China bugs and burgles Britain - <AUTHOR> http://www.timesonline.co.uk/tol/news/uk/crime/article7009749.ece <comment><USER3> I feel we've just been introduced to the realities of the new world of warfare.

Getting inside information on Google, Adobe, etc, would be of immense value for cyberwar. I don't think the information is as nearly useful for economic purposes as it is for making new software weapons. Every bit of source code or critical system you access gets you more information your teams can analyze for "0-day exploits" and more backdoors/trojans you can place to get more access to more networks whenever you need.

Imagine you've amassed a lot of brilliant computer scientists and security experts. Getting access to source code and installing trojans would be of immense value to you because you'd be sitting on a huge stockpile of weapons just waiting for you to analyze them in parallel long after you've infiltrated (and even if you were detected/shut-off). If we're seeing exploits streaming out of small security firms and off-shore spammers--- imagine the wealth of exploits a well-funded military division would be able to come up with. Now imagine you wanted to stay competitive with other such militaries... To them the means to get new weapons is more important (in a meta-sense) than pretty much anything else.

From my arm chair, I'd say for weapons of mass cyber influence the most prized possessions would be:

(1) control over the pipes (presumably the U.S. has this for a lot of key stuff, but these backdoors, too, might be exploitable)

(2) unknown exploits in common software

(3) control of highly/specially trafficked systems/services

(4) unknown exploits in specialized software

I'm not trying to make anyone paranoid, but it does seem to me that this sort of infiltration into corporations and government software/systems would be just as valuable to any country anywhere that had a powerful high-tech army. A weapon is a weapon and would be just as valuable to anyone.

There are only a few places that could coordinate attacks like these. We'd have to assume military-- the only other real option being organized crime (with their growth in this economy).

As such, I put it at, maybe, 80% chance that the attacks from China were from Chinese military sources, but (given motive, skill, and funding) there's at least 10-15% chance these are actually coordinated by the U.S. military or intelligence agencies themselves and pinned solidly on China. The remaining 5-10% or so falls on other militaries or maybe brilliant criminals.

If I was thinking like a cybergeneral, I would want someone else to be scrutinized other than myself. I might even specifically seek out companies important to me that also did business with my opponents so that it was easier to pass the blame. I feel the U.S. intelligence/military probably has the cleverness to make that all happen if they wanted. I very much doubt they did so, but I think we're silly to ignore the possibility.

What we really need to stop ignoring is that our software and systems are actually turning into weapons. I think the days of idle worry over spambot exploits is behind us--- now we have to imagine that your favorite websites, your business servers, and your home PCs are pawns in a very big game of chess.

<comment><USER4> I think the chess analogy is fundamentally flawed. You're presuming that there's a Chinese "chessmaster". Instead, as we have seen from all sorts of phenomena, from the Anonymous protests against Scientology to Al Qaeda terrorism, distributed movements with no central control are as powerful (and, in many cases, more powerful) than centralized armies.

Where you envision a controlled, organized hacking scheme organized by the Chinese military, I see a widespread group of nationalistic Chinese hackers employing whatever means are at their disposal to advance Chinese interests and disrupt Western businesses and governments. The threat might be the same, but the way one responds is vastly different.

<comment><USER5> "Instead, as we have seen from all sorts of phenomena, from the Anonymous protests against Scientology to Al Qaeda terrorism, distributed movements with no central control are as powerful (and, in many cases, more powerful) than centralized armies."

Are you sure the Anonymous have done any long term damage to Scientology? Or that Al-Qaeda actually achieved anything meaningful against the occident? If you look at history, those who are more centralized are always the ones how are the more powerful. Up until the point they become too big and things start to break down. After that, it's back to normal and the more centralized win. Short-term imperialism and attempts at unification throughout history gives us good examples of how things unfold.

There's certainly a lot of nationalistic Chinese hackers, but I don't think they could pose any significant threats. The best they could do is adding noise so that the "real" government hackers go undetected. They would also become dangerous if coordinated by the government, but at that point they're no longer decentralized.

I think decentralization have its advantages when considered in the right context. But politics and religion are all about centralization and always have been.

</comment></comment></comment><comment><USER6> Points also to the issue that thinking about security from a perimeter point of view (everything outside firewall is bad, everything inside is good) is outdated. There is no inside vs outside anymore.

<comment><AUTHOR> That always was a stupid strategy. Trusting stuff on one side of the firewall just because it is on the other side is not good enough, that means that after any breach at all your whole network is wide open.

Security should be applied at the lowest possible level, just like you would in a physical installation.

It's not like when you work in a bank once you are allowed 'backstage' that that automatically gives you the right to visit the tellers cage or the vault.

<comment><USER7> My bank takes a different approach, an old one, to security. Here are three things that happened to me at their main bank office over the last 6 months.

1 - I sat down with a mid-level manager asking about a debit card in my wife's name for one of my accounts. The manager pulled up my account and says "I see you were in Wilmington last week. My family is from there." And we chatted about Wilmington for a bit.

2 - I walked up to the teller desk and said "Please move $500 from account A to account B." I filled out no forms, showed no id, didn't even know the account numbers. The teller said "No problem Mr. Hancock, have a nice day."

3 - I needed to change my phone number linked to all my accounts. I walked into the teller and told her I have 5 accounts and wanted to change the phone number on all of them but didn't have my account numbers at hand. She handed me a post-it note and asked me to write down the new phone number: "No problem Mr. Hancock, we'll see it gets done."

The approach this bank takes is oriented around trust and liability, not IT security. Some may be upset that a bank manager would/could scan my transactions and openly acknowledge they see where I was last week. But I see this as openness in acknowledging that they can see the data. All banks can see this data and many credit data warehouses have this data. My bank simply doesn't pretend they can't see it.

In response to your post, jacquesm, I completely agree with your point of view from an IT perspective. However, I do not expect a bank, large or small, to get things perfect internally. So I choose to do business with one I trust to uphold their end of liability. I take this approach with most business partners, as I'm sure many do. When I buy a $50 item on ebay, I expect less of the supplier and pay accordingly.

<comment><AUTHOR> Yes, but that works at _your_ branch.

If you were to walk in to say the New York city branch of a major bank that you have an account with in the countryside then you'd be looking at a completely different situation.

I once borrowed E100K from my bank just on my promise that I would pay it back within 7 days. That would have been a lot harder if I had not been a very good customer of theirs for more than a decade.

But I still doubt they'd let me past the 'no customers beyond this sign', simply because they have a duty to safeguard the privacy of their other customers, even if we'd have a higher than normal level of trust between ourselves as people.

<comment><USER7> Your right; that's why I don't do much business with large banks ;).

I have one account with a large bank. I have not had any problems, but I limit my transactions with them to well documented transfers and have standing orders to not allow any other type of transactions.

I have no expectation that a large bank will cover my liability better than they cover theirs. I engage with them accordingly.

<comment><AUTHOR> The best way to spread your risk with banks is to make sure you never have more than your federally insured cap with any one bank. (that's a luxury problem though). Over that and you're up the creek without a paddle if anything should happen to that bank.

The funny thing here is that the people that the bank owes money over that amount are ruthlessly culled, but the people that owe the bank are not.

I think that should cut both ways, in other words if a bank folds then both the debts _and_ the deposits should be capped or none. But it seems to be completely asymmetrical to keep the people that owe the bank on the hook while capping those with whom the bank is in debt.

</comment></comment></comment></comment></comment></comment><comment><USER8> I shudder to think how routine may be such activity by Chinese corporations. Imagine sending a not-too-tech-savy sales/marketing dude to China. In the evening he gets 'friended' by a young lady offering a free thumb drive (or herself). How much training are western corporations giving their international staff about high-tech security?

<comment><USER9> At my job, at least (research at a major government contractor) we all have to undergo annual counterintelligence training. And that's for me, the intern who never leaves the country.

Among other things in the training is the assertion that multiple employees are currently being targeted for espionage and at least a few employees are most likely working for foreign governments. They also warn about accepting gifts and give examples of "spooky" things, like random strangers befriending workers on foreign travel only to reveal that they know way too much about that person.

Training is there in big corporations, maybe not in startups.

<comment><USER10> I took the Official Counterintelligence Training at a major aerospace contractor in the late 80s. It was bunk. The korean war vet who ran the class gave us some cock-and-bull story about Bulgarians flying ultralights at the state park not too far from the "Main Plant". But everything of merit about our rockets got published in Aviation Week every two years or so. Even material about possible payloads, which was so compartmentalized that we knew next to nothing, maybe a bolt pattern, mass and location of center-of-mass above the bolt pattern.

The "training" was all superstition and cargo cult management by slogan. When you thought about it for a minute or two, nothing they said made any sense.

<comment><USER9> The first time I took it, we had a video of an ex-KGB guy assuring us that agencies like his previous employer are indeed targeting us. These days, there's no concern about Bulgarians in ultralights, it's all about buying an employee a new car so he'll load up a USB drive with interesting info.

I wish I could be targeted for something like that... I don't even have access to secrets but "they" don't know that, and I could use some extra money.

</comment></comment></comment></comment><comment><USER11> Re comments that this has been going on a long time, and that the West does it too.

It probably has been happening a long time. Many may have assumed it. If Western governments have been papering it over, it's good that it comes out so that citizens and businesses can know how widespread the problem is, and how likely or unlikely anyone will be affected directly. I suspect that if we knew exactly what was happening, most would be surprised at the extent.

The West probably does do it too. I strongly suspect that there are a set of "niceties" that Western governments observe (or sometimes not, but there is that restraining tendency). I doubt that any similar niceties exist within the Chinese government at all; the very concept is probably amusing to them.

When China starts selling cars in the US, how much espionage do you think will be brought to bear on their US operations and employees? I'm guessing little more than an entry in a catalog at the CIA.

How much espionage is potentially brought to bear on Western companies operating within China? If I brought my business to China I would assume it was targeted. If I brought my business to Canada I wouldn't give it a thought.

IANASpook (but then, I would say that)

</comment><comment><USER12> Don't you just think these news about hacks from China are getting way to frequent?

