Scent dog identification of samples from Covid-19 patients – a pilot study - <AUTHOR> https://bmcinfectdis.biomedcentral.com/articles/10.1186/s12879-020-05281-3 <comment><USER2> This seems like a much more useful screening method than taking people's forehead temperature at the door. Plus, you can have a dog wander around performing constant passive screening.

<comment><USER3> The study seems to have been conducted on prepared samples of saliva, so not sure if that would translate to working in the field.

</comment></comment><comment><USER4> I wonder if this puts dogs at risk for contracting or spreading the virus.

<comment><USER5> AFAIK most dogs can't get Corona (for now). Dogs that have tested positive for corona are rare. There is no report from Dog to human infection.

<comment><USER6> Rare, but this method is asking them to smell saliva samples all day. That's a level of exposure very few dogs would have.

</comment></comment></comment><comment><USER7> 6% error rate is kinda high imho if this becomes the main method for airports etc, given the possible consequences of testing positive at customs.

<comment><USER6> 6% seems amazing if you can enable mass screenings at, for example, schools.

As for consequences, you'd presumably be isolated until a secondary test could confirm the results. That's better than a 14 day quarantine for everyone coming into a region, as many places are "requiring" in the US.

<comment><USER8> First positive case at a school is gonna have a lot of people sent home.

Our school it was. The entire classroom The teacher All secondary teachers / aids that kid interacted with. Possibly the kids the secondary personal interacted with. After 14 days everyone allowed back. Repeat each time a kid gets sick.

So with high false positives, everyone would be in quarantine perpetually.

General opinion was school would open, then very quickly get shut down.

Finally school just went 100% virtual. Except teachers have to come in and teach virtual lessons. Oh and they have to wear a mask while teaching lessons to the virtual audience. This is for kindergarten. So parents will have to be with kid 100% of the time or it's all a waste.

</comment></comment></comment><comment><USER9> See also:

[https://news.ycombinator.com/item?id=23542335](https://news.ycombinator.com/item?id=23542335)

</comment><comment><USER10> It's hard to imagine a cheaper test than this! I'm not sure I like the sociological conditioning or normalization that would happen with large-scale dog "testing" rollouts through society. But I can't deny that something like this would allow a lot of life to go back to normal and that would be a very good thing.

<comment><USER5> "It's hard to imagine a cheaper test than this! "

ROTFL. Do you know what a working dog costs? Good luck with that. But you could try to build an artificial nose based on the headspace.

<comment><USER10> Do they cost millions of dollars? I suspect not.

If you need to screen thousands of people per day as they're say, all going to the grocery store, or the office, or whatever, it doesn't take too many days of several thousand "tests" per day times say $1 per test to come up with $10k or $20k.

If a well trained dog that can do the test is $100k then yes you're starting to talk about an equivalently priced test to those already in the marketplace.

Covid tests require a significant amount of human and machine time such that they cost tens of dollars right now. I suspect that dogs could bring that down by an order of magnitude or more.

<comment><USER5> Such a do should cost you about USD$ 10k, possibly more for a Corona detection dog since it has to be trained in a dangerous environment. You need a dog handler. The dog is not able to work 8h a day and sniff out samples non-stop. Honestly I don't know how many hours a day the dog could perform. 3 hours may be realistic. So how many people can the dog smell in an hour? 60?

Taking into account he costs (dogs, transport, dog handler etc.) it does not seem to be a cost effective solution. Yes, fogs were used to detect pregnancies but we don't do this anymore.

</comment></comment></comment></comment><comment><USER11> They didn't mention what kind of dogs they use. Beagles?

<comment><USER12> Friend of the family uses labradoodle's exclusively for scent dogs.</comment></comment>


Is your idea a winner? - <AUTHOR> http://www.cambrianhouse.com/blog/startups-entrepreneurship/is-my-idea-a-winner/ <comment><USER2> They didn't give many concrete examples of adding value other than the advertising company, and Google.

But I think another example would be iTunes (no one else brings music to your ear as well). If that service went away, that would cause people pain.

</comment><comment><USER3> I really like the way this article is short and to the point.

</comment><comment><USER4> "The brother's advice is to try and look for opportunities where you bring all the value."

Is it possible to have more info. on this one ?</comment>


David Benatar: Corporal punishment of children should be limited, not abolished - <AUTHOR> http://www.corpun.com/benatar.htm

<comment><AUTHOR> The author is a philosophy professor at the University of Cape Town. He is probably most famous for his argument that existence is a moral bad, as described in his book _Better Never to Have Been: The Harm of Coming into Existence_.</comment>


Apple giving gift cards for upgrading iPad2 to iPad3 - <AUTHOR> http://thenextweb.com/apple/2012/03/14/apple-will-now-give-you-up-to-a-320-gift-card-for-your-old-ipad-2/

<comment><AUTHOR> I don't see that they were going to have any problems selling the iPad3, but this will boost their initial sales numbers, which I'm sure we'll see apple boasting about, even though they created a bit of false demand with this upgrade program.

</comment><comment><USER2> I will buy your iPad2 for $300 if you are interested to sell it back to Apple :)</comment>


Things you're doing wrong in Java - <AUTHOR> https://towardsdatascience.com/10-things-youre-doing-wrong-in-java-7608e2f050c7 <comment><USER2> Nice self promote on a pay walled article.</comment>


GitHub's 2017 Transparency Report - <AUTHOR> https://blog.github.com/2018-05-11-2017-transparency-report/ <comment><USER2> _In 2017, GitHub received eight requests—all from Russia—resulting in eight projects being taken down or blocked (all or part of six repositories, one gist, and one website taken down)._

Huh, seems odd. Any particular reason they all originated in Russia?

<comment><USER3> You can see the text of all takedown notices from Russia here:

[https://github.com/github/gov- takedowns/tree/master/Russia](https://github.com/github/gov- takedowns/tree/master/Russia)

<comment><USER2> oh cool, thanks! for anybody who cba to take a proper look but is idly curious, a quick browse of the stuff they pulled turned up...

* a couple of duped windows installers for... something... i'm not brave enough to run.

* something linked to a betting site

* an IP anonymiser

* an encoded block of JSON that is named enc_sources.json

* an issue raised with GreatWall (who apparently monitor and challenge Chinese internet censorship)

* a free web proxy

* and weirdly, a single commit to objidlib "A library for working with NTFS Object Idenitifers".</comment></comment></comment>


Stephenson's "Spew": Social Media in 1993 coming true today? - <AUTHOR> http://www.wired.com/wired/archive/2.10/spew_pr.html

<comment><AUTHOR> The more and more I see articles like this ([http://www.trendpreneur.com/online/social-media- online/socia...](http://www.trendpreneur.com/online/social-media- online/social-media-monitoring-is-the-future/)) and how trying to filter through the Twitter/Facebook noise is the future...the more I think of this story.

</comment><comment><USER2> I coincidentally reread _In the Beginning was the Command Line_ three days ago. Neal Stephenson is an awesome geek.

<comment><USER3> I did too. The second time reading it seemed so much _longer_.

</comment></comment><comment><USER4> Wow, Stephenson's writing style has changed drastically in the last 16 years.

"... where demographics, entertainment, consumption habits, and credit history all intersect to define a weird imaginary universe that is every bit as twisted and convoluted as those balloon animals that so eerily squelch and shudder from the hands of feckless loitering clowns in the touristy districts of our great cities."

Compared to that, Anathem reads like it was written by a monk. (-:

<comment><USER5> But isn't that partly because Spew is written in the first person, unlike Anathem? Spew slightly predates The Diamond Age, and the style of TDA is closer to Anathem.

<comment><USER6> Anathem is written in the first person as well.

<comment><USER5> Ugh. You are right. Should have opened my copy before I shot my mouth off. But the point is that style of Spew is appropriate to that narrator in that environment.</comment></comment></comment></comment>


Jordan Peterson's year of 'absolute hell' Retreated from public due to addiction - <AUTHOR> https://nationalpost.com/news/jordan-petersons-year-of-absolute-hell-professor-forced-to-retreat-from-public-life-because-of-tranquilizer-addiction <comment><USER2> From Wikipedia:

> In late 2016, Peterson went on a strict diet consisting only of meat and > some vegetables to control severe depression and an autoimmune disorder, > including psoriasis and uveitis.[26][141] In mid-2018 he stopped eating > vegetables, and continued eating only beef (see carnivore diet).[142] In > 2019, Peterson entered a rehabilitation facility after experiencing symptoms > of physical withdrawal when he stopped taking clonazepam, an anti-anxiety > drug. He had begun taking the drug upon his doctor's recommendation > following his wife's cancer diagnosis.[143][144][145] In early 2020, his > daughter revealed that he had spent the previous year struggling with > addiction to benzodiazepine tranquilizers and had gone to Russia for an > experimental treatment that included a medically induced coma.

