Zoom has a signed binary that runs any unsigned script - <AUTHOR> https://twitter.com/DanAmodio/status/1245329512889487361 <comment><USER2> A thread from yesterday: [https://news.ycombinator.com/item?id=22736608](https://news.ycombinator.com/item?id=22736608)

</comment><comment><USER3> Some more shadiness from this company. The Zoom.us-website is explicitly allowing the browser with its content security policy-headers to load scripts from these domains:

[https://*.50million.club](https://*.50million.club)

[https://apiurl.org](https://apiurl.org)

[https://secure.myshopcouponmac.com](https://secure.myshopcouponmac.com)

[https://serve2.cheqzone.com](https://serve2.cheqzone.com)

[https://ad.lkqd.net](https://ad.lkqd.net)

Doing a fast google for these domains shows they are mostly known for being associated with malware...

<comment><USER4> At least it's shady enough :D cX

</comment></comment><comment><AUTHOR> To clarify, this zoomAutenticationTool† is part of the preflight "script" that gets run inside the Zoom installer. It is a signed binary that happily runs anything, including unsigned scripts. This generic-looking tool can be used to bypass code signing requirements. (It does prompt the user for administrator privileges.)

†: I didn't misspell the name of the executable. It's missing an h.

<comment><USER5> What is with Zoom misspelling everything? Their shady installer pops up "System request administrator privileges", and the code it runs misspells "retina" as "reitna".

<comment><USER6> Lack of code reviews and quality assurance.

It is also reported that their engineering team are not native English speakers but I don't think that's the main issue. I've seen codebases full of spelling errors where all developers were native speakers.

<comment><USER7> Yeah, that just seems to be dog whistling to me. A native speaker isn't going to think "reitna" is right but "retina" is not. It's just poor QA IMO.

</comment></comment></comment></comment><comment><USER8> It does make me feel a bit better though - sometimes I go overboard with security and spend hours making certificate validation work everywhere etc - the people actually making money skip all that and just ignore it. They typically get away with bad practices until they really get massive, as long as the software works well otherwise.

Sometimes when coding I think there is technically an obscure race condition security flaw and, from time to time, leave a TODO instead of spending those grueling hours. This weirdly makes me sleep better at night.

At any rate, "sunlight is the best disinfectant"!

<comment><USER9> IMHO those you mention who make money are, in this case, qualified further to a category of products that in essence are not complicated. Video conferencing is not complicated until you have scaling problems. Similarly, Facebook was not complicated until it got millions of users at which point most of their interesting code had to do with scaling.

My point is that Zoom is replaceable and in fact, IMO should be replaced. Their tactics of using these dodgy techniques is because they want to have an edge over competition along the lines of "it just works".

I would contrast this to pure research services that add value that would otherwise not be there. Examples of this would be at the time that they were startups: Google (search algorithms) or Spotify (music categorisation algorithms). I'm not saying that today either of Google or Spotify are paragons of morality. At the hardware level I would include Tesla (battery tech) and Intel (processors).

My point is that the shady practises _are_ at this point Zoom's product offering. If their video scaling algorithms are superior (and not just lifted from some open source libraries) then that should be their product offering. Not "it just works" via security exploits.

Edit: Typos.

<comment><USER10> If video conferencing wasn't complicated, there'd actually be a product everyone likes. So far, everyone seems to hate all of them.

<comment><USER11> How much of this is related to the software though and how much is related to home internet speeds, camera quality, microphone quality, etc.? Most laptops ship with really low quality webcams and mics, and that's predominantly what people are using.

<comment><USER12> The difference between Zoom and Google Hangouts is staggering. Zoom works way better. I actually love it from a usability perspective, though it's frustrating because if Apple/Microsoft/Google could agree on an open standard with open-source clients/protocols Zoom wouldn't be necessary.

<comment><USER11> I've just been using Slack video (for small groups or one-on-ones) and BlueJeans for larger meetings. I've tried Zoom and didn't see what it added on top of BlueJeans except for feeling like malware.

</comment></comment></comment></comment></comment></comment><comment><USER13> Legitimate question: what is bad about this? I've read all the comments and still don't see a convincing explanation.

Code signing just says you can trust that the software you clicked on came from the actual developer.

It doesn't say anything at all about what the software does. Of course signed software can do whatever it wants. It's not like there's supposed to be some chain of trust that it's only allowed to run further signed code. It's free to run a Python script or shell command or whatever it wants. And installers certainly run scripts.

And as other comments here state, to do anything that requires root privileges, it pops up to ask for your admin password, so it's not getting around that.

I see references to this being a "malware pattern" but no explanation of why or what that means specifically. Zoom is commercial software (not malware) and I don't see how this is a vulnerability (something malware could take advantage of) so I'm not getting it.

Can someone explain what the problem is here? Or is there no problem?

<comment><USER14> i was about to write the same comment. id bet the percentage of HN readers running 100% signed code is damn close to 0.

the zoom witchhunt is really something. zoom may or may not be a witch (im no China apologist, i yell at all my friends for using tiktok), but if we get the answer right it will be based on luck and emotion, not logic and reason.

<comment><USER15> > zoom may or may not be a witch (im no China apologist

Zoom is an American company, headquartered in the US, employing mostly Americans, subject to US law, etc. Its CEO is an immigrant, but that's true of half the _American_ tech companies out there, including Google and Microsoft.

EDIT: I'm white, but my wife is Asian-American and has told me more than once how white people often treat Asian-Americans as if they're not real Americans. I'd never witnessed that myself, but I guess the above comment is the kind of sentiment she's talking about. Zoom may or may not be a scummy company, but its founder's birthplace is immaterial. He's a US citizen, and deserves the same treatment we give to maybe-scummy white American CEOs like Mark Zuckerberg.

<comment><USER16> > employing mostly Americans

""Our product development team is largely based in China, where personnel costs are less expensive than in many other jurisdictions," Zoom wrote in a regulatory filing."

Source: [https://www.cnbc.com/2019/03/26/zoom-key-profit-driver- ahead...](https://www.cnbc.com/2019/03/26/zoom-key-profit-driver-ahead-of-ipo- engineers-in-china.html)

<comment><USER15> The concerns about TikTok are that it's potentially Chinese government spyware because TikTok is owned by a mainland Chinese company which has legal obligations to the Chinese government.

Zoom is a US company that is not answerable to the Chinese government. Like many companies, Zoom has chosen to outsource some of its operations, and those overseas offices create various infosec risks. And given that Zoom infosec seems to be a total clown show, those infosec risks are probably more serious at Zoom. But that would be equally true of any other American company that is really lax about security and too cheap to employ American developers.

<comment><USER6> Not entirely true. While Zoom as a company is not answerable to the Chinese government, the developers are.

Given that we have such horrible laws even in the "more democratic" parts of the world, such as Australia [1], it is not unthinkable that the Chinese government may ask a Chinese developer to install a backdoor to a foreign based product they are working on:

[1] [https://www.bbc.com/news/world- australia-46463029](https://www.bbc.com/news/world-australia-46463029)

> The Electronic Frontier Foundation has said police could order individual IT > developers to create technical functions without their company's knowledge.

<comment><USER15> The same concern applies to any American company with Chinese offices, including Google, Facebook, etc.

<comment><USER14> except its not an office, its the majority of their dev team operating inside one of the top 3 unsafest, most anti-american (with respect to cybersecurity) countries in the world.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Hey! I posted this. Just want to be clear it still pops up and asks the user to authenticate as seen in the original post. Tried to clarify this in the thread I don't want people to get confused and think this is worse than it is. Still really weird and follows malware patterns. Most likely not a gatekeeper bypass or anything because delivery would be difficult but seemed like a sketchy decision to basically write their own sudo tool into the pre install scripts.

<comment><USER18> Why did you delete the tweet?

<comment><USER19> Its been re-posted - [https://twitter.com/DanAmodio/status/1245329512889487361](https://twitter.com/DanAmodio/status/1245329512889487361)

<comment><USER2> We changed to that from [https://twitter.com/danamodio/status/1245032929635586053](https://twitter.com/danamodio/status/1245032929635586053). Thanks!

