"A spambot barfed its post recipe on my blog" - <AUTHOR> https://twitter.com/renaudbedard/status/567827024775127040 <comment><USER2> You can search for the longer phrases in the spintax and find all of the places this spam was dropped before it apparently "barfed its recipe." It's pretty fascinating - Google returns over 600,000 results:

[https://www.google.com/?gws_rd=ssl#q=%22time+to+make+some+pl...](https://www.google.com/?gws_rd=ssl#q=%22time+to+make+some+plans+for+the+future+and%22+%22time+to+be+happy%22)

Looking at this link ([http://prophesyagain.org/radio/#comment-98](http://prophesyagain.org/radio/#comment-98)), it looks like this spam was left for a URL that redirects to [http://www.itunescoms.com/](http://www.itunescoms.com/), a fake looking iTunes knockoff that probably drops all kinds of nasty adware/malware on your PC.

For those unindoctrinated in SEO spam, the trick is to get past the spam filter, then leave a link in the name/username. You generate hundreds of thousands of backlinks to one page, which Google considers "votes" for your website. You can either send links directly to your "money site" or you can send them somewhere else and do a 301 redirect, passing the link juice.

Usually a spammer starts using something like Scraperbox and a lot of proxies to find thousands of blogs or forums with open comment fields, then use a script like the OP plugged into something like XRumer ([http://en.wikipedia.org/wiki/XRumer](http://en.wikipedia.org/wiki/XRumer)). The syntax of the OP is called spintax, and it basically chooses a random word inside of the {}s, creating an infinite number of comments. You find a few hundred thousand open comment fields to post in, ride a little wave of SEO boost until Google finds you and kills your site, rinse and repeat.

Nowadays most spam syntax as simple as the OP will be caught in filters or penalized by Google, but most spammers are actually really bad at what they do (as you can see by them forgetting a bracket and dumping the entire spintax).

<comment><USER3> > Google returns over 600,000 results

Tip: The result count estimate on the first result page is often off by several orders of magnitude. Often it's possible to navigate to the end of the results pretty quickly, and the number drops to something like 469:

[https://www.google.com/search?q="time+to+make+some+plans+for...](https://www.google.com/search?q="time+to+make+some+plans+for+the+future+and"+"time+to+be+happy"&num=100&safe=off&start=500)

<comment><USER4> why is that?

<comment><USER5> Google knows people rarely browse beyond the first few pages of results. Everything else is derived from the days when it was important to show off how big your archive is. They're basically still performing that vanity game. 600,000 results, nearly all of which are of such low quality it'd be embarrassing for Google to show off what they pretend is a valid result so they can fake a large result count (but they know users don't go there, so it doesn't matter).

<comment><USER6> I'm rather inclined to believe this is an artefact of the algorithm, something like:

1) grab index for each word in the query 2) grab first x results from each index 3) cross these to filter down to actual matches

I believe step 3 is as expensive as rendering the results AND nobody would like to wait for rendering 600k results before getting some of it. This they stick with some simple estimate, like max(size of found indices), or average or whatnot.

<comment><USER7> Seems like a reasonable hypothesis, but you can easily prove that it's wrong by doing a search for a single word, so there is no step (3).

I did a search for "hackerspace" (no quotes) and it claims "About 588,000 results." Paging through the results, I eventually got "In order to show you the most relevant results, we have omitted some entries very similar to the 390 already displayed." Even with omitted entries included, there only seems to be 832 results.

<comment><USER8> Yes, cause you are getting customized results.

Try [http://www.google.com/custom?q=hackerspace&num=100&safe=off&...](http://www.google.com/custom?q=hackerspace&num=100&safe=off&prmd=ivns&ei=-avkVLmtHYXsO5DlgfAC&start=800&sa=N&filter=0) it will show you that they actually found those thousands of results, but only if you search with an older algorithm.

<comment><USER6> Hmmm, they may exist, but:

> Sorry, Google does not serve more than 1000 results for any query. (You > asked for results starting from 9000.)

<comment><USER7> I agree. When I follow kuschku's link (starting at the 900th result), there is no next page link at the bottom, and if I try hacking the "start" value in the URL to go even one document farther I get no results and a "Sorry, Google does not serve more than 1000 results for any query. (You asked for results starting from 901.)" below the search box.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> That's called "spintax" and the overall approach is known as article spinning[1]. There's a small industry of software tools that facilitate that sort of thing (e.g. The Best Spinner[2]). Seems to be dying out as that kind of posting is more likely to get you penalized quickly nowadays rather than produce any real results.

[1][http://en.wikipedia.org/wiki/Article_spinning](http://en.wikipedia.org/wiki/Article_spinning) [2][http://thebestspinner.com/](http://thebestspinner.com/)

<comment><USER10> Aren't article spinning bots similar to stock trading bots in that somebody would only sell the bot if it wasn't working anymore?

<comment><USER11> not necessarily. a big strategy for gray/black hat tools is to sell the tools rather than using them to leverage risk.

Imagine a 100$ tool that might return 0 to 200$, the tool author sells the dream, and collects a more reliable income.

<comment><USER12> Yep, this is how forums work. Tools are very rare compared to other sold services because making tools are hard, and making a tool that people want to buy even harder.

You may see software like TheBestSpinner, XRumer and another one I can't remember the name of, basically a Wordpress comment spammer cannon that sell thousands of copies, more than that person would make using these tools themselves.

<comment><USER13> There is also Scrapebox for blogs and Senuke for other. They have been around since few years...

</comment></comment></comment></comment></comment><comment><USER14> Man: Well, what've you got?

Waitress: Well, there's {egg|bacon|sausage}, {egg and bacon|egg and spam}, egg {bacon|sausage} and spam, {spam|bacon} {spam| spam spam} sausage and spam, {spam|egg} spam spam {bacon and spam|sausage and spam}; spam {bacon|sausage|spam} {spam|spam bacon|spam tomato bacon} and spam

</comment><comment><USER15> Reminds me of my favorite email spam ever, from many years ago:

Subject was: "Dear java.lang.NullPointerException, you have been selected to receive..."

<comment><USER16> Obligatory XKCD link: [http://xkcd.com/327/](http://xkcd.com/327/)

The company I'm working for has alarms which monitor log files for "FATAL" and the like, some of them also contain user input, so naming your kid something like this is another good way to annoy some ops people :D

<comment><USER17> The guy who published a book about XSS, which ended up causing an XSS exploit on Amazon via the "book preview" function[1] is my favorite version of that.

There was also an attempted attack on the Swedish voting system via a handwritten SQL injection attack, but that was unsuccessful[2].

[1] [https://drwetter.eu/amazon/storedXSS- vuln.at.amazon.html](https://drwetter.eu/amazon/storedXSS-vuln.at.amazon.html)

[2] [http://alicebobandmallory.com/articles/2010/09/23/did- little...](http://alicebobandmallory.com/articles/2010/09/23/did-little-bobby- tables-migrate-to-sweden)

</comment></comment></comment><comment><USER18> The { grammar | word choice | punctuation | sentence structure } could really benefit from some { improvement | modification | proofreading }.

<comment><USER19> With that said, the English is actually quite good compared to most of the spam I see (although some of the synonyms don't make sense, so were probably automatically generated).

</comment></comment><comment><USER20> It is the best time to make a few plans for the future and it is time to be happy. I have learn this put up and if I may just I desire to counsel you few attention-grabbing things or tips. Maybe you could write subsequent articles regarding this article. I desire to learn even more things approximately it!

I'll right away clutch your rss feed as I can not to find your email subscription hyperlink or e-newsletter service. Do you've any? Kindly permit me recognize in order that I may subscribe. Thanks.

      re.compile(r'\{([^}]+)\}').sub(lambda x: random.choice(x.group(1).split('|')), tmpl)

</comment><comment><USER21> For anyone that doesn't like to deal with all of pastebin.com's horrible, here's the raw link: [http://pastebin.com/raw.php?i=U7jv9jxS](http://pastebin.com/raw.php?i=U7jv9jxS)

All the best,

<comment><USER14> pastebin's horrible {design|font choice|wrapping|what}?

