Drones flying nighttime patterns over NE Colorado leave law enforcement stumped - <AUTHOR> https://www.denverpost.com/2019/12/23/drones-mystery-colorado/ <comment><USER2> Could it be new Thz radars being tested? They could fit in a large drone easily and be used for close flight formation(they have collision detection) and also to scan nearby terrain(they penetrate vegetation cover). [https://e2e.ti.com/blogs_/b/industrial_strength/archive/2017...](https://e2e.ti.com/blogs_/b/industrial_strength/archive/2017/08/22/using- mmwave-technology-to-enable-sense-and-avoidance-in-drones) [https://www.foxtechfpv.com/77ghz-millimeter-wave-obstacle- av...](https://www.foxtechfpv.com/77ghz-millimeter-wave-obstacle-avoidance- radar.html) (similar stuff costs about 300$, but these drones have probably something much more powerful and heavier, for military or government agencies) [https://www.i-micronews.com/radar-to-spot-the-bad-guys- from-...](https://www.i-micronews.com/radar-to-spot-the-bad-guys-from-on- high/) (China is developing something similar too) "We mounted a prototype on a drone and recently conducted test flights in Shaanxi province," Li said. "A typical application of the radar in the future can be drone-based to help with large-scale detection of explosive-carrying terrorists or the placement of improvised explosive devices. This will be much more efficient and safer than deploying a lot of security personnel to do the same work."

<comment><USER3> > to spot the bad guys

> large-scale detection

> terrorists

 _sigh..._

</comment></comment><comment><USER4> My thought is that they're nongovernmental groups looking for illegal marijuana growing operations that they'll competitively harvest.

[https://www.theatlantic.com/technology/archive/2014/09/the-s...](https://www.theatlantic.com/technology/archive/2014/09/the- secret-pot-growing-operations-in-americas-cornfields/375913/)

<comment><USER5> If what they're doing is tied to illegal activity, you wouldn't think they'd be flying with collision avoidance lights.

<comment><USER4> Plausible deniability - they're just doing 'monitoring for deforestation' or doing 'speculative land investment' if anybody does track them down.

</comment></comment></comment><comment><USER6> It may currently be legal, but this isn't an acceptable long term framework. If you're flying below the regulation ceiling, you should need a line of sight operator and landowner approval. Above that you should need a transponder and rough flight plan – just like regular aviation. At no point should an operation be opaque to local law enforcement.

<comment><USER7> If there is no property being damaged, no law being violated, why does law enforcement need to be involved at all?

Law enforcement doesn't have to have an answer or info about every single event.

If I'm driving a car down the highway, law enforcement doesn't need to know where I am going or why. I'm not breaking any laws and not infringing on anyone's rights.

As a pilot I can go fly my plane at any altitude I wish as long as I am not entering any controlled airspace. I don't have to ask or tell anyone what I'm doing.

So why do they need to know why I'm flying my drone and where I'm going?

<comment><USER8> > As a pilot I can go fly my plane at any altitude I wish as long as I am not > entering any controlled airspace.

Well, no. That's not true. Firstly there are rules about the altitude you can fly at when it's greater than 3000', and second you are _required_ to file a flight plan any time you are flying IFR.

<comment><USER9> They specified "controlled airspace". Those rules you are talking about are controlled airspace. The previous comment clearly doesn't explicitly mean class A. It's too complicated to say anything but controlled airspace because that varies all over and can frequently extent up to class A.

And why are you bring up IFR? Most private pilots are flying VFR, even if they are IFR certified. But even in controlled airspace you don't have to file a flight plan. I can take off from a class C, fly through uncontrolled space and am not required to talk to anyone again. I don't have to say anything until I decide to land.

This is pretty common among pilots too. I'm not sure why drone pilots should be held to higher standard. Really they should be held to lower.

<comment><USER10> > This is pretty common among pilots too. I'm not sure why drone pilots should > be held to higher standard. Really they should be held to lower.

Drone pilots have to be held to a higher standard, because they have no skin in the game.

If a plane pilot flies like an idiot, they might hurt other people in the air... But they are very likely to also get themselves killed in the process.

This creates an incredibly strong incentive to not fly like an idiot.

A drone operator flying like an idiot is _far_ more likely to get other people killed, than they are to get themselves killed.

If drone pilots could only operate them, while wearing a suicide vest that explodes if the drone crashes, I'd be more open to holding them to a lower standard than pilots.

<comment><USER9> > A drone operator flying like an idiot is far more likely to get other people > killed

 _IF_ something catastrophic happens. Issue is that a 2lb drone is much less likely to do damage than a plane. You seriously can not compare the two. The danger levels of the two are nothing alike. If they were, I'd agree with you, but these things have magnitudes of difference in danger.

</comment></comment></comment></comment></comment></comment><comment><USER11> Whatever they're doing out there, it sounds like a lot of fun. Considering that they seem to be following the letter of the law, I'm fairly certain this is some sort of commercial operation. I can see a defense contractor using a large multirotor craft to test some new payloads, like night vision optical or IR sensors. If the 30 minute hover is to be believed, they must be a multirotor of some sort.

<comment><USER12> I agree it sounds like fun but it's probably pretty tone deaf to do so. Whoever does this should quickly clear this up just for their own sake.

</comment></comment><comment><USER13> I like the advise to not shoot down the drones, as this can cause a battery fire. Seems very US-American to me.

<comment><USER14> > He urged people not to try to shoot the drones down, both because their > batteries can cause intense fires and also because shooting a drone is a > federal crime.

Shooting an inanimate object hovering over your property is illegal? ... on the federal level? I suppose it would have to be, but...

Edit: Now I know: "Under Title 18 of the United State Code 32, the sabotage of an unmanned aircraft could carry a maximum sentence of 20 years in prison." [0]

[https://www.law.cornell.edu/uscode/text/18/32](https://www.law.cornell.edu/uscode/text/18/32)

<comment><USER15> I mean, same reason why you can't shoot down an airliner flying 30,000 feet above your house with a homemade Stinger missile or whatever--the airspace is not your property

<comment><USER16> This law will have to change as more illegally weaponized drones replace traditional drive-bys or other assassinations.

</comment></comment></comment></comment><comment><USER17> One possible source:

> New swarming drone technology could help find lost hikers, study wildlife

CU Boulder Today, Sept 16, 2017

[https://www.colorado.edu/today/2017/09/06/new-swarming- drone...](https://www.colorado.edu/today/2017/09/06/new-swarming-drone- technology-could-help-find-lost-hikers-study-wildlife)

Edit: Research and Engineering Center for Unmanned Vehicles (RECVU): [https://www.colorado.edu/recuv/](https://www.colorado.edu/recuv/)

Edit 2: This has been a fun topic to research! Here's a link to the list of equipment used by the Integrated Remote and In-Situ Sensing (IRISS) team:

[https://www.colorado.edu/iriss/content/equipment](https://www.colorado.edu/iriss/content/equipment)

<comment><USER5> Interesting, have you tried searching the FAA database of UAS Part 107 waivers:

[https://www.faa.gov/uas/commercial_operators/part_107_waiver...](https://www.faa.gov/uas/commercial_operators/part_107_waivers/waivers_issued/) ?

If they're non-government/military and are operating legally I think they would most likely have a 107 waiver filed, at least to allow night flying. That does mean they'd still need to be under the weight limit but I think the number of non-107 authorizations, which would allow heavier drones, is very small.

Also I'd be surprised if a University research program had the resources to field 17 drones of this size.

</comment></comment><comment><USER9> If this is such a high concern, why don't they go on a fox hunt? HAM is pretty popular in rural areas and HAMs love fox hunts. With the frequency and length that these things are up, they should be able to close in on the operators fairly quickly.

<comment><USER18> amateur radio is pretty popular in rural areas. While i guess the pork product is as well.

and as a ham we don't capitalize it, its not an acronym.

<comment><USER19> well it came from initials of Hertz, Armstrong & Marconi all of whom were instrumental in radio wave research. I think that counts as an acronym but when it is a common word it is often written in lower case

</comment></comment></comment><comment><USER20> Seems like this is the new norm and while I do feel the skies should be free to an extent I know this would concern me if it were happening over my head.

<comment><USER21> Just out of curiosity, why would it concern you? I live in a semi-rural tourism-heavy town and get a fair few drones in the vicinity of my house due to a major tourist site nearby, and it never really bothers me unless they fly low enough for the sound to get annoying.

