Unified access to the best community-driven cheat sheets repositories - <AUTHOR> https://github.com/chubin/cheat.sh <comment><USER2> I like the idea, and think it has potential, but…

The search engine is not great. The tutorial gives the example of searching for "execute+external+program". Change "program" for "command", you're OK. Change "execute" for "run"and it bombs. For something that simple, this causes doubt that if I were to look for a solution to a problem in a language I was learning and it bombed, is the fault with cht.sh, or with me? Does the language even let you do that? I've have to run towards my browser to find out.

Also, the big advantage Dash has over this, and of course local generated docs (like Go's doc server et al), is that they are local. No network needed. I can be productive when offline, and when coding I often like to try and go offline. It's also faster, and for some docs I can even search a little with grep which I already remember. I can also get integrations with my editors, etc.

It's a great idea, I like it, and I think it has a niche, but it needs more synonyms in that search engine, and perhaps some integrations to make it a little more accessible to the workflow.

<comment><USER3> I agree about the search engine.

I'm a big fan of Dash, but Dash is currently built around _documentation_ rather than cheat sheets. If someone loaded up Dash with a bunch of cheat sheets, that would be really handy.

<comment><USER4> Dash absolutely has cheat sheets.

<comment><USER3> Holy cow! There's a whole category for them. How did I miss that?

</comment></comment></comment></comment><comment><USER5> Similar project: Bro pages, like man pages but short examples of common use cases instead of extensive documentation.

[http://bropages.org/](http://bropages.org/)

<comment><USER6> Thanks for the tip on that, bro! That will really come in handy.

<comment><USER7> I think tl;dr pages[0] might be more popular, on a similar topic

[0] [https://github.com/tldr-pages/tldr](https://github.com/tldr-pages/tldr)

</comment></comment></comment><comment><USER8> I enjoy cheat sheets as much as the next person but I think folks are missing out the key element that there's significant benefit in making them yourself.

<comment><USER9> Yes, writing it down.

<comment><USER10> you _learn it_ by writing it down.

<comment><USER11> The act of writing down your own cheat sheet helps you to learn it.

<comment><USER12> It seems like the chain of four comments starting with Quequau's ([https://news.ycombinator.com/item?id=17505892](https://news.ycombinator.com/item?id=17505892)) and ending with superflyguy's ([https://news.ycombinator.com/item?id=17507512](https://news.ycombinator.com/item?id=17507512)) mean to disagree, but actually wind up agreeing. Is that correct, or is there some subtle distinction among them that I'm missing?

<comment><USER13> It's the nature of the medium being text-based.

FWIW, I didn't parse each of the nested comments as disagreeing, more like using their individual experiences to elucidate the point of the person they responded to.

<comment><USER11> Mine was me observing the similarity of the previous two. If there was any difference there then it was too polite/subtle for me.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> Instead of investing in out of band resources like this, I really wish people would just contribute improvements to the upstream documentation, which is usually more comprehensive and up-to-date than any of these resources can be.

<comment><USER11> No, I don't agree. Git has great documentation but if you want to know how to use it you either spend 15 minutes reading the relevant part of the big free book or you Google for a cheat sheet. Same goes for vim. I don't know why but some people are satisfied with documentation which, although not incorrect, only makes sense when you already have a substantial understanding of the topic at hand.

<comment><USER14> Nonsense, you can also read the man pages, and if any of these resources are insufficient you should spend any time you would have spent writing a cheat sheet contributing improvements to the actual resources - the documentation is an open-source community project as much as the project itself is.

<comment><USER11> Sounds like a bit of a waste of time to me. What are the odds Linus is going to update the git documentation with my list of handy shortcuts? He'll just swear at me. I don't think the official documentation is the place for it; not now it's been written the way it has. I'm happy with the book + my notes on gitlab.

<comment><USER14> Well, for one, Linus isn't the current maintainer of Git. It's currently Junio C Hamano <email@example.com>, someone whose main responsibility in open source is looking after git, who has the time and inclination to review your contributions thoughtfully. Have you ever actually read a git man page? Or do you just get all of your git knowledge from scattered blog posts and cheat sheets? No wonder people think git is hard. Read a random git man page right now and you'll find it quite pleasant to read and containing a plethora of useful information.

</comment></comment></comment></comment></comment><comment><USER15> I like it. I also like the feature 'Freak_NL pointed out - quick memory- jogging examples for a command.

Speaking of those top-level queries, I've noticed some of them are reported as unknown, even though they then are suggested. Observe:

      temporal@galactica~> curl cht.sh/lisp
      Unknown topic.
      Do you mean one of these topics may be?

          * lisp/ 100
          * elisp/ 89
          * alias 67

Changing the URL to cht.sh/alias correctly gives a list of examples, while lisp and elisp are always reported as unknown. My guess is, something somewhere is storing those tokens with forward slash in the name, whereas the HTTP handling code strips it out from request.

EDIT: [https://github.com/chubin/cheat.sh/issues/32](https://github.com/chubin/cheat.sh/issues/32). I need to kick the habit of writing HN comments first, then bug reports later :).

</comment><comment><USER16> I like how this gives me access to succinct example usages of tools just enough to get me going or to jog my memory for how a certain tool works — without having to resort to using a browser and a search engine.

        curl cht.sh/find
        curl cht.sh/sed

Like these.

<comment><USER16> If you're wondering where this tool gets its data from, have a look:

[https://github.com/chubin/cheat.sh#cheat-sheets- sources](https://github.com/chubin/cheat.sh#cheat-sheets-sources)

</comment></comment><comment><USER17> There's also a cheat sheet built into nearly every computer - it's called man pages.

<comment><USER18> This is true but they are often long and complicated and aren't always conducive to quick solutions or refreshing memories of a useful combination of arguments.

It is good to have both.

<comment><USER17> That's true. However I often encounter co-workers refusing to read man pages, because they _only_ want to see a cheat sheet. They end up endlessly wandering Stack overflow and google for hours instead of spending 5 minutes going through the actual manual.

</comment></comment></comment><comment><USER19> I like this (I find brief documentation with worked examples makes it a lot easier for me to understand most things), but I've just had a look at the python lambda one which is served up by curl... and it has some errors in it. Followed the instructions on how to edit it, forked it, and... the version I went to edit has the two changes I thought needed doing already done (3 hours ago)! Pity, my first chance to contribute to a project (early-learning level python student in my mid 40s)!

It does beg the question when do the curl versions get updated?

</comment><comment><USER20> Similar project: [http://tldr.sh](http://tldr.sh)

<comment><USER21> > Instead of creating yet another mediocre cheat sheet repository, we are > concentrating our efforts on creation of a unified mechanism to access > selected existing well developed and good maintained cheat sheet > repositories covering topics of our interest: programming and operating > systems usage.

[https://github.com/chubin/cheat.sh](https://github.com/chubin/cheat.sh)

</comment></comment><comment><USER22> Is the dropdown at [https://cht.sh/](https://cht.sh/) a little sluggish in chrome for everybody?

<comment><USER23> Yes, it is not good, we are working on the new frontend.

I can give a link to it to you if you want, but not here, because it will not handle the load that comes after that; just write me a mail if you want to test it.

Everybody who reads this and what to help testing the new frontend write an email to me I will share the link with you.

<comment><USER22> Do you know what's causing it?

</comment></comment></comment><comment><USER24> The output seems to be optimized for people with dark background color on the xterm.

Is there a possibility to have a different color scheme?

<comment><USER23> Yes

curl cht.sh/:styles-demo

select the best style for you, and use it in the queries.

curl cht.sh/:help

for more info.

Also, use the special client cht.sh which supports persitent configuration and many other useful features.

<comment><USER24> Thanks, that helps.

</comment></comment></comment><comment><USER25> Wait, in stealth mode it's listening for any text selected, even in other programs? This is a bit mind boggling - what's to prevent any program listening to any other (like a password manager for example)? Is this sort of access not prevented by an accessibility permission?

<comment><USER26> This is how traditional desktop operating systems work... some things require admin rights but most stuff is indeed fully accessible to any application.

</comment></comment><comment><USER27> This cleverly one-ups [http://bropages.org/](http://bropages.org/) by leveraging an existing command in the environment you are most likely to type "bro curl", but you don't need to install a tool first.

</comment><comment><USER28> I give it five minutes before this is on all the plagiarism checker of all those "coding challenge" sites recruiters/HR love to throw out in pre- interview screening...

</comment><comment><USER29> This is not working at all for me. I keep getting HTML & CSS vomit regardless on whether I use their command line tool or curl.

<comment><USER30> What user agent string is your curl request sending out?

I think it does user agent checking to decide whether to send out a shell escaped version of the page or one with traditional web markup because when I make a HTTP request with one of my other CLI HTTP clients it only sends shell output if I send curl's UA.

</comment></comment><comment><USER31> Wow I love the idea. Will try it out today. Could be a time saving pal when switching to topics you are not working on every day.