<comment><USER21> It's a rather general problem. It has ads, requires scripting (to view text!), breaks formatting, doesn't have sensible syntax highlighting available, etc. Imho, it's probably the worst paste client anyone could use for anything. [http://ix.io](http://ix.io) and [http://sprunge.us](http://sprunge.us) are significantly better alternatives.

But, if one is dead-set on using pastebin.com, the least they could do is post the raw link so users can escape some of the horrible.

</comment></comment></comment><comment><USER22> This is pretty outdated tool to cheaply generate "unique" versions of the articles in order to fool search engines in terms on "link juice". What you normally do is hire someone for $5-100[0] to write an article and manually or using a tool generate spintax version. During posting bot would simply select a random alternative from the spin list.

When Google started to use machine learning to filter out machine generated content this out this method quickly lost effectiveness. However, it is more effective on less sophisticated search engines so using this will show some benefit.

One of the more current methods is markov chain based article generation with provided keywords. And perhaps more importantly paying people to write content.

[0] With internet proliferation this has dropped substantially.

<comment><USER23> It's not always about the potential link juice, it can simply be a way to display a link in hope that people will click it.

</comment></comment><comment><USER24> Scott Hanselman blogged about a similar experience [1].

[1] [http://www.hanselman.com/blog/ExposedABlogCommentSpammersSou...](http://www.hanselman.com/blog/ExposedABlogCommentSpammersSourceTemplate.aspx)

<comment><USER25> Surprisingly similar, actually. Many of the sentences look exactly the same.

</comment></comment><comment><USER26> I don't understand, what's the point of such spamming? It's not advertising a brand or a product at first sight (I read it casually).

<comment><USER27> Often you'll see wordpress comments where the comment is some generic praise to make it seem legitimate and avoid deletion, and the "website" field is filled out so their username is a link to wherever they want.

<comment><USER28> One of my sites gets these every now and then and, given that the website field is omitted on my forum, users are usually quite bemused at the mysterious intent of the authors.

</comment></comment></comment><comment><USER29> I'm curious to see when spam bots will eventually use sophisticated language models in order to generate text, aimed to combat a search engine's own machine learning algorithms which detect spam. Barring the actual scenario where Google's resources are larger and Google's employees more intelligent than spammers, it would be interesting to see spam bots generate more and more intelligent content in a war of the AI.

<comment><USER30> _it would be interesting to see spam bots generate more and more intelligent content in a war of the AI._

[http://xkcd.com/810/](http://xkcd.com/810/)

<comment><USER31> We need some system to assign XKCD score to discussions - how may relevant XKCDs were linked in them :) .

</comment></comment></comment><comment><USER23> That's what happens when you don't match your brackets.

</comment><comment><USER32> Searching for a common string ("and bloggers made good content as you did") shows about 400k results. What's the payload here?

So what's the payoff here? Based on the text it looks like IE malware, but it could be site visits or back-links or something else.

<comment><USER33> I imagine payoff is about building an astroturf to spawn adoption or increase SERPs - essentially gaming search engine algorithms.

</comment></comment><comment><USER34> This sort of thing happens quite regularly: [https://twitter.com/jackgavigan/status/485833011184041984](https://twitter.com/jackgavigan/status/485833011184041984)

</comment><comment><USER35> Back in a days I built something like that, albeit as a exercise (never used for spamming):

[http://www.25pix.com/organic-text-generator/](http://www.25pix.com/organic- text-generator/)

</comment><comment><USER36> WOW. Loved this _comment template_. It could have a legitimate use in software development to generate some meaningful random text for mockups.

<comment><USER20> You can use a context-free grammar to produce amusing and sometimes convincing writing if the writing style it's intended to imitate is sufficiently obtuse, e.g.:

[http://davidsd.org/2009/01/the-real-theorem-generator-a- cont...](http://davidsd.org/2009/01/the-real-theorem-generator-a-context-free- grammar/)

[http://pdos.csail.mit.edu/scigen/](http://pdos.csail.mit.edu/scigen/)

<comment><USER37> In other words, a bullshit generator?

</comment></comment></comment><comment><USER38> How are these templates parsed? I mean what code goes through these and decides which word to use?

<comment><USER39> You can see a much fancier text-generator of this sort at [http://eblong.com/zarf/mutagen/about.html](http://eblong.com/zarf/mutagen/about.html)

(I once ported it to Python and wrote a parser for a more-convenient syntax like the OP's, then never released it partly because I'd hate to see spammers using it.)

</comment></comment><comment><USER40> I should write my job search emails like this.