It sounds like there's a lot more going on physically than just the benzos.</comment>


Federal IT Dashboard Announced by CIO Kundra at Personal Democracy Forum '09 - <AUTHOR> http://it.usaspending.gov/

<comment><AUTHOR> Happy to see this big step towards transparency. Don't like that it has waterfall concepts built in and excludes defense spending completely. But hey, it is progress and Fed CIO Vivek Kundra made progressive comments towards the importance of releasing early and often. To wit, the new dashboard site is a "beta" release.</comment>


Forward 40: Where is LOGO?  - <AUTHOR> http://blog.wired.com/wiredscience/2007/10/forward-40-wher.html

<comment><USER2> Oh man! All through elementary school in India, we were taught in every single class that "LOGO is the language of the computer". This was about 12 years ago.

I didn't really like the computer or programming much back then and almost flunked the LOGO exam. That just goes to say how cool the language is--I went into the exam clueless but after typing a few "LEFT" and "RIGHT" I was amazed it did exactly what you ask it to.

<comment><USER2> To the poor soul who likes to down-mod every comment I post, hope life gets better!

<comment><USER3> zaidf, you are wise, my friend.

To have compassion for such a person is unique and uncommon. I join you in hoping life does get better for that person, because it must be so very sad to be in trapped in such a life.

</comment></comment></comment><comment><USER4> I never liked LOGO. It was just one of the programs available for us to play with during 'computer lab time', and as far as I can remember we were never taught how to use it; commands were passed on in a sort of oral tradition from older schoolmates to younger. Since then, I've learned how cool it can really be and wondered about it often, though. Anybody know of a good, true-to-the- old-school-basic-program that's freeware for Win32?

*Edit: And while I'm at it with old games and such that I miss...anybody know where I can get ahold of a BASIC with the old nibbles.bas and gorilla.bas that came with QBASIC?

</comment><comment><USER5> Logo hasn't disappeared, though it's evolved a bit. Northwestern University has a version of Logo called NetLogo.

<http://ccl.northwestern.edu/netlogo/>

It's a decentralized version of logo, where you can control multiple turtles at once. It's useful in simulating distributed systems, such as "turtles, termites, and traffic jams."

There's a book by Mitchel Resnick by the same name. [http://books.google.com/books?id=K8P1rX8T4kYC&dq=turtles...](http://books.google.com/books?id=K8P1rX8T4kYC&dq=turtles+termites+traffic+jams&pg=PP1&ots=xjELl6ou14&sig=vbEYZIfpZuAgy9oWsx4zEEn0VbE&prev=http://www.google.com/search%3Fq%3Dturtles%2Btermites%2Btraffic%2Bjams%26ie%3Dutf-8%26oe%3Dutf-8%26aq%3Dt%26rls%3Dcom.ubuntu:en- US:official%26client%3Dfirefox-a&sa=X&oi=print&ct=title&cad=one-book-with- thumbnail)

If you get a chance, run some of the simulations on their demo page. They're available as java applets. It's pretty amazing to see complex patterns stem from simple interactions, also a theme of Wolfram.

<comment><USER6> I went to a Summer School in Collective Intelligence this year, and chose Netlogo to implement a project. It was definitely fun: quite messy., but you really could get an experiment up and running very quickly. In fact most teams chose Netlogo for their experiments.

So Logo is alive ;-)

</comment></comment><comment><USER7> The article mentions Oregon Trail as another classic app that changed lives at a young age -- this is dead on. I remember playing Oregon Trail during "computer time" as young as 2nd grade (about 8 years old) and wondering how the computer translated my keyboard input into what to display on the screen. And thus, a future hacker's curiosity is piqued.

If only my family didn't die of dysentery so often...

<comment><USER8> Hahah all Oregon Trail prepped me for was Castle Wolfenstein. I'd spend all my money on bullets and hope I could find some buffalo to strafe.

</comment></comment><comment><USER9> I'm not a big fan of LOGO either. Drawing lines gets boring quickly.

I'm reminded of picking a university. I went to two introductory CS courses.

One had us drawing Mickey Mouse in Pascal on a old Mac, which gave me a deep hatred of Apple that lasted until I discovered OSX.

The other was an introduction to MINIX. And the end, we all received a disk with MINIX on it. I didn't even know at the time that there were alternatives to MS-DOS, and was deeply impressed.

Moral: Don't be condescending to kids - it's better to overestimate them. And LOGO is a condescending language.

<comment><USER10> No, it is not.

Some LOGO books are, but the language is not. I tried reading 'Turtle Geometry' when I was young. Some parts are like University Maths. In fact, all of it is very strict in the mathematical sense. And all is based on LOGO. For someone in high school who had no idea of trigonometry, it was mind blowing.

</comment></comment><comment><USER11> In my school we had a mechanical turtle that drew lines on a big piece of paper on the floor. If you were really good and didn't mess around with your screen turtle you got to have a go at using it. We had to stop using it when someone gave it the command FORWARD 500 and it pulled its own cable out of the computer. Good times.

</comment><comment><USER12> I will never forget programming an animated rocket that blasts off in my 3rd grade glass... Logo is great.

<comment><USER12> And then writing Logo as a project my soph year.... ah, the full circle of education.</comment></comment>


Show HN: my customer validation page, a simple analytics solution - <AUTHOR> http://onsightapp.com/

<comment><USER2> I remember seeing a real-time analytics demo piece on HN a few days ago (<http://chatteranalytics.com/>). It's a single page that displays a live stream of all the actions by various viewers on the page as you viewed it.

While your solutions probably differ (and may in fact be complementary) it might be worth building a small portion of your analytics solution into your signup page, in the same fashion, to give the clearest indicator of what your analytics could do, and then you can SHOW people why they need it.

<comment><AUTHOR> OMG thanks for the tip, it's really useful!!!

<comment><AUTHOR> (I didn't know I had a direct competitor, but it makes it more fun)

</comment></comment></comment><comment><USER3> 1\. Too much text.

2\. We need screenshots.

3\. "Use your semantics" doesn't really mean anything to me.

4\. It doesn't seem to do anything that I can't already get. You need to find a real differentiation, _or_ explain it better if you already have one.

<comment><AUTHOR> Thank you! I know I have to work on the screenshots, just tried with the most minimalistic version I could. And yes, need to get the differentiator clearer.

<comment><USER3> Yes, first, do the differentiation. Do you know what it is? If so, just try to explain it to us here. We'll give feedback :)

<comment><AUTHOR> From what I know a differentiator is the key that makes you different from the competition, that makes unique your product, am I right?

<comment><USER4> Yes, but that's not what he was asking. The question is: do you know what your key differentiator is? If so, try to explain it to us here.

It's important to try to craft a "unique value proposition", and then make sure your page positions your product around that.

<comment><AUTHOR> Oh, OK. I'll try it then: its value proposition that differentiates from other solutions is its realtime and really focused output. The main interface is not graphs that sum what happened in a day, but more of what is happening right now. And of course its easiness to setup. My idea is you can know that people are doing something wrong on your website by looking at the stream. For example if you have an image that is understood as a link to the checkout, but doesn't have a link, this app should be able to tell it to you.

</comment></comment></comment></comment></comment></comment><comment><USER5> You need a better, more visual way to present what you're doing. A few sentences and a link to another page with another sentence doesn't really make a strong case for using your platform.

<comment><AUTHOR> Thanks for your comment! Yes, I know I have to work with visualization. I'll try to make another version that is more appealing, in these days!

</comment></comment><comment><AUTHOR> Do you think concepts are clear? Give me some feedback please :)</comment>


Node.js and Express Authentication Kit with MySQL, Sequelize and Connect - <AUTHOR> https://www.noodl.io/market/product/P201601091821557/nodejs-express-login-nodejs-express-login-create-accounts-login-logout-validate-sessions <comment><USER2> First time seeing noodl.io... interesting concept.

<comment><AUTHOR> Glad to hear! How do you like it so far?</comment></comment>


Evidence for Anyons, a Third Kingdom of Particles - <AUTHOR> https://www.quantamagazine.org/milestone-evidence-for-anyons-a-third-kingdom-of-particles-20200512/ <comment><USER2> Just to be clear for a general reader. These are quasiparticles. They are effective mathematical descriptions of certain effects in the real world, but the physical particles responsible for the effects are fermions and bosons, not anyons.

<comment><USER3> Yeah. In this case it's fine, but in general it can lead to confusion.

For some weird reason, condensed matter physicists keep giving their quasiparticles the same names particle physicists give their particle particles, even though the mathematics are quite different. If you hear someone proclaiming the discovery of Majorana fermions, axions, or monopoles, it's essentially guaranteed to be a quasiparticle in a lump of metal or something. Sometimes even the articles themselves get confused about this.

<comment><USER4> Is this really so different from particle physicists' "resonances", where they see a peak in a graph and pronounce a new particle:

[https://en.wikipedia.org/wiki/Resonance_(particle_physics)](https://en.wikipedia.org/wiki/Resonance_\(particle_physics\))

<comment><USER3> That's fine because basically everything's a resonance. The only particles that aren't technically resonances are those that have infinite lifetime, i.e. just the proton, electron, and photon.