</comment></comment></comment></comment><comment><USER20> I'm not super familiar with Apple's policies but is this really such a grave sin on OS X? The purpose of the signature, as I understand it, is mostly to assure the user of the provenance of the code and, in a pinch, let Apple disable it. It's not intended as some bulletproof runtime security mechanism and it's easy to think of lots of apps that would be signed but could legitimately execute some form of unsigned code.

<comment><USER21> It's not per se, otherwise Terminal.app and iTerm2.app would be among the most sinister signed apps ever. Signatures only protect the app bundle itself, not user-supplied code or code fetched to locations outside the bundle.

However, it's bafflingly weird to include such a thing just to skip a button press or two in the installer.

<comment><USER20> I can see how skipping the installer flow might skeeve people out but this particular bit about some signed doodad in the installer being able to launch scripts seems like something between a nothingburger and mildly curious. Just wondering if I'm missing something here.

<comment><USER21> Yeah I don't think this additional swipe adds much to [https://news.ycombinator.com/item?id=22736608](https://news.ycombinator.com/item?id=22736608).

</comment></comment></comment></comment><comment><USER22> Meanwhile most of us curl stuff directly into our shells sometimes: [https://brew.sh](https://brew.sh)

<comment><USER23> At least in those cases we know it's happening and we can have a look at the script if we want.

<comment><USER24> Daily reminder: You can detect whether the script is being piped to shell or not, so inspecting the script, then curl | shell might not get you the same script. curl > file, inspect file, ./file is (probably) safe.

<comment><USER25> To expand on this, it is possible to tell apart the redirection to file and pipe to shell.

[https://www.idontplaydarts.com/2016/04/detecting-curl- pipe-b...](https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash- server-side/)

<comment><USER23> Sounds interesting and excessively comples; You can just as easily do this:

\- Send X bytes of the script

\- Send the line `curl my.server.com/asdjkfh`

\- Stop sending data, wait for a request to `/asdjkfh`

\- If you receive said request, start sending malicious data

\- If you don't, wait 5 seconds and continue sending a "fake" script

</comment></comment></comment></comment></comment><comment><USER26> In a couple weeks the public will have done a complete audit of all of zooms tools.

<comment><USER27> With zero impact on Zoom's practices or their popularity, probably.

 _Edit to add:_ I mean, I _hope_ they'll lose a substantial number of paying customers over this? But I doubt it.

<comment><USER28> I actually hope they will just fix all of their security/privacy issues, and that we will end up with a decent video conferencing app that actually values users privacy.

I don't get why people are so negative. I mean zoom is not unique in this sense, many of the everyday apps we use share at least some of these issues.

How many of us use Intel CPUs that had (still have) infinite number of vulnerabilities? Or MacOS that at some point allowed root to login without passwords? How many security issues we (software engineers) create on a daily bases simply because the management needs something for yesterday?

<comment><USER27> _I actually hope they will just fix all of their security /privacy issues_

Yes, me too! I was going to edit my comment again to clarify, but I figured it wasn't worthwhile trying to list all the caveats explicitly. But yes, if they fix this stuff and continue to be successful, that would be good.

 _How many security issues we (software engineers) create on a daily bases simply because the management needs something for yesterday?_

I disagree with your premise there. Sure, security bugs can sneak in if you're rushed, but that's qualitatively different from actively exploiting security holes and using dark UI patterns to make your own life easier. I hope most engineers would refuse to implement feature requests like that. It should be considered a form of malpractice.

</comment></comment></comment></comment><comment><USER29> That my friends is the text book definition of high quality malware.

</comment><comment><USER30> Not a problem if everyone used Linux. (Sarcasm intended: no workable binary signing)

<comment><USER31> You're right, but there is signing of kernel and modules now, via secure boot, eg: [https://access.redhat.com/documentation/en- US/Red_Hat_Enterp...](https://access.redhat.com/documentation/en- US/Red_Hat_Enterprise_Linux/7/html/Kernel_Administration_Guide/sect-signing- kernel-modules-for-secure-boot.html)

I'm not sure about binaries in general - having secure boot as an anchor at least makes the exercise less futile - but there an interesting point brought up here:

[https://stackoverflow.com/questions/1732927/signed- executabl...](https://stackoverflow.com/questions/1732927/signed-executables- under-linux)

Dynamic linker, dynamic libraries and dlopen.

I see solaris has elfsign - and it appears to be in OpenSolaris too: [https://github.com/joyent/illumos- joyent/blob/master/usr/src...](https://github.com/joyent/illumos- joyent/blob/master/usr/src/cmd/cmd-crypto/elfsign/elfsign.c)

Not sure if it would work on Linux - and you'd might want to prevent running unsigned binaries. Not sure if that's a thing on OpenSolaris. Still, being able to verify a binary might help with handling random downloads, I suppose.

<comment><USER30> Yeah, module signing but not turned on by any distro. I can't even imagine not having driver signing on windows in 2020. There is IMA in Linux too. Even package signing barely started catching up in the last few years on most non- mainstream distros. It's practically unthinkable to have script signing too.

<comment><USER31> AFAIK it's on by default in Ubuntu?

> Modules built and shipped by Canonical with the official kernels are signed > by the Canonical UEFI key and as such, are trusted. Custom-built modules > will require the user to take the necessary steps to sign the modules before > they loading them is allowed by the kernel.

[https://wiki.ubuntu.com/UEFI/SecureBoot](https://wiki.ubuntu.com/UEFI/SecureBoot)

</comment></comment></comment></comment><comment><USER32> Now that it's clear that Zoom developers do their best to do the worst, Apple should ban it entirely from their platforms

<comment><USER33> They can't. Not now at least. For better or worse, people all over are using Zoom to stay in contact. If Apple banned it, it would be extremely difficult for them to not take a PR hit right now.

<comment><USER34> Instead of banning, Apple should be working together with them to understand why they're resorting to such ugly hacks just to improve the installation UX, and use that feedback to improve macOS instead.

<comment><USER35> The installation UX needs not be improved. It needs the holes Zoom abused fixed, so that it can no longer circumvent asking for the user's final consent. There is absolutely no reason Zoom should get away with intentionally abusing the platform they're given.

<comment><USER36> > It needs the holes Zoom abused fixed, so that it can no longer circumvent > asking for the user's final consent.

but... installing zoom is already asking for my consent, through an OS prompt. Do you want to have to type your user password two times for every app you install or what ?

<comment><USER7> It could prevent an app from posing as "System" in the prompt for starters.

</comment></comment></comment></comment></comment></comment><comment><USER37> I wouldn't be surprised if some other MacOS apps pull similar tricks.

Interesting that we didn't know Zoom did this until everyone started using it, and someone finally audited it.

</comment><comment><USER38> How would you bypass Gatekeeper with that? Something needs to run it. If you can, why can't you just do the same with osascript instead of running zoomAuthenticator?

       /usr/bin/osascript -e 'do shell script "touch /tmp/ran_successfully " with administrator privileges'

</comment><comment><USER39> The tweet has already been deleted. You don't get substantive content from a tweet, you don't get detail, they're hard to follow when threaded, and usually they aren't well thought out or researched. Please don't submit (or upvote) tweets. It would actually be better if you created a blog post with a screenshot of it and posted that.

<comment><USER40> Not sure why you're being downvoted - I expect more meat from a submission than 'here's a context-free few sentences on a tweet!'

</comment></comment><comment><USER41> Google cache has a copy of the deleted tweet: [https://webcache.googleusercontent.com/search?q=cache:a7E7do...](https://webcache.googleusercontent.com/search?q=cache:a7E7domEms0J:https://twitter.com/danamodio/status/1245032929635586053+&cd=1&hl=en&ct=clnk&gl=us)

</comment><comment><USER42> Any context as to why the tweet was deleted?

</comment><comment><USER43> Link to the cached version of the tweet: [https://webcache.googleusercontent.com/search?q=cache:a7E7do...](https://webcache.googleusercontent.com/search?q=cache:a7E7domEms0J:https://twitter.com/danamodio/status/1245032929635586053+&cd=3&hl=en&ct=clnk&gl=us)

</comment><comment><USER44> Curious why the focus on Zoom specifically given that there are 10,000 different conferencing products out there.

Are they the biggest?

<comment><USER45> Since all the lockdowns and social distancing rules have come into play for COVID-19, Zoom has seen a huge increase in consumer usage. That in turn has lead to increased scrutiny as more people use it.