</comment><comment><USER41> lol I've totally seen that in the wild

</comment><comment><USER42> role {nonspeaking 2,0.919,7 play 1,0.819,67:1,0.670,77:1,0.549,56:6,4.098,229:1,0.670,49:1,0.670,31:3,1.857,77:5,1.880,167:1,0.670,109:3,2.159,137:2,1.341,122:1,0.819,25 directional 1,0.819,13 science 1,0.819,39 industrial 1,0.670,40 line 1,0.670,74 arm 1,0.670,95 directing 2,0.649,13 spoken 1,0.549,15 progress 1,0.549,45 speech 1,0.449,121 mother 1,0.449,32:1,0.670,25:1,0.165,48 felt 1,0.368,70 involving 1,0.368,84:1,0.002,78 capable 1,0.301,295 direction 1,0.301,72 imposing 1,0.247,20 leading 1,0.202,56:1,0.819,31:6,1.345,20 conducting 1,0.165,13 showing 1,0.135,373 aware 1,0.247,15 individual 1,0.301,109:1,0.670,18 value 1,0.549,34 awareness 1,0.670,35 action 1,0.368,129:1,0.091,161 potter 1,0.449,10 self-consciou 3,1.468,39 thought 1,0.449,175 social 1,0.670,94:1,0.819,136 guardian 1,0.819,10:1,0.819,12 limited 1,0.100,104:1,0.819,13 marriage 1,0.301,35 constituent 2,1.637,21:1,0.549,56 special 1,0.670,79 exercising 1,0.301,31 control 1,0.449,64:1,0.033,74:1,0.165,184 scope 1,0.549,115 television 1,0.549,11 grammatical 2,1.637,12:1,0.819,29:1,0.819,93 dominant 3,1.368,17 molding 1,0.819,11 exocentric 1,0.100,8 opinion 1,0.549,109 fulfilling 2,1.341,12 plummy 2,0.770,3 specific 2,1.187,154:2,1.489,51 endocentric 1,0.100,9 grammar 2,1.098,57:1,0.301,36 public 1,0.670,42:1,0.368,77 noun 1,0.368,32:1,0.368,71 informal 1,0.549,137:1,0.549,25:1,0.368,131:1,0.368,75 influence 1,0.368,92:1,0.202,64 blind 1,0.670,9 mission 1,0.819,19 partner 1,0.368,11 adverb 1,0.449,19 easter 1,0.670,14 serve 2,0.998,28:7,1.897,76 function 1,0.449,74:1,0.165,61:2,0.468,56:3,1.671,62 mice 1,0.549,9 iago 2,1.219,6:1,0.670,3 prima 6,1.757,14 performer 3,0.970,14:1,0.819,4 providing 1,0.091,26 mannered 1,0.301,17 book 1,0.549,62 resolution 1,0.819,22 pair 1,0.005,64 silliness 1,0.819,17 artist 1,0.670,14:1,0.202,68 meaning 1,0.074,87 time 1,0.091,244:1,0.670,132:1,0.670,125:1,0.135,102 virtue 1,0.165,31 secondary 2,0.919,11 donna 3,0.916,14 star 3,0.997,26:1,0.015,124:1,0.100,44 nobility 1,0.202,14 derived 1,0.368,85 theme 1,0.670,13 weak-kneed 2,0.770,5 multiple 1,0.135,78 playing 3,1.938,29:2,0.313,66:1,0.670,20:1,0.819,24 interchanged 1,0.819,14 sentimental 1,0.449,20 sentence 2,0.909,14 vulgarly 1,0.247,17 decidedly 1,0.301,39 played 1,0.670,23:2,1.341,67:4,0.921,50 beache 2,0.468,8 bearing 2,0.442,52 episode 1,0.135,49 ballerina 3,0.861,14 event 1,0.670,52 direct 1,0.135,22 interchangeable 2,0.401,14 man 3,0.946,132:5,0.524,303:1,0.368,195 heavy 4,1.468,86:1,0.100,11:1,0.100,9:1,0.061,124 musical 1,0.368,17:1,0.549,205 treble 1,0.091,57 twofold 1,0.449,45 part 1,0.003,224:2,1.489,205:3,0.867,612:1,0.549,207:2,0.984,95 stature 1,0.368,18 preaching 1,0.301,39 title 4,1.660,23 figure 3,1.119,52 performance 3,1.169,59:1,0.670,96:1,0.449,90 phrase 3,1.421,36 consist 1,0.111,69 rank 1,0.449,76:1,0.135,14 dual 2,0.846,59 negotiation 1,0.819,45 camp 2,0.919,17 bought 1,0.074,14 statu 1,0.135,49 sister 1,0.368,8 fish 3,0.417,36 campy 1,0.549,17 skater 3,1.285,14 dignitary 1,0.247,11 word 2,0.917,174:1,0.449,397 beat 1,0.165,98 artificially 1,0.202,26 binary 1,0.012,54 relation 1,0.449,50 harrison 1,0.050,39 amusement 1,0.135,17 object 1,0.111,76 frederick 1,0.061,39 yolk 1,0.008,45 emerson 1,0.165,39 major 5,2.736,77 lacking 1,0.549,382 dissenter 1,0.819,5 head 2,0.549,86:1,0.100,34 starring 3,1.503,14 importance 2,0.850,80 indicating 3,0.650,84 greater 1,0.247,61 influential 1,0.549,13 argument 2,1.489,102 private 1,0.247,39 sophisticated 1,0.111,40 mathematic 1,0.549,24 effect 2,1.120,127:1,0.670,13 titular 7,2.156,17 power 1,0.670,142:1,0.301,85 logic 1,0.670,32 important 3,0.794,25:1,0.368,30:1,0.819,134:1,0.819,53 villain 2,1.219,6 fairly 1,0.247,13 stellar 6,3.157,14 fresh 2,0.307,37 aspect 1,0.449,74 world 1,0.819,90 dissimilar 1,0.368,39 quality 2,1.098,246 highway 1,0.670,20 clergyman 1,0.549,39 measure 1,0.202,62 duple 1,0.061,45 copilot 1,0.050,45 double 8,1.091,59 performed 1,0.549,49 symmetric 1,0.549,14 signifying 2,0.357,17 pilot 1,0.041,45 hollywood 1,0.449,17 actor 3,1.939,60:1,0.670,32:1,0.670,34:1,0.449,15:1,0.549,7:1,0.549,60:1,0.549,21 large 3,1.220,73:1,0.368,59 egg 1,0.006,60 component 1,0.004,109 office 1,0.670,45:1,0.301,85 door 1,0.022,76 banal 1,0.368,17 othello 2,1.120,6 manner 1,0.670,49:1,0.670,28 children 6,3.498,100 put 1,0.549,135 war 1,0.819,394 sexual 1,0.819,90:1,0.819,57 pretend 3,1.569,21 hat 2,0.770,7 position 2,0.549,324:2,1.187,148 government 1,0.549,23 adopting 1,0.449,8 perforation 1,0.100,6 other 1,0.165,73 interact 1,0.368,9 adult 1,0.301,9:2,0.196,33 doctor 4,1.361,62 person 2,1.065,195:1,0.549,256:4,0.764,1610:1,0.549,927 movie 1,0.670,5:1,0.819,64:2,1.065,15 father 1,0.819,15:1,0.135,97 opposite 1,0.819,18:1,0.819,63 group 1,0.301,140:1,0.135,127 separation 1,0.549,19 duty 1,0.819,86:2,1.268,52 fire 1,0.449,44 sport 1,0.819,145 keeping 1,0.301,53 sometime 1,0.247,36 punching 1,0.819,6 politician 1,0.819,11 player 1,0.549,337 nurse 1,0.549,27 monitoring 2,0.549,11 acting 2,0.919,16 assigned 2,0.954,38 firemen 1,0.819,7 clothe 1,0.549,14:2,1.219,61 team 3,1.589,139 act 2,0.836,1839:10,3.057,70 casting 1,0.100,25 normal 2,0.649,33 observing 1,0.202,24 customary 2,0.770,19 frankly 1,0.449,7 sex 1,0.670,41:2,0.770,25:1,0.670,45 required 1,0.165,76 psychotherapy 1,0.819,9 explored 1,0.202,11 drama 1,0.819,4 talked 1,0.549,7 roleplaying 1,0.100,3 body 1,0.135,318 doe 1,0.368,39 transvestism 1,0.100,8 choice 1,0.549,19 teacher 1,0.449,15 house 2,0.265,45 activity 3,1.030,196 patient 1,0.670,20 communication 1,0.549,14 record 1,0.368,21 hole 1,0.819,12 term 1,0.670,38 game 1,0.091,516 fireman 1,0.100,7 expected 1,0.202,20 practice 1,0.368,102 ease 1,0.670,14 emotional 1,0.670,54 horse 1,0.041,31 noisy 1,0.100,15 care 1,0.247,81 form 1,0.247,459 called 2,0.954,46 ventricle 1,0.165,47 gyru 1,0.301,27 intimately 2,0.313,38 wife 1,0.819,110 playwright 1,0.549,6 give 1,0.247,107 located 1,0.091,84 order 2,0.751,91:2,1.368,13 room 1,0.449,20 assume 1,0.670,32 stooge 3,1.737,8 big 1,0.301,20 cast 3,1.735,29:2,0.549,31 assign 1,0.819,71 transport 1,0.819,18 variou 1,0.819,39 consisting 1,0.819,179:1,0.050,99 female 1,0.819,15:1,0.301,25:1,0.449,61 profit 1,0.549,10 need 1,0.819,25 wringer 1,0.100,6 rust 1,0.368,37 art 1,0.111,45:1,0.135,88 complex 1,0.015,42 juliu 2,0.188,19 floor 1,0.111,40 tragic 1,0.819,4:2,1.637,8 ingenue 1,0.100,6:2,0.200,10 maid 1,0.449,8 write 1,0.449,29 rendition 1,0.100,5 system 2,1.219,149 lateral 1,0.135,41 dramatic 1,0.819,54 take 1,0.301,108 kind 1,0.819,21 desk 1,0.027,20 birth 1,0.301,49 development 1,0.549,12 property 1,0.368,807 parallel 2,0.919,16 basi 1,0.670,8 neural 2,0.046,51 caesar 2,0.154,19 famou 1,0.549,46 broadway 2,1.368,5 lady 1,0.549,8:2,0.795,23 photo 1,0.301,16 shakespearean 1,0.819,13 great 1,0.819,80 hamlet 2,0.751,19 nurture 1,0.368,12 prepare 2,0.770,6 fictitiou 1,0.449,5 gnosticism 1,0.202,11 model 4,1.184,23 woman 1,0.449,16:2,0.503,315:2,0.347,221 readily 1,0.301,60 gray 1,0.061,47 sunday 1,0.074,40 competent 1,0.033,23 male 3,0.634,134 adopt 1,0.449,7 central 1,0.819,60 eon 1,0.100,11 design 2,0.770,25 opposed 1,0.111,23 temporal 1,0.061,50 interpreter 4,1.238,16 typecast 1,0.100,4 theater 2,0.510,42 sea 1,0.033,32 principal 1,0.819,15 mistress 1,0.670,19 appoint 1,0.301,31 cerebrum 1,0.091,51 hippocampu 2,0.302,51 general 1,0.111,41 tree 1,0.670,57 lover 1,0.670,25 operation 1,0.819,11 served 3,0.498,44 mediate 1,0.050,21 jury 1,0.549,37 pert 1,0.819,8 popular 1,0.670,4 commerce 1,0.165,31 designed 1,0.368,11 stage 3,1.293,50:1,0.368,30 miscast 1,0.100,6 pure 1,0.202,42 relative 1,0.670,28 interest 1,0.202,68 nature 1,0.368,97:1,0.449,34 command 1,0.202,78 significant 1,0.819,30:1,0.819,12 table 3,0.499,57 union 1,0.165,13 freedom 1,0.061,47 ductile 1,0.074,107 christma 2,0.103,28 maximize 3,0.649,5 lake 1,0.301,30 president 1,0.091,29 women 1,0.165,20 iron 1,0.100,166 magnetic 1,0.091,52 work 1,0.301,144 macbeth 2,0.872,19 reproductive 1,0.819,43 script 1,0.670,51 gielgud 2,0.872,19 painter 1,0.061,44 use 1,0.111,82 support 1,0.100,13 student 1,0.247,228 men 1,0.202,61 memory 1,0.670,24 young 1,0.549,6:2,0.984,107:2,0.751,86 photographer 1,0.050,19 unsuitable 1,0.819,6 character 1,0.061,54 husband 1,0.819,45 promote 1,0.091,59 imitation 1,0.549,16 pose 1,0.041,16 comedy 1,0.368,8 universe 1,0.670,71 boyfriend 1,0.549,24 emote 1,0.100,5 lobe 1,0.074,49 artless 1,0.670,6:2,0.954,10 formation 1,0.819,24 sensitive 1,0.301,13 understudy 2,0.770,2 divine 1,0.247,34 expression 1,0.449,21 acted 2,0.229,19 painting 1,0.202,13 bus 1,0.247,26 element 1,0.135,512 raise 1,0.449,12 pseudonym 1,0.100,5 dancer 1,0.670,9 reveal 1,0.247,18 blood 1,0.549,383 comedian 1,0.549,23 army 1,0.027,46 }