</comment></comment></comment></comment><comment><USER5> What does the "looping around" mean here? There's no definition given, and the expression can be interpreted in several ways.

Does it mean "being moved on a circular path around something"? That would be simply a couple of translations, which change exactly nothing. Or does it happen in a sort of a field?

Taking the interpretation of "engulfing", like "a rope _looped around_ a post engulfs it" shows a clear difference between 2D and 3D, and seems topologically relevant, but what does it mean "to go back again"?

Not knowing the topological model for particles beforehand, I am unable to learn anything from the article.

<comment><USER6> > Does it mean "being moved on a circular path around something"? That would > be simply a couple of translations, which change exactly nothing.

I can't exactly tell you how the topological part works but I can tell you that this statement isn't as simple as you think.

You're not reasoning about the location of a particle, but you should actually be reasoning about the Feynman path integral, the sum of all the probabilities of the potential paths that the particle could travel through in the future — because this is physics and our particles are all waves.

Say that translating the particle does not change its state. Imagine for a moment a macroscopic two dimensional system in which you have a globe depicting the Earth. Initially, this globe is set with the north pole facing up and the Greenwich meridian facing north. Draw an circle on the floor and place another sphere in the middle. Roll this globe around the circle. When you it returns to the initial location, does the globe look the same? It might not!

The globe has state and that state changes as it is moved around. Your globe changes direction because it is rotating on the floor. Particles don't have a floor to roll on, but they can have internal state.

If your globe ends up the same place after a circle, then your globe is a boson (phase factor 1). If the globe is upside down with Antarctica on top but otherwise the same, it is a fermion (phase factor -1). If Florida or the Ukraine or God-knows-what end up on top instead, it is an anyon.

Now, you're going to rig this up to a camera and do a time lapse (this is us taking the integral). Every time the globe passes the camera, take a photo. Stack all the photos after each other in a video. If you have a boson globe, any picture looks like one facet of the globe. If you have a fermion globe, you'll have a double-image, with "north" pointing two directions at once. If you have an anyon globe, well, it could look like a bunch of different things, and that's the point.

In physics, of course, we actually want to run this sort of integral on all sorts of circles simultaneously, instead of just one, and some of these circles are more probable than others, and everything gets all quantized (which is _why_ the path integrals usually add up in a way that exclude anyons instead of that being the default.)

</comment></comment><comment><USER7> This is a surprising error from Quanta, which is otherwise pretty good at getting the details right:

> Imagine two indistinguishable particles, like electrons. Take one, then loop > it around the other so that it ends up back where it started. Nothing seems > to have changed. And indeed, in the mathematical language of quantum > mechanics, the two wave functions describing the initial and final states > must be either equal or off by a factor of −1.

As explained later in the article, in three or more dimensions, if you loop a particle around another and back where it started, you did nothing at all. The factor is 1, not -1.

The actual thought experiment is that you _swap_ two indistinguishable particles. The resulting state must be the same up to a scalar factor _k_ , since, if it wasn't, you could tell the particles apart. Moreover, if you swap two particles twice, you end up exactly where you started, so _k_ ^2=1.

In two dimensions, this all breaks down a bit, and it gets very complicated very quickly.

<comment><USER8> I'm a little bit curious here. My understanding is that the wave function has complex values and the "state" is described by the wave function times its complex conjugate. Couldn't they have meant the factor of -1 to be on the imaginary portion and then things still work out to have the same probability distribution?

<comment><USER7> Suppose you have a very simple system with two indistinguishable particles in one dimension and no spin or any other complications. The wavefunction is just a complex valued function of two variables:

f(x0, x1)

where x0 and x1 are coordinates of the two particles.

The fact that the particles are indistinguishable means that no possible experiment can tell them apart. After a bit of math, this means that f(x0, x1) = k * f(x1, x0) where k is a constant. All wavefunctions are normalized, so |k|^2=1, which constrains k to be on the unit circle.

But you can go farther: it's possible, at least in principle, to come up with an experiment that measures k. So you start with the particles in their initial state, do your experiment, and learn k. (Maybe you need to repeat it a bunch of times -- no big deal.) Now you repeat the same experiment but start with the two particles having their roles swapped. Since the particles are indistinguishable, you had better measure the same value for k. This means:

f(x0, x1) = k * f(x1, x0)

and also

f(x1, x0) = k * f(x0, x1) = k^2 * f(x1, x0)

So k^2 = 1, and that rules out everything except k=1 or k=-1.</comment></comment></comment>


Ask HN: Which Macbook Pro will you buy? 13" or 15"? - <AUTHOR>

I am confused between 13" (with 16Gb RAM, 512G SSD, dual core i5 processor worth $1999) and 15" (with 16Gb RAM, 256G SSD and quad core i7 processor worth $1999) I will be doing web and mobile development, occasionally running a windows virtual machine, if needed. <comment><USER2> If you primarily work on the laptop monitor then the 15" might be more pleasant. I have the 13" and its all good for me. But I also have dual 23" screens when I need to, so its all good. I also go mobile a lot so having the lighter weight and smaller size to me is great.

As for performance, 95% of the time I don't care that I have the i5, and the other 5% of the time I remember to get up and do something other than stare at a computer.

</comment><comment><USER3> (developer also, web and ios) Recently, the logic board on my 15" Macbook pro died (just shy of 4 years old) and I ran to the Apple store to buy a new one.

Not wanting to spend almost $2000 again, I went with the base 13" retina this time (128gb ssd, 8gb ram).

I have almost 0 complaints. The screen is beautiful, it's significantly lighter then my 15 inch was and it's plenty fast. Photoshop / Illustrator have been fine when cutting up mockups. Xcode hasn't given me any problems either.

My only complaint is no built in ethernet jack (had to get the $30 lightning adaptor). This is obviously understandable given the thinness of the laptop, it just didn't occur to me it didn't come with it when I got home. Lack of CD / DVD drive hasn't bothered me yet.

Oh yeah - can't upgrade the ram either; had I known that, I might have gotten more (was panic'd and needed a laptop that weekend)

<comment><AUTHOR> I feel 128gb is not enough. Given a choice, would you instead have gone for 512gb with 16gb ram?

<comment><USER3> I'd have gone with more ram just to have it, but 8gb hasn't proven to be a problem yet.

Storage space has never been a problem; my work is always on some server somewhere (dropbox, time capsule, a server, gmail, etc...) same reason i never get iPhones bigger then 16gb - most of my data, music, images are usually an app / website away

</comment></comment></comment><comment><USER4> I currently own a 2012 15" Macbook Pro and I could not imagine using the smaller screen.

Mine is not a retina, so that could change things a little, but not much. The wider feel really matters to me, even on very high resolution screens. I've used the Retina displays, and a 13" has what it takes to get it done. Really, it's about overall feel, room to type, rest hands, whatever.

It's also about connectors for me. The larger models have room for a bit more, and I tend to connect a lot of stuff. If there are more / better connectors on the 15" (I've not looked), go for the 15, if having these options matter.

When I buy laptops, overall feel matters as I've mentioned, but core machine capability matters much more. I tend to run 'em for a few years, and once they are cycled out of full time use, run 'em some more. It's now to the point where I've cycled out all desktop machines, and that is possible by buying up on core machine specs and buying quality hardware that will run for a long time.

I would do the 15" for the better processor, assuming that i7 has respectable cache, and ideally the hardware virtualization modes included. I've never, ever regretted spending for the "sweet spot" best CPU. Production, day to day, machine life is extended by a year or so, and non-production life is extended several years.

I've an older Lenovo T60p that is still being used by somebody doing online school. It had the fastest Core DUO in it available at the time, and nearly 10 years later, that machine still works well on Windows 7. I put an SSD in that one a while back. Totally worth the extra few hundred back in the day.

Chances are, you may end up replacing the SSD over time, and that can always be cloned and upgraded when you need it too. If the size ends up being an issue, pick your time and score a huge one on a great deal, clone your existing one and go that route.

I would definitely go for the 15" given your use case and these choices.

<comment><AUTHOR> Thanks. very useful. appreciated.

<comment><USER4> Glad to be able to help.

</comment></comment></comment><comment><USER5> 15"</comment>


Show HN: The best stories from 2015 - <AUTHOR> http://readthisthing.com/2015 <comment><USER2> You already did a Show HN somewhat recently.

[https://news.ycombinator.com/item?id=10186867](https://news.ycombinator.com/item?id=10186867)</comment>


Immutable.rs: immutable data structures for Rust - <AUTHOR> http://immutable.rs <comment><USER2> > Most of these data structures support in-place copy-on-write mutation, which > means that if you're the sole user of a data structure, you can update it in > place with a huge performance benefit (about an order of magnitude faster > than immutable operations, almost as fast as std::collections's mutable data > structures). > > Thanks to Arc's reference counting, we are able to > determine whether a node in a data structure is being shared with other data > structures, or whether it's safe to mutate it in place. When it's shared, > we'll automatically make a copy of the node before modifying it, thus > preserving the usual guarantees you get from using an immutable data > structure.