Besides that, this certainly isn't the first time Zoom's shady practices have been exposed, where many other conferencing products haven't had such a track record.

<comment><USER46> What about using one of the many conferencing services that run from your browser?

Zoom has been repeatedly breaking the trust of their users - it's a clear pattern that won't change.

<comment><USER47> Isn't Zoom also one of the many conferencing services that run from your browser?

<comment><USER48> They use dark pattern to hide that: You'll have to cancel their attempt to open/download (one of that, don't remember) the native app three times before the link appears.

</comment></comment></comment></comment></comment><comment><USER49> What's the right way to sign a script? I've spent some time researching this and never found a satisfactory answer.

<comment><USER50> Put it inside an app bundle?

</comment></comment><comment><USER51> How to completely remove zoom from a unix system...

[https://www.fosslinux.com/3534/how-to-completely- uninstall-a...](https://www.fosslinux.com/3534/how-to-completely-uninstall- applications-by-command-line-in-ubuntu.htm)

</comment><comment><USER52> Last straw. Goodbye Zoom. I'll use it in a VM if I must.

</comment><comment><USER53> Could someone kindly ELI5?

</comment><comment><USER54> Meanwhile, apple doesn't accept my app because they claim the UI sucks

<comment><USER55> Apple didn't review or accept Zoom. It's not on the App Store.

<comment><USER56> Yeah, as much as I don't like the locked down nature of Apple devices/OS/software, this case with Zoom being able to do this stuff, is an argument for the locked down garden.

<comment><USER57> Isn't this the exact opposite? Zoom didn't bother to go get accepted into high requirement locked down garden, instead they choose to distribute the binaries on their own without having to deal with pesky rules about unsigned scripts.

<comment><USER56> Well, if it was only possible to install apps via the App Store (Apples wet dream, but they'll lose a ton of users), then Zoom wouldn't be able to distribute their app any other way and forced to follow the guidelines.

Again, I'm playing devils advocate for a pro-walled-garden opinion me myself don't believe in, so don't take my opinion too seriously.

<comment><USER58> It's not an either/or. You can simultaneously have more trust in apps coming from the walled garden _and_ cherry-pick with greater care the select number of potent applications that come from outside of it and are therefore harder to trust, precisely because they may be able to do more than what's allowed within the walled garden.

</comment></comment></comment></comment></comment></comment><comment><USER59> Reposted tweet: [https://twitter.com/DanAmodio/status/1245329512889487361](https://twitter.com/DanAmodio/status/1245329512889487361)

</comment><comment><USER60> Tweet got deleted :/

Just based on the title, consider that web browsers are signed binaries that run any unsigned script :)

<comment><USER61> In a sandbox, yeah.

</comment></comment><comment><USER62> Tweet removed and re-posted as [https://twitter.com/DanAmodio/status/1245329512889487361](https://twitter.com/DanAmodio/status/1245329512889487361)

<comment><USER2> Changed to that from [https://twitter.com/danamodio/status/1245032929635586053](https://twitter.com/danamodio/status/1245032929635586053). Thanks!

</comment></comment><comment><USER63> Get your friends and family off of Zoom. Use Jitsi Meet [https://jitsi.org/jitsi-meet/](https://jitsi.org/jitsi-meet/)

It's opensource, free and doesn't require user accounts. Plus you can host it yourself.

</comment><comment><USER64> I don't see anything wrongs here, you investigate the script and it just an installer. Did you even look at nvidia-installer? Why no one talks on that crap? So much hate on Zoom... I hate that too, I was at meeting yesterday and my interentet got disconnected and couldn't get back but even after reconnecting there was an audio issue.

<comment><USER65> What's wrong here is that Zoom hacked together an installer against all normal structure that Apple recommends. And that installed includes a very stupidly designed component that will try to run whatever you ask it with admin privileges.

This is yet another indication that nobody at Zoom has a single clue on how to build a secure and stable application. Another example of that mindset released today: [https://www.theverge.com/2020/3/31/21201956/zoom-leak- user-i...](https://www.theverge.com/2020/3/31/21201956/zoom-leak-user- information-email-addresses-photos-contacts-directory) They are proving to completely not understand how to design security/privacy features. Frankly, their technology team sounds like total amateurs that hack things together.

<comment><USER21> "Total amateurs hacking things together" somehow managed to ship something functionally better than products from mature shops like MSFT that mean serious business. The irony there.

<comment><USER66> It's more like they gained better ease of use by bending platform rules, to the detriment of security.

<comment><USER21> I highly doubt Zoom's video conferencing solution was solidly working while MS Teams crumbled under load two weeks ago is due to magic in Zoom's macOS installer.

<comment><USER66> Wasn't talking about infrastructure, was talking about the ease of use that led to large market share. Zoom broke lots of platform rules to perform that trick.</comment></comment></comment></comment></comment></comment>


The Clubhouse - <AUTHOR> https://divinations.substack.com/p/inside-the-clubhouse <comment><AUTHOR> Title is "Inside the Clubhouse" but the parser snipped it because who knows.

</comment><comment><USER2> For people wondering what this is (not a super descriptive title, my apologies!) it's about the new audio social app called "Clubhouse"

</comment><comment><USER3> I am very interested in an invite.</comment>


STNS: Simple authenticate provider for Linux users and public keys using TOML - <AUTHOR> https://github.com/STNS/STNS <comment><AUTHOR> STNS use JSON API via HTTP protocol. So STNS server can place under a http reverse proxy like nginx. It's very useful when used in combination with other servers.</comment>


Rogue Dairy Queen has been ignoring corporate HQ since 1949 - <AUTHOR> http://nypost.com/2015/07/23/rogue-dairy-queen-has-been-ignoring-corporate-hq-since-1949/? <comment><USER2> The tldr is that that are not rogue nor ignoring corporate HQ. They are just operating under a very old agreement (dating to the 1940s) which offers the local owners more flexibility. That allows them to offer their own menu items, close during winter, and make standard DQ items in nonstandard ways (which my local DQ is happy to do as well, FWIW).

</comment><comment><USER3> Honestly it sounds like corporate has their head up their own butt. I understand why uniformity sells, DQ becomes a "known quantity" and if you're driving in an unknown area you can hop in and know exactly what you're getting.

But you can accomplish that AND allow individual stores to excel by allowing them a few bespoke/store specific items. Just call them "store specials" or something.

I think DQ HQ sounds too arrogant, instead of trying to bring this store in line, they should be looking at what they're doing that makes them so popular and try to replicate core elements of that across other stores.

DQ as a brand, to me, is one that is slowly dying or at the very least has hit a growth stall. They may not be struggling, but the storm clouds are off over the horizon, and around here places like Menchie's are much more popular for desert.

<comment><USER4> I wish the franchise model allowed this. You can have a minimum level of service, but allow some locations to customize their experience or provide other services as long as it goes above and beyond the minimum. For example, a Starbucks in the big city can standardize around fancy latte art, but a location in th country could compete more directly with Dunkin Donuts. You can have a local McDonalds with furniture and decor that more resembles Shake Shack or Chipotle than McDonalds from the 90s.

</comment></comment><comment> at-fates-hands This DQ is pretty famous in the area and is located at a busy intersection in Moorhead.

You can get a decent lunch for around $6 and be totally full, which is hard to do these days. A foot long chili cheese dog, an order of fries and a 20oz drink for $6? Unheard of these days.

With all the fast food places (including DQ Grill and Chill restaurants) starting to reduce their portions while increasing prices, this place hasn't done that yet - a simple reason people keep coming back. In the summer, the lines are long because all the landscapers, lawn crews, and construction guys flock to this place for lunch because you get a ton of food almost nothing.

</comment><comment><USER5> There's nothing rogue about this DQ at all, this is just a corporate press release that has unfortunately gotten picked up a bit. If you look at their "local items" that are supposedly rebellious, it's just hot dogs like every other DQ that serves hot food serves.

My local DQs close for the winter too, there's nothing special about that either. It's typical of DQs with no indoor seating in northern states.</comment>


What I learned from others' shell scripts - <AUTHOR> http://www.fizerkhan.com/blog/posts/What-I-learned-from-other-s-shell-scripts.html <comment><USER2> I don't like the `require_curl` example.