whoops</comment>


Reflections of a 20-Something Working in the Big, Scary, Tech-World - <AUTHOR> http://lacke.mn/reflections-of-a-20-something-working-in-big-scary-tech-world/ <comment><USER2> Thank you for sharing. I've just gone through a very similar experience and it's about time I return to the workforce as an employee. Your reflections are insightful and I hope that I too can make the transition. Here's to finding working bliss! :-)

<comment><AUTHOR> Thanks! Cheers and good luck, keep learning!</comment></comment>


Why Intel x86 must die: Our cloud-centric future depends on open source chips - <AUTHOR> http://www.zdnet.com/article/why-intel-x86-must-die-our-cloud-centric-future-depends-on-open-source-chips-meltdown/ <comment><USER2> The fact that Spectre was manifest on Intel, AMD and ARM suggests that any open source solution that utilized the same performance strategies would have also had the same attack vector.

<comment><USER3> _> any open source solution that utilized the same performance strategies would have also had the same attack vector._

And then researchers, armed with open-source hardware implementations, can openly probe the systems with white box attacks; then they can fix the system; and then they can verify the fix.

In reading the Spectre/Meltdown white papers, I was a little disturbed at how the authors had to grok through the fog to figure out how to attack the machine, and that they could not say with certain if a particular CPU was actually invulnerable or if their particular attack was simply ineffective.

</comment></comment><comment><USER4> Much as I am in support of open source, this isn't a magic cure.

I just got confirmation that POWER is susceptible to Meltdown/Spectre so there's that...

<comment><AUTHOR> But, at least, if the architecture (not just the ISA) are open, the safety can be verified and, if we are lucky, even proven.

BTW, it seems SPARC (also open) is not vulnerable.

<comment><USER5> > _...if the architecture (not just the ISA) are open, the safety can be > verified..._

That's just the old "many eyes make all bugs shallow" fallacy, which has long been discredited. Given that architects at nearly all of the processor makers on the planet missed Spectre and the article itself notes that only "chip weenies" (their phrasing, not mine) could've figured it out, there's no real basis for such claims.

> _BTW, it seems SPARC (also open) is not vulnerable._

OpenSPARC happened to be open and happened to be not vulnerable, therefore the former caused the latter? Unless there's some persuasive evidence otherwise, that's clearly faulty reasoning.

<comment><AUTHOR> The facts behind Meltdown and Spectre are not new. We all knew not all side effects of speculative execution were reversed and some could even be impossible to (even if you clear a cache, if a read went to the bus, the CPU already disclosed to an external observer an execution path that was later discarded).

What happened is that someone insanely clever figured out a way to exploit those side effects we all thought were innocuous.

In the future, when someone looks at an open CPU design and spots an out of order core that leaks side effects of instructions that were on branches not taken, they'll hopefully remember this mess and proceed with care.

Processor erratas are always a worthy, even if sometimes terrifying, read.

And even if we consider the eyeballs are not optimally distributed, the more eyeballs we have, the shallower the bugs will be. Like I mentioned, we all knew (and I'm not even actively working in chip design - I'm just someone who reads research papers when I can) some speculative execution side-effects remain after the CPU rewrites the past and discards the primary effects.

</comment></comment></comment></comment><comment><USER6> On the other hand AWS is moving toward its own proprietary chipset handling networking and storage (Nitro). The next step might be to create their own (proprietary) CPU that is more amenable to large scale virtualization and doesn't have the x86 baggage.

<comment><USER7> But who is going to be able to use those new completely non-compatible chips for real world workload?

The problem for any fix is the same that faced Intels Itanium chips and the manycore/CELL architectures is that you kind of have to reinvent the compiler to use them and for manycore even that is not enough.

<comment><USER8> In the AWS case it probably would have to be transparent to users if they designed their own cpu. I can't imagine they'd get very far requiring recompilation or with a performance impacting translation layer.

My main point is that cloud services infrastructure seems to be moving away from open source software hypervisors (eg Xen) on commodity hardware towards opaque custom virtualization on custom hardware. If they wanted to assure their own security against bugs like spectre they would be more likely to design their own CPUs than to use an open source one.

</comment></comment></comment><comment><USER9> There is no silver bullet and it is not x86, its ISA problem, it is the implementation that matters.

On the x86 must die notes, there are rumours that Intel is working on a new ISA that takes the best part of X86-64 but put compatibility in the back-seat. I just wish they call the new ISA "AE86".

</comment><comment><USER7> The problem is more that we are still horribly addicted to single core performance and cannot really utilize a proper manycore architecture likes the ones coming out of china's higher end semiconductor industry.

This forces the semiconductor industry to keep coming up with clever hacks to make their cores more efficient despite not being able to actually increasing speed by introducing all sorts of "clever logic" that suffers the same kind of bugs as software directly into the silicon, and until we stop doing that spectra like bugs will likely keep resurfacing.

At this point the only thing unaffected seams to be low end arm cores(which don't attempt to be smarter then they are), and a couple of obscure legacy architectures like SPARC and Itanium.

</comment><comment><USER10> Looks like everyone's forgotten about the heart bleed bug - existed for a LONG time in open source software.

Open source doesn't guarantee a big free, or backdoor free implementation. Only validation budget & intensity does

</comment><comment><USER11> What does this portend for RISC/V and other architectures?

<comment><AUTHOR> RISC-V is an ISA. You can implement it in vulnerable and not vulnerable ways. My suggestion would be to extend, if needed, the ISA to mark instructions the compiler can tell aren't safe to speculatively execute so that implementations could use that instead of figuring it out on their own at runtime.

SPARC and POWER are also open. So far, it seems SPARC M7 and M8 are safe, but all current POWER CPUs are not (but don't trust me on that - I didn't check it).

<comment><USER11> I'm sorry for phrasing it poorly. What I mean is, do you think the shifting economic incentives will provide the push necessary for people to invest in production and development on the RISC-V architecture? I'm not especially into it myself, but I've been wondering if this might be the thing to get people to move on from the x86 paradigm. I've always admired RISC because small instruction sets seem that bit easier to validate, though (as you can tell) I'm no expert on chip design.</comment></comment></comment>


New ice age? Don't count on it - <AUTHOR> http://www.newscientist.com/blogs/shortsharpscience/2011/06/new-ice-age-dont-count-on-it.html <comment><USER2> With these sorts of articles now I'm never quite sure what to believe.

Now before you jump in to mock me, it's just that I don't have time to keep really up-to-date with climate change anymore. Are we really getting warmer? Are we cooling? What's causing it?

For each article I read that tells me one thing, a few days later another comes out and tells me the previous one was wrong and here's why.

