Single-Page Site with Parallax - <AUTHOR> http://nikebetterworld.com/index

<comment><USER2> Well, it appears as if 2011 is the year that parallax web designs go mom-and- pop mainstream and I predict they'll become as common as web2.0 shiny Beta badges and Comic Sans font usage shortly.

I personally don't see much merit in this submission other than ad-spam. It's not a new technique any more and I don't even consider this a particularly good example of it.

<comment><USER3> Nike's hired guns for design are generally a bit ahead of the mainstream curve of any art direction. They've got a long history of legitimizing (rather, stealing) a particular style, postmodern editing in general, and Sagmeister and Victore's scratchiti style in particular.

So, yes. You'll start to see a lot of pop sites employ this technique. Still, there's likely to be a bit of a reprieve between this and when the really bad shops start using it. Say, eight months?

<comment><USER4> Gee, I was thinking "Now".

And wondering if we're going to be seeing more of the ooh-shiny marketeer's web sites getting posted, too.

We had a similar street-scene parallax ad site posted a while back, and the parallax HTTP messages from Github just got posted.

And yes, now contemplating writing a browser extension to get these pesky ooh- shiny parallax kids off my lawn, too.

</comment></comment></comment><comment><USER5> Very interesting, but I personally dislike the paradigm of having fixed content that gets scrolled over depending on the position of the scrollable content. Is this what is referred to as 'parallax'? Writing CSS to do this sounds really fun, but I think it's really disorienting and kind of gimmicky to look at.

</comment><comment><USER6> Not a smooth experience for me at all. Tried multiple ways of scrolling.

<comment><USER7> I could only get the presentation I think they were after by using their navigation buttons on the right side of the page. Using the scroll wheel or scroll bar manually gave a very poor experience.

<comment><USER6> Those buttons didn't show up for me until a good 5 seconds after the vertical scroll bar appears, so I did what any impatient user would do.

The fact that we're even having this conversation indicates failure on their part.

</comment></comment></comment><comment><USER8> I started hitting the Space bar to scroll down (like I always do) and was less than impressed. Only after using the inconvenient and overly subtle nav buttons on the right was I able to see why it was slightly interesting. But finding and using those nav buttons made the site so much less usable.

</comment><comment><USER9> Works fine and looks great for me. Also, it's a first parallax website I've seen so far, so thanks for posting!

BTW. Despite that it's an advert, it has a positive message. Made me feel better, at least a bit.

<comment><USER10> Why "despite"? Advertising is, by and large, getting positive feelings associated with the brand. "Because it's an advert" is probably more accurate.

</comment></comment><comment><USER11> doesn't even load up well in Chrome. Pictures are all jumbled up. To "fix," one needs to scroll down with the arrow key, then scroll up with the arrow key. Then, it looks as intended. Considering Chrome is taking market share very quickly, I'd say this is REALLY bad

<comment><USER12> Which "Chrome"? Chromium 10.0.627.0 on Ubuntu works fine.</comment></comment>


Cloud on cloud on cloud...can it work? - <AUTHOR>

During the recent AWS outage, I noticed companies like Heroku saying they were down, and other companies saying they were down because Heroku was down.<p>At what point will this madness end? Does it ever make sense to be a cloud service, built on a cloud service, built on another cloud service? <comment><USER2> Isn't levels of abstraction the way technology works? Look at the evolution of the computer and programming languages.

What is the alternative? Buy hardware, rent colo space and manage your own machines that die in the middle of the night? The next level up is dedicated servers managed by a hosting provider. The next level up is a virtual machine on the hardware managed by the hosting provider. The next level up is a service provider letting you run processes on a platform they built. These layers of abstraction are needed so that we on a multitude of levels can do what we need to.

Does it make sense? Yes but it makes it all too easy to become reliant on the cloud provider for resilient fault tolerant systems rather than understanding how to fulfil the need yourself.

</comment><comment><USER3> To be honest, any other cloud provider suffering the same persistent outages would be losing customers left and right. AWS is a testament to vendor lock in, both in mindshare and technology. Heroku being down, no clue what to say to that, they've been bitten by this so many times...

</comment><comment><USER4> Can it work? It's already working pretty well. Not perfect for sure, but working pretty well.

<comment><AUTHOR> Maybe my question should have been "should it work?" I'd argue that it isn't working well.....and my point being the recent AWS outage that took down PaaS providers like Heroku and AppFog.

I just wonder if there is a better way? What would happen if PaaS companies sourced infrastructure differently? Would it be worth the time/cost?

I don't know, just curious.</comment></comment>


Life's Building Blocks Found on Dwarf Planet Ceres - <AUTHOR> http://www.space.com/35729-dwarf-planet-ceres-organic-molecules.html <comment><USER2> Reuters version posted earlier has 40+ comments:

[https://news.ycombinator.com/item?id=13667934](https://news.ycombinator.com/item?id=13667934)</comment>


Uber Treats Its Drivers the Way Cellphone Companies Treat Customers - <AUTHOR> https://slate.com/technology/2019/03/uber-gig-workers-customers.html <comment><USER2> Uber seems like a new take on the same exploitative multi-level marketing as Tupperware parties, Amway, and Herbalife. They take advantage of the desperate and unemployed by re-classifying them as something other than employed to make a business model that wouldn't work otherwise.

Instead of buying $6000 of product from Uber, you are essentially leasing them your car and getting barely enough back in fares to pay the depreciation and operating expenses. Some even manage to get enough to pay themselves minimum wage. In the meantime Uber is advertising that their drivers are making close to six figures.

</comment><comment><USER3> Yep, it's a shame there aren't more services such as libretaxi to fill in the market.

</comment><comment><USER4> but they _are_ customers/clients. it is dangerous to think otherwise

<comment><USER5> They used that argument in court, and a judge disagreed. From TFA:

Uber has tried to maneuver around legal walls using this thin argument of technological exceptionalism to protect its management practices. However, Judge Edward M. Chen seemed to find the company's reasoning highly improbable in a class-action lawsuit brought by Uber drivers alleging that Uber violates labor law by misclassifying drivers as independent contractors, rather than as employees. When presented with the idea that drivers are customers of Uber's technology, he said, "The fact that you screen drivers, select them, the fact that you, Uber, sets the fare, not the drivers, the fact that the company could not operate and exist as a company and make money without drivers, you think that does not establish, among other things, that these drivers serve Uber?"</comment></comment>


Ask HN: Move fast and break things" explanation? - <AUTHOR> What does this statement really mean in particular? Ship fast and make mistakes? <comment><USER2> It's a bumper-sticker catch phrase, and like everything that can fit on a bumper sticker it lacks nuance and value, ie it is sloganeering bullshit for the tech set.

Best to ignore it.

</comment><comment><USER3> Facebook doesn't think it's good enough for them anymore [http://www.businessinsider.com/mark-zuckerberg-on- facebooks-...](http://www.businessinsider.com/mark-zuckerberg-on-facebooks- new-motto-2014-5) but it might be a champagne problem.</comment>


APIs, App Stores, and the Era of Mass Customization in Banking - <AUTHOR> http://blog.zactownsend.com/apis-app-stores-and-the-era-of-mass-customization-in-banking

<comment><USER2> Almost seems like a pr piece for Standard Treasury, [http://standardtreasury.com/](http://standardtreasury.com/). White labeled customer (developer) facing api's, _I believe_. I'm not entirely certain how this scales for ST because even though they will provide a standard forward facing api, ST will have to custom fit that on the backend to each customer. (Possibly more disjointed than the industry I'm involved with, healthcare, because at least in healthcare there are a handful of major EMR vendors that all the major institutions use.) In Big Finance most everything is custom legacy, I would imagine. On top of all this, they have the taint of the startup about them. Large industry is loathe to get in bed with startups simply because they are not proven and can not be relied upon in the long term, further, startups are prone to get acquired. How would you like to be Citibank and have a competitor, say BoA, buy the company whose product you just deployed? See Simple.

Although I do see the need, I don't see the innovation from Big Finance. As with anything else trying to disrupt an entrenched industry, it will take early wins to get the ball rolling. In order for this to work Banks would have to become tech shops with all that entails, this has been discussed on HN previously. It is just not in their nature. Banks don't do board shorts and dogs in the office. Modern techies are loathe to work for banks. Where does the innovation come from?

<comment><AUTHOR> Ya :). Most of my writing to date hasn't been about ST, per se, but this was my first trial. Sorry that if it is too marketing-y.

<comment><USER2> Sorry, zt. Didn't scroll down to the footer/know that you were connected to ST. I'm sure you're doing great stuff but it's hard to see how you get customers without a big bond/insurance against buyout. How do you change hearts in minds and the C suite of Big Finance? I know in my field it is virtually impossible to get Bit Health to buy from startups - even though health is used to constant change (research>better care>new care protocols).

<comment><AUTHOR> Basically we sign long contracts that don't have many outs. (We also put our code in code escrow). In this way, even if we were bought by Bank 1, they would be obligated to serve the contract of Bank 2. In essence, the moment we signed one long-term deal, we became unacquirable to other FIs and are left with folks like First Data, FIS, Fiserv. Basically, we aren't selling.

<comment><USER2> Without giving away the secret sauce, could you talk a little about how you unlock growth by decoupling from the incredibly time intensive task of custom integration with each customers (Financial Insitution's) backend? Or maybe you don't and it just is what it is. I imagine you have some internal model you code to that is multi-tenant in some fashion but you are still bound by integration time with each client and then each client needs to be constantly monitored for change management basically forever. Like you need to be inserted in their change management process so they don't break your product. Eeep!