Here's what is done there:

        OK=0
        FAIL=1

        function require_curl() {
            which curl 2>&1 > /dev/null
            if [ $? -eq 0 ]
            then
              return $OK
            fi

            return $FAIL
        }

(`2>&1 > /dev/null` drops stdout and writes stderr to stdout—not what was meant. `which` doesn't write to stderr, so I drop that part.)

That can be shortened significantly by using the return code directly in the if branch:

        function require_curl() {
            if which curl > /dev/null
            then
              return $OK
            fi

            return $FAIL
        }

Or by just using the return code directly:

        function require_curl() {
            which curl > /dev/null
            return $?
        }

And as it will return the return code of the last statement executed:

        function require_curl() {
            which curl > /dev/null
        }

<comment><USER3> As I mentioned elsewhere ([https://news.ycombinator.com/item?id=6210440](https://news.ycombinator.com/item?id=6210440)), it's just wrong to use "which" in general.

<comment><USER4> Indeed, which does not recognize aliases and functions, so `command -v` seems better:

        command -v llh >/dev/null 2>&1 ; echo $?
        0 # good
        usr/bin/which llh >/dev/null 2>&1 ; echo $?
        1  # good

however (zsh) shell internal which does:

        which llh ; echo $?
        llh='ls -lh'
        	/usr/bin/ls
        0 #good

(I'm not sure however when ZSH chooses to use its internal function or the one from $PATH)

</comment></comment></comment><comment><USER5> My eyes bleed. So many unquoted expansions!

      APP_ROOT=`dirname $0`
      filename=`basename $filepath .html`

should read:

      APP_ROOT=`dirname "$0"`
      filename=`basename "$filepath" .html`

Plus if your script supports both `--version` and `--help` with proper formats, you can easily generate a manual page with `help2man`. The help output example is far from that. Also, he does not mention getopt at all.

The magic line for that is:

      eval "set -- $(getopt -o hV -l help,version -- "${@}")" || exit $?
      echo "${*}"

It does this:

      $ ./test foo bar --help --version
      --help --version -- foo bar

Which can be parsed using a `while` loop with `shift`.

For other tips on shell scripting best practices I recommend Gentoo ebuilds. They tend to be quite well written. And always read scripts from other people before running them yourself.

<comment><USER6> I always wanted a shell best practices book (for formatting, beyond the TLDP Advanced Bash Guide, or dare I even say the POSIX spec). I will definitely checkout the Gentoo ebuild scripts. I used to look at Debian in my youth to try and find someone to imitate.

However, are there are any people writing lint or prettify or Perl Critic like progs or web services that will properly wrap and do things you mention?

Would there be interest in such a thing?

UPDATE: I found this stuff. Does anyone use these things?

[https://trac.id.ethz.ch/projects/bashcritic/](https://trac.id.ethz.ch/projects/bashcritic/)

[http://man.he.net/man1/checkbashisms](http://man.he.net/man1/checkbashisms)

[http://stackoverflow.com/questions/3668665/is-there-a- static...](http://stackoverflow.com/questions/3668665/is-there-a-static- analysis-tool-like-lint-or-perlcritic-for-shell-scripts)

<comment><USER7> A (cheap) trick for formatting shell scripts is approximately:

      wrap script into a shell function
      source function definition
      diff defined function against script

with something like:

      { printf 'dummy (){ '
        cat script
        printf "; };\ntype -a dummy\n"
      } > dummy
      source dummy > defined
      rm dummy; unset -f dummy
      diff script defined

Issues include:

      comments are absent from defined function listing
      trailing semicolons appear after each shell command / line
      the first semi in the trailing "; };" may be a syntax error

The default function listing format is fairly generic, so personal formatting preferences must be left as an exercise for the reader.

MHO: people who insist on specific code formats should provide tools that can convert arbitrary code into their preferred format.

</comment></comment></comment><comment><USER8> Shell scripts have their use but at the point when your script needs output coloring or printing debug information, it is time to switch to Python.

Edit: Place a general disclaimer to weaken the absolute tone of the above statement. Rule of thumb, exceptions apply, yadda, yadda. In other words, I somewhat agree with most responses that disagreed with the statement above :-)

<comment><USER9> Python is an ideal replacement for small Java programs, not Shell.

The moment your script needs any more than 10 regular expressions, or dealing with >3 files all in a complex interplay- use of Perl becomes inevitable. And that is something like the very utmost basic thing you can do with Perl.

Python is more like tried-to-be-scripting-but-is-a-web-framework language.

<comment><USER10> I agree that Python is a general-purpose language that could replace much of the Java code you see around, but I never got the feeling that it is particularly well-suited for the web. For one thing, with significant whitespace, it's harder to embed snippets of code in HTML or vice versa, so you have to work with a templating library right from the beginning. Some will see this as a blessing in disguise, but for very small projects or mostly self-contained components, having logic and presentation in one file is much more productive.

<comment><USER9> Ironically bulk of all the Python out there is web code.

In fact Django, Twisted and Zope is all the Python code there is.

Scripting was never Python's forte. Scripting is all about succinctness, power and providing as much power with fewer constructs and restrictions. Which happens to be exactly the very opposite of Python goals, and some thing which more or less as a mission statement Python tries to achieve. This is why Python will likely never be a very successful scripting language.

Python was always a web language for frustrated java programmers who couldn't put with java's problems anymore. Much of Python's success is in web frame work area. Which was previously Java's territory.

<comment><USER11> Yes, Python is obviously used for web development. But it's very short- sighted, and even absurd, to claim that the "bulk of all the Python out there is web code".

It's even more absurd to claim that "Django, Twisted and Zope is all the Python code there is." That's utter nonsense, in fact.

There are numerous non-web applications that use Python extensively, whether they're partially or fully implemented in Python, or whether they can be scripted using Python.

Then there are the numerous libraries and frameworks for Python, from GUI toolkits through to scientific computation packages.

Many, many organizations use Python internally for a very wide variety of tasks and systems, without broadcasting such use loudly, if at all. This ranges from one-off scripts up to entire multi-million-line software systems.

I sure hope that you're joking, but it just isn't coming across as a joke. Nobody can seriously claim that "Python will likely never be a very successful scripting language" when it has undoubtedly been one of the most successful, and versatile, programming and scripting languages around for many years now.

<comment><USER9> The biggest reason why Python 3 is/was seeing such late adoption is purely because web frameworks/libraries were not migrated to Python 3. Goes on to tell how many people use Python for what purposes, that absence of a domain of frameworks/libraries slows down the adoption of the language itself for years.

Of course Python is used for scripting purposes. But that amount of code is no where close the web code that is written in Python. It all depends how much code in ratio is written for what purposes and not the total amount of code written for that purposes.

Python's glory days came with web frameworks and continue to be the reason for its fame and wide spread adoption.

I will take Python seriously if it offers the same capabilities as Perl at least on the command line.

Python is a awesome general purpose language. But so far as scripting is concerned it is still no match to Perl

<comment><USER11> Like I tried to explain to you earlier, those who use Django and the other Python web frameworks that may not really support Python 3 yet are a very small portion of the entire Python user community.

Many of the rest of us have been happily and very successfully using Python 3 for years now, including for the scripting tasks that you incorrectly claim we don't use Python for.

Your other claims like "Python's glory days came with web frameworks and continue to be the reason for its fame and wide spread adoption." are truly absurd and outright wrong. Python was very popular and widely used well before the mid-2000s, when many of the web frameworks you're referring to were first released.

I think you vastly overestimate the amount of Python used for web applications, as well. This is understandable, as such uses are often more visible than the other behind-the-scenes uses. But there's a staggering amount of Python code that you don't see, and that isn't used for web applications.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Huh, no mention of "set -e -u"? Do yourself a favor and follow this, too: [http://www.davidpashley.com/articles/writing-robust-shell- sc...](http://www.davidpashley.com/articles/writing-robust-shell-scripts/)

<comment><USER13> Also, regarding the lockfile examples, Linux users get a much simpler method using flock: [http://mywiki.wooledge.org/BashFAQ/045?highlight=%28flock%29](http://mywiki.wooledge.org/BashFAQ/045?highlight=%28flock%29)

</comment></comment><comment><USER14> A good gem I found recently was to use the big version of the command line flags. So instead of seeing -s -q 1, you should use arguments like --max- depth. Increases the readability of scripts by a huge margin.