The attack on Google was said to be a way to get access to the accounts of free rights activists, but they also attacked several other US companies. The reason must be to steal the companies' know how.

Would you be surprised if a few years from now a Chinese Google was announced and similar and maybe better products in other industries?

And I think these actions are all supported by the Chinese goverment which knows getting chinese competitors in some key fields is the only way of exponentially develop its economy.

<comment><USER13> According to Bruce Schneier, the Google attacks were using the CALEA intercept points which are mandated by US law. There is no possible way that Google could shut down those access points without violating US law.

> _In order to comply with government search warrants on user data, Google > created a backdoor access system into Gmail accounts. This feature is what > the Chinese hackers exploited to gain access._

[http://www.cnn.com/2010/OPINION/01/23/schneier.google.hackin...](http://www.cnn.com/2010/OPINION/01/23/schneier.google.hacking/index.html)

<comment><USER14> You'll note that he provided no support for that claim; he just said it in an authoritative tone.

<comment><USER15> For some reason I'm strangely reminded of the episode of Big Bang Theory where Sheldon talks on NPR whilst having helium pumped into his room. That would be an authoritative Schneier.

</comment></comment></comment></comment><comment><USER16> Are MI5 trying to suggest that they don't use the same tactics against other countries? Industrial espionage has always been common, so this is nothing new except perhaps for the particular technologies used.

<comment><USER15> Yes CPNI is technically part of MI5 but they're not full on spooks per se (and MI5 don't do CPNI's job). They receive intelligence from other departments and are responsible for certain elements of gov.uk security, although the primary source for information assurance/security is CESG based at GCHQ (which is more MI6 than 5).

CPNI also handle liaison what's called the Critical National Infrastructure. That is to say things that are not government owned but would cause problems if affected (like power companies, transport firms etc.).

As an analogy CESG are probably closer to NIST and the standards part of the NSA, whereas CPNI are closer to the FBI. Note that in the US model something like that type of tactic would be a CIA or military operation, not NSA - <USER2> and MI6 would be the same, offensive security if anywhere would have fallen in the remit of the armed forces, at least until the recent cybersecurity strategy came out which establishes the structure of the UK's offensive function.

<comment><USER16> Well whatever the particular acrynms might be I find it hard to believe that British secret service agencies don't use near identical tactics to obtain information from other countries or organisations.

</comment></comment></comment><comment><USER17> To be perfectly honest if the all the people caught in Chinese honey traps just went to their wives and the press saying "I committed adultery because the Chinese attempted to get leverage over me, it was irresistible"

I think they'd get awarded the Victoria cross for bravery or something. Ig noble prize for politics please?

CHINA! Feel free to send honey traps this way. I'm in local government. Fantastic. They've obviously not looked at the divorce statistics lately.

</comment><comment><USER18> Anyone got a link to the leaked MI5 document itself? I don't really trust this article to present its claims faithfully.

</comment><comment><USER19> This whole thing is fishy.

Here's an article from 3 years ago, with a very similar "document": <http://www.foxnews.com/story/0,2933,314718,00.html>

<comment><USER17> Excuse me.

Even though Darth Siddy may own the times, journalistic integrity is a point of pride in Britain. Not everywhere but in the Times, BBC, Guardian etc it certainly is.

He also owns Sky and that's our version of faux news. Sky is rubbish and complains the BBC is 'too big' and a 'monopoly'.

Why? Because the BBC is made of uhm. 'Win'. No adverts and an insane amount of programming for less than a couple of months of Sky (For Sky think Cable). Fantastic.

<comment><USER19> I'm not sure I understand your point, however the link I posted was Fox News syndicating the Times which as you say, does have journalistic integrity...

I'm sure this document is real, I'm just saying that the fact that the chinese government has been spying on large multi-national corporations across the world is not "news" or even "hacker news".

<comment><AUTHOR> If one government trying to hack another using gifted USB sticks and cameras isn't hacker news then I really don't know what would be, but if you feel that way there is always the 'flag' option.

</comment></comment></comment></comment><comment><USER20> the report this journalist quotes appeared on wikileaks over the summer. I wonder how legitimate his sources are. I'd like to see an official report from MI5, but of course, as the writer puts it, it is a "restricted report", so I guess we wont actually get a source on this.

</comment><comment><USER21> "The growing threat from China has led Evans to complain that his agency is being forced to divert manpower and resources away from the fight against Al- Qaeda."

Good.

<comment><USER22> Think about the children!</comment></comment>


Ask HN: for iPhone photography, should i go X (refurb) or Xr - <AUTHOR> X > Xr because of dual camera vs single
or
Xr > X because of chip a12 & software (variable depth of field is awesome)
I assume price will be ~ same. I like the X finsh, but Xr will have more support in time & better faceid
Anyways X (refurb)  or Xr ??
P.S: i do not wish to pay max premium, so Xs not a possibility <comment><USER2> Either will take pretty good photos I would always get the newest model. If you are that serious about photography you will ultimately want a dedicated camera anyway. The quality of your photos is going to be determined much more by other factors e.g. composition, lighting, perspective etc. than which particular model of camera or phone you shot it on.

</comment><comment><USER3> Agree with Steve, if you want the best quality photos to take the newest version of iPhone xs max with 264GB (because you must have best shots with you all the time).</comment>


Special Operators Are Using Rapid DNA Readers - <AUTHOR> http://www.defenseone.com/technology/2015/05/special-operators-are-using-rapid-dna-readers/113383/

<comment><AUTHOR> Rapid DNA reading is an interesting wrench in the expectation of privacy that we currently have in today's society- assuming that the technology gets better and better, what happens when we get to a point where our identities are almost instantly conformable by anyone with a DNA reader?

Personally, I think that this is has the potential to be a _good_ thing for privacy and identity security, because no one can hack your DNA... or at least we don't know how they'd hack your DNA currently. However, I also think that this would bring about some crazy Orwellian government oversight in the name of "preventing terrorism" or perhaps "think of the children" where all citizens are required to register their DNA in a national database. The ultimate issue with _that_ being that DNA changes as people get older[1], so what happens if you forget your yearly registration renewal with the national DNA Database? Suddenly you're Lilu Dallas and you're not officially registered so obviously you're a criminal?

[1][http://genetics.thetech.org/original_news/news91](http://genetics.thetech.org/original_news/news91)

<comment><USER2> People too often confuse privacy with anonymity, anonymity is about not being to relate a certain record or an activity to a person, privacy is the agency which allows a person to decide and enforce with whom they share information. While real time DNA scanners might be an issue for anonymity they are no bigger to privacy than photo-ID's.

Now it's true that anonymity and privacy have some overlap since you might consider information that can be extrapolated from your name or location private, but that's a the limitation of any system which grants you privacy, if people can directly see, hear, smell or otherwise sense you, you don't have agency over that information no matter if they use their eyes, noses, or fancy DNA scanners.

As for the other parts, it's already possible to hack DNA, and it's been possible to "hack" the methods that forensic DNA analysis uses for over a decade now (POC's were shown in the early 2000's) since technically forensic DNA mapping isn't a map of your entire genome, but as most other DNA profiling methods just a fingerprinting (remember that even actual fingerprint analysis has 0.8-4% false positive rate depending on the type of print and method used) method takes your genes and crates a fingerprint out of them, that fingerprint will not be unique, but will be sufficiently rare to tie a person with that fingerprint to a sample, and outside of immediate familial matches the chances of a true false positive is not an issue beyond theoretical statistics.

That said there already ways to generate those forensic samples, the oldest version involved splicing specific DNA markers into viruses or bacteria for reproduction and mixing them with the sample, since most DNA analysis uses a shotgun approach it allows you to splice smaller DNA strands that would be then "glued" together during analysis since that process breaks DNA to short strands for quick identification anyhow. More modern techniques incorporate molecular restructuring which can actually produce completely artificial DNA, think of 3D printing the molecular structure of DNA from scratch. This process is still in it's infancy but most experts agree that within 10-20 years you will have a device the size of a desktop laser printer that will be able to generate DNA and other complex protein molecules.

And while this is scary this isn't the 1st time when forensics had an issue when techniques and technologies had an impact on their reliability, but just as how they've learned to detect the difference between latent and transference (when some one actually takes your print from surface a and puts it on surface b) prints, and how lift DNA analysis on fingerprints allowed them to detect even more advanced methods of transference such as molding entire fingers and even palm surfaces to delivery prints they will adapt to "hacked DNA" as well.</comment></comment>


Show HN: Planar Reflections in WebGL - <AUTHOR> https://mikolalysenko.github.io/regl/www/gallery/planar-reflection.js.htmlblob/gh-pages/example/planar-reflection.js <comment><AUTHOR> Whoops, wrong link. Here is the correct one: [https://mikolalysenko.github.io/regl/www/gallery/planar- refl...](https://mikolalysenko.github.io/regl/www/gallery/planar- reflection.js.html)

In this demo, I render reflections in a plane using a trick with the stencil buffer. I provide a video([https://www.youtube.com/watch?v=FUNAcjJHo8U](https://www.youtube.com/watch?v=FUNAcjJHo8U)), in case the demo won't run. Those who are curious can find the implementation details described in the top of the source code: [https://github.com/mikolalysenko/regl/blob/gh- pages/example/...](https://github.com/mikolalysenko/regl/blob/gh- pages/example/planar-reflection.js)</comment>


If you have to learn just one programming language(2009) - <AUTHOR> http://blog.srinivasan.biz/software/if-you-have-to-learn-just-one-programming-language

<comment><USER2> There was significant discussion when this was previously posted. Here are some:

[https://news.ycombinator.com/item?id=1344641](https://news.ycombinator.com/item?id=1344641)

[https://news.ycombinator.com/item?id=1390524](https://news.ycombinator.com/item?id=1390524)</comment>


Bandwidth costs around the world - <AUTHOR> https://blog.cloudflare.com/bandwidth-costs-around-the-world/ <comment><USER2> I wonder if there is a reason for the high cost. In Australia some of the infrastructure is being upgraded for the NBN, maybe that's part of it? I don't know but I'm curious to find out.</comment>


Freelance Programmer Survival Manual - <AUTHOR> http://luaz.blogspot.com/2012/09/freelance-programmer-survival-manual.html

<comment><USER2> It lacks the most important advice: charge more.