<comment><USER22> They might be using cameras on my home or family. They might be testing some kind of radar or other tech that has a health impact. They might be a competitor assessing my crops. More broadly their very presence is a trespass on my right to live and be left alone on my own property.

<comment><USER23> Radar at legal power levels does not have a health impact.

<comment><USER24> Even so a property owner should have a right to decide whether it is used on his property

<comment><USER25> I totally agree. Infact the FAA owes me money if they allowed drones below 400ft. This is a taking of my property. I own up to 400 feet. If these drones want to follow the roads that is fine with me. Don't tread on my private property.

</comment></comment></comment></comment></comment></comment><comment><USER26> 6ft hovering drones? Hovered over a town all night? These are unusual drones. You have to put engineering effort in to keep a drone up for more than 30 minutes and 6ft is really big for a hovering drone.

<comment><USER11> Right? At that point you're trading off between useful payload and batteries. I'm wondering if maybe they're witnessing a loiter pattern, and misrepresenting is as a hover. These likely aren't aerospace Engineers giving quotes here.

<comment><USER11> A 6ft fixed wing drone could fairly easily achieve what's described in the article if it was really a loiter, not a hover. A multirotor would be an engineering feat.

<comment><USER27> 30 ft wingspan powered glider drone made from composite materials would be even more energy-efficient. Multirotor drones have low energy densities and waste it rapidly.

Other aspects to consider are that the "drones" are replaced by others as batteries deplete or that the drones aren't really there as long as people believe.

It's possible that someone is doing this as a hobby for artistic, conspiracy theory "reconnaissance" or benign data gathering-purposes or conducting some sort of investigation or intelligence gathering.

</comment></comment></comment></comment><comment><USER28> Does anyone have an alternate source? This site is horrendous on mobile.

<comment><USER29> My god this has to be one of the worst news sites I've ever seen. Do these publishers have no shame? I got two full screen video ads with audio on mobile and it dragged my brand new Pixel phone to a crawl.

<comment><USER30> Firefox + ublock origin, my friend

</comment></comment></comment><comment><USER31> The first thing I thought of was [https://en.wikipedia.org/wiki/Fenn_treasure](https://en.wikipedia.org/wiki/Fenn_treasure)

</comment><comment><USER32> Alternate Article:

[https://sputniknews.com/us/201912241077783862-its-not- santa-...](https://sputniknews.com/us/201912241077783862-its-not-santa- mysterious-gang-of-nighttime-drones-flown-over-colorado-raises-alarm/)

This sounds like a commercial operation. They're obeying the law, staying below 400ft, and operating in a rural area. It seems like the news articles are doing their best to make this sound bad when there's nothing nefarious going on.

<comment><USER33> > They're obeying the law

The article states that small drones must be flown during daylight hours according to the regulations. These drones are flown at night, which means they would be in violation of those rules.

<comment><USER34> The article also suggests that these are not small drones and thus likely not covered under the regulations mentioned.

Also, from the article: "they emerge each night around 7 p.m. and disappear around 10 p.m.". 7-10 p.m. isn't night, it's evening. Yes, in the US it's (probably?) dark by then this time of the year, but maybe they're following some regulation that is defined in terms of time of the day, and not the amount of daylight?

<comment><USER35> Sunset is 4:39PM right now in Fort Collins.

Night is after sunset in common English: [https://ell.stackexchange.com/questions/8954/the-exact- time-...](https://ell.stackexchange.com/questions/8954/the-exact-time-of- evening-and-night)

Also for the FAA:

14 CFR § 1.1: "Night means the time between the end of evening civil twilight and the beginning of morning civil twilight, as published in the Air Almanac, converted to local time."

</comment></comment></comment></comment><comment><USER36> > A farmhouse sits abandoned on County Road 24 in Yuma County on May 1, 2017

Looks pretty comfy to me. How much does an abandoned farm house in Yuma County go for these days?

<comment><USER19> for reference, I see the house here

[https://email@example.com,-102.240448,419m/dat...](https://firstname.lastname@example.com,-102.240448,419m/data=!3m1!1e3)

</comment></comment><comment><USER37> My partner lives in this area and while I was there on Monday night, at about 8:45pm, we counted about 10 drones flying around. They came in from the west but for the duration of their visit, moved around from west to south, to east to north, in erratic patterns.

Given the first sightings were in the more eastern counties of Colorado, and have been moving westward, but remaining in the rural areas still, it seems like someone is searching for something. Did the military lose something? There's an air-force base in Cheyenne, WY, and one down in Colorado Springs...

<comment><USER38> Military seems most likely to me. The military have said it is not them but we all know that doesn't make it true.

Assuming they are searching for something what could be found after dark? Perhaps something that gives off radioactivity or light in an invisible spectrum? Why would they fly at night other than to help them lay low?

Perhaps it is some sort of military drone flight training program?

<comment><USER37> Yeah, the prevailing thought was it has to be radioactive or tagged with something that can be seen with IR or something.

I assume the nighttime thing partially has to do with avoiding migrating Canadian Geese, and of course obscured visibility.

It absolutely could be some sort of training program, which seems like the most likely answer, but why lie about it when you've been so readily "caught"?

</comment></comment></comment><comment><USER39> Slightly OT, but I suggest reading the book "Army of none" by Paul Scharre to anyone who wishes to learn more about autonomous aircraft, drones, and the impact of AI on warfare.

</comment><comment><USER40> Illegal Drones.. to large and flting outside FAA regs. Can it be China ..Russia.. looking for our missle silos ???

Or freindly UFO... scouting out landing spot for mother ship anyway it is not normal to fly and operate such a fleet of drones undocumented in the USA..

</comment><comment><USER41> Interesting that these drones can apparently hover "all night."

</comment><comment><USER42> We have similar going on in Annapolis Maryland. You can see the lights, particularly the red/green on either side.

They seem to just loiter for several hours at a time.

<comment><USER43> Likewise. This article caught my eye, because it describes a phenomenon similar to one I've observed locally over the past year. I'd be curious about how well this meshes with what you've seen.

We have a fleet of (at least) 30 drones operating in a similar manner over Indiana. All of them reliably following paths between fixed waypoints. Upon reaching their waypoints, they tend to loiter place for a bit, change elevation, then move to the next point on their route. They typically come out around 7 pm, and disappear around 5 in the morning. They never fly in poor weather conditions.

The bulk of them seem to be Delta-wing aircraft, with lights at each point of their triangular bodies, and another array of three white, rectangular lights beneath them which will often flash, be disabled, or even on in lieu of the lights at their wingtips. I've estimated them to be between 6 and 15ft in wingspan.

They have a forward-swept vertical control surface with a red light at its apex, that I've variably seen at the top, and the bottom of the craft.

I've seen them fly forwards, backwards, and taxi side to side in rotating triangular formations of four, with one at the epicenter. They typically fly around 50mph.

They first appeared in the large numbers around south-central indiana July of 2018, but operate at lower densities across much of the southern half of the state.

I've always attributed it to the nearby naval warfare research center, due to the lack of public comment on the part of our local government, or regulatory bodies.

<comment><USER44> > _... over Indiana._

> _... the nearby naval warfare research center, ..._

I'd be interested in more details (either here or via e-mail to my username at gmail) as to where you've seen these flying. I'm basically in between Bloomington and Crane (which is, I assume, where you're referring to) and have several friends who work at various levels in law enforcement in the area and even more friends who work at Crane.

This is the first I've heard of anything like this in the area, though.

<comment><USER43> I've emailed you via hn àτ crocodile.observer

</comment></comment></comment></comment><comment><USER45> When I fly a personal drone I have to keep it within line of sight, I thought if you were doing otherwise you'd have to register with the FAA.

<comment><USER46> Lots of people are seeing the drones. If you start and land dark it's probably pretty easy to have the drones in your line of sight without being seen yourself.

</comment></comment><comment><USER47> No doubt the same brand of drone use in Gatwick, hysteria.

The car following a star is a classic.

It used to be aliens, now it's drones, interesting culture shift.

</comment><comment><USER48> I've been wondering when the first drone-view map of the world would appear. Maybe it's one of the usual suspects?

</comment><comment><USER49> <Here. Hold the keys to my 45' RV while I learn to night fly a group of drones on personal recon missions.

America is pretty great isn't it? Just don't try to bring a liquid on a public flight and you're a model citizen.

</comment><comment><USER50> Sounds like a good way for criminals to find illegal grow ops.

<comment><USER51> or legal ones for that matter. I don't think they care about the legality of those they are robbing all that much.

