How the Syrian Electronic Army Hacked The Onion - <AUTHOR> http://theonion.github.io/blog/2013/05/08/how-the-syrian-electronic-army-hacked-the-onion/

<comment><USER3> Google requiring you to enter your password at random times for random things (e.g. to read a Google Groups message) seems like one contributing factor, since people treat those prompts as routine noise, and are less likely to investigate such a common occurrence too deeply.

<comment><USER4> I agree with this point. I retype my user information, even while logged in, at least a few times a week.

<comment><USER5> That's odd because I never do. I'm using two-factor and I only have to retype login information when that expires (approximately 30 days I believe.) Also, someone did phish my Google cookies and Google immediately shutdown my account and made me type in something from a text to reactivate my account. Overall I'm pretty happy with both of those circumstances.

<comment><USER3> Good point; I wonder how many people take that approach. I personally tend to log out of Gmail after I read my email, which signs me out of my Google Account fairly regularly. But maybe that's an unusual use pattern.

<comment><USER6> I always log out of my Gmail account when I am done reading my e-mail, as well. Until recently, when I've come across several people who stay logged in all the time, I thought that was the 'normal' use pattern. Then again, I'm old and "back in the day" you always logged out of an application/system when you were done.

</comment></comment></comment></comment></comment><comment><USER7> > "Please read the following article for its importance"

This immediately hit my brain's bayesian classifier like a ton of bricks. Or as the saying goes, "If spammers ever learn proper English, god help us all."

* the English _is_ actually proper, but the wording is unusual

<comment><USER8> It doesn't work for spear phishing, but for wide-ranging hits the broken english is often on purpose: <http://research.microsoft.com/pubs/167719/whyfromnigeria.pdf> :: [http://www.onthemedia.org/2012/aug/31/why-nigerian-email- sca...](http://www.onthemedia.org/2012/aug/31/why-nigerian-email-scams- work/transcript/)

tldr: you have a lower number of leads but a higher conversion rate from those that do respond.

<comment><USER9> I can see the logic here, but for something that's a one-and-done "click this link and type in your credentials," I honestly think good spelling would add to the legitimacy. So in The Onion's case I think it's just a matter of the attackers not being good at English; if they were, I feel their success would increase a bit.

</comment></comment></comment><comment><USER10> I often think about creating a browser and email plugin/extension to help with this:

\- Look at all link tags.

\- If it looks like a URL (has a scheme at the beginning, or something which resembles a hostname, or a bunch of path or query parameters), inspect the actual link.

\- If they have different hosts, warn the user, and perhaps give them the option of just visiting what the contents of the link tag say (rather than the href attribute).

\- Maybe do some magic with onclick events too.

I don't care that it wont be right 100% of the time. I don't care that some times I'll be warned when in fact it is perfectly fine. What I do care about is that when I click a link, I go to that link.

It would be quite helpful for attacks like this, but I'm also interested from a privacy perspective.

Google, Facebook and others go to great lengths so that when you mouse over a link, it looks like it will take you directly to the webpage it says it will, but actually redirects via themselves first. I often find myself copying a url from Facebook and pasting into the address bar, because I don't want them to know which articles I read (yes, I know, if I'm that paranoid, I probably shouldn't use Facebook, blah, blah).

<comment><USER11> My brain is a bit fried, but what about a rule that "if the text contained in the <a> tag is a FQDN, it should match the FQDN in the href exactly"?

What are the false positives?

<comment><USER12> Things like Google results that go through a redirector for click tracking.

<comment><USER13> So, another practice that should be highlighted and made to stop.

</comment></comment></comment></comment><comment><USER14> You can imagine the tech team at the Onion feeling a race against time before their editorial team managed to so infuriate the attackers that the situation got out of control.

<comment><AUTHOR> Accurate. On one hand, we didn't want to fuel the fire, but on the other, that inflammatory article forced the attacker to reveal their hand. So it was actually to our benefit, strangely enough.

</comment></comment><comment><USER15> Broadly speaking this is just what happened to us at The Guardian.

Our major takeaways have been a drive to 2FA-by-default for all users, and a move to managing social accounts through intermediaries like HootSuite.

</comment><comment><USER16> One more reason to use 2FA on your Google Apps account.

<comment><USER17> 2FA is great, but it wouldn't save you here if you ask it to remember you for 30 days.

<comment><USER16> It would have stopped someone from using a phished GApps credential from logging in to Google using it, though.

It sounds like one prong of the attack was to gain access to one employee's email, then use that account to send phishing emails to other employees. 2FA would have stopped that.

<comment><USER18> I wonder if it would be possible to phish 2factor while you're at it... Something like:

1- get target to enter google credentials

2- log into target's account using those credentials with a proxy/controlled IP that shows up nearby in geoip DBs

3- display a credible message, asking for 2factor code (something something DHCP something something more buzzwords - dummy mode on)

Any reason this wouldn't work?

</comment></comment></comment></comment><comment><USER19> This is almost verbatim to the spear phishing email that allowed the AP twitter account to be compromised.

[http://jimromenesko.com/2013/04/23/ap-warned-staffers- just-b...](http://jimromenesko.com/2013/04/23/ap-warned-staffers-just-before- ap-was-hacked/)

</comment><comment><USER20> An interesting story.

> The email addresses for your twitter accounts should be on a system that is > isolated from your organization's normal email. This will make your Twitter > accounts virtually invulnerable to phishing (providing that you're using > unique, strong passwords for every account).

That doesn't make a lot of sense. Sure, now your twitter account is somewhat protected against phishing (I think 'invulernable' is a bit too confident, even with 'virtually' added as qualifier).

But what about any other possible account? So now you say every single other possible account related to your business should be associated with an email address isolated from normal email, to protect them from phishing. Right?

Okay, so what makes is the 'normal email' again? You've just decided to split all your email amongst as many disparate systems as possible, to protect against phishing... which I guess it sort of does, but at cost of so much confusion that you've probably opened yourself up to something else.

Unless twitter alone is so high value to protect in this way?

Or am I missing something?

<comment><USER21> Our point there was this: the type of phishing that caught us was pretty casual, and aimed at users who weren't very technically sophisticated, and those users shouldn't have had access to our twitter accounts.

The proposed solution is certainly pretty drastic, but when it comes to securing twitter accounts, there aren't a lot of options. The safest one I can see is to connect the accounts to an email address that isn't part of our google apps organization, as that is the common attack vector here.

Our twitter accounts _are_ a high value resource, and are pretty hard to protect. We have almost 5 million followers, and two factor authentication isn't even an option. Once hackers change the email address on the account, we lose all access until we can get in touch with someone at Twitter (which takes a while, even for us).

<comment><USER22> There's a potential non-technical problem with that solution, though - <USER2> happens when the person who controls that email address leaves the company, especially if they leave on bad terms? I've had to deal with figuring out the mystery email that was connected to a corporate social media account, and it was a hellish bureaucratic nightmare to find the social media intern from three summers ago who had the password for the throwaway email. If it had been an email from our corporate domain, it would have been a lot easier to gain control of it again.

(What I would have given for a physical, printed list of social media accounts, associated emails, and passwords hidden in a file drawer somewhere.)

</comment></comment></comment><comment><USER23> Wait, did did The Onion actually get hacked? I just assumed that was a joke. Now I'm confused...

<comment><USER24> Notice that the Onion Tech Blog is an entirely new site with a single post. Presumably because if this was posted on theonion.com no one would've believed it.

<comment><USER23> That's wild. Yeah, I read both of the Syrian Electronic Army articles, but it never occurred to me they had actually been targeted. That makes a "SEA has some fun before their inevitable deaths" a bit cruel perhaps. Since that could very well happen.