That's a really interesting approach. I could see that being really useful in a lot of cases, and it lets you get good single-threaded performance on code that would also continue to work in a multi-threaded case.

<comment><USER3> Arc::make_mut is really nice and is something we use a bunch in Stylo to safely mutate possibly-shared styles. Across threads.

<comment><USER4> But isn't it an anti-pattern to wrap something in an `Arc` when some of your use cases for it are purely single-threaded, and as such you're wasting a certain (potentially very significant) amount of performance on upholding memory visibility and such even when it's not needed? I have only dabbled in Rust, so I may be misunderstanding the implications of Arc and how it is implemented, and how it behaves in the absence of multiple threads. To me it feels a bit like some of the relatively early Java days when even the Standard Library was using `synchronized` (which is of course way worse than `Arc`) in lots of places like StringBuffer (used for String concatenation), just to be safe in case anyone ever wanted to use that code in a multi-threaded context. Only later folks began to realize that maybe that's not such a great idea and that you need to be able to not pay any synchronization costs when you know you're not going to be sharing a data structure across threads.

<comment><USER5> These collections are of somewhat limited use outside of concurrent scenarios, and I don't think you can (currently?) be generic over allocation in Rust. Since these structures need some sort of automatic memory management for structural sharing, you need to use a GC of some sort, having both atomic and non-atomic Rc would require duplicating the entire thing, once with Rc nodes and one with Arc node, for more or less no value.

> I may be misunderstanding the implications of Arc and how it is implemented, > and how it behaves in the absence of multiple threads

All Arc means is that refcounting operations use atomic increment/decrement instead of regular ones.

<comment><USER4> So that means that the synchronization cost would only be paid when making a new copy of the Arc and releasing each of those. Ok, that extends the set of use cases where it's acceptable to use Arc then. Thanks for clarifying.

EDIT: wording

<comment><USER5> > So that means that the synchronization cost would only be paid when making a > new copy of the Arc and releasing each of those.

Yes. An interesting note here is that due to Rust's ubiquitous use of references there will be little extraneous refcounting traffic unlike systems like e.g. Python where `a = b` might trigger a refcount increase. I think it was Armin Ronacher (mitsuhiko) who made that observation a few weeks back, possibly on twitter?

</comment></comment></comment></comment></comment></comment><comment><USER6> What kind of uses cases do people have for this? Since rust already pretty tightly controls mutability, my normal reasons for using immutable data structures don't apply there.

<comment><USER7> > _Why Immutable Data Structures_

> _... Rust, being what it is, does a good job of discouraging this kind of > behaviour, and keeping it strictly controlled when it 's necessary, but the > standard library doesn't provide collection data structures which are > optimised for immutable operations. This means, for instance, that if you > want to add an item to a Vec without modifying it in place, you first need > to clone the whole thing before making your change._

> _Data structures exist which are designed to be able to make these copies > much cheaper, usually by sharing structure between them, which, because this > structure is also immutable, is both cheap and safe. ..._

Seems pretty straightforward. You'll still have some benefits to immutable- data coding-patterns because it requires only read access on a value, not write, all the way up to the moment you want to swap values (if ever). Making that faster is a worthwhile goal.

<comment><USER6> Ok, but I repeat: what is the use case?

Yes, this allows me to do things like add an item to a Vec without modifying it in place, but why would I want to do that? What's the situation where that's helpful?

In other languages I do that, specifically to avoid mutability hell, but that doesn't apply to rust.

EDIT: Thanks to the responders for the great examples!

<comment><USER7> No ability to mutate -> no mutable ownership complications. Ever. And that's probably the biggest pain-point for people using Rust.

Not _necessary_ , but can simplify things, by encouraging(/forcing) simpler use of data by default.

<comment><USER8> But you get another pain-point in return - having to replace the whole state at root position, which in turn leads to redux.

<comment><USER7> That's a pretty normal way to handle immutable-data systems, yes.

</comment></comment></comment></comment></comment></comment><comment><USER9> I you are into immutable and c++ you should really have a look at Immer by Arximboldi (who is a user here on HN). Really amazing stuff: [https://github.com/arximboldi/immer](https://github.com/arximboldi/immer)

<comment><USER10> The other immer[0] of note is a JS library that gives you immutability with a mutable API i.e. you mutate your code as normal, but all changes are proxied to a copy, which is then returned as a result of your mutations.

[0]: [https://github.com/mweststrate/immer](https://github.com/mweststrate/immer)

<comment><USER11> Sounds a lot like jq's jv API: [https://github.com/stedolan/jq/wiki/C-API:-jv](https://github.com/stedolan/jq/wiki/C-API:-jv)

</comment></comment></comment><comment><USER12> [http://smallcultfollowing.com/babysteps/blog/2018/02/01/in-r...](http://smallcultfollowing.com/babysteps/blog/2018/02/01/in- rust-ordinary-vectors-are-values/) is an interesting look at how Rust's ownership system lets you treat the standard collections as values.

<comment><USER13> Good read, if you are the author I am not sure if feedly is lying that you have rss but despite saying you do I can not subscribe.

<comment><USER14> The author doesn't post to HN that I'm aware of, I'll ping him. Thanks!

</comment></comment></comment><comment><USER15> The ergonomics of using immutable structures with Rust are really good. You wouldn't know you have an immutable structure in front of you (other than that maybe there are more Arcs than you would expect).

</comment><comment><USER16> Yay, it's no longer LGPL'd: [https://github.com/bodil/im- rs/commit/32f58e914c84a6e965eea8...](https://github.com/bodil/im- rs/commit/32f58e914c84a6e965eea8e732a81cc3cd160fbb) :)

</comment><comment><USER17> I'm trying to figure out what the basis is for the implementation of the sorted map. For example, in related project [https://github.com/orium/rpds](https://github.com/orium/rpds) they explicitly note that they are basing their sorted map on Okasaki red-black tree.

<comment><USER18> ordmap.rs notes that it's based on B-trees. Doesn't that help?

</comment></comment><comment><USER11> This could really use some examples.

I hope this is as easy to use as, say, the jv functions in libjq [0].

[0] [https://github.com/stedolan/jq/blob/master/src/jv.h](https://github.com/stedolan/jq/blob/master/src/jv.h)

</comment><comment><USER19> This looks more like a view library where you have an iterable and views that let you access them in convenient ways and copy as little as possible than a data structure library where data is created on the fly within the data structure as needed.</comment>


Npm Private Modules - <AUTHOR> https://www.npmjs.com/private-modules <comment><USER2> So this reads to me that they're simply not going to update the ability to use GIT. Right now you can point to a repo or specific branch / tag but it doesn't read any of the versioning like bower does, so it can't handle versioning properly. If they updated the use of GIT you could completely eliminate the need for this feature.

That kinda rubs me the wrong way; it feels like they're trying to force this monetization as they've had plenty of us from the community wanting better GIT support for this very reason.

Honestly npm isn't a very complex piece of software, you could even replace it with bower if you want git with versions. I wonder if any competitors are going to spring up who can simply iterate faster. I won't even get started on their login system, ugh.

<comment><USER3> > Right now you can point to a repo or specific branch / tag but it doesn't > read any of the versioning like bower does, so it can't handle versioning > properly.

You can even point to a specific commit hash. But no, it doesn't read any of the versioning. What if two different branches have the same version number? The publish step is pretty important, because ...

> If they updated the use of GIT you could completely eliminate the need for > this feature.

... You'd still miss out on the prepublish hook - one of the major reasons I've looked into using NPM Enterprise.

Sometimes your package needs to do some housekeeping _before_ you publish, and the files generated by that should be distributed -- but not checked into source control.

<comment><USER4> > You can even point to a specific commit hash. But no, it doesn't read any of > the versioning. What if two different branches have the same version number?

The semver mechanism would be based on the tag, so it would not work when pointing to a specific commit hash (and you wouldn't want it to).

> ... You'd still miss out on the prepublish hook - one of the major reasons > I've looked into using NPM Enterprise. Sometimes your package needs to do > some housekeeping _before_ you publish, and the files generated by that > should be distributed -- but not checked into source control.

That's a nice feature and all but not required to have proper git support.

</comment></comment></comment><comment><USER5> We're already using "private" modules, by hosting them in a private git repo. NPM can install from these, e.g., git+ssh://user@server:Account/Repo.git, without problems. I'm not sure what value this would add for us, and the URL doesn't sell me well on it.

<comment><USER6> We're glad private repos work for you :-) However, the overwhelming feedback from our users has been that git dependencies are a gigantic pain in the neck, and this has been our own personal experience as users of npm. Much like npm itself, we are doing something you could do without npm, it's just much easier with npm, and we hope that reduction in friction is valuable :-)

<comment><USER7> Is it modeled strictly per-user or is there any notion of an "organization" similar to Github? It's hard to imagine a business having to manage paying for a bunch of individual accounts so they can have access to the company's private repo.

