Learn prolog now - <AUTHOR> http://www.learnprolognow.org/ <comment><USER2> Prolog is a language where easy things are hard and hard things are easy. It will expand your mind in ways that even lisp cannot manage.</comment>


Why the AWS Crash is a Good Thing. - <AUTHOR> https://signnow.com/blog/2011/04/22/why-the-aws-crash-is-a-good-thing/ The cloud computing world is in crisis and its a good thing for everyone in the long term. <comment><USER2> While I agree this is a good thing, the central issue in my mind is that AWS lead a lot of folks to believe that spanning their application across multiple availability zones was a way to protect against AWS's own failures. They spoke at YC a few months back and recommended this as a primary strategy for dealing with failure. None of their engineers or staff recommended spanning applications across different physical locations.

When all of the dust settles on this mess, thats the one question I'll be demanding from AWS. Also, how will they prevent multiple AZ's from going down simultaneously in the future?

<comment><USER3> Some of this is evolving, but if it turns out AWS mislead people you are right.

</comment></comment><comment><USER4> Twitter goes down all the time, sure, facebook has dropped off, yeah...

But neither of these things have ever happened for a full day. If twitter goes out, refreshing a few times (this was true even a couple of years ago when the downtime was _really_ bad) usually lets you get through. The worst I remember seeing was a few hours down.

Same goes for facebook. The worst I can recall right now is part of the oauth system bailing out for a few hours.

AWS going out like this is an entirely different disaster. Not only was it down for an entire day, but there were a _ton_ of eggs in the basket.

<comment><AUTHOR> I expect large companies will rethink scalability and not put all eggs in one basket.

</comment></comment><comment><USER5> 100% uptime _is_ possible, and it's possible today. Nobody complains that their torrents are ever "down".

So to correct: 100% uptime is not possible... with a central point of failure such as a datacenter.

<comment><USER6> Ironically enough, I have an... interesting service provider at this location who aggressively throttles peer connections. I've been using torrific as a workaround, which, in turn, uses AWS.

So yes. My torrents are "down".

<comment><USER5> Your torrents aren't "down". In the same sense that having a theoretical crappy ISP that blocks GMail doesn't mean your GMail is "down".

When we talk about downtime we usually mean a global outage, for most everyone.

That's what happened at Amazon. This never happens for an active torrent. And it's all by design.

</comment></comment></comment><comment><USER7> How much do organizations such as Amazon, Facebook, Twitter, Hacker News etc. plan ahead for holidays such as Christmas, Easter, Thanksgiving, Mother's Day, or the last day of school, first day of University?

It seems most outages could at least be predicted somewhat just by looking at "cultural patterns", for lack of a better phrase, from my perspective a lot of outages seem to occur during the events I mentioned.

Add to that most people and resources may not be available as much or as quickly during the days when it's busier making it even more likely something will happen.

</comment><comment><USER8> s/Why/How/

</comment><comment><USER9> > Why the AWS Crash is a Good Thing

because it didn't happen with me.</comment>


Show HN: Debuggify – Advanced error analytics for modern Javascript applications - <AUTHOR> https://www.debuggify.net/

<comment><AUTHOR> Hey everyone ! We are trying to make internet a better place for everyone by helping web-developers in finding and solving javascript related problems on their live websites/apps and also helps them provide a bug free experience to their end users.

</comment><comment><USER2> You mention that Google Analytics uses image URLs to send data and the limit is 1800 characters. It's actually 2083 characters in IE, and 20,000+ characters in other browsers. We use the image tag for similar reasons as well, and wrote a component that chunks up the data and can send out large amounts of data this way with no noticeable hit on the user's machine.

<comment><AUTHOR> @city41 If you subtract the host information this size is further reduced. As IE has more than 20% of the internet traffic, this is a big limit.

Yes, you can definitely hack things as required to make sense for you, but google analytics doesnot do that automatically.

<comment><USER2> That is true, about the host info.

btw, now that I've been to the demo page, every time I return to www.debuggify.net, I get redirected to <https://www.debuggify.net/dashboard/debuggifydemo#/projects>

<comment><USER3> I think it is logging you into a demo account. You need to logout.

<comment><AUTHOR> yes, you need to logout. After logout you will be redirected to homepage

<comment><USER2> I realized that, I guess my point is it's odd behavior. I would still want to get to the homepage if I was logged in. I'd especially want to get to the homepage if I was logged into a demo account. I was trying to show a coworker the homepage.

<comment><AUTHOR> I agree, I have added it to my todos.

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> I was one of the early users and can definitely attest the analytics + error traces work really well.

I think the major differentiator here is that many products just focus on analytics and some on errors but bringing both on a single screen gives a developer much better insights.

</comment><comment><USER5> This is a great looking product. You might want to have a native English speaker proofread the homepage, there are some sentences that either contain typos or feel unnatural.

"Advance Error Tracking" "through setTimeout and setInternval" "The errors tracking" "This come in handy"

<comment><AUTHOR> Thanks for mentioning it. I will take care of it.

</comment></comment><comment><USER6> This will definitely a relief for a product like ours - one of the modules of our product works inside Gmail...

<comment><AUTHOR> yeah, true

</comment></comment><comment><USER7> How is this different than: <http://www.errorify.com/> ?

<comment><AUTHOR> Debuggify does much more than just tracking javascript exceptions through window.onerror.

For starters

\- provide apis to track custom exceptions though try catch

\- enables you to track errors for cross origin scripts

\- support minified code through source map

\- track the users so its easy to understand the impact of problem.

\- supports modular logging same as server side

\- track custom events

\- search though the data

And much more

Check out documentation to know more

<http://developers.debuggify.net/docs/#!/guide/simple>

<http://developers.debuggify.net/docs/#!/guide/advance>

</comment></comment><comment><USER8> What's the difference between this and ranger.io?

<comment><AUTHOR> Debuggify is all about tracking problems when users using you website in live environment and help developers to fix them as well. Its can be called Crashalytics for Javacsript driven applications

Whereas Ranger.io seems to monitor URLs, if the url doesnot open it will report

</comment></comment><comment><USER9> i have seen the product, looks very helpful.

<comment><AUTHOR> Thanks, Try it out and give some feedback.

</comment></comment><comment><USER10> tried it for my blog. Looked good.

<comment><AUTHOR> Cool

</comment></comment><comment><USER11> looks good idea. will try it out.

<comment><AUTHOR> Thanks</comment></comment>


Why LiteCoin is better than BitCoin - <AUTHOR> https://www.reddit.com/r/litecoin/comments/7cngf8/prompt_about_this_whole_marketing_thing/dpr756b/ <comment><USER2> I also like Litecoin a lot as an speculation/investment. It has very high transaction volumes relative to the market cap. So people are actually transacting with it instead of hodling.

<comment><USER3> That's every coin but Bitcoin. Ethereum, monero, Bitcoin cash, etc are all fast and trivial to send transactions through. Only Bitcoin has problems because it is being artificially strangled.</comment></comment>


Breaking a Monopoly - <AUTHOR> https://en.wikipedia.org/wiki/Herbert_Henry_Dow#Breaking_a_monopoly <comment><USER2> Funny story. I wonder why Bromkonvention didn't raise the price of bromine to just under what Dow was selling at? That way it wouldn't be economical for Dow to buy it and ship it back to Europe.

<comment><USER3> In that move, the goal would have been to put Dow out of business. If it is a few cents lower, Dow can also go a bit lower. Putting the competition out of business needs them to put it so low that the other party has to run up huge loses or no sales at all.

</comment></comment><comment><USER4> Reminds me of Milo Minderbinder's failed plan to buy all of the cotton in Egypt in Catch-22.</comment>


Google Now's latest update is… "In your face" - <AUTHOR> http://marakblog.wordpress.com/2013/11/23/google-nows-latest-update-is-in-your-face/

<comment><USER2> The only thing I want is to be able to choose the "main" desktop. Right now, this is reserved for the first desktop to the right of the Google Now page. So, when you press the home key, it takes you to that desktop.

Prior to installing the GEL, I had two desktops on either side of the primary one, but pressing home would take me to the center one. Now that Google Now took up residence to the left of the main desktop, I had to move the previous "left" desktops to the far right, which means two more swipes than before. The only reason I had to do this was because GEL thinks the primary desktop is the leftmost one after the Google Now page.

If they update it to allow choosing a primary desktop, the problem goes away.

</comment><comment><USER3> All of these updates can be turned off ... that's part of the point of Google Now. You choose the categories of things you want to be notified of.

<comment><AUTHOR> You can't turn on/off notifications as you please. All or nothing since the latest update.</comment></comment>


409A as a Service: Cash Cows Get Slaughtered - <AUTHOR> http://siliconhillslawyer.com/2014/03/15/409a-service-cash-cows-get-slaughtered/ <comment><USER3> God this is an insanely good idea. Not only do you solve a real pain point for startups (the whole 409a eval) but if they sign up and feed you monthly updates on their financial position you could massively front run the market on what startups were going to pop and which were going to expire quietly. Google thinking about acquiring your startup? Lets have a look at the other six companies in your space for which is the right one to grab and for how much. Ka-CHING!

