are always honest what's the point of this complicated system he's set up? Might as well just give funds away to our "honest" developers' address.

<comment><USER3> In the boring fusty old world of law, where the past lives but still somehow operates pretty well, there are two concepts that render this tractable.

The first is process serving. To start a lawsuit you need to be able to identify and notify the other party (except in _very_ special circumstances). If you transact with anonymous counterparties, you won't get much help from the courts.

The second is a nexus. Basically, it's something the court has the authority to reach out and grab. It might be property, a passport, a right, money, accounts, whatever. So long as the court can make an order and someone, somewhere will enforce it, there's a nexus. Without a nexus a court's order is just warm paper. Wave it all you like, the other guy won't feel any heat.

If you don't have a nexus -- if trust and authority is totally distributed, relying on code you hope is the first bug-free code you've ever written in your life -- then it's pretty hard to go from starting a dispute to receiving compensation or enforcing retribution.

Distributing trust sounds really cool, but it turns out that the unit economics suck. There are economies of scale involved for both malicious actors and those who want to punish them. In the current ecosystem, the adversaries are few and their interests highly concentrated. The defenders are many, widely dispersed and poorly able to coordinate their efforts. This is the sort of situation centralised trust is much better at sorting out.

I am of course not a lawyer and nothing here is not legal advice.

<comment><USER3> I should add that there's one area where blockchain systems have a pretty strong advantage: establishing a sequence of events.

Court cases often come down to who had the better evidence. If you sue me saying you never approved something, but I have meeting minutes showing otherwise, then I am more less going to win by default. Likewise if I say you never had authority to withdraw money from the company account, but you can produce a copy of an authority letter held by the bank with your name on it, you win.

Blockchain promises to shortcut a lot of evidentiary stuff, which is a win. That's why there are so many banks interested in distributed ledgers, title registries, supply chain custody and so on.

<comment><USER4> All that a blockchain does is establish a sequence of events. It doesn't have to be a sequence of state transitions, it just usually has been.

<comment><USER3> I don't really follow what you're saying, but I assume you're pointing out an implication I've missed.

</comment></comment></comment></comment></comment><comment><USER5> I really don't understand why people, especially from cryptocurrencies, are stuck up on the fact that "Game Theory" can explain everything. Human nature is fickle. Things can happen which are beyond the coded game theory assumptions, especially when everyone is aware of the rules.

One of the biggest assumptions which has always been made is on the miner's side. They can't attack the network because 51% stops it. But that has proven wrong when F2pool manipulated the Status ICO:

[https://steemit.com/ethereum/@dhumphrey/f2pool- manipulates-u...](https://steemit.com/ethereum/@dhumphrey/f2pool-manipulates- usd1-2-million-on-the-ethereum-blockchain-during-the-status-im-ico)

So what happens if there is a miner working in conjunction with the devs?

<comment><USER6> The document sees the 51% attack originating from token holders, not miners.

</comment></comment><comment><USER7> Buterin is in danger of becoming a parody of himself. I literally thought this was satire for several paragraphs, before glancing up at the byline.

A DAICO is a merger of two dubious ideas, and inherits the flaws of each. It has DAO problems- that it trusts a large quantity of money to public code that can't be fixed without breaking the guarantees provided by the immutability of that same code. It also has ICO problems- the combination of extremely volatile "stores of value," non-expert enthusiasm, and anonymity of the developers is ripe for fraud.

Something like this might work for a "distributed Kickstarter," once the bugs have all been worked out of a standard "form" contract and assuming that no payout is promised to token-holders. But this requires abandoning the core conceit of an ICO (that there are valuable "coins" involved) as well as a reasonably important feature of DAOs (that they can be meaningfully adapted towards specific use-cases.)

<comment><USER8> I don't think that is necessarily true, while you might be right in the sense that more complex behaivour has the chance of introducing more bugs into the code.

The tools, frameworks and contracts keep getting better and more mature, so hopefully we won't see occurrences like the ones of TheDAO.

> But this requires abandoning the core conceit of an ICO (that there are > valuable "coins" involved) as well as a reasonably important feature of DAOs > (that they can be meaningfully adapted towards specific use-cases.)

I honestly don't agree with this, there is no reason for coins not to retain its value.

</comment></comment><comment><USER8> Vitalik initial concept is promising but I encourage everyone to read the rest of the thread there are some very good alternatives and additional ideas.

Overall, if the main goal is to improve the ICO mechanism to reduce fraud and increase accountability from the development team, that in my book is worthy of consideration and discussion.

</comment><comment><USER9> Why would anyone give X money to a new venture if there's no mechanism by which they get Y*X money back?

Wouldn't it make more sense to dispurse new funds in tranches only after the first tranch has been repaid with interest?

</comment><comment><USER10> Why would I as a founder want the tap rate be controlled via consensus? It could hinder certain purchases if they are time sensitive.

<comment><USER11> Why would you as a founder want any kind of accountability? Maybe you can raise more funding that way. In the current environment that's not really the case, but things have to change eventually.

</comment></comment><comment><USER12> > Any vote is subject to 51% attacks...

Isn't the entire point of voting in the first place to determine what >= 51% of the voting population desires?

Calling a system working exactly as intended an attack seems a bit...odd.

</comment><comment><USER13> That fat comment with the _fetch a grownup button_ is mine ;)

<comment><USER8> Really enjoyed your contribution to that thread.</comment></comment>


Main thread blocking bug in Firefox fixed after 8 years - <AUTHOR> https://bugzilla.mozilla.org/show_bug.cgi?id=235853

<comment><AUTHOR> This bug is rather nasty as it prevents Firefox being adopted by more enterprises (ESR firefox really needs it) where automatic proxy configuration is often used</comment>


A landmark 2012 paper transformed how software recognizes images - <AUTHOR> https://arstechnica.com/science/2018/12/how-computers-got-shockingly-good-at-recognizing-images/ <comment><USER2> The paper is "ImageNet Classification with Deep Convolutional Neural Networks" by Alex Krizhevsky, Ilya Sutskever, and Geoffrey Hinton, and is available here:

[https://papers.nips.cc/paper/4824-imagenet-classification- wi...](https://papers.nips.cc/paper/4824-imagenet-classification-with-deep- convolutional-neural-networks)

</comment><comment><USER3> I enjoyed genji256's comment on the article:

genji256:"Anecdote: I was one of the three reviewers for that paper and I tend to review harshly. A few years after it was published, I started worrying that I had given it a bad score and completely missed a field-changing paper. I frantically dug through my emails and found the review. Turns out I gave it a 7/10 so it wasn't THAT bad, though my summary makes me cringe a bit: 'A paper which, by giving precise details on the various tricks used, is a useful addition to the deep learning literature. I wish comparisons with other techniques were somewhat fairer.' "

</comment><comment><USER4> I'm curious, are there papers in other ML fields that could be considered breakthroughs comparable in impact to AlexNet?