</comment></comment></comment><comment><USER25> I assume the email was in HTML where the link's href was pointing to something different than what the text is. Couldn't gmail easily detect this discrepancy and warn the user that this is potentially a phishing attempt?

</comment><comment><USER26> I'm not sure what happened here:

> _... which asked for Google Apps credentials before redirecting to the Gmail > inbox._

followed by:

> _Coming from a trusted address, many staff members clicked the link, but > most refrained from entering their login credentials._

Does this mean "[asking] for Google Apps credentials" should be read as "put in their Google username and password", or should it be "gave the site OAuth access to their Google account"?

I'm a bit curious, because it _sounds_ like they set up a Google Apps app that sent phishing emails from the first-round-phished accounts to others in the company, so it looked more legit, but this second-round email was _not_ the same as the first. I haven't heard of that trick before, but it's clever, and probably hard to work around.

But if they actually entered their user/pass, there's an easy solution. USE A PASSWORD MANAGER. Kills phishing dead, since it won't auto-fill on the wrong domain.

</comment><comment><USER27> > The email addresses for your twitter accounts should be on a system that is > isolated from your organization's normal email. This will make your Twitter > accounts virtually invulnerable to phishing (providing that you're using > unique, strong passwords for every account).

This, of course, is an artefact of the well-known, old problem of your email being the single point of failure for your entire online identity.

Google might be able to do something to help here: Surely, they can detect with high reliability if a given email contains a password reset link, and trigger an extra challenge. I'm not sure what it should be, as obviously the account password isn't going to cut it. It could really just be a very short PIN-style code for opening "sensitive" email.

</comment><comment><USER28> I thought it would be something interesting given the title..nope just something you see in your email everyday .. Maybe the Onion's next move should be to invest with a Nigerian prince.

I will forward this post to my grandfather with "Don't let this happen to you" in bold.

/onion

<comment><USER19> When an email looks like it came from someone you know, and says something like:

"hey, check this out: <http://blah.com> "

and has their name at the bottom, it becomes very easy to make a mistake.

</comment></comment><comment><USER29> It's really cool to see The Onion hosting on github and using Octopress for blogging.

</comment><comment><USER30> Yet another reason to use a password plugin like 1Password or Keepass or whatever: because they memorize password-per-domain, they do not attempt to fill in a password when the domain is merely similar to a known domain.

</comment><comment><USER31> It's good to see that the Syrian regime has its priorities well thought through (assuming this has anything to do with Syria). First, hack the Onion. Then, fight off the rebels.

</comment><comment><USER32> I got several paragraphs into this writeup before I realized it wasn't just an Onion spoof of the once-a-day "anatomy of a hack" articles that come through here. :P

</comment><comment><USER33> The points in this blog post are good...but how about something more basic: __Never log in after clicking through an email link __

<comment><USER34> Why would you ever click on an e-mail link?

No wonder! I was wondering what the problem was, and it appears to be PEBKAC.

</comment></comment><comment><USER35> don't credit them and say this is a hack....it's just phishing.

</comment><comment><USER34> I think it is _hilarious_ that people still click on links in e-mails.

Just go to the website directly via a URL. Don't ever click on links in e-mails. Once you learn this, you're much safer.

<comment><USER36> People do what they're told. Or more accurately, they do the last thing they're told.

The IT department yells at them not to click any links in emails. But then, every legitimate web site also still routinely sends emails instructing their users to click links within.</comment></comment>


Australian traffic button pushes beautiful design - <AUTHOR> http://www.abc.net.au/science/articles/2016/02/09/4401055.htm <comment><USER2> There are some places in the Netherlands that have great pedestrian/bike traffic buttons.

\- They have distinct ticking sounds for: locating them (slow tick), when the button has been succesfully pressed (slightly faster tick), when you can walk (very fast tick) , when the traffic light will turn red soon (intermittent fast tick) so you know to hurry up and then back to the normal slow tick.

\- They have a ring of leds around the button that lights up when you've pressed it and then counts down by turning of the leds one by one to when the light is gonna turn green.

\- The ticking can be felt through the entire pole

\- Often there are two traffic lights on it. One big one above and a smaller one at eye-level.

Here's a button that shows the wait-indicator ring:

[https://upload.wikimedia.org/wikipedia/commons/thumb/9/95/Tr...](https://upload.wikimedia.org/wikipedia/commons/thumb/9/95/Traffic_light_switch_0823.JPG/220px- Traffic_light_switch_0823.JPG)

They're not available everywhere unfortunately.

<comment><USER3> I wrote a post a while back about how count down timers on pedestrian walkways can have unintended consequences.

[http://www.tragicdesign.com/blog/bad-design/tell-me-when- to-...](http://www.tragicdesign.com/blog/bad-design/tell-me-when-to-go-bad- ux.html)

Cars can spot them as they drive and try to run yellows more often.

<comment><USER4> > Cars can spot them as they drive and try to run yellows more often

They can also be used to avoid panic stops. I watch them and begin braking if the light will turn yellow before I enter the intersection. Safer an less stressful.

</comment></comment></comment><comment><USER5> When I see one of these I reminded of Jan Gehl saying they are for reminding people who walk that they must keep asking permission to cross the road (cartoons at [http://reviewanew.com/2014/11/17/the-cartoon-case-for- walkab...](http://reviewanew.com/2014/11/17/the-cartoon-case-for-walkability/) ). They might be attractive to some, but you soon tire of them. In the last five years the design has changed to remove the red light just above the button to acknowledge your request has been received, so now if it isn't working you'll never know. As Jan Gehl keeps saying to governments who invite him over here, you need to remove the buttons but that seems to fall on deaf ears. However we've been able to detect people who drive and even those on bicycles now with ease. Sigh.

<comment><USER6> _people who walk that they must keep asking permission to cross the road_

Driving and walking are wildly disparate modes of transportation, and having them coexist in adjacent physical space and intersect each other inevitably requires some set of rules describing who will have priority and when.

Many intersections in cities simply have a fixed repetitive cycle of granting priority to different modes in different directions each in turn automatically. Those which require explicit "requesting" of priority typically occur when traffic of a given mode or in a given direction is light enough, compared to other modes/directions, that the overall highest throughput occurs from explicit request. It's also not incredibly burdensome to use a button for this in the case of the pedestrian; detection mechanisms for motorized vehicles/bicycles on the road are there because a button would be unwieldy for those vehicles, not because designers of intersections want to force pedestrians into some type of ultra-lowest-class group. Indeed, the "high class" (in your view) automatic detection is often unreliable and leads to a far more conscious feeling of having to work to obtain priority, as vehicles shift forward and back hunting for the magic spot that will trigger the detector.

And honestly, the number of buttons which are non-functional but simply exist to provide a placebo feeling of speeding up an otherwise fixed pattern in which everyone gets priority in turn makes it kind of a silly argument anyway.

<comment><USER7> It makes sense to control pedestrian traffic in some intersections, but it just seems like they're not even trying to optimize pedestrian throughput. What makes the lack of feedback for crossing buttons worse is the fact that many of them are so conservative about letting you cross that you question if they are working. I encounter a lot that will refuse to let you cross if the light is already green, even if there is still plenty of time left. Unfortunately, lowering pedestrian accidents looks great, while saving pedestrian time is hard to measure.

<comment><USER8> I would much rather be safer than a few seconds faster.

<comment><USER9> What if you miss the train and have to wait 15-30 minutes longer because of a red light?

<comment><USER10> Then you shoukd have left 5 minutes earlier.

</comment></comment></comment></comment></comment></comment><comment><USER11> I prefer the beauty of the secret british pedestrian button.