<comment><USER4> Hello -- founder of Preferred Return (the valuation firm behind this offer that is partnered with eShares) here. As appraisers we cannot own equity or any economic rights in the companies we value.

<comment><USER3> That makes perfect sense, but it isn't owning equity in the companies that is valuable, rather it is the knowledge of both the current value and change in value of a material number of startups in a particular space.

Today there are a number of research companies that use this exact same information, as reported by public companies as part of those company's obligations to the SEC, to evaluate investment risk and opportunity. Their services go from 'free' (as in Charles Schwab will send you a copy of their research department's report on a company or a segment if you're an account holder) to 'extortionate' which some of the larger trading houses keep in their back pockets to help them pick winners and losers.

As a collection point for this information about _privately_ held companies, it puts you in a nearly unassailable position to do research on which of these companies are likely to be successful or not (your own sort of buy/hold/sell ratings) This isn't even possible today because, as the article mentions. everyone goes to different places to get their 409A valuations. So no single entity has enough of the puzzle to assemble a recognizable picture, yet by offering this valuation service, and attracting a very large number of customers, you create the opportunity to be that single source of information.

I would venture a guess that there are venture capitalists that would pay handsomely for a 'peek' at the state of the industry 'yet to come' as it were. That would not involve you (Preferred Return) owning any equity in any company, all you'd need to do it offer up research reports at $500,000 a copy describing the state of the industry :-)

I am in awe of how amazingly clever this whole scheme is!

<comment><USER4> Because we want to continue to run a respectable business, and staying in business depends on our clients trusting us, we have no incentive to pursue a data-based revenue model. We are a service provider, like an accountancy or a law firm, not a software or data company.

To do what you propose would involve trading our large, primary revenue stream for an untested one-shot reporting product that would be extremely unpopular with everybody and put us out of business overnight. It makes little sense to me. You draw analogies to public markets, but there's a reason private companies are called private companies.

In addition to our standard engagement terms that forbid such use of client data, we are happy to sign customer NDAs and regularly do so. We have never earned a cent from client data and have no intention of doing anything of the sort.

Happy to discuss over the phone if you have any further suggestions on this front.

<comment><USER3> Pendevere, email me. Address is in my profile.

</comment></comment></comment></comment></comment><comment><USER5> With the 2048-as-a-service thing earlier, I thought at first that this was just a misspelled attempt to try to one-up them.

<comment><USER6> Ironically meta, considering how Threes was accused of being a clone of 2048.

</comment></comment><comment><USER7> There are many legal/legalistic-type assurance and regulatory frameworks that can be automated, in significant part. I work in a compliance-as-a-service startup (HIPAA specifically, to start). It's absurd how much mediocre consultants and lawyers make doing work that is mostly boilerplate.

<comment><USER8> Any chance you'd be interested to link to your startup in this thread? You've piqued my interest.

<comment><USER7> Aptible ([https://www.aptible.com](https://www.aptible.com)). I'm Chas - <USER2> me at email@example.com if you'd like to chat. Honest advice is always free, if you're looking to work in healthcare and want to get your bearings. That goes for anyone.

</comment></comment></comment><comment><USER9> From the article: "at the early stage, these valuations are generated in an almost entirely automated fashion."

I'm curious, anyone know what the typical formula is?

<comment><USER10> Take a look at the top voted post on Quora about 409A valuations.

[http://www.quora.com/409A-Valuations/What-is-a-good-firm- I-c...](http://www.quora.com/409A-Valuations/What-is-a-good-firm-I-can-use-to- get-a-409A-valuation-for-my-startup)

</comment></comment><comment><USER11> Doesn't the IRS need some algorithm to determine the fair market value of your shares? I see two different possible answers to this question:

\- The IRS doesn't use such an algorithm. In this case, how can an IRS audit overcome the "there's no evidence we acted incorrectly, the IRS is just picking on us" defense? If there's no objective standard, how can the IRS ever figure out if anyone's valuation's too low?

\- The IRS does use such an algorithm. In this case, what's preventing companies that issue the shares from just using the same algorithm the IRS uses?

<comment><USER12> They do - they basically all use the Black-Scholes Model [0] and just plug in the numbers.

I assume most of the cost of these 409a's is for the backside covering aspect - if the IRS says how did your come up with your pricing you can point them in the direction of someone "serious" and blame them if they typed in the wrong numbers.

[0] [http://en.wikipedia.org/wiki/Black–Scholes_model](http://en.wikipedia.org/wiki/Black–Scholes_model)

</comment></comment><comment><USER13> Thank god. I'm going through this right now, and all it's done is keep us from issue options and getting an advisor on board, for almost a month now. I'll do anything to make sure we never have to deal with that again.

</comment><comment><USER14> Thank you! This was a horrible tax on startups -- not just the cost, but the cognitive load before every transaction, and sometimes delaying grants or onboarding at (not very well run) companies due to confusion.

</comment><comment><USER15> Brilliant!! Like how the landing page explains the fees clearly and how it works.

</comment><comment><USER12> Does anyone here know if there is an equivalent to 409a in Australia?

</comment><comment><USER16> I can't see the page, says "403 forbidden"

<comment><USER17> Do you mean the blog post on [http://www.siliconhillslawyer.com](http://www.siliconhillslawyer.com) or the links to [https://www.esharesinc.com](https://www.esharesinc.com)? Both seem to be working fine for me.</comment></comment>


129 Zenefits Staff Quit After Offer from CEO - <AUTHOR> https://www.buzzfeed.com/williamalden/129-zenefits-staff-quit-after-offer-from-ceo?utm_term=.vsBe68V0a#.qg2WK9wGo <comment><USER2> How many people would leave their job for severance pay? Even if they enjoyed their job? I think I could swing into a job in under 2 months but still feel like I'd have to dislike my work a lot to do that...

<comment><USER3> Don't forget zenefits used to be 1600 and is now down to 910. At this point, there's a good chance they're the last round of layoffs that comes with a severance.

My experience at previous companies is this: if someone offers a buyout, volunteer. Only the first round gets good packages. By the 3rd round you're lucky to end up with the pay you're owed.

<comment><USER4> I've seen this mindset but for a different reason.

While buyouts are supposed to get rid of the lower performers, it often doesn't work that way.

If the offers go to everyone, many of the best qualified people know they can a) get a job quickly and b) are looking at N months of paid vacation/extra pay, so they jump. Even worse, they know who the good people are so when they land the new job and need to recruit, they know who to target.

A decade+ ago, I was at a company and we were made offers. I was on the fence but decided to watch three specific people I deeply respected. When two of them left, I was next. The third was a few days later.

In under 4 months, almost the entire tech staff turned over and many of us have worked together since.

<comment><USER5> So the moral of the story is don't make offers, just fire the chaff?

<comment><USER4> Maybe fire, maybe target the offers to people you actually want to leave. There is probably fallout involved in that one as people figure it out but is it more/less than your top people leaving?</comment></comment></comment></comment></comment>


Stop the Hate: Obj-C Deserves Your Love - <AUTHOR> http://intridea.com/2010/7/13/stop-the-hate-obj-c-deserves-your-love <comment><USER2> As someone who has been, on and off, writing Objective-C for the past decade, I will unequivocally state that as application programming languages go, it's a terrible 1980s jalopy of bad language decisions cobbled on top of more bad language design under which Smalltalk-descendent ideas peek through now and then.

Language research has progressed. Microsoft has invested heavily in C# and related technologies. Even Smalltalk research moved on -- strongtalk, newspeak. We have alternative, real-world usable languages running on the JVM, from Scala to Clojure.

Yet Objective-C moves forward one slow, stuttering step at a time. There are no namespaces. There are no self types (your init methods all have to return id so that they don't conflict with other init methods that have the same name). There are no private methods. Writing an initializer takes 3 lines of boilerplate, every time, plus the header declaration:

      if ((self = [super init]) == nil)
        return nil;

      return self;

The language is obtuse, ridiculously verbose, frustrating to use, and downright paleolithic compared to modern deployed languages. It's a joke compared to everyone else's modern language research. I suffer through it full time because that's what the platform demands, but I would shoot it in the head in a second if I could.

Nuke it from orbit. It's the only way to be sure.

Anyone who thinks ObjC is a good language either hasn't actually spent significant time outside of C/C++/ObjC, or is still new to the wide, wonderful world of Mac/iPhone development.

<comment><USER3> As someone who does a ton of Objective-C, I challenge the notion that namespaces are even remotely necessary. I've also done development in nearly everything under the sun, in nearly every "popular" language under the sun, which challenges your other assumption that anyone who thinks Objective-C is good hasn't spent time outside of C/C++/Objective-C.

I'm guessing you've never written a Windows app with C++ and MFC. Or have done any hardcore UI development in C# or Java - both languages that are easily way more verbose - and require way more boilerplate - than Obj-C.