For NLP the recent ELMo and BERT papers for word embeddings come to mind, although their scope is somewhat different than AlexNet.

<comment><USER5> Sure, lots! We've made lots of progress just in the last decade or two. LSTM, recurrent, and convolutional nets. Slightly older (late 90's), but I think Random Forests were a pretty significant breakthrough.

Another huge one is Paul Graham's own work using Naive Bayes to filter spam.

<comment><USER6> Both convolutional and recurrent architectures were developed in late 80s. LSTM (improved RNN) was published in 1997.

</comment></comment></comment><comment><USER7> Man, I took a neural network class in uni and loved it. It was offered by the Psych department (however I was in Comp Sci). All I remember now is matlab labs, some of the terms, but otherwise nothing at all. My career took me nowhere near this subject matter and I've regrettably lost most recollections of it, so I appreciate this article explaining the basics again.

</comment><comment><USER8> > Right now, I can open up Google Photos, type "beach," and see my photos from > various beaches I've visited over the last decade. I never went through my > photos and labeled them; instead, Google identifies beaches based on the > contents of the photos themselves. This seemingly mundane feature

"Seemingly mundane"?? This is scary as hell.

<comment><USER9> Scary how? If you send a photo to Google's computers, expect someone to look at it and classify it. If the expectation is that one can drown that possibility away using _volume_ , then one would need to reassess their understanding of the purpose of computers.

What are your expectations, and why would the elicit such an extreme reaction to the status quo?

<comment><USER8> I knew they were doing this. I am just objecting to calling this "mundane".

<comment><USER10> "[S]eemingly mundane". As in something you (a human) wouldn't need to put any thought or effort into. It doesn't actually occur to Muggles that there are things that they do that are actually hard problems for computers, even if they understand that there are all sorts of things computers can do in a flash that would exhaust their personal resources for weeks on end.

</comment></comment></comment></comment><comment><USER11> Secure Connection Failed.

What's going on arstechnica?

<comment><USER12> Seems like they've got some server problems and are working on it ([https://twitter.com/arstechnica/status/1080502151363715072](https://twitter.com/arstechnica/status/1080502151363715072))

It's also gradually coming back together, one page resource at a time.</comment></comment>


Show HN: Forgiva – Never saves your passwords but regenerates them - <AUTHOR> https://forgiva.com/ <comment><USER2> As I see it, the main benefit of deterministic password generation is the convenience of not needing a password database. Indeed, if the scheme is simple and/or portable enough (e.g., PBKDF2) you can implement it from scratch in a minute or two, depending on what software you have handy. The convenience breaks down as you need to maintain additional state: password rotation, site- specific password rules, etc.

Forgiva is based on the premise that a password generation scheme is more secure than a password database. I'm unconvinced in general; from what I see in the FAQ and the Ruby code on Github, even less so for this particular implementation. Spamming the input with an array of whatever OpenSSL algorithms Ruby happens to make available, rather than using a memory hard KDF like scrypt, is a bad smell.

<comment><AUTHOR> >> Spamming the input with an array of whatever OpenSSL algorithms Ruby happens to make available, rather than using a memory hard KDF like scrypt, is a bad smell.

Sooner or later key-derivation schemes gets outdated and requires a better version as happened to bcrypt [1] and will happen to scrypt [2].

It is not "whatever OpenSSL provides" but just combining strong algorithms over to spread the "getting outdated" risks. Think like you are investing your money? Would you prefer betting on just one thing or spreading it over various different investment opportunities?

[1] [http://www.unlimitednovelty.com/2012/03/dont-use- bcrypt.html](http://www.unlimitednovelty.com/2012/03/dont-use-bcrypt.html) [2] [http://blog.ircmaxell.com/2014/03/why-i-dont-recommend- scryp...](http://blog.ircmaxell.com/2014/03/why-i-dont-recommend-scrypt.html)

<comment><USER3> Not only did that _not_ happen to bcrypt, but the whole point of bcrypt is that that _doesn 't_ happen: it's an adaptive hashing scheme, which means it comes with a dial you can turn to up the hardness as computers get faster.

I would be nervous about taking password storage advice from someone who thinks bcrypt "got outdated and requires a better version".

We had a Password Hashing Competition because people realized that password hashing and KDFs had become an important topic that hadn't received significant formal study. Similarly: we're having a CAESAR competition because people have recognized the importance of all-in-one authenticated encryption constructions. The existence of CAESAR, AEZ, NORX, &c doesn't mean that Poly1305-AES is "outdated and requires a better version".

<comment><AUTHOR> Probably i should explain what i meant with "got outdated and requires a better version" sentence. It is a race and as stronger algorithms comes to life -and stronger attack methods invented against them-, others gets simply weaker and weaker just like happened to MD2 and then MD4 And then MD5.

Sorry for misunderstanding.

<comment><USER3> MD4 and MD5 didn't get easier and easier to crack due to cryptanalytic advances; it got easier to _generate collisions_. That's a serious problem for a cryptographic hash, but depending on the construction you're using, it might not have anything to do with MD5's suitability as a password hash. There's no password hash cracking tool I'm aware of that takes advantage of MD5's weaknesses.

So, no: this isn't happening with bcrypt.

</comment></comment></comment></comment></comment><comment><USER4> > To crack a password with 70 bit entropy on a MacBook Pro Early 2013 it will > take ~6 million years to complete all combinations on Normal complexity. On > Intermediate complexity it will take ~24 million years and on Advanced > complexity it will take ~280 million years to reach all combinations at > minimum.

If you were cracking a password wouldn't it be significantly faster to use GPU(s) rather than CPUs [1]? If so, why bother mentioning how long it would take on a CPU at all?

[1] [http://arstechnica.com/security/2012/12/25-gpu-cluster- crack...](http://arstechnica.com/security/2012/12/25-gpu-cluster-cracks-every- standard-windows-password-in-6-hours/)

<comment><USER5> > If you were cracking a password wouldn't it be significantly faster to use > GPU(s) rather than CPUs?

When you're dealing with time scales greater than a decade, probably not. The right answer is almost always to wait until future hardware is available that can crack the password significantly faster than our current CPUs and GPUs. Whether that's quantum computers or just faster iterations of the kind of stuff we've got now doesn't really matter...the time spent waiting for new hardware is insignificant compared to the time spent waiting for calculations on current hardware to complete.

But I agree that it's disingenuous to list numbers like that because they're meaningless and aren't at all the answer to the "How soon can my password be cracked?" question.

<comment><USER6> 2^70 / 6,000,000 years / 365.25 days / 24 hours / 60 minutes / 60 seconds = 6.2 million reference guesses per second.

Modern multi-GPU instances are 560,000x faster, 350 billion guesses per second. So that gets you to 6 million years / 560,000 = ~100 years. So "decade" isn't accurate in this case, but only because of the awful comparison to begin with. Comparing a 2013 CPU to even a 2013 GPU will give you a 100 or 1000x bump easily, and since this is a case of "embarrassingly parallel" operation your scale is much smaller than expected.

