New Medium Instance, 64-bit bit Ubiquity, SSH Client - <AUTHOR> http://aws.typepad.com/aws/2012/03/ec2-updates-new-instance-64-bit-bit-ubiquity-ssh-client.html

<comment><USER3> 64-bit small instances are perhaps the best new announcement. We now have two different builds and AMI's for all our different node types, just so that we can use a small instance when necessary and a large instance otherwise. We can now drop half of our images and use 64-bit everywhere.

The medium instances are also very welcome, since previously the gap between small and large was quite big (4x the memory for 4x the price).

<comment><USER4> I remember being at a Cloud Unconference in Seattle about 2-3 years ago asking for 64bit for all instance types. Actually, I think I begged for it. It took a while, but I'm glad it's here now.

I would have to say, Amazon is at least receptive to suggestions. You can always email or chat with Jeff Barr and make suggestions.

<comment><AUTHOR> Thanks Gary, I am always happy to listen to and to pass along suggestions. My email is in my profile.

</comment></comment></comment><comment><USER5> We have most of our workload running on Rackspace Cloud Servers (UK) and the more improvements AWS make, the more overpriced and ridiculously underperforming the Rackspace offer becomes:

Underperforming: I don't get why the bigger Rackspace Cloud Servers don't get more CPU cores, just a bigger share of the original 4 cores on the host server. This might look fine but at the end I just want more processes (PHP threads) running at the same time.

Overpriced: The pricing is really high for Cloud Servers. I'm paying around £460 a month for a 16GB RAM Cloud Server (4 cores, 620GB (!) disk). For around €448 I have a Rackspace dedicated server with 48GB RAM, 2 x 6 (modern) cores and a 480GB RAID10 array.

I'm actually switching most of our workload to dedicated hardware, it's less cool but it's just cheaper and faster, in this case.

NB: We tried AWS but the MySQL IO performance, either in EC2+EBS or RDS, was not enough for us.

<comment><USER6> I've been told by my Rackspace rep that they're working towards moving away from VMWare and onto something else (based on their Open Stack system).

Supposedly (and take that with a grain of salt since this information is a few layers removed) the current VMWare based cloud they have is limiting how flexible they can be about their offering, i.e. every instance price level just doubles everything and all but the 32G instance has 4 virtual cores. Once they move to the new system supposedly you'll be able to mix & match things more. Maybe their current cloud really requires homogenous hardware, I don't know.

As for modern cores: Rackspace is somewhat conservative about what hardware they offer, though you can get special order. My desktop i7 2600K has single- thread performance that's essentially twice of the quad-core quad-CPU Xeon in the "real" server. A place like Hetzner -- [http://www.hetzner.de/en/hosting/produktmatrix/rootserver- pr...](http://www.hetzner.de/en/hosting/produktmatrix/rootserver- produktmatrix-ex) \-- offers a € 49 server using that.

As for AWS, isn't the way to "fix" that to use essentially striped EBS volumes?

<comment><USER7> That's not quite right. Rackspace currently uses the Xen Hypervisor for public Cloud, not VMWare. The new Cloud Servers (Nova) is based on the open source OpenStack Compute (<http://openstack.org/projects/compute/>) code base. The new Cloud Servers is in public beta right now for people to try out ([http://www.rackspace.com/blog/rackspace-cloud-servers- powere...](http://www.rackspace.com/blog/rackspace-cloud-servers-powered-by- openstack-beta/)).

The new Cloud Servers will have much greater flexibility and a better feature set. It will help solve many issues that customers have with the current offerings. That information will be coming out over the next couple of months, but since we are only about two-weeks different from the OpenStack nova code base, you can always look there for a preview.

Rackspace does offer a VMWare based private cloud (<http://www.rackspace.com/managed_hosting/private_cloud/>) for customers who want virtualization, but on their own dedicated hardware. VMWare is not used for public cloud (as far as I know).

Obvious Disclosure: I work at Rackspace and this is to the best of my knowledge.

</comment></comment></comment><comment><USER8> Also: the MindTerm Java SSH client!

I can't think of too many cases in which I'd have my private key but no terminal to SSH from, but I like having this option.

(Takes me back to bygone days of serving up MindTerm from my home computer over dyndns, a convenient way to do what I needed to do from restrictive school machines... Anyone else do that?)

</comment><comment><USER9> This is exactly what I needed.

I'm currently using the Rackspace VM that gives 4gb of ram. I wanted to switch to EC2 after they dropped prices, but I would have either had to drop down to a small (1.7gb - not an option for my workload) or up to a large (7gb - <USER2> over $50/mo more).

With all of these improvements Amazon is making, Rackspace's VM offerings are now horribly overpriced.

</comment><comment><USER10> These are welcome changes, but I really, really wish that new medium instance had 2 or 4 cores. I would pay a bit more for that, and having a single core is where many of our workloads really start to feel the pain, but we don't need all of the power (or cost) or a large instance.

I understand the economics though - cores definitely cost a lot more than memory, so perhaps its just wishful thinking.

EDIT: I should clarify - I know they already have the "High CPU Medium", but it would be nice to have a step between that and the Large instance type that had two cores, but slightly more memory.

</comment><comment><USER11> This is a great news. Before that, if you start with a small instance, there is no way to upgrade to higher instance since they exclusively support 64-bit. Now you can upgrade smoothly from micro to any instance.

</comment><comment><USER12> Go 64-bit!

A medium instance is actually a very nice option for small deployments.

Micro instances are throttled -[http://gregsramblings.com/2011/02/07/amazon- ec2-micro-instan...](http://gregsramblings.com/2011/02/07/amazon-ec2-micro- instance-cpu-steal/). I, personally, do not maintain any 32-bit AMIs. The offer gap between a micro and a large instance for 64 was large enough for me to feel it.

</comment><comment><USER13> This is excellent, I was just complaining about the 32-bit-only medium high- cpu instance types yesterday. Now I just wish they'd add another mid-range instance with ~3.75 GB RAM and 2x2=4 or 2x2.5=5 CPU. Basically combine the higher resources from each of the medium types.

</comment><comment><USER14> Typo in title: "64-bit bit Ubiquity"

Other than that, exciting news. EC2 has always been about being able to choose a fitting solution for your particular needs, and this fills a niche.

</comment><comment><USER15> It's weird that they would introduce the Medium instance as "new", when it's actually a return -- they used to have Medium instances a couple years ago, and retired them.

<comment><USER10> They've still had medium instances - I just spun up a few the other day. When did they retire them?

<comment><USER16> AWS has a couple classes of medium. For a complete list, go here:

<http://aws.amazon.com/ec2/instance-types/>

In the API, the new one is "m1.medium" . The one you spun up the other day was probably a "c1.medium" .

</comment></comment></comment><comment><USER17> The first two changes feel related. What change do you suppose they made to their infrastructure that has enabled these features?</comment>


"The Code Lumberjacks" – a simple analogy about how effective programmers think - <AUTHOR> https://docs.google.com/document/d/16DFBJcsqs5aHWz6cX0zGeUEQ_SxSNBUnKpwEknGXFvE <comment><AUTHOR> My wife has been teaching herself to program for the last year - one of her big challenges has been understanding when to hack on a problem until it's solved versus when to go looking for sharper tools.

She found this analogy quite helpful, and I hope others in the same boat will find it helpful as well.

</comment><comment><USER2> Trees and forests may not be the right context. Weeds and the vegetable garden may be better. The third time out, a tool that removes weeds may look pretty good.

<comment><AUTHOR> Hmm, that's probably also a good place to start an analogy about code maintenance. Weed by hand first, then weed using good tools, then automate your weeding if things get out of hand.</comment></comment>


Build a GraphQL API server efficiently without vendor lock-in - <AUTHOR> https://github.com/charlie0077/graphql-server-crud <comment><USER2> I'm glad this exists.

When I was getting started in GraphQL two years ago and had questions for things like pagination I either got downvoted[0] to hell or "help"[1] in the form of, "Why don't you just use Apollo/Prisma"? No offense to any frameworks but they often come with a bunch of crap I don't want/need. Even the eventual "solution" provided in [1] didn't offer pagination without a framework.

[0]: [https://stackoverflow.com/q/48817281](https://stackoverflow.com/q/48817281)

[1]: [https://github.com/howtographql/howtographql/issues/514](https://github.com/howtographql/howtographql/issues/514)

<comment><AUTHOR> Thanks for sharing. I totally feel you. I spent long time doing research and not super happy about what I found. I would say prisma/hasura is pretty good at this point, however, as a "minimalist", I just feel it is better to have some light weight "helpers" that does most the jobs and give you full control of everything, no extra process, no new things to learn, no blackbox, etc.

</comment></comment><comment><AUTHOR> You should try it if you don't like black box.</comment>


Simone Giertz is out of surgery and her doctors are very pleased - <AUTHOR> https://twitter.com/SimoneGiertz/status/1002036156752543746 <comment><USER2> Really great news, and heartwarming to see so many people pulling for her.