My assumption is that you simply don't grok it, that you haven't learned how to utilize dynamic dispatch, KVO, etc. to greatly simplify and streamline your application designs. Or you are one of those script kids that takes all the low level shit for granted. This isn't python. This isn't ruby. This isn't even smalltalk. It's a high level layer on top of a low level language. You don't get that kind of performance without some sacrifice, but rest assured that sacrifice is significantly less than C/C++ while maintaining similar or the same performance.

<comment><USER2> _As someone who does a ton of Objective-C, I challenge the notion that namespaces are even remotely necessary ..._

Apple is now suggesting that you use three-character class name prefixes, since they claim all the two character ones. I had my two character prefix claimed by a new private framework Apple added to iOS, and now one of my class names conflict with one of theirs. Kaboom.

If you go the no-prefix route, your code isn't library-reusable since other people will do the same thing, and you will still get screwed -- Apple regularly claims non-prefixed classes in their code, too.

 _My assumption is that you simply don't grok it, that you haven't learned how to utilize dynamic dispatch, KVO, etc. to greatly simplify and streamline your application designs. Or you are one of those script kids that takes all the low level shit for granted. This isn't python. This isn't ruby. This isn't even smalltalk._

Seeing as you're writing ObjC using a compiler I've worked on, I think that probably understand the "low level shit" better than you do.

<comment><USER3> So you work on GCC and are complaining about mostly legacy C things?

What?

<comment><USER4> The best way to hate a language is to implement it. It forces you to learn all the ins and outs of the language, every nook and obscure corner that something, somewhere, depends on.

</comment></comment></comment></comment></comment><comment><USER5> He is at the first stage of Cocoa development. Learning a new language is fun, and you can create some really cool stuff with the Cocoa frameworks. But once that wears off you are left with Objective-C, a vestigial language that isn't suited for a majority of application development.

Here are some reasons I think Objective-C needs to be retired:

\- Header Files: These are archaic and require you to repeat code unnecessarily. Compiler's shouldn't require humans to do something that computers are better at.

\- No Automatic Garbage Collection: In ObjC 2.0 we have this, but not on the iPhone. Unless you are making a high performance game, there is no reason the phone can't handle Automatic GC.

\- No NSDictionary/NSArray literals: [[NSDictionary alloc] initWithObjectsAndKeys:@"value", @"key", @"value2", @"key2", nil]; // Enough said

\- No regex: You kind of get regex's in 3.2+, but they are very limited and require around 3-4 lines of setup to get anything done.

\- Xcode: You are pretty much required to use Xcode and I don't like Xcode. Even if you use the "xcodebuild" CLI, you still have to create the project through Xcode.

\- Closures: I guess we will be able to use these soon, but it is going to take awhile for all the API's to get updated to accommodate them.

\- No dynamic variables: It's handy to be able to shove data into objects sometimes. It's a hack, but as long as you treat it as such you can save a lot of needless code. (You can do this via the ObjC runtime, but it's messy)

\- Unit Testing: It barely exists and is difficult to use.

\- No namespacing: ObjC handles namespaces by prefixing class names. Blah, that is so 1978.

<comment><USER6> Am I the only person in the world who happened to like header files? It's a nice tool (for me) to separate interface declaration from modules/classes, so it's much easier to navigate massive codebases without the help from IDE.

Seriously, how would you get a list of all functions in a module without an IDE? Besides, I put all my documentation into h-files as well, so other devs can pretty much see what I am doing without ever glancing at c-files.

With Ruby or Java you need some advanced folding support in your editor or a full-fledged IDE.

<comment><USER3> No I'm with you re: header files.

These "people" don't also seem to get when you distribute a lib, you need to distribute headers with them.

</comment></comment></comment><comment><USER7> Didn't see a single explanation of why the language deserves my love. Let's see.

* The language is verbose.

* Practically speaking, it's only used to developer for two platforms (OSX and iOS).

* The frameworks for those platforms are MEGA verbose.

* The memory management model for the iOS platform is not GC, and it's not manual management. Frankly I found manual management of memory simpler than retain/release. And the autorelease pool? That's just wrong.

* Typically speaking back to two files per class.

* Doesn't have any functional elements to it whatsoever. Any manipulation of collections = instant development velocity kill.

* Typically have to deal with two different kind of strings (NS versus C).

So for now, yep, I still hate ObjectiveC.

<comment><USER3> > Typically have to deal with two different kind of strings (NS versus C).

NSString has plenty of methods to deal with this, and you get boxing for free between CFString and NSString.

> The frameworks for those platforms are MEGA verbose.

Which some view as self documenting.

<comment><USER4> _NSString has plenty of methods to deal with this, and you get boxing for free between CFString and NSString._

And that pesky char * that you get from C.

</comment></comment></comment><comment><USER8> I don't understood why people think automatic deallocation = garbage collection = slow language. You can have reference counting without garbage collection. It's pretty obvious to a compiler when a variable has gone out of scope and can be dereferenced (and deallocated immediately at 0).

Using a language like obj-c where you have to do memory management manually just seems so archaic after using modern languages. Plus there is strange property duplication syntax, split header/code files, a GUI editor that doesn't easily wire events to code, named parameters, c/smalltalk calls mixed together, etc.. it's just a mess.

In my brief stint using it the whole time I kept thinking this would be so much simpler if I could do it the XYZ language way. Obj-C is a language that you have to try really hard to like. If you have to convince yourself then maybe it's not that good.

<comment><USER9> First, even the "manual" version of garbage collection (the retain/release) pattern is pretty trivial with Objective-C (more so with the new property syntax). Once you know the rules it was pretty automatic and really didn't cause that many problems. It was more a problem with the "checklist" language comparisons.

The "property duplication syntax" (I assume you mean the declare versus synthesis) is there for flexibility and so you can do some pretty good customization to make your classes work better.

For OS X, Objective-C now has garbage collection that works pretty well.

<comment><USER10> Objective-C's retain/releasing is only trivial if you're doing fairly simple stuff. Ever create a circular reference with objects? Ugh...

</comment></comment></comment><comment><USER11> So the post is about how he had to learn Objective-C quickly because they fired their iPhone developer. If you look under Services on their web page they have this...

"Our mobile development team is highly specialized in creating applications for many popular mobile platforms including the iPhone..."

Does "highly specialized" mean learned it last night...

<comment><USER12> Hah, oops. I think Sean meant at a previous employer. All of our mobile devs are seriously skilled (f.e., Brendan Lim delivers talks all over the place about mobile dev) and check out our work (Mashable, Oil Reporter, etc.). Er, point is: our mobile devs rock. :)

</comment></comment><comment><USER5> The worst part is Apple forces you to use Objective-C on the iPhone even if better options exist. I created a Lua/Cocoa bridge [http://probablyinteractive.com/2009/10/18/Setting-up- iPhone-...](http://probablyinteractive.com/2009/10/18/Setting-up-iPhone- Wax.html) that works wonderfully. It considerably cuts down the amount of code I need to write, but Apple forbids me from using it on the iPhone.

</comment><comment><USER13> _One of the limitations of Objective-C, the inability to create a function with a variable length argument list ..._

Erm, not true. For example, NSString's

      + (id)stringWithFormat:(NSString *)format, ...

<comment><USER10> How do you _create_ such a function though? stringWithFormat is built in.

<comment><USER2> Like any other vararg function:

      + (NSString) stringWithFormat: (NSString *) format, ... {
          NSString *string;
          va_list ap;

          /* Fetch the arguments */
          va_start(ap, format);
          // Could iterate over the arguments yourself here, or just use:
          CFStringRef cfString = CFStringCreateWithFormatAndArguments(NULL, NULL, (CFStringRef)format, args);
          string = [NSMakeCollectable(cfString) autorelease];
          va_end(ap);

          return string;
      }

</comment></comment></comment><comment><USER14> Intended audience of article is Rubyists and other users of dynamic languages who are unfamiliar with having to code in a C style. Probably small subset of HN readers.

I would recommend use of Objective-C without Apple frameworks to anyone who must build robust modular systems while retaining C compatibility or performance characteristics. I use it myself in a game engine.

</comment><comment><USER15> This makes me feel old -- when I was learning programming/CS, memory management and storage classes were part of basic training. Now we've got a generation of programmers who've never had to worry about these things.

<comment><USER8> Just because it's good to be aware of how memory management works doesn't mean you should be dragged through tedious manual tasks every time you code.

Assembler was probably part of many peoples basic training as well. Do you want to spend your days juggling everything in 4 general purpose registers because it makes you feel like a better programmer? Is that the best use of your time?

</comment></comment><comment><USER16> Just thought I'd mention <http://rubydcamp.org/>. The people who wrote this post are sponsoring it (I'm not affiliated with them at all).

</comment><comment><USER17> I'm supposed to be impressed because Obj-C does reference counting?

It really is sad that so little of the state of the art in GC is available in mainstream languages.

<comment><USER18> I'd say he more aiming to _comfort_ than _impress_. The good part is that because of the homogenous paradigm there are three rules to learn about when to retain/release. You find them, read them, think about it for 10 minutes, and then get on with programming.