<comment><AUTHOR> Organization accounts are coming soon:

      Currently, private packages are only available for individual users, but support for organization accounts is coming soon. Feel free to create a user for your organization in the meantime, and we can upgrade it to an organization when support is here.

[https://www.npmjs.com/private- modules#organizations](https://www.npmjs.com/private-modules#organizations)

</comment></comment></comment></comment><comment><USER8> IMHO, tying language's defacto package management's capabiity to a single company's business model may hurts node.

No other language does this. you have all the same capability for propretary package with RubyGem/Python/Nuget, even Ubuntu allow you to add third party package repository.

It gives me the clue that npm may no longer improve, or many improvement will be "premium" feature.

I hope someone fork npm and add ability to parse semver from tag for github repo.

</comment><comment><AUTHOR> Everything looks pretty awesome, except the payment model.

I'm a little surprised they didn't go with a model similar to GitHub: \- Payment plans with X number of private modules, or $1/month per private module \- Unlimited paying/non-paying collaborators for private modules (perhaps only read access for non-paying)

With npm's model all my collaborators will have to pay for npm private modules as well.

<comment><USER9> Charging per-module like github would encourage people to author fewer packages and to lump more functionality into the same package, which goes completely against the ethos of npm and the spirit of tiny abstractions that do one thing well.

The way that npm has structured things, programmers pay once for membership in a commercial tier, where presumably money is already changing hands to work on private code. I think this makes much more sense and won't bias the code itself in a negative direction.

<comment><AUTHOR> That's a very good point!

I hadn't thought of it from the point of encouraging/incentivizing the authoring of more public packages.

But couldn't the current model then discourage the authoring of public packages, and lead people to start primarily publishing private packages.

I assume whatever reason people are authoring public packages today won't change because they get a paid account. Let's at least hope that's the case.

</comment></comment></comment><comment><USER10> Does anyone know whether the open source NPM implementation allows me to implement and host my own private repository system without forking npm? Or is npm (and thus node and iojs) hard-tied to npm, Inc's proprietary offering for private modules?

<comment><USER11> Nexus serves NPM packages, Ruby GEMs, YUM packages and also serves as a Maven repository.

[https://books.sonatype.com/nexus-book/reference/npm- configur...](https://books.sonatype.com/nexus-book/reference/npm- configuring.html)

Source code: [https://github.com/sonatype/nexus- oss](https://github.com/sonatype/nexus-oss)

<comment><USER12> One of our DevOps guys setup Nexus to serve npm packages. It both allows for the publishing of private repos (meaning you get semantic versioning support unlike git links) and caching of public repos from npm. It works extremely well.

</comment></comment></comment><comment><USER13> The Python equivalent to this is to simply place your source release tarballs on a simple private web / filesystem directory:

        pip install --find-links http://dist.example.com/packages/

This also makes it simple to mirror all requirements locally for more reliable installs.

I wish I could do the same with npm.

</comment><comment><USER14> If anyone is wonder the pricing like me just head to the home page: "publish unlimited private modules for just $7/month".

Here's a question: people with read-only access (to my private packages) have to be paid users too?

<comment><USER15> From the page:

> Give read access or read-write access for those packages to any other paid > user

<comment><USER14> My bad, I completely missed that.

So in the end is $7 per user, you can't have just one paying user publishing for everyone else. I guess I'll have to wait for _organizations accounts_ for now.

</comment></comment></comment><comment><USER16> Suggestion, add a pricing link? I usually do a ctrl-F to search for pricing in a service like this, make it easier for me to find.

<comment><USER17> If anybody else is wondering, it costs $7 per month (per user)

</comment></comment><comment><USER18> I'm fearful of where this monetization is going. Part of what I like about npm is that everything is free, from the dinky little packages that do one thing really well, to the monumental ones that provide a host of functionality.

I would hate if NPM went the way of wordpress plugins, where every stupid little plugin costs $5 to access.

</comment><comment><USER19> I might have missed the obvious but what is the difference between this and hosting your own private git repository?

</comment><comment><USER20> And now it's down:

[http://status.npmjs.org/](http://status.npmjs.org/)

<comment><USER20> And back up, but you can see a dip on charts.

</comment></comment><comment><USER21> Somewhat off-topic: "NPM Private Module" would be an excellent recursive acronym.

</comment><comment><USER22> I recently got interested in nodejs. However, then I discovered that:

1\. It doesn't support threads (facilitating structural sharing of large data- structures between parallel tasks, which cannot be done using ordinary processes).

2\. The module-loading mechanism ("require()") natively doesn't support delayed loading, which is needed when loading from within a browser. Yes, there is the "browserify" package, but, come on, something as basic like this should be supported out of the box. Especially considering the fact that there is a "http" module hardwired inside nodejs (why isn't this a separate npm module, btw?)

3\. To make my own privately held modules and install them properly, I have to run a npm server? This seems like an awful lot of work for something as basic as this. Ok, so now I can use the cloud for this, but come on, I should be able to do this just from within the filesystem, like e.g. git does it.

For people interested, one can use the package "sinopia" for hosting your own private modules. It seems to be a pretty decent package, but be aware that the authentication settings out of the box are completely insecure.

<comment><USER23> 1\. Node.js is (for the most part) single-threaded; that's its draw. It's not trying to be a swiss army knife, and if your use case requires a threaded language then Node.js certainly isn't the tool for that job. But it might find a useful place in your toolbox for other tasks.

2\. require() is part of the CommonJS spec, and how it physically works is dependent on the implementation. You point out that Node's implementation doesn't work well in the browser, but Node itself does not work in the browser so that point is moot. I agree that it might be interesting to load remote modules in Node, but keeping that operation synchronous does simplify the language quite a bit.

3\. You can also map modules to public or private git repositories in the package.json, as long as the private key used during npm install has access. If the git repo has tags, a tag can be specified in the git uri as well. Private npm repos are the superior way to distribute private modules with wider access, but I think this is handled fairly cleanly already.

<comment><USER22> Thanks for your comments. Some remarks here.

1\. Node.js is a tool for building servers. On a server you generally cannot afford to have the event loop blocked by a computational intensive task. You need threads.

2\. It would only require a "promise" to make the module-loading asynchronous. Leaving that out is not what I would call "quite a bit of a simplification", especially if using asynchronous callbacks is the "modus operandi" of programming on the Node.js platform itself.

3\. Okay, I stand corrected. I remember that I waded through the documentation quite a bit though, trying to figure this out.

<comment><USER24> _On a server you generally cannot afford to have the event loop blocked by a computational intensive task._

You are not supposed to use your main event loop for computational intensive tasks.

Offload those tasks to separate workers and use queues.

That's node's basic knowledge. Its a trade off that you're supposed to be aware of when using node.

<comment><USER22> The problem with workers is that they don't have an event-loop (like the main thread). So it is not possible to use asynchronous code written for the main thread in those worker threads, which is of course quite limiting.

EDIT: I mean workers which run in a thread (as opposed to in a process). An example is given by the webworker-threads npm module. Threads allow one to structurally share large data-structures, so one does not have to serialize them when calling a worker (serializing large structures would block the main thread).

<comment><USER25> Sorry you are getting a lot of downvotes. For what it is worth I don't think you deserve them, as your comments just show inexperience and lack of understanding of Node.js, and aren't trolling. However, I think you would be well served by doing some research into what Node.js and and how it works. Basically every Node.js process has an event loop. Your workers have an event loop just like your servers do.

Here is how a typical node stack works:

Nginx load balancer talks to a cluster of node server processes, one per core. The server processes handle all incoming web requests that won't block the event loop. On a typical REST server this is 99% of your tasks, and each node process can handle thousands of concurrent requests due to the way that the event loop works.

If there is a heavy, blocking task like processing an image or PDF file, (although even these things should be able to be done in a nonblocking stream manner) the server processes send a message through a background queue such as RabbitMQ, or Amazon SQS or the like to a background process which has the sole purpose of processing heavy tasks pulled from that queue. Fundamentally if you are using Node.js properly you don't need multiple threads. Instead you use multiple processes, and the processes are essentially "threads" that can talk to each other either using parent/child processes communication, HTTP, redis pubsub, or any other mechanism you want.

But there is no reason why anything should block a Node.js process if it is written properly. I've even done heavy video transcoding in a streaming manner in a Node.js process without blocking the event loop.

<comment><USER22> Thanks for the explanation and the moral support :)

I think most people here misread the line "facilitating structural sharing of large data-structures between parallel tasks, which cannot be done using ordinary processes" in my first post.

And by large data-structures, I don't necessarily mean structures which can be "naturally" streamed. I'm thinking more of a large index, for example, which can be used for fast lookup, and be used from several threads at the same time.