Also note: 350 billion is for NTLM in 2012. I can't find equivalent stats for modern GPUs from a few minutes of searching on my phone, but I know they're a factor of 2-10x better, so 2^70 is easily within reach.

</comment></comment></comment><comment><USER3> I'm reading the open source code and this thing is... odd. For instance: it has a "simple", "intermediate", and "advanced" password complexity, and depending on which you choose, it uses SHA1, SHA2-256, and SHA2-512 for the PBKDF2 hash. What does password complexity have to do with the strength of the algorithm used to generate passwords?

Also: it's 2016. Why is this using PBKDF2? If PBKDF2 is what you've got and you're protecting a website, that's fine, but this is a password manager.

Is the "commercial" version of this also Ruby code wrapping OpenSSL?

<comment><AUTHOR> >> What does password complexity have to do with the strength of the algorithm used to generate passwords?

It is not the algorithm only but if you can look a little bit more closely, it is iteration count too. It uses 1.000 times and 10.000 times more iterations respectively.

Plus, depending on complexity, character set range enlarges.

>> Why is this using PBKDF2?

We would like to use more industry-standart way of things rather than individual works.

>> Is the "commercial" version of this also Ruby code wrapping OpenSSL?

Commercial version is purely written C version of it and backed up with OpenSSL on some cases.

<comment><USER3> I don't think I asked the most important question clearly enough:

Why do simpler passwords get a different construction? What does password complexity have to do with KDF hardness?

<comment><AUTHOR> It's probably because different understanding of same terms. With "complexity" word we mean hardness to generate. It doesnt adds up more algorithms but character sets and hashing algorithms for PBKDF2 respectively.

<comment><USER3> Why, exactly, would a user _ever_ want to generate a password with a weaker KDF?

A password with lower levels of string complexity might make sense --- 1Password's strong passwords can sometimes be rejected by crappy websites. A password that sacrifices cryptographic strength in order to save a few tens of milliseconds of KDF, though, makes _no sense at all_.

Also: really, you should not be using PBKDF2.

<comment><USER7> Honest question: what's wrong with PBKDF2?

<comment><USER8> It's much weaker. Only reason for a password manager to use it is laziness or ignorance.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> As an end user, I don't care about how the passwords are stored. I care mostly about two things:

1\. How hard it is for someone to steal them 2\. How easy they are to retrieve when I need them

I'm currently really happy with 1Password on both counts, and I don't really understand why I should move. A competitor would need to establish that they are at least as secure as 1Password, and this landing page doesn't do that at all. For all I know, it's been built by a nefarious hacker or some junior Node.js developer who's just discovered security.

Has it been audited? What is the roadmap for the project? These things are much more important than some technical explanation that I didn't really understand.

<comment><AUTHOR> Theoretically stored passwords are not safe at all. Sooner or later they will get stolen if it is the case.

Forgiva is actually big brother of kyle ([https://github.com/esurharun/kyle](https://github.com/esurharun/kyle)) which has been at use for nearly 2 years and experienced and tested a lot.

Yes, you are definitely right on that we should put roadmap on webpage.

And no we are nor "nefarious" hackers neither junior NodeJS developers. :)

<comment><USER10> _Theoretically stored passwords are not safe at all._

What does this even mean? Aren't they as safe as the cryptography being used (key derivation scheme, encryption method, etc.)?

(Of course, if a machine is compromised with a keylogger, it's pretty much game over anyway. Unless you use a hardware authentication token.)

<comment><AUTHOR> >> What does this even mean?

Again "theoretically" all encryption methods prone to brute-force attacks. And plus, encrypted storages indirectly reveals "encryption passwords" on succeeded attacks.

<comment><USER11> And if you go that path, "theoretically" an attacker might simply guess your password on the first try when attempting to log in as you, so password "storages" and "brute-force" has nothing to do it.

<comment><AUTHOR> You are mistaken on one think: it is not just being it "theoretically" possible but likeliness -or hardness- of it.

If the possibility of an attacker guessing my password at first try is one in a billion -or trillion- chance, then we can say it pretty secure. But hacking a cloud with a possible zero-day flaw and cracking a password database is not that hard if we compare it with your example.

<comment><USER11> I was responding to this assertion:

> all encryption methods prone to brute-force attacks

The chance of succeeding within our lifetime with a brute-force attack against modern encryption is far less than one in a trillion. So in your words, it is far better than "pretty secure".

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Your password will never be secure when you store it on someone else his disk or let someone else encrypt your password. Its not a matter of how, but when there will be a way to retreive those passwords by anything but you.

And its not just that, everything you use your passwords for these days, is stored on some sort of storage in a cloudy architecture. Scattered all over the world in thousands of datacenters. You probably are currently trusting thousands of people working over there, but you dont even know these guys. Terrible imho..

<comment><USER13> What do you mean?

This solution does not store passwords at all, if I understand it correctly.

So whining about storing them on "someone else disk" is a bit odd, don't you think?

<comment><USER12> In the overview, it says on cloud or local. Which made me think, why would you even suggest storing this on a cloudy device when your offering a password manager.

<comment><USER14> _In the overview, it says on cloud or local._

Where? I don't see "cloud" anywhere on that page..?

</comment></comment></comment></comment><comment><USER15> From the FAQ ([https://forgiva.com/faq](https://forgiva.com/faq)):

> How about for sites with restrictive password requirements?

> Passwords, generated by Forgiva are offered with 16 characters minimum (you > can go up to 32 characters by default) of length and 70 bits of entropy > guaranteed on normal complexity level. And it is called on strong level for > financial institutions and military grade applications.

> Thus it is not expected for any site to deny Forgiva generated passwords.

This seems naive, at best. If you can't store an eight character alphanumeric password, you're not usefully managing passwords.

</comment><comment><USER16> A couple thoughts that came to mind as I was reading it:

1) How is this safer than a standard password manager with TOTP-based 2FA? The second token, either produced by TOTP or something like a Yubikey, would guard against keyloggers, since the one-time code is useless after it has been entered.

2) How is the certificate generated, and what is it based on? Is the cert unique per device, or would I copy it to my other devices that need to access Forgiva ala a public key?

3) There are some typos and other grammatical weirdness on the page that suggests English is not the writer's first language. That's fine, but it looks unprofessional. I can make some proofreading suggestions if you feel inclined. I don't really believe in this product, but I'd prefer it to be judged on its technical integrity rather than the quality of its marketing, so I'd be happy to help polish it up.

<comment><AUTHOR> >> 1) How is this safer than a standard password manager with TOTP-based 2FA? The second token, either produced by TOTP or something like a Yubikey, would guard against keyloggers, since the one-time code is useless after it has been entered.

No matter how many factors you are using, sooner-or-later you pass it with keyboards.And that step may be intercepted and you may think that you sent the second token to the other-side but failed.