</comment></comment></comment></comment></comment><comment><USER3> most banks (esp in asia ) didn't have much tech investments(other than the core investment they anyway make for banking services) in fee-based- revenues(against interest-based-revenues)(and hence its management) for sometime until the 80's or 90's.Later a lot of them started getting into the fee-income management for almost all their services.Some even got into product-catalog management (if that's what you call prod-eco-system) building their own service eco-system(eg many payment gateways in developing economies were run by banks) and loyalty management systems.

Service customization was a long run topic, in banks (esp europe and americas) , not that they were less agonized with technology but most corporate and wealth clients (of these banks) enjoyed lots of (un-federated) customization benefits.The very costs of these services led to them being so.(eg we have very few payment gateways in town , even today!)

However with depreciating computation costs these services opened up for federation , hence more customization.

However the repo-runs etc in the recent past led some raising very skeptical views of these.(e.g. fee based rev estimation on ABCP charges etc...)

Its however a very complex and dynamic market.Long time back DB research had a paper on complexities in retail pricing.([https://www.dbresearch.com/PROD/DBR_INTERNET_EN- PROD/PROD000...](https://www.dbresearch.com/PROD/DBR_INTERNET_EN- PROD/PROD0000000000304766/Pricing+in+retail+banking%3A+Scope+for+boosting+customer+satisfaction+%26+profitability.pdf))

Overall the thing being:service federation, service eco-system , service- customization etc are not something new banks for banks (that they have to learn from others)

Its only the revenue vs cost benefit that keept it away from these.

With regulatory policy changes in investment-banking post the repo-run era , banks are left with fee-based income as one more tap to top!Thus we see these banks doing these nowadays(as though suddenly jumping).Its not tech that led to these decisions.

Usually in reatail-banks : decisions are not driven by successful technologies , but rather by late application of those ...

</comment><comment><USER4> I bet there is so much inertia in the big banks that it's going to be left to startups like GoBank and Simple to build these things while there's less risk to them due to their size.</comment>


Six Months of HackerNews Front Page Data  - <AUTHOR> http://www.mattmazur.com/2010/03/six-months-of-hackernews-front-page-data/

<comment><USER2> I hacked together a quick script to generate new HN story titles from your list of existing ones. It is a pretty shoddy job -- no syntax-level modeling -- but some of the ones it generated are still pretty amusing:

mark cuban: how to say facebook

how ravelry scales to remove ipad stories from wind

google patents its way to copenhagen

bert and rails ecosystem white paper

how phusion built a blog posting

2010 conference makes the last days of android phones

is like sex. it's better when harvard teaches networking

thunderbird and one hell of the illusion of music

customer development and lying with nginx

toddlers develop individualized rules for scalewell startup fund

bill gates sums up massive data failure leads to control robots

the fuel for running our financial system

i have become a programming language

the future of instant approval

scheme that 'cancer-proofs' rodent's cells

the design and getting your business

h.264 to reach 1 billion rows into the expression problem

the bible that runs on your vc "closing" fees

ask pg: quick tips on different sql implementations

the insanely great in the free version of iphone

scalable apps on vetting opportunities

mona lisa's smile a frozen sculpture of programming

coelacanth: lessons from moleskine to rule your code

results with people: do what would never launch

<comment><USER2> I put the python scripts here if anyone wants to play with them:

<http://people.csail.mit.edu/eob/files/hn/>

The code wasn't written to be anything more than a quick toy.. so don't zing me for its poor quality :)

</comment></comment><comment><USER3> Based upon that data it looks like the best time to submit the data is between 12 and 16 UTC.

Edit: This is with thirty seconds of tossing it through awk. It is pretty well distributed so maybe it is insignificant. I only counted articles that reached 1st place, you should parse it yourself rather than take my word for it of course. And a graph would be nice.

<comment><USER4> I happened to be playing with R today, so I took a stab at making a chart:

<http://tinyurl.com/hnrank>

<comment><USER5> Rule of thumb for when to submit seems to be: whenever PST people are awake, and not eating meals.

</comment></comment></comment><comment><USER6> It has been just today that I discussed the prospects of analyzing HN front page posts with a friend.

Promise to come up with interesting results. Thank you.

<comment><USER6> and my friend didn't even wait up for me.

<http://news.ycombinator.com/item?id=1175223>

</comment></comment><comment><USER7> Thanks for the dataset. FWIW: %s/"//g takes it from 170M to 100M

Of course, compression negates the saving, but it still seemed odd.

<comment><AUTHOR> Good point. I just went with the default export settings--if I do it again in the future, I'll definitely do it this way.

</comment></comment><comment><USER8> The current data format is harder to read using python csv module. This code will convert it to python compatible csv : <http://gist.github.com/325195>

It's bit slow(~15 seconds), but it's a one time job.

</comment><comment><USER9> Thanks a lot Matt. That should be one heck of a dataset to play with.

</comment><comment><USER10> Thank you so much. This is all I needed to make my HN points predictor for newly submitted stories.

Now if I only find a nice chunk of time on a lazy weekend..

</comment><comment><USER11> Does anyone have a full dump of HN posts and comments?

<comment><USER12> Some were posted roughly a year ago, but they're no longer up. I might have them somewhere, give me some time to dig.

</comment></comment><comment><USER13> Hrmm....so now we will see if your tool explodes when a URL to the site reaches the front page.

Kinda like when you google google.

</comment><comment><USER14> Doing statistical coolness now. Will post results later. Stay tuned...</comment>


Ask HN: How much time and money did UL certification take you? - <AUTHOR>

My company is building an electricity submeter which must be UL certified. I know what the UL site says about costs/timelines, but I'd love to get some real-world data points on how long it actually takes and costs as we're about to undergo this process ourselves. <comment><USER2> I don't have any experience with it myself, but ZPM Espresso is a relatively high profile Kickstarter campaign that recently went through this process for their product (a home-appliance espresso maker).

Maybe you could reach out to them?

zpmespresso.com @zpmespresso</comment>


Ask HN: Is it harder to code as you grow old? - <AUTHOR> My dad keeps telling me that I should stop being just a programmer and take more responsability, because according to him, when I will grow old, there will be younger better programmer out there, knowing the latest technologies, and I won't be able to keep up.
I have always been good at learning new languages / frameworks, but I see his point: when I work with older programmers, most of them are indeed a bit slower to adapt, and have a harder time learning new concepts (like Observables in Javascript).
But I am very happy with what I do now. I love being given technical challenges and solve them ; I don't want to manage teams or write documents about architecture. So I'm asking you, especially the senior developers out there: do you see yourself struggling to keep up as you grow older? Is staying "competitive" more challenging? Do you regret not taking more responsibility or do you still love being "just" a programmer?
Thank you all very much for your insights :) <comment><USER2> I'd stay with what you enjoy. At 30 I could learn something once and have it stick. No need to review, didn't forget. At 65, it sucks when I learn something one day, and have to refresh myself the next day if it was complicated. But I felt useful and productive until sixty. Everyone will be different, of course.

</comment><comment><USER3> Two very important roles of experienced developers are to mentor the young ones on best practices and to tell the management when they have stupid ideas.

In workplaces where these roles are not recognized older developers tend to become grumpy and do not contribute much more than the others.

</comment><comment><USER4> It can be. But at least in my case for a surprising reason: you see the younger cowboys in your team being eager to make the same mistakes you've done years ago. Including the mistake of not listening to the elders... ;) So you have to account not only for what your code could do but also for what bad^H^H^H naively written code could do.</comment>


Django - starting from ground zero - any advice? - <AUTHOR>

I am new to Python/Django and have been hacking away happily with it. Any good tutorials out there that google isn't picking up in the first few pages or so? I know it's not as popular as Rails (yet!) to have crazy books with scratch to painted up pretty sites, but any good learn by doing examples out there (besides the few obvious first few pages of google and the Django official book). Bonus: If you are such a passionate python/django hacker, why don't you share with us your wonderful tutorial skills and write a b0|0k<p>My current comprehension level:- Damaged by Java, love at first sight with python. Hungry for more django. <comment><USER2> <http://code.djangoproject.com/wiki/Tutorials>

and

[http://www.b-list.org/weblog/2006/nov/16/django-tips-get- mos...](http://www.b-list.org/weblog/2006/nov/16/django-tips-get-most-out- generic-views/)

<http://www.b-list.org/weblog/2007/sep/04/django-accelerated/>

<http://www.slideshare.net/simon/advanced-django/>

<http://djangoplugables.com/>

Those are some sites I've come across when I was, and still am, learning Django. Good luck.

<comment><AUTHOR> Thank you!

</comment></comment><comment><USER3> "If you want to get smart - get doing." Code, code as much as you can and try and sway off the beaten path. My first project led me into middleware, user profiles and custom fields. I would also suggest that you rather use trunk than the 0.96 release.

Also, because no one has mentioned it before: <http://djangobook.com/>

<comment><USER4> wow surprisingly thats what my first project led me to as well...