I hope that this article's right and being New Scientist I have a lot more faith in it. I just wish I had more time to understand all the factors of climate change for myself.

<comment><USER3> FUD. That's the point of the decades long propaganda campaign by the energy companies. If they can't convince you outright they at least want to create the confusion and doubt.

<comment><USER4> Doubt is a very good thing.

It's propaganda versus propaganda now. I will never forgive whoever has made global warming a political issue, because it means debating rationally about it has become impossible.

Climate is a very complicated thing, especially when studied on a planetary scale. It's a bunch of chaotic parameters, and any prediction about it is likely to be wrong, or imprecise.

Much of science works that way, but problems arise when you need to make political decisions about such matters. You can't make large-scale decisions that will affect millions based on flimsy predictions that may turn out to be wrong.

<comment><USER5> So, how exactly couldn't it be a political issue?

<comment><USER4> By focusing public attention on something else. It's not as if we had a shortage of problems. Then, the matter of climate change could be settled in a scientific manner, as opposed to a religious debate involving legions of people who don't know what they're talking about.

Obviously, i'm being unrealistic. Once it's become politicized, it's already too late.

<comment><USER6> Deciding whether or not there is climate change and what is causing it is a scientific question.

What do to about it _is_ a political decision.

<comment><USER7> No, deciding what to do about it is an engineering decision.

Deciding to actually do what the engineers say is the best way to deal with the problem, based on the science, is the only political decision.

<comment><USER5> Engineers can't do that. You have to give them a goal and then you have to decide whether you like their plan for achieving the goal. The political process becomes important before engineers spring into action.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> I'd love to see more engineering efforts going towards improving our standard of living regardless of what the climate does. By all means, worry about whether the planet is getting warmer or cooler or a bit of both dependent on the place...but let's find a way to live regardless of CO2-induced warming, sunspot rarity or some other, unforeseen dramatic change.

A lot of the political and societal measures are aimed at making energy more expensive, reducing consumption and promoting a rather righteous view of how people should live. Why not spend the same effort to promote technologies that allow people to live however they want in a way that is sustainable regardless of the environment?

<comment><USER9> I don't think the aim of politics is to make people's live more miserable. Energy is being made more expensive to account for the externalities . The markets can then figure out how to make us live well with the proper energy costs.

What kind of tech promotion do you imagine, other than more efficient energy production and consumption?

<comment><USER8> I do genuinely believe that a lot of the reporting and comment on climate- related issues is a form of frenzy by the people involved - not rationally thought-out but a tendency on one side to claim that nothing's wrong and everything's fine (for optimists) and on the other to claim that everyone's going to die and terrible things will happen (for pessimists). The debate is too polarised to be useful, or even interesting, any more. Mixed-in with that, there are politicians, corporations and pressure groups seeking to distort the issue so as to create more power or profit.

I'd love to see more promotion given to sustainable agriculture that's tolerant of temperature drops or rises, city-structures that re-use the heat that they give off for something productive, research into how to build and live effectively in regions subject to hurricanes or earthquakes that don't come down to rebuild-everything-every-30-years, flood defences that are something more than 'build-a-wall', etc. I'm not saying that these things don't exist, but we spend so much time talking about how to change societies (unfeasibly, in my opinion) so as to mitigate climate change and not very much on what to do to mitigate that change into sustainable habitats.

<comment><USER9> "The debate is too polarised to be useful, or even interesting, any more"

Except that is probably part of the strategy - FUD. If you give up, the people in control are free do act as they please.

How do you propose to give incentives for development of those things you suggest? Don't you think more expensive energy would make people build more efficient things, recycle better, create cleaner energy?

<comment><USER8> It is part of the strategy - and one I have no heart to fight. There is simply no point in listening when the signal-to-noise ratio is too low and your chances of effecting the outcome are minimal.

Yes, expensive energy may do that - but is it the best way to do it? I would have thought that anyone who manages to do those things would probably make money from it regardless of whether the government takes a cut or not.

</comment></comment></comment></comment></comment><comment><USER10> Don't count on it? Honestly, I'm not counting on anything involving the climate.

</comment><comment><USER11> The Earth has been in an ice age since the Pleistocene. This is an interglacial period.

<comment><USER12> Yep, and we still don't understand what causes ice ages.

Let's stop and think about that for a minute. We're still pretty darn ignorant of the climate. Look at a plot of temperature over the last mere million years. Climate scientists will at this point tell you they know all about the variation over the last few decades. But point to the huge swings that occur on ten-thousand-year timescales and periodically freeze the entire Earth over and they'll say "Yeah, well y'know, that could be a number of things..."

Climate science is a dodgy form of science. Too many model parameters, too few observations.

<comment><USER13> Climate Science isn't a science. For science to be science, you have to control for variables.

When you can't--like with climate studies--you rely on intuition instead. That's a social science.

<comment><USER12> That's going a bit far.

It's all well and good to come up with a model for what the climate should do based on basic physics. The main trouble with climate prediction is that we don't have enough data points to check whether the models are really correct.

I do physical modelling for a living, but I know not to trust a fitted-but- untested model any further than I can comfortably spit a rat.

</comment></comment></comment></comment><comment><USER14> My friend writes: _Also, the 10-12 year cycle of sunspots does not have a significant effect on climate. In fact, the climate scientists desperately trying to find other causes of global warming investigated them thoroughly, studies show that the change in solar insolation to be roughly one and a half orders of magnitude smaller than needed to be comparable to the current temperature changes. The temperature decrease from even the little ice age was less than a third of the temperature increase we've already experienced, and you know we're in for another three times that best case scenario. A little ice age now would be a wonderful coincidence, but would hardly change the dire outlook as the heating well surpasses it. That fortuitous event would only effect the price we put on carbon by ~1/3_ 1/3. _

</comment><comment><USER15> Right, so there was a grand minima between 1645-1715, which has been widely attributed to the last mini-ice age and yet there is no way that this one can do the same because our models do not predict it, even though our models couldn't predict the current grand minima in the first place. From a logical standpoint, this argument makes absolutely no sense and suggests that the model is incorrect.

</comment><comment><USER16> Anyone have a link to the BBC coverage of this story?</comment>


GitHub Actions: The Runner is now open sourced - <AUTHOR> https://github.blog/changelog/2019-12-19-github-actions-the-runner-is-now-open-sourced/ <comment><USER2> Its forked version of AzureDevOps Agent

[https://github.com/microsoft/azure-pipelines- agent](https://github.com/microsoft/azure-pipelines-agent)

</comment><comment><USER3> ...and written in C#

<comment><USER4> What's wrong with C#?

<comment><USER5> I think that was just adding info to above comment not a complaint.</comment></comment></comment>


Security researchers crack Hitag2, compromising over 34 car makes and 200 models - <AUTHOR> https://www.usenix.org/conference/usenixsecurity12/gone-360-seconds-hijacking-hitag2

<comment><AUTHOR> I wasn't able to find any English articles about this crack apart from the actual paper.