Source: [http://www.bbc.co.uk/news/blogs- ouch-22706881](http://www.bbc.co.uk/news/blogs-ouch-22706881)

</comment><comment><USER12> I don't like the doubled arrow and the separate button.

In germany things are worse though: sometimes no feedback at all, feels like a hard cover plastic without any feedback at all. It seems to register touch ( _some_ do have a "please wait" lighting up when you touch it).

For the blind there is a nub hidden underneath. It has an embossed arrow on it and because of its horizontal orientation it can point precisely to the right direction. It vibrates when it's safe to cross. However this is the place that stays wet the longest after rain and where people smear their chewing gum and the cleaning personal doesn't even see it. I still enjoy the buttons, so I don'\- have to focus on the lights all the time.

edit: when you don't know about the nub for the blind, there is no arrow indication at all. When standing on an isle in the middle of a street and there are two buttons on one pole opposed to each other, I never knew which to press: the one facing where I want to go, or the one facing me while I face where I want to go (I think it's the latter)

<comment><USER13> Yea the German ones were weird. My ex (who is legally blind) would use the blind button, but wasn't sure if it actually did anything. They have no feed back of visual indicators otherwise.

I really like the New Zealand ones. They're like the Australian ones, but the red guy on the other side only lights up after it's been pressed (instead of the little red dot that's on the button for the Australian ones).

Also there were a few Australian ones that switched to the non-button feed back. OMG they sounded awful. There were like two where I lived. I think they were an experiment that failed and were forgotten about.

<comment><USER12> I also still don't know (living here all my life). It moves in quite a bit though...

</comment></comment></comment><comment><USER14> These things are so much more satisfying to mash than their American counterparts -- often, a tiny little nubbin that's very hard to push (and may become completely frozen in winter, meaning you are thoroughly hosed).

Deployment of alternative switches (a convex masher, a touch-sensitive dingus which vibrates slightly when it detects your press) has been uneven at best here.

<comment><USER15> To be fair, not _all_ American models are like that. In fact, a decent portion of the buttons in my town are very similar to the one described in the article.

But, then again, I live on a college campus which has higher standards for accessibility than most areas in the US.

<comment><USER14> Hence my comment about mixed deployment of alternative switches.

</comment></comment></comment><comment><USER16> I love the big chunky button on these things, but I have a few implementation niggles that someone might be able to shed light on.

My main gripe is that the buttons aren't symmetrical with their partner button pairs on the other side of the traffic flow. If I'm approaching the junction and there's someone on the other side of the traffic waiting to cross already, the green man on my side should also activate when the lights change. Means I end up having to do this jaunty quick-step fencing lunge to stab at the button if I see the lights changing, which I usually just miss out on then have to wait to cross.

<comment><USER17> Or the annoying behaviour that there's no 'automatic mode' in peak hour, where there's a whole bunch of pedestrians waiting to cross on both sides every phase and everyone else assumes someone else has pushed the button, then the lights change and there's no green man...

<comment><USER18> Why do you need a green man to cross when you have a green traffic light?

<comment><USER19> Different places have different practices and different legislation. In some places, walking at a red light is forbidden and there could even be a fine. In some others, your red man indicates that even if there is a green light for some vehicles (going straight ahead), there might also be a green arrow light that tells turning vehicles have right of way. The green man tells you that you can go.

<comment><USER18> It's easy enough to see if there's a green arrow. Is that the actual problem? Or is every other signal identical to the situation where you're supposed to cross, except for the one on the crosswalk itself?

<comment><USER20> Because of shades surrounding the traffic lights (to prevent glare from the sun) it is often impossible for pedestrians to see if a turn signal is lit from their perpendicular position.

So in the event of a red light for through traffic but a green light for turning traffic you don't want pedestrians crossing the road. That's why it is important to have separate lights indicating when a pedestrian may cross.

<comment><USER19> Right - and even without any shades, there are places where I can't see at all the light that permits vehicles to cross my path.

For instance, if I'm crossing the road here [https://goo.gl/maps/favpGxyKTLk](https://goo.gl/maps/favpGxyKTLk) (this is on my daily cycle commute)

there is no way for me to know when there is a green arrow light for vehicles that come from opposite direction and turn left (and therefore come my way).

The buttons requesting green man for pedestrians and cyclists is, btw, known here as "humiliation button" (because it forces cyclists to stop; there is automatic detection for motor vehicles on the driveway, but for pedestrians and cyclists they haven't found a reliable way to do it).

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> These are the standard crosswalk buttons in Sweden. [http://www.prismatibro.se/en/prisma- daps-2000-eng/](http://www.prismatibro.se/en/prisma-daps-2000-eng/)

The whole front is push sensitive, the lights are circular so they can be seen from the sides as well, and the side has a relief map of the crosswalk for the blind.

I didn't realize even these things have NFC in them these days

<comment><USER19> We have those in Finland as well, and I hate the lack of feedback when touching it. The sound seems to be faulty or disabled in many of them. If the light happens to be broken, there is no telling whether it registers anything. I end up banging it and then kicking it just in case a harder push is needed.

</comment></comment><comment><USER22> So many complaints about placebo-or-not buttons in comments. Feels like from countries that have no such dead simple thing as digital countdowns on traffic lights. You see infinity or --, you push the button.

Google: traffic light countdown timer.

</comment><comment><USER23> These buttons are horrible from a UX perspective. The old design had a light that would activate after you pressed to acknowledge your request. Many of these new ones don't, so pedestrians will stand there mashing over and over as there's no feedback.

Not to mention the smaller metal lozenge at the top which looks like a button but does nothing, so people press both surfaces in confusion.

Oh and people are so Pavlovian trained to start walking at the "cross" sound that when you have these buttons side by side at an intersection people will literally start walking into traffic when the adjacent button triggers.

The design is pants on head idiotic.

<comment><USER24> >Not to mention the smaller metal lozenge at the top which looks like a button but does nothing, so people press both surfaces in confusion.

If you'd ever touched one of these (or read the article properly), you'd know it provides a tactile mirror to the sound the button is playing, telling deaf people when to cross.

If I'm listening to music I often stick my thumb over it even though I'm not deaf, so I don't have to keep looking at the light to see when I can cross. The top of the button case is just the right size to rest your palm on it and allow your thumb to drop down and rest on the popper plate.

<comment><USER25> If you need to rest your hand on it or read an article, to understand how it works, that's a major fail in the design.

<comment><USER26> If it's designed for blind people, I don't think visually signaling its function is necessarily a great option (though to be fair, it would at least allow sighted people to point out the device to their blind friends).

<comment><USER25> Over 90% of people are not blind. Why deprive them of extra information they are able to use? And even if we wanted, reducing everyone to blind person's abilities won't work: If there are 5 people waiting for the same traffic light they can't all hold their finger on the button at the same time.

<comment><USER26> Sighted people can see the (much more convenient) lighted sign that says "cross/don't cross". A tactile device is unnecessary for those people, and it doesn't really matter if they know that it exists or what it is for. As such, I would say the biggest design priority with respect to the sighted majority would be to make sure it's not actively confusing (i.e. it won't be mistaken for the cross button), and visual cues as to its purpose would be above and beyond.

</comment></comment></comment></comment></comment></comment><comment><USER27> The same are used in Ireland. Does anyone know why they choose to use these, as opposed to the same as the UK?

[http://todayilearned.co.uk/wp- content/uploads/2011/07/crossi...](http://todayilearned.co.uk/wp- content/uploads/2011/07/crossing-push-button.jpg)

These not only give feedback when the button is pressed, but also have a tactile spinner on the bottom for blind people (most, but not all, pedestrian crossings in the UK beep when you can cross however).