<comment><USER3> Maybe it's not that far off the beaten path, and I assumed that it was because it isn't that well documented... _shrug_

</comment></comment></comment><comment><USER5> The best way to learn is by example. This is a good way to start. <http://www.7days7apps.com/>

Get the code here using svn:

svn checkout <http://7days7apps.googlecode.com/svn/trunk/> 7days7apps-read- only

<comment><AUTHOR> I love this already - just the right mix of examples and agile learning. Perfect! Thanks!

</comment></comment><comment><USER6> Some more..lots more at <http://del.icio.us/tag/django>.

I also like the APress book Definitive Guide to Django by Adrian & Jacob.

</comment><comment><USER7> Best place to start would be to read the free online book written by the authors of Django.

<http://djangobook.com>

I would also recommend "Python Pocket Reference" (3rd Edition) by O'Reilly. It really helped me get up to speed with Python in a short amount of time.

Good Luck.

</comment><comment><USER8> I like the post and the replies. Hacker News seems to be a really good forum for inquiries of this nature.

But what on earth is "Damaged by Java" supposed to convey? I guess you find Python with Django to suit your particular needs better than Java, no reason to play down the latter though.

<comment><USER9> I modded you up because I agree, but I also was in the situation where I was damaged by Java so I feel the need to respond.

Java is good, but I always felt so constrained when writing code. It just felt like I had to write so much extra junk code like getters and setters that it made rapid prototyping which I do a lot a hassle.

Python was a breath of fresh air, and is a great language for hacking around in. Java is very useful and I still use it quite a bit.

<comment><AUTHOR> Python was such fresh air that I felt Java was bloatware; no offense to Java, but I really loved the agile development with python that I downplayed java.

<comment><USER8> No hard feelings and thanks for the clarification.

I think Python is a slick language and tool and its Benevolent Dictator for Life is a knowledgeable and nice person. I ran into him while interning at Google (worked on the same team and almost did a project related to one of his).

I guess what I don't like is that devs of all kinds of backgrounds have been downplaying Java ever since its inception and in my view not always rightfully so.

My (admittedly subjective) impression is that this has been happening beyond the usual "religious programming language wars".

Developers writing native code are still complaining about Java's (supposedly) terrible performance, admin-focused scripters for lack of immediacy and web- focused coders for being bloated and not supportive of "agile procedure". I'd just like to point out that this language has become the "working man's language" and with it spans a wide variety of domains and features an incredibly large community. Perf-wise, I doubt that there is currently another language VM that has been better studied, optimized and supported than the JVM (Azul, anyone?).

Of course, the truth is that Java is a tool like every other language and has its proper uses and domains where I'd also pick a different weapon of choice.

<comment><AUTHOR> Quite true really - but since I am rather new and ignorant to the various language religiosity, it's good to know that Java is indeed a very versatile language, but, only if used for the right job. Yes, quite true that many complaints arise from using the wrong weapon indeed. I just felt for the moment that Django seemed to be a rifle and java, a shotgun.

</comment></comment></comment></comment></comment><comment><USER10> Also, if you want to keep up with the Django community and changes to Django code, I would recommend the "This Week in Django" podcast.

Read more about it in Michael Triers blog at <http://blog.michaeltrier.com/>

<comment><USER11> Seconded - really excellent podcast, also a great way of catching up on what's happened in the past week.

</comment></comment><comment><USER12> Unless you're already a Python whizz, "Python Essential Reference" is a must.

I found poking around inside Satchmo incredibly helpful for finding quality code examples. (<http://www.satchmoproject.com/>).

Other than that, just do the tutorial on the djangoproject site, and subscribe to the django-users group on google groups.

have fun!

Rich

edit: Also there's a feed called the django aggregator. A little noisy at times, but worth scanning through couple of days: <http://www.djangoproject.com/community/>

<comment><AUTHOR> Satchmo's pretty cool. And just fyi to other new pythonistas(?) - the new o'reilly book Learning Python is good, but thought it was a bit too long and expensive; the online tutorials fare very well indeed :)

</comment></comment><comment><USER13> [http://showmedo.com/videos/video?name=1100000&fromSeries...](http://showmedo.com/videos/video?name=1100000&fromSeriesID=110) <http://showmedo.com/videos/series?name=v7kABKL6R> <http://blog.disqus.net/2007/03/11/a-django-primer/> [http://www-128.ibm.com/developerworks/linux/library/l-django...](http://www-128.ibm.com/developerworks/linux/library/l-django/?ca=dgr- btw01DjangoAndPython)

<comment><AUTHOR> The showmedo was pretty good; also thumbs for the disqus one, seeing they have been Django substantially!

</comment></comment><comment><USER14> <http://en.wikipedia.org/wiki/Ground_zero>

<comment><USER15> Good point; I think he meant "square one" instead of "ground zero"

Oh... and when he's done he'll be on "cloud nine".

English is weird.

<comment><USER16> All languages are weird, but pointing out a fairly substantial error is not a bad thing; unless it's done in a mean spirited way.

<comment><USER15> I don't think this is a "fairly substantial" error. I understood what he meant, and I wasn't offended... so it's just a slight problem (like forgetting a comma, or using "affect" instead of "effect").

</comment></comment></comment></comment><comment><USER17> If you have about 30 minutes to kill, you can try my tutorial:

<http://www.instantdjango.com>

It's not that great, but it covers the basics. Also, it includes a no- installation-required django environment for Windows, which you can even run from a USB flash drive.

I will be uploading an update sometime in the next few days now that qsrf has been merged with trunk, but it's still quite usable as is.

</comment><comment><USER18> It takes very little time to learn how to do things in Django but it does take a long time to learn how to do them the best way.

Don't worry when you start about doing them the best way. Its often better to make the mistakes (while still exploring) and your next app will just be that much better.

Good luck and great choice :)!

</comment><comment><USER9> Ignore the built in admin in the beginning. It is far more useful/flexible once you know how Django works in and out. I have seen quite a few people rely too much on it to do things that should have been implemented separately.

</comment><comment><USER13> I had a look at django recently. Last week actually. My advise would be to start coding. Make sure the thing is installed right and that you can talk to your database of choice and that your examples run.

Then start coding. It's not too difficult. Some of the things with template engine are a bit funny, so try and not write any big code here, move it to the view/model. But otherwise remember that google is your friend.

My app is a geo based app, but I couldn't get geodjango to play nice. So I just installed the libs and went with that.

<comment><USER9> The template engine is intentionally designed so you have to move any major logic or 'business rules' to the view and out of the template. This can be a different style than other web languages in the beginning, but trust me you will be thankful in 6 months when you are adding a new feature that you don't have to touch the templates (or not much).

<comment><USER13> I think in most cases when you add a feature you end up touching everything in each of the layers.

It's only when you want to change something that it's possible that you might just be restricted to one layer.

I think the idea of the template is that you have one template and many views, and possibly that a template can be created of many different smaller templates, e.g. header, footer, sidebar.

Here is an example of something that I wanted to do with a very specific template that wouldn't be used on any other page.

My model gives distance in meters, for each of the objects and I wanted to display it in miles. So I had to add a new method to the model dist_miles. Instead of just saying round(cinema.dist / 1600, 2) in the template.

I've only been using django for a week now so its quite possible that I'm going about it all wrong.

<comment><USER19> Yep, all wrong :) You want a custom filter: <http://www.djangoproject.com/documentation/templates_python/>

<comment><USER9> Other types of complexity can be handled in custom template tags too.

The easy way to look at them is you could write your own 'filter' or 'count' or any of the tags you see.

However, most of your needs can be met by the built in filters.

</comment></comment></comment></comment></comment><comment><USER20> Does anyone know of good tutorial on django and flex integration. Also, something about javascript and django. Couldnt find any good tutorial. Thanks

<comment><USER21> well flex = a flash widget and javascript is just output as part of the template/html.

Are you talking javascript <-> flex, flex <-> HttpService in django and/or django with ajax?

Frankly I find ajax/flex/flash with django to be easier than asp.net webforms since you just setup a route (REST-like if you want) and then "post" to it and return some data and use it in javascript.

In ASP.NET it's not all that hard, but I just have to remove any master pages and remember to clear out the .aspx page contents if I'm not returning HTML.

I really don't see how it's any different than any other ajax + some server technology, so if you're used to ajax <-> php, then ajax <-> django is no problem.

</comment></comment><comment><USER22> Thanks for posting this topic. I'm in the exact same place as you and all these comments have been very helpful.

</comment><comment><USER23> Look at a lot of examples and use the example code to help build a small web application that would be useful for you.

</comment><comment><USER24> if you get stuck, hop into #django on irc.freenode.net. theres always someone around who can help out

</comment><comment><USER25> Duh! Install PHP!

Kidding.</comment>


GM Hikaru Nakamura-Cyborg vs. Stockfish Live Webcast - <AUTHOR> http://www.chess.com/tv

<comment><USER2> This was confusing. Nakamura Cyborg is a human playing and chess computer program called stockfish. Live commentary is on twitch...

<comment><USER3> Cyborg refers to Naka's playing tandem with Rybka. So it's part man, part engine against the best engine in the world (sans opening book).

The match is essentially to see if a human GM can bridge the gap between the best engine in the world and an older, significantly weaker engine.</comment></comment>


Locating people internationally? - <AUTHOR>

Right now I'm trying to make a project of mine more internationally friendly. As of now I rely on zip codes for my service. Is there a good method for determining locals other than postal codes? Or does anyone know of any up-to-date databases of international postal codes other than U.S. codes?<p>What I'm thinking would be cool is if users could click on a google map, so google could then identify their latitude and longitude and hand us off their postal code, city, etc through an api of some sort. This link is all I could find with my time: http://conversationswithmyself.com/googleMapDemo.html <comment><USER2> I think Google Maps has a "reverse geocoding" api. That's probably what you need.