I can provide you a special investigation of Sceptive to show how 2-factor- authentications has been bypassed by malwares targeting Eastern-Europe banks.

>> 2) How is the certificate generated, and what is it based on? Is the cert unique per device, or would I copy it to my other devices that need to access Forgiva ala a public key?

It is not unique per device. You can copy it to all devices you use no matter what.

>> 3) There are some typos and other grammatical weirdness on the page that suggests English is not the writer's first language. That's fine, but it looks unprofessional. I can make some proofreading suggestions if you feel inclined. I don't really believe in this product, but I'd prefer it to be judged on its technical integrity rather than the quality of its marketing, so I'd be happy to help polish it up.

It would be an excellent help, we are very unprofessional on language and marketing -as you well see-. Can you please send an e-mail to us at firstname.lastname@example.com to tell us our mistakes?

</comment></comment><comment><USER13> How does this compare to the KeePass family of pw-managers? (Besides that Forgiva is closed source and KeePass is open source.)

 _Fixes poor passwords, accessibility and storage problems with highly secure way._

What does that even mean?

<comment><USER17> The way I read it... it's a password manager that doesn't store passwords (centrally or locally).

Instead it regenerates the password each time.

i.e. password for HN may be: some trait of HN (domain?) + some salt + your identity (cert?) to always produce the same password.

I didn't understand it all from the site, the explanations and broken English didn't really elucidate. But... if my understanding was right, I wondered about how to handle cert changes or key rolling, etc. There seemed to be a mentioned mechanism for this, but again I didn't really understand that from the description.

Gist though: No generated and stored passwords, but a pattern to always generate the same password for a given site.

<comment><USER18> What happens then if you want/need to rotate your password?

How does it deal with stupid password format restrictions?

<comment><USER19> the salt gets changed

so, either password database + master password gets stolen, or salt database + master password gets stolen

<comment><USER20> Except if the master db is stolen without the master password, one can throw guessed passwords at it and know when one worked (i.e. the db becomes readable).

Throwing passwords at a salt db gets you... what?

</comment></comment></comment></comment></comment><comment><USER21> What would happen if the site's domain changes? Or my email changes? Or something else about the metadata changes?

Now what if this happens on a site where you can not reset passwords, such as blockchain.info, am I SOL?

I like storing passwords becuase I have 100% certainty that it won't just magically generate the wrong one.

</comment><comment><USER22> The Windows 64-bit installer is giving a bad signature even though its SHA256 installer hash appears to be correct.

It _looks_ like they used SHA1 checks in the installer. I suspect the author doesn't realize that older Win installers that use SHA1 are blindly rejected by Win10 as a security measure (mostly because it's so feasible to game).

It is a very poor introduction to the application on the majority platform.

<comment><AUTHOR> Actually installer compiled using Visual Studio 2015 on Windows 10 platform. Nothing specifically edited to the way of SHA1 but we fix it on next release.

>> It is a very poor introduction to the application on the majority platform.

Yes you are right it can be better and will be.

</comment></comment><comment><USER23> I wrote something similar some time ago: [https://addons.mozilla.org/de/firefox/addon/masterkey/](https://addons.mozilla.org/de/firefox/addon/masterkey/) [https://github.com/ninov/masterkey- firefox](https://github.com/ninov/masterkey-firefox)

Or as android app: [https://play.google.com/store/apps/details?id=de.ninov.maste...](https://play.google.com/store/apps/details?id=de.ninov.masterkey&hl=de)

It works by using SHA256-HMAC on the service name with your master key as key and then encoding it in Base85 or Base62 (if you don't want special characters)

</comment><comment><USER24> This is similar to masterpassword . They have a mobile app and desktop app . Moreover they are completely free . [http://masterpasswordapp.com/](http://masterpasswordapp.com/)

<comment><USER25> +1 for masterpassword. I always loved the concept of brain vaults. One thing about masterpassword is that I don't trust the clients and I can't inspect what's being logged when I fire up the app. The iOS app is closed source and proprietary and although the idea is great, the clients are not to be trusted. Get yourself a copy of the Javascript client, and place it in a secure VM so you have full oversight of what the code is doing. And don't let the application talk to the internet...

</comment></comment><comment> ryan-c I don't have the time to review the design of this right now, but is there anything to stop attempts to crack the master password from a plain, or even hash of a derived password?

The encrypted password database is an advantage. You have to steal it to be able to even try cracking. If it's fully deterministic, anyone with any output can go nuts trying to crack the master password, and then get all other credentials.

</comment><comment><USER26> At first I wondered if it was a spoof. However, it could be incorrect grammar:

> If you suspect against keyloggers or malware, Forgiva presents a visual > confirmation ystem which leaves less hope for the attackers.

But maybe it's actually phishing?!?:

> And if you get registered, Forgiva uses your registration signature to > generate special passwords for you. That means for a successful attack it > will require keyboard and monitor access, plus a file system gain too.

</comment><comment><USER27> Cool idea, but the main gripe I have with it is that the passwords it generates are clearly not made for remembering, but regenerating them takes multiple seconds.

</comment><comment><USER28> These security experts forgot one really important thing: usability. I'm not going to wait minutes for one password to generate!

</comment><comment><USER29> How does this handle situations where the generated password isn't accepted by the site? eg. Is too long, absolutely must have at least one symbol and one number, etc.

How does this handle changing passwords? How can I know from the master secret that xyz.com is on the 4th password?

<comment><AUTHOR> >> How does this handle situations where the generated password isn't accepted by the site? eg. Is too long, absolutely must have at least one symbol and one number, etc.

You can specify password length if it gets too long and it's character set provides symbols, numbers and letters in it.

>> How does this handle changing passwords?

It has a renewal mechanism to switch to a new password.

>> How can I know from the master secret that xyz.com is on the 4th password?

Can you explain more about what you mean?

<comment><USER29> Okay, so the password generation is deterministic, based on a single secret I need to remember right?

So then there has to be metadata to list the site domain, username, which generation of password, which characters are allowed or disallowed, length, KDF difficulty, etc? Where is that information stored?

What I'm getting at is with a brain wallet I only need to remember my secret and know the algorithm used to generate the key. With this it seems like you need a database to store more information, and without it, it's difficult to get your passwords back.

</comment></comment></comment><comment><USER30> Why buy that, when there is open-source and free [https://ssl.masterpasswordapp.com/](https://ssl.masterpasswordapp.com/)

</comment><comment><USER31> I was planning to write one as I do not like existing ones but time is a slight issue: without versions for all platforms and some way to keep them in sync it is hard to switch...

</comment><comment><USER32> This seems similar to Master Password ([http://masterpasswordapp.com/](http://masterpasswordapp.com/)).

<comment><USER33> And Master Password is free software (GPLv3) ([http://masterpasswordapp.com/](http://masterpasswordapp.com/)).

</comment></comment><comment><USER34> > To crack a password with 70 bit entrophy

Consider proof-reading the website: I wouldn't trust someone to do my crypto who can't spell the basics.