You could contrast it with malloc/free in the unix/C ecosystem. Get a pointer back from function X in library Y. What do you do when you are done? free? call X_Z? constraints on the order of freeing dependent objects? That is a trip to the man pages every time.

<comment><USER17> Cheering about doing better than malloc in 2010 is like being happy that you can outrace a Model T in the Indy 500.

</comment></comment></comment><comment><USER19> The discussion for another article on the front page discusses why, even today, many developers prefer C-family languages over Java for developing user interfaces, because of unpredictable delays in responsiveness with garbage controlled languages.

In that context, Objective C is the closest you will find to a best of both worlds language for responsive user interfaces. Being a strict superset of C, you can control the performance characteristics of your application to your hearts content. With SmallTalk style message passing, you can implement highly dynamic object oriented designs.

The warts that come along with this are the places where C still pokes through when you just want to work in a high level object oriented context and things like header files and static variables rear their ugly heads.

<comment><USER17> You can easily get unpredictable delays in responsiveness with reference counting too. How can you be sure releasing that reference isn't going to unleash the teardown of some huge data structure?

<comment><USER3> If it does than you are doing something incredibly wrong.

I'm really starting to doubt the intelligence of HN.

<comment><USER17> s/than/then/g

<comment><USER3> @cageface really? you can't refute my point, so you instead try to correct my spelling to make yourself look smarter?

<comment><USER17> If you choose to attack someone's intelligence instead of presenting a factual counterargument then it behooves you to get your spelling right.

So again, how can you be sure that the reference you just released isn't the last live pointer to some huge datastructure that now has to be torn down reference-by-reference?

<comment><USER3> Like I said, if that happens you are doing something incredibly wrong. It is your error. It's not the language, it's bad programming, bad architecture, bad whatever.

If you release an object and it gets torn down, it means you didn't increment the ref in the right place. And I don't get how release/retain is such a difficult concept to grasp. If you don't think you can deal with it, should this be your profession?

<comment><USER17> Brushing aside the unnecessary and uncalled for rudeness...

If you release the last pointer to a complex datastructure that has no other references, you certainly should hope it gets "torn down" = deallocated. If that object happened to contain a lot of other objects they will each in turn have to be released. Obviously your main code execution path is going to halt while this graph is walked and released.

Maybe Jimbokun is right that you can control this better in a ref counting scheme than in a typical GC but you're hardly immune from the problem.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> This one always tickles me

NSObject Class Reference

– performSelector:

– performSelector:withObject:

– performSelector:withObject:withObject:

why stop there, lets tack on more withObject arguments

</comment><comment><USER21> I'd actually go a step further and argue Objective-C is actually closer to Ruby than to C. So close, in fact, that MacRuby implements Ruby's object system using Objective-C's runtime.

Syntax and naming conventions are another matter...

<comment><USER22> That's because ruby and objective-C are both inspired by smalltalk.

</comment></comment><comment><USER23> As someone who is also learning Obj-C, it would be awesome if someone can provide some resources relating to

Ruby --> Obj-C or PHP --> Obj-C

Just for references sake. Or some "gotchas".

</comment><comment><USER24> Why does it deserve our (my) love again? I am missing the pro-love arguments in that article.</comment>


First subpixel typeface, ever - <AUTHOR> http://typophile.com/node/61920

<comment><USER2> _You must not look too closely, because colors get visible_

That happens with any anti-aliasing. After using a Mac for some time, what bothers me about ClearType to no end is that for some fonts, the colors are painfully visible _without_ looking closely. Without exaggeration, it looks like shit smeared on the text.

<comment><USER3> Color is only visible in sub-pixel antialiasing. Regular AA, or AA designed for something other than LCD output, is just shades of gray.

<comment><USER4> And in any case sub-pixel color artifacts were a fact of life for decades when we were all using CRTs. I don't remember anyone complaining about all those visible phosphors then.

Regardless: am I the only one who doesn't see much value here? The icons earlier were arguably more readable, but the colors are nonetheless a little distracting. And I have a strong suspicion from comments (some very positive, some like me much less impressed) that these images are being tuned very heavily to a particular LCD design, or pixel pitch, and aren't as generically useful as people think.

<comment><USER5> This font should work fine on any standard LCD, as long as the OS is not trying to apply any other kind of sharpening or AA overtop of it. However, it will only work correctly if it's rendered 1:1 at the resolution of the monitor -- it can't be scaled at all, so the final size will be dependent on the ppi of your display.

</comment></comment></comment></comment><comment><USER6> It might not be the first, and it might not be terribly useful, but it is interesting.

<comment><USER7> It's actually quite useful for a variety of purposes. One example is favicons which could contain text in this face.

<comment><USER8> If you're putting text in a favicon you're doing it wrong.

<comment><USER9> Look up

<comment><USER10> Lots of brands have been putting text or characters in favicons-- Facebook, Twitter, and Y-Combinator, to name a few. I think it makes the brand more recognizable.

</comment></comment></comment></comment></comment><comment><USER11> What if my monitor gets rotated?

Sub-pixel anti-aliasing belongs to the low-level font renderer, the part that knows how the sub-pixels are arranged in the current canvas.

Just blindly assuming a given arrangement is neither particularly clever nor future-proof. It's not even present-proof (I use a notebook attached to a rotated LCD display at work and a netbook attached to a big CRT at home) as many displays are designed to rotate (thus changing the sub-pixel arrangement).

</comment><comment><USER12> I once wrote a 3x3 pixel bitmap (just 1-colour pixels) font on my ZX Spectrum in Art Studio! The main problem was the S - it had to have a diagonal.

</comment><comment><USER13> Note: This I believe only works on LCD based displays. Which is still very useful.

<comment><USER14> It only works on LCD based displays where the subpixel layout is RGB. Some old ones are GBR.

Also won't work if your monitor is flipped sideways.

<comment><USER15> And many mobiles, which is one of the few places where this font could potentially shine.

</comment></comment></comment><comment><USER16> The font from Screenwriter ]['s 70-column mode in hgr2 for non-80 column Apple ][s may qualify as the first subpixel typeface.

[http://books.google.com/books?id=zBIvBTsHbtUC&lpg=PA118&...](http://books.google.com/books?id=zBIvBTsHbtUC&lpg=PA118&ots=D3RsC1m0Kj&pg=PA118#v=onepage&q=&f=false)

<comment><USER17> How so? The Apple's high-res graphics mode was 280 pixels wide, the standard ROM font drew characters 7 pixels wide to achieve 40 characters per line; it sounds like ScreenWriter II drew characters 4 pixels wide to achieve 70 characters per line (a bit cramped, especially for M and W, but doable). What is 'subpixel' about that?

<comment><USER16> It's not _really_ 280 pixels wide: there are 280 addressable pixels but changing one can affect another nearby. Drawing diagonal, intersecting lines can make your blue lines green or whatever. Loosely speaking, there are 280 sub-pixels across, which works fine on monochrome monitors but on color monitors screenwriter's 70 column mode is psychedelic.

</comment></comment></comment><comment><USER18> What does it mean that it's "sub pixel" ?

Given that each character is several pixels tall and wide, that seems like a misnomer, unless I'm missing something...

<comment><USER19> It's sub pixel in the respect that it independently uses every controllable dot on your display (three for every pixel, red, green and blue) to create the illusion of black lines. Zoom in on the font and you will see that no pixel is actually black or grey. It uses the underlying hardware structure of the pixel display. It basically doesn't manipulate the abstract and perfect pixel (throw three colors at a small square and get the combination of the three perfectly distributed across the surface of the square) but the underlying hardware structure of pixels. That's the reason why it breaks on different or rotated hardware.

</comment></comment><comment><USER20> Finally, some real hacking on hn.

</comment><comment><USER21> No Q, V, nor Y?

<comment><USER22> And the "e" is just a copy of the "c". That's why he wrote "Lor _i_ m ipsum".</comment></comment>


Higher-Order Perl -- Free Online Version - <AUTHOR> http://hop.perl.plover.com/ <comment> mark-t This looks interesting, but it doesn't seem like the content is actually available yet. Anyway, I think most perlmongers and anyone else who cares already knew perl had these capabilities.</comment>


Building a Eurorack Mechanical Sequencer [video] - <AUTHOR> https://www.youtube.com/watch?v=45-4xLrRMqg <comment><AUTHOR> I like passive engineering - allowing behaviour to emerge naturally rather than forcing it with reams of conditional code or complex mechanisms. This is why I am quite pleased with how this project turned out. Use the right architecture and you hardly need any code!