<comment><USER28> There's tactile feedback for the blind on these buttons. I'm not sure I'd class the button you linked as particularly good - most people know what to look for with traffic crossing buttons, and duplicating the lesson on every (quite small) button seems a bit pointless... and useless if you don't read English (eg tourists etc). It's overall too complex for a simple function. Using a white light for 'WAIT' is also a wasted opportunity (should be a regular 'warning' colour instead).

I don't really use either mechanism, but I would _guess_ that the ticker in the linked article (the metal bit in the middle of the arrow gives a strong click) would be preferable to touching something _underneath_ a city-dwelling box, where muck, gunk, and whatever accumulates. That's an edge-case complaint, though.

Another thing to consider with these kinds of things is reliability, maintenance, and cost. May not interest the UX people, but will definitely interest the local councils...

<comment><USER29> The newer ones look like this - the indicator with the red or green man is usually positioned so that you will be looking at oncoming traffic -

[https://www.google.co.uk/imgres?imgurl=http%3A%2F%2Fi.telegr...](https://www.google.co.uk/imgres?imgurl=http%3A%2F%2Fi.telegraph.co.uk%2Fmultimedia%2Farchive%2F02209%2Fcrossing_2209318b.jpg&imgrefurl=http%3A%2F%2Fwww.telegraph.co.uk%2Fnews%2Fuknews%2Froad- and-rail-transport%2F9241663%2FNew-inquiry-into-Puffin-pedestrian-crossings- amid-safety- fears.html&docid=J31kEmkjr52E0M&tbnid=9kbk4fPZsTpRRM%3A&w=620&h=387&client=ubuntu&bih=659&biw=1376&ved=0ahUKEwifkdm79YTPAhUIL8AKHU4YB_4QMwgfKAEwAQ&iact=mrc&uact=8)

</comment></comment></comment><comment><USER30> As an Australian, whenever I travel overseas I get subtly confused by the lack of audible and touch feedback on pedestrian buttons in many places. I'm _not_ disabled and I still find the aural and tactile elements of an Australian pedestrian button to be a key part of my road crossing experience :)

<comment><USER31> When I visit Australia I am always charmed by the iconic crosswalk sound. There are a couple of crosswalks in Manhattan that have this sound and PB5. They're around 23rd st & Broadway next to Madison Square Park apparently due to a school for the blind nearby.

</comment></comment><comment><USER32> Do these buttons really work? Like, all the time? At some street crossings here in Berlin I get the impression that they're just some placebo to limit your impatience and make you less prone to cross with a red light.

That's probably because the buttons here don't have any tactile feedback. They're touch sensitive and won't make any clic and the light is just a rare occurrence you might find in some of them (and it's completely invisible during the day, if it's there). You really feel like you don't have any way to know if they're even connected to the streetlight system.

Every time I touch them I always try to see whether they're making the light turn green faster and I never ever have that feeling. One should probably approach the thing more scientifically in order to have some sort of closure about them.

<comment><USER33> "In some Australian cities, in the central business district, the traffic light push buttons don't work at certain times — for example, 7 am to 7 pm, Monday to Wednesday, and 7 am to 9 pm, Thursday to Saturday.

The rationale is that between these busy hours, the road traffic is relatively constant, and also, the pedestrian crossings are in continuous use. So the lights do their own thing.

However, the traffic light push buttons do work outside these hours, including all day Sunday."

<comment><USER34> ... which is kind of annoying if you sleep on top of one. Endless tocking away on a hot summer night where you can't sleep is kind of like water drip torture.

</comment></comment></comment><comment><USER35> Rather than a "beautiful" button, I'd rather have no buttons and no need to press anything.

</comment><comment><USER36> Around here they look like this[1]. They have about the same sound as the Australian. The entire thing vibrates with the sound.

The blue area on the front is the button (not just the small circle). When pushed the light lights up[2]. On top is a tactile arrow pointing in the direction to walk. On the side is a tactile map showing how the intersection looks (starting from the bottom, at the small arrow): Blocks are lanes/cars, the almost-ellipse is a traffic island and horizontal bars are the sidewalk.

[1] [https://cdn1.cdnme.se/cdn/6-2/770231/images/2011/trafikljus_...](https://cdn1.cdnme.se/cdn/6-2/770231/images/2011/trafikljus_175212100.jpg)

[2] But people are happy to push the button again anyway.

<comment><USER37> Wow, that is confusing.

<comment><USER38> I agree. I thought the yellow light at the bottom is the button, because it's the only button-like object in the picture (and I've plenty of experience with buttons that light up when pushed.) The "blue area" does not look like a button at all, but only a sign to me. If I encountered one of these I'd probably keep trying to press the light...

</comment></comment></comment><comment><USER39> Looking for more info on the sound I found this and had to laugh:

[https://youtu.be/8UxT_UI4_6g?t=133](https://youtu.be/8UxT_UI4_6g?t=133)

</comment><comment><USER40> >In some Australian cities, in the central business district, the traffic light push buttons don't work at certain times — for example, 7 am to 7 pm, Monday to Wednesday, and 7 am to 9 pm, Thursday to Saturday.

>The rationale is that between these busy hours, the road traffic is relatively constant, and also, the pedestrian crossings are in continuous use.

That strikes me as a bit stupid. The slight increase in capacity is really only needed at peak times. They could just do away with the buttons entirely.

<comment><USER41> The traffic lights are optimised for throughput during peak times and optimised for travel time during non-peak times.

Throughput optimisation has the lights cycling at a constant rate, 60 seconds in one direction, 60 seconds in the next direction and so on. It's easy to tack the pedestrian cycle on to that (pedestrians walk in parallel with the traffic, though I've also seen lights which give the pedestrians their own cycle, and pedestrians can also walk diagonally across the intersection). The cycle might also be synchronized with other lights.

The Travel time optimisation for off-peak is completely different. Lights are always stuck onto a single direction (the direction with the most traffic). When a car triggers the sensor in the perpendicular direction, the traffic light quickly cycles and gives them a green light within 10 seconds. The green light only lasts about 5 seconds, barely enough time for a second car to get through the light. It's impossible to get a third though. But in typical night time traffic, this mode makes the traffic light only slightly slower than a stop sign.

Even if a pedestrian did arrive at the traffic light at the same time as a car, there is nowhere near enough time for the pedestrian to get across the road. You can't even run across the road in the allocated time.

The button is needed for two reasons. 1) to signal that a pedestrian is waiting. 2) to request the longer cycle that has enough time for a pedestrian to walk across the road.

<comment><USER38> _Lights are always stuck onto a single direction (the direction with the most traffic). When a car triggers the sensor in the perpendicular direction, the traffic light quickly cycles and gives them a green light within 10 seconds. The green light only lasts about 5 seconds, barely enough time for a second car to get through the light. It 's impossible to get a third though._

Wouldn't it be better for the light to stay at the last direction a car traveled through? In my experience, traffic tends to be quite "bursty" (although that could be because of upstream lights causing that) so it seems a slightly different strategy could work better: as long as there are no cars in the other direction, the light stays green. If there are, the light will change immediately if the current direction has no cars; otherwise a timer is started and forces the direction to change when it expires. This seems to incorporate both optimisations you describe.

<comment><USER41> I live on a residential street with this style of traffic light along it.

I suspect the cycles have been designed this way to also minimise the amount of noise. One or two cars every 30 seconds is less distracting than 5 cars in a row followed by 3min of silence.

</comment></comment></comment></comment><comment><USER42> There's a light on a main road near my house that has a one minute cycle. It only changes for cross traffic if someone trips it, but still does a 15 sec countdown on the crosswalk every time.

I've lost count of the cars that speed up to beat the countdown timer.