> I will give a lower price to a customer who I believe to have good > character, and I would hike up the price if he is a demanding or difficult > to deal with type

Please don't. Your beliefs don't matter. Even the coolest guy can come out as a PITA or a scammer. Or even if he's cool, he can have partners who will make your life a living hell. In the end, it's all about the money. Just charge what you're worth, so you don't regret it.

<comment><USER3> Don't be afraid of losing jobs because you charge too much. When I first started on oDesk I charged $10 an hour, because I didn't want to put people off. Then I realized that kids in my neighbourhood make more walking dogs. Since then I've put my rates up considerably, and even though I still get nervous when talking money, I've never had a client say it's too much.

Charging more lets people know you're serious. Low paying customers typically ask for way more "can you just" tasks, like changing the font colour a dozen times or moving something "just a little to to right". You don't call your lawyer to change the typeface on your legal letters.

<comment><USER4> +1. In fact in sites like odesk, you put people off by charging too little (putting you in the same league with guys no one wants to hire at any price whatever low).

</comment></comment></comment><comment><USER5> IMHO, Nothing like agile for freelancing.. every week the customer gets a solid deliverable, every week I get a real paycheck. If at any time the customer does not like my work or I don't like the customer, we can always part ways, what is done is all 100% his, (documentation, source code etc)

Worst case scenario.. I am out a week's work.

*so far, I've never been stiffed.

<comment><AUTHOR> I wish the customers at this part of the world (Malaysia) are sophisticated enough to accept the concept of "time & material". Most of them will refuse to pay if they are not satisfied with the work (in regardless of the completeness); and a partially completed work is of no value to a typical customer (especially non-IT customers).

<comment><USER5> Trust is a key issue, if we don't trust each other we are already in trouble. Trust goes both ways, so that is why I charge at the _end_ of an iteration with no money advance at all.

</comment></comment></comment><comment><USER6> The upfront depends on the project as well; some projects have less, some have more; depends on the size and the number of milestones. If you have, say, a project of $10k with 4 milestones, I would never do a 30/70 payment. Rather 30/10/10/20/30 or something.

Also, you can use the popular agile approach which is popular; in that case you define stories per sprint (which in smaller projects are a week usually) and every monday morning you agree with the client upon the stories to be done that week. When you finished the last story, the client needs to pay the price for that week and go on with the next week. This keeps both sides alert and doesn't allow for slacking on both sides. It can go very wrong if you agree to too much, then you get the dark side of agile which means you'll be working every weekend 24 hours/day to make that monday morning.

</comment><comment><USER7> I found it interesting that he barely touched what I feel is the most important part of freelancing: marketing. Yes, right now you can name your price if you are a good developer, but how do you show that, and how do you evaluate projects? (I know he touched on what kind of clients to keep.)

When I freelanced, I evaluated clients on three criteria:

* had I worked with them in the past?

* did I know anyone who had worked with them in the past?

* everyone else

If I trusted them or people who had worked with them, it made the engagement easier all around (though you still need a contract!).

As far as finding new clients, I relied on word of mouth, which probably didn't lead to as many opportunities as would have occurred if I was more active in various communities, but I was ok with that at the time.

Also, I wonder what the author moved on to?

<comment><AUTHOR> The only marketing I did is word of mouth: friends & family, those are usually the good paymaster due to our "relationship". Yup, returning customers are the best.

I didn't try any elance stuff, because I felt it's a race to the bottom price with programmers from India.

I move on to develop a restaurant review website (sort of lifestyle business): <http://food.malaysiamostwanted.com/>

</comment></comment><comment><USER8> Same comment I put on the blog, but keen to hear HN responses. Why do so many freelancers gravitate to small(er) clients? It seems to lead to direct competition with platforms such as freelancer.com, odesk, elance, etc which is impossible for a local freelancer.

Clients like digital and creative agencies, funded startups and corporates (managers that don't have access to internal dev resources, but still have dev needs). They use freelancers and they don't come with a lot of issues small clients have.

Interested to hear from freelancers as to how and why they work for smaller clients.

<comment><USER9> I just like small projects because I get bored quickly. Three months is about ideal. Projects for larger clients also have a tendency to go nowhere, that is they never make it into production. It is easier to get good rates from larger clients, though.

<comment><USER10> Couldn't agree more, part of the fun of Freelance work for me is getting to work on a range of projects with a range of differing technologies. Might just be my attention span but more than three - five months full time on a project which isn't my own and start getting itchy feet.

</comment></comment></comment><comment><USER4> I will never try doing anything without a 3rd party technically guaranteing me payments (like the odesk.com which bills people automatically per-screenshot using money pre-blocked from their CCs - absolutely no excuse can exist to avoid payment).

</comment><comment><USER11> I have also found most (if not all) points here to be true. Good essay.</comment>


Coming up with a GUI replacement for Hello World - <AUTHOR> http://blogs.msdn.com/alfredth/archive/2010/03/23/rethinking-hello-world.aspx

<comment><USER2> I think popping up a "Hello World" is an even more relevant first assignment in this magic world of IDEs and toolkits. The point of the program doing absolutely nothing interesting is that you are testing if your toolchain is configured properly and works- which is big.</comment>


911 Operator Missed Emergency Call, Was Ordering Pizza - <AUTHOR> http://www.nbclosangeles.com/news/national-international/911-Operator-Missed-Emergency-Call-Was-Ordering-Pizza-365481831.html?_osource=SocialFlowFB_LABrand <comment><USER2>
      "I thought there would be more than one person answering the phone.
      I can't believe there is just the one lady."

How could there be only one person with this responsibility? Seems like a pretty vulnerable area for failure which could result in severe repercussions.

<comment><USER3> IF the lady ordering the pizza is responsible for answering the calls that come in, what do the other people do and why couldn't they order the pizza instead? This story just makes no sense to me.</comment></comment>


An airline pilot has a really boring job thanks to automation. - <AUTHOR> http://www.cnn.com/2009/TRAVEL/10/28/pilots.cockpit/index.html

<comment><USER2> Lessee, I think airline pilots are like firefighters. I'm fine with these people being bored, as the alternative is usually not a "good thing"... When they're, umm, "excited", it's usually a bad day.

</comment><comment><USER3> Reminds me of the old joke about the cockpit crew of the future: a dog and a pilot. The pilot is there to feed the dog, and the dog there to bite the pilot if he tries to touch anything.

</comment><comment><USER4> I'd say let them have laptops, but install software on the laptops that will alert or lock the laptop when ever any issue (something is wrong, or the destination is approaching).. I'd say in most cases the plane would know when something is up.

</comment><comment><USER5> Not only is everything automated and nothing interesting happens, but when they actually _do_ anything, it's all listed out step-by-step in the manual.

I fly small airplanes and I have no desire at all to fly commercial jets. I used to say they were just glorified bus drivers, but bus drivers have a more fulfilling job than most pilots.</comment>


Ask HN: Validate my startup/service idea - <AUTHOR> Here's my idea: a site that provides on-demand copywriting for startups, developers, and entrepreneurs. You get paired with an expert copywriter who can improve your copy or write you totally new copy for all your marketing materials (web, email, social), with the aim of getting you more sales and reaching more users.
As a freelance copywriter + web developer, I've noticed that developers often don't have the time or wherewithal to write really great content. We can all write, but writing to make sales and get more users takes a lot of time and practice.
Questions:
- Would anyone here pay for this service? How much?
- Do you think there's demand for this?
- If yes, what are the next steps you would take to validate this idea?
Thanks very much HN. <comment><USER2> So, basically, you want to make nth freelancer portal_)

<comment><AUTHOR> I hope not. I think the distinctions are in: a) it would be specifically for copywriting, b) it would be "productized" in that you sign up for one of a few plans, like email campaign for $X, complete website re-write for $3X, etc., with a guaranteed turnaround of under a week and c) there would be only a small pool of qualified, vetted writers available at any one time.</comment></comment>


No more XML layouts in Android - <AUTHOR> https://www.kotlindevelopment.com/why-anko-layouts-dsl-better-xml/ <comment><USER2> Very new to android development and I absolutely hate doing anything in the layout/ folder. But should I even bother with this considering the absence of ConstraintLayout</comment>


Chinese CPUs Now Work on Domestically-Produced Operating System - <AUTHOR> https://www.tomshardware.com/news/chinese-cpus-now-work-on-domestically-produced-operating-system <comment><USER2> Big deal - x86-64s running Linux regardless of what CPUs and OS are named. Both are sort-of continuations of VIA's Centaur stuff (and I'd be surprised if they weren't still involved at some level).

<comment><USER3> Well, making x86-64s at 16nm is kind of a big deal. Very few places in the world can make those...

<comment><USER2> That's true which is why ([https://en.wikichip.org/wiki/zhaoxin/kaixian](https://en.wikichip.org/wiki/zhaoxin/kaixian)) they're apparently being fabbed by TSMC. :)</comment></comment></comment>


IMDb Turns 19. Yes, 19. Older Than The Web Browser.  - <AUTHOR> http://www.techcrunch.com/2009/10/17/imdb-turns-19-yes-19-older-than-the-web-browser/ <comment><USER2> Like the Gracenote* CD database, there were some bad feelings about the commercialization of content created by unpaid volunteers.

[http://en.wikipedia.org/wiki/Internet_Movie_Database#As_a_su...](http://en.wikipedia.org/wiki/Internet_Movie_Database#As_a_subsidiary_company)

*When I went to look up info on the Gracenote/Freedb controversy, I found it had been scrubbed from Wikipedia. Hmmn.

<comment><USER3> It's a mystery to me that nobody took that to court and claimed as the victim of an unfair contractual arrangement.