Having processes (here named workers) is a nice feature, but doesn't cut it when you want to share large amounts of data between threads (serializing that data would completely block the main thread). In my view, it is unfortunate that the designers of Node.js didn't opt for having multiple threads as opposed to putting every thread in a separate process.

<comment><USER25> I ended up replying to one of your other comments with more details but the answer to this problem is streams. You can use streams for any and all incoming data, whether it is file data uploaded via multipart upload from a browser, or streaming result set from a database, or raw data streaming out of a storage service like S3 or Dropbox. There is even a streaming JSON parser for Node.js in case you have the ungodly situation of having say a 500 MB JSON file or something horrible like that: [http://oboejs.com/](http://oboejs.com/)</comment></comment></comment></comment></comment></comment></comment></comment>


Ask HN: What are all the things that can go wrong during authentication? - <AUTHOR> Trying to build a bulletproof drop-in authentication system. What are all the things that could go wrong with authentication?<p>And I mean SSO, persistence, cookies, hashes, network dropouts, OAuth, etc. Curious to get y'alls take on it! <comment><USER2> Check out OWASP's cheat sheet: [https://cheatsheetseries.owasp.org/cheatsheets/Authenticatio...](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html)

<comment><USER3> Jesus this is a gold mine!

<comment><USER4> There is really no reason any developer should try to roll their own auth these days. OWASP has identified and enumerated all of the relevant info. It seems like negligence when a teacher/professor talks about building a web app without referencing the project.

<comment><USER5> When you say "roll their own auth", are you implying "designing from scratch their own method or idea of authentication"?

Or are you implying using existing libraries or services instead of rolling out your own?

</comment></comment></comment></comment><comment><USER6> Spoofing. I start up faceb0ok.website or whatever and theme it to look identical to Facebook. I then make a viral Facebook post that tells you Facebook will send you a $50 Amazon gift card if you click on this link. You click, then instinctively log in with your Facebook credentials because you can't tell that you're not on the real Facebook anymore. I now have your credentials.

Man-in-the-Middle (MITM). I'm at the same coffee shop as you and I've taken control of the router. You request your bank's web site and I'm able to route that request through my laptop, fetch the web page, and return it back to you. You log in to the web site. The connection is still encrypted, but the termination of the encryption is actually happening on my laptop. You log into the bank site. I now have your bank account credentials.

Cross-site scripting (XSS). Your site allows visitors to embed content (for example, message board posts) without that content being properly filtered. I use that to embed some JavaScript that watches for users using the log in form on your site and send those credentials to me, or sends the content of the cookie of users already logged on.

Poor hashing. You mentioned that above so you're probably aware of it already, but it's disturbing and surprising how many sites don't have this figured out yet.

I'm not sure what problems network dropouts could cause, at least in terms of security - which is the big problem here.

Of course there's more, but this is what comes to mind. In summary, I strongly suggest you don't try to reinvent a new authentication system. use one already in common use. It's probably already fairly battle-tested and validated for correctness and security. This goes for most other types of software as well.

</comment><comment><USER7> One that is often not mentioned: cache errors. When systems face scaling issues, caching is often a first line tool. Imagine a bug gets deployed with an off by one error in your cache, or the cache serves the latest entry instead of the right entry.

If you add caching (esp. to your auth-chain), you need automated tests covering every access pattern. Concurrent access, cache timeouts, cache full, cache invalidation, etc.

<comment><AUTHOR> But folks really cache auth related data? Isn't that better handled purely through client <> server requests and handling caching for all UI or action based data?

<comment><USER7> Not at scale. If our auth caching stops, our auth servers can get overloaded at peak times. Granted, horizontal scaling auth is a better first round choice, but caching gives you vertical scaling when you are hitting limits on your database. Another option is z-scaling, but that is really just a way to improve either of the previous two (have different pools of user databases).

</comment></comment></comment><comment><USER4> Normally I might try to enumerate examples, but I agree with bdibs that OWASP generally holds the canonical text for authentication of web apps.

Alex Stamos, former head of security at Facebook, described the security issues they got as a pyramid where the vast majority of issues were basic fraud, friend/family trust, fake login pages / fake emails, reused credentials, and email takeover. You won't be able to help with most of these unless you can help your users change their behavior.

For the other stuff, use the best SDLC techniques, never commit secure strings to version control (assume your source repo is misconfigured), use 12 Factor principles, read OWASP docs, search for relevant HackerOne disclosed reports (or blog articles, CTF write ups). There is no amount of coding that can replace red team user testing / a security audit.

<comment><AUTHOR> Amen to red team tests!

</comment></comment><comment><USER8> Just use keycloak.

<comment><USER9> Keycloak is a good option, but if you're not a Java development it may feel a bit cumbersome to setup.

There are a bunch of good options out there - and all of them are likely better than trying to go it alone!

</comment></comment><comment><USER10> As the founder of FusionAuth ([https://fusionauth.io](https://fusionauth.io)), let me relay 5 years of experience in building our platform in bullet points (not exhaustive by any means, but a rough overview). Also note that these aren't all authentication related, but once you build your own authentication, most everything else has to be done by hand as well:

\- OAuth 2 IdP and SP federation plus theming

\- SAML v2 IdP and SP federation

\- Nested federation (i.e. OAuth to SAML to OAuth to another OAuth)

\- JWTs (issuing, validation, introspect, user_info, numerous certificate and key-pair concerns, reconciliation, introspection)

\- Refresh tokens (managing, revoking, exchanging, securing, and more)

\- Lambdas to handle claim mapping and JWT population plus all the security around sandboxing JavaScript so it isn't an attack vector

\- Key management

\- Certificate management

\- User indexing and searching (when you have 100+ million users, this isn't easy)

\- Password rules (HIPAA, PCI, SOC, ISO, NIST)

\- Breached password detection (Have I been Pwnd style)

\- Password hashing (making it configurable, changeable, upgradeable, etc)

\- Devices (trust, OAuth Device Grant, MFA, passwordless)

\- Threat modeling and detection

\- Brute force prevention

\- Account locking

\- Event management (login, account creation, deletion, etc)

\- CORS

\- CSRF

\- XSS

\- Injection attacks (JS, SQL, etc)

\- Privilege escalation attacks (tunnels, backdoors, script injection, etc)

\- Replay attacks

\- JWT header attacks

\- Click-jacking attacks

\- IFraming

\- CVE management (libraries, OS, database, frameworks, APIs, etc)

\- MFA (authentication apps and SMS)

\- TOTP

\- MITM and spoofing

\- HSTS

\- Passwordless logins

\- Network management (firewalls, public and private access, intrusion detection, logging, auditing)

\- Pen tests (i.e. these aren't cheap)

\- Compliance (also not cheap and very time consuming)

\- Family management (multiple parents, divorces, multiple kids, roles, ages, consents)

\- Consent modeling (CCPA, GDPR, and many more are coming)

\- Group management

\- Roles and permissions

\- All the email things (forgot password, passwordless, email verification, templates, localization)

\- Reporting (DAU, MAU, etc)

Every line of code, every API, every HTML page, every button click, every form submit, every layer, every network hop, every operating system, every third- party tool, every library, and every browser must be secured and tested. If you have a big team and a lot of free time, you can probably get something workable that is secure in a year or two.

Of course, YMMV. ;)

Or like other folks have said, you can always use FusionAuth, Keycloak and others. They are all free and do all of this already. Though, I'd be suspicious with some projects. The compliance, auditing and testing pieces are expensive and probably not something they do much of.

And who knows what is going on with IBM and RedHat. I'd run screaming from that disaster if I were you. :)

<comment><AUTHOR> This is an amazing list and incredibly helpful. Thank you so much!</comment></comment>


Ask HN: Learning About Business - <AUTHOR>

Hello HN.
I'm a young designer and a front end developer. I went to school for design and "experimental media" and now I work as a designer/developer for a museum in NYC. I've been working for a startup as well and I'm becoming exposed more and more to the business side of things. My question for you is this: what are good resources for someone with a background like mine to learn more about business? I'd like to be exposed to some things that you might learn if pursued business as an undergraduate. I'm really looking for a few good books or any solid advice you're willing to give.
Much appreciated. <comment><USER2> The best way to learn is to start a business/become self employed.

A book would be: [http://www.amazon.com/Ten-Day-MBA-Step-step- Mastering/dp/068...](http://www.amazon.com/Ten-Day-MBA-Step-step- Mastering/dp/0688137881)

</comment><comment><USER3> <http://personalmba.com/best-business-books/></comment>


Design company made illusion of ocean waves trapped in architecture - <AUTHOR> https://cdm.link/2020/05/anamorphic-architectural-illusion-seoul/ <comment><USER2> So does the illusion only work from some angles?