<comment><USER32> How is it better than google

<comment><USER33> Can you quickly find cheat sheets in a similar style to one another via google? Some people prefer to stay in their commandline as much as possible, too.

</comment></comment></comment><comment><USER34> Weather wttr.in

</comment><comment><USER35> Any way or how to self hosting ?

</comment><comment><USER36> Would be nice to have an alfred or vscode plugin

</comment><comment><USER37> getting a bit long for a cheetsheet

      curl cht.sh/js/foreach

<comment><USER23> It depends on topic + you can use the ~ notation to extract only parts of the cheat sheet. Check README on Github for that (or curl cht.sh/:help)

</comment></comment><comment><USER38> Works fine. Nice idea.

</comment><comment><USER39> Not very respectful of [https://github.com/chrisallenlane/cheat](https://github.com/chrisallenlane/cheat) to use the same name.

The original cheat does exactly the same thing, has a big following and more stars, and has existed for years.

I've opened an issue re: the name conflict [https://github.com/chubin/cheat.sh/issues/34](https://github.com/chubin/cheat.sh/issues/34)

Afaik these are the big players in the space: \- bro: [https://github.com/hubsmoke/bro](https://github.com/hubsmoke/bro) \- tldr: [https://github.com/tldr-pages/tldr](https://github.com/tldr-pages/tldr) \- cheat: [https://github.com/chrisallenlane/cheat](https://github.com/chrisallenlane/cheat)

<comment><USER23> We are of course aware of the beautiful cheat project and we even use it (what is documented in our README.md file), but please keep in mind that:

1\. Our project is called cheat.sh and not cheat (for example xterm.js and xterm are two separated projects and xterm existed for decades before xterm.js; should they be renamed too from your point of view?);

2\. We are trying to mitigate the impact by using cht.sh where possible;

3\. We do not and did not ever use the name to steal, to borrow, or to somehow use popularity of cheat.

I do not see any naming conflict actually. The client/command is called cht.sh, does not even have cheat in their name.

I am a big fan of the cheat project myself, and I don't want to do any harm for it. Even more, as I said, I would prefer that we cooperate with that project.

<comment><USER39> The reasoning boils down to Google-ability.

sh is not a distinct enough term when googling for shell suggestions, because both cheat and cheat.sh will have sh in the results. That is very distinct from xterm.js where xterm-only results are very unlikely to have JS in them.

A similar debate played out when the gofish package manager was launched, which conflicted with the fish shell [https://github.com/fishworks/gofish/issues/37](https://github.com/fishworks/gofish/issues/37)

Anyway, the choice is not mine to make, it just seems like an easy issue that could have been avoided by choosing a name that wasn't already in use.

</comment></comment></comment><comment><USER40> It is interesting to see how the title effect number of upvotes and comments. I've submitted this other day and it did not get any upvotes. My submission: [https://news.ycombinator.com/item?id=17471476](https://news.ycombinator.com/item?id=17471476)

<comment><USER41> Yes it's called "marketing" and it has a huge impact on initial perception.

Consider each of these and think of which would catch your eye enough to click it, read about it, then come back and upvote it:

* Meta cheatsheet

* The only cheat sheet you need

* Cheatsheet.sh

* Cheat Sheetah

* Unified CLI Cheetsheet

People gaming the title is the reason for the rule that the title has to match the actual linked article. Though if you're the creator of the content that's not an issue as you can title it at the source however you want.

<comment><USER42> Also that "Meta cheatsheet" sounds like a cheatsheet for something called "Meta", and not being familiar with any such technology, I wouldn't be curious about a cheatsheet.</comment></comment></comment>


2 Actionable Habits to Grow Wiser - <AUTHOR> https://medium.com/@yonishechter/2-actionable-habits-to-grow-wiser-a768140f33a2

<comment><USER2> Not convinced about point 2. A kind of internal silence that's not always questing for more knowledge has importance as well.</comment>


Is the Cure Killing Us? How History Can Help Us Rethink Our Covid Response - <AUTHOR> https://www.peterhaas.org/is-the-cure-killing-us-how-history-can-help-us-rethink-our-covid-response/ <comment><USER2> My opinion is that the article is misguided in many ways.

1\. A viral pandemic is very different than a major fire.

Fires are visible and generally localized. To compare viral infections to fire catastrophes as equivalent is not understanding the exponential way infections spread -- in this era, it's global and cannot be localized. A better analogy is like if a city caught on fire, and anyone who tried to run away from that city carried the fire to where they went. The non-visible nature of it makes it hard for people to understand compared to a hot, visible flame.

2\. A flawed comparing number of deaths and other cases of undesirables.

Take for example, the estimated number of deaths due to drug overdose, which a majority percentage are opioids: ~70k in 2018 [1], a whole year. The normal flu death estimates on the high end are 60k in 6 months[2]. Covid-19 deaths are estimated at ~90k as of today, starting April 14, 2020. That's ~90k deaths in 1 month. Let's be generous and say covid-19 in the US started in end of February; that's still less than 3 months.

We are living out 1 year worth of deaths due to a single cause in two-ish month. And it will continue for at least several months.

Is the current cure killing us? A lot slower than if we didn't act, inferring from the numbers above. What action would you take otherwise and not knowing the information we know in these short 2.5 months? If California didn't act early, if Washington state didn't act early, the rest of the country would've been infected far worse than it currently is due to all the travel and commerce that happens. Imagine a situation worse than it currently is!

Is it better to trade this covid curves for other curves? From an overall population standpoint, yes it is, the sheer quantity and magnitudes are completely different. Someone's carrying fire, and it's not always clear who's carrying that fire, ready to burn cities and towns down.

Is the blanket response SIP orders reasonable? This one is less clear, but on the whole, yes, it's reasonable - most people don't critically think to survive these days. If they did, a lot of things in our country would be different...

It would've been better had all of us been prepared with masks and having stock piles of supplies ready. It's a small lesson out of many the US and citizens should take out from this situation.

Take some time and ask oneself now -- if you went out, caught the coronavirus, then hung out with your parents, and one of them could die, how much money would you spend to get them out of the danger zone? Does money even mean much in that scenario?

[1] [https://www.cdc.gov/drugoverdose/data/statedeaths.html](https://www.cdc.gov/drugoverdose/data/statedeaths.html) [2] [https://www.cdc.gov/flu/about/burden/preliminary-in- season-e...](https://www.cdc.gov/flu/about/burden/preliminary-in-season- estimates.htm) [3] [https://www.cdc.gov/coronavirus/2019-ncov/cases- updates/case...](https://www.cdc.gov/coronavirus/2019-ncov/cases- updates/cases-in-us.html)

</comment><comment><USER3> This article repeats what I've been saying for months, but will help provide context for people who don't study history, or who didn't live through previous disasters like SARS-1, etc.

The response to date for SARS-2 will be laughed at for centuries.

Non sequitur is a word to get familiar with:

Non sequitur: The argument itself could have true premises, but still have a false conclusion.

In the case of corona, yes it's fatal to a very small percentage of people, but vaporizing the US economy when we don't have nearly adequate testing, tracing or vaccines for a highly infectious disease makes no sense, aside from the political optics of "I tried to do something, so re-elect me."

I would argue we have dishonored those who died from corona by also tanking our economy, for no benefit.

[https://en.wikipedia.org/wiki/Formal_fallacy](https://en.wikipedia.org/wiki/Formal_fallacy)

If you think I'm being cynical about politicians, it turns out the Falkland War was solely about Thatcher getting re-elected - residents of the Falklands aren't British citizens. (Now it turns out there's massive oil and gas fields there, so it worked out fine for Britain.)</comment>


Exposé is very cool, but why can't I also search for a window using keywords? - <AUTHOR>

You could for example search by keywords in the titles of windows. <comment><USER2> Good idea and I think it would work for Spaces too. Probably possible to build yourself with Automator. Related feature I want to see: focus-follows-mouse.</comment>


Launch HN: Kanaree.io – Liberate your clickstream data - <AUTHOR> https://kanaree.io <comment><AUTHOR> Hi everyone,

Today we are rebranding and relaunching a clickstream data tool called Kanaree.io. Now, you're probably wondering why this one is any different than the others that are out there. It's a fair question. With Kanaree you KEEP your data. Kanaree does not house data. The platform was built to funnel your clickstream data into YOUR data warehouse. More information at Kanaree.io!

</comment><comment><USER2> Checkout Kanaree.io it is the real deal for building out eCommerce data warehouses</comment>


Single Board Computers Introduced in 2017 - <AUTHOR> https://www.eetimes.com/document.asp?doc_id=1332763 <comment><USER2> To save others the pain of EETimes' annoying ass ad exploits:

      1. Raspberry Pi Zero W -- $10
      2: Asus Tinker Board -- $54.99
      3: Marvell Espressobin -- $79.99
      4: 96Boards HiKey 960 -- $239.99
      5: PINE64 Rock64 -- $24.95
      6: Orange Pi R1 -- $13.90
      7: MYIR MYS-6ULX -- $24.80
      8: LeMaker Banana Pi Pro -- $47.99
      9: LattePanda -- $209
      10: Sparkfun BBC micro:bit -- $17.50

<comment><USER3> Micro:bit seems a bit expensive when you compare its features with the other options.