<comment><USER52> > I don't think they care about the legality of those they are robbing all > that much.

People robbed of illegal property usually do not report such losses to the authorities.

<comment><USER53> Why do you assume it's illegal though? They have legal cannabis in Colorado.

<comment><USER54> > Why do you assume it's illegal though?

Because growing, selling, and possessing cannabis is illegal under US federal law, and if you are a organizer, manager, or supervisor deriving substantial income from such an operation conducted with 5 or more other individuals, you can be charged wih a felony with a 20-year mandatory minimum sentence for a first offense, and if the operation handles enough product or makes enough money, the _minimum_ sentence moves up to life without possibility of parole.

There's a current federal law that prohibits initiating prosecutions for cannabis operations that are permitted under state-level medical marijuana laws, but that doesn't negate the offense, it just means any charges that would be covered by the prohibition (which violations not strictly with _medical_ marijuana laws.are technically not) are delayed as long as the policy is in effect.

> They have legal cannabis in Colorado.

No, they have a situation in which some cannabis trade is prohibited by only one of the two applicable sovereigns.

</comment></comment></comment></comment></comment><comment><USER55> Off topic, but in Reader View the page seems to apply a Caesar Cipher with shift one on the content after a couple of seconds to make reading annoying.

<comment><USER56> Maybe it's an extension you've got installed? I wasn't able to reproduce it (on macOS Safari). What reader are you using?

<comment><USER55> iOS Safari.

<comment><USER57> I distinctly recall you griping about ads while reading IEEE articles a few days ago[1].

FYSA wasn't able to replicate the reader view issue with uBO on Firefox, both desktop and mobile.

[1] [https://news.ycombinator.com/item?id=21850005](https://news.ycombinator.com/item?id=21850005)

<comment><USER55> I gripe about ads a lot. As you can probably tell, I'm not a fan of them.

</comment></comment></comment></comment></comment><comment><USER58> To catch a drone, or drone operator, use another drone.

Any chance the drone activity is related to Kim Jong-un's promised Christmas present? NE Colorado has, or had at one time, a few Atlas or Minuteman missile silos.

</comment><comment><USER59> From the article:

He urged people not to try to shoot the drones down, both because their batteries can cause intense fires and also because shooting a drone is a federal crime.

"It becomes a self-generating fire that burns until it burns itself out," he said. "If you shoot a drone down over your house and it lands on your house, you might not have a house in 45 minutes."

So these are really vehicles of arson?

<comment><USER60> Maybe. In a related note, if you shoot my car until it crashes, it may catch fire and burn everything around it. People probably shouldn't do that either</comment></comment>


List of commercial video games with available source code - <AUTHOR> https://www.wikizero.com/en/List_of_commercial_video_games_with_available_source_code <comment><USER2> The actual Wikipedia article: [https://en.wikipedia.org/wiki/List_of_commercial_video_games...](https://en.wikipedia.org/wiki/List_of_commercial_video_games_with_available_source_code)

No idea what WikiZero is. Looks like it's just rehosting Wikipedia content with a different stylesheet and a lot more things getting blocked by uBlock Origin.

<comment><AUTHOR> Mmm. You're absolutely right, my bad. Poor research on my part. The site does look shady. Too late now to change the link I guess.

</comment></comment><comment> m-p-3 One of the recent interesting case is how Super Mario 64 code was recreated by hand.

[https://github.com/n64decomp/sm64](https://github.com/n64decomp/sm64)

</comment><comment><USER3> Don't forget Warzone 2100!

[https://wz2100.net](https://wz2100.net)</comment>


Birthday problem - <AUTHOR> https://en.wikipedia.org/wiki/Birthday_problem <comment><USER2> I wrote something about this some years ago, and in particular, connected it to the question/problem of clashes when generating (hopefully) UIDs.

[http://www.solipsys.co.uk/new/TheBirthdayParadox.html?HN_201...](http://www.solipsys.co.uk/new/TheBirthdayParadox.html?HN_20151220)

This submitted wikipedia link is more complete, but I hope mine is more readable as an introduction to the question.</comment>


Show HN: Browse work from home, remote, and telecommute jobs - <AUTHOR> https://www.remotebaba.com <comment><AUTHOR> Hey guys, I put together www.remotebaba.com which aggregates work from home jobs. Please check it out, and let me know what you think!</comment>


Go's runtime C to Go rewrite, by the numbers - <AUTHOR> http://dave.cheney.net/2014/09/01/gos-runtime-c-to-go-rewrite-by-the-numbers <comment><USER3> Why Go?

I had a chance to do a bit of Go a year or so ago, and found the language very (how to put it?) bland. There just didn't seem to be anything surprising or obviously better about it.

If the alternative is C++, I can understand the appeal of garbage collection and getting away from the complexities of the STL. But Java provides both. Anyone want to make the case for Go over Java?

<comment><USER4> A lot of us _love_ bland. Personally working on Scala for my day job and I curse the authors every time I see some neato feature that's been abused by a bored dev or a dev on a deadline.

As far as Go over Java, in terms of differences:

1) Error codes instead of exceptions, big difference, puts Go more in the 'write a server' than 'write an application' category although those lines have been blurred

2) Duck typed interfaces, type inference, automatic delegation and whole bunch of useful little things that make Go, IMO, "Java done right". Regardless of the fact that most of the Go community would want to punch me for calling it that. Go's conventions encourage 2010s Java, Java can sometimes encourage 1990s java.

3) Goroutines being first class is quite different from always instantiating/passing-around an ExecutorService.

4) First class functions and lambdas, although lambdas are a little less useful for not having generics.

<comment><USER5> I love bland and hate surprises.

One of the features I despise most in Ruby is Monkey Patching since it changes expected behaviour.

</comment></comment></comment><comment><USER6> What's interesting is amount of C and Go code being so proportional - <USER2> every 100 lines of C code rewritten you seem to get 100 lines of Go.

It surprises me, because from what I've seen Go seems to be much higher level language. Or are those just all the `if err != nil` lines?

<comment><USER7> The runtime code probably deals with a few things that aren't as compact in Go either. For example using the unsafe package in Go is very verbose since you are trying to work around the type system. C just lets you dereference any pointer you want etc etc.

There are many types of code that are significantly longer in C# or java than in C, just because C lets you do crazy things with memory mapping.

To get more terse code, you need to switch from the C family of sytax imo.

<comment><USER8> There are plenty of C family syntax languages that are more compact. The main reason why Go is very verbose is because it doesn't support generics (so you have to duplicate a lot of code) and no exceptions (so your code is littered with

        ok, err := Foo()
        if err { ... }

and then the caller has to do the same thing (basically reinventing manually what exceptions do for you).

<comment><USER9> Absent exceptions, for quick-and-dirty stuff I wish Go had a mode like Bash's 'set -e', which just aborts on any error return from any call. When the only thing you want to do on errors is abort the program, it's really tedious to write that same "if err, exit" after every function call. But perhaps the golang people's answer would be that for those kinds of quick-and-dirty programs, I should be using a shell script anyway, not Go? Or maybe Perl, which does require an explicit check, but uses a compact idiom for it, _f() or die;_

<comment><USER10> Yeah, I'd quite like an `or die;` equivalent, as I've run into the same thing as you: scripts that can't do anything if the chain of commands fails anywhere. I have written functions that do the same thing: xOrDie(), but it's a bit sucky.

As far as "Why Go for shell scripts?" I actually think Go is pretty well suited to shell scripts (aside from no or die): getting stdout/stderr pipes set up is pretty trivial with the exec package. There must be anecdotal law somewhere that states that all shell scripts tend to Turing completeness over time: what starts with "oh, a small shell script would do this" always ends up growing to a full blown 1000+ line program with multiple code paths. Writing the first script in Go is a piece of defensive programming so that when it inevitably grows, it's growing into a language that better supports its size (static typing, readability, libraries etc.) It's probably overkill for personal stuff, but it is probably the right hammer for the job over time when it comes to corporate work.

</comment></comment></comment></comment></comment><comment><USER11> Cool visualization. What causes the spikes? Code merges?

<comment><USER12> Wouldn't make sense for the few solitary spike though. Perhaps they are found regressions, causing them to go back to the original C code for a while? That would make sense in the context of merges too - there's _always_ a few bugs that show up under closer scrutiny.

</comment></comment><comment><USER13> Spoiler: Flash plugin would let you see a timeline graph showing lines-of-C vs lines-of-Go in the go project.

(Strange that a Google Docs widget requires Flash...)