<comment><AUTHOR> Thanks! Exactly what I needed.</comment></comment>


Catena: A time series storage engine written in Go - <AUTHOR> http://misfra.me/state-of-the-state-part-iii

<comment><AUTHOR> Author here. There's a lot I left out of the post, especially since it's such a young project, but I'd be happy to answer any questions.

Edit: I'm not sure why I'm being downvoted... I'm not home at the moment, so I'm trying my best to answer using my phone.

Edit #2: Back home with a full-size QWERTY keyboard :).

<comment><USER2> Do you think it's good enough to replace Graphite's Carbon at this point? Not as a drop in to graphite, but as a backend to a custom metrics system?

I know your project is young and probably has not seen much battle testing, but your blog post indicates to me that you've put a lot of thought into it being robust.

We are using Carbon for our metrics solution at the moment, and I've read its source and it's not something I'd give a big 'ready for production' stamp even though I know many shops are using it in production.

Perhaps, if you feel like it and will entertain my cheap grab for information, could you give super small explanation of the performance differences between your partition style format and for example Whisper (like RRD, it's what Carbon uses) and InfluxDB? As far as I understand Whisper is simply a cyclic buffer of fixed time distance points in a file per series. And InfluxDB is simply a key value store I think.

Your solution lies somewhere in between those right?

<comment><AUTHOR> InfluxDB uses Bolt in the latest version. Yes, it's a key-value store. See my other comment below about why I'm not using Bolt.

I'm not too familiar with Whisper, but it since it uses fixed size storage, it's not for my use case. I have large amounts of time series metrics (>10,000), and many of them end up being sparse with only a few irregular points. Partitioning by time instead of by metric means I don't have to deal with thousands of files, especially those that have some large, fixed size.

I'm very focused on making this "production ready." It's currently used for another project of mine[0], so I haven't been looking at integrating it into other systems.

[0] [http://preetamjinka.github.io/cistern/](http://preetamjinka.github.io/cistern/)

</comment></comment></comment><comment><USER3> This is a pleasant, self-honest discussion of purpose-driven software as it is being implemented. The language is irrelevant; it's fun to read this type of piece.

<comment><AUTHOR> Thank you! You're right; the language is irrelevant. I wrote this in Go because the parent project is written in Go. I'm looking forward to writing more of this blog series.

</comment></comment><comment><USER4> Hi, Prometheus[0] author here. Thanks for the interesting article!

Since I was curious how this compares to Prometheus's internal storage for writes, I whipped up some (disclaimer: very naive and ad-hoc!) benchmarks[1] to get a rough feeling for Catena's performance. I am not achieving a lot of write performance with it yet, but maybe I'm doing something wrong or using it inefficiently. Some questions to investigate would be: what's the best number of rows to batch in one insert, and are timestamps in seconds, milliseconds, or essentially only user-interpreted (I noticed the partitioning at least depends heavily on the interval between timestamps)? So far I've just done a tiny bit of fiddling and results haven't changed dramatically.

The benchmark parameters:

* writing 10000 samples x 10000 metrics (100 million data points)

* initial state: empty storage

* source names: constant "testsource" for all time series

* metric names: "testmetric_<i>" (0 <= i < 10000)

* values: the metric index <i> (constant integer value within each series)

* timestamps: starting at 0 and increasing by 15 seconds for every iteration

* GOMAXPROCS=4 (4-core "Core i5-4690K" machine, 3.5GHz)

* Disk: SSD

* Other machine load: SoundCloud playing music in the background

The benchmark results:

#### Prometheus ####

(GOMAXPROCS=4 go run prometheus_bench.go -num-metrics=10000 -samples-per- metric=10000)

Time: 1m26s Space: 138MB

#### Catena ####

(GOMAXPROCS=4 go run catena_bench.go -num-metrics=10000 -samples-per- metric=10000)

Time: 1h25m Space: 190MB

So in this particular benchmark Catena took 60x longer and used 1.4x more space.

Please don't take this as discouragement or a statement on one being better than the other. Obviously Catena is very new and also probably optimized for slightly different use cases. And possibly I'm just doing something wrong (please tell me!). I also haven't dug into possible performance bottlenecks yet, but I saw it utilize 100% of all 4 CPU cores the entire time. In any case, I'd be interested in a set of benchmarks optimized specifically for Catena's use case.

Unfortunately we also haven't fully documented the internals of Prometheus's storage yet, but a bit of background information can be found here: [http://prometheus.io/docs/operating/storage/](http://prometheus.io/docs/operating/storage/) Maybe that's worth a blog post sometime.

[0] [http://prometheus.io/](http://prometheus.io/)

[1] The code for the benchmarks is here: [https://gist.github.com/juliusv/ce7c3b5368cd7adf8bc6](https://gist.github.com/juliusv/ce7c3b5368cd7adf8bc6)

<comment><AUTHOR> Thanks for trying it out! I haven't had time to run any benchmarks, so I really appreciate you taking the time to do this (especially since it took so long!).

I'm not sure what the best batch size is at the moment. Timestamps are int64s, and it's up to the user to interpret them as they wish. Partition sizes are in terms of the number of timestamps. If you had timestamps which correspond to seconds, and you wanted each partition to be 1 day, you'd choose 86400. This isn't configurable yet unless you modify the source.

I'm not surprised it's that slow. I'm not a storage engine expert, still a college student, and this has my first lock-free list implementation :). There is a lot of silliness going on with inserts, like launching a goroutine for each metric on inserts[0], using lock-free O(n) lists for sources and metrics[1] when I could have used a map, there's still a lock left that should be removed[2], and a bunch of others.

On an unrelated note, I see that someone from Prometheus will be at Monitorama. I'll be there too, so I'd love to you guys some more.

Thanks again!

[0] [https://github.com/PreetamJinka/catena/blob/8e068b1b95ce1a10...](https://github.com/PreetamJinka/catena/blob/8e068b1b95ce1a107cfed75e2f9e33693ce4bff5/mem_partition.go#L163-L169)

[1] [https://github.com/PreetamJinka/catena/blob/8e068b1b95ce1a10...](https://github.com/PreetamJinka/catena/blob/8e068b1b95ce1a107cfed75e2f9e33693ce4bff5/mem_partition.go#L191)

[2] [https://github.com/PreetamJinka/catena/blob/8e068b1b95ce1a10...](https://github.com/PreetamJinka/catena/blob/8e068b1b95ce1a107cfed75e2f9e33693ce4bff5/mem_partition.go#L273-L274)

<comment><USER4> Ah ok, so some obvious things left to optimize then :) Thanks for the explanations!

As far as I know, none of the Prometheus core developers will be at Monitorama this year. But we'll be at SRECon Dublin, DevOpsCon Berlin, GopherCon Denver, and hopefully also at one (or both) of the VelocityConfs later this year.

Indeed, it would be great to catch up in person if you're at any of these.

<comment><AUTHOR> I see. I should be going to GopherCon too, so I hope to see you there.

</comment></comment></comment></comment><comment><USER5> "Catena" is also a password hashing function: [http://eprint.iacr.org/2013/525.pdf](http://eprint.iacr.org/2013/525.pdf)

</comment><comment><USER6> Good stuff!</comment>


Ask HN: HN alternatives to basecamp? - <AUTHOR>

I have a need to manage some projects (open tasks) with other developers (for mobile apps). I was just going to use basecamp, but I'd prefer to use an HN startup if there is one out there. <comment><USER2> It's not an HN startup, but I've been building <http://speckleapp.com/> for a while :)

Edit: It is an HN startup! I need more sleep!

<comment><AUTHOR> If you're building it, doesn't that make it an HN startup :) ?

<comment><USER2> Bah! I guess I was thinking a YC startup.

</comment></comment></comment><comment><USER3> We use voo2do for our small web firm.

<http://voo2do.com/>

It's nothing like Basecamp but fits our model well.

<comment><USER4> Cool! Voo2do probably qualifies as a HN startup, although I started it (as a hobby project) in 2005 before HN existed. :)

</comment></comment><comment><USER5> I'm not sure about Basecamp Alternatives created by HN / YC members but I've used ActiveCollab, which is self-hosted and very nice. Zoho has a great offering, too.

Here's a fairly comprehensive list, but I'm not sure how old it is. <http://pm-sherpa.com/features/basecamp-alternatives/>

<comment><AUTHOR> Yeah, I searched the web and searchyc, but was wondering if there were any _HN_ alternatives, i.e. the owner is on here.

<comment><USER6> What qualifies as being on here? Jason Fried of Basecamp has been on here for almost two years. Granted, most of his comments are on articles releated to 37signals.

<http://news.ycombinator.com/user?id=jasonfried>

</comment></comment></comment><comment><USER7> You could use Trailer Park;-)

<http://73primenumbers.com/trailerpark.html>

Joking aside, depending on what you're doing, you could probably get by with something as simple as a Google spreadsheet.

<comment><AUTHOR> I want built in notifications, comments and task completion. I could get this via Google docs, but it isn't seamless.

<comment><USER8> you can setup a <http://redmine.org> instance . I've done it recently for my company and it hasn't broke yet :) if you n€€d help let me know :)

</comment></comment></comment><comment><USER9> It's not a HN company...but what about <http://unfuddle.com>?