<comment><USER4> I think it's intended as more of an all-in-one board for the educational purposes (specifically educating children, I believe). It has a couple of buttons, an LED array (basic display and light sensor), compass, temp sensor, an accelerometer and some edge pins that you can use alligator clips with. It might not be the best and/or most affordable platform for general purpose stuff but I can't be certain as I've only used it for teaching kids how to program.

</comment></comment></comment><comment><USER5> BeagleBone Blue was also released for sale this year, [https://beagleboard.org/blue](https://beagleboard.org/blue)

> BeagleBone® Blue is a complete, Linux-enabled robotics computer. Community- > supported and fully open-source, the real-time performance, flexible > networking and rich set of robotics-oriented peripherals make building > mobile robots quick and affordable.

Unlike the Raspberry Pi line of single-board computers, the BeagleBone line is completely open source and permissively licensed. The design files for Blue are at [https://github.com/beagleboard/beaglebone- blue](https://github.com/beagleboard/beaglebone-blue)

UC San Diego is developing coursework based on the Blue, [https://www.ucsdrobotics.org/](https://www.ucsdrobotics.org/)

<comment><USER6> Wasn't sure what made the BeagleBone Blue variant variant good for robotics until I read about the 8 servo drivers and 4 DC motor drivers built into the SBC! That's going to be really handy for lab robotics projects. Buying a servo hat for Raspberry Pi's or wiring up my own driver chips for one off projects has been annoying. Thanks!

Question, do you know if the UCSD course is using the PRU's and/or porting ROS to the PRU's? That'd be really excellent.

And of course there's the Pocket BeagleBone [1] that was released this year. I just preferred 4 for prototyping, primarily since they have the onboard dual 200 mhz real-time processors, are in stock, and have really good support and design specs.

1: [https://beagleboard.org/pocket](https://beagleboard.org/pocket)

<comment><USER5> Unfortunately, I'm waiting on the publication of the MOOC and course materials to find out.

It looks like the latest book, "BeagleBone Robotics Projects, 2nd Ed", [https://www.amazon.com/BeagleBone-Robotic-Projects-Second- co...](https://www.amazon.com/BeagleBone-Robotic-Projects-Second- control/dp/1788293134/), came out in June and I haven't had a chance to look through it. The 2014 book, "Mastering BeagleBone Robotics", by the same author walked through multiple robotics examples implemented using Python and didn't involve the PRUs. Using only Python, there were examples of a rotary aircraft, fixed wing aircraft, sailboat, wheeled vehicle, and computer vision tracking.

My understanding is that TI only recently began improving the PRU documentation to make it more accessible and that Code Composer and other tools TI has created for working with the PRU are maturing slowly. I've never tried using it. Here's the PRU page on the BeagleBone wiki: [https://elinux.org/Ti_AM33XX_PRUSSv2#C_Compiler](https://elinux.org/Ti_AM33XX_PRUSSv2#C_Compiler)

Another thing I've never tried, but that might be of interest to HN readers, is the Nerves project for Elixir development on single board computers including BeagleBone Black. [https://hexdocs.pm/nerves/targets.html](https://hexdocs.pm/nerves/targets.html)

</comment></comment></comment><comment><USER7> How do people deal with the software side of these boards? AFAIK, Raspberry Pies are the only ones with good support, plus there are a few boards that have Tier 1 support on NetBSD. The rest seem too risky to rely on if you don't want to live with vulnerable kernels after a year or two.

<comment><USER8> There are a number of Freescale and NXP SBCs that have good software support (including Mbed support, Yocto recipes and Github kernel repos), but they don't catch the interest of hobbyists like these other boards do.

</comment></comment><comment><USER9> I've been looking for a SBC with at least 2 gigabit Ethernet ports to use as a router, firewall, and netflow generator on my home network.

I almost bought an Espressobin, but English-language websites only had the 1GB version and I just couldn't figure out Taobao to try and order the bigger one.

At this point I'm probably going to get a PC Engines APU 2 board, which is a quad-core AMD Geode processor w/ 4 GB of RAM. I can get it with a 60GB mSATA drive, a case, a wifi miniPCI board, and all the wiring for external wifi antennas for $243 shipped. That's a little steep but the other advantage is that the x86-64 architecture should make OS support easier, unlike all these little ARM boards that get one hacked-up kernel release and no updates after that.

<comment><USER10> You may be interested in UBNT's ERLite 3. It runs a fork of VyOS on MIPS, and is a really nice product. I'll never build my own network box again (and pfSense has ceased to exist in my universe).

<comment><USER11> I came here to say this! There is also a newer (cheaper) ERX, but some of the specs are not as good.

</comment></comment></comment><comment><USER12> 1\. Terrible website, Safari complains about unsafe form submit attempts on every page.

2\. They omitted at least

* nanopi neo2 (my favourite). 40x40mm Allwinner H5 (4 cores A53), gigabit Ethernet.

* nanopi A64, 64x60mm Allwinner A64.

<comment><USER13> 1\. Same on Firefox and Edge.

It would have been nice to see the updated version of the C.H.I.P. Pro from Next Thing on the list. It's a fairly capable board at a good price, and it's more open than the Pi and other ARM boards.

[https://getchip.com/pages/chippro](https://getchip.com/pages/chippro)

The Intel Atom board looks like a good foundation to build a customized portable computer; AFAIK there's no IME mess involved and it can run pretty much any Linux or BSD OS out there. I'm thinking it would make a great base for a portable OpenBSD machine.

</comment></comment><comment><USER14> What? No mention of the single board relay computer?

[http://relaysbc.sourceforge.net/](http://relaysbc.sourceforge.net/)

I sold 8 fully assembled computers and 20 bare boards in 2017.

<comment><USER15> Wonderful! Thank you for showng us.

</comment></comment><comment><USER16> For anyone looking for cheapest SBC. Best I've found was Orange pi zero at $6.99 for 256mb version. That includes wireless wifi onboard.

I'm not affiliated with them in any way. They can be found at their official aliexpress shop.

<comment><USER17> Be advised that Orange Pi have many different boards with similar names, but vastly different specs. The $6.99 model is for 256MB RAM and a Allwinner H2 chipset.

Also a lot of the boards can only be powered by a DC jack, not the onboard MicroUSB.

<comment><USER18> _> Be advised that Orange Pi have many different boards with similar names, but vastly different specs._

How is this any different than the general SBC market? You could make the same point about the "Raspberry Pi" which has:

* Raspberry Pi model A/B

* Raspberry Pi 2 model B

* Raspberry Pi 3 model B

* Raspberry Pi Zero

* Raspberry Pi Zero W

 _> Also a lot of the boards can only be powered by a DC jack, not the onboard MicroUSB._

Almost all boards can also be powered via 5V GPIO pins, so you can wire a DC jack to that to avoid using micro USB.

<comment><USER19> Yes, the Raspberry Pi models are a little confusing, especially with the '+' versions and PCB-revisions. But I don't think the purpose of the parent comment was to say that it was worse than others, more of a heads-up to someone looking to order a model to take a second look and verify the specifications.

</comment></comment></comment></comment><comment><USER20> All on one page for those that hate the "here's a picture with some text, now click 'next' 10 more times so we can artificially boost our page views" approach: [https://www.eetimes.com/document.asp?doc_id=1332763&print=ye...](https://www.eetimes.com/document.asp?doc_id=1332763&print=yes)

It's not mobile friendly (viewport issues) but if you use reader mode in it becomes great.

</comment><comment><USER21> Checkout the fitlet2 for those wanting an Intel J3455[0] based platform.

I'm waiting for stock to show up at Amazon so I can upgrade my pfSense machine.

[0] [https://fit-iot.com/web/products/fitlet2/](https://fit- iot.com/web/products/fitlet2/)

<comment><USER22> I thought Intel were getting out Atom chips. I'll be looking to upgrade my C2758 NAS at some point - maybe there's some hope after all.

<comment><USER21> Intel is pouring fuel on the fire for the C3000 chips with features like 2x 10 Gbps network interfaces on the SoC.

Checkout SuperMicro's C3000 offering: [https://www.supermicro.com/products/nfo/atom.cfm](https://www.supermicro.com/products/nfo/atom.cfm)

<comment><USER22> For some reason the SOHO / lower end SuperMicro gear is almost impossible to get in Australia.

</comment></comment></comment></comment><comment><USER23> Quick glance (click PRINT instead of 10 sub pages) and memory capacity is wrong in almost every single listing.

I expected better from eetimes (owned by Arrow, serious Fortune 500 electronic components supplier giant).