<comment><AUTHOR> You are definitely right.

</comment></comment><comment><USER35> Does this implement Shamir's Secret Sharing?

<comment><AUTHOR> No. Why should it?

<comment><USER35> added layer of security

</comment></comment></comment><comment><USER36> Does this also support shared folders for teams?

<comment><AUTHOR> We are working on Enterprise version of it which will be having this option.

</comment></comment><comment><USER37> I use getvau.lt, how does this compare?

<comment><AUTHOR> Same strategy but Forgiva doesn't just use one key derivation algorithm (such as PBKDF2) but plus various hashing and encryption algorithms too.

And at the same time you may forget the options you used in Vault, it is not an option in Forgiva.

<comment><USER14> _plus various hashing and encryption algorithms too._

Is there any evidence that using multiple algorithms has any benefit over simply increasing the cost factor on one?

<comment><USER19> assuming combined correctly

A( B( C(X) ) ), if A becomes broken in the future, its still

B( C(X) ), as opposed to just revealing X straight away

<comment><AUTHOR> Yes, definitely you are right.

And at the same time using various other methods "depending on the master key" makes it impossible for an accurate time and process estimation for brute- force attacks.

</comment></comment></comment></comment></comment><comment><USER38> No mobile apps?

<comment><AUTHOR> Upcoming.

And planning to make it available as Telegram Bot.

</comment></comment><comment><USER39> Semi OT, I wrote this satircal piece on how passwords are dead yesterday: [https://news.ycombinator.com/item?id=12613433](https://news.ycombinator.com/item?id=12613433)</comment>


Apple Quietly Fixes iPad's Broken App Store Revealing 1,422 Games - <AUTHOR> http://m.kotaku.com/5530530/apple-quietly-fixes-ipads-broken-app-store-revealing-1422-games

<comment><USER2> The iBooks store has the same problem; most books can only be found via search, making an already paltry inventory seem even smaller.

I wonder if this has been improved? (I don't have an iPad handy while I'm working, so I can't verify myself.)</comment>


Start with Kicad – Schematic Diagram - <AUTHOR> https://www.instructables.com/id/Start-With-Kicad-Schematic-Diagram/ <comment><USER2> I recently created my very first PCB and used KiCAD for that.

Having never used PCB design software before, I was able to go from downloading the KiCAD software to uploading a finished PCB in one evening.

The design was a 2 layer PCB with 3 connectors, an I2C GPIO expander, some switches, LEDs and a bunch of SMD resistors and capacitors. Not complex by any stretch, but I was still incredibly impressed with the tool.

The PCB was uploaded to JLCPCB, who asks $2 to product 10 10cm x 10cm PCBs + $5 shipping costs. Absolutely mindblowing how cheap things have become...

<comment><USER3> This closely resembles my own experience with KiCAD.

Combined with the power of Chinese PCB manufacturers (smart-prototyping in my case), my childhood dream of "making my own PCB one day" was realized pretty easily.</comment></comment>


Remote-only jobs board - with salary and timezones - <AUTHOR> Https://remotely.tech <comment><USER2> No DevOps jobs?

<comment><AUTHOR> We have DevOps category but unfortunately there is no offers rigth now:/ Thanks for feedback :-)</comment></comment>


Baby Steps into Genetic Programming - <AUTHOR> http://aerique.blogspot.com/2011/01/baby-steps-into-genetic-programming.html

<comment><USER2> _"As you will find out if you start experimenting with the code in this article bloat is a big problem, as well as a successful form taking over the entire population."_

A very simple way to fight bloat is to penalize an individual's fitness value in proportion to how long it takes to find that individual's fitness value.

Then, if you bias selection such that fitter individuals are more likely to survive, then the individuals that take a shorter time to evaluate should have a slightly higher chance of surviving; and those individuals should be the very individuals that are less bloated.

Of course, the problem is determining just how much to penalize their fitness values. And, as in much else in evolutionary computation, that generally comes down to simply doing a number of runs with different penalties and see how they compare.

One down side to keep in mind when using any kind of penalty for bloat is that some research has shown that unrestricted tree growth is often required for solving larger and more complex problems. So there's a trade-off involved in reducing bloat vs allowing better solutions to evolve.

Now, as to the second problem of maintaining diversity, that is a much tougher nut to crack.

Two of the simplest techniques are using mass extinction events and separating the larger population in to a number of smaller populations (called "demes", "islands", or "subpopulations") and is generally referred to as "the island model".

Mass extinctions are very simple. Just wipe out a large portion of the population in a given number of generations (or when you've determined that the population has become too inbred) and repopulate it with random individuals. This will maintain diversity.

Of course, you usually don't want to wipe out your best individuals, so you'll spare them. But that's where the problem comes in, as the best individuals will likely quickly come to dominate the population again. But hopefully in the mean time they'll breed with some of the new random individuals and the population will get some new blood. And when the population starts to get too inbred again, or a certain number of generations pass, there could be another extinction event, etc..

In the island model, if the islands are kept totally separate and no individuals from any island are allowed to breed with individuals from any other islands, then this is obviously equivalent to simply running a number of separate smaller populations at the same time. This is might be fine for maintaining diversity, but no benefit will accrue from combining the solutions in each of the subpopulations.

So, what's usually done is to let individuals from one subpopulation breed with individuals from another subpopulation at given times during the run. Again, if they are allowed to interbreed at every generation, then this will be equivalent to just having one large population as usual. So you'll want to keep individuals on any given island from breeding with individuals from other islands for a number of generations. The longer you keep the subpopulations from interbreeding, the more diverse they'll be (or so the theory goes). At the same time, the longer you keep them from interbreeding, the slower the convergence rate (the time it takes to reach a global optimum in the search space) will be.

Unfortunately, there have been mixed results reported about the island model. Some research has suggested that it's better to just use one very large population. But on the other hand, there have also been successes reported with the island model, and reports that smaller populations outperform larger ones. So it's a mixed bag, and usually very problem dependent, as much of evolutionary computation tends to be.

Finally, there are also many, many other much more sophisticated and effective techniques for fighting bloat and maintaining diversity. But I'll leave finding those as an exercise to the reader. Just a quick tip: type "genetic programming" and "bloat" or "diversity" in to the form on this page:

<http://citeseer.ist.psu.edu/>

<comment><USER3> re: diversity, wouldn't lack of diversity be a consequence of the selection method? That's what I found with the genetic algorithm for hello world I wrote (which I fully admit is decidedly less complicated than GP). When I simply culled all candidates below a certain fitness, I quickly evolved a population of clones. Likewise roulette-wheel still got the population converging on one fit solution.

Whereas with tournament selection I found that the population remained diverse.

Just my findings though, I'm no expert on GA and certainly not on GP.

<comment><USER2> _"wouldn't lack of diversity be a consequence of the selection method?"_

Diversity of individuals in the population depends on a number of factors. The selection method is one such factor. But another factor is what individuals there are to select from in the first place.