Dutch source: [http://nieuwsuur.nl/onderwerp/403997-auto-eenvoudig-te- stele...](http://nieuwsuur.nl/onderwerp/403997-auto-eenvoudig-te-stelen.html)</comment>


Ask HN: Tips on (mind) hacking programming interviews? - <AUTHOR>

Hi HN,
I've worked for several years as a developer at a company that most would consider to be a top-tier tech company. I also got a degree from a top-notch CS program and did well in school. I've done well at work and have hacked on various projects on the side. However, none of this really matters when it comes to applying for jobs, since the most it gets me is a quick response from recruiters and my resume at the top of the pile. Like all other mortal developers, I still have to go through the interview process.
This is where I'm having problems.
Lately, I've been interviewing with various startups and tech companies with high hiring bars. For some reason, I just don't seem to be doing very well in the initial phone interviews. The questions are not hard, but the combination of having to think, write, and talk at the same time is causing me problems. I can usually only proficiently do one or two of those things at a time. Some of the companies use web-based collaboration tools for the phone interviews where the interviewer can see responses in real-time. This seems to only make things more difficult. I find it hard to strike a fine balance between talking out loud to verbalize my thought process, taking time to think solutions through, and getting code out so the interviewer sees that I'm doing something.
It also doesn't help not knowing what the interview wants to see. Should I draw everything out on paper then type out the code? Should I just blast out code then fix it as I go? Should I talk while I'm thinking or brainstorming or coding? It's all very distracting.
At times, I find myself not actually thinking about the problem at hand, but thinking about how the interviewer thinks I'm doing. The less feedback or response I get from the interviewer, the worst off I think I'm doing, and I lose focus on solving the problem. It also doesn't help that I've been on the other end of the phone as the interviewer, dozens of times; it's even more distracting when I realize that I'm making some of the mistakes that so many candidates I've interviewed have made. For me, it's not really a lack of knowledge or preparation. I need to figure out how to balance thinking/writing/talking in a manner such that the interviewer can see that I'm not a complete n00b.
So, I'm reaching out to the HN community for ways to hack the interview. Especially any "mind" hacks.
* How do you approach interviews mentally - especially phone screens?
* Do you draw things on paper before implementing a solution? How do you progress from conceptualizing a solution to implementing it?
* How do you verbalize your thoughts or let the interviewer know that there's progress being made and you're not just bewildered and completely lost?
* What are some psychological ways to hack the interview? How do you stay focused on solving the problem and not get distracted by having to express your thought process and worrying about the interviewer's perception? <comment><USER2> 1) Do they want to hire me? Yes, hiring me is the best thing that ever could happen to them. So in the worst case it's they who fail in this interview, never me.

2) I draw only if I need to explain something to the interviewer. But I have a visually oriented way of thinking, so I don't need this for myself in most cases. Then tell them how to implement this or that, when I know how it would work. (We will need a vector to store this data, run a search on this, have those tables in the database, linked this way, to be queried with this SQL expression). Would depend of course, if they actually expect you to show some code or just to outline the core points of the possible solution.

3) Normally I talk a lot and let them know intermediate steps (Watch their faces, you can see if you're on the right track). There is no problem in saying something that's wrong. If the interviewer knows a bit about the job, he won't expect you to be perfect on the spot. (If they send you somebody to interview you who doesn't know that: wrong company, good bye) If I get stuck, I tell them that that's a complex problem and I need to think some time about it. Shouldn't be a problem. Maybe I give them some of the points that make me worry and line out the possible problems and solutions. (If I do it that way it will use more memory, but the other way will give me better performance, cleaner code...)

4) I just tell them what I'm thinking. I don't think what they may want to hear. They get what I have and that's it. If they don't like it, that's bad luck (For them of course, not for me)

</comment><comment><USER3> schedule a interview with a company you don't really want a job ahead of the interview with the company you do want a job from as a practice interview.</comment>


Show HN: Stop wasting money on Saas services you don't use - <AUTHOR> http://saasly.com

<comment><USER2> I think it could be useful, however I just caught myself summing it up to the guy sitting next to me as "a web service for people who subscribe to too many web services"

</comment><comment><USER3> I'm a little surprised about the praise this is getting here.

"First world problem" seems like an understatement. More like "Silicon Valley problem"...

<comment><USER4> Well, the one thing Silicon Valley does best is solve its own problems :)

<comment><USER5> Hah! Very true. Very inward looking right now. What's the world coming to when the ROI touted on the homepage is "I saved $45 a month!" Well, that sounds too snarky. I'm sure this will be valuable to a lot of folks.

<comment><USER4> Simple honest answer, its a beachhead. Techies are natural early adopters so it makes sense to start small with them. Trust me, our ambitions are far greater :)

<comment><USER6> Eventually you'll get to "Hey! Are you sure you still need Netflix? You haven't used it in weeks!" =)

</comment></comment></comment></comment></comment><comment><USER7> Honestly, this is great idea. But I'm not going to forward all my bills to some random service. If it somehow worked automatically (ridiculous, I know), I'd absolutely use it.

I just don't want all the overhead.

<comment><USER4> Yep, inbox mining (via gmail oauth) is our first dev priority. I agree it's gotta be automatic for it really to be useful. Thanks for the feedback!

<comment><USER8> Alternatively, perhaps you could set up mailboxes for each user that can be entered as the billing address on the individual services.

eg: On my Freshbooks/Chartbeat/Less Accounting/whatever dashboard, I put in "firstname.lastname@example.com" as the billing address, then all mails from that service go directly to you - you may even be able to attempt to parse arbitrary services, looking for a "Total: $n.nn" type string in the e-mail, or set up per-service parsing.

</comment></comment></comment><comment><USER9> If you're wondering about the process, look at this link. <http://saasly.com/confirmation>

Not sure why you wouldn't want to put that front and centre (instead of making me enter my email first).

<comment><USER10> Thank you. I definitely shouldn't have to work to find out what this service actually does, and there's no way I'm giving my email (even to someone who says they won't spam me) until I have an idea how the thing works.

<comment><USER4> Yeah, good call. We figured we didnt want to confuse users on the "how" while we were trying to pitch them on the "what".

We'll add a "how do we work" link that brings up this information directly on the landing page.

</comment></comment></comment><comment><USER11> I wish there were a way to use useful services like this without granting permission to read all of my email.

<comment><USER4> Agreed. That's one reason why we added the email forward (so you just have to forward the specific bills). But it's a bit manual (though you only ever have to forward once, we calculate the monthly date for all the other bills for each service).

Also, we got a great suggestion from someone else about setting up inboxes for everyone so you can just sign up with services with [yourname]@saasly.com and then we just look at your bills instead of all your email.

</comment></comment><comment><USER12> The idea is pretty neat--I recently got the reminder that my AWS free trial was expiring soon, which trigger a "holy crap!" moment because I had completely forgot I was even running an instance there.

That said, seriously guys what is it with ending everything in -ly? It doesn't even really make sense... "in a manner resembling SaaS"? And you're saasly.com, not even saas.ly. SaaSmon, SaaSwatch, these sort of indicate what you're doing, at least, and are reasonably pronounceable too.

</comment><comment><USER13> Would Sassly ever tell me I'm paying to much for Sassly or is that too meta?

Thanks, it's a great idea I'll be leveraging soon! :)

<comment><AUTHOR> We're free, forever.

</comment></comment><comment><USER14> You might want to look into inline installation for the chrome extension:

[https://developers.google.com/chrome/web- store/docs/inline_i...](https://developers.google.com/chrome/web- store/docs/inline_installation)

<comment><AUTHOR> Thanks! That's great feedback :-)

</comment></comment><comment><USER15> Personally, if this service could tell me of all the sass software that I am using, that alone would be tremendously useful.

Recently, just for testing, I subscribed to multiple tools to measure site's performance, SEO, to help me navigate all the social media chatter, to help me alleviate emails ...etc.

The only ones I remember are SEOMoz and 37Signals product, because they charge a lot of money and that's kind of memorable. Everything that charges under 20 bucks is below radar until it accumulates.

If this tool could simply extract this bill information and remind me to unsubscribe in time, it would certainly be helpful!

</comment><comment><USER16> Then once they mine your inbox / bank statements they can get referral bonuses for legitimately churning you to alternate energy / insurance / telco subscriptions etc.

People will hand over all kinds of data to save money.

(Not being snarky, I suspect there is a bigger business model for this)

</comment><comment><USER17> Congrats on executing a cool service. I wouldn't say we are a direct competitor (mergepay.com), since we are focusing on tracking for businesses and eventually income/expense tracking. Seems like there is definitely a need for this kind of thing.

</comment><comment><USER18> Awesome idea and only gonna be better with the mail mining. Once you get some traction should be easy to sell targeted ads and mine your own data and sell as market research. Is a Firefox add-on coming soon for the non-Chrome folks?

<comment><AUTHOR> Thanks -- Yeah, the service coud definitely be a lot more useful once we're capable of mail mining. When we get traction, we'll be able to sell more specific ads and capture some basic, anonymized data about usage.

</comment></comment><comment><USER19> Before signing up, it'd be great to know what services you "support."

</comment><comment><USER20> What a fantastic judo move service. Almost feels counter-cultural.

</comment><comment><USER21> I suddenly have this image of a programmer working while seated in one of those carnival dunk tanks. With a clock ticking away....