</comment><comment><USER24> I like the sound of the Pine64 ROCK64 one, with the 4k HDMI, USB3 port and 1Gbps ethernet, does anyone have that board, I'm curious how the software support is?

<comment><USER25> As one of the suckers that preordered the 4gb version, I'd strongly caution against getting one.

I've tried every OS released for it, and they're all rife with bugs producing kernel panics aplenty. This makes running the unit as headless unfeasible. I drawer'd it and replaced it with a tried-and-true Odroid c-2. Btw if you're looking at SMBs, check out dietpi.com, its well maintained and brings a world of functionality to SMBs

<comment><USER24> Thanks a lot for your reply! This is exactly the kind of thing I was worried about and is one of the reasons I do like the RPis I have so much which seem to have very decent OS support.

</comment></comment></comment><comment><USER26> I am looking for a 4k single board computer to run a cheap 4k Arch Linux i3 workstation (mainly for Vim and Chrome). Any ideas?

<comment><USER27> Something like this would probably fit the bill and be pretty fast:

[https://www.gearbest.com/tv-box-mini- pc/pp_562952.html](https://www.gearbest.com/tv-box-mini-pc/pp_562952.html) (2G ram)

(youtube reviews seem to imply ram is usually upgradeable, with laptop DDR3 sticks you may have lying around)

or just go straight to 4G ram

[https://www.gearbest.com/tv-box-mini- pc/pp_635382.html](https://www.gearbest.com/tv-box-mini-pc/pp_635382.html) (4G ram)

These are intel boxes, support linux better than most laptops, have slow SSDs (which are still far faster than normal disks, and also usually upgradeable).

They are especially far, far faster than most boards listed here, and they support a lot more software. (including portal 2 which is incredible and on sale: [http://store.steampowered.com/app/620/Portal_2/](http://store.steampowered.com/app/620/Portal_2/) )

</comment></comment><comment><USER28> Previous discussion from last week:

[https://news.ycombinator.com/item?id=15975229](https://news.ycombinator.com/item?id=15975229)

</comment><comment><USER29> The Marvell board looks pretty interesting. Would be nice to get FreeBSD or OpenBSD with pf up and running on it.

</comment><comment><USER30> I'm looking for a cheap-ass VPS setup at home. Need 2 nodes with 16Gb each. Any recommendations?

<comment><USER31> Depending on your definition of cheap, I can highly recommend the HP ProLiant Microserver - it's small (about one cubic foot), an entry level model with 16 GB RAM (without HDDs/SSDs) is about € 300-350.

I have used it as my home server for the last two years, and it has worked very well for me. Quiet, reliable. The Gen8 which runs on an Intel CPU can be equipped with a low-end Xeon, if needed, but that drives up the price accordingly.

<comment><USER29> I like the Gen8, limited to Intel Ivy Bridge at best but I have a Xeon E3-1230v2 in mine with 12GB RAM and it works great. If you can find a cheap license for iLO Advanced the remote administration is really useful too.

<comment><USER31> For the price, it is amazing how much server HP managed to cram into that little box. Mine has Celeron CPU, 16 GB RAM, runs FreeBSD, is mainly a file server (ZFS w/ 8 GB ARC) plus a few virtual machines via bhyve. The entire machine, including HDDs was about € 800,-

CPU-wise, performance is not exciting, of course, but disk- and network- performance is totally sufficient to serve a small home or office network. Which is what they were made for, I guess. ;-)

In two years, this little box has not let me down once.

<comment><USER29> I love my little microserver. I've ran Ubuntu for a while, then FreeNAS and now Alpine Linux though I've been playing with FreeBSD on my second laptop and am tempted to try running it instead. I'm already using ZFS for storage (migrated the pool between each OS).

<comment><USER31> FWIW, mine runs FreeBSD, and it has not given me any trouble. Virtualization support is present even in the Celeron GT1610, so bhyve works as well. Jails and ZFS play together very nicely.

</comment></comment></comment></comment></comment></comment><comment><USER22> This article has been here recently although I can't find it</comment>


Ruby arrays : A revision - <AUTHOR> http://techslam.net/2010/12/ruby-arrays-a-revision/

<comment><USER2> The article is actually about a _revisit_.

Lots of folks could spend similar time getting familiar with the core classes, be it just in irb/ripl (the REPL) using Object#methods, Class#instance_methods &c., using the command-line ri tool (e.g. $ ri Array) or one of the web-based doco sites: rubydoc.info, ruby-doc.org or apidock.com.

<comment><USER3> If you really want to dig into objects in irb, you should check out <https://github.com/matthew/method_lister>

It'll give you a really good idea of where all those methods on your objects come from.</comment></comment>


The 'blob', an organism with no brain but 720 sexes - <AUTHOR> https://uk.reuters.com/article/uk-france-zoo-blob/paris-zoo-unveils-the-blob-an-organism-with-no-brain-but-720-sexes-idUKKBN1WV2AO <comment><USER2> Quite fascinating, but a bit short and low on details.</comment>


Miners Aren't Friends - <AUTHOR> https://blog.keep.network/miners-arent-your-friends-cde9b6e0e9ac <comment><USER3> Can someone explain to me how on earth Ethereum is still a thing? People have lost hundreds of millions of dollars in the Ethereum ecosystem, many due to basic flaws in the "Solidity" language. For example, last November $280 million was frozen in Parity wallets because function visibility defaults to external rather than internal (see the previous HN discussion here[0]). Just for fun, I was looking through the Security Considerations[1] in the Ethereum docs, and here are two so-called "minor details":

\- In `for (var i = 0; i < arrayName.length; i++) { ... }`, the type of `i` will be `uint8`, because this is the smallest type that is required to hold the value `0`. If the array has more than 255 elements, the loop will not terminate.

\- The `constant` keyword for functions is currently not enforced by the compiler. Furthermore, it is not enforced by the EVM, so a contract function that "claims" to be constant might still cause changes to the state.

WTF?! Trivial loops won't terminate to due (unchecked) integer overflow, and the `constant` keyword does nothing? It's a complete gong show. I'm not touching anything to do with this language with a 100 foot pool. Is the hype bubble just that big?

[0] [https://news.ycombinator.com/item?id=14807779](https://news.ycombinator.com/item?id=14807779)

[1] [https://solidity.readthedocs.io/en/develop/security- consider...](https://solidity.readthedocs.io/en/develop/security- considerations.html)

Edit: Oops, it looks like I'm mixing up my multi-million dollar screw-ups. First in July $30 million was stolen due to the "public is default" debacle, and then _the fix_ for that problem introduced another bug (the developers forget to call the `initWallet` function), which lead to the $280 million being frozen in November[2]. Holy crap.

[2] [https://news.ycombinator.com/item?id=15642856](https://news.ycombinator.com/item?id=15642856)

<comment><USER4> Does Ethereum's existence hinge on Solidity? Isn't Solidity just a language that one can compile to the lower-level language actually built into Ethereum?

<comment><USER5> Solidity is the official language, part of the ethereum project, and pretty much all you get when you look for how to develop eth contracts, unless you specifically exclude mentions of solidity. Then you get Ivy (prototype & for bitcoin not eth) and Pyramid Scheme.

So I'd say yeah, technically not but practically it is.

<comment><USER6> Wait, there's a scheme variant for Eth called Pyramid Scheme? That is the best programming language name ever.

<comment><USER7> [http://www.michaelburge.us/2017/11/28/write-your-next- ethere...](http://www.michaelburge.us/2017/11/28/write-your-next-ethereum- contract-in-pyramid-scheme.html)

"Pyramid Scheme is implemented using the appropriately-named Racket."

<comment><USER8> could have used larceny as well..

[http://www.larcenists.org/](http://www.larcenists.org/)

</comment></comment></comment></comment></comment></comment><comment><USER9> > Again, let's design a simple smart contract. This time Alice wants to play a > guessing game. Alice puts 5 Ether in her contract. That ETH goes to the > person that guesses closest to the number she's thinking of. Alice calls > commit with the hash of the number, so she can't change her mind. Anyone > else can call guess to submit a guess. After 2 blocks Alice calls reveal to > tell everyone what the number is.

This scheme is not unsafe because of miners. Transactions are public. As soon as Alice's "reveal" message is published to the network, _everyone_ can submit guesses using the revealed number. And miners are incentivized to include whichever transaction pays the highest fee, which means the transaction fee of the guessing transactions published after the "reveal" transaction will converge with the prize sum.

Alice's commit transaction needs to specify some block height after which further guesses are ignored, and then publish the "reveal" message some (safe) number of blocks after this.

<comment><USER10> > Alice's commit transaction needs to specify some block height after which > further guesses are ignored, and then publish the "reveal" message some > (safe) number of blocks after this.

I think this is unsafe as well. Noted that since everyone can verify the real answer, there is no point for Alice to reveal it. As a result, as soon as anyone submits the correct answer, the miners can cheat and replace the answer as their own.