<comment><USER10> For whatever it's worth, I use unfuddle for some projects and I like it pretty well. Occasionally their web interface is painfully slow though.

<comment><USER8> i've been using the free account for a couple of years and have upgraded to a paid account sometime ago and it works very well

</comment></comment></comment><comment><USER11> Have you looked at <http://pivotaltracker.com> ? It's what Google engineers use to manage projects. And it's free for unlimited projects. It's tailored to agile software development.

</comment><comment><USER12> Is there something with functionality similar to basecamp that allows you to use your own domain, not a sub-domain, and to theme the interface in a custom way to completely match your company's colors and branding ?</comment>


Show HN: BSWX – PWA to compose and record guitar riffs - <AUTHOR> https://bswx.co/ <comment><AUTHOR> I needed an app to compose and record power chord riffs. I normally use various DAWs, physical instruments and plugins to do that, but they're not portable, they're not easy to use and they're terrible when it comes to sketch music.

So I made BSWX. The main features:

* It's ready to compose, record or play back in less than 1 second, on any device.

* It's a Progressive Web Application, which means it can be accessed via the browser or installed as an app on mobile and desktop.

* It records on the cloud but works well when Internet is down: it synchronizes automatically when you go back online.

* It can export MIDI files from your recordings for use on any Digital Audio Workstation.

[https://imgur.com/a/GpXU7](https://imgur.com/a/GpXU7)</comment>


Apple's SSL/TLS bug - <AUTHOR> https://www.imperialviolet.org/2014/02/22/applebug.html <comment><USER3> It's interesting watching all the speculation about "was it a backdoor, or just a bug?"

Lots of points in favor or against:

1) It's a huge compromise, and "open" to anyone to exploit, which would ultimately get caught and fixed faster. But it's also not targeting anything specific, so there's less of a signature of the attacker.

2) Incredibly simple, and thus a plausible mistake.

3) Hidden in plain sight

I'd generally come down on the side of "accident". The better question is if an systematic testing system for exploitable weaknesses (or a lucky chance finding) could find something like this (either a regression, or a badly implemented new feature) and exploit it -- basically assuming there are going to be errors in implementations. That's understood to be a standard technique in the IC, and a whole industry built around it... and then, the scale of compromise.

There are lots of mitigation techniques for vulnerabilities like this (essentially, devices which are too fast-changing and too difficult to fully trust, but which have to touch sensitive data), but it's not as if people can carry around a firewall in their pocket these days, sadly.

I'm certainly re-generating any keys which touched iOS or OSX devices (thankfully very few), and reinstalling OSes, in the interim.

<comment><USER4> My gut says the probability of a random typo executing without raising an error or exception is rather low. The probability of it doing so in a way that well aligns with the interests of nation states, large corporations, and/or criminal enterprise is even lower.

This might explain DROPOUTJEEP particularly considering how much more efficient it is than breaking messages after they are encrypted.

[http://mobile.eweek.com/security/nsa-spying-on-apple- iphones...](http://mobile.eweek.com/security/nsa-spying-on-apple-iphones.html)

<comment><USER5> Sure, this aligns with interests, but the bug's existence is predicated on the _entire code base being written with substandard style rules and no static analysis or tests_ , which suggests to me that incompetence got here first.

<comment><USER6> > entire code base being written with substandard style rules and no static > analysis or tests, which suggests to me that incompetence got here first.

That _and_ inadequate, bordering on zero, code review. Even a beginner C programmer looking at this code could see how fishy it looks.

No code review while checking in code to libssl. That takes a lot of incompetence.

<comment><USER7> _That takes a lot of incompetence._

"Any sufficiently advanced incompetence is indistinguishable from malice"

[https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/HT...](https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/HT5780/Crypto_Officer_Role_Guide_for_FIPS%20140-2_Compliance_iOS_6.pdf)

We begin therefore where they are determined not to end, with the question whether any form of democratic self-government, anywhere, is consistent with the kind of massive, pervasive, surveillance into which the Unites States government has led not only us but the world.

This should not actually be a complicated inquiry.

[http://snowdenandthefuture.info/events.html](http://snowdenandthefuture.info/events.html)

</comment></comment></comment></comment></comment><comment><USER8> Worth noting that static analysis finds bugs like this immediately. TLS code seems like the perfect candidate to run through static analysis on every checkin. There are products such as Coverity and PVS-Studio that would have immediately flagged this and probably some open-source ones built around LLVM as well (unsure about this one, though). I personally use Coverity and have it hooked up in the same way everyone connects Travis CI.

<comment><USER9> There is no excuse to bypass static analysis nowadays. At very least should be part of the continuous integration build.

The problem are the many developers that still think they are perfect and know the full C standard, including undefined parts.

<comment><USER10> Unfortunately the decision to use static analysis tools would have to come from developers who are comfortable admitting they make mistakes sometimes.

It takes a special kind of ego to write an SSL library with no unit tests, not turn on compiler warnings, and not use static analysis tools.

<comment><USER11> OpenSSL was written by monkeys: [http://www.peereboom.us/assl/assl/html/openssl.html](http://www.peereboom.us/assl/assl/html/openssl.html)

<comment><USER12> Wow. Thats really bad, who would have thought OpenSSL is such a piece of crap? Its about time someone writes a decent alternative!

</comment></comment></comment></comment></comment><comment><USER3> Unfortunately OSX does not appear patched even in the latest developer center 10.9.2 build (13C62). Tested in both Safari and OS-distributed curl. Chrome/Firefox of course is still fine since it uses the NSS stuff, but plenty of OS services use the OS crypto. (I'm violating NDA by commenting on pre- release Apple stuff, of course.)

Windows or ubuntu bootcamp until they fix this, I think.

<comment><USER13> MITM of any SSL connection in Safari and other system apps, and they couldn't even bother to have an OS X patch ready at the same time as the disclosure for iOS? I think anyone relying on the security of OS X is going to have to seriously rethink their OS choice after this.

<comment><USER14> Indeed the only secure OS nowadays is Linux. Everything else should be considered _compromised by default_ a priori.

<comment><USER15> Linux is only secure if you secure it.

<comment><USER14> Sure, but at least you have _a say_ there.

<comment><USER16> If you need to say something to make it secure then wouldn't it also be compromised by default?

Security is not a Boolean. A better question is, which OS is more secure OOTB for a given user.

<comment><USER15> For some users, none of them. Some users, no matter what, demand _password_ as their password.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> I just made this - it'll tell you if you're vulnerable.

[https://gotofail.com/](https://gotofail.com/)

Not very well tested, please let me know if it works for you. If you're on OS X Mavericks or on iOS 7 and haven't patched you should get big scary red text.

Edit: posted here [https://news.ycombinator.com/item?id=7282164](https://news.ycombinator.com/item?id=7282164)

<comment><USER18> "If you're on OS X Mavericks or on iOS 7 and haven't patched"

how do I patch on OS X Mavericks? Software update shows nothing to update

<comment><USER17> There is no patch for Mavericks out yet. :-(

<comment><USER18> I thought Apple's policy was to not release these sort of security notices until a fix was in place?

<comment><USER19> That's partially why people are so upset. Mavericks is still very much vulnerable to a publicly acknowledge bug with many PoCs out.

</comment></comment></comment></comment></comment><comment><USER8> From looking at the code it seems like there should be a way to change the instructions to "fix" the issue, but in a round-about way. This code:

        if (sslVersionIsLikeTls12(ctx)) {
            /* Parse the algorithm field added in TLS1.2 */
            if((charPtr + 2) > endCp) {
                sslErrorLog("signedServerKeyExchange: msg len error 499\n");
                return errSSLProtocol;
            }
            sigAlg.hash = *charPtr++;
            sigAlg.signature = *charPtr++;
        }

is only executed in the TLS 1.2 case, but the sigAlg structure is always on the stack. So if this code remains "skipped" in the non-TLS 1.2 case, then later on:

        if (sslVersionIsLikeTls12(ctx))
        {
            err = SSLVerifySignedServerKeyExchangeTls12(ctx, sigAlg, signedParams,
                                                        signature, signatureLen);
        } else {
            err = SSLVerifySignedServerKeyExchange(ctx, isRsa, signedParams,
                                                   signature, signatureLen);
        }

the broken "else" case can be replaced with instructions to poke the proper values into sigAlg and then relative jmp to the code offset where the inlined SSLVerifySignedServerKeyExchangeTls12 begins (0x86cb9), as that version of the function does not have the bug.

I checked inside the SSLVerifySignedServerKeyExchange disassembly and the compiler expectedly omitted the remainder of the function, so it isn't as simple as sticking a few nops in.

<comment><USER20> If Security.framework is fully buildable from their source, perhaps the optimized out code isn't as much of a problem.

[http://opensource.apple.com/source/Security/Security-55471/](http://opensource.apple.com/source/Security/Security-55471/)

</comment></comment><comment><USER21> How is this code not covered by a unit test?

I'll admit I don't think of myself as great at unit testing, but the first thing I do when writing one for a new tool or class is use a code coverage tool to look for uncovered lines and once I have written a few basic behavioral tests I write tests to exercise and validate the output of the uncovered lines.

This ensures that the tests I write to cover the public API don't miss catching internal behaviors that require more subtlety to uncover.