It is useful for my 5 AM commute though, when there's not a soul around, and I have to turn left. If I come to it and the timer hasn't started I'll do a right-on-red and then u-turn on the main road.

</comment><comment><USER43> The new countdown crossings in Martin Place are brutal. If it hits zero you'd better be across or you're roadkill.

</comment><comment><USER44> My main love for these buttons is the fact that I can trigger them with my elbow or hip whenever my hands a full with shopping bags etc. I like the mushy way they depress then seemingly inflate back into place...

</comment><comment><AUTHOR> See also:

[https://theconversation.com/sublime-design-the- pb-5-pedestri...](https://theconversation.com/sublime-design-the- pb-5-pedestrian-button-26232)

</comment><comment><USER45> What's the difference between the arrow button and the concave button?

</comment><comment><USER46> Vechicals don't need to push a button to cross an intersection, why do walkers need to push a button to cross an intersection?

<comment><USER47> It's often better for pedestrians when there's a button. Because the light usually changes pretty quickly after pressing the button. Otherwise you'd have to wait until the timer switches the lights.

It's usually used for pedestrian crossings where pedestrians are rather rare.

<comment><USER46> Placebo Walk Buttons: [https://en.m.wikipedia.org/wiki/Placebo_button#Walk_buttons](https://en.m.wikipedia.org/wiki/Placebo_button#Walk_buttons)

(My point is that just like for cars, there should be sensors for walkers, not buttons.)

<comment><USER47> Sometimes people stand at intersections and just chat and don't want to cross. And in Germany and Hungary where I used such buttons, they are definitely not placebo, because the switch comes quickly and when you forget to press it it does not switch.

</comment></comment></comment></comment><comment><USER48> we've lost the meaning of the word when we describe this banal traffic button as "beautiful". In my opinion, if anything, the photo, and indeed the entire article web page, is quite ugly.</comment>


Ask HN: What's the longest Unix uptime you've ever seen? - <AUTHOR>

A friend of mine shared this one recently:
17:06:59 up 1739 days, 23:38, 1 user, load average: 0.00, 0.00, 0.00
(A gentoo fileserver, 2.6.17 x86_64 kernel.)
I'm curious now what the all time record is, but haven't found a definitive answer.
What's the longest you've personally seen, or that you have access to right now? Details about the OS and what the machine is used for would also be interesting. <comment><USER3>
      $ uname -s
      OpenBSD

      $ uptime
      3:37PM  up 2597 days, 20:57, 1 user, load averages: 0.12, 0.13, 0.09

Though, uptime is only a measure of how long it's been since you last patched/did kernel upgrades.

This box is off most of the network and being left alone just to see how long it lasts before it totally dies ;)

<comment><USER4> Yeah... the OP friend's 2.6.17 box is afflicted with multiple published and weaponized vulnerabilities. :(

Here is an example, with both code and a detailed explanation (I found this much better than a CVE).

<http://www.win.tue.nl/~aeb/linux/hh/hh-12.html#ss12.4>

</comment></comment><comment><USER5> Not UNIX but VMS. At an old job, we had a central VAX server running VMS. It had an uptime of almost 6 years. I was there when they had to reboot it and it was this big major event.

The sysadmin, who had been hired long before me, started after the last time it was rebooted, so he was visibly sweating. Everything came right back up.

</comment><comment><USER6> You might have an interest in "The Uptime Project": <http://www.uptimeprj.com/>

The similarly-named "Uptimes Project" seems to have expired, leaving only its dried corpse on the web.

<comment><AUTHOR> Thanks! I knew there had to be something like this out there.

> The similarly-named "Uptimes Project" seems to have expired...

The irony.

</comment></comment><comment><USER7> This would be hard to prove on _really_ old Linux boxes since uptime rolled over after (just shy of) 500 days.

</comment><comment><USER8> I used to run a thinkpad t41 as an in house server running dhcp, dns, that sort of thing. After a while, the uptime became oddly important to me, and I once managed to move house ~60 miles without losing the uptime.

It died at around 1050 days, RIP.

<comment><USER9> Holy! I STILL use this exact thing at home. My T41 handles DNS, DHCP, and print services. I just moved and it's still going strong... I never though to check the uptime before I left the old house, but it had the potential of 5+ years as we have had no major power outages.

</comment></comment><comment><USER10> web10 ~> uptime 2:33pm up 1924 days 13:36, 1 user, load average: 0.39, 0.27, 0.16

web10 ~> cat /etc/issue

Welcome to SuSE Linux 9.3 (x86-64) - <USER2>

</comment><comment><USER11> > What's the longest you've personally seen

there's a script for that

        /usr/bin/uptime | perl -ne "/(\d+) d/;print 8,q(=)x\$1,\"D\n\""

<comment><USER12> Oh that's cute :P</comment></comment>


Microsoft Design - <AUTHOR> http://www.microsoft.com/en-us/design/ <comment><USER2> When I see Microsoft Design, I think of metro, years ago, the ui become flat- ize,Microsoft introduce metro, a big advance, but material design it's a big win.</comment>


Twitter Hires New VP of Diversity and Inclusion from Apple - <AUTHOR> http://techcrunch.com/2015/12/28/twitter-hires-new-vp-of-diversity-and-inclu-from-apple/ <comment><USER2> Is this really a VP level position?</comment>


China Mobile running 400k unlocked iPhones - <AUTHOR> http://www.news.com/8301-13579_3-9873327-37.html?tag=nefd.top <comment><USER2> I find this interesting, I wonder how they got that many phones into China where they are not even supposed to be selling...

<comment><USER3> FedEx?

<comment><USER2> I figured more that since they make them there maybe they made a "few extra" but sure FedEx might be the real reason why so many phones are there.

<comment><USER3> Yeah, that also makes sense...

It was just so easy and profitable for individuals and small time vendors to ship them overseas that I figured it happened on a small scale over and over and over again. Banning cash purchases of the iPhone didn't do much.</comment></comment></comment></comment>


Subliminal Messaging Experiment on Al Sharpton's Brother - <AUTHOR> http://ninetythreeeighteen.com/operation-save-the-kennys/ <comment><USER2> could you share the photo of the altered pine trees please</comment>


Facebook Adds A.I. Labs in Seattle and Pittsburgh, Pressuring Local Universities - <AUTHOR> https://www.nytimes.com/2018/05/04/technology/facebook-artificial-intelligence-researchers.html <comment><USER2> Previous discussion

[https://news.ycombinator.com/item?id=17003244](https://news.ycombinator.com/item?id=17003244)

<comment><AUTHOR> Mobile website strikes again :-(

</comment></comment><comment><USER3> University that want to retain computer science professors, especially those working in hot fields such as artificial intelligence and machine learning, will have to pay them well. The main problem may be political -- can they pay professors in different departments very different amounts?

One reason it is difficult to attact high school teachers who can teach computer programming well is that teachers' union contracts say that you have to pay gym teachers and CS teachers the same amount.

<comment><USER4> > can they pay professors in different departments very different amounts

In the US this is already common. But salaries in AI (and to a lesser extent CS in general) have recently gotten high enough that you'd need much bigger differentials, plus you start getting to absolute salary numbers that become unaffordable to all but a handful of places. An early-career academic at a top university might make, say, $60-80k in the humanities versus $100-130k in CS, but companies will pay $150k+. A prominent tenured professor in CS can make $200k+ in some cases in recent years, but if you believe recent reports [1], senior AI researchers are being paid $1m+ outside of academia, which seems really unlikely to be matched.

I'm not sure it's necessarily a _problem_ per se, though. Depends on what your goals are. As a fairly junior CS academic, it's good for _me_ personally. CS faculty jobs are now much easier to come by than is usually the case in academia (look at the nightmare stories of physicists and biologists doing 10-year postdocs trying to land a tenure-track position). And pay has risen enough that it's now pretty good, even if still not as good as industry.