<comment><USER14> Google Docs was built before HTML5 was a thing. Second, lots of companies switched to Docs without being able to switch to a modern browser, so they're stuck with Flash for proper visualisations like that - and Google can't just drop support without losing enterprise customers.

<comment><USER15> The seem to have a workable solution for Youtube: they support both HTML5 _and_ flash.</comment></comment></comment>


Why the daily standup meeting is an anti-pattern - <AUTHOR> https://blog.nuclino.com/why-the-daily-standup-meeting-is-an-anti-pattern-and-how-to-fix-it <comment><USER2> What about Basecamp? That seems to do well for distributed teams, but I don't know if it can be effective if all you use it for is for daily updates. I've never used any of these async tools outside the Jiras and Gits of the world so my experience is limited.

<comment><USER3> My previous company used Basecamp, could definitely work in this setting. I just really hate the UI...

We've recently hired several remote team members and have been experimenting with standups over Slack using chat bots such as Geekbot but Nuclino looks interesting too.</comment></comment>


The Purpose Driven Startup - <AUTHOR> http://fortative.com/insights/read/the_purpose_driven_startup <comment><USER2> I'm getting a little sick of hearing the "X Driven Y" construct. What made Test Driven Development so powerful was how it creates a workflow that allows a developer to reduce cognitive load by moving across layers of abstraction intelligibly.

Tests _drive_ your development. At any point, you can simply run the tests and get an accurate picture of where the project is at. If it's all green, write more tests, if you have failing tests, fix the tests.

It's something that every single other X Driven Y idea I've seen has completely lacked. Yes it's nice for an organization to have purpose beyond profit. But how do you actually do it? How do you solve the infinitely-many hard problems business throws at you and still retain your vaunted purpose? Is there a way to iterate from a normal enterprise in the direction of purpose, or does the paradigm force you to just start a new startup?

TDD wrapped answers to all the problems it solved into a neat little workflow. This does nothing of the sort. I'm going to start thinking of these the same way I think about mall Cajun food.

<comment><USER3> I really don't think that TDD was the beginning of the 'X Driven Y' construct, though maybe you're not saying that directly here.

> But how do you actually do it? How do you solve the infinitely-many hard > problems business throws at you and still retain your vaunted purpose?

Sorry, but it sounds like you haven't experienced what it's like to be driven by a purpose. It works the same as you describe TDD,

> Tests drive your development. At any point, you can simply run the tests and > get an accurate picture of where the project is at. If it's all green, write > more tests, if you have failing tests, fix the tests.

only that trying to automated it would probably require some machine/deep learning, and so at this point the 'green' (and 'red') comes from your own internal/obvserved understanding of your direction and current state.

TDD is rather just a part of what being 'Purpose Driven' means, for even with it, there is still a purpose (usually 'to have bug free, well working code and product')

</comment></comment><comment><USER4> What is this? It looks like just an advertisement for startup consultant based out of Raleigh, North Carolina?

There's a cynical saying that is basically: anytime you meet a "startup consultant for hire" there's usually a sad story there, and the only reason to pay for a startup consultant is to ask them why their own startup failed and get advice about what not to do.

With that said, unfortunately the startup world really is in desperate need of honest, affordable, talented business consultants without conflict of interest. But the best people to do this type of work are busy running companies or have enough money to retire and don't sell consulting services to startups (though many of them do some angel/VC investing and advise their portfolio co's).

I'm not sure what the story is for this link or if it fits HN guidelines. But either way, good luck on the new consulting business! and Happy Holidays!

<comment><USER5> Yes there is a massive need for good, conflict-free advice. For what it is worth, my advice is ask for advice from people who don't have time to give advice.

</comment></comment><comment><USER6> I think this is a good concept for startups. If you can get people to trade their time for a purpose instead of money, you will spend less and get dedicated workers making you rich.

<comment> white-flame Poe's law is strong here.

<comment><USER6> Did not know about that law. Good concept. It captures the absurdity I was aiming for completely.</comment></comment></comment>


A command-line installer for Windows - <AUTHOR> https://scoop.sh/ <comment><USER2> I struggle with all the alternate 'installation managers' for Windows. Microsoft has already done this with their MSI system (Although even they have basically abandoned it in favour of the APPX stuff). MSI was a good format, and could be installed silently with the right switches (/q/b), support alternate installation options via MST files, and even patches via MSP files. Even the specific DLL dependencies ('DLL Hell') got fixed via manifest files/attributes. Microsoft published the MSI specification early on, and encouraged everyone to support it.

However, the core problem with Windows software is there isn't a primary software repository for all approved and tested software, like there is for *nix platforms. Ideally that's what needs to be fixed first before yet more client-end installers get created.

To fix this, based on the current landscape, all third-party client-end installers need to support all existing third-party repositories. Even better, everyone agrees on a standard JSON format (or whatever) for their repository manifest and all third-party installers understand that. Then just like Linux et al. all you have to do is add the new repository URL to your installers config, and all the packages advertised within are immediately available.

It seems really simple to fix - but people have to co-operate.

<comment><USER3> I have a different fix: don't use installers at all and release applications as portable self-contained directories. You don't need fancy support for silent installs, you just push the directory and you're done. No need for a middleman repo either.

<comment><USER4> For software targeting more advanced users and with limited dependencies, I agree. But if your software has large shared runtime requirements, is expected to be used by simple users expecting an icon, has non-trivial installation checks, etc, an installer is the way to go.

</comment></comment></comment><comment><USER5> Reading the headline made of think of installing Windows via the command-line (say via imagex). Which is actually very useful in certain tricky situations when you mess up an install.

Once I didn't have enough space on a flash drive to install Windows via an ISO...but I did have a liveboot ubuntu system and 2 spare drives. Interestingly enough imagex and WIM tools were ported to linux, and it was a surprisingly easy experience.

<comment><USER6> I did that too! The world certainly has changed now that installing Windows is easier to do from Linux!

I'm also looking towards using the winre partition to store wins and some kind of iterative snapshots for PITR recovery.

Any suggestion is welcome!

<comment><USER7> There was a tool called Unattended [1], built to install Windows from Linux via PXE booting. I've used it a couple of times, but it left off at Windows XP (and Server 2003), which is a bit too far beyond for me now. Anyway, I think Windows 7, and definitely Windows 10 are easy to boot from USB, which is almost as good as a network boot.

[1] [http://unattended.sourceforge.net/advanced.php](http://unattended.sourceforge.net/advanced.php)

</comment></comment></comment><comment><USER8> you can use windows build-in powershell feature "Install-Package" with package provider "chocolatey" just like this on a fresh windows install:

      Set-ExecutionPolicy unrestricted
      Get-PackageProvider -name chocolatey
      Install-Package chromium
      Install-Package 7zip
      ...

<comment><USER9> I discovered Chocolatey during a Windows stint at work ~3 years back and found their package quality to be very poor. I'd go as far as saying packages had a 50% chance of leaving you with a usable installation of software.

We ended up changing provisioning scripts to download .msi installers directly and run them with appropriate switches.

I also remember their website having a lot of "maintainers required" notices - I got the impression that the situation was a little desperate.

Has package quality improved? Is Chocolatey a genuinely reliable way to install software, now?

<comment><USER10> I've been using it since about 2 years and never had any problems installing anything. I guess I'm mostly using popular well-maintained packages though, so YMMV if you are installing some more obscure software.

I'm not sure about the maintainer situation. Some packages get updates quite regularly while other packages are always a few versions behind the latest release.

</comment></comment></comment><comment><USER11> I've been exclusively using Linux/*BSD (Slackware/Gentoo/Arch) for personal use since upgrading from my K6-2 500 to an AMD Barton 2600+ because finding, installing and managing "trustworthy" software is easier.

Linux has hardware compatibility challenges and software with bugs, but so does Windows. I don't, however, have to search through monstrosities like Download.com. I don't have to figure out what software may have a new release that is important to me. Critical dependencies are handled automatically. Every distribution may handle these in slightly different ways but these basics hold true.

Every time I've had to use Windows I've spent an enormous amount of time searching for and installing things. Once installed I then discover the software has changed to a limited free trial or some other nonsense that ends in another search, install and disappointment loop.

It's tools that have shown up in the last few years like scoop that have made dealing with Windows at least somewhat tolerable.