<comment><USER22> > How is this code not covered by a unit test?

...or an integration test. or a functional test.

When you write an SSL lib, I suspect that at some point you ought to test that it checks f%^&ing certificates :/

<comment><USER23> Negligence or malice.

My theory is that Apple is spread too thin. Kayak.com reproducibly crashed MobileSafari the day iOS7 shipped, and brand new iPad minis regularly kernel panic and reboot.

It wasn't always like this.

<comment><USER24> Hmm, not just my Nexus 7, then. Fortunately that's not very frequent.

</comment></comment></comment></comment><comment><USER25> If blocks without curly braces ಠ_ಠ

<comment><USER26> I cringe whenever I hear people advocating that it's okay to avoid braces with single-statement conditionals/loops/etc.

This is a perfect example of just how bad that suggestion is, and just how disastrous it can be. It's totally worth typing a few extra characters here and there to basically avoid these kind of situations completely.

<comment><USER27> I do write single statement conditionals without braces, but I write them on one line, which emphasizes the single-statement nature:

      if (something) do_something();

Instead of:

      if (something)
          do_something();

So it's much less likely that I'll confuse indentation with a block scope.

<comment><USER28> > I do write single statement conditionals without braces, but I write them on > one line

That's fine until you write

        if (something) do_something(); do_something();

or worse:

        if (something); do_something();

I've actually seen something very similar to that one.

You haven't really changed the dimensions of the problem by putting it all one one line. Only the whitespace is different. Sure it looks wrong to you; but so does the incorrect code from apple.

I don't understand the need to omit braces; it doesn't make the compiled program any smaller. And denser source code is not always more readable, or we'd prefer "? :" to "if" every time.

<comment><USER29> Note that braces won't save you from

        if (something); { do_something(); }

(Personally, I configure my editor to highlight if (...); in bright red.)

<comment><USER28> This is true; there is no silver bullet. So we rely on defence in depth.

The first line of defence is consistent code layout; e.g. always use "{ }" after an if, and only one statement per line. This aims to make simple typos less likely to compile, make the code more readable and so make errors stand out.

Then there is using and paying attention to the linter / compiler warnings / jshint + 'use strict' / static analysis or whatever it's called in your language of choice.

Then there are unit tests or integration tests.

Any of these might have caught the apple error, but there are no absolute guarantees.

IMHO it's a professionalism issue – gifted amateurs are great, and they can succeed... most of the time. But a professional engineer would put aside ego "I won't make mistake like that" and laziness "I don't need to type braces this time" and do the careful thing every time. Because each step raises the bar, and makes it harder to ship code with bugs like this. Because sometimes it matters.

</comment></comment></comment></comment></comment></comment><comment><USER30> I think what this really shows is that Apple has no unit tests to cover the security of their products. And that is pretty scary.

<comment><USER3> I don't think you necessarily need unit tests to catch this; code review would work (even I probably would have caught this if I'd actually read it; "fucking gotos" would have drawn my attention to begin with, and if it was a _single_ line commit, even more so.)

The problem is Apple (intentionally) understaffs and overworks, so I doubt they have the spare people to look at most commits.

<comment><USER23> If only they had the money to devote to quality engineers to ensure good processes surrounding their most critical, security-sensitive code.

You can't really blame them for doing the best they can with limited resources. Startup life is hard.

</comment></comment></comment><comment><USER31> Reminiscent of the "Linux Backdoor Attempt of 2003" [https://freedom-to- tinker.com/blog/felten/the-linux-backdoor...](https://freedom-to- tinker.com/blog/felten/the-linux-backdoor-attempt-of-2003/)

</comment><comment><USER32> [http://opensource.apple.com/source/Security/Security-55471/l...](http://opensource.apple.com/source/Security/Security-55471/libsecurity_ssl/lib/sslKeyExchange.c)

Can someone explain to me what this code is? It appears to be implementing standard crypto procedures -- are there not suitably licensed public implementations that apple can use? If they are writing it themselves, why are they open sourcing it? (I don't have a reason why they shouldn't it's just that I've never associated apple with much interest in open sourcing things).

<comment><USER33> This isn't a defense of Apple's choices, but:

Using public implementations for crypto code has been difficult until pretty recently. There didn't exist many high-quality, trustworthy, public implementations of the types of crypto that real-world systems have wanted to do.

Even now, the situation is pretty grim for anyone who wants to integrate crypto code into an existing large codebase. The canonical answer is "just use NaCl." However, I've had developers outright refuse to use NaCl because "it's so hard to compile." They were saying NaCl has some issues compiling on certain types of architectures, and issues compiling as a dynamic library. When libsodium was suggested in response, they retorted that libsodium was "NaCl but with modifications by people other than the ones you'd want making modifications to crypto code." In other words, libsodium purports to be "NaCl, but easy to integrate into your project," yet the reason it's easy to integrate is because someone other than recognized cryptography experts fiddled around with NaCl until it was easy to compile. So apparently it's an open question whether libsodium is as trustworthy as NaCl, and NaCl is a pain to integrate.

All of this implies that the current situation is _still_ not very good as of 2014 for people who want to just do crypto safely and in some standard way. And rather than writing that code in 2014, Apple had to write it years ago, when the situation was far more painful than the present day's shortcomings.

To answer your question, yes, there are public implementations which could theoretically be used. But actually using them is... difficult. Not nearly as difficult or as error-prone as rolling your own, but perhaps difficult enough where someone who isn't an expert in cryptography might make the dire mistake of believing that rolling their own is less difficult.

I wish Matasano would publish an open-source crypto library. An "NaCl that's easy to use and that people actually trust." They have the resources and the credit to pull it off.

Alternatively, I wish we could gather funds to have them audit libsodium.

Also, all of this is based on the assumption that NaCl or libsodium actually meet the needs of what Apple was trying to do with this crypto code. It probably doesn't, because NaCl / libsodium provides a complete replacement to the entire crypto stack of an application. To take a wild guess, I'm thinking that Apple needs to implement / interact with some other kinds of crypto than what NaCl/libsodium provide. For example, certificate validation. So then you'd suggest "use cryptlib!" but this is hampered by the fact that in addition to all the previous considerations, cryptlib also isn't free.

<comment><USER32> Thanks! Is it surprising that they open source it? That gives their adversaries opportunity to look for weaknesses in their code. And as for benefit for apple, ... it seems to be exposing the fact that they have a mixture of tabs and spaces and have let someone edit an absolutely critical file with no code review or testing.

<comment><USER33> What you say is true. But security through obscurity doesn't work, because people are very good at reverse engineering and decompiling. So your choices are either: open source your crypto code and suffer some embarrassments which people will forget and forgive, or have closed source crypto code that either doesn't work or can be exploited in subtle ways. Pick your poison. :)

</comment></comment></comment></comment><comment><USER34> Emerging tools such as gofmt and clang-format are able to automatically re- format your code based on the language rules rather than the human behind the monitor. Using those tools this specific category of issues should at least be visible in the formating diff.

Interesting. Never thought about it that way before.

<comment><USER26> Those kinds of tools aren't new or emerging. The "indent" utility for C has been around for decades. I first remember using it on 4.3BSD, but it may have been around before that.

<comment><USER35>
        indent - indent and format C program source

        HISTORY
            The indent command appeared in 4.2BSD.

And for context, 4.2BSD was released in 1983.

<comment><USER36> cb(1) was in Seventh Edition (1979).

      NAME
        cb - C program beautifier

      SYNOPSIS
        cb

      DESCRIPTION
        Cb  places a copy of the C program from the standard input on the stan-
        dard output with spacing and indentation that displays the structure of
        the program.

</comment></comment></comment></comment><comment><USER37> I'm going with accident either through a merge or a double paste. I'm guessing that if they were running some kind of static analysis tool that it probably would have flagged this one as a duplicated line and someone would have caught it earlier.

</comment><comment><USER38> Does anybody know the .dylib or binary file where this function resides on OSX? I can't find libsecurity_ssl on my system.

It should relatively simple to NOP out the 2nd goto, if the rest of the function hasn't been optimised away.

<comment><USER8> The static function that has the bug will most likely be inlined into the other static function which will then be inlined into the outer public symbol that calls it.

I believe you can dump the assembly of the entire function like this:

        otool -t -p _SSLProcessServerKeyExchange \
            -V /System/Library/Frameworks/Security.framework/Versions/A/Security | less

edit: I believe this could be the offending instruction:

        0000000000086df6        jmp     0x86e0d

edit2: That is actually in SSLVerifySignedServerKeyExchangeTls12(). Trying to track down the real one..

edit3: Looks like the compiler did optimize it out if I'm reading it correctly now. The code is around 0x86c97. It does the last if() call and then immediately calls SSLFreeBuffer() and jumps to the end. :(

<comment><USER38> Confirmed here too :(

        0000000000086c80    callq   *%r14 ; SSLHashSHA1.update(&hashCtx, &signedParams))
        0000000000086c83    movl    %eax, %ebx
        0000000000086c85    testl   %ebx, %ebx
        0000000000086c87    jne 0x86c9c
        0000000000086c89    leaq    0xffffffffffffff38(%rbp), %rdi
        0000000000086c90    leaq    0xffffffffffffff58(%rbp), %rsi
        0000000000086c97    callq   *%r14
        0000000000086c9a    movl    %eax, %ebx
        0000000000086c9c    leaq    0xffffffffffffff08(%rbp), %rdi
        0000000000086ca3    callq   _SSLFreeBuffer

</comment></comment></comment><comment><USER39> The faulty block of code -- line 623 (function SSLVerifySignedServerKeyExchange) -- looks like a cut and paste (or the reverse) of the block of code at line 372 (function SSLSignServerKeyExchange), except this one doesn't have the extra "goto fail;".

