Machines, Minds, and Morality: Ethics in a Changing Technological World - <AUTHOR> https://www.rosemont.edu/about/the-institute/symposium.php <comment><AUTHOR> Ethics is an important topic in these days of outrageous conduct, massive surveillance, and fake news that is hard to distinguish from the truth (and the converse, as well). This symposium has a very interesting complement of speakers who seem willing to take on the hard questions.

The organizers say they will both video and stream the talks, but I see no information about how to access yet.</comment>


VersionPress 1.0 Released - <AUTHOR> http://blog.versionpress.net/2015/04/versionpress-1-0-released/ <comment><USER2> > There is one important thing to understand about VersionPress: though it is > technically a WordPress plugin, it is one of the most complex ones you can > imagine.

This send shivers down my spine.

<comment><USER3> True! VersionPress looks promising and I hope it works well.

But it's sort of scary how many things are accomplished through workarounds/hacks in WordPress. Like deploying a site, where you need third- party scripts (or write your own) to change strings in the database without breaking WordPress' serialisation mechanisms...

<comment><USER4> Agreed. When we need to move things around we dump, find/replace and then re- serialize via [https://github.com/rysi3k/Fix- Serialization](https://github.com/rysi3k/Fix-Serialization). It's crazy there isn't a better way and the way WordPress handles URLs could be better.

<comment><USER5> Have you considered using wp export/import in lieu of actual database dumps?

[http://wp-cli.org/commands/export/](http://wp-cli.org/commands/export/)

</comment></comment></comment></comment><comment><USER6> Looking over this and revisr and gitium, and being already familiar with Drupal's "Features" and new CMI, I feel there is a general pattern here.

The pattern is that we build a tool that allows non-programmers to build more and more complex things, until they are actually programming, and then we find ourselves in a mess because we have "code" with all the complexity of such without the tools and practices to manage it.

I think I saw this decades ago as the community of Unix users I was with developed more and more complex dotfiles, and traded them around, they were modified more and more by non-programmers, until the day someone put them in CVS and shared them.

This definitely happened in the Visual Basic story arc.

I suspect this also happened in COBOL, which started out as a way to let non- programmers program, then became a programming language that non-programmers could at least read and understand, and then became a black art.

I believe this happened with PHP, as it started with a way for non-programming "html coders" to reference the same $footer across all pages, and as that group of programmers moved through their careers and became real programmers, the tools and PHP itself evolved with them.

I think this is happening with Javascript now, as a class of "front end developers" who mostly started out as non-programmer, non-technical graphic designers discovered the power of being able to tell computers what to do, and now are doing things like node.js.

In the CMS world, I think WordPress is a bit behind on this arc compared to Drupal. That's not a criticism, it's just an observation of where a much larger community with a different balance of site builder vs user vs developer is -- WordPress is much further along on arc of widespread adoption, though.

<comment><AUTHOR> I really liked the first two paragraphs - they put it well.

</comment></comment><comment><USER7> Text cache: [http://webcache.googleusercontent.com/search?q=cache:http://...](http://webcache.googleusercontent.com/search?q=cache:http://blog.versionpress.net/2015/04/versionpress-1-0-released/&strip=1)

</comment><comment><USER8> been using revisr, a free plugin that not only does the same thing and more but it has been out for almost a year now with regular upgrades and feature adds:

[https://wordpress.org/plugins/revisr/](https://wordpress.org/plugins/revisr/)

will take a look at this to see how it compares

<comment><AUTHOR> Revisr is a fine plugin and it does many things nicely. However, it is vastly different from VersionPress, as described here:

[http://blog.versionpress.net/2015/01/versionpress-vs- revisr/](http://blog.versionpress.net/2015/01/versionpress-vs-revisr/)

<comment><USER8> revisr has automatic change tracking btw

<comment><AUTHOR> Really? Last time I checked it was manual commits only. Still, the way they track database is very different from how VersionPress does it. But as I said, I'm glad Revisr exists, it is a great tool for certain scenarios.

<comment><USER8> [https://revisr.io/revisr-v1-9-3-released/](https://revisr.io/revisr-v1-9-3-released/)

[https://wordpress.org/plugins/revisr/faq/](https://wordpress.org/plugins/revisr/faq/)

How does Revisr handle the database?

You have complete control, and can decide whether you want to track the entire database, just certain tables, or if you don't want to track the database at all. Then, during a backup, the tracked database tables are exported via "mysqldump". When importing or restoring the database to an earlier commit, Revisr first takes a backup of the existing database, creating a restore point from immediately before the import that can be reverted to if needed.