[1] [https://www.nytimes.com/2018/04/19/technology/artificial- int...](https://www.nytimes.com/2018/04/19/technology/artificial-intelligence- salaries-openai.html)

<comment><USER5> Professors taking sabbaticals to work at private companies seems to be a common pattern as well—and probably a generally good one for everyone involved.

</comment></comment></comment><comment><USER6> This wave of hate starts looking funny already. Facebook pays researchers decent salaries? Let's say it "pressures local universities".

<comment><USER7> OTOH, having many of our most brilliant minds all working on putting more ads in front of more eyes to get more clicks isn't such a great thing.

<comment><USER8> hmm, they will develop more intelligent systems which will have applications in all domains.

<comment><USER9> Scenario: a well-placed middle manager has a mid-life crisis and authorizes a skunkworks project to have an AI surreptitiously replace them while they travel the world. When other managers discover this, they demand their own AI surrogates rather than reporting the scheme to the C-suite. When this is eventually exposed, FB collapses in a firestorm of controversy, only for its investors to quietly start a bunch of new companies intentionally based on AI management. Eventually _Accelerando_ , I guess.

</comment></comment></comment></comment><comment> Al-Khwarizmi To be brutally honest, I must confess that as a European in a peripheral university, also working in an AI subfield, I feel a bit of glee about this.

Those elite American universities have been sucking talent away from all over the world, and working with an amount of resources that provide them with a considerable advantage.

Now they receive some taste of their own medicine.

Note: I'm aware that there is nothing bad in what those universities have done (probably every university would do the same if they could or knew how) and I shouldn't feel like that! But I'm just human, and unfortunately far from being a perfect human... and being beaten to results by people that have 3x as many PhD students and 10x as much GPU power ends up creating bitter feelings.

<comment><USER10> This is just going to make it more competitive for everyone. Even more European professors will be hired away for even more money.

Note: I am not saying it's better or worse, just (much) more competitive.

</comment></comment><comment><USER11> In my opinion, shame on any professor who joins an organization which has shown such disregard for their users without at least demanding reform.

<comment><USER12> I agree!

I just can't tell whether you're referring to universities or to tech.

<comment><USER8> He is clearly referring to the guys charging 50k / year to 19 years old.

<comment><USER13> *19s year old

</comment></comment></comment></comment><comment><USER14> Surely lecturers will just keep one foot in each world? Back before '08 when finance gurus were killing it, many of them kept ties with academia. It's a useful insurance policy, and it's great to be able to fall back to teaching or research once you've had enough of industry.

</comment><comment><USER15> I love that even the new york times is apparently incapable of introducing a cookiebar that conforms to the actual law they're trying to conform to. It's not especially complicated to not give me cookies unless I say I'm OK with receiving them, instead they've gone with the "implied consent" option (again) that is pretty explicitly not consent anymore.</comment>


Kingshard--A High-Performance Proxy for MySQL Powered by Golang - <AUTHOR> https://github.com/flike/kingshard

<comment><AUTHOR> Overview kingshard is a high-performance proxy for MySQL powered by Go. Just like other mysql proxies, you can use it to split the read/write sqls. Now it supports basic SQL statements (select, insert, update, replace, delete). The most important feature is the sharding function. Kingshard aims to simplify the sharding solution of MySQL.

Feature

splits reads and writes

sharding table across multiple nodes

client's ip ACL control.

transaction in single node.

supports prepared statement: COM_STMT_PREPARE, COM_STMT_EXECUTE, etc.

MySQL HA</comment>


Arxiv.org is down - <AUTHOR> https://arxiv.org/ <comment><USER2> Problem with Cornell service outage:

> Cornell is experiencing an unplanned service outage that is currently > affecting arXiv.

[https://twitter.com/arxiv/status/978393984304340992](https://twitter.com/arxiv/status/978393984304340992)</comment>


AMD ships 16-core Bulldozer Interlagos Opterons destined for Cray XE6 - <AUTHOR> http://www.geek.com/articles/chips/amd-starts-shipping-16-core-bulldozer-interlagos-opteron-server-chips-2011097/

<comment><USER2> Sweet! I hope they don't get bulldozed by Intel's aggressive (some might say 'predatory', but not me, no, not at all) pricing. I've been in a project where management decided to ditch AMD, do a hardware respin and linux driver re- writes due to last minute vendor shenanigans :-(</comment>


Cello – A library that brings higher level programming to C - <AUTHOR> http://libcello.org/ <comment><USER3> Looking at the code, a great deal of this is non-portable and/or U.B, so I would hesitate to call it C. And I'm not talking about some hypothetical problems, but stuff that should surface quite soon. For example, this is how stack allocations are made:

        #define alloc_stack(T) ((struct T*)header_init( \
          (char[sizeof(struct Header) + sizeof(struct T)]){0}, T, AllocStack))

So far as I can see, there are basically no alignment guarantees here - <USER2> returned pointer to the char array is not guaranteed to be aligned properly for Header (which is a struct of a single void* field), nor is there any attempt to align T inside the array. If things get misaligned, on x86 and x64, it'll work (but possibly much slower than normal), but on e.g. ARM you'll get all kinds of weird things happening.

<comment><USER4> Apparently ARM allows unaligned loads now (permitted in ARMv6, default in ARMv7). There seem to be some instructions that don't support it, like STM. Also, afaik code needs to be aligned properly, and function pointers need to be aligned properly lest you will switch between arm and thumb mode. Apparently you can tell the ARM compiler to assume all memory accesses are unaligned.

Under ARMv8, I think alignment is less of an issue.

[http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc....](http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.faqs/ka15414.html)

</comment></comment><comment><USER5> Cello seems to make its way to HN quite often. The author (also of buildyourownlisp.com fame) has previously posted his motivations for building libcello on HN: [https://news.ycombinator.com/item?id=8800575](https://news.ycombinator.com/item?id=8800575)

Another previous discussion: [https://news.ycombinator.com/item?id=6047576](https://news.ycombinator.com/item?id=6047576)

</comment><comment><USER6> > Can it be used in Production?

> It might be better to try Cello out on a hobby project first. Cello does aim > to be production ready, but because it is a hack it has its fair share of > oddities and pitfalls, and if you are working in a team, or to a deadline, > there is much better tooling, support and community for languages such as > C++.

Wow. Straight talk instead of salesmanship. High marks for that.

</comment><comment><USER7> As a superstitious C programmer, typedefing (void star) feels like walking on the cracks in the pavement, crossing the path of a black cat, walking under a ladder, or squeezing a lemon under the full moon to me. These kinds of tricks seem very clever at first but there always comes a point when they start to break down. I'd be leery about using union in 2017, but typedefing (void star) is like putting on your underpants outside your trousers, thinking you're superman and jumping out of a window thinking that you can fly.

<comment><USER8> I'm not super familiar with Cello (and I'm not sure I get the point of it overall, are there that many platforms left that you can target from C but not C++?) but in its defense it does seem to implement fat pointers and runtime checks to have a degree of type safety. Not sure how thorough it is but it's not just decaying everything to void pointers behind the scenes.

It's a pretty clever hack though, like using setjmp for exception handling. I'm pretty sure I'd never want to use that in production anywhere but it was probably fun to implement.

<comment><USER9> Do you use Python in production? It uses setjmp for its exception handling.

</comment></comment></comment><comment><USER10> The style reminds me of some J implementations!