Using the simple mass extinction event technique, you effectively limit the pool of individuals that can be selected from to those few that survive the extinction plus the new randomly created individuals that take the place of those that went extinct.

I suppose this could be considered a special rare breeding phase that combines an elitist selection method along with a 100% mutation of the remaining population.

Some other factors that influences diversity are the crossover and mutation operators that are used, along with the decisions concerning which parts of the program trees are allowed to change and where they get the replacements from.

For instance, if crossover were allowed only from or to certain parts of the tree, that could decrease (or even increase) diversity compared to the standard case of imposing no such restrictions during crossover.

Another possibility is performing crossover multiple times per generation on the same individual. The more similar a given individual is to other individuals in the population, the more crossovers could be performed on that individual, hopefully increasing the diversity in the population. Multiple mutation could similarly be employed.

Yet another factor that could affect diversity is simply the population size. Clearly, a population of one individual is minimally diverse. As the size of the population grows, so too (hopefully) does the diversity. There has been some research in to dynamically sizing the population to increase or decrease diversity as needed.

Something else that has been proposed for increasing diversity is segregating highly fit individuals from very unfit individuals. This way the highly fit individuals won't come to dominate the very unfit individuals, and thereby hopefully preserve diversity. This could be done with an island model, and as higher fit individuals on a certain island evolve, they can be transferred out of the islands of lower fitness to other islands of higher fitness.

And there are probably dozens if not hundreds of other ways of trying to influence diversity, as it is a critical aspect of genetic programming.

One last thing I should mention (maybe I should have mentioned it first) is that a lot of this depends on exactly how you measure diversity (yet another important field of research).

Is it enough to call a population diverse if every individual is different from every other individual? Well, what if they are but they differ only in ways that don't affect fitness? Or what if they do differ in ways that affect fitness, but with only minor variations from individual to individual? And what about structure differences? It's possible to have two individuals with the same fitness value but different structures. And there are many other measures as well.

So, depending on how you measure diversity (and when you do so, and to which members of the population), you could come up with different approaches to trying to influence it.

<comment><AUTHOR> Thank for your extensive comments, gnosis. They're very elucidating.

</comment></comment></comment></comment><comment><USER4> Koza's "gp.lisp" seems to be a prerequisite for getting any of this stuff working, but I can only find dead links to it.

I tried copying and pasting the stuff in here: [<http://www.genetic- programming.org/gplittlelisp.html>] into a file and loading it into clisp but it throws a bunch of syntax errors.

anyone know where you can grab a working copy of it? (I have never used lisp before, so I am probably not the best person to debug by hand...)

<comment><USER5> I bought this book a few years ago, by Koza. It has tons of working code in it-- each problem he steps through building up a solution with a working program:

[http://www.amazon.com/Genetic-Programming-Computers- Selectio...](http://www.amazon.com/Genetic-Programming-Computers-Selection- Adaptive/dp/0262111705)

This is one of my most prized computer books, perhaps _the_ most prized book I have. Even though I wasn't a Lisper when I started reading this book, I ended up building (without realizing it at first) a little Lisp inside Python for exploring the concepts.

If you thought Koza's old website is inspiring, consider getting this book. It's huge and expensive, but to me it feels like one of the 3 books I'd want to bring with me to a desert island or through the destruction of civilization.

<comment><AUTHOR> You certainly can sell a book :-) I'll be getting it for my birthday in a couple of months.

</comment></comment></comment><comment><USER6> I had made a small library for Genetic Programming in Python. Have a look: <http://paraschopra.com/sourcecode/GP/index.php>

The problem with genetic programming is that as soon as you start a approaching a program of reasonable complexity, even small mutations start wreaking havoc to whole program logic. If we make a biological analogy, it is like evolving an elephant from an ape-like ancestor. Evolution in real world isn't so drastic.

<comment><USER2> _"Evolution in real world isn't so drastic."_

Remember that elephants (and all other life on this planet) evolved from single-celled organisms (and even from non-life), which are far more different from elephants than even apes are. So drastic evolutionary changes do happen in the real world. But they just take a very long time.

The problem is that not only do we not have millions or even billions of years to evolve our artificial organisms, but that the environments in which our artificial organisms grow, their representation, and the operations performed on them during their "lifetime" and during breeding are incredibly restricted and simplified compared to what happens in the real world.

It's very difficult to model even a tiny fraction of that (see the supercomputer time dedicated to creating a detailed model of even a single neuron, for instance). And, as for the programs that are evolved via GP, it's rare for them to be allowed to create completely arbitrary code. Their instruction sets are usually very limited so as to reduce the search space. They are also usually given quite limited data to work with, are modified very little during their lifetimes (if at all), and the sorts of things that can happen during breeding are similarly curtailed. So it's really no wonder that their existence and evolution is not always so spectacular as what nature has been able to achieve over the millenia.

Now, the problem you mention regarding the disruptive nature of mutation (crossover can also have this effect) is also important. The attempts to solve it have generally focused to finding ways to reduce this disruption (usually by making the crossover or mutation less random). I recommend searching Citeseer for "destructive crossover" to see examples of some proposed solutions.

<comment><USER6> I meant that changes are not drastic in a single level (at least on phenotype level). You don't expect progeny of an ape-like ancestor to give birth to an elephant like organism. But that is what precisely happens with Genetic Programming.

<comment><USER7> It sounds like maybe a speciation mechanism could help with that, ie. don't let two individuals cross-over if they are too different by some measure.

</comment></comment></comment></comment><comment><USER8> John Koza is a name worth googling if you're interested in learning more about Genetic Programming.

<comment><AUTHOR> Ah yes, perhaps I should have mentioned him :-(

Some of his work has even created patentable inventions! (I'm on my phone and cooking so no links.)

<comment><USER2> Not only should Koza be mentioned because he's the inventor of genetic programming, but also because his original implementation of GP was done in Lisp!

Given that most later GP implementations have been done in other languages (from C to Java to Python), it's good to finally see it come full circle back to Lisp once more.

<comment><USER7> It seems like it should be much easier to do this in Lisp. In other languages wouldn't you need to work on the AST instead of on the source code to have much chance of generating syntactically correct programs ?

<comment><USER9> Lee Spector has made a Forth(like) language, called PushGP, which, in my opinion, handles syntactical correctness in a nice way. There's even a JS implementation, which wasn't there the last time I checked.

<http://hampshire.edu/lspector/push.html></comment></comment></comment></comment></comment>


Dogs that protect little penguins (2015) - happy-go-lucky https://www.bbc.com/news/magazine-35039105 <comment><AUTHOR> Could you imagine living with a creature 10+ times your size who keeps you alive? It's basically _The Iron Giant_ in nature.

<comment><USER2> > Could you imagine living with a creature 10+ times your size who keeps you > alive?

So, a child with a parent?

<comment><AUTHOR> That's a reasonable analogy, yes.