<comment><USER22> And then I suddenly had this image of very upset developers soaked in the tank with thousands of dollars worth of laptops and other hardware ruined.

</comment></comment><comment><USER23> Great tool for individuals AND could be seriously useful to businesses tracking team usage across several services. Very cool.

</comment><comment><USER24> How much for your customer list? A list of impulse subscribing customers has got to be worth something...

</comment><comment><USER25> This is awesome .. have been waiting for this.

</comment><comment><USER26> I have been waiting for this type of product

</comment><comment><USER27> This is a fantastic idea. I could see myself using this thing as a consumer too (ie not just for hacker stuff). May have much broader appeal than something just for hackers. Monetization should be fairly straightforward... You know what apps people have, sell very targeted ads for new stuff, sort of like a mint. Seems like a potential gold mine once you get to scale.

You should build something that searches through my gmail for common bills though, I don't want to go through the process of sending you all my bills</comment>


Snowboarding, Life and The Secret Of Pushing Yourself - <AUTHOR> http://macournoyer.com/blog/2010/02/14/snowboarding/

<comment><USER2> Yeah word of advice kiddies don't try that trick unless you can land other ones. It's a good point that you need the guts but you also need the planning and skill. He practiced in his mind and watched video's.

<comment><USER3> Practicing in his mind is actually the most important thing he did to land it.

I watched a documentary on TV a long time ago that said that Olympic divers will typically spend several days rehearsing a dive they've never done before in their head before attempting it. Only when they feel confident that they've got every motion clearly set in their head do they try it.

There was a scientist who was doing I think fMRI tests on one of the divers as he was "practicing" and the scientist said that most likely when the dive is actually being executed (the diver didn't have that head-bowl thing on when he was actually diving obviously), the same neural pathways are used. What the diver was doing when imagining the jump over and over was reinforcing the same pathway over and over. That's what allowed him to execute the dive perfectly on the "first" try.

The same effect comes into play in a breakup after a long relationship. The reason you feel so depressed and so physically bad in an unexpected breakup is that you've been reinforcing one specific pathway every day for years so if it's suddenly cut off the brain doesn't handle that well at all.

</comment></comment><comment><AUTHOR> The last sentence just about sums up personal growth for me.</comment>


Proxmia B May Have Oceans - <AUTHOR> <comment><USER2> On its own this is a bit underwhelming; a link might have been nice.</comment>


Trolling Right Along: An Interview with Joe 'Big Cock' Johnson - <AUTHOR> http://www.uni-watch.com/2013/04/19/an-interview-with-uni-watchs-most-prominent-troll/

<comment><USER2> This is a pretty hillarious article, you're unlikely to read anything like this for a while since Weev is in jail.</comment>


Chrome Release Cycle - <AUTHOR> https://docs.google.com/present/view?id=dg63dpc6_4d7vkk6ch&pli=1 <comment><USER2> I've used chrome for about a year now. I've gotten so used to the seamless and silent updates that every other piece of software seems like nagware.

I'm sure I'd be singing a different tune if it broke my browser during a silent update.

<comment><USER3> Lack of silent updates was one of the key reasons I switched from Firefox to Chrome (speed was another.) Seemed like every time I opened the browser to view a webpage I needed to see _that very moment_ , Firefox would pop up an annoying update prompt that I'd keep clicking out of each time.

<comment><USER4> The funny thing is that from a Linux user's perspective, Google was simply providing a workaround for what should have been the OS's job. On Linux, Firefox's auto-updates are disabled so that the OS can handle that instead.

This is probably the best solution, as it gives you the most control over updates, and applies to all software system-wide. You're not forced to install updates at any time, and you can disable the notifications if you want.

<comment><USER5> The update popup for extensions is still annoying though - even on linux.

<comment><USER4> Like I said, you can disable that.

</comment></comment></comment></comment></comment><comment><USER6> One thing that helps Chrome release often is that the api for building extensions is all javascript. By comparison, Firefox extensions can have binary components. This means there needs to be a certain amount of platform stability or extensions will break every six weeks. I think that in the future we'll see faster release cycles for Firefox as the api for extension building becomes more js based and less dependent on xpcom components.

<comment><USER7> I don't know about that. I would love to have an extension that made the omnibar a lot more like firefox's awesomebar (good indexing, can search for key phrases for title of article and the such) but to my knowledge that's pretty much impossible because of the javascript limitation (I hope I'm wrong here, not really sure).

I just wish google was a bit more subtle about wishing people search on google again when looking for previously viewed sites.

<comment><USER8> Funny, I wish Firefox's awesome bar let me press enter to go to the first result without pressing down first.

</comment></comment></comment><comment><USER9> One 'problem' with this modus operandi is that some companies use the big releases as selling points. It is interesting that the Chrome team does not feel the pressure to do this. Especially considering how heated the browser war is these days. Everyone seems to think Firefox 4 is going to be the salvation, for example.

On the other hand, the silent updates are a blessing, and good features are another way of attracting users.

<comment><USER10> Well, Google does make some noise about releases. I forget which version (proving your point) of Chrome brought the Store, but at the time it was touted by version number, despite the silent update. Probably something we'll see more of as companies move to the cloud and mobile.

<comment><USER11> The version number was touted by tech blogs and other media, but not by the Chrome team themselves, a point which they made in response to a comment here on HN if I remember correctly.

</comment></comment></comment><comment><USER12> I like the idea of hiding features behind flags. You can see evidence of this from the number of command line options in the source:

[http://src.chromium.org/svn/trunk/src/chrome/common/chrome_s...](http://src.chromium.org/svn/trunk/src/chrome/common/chrome_switches.cc)

They do this even for fundamental features of the browser. For example, there's four different process models available:

[http://dev.chromium.org/developers/design- documents/process-...](http://dev.chromium.org/developers/design- documents/process-models)

For planning software releases, I take inspiration from Chrome, Ubuntu, and Microsoft. They all have different release cycles, it's interesting to compare them.

Chrome: agile, 12 weekly releases, subtle upgrades, parallel versions with different stability levels.

Ubuntu: fixed six monthly schedule, well advertised schedule (e.g. <http://www.youtube.com/watch?v=107E4RXNxYc>) means difficult for them not to release on time, it's a selling point. Every 24 months long term support release.

Microsoft: major products released approximately every three years. Heavy marketing efforts around releases rather than features. Service pack releases and patches released on an ongoing basis.

I guess Chrome has less of an enterprise install base, which means they are more able to release on an ongoing basis. Enterprise IT teams like to install known good releases and not let other the vendors manage the upgrades.

<comment><USER13> Also: Microsoft is charging for updates. I'm not sure people are ready for a paid subscription service for windows.

<comment><USER14> Indeed. Microsoft charges for their major version updates. I'm sure this is a reason why people have put excessive importance in Chrome's major version number. When you release for free you can choose version numbers for engineering reasons, when your revenue is tied to releases you ensure that each major version bump is sufficiently "meaty" to justify the purchase.

</comment></comment></comment><comment><USER15> "Market features, not versions," but to be sure this is Chrome's most important feature. It also mirrors what's happening in the development of HTML. [http://www.mail- firstname.lastname@example.com/msg23160...](http://www.mail- firstname.lastname@example.com/msg23160.html)

If IE had been engineered in the same way, we never would have gotten into the IE 6 trap and when all browser manufacturers adopt this strategy, web technology will move much more quickly.

</comment><comment><USER16> This came out at just the right time. I've been pushing my team towards a releaSe cycle very similar to this one, not modeled after any particular system, just seemed like a good. Idea. Nice to have some outside vindication from such a respected source.</comment>


Show HN: I hooked up my smart light bulbs to my Bitcoin portfolio - <AUTHOR> https://youtu.be/VvrtAw1AEcw <comment><USER2> Creative project. However, I wonder if it would have been more efficient to do this with IFTTT vs creating a Home Assistant script from scratch.

<comment><AUTHOR> Yeah, now that you mention it, maybe IFTTT would have been easier / more efficient!</comment></comment>


Lorentz.js - live reload client. - <AUTHOR> https://github.com/eoinmurray/lorentz

<comment><USER2> Hey Eoin, Could you explain what benefit this may have over livereload itself?