<comment><USER3> Seems like it has to be the case since a screen can only show a single pixel to observers from all angles - but we know that pixel is supposed to actually correspond to the lightray from all those angles (the basis of raytracing.) The depth is statically set - so it appears the lightray started out within the chamber - and since the pixel is static - the angle of the observer also has to be set. Luckily the distance is a variable that scales just fine as long as the vanishing point is along the observers axis. And if I had to guess..it's all pre-rendered ray tracing on loop. Particle effects this good are near impossible to do real-time without some heavy duty equipment.

Still, super impressive coordination of the physical positions of the screens and the effects, mapping from physical space to model space.

If I had to guess how it is done? Each screen has 2 position sensors or transmitters (4 aren't necessary) in opposite corners. The simulation, when first installed, is calibrated by pulling all those positions in, to build the chamber model from the point position vertexes of the chamber screens. Then the simulation is ran and recorded, using raytracing, projected to an observer standing somewhere centered in front of the chamber. Generate a long enough loop (15 minutes?) to be unnoticeable. This footage is saved and now the screens just become dummy displays that just need to play a video file, that can even be on an SD card. Synchronization can be an issue but that's as easy as just using IR remote/trigger to start them all playing at the same time.

Maybe they've just done a lot more but I'm just providing the low maintenance solution I would do if tasked with the project.

</comment></comment><comment><USER4> There is a linked article on how to start making anamorphic illusions: [https://medium.com/@tqvinn/the-secret-to-anamorphic- illusion...](https://medium.com/@tqvinn/the-secret-to-anamorphic- illusions-853e3674209a)</comment>


Why CommonCrawl is a Disruptive Force in Big Data - <AUTHOR> http://myeverwrite.com/commoncrawl-disruptive-force-search/

<comment><USER2> Wasn't the major problem with commoncrawl that most of the index data was too old to be useful?

Besides, search index crawling is comparitively cheap compared to the data processing required to make it useful for actual search.</comment>


Making Github's Code Readable - <AUTHOR> http://codeulate.com/2009/11/making-githubs-code-readable/

<comment><USER2> Why do they even bother specifying Courier, instead of going straight to 'monospace'? At least that way, the user-defined monospace will be used, which might in the worst case still be Courier, but is more likely to be something sensible.

(Also, I find the DejaVu fonts better than the Bitstream originals.)

</comment><comment><USER3> I guess not everyone uses an OS that comes with the Bitstream fonts.

</comment><comment><USER4> Why isn't his browser anti-aliasing the text?</comment>


Submitting your Windows 8 apps - <AUTHOR> http://blogs.msdn.com/b/windowsstore/archive/2012/02/13/submitting-your-windows-8-apps.aspx

<comment><USER2> Wonder how are they going to keep people from gaming the name reservation system?</comment>


How Lufthansa Cares for Passengers' Medical Needs (2014) - <AUTHOR> http://www.airlinereporter.com/2014/09/how-lufthansa-cares-for-passengers-medical-needs/ <comment><USER2> Interesting.

I know that on most Domestic US flights, doctors, nurses, and paramedics are not permitted to open the medical bag unless their identity (and license) are confirmed by a flight medical group, and even at that, in situations where there is no doctor on the flight (but a paramedic or RN is), they will act upon the authority of a ground based doctor who approves all medication use.

In 2004, I was on a flight from CMH -> SJC and there was a medical emergency. At the time, I was a licensed paramedic, and pressed my call button when there was a page for 'medical personnel on the flight' after some delay when nobody else pressed their button. A flight attendant came up, asked me what my training was, and went to the front to call somewhere. A few minutes later, she brought a bag and took me to the back galley and handed me an airphone with a doctor on the other end, who confirmed with me the proper dosing and timing of ACLS drugs as we worked together to stabilize a patient. The process itself was like riding around with a doctor in the back of an ambulance -- he was very methodical about asking questions and quickly approved medication within reason at my discretion.

Ultimately, the flight was diverted, the patient was (very quickly) offboarded from the back galley and after some fuel for the plane, we were back on our way to SJC.

US Airways gave me a fair amount of miles (50K? 100K? I don't remember the exact number), upgraded the rest of my flight to first class, and provided me Platinum status for the rest of the year, along with a few other trinkets/swag pieces.

<comment><USER3> Not always imo. A British doctor was able to provide care on. Jetblue flight when no one else was available. Of course they can't check British Medical registration but they were happy nonetheless to allow care to be provided as no one else was available. No pharmaceuticals were given of course however.

</comment></comment><comment><USER4> Certainly great customer service, but also a very good business decision by the airline. With an average cost of $100k per diversion, 54 diversions cost Lufthansa ~$5.4m annually.

With a conservative 40% of urgent cases being treatable under the Doctors on Board program, that's a $2.16m saving.

Cost of such a program is next to negligible - airlines spend hundreds of $ per flyer per year marketing in various ways to frequent flyers. A €50 discount voucher per flyer certainly won't break the bank.

</comment><comment><USER5> My friends family got stuck with a very sick child on the other side of the world and needed to go home. They managed to raise the funds needed amoung friends and family and used this plane conversion to get safely home. Im very grateful this can be done and I don't want to think about what could have happened if it didn't.

</comment><comment> ryan-c Interesting. I was on a Lufthansa flight last week and they had a call asking for a doctor/emt/paramedic on the PA, however the flight was not diverted. I'm not sure what happened. This was on an 11 hour SFO-FRA flight.

<comment><USER6> Same thing happened to me (LH 0455 25 DEC) -- maybe we were on the same flight?

It was an older passenger about 5 seats across from me in Premium Economy. He looked to be having some kind of illness, age, or pre existing condition difficulty, not anything I could deal with (I know trauma care reasonably well from SF medics and working in a hospital, and some dive medicine stuff, but do t have any certification beyond first responder stuff), so I didn't do anything.

I was fairly surprised there were no medical people on the flight. I did notice some of the flight crew checking in on him periodically, and he seemed to de-plane normally, wasn't met with an ambulance, etc.

</comment></comment><comment><USER7> They should also start caring about their basic comfort. I am 1.90 and had to take 12 hour flight with them. The seats were so close to each other so I could barely walk after the flight after we landed. I believe adding more and more rows of seats is really absurd.

<comment><USER8> Everyone says this, and yet everyone buys the cheapest ticket at the most convenient time. If consumers cared enough to pay more for better seats, they would have paid extra for the airlines with better seats. They didn't.

<comment><USER9> I think a big part of the problem is that it's not obvious which airlines have better seats. If I run a search on Kayak (or similar) I can easily find the right combination of price and time that I need. But short of selecting a higher class it's not clear which of the airlines will have wider seats or more legroom. There is no way to sort by these criteria. Sure, you could do some research to figure this out, but most people won't have the time or knowledge to do that.

If anyone does build a airline shopping site that does offer the ability to compare flights based on comfort I will gladly start using it exclusively.

<comment><USER10> Probably 1/3 of the time I travel from YVR I am put on a plane with a different tail than the airline I booked through. I pay for "Air Canada to SFO" but end up getting a United flight. So I've given up trying to figure out exactly which airline I am flying with.

(I actually really really hate air canada for this. I keep forgetting that I need to go to the united checkin at SFO, not the Air Canada desk which is 11 billion footsteps away at the other end of everything.)

<comment><USER11> At least on the case of Air Canada and United, that's code-share flights. If you book via the Air Canada website it's very very obvious whether you're taking a real AC plane or not, but third party booking sites tend to hide that.

In case it helps, the United code-share flights are numbered AC[345]\d\d\d.

<comment><USER10> The information is there, although in different placed depending on which website is used. I just have to remember to check the fine print, at least when I am the person actually booking the ticket. When i'm not, then I have to check the boarding docs for the little "operated by" tag. The whole scheme is not something you expect from a supposedly national airline like AC.

I've also had this happen with Alaska and United.

</comment></comment></comment></comment></comment></comment><comment><USER12> They dont see too bad when I was with them but interestng read</comment>


HN: Check out my Arduino Project - An Ultrasonic Hat - <AUTHOR> http://www.blendedtechnologies.com/how-i-created-a-haptic-ultrasonic-range-finding-hat/234

<comment><USER2> This deserves more attention than it's gotten - very cool stuff.

<comment><AUTHOR> Thanks. It was a fun project.</comment></comment>


Ask HN: What single most important piece of information did I miss? - <AUTHOR>

Hi all
Been to Thailand for 3 weeks and promised my self to stay away from HN.
So the question now is:
What single most important piece of information did I miss (if any)? <comment><USER2> <http://news.ycombinator.com/best>

<comment><USER3> Sadly while "Android Now Ported On The iPhone" got the most points here, it's far from the most important tech story of the last 3 weeks.</comment></comment>


Ask HN:Ideas for an easy service/SaaS to reverse engineer to profit - <AUTHOR> I am an experienced full-stack engineer with a great career and I am looking to build something to generate income.
I am not looking for large income I currently own anime streaming website which is 3 months old with 6k users a month using server-side rendered react and Kubernetes with micro services to do jobs for the app. The app is young and doesn't generate any income yet and I want to move on to a different type of project while the anime app is growing.<p>I would love to hear suggestions from you guys. <comment><USER2> Maybe I'm reading your question wrong, however:

Reverse engineering someone else's work for profit seems lazy, asking help deciding _who_ to rip-off seems extremely lazy.