</comment></comment></comment><comment><USER3> We have a Maremma, as do some of our friends. They are incredibly dogs, extremely smart and independent. Also stubborn.

</comment><comment><USER4> I was unaware they were no longer called Fairy Penguins.

<comment><USER5> Anyone could clarify what's politically incorrect about that name? English is not my native language.

<comment><USER6> The word is occasionally used to mean gay, although the meaning of small imaginary creatures is still much more common.

<comment><USER7> I wonder if it's more commonly used that way in Australia?

<comment><USER8> The Australian usage is more along the lines of an weak or effeminate man, similar in usage to pansy.

</comment></comment></comment></comment></comment><comment><USER9> Why don't the dogs kill the penguins?

</comment><comment><USER10> if only English didn't bring the foxes to Australia...

<comment><USER11> Obviously yes, but heck if only humans had never gone to Australia in the first place it would still be populated by innumerable species that simply no longer exist.

We were destroying ecosystems long before there was anything that could reasonably be called a nation state.

<comment><USER12> The foxes weren't any kind of accident or incidental to human arrival though - they were deliberately introduced so that fox hunting could be engaged in!

<comment><USER13> The combustion engine was deliberately mass produced for vehicles so that people could move faster!

<comment><USER12> In my opinion there's a relevant distinction between the development of a technology that caused incidental and largely unforeseen environmental degradation, and an act of deliberate alteration of the environment that resulted in entirely foreseeable degradation.

</comment></comment></comment></comment></comment><comment><USER14> aww

</comment><comment><USER15> I'm baffled why they didn't just dredge the channel to make it a few feet deeper, keeping the foxes from crossing?

<comment> barry-cotter The foxes know the penguins are there now and they're perfectly capable of swimming across a ten metre channel for some food. Also, dredging would need to be repeated every ten years minimum. The dogs may be cheaper as well. Dog food is cheap.</comment></comment>


Designing for DevOps - <AUTHOR> http://coderwall.com/p/tfawsg

<comment><USER2> I invite anyone who has anything to do with coderwall.com to try visiting their own site with Javascript switched off. It's seriously ugly and impossible to read.

Doing markdown in Javascript? Really?</comment>


Are Internet Explorer users dumb? - CNN - <AUTHOR> http://articles.cnn.com/2011-07-29/tech/internet.explorer.dumb_1_browser-users-of-internet-explorer-google-s-chrome?_s=PM:TECH <comment><USER2> There's probably a correlation between intelligence and technical skill (using a computer), if you're intelligent you've got a higher chance of actually learning how it works or picking it up faster.

Many of those which are intelligent and technically challenged are just less likely to rely on a computer. So if you don't understand how to use your computer efficiently you would just use the browser which comes with it. To you there aren't any other choices, Internet Explorer is just 'How I get on Facebook and my AOL Mail'.

How can people be expected to know they need to upgrade to Windows 7 or Internet Explorer 10 without either doing some research, being told by a technical friend/family member or reading about it.

</comment><comment><USER3> No.

Do people with a lower IQ tend to not think about changing the default software provided? Yes.

</comment><comment><USER4> Is the title of this article link bait? Yes.</comment>


Mongolia's surprising alternative to potato crisps - <AUTHOR> http://www.bbc.com/travel/story/20180114-mongolias-obsession-with-pine-nuts <comment><USER2> Pine nuts. Saved you a click.</comment>


Ask HN: What is the norm for NDAs with Mentors? - <AUTHOR>

I was wondering what is proper etiquette when approaching potential mentors who are professional VC/investors. I certainly would feel more comfortable with a NDA in place, but also don't want to offend a potentially valuable mentor. Since this person is a VC, I am sure he sees many projects. But I also don't want to get into the Urban Fetch / Kozmo situation.<p>Thanks for any input. <comment><USER2> I would suggest that asking a mentor to sign an NDA is inappropriate. You are already asking the mentor to do you a significant favor by providing ongoing advice and guidance. To then ask a mentor to sign a legal document is placing an unfair burden on the mentor.

The two solutions are to either (a) find a mentor you can trust with confidential information or (b) keep your "secret sauce" information private until you have created others barriers to entry.

<comment><AUTHOR> Thank you for your thoughts. Definitely holding back the secret sauce is a good idea. Also, I am fairly far along in the project development which I hope the momentum will create at least a small barrier.

<comment><USER3> Your secret sauce is probably less secret and less saucy than you think :)

</comment></comment></comment><comment><USER4> Most of the time a VC or investor is not going to take your idea and decide to stop investing, but instead go back to his basement and code for hours on end.

I would suggest not even mentioning an NDA and don't worry about spilling the secret sauce. It's hard enough to get advice from them so why make your/their life any harder?

</comment><comment><USER5> I would have thought they will treat the idea with professional courtesy and respect your wishes if you ask them to keep it secret, but they cannot sign NDAs on every pitch, else they would soon be unable to do their jobs, because they would be legally unable to talk about or fund anything—ideas are not so unique.

</comment><comment><AUTHOR> It is a consensus. Very clear what I should do. Thank you all.</comment>


My Development Environment, Part 1: GNU Screen - <AUTHOR> http://blog.anassina.com/28545646

<comment><USER2> In ~/.screenrc:

        altscreen on

enables alternate screen, which is disabled by default, but is normally enabled in most terminals. It's the thing which prevents less, vi, etc. from clobbering the screen contents and leaving their gunk behind after exiting.

(A Google search seems to indicate that some people dislike this feature, but I found screen unusable until I discovered this option.)

<comment><USER3> Thank you! I have been using screen for 2 years and wanted to know how to fix this, but never knew what phrase to google to see if there was a fix. Every time I would background emacs (^z) it would clobber all of my previous console output so I would have to re-grep things, for example.

In return I give you my favorite screen hack that displays the available RAM on the server every 30 seconds in the caption:

In ~/.screenrc

        backtick 2 30 30 $HOME/.screenrc.bt.2
        caption always "%{gk}plab001 %?%{wk}%-Lw%?%{yK}%n*%f %t%?(%u)%?%?%{wk}%+Lw%? %=%{yk}%2` %{gk}%c %{yk}%d/%M/%Y"

in ~/.screenrc.bt.2

        free -m | xargs | awk '{print $17 "MB"}'

The caption string above also prints the current window titles and the time/date, so this is also useful for keeping ssh sessions open indefinitely since there is activity at least once a minute when the time updates.

</comment></comment><comment><USER4> Prediction: part 2 is vim and part 3 is about his pimped up bash prompt that shows the current Git branch. Or something like that.

</comment><comment><USER5> Here's the mandatory "if you're using GNU Screen check out tmux" comment.

Really though, check it out. The main thing I like better in tmux is that it does both horizontal and vertical split terminal windows in a way that seems much more intuitive to me than screen.

</comment><comment><USER6> This is absolutely uncanny. I've just started writing a similar blog post thread about my dev environment, and its similar to yours (i.e. screen (I'm moving to tmux though), vim, bash, etc.).