</comment><comment><USER40> I'd love to see the git blame logs for that one.

Whoever wrote that code even before it had the bug was an incompetent cowboy hotshot who wanted to show off how pedantically he knew and could surf the nuances of syntax and optimize the code to have the smallest source file size by penny pinching brackets.

"ALWAYS USE BRACKETS" is one of the oldest and wisest rules in the book, and this shows why. Anyone who actually writes security related code like that, blatantly ignoring important coding practices in the name of "aesthetic beauty" or however they rationalize omitting brackets, should be fired.

I bet they're the same cowboys who fanatically prosthelytize JavaScript automatic semicolon insertion too, because that's another outlet for their obsession with showing off how clever they are to write code that requires them to deeply understand and consider every nuance of the syntax at every keystroke, instead of facing the fact that they or somebody who comes later might actually make a mistake, and coding defensively.

Maybe they really are fucking geniuses who never make mistakes, but that's not true about everyone else who has to read and modify the code.

Apple should go through all their code and fix it, and dock the salary of anyone caught not using brackets.

</comment><comment><USER41> One of the most valuable companies in the world and they can't hire a junior level engineer to write 100% code coverage unit test? Unbelievable.

<comment><USER42> Or an intern to rewrite the entire thing from scratch. The code quality of the entire library is awful. No comments. Impossible to determine ownership of pointers. MIXED TABS AND SPACES?? WTF?

People are downvoting my comments all over this thread but really, if this is not literally the worst code in iOS then I'm throwing away my iPad immediately. The priesthood of cryptography is always warning the lay programmer to avoid re-implementing crypto, and instead to use libraries written by experts. But the crypto experts are apparently good at math and terrible at programming computers. This Apple library certainly isn't the only evidence of that. OpenSSL is largely uncommented and untested as well.

</comment></comment><comment><USER43> This shows another of the benefits for the community of open sourcing code - because we can see exactly where and what the bug was steps can be taken in other projects to stop it happening there (I think Adam mentioned he was going to check for a test case in Chrome).

If the code was closed all we would have is Apple's release note which just says validation steps were skipped...

<comment><USER44> The code in question _is_ open source.

<comment><USER44> Wish I could delete that comment - reading comprehension failure!

</comment></comment></comment><comment><USER45> Non-semantic indentation claims another victim.

</comment><comment><USER20> I loaded up the Xcode project for Security.framework and it complained about disabled compiler warnings.

I also noticed their open-source download page [1] doesn't force you to https by default, which probably matters to anyone looking at Security.framework to fix SSL MITM problems :)

Doesn't look like they make their frameworks easy to compile for outsiders. The only corecrypto headers I can find are in XNU, and they appear to be outdated.

I'm hand-constructing what I can from context. Here are the defines from ccasn1.h: [https://bochs.info/p/6jquf](https://bochs.info/p/6jquf)

You need these too:

        typedef int ccoid_t;
        extern size_t ccder_sizeof_raw_octet_string(signed long length);

Currently working on libaks.h and corecrypto/{cczp,ccec,ccec_priv}.h

[1] [https://opensource.apple.com/release/os-x-109/](https://opensource.apple.com/release/os-x-109/)

</comment><comment><USER46> I wonder if this would have as much attention without the Snowden leaks. I guess yes.

Not to be a conspiracy theorist, but history tells that computer technology was released to the public, so to me it still looks like there is no absolute objective, safe way to use a computer for a layman. It still looks more like a tool of surveillance than a tool of communication.

You'd want my opinion, but I'd be apple (or Linux for the days that happened for a certain commit with a =!0 thing), I'd try to sue the guy who was responsible for this commit.

You could argue in court that it's impossible to prove if it's voluntary, but I guess we must set an example and start to hold anyone responsible for this. It's time to set the courts aware of computer security standards...

<comment><USER47> You cannot sue a programmer for writing a bug in software, or at least it would be thrown out immediately. It is the company's responsibility to ensure that the code is peer reviewed and tested before deploy. There are so many bugs in software, that this would be a terrible standard to set, and no developer would be safe. The best a company could do is fire them, but even that is unlikely.

<comment><USER48> > You cannot sue a programmer for writing a bug in software ...

Of course you can.

> It is the company's responsibility ...

Not if the programmer was hired for his independent expertise rather than to be told what to do, and how to do it, by higher-ups. That's a a common arrangement in small companies.

> There are so many bugs in software, that this would be a terrible standard > to set, and no developer would be safe.

All true, but surely you realize that lawyers and judges don't necessarily ask themselves, "Is this fair?"

Remember that a group of scientists were successfully convicted of manslaughter in Italy for _not_ predicting an earthquake. It was a different country and legal system, but not that different.

[http://abcnews.go.com/International/scientists-convicted- man...](http://abcnews.go.com/International/scientists-convicted-manslaughter- failing-predict-italian-quake/story?id=17536977)

The handwriting is on the wall.

<comment><USER47> > Not if the programmer was hired for his independent expertise rather than be > told what to do, and how to do it, by higher-ups. That's a a common > arrangement in small companies.

1\. That does not excuse software from a proper code review process, in fact any reasonable software company would probably see this as even more of a reason to code review the code. If I knew that a software company doesn't properly review critical code, I would definitely think twice about using that company's software.

2\. Apple is not a small company so that doesn't excuse them in this case.

>All true, but surely you realize that lawyers and judges don't necessarily ask themselves, "Is this fair?" Remember that a group of scientists were successfully convicted of manslaughter in Italy for not predicting an earthquake. It was a different country and legal system, but not that different. [http://abcnews.go.com/International/scientists-convicted- man...](http://abcnews.go.com/International/scientists-convicted-man..).

Come on this is the Italian legal system. No offense to Italy, I believe it to be a beautiful country, but they have had a shocking record in their legal system as of late. And I highly doubt that this would have stood up in many other western legal systems.

But even if I concede to all your points, someone on HN should be smart enough to realise that suing someone for a software bug would definitely not be a smart move. And we definitely shouldn't be recommending such a thing. Just like we shouldn't be recommending scientists to be convicted of manslaughter for not predicting an earthquake.

<comment><USER48> >> Not if the programmer was hired for his independent expertise rather than be told what to do, and how to do it, by higher-ups. That's a a common arrangement in small companies.

> 1\. That does not excuse software from a proper code review process, in fact > any reasonable software company ...

You changed the subject. The original subject was whether a programmer could be held accountable for a bug in a computer program. The answer is yes, under civil law, that can happen.

There are companies whose computer science departments consist of one person, which was my example, and in such a case, there is no company-wide software review process, because -- as I already said -- the computer science department consists of one person working alone.

Feel free to change the subject if you want.

</comment></comment></comment></comment></comment><comment><USER49> Umm .. Code-coverage, Apple? That's the most scary aspect of this issue - <USER2> there is clear evidence that Apple aren't testing with coverage. At all. Or else this wouldn't have ever made it to release ..

</comment><comment><USER50> I installed this last night and the update came in at 15MB. Surely a one line bug shouldn't cause a 15MB update? Or is it that some things in iOS might be statically linked and those had to be pushed out as well?

<comment><USER51> The dynamic libraries in iOS aren't shipped as separate dylibs on the device. Rather, they're essentially concatenated together as part of a single file called the dyld shared cache that also lets Apple do some prebinding tricks, interning of objc selector names across all system libraries, etc.

The system-wide iOS build scripts actually randomize the order of the libraries in the shared cache by default (you can check this using dyld_shared_cache_util against the shared cache file, which you can compile from the dyld project on Apple's open source site). Since the ordering of dylibs in this giant shared cache file varies between builds, you could easily end up with a 15 MB diff even though all you've done is deleted a single goto in source code.

</comment></comment><comment><USER52> Can't wait for Apple to patch this bug? Downgrade to 10.8.5 ...

The answer here, folks, is don't update until all the bugs have been found and fixed. Apple's golden days of OS updates was back in 10.6, when they spent most of the time just fixing bugs rather than adding new features. Every OS update since has had as many bugs as it fixed, though overall things were getting better.

It's the old Wait-until-SP1 advice. For security, it's often true. The exception being if the patch cycle is fast enough...I'm not going to say for sure whether one is better than another.

<comment><USER47> > The answer here, folks, is don't update until all the bugs have been found > and fixed.

How can you ever be sure of this? And also I can almost guarantee that there is no non-trivial software that is bug free. As a programmer the only way you can guarantee bug-free code is to not program at all.

So if you follow this advice, you will never update at all, which in my opinion is bad because the benefits of an update outway the negatives.

<comment><USER52> I was being facetious in that one line. I never expect "all" the bugs to be fixed, but it's equally true that if you wait 8 months, you'll know better what you're upgrading /to/. In this case, 10.9 had the bug, 10.8 did not. It's usually the case that as new features are added, it's much more likely that you've added new bugs. Whereas in slightly older code, you might be "out of date" but at least you know where the bugs are, generally, by watching what changes in newer releases and back-port as necessary. And as I think I've said elsewhere, if code is updated frequently, this advice might change -- so long as you're running a stable channel, you can both get new updates and enjoy tested code.