</comment><comment><USER3> Excellent! I saw her short video she released yesterday just before her surgery, and was wondering how it went. I hope her recovery is as quick and painless as possible, she's a great lady.

</comment><comment><USER4> Finally breathing again. Couldn't bring myself to watch her "Going into surgery" video yesterday. I may not be close to her in any sense of the word, but she is a valuable person to this world and certainly above average in terms of humanity and kindness.

</comment><comment><USER5> Glad to see this update here, I was just thinking about it this morning.

</comment><comment><USER6> related, [https://www.youtube.com/c/simonegiertz](https://www.youtube.com/c/simonegiertz)</comment>


Go Debugging with Delve, or No More Fmt.Printfs - <AUTHOR> https://tpaschalis.github.io/delve-debugging/ <comment><USER3> Coming to Go from C#, I was shocked at how poor the debugging experience was, even inside Google itself (I worked at GCP for less than a year).

I don't get the mentality of people who don't feel the importance and satisfaction of being able to step through their code line-by-line and see everything coming to life in a debugger window, even if its for sake of watching it, not for finding a code bug. Some people seem to never have used one for years and they take it as a sign of weakness if someone says they need one to find a bug rather than looking at the code.

I haven't and if its up to me, I would never use Go again, just because of the piss poor debugging experience in a language that's so new. Google engineer's mentality is very old school and anyone who enjoyed the beauty of conditional breakpoints and step-through debugging in modern IDEs will know exactly what I am talking about. Go is so new yet built with incredibly ancient mentality.

<comment><USER4> You should try Jetbrains Goland if you're looking for a modern IDE with a great debugging experience [0]. If you're talking about visual studio being modern, i don't think that's true. I have used it recently and i was surprised by how outdated it is (maybe i'm not used to it). Also, I can't seem to do any changes while the code is running. That's very annoying.

[0][https://www.jetbrains.com/go/](https://www.jetbrains.com/go/)

</comment></comment><comment><USER5> I occasionally feel the need to use a debugger. But nothing beats the ease and power of the humble printf in all it's forms in all languages. Sometimes you need a debugger. But you can get _really_ far with just a printf.

</comment><comment><USER6> Delve is great and debuggers in general are some of the best tools but to take the title at face value diminishes the value of the unassuming print facilities in every language.

There's a time and place for proper debuggers and (more?) time and place for a simple print statement in my humble opinion.

</comment><comment><USER7> I remember trying out Delve about a year ago while it was still in its infancy and don't remember there being commands like `goroutines`; I may be wrong. The overall experience wasn't all that good to be honest.

My initial impressions of delve was "Oh it's basically GDB for Go". But seems like the debugger has become more stable and more mature over the years by shipping language specific commands; like `goroutines`.

<comment><AUTHOR> Yes, the project has gone a long way, as it's being used by what may be the two most prominent development environments for Go (VSCode and Jetbrains Goland).

GDB still has a lot of value if you're working with a non-amd64 architecture or want to dive into cgo parts of a codebase, but Delve is a great addition to your toolbelt!

</comment></comment><comment><USER8> The only thing I've seen that seems genuinely better than print debugging most of the time is the Playground concept, which is just print debugging automatically for every line of your program. Debuggers seem like they are useful sometimes, especially if it takes a lot to get into the state you want to debug, but focusing on making small rapid tests and printing lines that are interesting to you seems to keep me from ever actually bothering to setup delve.

<comment><USER9> > which is just print debugging automatically for every line of your program

Like... a REPL?

<comment><USER8> Playgrounds are like a REPL but they are constantly reevaluating your code from the beginning, so you can edit code anywhere in the file and see how it changes everything.

</comment></comment></comment><comment><USER10> Go plugin for VS Code has first class support for delve (as well as Emacs) - <USER2> have been using it for more than a year!

<comment><USER11> It has support, but definitely not first class - I just tried a short time ago, and it wasn't possible to invoke functions while debugging; GitHub issue here: [https://github.com/microsoft/vscode- go/issues/2655](https://github.com/microsoft/vscode-go/issues/2655).

<comment><USER3> Its a problem with the Go compiler. Even IntelliJ doesn't support that, and its annoying AF.

</comment></comment></comment><comment><USER12> As a lifelong printf debugger in many languages, what I'd prefer is to be able to send my printf's into different streams and have a scrollable, filterable and searchable console for each stream

Kinda like the console in web developer tools (F12)

<comment><USER13> Are you looking for the log module, but with a UI on top of it (something like splunk, but for local development)?

<comment><USER14> I think we all ultimately want Chrome DevTools features for Go :)

</comment></comment></comment><comment><USER15> Does anyone have a good workflow for spanning go->cgo. I have found it very hard to code and debug in the space. I end up using gdb, but that lacks a lot of the go context and you cannot go into the c code with delve.

<comment><USER16> This is where I typically resorted to printf statements in pure C.</comment></comment>


Ask YC: What should people want that they don't? - <AUTHOR>

What important projects is "Build something people want" leaving out? <comment><USER2> Transparent, secure, end-to-end encryption of communications. The PGP/GPG folks have been telling us "eat your vegetables" for 25+ years now, to little effect.

Long-term internet archives aka public record.

Free as in speech software as the default.

Data and format portability.

<comment><AUTHOR> Why doesn't "build it and they will come" solve these issues?

<comment><USER3> They're not pain points. Solving them doesn't improve convenience.

</comment></comment></comment><comment><USER4> I think that the line "build something people want" is not particularly useful. It's been said that "marketing is the art of making people want what you have". There are plenty of examples of things that people didn't want because they didn't exist, from Coca Cola to Twitter. I never imagined that I wanted an ipod shuffle until I tried one and now I don't leave home without it. Had it never been made, I still wouldn't know.

</comment><comment><USER5> Its the lack of information. Most people are clueless about their surroundings...so pretty much anything where people are ignorant would fall under that category.

So pretty much anything privacy related.

<comment><AUTHOR> When I present ideas about parenting people say "Are you a parent?"

That is private and irrelevant information, but they keep pestering me about it. Can you make a start up to solve this problem please? i want more privacy. thanks :)

</comment></comment><comment><USER6> That's a dangerous question to ask, because if you have to wonder what you want people to want, they probably don't really know either and won't see the value of your idea. It seems that best and most useful ideas tend to grow naturally and looking too hard for a problem to solve will probably end up solving a non-problem.

For a good example of this, see <http://www.joelonsoftware.com/items/2008/05/01.html>

</comment><comment><USER7> Information: A way of checking and tracking the actual polling processes of published opinion polls, including exact questions asked and calculations of margin of error. A way of tracking your person diets intake of different ingredient types, (transfats, hfcs, etc.) and rank health impacts. Meshes of lobbyists, industries, politicians involved in each vote. I can think of many more places where people should want more information but don't.

<comment><USER8> > A way of tracking your person diets intake

(along that line) The data that companies have about you available to you in a machine readable format. (e.g. your grocery receipts)

</comment></comment><comment><USER9> People might not always know what they want. An example: my mother needs a simple, easy to use computers that does barely more than surfing in the internet, manage her photos and write some documents. But she thinks she needs a full-blown PC with Windows Vista just because her friends have one.

</comment><comment><USER10> If you build something they _should_ want it but _don't_ , then you have 2 problems, building it and convincing them that they _should_ want it.

Since the former is difficult and the latter is _very_ difficult, I'd just stick to building something they know they want.

How do you know what that is? Ask them. People aren't bashful when their hair is on fire.

<comment><USER4> One problem is that what people want is not always what they say they want. I'm sure lots of people would say they want news shows without fluff, healthy fast food, a funny partner who enjoys leisurely walks on the beach, etc. On the other hand you have the "guilty pleasures" that people won't admit to. As a mild example, I dislike CNN but I still go to their site once in a while.

One more thing is that what people want (even when they tell the truth) is not necessarily what they will pay for, or at least pay enough to make it profitable. I want a flying car with a high mpg at the price of a regular car. I'd buy a Segway for $500.

The truth is that there are no formulas for creating a hit. It's a matter of persistence and iteration. Create something, see how people like it, make it better/cheaper depending on what they want, keep iterating. Stay focused and execute better than your competition. Of course, easier said than done.

<comment><USER10> Agree to all of it.

I'm just suggesting that it's easier to scratch the itch they claim to have than to scratch the itch you think they should be claiming to have.

Either way, you have a lot of work to do.</comment></comment></comment>


Generating convincing audio and video of fake events - <AUTHOR> https://www.economist.com/news/science-and-technology/21724370-generating-convincing-audio-and-video-fake-events-fake-news-you-aint-seen <comment><USER2> Hasn't this already happened? Remember the Project Veritas videos of ACORN employees giving advice to a pimp on how to run his child prostitution ring that were all over the news in 2009? Multiple investigations found the videos where so heavily edited as to be fake:

[https://en.wikipedia.org/wiki/ACORN_2009_undercover_videos_c...](https://en.wikipedia.org/wiki/ACORN_2009_undercover_videos_controversy#Investigations_of_ACORN_and_the_videos)

The original videos were everywhere, ACORN was driven to bankruptcy, and the investigations revealing the videos were faked got hardly any news coverage. The art project described in this post is very quaint in comparison to this very real life event.