Also, good luck trying to get any of your personal information removed from it (eg I added my date and exact birthplace years ago in the mistaken belief that I could filter my own private/public data). Their attitude is that once you've given them a piece of data, they own it.

</comment></comment><comment><USER4> Just to add a couple facts to the context of IMDb being older than the browser...

According to <http://www.boutell.com/newfaq/history/fbrowser.html> the first web browser prototype was developed in late 1990/early 1991. Mosaic was released in March of 1993.

<comment><USER5> The extremely short time scales involved in www history always amaze me. Was there any other invention in human history that was so widely used in such a short time?

<comment><USER6> www history isn't as interesting as Internet history or computer history.

</comment></comment></comment><comment><USER7> imdb was what got me interested in computers

its such a shame its actually got less useful since that first time I used it.

<comment><AUTHOR> Really? How so?

<comment><USER7> just general usability, you never used to have to be logged in to view discussions (logging in loses your location) along with the crazy default of seeing 1 post per page in a conversation, the adverts (I am sure ive seen some pop ups in there as well) and general cramped ui.

to be fair the ui hasnt changed all that much since the early days, but my expectations have :)

<comment><AUTHOR> It's true that a major facelift would be a good idea. They have been making minor redesigns over time, but nothing major.

<comment><USER8> Or they can just offer a metered API and people would Mint them.

</comment></comment></comment></comment></comment><comment><USER9> Holy crap, it's older than me!

</comment><comment><USER6> Older than the Web Browser isn't a big deal. EMAIL is older than the Web browser...</comment>


Announcing Notepad Conf 2014 - <AUTHOR> http://notepadconf.com

<comment><USER2> Where is the love for vi and other cli text editors?

</comment><comment><USER3> I've been practicing my copy/paste for some time. Finally, a venue to show my skills!</comment>


How to use drop shadows with CSS3 - <AUTHOR> http://mrbool.com/how-to-use-drop-shadows-with-css3/27101

<comment><USER2> > The first one, the filter is for IE ... the webkit tag is for Chrome and > Safari, and the moz-box-shadow tag is for Firefox.

Ah, yes, the standards-compliant Web we've all been waiting for.</comment>


Tablets Are Waiting for Their Bloglines - <AUTHOR> http://www.rumproarious.com/2012/12/08/tablets-are-waiting-for-their-bloglines/

<comment><USER2> Completely unrelated to the content, this is a 2 paragraph article with 2 footnotes that are a paragraph apiece. Why not just write 4 paragraphs?

</comment><comment><USER3> Wouldn't Flipboard and Zite (not to mention the more direct descendents Feedly and Newsblur) fit the bill?

<comment><AUTHOR> I'm not sure. They seem to be in the right space, but they are also aggregating big media, as much as independent publishers.</comment></comment>


ZFS Licensing and Linux - <AUTHOR> https://insights.ubuntu.com/2016/02/18/zfs-licensing-and-linux/ <comment><USER2> I find it odd he uses the term "quite obviously" twice in his post. If it was so obvious, why bother seeking legal counsel? I think he's doing Ubuntu a disservice with that kind of response. It makes it seems as though they haven't put in an appropriate amount of effort to vet this thing out.

I'm also curious as to why they'd have waited so long to include it if the legal questions were so trivial.

<comment><USER3> I imagine the wait was mostly that it wasn't deemed necessary to have ZFS on Ubuntu until now.

Containerisation has drastically increased interest in CoW filesystems. Traditionally their only use-case has been for implementing livecds and similar ro + rw layer environments.

For this AUFS has been the gold standard since basically forever. However AUFS has some flaws and lack of features that make it undesirable to use in production container workloads, hence looking to ZFS to fill this gap.

<comment><USER4> Note that AUFS has been succeeded by overlayfs which, unlike the various earlier union fs attempts, has actually been merged into the kernel. I'm not sure where it stands with regard to flaws

<comment><USER5> It's pretty flawed - for example, if you open a file read-only, open it again read-write and the write to it, any read from the first file descriptor won't show the writes. The corner cases don't bite people under most circumstances, but when they do they're awful.

<comment><USER6> That sounds like a fairly normal structured file/multiprocess workload, not much of a corner case there :(

</comment></comment></comment></comment></comment><comment><USER7> > Our conclusion is good for Ubuntu users, good for Linux, and good for all of > free and open source software

I would say that your conclusion is bad for linux and bad for all of free software. Because if linking your non-gpl-licensed binary blob with the GPLed kernel is legal then linking any other non-gpl-licensed binary blobs with any other GPL binary is also legal and thus the GPL is completely worthless.

Is it worth setting such a precedent over the ability to run ZFS on Linux?

<comment><USER8> Just some informative notes for those who are not familiar with the intricacies of GPL. I'm not detracting your point.

Disclaimer: IANAL

The GPLv2 license governs the distribution of software licensed with said license. It forces anyone who distributes a GPL binary to also distribute the source code used to build that binary.

If in order to build that particular binary you had to include some other code, then you have to provide the sources for that code as well. Furthermore, that code you provide must be distributed in turn under the GPL license. Any such "added code" becomes part of the thing you distribute and thus constitutes "derivative work".

The key thing here is that it doesn't matter if the "added code" is just some bit of extra functionality of if it's the "whole thing" while the GPL code is just one header. When you build a kernel module, you have use some GPLd headers at the very least.

This last point technically taints a binary kernel module and forces you to release all the sources used to build it _and_ release those sources as GPL.

However there are two interesting points here:

1\. Distribution

Notice how the license only mentions distribution. You are allowed to do whatever you want with a GPL source that you hold on your hands: you can change it, add some code, link it with other code. There is absolutely nothing forcing you to immediately release your derivate work to the public and thus nothing forcing you to release the sources of your derivate work.

This means, that if you build a kernel module on your machine, from a mixture of sources with GPL and an other licence; you didn't violate the GPL (whether you violated the other license, it depends on that other license).

Please read very informative:

[http://zfsonlinux.org/faq.html#WhatAboutTheLicensingIssue](http://zfsonlinux.org/faq.html#WhatAboutTheLicensingIssue)

TL;DR: ^^^ In the case of the kernel, this prevents us from distributing ZFS as part of the kernel binary. However, there is nothing in either license that prevents distributing it in the form of a binary module or in the form of source code.

2\. Exemptions

[http://www.gnu.org/licenses/old- licenses/gpl-2.0.en.html](http://www.gnu.org/licenses/old- licenses/gpl-2.0.en.html)

        However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.

This has a much less clear interpretation in the context of kernel modules. This clause is mainly intended to allow you to use GPL software on a proprietary operating systems as well as running proprietary software on GPL operating systems. You can compile it: which means you can include headers provided by the compiler and OS. And you can run it: which means you can invoke system calls and/or link it with possibly proprietary libraries that make up the main interface.

I have no idea whether in the context of a kernel module, the kernel internal API can fall under this category, given that it's arguable that it doesn't make up the "main interface" of the linux OS.

\----

How does this relate to the article from canonical ?

They are claiming something entirely different. They claim that the ZFS kernel module is "evidently" not a derivate work on the grounds that it's self contained and they cite existing exemptions for other binary drivers such as those by nvidia.

They don't explicitly mention the exemption on the aforementioned point in the GPLv2 license text.

Thus, it's not clear how this will affect the observation of the GPL license and whether it will set a precedent at least for all cases where one can argue that the binary blob is linked against an well define interface that is meant to provide an "execution environment". (e.g. plugins, kernel modules, binaries running inside an OS). Not sure if setting this precedent will eventually erode the general case of linking though.

The line is thin, but I would have preferred some more explicit reasoning instead of "we have concluded that we are acting within the rights " and "is clearly not a derivative work", and finishing with a "As we have already reached the conclusion, we are not interested in debating license compatibility".

<comment><USER9> I wonder what a legal engineering solution looks like.

Clearly ZFS is open source, Linux would profit by including it, but both ZFS and Linux have licenses that are, at this point, impossible to change for various reasons.

It seems that the people opposing this move by Ubuntu claim that by linking against the VFS stuff in Linux, that particular ZFS distribution becomes a derivative of Linux (weak claim IMO but argiuable) and therefore must be GPL'd. But it can't be. And we (or I at least) would like to see ZFS on Linux become easier.

I wonder if some brave soul could make a new, completely superfluous layer of glue on top of ZFS that's both GPL and CDDL? And then could link that glue to linux/vfs while leaving ZFS itself in a completely underived state? Would that satisfy people?

Ultimately we're talking about open source code with nice engineering, here. I think the whole computing community could benefit from a solution.

Sidenote: I wonder how many people here who claim copyright of an API (vfs) prohibits this integration felt the exact opposite way when it was Oracle v Google.

<comment><USER10> CDDL is not compatible with GPL. So this won't work.

<comment><USER8> Not sure it wouldn't work.

Imagine you have a small GPL program, that all it does is to load plugins, e.g. with dlopen and invokes some function, let's call it "main".

It clearly doesn't care what license the binary loaded that way has.

What i does is to load a binary in memory, locate an address and transfer control to it. If the GPL didn't allow this kind of thing to happen, then the GPL linux kernel couldn't possibly load any proprietary program.

Now, let's allow those "plugins" to do something more interesting: request some action by the plugin host. The "main" function receives a function pointer that serves as an entry point for "system calls". Again, it's perfectly legal to invoke such a function, regardless of whether you can see this as "dynamic linking", you can also see this as "providing an operating system system call".

If you're not convinced, let's call this "plugin host" an novel operating deepcloudstrumpfkernel operating system.

Now, this is a pretty hard to use interface. You probably want a library linked to your "plugin"/"program" that provides a more natural interface on top of this basic "syscall" interface. This library and it's headers will contain functions, constants etc.

This library doesn't have to be licensed with GPL; any license compatible with your "plugin" will do. Let's make it CDDL (or MIT).

Now, it would be very useful that this library, or parts of it (e.g. constant definitions), is shared with the "plugin host" a.k.a deepcloudstrumpfkernel; No problem again, whoever owns the copyright for this library can release it with both MIT and GPL license.