<comment><USER13> Note that some of those long arguments don't work on OS X or BSD, so do some tests if you want to be portable.

<comment><USER15> To be fair, with some commands there are flags which do different things in OSX/BSD and in GNU. So you should verify that all arguments, both short and long, do the same thing

As an example, `sed -i` is used for in-place editing. BSD/OSX variants expect an extension argument to be provided after the flag, with an empty string for no backup (sed -i '' 's/foo/bar/' foo.bar)

On the other hand, gnu expects the backup extension in the flag (like -W in C compilers), so the command is parsed as if 's/foo/bar/' was the file to open

</comment></comment></comment><comment><USER16> My favorite discovery is how to efficiently do RPC style calls in BASH. Let's say you have some functions and variables you want to execute on a remote server. Just do the following:

        ssh remotehost "
            $(declare -p var1 var2 var3)
            $(declare -f func1 func2 remotemain)
            remotemain"

In this example, var1, var2, var3 and func1, func2 are support variables/functions for the function "remotemain". This pushes all those to the remote side, then calls remotemain.

<comment><USER17> And don't forget that you can still set the remote environment variables, use stderr output of the remote command, pipe it and so on:

        $ ssh remotehost "arecord | gzip -c" | gunzip -c | aplay

records raw pcm stream an a remote machine, gzip's it and gunzip's and plays on the local machine.

</comment></comment><comment><USER18> A while ago I was working on a bash function library. The library itself may not be that usefull but it also contains some examples on how to color output and move the cursor around. [http://code.google.com/p/bsfl/](http://code.google.com/p/bsfl/)

</comment><comment><USER19>
      function require_curl() { which "curl" > /dev/null; }
      function require_curl() { which -s "curl"; }
      function debug { ((DEBUG)) && echo ">>> $*"; }

Last one is bash, which -s is BSD'ish

<comment><USER3> Really, just say no to which: [https://news.ycombinator.com/item?id=6210440](https://news.ycombinator.com/item?id=6210440)

</comment></comment><comment><USER20> As someone who is learning PHP as his first programming language, I am surprised to see similarity in terms to syntax with shell scripts. Are there other popular language with php-like sytax?

<comment><USER21> The syntax of php was inspired by Perl (and C). Perl was inspired by sh/sed/awk.

</comment></comment><comment><USER22> Shell scripts frequently fail to handle directory names with spaces in them. Example from the linked article: APP_ROOT=`dirname $0`

This is not going to do what you expect if the current script is run via a command with spaces in one of the preceding directories' name.

It should be: APP_ROOT="`dirname "$0"`"

Even this would fail if your immediate parent directory's name ended with a newline character, but should handle any other whitespace without issue.

<comment><USER23> The outer quotes aren't required:

      APP_ROOT=`dirname "$0"`

(See [http://www.tldp.org/LDP/abs/html/varassignment.html#EX16](http://www.tldp.org/LDP/abs/html/varassignment.html#EX16))

Also, even if ^J or ^M were present in a parent directory's name, the command above would still work. Whitespace-like characters take some getting used to with Bash.

</comment></comment><comment><USER18> Browse this website and you will learn a lot about bash. Opinionated at times, but that's what I like. If you use Bash scripting you've might encountered this site already, but for what it's worth: [http://mywiki.wooledge.org/BashFAQ](http://mywiki.wooledge.org/BashFAQ)

</comment><comment><USER24> I wrote a silly script for noob openbsders like yours' truly: it builds the usage from functions' comments in the script on-the-fly. [https://gist.github.com/6120072](https://gist.github.com/6120072)

</comment><comment><USER25> Might inject those `tput` color commands into my shell

To those curious: [https://github.com/jalcine/dotfiles](https://github.com/jalcine/dotfiles)

</comment><comment><USER26> All this article does is make me wish there were an alternative to typical Borne shell garbage. No sane person would ask for a wretched pile of hacks like this.

<comment><USER27> I guess you'll just have to wait for someone to develop Perl, then...

</comment></comment><comment><USER28> Shouldn't it be:

which curl >/dev/null 2>&1

?

(what I learned from man bash)

<comment><USER3> Sadly, much of this article is an example of why you _shouldn 't_ learn from other people's shell scripts. Too often shell scripts are quickly written without much attention to best practices, so they have a lot of bad habits in them. For much the same reason bad code tends to get copy and pasted about until it becomes common such common practice no one questions it.

One shouldn't use which at all. It forks an external process, it is vulnerable to PATH issues unless you specify what will surely be a non-portable path to the executable, often isn't included in chroot'd environments, and doesn't actually return an exit status on many platforms. In short: it sucks in almost all possible ways you could hope to suck.

The proper expression to use is:

        command -v curl >/dev/null 2>&1

If you know you are in bash, type -P and possibly hash become acceptable alternatives, but then... why not just use command -v right?

<comment><USER29> More about it here:

[http://stackoverflow.com/questions/592620/check-if-a- program...](http://stackoverflow.com/questions/592620/check-if-a-program- exists-from-a-bash-script)

</comment></comment></comment><comment><USER30> [http://mywiki.wooledge.org/Bashism](http://mywiki.wooledge.org/Bashism)

</comment><comment><USER31> You've got a trailing comma in your about json.</comment>


How a Universal Basic Income Could Fuel Entrepreneurship - <AUTHOR> http://www.geektime.com/2015/12/17/how-a-universal-basic-income-could-fuel-entrepreneurship/ <comment><USER2> Most Entrepreneurs probably have skills that pay way above poverty. Apple founders worked for Atari, that kid that's building his own drive less car, won bunch of hacking competitions to fund his project. Brilliant people don't need a check for << less than poverty because they can find contract work at high rates or get a job or go to college and if they're driven they will get there project done anyway.</comment>


Tesla revealing a self-driving semi-truck soon - <AUTHOR> https://www.theguardian.com/technology/2017/sep/14/elon-musk-tesla-electric-lorry-unveiled-late-october <comment><AUTHOR> Interesting bit towards the end:

"The UK Government said new vehicles driven by diesel and petrol engines will be banned from 2040 as part of efforts to tackle air pollution"</comment>


Index Ventures Puts Heavyweights Behind New Seed Fund - <AUTHOR> http://techcrunch.com/2010/04/25/index-ventures-puts-heavyweights-behind-new-seed-fund/

<comment><USER2> Original submission, linking to Index's announcement. <http://news.ycombinator.com/item?id=1293110></comment>


Ask HN: Do you know any huge-bandwidth case that using Cloudflare free/pro plan? - <AUTHOR> And what is the bandwidth? <comment><USER2> Their sales people start emailing you at ~4Tb/month on the business plan.</comment>


Following Google Trends, Le Pen would not enter second round of French election - <AUTHOR> https://medium.com/@soufron/when-looking-at-google-trends-marine-le-pen-would-not-enter-the-second-round-of-the-french-6a54c02e1426 <comment><USER2> Are there polls that limit their demographics to people that have a track record of actually voting? I know they try to normalize for various demographics, but I've never seen this one mentioned, possibly because I live in a country with compulsory voting though.</comment>


Why are so many coders musicians? - <AUTHOR> https://firstname.lastname@example.com/why-are-so-many-coders-musicians-60389fb8b645?source=linkShare-b5cda7ef119b-1520515157 <comment><USER2> "I noticed many developers were musicians"

How does that compare to other fields? That is, my previous dentist was a musician, I know authors who are musicians, I know scientists who are musicians.

Sting was a bus conductor, building labourer, and schoolteacher.

If developers are underrepresented, percentage-wise, as compared to other fields then all of these conclusions about a connection are wrong, or at least very weak.

<comment><AUTHOR> It could be there's not a real correlation between the likelihood of being a musician when you're a developer or vice versa. Proving that isn't the purpose of these articles anyways. I was interested in the relationships between the processes of learning and creating/writing music and code that many developers and musicians I've met (and myself) have noticed.

<comment><USER2> Or, it could be there is an anti-correlation.

</comment></comment></comment><comment><USER3> Great article! Thank you for writing this.