<comment><USER3> To expand on this point further, the phenomenon of synthesizing accounts of a person saying something has already existed for thousands of years.

If I tell you that "Trump said that low income families will receive unconditional, federally sponsored medical coverage," you will not immediately take my word on it. You will critically analyze my statement by scritinizing who I am to make this claim, and the claims congruency with what you already know to be reality. I am not a reputable publication, so you are not likely to believe me, because the claim is contrary to what is already known.

The same will become true of video. A video of what looks like somebody saying something will become as useful as hearsay testimony. We will, through necessity, begin critically scrutinizing the source of footage, not just taking it's content at face value.

In many ways this already exists in the photography world. Convincing photo manipulation is old technology at this point, and I think we've adequately adapted to it.

<comment><USER4> _In many ways this already exists in the photography world. Convincing photo manipulation is old technology at this point, and I think we 've adequately adapted to it._

Have we? I'm pretty sure there's still a pretty serious problem with young girls developing their self-image based on heavily manipulated photos of models in the magazines they read. That's a benign example, as far as the purpose of the manipulation, which can be argued to be 'artistic'. An intentionally-damaging example of photo manipulation is much of the falsified propaganda that was distributed last year during the presidential campaign, which I'm sure included a lot of manipulated photos. That stuff definitely influenced the election, and our whole political climate. I don't think people, in general, have adapted to the idea that what they see isn't necessarily real.

</comment></comment></comment><comment><USER5> This article title is a bit off. The audio is not generated, the video is not convincing, and the original conversation is not fake.

This is an art project which highlights the implications of research like Face2Face: [https://youtu.be/ohmajJTcpNk](https://youtu.be/ohmajJTcpNk)

<comment><USER6> Glad you posted this, I was about to look for this same link to share. Between this and Adobe's voice emulation software [https://thenextweb.com/apps/2016/11/04/adobes-upcoming- audio...](https://thenextweb.com/apps/2016/11/04/adobes-upcoming-audio-tool- lets-you-synthesize-speech-in-anyones-voice/) it appears possible to create very realistic 'footage' of constructions based on real people doing and saying things. The film industry create computer generated characters of deceased actors (Star Wars for example). this makes the Economist piece very out of touch with realities, and presumably there are far more sophisticated technologies we don't know about too....

</comment></comment><comment><USER7> Most prestigious publications have weighed in on this topic, with all it's titles and euphemisms: fake news, alternative facts, conspiracy thinking, echo chambers..... mostly with nothing to say.

Scientific American recently ran a feature that may as well have been titled: " _You won 't believe SHOCKING the TRUTH about FAKE news!!_"(1) For the first half of the article, they cited credentialed research institutes, people, sub- disciplines like computational sociology and talked about recent "advances" made "studying social phenomena in a quantitative manner."

As far as I can tell, the only content was "confirmation bias exists," with a non-explicit implication that our understanding of this newly discovered phenomenon is advancing fast. There was also an anecdote about texas.

Everyone seems to want to weigh in on this conversation, but no one seems to have anything substantial to say about it.

So sure, "conspiracy theorists" will be able to challenge video evidence. I don't know if that changes anything.

(1) actually titled "inside the echo chamber"

</comment><comment><USER8> I remember an old sf book (sorry, forget the name) where this kind of "fake" video is used for nefarious purposes. Imagine a video of a president saying something inflammatory that they never said.

Talked about that with a friend who does video editing in the early 2000s and she said they could it then.

So, while GANs make make it far easier to build up fake soundbites, the capability has been around. We just need restraint in the media and ways for the common person to verify info. (Given how easily fake news spreads around FB, the latter is probably more important.)

<comment><USER9> > ways for the common person to verify info

If that could be done automatically, we could skip a lot of time consuming, expensive research. Church and Turing already proved there are no general solutions to the _Entscheidungsproblem_.

On the other hand, if you were thinking of some sort of service that provides "authoritative" verification, you've only moved the problem. The service can be faked (or corrupted) just as easily. Similarly, we already have many historical examples where restraints on media are ( _de facto_ ) used against political enemies.

What we need is a way to educate people with the scientific method and just enough logic to implement it practically. Sagan discussed this problem in "The Demon-Haunted World: Science as a Candle in the Dark", which I regularly recommend to anybody that seems to need his "Baloney Detection Kit"[1].

[1] [https://www.brainpickings.org/2014/01/03/baloney- detection-k...](https://www.brainpickings.org/2014/01/03/baloney-detection- kit-carl-sagan/)

<comment><USER10> The issue, unfortunately, is that if I were to generate a video of Mike Pence doing something X-rated with another man, there's no conceivable way the scientific method would help. I mean, if he were a closeted homosexual, would you really immediately discount it as faked just because the evidence was against it? That happens to conservative American politicians _all the time._

Worse, the current president has set a new bar for saying outlandish things. Every time he opens his mouth I am literally shocked into silence. The number of things I genuinely cannot imagine him saying is shrinking rapidly. If you were to see a video of Trump walking up to a podium like Obama did when he announced Bin Landen's death and saying very solemnly that bombs were about to be dropped on Russia, would your first thought be "Preposterous! There's no way the man would do _that_ ; it must be a clever hoax."

Not to mention that if this technology becomes exceptionally user-friendly it could be used to destroy lives in myriad ways. Where is your science now?

<comment><USER9> I would say that such a video is none of my business; just like the Clinton's bj, that's a private topic that should be relevant only to the people involved.

I get your point, that scandals involving outdated systems of morality _are_ still a problem in some areas. Technology marches on, and we must learn - as a species - to update our social and moral systems _fast_ or we may find out that intelligence is not[1] an effective survival trait in the long-term.

> The number of things I genuinely cannot imagine him saying is shrinking > rapidly.

Trump's speech is _very_ predictable in it's general theme. The details are random, but he always says things that are self-serving, in a childish "obviously I was always right" attitude. If there's is a way to add a not- very-subtle insult, he will add it.

Most important, it's foolish to try to parse his statements for _information_ , because that's not how he uses language. Instead, he uses phatic[2] language to express emotion, confidence, and social standing.

> [Trump] saying very solemnly that bombs were about to be dropped on Russia

Why would he bomb the people he wants to do business with? The few comments Trump has made about increasing talks with Russia is one of the very few things I like about Trump (not that I expect he will actually do anything whatsoever on that topic). Anything that reduces the risk of _nuclear war_ is great.

> I am literally shocked into silence.

Fear is the mind killer. Recently a _lot_ of people of - orthogonal to political ideology - are doing everything in their power to push the politics of fear. Almost all of it is unsubstantiated hot air... which is what the Baloney Detection Kit is for. Science isn't perfect, but it's still the best method we have for filtering out charlatans, propagandists, and simple mistakes.

[1] [https://news.ycombinator.com/item?id=8916033](https://news.ycombinator.com/item?id=8916033)

[2] [https://news.ycombinator.com/item?id=14577909](https://news.ycombinator.com/item?id=14577909)

<comment><USER10> The point wasn't about outdated morality. It could just as easily be a doctored video of Theresa May stabbing a man to death in cold blood.

I think you've focused too much on the specific examples I gave. Consider a faked video of your SO committing adultery, or a faked video of you committing a crime that's used to convict you, or a video of Merkel saying Putin has erectile disfunction or something.

You can't just analyze these videos for inconsistencies; at some point, the technology becomes more powerful than human ability to discern whether it's real. Then what? What do we do once video evidence becomes unreliable?

(By "shocked into silence" I mean, "stunned by how asinine/insane/pointless/cruel that just was".)

</comment></comment></comment></comment></comment><comment><USER11> The article's recommendation to demand metadata seems pointless. It's easier to fake than content.

<comment><USER12> Easier to _generate_, but also easier to disprove. So maybe not easier to fake. The article briefly touches on this.

</comment></comment><comment><USER13> I wish projects like the Hardy video had a convention to tell the audience that they're fake.

Sometimes the late night shows release satire videos which are difficult to determine if they're real. We should have a logo for "btw, this news footage is a joke."

<comment><USER14> I disagree, sharpening the skill of figuring out what is fake and what is not is important. If you don't learn that, it puts you even more at the mercy of malevolent people putting out fake stuff (which they would then of course not mark).

<comment><USER15> The issue is that there comes a point where the human skill becomes insufficient - the technical capacity to fake exceeds the cognitive capacity to detect it. Sufficiently advanced technology etc.

The solution is not clear.

<comment><USER16> Right. So authenticity becomes a matter of technical analysis. Dueling experts. And given alternative versions of events, people will believe what they like.

<comment><USER17> Or how about hard laws that forbid fabricated news (unless tagged as such)? I'm not saying it is a solution, but it should be explored.

</comment></comment></comment></comment></comment><comment><USER18> Nothing new here. GANs still are not nearly as good at creating fakes then humans.