After some degree of thinking, I find that it is quite difficult to design a secure smart contract such guessing game. I haven't find a way can fulfill all following security properties: (a) the Alice has to pay for the first person who finds the correct answer; (b) that person can only collect reward after showing the the correct answer; and (c) the miner cannot cheat.

I wonder if anyone has a solution for the above problem. Also, if such solution exists, we can actually use it to implement the RSA challenge [1] in smart contract.

[1]: [https://en.wikipedia.org/wiki/RSA_Factoring_Challenge](https://en.wikipedia.org/wiki/RSA_Factoring_Challenge)

<comment><USER11> You can solve that with additional step: 1\. Alice send the challenge. 2\. You submit the answered, encrypted. 3\. After you verify that your answer was included in a block, you post the private key you used for the encrypted answer. 4\. Profit

<comment><USER10> I think the miner can cheat in step 3. After you submit your private key as a transaction, the miner can delay it to be included in the blockchain for arbitrary time. During which, the miner can use your private key to decrypt your answer submit in step 2. And resubmit their version of the answer.

<comment><USER11> That won't help him much, since my answer is already published in the blockchain when he will publish his answer.It is trivial to see that my answer was published first.

</comment></comment></comment></comment></comment><comment><USER12> IT's capitalism in its purest form. The work done is work n the physical sense of production, but from a labor perspective it ends up as a constant rote of attrition and self negation - people gt interested in coins to make a quick buck and take it easy, but either drop or spend all their time, energy, and money racing for a slice of the pie while producing little of value - in this case, trust tokens which may or may not turn out to be valuable later. The rewards always go to people who were there early and had excess capital to spend on buying, or could mine easy pickings and then let someone else take over the grind.

Oddly the mining analogy reminds me most of Eve Online, which has a professionally tuned in-game economy and where you basically have a graphic representation of everything mentioned in the article, including the tedium and energy of mining, the endless technological arms race (designed to make you invest as much time as possible or buy credits to leapfrog other players), and pointless destruction of wealth - intra-player conflict is where most of the action and excitement is because the exploratory aspect of the game is only as interesting as it yields new technology that gets recycled back into the arms race.

Perhaps the solution is a medium of exchange that doesn't use absolute units, but is a function of your ability to pay.

<comment><USER13> > a medium of exchange that doesn't use absolute units, but is a function of > your ability to pay.

This is already implemented in many areas of modern life, especially by governments (Obamacare, progressive taxation, social security, etc), and it has a major negative side effect of incentivizing poverty: either real (by encouraging the young to work as little as possible) or faked (by encouraging those with accumulated wealth to conceal it as much as possible).

<comment><USER14> yes, if we take away the "he who does not work, neither shall he eat" incentive[1] people will work less. Is that good or bad? depending on your ideology, it could be either one. Do you think that it's ethical to threaten the poorest with starvation to add a few points to our gdp?

My own personal view is that using starvation to incent work is acceptable only if society is unable to produce enough food for everyone; in that case, those few points to the GDP have real impact. I personally don't feel that it's okay to use starvation to incent work when that work largely produces luxuries, but that's just me, and everyone has an opinion on this one.

[1]Interestingly, historically this aphorism has been a leftist saying... that is, the rich should have to work, too. Leaving aside my controversial views of the bible, in more recent history, John Smith used it to this meaning in Jamestown, and then in the early 20th century, Lenin argued that it was a fundamental principle necessary for socialism to work. Both were talking about situations were people were starving (the early days of Jamestown and the early days of the Russian revolution, respectively) More recently, it's used as a rightest saying, arguing that the poor ought to work or starve, something that was the assumed truth in earlier ages.

<comment><USER15> > I personally don't feel that it's okay to use starvation to incent work

I think most people would agree with you on that one. And the fact that people in "rich" countries are still food-insecure is horrible.

One problem is that there isn't a clear bright line between "starvation" (in the sense of malnutrition) and "nutritious but not very tasty food" and "nutritious and tasty but not very pretty food". And you can keep going in that vein to things like "not having a flat-screen tv", say, which I think most people would classify as quite different from "starvation". But there isn't an obvious cutoff point on the way.

Oh, and what we consider sufficiently nutritious today may not be so considered tomorrow. Both literally (at some point nutrition science discovered vitamins and then trace minerals, etc), but people nowadays also get into arguments about whether internet access is a fundamental right like food or a luxury. And whether personal transportation (e.g. cars) is a fundamental right. What will people think about access to a self-driving car 50 years from now: luxury or fundamental right?

In practice, what we consider below-acceptable standards of living (which we as a society need to subsidize until they reach acceptable levels) are a good bit higher than what was considered totally acceptable 50 years ago. That's a natural consequence of society growing richer, of course and I would say it's a _good_ thing.

But here's the question that bothers me: Had we frozen per-capita production at 50 years ago levels, while subsidizing living standards to a level above the 50-years-ago acceptable minimum but below the today acceptable minimum, such that vast numbers of people today would be forced to live below what we consider an acceptable living standard today, would that be a net gain? In the short term, clearly yes (we subsidized people at a higher level). In the medium term (to today), it seems clear to me the answer is no. In the longer term (200 years from now, say), I have no idea.

It's hard to tell even post facto, much less a priori, whether we're over- subsidizing or under-subsidizing to achieve maximal happiness. And that's even if we can all agree on a timeframe. Combine that with the fact that different people already have different definitions of what constitutes minimum acceptable living standards, and it becomes very hard to apply ethical considerations to this problem in a principled way. :(

</comment></comment></comment></comment><comment><USER16> >Ethereum is a decentralized platform that runs smart contracts: applications that run exactly as programmed without any possibility of downtime, censorship, fraud or third party interference.

Except that ethereum is lying when they say this. The DAO contract was nullified and censored. The Ethereum Foundation and the DAO team were bailed out and had preferential treatment.

<comment><USER17> And how was the contract nullified exactly?

<comment><USER18> It was replaced with a new contract via a hard fork. Doing so was the right move, by far, but purists loathe the move.

<comment><USER17> I was partially being facetious :) But you said it precisely, it was via a hard fork, which was agreed upon in a democratic fashion. The person I was replying to was suggesting that transactions were simply revoked from Ethereum-HQ, which is far from the case.

</comment></comment></comment></comment><comment><USER19> The title of the piece is "Miners aren't your friends", implying that the interests of miners and the reader differ. However, the title of the HN submission is "Miners aren't friends", which implies that the interests of two separate miners diverge.

We should probably change the title to match the original one.

<comment><USER20> Agreed, I was frustrated at that too.

</comment></comment><comment><USER21> Nice article! Here's another type of failure with its solution:

* You want to register a domain name on the blockchain and associate it with your address, so you submit "register foo".

* The miner sees it, and inserts an earlier transaction registering foo to them instead.

Solution:

* You register the _hash_ of foo, which registers the plaintext encoded by that hash, then wait until the transaction is accepted publicly and submit a second transaction that reveals to everyone the plaintext of the hash that you registered.

The miner could still try to guess at which name you're registering based on the hash (by having a long list of potential names to hash just in time), but I can't think of a way to do better than that. Anyone else?

<comment><USER22> You register the hash of domain+seed. Second transaction reveals both.

<comment><USER23> Couldn't someone else then simultaneously register the hash of the same domain with a different seed? Neither of you would know of the duplicate until you revealed your seeds.

<comment><USER24> What's the chances of simultaneous transactions? (That's a question, not a snarky statement).

<comment><USER25> There aren't any. That's what the article was about: The order of the transactions in a block.

<comment><USER24> Sorry I shouldn't perhaps have said transactions - the parent asks what to do with simultaneous requests for to reserve a unique unduplicable good, it was the simultaneity of identical requests I was asking about rather than the impossible simultaneity of processing the blockchain transactions.

</comment></comment></comment></comment></comment></comment><comment><USER26> Almost all miners use a mining pool so wouldn't have access to these tricks. The pools on the other hand...

I used to have an Ethereum mining operation, before it became unprofitable to do so. It was one of the most fun ventures of my life. All the cards and enormous heat and fans exchanging outside air in. It felt like I was part of something futuristic and new, solving problems I had never had experience with before. I miss it very much, I wish it could have gone on forever.

<comment><USER27> If you have modern cards you can still mine with one of the services that find the most profitable algorithm for you.

I use NiceHash and have historically made about $2/day per GTX1070. This past month though I've been making more that double that.

EDIT: Use this site to find out if your cards will be profitable considering your energy costs: [https://www.nicehash.com/profitability- calculator](https://www.nicehash.com/profitability-calculator)

I do want to leave one important caveat. NiceHash was recently hacked and anyone who left their money in their online NiceHash wallest lost it. They recently came back online and claimed they have a plan for paying people back and will give more details at the end of this month. That being said they have paid me for my mining since the hack. If you do use them I'd recommend withdrawing to wallets you control as often as possible.

<comment><USER28> I don't understand the economic argument for personal mining (I totally get it from a fun, geeky PoV if making money isn't the primary goal - it's how I got started in crypto).