<comment><AUTHOR> Not much, other than the fact that its really small and takes two lines to implement. For a node.js app it may be faster than the [node-livereload] because it uses socket.io instead of polling.

[node-livereload]:<https://npmjs.org/package/livereload>

<comment><AUTHOR> Ah, the title is misleading, this is not a client for <http://livereload.com/>, its just an auto-refresh that I built in node.

<comment><USER2> ah! thanks for the clarification.</comment></comment></comment></comment>


Hybrid graphical novel - <AUTHOR> http://graphicnovel-hybrid4.peugeot.com/

<comment><USER2> Very interesting execution, but I found myself frustrated that it didn't want to let me control the scroll speed.</comment>


Why the US Government Just Made Its Own Font, Open Sans - <AUTHOR> https://motherboard.vice.com/en_us/article/evy4wj/why-the-us-government-just-made-its-own-font <comment><USER2> > Fortunately, the GSA is releasing Public Sans under the SIL Open Font > License, so designers working on projects outside of the federal government > will be able to freely utilize the new typeface.

Aren't all works of the federal government copyright-free by law, regardless of whether they have an explicit license?

[https://en.wikipedia.org/wiki/Copyright_status_of_works_by_t...](https://en.wikipedia.org/wiki/Copyright_status_of_works_by_the_federal_government_of_the_United_States)

</comment><comment><USER3> Title is wrong Public Sans not Open Sans</comment>


New Patent Law Actually Makes Life Harder For Startups - <AUTHOR> http://www.betabeat.com/2011/09/19/new-patent-law-first-to-file-startups/

<comment><USER2> I think 'tzs actually is an IP lawyer (or studying to be one?) and here's his largely-positive take on this bill:

<http://news.ycombinator.com/item?id=3011427>

Much is being made out of "first-to-file" vs. "first-to-invent", but the name is scarier than the actual practice. 'tzs explained that one too:

<http://news.ycombinator.com/item?id=2976041>

His summary, paraphrased: first-file is as accurate as first-invent, but cheaper. In particular, it seems to be subject to less legal uncertainty.

Broadly speaking, the only reforms to patent law that really matter to startups are the ones that foreclose on patent trolling. Patents take longer to issue than the event horizon for most startups. In the 5+ years you'd wait to get one --- an award that merely offers the privilege of spending hundreds of thousands of dollars and many additional years to initiate lawsuits --- you'll already have proven your company or not.

<comment><USER3> I'm not a lawyer, though I once was studying to be one. In '92 I took a break from programming and went to law school (University of Washington) with the intent of becoming an IP, corporate, tax, and civil rights lawyer.

This was motivated both by curiosity about the law, and I was getting burned out on programming. We were basically a small contract programming shop, specializing in taking on firmware projects that were late, over budget, and failing and turning them around on a fixed bid and tight schedule. It was rather intense, and after four years of it, I needed a break.

Law school was a perfect extended vacation. While I was in law school, my former company had switched from the business of fixing people's messes to developing its own products and selling them, and I had done some programming on that part time and over the summers as I got over my programming burnout.

By the time I was finishing up law school, and only had left writing a paper for the intellectual property seminar I had taken, I hit a case of writer's block. I could just not get going on the topic I had chosen (intellectual property issues of usenet).

By that time the plan was to get the law degree, pass the bar, and go back to my old company as primarily the chief programmer and secondarily as in-house counsel on corporate and IP matters. I went back to work full time that summer and intended to write the paper when the writer's block passed and inspiration struck, however long that took. I never did get around to that, and that's where the matter stands today, 16 years later.

So, combine that with (1) a decent math and science background (BS Mathematics, Caltech, class of '82), (2) an above average ability to recall obscure but relevant snippets from magazines, books, blogs, and whatever other random sources I've read or seen, and (3) sufficient lack of a social life that I have time to Google obsessively before making statements of fact that I'm not sure of, and I can end up sounding like I actually know what I'm talking about!

<comment><USER4> A math degree from Caltech is more impressive than a law degree.

</comment></comment></comment><comment><USER5> Why doesn't someone start a project to crowd-source the reviewing of these patents?

There are 150k patents issued in the US every year, which works out as some 410 a day. For a small company, that'd be a gargantuan task. Let's say half of these are software patents. That's 200 a day.

All you need is about, what, 1400 programmers to volunteer a few hours every week to review the 1400 relevant patents and flag them up for "wait a minute, wtf". If those are then rejected, it will make spurious patent filing a costly and pointless endeavour. If the patent office isn't reviewing stuff, it sounds like we have to take that into our own hands.

1400 programmers for a few hours a week doesn't sound that impossible. Presumably the EFF could help on the legal side. Or am I missing something fundamental?

<comment><USER2> Because, not to put too fine a point on it, programmers suck at evaluating patents.

Patent language is pure, uncut crystal nerdbait. If you don't know how patent claims language works (and why would you?), most patents will appear ludicrous --- and that's assuming your programmer patent reviewers even know the difference between claims and background material.

Incidentally, reviewing patents prior to their issue isn't necessarily a win for defenders. I remember reading an analysis showing that defenders stand a better chance invalidating a patent in court than during the patent process. The crowdsourced review process could just end up helping patentholders by providing a first wave of claims strengthening.

It would be far more feasible to fight and win the battle to abolish software and business method patents.

<comment><USER6> I don't know that it's possible to abolish software patents. The Supreme Court tried, and were overruled by a lower court. Then those lower court precedents were invalidated, yet software patents are still not abolished. The US legal system is baffling.

<comment><USER7> _The Supreme Court tried, and were overruled by a lower court._

what

 _The US legal system is baffling._

I can see why you'd think that. Could you try referencing which case you think involved a lower court overruling the Supreme court (like find a news story that mentions it or something)? That way someone might be able to clear up the misconception for you. I agree that civil procedure and matters of precedent can be very confusing, but I promise you the lower courts aren't going about overruling the Supreme Court, much as they might like to.

<comment><USER6> I promise you that if the legal reasoning in "In re. Alappat" and "State Street" were applied to Benson and Flook, those cases would have been decided the opposite way. The legal precedent in those Supreme Court cases was overruled by the Fed Circuit.

</comment></comment></comment></comment></comment><comment><USER8> I thought the same thing, until someone pointed out that if you publish information on your invention, it makes it impossible for anyone else to file after that. (Prior art.) However, YOU can still file up to a year later. (In Europe, it works as prior art against yourself, though. Meaning you can't file, either.)

That effectively makes it 'first to publish' rather than 'first to file'.

I am not a lawyer, and neither was the person who told me this.

<comment><USER9> I believe under the new law you would need to show you employed your invention as part of a business prior to their filing in order to have a case for prior art.

<comment><USER2> Am I misreading this, or is what you said the opposite of true?

[http://www.law.com/jsp/nylj/PubArticleNY.jsp?id=120251473037...](http://www.law.com/jsp/nylj/PubArticleNY.jsp?id=1202514730370&Finally__A_Revitalized_Patent_Act&slreturn=1&hbxlogin=1)

(It is _very_ likely I'm misreading it).

<comment><USER10> I'm an entrepreneur and inventor. I want to make a record here that I have no fucking idea whether publishing my invention is enough to have Prior Art, or whether I need to state the use of the invention in my business case, or whether I need to file a patent.

<comment><USER2> As an entrepreneur, an "inventor", and a patentholder: I believe this is simple:

(a) if you're planning on staking a claim on a patent, get a patent lawyer ( _no part_ of this bill reduces the need for IP lawyers; whether you like the concept of requiring IP lawyers or not is besides the point).

(b) if you're not planning on getting a patent (and I think you shouldn't, for simple pragmatic reasons), just publish what you're doing as soon as you can, and you'll have established a prior art track record.

The reform we're talking about changes the mechanics of competing claims for a patent, but it doesn't make prior art harder to establish (my understanding is that in a variety of little ways it makes prior art _easier_ to establish).

</comment></comment></comment></comment></comment><comment><USER11> Can you say plutocracy?

<comment><USER12> Go back to reddit.

<comment><USER2> I appreciate the sentiment but next time just hit the downvote button.</comment></comment></comment>