</comment><comment><USER19> I think they mixed up which network is the adversary?</comment>


How U.S. tech powers China's surveillance state - <AUTHOR> https://www.axios.com/china-us-technology-surveillance-state-5672b822-fdde-45f9-ac77-e7b5574e9351.html <comment><USER2> The conspiracy theorist in me can't shake the idea that American Government allows this because certain US tech is backdoored by US spy agencies and they use it as a way in..</comment>


We should all be Productized - <AUTHOR> https://medium.com/@sazaybarcode/why-we-should-all-be-productized-2d481b6d2e84 <comment><AUTHOR> There is a big boom of programmers and designers in Nigeria , the world "tech" is nothing new or fascinating , all genders and species younger than 30 have started their journey to become software developers one way or the other and each company knows they need an "internet" expert . I can confidently say there isn't a stack alive that hasn't been conquered and the word "full-stack" is not only respected but is chased soo vehemently, you might compare it to been knighted.

<comment><USER2> Yeah I agree with you... I believe the Nigerian technology ecosystem is ready for this productized services revolution. In few years from now we would see productized services pop-up the Nigerian market and this is good for the ecosystem.</comment></comment>


LulzSec's 'Topiary' arrested  - <AUTHOR> http://nakedsecurity.sophos.com/2011/07/27/suspected-hacker-arrested-in-shetland-islands/

<comment><USER2> Excellent. This means the problem is solved and we don't have to secure any of our systems, because he was a one-in-a-billion case that nobody could replicate. (Surely nobody is _currently_ doing the same things with less fanfare.)

<comment><USER3> So we shouldn't arrest people when they commit a crime because others are committing the same crime? Or because they're doing it in a high-profile manner?

I'm not sure what your point is here.

<comment><USER4> > It is dangerous to be right in matters on which the established authorities > are wrong. ~Voltaire

Our governments have no comprehension or understanding of the prospects or implications that the internet has on modern civilization. When an individual can take down an organizations method of operation (mastercard/visa/paypal), it isn't the individuals fault (regardless of their actions) it is the organizations fault.

You don't blame someone for stealing from a bank when they pile gold bullion in the entrance without a guard in sight. You blame the bank because _that's fucking stupid_.

Being able to dDOS mastercard isn't the individuals fault, it's mastercards. I've never heard of someone dDOSing Google, why? Because Google only makes money when people access it and their system can support insane amounts of instantaneous traffic. It's a simple fact that sooner or later mastercard/visa would have been taken down by a normal traffic spike.

Is it the users fault when mastercard gets dDOS'd by a few million people placing midnight orders on Black Friday?

Seriously, look at the world rationally. If I can spend $5 on a padlock, it's my fault when someone steals my $500 BBQ from my back yard. Someone committed a crime, yes, but I'm going to be buying a padlock like I should have in the first place.

Why didn't mastercard/visa/paypal/sony/sony/sony/(sony x 27 fucking times) front the goddamn cash so they wouldn't lose hundreds of thousands.

<comment><USER5> > When an individual can take down an organizations method of operation > (mastercard/visa/paypal), it isn't the individuals fault (regardless of > their actions) it is the organizations fault.

Who cares whose fault it is? It's illegal, they get arrested, it's simple really.

> You don't blame someone for stealing from a bank when they pile gold bullion > in the entrance without a guard in sight. You blame the bank because that's > fucking stupid.

Sure, you can do that. That, and arrest the person too because, you know, they broke the law.

<comment><USER6> >Sure, you can do that. That, and arrest the person too because, you know, they broke the law.

I think it's more relevant that what they did was willfully malicious. I probably regularly violate laws that I'm not even aware of, but the fact that I'm not intentionally doing harm to anyone establishes some kind of innocence.

<comment><USER7> <http://en.wikipedia.org/wiki/Ignorantia_juris_non_excusat>

"The rationale of the doctrine is that if ignorance were an excuse, a person charged with criminal offenses or a subject of a civil lawsuit would merely claim that he or she is unaware of the law in question to avoid liability, even though the person really does know what the law in question is. Thus, the law imputes knowledge of all laws to all persons within the jurisdiction no matter how transiently."

</comment></comment></comment></comment></comment></comment><comment><USER8> The other day his Twitter feed was cleaned up and a single tweet remained: <http://twitter.com/#!/atopiary/status/94225773896015872> reading "You cannot arrest an idea". I guess he saw this coming.

<comment><USER9> Almost positive that's a direct quote toward the end of Alan Moore's _V for Vendetta_.

Which kinda makes me grin and roll my eyes at the same time.

<comment><USER10> I've been listening to the teaching company's audio lectures on the history of freedom, and I think the idea that "you can't kill an idea" is also represented in Socrates & Jesus-- both of their influences did not waver after death. /historynerd

</comment></comment></comment><comment><USER11> So the A-Team dox were a bunch of rubbish? (or perhaps that was already confirmed and I missed it).

<http://pastebin.com/iVujX4TR>

<comment><USER12> If this report is right, then those d0x were BS:

      ###########################################################################
      ###########################################################################
      ooooooooooooo                       o8o
      8'   888   `8                       `"'
           888       .ooooo.  oo.ooooo.  oooo   .oooo.   oooo d8b oooo    ooo
           888      d88' `88b  888' `88b `888  `P  )88b  `888""8P  `88.  .8'
           888      888   888  888   888  888   .oP"888   888       `88..8'
           888      888   888  888   888  888  d8(  888   888        `888'
          o888o     `Y8bod8P'  888bod8P' o888o `Y888""8o d888b        .8'
                               888                                .o..P'
                              o888o                               `Y8P'

      ###########################################################################
      ###########################################################################

        Now we have Topiary.  Probably the lamest one of the bunch.  He doesn't
        actually do anything except give interviews.  There are plenty of logs of
        him all over the internet being a complete idiot.  His "d0x" are all over
        the internet also.  He tries to deny it but there are logs of him bitching
        about being d0x'ed int he #hq logs that Laurelai leaked.

        Name: Daniel Ackerman Sandberg
        Location: Sweden

<comment><USER13> It's not unreasonable to suspect that a user in the Shetlands Isles might have had a POP in Sweden, or use of a connection in Sweden to host a remote box with a better connection than available to them normally.

<comment><USER14> Well he can probably see Sweden from his house!

</comment></comment></comment></comment><comment><USER15> Every time I read a story like this, I picture the opening sequence from "Hackers". I wonder if that isn't one of the most realistic portrayals (of anything) in that movie?

<comment><USER16> I was busted in much the same way in the early 90s in NYC.

Yes, it was the only realistic part of the movie. It is a bit frightening to be woken up by a man pointing a shotgun in your face when you are 13.

IIRC, there was a well known NYC hacker who was getting ready for school, and was in the shower, when the SS burst in and the scene was loosely based on him.

<comment><USER17> Any way we could get you to share more of your story?

<comment><USER16> Not much to say. It was part of operation sundevil. I was never arrested or indicted and eventually got all my equipment back.

I'm not sure if it is SOP, or the Secret Service thought they were dealing with violent criminals. But they knocked down the front door with one of those rams you see on TV , ran room to room "securing" everything. Once they realized they were dealing with a scared 13 year old they seemed more embarassed than anything.

In addition to the local cops, and the Secret Service, there was a postal inspector involved, that guy was kind of a dick, he kept sneering and telling me stuff like "you are going down buddy", even at that young age I figured he didn't get out of the office much. The Secret Service spent post of their time bullshitting and telling me stories of various trips abroad with the president. Some of the nerds bagging up all my equipment would sometimes come in and peer at me, asking me minor questions like "Why do you have so many batteries" until they were reminded that I was a minor and they did not have parental permission to ask me questions.

I waited for years for the other shoe to drop, and be indicted, but I never was.

I still have all the equipment, still tagged, and even have some disks they put in the drives labeled "SS transport disk"

<comment><USER18> "I'm not sure if it is SOP, or the Secret Service thought they were dealing with violent criminals"

seems possible the bulk of them had first learned about hackers at the same time they learned about the raid -- perhaps from someone who exaggerated the average size of a hacker's fangs. in any event it doesn't seem likely that in preparation for sundevil they'd have consulted with anyone that would have urged a relaxed and moderated view of what was at that time an unexplored frontier of law enforcement.

<comment><USER16> Right, from the sheer scope of the raids I'm sure they thought they were dealing with some sort of syndicate, probably professional criminals branching out. They were absolutely dumbfounded, they didn't know whether to slap the cuffs on me or give me milk and cookies.

<comment><USER4> > they didn't know whether to slap the cuffs on me or give me milk and > cookies.

Sounds like good cop, bad cop to the extreme. I think I'd deal in 5 seconds if a cop offered me milk and cookies over handcuffs.

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> I find it hard to believe that European kids care that much about the CIA or Arizona's immigration laws. Yet many of these alleged LulzSec arrests seem to be in Europe.

<comment><USER20> I think every wannabe-hacker wants to "hack" the CIA and Arizona's racist laws have been covered extensively on comedy programs like The Daily Show which I'd imagine are popular with anti-authoritarian internet-savvy youths worldwide.