A GTX1070 costs about $800. At $4/day, it will take you 200 days to make back your principle (ignoring power costs, difficulty scores going up etc. - <USER2> reality it will obviously take you even longer to cover your costs).

If you had put that same $800 in to buying ETH (picked because it's a relatively safe, "boring" coin) on 1st July, 200 days later (or 7 months) it would have been worth $2,140 (yielding a $1,340 profit per card equivalent cost invested - note I'm using ETH price on 1st Jan 2018 and not including the recent growth to a new all time high). And the profit will likely x5 (or more) this year if you hold on to your ETH.

<comment><USER29> If you're buying stuff on darknet markets it's nice to be able to do it with freshly mined coins that don't have transaction histories associated with them.

<comment><USER30> This would only apply to solo-mined block rewards. If you use a mining pool, there is a coin trail through the pool. The pool likely has the IP address records of your miners and can link these to your payout transaction.

Mined coin is only just a little less traceable than exchange purchased coin.

</comment></comment></comment></comment></comment><comment><USER24> >"In this way, Proof of Work forces miners to constantly re-invest revenue." (the OP) //

Classic capitalist view. It's not that miners are forced to reinvest, if all miners were satisfied with the _status quo_ then it could continue and each miner would get the same returns - depending on the structure of the system, greater demand could even drive hash value up.

But miners aren't satisfied, they want more, and new miners want a go at picking from the money tree. So the available pickings get higher up (require more resource expenditure). In theory, and often practically, it drives optimisation. Ultimately the return should be so low as to match safe investment returns.

It seems it should be possibly to design a system such the the coin holders can effectively own the means of hash production, which would keep value in the system.

<comment><USER31> > Classic capitalist view

I would consider myself center-left and I think you're confusing "capitalism" with "realism".

Any political system that requires altruism towards strangers is doomed. Altruism grows out of community - and requires consequences for "bad" behaviour to some degree. Tragedy of the Commons and all that.

<comment><USER32> Capitalism demands constant growth. His usage fits perfectly. Center-left means you are a capitalism supporter and makes no difference. Claiming the capitalist mode of production is "realism" is really you trying to say capitalism is natural.

<comment><USER31> Before I answer that, could you clarify your definition of "capitalism"?

(Genuine question)

</comment></comment></comment></comment><comment><USER33> Some of these issues do seem concerning, but most wouldn't be profitable unless every miner was doing it (because the impact on one of these malicious behaviors will be felt in a later block).

Unless you're lucky enough to mine two blocks in a row, I don't see how you can gain directly from malicious transaction reordering. You'll consume the first retrieve fee, but the second retrieve will be in a later block (which you probably won't mine).

I'm not saying this is ok, but I'm also not sure this particular situation is worth the effort to exercise.

Transaction insertion, however, sounds like it would be very effective for the case presented. On the other hand, how big a deal are "guessing game" dapps?

You can sum all this up by saying, "consolidation of mining power can be used to exploit the network at the cost of non-miners". But consolidation is a problem for reasons beyond just these examples.

Finally, if a network becomes so corrupt, people will move to a different cryptocurrency (which will lower the value of the corrupt network). Thus, the bad actors would be taking small short term gains at their own cost of long term survival (especially when considering sunk costs in hardware).

<comment><USER34> Full disclosure: tech lead on Keep (the project whose blog this is posted to), and the post is by one of our advisors.

It might not be worth the effort when volume is low, but if you have a highly- used set of contracts susceptible to this, there will be a stronger incentive to take advantage of them. With high volume, if you do it only occasionally, you can gain an edge without necessarily revealing network corruption (unless someone is looking for it). Additionally, this kind of careful misbehavior can lead to consolidation---by allowing some clever miners to gain enough of an advantage to continually grow their operation.

Note also that only the most basic transaction reordering gains solely from transaction fees. Transaction insertion requires no further blocks, and forced errors can be used to subsidize miner transactions (rather than simply to gain later on). Lastly, censorship has more than economic advantages, depending on the underlying application.

If the whole network becomes corrupt, people will move; however, there's a lot of room between "enough malicious transactions to cause a problem" and "network is so corrupt people are leaving", particularly if a chain is popular. Indeed, if a chain is popular, "just leaving" is not necessarily an immediate option. The important thing is that, as a developer for a given chain, you want to make sure you're aware of these pitfalls (whichever ones apply to your chain---many will apply across many chains) so you can design around them. More than many platforms, building for public chains require adversarial thinking. Or perhaps better put, they _should_ require adversarial thinking. It's easy to forget that when you're getting started.

This is even more true when you're building components that you intend others to build on, which is what we're doing. That's what motivates the interest we have on our team in these kinds of concerns. We feel they're important to share as development on public blockchains gains greater visibility, interest, and therefore new developers.

<comment><USER35> > and forced errors can be used to subsidize miner transactions

Sure, you _can_ error out a transaction but what gain is to be had over just being a 'rational actor' and collecting the transaction fee rather than giving your rivals a potential payday?

Unless they have an _extremely_ high probability of mining the follow-on transactions this attack seems to have a very low (or even negative) benefit.

Though I would posit that if this attack were ever consistently profitable the system would have a much bigger problem to deal with.

</comment></comment></comment><comment><USER36> Miners are surely not gamers' friends. All high end cards have been sold out for weeks. They are now completely overpriced ($1300 for a GTX 1080 Ti).

<comment><USER37> Are people now moving on to nvidia cards for mining? I haven't followed closely for several years, but back in the day, it was all about AMD because nVidia's chips were much less efficient at this type of work.

If nvidia is now in demand for mining, are people going for that because AMD is nowhere to be found and they're just going for the next-best thing, or has nvidia gotten better at this?

<comment><USER38> The latter. Less efficient, but in the current market still pennies on the dollar as far as nVidia efficiency goes.

</comment></comment></comment><comment><USER39> So many false assumptions in this post. As if only 1 miner is trying to mine a block. There is simply no way to know whether you or someone else is going to mine that specific block, it's totally random.

> There are two ways to increase mining profitability: generate more revenue, > or reduce expenses.

No. There are more ways. Mining the right coin at the right time and selling it at the right time for example.

Mining has a lot of common ground with investing in the stock market. It's not that simple.

</comment><comment><USER40> It seems like a lot of these problems are due specifically to using proof of work. Do any of these problems go away with other consensus algorithms? I would at least expect that miners wouldn't have as much incentive to arbitrarily cause errors if they were using something like proof of stake.

Also, how easy is it to detect that miners are doing these things? If it's not terribly difficult, then maybe a federated system would iron out some of the wrinkles?

<comment><USER41> They do! But usually they get shifted elsewhere. While he was working on this post James and I discussed how PoS might yield stronger incentives to DoS rivals and get an advantage, since some of these other optimizations (attacks? Unclear) will be unavailable.

Edit: Regarding detection, of course- but I'm not sure detection lends itself to a general solution outside name-and-shame. Most of these are things developers should code defensively against.

Disclosure: lead at Keep, edited this piece

</comment></comment><comment><USER42> Can any explain how the economics of mining does not promote the creation of a miner monopoly, aka a "miner Amazon". Once a single entity controls mining, Game Over: the economy is owned.

<comment><USER43> You are answering your own question. Suppose someone would invest billions in obtaining a mining rig that single handedly achieves 51% of the mining power of the network, then he effectively kills that network, and makes his investment worthless.

There's a reason the valuations of Bitcoin and Ether waiver every time it seems a pool is coming close to 51% mining power, it's because everyone is scared of what happens when that happens.

In the real world, I think miners approaching 51% of mining power is an accidental and temporary thing. It means that the coin is overvalued, and investors are over investing in mining operations. As the article states, the amount of profit these operations turn really isn't that big. They're operating on thin margins, and operations going bankrupt is not unheard of.

There's simply no reason to go and "own" the network. Best case, you'll turn a loss, worst case, you destroy the network and lose your entire investment.

<comment><USER44> If you can keep your majority a secret, you can avoid the devaluing scenarios. The trick is to use the majority only when you need to, and to avoid detection.

</comment></comment></comment><comment><USER45> Another instance of this is if you managed to build a business around a particularly profitable contract or set of contracts, the nature of which requires you to regularly post maintenance transactions of some sort.

If you get big enough and profitable enough, the miners will have an incentive to specifically refuse to include your maintenance transactions unless you include a large transaction fee - in other words, market segmentation for transactions.

</comment><comment><USER46> As someone who has a couple rigs mining 24/7 I would say he's looking at the profitability of mining wrong. Personally I don't reinvest my mining profits in more mining equipment. There's a hard cap on how much amperage can be delivered to my house, and I have no interest in interfering with my daily appliances.

As far as when does it becomes profitable to play games with consensus? Never. Most miners mine using pools like suprnova, ethermine, and nanopool. I don't have control over whether we are appropriately confirming transactions or not, but it would be pretty unwise for my pool to start violating consensus.