You can use the same trick to implement a loadable kernel module that doesn't violate the GPL. However there is a lot of work.

In order to properly abide by the GPL rules, you must be able to build a fully working kernel module without touching any line of GPL code (except header files and library objects provided by the compiler and your OS "primary interface").

This last part is what is tricky. If you want to create a kernel module, you need to include some helpers. If linux had a stable "driver API", somebody else could write a library that helps you build a compliant kernel module, but in order to be more agile, IIRC the linux kernel module subsystem is designed to be source compatible and not binary compatible between releases and the layer exposes a lot of linux internals, which are part of the kernel and it would be very hard to duplicate all this without being caught in a copy paste.

jbooth's suggestion was to write such a dummy layer that bridges the linux VFS interface with something else; thus not requiring the kernel module to use the internal linux API. However there is more to it than the VFS API: you also need the bare minimum to make your kernel module actually loadable by the kernel not depend on any GPL library that helps you adhere to that ABI.

</comment></comment></comment></comment></comment><comment><USER11> > And zfs.ko, as a self-contained file system module, is clearly not a > derivative work of the Linux kernel but rather quite obviously a derivative > work of OpenZFS and OpenSolaris

I don't see at all why that follows. Why not both? Building a kernel module requires including headers and writing glue code to conform to the kernel API, which is licensed only under the GPLv2. It strains reason to argue that a ELF binary with Linux metadata and Linux module entry points registering functions to implement a Linux filesystem is "clearly not" derivative of Linux.

<comment><USER12> _It strains reason to argue..._

So then the question is, why is "nvidia.ko"'s binary blob not a derivative of Linux? What's the logic that says one binary blob is a derivative work, and the other is not when they both are 'ELF binary with Linux metadata and Linux module entry points'.

<comment><USER13> Many people think it is, but apparently no one with authority to go to court over it has done so.

<comment><USER12> It certainly would be interesting to see a "Software Freedom Law Center" vs "Free Software Foundation" legal battle. But if no one wants to fight over a clearly more egregious graphics blob, then why would they go after Canonical for something seemingly less of an issue.

</comment></comment></comment></comment><comment><USER14> Wouldn't the same logic let you conclude that, say, CLISP under a proprietary license + readline under GPL can be distributed together, if readline is distributed as a loadable module instead of a static binary? readline is "quite obviously" not a derivative of CLISP, or vice versa.

[http://clisp.cvs.sourceforge.net/viewvc/clisp/clisp/doc/Why-...](http://clisp.cvs.sourceforge.net/viewvc/clisp/clisp/doc/Why- CLISP-is-under-GPL)

<comment><USER15> The definition of a derivative work comes into play here. An argument has been made by Illumos who ported the KVM module from Linux that since they did not have to make any changes to Illumos to support KVM, and they only made minor modifications to allow KVM to be loaded into the Illumos kernel that it does not constitute a derived work since it in no way depends on Illumos to function and that there was no changes made to Illumos to support it. Illumos gets to stay as CDDL and KVM remains GPL.

A program that functionally _requires_ libreadline to function is very obviously a derived work in copyright law, calling dlopen() isn't going to save you from that.

</comment></comment><comment><USER16> What is the worst case can happen in this use case?

Let's say a NAS company (WD?) takes the linux + zfs and build a NAS incorporate all the zfs features.

Who will/can/should file a lawsuit against them and on what probable cause?

Would/should EFF do it? Why?

<comment><USER17> > Who will/can/should file a lawsuit against them and on what probable cause?

A copyright holder for the linux kernel, on the grounds that they are distributing an unlicensed derivative work thereof (there would be no need to show damages, there are statutory damages; it's definitely unlicensed, the part that's not clear is whether it's a derivative work). It's not really in the EFF's wheelhouse; mjg59 (who holds at least some kernel copyrights) claimed to be talking to the software freedom law center about his options. I'm unsure why he'd regard zfs.ko as more problematic than nvidia.ko (I mean fundamentally end users have the access they need to fix bugs in the ZFS source, the CDDL is basically the same as the GPL, whereas end users cannot fix bugs in the NVidia video drivers, not in some theoretical legal sense but in actual practice), and if the legal theory is correct then it surely applies equally well to both, but he's the one with standing to sue so it's his call. IANAL.

<comment><USER18> Theoretically, nvidia.ko never comes in the same dvd / usb-stick / download as the kernel, it's always a separate piece installed by the user later (even if with a helper program). "Super Easy" derivatives of mainstream distros may include nvidia.ko (and libdvdcss etc) in the initial install, but mainstream distros including ubuntu do not. So they could say, if there was some violation of license going on, it wasn't them doing it, because they were not _distributing_ something derived from the linux kernel. They may separately offer some "shim" code and binary under a separate license that the user then combines with the linux kernel headers on their own machine, and does not distribute the combination.

That's one of the attempted justifications anyway. So what's more "audacious" here is Ubuntu distributing zfs.ko included in the initial install, and not requiring a dkms-like setup.

There's disagreement, even among core kernel developers, about whether nvidia's binary kernel module is OK. The fact that they've gotten away with it for a long time doesn't mean that it's OK, just that it's somewhere between hard and impossible to enforce copyleft (for various reasons worth of a separate post). ref: [https://lkml.org/lkml/2012/8/1/411](https://lkml.org/lkml/2012/8/1/411)

<comment><USER19> Then, theoretically, how about distributing the zfs-on-linux source code with the NAS and present a button in the web interface "Install ZFS" which pops up a big "this will install a non-GPL-compliant module" message which everyone just clicks "OK" on and we're done?

<comment><USER17> This is essentially what DKMS does and how Debian is shipping ZFS. I can only imagine that Ubuntu wants to make it easier that (perhaps it would be hard to have the installer support ZFS as root filesystem without having the binary ZFS module - you'd have to ship a full compiler toolchain as part of the installer?)

</comment></comment></comment></comment></comment><comment><USER20> Interesting that it took so long to reach this conclusion. I thought Linux devs stayed away from ZFS mainly due to the licensing which leads me to believe it's not quite as 'obvious' as this post mentions.

<comment><USER21> Linux stayed away from including it into the shipped kernel, which is indeed a derivative work. Their argument is that kernel module loaded into kernel separately is acceptable to avoid GPL violation.

<comment><USER22> If this is acceptable then the GPL is useless. This behavior is _not_ in the spirit of the GPL and copyleft.

<comment><USER21> GPL defines what is supposed to be the subject to its limitations. And apparently this use case isn't part of it. So how do you define what's in spirit and what is in the letter of the law here?

</comment></comment></comment></comment><comment><USER23> Can someone explain the circumstances around nvidia.ko and why that has been allowed?

<comment><USER24> I believe the claims are along the lines that the core of the Nvidia blob is actually the Windows driver, which is then not a derived work of Linux. They do provide the source for the bit that adapts between the Linux kernel and their blob.

If you are being most charitable, you could consider this like NDISWrapper which doesn't make the driver used become part of the kernel from a license point of view. The least charitable is that Nvidia are circumventing / violating the kernel GPL by their stunt.

Ultimately it would likely take some lawyers, time and money to get a strong decision, which no one seems willing to do, yet.

</comment></comment><comment><USER25> > Equivalent exceptions have existed for many years, for various other stand > alone, self-contained, non-GPL and even proprietary (hi, nvidia.ko) kernel > modules.

If your conclusion depends on asserting the obvious legality of nvidia.ko and saying that you're just doing what they are, you're in a super bad place.

<comment><USER26> That, plus at least one of the authors in question (Oracle, nee Sun) appears to have picked a license deliberately to ensure that ZFS couldn't be distributed with Linux. They were otherwise happy to dual-license with some form of GPL where it suited them; Apple dropped the thing like a hot rock too.

A read of the license text is one thing, the intent of the author is quite another...

</comment></comment><comment><USER27> Why not just use FreeBSD or OmniOS ? Why do I want to use Ubuntu. So I can say "Bro we use the ubuntu it rocks" ?

</comment><comment><USER28> Oracle America, Inc. v. Canonical Ltd. (2020).

<comment><USER29> If one group were to sue Canonical, it would likely be the Conservancy, as the issue is the GPL not allowing for ZFS to be included.

</comment></comment><comment><USER30> The CDDL is an anti-forking license. It requires spooning.</comment>


Why can't you pickle generators in Python? A pattern for saving training state - <AUTHOR> http://blog.metaoptimize.com/2009/12/22/why-cant-you-pickle-generators-in-python-workaround-pattern-for-saving-training-state/ <comment><USER2> Pickling generators is one step from being able to pickle a continuation or save the state of a running function. This is actually a useful thing to do. I wrote a script awhile that spawned several processes that each required posting multiple jobs to Mechanical Turk and doing so in a certain sequence. My language Sleep supports continuations (and generators) and allows me to serialize (pickle) my continuations. I just spawned off a thread for each "process" and periodically saved that executing function to disk. Later when I wanted to restart the program, it'd look on disk for the saved functions, load them, and execute them. Very fun.

I wrote on article about how to do this kind of stuff awhile back:

[http://today.java.net/pub/a/today/2008/07/24/fun-with- contin...](http://today.java.net/pub/a/today/2008/07/24/fun-with- continuations.html)

</comment><comment><USER3> Seems like a misguided way of solving a basic refactoring problem. What he actually wants to pickle is a data structure that the generator depends on. The use of some ALL CAPS magic variable name and global state rings all sorts of warning bells in my head when I look at it.

However, it's hard to tell why he actually needs to pickle generators from looking at his examples. I can think of some good hypothetical reasons, but his examples don't justify it - it looks equivalent to 'I want to pickle a suspended thread' to me.

<comment><AUTHOR> I am the original author.

The example holds without the ALL CAPS magic variable names, "HYPERPARAMETERS". However, I include HYPERPARAMETERS because I am including the actual code I am using. Hyperparameters are global, read-only variables that specify the particular experimental condition being tested. I can't say that I have the best solution to this particular aspect of experimental control (hyperparameters). I might write a blog post about it in the future, to solicit feedback on improved methods. However, I have refined my current approach over several years, and I currently use the assumption: One experiment per process. Hence, one set of hyperparameters---specified at invocation---per process. This assumption has saved me a lot of pain. As I said, I am interested to discuss alternatives.