       #define DO(n,x) {I i=0,_n=(n);for(;i<_n;++i){x;}}

[http://code.jsoftware.com/wiki/Essays/Incunabulum](http://code.jsoftware.com/wiki/Essays/Incunabulum)

<comment><USER11> I think Arthur Whitney's (in)famous code makes its way to HN about once a year.

<comment><USER12> #A=As #I=it #S=sh #o=o #u=uld

A I Sou

</comment></comment></comment><comment><USER13> Cool. This is a bit extreme but on purpose I think, it is an exploratory project AFAIK. If I had my hands free I would spend my time writing a new C library since I firmly believe that the problems of C are, for the larger part, in its standard library and not in the language itself. C memory model is unsafe but if mediated by a sane library for strings, and if by default you have most of the things where bugs are put (data structures, facilities for parsing, ...) things get a lot simpler and safer.

</comment><comment><USER14> What features make it "higher level"? It looks like syntactic sugar on C code without any real improvements (aside from GC).

<comment><USER15> I've used Cello for a few side projects, and it doesn't even really feel like C in the end.

Just a few off the top of my head:

* No need to specify type. Use var.

* Simpler for loops

* Inbuilt types for Hash Tables

* File types, making file reading much easier

* Function types, making it easier to pass functions around

* Doctype access

* Threads & Mutexes

* Format strings

* GC (with ability to turn C-types into Cello-types for GCing.)

It _is_ fundamentally syntax-sugar, but enough that what you end up with doesn't necessarily _look_ like C at the end.

        with(f in new(File, $S("test.txt"), $S("r"))) {
          var k = new(String); resize(k, 100);
          var v = new(Int, $I(0));
          foreach (i in range($I(2))) {
            scan_from(f, 0, "%$ is %$ ", k, v);
            show(k); show(v);
          }
        }

(From: [http://libcello.org/learn/file](http://libcello.org/learn/file))

<comment><USER16> > * No need to specify type. Use var.

I see types everywhere; they appear to just have been moved from the left-hand side to the right-hand side? eg:

      var i0 = $(Int, 5);
      var items = new(Array, Int, i0, i1, i2);

<comment><USER15> Mmm, kinda.

        var i0 = $(Int, 5);
        i0 = $(String, "Hello");

Perfectly valid.

</comment></comment></comment></comment><comment><USER17> IIRC Cello doesn't enforce type safety, which means you can foldl but it's not much different from writing foldl in C and using void pointers everywhere.

I had thought about trying to make a type-safe version of Cello but I eventually realized that I can't do it in cpp so at that point it became its own language and too much work (I did not write Cello).

<comment><USER18> I'm going to say you're right, given one of the first declarations is

        typedef void* var;

Cello is extremely impressive and could be fun for hobby projects, but for something you'd actually want to use on a real product you'd be better off just creating a new language (it could compile down to C even, like Vala did).

<comment><USER19> >> (it could compile down to C even, like Vala did).

Nim is another take on that particular strategy.

<comment><USER20> Another recent one is Ivory. [http://ivorylang.org](http://ivorylang.org)

</comment></comment></comment></comment><comment><USER21> There are several reasons why people use C, one of them is that the language makes it very explicit what generated code is going to look like. That's one of the reasons why Windows kernel is written in C ([https://msdn.microsoft.com/en- us/library/windows/hardware/ff...](https://msdn.microsoft.com/en- us/library/windows/hardware/ff559740\(v=vs.85\).aspx), [https://view.officeapps.live.com/op/view.aspx?src=http://dow...](https://view.officeapps.live.com/op/view.aspx?src=http://download.microsoft.com/download/5/b/5/5b5bec17-ea71-4653-9539-204a672f11cf/KMcode.doc)). Libraries like this obfuscate source code.

<comment><USER22> A problem with C in modern usage is that many people believe this to be more the case than is warranted.

</comment></comment><comment><USER23> Here's the author of Cello talking about the project at PolyConf in 2015: [https://www.youtube.com/watch?v=bVxfwsgO00o](https://www.youtube.com/watch?v=bVxfwsgO00o)

« In this talk I dig into the depths of my programming library Cello - a fun experiment to see what C looks like when pushed to it's limits. I'll cover how Cello works internally, some of the cuter tricks used to make it look and feel so different, what is in store for future versions of Cello, and why it is important to push languages to their boundaries. »

</comment><comment><USER24> How about performance? As I understand, it uses fat pointers fat pointers and GC, so performance drop is expected. There are not many reasons to use C nowadays beside performance.

<comment><USER25> > There are not many reasons to use C nowadays beside performance.

portability? stable ABI? ... writing something in C make it easy for any other higher level language to link to it. That's why we're not done with C, at all ... it's basically the only serious language out there used to share code among every possible platform or language. Even C++ which is a bit safer in practice is harder to link.

I just wished C was a bit safer by default (arrays with bound checking,...)

<comment><USER26> > Even C++ which is a bit safer in practice is harder to link.

Not to go down the C++ evangelist route, but if you want to write libraries in C++ to use with other high level languages, you can wrap the headers in extern "C", and still write C++ as normal in your own code.

<comment><USER27> …unless your library exposes classes/templates, which is probably what the majority of C++ libraries do (e.g., wxWidgets, Qt, Boost, etc.). In this case, creating C bindings is a real pain.

</comment></comment></comment></comment><comment><USER28> Isn't this something similar to vala ?

<comment><USER29> No not really.

Vala has an own seperate transpiler that generates C code from Vala code.

Cello uses the normal C preprocessor to generate C code.

<comment><USER25> Actually Vala generates GObject code, which fundamentally has its own "type system" and uses reference counting.

</comment></comment></comment><comment><USER30> Why not just use C++?

<comment><USER31> That's like saying "Why not just use lisp?" to a python programmer. They're entirely separate languages (albeit it they do share some commonalities, but not as many as you might think).

C is my main language and I dabble in C++. I really dislike C++. I love C. I welcome any efforts to add a bit of higher level functionality to C. I have no desire (ever) to switch to C++.

<comment><USER32> C programmer here. Cello isn't really C. So as long as you're using something that isn't quite C, and you want an object model, I think "why not C++?" is a reasonable question.

<comment><USER33> Looks like C to be. Just some macros and function calls.

<comment><USER34> If someone showed me a sample of the code, out of context, I wouldn't have guessed it was C. Maybe Javascript (with the "var" declarations).

</comment></comment></comment></comment></comment><comment> r00t- Either the examples are terrible or the library is. I'm leaning towards the latter.</comment>


Bootstrapping / startup-life-hacks we've learned (so far) - <AUTHOR> http://maplebutter.com/10-bootstrapping-startup-life-hacks-we%e2%80%99ve-learned-so-far/

<comment><USER2> "Work from a founder's home"

Works great unless you're married or have a significant other at home. Trust me on this, after a week of seeing your face constantly even the most beloved becomes the most revolting.

See also: <http://theoatmeal.com/comics/working_home>

<comment><USER3> Been working from home for six months and this echoes a bit too painfully close to the truth. My wife kicks me out daily right now.

<comment><USER4> My wife and I have worked from home together for years. We have a roommate who also has his own start-up and works from home. Different strokes...

<comment><USER5> Same here. Husband and I have worked from home together since 2006, and hope to never have to work apart again.

</comment></comment></comment></comment><comment><USER6> You got to extremes with budgeting for food but you spend up on hiring a design firm for your frontend?

Your priorities are out of order. Some of the most successful sites on the web had completely shit designs.

The Google guys didn't even know html.

<comment><USER7> It's not 1998 anymore. While I agree that design is not key to the success, I believe that when people see site with bad (like 1998-bad bad) design, they automatically distrust it.

I also don't think that what they are doing is 'extreme budgeting'. It seems like pretty reasonable thing that everybody does where I live.