</comment><comment><USER47> To my limited understanding of Ethereum and Bitcoin, the network already has rules in place to punish nodes that misbehave or cheat. In the case of Bitcoin, that is part of layer 1 so it is independent of any application layers and thus it should always be at the core of the network.

With PoS cheating is likely to become a bigger issue [1], since with PoW the miners who get punished will have wasted their time and electricity.

Would be great to hear comments from more knowledgable people.

[1] [https://twitter.com/hugohanoi/status/951762596255838209](https://twitter.com/hugohanoi/status/951762596255838209)

<comment><USER48> Proof of stake doesn't work in practice unless we can find a source of randomness that is globally available, non-influencable and everyone can agree on [1]. At the moment, that source of randomness is completely elusive. It might be possible to create a random source from some form of binary astronomical event which can be widely verified but it would have an incredibly low bit rate of new randomness. One possible candidate is randomly nulling pulsars [2]. Unfortunately, the equipment required to observe this phenomenon is probably not widely available outside of large observatories. Having said that the costs would still be lower than the energy costs of the Bitcoin network.

[1] [http://www.truthcoin.info/blog/pos-still- pointless/](http://www.truthcoin.info/blog/pos-still-pointless/)

[2] [https://arxiv.org/abs/1706.05407](https://arxiv.org/abs/1706.05407)

<comment><USER49> Can imagine a protocol for generating randomness to some arbitrary security level (at the expense of locking up security deposits):

(1) Anyone can decide to become a 'randomness provider' by putting up a large security depsoit

(2) Every epoch (some number of blocks), each provider chooses a private random number and commits to it by publishing its hash

(3) During the next epoch but, each provider publishes the random they committed to earlier.

(4) xor together all the random values. The result is a pseudorandom number everyone can agree on, and which should be sufficiently good for many applications include PoS selection __

If any provider fails to publish the random number they committed to, they lose their security deposit and there is no random value provided for the associated epoch. The process starts over.

If you're worried about bribing attacks over all providers, recognize that all we need is a _single_ altruistic provider to keep the system safe. Altruistic behavior may be rare compared to selfish behavior, but I think we can usually rely on its nonzero presence.

If you're still really worried that collusion could be going on amongst ALL randomness providers, just become a provider yourself.

 __It 's possible for a provider to wait for all other providers to reveal their values, and then privately determine whether or not the final random value would be favorable to them; they then have the option of canceling the epoch by keeping their private value hidden and losing their security deposit. This option (in combination with a particular application, and the size of the security deposit of providers) puts a bound on what the random value can be safely used for (e.g., if it's for a lottery, the expected value of another truly random swing at the jackpot has to be lower than the value of a security deposit).

<comment><USER50> > If you're worried about bribing attacks over all providers, recognize that > all we need is a single altruistic provider to keep the system safe. > Altruistic behavior may be rare compared to selfish behavior, but I think we > can usually rely on its nonzero presence.

You also need to be sure that the others don't ignore the single altruistic source.

In a byzantine system, you can't distinguish if somebody is offline or if the others are silencing him.

<comment><USER49> > You also need to be sure that the others don't ignore the single altruistic > source.

Well sure, but the code people run listens to all the providers. Everyone is listened to automatically. That's part of the social consensus encoded in software. If you don't follow along, you end up on your own fork. That's how these systems work — e.g, you also need to make sure that people don't "ignore" the consequences of failed hash checks throughout a cryptocurrency codebase.

It would be quite possible to run your provider on a machine hidden somewhere, and inject your transactions to nodes at random points in the network. It'd be pretty tough to silence someone directly.

Miner censorship attacks, e.g. a 51% attack, are also possible (i.e., all miners, or a sufficient majority, refuse to mine your tx until the epoch ends). This kind of censorship threat is always present for all kinds of transactions; in theory they're particularly pernicious for protocols like this one that require a tx to be submitted by a deadline. But no one is claiming that these systems are completely invulnerable to a misbehaving majority of miners or validators.

</comment></comment></comment></comment></comment><comment><USER51> The LeastAuthority audit of Ethereum gas economics in 2015 brought up this issue of transaction reordering: [https://github.com/LeastAuthority/ethereum- analyses/blob/mas...](https://github.com/LeastAuthority/ethereum- analyses/blob/master/GasEcon.md)

(They also pointed the issue that led to the DAO hack and recommended "value reverts to the sender upon exception".)

</comment><comment><USER52> Miners have proven to be unreliable. F2pool has been accused of manipulating Status ICO:

[https://steemit.com/ethereum/@dhumphrey/f2pool- manipulates-u...](https://steemit.com/ethereum/@dhumphrey/f2pool-manipulates- usd1-2-million-on-the-ethereum-blockchain-during-the-status-im-ico)

</comment><comment><USER53> Aren't all of those scenarios covered by fraud laws? Obviously one should be able to provide evidence that an actual miner willingly reordered transactions to get paid twice. I don't know if this is possible (gathering the evidence.)

<comment><USER25> Miners are not required to put anything into a block in any particular order. If you don't like what they are doing, stop paying them.

</comment></comment><comment><USER54> Do these vulnerabilities affect BTC? Is there any unbiased source of security reports on all the various coins?

<comment><USER30> Not exactly because bitcoin only supports a few simple transaction types -- Pay to Public Key, Pay to Public Key Hash ('standard tx'), Pay to Script Hash, Pay to Public Key Witness Hash, Pay to Script Witness Hash.

These are only serial dependent -- ie: A pays B, B pays C. You cannot reorder and still remain valid.

The security of the standard tx is the strength of the public key hash function RIPEMD-160. The security of Pay to Script Hash is finding a valid SHA256 collision with OPCODES.

The witness variants are a new tx format that uses less space (aka segwit).

The attack is simply a Denial of service, an attacker can block a tx. So if A pays B was never included in a block, B could never pay C.

</comment></comment><comment><USER55> Just a miner inconvenience.

</comment><comment><USER56> Sounds like insider trading is built in fundamentally. Should help legitimize ETH on Wall Street.

<comment><USER57> COuld you elaborate on builtin insider trading?

</comment></comment><comment><USER58> Looks like the author of this piece is not aware that proof-of-work is antiquated and essentially obsolete.

There are way better methods to achieve distributed consensus, like Hashgraph or even proof-of-stake.

Edit: The critique that if the blockchain is slow, your Dapp will be slow is fallacious as well. You can mitigate that using side chains.</comment>


Netflix Global Search - <AUTHOR> https://unogs.com/ <comment><USER2> I wish there was a site that listed releases in a certain country by release date, in a simple table. This comes close, but you can only view the last 7 days for some reason.

<comment> tomas-lp Tried something like [https://flixboss.com](https://flixboss.com) ?</comment></comment>


Show HN: Side Project - Just the Images from Reddit - <AUTHOR> http://imgonly.info/

<comment><USER2> Good work, but I don't like how all the images are forced to 1:1 ratio. You should try to preserve the original aspect ratio. You could either choose a width and that way you can have a certain # of columns with images running down vertically. Or choose a height and have them running left to right in rows of equal height.

<comment><AUTHOR> Yeah... it's not great but it was on purpose. Some images are crazy dimensions like 300px wide and 5000px tall so it's kind of tough to handle. I guess I could write some logic to preserve the aspect ratio up to a certain point. I do like the nice perfect square of images though.

</comment></comment><comment><USER3> <http://panoptikos.com/> did this pretty well for me in the last few months, but it's always nice to have several choices :)

Care to share the tech behind the site, and how it works ?

<comment><AUTHOR> Cool, I haven't seen that before. The tech is pretty simple, it's ruby on rails, and a cron job grabs the RSS feed for the Reddit home page, then downloads all of the posts that link to images hosted on imgur. The images are all uploaded to Amazon S3 and the server is on a free Heroku plan. The next feature I plan to add is a link back to the Reddit comments for each image.

I did find out that if imgur will block you if you retrieve too many images too fast.

</comment></comment><comment><USER4> Most embarrassing moment of the day was realizing I had (1) already seen all of those photos on Reddit and (2) already forgotten the context to half of them.

</comment><comment><AUTHOR> Wow - 3GB of data transfer already this morning - I'm glad the images are on S3!

</comment><comment><USER5> Needs more "next" buttons.

</comment><comment><USER6> reddpics.com</comment>


Project Cassandra: Facebook's Open Source Alternative to Google BigTable - <AUTHOR> http://www.25hoursaday.com/weblog/2008/07/14/ProjectCassandraFacebooksOpenSourceAlternativeToGoogleBigTable.aspx

<comment><USER2> good stuff... the amazon dynamo paper should be required reading for people contemplating implementing these "eventually consistent" data stores.