<comment><USER7> +1 for tmux. I switched from screen, and have been very happy with it.

<comment><USER8> Does tmux support tab/windows re-ordering like browser do with tabs? I miss it in screen.

<comment><USER9> Screen has some support for that. Try "C-a :number NN"

</comment></comment></comment></comment><comment><USER10> I really wish there was a nice way to run nested screens, I like having screen run locally, but I always want to be able to easily attach and detach from screen sessions on my server. I know I can escape them with keyboard shortcuts, but its confusing and I have never managed to get used to it, so I generally do server screen sessions in a seperate terminal

<comment><USER8> I use backtick(`) as the meta key and that works till I'm 2 levels nested. I can do `+p or ``+p to go to the next screen window at the 1st or 2nd level this way. However, 3rd level doesn't work, unless I set a different meta key on the 3rd machine. Having some shortcut to select the current nesting level would be awesome :)

</comment></comment><comment><USER11> Thanks for a solution to the problem of missing bright/bold colors that I found in your .screenrc. This issue hadn't bothered me much, otherwise I'd have researched it before, but it's nice to have it fixed anyway.

For reference, the option is question is

       attrcolor b ".I"

</comment><comment><USER12> Great post. Jon Druse created a Ruby gem recently that does something very similar -- but more project-oriented rather than global ~/.screenrc:

<http://github.com/jondruse/screeninator></comment>


The Tapper videogame patent - <AUTHOR> http://www.kmjn.org/notes/tapper_videogame_patent.html

<comment><USER2> An important detail about the whole thing is that _Tapper_ was designed and written by Marvin Glass and Associates, a toy design firm in Chicago. Glass was responsible for hit toys like the Evel Knievel stunt bike, Mousetrap, Simon, Lite Brite, Operation, Rockem Sockem Robots, etc.

Toymakers patent the living hell out of everything they do. So writing a 5000-word patent about a videogame was pretty much par for the course for MGA.

[https://en.wikipedia.org/wiki/Marvin_Glass_and_Associates](https://en.wikipedia.org/wiki/Marvin_Glass_and_Associates)

</comment><comment><USER3> It's surprising that both of us found game patents for old games we like at nearly the same time. I found this one for Tokyo Xtreme Racer (1999, Dreamcast) just a few days ago.

[https://www.google.com/patents/US6422939?dq=inassignee:%22Ge...](https://www.google.com/patents/US6422939?dq=inassignee:%22Genki+Co.,+Ltd.%22&hl=en&sa=X&ved=0CDMQ6AEwA2oVChMI- rahgJmQxwIVC1CSCh2DTQE2)</comment>


Apple to Match $10K in Charitable Contributions Per Employee - <AUTHOR> http://www.pcmag.com/article2/0,2817,2392762,00.asp

<comment><USER2> Google matches up to $12K in charitable contributions per employee.

It used to be $6K, but during one of the weekly all-hands, an employee asked if it could be raised (to match the recent pay raise that was happening at that time). Two days later, it was doubled to $12K.

<comment><USER3> Something about your comment got under my skin. My first response is, "so what?" However, I'm not sure what the purpose of your comment was. I read it to say "Google is not only $2K/employee more charitable, but also much quicker to act on this sorta stuff." But there'll almost always be someone who donates more and who reacts quicker...we could probably find a company that matches $13K, and $14K and 15K...but we aren't gonna list them all, are we?

I guess I'm just missing the point/value of your comment and I'm assuming the worst (which really isn't all that bad when I think of it :)

I need computer break..bbi30

<comment><USER4> Probably because the article made it sound like something unique to Apple or at least Silicon Valley. It's great that they're doing it, but it's nothing new.

</comment></comment></comment><comment><AUTHOR> There are lots of workplace giving programs out there. We (TechiesGiveBack - techiesgiveback.org) are looking into a program to bring workplace giving programs to smaller tech companies. IBM, cisco, goldman all have those types of things, often with a commitment to matching, but smaller tech companies who might just be getting HR departments up and running and certainly don't have corporate social responsibility depts seem to be an area that could use some prodding towards allowing their employees to give. Charity navigator has some stuff on workplace giving: [http://www.charitynavigator.org/index.cfm?bay=content.view&#.... I think it amounts to a few billion per year ($4.8bn according to this link: http://www.charitynavigator.org/__asset__/_etc_/Guide_To_Wor...).

</comment><comment><USER5> I really hope that the OP is wrong in implying that the matching is in response to that NYT article, which was one of the most churlish things I've ever read.

</comment><comment><USER6> Would it be unethical for a company to decide to match $10K in Voluntary Tax Contributions Per Employee as well?

<comment><USER7> I don't think it's unethical. However, if they match for a charitable contribution, doesn't it become a tax deduction? If you donate to the government, there is no such deduction.

</comment></comment><comment><USER8> That is awesome. I wish my company did that.

Or even $10 per employee would be an improvement....

</comment><comment><USER9> That's nice, but why not just _give_ $10k per employee to charity?

<comment><USER3> _sigh_...seriously?

First, simple math. $20K > $10K. If you have 100 employees, and they donate $10 and you donate $10..that's $2K. If only you donate $10, that's $1K. In other words, if you are gonna ask this silly question, it should at least be "why not just give $20K per employee".

Secondly, Apple already donates to charities (google it). At what point does a company donate enough that people stop asking "why don't they donate more?" (especially keeping in mind that Apple's priority is to its shareholders).

Thirdly, this is an opportunity for employees to donate money to a cause they believe in and have it essentially doubled. I'm not even sure how else to explain this, except to assume you've never donated money in your life before. For some people, this is a very personal thing (maybe their wife died of cancer)...they _want to donate_ and this is just an little bit extra goodness. Having the company just write a cheque isn't even close to the same thing.

Finally, this makes donating (not just money either, but time and other services) a culture aspect of the company now. The impact of engaging and involving employees can be considerably more significant than just a cash lump sum payment.

<comment><USER10> His comment is not without merit. Your view assumes that a high percentage of employees are inclined to donate. Perhaps they are not. If only 10% of employees partake then that's a far smaller amount going to charity.

What would be best is to say "Apple will donate $10k to the charity of every employee's choice and we encourage our employees to add to those donations as well". Then you get a donation even for those who won't donate of their own accord, they still pick the charities, and those who wish to donate still have the chance to do so as well for personal reasons.

I'm just playing devil's advocate here but if you're looking for guaranteed highest donations generated that would be it. Not that I've ever seen any company do that so it's mostly a mute point.

<comment><USER11> [http://www.one-step-forward.net/2008/05/making-moot-point- mo...](http://www.one-step-forward.net/2008/05/making-moot-point-moot-versus- mute.html) just FYI. And, btw, it rhymes with "newt" not "cute".

<comment><USER12> Bad selection of terms -- where I come from, "newt" and "cute" rhyme. Perhaps "boot"?</comment></comment></comment></comment></comment>