</comment></comment></comment><comment><USER53> This seems to be the current thread on the topic, so I'll mention here in case anyone cares that iOS 5.1.1 does not contain the vulnerability, according to gotofail.com's test for it.

</comment><comment><USER54> Dijkstra always contended GOTOs were harmful!

In all seriousness it's unfortunate the C family of languages even allow this kind of bug - we've all been bitten by it at one time or another.

<comment><USER55> I'm calling you on the GOTO is evil thing. It's not. This is a well-structured use of GOTO, and it has a long tradition in C shops. This is a well-understood idiom, and you're seeing a _different_ failure.

Your choices for exception handling systems in the C-like languages are:

\- early return (whereupon, resource leaks and bloated cleanup code)

\- setjmp/longjmp (whereupon, utter chaos)

\- "chaining" success, where you don't use GOTO and have to _consistently_ check your current 'err' state before doing additional "work" (whereupon, lots of bugs when you forget to handle an error case)

\- or GOTO to a single piece of error handling code (this is usually coupled with an earlier hunk of code where you initialize variables and set up state; this is essentially the C++ "constructor / destructor" idiom, but done by hand).

The GOTO is the best choice, because everything else is worse.

(If you're using C++ exceptions you're in serious trouble. The effort required to write correct code in the presence of arbitrary exceptions is very high, and you're likely to get things wrong. Scott Meyers wrote like three whole books on the subject, which should be strong evidence that something is Very Wrong, and if you've ever used exceptions in a language that doesn't have garbage collection you'll probably agree (and even GC doesn't save you). Most production C++ code that I've seen use exceptions simply catches them in a bug-handling layer, which responds by scribbling some kind of report and then restarting the app).

Often these GOTOs are wrapped with macros that hide the fact that GOTO is being used. This _can_ hurt code quality, since things are less clear, but in general they work well.

Basically they should have had the dead code warnings enabled, and listened to them, and done better checkin reviews. GOTO is not the enemy here. In paranoid code like this, generally you want to "claim success" as late as possible, so setting 'err' to some failure code would have been a better choice.

But using GOTO wasn't a mistake.

<comment><USER56> _If you 're using C++ exceptions you're in serious trouble._

Sorry, but I'm going to call you in turn on that one.

Of course there are some unwise things you can do in the presence of the C++ exception mechanism, and 15 or 20 years ago plenty of us did them. I think probably Herb Sutter deserves more credit than anyone else for drawing attention to these things, but the point is valid in any case.

However, we've figured out a lot since then, and for a long time writing exception-safe code from scratch in C++ has been quite straightforward. Just follow the common idioms, which mostly boil down to "use RAII for anything that needs cleaning up".

The biggest difficulties with exceptions in C++, IME, generally come from trying to retrofit them into code that was written without exceptions in mind. If your existing code doesn't necessarily follow even basic good practices for writing exception-safe code, the WarGames rule applies.

</comment></comment></comment><comment><USER57> So here is the shirt – proceeds will go to EFF and FSFE: [http://teespring.com/goto-fail](http://teespring.com/goto-fail)

<comment><USER58> in.

</comment></comment><comment><USER59> How do we even know we are downloading the real iOS 7.0.6? - surely it downloads the new version using this library?

Edit: it's also digitally signed

</comment><comment><USER60> I continue to be baffled as to why Apple hasn't rolled out a security update for this issue on OS X.

</comment><comment><USER61> Come on Apple. This makes the whole blunder even more embarrassing.

Code Reviews? Static Analysis?

/sigh

</comment><comment><USER62> Something that concerned me was things like software update daemons connecting with SSL. Can they be compromised? Or is this something that requires connecting to a black-hat server?

<comment><USER63> If all methods of updating need SSL, and SSL is broken, then there's no real way to securely ship a patch.

</comment></comment><comment><USER64> Any theories on how this got committed and merged?

<comment><USER65> Looks like the kind of mistake an automated merge can make.

<comment><USER42> Or even a manual merge.

</comment></comment></comment><comment><USER66> This could not have happened with C++ exceptions and RAII instead of manual error checking and goto for cleanup ;)

<comment><USER67> Any language that lets you omit braces for single statements is prone to this bug, which includes C++.

<comment><USER68> Suggestion to clang and gcc developer: implement -Wmandatory-curly-braces

At least, short of making it mandatory it would at least signal bad style.

</comment></comment></comment><comment><USER69> Looks like the result of a bad merge

</comment><comment><USER70> I hope the someone fixes a patch for jailbreak'ed devices.

</comment><comment><USER71> We can assume that all Apple devices have now been backdoored.

</comment><comment><USER72> If only it was open source this never would have happened.

<comment><USER73> Once eyeballs are thinly spread over enough projects, all bugs are deep again.

<comment><USER74> In what possible reality was this not the inevitable outcome? The "enough eyeballs" aphorism makes for a nice soundbite but in practice was always a red herring.

</comment></comment></comment><comment><USER42> The code is crap and while I can understand why a single person might have written it this way, I think any organization of full-time professional software developers should be collectively embarrassed to have accepted it. The only reason to use the "goto fail;" idiom is to free two buffers before returning. But the buffers in question are just sslBuffer structs that live on the local stack. Their destructors will be called, in reverse order, regardless of how the function is exited. If this code simply had a fucking destructor for sslBuffer to delete the data pointer, none of the rest of these call sites for SSLFreeBuffer would need to exist at all! And there's 24 such call sites in this file alone. Anyone with any sense would chose the 2-line destructor over dozens of calls to free buffers.

There's even this bullshit:

        if ((err = SSLFreeBuffer(&hashCtx)) != 0)
            goto fail;

Which is hilarious, because the only way for SSLFreeBuffer to fail is if the buffer doesn't exist, but hashCtx is a local temporary object and it MUST exist. Anyway the only thing we do by jumping to fail is to free the non- existent object once again.

In short: wow.

<comment><USER75> > Their destructors will be called, in reverse order, regardless of how the > function is exited.

Not in C.

<comment><USER42> Yes, one makes a conscious choice of implementation language. They aren't dictated by the laws of physics. Choosing your implementation language is a rather important step.

<comment><USER24> Indeed, a step involving more factors than simply whether the language has destructors.</comment></comment></comment></comment>


The Most Important Software Innovations - b-man http://www.dwheeler.com/innovation/innovation.html

<comment><AUTHOR> I particularly liked the analysis on the impact of patents. Essentially, no important software innovations have been patented.

</comment><comment><USER2> Excellent list for those of us who have grown up taking this stuff for granted. One minor nitpick: it's very difficult fore to agree that "refactoring" belongs in the same list as relational algebra and Boolean logic.</comment>


Are javascript frameworks suitable for content websites - <AUTHOR>

MV* JavaScript frameworks are the latest craze in website development but are they really more suited to app development rather than content heavy websites such as bbc.co.uk or guardian.co.uk? Is that approach plain wrong for that type of project, if so which approach is better suited? <comment><USER2> It depends on what you're trying to do. The server-side breaks down into MVC readily: you have a database or set of files or some more exotic data store as a model, the HTML/CSS/JS/whatever that gets sent to the client as a view, and your middleware as the controller.

When you do this, then by the time you get to the browser, you're already working in the view. But does it make sense to break the view down into its own model, view, and controller? If you're dealing with a page as a monolithic blob of text, then probably not, and there are cases where it makes sense to do that.

But not all content can be treated as monolithic blobs of text. You mention journalism, but it is not at all uncommon in journalism to have to present some form of raw data to the user -charts, tables, and such- even if that data is just a summary of some other data. MVC is well-suited to that task, perhaps as a series of data presentation widgets within the site. But even blobs of text are not always monolithic. One example that comes readily to mind is also pertinent to news sites: comments. If you need to manipulate comments on a page, then that's another case where MVC could come in handy.

The bottom line is that it depends on what you want to do to the site. Monolithic blobs of text don't require MVC, if that's really all you're handling, but is that all you're handling? Maybe, but maybe not.

<comment><AUTHOR> I think that is exactly it, content heavy websites are no longer just pulling blobs of text out of the database and dumping them on a static page. Even traditional content websites are becoming 'applications'. The lines are blurring and therefore choosing the right tool for the job becomes more challenging.

</comment></comment><comment><USER3> I think you might be asking a question that is not relevant to the subject matter. IMHO the answer to your question is yes, because the technologies can be used to create content heavy sites. What is also needed however, is some form of content creation/management system which can be created with a JavaScript framework as a component. So yes, you can, but it won't be quite that simple.

For example, sammy.js can be used for navigation, and knockout.js for data binding, but this sort of system would need to be carefully thought out and structured. There are many content management features that would need to be added that wouldn't come from the class of frameworks that I mentioned. Hopefully this answer is helpful and I would be glad to answer any further questions.

<comment><AUTHOR> I'm not sure what you mean by "I think you might be asking a question that is not relevant to the subject matter", could you clarify?

</comment></comment><comment><USER4> I actually use Backbone.js for content websites. Not because I'm doing a ton of ajax or passing data back and forth, I just find that Backbone helps me keep things more organized.

I'd rather set up a Backbone view for the entire page, register my event handlers, and do all the callbacks and stuff from there than end up with a big soup of javascript.

Of course, when I'm doing these content websites, I rarely use models, collections, templates, or the router.</comment>