<comment><AUTHOR> Glad you liked it, more coming.</comment></comment>


Shypmate is now Envyl - <AUTHOR> https://medium.com/@Shypmate/shypmate-is-now-envyl-5040559f278a <comment><AUTHOR> So I think it's great that you're branching out and spreading your tentacles but you really need to get your act right.

1\. Make sure your old site redirects the the new one. I was wondering if you'd gone bust so I had to go to your twitter page before i saw a link to your medium post.

2\. Maybe you should put a link to your new site at the beginning of the post and not at the end unless you're trying to force me to read the post right to the end…

3\. As a recent customer you could have sent out an email informing me about the change

4\. I really hope you've fixed your online order status page because it's a tad irritating to have to send emails to support at every milestone to find out the status of my sh(y)pment.

Other than that I wish you guys all the best and thank you for establishing this very convenient service!</comment>


Thought as a Technology - <AUTHOR> http://cognitivemedium.com/tat/index.html <comment><USER2> I think there's a subtle danger to "cognitive outsourcing", or at least an important distinction to be aware of. "Cognitive outsourcing" works like an oracle, but many of our best tools work more like bicycles: very direct, very fluid, very analog, with continuous feedback that helps us build an constructive intuition. Bicycles extend the range of what a human can do; oracles do something that a human tells them to do.

Sometimes this difference is a function of how information is displayed and how it reacts to the user. Terminals and REPLs are inherently oracles; spreadsheets connect our fingertips directly to raw information.

Other times it's just a difference in the conceptual model that users construct. Some people think of Google as an oracle ("what is the weather like?"); others as a bicycle ("weather"). Those who bicycle around Google aren't just "better at Googling"; they have a fundamentally different view of what they're doing.

This isn't to say that oracles are inherently wrong or that bicycles are always better, but there's a huge difference between truly augmenting a human and merely interfacing with one. It's important to know which idea is appropriate for any given problem space.

(most of this comment was ripped from here: [http://joelgustafson.com/ideas/2016/08/25/oracles-and- bicycl...](http://joelgustafson.com/ideas/2016/08/25/oracles-and- bicycles.html))

(see also [http://mental.bike](http://mental.bike), which I don't know why I own)

<comment><USER3> I think your bicycle/oracle distinction is interesting. It seems like the tradeoffs in preferring a bicycle to an oracle are similar to considerations leading up to decisions _not_ to abstract. If we could assume the oracle would fulfill its function perfectly, there would be no real reason to prefer the bicycle; unfortunately, however, experience shows us that the internals of complex black boxes we construct are rarely perfect, and that opening the box may be necessary, and unpleasant. On the other hand, with a bicycle, a feeling of control remains throughout: it's always understood how some action on the bicycle will evolve the state of your situation. The downside for the bicycle is that its definition requires it to remain relatively simple.

My first thought for getting around this was something like formal verification that a black box does what it says—but once 'what it says' is too complex for a person to really understand (e.g. a black box containing the behavior of a human brain), you've hit a wall with this approach.

The other thing I can imagine is building up 'bicycles' which have parts of proven-correct medium complexity, arranged together in a single higher-level system also of proven-correct medium complexity (where medium complexity is: more complex than bike parts, but still with readily human-comprehensible semantics). I'd characterize these systems as sort of like Iron Man suits. Maybe that doesn't really add anything of practical benefit beyond the original bicycle analogy though ;)

<comment><USER4> >If we could assume the oracle would fulfill its function perfectly, there would be no real reason to prefer the bicycle

The bicycle might be more fun to ride

<comment><USER2> Not only might it be more fun, but you'd build a better intuition about what to expect from it (or even how it works).

It's like how people often make fewer mistakes with slide-rules or abacuses than pocket calculators, since the former two require you to check your answer against your intuition, while the latter just tells you "the answer" to your (potentially ill-formed) query. Trusting a black box can be quite dangerous.

</comment></comment></comment></comment><comment><USER3> Part of this reminds me of a project idea I've had in the past: figuring out how to teach people an 'abstract visual relationship' language. I'll quote from the article:

> _... he immediately responded that when he taught algebra courses, if he was > discussing cyclic subgroups of a group, he had a mental image of group > elements breaking into a formation organized into circular groups._

Jacque Hadamard once conducted a study of how mathematicians approach their work, which can still be found in a book called "The Psychology of Invention in the Mathematical Field". Here's an excerpt:

> _Indeed, every mathematical research compels me to build such a schema, > which is always and must be of a vague character, so as not to be deceptive. > I shall give a less elementary example from my first researches (my thesis). > I had to consider a sum of an infinite number of terms, intending to valuate > its order of magnitude. In that case, there is a group of terms which > chances to be predominant, all others having a negligible influence. Now, > when I think of that question, I see not the formula itself, but the place > it would take if written: a kind of ribbon, which is thicker or darker at > the place corresponding to the possibly important terms; or (at other > moments), I see something like a formula, but by no means a legible one, as > I should see it (being strongly long-sighted) if I had no eye-glasses on, > which letters seeming rather more apparent (though still not legible) at the > place which is supposed to be the important one._

It seems to me that this is a surprisingly common approach to dealing with highly abstract subject matter. I first noticed myself doing it while reading _Structure of Scientific Revolutions_ and later used it intentionally in working on math and CS stuff.

My experience with it so far leads me to believe it can be taught/strengthened. I've written a much more in depth essay on this in the past, but it's fairly unfinished. I still wonder about it though...

<comment><USER5> Please release your essay! You don't even have to finish it. You could even email it to me without commentary, and I would ask you questions about it.

</comment></comment><comment><USER6> This is interesting, but combines about five ideas. Expanding any one of those would be useful. The notion of a "transformative interface" seems to combine two concepts - "Wow factor" and "representation that yields insight". Those are different. The latter is more useful (but the former is more profitable.) Feynman diagrams come to mind.

Sussman's talk on how to think about circuits is here.[1] Here are the slides.[2] The video shows Sussman's talking head and him pointing at an off- screen display of the slides, which is not too helpful.

[1] [https://www.infoq.com/presentations/We-Really-Dont-Know- How-...](https://www.infoq.com/presentations/We-Really-Dont-Know-How-To- Compute) [2] [http://web.mit.edu/xtalks/Sussman- xTalk-3-2-16.pdf](http://web.mit.edu/xtalks/Sussman-xTalk-3-2-16.pdf)

<comment><AUTHOR> often though, representations that yield insight have some wow factor to them, especially if the world hasn't seen it before.

Between Nielsen and Bret Vector, I'm kinda jealous about what my future kids can learn with much more ease.

</comment></comment><comment><USER7> One things that I think would enable the kind of thinking necessary to come up with new interfaces for exposing concepts is to have a library of existing patterns.

I have seen various books and resources that come close (Edward Tufte books for example) but I think there could be much more work done.

There seem to be quite a few books on mechanical motion that are basically an encyclopedia of patterns that can be used to create new devices but I haven't really seen much type of this work done for computer interfaces.

If anyone has any good references please share.

<comment><USER8> You should have a look at books about the TRIZ system, such as this one

And Suddenly the Inventor Appeared: TRIZ, the Theory of Inventive Problem Solving [https://www.amazon.com/dp/0964074028/ref=cm_sw_r_cp_api_](https://www.amazon.com/dp/0964074028/ref=cm_sw_r_cp_api_)

It is rather hard to describe quite simply, but I would try like this: TRIZ is about all of the patterns and heuristics found in the invention of mechanical engineering elements. It purports to provide an algorithm for innovation, but you don't have to accept that grand of a claim in order to find the content fascinating.

<comment><USER7> I'll check it out. Thanks.

</comment></comment></comment><comment><USER9> Interesting insights. There's a lot to unpack here, but ultimately it boils down to working with, and creating, a "bicycle for the mind." The computer is one such example of such a technology, but so are the software programs it runs, as are art forms and language.

<comment><USER8> I understand what you mean, but I think it goes even further than a bicycle. At the risk of abusing the comparison, a bicycle will let you do what you already can do, move about, just a little bit faster. By contrast, what I think the article is talking about is doing something fundamentally new that you couldn't do before.