<comment><USER21> Of course, if it were really about their problems with "racist" immigration laws, many countries in Europe have stronger and more strictly enforced immigration policies.

</comment></comment></comment><comment><USER22> I am very curious as to the methods of how they caught him. Anyone care to guess, or know?

<comment><USER23> Well, since no one else is wading in here's what look like the usual suspects to me:

\- obvious digital connection (forgot to use tor / ipredator / hacked vpn)

\- timing attacks (keeping normal waking hours for his home country, using a vpn instead of tor)

\- word frequency attacks (since he wrote a lot of press releases, his word choices may have been cross correlated with a personal blog)

\- bragging to a friend

\- getting flagged after showing up at a political/high-suspicion meet up (which might be enough to allow for a timing attack)

\- voice analysis from interviews he did w/o a voice transformer being matched to other audio

\- opsec blunders (loose lips when talking to press / on IRC / wherever anon talks)

Anyone else have any guesses?

<comment><USER24> if I were tasked with catching these guys, I would:

* setup numerous honeypot open proxies and tor gateways

* work with journalists to have all emails and communications forwarded

* isolate ddos clients and reverse-engineer command and control. surprisingly many of these trojans are poorly written and have security holes themselves

* setup numerous fake twitter profiles and provoking them into responses - things like posting images, replying, etc.

* setup fake hacker groups. stage defacements etc. in order to get in touch with them

* I would write a system that tracks and stores every bit of communication they make and plot out their social communication graphs and when they are talking, who to, etc.

* ask ISP's or proxy providers to grep for traffic patterns.

* get user-agent info from twitter, or provoke them into visiting a link, and possibly load malware. no browser is really safe in a targetted attack

* word/speech tracing. this is why 1337 5p34k was invented, so you can not be traced via your vocab/grammar/spelling/phrases etc. it doesn't take a large sample to start narrowing it down

probably more - haven't really thought about it, but when i did see that they started using twitter I gave them 3-4 months, tops.

<comment><USER22> "1337 5p34k was invented so you can not be traced via your vocab/grammar/spelling/phrases etc"

What about txt msg spk?

<comment><USER25> It was invented so you can not be understood via your vocab/grammar/spelling/phrases etc.

</comment></comment></comment></comment></comment><comment><USER26> Article does not say why they think that he is Topiary.

<comment><USER24> the newspaper hacked his phone

</comment></comment><comment><USER27> For computer crime do they have to be able to draw a direct line from the act to the person's computer? Also, does a persons computer legally mean they committed the crime? What I'm getting at is, could a group like LulzSec guarantee lighter sentences for themselves if a line could be drawn from the crime to the group but you couldn't determine who actually hit the keyboard?

<comment><USER28> In the US, they could be charged with "Conspiracy to commit <crime>".

> _One important feature of a conspiracy charge is that it relieves > prosecutors of the need to prove the particular roles of conspirators. If > two persons plot to kill another (and this can be proven), and the victim is > indeed killed as a result of the actions of either conspirator, it is not > necessary to prove with specificity which of the conspirators actually > pulled the trigger._ [1]

I'd assume English law has something equivalent -- it's a really old problem, and involving computers won't change the principles involved.

[1] [http://en.wikipedia.org/wiki/Conspiracy_%28crime%29#Conspira...](http://en.wikipedia.org/wiki/Conspiracy_%28crime%29#Conspiracy_in_the_United_States)

<comment><USER2> Given the close proximity of this case to the News Corp phone-hacking case, any bets on whether similar conspiracy-to-hack charges will be brought against all the people who were involved in that one? Not putting large odds on it; I'd bet that if anybody goes to jail for it, it'll only be a person or two who can be shown to have actually personally done the break-in.

</comment></comment></comment><comment><USER29> I'm curious what led to all the arrests. It's not _that_ hard to hide your identity if you truly want to be anonymous.

<comment><USER30> Hiding your identity from casual observers: trivial. Hiding your identity from scrutiny by local law enforcement: straightforward. Hiding your identity from scrutiny by federal agents: Tricky. Hiding your identity from scrutiny by an international investigation after having pissed off several high octane intelligence agencies: impossible.

<comment><USER31> Not impossible. Very burdensome and lonely, but not impossible.

<comment><USER32> Not impossible in the strictest since, but highly improbable. Even Bin Laden went down and he had a lot more on his side than all of the members of lulz and anon combined.

</comment></comment></comment></comment><comment><USER33> According to:

[http://www.guardian.co.uk/technology/2011/jul/27/lulzsec- hac...](http://www.guardian.co.uk/technology/2011/jul/27/lulzsec-hacking- suspect-topiary-arrested)

The source is the Metropolitan Police Service of London, a.k.a. Scotland Yard.

</comment><comment><USER34> The top minds behind Lulzsec are worth more to federal authorities ALIVE - when (or if) they are caught. By alive, I mean: not in a prison cell.

Frank Abagnale Jr. comes to mind.

<comment><USER35> No they're not that good, if the arrests are correct then they're actually pretty bad. For the little value that they are worth, they're worth far more as an example to be made for others.

<comment><USER36> Actually, arresting them is next to worthless. Does the oodles of cash spent each year pursuing, prosecuting, jailing, fining, policing and enforcing vandalism cases result in decreased vandalism? Boredom is a social problem, no amount of enforcement will reduce bored kids desire to break stuff. If anything, drawing attention to Anonymous only attracts more people to it.

</comment></comment></comment><comment><USER37> It always grates on my nerves when someone that young, seventeen, is referred to as a "man".

I suppose teenagers enjoy more freedom in Europe, maybe it's more appropriate there.

<comment><USER38> Scots law: age of consent (and age you can enlist) is 16, drivers license is 17, drinking and voting is 18. And this is Scotland, so the age of criminal responsibility is 12. (Until recently, it was eight: <http://news.bbc.co.uk/1/hi/scotland/7916561.stm>).

</comment></comment><comment><USER39> I found it interesting how he deleted all of his twitter updates with the exception of "You cannot arrest an idea"

<comment><USER40> I think that at least a few other people have access to the account. To bad there isn't an api to see when the tweets were deleted.

</comment></comment><comment><USER41> I'm on the edge of my seat following all this AntiSec/AntiAntiSec drama: The original AntiAntiSec crusader: <http://th3j35t3r.wordpress.com> has picked up some helpers: <http://lulzsecexposed.blogspot.com/>

</comment><comment><USER42> They always shoot the messenger.

</comment><comment><USER43> <http://www.quip-art.com/3RP>

</comment><comment><USER44> I was surprised there was someone in the Shetland Islands?

</comment><comment><USER45> Interesting that this arrest follows just a week after a series of other arrests in USA/UK/NL regarding LulzSec and Anonymous:

[http://nakedsecurity.sophos.com/2011/07/20/arrests- lulzsec-a...](http://nakedsecurity.sophos.com/2011/07/20/arrests-lulzsec- anonymous-hacker-suspects/)

Not a good time to be a hacktivist

<comment><USER46> Hacktivists? These guys are breaking into private companies and stealing property. They're _criminals_.

<comment><USER47> Hold on, hold on, let me try to clear some things up.

A _criminal_ is a rigidly-defined adjective meaning an entity which breaks or broke laws.

An _activist_ is a rigidly-defined term meaning an entity which acts to further some idea and bring it to public perception.

A hacktivist isn't well-defined, but we'll assume here that it's a form of activist.

Now based on this, the Anonymous and Lulzsec hackers _were_ hacktivists, at least according to their own statements of their intent. They also _were_ criminals, at least according to my reading of the laws of the US. Now, what you may be looking for is whether they were _ethically good_ \--- but don't conflate lawfulness with morality, that's worked out poorly in both directions.

But of course, you acknowledge that this is a horribly simplistic view of things. Even DnD got this, after all (clearly Anon is Chaotic, and whether it's Neutral or Good depends on whom you talk to).

So perhaps you might say "I don't believe Anon's actions were for the good", or even "weren't well-intentioned", but please recognize that passing judgement beyond noting the factual statement that they are criminals, is a personal judgement. Not that personal opinions shouldn't be argued, defended, and spread --- just that they should not be conflated with fact.

<comment><USER48> I agree to the defined terms, and further purpose hacktivist is an activist who's chosen/preferred method is "technology", be it illegally accessing private systems, or building nifty robots out of servos and shit.

But, what cause or idea have they furthered? Computer security? Social injustices? Tax evasion by corporate amarica? I can't find one other then their own personal enjoyment.

I can not point to a single action they have taken and describe it as "constructive." The issues they do occasionally allude to could be furthered much more successfully, legally and in a morally responsible fashion (respecting individuals privacy) by other means.

As for their harm, it is fairly self explanatory, but to make it clear, releasing innocent individual's personal information and encouraging others to use it to commit further crimes is most decidedly not neutral.

I don't believe LulzSec's actions helped anyone. If you think they did some good, please enlighten me, point it out. I can't see it.