The training state, however, is not global. You can pickle the training state objects individually. I was considering an ugly global way to refactor, but instead I used this pattern. Which is the reason I wrote the article.

I do come to the conclusion that you must pickle the data structure that the generator depends on. This is why I refactor it into a class object with __getstate__ and __setstate__ methods.

The reason I want to pickle generators is as follows: Generators are the easiest way to write methods that stream input. Because, if you stop and restart, you want to stream from where you left off, refactoring these generators is on the critical path to persisting your experimental state.

</comment></comment><comment><USER4> Nice! I haven't needed to pickle generators, but that should come in handy when I do.

<comment><USER5> If I'm reading it correctly, he's not really pickling the generator itself. Instead, he's counting the number of times he called the generator and pickling _that_ instead. Then, to "unpickle", he retrieves the count and calls the generator that many times.

Two major limitations of this approach: (1) You can only pickle generators that generate the same sequence every time they are restarted. (2) All the work the generator did prior to pickling must be performed again on unpickling.

<comment><AUTHOR> Good criticisms.

 _(1) You can only pickle generators that generate the same sequence every time they are restarted._

I don't know how you can persist state if you do not make this assumption.

 _(2) All the work the generator did prior to pickling must be performed again on unpickling._

Something faster would be to use file.tell() to get the state and file.seek() to set the state. Since the "unpickling" is not a bottleneck, I didn't optimize this.</comment></comment></comment>


Why Microsoft 8 doesn't matter - <AUTHOR> http://www.roughlydrafted.com/2011/09/15/why-microsoft-8-doesnt-matter/ <comment><USER2> I agree that a lot fewer people would actually want to use Windows, especially now that they're completely revamping the interface, and "normal" people might find it hard to accomodate with it, if they didn't have all the Windows programs.

But I also don't think the iPad has "won" for eternity the tablet market. It's having a nice head start, but eventually its market share will become a bit more niche with 20-30% market share.

Apple is great for the computing industry, they push it forward. But they can do that very well from a 20% market share, too. But even at that kind of market share they tend to become very strict with what they allow on their computers. Can you imagine how much worse it would be if they actually had over 50% of the market? Or even 90% like Microsoft?

I don't think any company should have more than 50% of a market. Not Apple, not Google, and not Microsoft. They all become a bit perverted when they get that much. Some more than others.

</comment><comment><USER3> Computing has changed so greatly in just the last 5 years alone. While Microsoft is still a huge player in the industry, I don't think Windows 8 is going to do that much for them. Only time will tell though

</comment><comment><USER4> Completely rubbish article. His analysis is flawed left right and centre. Not that I'm probably much better but heres my take on his points:

1) The Zune failed because Apple controlled the price of hardware. A Zune was more expensive than an iPod and lacked the years of advertising and brand building behind it.

2) The Metro doesn't fail as a phone operating system. Its a lot nicer I'v found than many others. One major reason it didn't sell was it wasn't shipped to stores. Go try buying one, clerks will try and sell you anything but one. Why... I dunno... probably kick backs.

Personally I went into a store and said I needed one for developing, the guy spent 10 minutes refusing to sell me one and trying to talk me in to an android. I've heard this identical story from several other developers I know as well, its not isolated.

Another point is MS tried to play hardball with carriers like Apple did and got smacked around. With Android carriers have complete control, they roll there own versions, my dad has an android device which is almost unusable due to the carrier OS on it. They have locked it down, and whats worse if he mucks with it voids the warranty, looses help support. Not good for a 60 year old mechanic.

Chances are carriers decided to teach MS a lesson, MS came in guns blazing only to find I bet the resistance they have met has been way more than they expected. And Im sure carriers know all too well the history of MS and have deliberately knee capped them from trying to dominate the phone markets.

3) "Microsoft is being run by HP" and what does that mean? I assume he means run by people without foresight, making bad business decisions. But arguable HP have a good business plan which involves making a lot more more off software than hardware. HP is a hardware company making a transition to software.. its nothing like MS. MS is innovating on quite an unusaual scale, its nothing like HP ATM.

4) Lessons unlearned from vista. Please making an argument that incremental change is plain idiotic. Without incremental change nothing improves. Innovation is a process of failing till you get it right. Sure Vista had huge problems, but if anyone hasn't noticed already every second version of windows sucks. They innovate with one release then perfect with the next. Which is a bad Sign for Win 8 as its an innovate release, Win 9 will be the king maker or breaker.

5) "That's an alcoholic level of denial" No there isn't, Longhorn was the catastrophe not Vista, Vista was the recovery. And it showed that it was rushed out the door, but it wasn't an epic failure, it sold perfectly well like windows always does. And By SP 2 there wasn't anything wrong with it at all. Denying Longhorn is an alcoholic level of denial.

6) "there's already an ARM tablet that runs Windows" really.. saying building for arm is a mistake... not sure I can even be bothered going into this. The writer blames MS for being short sight, then says this...

7) "A key reason why lots of PC users have switched to Macs since 2006 is that they could access the native functionality of Windows" sure.. I'd also say 1/3 drop in price helped more than being able to move your apps. But I guess there where some who where interested in running Windows apps on a Mac. Another key reason is the bad press from Vista.

8) "Tablet troll fight: Android vs Windows" this entire area neglects the entire patent and copyright war going on. Is ignoring the head start Apple has. And is focusing on 'fan boy' aspects... weakest part of the whole article, Im not even sure he had a point, just some loosely related comments.

9) "PC market is decline" Wasn't there an article recently from PC World or some similar out fit that totally dismissed this? pointed out numbers are still extremely strong, desktop computing is going anywhere? An article which had industry figures and not just someone thinks is happening from there arm chair. From memory what is happening is desktop are being replaced with laptops and people are buying portable devices along side there primary device (laptop/desktop).

Overall I think he's right Win 8 won't matter as its going to be a cluster f/ck. But its going to be a fun ride for me. I've already written 3 apps for the Win 8 store, got 3 more sketches o my wall.

MS will continue because MS has the contracts, its the same reason Vista sold so well, its going to be on every machine whether you want it or not.</comment>


Hackers Highlight Offers of Corporate Espionage - <AUTHOR> http://www.nytimes.com/2011/02/12/us/politics/12hackers.html?hp

<comment><USER2> I would never wish what happened to the people at HBGary on anyone (Dumping all their private emails? Deleting all their data?), but the more that comes out the harder it is to sympathize with them.

How do you do this crap and live with yourself after?

<comment><USER3> It's important to note that the sleazy stuff comes from HBGary Federal, a wholly owned but independent subsidiary of HBGary Inc. HBGary Federal appear to have been set up to do government work, and were struggling to get it so it appears that Barr and Vera went down a fairly dark path to keep things going.

The big question is how much of this was known to the top brass in the parent company. My guess is not a lot, as having met Penny and Greg I don't think they'd support the idea of going after wikileaks. In fact, even Karen Burke's emails about the anonymous stuff show that the parent company were quite uneasy about the whole anonymous research in general.

It does seem like Aaron Barr is a bit of a fool and quite a nasty piece of work to boot. I noticed his talk was removed from B-Sides SF. He should (for HBGary's sake, if not his own) do the decent thing and fall on his sword.

<comment><USER4> "It's important to note that the sleazy stuff comes from HBGary Federal."

Some of these email "teasers" would indicate otherwise:

<http://anonleaks.ru/>

</comment></comment></comment><comment><USER5> Wow...

HBGary was a real piece of work it seems. Well, you become visible when you're sleazy _and_ stupid.

The thing about this stuff is it was proposed to a law firm that worked for B of A.

I assume that the way a major corporation would operate is to never directly deal with "gutter punks" like HBGary but rather to hire someone to hire someone to "do something, I don't want to know what". When HBGary folds, I again assume that another group can be hired by a different law firm that can be hired by B of A, who still won't know anything about it.

<comment><USER6> my experience working on gov contracts and many stories such as this causes me to believe this (being middle man / providing deniability, PR scapegoat) is the primary service (some) lawfirms offer. accounting aggencies too.

</comment></comment><comment><AUTHOR> What is interesting that are all these players discrediting and releasing each others documents: Wikileaks, Manning, HBGary, Anon. If you were to make a list of their fate from worst to best: Manning > Wikileaks > HBGary > Anon, it look like Anon very much come out on top of this pile.

</comment><comment><USER7> it didnt take me to an article, it took me to a flash ad for the economist.</comment>


Ask HN: Review my app: www.organizemysearch.com - <AUTHOR>

Hi HN,
I have been working on a personal project for some time called organizemysearch.com.
I came up with it because I got tired of having to manage used car searches while looking for a car. I'm the type of person who likes to do lots of research before buying something (eg. I spent about 2-3 months each weekend looking for my last car, seeing options and comparing. And it was worth it. I got a great deal).  But, while doing this research I end up saving tons of links from across different sites like craigslist.org, cars.com, autotrader.com and it gets messy after a while.
So I created organizemysearch.com to allow you to save and organize links whenever you are searching for an item (Eg. a used car, an apartment rental,etc). The critical feature is that it recognizes and parses out data for you if you paste in a link from one of the websites that it monitors.
Example: If you find a car ad on craigslist.org, cars.com or autotrader.com, the application will parse out all data like price, miles, make and model for you. You can then save each ad you find interesting from several websites, and have all the options you are considering in one place, so you can make a decision easier.
I also plan to add some other functionality in the future (if the site grows): - firefox extension so you can add links directly from the browser - checking if an ad you saved has been taken down already (eg not available anymore) - charts for comparing all the items/options you find in a visual way
I'm not very good at graphic design, so I don't expect any thumbs up, but I would really appreciate your honest feedback on the concept and functionality, and any other thoughts you may have to make it more useful (if you do find it useful that is :-) ).
You can log in with a test account: hn/hn <comment><USER2> Concept is good and I think it is definitely useful.