</comment><comment><USER12> Curious how this compares with Chocolatey

<comment><USER13> I was curious too, turns out it's addressed in the wiki:

[https://github.com/lukesampson/scoop/wiki/Chocolatey- Compari...](https://github.com/lukesampson/scoop/wiki/Chocolatey-Comparison)

Short version:

\- Installs to ~/scoop/ by default.

\- No UAC popups, doesn't require admin rights.

\- Doesn't pollute your path.

\- Doesn't use NuGet.

\- Simpler than packaging.

\- Simpler app repository.

\- Can't always install a specific version of a program.

\- Focuses on developer tools.

<comment><USER14> Can I install MS office using scoop? Or other proprietary software that usually install globally and need admin permissions?

Choco can do that (not that I am affiliated). Also, I like my "path being polluted". The least these programs can do is symlink to a single binary directory so I can run them from anywhere.

Simpler repository is just a euphemism for- we have little.

As an end user I have no business whether it does it doesn't use nuget.

I'm not trying to diss - I respect and appreciate not players in this space but its important to say it like it is. Also, given how "open" choco ecosystem is- I'd love to see non-official tools on top of that.

<comment><USER15> I gave up on Choco because it got too hard. I could never tell which package I should install, I was never sure if I should be installing from an elevated prompt or not, and then they added a bunch of premium plans to choose between with a confusing feature matrix.

<comment><USER16> I really _want_ Chocolately to suceed, but so many packages are outdated, and there are a lot of duplicates, so you often don't know which one you should get. I find the web UI very clunky too.

<comment><USER17> Have you ever tried to uninstall Chocolatey? When I tried doing that for the first time, it was a terror so I never looked back.

</comment></comment></comment></comment></comment></comment><comment><USER18> _> >Scoop reads the README for you<<_

I'd rather just have a clear and concise README. Better yet, if vendors distributed their applications as single bundled EXE files like back in the day.

Don't take this the wrong way, I haven't used scoop and I have nothing against it. Just wish there weren't a need for it.

</comment><comment><USER19> Scoop together with a large collection of portable software is a godsend in a corporate environment, where you don't have admin privileges on your work machine and getting up-to-date software approved and installed by your IT department is a royal pain in the ass. I can confidently say that were it not for Scoop, I'd be in order of magnitude less productive at my work due to the lack of necessary software. Scoop is one of those things that makes a potentially unbearable work environment a productive and even enjoyable one. Yes, Scoop is not perfect. Sometimes it breaks and I have to manually fix it (it likes to uninstall outdated packages before downloading and verifying the checksum of the updated ones). But the time spent on fixing it is easily recovered by boost of productivity that it provides.

</comment><comment><USER16> I realise I can find packages by scouring the GitHub repos[0][1], but I'd also appreciate a web search UI, especially as the number of available packages grows. This could also let me easily discover what version(s) are available etc.

I can't seen to find it, but does such a UI already exist?

[0] [https://github.com/lukesampson/scoop/tree/master/bucket](https://github.com/lukesampson/scoop/tree/master/bucket)

[1] [https://github.com/lukesampson/scoop- extras/tree/master/buck...](https://github.com/lukesampson/scoop- extras/tree/master/bucket)

<comment><USER20> [https://repology.org/](https://repology.org/)

It's a common web interface on top of many package repositories, including this one.

<comment><USER16> Thanks, I've never come across this before, and it looks really useful for finding Linux packages, even if it's not exactly the most user-friendly UI!

</comment></comment></comment><comment><USER21> My main machine broke two days ago and I had to buy and setup a new one quickly to resume working. I used scoop to install all applications I needed to work. It was easy and all the apps stay organized in their folder inside my home folder. I find scoop very refreshing and easy to use compared to other windows alternatives. I really recommend it to people, specially developers.

</comment><comment><USER22> This looks pretty good. At the moment I'm using MSYS2 on my work machine (have to use Windows).

Any thoughts on this installation method?

        iex (new-object net.webclient).downloadstring('https://get.scoop.sh')

I'm not sure IT Security here would be too impressed.

<comment> yjftsjthsd-h `curl | sh`, take 2:) I hope _nobody_ would be impressed, unless there's some safety features that aren't obvious here.

<comment><USER23> FYI powershell comes with curl now (and ssh).

<comment> yjftsjthsd-h I'm aware of openssh on NT being a thing now, but last I saw I thought powershell's "curl" was just an alias to their equivalent, which means that ex. options don't actually match for anything non-trivial. (IIRC, they did this with lots of commands; `ls` gets mapped to a local equivalent, but `ls -lahr *.foo` would not do what you think it should)

<comment><USER23> It's the real curl[0]. I actually like the aliases and they've even added ctrl-shift paste in the options. Maybe they should be the default.

The windows filesystem still makes no sense but that's an NT issue (dropbox cant sync con.sh???). SSH has a surprisingly native feel but graphical apps (vim, screen) still have rendering problems, and the ssh-agent daemon isn't set up right by default.

Until they make Windows LTSC unusable, it's not _too_ horrible right now. But for a serious programming project there's still no question for me (but fix your damnable sound drivers Ubuntu).

[0] [https://blogs.msdn.microsoft.com/commandline/2018/01/18/tar-...](https://blogs.msdn.microsoft.com/commandline/2018/01/18/tar- and-curl-come-to-windows/)

</comment></comment></comment></comment></comment><comment><USER24> It's easy to add new bucket entries by adding json files. Also if I understand it correctly, their auto update feature allows many apps to be self maintained i.e. you don't have to update the json when a new version comes out.

</comment><comment><USER25> Why handle windows only? This was posted recently on HN : [http://gofi.sh](http://gofi.sh) \- Fish - A systems package manager like homebrew but cross-platform

<comment><USER26> Why in the world does it symlink stuff into C:\ProgramData? Normal Windows installers don't do that.

<comment><USER27> I guess it is for cross user install support but that can be achieved in other ways easily

</comment></comment></comment><comment><USER28> Scoop is about the only thing that works on my stupidly locked work laptop. Unfortunately, McAfee AV just started deleting scoop scripts randomly. God I hate windows.

</comment><comment><USER29> Changing the Execution Policy triggers a UAC prompt...

<comment><USER30> Not if you define the scope for execution policy.

<comment><USER29> At my place of work, IT has taken the scorched earth route and blocked Powershell altogether.

</comment></comment></comment><comment><USER31> How does it compare to chocolatey ?

</comment><comment><USER32> I wouldn't put so much trust in this unknown package manager, Chcolatey or Homebrew on Windows would be far better choices.

<comment><USER33> You don't know what you're talking about.

</comment></comment><comment><USER34> Ha one important reason why windows won was because you never had to touch the keyboard ever again.

<comment><USER35> A lot of the people that thing was meant for are now using smartphones and tablets. PCs will be for power users and office workers.

</comment></comment><comment><USER36> MinGW ships with pacman, I can't see why one would need this.

<comment><USER37> Because not everybody needs all the stuff that comes with MinGW? Why install all that stuff if they don't intend to use it, just to get a package manager designed for another platform?

Apart from the fact that the MinGW port of pacman is designed for the MinGW environment only, and therefore doesn't necessarily integrate all that well with the rest of the Windows system, the packages it provides are mainly ports of software from other systems (chiefly Linux and BSD) rather than native Windows software.

Doesn't seem all that relevant.

<comment><USER36> > Looking for familiar Unix tools?

Is the leading line in the motivational paragraph for this tool, and its example usage is

> scoop install curl

Your comment doesn't seem all that relevant.</comment></comment></comment>


CVSS v3 Creates New Challenges For Developers (2018) - <AUTHOR> http://whitesourc.com/cvss-v3-creates-new-challenges-for-developers <comment><USER2> In general, I'm not a fan of vulnerability quantification efforts like CVSS.

The reason is that they provide the appearance of repeatability and objectivity when, in reality, many of the assessments used are subjective and opinion based.

A simple "critical", "high", "medium", "low" will generally provide enough actionable information without pretending to be something it's not.

For examples of the weaknesses of CVSS, you only have to look at the software that uses it like Vulnerability scanners.

In many cases they have different ratings for the same issue and also have ratings which are nonsensical

here's one example.

Telnet (totally unencrypted protocol) CVSS v2 5.8 [https://www.tenable.com/plugins/nessus/42263](https://www.tenable.com/plugins/nessus/42263)

SSL Self signed cert CVSS v2 6.4 [https://www.tenable.com/plugins/nessus/57582](https://www.tenable.com/plugins/nessus/57582)

So using an unencrypted protocol is worse than an encrypted one with a self- signed cert. (and before anyone says "ah that could be because people mis- place trust in the cert", that's not a factor in CVSS calcs) yet the unencrypted protocol scores lower.