You can also set a "Development URL" that will be automatically replaced in the database during import- allowing for backups and restores that work on both your dev and live environments.

<comment><AUTHOR> VersionPress' automatic change tracking means that new commit is created after every logical change to the site, e.g., after you update a post, update a plugin or just about anything. Revisr, if nothing changed recently, only creates commits when you manually say so. That's a difference.

</comment></comment></comment></comment></comment></comment><comment><USER9> The staging aspect of this is what I'm really looking forward to. Once this works I'm hooked. I'd also gladly pay for a plugin this complex and all the benefits it provides.

</comment><comment><USER10> I really love the idea behind this. The team is dedicated too. I have been following it for awhile, hoping they would get here. Great work.

</comment><comment><USER11> Hmm, if I pay $50 to download it, can I charge them $50 for advance notice of any security vulnerabilities I find in their plugin?

<comment><AUTHOR> Deal!

</comment></comment><comment><USER12> Hmmm, this is kinda nifty. How long does the mysqldump and git commit take? It seems like comments could DOS the server.

<comment><AUTHOR> We're not dumping. A comment (and most other changes) is a single text file so commit is fast.

</comment></comment><comment><USER13> Honestly, this is what WordPress revisions should have been. In the age of git, there's no point in re-creating a versioning system that only covers elements of your system and not the entire thing. Just hook into git if it's available or even make a PHP implementation of git and use it.

<comment><AUTHOR> There's been some discussion whether this should be in the core or not. I understand why they chose their current "simplistic" implementation, it has a lot of benefits but we try to go far, far beyond that.</comment></comment>


Bayer to retire Monsanto name - <AUTHOR> https://www.reuters.com/article/us-monsanto-m-a-bayer-closing/bayer-to-close-monsanto-takeover-to-retire-targets-name-idUSKCN1J00IZ?il=0 <comment><USER2> This is a two-sided sword. Yes, Monsanto will disappear and that could be a good thing. Like lastUsername said before: if they continue their work ethic, then Bayer will become the new Monsanto.

Or as Shakespeare put it in Romeo and Juliet:

"'Tis but thy name that is my enemy: Thou art thyself, though not a Montague, What's Montague? It is not hand nor foot, Nor arm nor face. O be some other name, belonging to a man! What's in a name? That which we call a rose, By any other word would smell as sweet."

<comment><USER3> Are you trying to imply that Monsanto is an "enemy"?

<comment><USER4> No, the quote is saying that the name is irrelevant.

The OP is saying that Bayer will acquire the reputation of Monsanto because the activities of Bayer will be the same as Monsanto.

<comment><USER5> Oh the irony. The company that literally brought heroin to market, gets a bad name from buying a company known for heavy-handed corporate litigation practices.

To be clear I'm not trying to blame Bayer for the opioid epidemic. I just think there's a joke in there

<comment><USER6> Outside of the US heroin is still very much on the medical market. It's used in hospitals mostly.

</comment></comment></comment></comment></comment><comment><USER7> I'm not going to defend Monsanto's bad business practices, but I don't think I've ever met someone who accurately articulated real problems with Monsanto as opposed to hysteria and conspiracy theory, so this is probably the best move over all.

<comment><USER8> Check the Monsanto Wikipedia page for more details, but the short version is that Monsanto patented its genetically engineered seeds and then sued farmers for patent infringement if they were found to be growing crops from that seed without a license.

The problem with this is that seeds tended to blow between fields, so if your neighbor licensed Monsanto seed and then the next year a bunch of that seed manages to take hold in your field, you're liable for a patent infringement.

Additionally, they argued, successfully before the Supreme Court in 2013, that additional generations of seed from the initially licensed seed required new licenses from the patent holder.

As might be expected, this rubs A LOT of people the wrong way.

<comment><USER9> > The problem with this is that seeds tended to blow between fields, so if > your neighbor licensed Monsanto seed and then the next year a bunch of that > seed manages to take hold in your field, you're liable for a patent > infringement.

Do you know of a court case where this actually happened?

I've seen this defense thrown around in the few cases I've seen, but investigators have usually had evidence that it wasn't accidental contamination, but rather just being used as an opportunistic defense.

> Additionally, they argued, successfully before the Supreme Court in 2013, > that additional generations of seed from the initially licensed seed > required new licenses from the patent holder.

I found this court case: [https://en.wikipedia.org/wiki/Bowman_v._Monsanto_Co](https://en.wikipedia.org/wiki/Bowman_v._Monsanto_Co).