</comment><comment><USER2> Anyone interested in this sort of thing would probably enjoy having a look at the Bastl brand Eurorack modules, which allow sensors, solenoids, and motors to be hooked up in directly to your Eurorack system, without bothering with intermediaries like the Arduino and whatnot.[1][2][3][4][5]

Also of interest may be just about any of the cute, quirky, Rube-Goldberg-like creations from Gieskes[6]: [7][8][9][10][11]

[1] - [https://www.youtube.com/watch?v=ybopzDfrZ08](https://www.youtube.com/watch?v=ybopzDfrZ08)

[2] - [https://www.youtube.com/watch?v=0sA_IcICKxU](https://www.youtube.com/watch?v=0sA_IcICKxU)

[3] - [https://www.youtube.com/watch?v=CpRYWuRCdLw](https://www.youtube.com/watch?v=CpRYWuRCdLw)

[4] - [https://www.youtube.com/watch?v=53J1hEXsovg](https://www.youtube.com/watch?v=53J1hEXsovg)

[5] - [https://www.youtube.com/watch?v=eFX4WeXa21k](https://www.youtube.com/watch?v=eFX4WeXa21k)

[6] - [http://www.gieskes.nl/](http://www.gieskes.nl/)

[7] - [https://www.youtube.com/watch?v=lf_rmr5Arbs](https://www.youtube.com/watch?v=lf_rmr5Arbs)

[8] - [https://www.youtube.com/watch?v=Diix7VTdwdM](https://www.youtube.com/watch?v=Diix7VTdwdM)

[9] - [https://www.youtube.com/watch?v=JsPBkBx3YpA](https://www.youtube.com/watch?v=JsPBkBx3YpA)

[10] - [https://www.youtube.com/watch?v=sTeNfms0lX4](https://www.youtube.com/watch?v=sTeNfms0lX4)

[11] - [https://www.youtube.com/watch?v=Laj57aAuZKw](https://www.youtube.com/watch?v=Laj57aAuZKw)

</comment><comment><USER3> This is very neat, but this video feels very much "draw the rest of the owl" to me.

Were there supposed to be links, e.g., to that website explaining how to drive stepper motors?

<comment><USER4> Well, a lot of the the things like how to drive a stepper motor or how to program a microcontroller are pretty easy to find on the net-- there's a lot of documentation.

In this video, I think that the author did a pretty good job of giving a very high level overview while still hitting some of the technical details.

that's just my opinion, and maybe it is easier for me to feel that way because I'm already aware of (or have done) a lot of what the author is talking about, so seeing the thought process is enough for me to grok the rest of the project without more detail... if I knew less I might not feel that way. But then, at that point, I probably wouldn't be in a position to carry out a project like that, so detailed instructions wouldn't be super helpful anyhow.

<comment><USER3> Yeah, that's a good point. I didn't realize at first that the video was only two minutes, and I have no experience with any of this, so as soon as the wiring diagrams started firing off, I was immediately lost :P

</comment></comment></comment><comment><USER5> This is great, love the pacing and the editing, the voice-over seems fluid and coherent.

Perhaps I'm not the target audience, but you seem to make the assumption that the viewer is familiar with the use case for this device. What I was able to gather from the video is that this device allows you to generate triggering audio/midi (?) in a more "organic" way than with something like a drum pad?

<comment><USER4> A lot of the cool parts of music making in modular systems comes from injecting complexities that you can't quite fully reason through.

So in this case, the disk is a bit more complex than just using a clock and some switches to send out a trigger signal, -- it's less reliable and less precise.

But those are positive traits because it's easy enough to get a reliable, precise sequencer.

For what it's worth, all this device is sending out is a trigger pulse, which can be hooked to anything that would find a pulse like that useful... that's what is cool about modular synths.

So you could use it to "trigger audio" by hooking that trigger pulse to an envelope generator, but you could just as easily hook it to the "reset" of another sequencer and have it start a sequence over with every pulse. Or you could hook it to a flip-flopping swithc and have it, say, turn on and off the reverb in time with whatever is on the disc...

it's a really fun (albeit expensive) way to make music.

</comment></comment><comment><USER6> Any tutorial about creating a simple software one out there? at least the concepts. Been using flowstone lately, I wonder how hard it is to achieve.

<comment><USER7> Not a tutorial, but I've been building one. One version of the software is here: [https://bitbucket.org/doughammond/simpleseq](https://bitbucket.org/doughammond/simpleseq)

</comment></comment><comment><USER8> You sequence the motor, get a pick up from the light sensor and then turn it into a note trigger. It'd be simpler to sequence an array rather than a motor and generate a trigger based on array content.

But sure. Art. It's a piece of kinetic sculpture....

<comment><USER9> True. But then you lose the ability to generate a new sequence by cutting out a piece of paper...!

<comment><AUTHOR> Yeah the whole point is to make it loose and organic instead of rigid and quantized :)</comment></comment></comment>


Elasticsearch: The Definitive Guide - <AUTHOR> https://www.elastic.co/guide/en/elasticsearch/guide/current/index.html <comment><USER2> What I really miss from the official docs is a reference. Something that lists all endpoint sand gives a pseudo-BNF schema overview. With the current docs, seeing all the possible permutations possible within the JSON structure is left as an exercise for the reader; it really requires reading the descriptions of the APIs very closely.

<comment><USER3> I wish they did this and had a better search interface. Their current "all in one bar + suggest" functionality works somewhat poorly for me.

Also I feel like they could reduce the needs for super great API docs if they had something like a query optimizer so that I don't have to care about the exact way that ES translates my queries into Lucene queries. My favorite bit is how if you permute your filters and queries in the wrong order you end up completely killing your performance (filter then query or query then filter).

<comment><USER2> I believe filters and queries are in the process of being merged. Quite possibly they are moving towards having some kind of planner.

<comment><USER4> They are. Filters are going away in 2.0.

[https://www.elastic.co/blog/elasticsearch-2.0.0.beta1-coming...](https://www.elastic.co/blog/elasticsearch-2.0.0.beta1-coming- soon)

</comment></comment></comment></comment><comment><USER5> This guide is pretty good and gives you a comprehensive view of Elasticsearch, but to me it was a bit confusing when I first read it. If you are looking for a more "tutorial" style book, with some examples and use-cases, I would recommend "Elasticsearch in action"[0].

I might be biased towards Manning books, but I find their style and ELI5 wording to be very helpful as an introduction to a subject.

[0] [http://www.manning.com/hinman/](http://www.manning.com/hinman/)

</comment><comment><USER6> I was about the hit the purchase button!, thanks :D

</comment><comment><USER7> How is this different from the usual API docs? I'm not saying that it isn't, I'm just curious as to how it is.

<comment><USER8> In my experience as you are learning to use ElasticSearch during an implementation, or even going back to reference there is a high-ish probability you will need the manual and the definitive guide. Really, I think they ought to be combined in some way because there are huge gaps in the docs.

<comment><USER9> I bought the book and I'll say I was disappointed with the book. A couple of points, though. 1. The topic is huge, it's hard to cover everything because the way you can query and setup your mappings is really very open-ended. 2. The book is a good way to get started, but it lacks as a reference. See point 1., a reference may not be possible.

The best way to learn ES is to set yourself up with a scripting language (python, ruby, etc.) and prototype _everything_ , then apply what you learned to your language of chocie (i.e. Java if the scripting language isn't your language of choice).

</comment></comment></comment><comment><USER10> When I was looking for a full-text search solution a few months ago, this guide sold me on Elastic.

</comment><comment><USER11> How is this different from Apache Lucene?

<comment><USER2> ElasticSearch is a complete, distributed search engine. It runs as a daemon, does sharing and clustering, provides APIs etc. Lucene is just a library. ElasticSearch uses Lucene internally.

<comment><USER12> And I'll say it again: Elasticsearch is one of the few things that lives up to its hype. It really is that good. Indexing, clustering, It Just Works. I'm very impressed with them and it's a refreshing change from other very hyped tech.

<comment><USER13> I actually have quite a few gripes with Elasticsearch. It's a pain to manage - there seems to be no way of killing long-running queries other than restarting it (so if you have users using kibana etc at some point someone will submit a impossibly hard query and kill the server), the quality of the search results just isn't that good and it takes a lot of customization to improve it - I've never been impressed with the results from any of the large deployments (e.g. github). Ideally it would come with good tokenization and synonyms etc out of the box rather than every deployment having to tinker with settings until it seems to work.

That said ELK is great overall and I would still use it for user-facing search, but I think there is still a lot to improve.

<comment><USER14> jordan, agree fully with your assessment. i have experienced significant challenges in keeping elasticsearch in green since it just loves to failover at times without prior notice, while seeming to work smoothly otherwise!</comment></comment></comment></comment></comment>


Mirai Botnet Client, Echo Loader and CNC source code - <AUTHOR> https://github.com/jgamblin/Mirai-Source-Code <comment><USER2> This thing's strategy for finding machines to take over is so simple it's embarrassing. It tries to open an unencrypted Telnet connection to random IP addresses. If it gets a response, it tries the following username/password combinations:

        root     xc3511
        root     vizxv
        root     admin
        admin    admin
        root     888888
        root     xmhdipc
        root     default
        root     juantech
        root     123456
        root     54321
        support  support
        root     (none)
        admin    password
        root     root
        root     12345
        user     user
        admin    (none)
        root     pass
        admin    admin1234
        root     1111
        admin    smcadmin
        admin    1111
        root     666666
        root     password
        root     1234
        root     klv123
        Administrator admin
        service  service
        supervisor supervisor
        guest    guest
        guest    12345
        guest    12345
        admin1   password
        administrator 1234
        666666   666666
        888888   888888
        ubnt     ubnt
        root     klv1234
        root     Zte521
        root     hi3518
        root     jvbzd
        root     anko
        root     zlxx.
        root     7ujMko0vizxv
        root     7ujMko0admin
        root     system
        root     ikwb
        root     dreambox
        root     user
        root     realtek
        root     00000000
        admin    1111111
        admin    1234
        admin    12345
        admin    54321
        admin    123456
        admin    7ujMko0admin
        admin    1234
        admin    pass
        admin    meinsm
        tech     tech
        mother   fucker

That's it.