<comment><USER3> They're both rated medium. Makes me wonder how one come across either of these vulnerabilities in practice.

Telnet is disabled by default since windows 7 (that's 10 years ago). You wouldn't see anything internal with telnet unless it's seriously misconfigured or employees doing their own thing to circumvent IT. This should one maybe be upped to high.

self signed certificates on the other hand. either there is someone too lazy to obtain public certificates or the scanning tool doesn't accept the internal PKI.

<comment><USER2> Endpoints in a network aren't all PCs :) In some industries (e.g. SCADA) Telnet is very much alive.

Also even on the Internet, Shodan has about 5.2Milllion hosts with the Telnet port exposed...

</comment></comment></comment><comment><USER4> Once upon a time I wrote a CVSS 2/3 library for Python[1] (more have appeared now, this[2] looks nicer).

CVSS is really complex and seemingly arbitrary. Take a look at this (rather horrible) code to calculate a CVSS score from another library[3]. Yes, the code is disgusting, but even if you abstract it away nicely it boils down to: do some maths with some arbitrary numbers[4], then perform a bunch of conditions, and you (hopefully) get 3 numbers spat out.

I don't like it. There are bugs in the 'official' calculator around floating point numbers, the spec had several typos in the calculations (one being an extraneous negative symbol!) and the naming system for the components is needlessly complex.

There are surely simpler, less magical ways to score, compare and rate vulnerabilities?

1\. [https://github.com/ctxis/cvsslib](https://github.com/ctxis/cvsslib)

2\. [https://github.com/skontar/cvss](https://github.com/skontar/cvss)

3\. [https://github.com/toolswatch/pycvss3/blob/master/lib/pycvss...](https://github.com/toolswatch/pycvss3/blob/master/lib/pycvss3.py#L32)

4\. [https://www.first.org/cvss/specification- document#7-1-Base-M...](https://www.first.org/cvss/specification- document#7-1-Base-Metrics-Equations)

</comment><comment><USER5> I don't know any real software security person who takes CVSS seriously. It's mostly a Ouija Board you use to rationalize setting finding severities where you want them (high if you're on offense, low if you're on defense).

The other useful function of CVSS is to flag people you shouldn't take seriously in the industry. So, for instance, Kevin Mitnick runs a "zero-day vulnerability brokerage" that only accepts zero-days past a threshold CVSS. That's a pretty decent clue about the legitimacy of the service.

Don't waste time with CVSS.</comment>


Decriminalize Psychedelic Plants and Fungi in San Francisco - <AUTHOR> http://decrimsf.org <comment><USER3> There are some drugs about which good arguments can be made on both sides of the legality issue. Highly addictive ones do indeed ruin lives, and while there is an argument that that should be the person's choice, the other side can argue that the government is there to better the common good, and that can include protecting people from their own bad decisions. I have mixed feelings about the legality issue when it comes to cocaine, meth, heroin, prescription opioids, etc.

With psilocybin mushrooms, though, I can't imagine any reasonable argument that people need to be protected from themselves. They aren't addictive by any definition of addiction I know of. And they can do some amazingly positive things, especially for those who are facing death due to illness or just old age. I would go so far as to say it is tragic that such people are denied relief from the horrible feeling of impending death that mushrooms can provide.

Not that I am against people just doing them for kicks, either.

<comment><USER4> Please bear in mind that the origins of drug prohibition had little to do with "protecting" people, and were instead instruments of oppression.

Drug abuse a health problem, not a criminal problem. We spend orders of magnitude on the criminal side and, guess what? It only makes things worse.

Legalize. Regulate. Tax.

It's very simple, and is the only correct answer.

<comment><USER3> Maybe. I think it's unfortunate that people who are saying their answer is "the only correct" one are probably going to slow down progress.

Laws aren't always about crimes, by the way. Not wearing seatbelts or motorcycle helmets shouldn't be seen as a criminal problem, but we still have laws about it. Maybe you disagree with those laws, and that's fine.

I think it is less fine to say that your perspective on the issue is the only one that can be reasonably seen as valid.

<comment><USER4> Please don't confuse my adamance in defining the problem as an applied ideology in the real world. I'm pretty damn pragmatic and don't play purity politics.

I'm sticking with my statement, because it's true. I welcome reasonable refutations to it.

You overlooked the word "regulate". That means laws, but applied towards health and safety of products sold, rather than punishing the consumer.

We still need DUI laws (and related), but otherwise it's a personal choice all the way down.

</comment></comment></comment></comment><comment><USER5> The DEA Scheduling system is not fact-based and needs to be completely redone. In fact, the categorizations are provably false e.g. PCP is schedule II, Cocaine is schedule III, Xanax is Schedule IV etc, while Marijuana and Psilocybin (mushrooms) are Schedule I.

Yes that's right, according to the federal government, marijuana and mushrooms are more harmful, more addictive, and have less medical use than PCP, Cocaine, or Xanax.

<comment><USER6> PCP was a general anesthetic, cocaine is still a local anesthetic used humorously enough for rhinoplasty [1] (and eye surgery if I'm not mistaken) and Xanax is an antidepressant so by that strict measure there's some logic.

With that in mind it's a completely asinine system and should be thrown out. It's such an utter waste of time when Portugal's policy of decriminalizing everything a decade and a half ago showed massive public benefit and no increase in drug use. [2]

Nothing about the war on drugs is "fact based." This whole conversation is about re-shuffling the deck chairs when we should be getting off the Titanic.

[1] [https://www.ncbi.nlm.nih.gov/m/pubmed/9935273/](https://www.ncbi.nlm.nih.gov/m/pubmed/9935273/)

[2] [https://www.theguardian.com/news/2017/dec/05/portugals- radic...](https://www.theguardian.com/news/2017/dec/05/portugals-radical- drugs-policy-is-working-why-hasnt-the-world-copied-it)

<comment><USER7> Xanax is not an antidepressant, it is a sedative-hypnotic.

<comment><USER8> Ostensibly, it's foremost an anxiolytic.

</comment></comment></comment></comment><comment><USER9> Can't help but wonder what the unintended consequences of decriminalizing psychedelic plants would be in society? I'm thinking this might create a new market for Shamans (therapists ?) that guide you through psychedelic uses! What else?

<comment><USER10> They are decriminalized in other parts of the world, including places like the Netherlands, and you wouldn't know it.

</comment></comment><comment><USER11> Amazing how psychedelics might be legalized before housing in San Francisco.

<comment><USER3> Housing is far more complicated, obviously. To claim it isn't "legalized" is using a very weird definition of the word.

Luckily, the city of San Francisco can work on multiple problems at once. They don't feel the need to wait for the homeless problem to be solved before they fix a pothole on the street or apply a fresh coat of paint to a piece of playground equipment.

This is a simple issue that can improve lives. Sometimes in dramatic ways, such as for the terminally ill. And it can be changed without a lot of money or effort being spent.

</comment></comment><comment><USER12> Why stop at plants? If someone chooses to take whatever substance it's no one else's business (unless others have to pay for the medical treatment afterwards... but that is easily solved by NOT making others pay). The actually dangerous drugs - the ones (SSRIs, notably) which have suicide as a side effect, sometimes resulting in people going on murderous rampages - <USER2> quite legal and widely prescribed. Go figure.

<comment><USER13> _How_ do you stop paying for medical outcomes? And _why_ should we care?

As part of insurance pools, today I pay for extreme sports injuries, alcohol and tobacco related chronic problems, outright stupidity, and obesity related issues.

No one seems to balk at that; why should THC or magic mushrooms be fundamentally different? Even if they "should" be, how _could_ they be?

<comment><USER14> I agree with you in the sense that refined sugar in processed foods should be highly regulated, as society pays an enormous cost for it.

</comment></comment></comment><comment><USER15> I had to vouch averros and I can't reply to him, great. Decriminalize all drugs.

Cheese + SSRI: [https://en.wikipedia.org/wiki/Serotonin_syndrome](https://en.wikipedia.org/wiki/Serotonin_syndrome)

Grapefruit + SSRI: [https://en.wikipedia.org/wiki/Grapefruit%E2%80%93drug_intera...](https://en.wikipedia.org/wiki/Grapefruit%E2%80%93drug_interactions)

<comment><USER16> Are you thinking of cheese+MAOIs?

Because SSRIs aren't known for having that interaction with fermented products at any dose I've seen.