<comment><USER49> I would argue that their actions, at the very least, are getting people thinking about the privacy and security issues we face. Their methods are blunt and can be damaging, but you can't deny that people have been talking about these issues much more, and I think that's a good thing.

<comment><USER48> Raising awareness for privacy and security issues is a good thing. Doing so by creating more privacy and security issues is decidedly counterproductive.</comment></comment></comment></comment></comment></comment>


The anatomy of a housing bubble - <AUTHOR> http://www.macleans.ca/economy/economicanalysis/the-anatomy-of-a-housing-bubble/ <comment><USER2> What?? Maclean's? How could you?</comment>


Bust Your Butt for a 4% Raise or Coast for 3%? - <AUTHOR> http://www.ellisbenus.com/ellis-benus/programmer-compensation-is-in-the-crapper/

<comment><USER2> Not my experience. But I've primarily worked in places where programming talent was front & center, valued, and the cost of replacing a good developer was high.

If you get a 3% raise at a big software company, that's usually a sign you're not doing very well and might want to think about leaving. A healthy raise should be in the 6-12% category. Your top co-workers are getting raises like that. Compounded yearly, it adds up.

Not to mention the component of negotation that comes into play. You'll have similar employees making $60k next to ones making $90 or $120. Not necessarily all skill driven.

Worry about saving a little out of each paycheck and getting good returns in the stock market? You're better off doing well at work and getting a healthier raise.

Pick a good place to work. If you care enough about your career to spend time on ycombinator, but you're working in the back office of a healthcare company, you should seriously think about upleveling your employer. Remember, you can always fire your boss. Find a place to work where the software talent is the main thing. Not back office support. Not consulting. A place where software drives the business from the revenue side, rather than being a cost center.

</comment><comment><USER3> I don't think that most managers are money-stupid at all. I think they rightly recognize in most cases that mediocre is far cheaper than great, and the difference might be worth the savings. If you're a manager of an internal IT department, it doesn't benefit you that much to have a kick-ass coder on your team, not nearly as much as it benefits you in your review to have saved that much money in salaries. jsrfded has the right idea, the only place to find proportionate compensation is in a business where the software is the product.

</comment><comment><USER4> Many companies are penny wise and dollar stupid.

</comment><comment><USER5> There's a reason companies can do this: most people don't bother keeping up on what they're worth in the open market. Inertia's a bitch. Especially after a few years working.

Another way to say that: people's worths tend towards what they get paid. Especially if that's all they get out of work.

</comment><comment><USER6> very good post. I see this happening all the time, and it happened to me with my last company.</comment>


Parity wallet critical vulnerability. $32M (153k $ETH) Stolen - <AUTHOR> https://twitter.com/cryptoreach/status/887756542514049024 <comment><USER2> Some helpful information about this issue:

\- The vulnerability is in Parity's "enhanced" multi-sig contract

\- This affects Parity 1.5 and later

\- Parity 1.5 was released on January 19, 2017 (have you created any multi- sigs in Parity since then?)

\- The canonical multi-sig contract used in Mist / Ethereum Wallet does NOT have this vulnerability

</comment><comment><USER3> After seeing how many contracts get hacked I wonder why ethereum doesn't implement a way to patch them. I know the blockchain is immutable but they could publish a diff and allow developers to patch bugs before it's too late

<comment><USER4> Not familiar with this too much, but what would stop developers from patching the contract all the time?

<comment><USER3> Maybe define who can patch the contract at time of creation. In many cases you are already trusting the developer not to suicide the contract and run away with the money so I don't see how that would change things.

<comment><USER5> The point of all this automated contract enforcement is so that you don't have to trust the counterparty to abide by the terms.

If you trust the counterparty enough to allow the entity to change the terms of the contract, why use Ethereum?</comment></comment></comment></comment>


Is there a serious problem with coffee capsules? - <AUTHOR> http://www.bbc.com/news/magazine-35605927 <comment><USER2> Betteridge's law of headlines is an adage that states: "Any headline that ends in a question mark can be answered by the word no."

[https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headline...](https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines)

</comment><comment><USER3> Doesn't seem so.</comment>


Why I'll never abbreviate a variable as long as I live - <AUTHOR> https://beehollander.wordpress.com/2016/07/08/the-6-month-bug-and-why-i-will-never-abbreviate-variable-names/ <comment><USER3> "Never abbreviate a variable" is a very strong statement, surely inspiring religious wars. And maybe there are edge cases: i as a loop counter, id for an integer primary key, whatever. But this example is something else entirely; "ttpfe" is honestly the worst variable name I have every seen.

<comment><USER4> Ah, good ol' TransactionTemplatePayloadFactoryExtension.

<comment><USER5> I've just started using Spring in my internship now and some of the class names in our code are pretty hysterical.

</comment></comment></comment><comment><USER6> When hiring we ask for sample code from developers written specifically for the job application. We place a really high premium on readability. Occasionally we'll get code from devs that is very concise - not just abbreviated variable names, but complex long statements using ternary etc.

I'll usually ask them to resubmit code and really focus on readability and it turns out fine. But I think there might be a misconception among devs where the thought is that really compact code shows talent.

Our ideal coder is someone who cares deeply about performance and where the code is ridiculously easy to read and trace through. I mention performance, because in some situations making things more verbose can affect that.

<comment><USER7> Whenever we interview a candidate, the one thing we give high premium on is structure, the rest come next.

 _bad_ variable names, long complex code...can easily be _adjusted_. If the candidate doesn't have a good understanding of how to structure a code (what goes where, for what purpose, separation on concern...), it'll take much more effort to teach that candidate than to teach the _bad_ variable namer.

Properly structured code _naturally_ leads to a better performing software, even if/when a bug arises it'll be easier to spot / test.

All that being said, if a coder names a variables, 'a', 'aa', 'aaa', 'aaaa' that's a serious red flag.

<comment><USER8> "I ran the code through minify, but it's _bigger_ now?!?"

<comment><USER7> I don't understand.

Why would one submit a minified code for a review?

A friend of mine used to work at a place where one of the coder actually used 'a', 'aa', 'aaa'...when naming variables.

<comment><USER8> I was joking. The example sort of looks like something that would fall out of minify -- although 'a' \- 'z' would have to be used/visible in a scope before 'aa' would be generated as a name.

<comment><USER7> I should have clarified. The coder _style_ of naming might seem to be run through minifier, but the coder _actually_ wrote 'a', 'aa', 'aaa'...

My guess is that the coder saw a minified code a took it as a _standard_ or something.

<comment><USER8> And that was the joke: that the original code "out-minified" minify - <USER2> running the original gibberish through minify would NOT make it any smaller :-)

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Great writeup, full of sharp details.

In the 90's I worked on a FoxPro application, also for DoD. My boss, a retired Navy Captain, used very terse variable names, partly because he was a hunt- and-peck typist, and partly because earlier languages allowed only two- character names.

But FoxPro allowed variable names of any length. However, it only _recognized_ the first ten characters. To my boss's chagrin, I often used names longer than ten characters, risking collisions with other long names. That never happened.

But ten years after leaving, I was hired to port the product to Visual FoxPro, which _does_ recognize the whole name. Some of the early commits were "Fixed inconsistently-used long variable name..."

Of course, in those days we weren't using linters, or tests, or source control, or reproducible builds... and yet still had a business. No wonder Alan Kay calls computing "not quite a field."

<comment><USER5> Hearing that absolutely terrifies me like?? Silently allowing names to collide in that way just sounds ridiculous to me.

<comment><USER8> Many early 90s C compilers did much the same thing, though the limit was usually around 32 chars, rather than merely 10.

</comment></comment></comment><comment><USER10> I was recently implementing a geometry algorithm which I looked up on quora. It was described using typical vector notation, using r,s . t,u. Since I referenced the algorithm in the comments, I decided to use these same variable names in my code.

I think this is the right choice, but my code reviewer didn't. But he didn't click on the quora link.

Why is okay for mathemeticians to abbreviate things but programmers? Is it because they deal in more abstract entities where the name is irrelevant?

<comment><USER11> In math, notations are designed to make statements about the problem domain concise. Once you pass a certain degree of concision, longer names impede readability rather than enhancing it. That is because the ability to take in an entire complex expression or subexpression at a glance tells you things—and lets you see patterns—that wouldn't be as apparent if longer names were used. Programmers in the APL tradition understand this, but most programmers do not. (Many refuse to believe it's possible when they hear about it!)

In software, programmers have grown accustomed to a notion of readability that derives from large, complicated codebases where unless you have constantly repeated reminders of what is going on at the lowest levels (i.e. long descriptive names) there is no hope of understanding the program. In such a system, long descriptive names are the breadcrumbs without which you would be lost in the forest. But that is not true of all software; rather, it's an artifact of the irregularity and complexity of most large systems. It's far less true of concise programs that are regular and well-defined in their macro structure.

In the latter kind of system, there's a different tradeoff: macro-readability (the ability to take in complex expressions or subprograms at a glance) becomes possible, and it turns out to be more valuable than micro-readability (spelling out everything at the lowest levels with long names).