Deploying millions of devices with fixed passwords that dumb is clear evidence of gross negligence on the part of IoT device manufacturers. If this gets to court, some lawyer is going to enter that list as evidence and read it to a jury.

 _" That's the kind of combination an idiot would have on his luggage!"_ \- Spaceballs

<comment><USER3> What's up with 7ujMko? That one seems really secure.

<comment><USER4> It's a simple pattern on a QWERTY keyboard. 7UJM and MKO are each on a diagonal path.

</comment></comment></comment><comment><USER5> There is an irc snippet in the source - [https://github.com/0x27/linux.mirai/blob/master/dlr/release/...](https://github.com/0x27/linux.mirai/blob/master/dlr/release/.build)

From the full mirror linked below

<comment><USER6> Glad to see these are American hackers and not Russian.

<comment><USER7> [https://github.com/0x27/linux.mirai/blob/master/mirai/prompt...](https://github.com/0x27/linux.mirai/blob/master/mirai/prompt.txt) looks awfully Cyrillic to me, anybody know what it means?

<comment><USER8> "I love chicken nuggets"

</comment></comment></comment></comment><comment><USER9> This source is incomplete. See [https://github.com/0x27/linux.mirai](https://github.com/0x27/linux.mirai) for a full mirror of the release.

<comment><USER10> Thanks.

Question for the C folks. The author seems to have reimplemented functions such as strlen, memcpy, and atoi in 'bot/util.h' instead of using the stdlib. Anyone know why?

[https://github.com/0x27/linux.mirai/blob/master/mirai/bot/ut...](https://github.com/0x27/linux.mirai/blob/master/mirai/bot/util.h)

<comment><USER11> Because you cannot rely on some chintzy IoT device to have dynamically loadable libraries. In all likelihood, they don't. But let's assume they do have loadable stdlib, would would you trust the integrity of your botnet to dozens of poorly designed IoT devices?

<comment><USER12> You can statically link the binary you build, doesnt mean you need to reimplement.

<comment><USER13> But it is easier to copy/paste those few functions rather than play with static libc and then making sure all the other functions don't get linked into the final binary.

</comment></comment></comment></comment></comment><comment><USER14> Could someone please illustrate a concrete example of how having the password to my camera (assuming it has an routing through NAT) can be used to generate outbound traffic?

I have five cameras set up with NAT port holes. My passwords are (I believe) secure. But even if they were on the list, how could that be used to generate outbound traffic to DDoS someone? Presumably, only by a further vulnerability in the firmware.

In all the media / HN coverage, even with the release of Mirai source, I have yet to see a concrete example of a brand/model of camera/DVR who's firmware is exploitable. Let alone a list of models that are.

One exception: The D-Link DCS-930L[1] has a known vulnerability.

[1]: [https://www.exploit-db.com/exploits/39437/](https://www.exploit- db.com/exploits/39437/)

Edit: Okay, if you can get in on telnet, then nevermind; you're p0wned. But if you're a webcam on port 8080, what is the attack vector?

</comment><comment><USER15> I'm just happy to see that kids these days still say "greetz" in their github/BBS posts these days.

Or maybe this is a greybeard hacker?

</comment><comment><USER16> The IoT devices can be accessed over telnet. Out of curiosity: Is there a self destruct command? or a way to make one?

It seems to me that destroying the vulnerable devices would solve the DDoS problem and gives a big kick in the face of the affected manufacturers plus a good press coverage.

<comment><USER17> This was my exact thought. If we have the source code, it seems as if it wouldn't be too hard to make our own version which seeks and destroys other versions, possibly patching the system, or at least changing the password to be something secure.

Is there a reason this can't be done? (Other than a legal reason, which hackers don't tend to care too much about.)

</comment></comment><comment><USER18> [https://raw.githubusercontent.com/0x27/linux.mirai/master/po...](https://raw.githubusercontent.com/0x27/linux.mirai/master/post.txt)

This explains how it's used, etc.

</comment><comment><USER19> What does "CNC" stand for in this context?

<comment><USER20> Command and control

</comment></comment><comment><USER21> The whole focus on IOT and random individual devices on the network seems misplaced. If all it takes is misconfiguration of random devices that join the network to take it down then you have a larger problem than these devices.

Since there is no way to police this and 'wack a mole' for billions of devices is not a practical strategy this security focus on IOT devices while nice does not address the core problem of vulnerable networks and ddos. It distracts and diverts from it.

<comment><USER22> True, but there's conversely a whole bunch of problems associated with the scandalous lack of security wrt many IoT devices, that aren't anything to do with DDoS. I wonder how many people are being watched as we speak.

</comment></comment><comment><USER23> Is there a page somewhere that maps these passwords to corresponding devices? Essentially a list of what devices are affected by this botnet? I don't think anything I own is affected, and I monitor my network pretty closely, but would like to double check. And make sure not to buy any of them either.

</comment><comment><USER18> So this was dumped 20 days ago, and now we've got a fairly large outage taking place.

In other words, it could have been anyone?

<comment><USER24> Misdirection? Maybe that is what we are meant to think.

</comment></comment><comment><USER25> Would it be illegal to innoculate IoT devices by forking Mirai and then changing each vulnerable device's default password to a random choice of high entropy?

<comment><USER26> Doesn't this brick the device from the user's perspective?

<comment><USER25> In many cases, sure, but there is usually an easy way to reset such a device back to its factory defaults.

</comment></comment></comment><comment><USER27> I think the headline there, "Mirai Botnet Client, Echo Loader and CNC source code", is more descriptive and suitable than the current title.

"Mirai" is a rather generic name; for a moment I was wondering if it was related to the [https://en.wikipedia.org/wiki/Toyota_Mirai](https://en.wikipedia.org/wiki/Toyota_Mirai) ...but it did make me click to find out.

<comment><USER28> What is the origin of the name?

I assumed (guessed) it was the last name of the "father of the internet" on Japan.

<comment><USER29> Mirai means future.</comment></comment></comment>


Apple rebuts complaints of bending iPhones - <AUTHOR> http://online.wsj.com/articles/apple-defends-against-complaints-of-bending-iphones-1411668618

<comment><USER2> >Its not very common

>Only 1 in 9 (11%)

<comment><USER3> Show your work! -10 points

Where are youg getting 1 in 9 from? It's 9 out of 10,000,000.</comment></comment>


Ask HN: Is having an inside connection the biggest factor in landing a next job? - <AUTHOR> In your experience, do non-US candidates have a strong chance in landing a job at a US workplace from merit alone? <comment><USER2> It depend on the economy, but in general yes. This is the annoying role where headhunters can be your inside track.

It is a system I hate, but the reality is if you have 2 candidates. Equal in most aspects, with one key exception. Your wife's, cousins, neighbor, mother in-law, whom you have a positive opinion of, because you were both at a party together once. Said candidate 'A' is really good.

Whom are you going to hire?

</comment><comment><USER3> It generally won't hurt. FWIW, as a US citizen working in tech my whole life, only my entry level job was from a connection.

Now for the bad news - it's really, really hard to get a job places without living in that city. Much less country.

That said, big tech is so hungry for talent they put the resources into relocation, visa support, etc. That would be my suggestion - look at the big tech (Amazon, Apple, Google, Facebook, Netflix, MS, etc.)

</comment><comment><USER4> Even if it's not related to US. It's really expensive and ineffective to filter strangers. The easiest, safest way to get a great hire is via recommendation.

It works the other way too. A lot of top tier talent won't go job hunting or bother with interviews, so inside connection is the best way to poach a star.

</comment><comment><USER5> Everyone is hired on merit, but going to techy social events will help you get past the HR filter. If you are in a US city then there is probably some social network that publicly schedules monthly open houses at different tech companies. In Austin, TX that would be BuiltInAustin.com, I'm not sure what it is in other cities, but there is also Meetup which can be good.

</comment><comment><USER6> As a non-US citizen working in the states -yes, you can land a job from merit alone.

My 2cents of advice are be upfront about what type of visa you will need when you start the interview process. Don't trust that the HR will know the correct visa and requirements. Do you own research about processing times for the visa, make sure you look at recent data for this!

Good luck!

</comment><comment><USER7> Sorry this isn't an answer as I've never thought of going to the US, but someone posted this earlier today: [https://hackersurfing.com/2019](https://hackersurfing.com/2019) I think meeting people in person will greatly increase your chances of landing a job in the US, because that's definitely how it is down here in NZ.