1) The interface should guide you through the process of creating a search and adding item. Maybe do that if they don't have any saved searches.

2) You should be able to add comments for each item

<comment><AUTHOR> thanks for the ideas. next version be to make it more user friendly.

by comments, do you mean a description for each field in a search? or a comment field for each item?

</comment></comment><comment><USER3> Is there a problem with sign-ups?

"An error occured while joining. The email you entered may have been registered already."

<comment><AUTHOR> looks like the email you entered was too long. try a shorter one if you can. i'll put in a fix now for larger fields for email addresses.

</comment></comment><comment><AUTHOR> clickable link: <http://www.organizemysearch.com></comment>


Google Play Protect dead last in Android security ranking - <AUTHOR> https://www.ghacks.net/2017/10/26/google-play-protect-dead-last-in-android-security-ranking/ <comment><USER2> This is nonsense. Google does not make such an app and would never as apps do not have the ability to protect from malware, nor should they as that would be giving them the permissions to actually become malware!</comment>


Ask HN: Need for openly available source-to-source compilation projects - <AUTHOR> Is there need for openly available, batteries included, source-to-source compilation projects?
I talk being able to transpile from one programming language source to another (java to rust, cobol to java and so on).
There is of course, option like ANTLR, though it leaves ground wide open after parsing.
IMHO having such tool can help renovate legacy codebases easier, minimize over focus on programming language decisioning in greenfield projects.
Yet, despite noticing organizations always burdened with managing old codebases, surprisingly there aren't such tools built out in the open. Why? Do I mis-judge the demand space as being strong? <comment><USER2> I don't think demand is particularly large: do you have examples of projects that used source-to-source compilation on a large scale (outside the web ecosystem, which is very much a special case). And I especially don't think they are good candidates for being open tools, especially if porting "forwards" to more modern languages, but much more likely to be inhouse tools of companies specializing in ports.

<comment><AUTHOR> > do you have examples of projects that used source-to-source compilation on a > large scale

That's the root of opening this question. In the companies, that I've been in, I have numerous cases where business was impaired by speed at which codebase could be renovated. Basically, a. business looks at engineering b. engineering shrugs (we got capacity, time constraints)

This is where, I believe, an openly available tool like above would make the difference.

I'd like to hear more on what you say at the tail end.

> And I especially don't think they are good candidates for being open tools > Why?

> especially if porting "forwards" to more modern languages Am curious. What, > in modern languages, makes it so?

> but much more likely to be inhouse tools of companies specializing in ports. > Why do you think it fits inhouse cases?

I can imagine an openly available option, commonly used by each inhouse team, to be more effective. You get community scale of development, This space doesn't really look very IP differentiating vis-à-vis business anyways.

<comment><USER2> Porting forwards is in my view typically done to move a project from A to B once. That can be a longer process due to complexity, but it's a phase that starts and ends and ideally is short. In contrast, compiling "backwards" is often done for a longer time for platform support -> compiling languages to run in the browser with JS, to run on platforms that only have a C compiler, to bootstrap a compiler toolchain off a C/C++ compiler.

<EDIT> Doing it fully automatically often has problems with the usability of the source code for further development. Automatically converted code will work, but typically not look like properly human-written code in the target language. Fixing that is additional difficulty or human work, so often semi- automated is actually better. </EDIT>

At the same time, building such tools requires different skillsets than typical application development or manual porting. If you are massive, or the type of company that has uses for this skillset elsewhere, it might still be viable to hire for those skills. But for many companies, they don't want to have this problem around long-term. They do not want to long-term maintain migration tooling, they're the happiest if the migration happens and they never need to think about anything related to it again. That's a poor motivation to maintain an open project. (they'd of course _love_ if _other people_ had done that and open-sourced their work)

On the other hand, specialized knowledge required on a per-project basis is pretty much the perfect scenario for consulting work. And a company that repeatedly does ports for customers has an interest in a) having deep knowledge about it b) automating the work where possible, even if automation is expensive up-front c) being paid for said investment in knowledge and not giving it away for free.

<comment><AUTHOR> > But for many companies, they don't want to have this problem around long- > term. They do not want to long-term maintain migration tooling, they're the > happiest if the migration happens and they never need to think about > anything related to it again.

Treating $(subject) tool to be equivalent of day 2 ops, does the trick.

What makes it viable to do it with a team of (say) 6 folks? Community driven core, adopted internally by this team.

So is it mostly about mindset change, or it just really doesn't have a place in org internal engineering team setups?</comment></comment></comment></comment>


Ask HN: What happens to startups with legitimate A players? - <AUTHOR>

I've worked at half a dozen companies over the course of a decade, and at each one there are 2-3 guys who are head and shoulders better than everyone else.  I'm wondering what would happen if you stuck 10 of these "A" players in the same room for 3 months?  And no, the ivory tower mouth breathers at google/amazon/apple don't count as "A" players. <comment><USER2> You get the same dippy dynamics as you do with any other randomly assembled group of people. 2 of them will utterly fail to perform for a reason that has nothing to with the startup, 5 of them won't perform because they're too busy being machiavellian to each other, the remaining three will get something done until one of the 4 budding Sun Tzu's stabs them in the back. If you're lucky the three guys who were doing the heavy lifting finish building the product before they become entirely disillusioned.

Not to be cynical, but few companies have succeeded with that strategy because monkey issues get in the way. People with amazing technical skills can get completely sidetracked by stupid political games.</comment>


The China GPS shift problem - <AUTHOR> https://en.wikipedia.org/wiki/Restrictions_on_geographic_data_in_China#The_China_GPS_shift_problem <comment><USER2> It also links to [https://en.wikipedia.org/wiki/Restrictions_on_geographic_dat...](https://en.wikipedia.org/wiki/Restrictions_on_geographic_data_in_China#Legislation) which says "private surveying and mapping activities have been illegal in mainland China since 2002."

So gathering data for crowdsourced maps like OpenStreetMap is illegal unless you get the Chinese government's permission.

I wonder why? And also, how they could possibly enforce it -- if you drive around with GPS logging turned on and don't tell anybody, how do they find out?

EDIT: According to [https://en.wikipedia.org/wiki/Restrictions_on_geographic_dat...](https://en.wikipedia.org/wiki/Restrictions_on_geographic_data_in_China#GCJ-02) it "uses an obfuscation algorithm which adds apparently random offsets to both the latitude and longitude, with the alleged goal of improving national security."

True, there are probably legitimate military reasons to keep accurate maps of your territory out of the hands of potential enemies. But surely any country thinking of attacking China with, say, GPS guided missiles / bombs would also be quite capable of getting an accurate map with satellite imagery, or for that matter, a few agents carrying ordinary smartphones with GPS logging turned on...

<comment><USER3> I doubt it has anything to do with foreign adversaries, and more to do with control of the internal population in some manner.

I tend to wonder how they'll get self-driving vehicles to work over there (hmm - I wonder if there are any Baidu papers on this issue available?)...

</comment></comment><comment><USER4> Good GPS receivers allowed changes to datums. Furthermore, there is a transformation possible between ellipsoids if you have their exact parameters.

Source: I worked at Trimble.

<comment><USER5> I agree. How is this different from all the other failures caused by false assumptions about map datums? (And why aren't those just another case of bad metadata, comparable to character encoding issues?)

Edit, read the rest of the article to put the linked section into context. The commies are trying to obfuscate a _map grid_? That's just nutty. Are they really going to arrest everyone who is found in possession of a magnetised needle?

</comment></comment><comment><USER6> For a great example of this look at the border between Hong Kong and Shenzhen on plain google maps ... turn on the street map layer, then the satellite layer - they match on the HKG side of the border, but not to the north in China

</comment><comment><USER7> This was an issue in earlier versions of Galileo Offline Maps.

[http://idea.galileo-app.com/?ia=20787](http://idea.galileo-app.com/?ia=20787)</comment>


OpenSSL Security Advisory - <AUTHOR> https://www.openssl.org/news/secadv/20160922.txt <comment><USER2> My first reaction: This _never_ ends, does it? Second reaction: Security is notoriously hard, nice that people are looking at the code and being thorough, it's for the collective best.

<comment><USER3> What never ends? Low severity memory safety bugs in a large C codebase? Probably not.

You may think this is a lot. It's not. This largely appears a lot because OpenSSL treats a lot of very low impact issues as vulnerabilities. A lot of other projecs would rather start arguing that this is not exploitable, should never get a CVE etc. This is a good sign. OpenSSL is taking security seriously by treating even low impact things as vulns. More severe stuff still happens, but I'm pretty positive there is a decline in severe issues.

<comment><USER4> Exactly. With C, it will effectively never end. Libraries like that would probably benefit most from using a language with strict static analysis, like Rust. Tools Of similar nature for C do exist, but probably they are harder to apply, and likely not free.

<comment><USER5> I hope I don't come across too harsh.

Is HN still really up for that argument? Yes, we know the downsides of C. But the upside is that _we know the downsides of C_.

Constantly complaining about C isn't going to get anyone anywhere. It's been shown over and over again that secure C coding is possible and doable and feasible and exists in the real world. Some of the most secure software is written in C, and that's not attributed to enough fingers banging at a keyboard over a C program, but because C forces the programmer that _wants_ to write a secure program think about all the issues, the universe and everything.

So please, pave the road and show us the safer OpenSSL-rust you have. Until then good luck and thank you for your feedback.

<comment><USER6> I've spent a career of 12 years writing, reviewing and breaking C in high- security products such as HSMs. I'm still to see real world, secure C. Maybe you could point me towards the numerous real world examples of people getting this right. I'd prefer scaled-up outcomes here, not just saying 'djb wrote qmail'.

(Incidentally, I don't have a quarrel with C specifically. All memory-unsafe languages expand the range of terrible vulnerabilities available to the engineer. This is not defensible these days, in my view.)

> So please, pave the road and show us the safer OpenSSL-rust you have.