Have you considered doing something interesting/useful with your life?

<comment><AUTHOR> Maybe I should have explained better. I am not looking for some original ideas to copy. More like some common service where there is a lot of competition anyway. Besides, you can bring a service to a local market or provide a better experience more features and so on. Just looking for a base. I see your point of view well but considering that you see duplicates of the same thing all over the place is real there is no shame in starting as a copy and becoming better.

<comment><USER2> Fair enough :D

When I lived in China, I inadvertently ended up running a VPN service. It started because I needed a connection out of China myself and ended up getting more and more customers because I was proactively keeping the connections across the great firewall alive.

I guess a VPN service would qualify: easy to start, already quite a bit of competition, up to you how you'll set yourself apart from said competition ;) Good luck!

<comment><AUTHOR> I have been thinking about it lately, though I didn't look up the whole infrastructure of how VPN works in detail. It seems like a solid idea with proper user experience and good resource management it can be very profitable.

</comment></comment></comment></comment><comment><USER3> This was just on here a few days ago:

[https://training.kalzumeus.com/newsletters/archive/validatin...](https://training.kalzumeus.com/newsletters/archive/validating_product_ideas)</comment>


A Superconductor That Works at -70 °C - <AUTHOR> http://www.technologyreview.com/view/542856/the-superconductor-that-works-at-earth-temperature/ <comment><USER2> This is pretty huge. The last major break thru was getting superconductivity in Y1B2C3O at liquid nitrogen temperatures (-200 C) back in the 1980s. I worked in a lab with the discoverer of this phenomena, Dr. Paul Chu.

While -70 is still damn cold, it should be achievable a lot more cheaply than having to cool things with LN2, so hopefully-- cross our fingers-- this will lead to the breakout of superconductivity into broad industrial use (and maybe the mainstream consumer market) that people have sought for decades.

BTW- while in that lab I used a variation of the meissner effect to design a memory circuit that was theoretically buildable at the time- static RAM that was superconducting. (and basically, the essentials of a transistor were there so logic gates could be built from super conductors, that was the thought experiment I was doing.)

Since heat is a major concern in CPUs, the ability to be superconducting (and thus producing no heat) would be a huge boon for computation. Of course initially this wold be at scales much larger than current lithography and thus only for specialized applications. But who knows.

With effort the cost of keeping a CPU at -70 should come down dramatically the way battery capacity per dollar has... or dare we hope the way flash density has.

<comment><USER3> > Since heat is a major concern in CPUs, the ability to be superconducting > (and thus producing no heat) would be a huge boon for computation.

But (if the superconducting transistors worked like current CMOS, which is a big if): While there would be no power draw or heat dissipation at steady- state, there would still be some when gates switched, correct? And if so, you could still wind up with pretty significant heat dissipation...

<comment><USER4> I thought most of the heat nowadays is created by leakage. The rest by the semiconductor. Not sure how a superconductor would help here.

<comment><USER5> SQUID devices can be made switchable by the presence of an applied magnetic field, if I recall correctly. So you could build your superconducting computer entirely out of superconducting components.

</comment></comment></comment></comment><comment><USER6> For low values of "earth temperature". Apparently, when hydrogen sulfide gas is compressed to very high pressures and cooled to -70C, it becomes a superconductor. That's an interesting physical phenomenon, but lots of materials have unusual physical properties under extreme pressures. Chemicals can be forced into a crystal lattice even when they don't stably bond that way.

Still, it's a new data point. Maybe someone will find something that's both stable under standard conditions and superconductiong.

<comment><USER7> Plus, at that temperature, you can easily keep the conductor cooled with frozen CO2, which is pretty easy to produce / readily available.

<comment><USER8> Thermoelectric cooling ([1]) can reach such temperatures, which will not require any gas consumables. However, it could be more energy-efficient to cool with CO2. I have not done math for that.

1\. [https://en.wikipedia.org/wiki/Thermoelectric_cooling](https://en.wikipedia.org/wiki/Thermoelectric_cooling)

<comment><USER9> Most biology labs have a -70C or -80C freezer (or several) in their lab. As far as I know, they work the same way as the freezer in your kitchen. Since they're so widespread, I'm assuming this is probably the most economical way to achieve temperatures of -70C. But that might change depending on what volume needs to be cooled to that temperature.

<comment><USER10> Funky refrigerants...

The following has an evaporator temp of -96C to -73C, and a condensing temp of -29C.

[https://www.chemours.com/Refrigerants/en_US/assets/downloads...](https://www.chemours.com/Refrigerants/en_US/assets/downloads/h53011_Freon23_for_vlt.pdf)

If you scroll down in the PDF you can see a comparison with R-503 and R-13, two other low temp refrigerants.

But you can't just put that in a normal refrigerator.

</comment></comment></comment></comment></comment><comment><USER11> For information, this "news" is two months old. One of the multiple articles on this: [https://www.newscientist.com/article/dn28058-warmest-ever- su...](https://www.newscientist.com/article/dn28058-warmest-ever- superconductor-works-at-antarctic-temperatures/)

</comment><comment><USER12> Note that hydrogen sulfide is in the realm of hydrogen cyanide in terms of toxicity. (Unfortunately, Wikipedia doesn't have comparable LC50 times for humans, but for H2S we're talking 600 ppm for 30 min and HCN is 357 ppm for 60 min.)

We're unlikely to see high-pressure H2S lines running through residential neighborhoods any time soon.

<comment><USER13> Hydrogen sulfide is in farts. About one percent, if I recall correctly? "Silent but deadly" indeed.

<comment><USER14> If you were sitting in a room of 100% pure fart, pretty sure you would die.

<comment><USER15> Signs are on it: [http://www.bbc.com/news/uk-northern- ireland-27754408](http://www.bbc.com/news/uk-northern-ireland-27754408) .

</comment></comment></comment></comment><comment><USER16> To my untrained eye, the Meissner effect appears to be the most obvious connection between the previous high-temperature superconductors and this finding.

If intense pressure causes superconduction, then perhaps the Meissner effect is a manifestation of the same phenomenon. If the Meissner effect expels magnetic fields from the material, then perhaps this effect also causes the material itself to be compressed physically in response, or something like that.

Disclaimer: I know nothing about superconducting physics, but I did stay at a Holiday Inn Express last night.

</comment><comment><USER17> How come physics can't predict the warmest superconductor?

<comment><USER18> Disclaimer: I'm a physicist but have no expertise in solid state physics. I remember when the whole high-Tc thing started. My recollection is that the discovery broke what was at the time considered to be the mainstream understanding of superconductivity. And, a more comprehensive and satisfactory theory has not yet emerged. As a result, we're in a sort of tortoise-and-hare race between theory and experiment, where each one advances a bit when the other one catches up and makes a new discovery.

<comment><USER19> Disclaimer: I'm (technically) an engineer, not a physicist, but I took a course on this back in uni, and as far as I can remember, you're correct. The gist of it is that BCS theory, which satisfactorily explains conventional superconductivity, fails to predict the behaviour of high-temperature superconductors, and there simply isn't a better model available at the moment.

For any sane individuals reading this, the answer is "We're trying really hard but so far we haven't been able to deduce a formula for the highest temperature."

I'm not very optimistic with regards to this ever happening. I remember reading a paper regarding one of the many high-temperature superconductors, BSCCO; it has a crazy crystaline structure, it's quite unlikely that we'll ever come up with an analytical model describing its superconductive behaviour.

</comment></comment></comment><comment><USER20> If we could run a CPU with no heat generated, what limits the clock-speed? The speed of the electric potential-change in the conductors?

<comment><USER21> > If we could run a CPU with no heat generated

Nitpick: not much heat generated, but not _no_ heat. There are fundamental lower bounds on the entropy increase caused by doing irreversible computations (Landauer's principle), superconductors or no superconductors. TAANSTAAFL: the universe won't let you compute for free.

As for what limits the clock speed: for one thing the speed of light - information still has to get from one part of a CPU to another.

</comment></comment><comment><USER22> -70C is above the dry-ice sublimation point, though just barely, so perhaps not enough to be useful; another 10C and it really could be.

<comment><USER23> There is no dry-ice necessary. You can cool something down to -70C and lower with a freezer as used in biology or medical labs. Such a freezer isn't even that fancy, they look and afaik work pretty much like the household appliance variant.

</comment></comment><comment><USER24> What do you guys think of these room temperature (and above) superconductors?

[http://www.superconductors.org/400K_SC.htm](http://www.superconductors.org/400K_SC.htm)

</comment><comment><USER24> This was actually known for at least a year:

[http://www.superconductors.org/sulfhydr.htm](http://www.superconductors.org/sulfhydr.htm)</comment>