It's clear that overtime human beings can think about things that they didn't used to be able to think about. We can bootstrap our brains in this way, because it is all cumulative. Explaining the Internet to someone from the Middle Ages would be almost impossible, but it wouldn't be that difficult for someone from the 1950s who only understood telephones.

So this phenomenon of bootstrapping into new kinds of knowledge is clearly real and powerful. It's very useful and quite meta to think about how we could do that faster or better.

<comment><USER10> > Explaining the Internet to someone from the Middle Ages would be almost > impossible

I think it's quite possible. "In the future, by pressing fingers on these letters printed on a specially built rectangular object in a pattern to invoke certain incantations, people will be able to speak directly to other people from around the world, as well as control machines in factories to produce stuff with little or no manual labor." Do make it clear you have no part in any of it, to avoid getting hanged or burned, but I'm sure they'll understand you.

<comment><USER11> I'm in the middle of the second "Off to be the Wizard" books and this is exactly how they deal with it. Really it just comes down to abstracting away everything under hood and relating to existing concepts and ideologies.

Even today, most people wouldn't get how a car functions, but they would understand that you push this and turn that and this moves you.

</comment></comment></comment></comment><comment><USER12> Imagining is the easy part if you ask me. What would you do, if you could program your own mind? My first app would probably be some more manual control over the body. Sure would be nice to have a 75 bpm in a stressful situation.

<comment><USER13> More consistency.

If I like something, let's like it more consistently. Let's really eat pizza for 3 days for every meal. So I can order the large one and pop slices into the microwave and enjoy the fuck out of them.

More motivation for progress.

If I decide I want to build a house let's not lose enjoyment after 1 hour of searching the net for floorplans, materials, warehouses, plots of land, and so on.

Also, better [internal] metrics. And naturally better interrupt management. Both internal and external. With better metrics we could see whether what we were doing (and possible what we can do) was (would be) effective/good/useful and how much. And with more efficiency we could reschedule more frequently (not just after we spent a day fiddling with something) so we'd be more effective overall.

And so on.

And probably a lot of these are pretty hackable, as in sprinkle cocaine on that pizza, alaways a bit more the longer it was in the fridge. And probably physiologically it's possible to make a pill that'd give you focus for one hour, we already have a dozen or so ADD/ADHD pills used as attention enhancer nootropics. And we have drugs that alter our view of our own life. Bam, instant feedback on your life. Are we going the right way? Yes, good, keep doing.

Is that too mechanical? Sure, yet sometimes that'd be pretty useful.

And in general, what if you could take a pill to feel in love with someone for 500 days? You get together things are okay, but emotionally something is bothering you a bit, both of you take a pill, and done. Instant good relationship.

The same could go for not getting dragged down by half-hearted relationships.

And that's basic limbic system efficiency, nowhere near mind-hacking. We'd benefit a lot from better pattern matching, better memory (faster, more accurate, etc.), better associations, better theory of mind. A bit of raw working memory, maybe a numeric submodule, something for proper alarms, alerts, better introspection, and so on.

<comment><USER14> All of these assume that the conscious "you" knows better about optimizing some meta-objective function than does the limbic "you." Except the latter has been proved out to be species-useful for tens of millions of years, and even more if cross-species evolutionary conservation is considered.

So the interesting question from my PoV is: beyond the immediate reward you hope to enjoy (e.g., loving the pizza as much on day 3 as on the first bite; easy relationships for 500 days) what would the consequences be of these overrides? I'm betting they're all catastrophic, but it's fun to think about the nature of the catastrophe.

<comment><USER15> > Except the latter has been proved out to be species-useful for tens of > millions of years, and even more if cross-species evolutionary conservation > is considered.

One of the things that makes humans dominate the planet so thoroughly is that we are programmable, so we can evolve culturally on a scale of decades, instead of genetically on a scale of centuries.

The side effect of this is that that parts of us that aren't programmable are not keeping up with rapidly changing environment eg being _both_ cognitive misers _and_ obese ([https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4547044/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4547044/)).

It does lead to a neat heuristic though - if some easy change improves intelligent/memory/whatever, it should be expected to have side effects that would have been a poor tradeoff in our ancestral environment, otherwise it would have been selected for already - [https://www.gwern.net/Drug%20heuristics](https://www.gwern.net/Drug%20heuristics)</comment></comment></comment></comment>


Show HN: Random Fractal or The secret behind my tree - <AUTHOR> https://github.com/victorqribeiro/randomFractal <comment><AUTHOR> People usually like the tree I use on my homepage and often ask me about it. So, this is me taking a little time to talk about it, and provide some code to illustrate.</comment>


U.S. Supreme Court lets Google advertising class action suit proceed - <AUTHOR> http://www.reuters.com/article/us-usa-court-google-idUSKCN0YS1GI <comment><USER2> Serious question- Would this have been possible if Google had put in their contract that all parties waive their right to a class action? Many companies do this now- Microsoft's xbox live, for example not only forces you to forfeit any class action lawsuits, but at the time I stopped using their services, I believe they also required meditation with a mediator to be chosen by Microsoft. I sold my xbox 360 and never looked back.

edit- I also remember specifically Microsoft releasing a TOU update just days after, if not the day of, the ruling allowing companies to do this came down.</comment>


Show HN: Swift SOAP Client library through code generation - <AUTHOR> https://github.com/Bouke/Lark <comment><USER2> I pitty anyone writing direct SOAP interfaces for an iOS app.

From a few years of app dev, at the end of the day it makes everthing a lot more flexible if proxied, even with a tiny facade, because it gives you options and choices when it comes to making changes.

<comment><AUTHOR> Sure it might not make sense to use SOAP for communication between an iOS app and its server-side counterpart. However when writing consumers of an existing SOAP service, for example in an macOS or console application; it might make more sense.

<comment><USER2> Or server-side swift for that matter...

</comment></comment></comment><comment><USER3> If anyone is looking for an auto-generated Swift REST client, please give Swagger Codegen [1] a try and the latest master supports both Swift 2.x and 3.

[1]: [https://github.com/swagger-api/swagger- codegen](https://github.com/swagger-api/swagger-codegen)

Disclaimer: I'm a top contributor to the project.

</comment><comment><USER4>
        Why is it called Lark?

        SOAP is sometimes referred to as a fat messaging protocol.
        Swift is an elegant bird.
        A Lark sometimes looks like a fat bird.

Excellent sense of humor, and a really useful library. Thanks a bunch for sharing!

</comment><comment><AUTHOR> Author here, happy to answer any questions.

<comment><USER5> This looks great - I was working with an old iOS app back when Swift was first released and I wrote an XML parsing library SOLELY because the SOAP support was horrific. I think this will help a lot of people. If you don't mind, I might add a link to your repo from my README just to help point people towards a better approach over manual XML parsing.

<comment><AUTHOR> Thank you! links are fine of-course; the more the merrier.

</comment></comment></comment><comment><USER6> Cool! As the author of a relative new python soap client (zeep) i do feel sorry for you Most wsdl documents dont follow the various specs which will result in a lot of support issues from users

Anyway feel free to contact me if you have any spec related questions

<comment><AUTHOR> Cool project, seems like a nice improvement over what I've used in the past (suds). Also has some features that Lark currently lacks (SOAP 1.2 / HTTP bindings / rpc / WS-Addressing / WSSE).</comment></comment>


I get more business from my Google places than from Adwords? - <AUTHOR>

Can I list my business in other cities that are in my service area or can I only do that if I have a building there?
Is google plus local different than places or just the new way of saying it?
Thank you for any help/feedback <comment><AUTHOR> Is this just how it is for local businesses?</comment>


What does Pope's death penalty shift mean for Catholic politicians? (2018) - <AUTHOR> https://edition.cnn.com/2018/08/02/politics/pope-death-penalty-us-politics/index.html <comment><USER2> Gosh, been about 1.5 years since this, and whatta ya know, no change!

Doesn't this indicate that (at least in the USA) politicians use religion to propagandize for their goals, rather than let religious faith guide them to their goals?</comment>


Downturn Dims Prospects Even at Top Law Schools - <AUTHOR> http://www.nytimes.com/2009/08/26/business/26lawyers.html <comment><USER2> Taking on a lot of debt to finance an education is never a really good idea - unless you can afford the risk. If the market for your training goes sour, or you never meet the right people, or you become disillusioned with the position you thought you wanted, that debt might weigh on you for half a lifetime.