It also turns out that consistent naming conventions give you back most of what you lose by trading away micro-readability, and consistent naming conventions are possible in small, dense codebases. That of course is also how math is written: without consistent naming conventions and symmetries carefully chosen and enforced, mathematical writing would be less intelligible.

Edit: The fact that readability without descriptive names is widely thought to be impossible is probably because of how little progress we've made so far in developing good notations, and tools for developing good notations, in software. This may not be so hard to understand: it took many centuries to develop the standard mathematical notations and good ways of inventing new ones to suit new problems. Mathematics is the most advanced culture we have in this respect, and in computing we're arguably still just beginning to retrace those steps. If we wrote math the way we write software, mathematics as we know it wouldn't be possible.

Edit 2: The best thing on this is Whitehead's astonishingly sophisticated 1911 piece on the importance of good notation: [http://introtologic.info/AboutLogicsite/whitehead%20Good%20N...](http://introtologic.info/AboutLogicsite/whitehead%20Good%20Notation.html). If you read it and translate what he's saying to programming, you can glimpse a form of software that would make what people today call "readable code" seem as primitive as mathematics before the advent of decimal numbers seems to us. The descriptive names that people today consider necessary for good code are examples of what Whitehead calls "operations of thought"—laborious mental operations that consume too much of our limited brainpower—which he contrasts to good notations that "relieve the brain of unnecessary work".

Applying Whitehead's argument to software suggests that we'll need to let go of descriptive names at the lowest levels in order to write more powerful programs than we can write today. But that doesn't mean writing software like we do now, only without descriptive names; it means developing better notations that let us do without them. Such a breakthrough will probably come from some weird margin, not from mainstream work in software, for the same reason that commerce done in Roman numerals didn't produce decimal numbers.

<comment><USER12> _If you read it and translate what he 's saying to programming, you can glimpse a form of software that would make what people today call "readable code" seem as primitive as mathematics before the advent of decimal numbers seems to us._

This is an extraordinary (and enticing and often advocated) claim that has, so far, failed to produce the extraordinary evidence. It says something that a person as concerned with notation as Knuth used mathematical notation for the analysis of algorithms and a primitive imperative machine language to describe behaviour.

<comment><USER11> I see no connection here to what I wrote, which has nothing to do with functional vs. imperative programming. I'm talking about names and readability in code.

Imperativeness is a separate matter. One can easily have it without longDescriptiveNames, and although I don't have Knuth handy, I imagine he did.

<comment><USER13> At first read the idea you propose is very attractive but I think you do need to address why APL didn't take off. Perhaps they chose a poor vocabulary, are there better ways to represent algorithms?

<comment><USER11> I'm sorry I didn't reply to this during the conversation, but am traveling this week. IMO the short answer is that questions like "why didn't APL take off" presuppose an orderliness to history that doesn't really exist. Plenty of historical factors (e.g. market dynamics) can intervene to prevent an idea from taking off. Presumably if an idea is really superior it will be rediscovered many times in multiple forms, and one of them will eventually spark.

</comment></comment></comment></comment></comment></comment><comment><USER14> If the variables had been named timeOfTenPercentHeightOnTheFallingEdge and timeOfTenPercentHeightOnTheRisingEdge it probably would have still been hard to notice that they had been swapped in that one line.

<comment><USER15> I think the catch is that the 'f' and 'r' keys are right next to each-other, so if you accidentally type one instead of the other then you'd get the other variable by mistake.

That said, you raise a fair point - we don't know how this bug got there. If it was a simple typo like above then the verbose names would have prevented it. If it was a logic error by the programmer (For whatever reason), then you're right that the name wouldn't matter because they typed the one they intended, it just wasn't the right one to use.

<comment><USER16> Fat-finger is only one kind of error -- and one far less common than the good- ole brain-spasm which can easily replace "Falling" with "Rising".

The ability to read the code an find _see_ the error is more important. And one that score even though ttpfe is a _terrilbe_ name "timeOfTenPercentHeightOnTheFallingEdge", is even worse.

</comment></comment></comment><comment><USER17> I definitely prefer more verbose names to abbreviated ones, but I'm not sure that _never_ abbreviating a variable name is the right way to go either. Surely there's a middle ground between `Ttpfe` and `timeOfTenPercentHeightOnTheFallingEdge`?

<comment><USER18> tl;dr: use newtypes!

I like using static types to avoid these sorts of problems. Modern languages like Swift, Rust and Haskell let you make zero-overhead type wrappers around other types.

So here they could have defined `newtype RisingEdge(Float)` and `newtype FallingEdge(Float)`, and then use those types in the function parameters as appropriate.

Helps shorten function names to boot!

<comment><USER8> I miss Pascal "type" block definitions (or C typedefs, at least) when I have to work with too many Java generics.

I know, [Turbo] Pascal (etc) never had generics. But if they had, you would have been able to make a type with a generic expression, rather than a constantly repeated inline monstrosity of an expression.

</comment></comment></comment><comment><USER16> One thing I often see elided in these naming wars is scope: am I the only person who gives longer names to globally visible things than to locals?

For example:

        size_t *find_foo(const char *source_text)
        {
            const char *src = source_text;
            for(; src != 'f'; src++)
               ... do stuff
            ... do more stuff

            return src - source_text;
        }

Now the meaning of "source_text" would not be evident, except for the name. But just glancing at the usage shows that "src" is clearly a working cursor into the source text.

But if I called it "working_cursor" would that really explain anything to the reader? If anything, giving a detailed name risks _misleading_ readers in much the same way as stale comments can mislead.

</comment><comment><USER19> The problem was not that the variable was abbreviated. The problem was that the abbreviated variable was so similar to another abbreviated variable that was used for a similar purpose.

<comment><USER20> sure but if the variable was not abbreviated the chance of collision would have been less.

<comment><USER21> Even with a 200 character variable name, the chance of collision is 100% if it was auto-completed or copy-pasted.

<comment><USER22> At a minimum, readable variables would have simplified identifying the issue after it was introduced.

</comment></comment></comment></comment><comment><USER23> I say this tongue in cheek: With current IDEs having such great autocompletion, has anyone experimented with coding far outside of the ASCII character set? Programming language restrictions aside, I recognize the obvious troubles this would cause. And yet I do a lot of work on simulations where math formulas are converted to code, which means lots of compounded Greek names like "omegaSquared" or "epsilonMinus". Naming decisions becomes more challenging as subscripts and superscripts are added, yet alone matrix indices. At some point perhaps the symbolic name should be replaced with the descriptive name, such as "first_eccentricity_flat_to_fourth". But it sure would be nice to have access to something with such brevity.

<comment><USER24> I see some new emojis on the horizon!

</comment></comment><comment><USER25> I self-tested variable name lengths on my own code.

Three letters is enough to avoid most collisions. Words do not make sense yet. At four letters most words become decipherable given an appropriate encoding. At five letters a two word phrase may make sense.

I make a rough decision based on variable scope - shorter lifetime means shorter variable name, but I rarely go with just one letter as it reduces uniqueness.

If I need to use a really long phrase frequently I take a mathematician's approach and alias it to an abstract and highly unique symbol. The phrase may still exist in the addressed data structure, I just avoid it within the algorithm. Mathy code also has a tendency to encourage numbered variables, e.g. "x0, x1, x2".

<comment><USER26> Did you self test on code from years ago or was it all fresh in your mind?

<comment><USER25> I had approximately a month between when I wrote it and reread it. While it was serviceable in short-term memory, comprehension suffered noticeably in the long term with four-letter or less names.

At the time I did this I was pursuing Arthur Whitney's extremely terse style to see what advantages and disadvantages it brings. My main modification was to add a full description comment inlined into the declaration of every variable, a practice which I have mostly kept up with even after the experiment ended, e.g.:

        var tz : String; /* time zone */

This meant that I was not testing on whether I could reconstruct the entire meaning in my head, just whether it made code flow better to use very short names. My discovery was that it does help, up to a point, because you can always create original short names that differentiate better than long abbreviations:

        result = ttpfe + ttpre;

vs.

        result = q + k;

Any time you copy-paste-modify, you create a risk of error. Including the whole phrase slows down your reading and brings diminishing returns on comprehension as it puts friction on actually working with the variable. With the highly differentiated "q" and "k", error has a lower likelihood of slipping in than the abbreviation because you've minimized the amount of noise in the data - it "chunks" better and you can read the whole algorithm more fluidly. The only problem with using such short names is the issue of reconstruction, which is why I opt for aliasing a long name if I need to work with it frequently, even if it means extra boilerplate to make a local variable. Abbreviation is the worst of both worlds and so I try not to do so much of it.

Given the original 8-character constraint of OP I might have tried something along the lines of:

"edge_t0" "fall0" "ef"

Because there is no way to convey the entire phrase, I see it as preferable to focus on a key aspect, expand that word, and push everything else into more symbolic content, especially numbers. Programmers are already trained to look carefully for uses of 0 vs. 1 in our code. That doesn't mean it's my go-to for an abstract symbol, but it works better than a bad abbreviation.