<comment><USER15> I am thinking of cheese and MAOIs. SSRIs are still extensively mentioned in the wiki article on Serotonin syndrome.</comment></comment></comment>


My Own Car System, Rear Camera, Offline Maps and Routing with Go - <AUTHOR> https://blog.nobugware.com/post/2018/my_own_car_system_raspberry_pi_offline_mapping_map_matching_places_part2/ <comment><USER2> This is pretty awesome. Back in the late 90s I ran a 333Mhz Celeron in a little box under the seat of my car, with a parallel port LCD display, as my MP3 player.

I've thought about building something like this, but it just seems like a ton- o-work. This project seems to have maps+camera, no media player yet.

I do run/build a lot of my own stuff (my own web/email server managed via ansible/docker), I run custom Android roms and I do like building things myself, but with the time tradeoff, I just find it easier to get a Pioneer nav/media unit. (Tried the Joyen Android versions for a bit too, but it's difficult to get a good/safe car UI setup in Android).

<comment><USER3> I've often wondered why there hasn't been someone that developed a good Android headunit project. What is it about Android that has made it difficult to make a good/safe car UI? Couldn't one just mimic Android Auto? Or even just run Android Auto?

<comment><USER4> You can buy aftermarket Android Auto headunits: [https://www.androidauthority.com/best-android-auto-head- unit...](https://www.androidauthority.com/best-android-auto-head- units-791179/)

<comment><USER5> I have one in my car - pumpkin audio. It does the job great. Talks to my back up cam - smart mirror, and i've written scripts so it takes pictures of the driver at ignition, opens my last spotify track, last google map search etc

<comment><USER6> The pumpkin audio website isn't super-informative -- do you know where I could find out if their units support my Toyota's backup camera and steering wheel buttons?

</comment></comment></comment></comment></comment><comment><USER7> Great project. Offline mapping is a great feature addition. I'm working on a similar side project using C++ and Qt. I tinkered with Qt maps for a bit, but found it was sucking up too much of my time building a navigation app with all of the necessary features so I scrapped it. I will probably try to integrate an open source mapping app later on to make life easier.

So far, I got music streaming and voice calls working over bluetooth and I'm currently working on cleaning up the UI. I'm also considering upgrading my board to the i.MX8 which recently came out. Next I''m planning on adding an LTE modem, OTA updates and some kind of basic music app.

<comment><USER8> How do you handle aesthetics? Sounds like a really fun project but a big challenge, at least for me, would be to make it look pretty and not like a Sunday hack.

<comment><USER7> Hardware is the biggest challenge and what I assume you are asking about. My first approach was to get a double din computer case, which gives you an aftermarket look. The better option is to go to the junk yard and get a stock head unit and replace the internals. The problem here is finding an LCD that fits the dimensions. Another thing I've been thinking about is using a larger LCD that sticks out of the dash like the Tesla Model 3. Downside here is there is no space for physical buttons which I really like.

</comment></comment></comment><comment><USER9> Very neat! I'm still relying on my car's built-in display for the camera, so my computer isn't doing maps or the like, but I've got a computer in my car mostly for music and GPS logging, always neat to see what other people are doing!

<comment><USER10> Do you have any writeups/pictures/etc on your setup? I'd like to get some systems in my car but I'm not sure where to start.

<comment><USER9> I don't have a good comprehensive write-up, but the code is here: [https://github.com/ocdtrekkie/HAController](https://github.com/ocdtrekkie/HAController) The README describes the modules which should give you some idea of what it's designed to do. It's built in Visual Basic and also designed to run my home automation system. It is janky and while I wouldn't mind someone else using it, I wouldn't exactly recommend it. :P

In the car, I run an Intel NUC on the floor of my car, and the display I use is an Adafruit serial backpack-based unit ([https://learn.adafruit.com/usb- plus-serial-backpack/overview](https://learn.adafruit.com/usb-plus-serial- backpack/overview)) inside a plastic enclosure along with a small USB hub and the GPS receiver. The enclosure's attached to my dashboard using the same 3M strips available for IPASS/EZPASS devices.

My first question is always "what do you want to do?" What frustrations do you have, what would make your life easier to automate? A lot of times it is less than you think.

</comment></comment></comment><comment><USER11> Does your car have a custom licence plate ?

<comment><USER12> From what I can gather by the maps, he's located in Quebec city in Canada and we didn't have custom plates until July 2018.

</comment></comment><comment><USER13> Does anybody know if it would be possible to just run a standalone version of Android Auto on something like this?

</comment><comment><USER14> > _In Part I, I had to patch qtmultimedia for the camera to work, but Qt > compilation is ressource hungry, same goes for the osrm compilation, the > memory of the Raspberry Pi is too small_

I was just thinking about this today. Is it possible to set up an arm VM for "dev" and port the binaries over to the RPI?

<comment><USER15> qemu is capable of emulating an ARM cpu so yes but won't be able to emulate all the real hardware, especially the opengl ES gpu. From a compilation perspective I believe using a cross compiler is way more efficient than emulating the whole system.

<comment><USER16> > _...especially the OpenGL ES GPU..._

Does Virgil3D not work in DBT QEMU targets?

Generally agree that cross-compilation is a better solution, but I think it could also be nice to have everything (except the drivers for your actual hardware) tested _as delivered_.

</comment></comment></comment><comment><USER17> Why write a new gpsd when a mature one exists? Why not just write a Go interface to it?

<comment><USER15> I've tried to explain this in part 1:

I assume you talk about gpsd? or libgeoclue?

gpsd is slow to start because it tries to detect the baudrate as stated in the manpage Autobauding on the Trimble GPSes can take as long as 5 seconds

I didn't find any solutions to disable this behaviour.

libgeoclue is a giant ecosystem relying on tons of libraries to work with and it does not work on my system.

<comment><USER18> No, a cheap tablet with Android and install OsmAnd~

</comment></comment></comment><comment><USER19> And you can add 100% on-device and private-by-design Voice AI to your car using what we are building at [https://snips.ai](https://snips.ai)

<comment><USER9> My system is built for a conversational interface, but I don't have voice recognition in place yet. Questions: Why is a Raspberry Pi required? If a Raspberry Pi is required, why does the computer need to be either MacOS or Linux?

Would it be possible to use this to, say, look for a hotword and then just always return the rest of the command to a single program, since I have my own command structure already in play? I need the on-device voice recognition and hotword detection, but not the actual assistant.

<comment><USER20> A popular choice seems to be Mycroft

[https://mycroft.ai/](https://mycroft.ai/)

(no affiliation)

<comment><USER9> Mycroft is again, a whole assistant setup though, I just need a good local voice recognition component. Command processing and TTS are already built-in to my own code. I'm not totally opposed to adding a Raspberry Pi, but since my existing automation code runs on Windows, I at least need something that can talk to a Windows box.

</comment></comment></comment></comment><comment><USER21> I'm thinking of replacing my 2010 BMW with something... simpler. Since good mechanics don't exist I need a car I can work on myself. That means probably not much later than 2005. I see that late 90s 4-Runners are cheap now and nice vehicles but miss a lot of the fancy buttons I have become accustomed to. Early 2000s M3s are similarly priced. Both have DIN headunits. This kind of project would really fill that gap for me.

</comment><comment><USER22> The latest Kenwood AA units use Linux (no surprise) and Qt. Their UI is wonky af though.

<comment><USER23> Do they comply with the GPL? If so, custom firmware seems like a real possibility!

<comment><USER24> Qt for devices is commercial only, not GPL.

<comment><USER23> My question has nothing to do with Qt.. GP said it was using Linux, and the kernel _is_ GPL.. so.. are they compliant? Are they releasing any/all modifications they are making to the kernel for booting it on their device?

<comment><USER24> GPL requires you to supply sources together with binaries. Is he distributing binaries to anyone?

</comment></comment></comment></comment></comment><comment><USER25> Now this is something I can get behind.</comment>


Paranoid: North Korea's computer operating system mirrors its political one - <AUTHOR> http://uk.reuters.com/article/northkorea-computers-idUKKBN0UA0GF20151227 <comment><AUTHOR> More discussion on previous submission here: [https://news.ycombinator.com/item?id=10798586](https://news.ycombinator.com/item?id=10798586)

</comment><comment><USER2> But now we need a UX analysis ;)</comment>


Zoom private chat text between attendees is actually public - <AUTHOR> https://twitter.com/HJHaldanePhD/status/1244302917206708233 <comment><USER3> This headline is SOOO garbage - seriously - what is up with HN and Zoom these days. Just trash headlines.