Those who can't afford the risk need to consider working their way through a public school. Life can be enjoyed without a prestigious job or lots of dough.

</comment><comment><USER3> I can't say this is necessarily a bad thing.</comment>


Ask HN: how many EC2 instances do you run? - <AUTHOR>

I'm speaking at Cloud Connect in Santa Clara tomorrow morning, giving a talk on how to launch hundreds or even thousands of concurrent EC2 instances and manage them all.
It's based on my experience with a load testing startup I launched a few years back (http://browsermob.com). I thought it might be fun to incorporate some stories from the HN community on how they use EC2.
So please feel free to share what your instance limits are, how many you run concurrently, what kinds of instances you use, whether they are "long running" or you have "spikey" usage, or anything other interesting experiences.
I'll be sure to post my slides to the thread tomorrow afternoon. And if you'd like a hat-tip in the slides, just say so in the comments. Thanks! <comment><USER2> At one time, extremely spiky usage: my primary use-case was short-term compute cluster deployments for specific projects, so it would fluctuate wildly. Typical sizes at any given time were 0 (no project), 16 (small cluster), 64 (moderate) and 128 (decent, at least for the particular domain I was in).

These days it's zero, because I work at an HPC-targeted IaaS startup that hosts our own hardware. (Because Infiniband is _awesome_ when you're latency- bound.) But I used some decent-size ec2 deployments for a bit there.

<comment><AUTHOR> Thanks for sharing! What kind of instance types did you use? Was it the cluster compute instances, or something else?

<comment><USER2> Typically cluster compute for production, yeah. I also did a couple tutorials where we used m1.small in "student clusters ".

</comment></comment></comment><comment><USER3> I use just 1 small instance for database, web, SOLR, cron jobs, and everything in-between. And yes, I do get a lot of alert emails saying it's over load. But that's how I roll.

</comment><comment><USER4> Small bit of work here, but I use up to 11, I have one instance as my command and control that uses a messaging queue to send work to the others that are dynamically added as needed up to the self limit of 10 workers.

<comment><AUTHOR> Thanks for sharing, Jason! What prevents you from scaling higher? Lack of need? Cost? Architecture?

</comment></comment><comment><USER5> It fluctuates, but most recently somewhere between 34 - 56 instances for dev, staging and production search, crawler and content build clusters. (we index terabytes of data and hundred of millions of documents)

<comment><AUTHOR> Thanks! Reserved? Spot? On-demand? What instance types?

<comment><USER5> The needs of our customer are too transient for reserved yet, so it's primarily been as needed (on demand?) We run into problems during provisioning sometimes and Amazon has to then raise our quota. Some customer architecture and capacity requirements have stabilized, so they are talking about getting reserved instances. We also have been experimenting with provisioning a bunch of servers for short durations for "burst processing" of content, but we're never totally sure if AWS will have the capacity we need. Things like reserved instances might get more use by us soon.

</comment></comment></comment><comment><AUTHOR> Come on now, don't be shy :) If you'd like to share anonymously, shoot me a note at firstname.lastname@example.com and I'll repost here.

</comment><comment><USER6> Currently running about 13 EC2 instances and 6 RDS instances for production & development/staging environments...</comment>


Obnam: easy, secure backup program - <AUTHOR> http://obnam.org/ <comment><USER2> Does this have provisioning for easy automatic backups and restoration? I can never find one that does both good automation with secure remote backups, and also tackle a good restoration experience.

<comment><AUTHOR> Yes.

The manual [1] gives a restoration examples. The backup examples could be plugged into cron so as to make those automatic.

[1] [http://code.liw.fi/obnam/manual/manual.html](http://code.liw.fi/obnam/manual/manual.html)</comment></comment>


Amazon Quietly Closes Security Hole After Journalist's Devastating Hack - <AUTHOR> http://www.wired.com/gadgetlab/2012/08/amazon-changes-policy-wont-add-new-credit-cards-to-accounts-over-the-phone/

<comment><USER2> This is the only possible response after the "exploit" was published. Amazon's process was appropriate for their business, and the problems the journalist experienced were due solely to the level is security Apple chose to implement and their decision to allow remote wiping of people's Macbooks.

This is only a story because of Apple's of operational decisions. The information required to game their system could have come from a myriad of sources other than Amazon.

<comment><USER3> I disagree that Amazon's processes were 'appropriate'. Being able to gain access to someone's Amazon account with such basic information can be a big problem.

I know a guy that's a huge amazon seller and he says there are Amazon sellers often with upwards of $100,000 in their accounts on Amazon before pulling the cash out. If someone were able to gain access to a seller account (I'm not sure if this 'exploit' would have worked for a seller account or not), that could have been quite financially painful for some people.

<comment><USER4> Why are they leaving so much in their accounts? Amazon is not a bank, and as such they're probably not subject to the same regulations. We've already seen this issue with people leaving too much money in winnings in online poker accounts, or PayPal accounts.

</comment></comment></comment><comment><USER5> While they have closed the loophole for adding credit cards, you can apparently still change your email or password via phone: [http://www.forbes.com/sites/kellyclay/2012/08/07/amazon- tigh...](http://www.forbes.com/sites/kellyclay/2012/08/07/amazon-tightens- security-after-high-profile-hacking-sort-of/)

<comment><USER6> If you can change the email or password by phone, then nothing is solved. Adding the credit card was, as I understand, simply because amazon required a credit card number on the account (possibly last four digits).

</comment></comment><comment><USER7> I would like to see a customer service/tech support org where customers have to enter their 2-factor PIN at a phone menu before reaching a _human_ support agent. You could possibly combine that with caller ID for better verification - basically use phone # like a username and the PIN as password.

Or you could just use them alongside other verification steps.

<comment><USER8> What if they've had their mobile phone stolen and can't do 2-factor auth and that's why they're calling?

<comment><USER4> Isn't this scenario why Gmail's 2-factor authorization gives you a set of one- time passwords?

<comment><USER9> What if you lose them?

At some point, there has to be a way to get back into your account. Probably, going through slow and hard to hack methods like the postal system.

<comment><USER4> Well, continuing to use Gmail as an example, there is an account recovery system, which IIRC asks for a bunch of details to try and determine if you are the account owner (account creation date, names of labels used, etc.) If Google or a third party would provide a list of these details, then you could collate that info as additional insurance against your posited scenario.

</comment></comment></comment></comment></comment><comment><USER10> Is it possible to prevent a remote wipe by Apple? Or at least so it is only possible with knowledge of my password? If I lose _both_ my MBA _and_ my password, I am ok with not being able to remote wipe.

EDIT: OK, I can disable remote wipe entirely by disabling 'find my mac'.

<comment> X-Istence It is only possible if you know your iCloud username and password.

Now the reason why the attacker was able to remote wipe is because he had the iCloud username and the newly generated password.

</comment></comment><comment><USER11> For those not aware whenever a journalist uses the term "quietly" it equates to "didn't issue a press release" or post publicly in an announcement.

<comment><USER12> Yeah, and? What else would it equate to?

Press releases and public announcements are how a company communicates. If a company changes something without communicating, they changed something quietly.

I'm not really understanding what point you are trying to make. What is there to misunderstand about that "quietly"?</comment></comment>


Taking the headphone jack off phones is user-hostile and stupid - <AUTHOR> http://www.theverge.com/circuitbreaker/2016/6/21/11991302/iphone-no-headphone-jack-user-hostile-stupid <comment><USER2> More subjective journalism. We have 3 ways to listen to music from our phones, and Apple wants to remove the oldest technology. Who still cares about the 30-pin connector?

I'm happy to lose the headphone jack as I use Bluetooth in both the work car and my own car (which works very well), and I'm generally around other devices when I feel like listening.

I'm also tired of seeing the DRM argument. Maybe we should go back to analog signal transmission because clearly digital is mutually exclusive with DRM, and The Verge thinks HDCP is still a widespread issue.

The only argument against it, which was barely noted under point #5, is vendor-specific ports. At worst, you'll need to purchase a dongle the size of your fingertip to interchange, if you're use the same pair of headphones in different devices. You're paying $1000 for a phone and you're worried about a $20-30 dongle for your $60 headphones?</comment>