</comment></comment><comment><USER8> _If the original title begins with a number or number + gratuitous adjective, we'd appreciate it if you'd crop it. E.g. translate "10 Ways To Do X" to "How To Do X," and "14 Amazing Ys" to "Ys." Exception: when the number is meaningful, e.g. "The 5 Platonic Solids."_

— <http://ycombinator.com/newsguidelines.html>

</comment><comment><USER9> Just for the authors' edification, Scriptlance is very "meh." I found the providers to usually be at least a tier below Elance, oDesk etc in terms of quality. $5 dollar-esque bids are the norm, which usually translates into that level of quality when it comes to code, imagery etc. But as with any freelance site, it's about the providers first & foremost. Pay close attention to the portfolios & ask detailed, focused questions before beginning any job.

Also watch out for North American middlemen that go out and farm your projects out to programmers in India, Bangladesh etc whose quality (or lack of quality) you may have no awareness of. Not that I haven't been burned in the past or anything...

</comment><comment><USER10> "We also truly believe in spending on hiring the right talent, contractors or agencies (and paying them competitive rates along with rewarding them with bonuses)."

And yet you recommend crowdsourced design sites like 99designs.com?

<comment><USER11> I don't find that mutually exclusive. Having a high priced contest on 99Designs is the best way I know of to get in touch with great designers. You can work with them further offline as well.

<comment><USER12> A great designer would not be seen near such a place. Heck, any self respecting designer would do their best to avoid it. You're buying the time of kiddies equipped with photoshop, nothing more.

</comment></comment></comment><comment><USER13> A Rogers bill! You're missing out... Teksavvy is a rogers reseller that is cheaper with no caps... since you're in the GTA you may be able to save a couple bucks through them!

Good tips - I find that the heat of all the PCs/equipment isn't that bad, but why not opt for somewhere all-inclusive (a ton of condo's have this, since it seems you're in a condo building)

The ping pong desk is a cool idea, I'd want to make mandatory chill out times though where say every thursday at 5pm you have a ping pong tourney or something.

<comment><USER14> Adam here. Actually, we're with Rogers because they've got a discount available for condo residents, so it's better value than Teksavvy, all things considered. I'm a huge Teksavvy fan and have them at home as well! But we opted for the Rogers deal instead.

The all-inclusive condo option is an interesting idea as well :)

Regular ping pong matches was something we originally wanted to do, but now it would require moving our monitors, laptops, all-in-one printer, etc. and that's just too much work! hehe.

If I had to add an 11th point, it would be "SSDs should be mandatory". I've found a huge productivity increase since switching to one, and will never go back to anything else for the primary disk on my development machine. That said, we're bootstrapping, so not everyone has one _yet_ ;)

</comment></comment><comment><USER15> A solid alternative to working from an apartment is to find coworking spaces in your city. In Atlanta, myself and my cofounder work out of a place that has plenty of space, tables, printers, etc. and only costs $80/month/person. Also a great networking tool, as you meet other bootstrapping entrepreneurs!

Additionally, if your city has an entrepeneurship society or network of any kind, go for the food if nothing else - aside from meeting other entrepreneurship-minded people, nothing better than a free meal.

<comment><USER16> I'm based in Atlanta and would love to hear more about that.

<comment><USER17> Check out this page:

<http://wiki.coworking.info/w/page/16583399/CoworkingAtlanta>

Or for more general info look here: <http://coworkingregistry.org> or the wiki linked above on the frontpage has a list of directories: <http://wiki.coworking.info/w/page/16583831/FrontPage>

There's also a very helpful Coworking Google Group if you want to explore deeper and find the community.

</comment></comment></comment><comment><USER18> The bag of rice propping the door open brought a smile to my face. I can just imagine someone needing to cook some rice then realizing the quantity needed may tip the balance in favor of the door. A second of hesitation before the aha moment and finding a new door prop...till the next day when someone goes "Where the hell is the rice?"

ya.....I need to get back to work!

</comment><comment><USER19> That is a _nice_ apartment. Maybe rent is just really cheap in Canada, but to my limey eyes that place looks distinctly lavish.

</comment><comment><USER20> I'm looking at the pictures of your office and thinking you're being penny wise and pound foolish.

</comment><comment><USER21> My favorite bootstrapping-startup-life-hack is to eat your own dogfood. I'm not talking about using your own software, I'm talking about eating actual dogfood. It saves a lot of money.

<comment><USER22> I don't know how to say this - but, are you for real?

Its very important to eat well. Yeah, eat cheap food thats fast to cook, but also make sure its healthy. Vegetables and noodles, pasta, are cheap and quick.

The safety standards and quality of product that goes into dogfood is very different than food for human consumption.

From: <http://en.wikipedia.org/wiki/Dog_food> "As well, cow brains and spinal cords, not allowed for human consumption under federal regulation 21CFR589.2000 due to the possibility of transmission of BSE, are allowed to be included in pet food intended for nonruminant animals."

This is just one example, but _you do not want vCJD_ [http://en.wikipedia.org/wiki/Creutzfeldt%E2%80%93Jakob_disea...](http://en.wikipedia.org/wiki/Creutzfeldt%E2%80%93Jakob_disease)

Its crazy to eat dogfood, don't do it.

<comment><USER23> I'm not sure if you're being serious, but I believe he was referring to: <http://en.wikipedia.org/wiki/Eating_your_own_dog_food>

<comment><USER22> I was replying to this: "I'm not talking about using your own software, I'm talking about eating actual dogfood."</comment></comment></comment></comment>


Welcoming TellApart to Twitter - <AUTHOR> https://blog.twitter.com/2015/accelerating-direct-response-advertising-welcoming-tellapart-to-twitter <comment><USER2> Interesting. This also dovetails with the news about Twitter releasing their ad inventory to DoubleClick for direct buying there as well.

Twitter has a clear and direct interest in building out ad-tech offerings to better leverage their platform. This is the first manifestation from what I can tell.

<comment><USER3> tellapart's business, afaik, is this:

* ecommerce retargeting for eg shopping cart abandonment (put shoes in your cart then don't buy? Those shoes follow you around the internet). This, btw, requires catalog integrations with retailers and is not easy.

* dynamic pricing (though who knows how used this is)

* cross device retargeting (competing with fb+google+twitter who stitch identities with logins/single sign on, and drawbridge which estimates them)

It's not clear to me exactly what the synergies with twitter are. The obvious one is cross device retargeting, but if twitter can't get that done with their signin, I'm not sure how much tellapart can help.

</comment></comment><comment><USER4> Hopefully not an all-stock deal considering Twitter stock is down nearly 20% today.

Not that that necessarily means anything in the long term, but I imagine it would be a bit of a psychological kick in the pants to watch that happen on the day you announce a deal to be acquired.

<comment><USER5> When the stock recovers, they'll be pleased as punch!

</comment></comment><comment><USER6> Congrats to TellApart!

I'm bummed though, because they had good parties that seem unlikely to continue under their new corporate overlords.

</comment><comment><USER7> Congrats to Dick Costolo for being an angel investor in TellApart. Nice win!

</comment><comment><USER8> Congrats to Josh and the TellApart team. Well deserved!</comment>


Monitoring service/server with Arduino microcontroller - <AUTHOR> http://burnsforce.com/original-guides/project-arduino-nagios-server-monitoring/

<comment><USER2> Really cool, but I'd love to see the code you use to monitor your gmail account as well.</comment>


The Largest DDoS Attack Worldwide - <AUTHOR> http://r00t-services.net/knowledgebase/31/Largest-DDoS-Attack-Worldwide-Are-you-Ready-to-Get-Protected.html

<comment><USER2> \- boring \- stupid \- false \- linkbait \- spam</comment>