</comment></comment></comment><comment><USER27> It's the quality of engaging posts like this one that draws me here on a Friday night.

<comment><AUTHOR> Why thank you, sir.

</comment></comment><comment><USER5> Anyone else feel a bit uncomfortable reading the level of detail in this post?

<comment><AUTHOR> I tried to keep it as high-level as I could. What would you change?

<comment><USER5> honestly I don't have any experience working with anything classified, so your judgement is likely oodles better than mine. Great story :)

</comment></comment></comment><comment><USER28> Heh. When I first learned to code as a kid, a variable was max two characters (the first of which had to be a letter A-Z and the other could be a letter or number).

<comment><USER10> Ha, you're right. Commodore BASIC, probably? (written by Microsoft, I think.)

I do remember at some point having access to a language with less restrictions on variable naming, and thinking, "wow, that's so amazing"

<comment><USER8> Or Apple "integer" BASIC. Probably a few other dialects, as well.

</comment></comment></comment><comment><USER29> I would suggest that the need for Englishy variable names is due to a weakness in programming languages and possibly the programming model itself. Why should a set of legitimate values for a computation benefit from how you refer to that set? Can that variable take on undesired values? Do you rely on that name and its comprehensibility to distinguish good from bad values? I sometimes find it hard to believe we still program this way.

<comment><USER30> We don't _have_ to still program this way - you can write code with very strict types, with machine-checked proofs that it works correctly, etc, etc. We don't do this very often because it turns out this level of rigor is incredibly time-intensive.

</comment></comment><comment><USER31> May I recommend checking out Rob Pike's document for a counter-point [http://doc.cat-v.org/bell_labs/pikestyle](http://doc.cat-v.org/bell_labs/pikestyle)

I think that his variable names section is utterly ridiculous, but it's a relevant read from a relatively prolific person, so worth sharing.

<comment><USER8> Thank you for that. That was a good little read.

While many of the Bell Labs guys didn't much like Pascal, Turbo Pascal managed to address almost all of the complaints I've ever seen, while preserving the good parts of Pascal (or Modula???).

Java must look irredeemable to the Bell Labs folks, though. Perhaps it is: UglyNames; limited structured constant literals; still too clunky lambdas for callbacks.

</comment></comment><comment><USER32> This is common in the sciences as well, since senior professors also had the 8-character limit (from fortran [0]). And functions are also named this way as well (see lapack/blas).

Some people also hate typing out slightly longer variable names and what not. I try to emphasize that a section of code will tend to be read more times that it is written, and therefore readability is more important. It's a frustrating battle sometimes, though.

[0] Exacerbating the problem of using the wrong variable is the fact that much existing code uses implicit types...

</comment><comment><USER33> > The term was supposed to be "Ttpfe", but he had mistakenly called it > "Ttpre",

The same cognitive mistake could have happened with it spelled out. Two concepts closely related can easily be confused.

</comment><comment><USER34> TL:DR Abbreviated variables are not always intuitive to others. I tend to agree. If you're going to use a pattern or abbreviation then be as non- creative as possible.

</comment><comment><USER35> Is the issue that they were abbreviations or that they were named similarly?

<comment><USER36> Similarly. The term was supposed to be "Ttpfe", but he had mistakenly called it "Ttpre"

</comment></comment><comment><USER5> I have the... pleasure of working with a legacy oracle database where table names are restricted by convention to 8 names.

</comment><comment> D-Coder Typing is easy. Thinking is hard!

</comment><comment><USER37> let thisIsCertainlyAnApproachThatIAdvocate = true

</comment><comment><USER38> Pwd stands for: ________?

Correct, you guessed it!

Once an abbreviation or acronym becomes _widely used_ it makes sense to use it as a variable name for as long as you live.

<comment><USER37> This comment really deeply gets to the heart of the issue.

Programmer X thinks "I'll abbreviate because MAN IT IS SO OBVIOUS what the abbreviation is, what sort of idiot would think anything else?".

You have nothing to lose by typing:

let password = ''

as opposed to

let pwd = ''

<comment><USER8> It depends on how many characters are significant to the compiler/interpreter. This was a real issue in the 80s, as laughable as it sounds now.

</comment></comment></comment><comment><USER39> That's what linters are for :-P

<comment><AUTHOR> How would a linter catch the presence of a variable that exists?

</comment></comment><comment><USER40> I think the usual rule is that the size of a variable's name should be a function of the size of the scope in which it's visible: If it's a global, it should have a long, descriptive name, perhaps with_underscores or CamelCase or similar. If it's a class member, abbreviate it some. Function locals get even shorter names, and loop indices or temporary variables only used in one part of the function can be single-character.</comment>


Priceonomics: How to Hack the Price of a Hotel Suite - <AUTHOR> https://priceonomics.com/how-to-hack-the-price-of-a-hotel-suite/ <comment><AUTHOR> Hey there, I'm one of the founders. AMA about hotels legacy technology preventing them from being able to compete against Airbnb.</comment>


The Internet's Own Boy: The Story of Aaron Swartz [video] - <AUTHOR> https://www.youtube.com/watch?v=vXr-2hwTk58

<comment><USER2> Previous discussion with video download links:

[https://news.ycombinator.com/item?id=7959979](https://news.ycombinator.com/item?id=7959979)</comment>


Ad-hoc Polymorphism in F# (how to survive without Type Classes) - <AUTHOR> http://withouttheloop.com/articles/2014-10-21-fsharp-adhoc-polymorphism/ <comment><USER2> My preferred approach [http://withouttheloop.com/articles/2014-10-21-fsharp- adhoc-p...](http://withouttheloop.com/articles/2014-10-21-fsharp-adhoc- polymorphism/#comment-2990462112)</comment>


Harvard Smartphone Usability Study  - <AUTHOR> http://www.youtube.com/watch?v=sryBnF6Klcg&feature=player_embedded

<comment><USER2> I can't tell if they had multiple people trying to complete each task on each phone, or if they had only one shot per phone.

Plus adding contacts and dailing a number, aren't really common tasks on a smartphone, are they??

On the iPhone, it seems the user didn't have to select a person to send the txt too.

</comment><comment><USER3> Love the Benny Hill music, but for a study, don't you need more than one person per phone per task? Would it have been too hard to get 5-10 people per phone per task?</comment>


Ask HN: Handling Aggressive Competition - <AUTHOR>

It came to my attention today that a competitor of ours is spreading false information about my company in their sales process.  My co-founder occasionally takes meetings, on behalf of our clients, with other marketing companies.  At a meeting today, the account manager of one of our competitors gave my co-founder incorrect "factual" information about our company, unaware that while my co-founder was representing the client at the meeting, he represents our company full time.
While I'm not terribly concerned about the competition, as I feel we have a superior product, and I know we have a substantially lower price, I am concerned about the nature of the information that they are spreading.  Essentially, we know that they are willing to tell our clients that we have poor search engine visibility and substantially less traffic than we actually have in order to encourage them to cancel our service and transfer to theirs.  Neither of these statements is true, we currently rank first on Google, Yahoo, and Bing for the appropriate keywords.
In addition to their statements, I am also concerned by the company itself.  Unfortunately, the competition in this case is a Fortune 500 company.  My concern is that their status and partnerships will lend credibility to their account manager's false statements, and start costing us clients and future sales.  The situation is essentially upside down; we have captured the market in this geographic area, and the new entrant is our large competitor.
Has anyone dealt with a similar situation?  What do you do when your competition isn't playing fair? <comment><USER2> stick with measurable advantages. Nobody rational expects a salesman to tell the truth, so when you have a measurable advantage, the salesguy has got to work extra hard to make the sale.

If you are charging $20 for something that is measurably quite similar to what your competitor charges $70 for, well, they have to do a lot of talking to close the sale, while you are in a pretty good position just slapping the price and how you are measurably similar to the competition on your webpage.

Having a liberal money-back guarantee (and following through with it; people talk.) also helps overcome credibility gaps.

I think Paul Graham wrote something about how 'you might be able to out-hack oracle, but there is no way you can out-sell oracle' or something like that. I'm probably misquoting him. but the idea is that large companies have huge sales advantages that you simply can not touch. your product needs to be a better enough value that it doesn't matter that the competition has better sales than you do.

at prgmr.com, I focus on picking up the 'cheap' customers- I don't just mean people who don't want to pay, I mean people who don't cost as much to support. Don't be afraid to loose high-effort customers to your competition. (as much as possible, do so gracefully.)

</comment><comment><USER3> Find out if you have legal recourse. Assess the extent of the situation, and the clients involved. Place correct information on your website. Expose your competitor in whatever way necessary, especially for people cancelling with you.

<comment><USER2> Eh, personally, I think it's important to appear graceful about it. Sure, post truthful statements on your website, tell people, etc... but, for example, publicly accusing your competitor of lying about you is probably in bad form.

</comment></comment><comment><USER4> If it's a large company, talk to the manager of the person who is sharing incorrect information and ask them politely to talk to the person about it.</comment>