</comment><comment><USER8> 1\. yes 2\. EU, but no. Companies hire from the EU first, immigrants second.</comment>


Ideal co-working space concept - <AUTHOR> http://ajai.squarespace.com/blog/2009/7/22/ideal-co-working-space-concept.html

<comment><USER2> Hmm. What kind of place can you get coffee, shower, go to bed, take calls in a private room, eat, do laundry, and not have to waste time going home and back again? I think once those requirements are met you might as well live there. Sounds like a hacker house to me. So it would be a better value-add if you just built a walkable, high-density residential community around this theme, since then you wouldn't have to have a residence and a 1 hour commute to worry about. Which is exactly what students and entrepreneurs traditionally do: dorms and garages rather than 1 hour commutes in and out of the suburbs. If it wasn't for brain-dead American urban planning and suburban sprawl this would be more obvious, but the on-campus dorm is closer to what you want to replicate than the coffee shop/sleep tube 1-hour-away-from-home concept.

So let's take this residential concept. You could have private kitchens (as well as a public cafeteria) and resell tons of cheap bulk foods as well. Less Starbucks, more Costco. The idea is to encourage frugality, but not at the expense of community. The revenue model is easy--charge rent (and if people who don't live there wanna hang out, that's cool too). Starbucks? That's a money drain.

<comment><USER3> Yeah, home is pretty good. However, you can't meet random people at home -- granted you may not _want_ to. For me, the ideal working space has the right amount of "human noise" and enough opportunity for social distraction for when I need a break.

Secondly, not having to cook a good meal, not having to make your own espresso, and not having to do dishes holds value as well.

<comment><USER2> Which is why you'd want to live in a community rather than some kind of antisocial suburban subdivision. Half of my post was about building that kind of community, complete with shared social centers. But with the ability to have a place at home where you can focus and achieve flow.

The right model for having someone else fix your meals and coffee is probably closer to a cafeteria than a Starbucks or restaurant. We're talking about a target market that really shouldn't be wasting money.

</comment></comment></comment><comment><USER4> Seems like you could cross sell this to some business travelers. Perhaps also up-selling some professional services (legal/design/marketing).

Personally I like having separate spaces for work and home.

Sounds like a good idea to partner with a Kinkos. Maybe hard to make the numbers work out, but worth looking in to.

</comment><comment><AUTHOR> My thoughts and ideas regarding an ideal co-working spot for entrepreneurs. It is a little raw, so please comment on any improvements.

<comment><USER5> Interesting ideas, I work at Station-C.com in Montreal. The main issue I see with your ideas are cost - building something like what you are saying would be very expensive and tough to sell. We have one shower at our place, but I have heard of much larger co-working spaces in Europe and Berlin in particular.

</comment></comment><comment><USER6> Even though I'm intrigued by the capsule hotel idea, it sure does look like a kennel for humans.

<comment><USER7> I was thinking morgue, but kennel is probably more accurate.</comment></comment>


Platform as a Service team takes even-handed approach to meetings - <AUTHOR> https://gds.blog.gov.uk/2016/10/07/platform-as-a-service-team-takes-even-handed-approach-to-meetings/ <comment><USER2> "In my experience, people don't dominate a conversation or interrupt others because they are unkind or power-hungry."

Suggests the author needs more experience of the workplace.

<comment><USER3> I've encountered an environment where they used something similar it was ridiculous.

It turns passive aggressiveness to 11, there will always be rude people or people with poor conversations skills.

However they are usually toned down because there is a limit to how much you can interrupt someone before people tell you off, especially if there is a line manager or a supervisor present.

Now you get stuck with some douche constantly using the disagree sign to your face, and worse it can be maintained throughout your entire speech forcing you to yield or tell them to sod off which means you lose.

It also doesn't really help new or shy team members if they don't want to express an opinion they won't regardless if it's verbal or smoke signals.

Improving meetings can easily be done by having a meeting captain and a clear agenda.

</comment></comment><comment><USER4> Historical note: [https://en.wikipedia.org/wiki/Occupy_movement_hand_signals](https://en.wikipedia.org/wiki/Occupy_movement_hand_signals)

<comment><USER5> Yeah, I think that a key point here is that it is a way of keeping meetings on track with larger groups. Once you have a bunch of people who have strong opinions about the current topic of discussion, then you will get times when multiple people want to express themselves at the same time.

The person running the meeting may then have to step in and act as traffic cop, but they can only be reactive, after people start talking over each other or whatever. It can take a combination of a good chair and mutual goodwill to sort out the communication traffic jam. It's also rough on the people who aren't assertive, as the article says.

</comment></comment><comment><USER6> I find mechanisms like this to be silly and childish. We're all adults; part of life is learning how to communicate and how to be heard - more generally, how to function in a group. If you haven't figured out how to function properly to the point that you need a system of hand signals in meetings, then it is worth it to look at why your development has been stunted, perhaps with a therapist.

Similarly to that other commenter who didn't give a reason, I would also immediately start looking for work if my workplace implemented this.

</comment><comment><USER7> I would probably start looking for somewhere else to work if I had to use special hand signals during meetings.

<comment><USER8> Explanation for downvote: it doesn't contribute to the thread at all. You could have mentioned why you object to using hand signals.

</comment></comment><comment><USER9> The hand signal for point of order is very similar to BSL for vagina. I'm not sure they consulted any Deaf people.

<comment><USER10> This is what I was thinking[0]. There are loads of really expressive BSL signs that are more than appropriate for this kind of discussion. This is unsurprising as deaf people have group conversations too! As a note for those without experience of BSL, the signs are often dynamic and where consensus/voting is being expressed you usually hold the last part of the sign.

The occupy signs are deliberately chosen to be readable from really great distances and not being part of a larger signing system they are hard to expand upon.

[0] [http://www.signbsl.com/sign/vagina](http://www.signbsl.com/sign/vagina) [1] [http://www.signbsl.com/sign/agree](http://www.signbsl.com/sign/agree) [2] [http://www.signbsl.com/sign/disagree](http://www.signbsl.com/sign/disagree)

<comment><USER11> What an oddly helpful but unhelpful site.

Hiding the symbols behind videos means I can't see what the symbol is as the people haven't made it yet, unless I play the video.

Couldn't they have at least one sketch or marked up jpeg showing the symbol or gesture?

Weird.

<comment><USER10> It's made completely by contributors in their own time.

It's also much harder to create a sketch than simply record yourself signing.

And sketched signs are pretty much useless for everything except finger spelling

</comment></comment></comment></comment><comment><USER12> The GDS have done some great work. Nice to get a gentle reminder that they're still public sector crazies once in a while. ;)

</comment><comment><USER13> Personally I think they might be more useful as a secondary bandwidth channel: you can now see, while you speak, if the majority needs the point clarified.

</comment><comment><USER14> The Lean Coffee hand signals includes a couple others that aren't in this blog post.

[http://www.lovelifepractice.com/practice/using-hand- signals-...](http://www.lovelifepractice.com/practice/using-hand-signals-for- better-meetings/)

Another hand signal I've used in large groups is pointing at a person who has a hand up (wants to say something). It's a useful signal to the person speaking and can avoid people stepping on each other to speak next.

<comment><USER15> Ironically I've used exactly this to generally shut down interrupters I didn't want. Point at them when you can see they're about to interrupt and then keep talking. Indefinitely.

</comment></comment><comment><USER16> Sounds like an episode of The Office!

</comment><comment><USER17> Is there a reason they don't use something like parliamentary procedure?

<comment><USER10> Likely it is too formal, extremely cumbersome, and implies everybody has a vote.

When I am talking to a team I want to know what they think, ideally as immediately as possible (which visual clues allow) but don't want to have to preplan anything.

<comment><USER18> Parliamentary procedure really isn't cumbersome; you can use as much or as little of it as you need. It's well-designed for organisations seeking to have discussion and reach decisions, even when the group may be ultimately unable to come to unanimity.

And on a team, _doesn 't_ everyone have a vote?

<comment><USER10> > And on a team, doesn't everyone have a vote?

No.

It would largely depend on the structure of the team as to what is optimal, however it is obvious that even though the h/w specialist should be involved in the discussion of the DB system we use on the device it is the data specialist who makes the decision.

Many decisions have many more involed parties than decisionmakers for good reason.

<comment><USER18> Good point. Well, FWIW parliamentary procedure can still handle non-voting parties, e.g. the non-voting representatives of U.S. territories in the U.S. Congress.

</comment></comment></comment></comment></comment><comment><USER19> Love the bunny rabbit signal for "disagree". Very cute.

<comment><USER20> It's weird that they chose the English-speaking-world's hand gesture for "stop" as their "agree", especially when there's already "thumbs up" and "ok" out there.

<comment><USER21> The thumbs up gesture is an offensive gesture to Muslim cultures. Equivalent to the middle finger in US culture.

The "OK" circle with thumb and finger is offensive in Southern European countries (e.g. Greece), also somewhere around the same level of offence as the middle finger.