<comment><USER2> [http://s3.amazonaws.com/AllThingsDistributed/sosp/amazon- dyn...](http://s3.amazonaws.com/AllThingsDistributed/sosp/amazon-dynamo- sosp2007.pdf)

</comment></comment><comment><USER3> The funny thing is we heard all of that in the 90s when object relational databases became popular. More interesting would be to hear how Cassandra scales across machines because that's what's so troublesome with databases, not the datamodel.

And, by the way, it's ironic that users of MySQL complain about the join performance of relational DBMS

</comment><comment><USER4> Looking for more information on this project, I come across this Wiki entry:

<http://en.wikipedia.org/wiki/Cassandra_Project>

I thought this was somewhat amusing considering some of the conspiracy theories surrounding FaceBook.

</comment><comment><USER5> This is great news... At first glance, the Cassandra codebase looks smaller and simpler than HBase. It will be interesting to see how it compares -- I've had data integrity with HBase, but I'm also doing weird stuff to it (storing tons of scientific floating-point data...)

</comment><comment><USER6> This is implemented in Java, a language I have been told by people who get heavily voted up on this site is a ball and chain.

BigTable is implemented in C++ or Java. Cassandra appears to be most or all Java. But Java and other compiled languages are death for startups and corporations. Error! Error! Does not compute! Why aren't they using Ruby or Lisp?

<comment><USER7> Java is an excellent language for writing the kinds of programs that were traditionally written in C but where the performance of Java is adequate (and as the performance of well-written Java programs seems to be asymptotically approaching the performance of well-written C programs this set is larger all the time). In fact, treating Java as a garbage-collected C is often a very reasonable thing to do.

People who bitch about how 'Java is dead' are referring (whether they know it or not) to the practice of attempting to write change-prone business logic and other glue in it. This practice was always a bad idea, something that even Sun now seems willing to admit. If the Rails/Django discussion is at the center of someone's programming universe then it is likely that to him or her that this is the only kind of code in the world, and thus Java is of no consequence to those sorts of people.

However, if your project is ambitious enough you'll find that you will need both glue and infrastructure, in which case having a language like Java underneath your dynamic language (people who use JRuby for example, or like me, Rhino) will be a godsend when you need performance or the occasional static-typing guarantee.

If you'll allow me to make the obligatory pg/Viaweb reference then I'll point out that Viaweb contained non-trivial amounts of both C and Perl, in spite of the obvious advantages of using Common Lisp for the store editor proper.

<comment><USER6> I find it disappointing that you feel dynamic typing is incompatible with performance.

Now's the time to rediscover optional static type annotations used for optimizing compilation. Radically innovative!

<comment><USER7> Addressing someone like a tardy child (I'm not mad, just disappointed) is a reliable way to inflame the discussion. I don't think I will respond if you phrase any further replies like that.

The claim that "dynamic typing is incompatible with performance" is considerably stronger than what I said (and I would contend belies an imprecise if not misguided notion of "dynamic typing"). That being said, for people interested in using a mainstream platform to develop their applications, the JVM offers a number of extremely productive "dynamic" languages none of which perform as well as Java across a broad spectrum of activities. I think you will find it telling that the engineers at Facebook (who are world-class) chose to implement this system in Java.

Optional type annotations are a wonderful idea and I am optimistic that someday the tradeoffs we mark around performance and convenience can be granular and addressable at a lexical level in a single file. Until then, the mix of a JVM scripting language and code written in native Java calling each other trivially is pretty damn close.

Now I invite you to write a similar system using SBCL, if you enjoy debugging inexplicable concurrency failures. Or maybe you'll use Actionscript 3? I hear it has optional type annotations. Now if you'll excuse me, I need to go work for the Man on dreary accounting software.

Fail.

</comment></comment></comment></comment><comment><USER8> I can't hear the name Cassandra without thinking of Woody Allen's "Mighty Aphrodite."

<comment><USER9> In France, she'd be called la renard. Hunted, with only her cunning to protect her.

</comment></comment><comment><USER10> I hope I'll need to deploy this in a couple of years. :)</comment>


Tips for building social casino games - <AUTHOR> http://altdevblogaday.com/2012/03/29/how-to-build-irresistible-social-casino-games/

<comment><USER2> Great sum up and a lot of good advices based on the Lean Startup. They say Facebook is now crowded and it's almost impossible for an indie to just have viral success anymore so how did they obtain viral success outside of facebook/social network in the end?

I love the advices about analytics being key but I still don't understand what these projects use to perform their analytics. Are they all building their own solution or using something like Mixpanel right from the start?</comment>


A Time For Assessing "Strategic Opportunities" - <AUTHOR> http://www.avc.com/a_vc/2009/02/a-time-for-assessing-strategic-opportunities.html <comment><USER2> "But many of the younger companies ... have not stepped back and thought deeply about the big picture."

Perhaps by "deeply" he means create a concrete plan for the future including a list of potential buyers.

But I'm curious, is it not common for an entrepreneur to let their mind wander to the future, including a potential exit, at least a few times a week? I know it's easy to get lost in your huge workload, but I imagine most of still think pretty deeply about the future waiting in line at the grocery store.</comment>


Microsoft Internet Explorer 8 Launches at Noon - <AUTHOR> http://www.dailytech.com/article.aspx?newsid=14620 <comment><USER2> Maybe I'm being too optimistic, but could this be the final nail in IE6's coffin?

At a minimum, I guess it's more ammunition to justify not supporting IE6, since it's now two major versions (and 8 years) behind the most recent.

<comment><USER3> Unfortunately, I think this means that the pragmatic web dev now has to learn about three versions of IE.

<comment><USER4> Yep. My workload just went up another notch. I'm sure my clients will be grateful for the opportunity to fork over more money to work around Microsoft's refusal to embrace an open standard.

Incidentally, I've been using multiple VMs to test multiple versions of IE. But it is now apparent (well, _more_ apparent) that this method cannot scale. Has anyone had luck with these tools that can install multiple versions of IE at the same time, like this one: "Internet Explorer Collection"?

<http://finalbuilds.edskes.net/iecollection.htm>

Is this what I should have been using all along?

<comment><USER5> The release of IE8 all about embracing open standards (CSS 2.1, most of HTML 4, parts of HTML 5, major parts of ECMAScript 3.1). How is Microsoft supposed to embrace open standards without releasing major upgrades to their products? How can Microsoft start embracing open standards without people complaining about too many versions of their software?

<comment><USER6> I don't know the specifics, but there's no point in embracing an open standard if you just run hopscotch through the spec, picking and choosing what you'll implement.

<comment><USER5> No browser implements 100% of any of those specs. Some of those standards aren't even (close to) finished.

</comment></comment></comment></comment></comment></comment><comment><USER7> > Last year, Microsoft began to perk attention in the computer community > releasing a beta of Internet Explorer 8, which featured innovative browsing > modes like InPrivate, which were quickly copied by its competitors.

Didn't Safari have "Private Browsing" mode long before that?

<comment><USER5> InPrivate browsing also has features that make it harder for websites like google-analytics.com and googlesyndication.com to track you across multiple websites. I don't think any other browers have a built-in feature that does that yet.

</comment></comment><comment><USER8> I haven't been following IE 8 as close as I should have been, is there a good way to have both IE 7 and IE 8 at the same time? (Well it doesn't even have to be at the same time, but such that I can quit one and open the other.) Maybe compatibility mode is good enough?

<comment><USER9> Kind of-sort of: <http://tredosoft.com/IE7_standalone>

</comment></comment><comment><USER10> Thanks for posting this. I'm curious to see if this is the final straw or not as well. Personally, I may install it but it'll only be briefly.

<comment><USER11> good luck with the uninstalling part.

</comment></comment><comment><USER12> Noon where? Does that somehow go without saying?

<comment><USER13> Perhaps noon local time.

<comment><USER14> my local time?

</comment></comment></comment><comment><USER15> I just installed it, and had to reinstall Chrome because it stopped working once IE8 installed. Great work Microsoft!

</comment><comment><USER16> Seriously, if just a few advertisers said that they'd start using AdCenter, they could get Microsoft to fix IE.

</comment><comment><USER17> More PITA. Now you'll have to test your webapp againt another sucky browser.

</comment><comment><USER18> Quite frankly, does anyone actually care anymore?

<comment><USER19> If you do any kind of web development you should definitely care...

</comment></comment><comment><USER20> The improved functionality in IE8 + IE Developer Tools (ToolBar) is impressive. Getting much closer to FireBug features and usability now.</comment>


An Exciting History of Drywall - <AUTHOR> http://www.theatlantic.com/technology/archive/2016/07/an-exciting-history-of-drywall/493502/?single_page=true <comment><USER2> Not exactly a _comprehensive_ history. Article poses a lot of questions that it doesn't answer. Why does drywall in a landfill produce hydrogen sulfide, yet recycled drywall can be used as a _soil additive?_ Why is it good in one context and not another? Why does drywall grow mold when plaster doesn't? (The paper layer on top?) If plaster is moldproof, why don't we cast panels of it, and use it like drywall? (Not strong enough)

This reads like the outline of an article, published prematurely.</comment>