My contribution here is [https://github.com/ctz/rustls](https://github.com/ctz/rustls)

<comment><USER7> I think OpenBSD beg to differ.

Not to mention I would argue memory exhaustion bugs like this happen in memory safe garbage collected languages frequently too.

<comment><USER8> There are edge cases for everything. A language is what it makes easy.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Luckily I moved everything to openbsd's libressl which is /mostly/ compatible.

I wonder if this bug affects them, typically the HIGH's haven't[0]

It really feels like every other week there is a bug in OpenSSL and after following along with the libressl blog I understand why- the code is an absolute mess[1]

[0] [http://undeadly.org/cgi?action=article&sid=20150319145126](http://undeadly.org/cgi?action=article&sid=20150319145126)

[1] [http://opensslrampage.org/page/49](http://opensslrampage.org/page/49)

<comment><USER10> The interesting thing about LibreSSL is that it's got such a halo around it that people just assume it's not vulnerable to any OpenSSL bugs.

Practically every OpenSSL bug posted here gets the standard "Luckily LibreSSL isn't affected by this kind of thing" response. On a couple of occasions I've taken the bait and linked to the LibreSSL source to show that the relevant bits are in fact not changed at all, so they were both vulnerable.

Not saying LibreSSL isn't doing good stuff, I just wish people would actually check if it's affected before using any opportunity to jump on the let's-hate- on-openssl bandwagon.

(I haven't looked into these bugs in the LibreSSL code since I don't have time for it right now, but I'm sure some message is forthcoming).

<comment><USER11> No one is claiming that LibreSSL has fixed all the OpenSSL bugs, the parent certainly didn't. LibreSSL has historically been vulnerable to _less_ of the bugs than OpenSSL and, for a long time, none of the sev:high bugs.

<comment><USER12> >none of the sev:high bugs.

Well it looks like that has just changed: [https://marc.info/?l=libressl&m=147454940615412&w=2](https://marc.info/?l=libressl&m=147454940615412&w=2)

</comment></comment></comment></comment><comment><USER13> OK, _now_ we can go ahead with FreeBSD 11.0-RELEASE.

In my time as security officer, it was a rare and surprising occurrence when we didn't need to hold an upcoming release due to a pending OpenSSL advisory. It got to the point of the release engineer saying "I think we're ready to start the release builds tomorrow, any news from OpenSSL" and me replying "nothing yet, but I'm sure it will come" \-- their timing was absolutely impeccable.

<comment><USER14> LibreSSL isn't up to speed yet? [http://www.libressl.org](http://www.libressl.org)

<comment><USER13> It certainly wasn't when I was Security Officer -- it didn't exist yet.

I believe some people are working on bringing libressl into the FreeBSD base system, but there are some challenges; for example, FreeBSD supports stable branches for 5 years, while libressl follows OpenBSD's "break everything once a year" model.

<comment><USER15> Could be biased, but I think we're more careful about bundling breaking changes in security patches though.

<comment><USER13> If you try at all, then you're trying harder than OpenSSL. But that doesn't necessarily help if there has been so much code churn over the past 5 years that we can't figure out how or if we should apply the security patch.

</comment></comment></comment></comment></comment><comment><USER16> if i understand correctly this one is relevant to certificate issuers that publish certificate revocation lists via the OCSP protocol; could be used for denial of service but not for hacking into the certificate issue, is that correct?

Also most bugs in OpenSSL seem to be during renegotiation of protocol zzzz defined by some obscure RFC that nobody really understands how to implement, is that correct? Why can't they simplify these protocols, do we really need these fancy renegotiation features?

Actually Daniel Bernstein says that over-complicating the protocols is a clever way to make sure that software infrastructure remains insecure.

[https://cr.yp.to/talks/2014.10.18/slides- djb-20141018-a4.pdf](https://cr.yp.to/talks/2014.10.18/slides- djb-20141018-a4.pdf)

<comment><USER17> Simplifying the protocol, making it easier to analyse (and prove) and especially removing legacy things we know are troublesome is the main goal of the draft TLS 1.3: now already live and rolled out across CloudFlare and Chrome, and which removes such things as renegotiation, all non-AEAD ciphersuites, MD5, SHA-1, static RSA, and many of the other classic TLS bugbears which keep bearing interesting vulnerabilities.

Which isn't to say the optional (but usefully fast) 0-RTT mode might not introduce a few more, for those lackadaisical devs who inevitably ignore all dire warnings and abuse it for non-idempotent requests like POSTs (or GETs that _do something_ \- bad idea!).

But even if it's not how I would have designed it afresh (the Noise Protocol Framework from Trevor Perrin is how I would have designed a new connection protocol now) it's still a big improvement over previous TLS/SSL iterations and a drastic enough change it probably deserves to be called TLS 2.0.

</comment></comment><comment><USER18> As far as I can tell, patched OpenSSL packages for affected Debian/Ubuntu releases are not yet available.

[https://security-tracker.debian.org/tracker/CVE-2016-6304](https://security- tracker.debian.org/tracker/CVE-2016-6304)

[https://people.canonical.com/~ubuntu- security/cve/2016/CVE-2...](https://people.canonical.com/~ubuntu- security/cve/2016/CVE-2016-6304.html)

<comment><USER19> You'll typically see these come through USN (Ubuntu Security Notices) as they're available.

[http://www.ubuntu.com/usn/](http://www.ubuntu.com/usn/)

</comment></comment><comment><USER20> The relevant commit (fix): [https://github.com/openssl/openssl/commit/e408c09bbf7c3057bd...](https://github.com/openssl/openssl/commit/e408c09bbf7c3057bda4b8d20bec1b3a7771c15b)

Edit: This is only the commit for the HIGH severity CVE-2016-6304.

<comment><USER21> That's just one of many commits related to today's advisory.

[https://security-tracker.debian.org/tracker/source- package/o...](https://security-tracker.debian.org/tracker/source- package/openssl) has a good overview of each issue with links to commits etc on each CVE entry.

<comment><USER22> I don't understand your link, it lists this issue under "Open Issues" – Does that mean the fix for Debian isn't published yet?

<comment><USER21> That's correct. Knowing Debian, there's probably an update coming in the next few hours.

</comment></comment></comment></comment><comment><USER23> Why is the severity of the first vulnerability high? It allows a denial of service on the server's side by a client and nothing else. The second vulnerability seems to be very similar in severity, except that it can be used both against clients and servers, and yet it is of just moderate severity. What am I missing?

<comment><USER24> Presumably because fewer applications use SSL_peek().

But yes, that issue is a serious problem, too.

</comment></comment><comment><USER25> Wonderful. Glad I recently added OCSP support to servers. Arg!

So does this affect TLSv1.2 only servers that do NOT support client renegotiation of any type?

<comment><USER26> This is the only claim that i've found saying that throttling (or disabling, for that matter) renegotiation would prevent the issue: [https://twitter.com/Unreal_IRCd/status/778975019829489664](https://twitter.com/Unreal_IRCd/status/778975019829489664)

The advisory makes it sound like that would be the case, but it would have been great if that was explicitly stated.

</comment></comment><comment><USER27> Does not appear that SSL Labs ([https://www.ssllabs.com/ssltest](https://www.ssllabs.com/ssltest)) tests for this exploit (CVE-2016-6304) yet. Anybody have instruction on how to test your server?

</comment><comment><USER28> >"Servers using OpenSSL versions prior to 1.0.1g are not vulnerable in a default configuration [..]"

In case anyone is using older versions, like we do in our production environment.

</comment><comment><USER29> >This issue was reported to OpenSSL by Shi Lei (Gear Team,Qihoo 360 Inc.)

A Chinese hacker

<comment><USER30> No. See [https://en.wikipedia.org/wiki/Qihoo_360](https://en.wikipedia.org/wiki/Qihoo_360)

A very popular chinese anti-virus company which fashions the US freemium model, with advertising on their homepage being the biggest revenue, and a market cap of $11.42B. Not a hacker.

</comment></comment><comment><USER31> If it does not have a home page and a catchy name like "Heartbleed", then this bug does not exist.

<comment><USER32> There's one in the advisory for CVE-2016-2183 - [https://sweet32.info](https://sweet32.info).

I'm trying to track these sites, mainly for my own amusement: [https://github.com/KeenRivals/Bugsite- Index](https://github.com/KeenRivals/Bugsite-Index)

<comment><USER33> Thanks to you, my new favourite is [http://backronym.fail](http://backronym.fail)</comment></comment></comment>


As We May Think (1945) - <AUTHOR> http://www.theatlantic.com/magazine/archive/1945/07/as-we-may-think/303881/?single_page=true <comment><USER2> [https://hn.algolia.com/?query=As%20We%20May%20Think%201945&s...](https://hn.algolia.com/?query=As%20We%20May%20Think%201945&sort=byDate&dateRange=all&type=story&storyText=false&prefix&page=0)

for previous submissions and commentary</comment>


Show HN: Complete Numpy-only 3D rendering pipeline - <AUTHOR> https://github.com/belzebalex/pyWireframeRenderer <comment><USER2> It doesn't do rasterization or culling in Numpy, so I wouldn't call it a complete rendering pipeline.

Cool proof of concept — But not particularly surprising that you can do matrix multiplications on points using a matrix library. Pyrr is another good library that is built specifically for this 3D use case.

<comment><AUTHOR> Yeah, that's just for teaching purpose. There's no way to lose yourself in the code as there's only a few lines for parsing the .obj file and everything else is the pipeline.

<comment><USER2> Nice! It is definitely a very easy way to understand the different matrices involved in 3D rendering.

</comment></comment></comment><comment><USER3> Cool stuff! I have something very similar built in JS [https://codepen.io/osmanmesutozcan/pen/wjNvvP](https://codepen.io/osmanmesutozcan/pen/wjNvvP)

<comment><AUTHOR> Yes and no: you're doing all the rendering in JS without any framework, that's true. But, you're not using a traditional "everything is a matrix multiplication" concept using homogenous coordinates. You're suming vectors coordinates instead of multiplying by a translation matrix.</comment></comment>