GDS might be part of the British civil service, but the UK is still a multicultural society with workers from all over the World here, including I believe, GDS. That might change in the next two years, but right now, it's who we are (and I personally hope it's who we remain in years to come).

It's not "political correctness gone mad" to choose a hand signal that isn't offensive over one that a third of the room might find offensive. It's just polite.

<comment><USER22> No body said "political correctness gone mad", you are projecting.

What was said was "It's weird that they chose the English-speaking-world's hand gesture for "stop" as their "agree"" \- which it is, I see two hands palm up at me and I see "stop".

</comment></comment></comment></comment><comment><USER23> No evidence, no credit!</comment>


A Look at Linux 3.1  - <AUTHOR> http://www.linux.com/learn/tutorials/498187-a-look-at-linux-31

<comment><USER2> The article doesn't go into much detail about the UNAME26 personality to (optionally) report a 2.6 kernel version number. Here's the skinny: [http://kernelnewbies.org/Linux_3.1#head-663d1f135c18d10f111f...](http://kernelnewbies.org/Linux_3.1#head-663d1f135c18d10f111fd7cf036bba339554e20d)

Just for laughs: [http://www.omgubuntu.co.uk/2011/09/linux-logo-change- version...](http://www.omgubuntu.co.uk/2011/09/linux-logo-change-version-3-1/)

</comment><comment><USER3> If you'd like more detail, [http://www.h-online.com/open/features/What-s-new- in-Linux-3-...](http://www.h-online.com/open/features/What-s-new-in- Linux-3-1-1347364.html?view=print)

<comment><USER4> Or: <http://kernelnewbies.org/Linux_3.1>

</comment></comment><comment><USER5> OMG.. There's something really exciting in this release that I've been waiting for:

"The kernel code for software RAID now offers bad block management for RAID levels 1, 4, 5 and 6. This detects and avoids known bad areas on the RAID disks (for example 1, 2, 3). Dm-crypt is now able to forward discard commands to the underlying disk. This is useful for SSDs, as it allows them to be informed of freed blocks via ATA trim, improving both speed and lifespan."

AFAIK, this is the first time you can configure SSDs into a RAID and then have that configuration utilize TRIM.</comment>


Xmake: A cross-platform build utility based on Lua - <AUTHOR> https://xmake.io/ <comment><USER2> I don't understand the motivation behind an imperative build system. Why is it "add_rules(a,b)" instead of just "rule(a,b)"? It's like someone discovered the benefits of a domain specific language and butchered the concept by making the internal implementation the public interface. Why does it matter to the user that something is getting added to something? Why doesn't it look closer to this [0]?

[0] [https://repl.it/repls/DeadCalmPrinter](https://repl.it/repls/DeadCalmPrinter)

<comment><USER3> It's imperative in order to allow arbitrary control structures instead of bending over backwards with 80% solutions and stupid fragile tricks like you would need with Make.

</comment></comment><comment><USER4> I'm not sure we need _yet another_ build system. We pay a real price for this sort of fragmentation. If I have to pick up your cross-platform C++ codebase, I shouldn't have to learn yet another build system.

CMake/autotools/Premake/SCons/waf/Ninja/Meson/GYP/qmake/Bazel... and now xmake.

I'd rather CMake just be improved, than see endless incompatible reinventions. If you'll forgive a little snark: on the plus side, it's unlikely this new challenger will see any real uptake.

<comment><USER5> I feel you're grossly exaggerating the current state of affairs.

From your list alone, cmake is the de-facto standard. All others are either defunct, abandoned, or dropped out of favour, or never had any expressive adoption. For instance autotools is largely a relic of back in the days where C++ was C with classes, and Qmake was already dropped by their makers in favour of cmake.

Additionally, some of your entries don't make much sense. For example, ninja is at most a low level alternative to raw makefiles, and in fact tools like cmake are able to generate either makefiles or ninja files, and GYP is just a high-level format designed to generate other build system project files, specially IDE-specific projects such as XCode and Visual Studio project files.

<comment><USER6> " _For instance autotools is largely a relic of back in the days where C++ was C with classes..._ "

Minor point: autotools is a relic of the days when there were multiple, only somewhat compatible implementation of Unix in common use. Now that the world is a Linux monoculture and most software is installed by end users in the form of pre-built binary packages, the form of portability provided by autotools is no longer needed.

<comment><USER5> I don't agree with you at all. Autotools boil down to a bunch of shell scripts that enable projects to abstract away the OS/distribution while following a somewhat standard structure.

And binary packages are completely irrelevant and unrelated, because autotools is a build system, thus designed to help build software. Although the availability of source code packages enabled build systems to be also used as installers, thay does not mean the need for build systems is replaced with plain old installers.

</comment></comment></comment></comment><comment><USER7> With years of experience with Scons, I can say quite confidently that I don't ever want to work with a Turing-complete build system ever again.

<comment><USER8> > I don't ever want to work with a Turing-complete build system ever again.

so do you instead write custom additional executables that may require a cross-compilation step for whenever you have to perform custom pre/postprocessing tasks on your code (e.g. parsing it, etc)

<comment><USER9> And your point is that it would be better to write pre/postprocessing logic _in_ the build system? That sounds like a recipe for disaster and slow build times.

<comment><USER8> > And your point is that it would be better to write pre/postprocessing logic > in the build system

well, it has to be somewhere and i'd rather write my build configuration in a language instead of N. So yes, that's what I do currently and it causes me exactly zero issues.

</comment></comment></comment></comment><comment><USER10> Looks pretty similar to premake[1] but I couldn't find a comparison on the site. Could you provide a pitch or comparison? From what I can tell so far, it looks like xmake directly invokes the build tools whereas premake generates a Makefile/Xcode project/visual studio project from which you then need to use those tools to perform the final build.

[1] [https://premake.github.io/](https://premake.github.io/)

<comment><USER11> I've only kicked the tyres of both, but Xmake seems to be more opinionated than Premake. It gives you quite a lot out of the box that you have to build yourself in Premake. Eg (basic) dependency management.

Tbh, I was impressed by Xmake. All I need is a meaningful project to use it on.

</comment></comment><comment><USER12> Benefits over meson? I found no unique features from skimming the docs.

<comment><USER13> It doesn't depend on Python.

<comment><USER14> People are downvoting but it's 100% true. A build system targeting primarily C/C++ requiring an interpreter and runtime dependencies is a no-go for quite a number of projects. There's a reason they were written in C/C++ in the first place, and the fact that a lot of people install via packages (separating build from distribution) is scarcely solace.

<comment><USER15> But lua requires a runtime and an interpreter, right?

<comment><USER14> lua is unique because it can be embedded into C applications as a library, e.g. the difference between SQLite and MySQL.

For example, there's an nginx module that lets you use lua to configure the server logic. I'm presuming you don't need to have lua installed to use xmake (i.e. batteries included), otherwise you're a hundred percent correct.

<comment><USER16> I don't get it honestly and never did. On Linux-likes deps are installed by a pm, and chances are you already have python for various reasons. The same goes for Lua. On msw there is more routine, since you don't have a pm, and have to install everything by hand (+PATH) or choose a pm and begin dealing with its nuances. The same for Lua and xmake. What's the difference beyond non-C/++ impurity?

<comment><USER17> I believe xmake doesn't "require" Lua. Instead, xmake _embeds_ Lua. Specifically it embeds LuaJIT 2.1, based on what I could tell in their repo source. So, when you run xmake, you're actually running a a full-blown Lua implementation that is self-contained in the xmake binary, that has some automatic imports for the xmake embedded build DSL. If you want to run arbitrary Lua using xmake, there is a built-in "lua" plugin, shorthand "xmake l", described here:

[https://github.com/xmake- io/xmake/blob/master/README.md#run-...](https://github.com/xmake- io/xmake/blob/master/README.md#run-the-custom-lua-script-plugin)

So, it would be a bit like if you built a build language atop Python, but rather than _depending_ on Python, you made your whole build tool embed the entire CPython interpreter, pinned to some version. Lua is used in this way more commonly than Python is, of course.

So: xmake itself is just a C program with large submodules written in Lua, running inside that embedded Lua context. The upside here is that xmake's releases are just plain platform-specific native binaries that bundle everything you need, and that make no assumptions about your base system. This is a nice benefit in a build tool, as it aids in reproducible builds.

<comment><USER2> I have used lua this way myself but I don't understand how installing python is a barrier. I understand that depending on a secondary programming language to build your software is sub optimal because only the person setting up the build system gets familiar with the "build language" and when something breaks that person is the only one that can fix the build. Switching away from python to lua only makes that problem worse because python is more popular than lua.

<comment><USER16> Yes, and this is a big problem. People are unaware how other lang's environments work. This exact issue I have with AutoHotKey app. Instead of taking something popular, it reinvented its own cryptic language and its author seems to be attached to it to _not_ even think to support other runtimes. Many things I'd like to do in AHK, but this wall is hard. Even if you learn a language, without practice it fades rapidly, and next time you return there it's still the same cryptic copy-paste cookbook.</comment></comment></comment></comment></comment></comment></comment></comment></comment>