Edit: In case it is removed this was the original headline "Zoom private chat text between attendees is actually public"

From the zoom docs.

"If you save the chat locally to your computer, it will save any chats that you can see-- those sent directly to you and those sent to everyone in the meeting or webinar.

If you save the chat to the cloud, it will only save chats that were sent to everyone and messages sent while you were cloud recording."

This is TOTALLY different than all private chat text is public. 100% false. Private chat text is available to the folks who were participants in the private chat. That would be a much more accurate headline.

Now if the recipient of a chat first downloads it to their computer (zoom auto-scrubs if you upload to cloud) and THEN uploads it to the cloud - <USER2> whoever has access to it can see it. But this takes a number of steps. Download your chat and then publish your chat publicly. The headline is completely wrong.

<comment><USER4> The headline isn't fully accurate, but if people are confused about – and burned by – this behavior, it is a documentation & design issue in Zoom.

They need clearer warnings this will happen, or a design which clearly separates the two info-streams, of differing sensitivity, into separate download steps & filenames.

<comment><USER3> The headline is inaccurate.

In a lot of businesses this really is not an issue. Many businesses don't want a lot of bob mockery in private chat. Webinars people want these questions to go over with a supervisor (common question analysis etc). Hosts can set appropriate controls (public chat only / host only etc).

I hope zoom continues to cater to people trying to get work done - which they seem to be, and not this hyper paranoid, totally misleading title crowd.

The solution on hacker news seems to always be to add lots of new steps, warnings, device authentications, encryption keys, block the host from doing this or that etc. I'm already tired to the endless cookie acceptance popups on the public web.

<comment><USER5> Ah yes, the "totally misleading title crowd," a well known group of people that everyone can easily identify.

> In a lot of businesses this really is not an issue.

I don't think anyone cares about the business in this situation. Individual privacy and freedoms are more important than shareholder value and micromanager snooping. When you force everyone to engage with their coworkers online, you need to find a way to preserve basic human rights -- like two individuals having a private conversation. Tech that obfuscates that, or exposes the contents of private conversations, should be called out for doing so.

Yes, we want business discussions to be open. But at the same time you have to remember that it's _humans_ that conduct the business (as little as VCs may like that, because they're so hard to control and pacify), and that those humans have human needs and emotions, and will have private conversations wherever conversations can be had.

<comment><USER3> The use case zoom is targeting is not encrypted private conversations that focuses on user privacy.

It is conferencing -> generally public / group meetings.

The permissions are _VERY_ loose by default - anyone can join your personal meeting room if you don't put a password based on a simple set of digits after a URL. People can join with NO account, no login. My own experience trying to do a lot more lockdown - people don't like it, they WANT this free and open approach.

If you want private conversations - lots of apps out there support that. But many apps targeting business have a corporate / compliance / discovery API option. For example, slack is very popular, and admins can get corporate export turned on or discovery API which allows exports of your PRIVATE direct messaging conversations by the company. So if you think zoom letting a user see their OWN messages is bad, slack (often a popular programmer system) let's admins get everything you ever typed.

The one I hate the most are the SSL middleware boxes and decrypt everything.

</comment></comment></comment></comment></comment><comment><USER6> It's not clear to me from this thread whether those messages only become public if one of the parties to the messages then download the chat, or even when a third party downloads the chat. One seems more serious than the other.

<comment><USER7> The consensus appears to be that if Alice is talking "privately" to Charlie about Bob's stupid hair, and Alice is the person designated to save the minutes of the meeting and post them, then she may accidentally include the transcript of her Bob-mockery.

<comment><USER8> Correct. When a given user downloads chat history, it downloads everything they can see: public chat and their own 1:1 conversations. Zoom has plenty of security and privacy issues, but this is not one of them [1].

[1] [https://support.zoom.us/hc/en- us/articles/115004792763-Savin...](https://support.zoom.us/hc/en- us/articles/115004792763-Saving-In-Meeting-Chat)

<comment><USER9> I wouldn't say it's not one, just that it's a very minor one. Mixing of privacy contexts is a common problem on the social side of security. If it warrants an alert notifying you that you are saving both private messages and public ones if it notes both when saving locally (and I think that is definitely warranted), then not doing so is a (minor, most likely) security UI problem (if you accept that actual people and their common behaviors need to be accounted for as threat vectors).

<comment><USER10> > then not doing so is a (minor, most likely) security UI problem (if you > accept that actual people and their common behaviors need to be accounted > for as threat vectors)

Yes, you want to account for people's actual behavior. This isn't going to rise above the level of "minor" if viewed from a security perspective, because it's a self-only attack -- nobody gets any powers they didn't already have, and Alice is hurting herself, not someone else.

(She might inadvertently hurt Carl, if Carl was sending her messages making fun of Bob, but she was _allowed_ to do that anyway.)

A usability or operational perspective might object to the behavior here more strongly.

<comment><USER9> You're assuming it's only used for interpersonal things. If Manager A requests a password regarding some system they are discussing from Manager B in a private chat which other Employees in the channel should not have access to, but inadvertently exposes it after downloading and sharing the channel chat, that is definitely a security problem. Any private channel of communication that is easily combined with a public channel of communication without warning is a security problem.

It's not about hurting people's feelings, it's about _information leakage_. And to cut off anyone that says passwords shouldn't be shared in a private chat, that's irrelevant. Good infosec security practices in one place do not preclude criticism of bad practices elsewhere. Security is about layers or protection, so any layer with problems should be noted. If that layer happens to be a third party application that mixes private and public channels in some instances and if there isn't warning as to this happening, it deserves to be called out.

Another way to look at it is that any minor information leakage can have a major impact if the information leaked is very important.

<comment><USER10> > And to cut off anyone that says passwords shouldn't be shared in a private > chat, that's irrelevant. Good infosec security practices in one place do not > preclude criticism of bad practices elsewhere.

It's not irrelevant. There are phone apps with no other purpose than to publicize your location. If you should happen to be a fugitive, using such an app would be a bad move. Does that make the privacy leak in the app a security problem? No, how could it? If you don't want your location publicized, the answer isn't to remove the only feature from a location-sharing app so you can run NOPs in peace. It's to stop using the app.

Your misuse of a feature that performs exactly as advertised can't justify calling that _feature_ a security problem. The people responsible for the feature don't know how you're using it. The _use pattern_ is the security problem, and it needs to be addressed by people who (1) know what it is, and/or (2) are responsible for it. Zoom fulfills neither criterion.

<comment><USER9> > It's not irrelevant. ... the answer isn't to remove the only feature from a > location-sharing app so you can run NOPs in peace. It's to stop using the > app.

That's clearly not the case here. It's irrelevant in that in the context of this specific discussion, which this application, which is marketed towards enterprises as secure, an argument that a sharing of private information accidentally though bad UI is the problem of the user for putting private information in that private channel is irrelevant.

> Your misuse of a feature that performs exactly as advertised can't justify > calling that feature a security problem.

That depends on how we classify "exactly as advertised". If the overall claims of the product as to being secure are easily and often circumvented on accident through poor UI, then that _may_ be a security or privacy problem. If that place it's advertised is not something that most users will encounter during normal usage, then how it's advertised is of little consequence.

One extreme end of this would be something hidden deep in the EULA or privacy policy that advertised how this works, and the other extreme end would be an alert every time you use it that explains this. I think one is obviously a problem (to the point that it looks purposeful), and the other obviously isn't, but the only difference between them is where the information is placed or how assured you can be that the user has encountered and hopefully understood it. I think this clearly indicates that the problem is not whether certain behavior is advertised, but how aware users are made of how the application functions.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> Personal anecdote: Use Slack for DMs.

<comment><USER12> Slack DMs aren't guaranteed to be private from server admins

</comment></comment><comment><USER13> Zoom is a wall-to-wall security disaster. When my company switched to it about a year ago one of my colleagues showed me how to force any Zoom room, anywhere on the planet, in any organization, to join our meeting. I just don't think it was architected for privacy and security, and you can't add those things later, so you should be prepared for a years-long trickle of this kind of news.

<comment><USER14> Out of curiosity: Could you be more specific on the issue and how it works?

<comment><USER13> It's related to [https://medium.com/bugbountywriteup/zoom-zero- day-4-million-...](https://medium.com/bugbountywriteup/zoom-zero- day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website- ac75c83f4ef5)

<comment><USER14> Thank you.</comment></comment></comment></comment>