"sold the seed from which these soybeans were grown to farmers under a limited use license that prohibited the farmer-buyer from using the seeds for more than a single season or from saving any seed produced from the crop for replanting"

I'm not totally sure what's objectionable about this ruling. The original buyers explicitly agreed to the license.

I think there is an argument to be made against intellectual property in general, but this doesn't seem any more egregious than, e.g. music or software copyright, and most people are quite happy with those.

<comment><USER10> _this doesn 't seem any more egregious than, e.g. music or software copyright, and most people are quite happy with those._

Many pro-copyright arguments are accompanied by "You don't need it, so if you don't like the [price, terms, DRM] just don't consume it."

This is dealing with actual food, which we most definitely do need, so people will understandably be a bit more motivated.

<comment> Digital-Citizen I take it as sign of failing moderation that the parent comment was moderated down and rendered harder to read by default. It's quite right--music copyright licensing is not foreseeably an issue of life and death. Any music copyright holder depending on that income can try and get another paying job, even a non-musical job to earn money. I'm not a fan of that approach (for reasons outside the scope of this discussion) but it is more practical than waiting for a license check and starving. Planting seeds, harvesting plants for food, and replanting the seeds that naturally grow was a process big agriculture had to spend effort to stymie because the natural way got in the way of profits. That's harmful to us all.

Also, the grandparent article is conflating copyright and patent laws in the language of "intellectual property" and ought not be allowed to go without comment. These laws work very differently, cost different amounts of money to acquire and defend, and conflating them is a sign of ignorance or a sham. These laws have far more separating them than they share (one sentence in the US Constitution). [https://www.gnu.org/philosophy/words-to- avoid.html#Intellect...](https://www.gnu.org/philosophy/words-to- avoid.html#IntellectualProperty) explains more in-depth.

</comment></comment></comment></comment></comment><comment><USER11> Good marketing move, Monsanto has a very bad doppelganger.

If they continue with Monsanto ethic it will not take too long to have that doppelganger attached to Bayer.

<comment><USER12> Bayer doesn't exactly have a good reputation either [1].

I don't think it is a good PR move at all.

There is some litigation going on against Monsanto and probably a lot more to come. In the news you will read Bayer now instead of Monsanto which is going to hurt the Bayer brand.

[1] [https://en.wikipedia.org/wiki/Bayer](https://en.wikipedia.org/wiki/Bayer)

<comment><USER13> Buying slave labour from the Nazis, massive stake in the company that made Zyklon B, invented heroin, knowingly gave people AIDS with an anti- haemophiliac drug when it was banned in US markets. Quite the rap sheet.

<comment><USER14> The danger as a society we have to day is the people who grew up during those events are all passing away. We soon no longer will have people of any influence who experienced the horrors of a true world war. Names then have little connection to the past and companies "reinventing" themselves are only further opening this knowledge gap.

<comment><USER15> _The danger as a society we have to day is the people who grew up during those events are all passing away._

This seems to say exactly the opposite of what you think it says. By your own admission, you're describing the actions of _dead people_. What does any of that have to do with the people running the company today?

<comment><USER16> I think at some point you might absolve the present-day organizations of the sins of their predecessors - organizations, corporations, families, countries are made of people, and the moral responsibility ultimately lies with the individuals who choose to act, to not act, or to allow others to do so.

But it's also the case that an organizations future is based in its past; even if the individual people who chose to act have long since died and there are none alive who know their face or name, if a group of people (an organization, a country, a corporation) has enriched itself through immoral acts in the past, even if it acts morally today, is it right to leave them with the fruits of its crimes? If a people has been impoverished by crimes committed against them in the past, even if no one today is still wronging them, is it right to leave them impoverished today?

</comment></comment></comment></comment></comment></comment><comment><USER17> > Agriculture is too important to allow ideological differences to bring > progress to a standstill," Bayer Chief Executive Werner Baumann said in the > statement.

On the one hand, they want "dialogue with the society", and at the same time they clearly show what their priorities are, and that they're not likely to listen. What they call "ideology" is - depending on the context - deep care for our Earth, for the future of what we eat, how the seeds are controlled and distributed and similar issues. Baumann contrasts progress with ideology, which is a neat PR trick, but distorts complex reality.

<comment><USER18> If there's one pattern I've noticed, it's that absolutely nobody who ever calls for "dialogue" actually wants dialogue. Invariably, they imagine telling a bunch of people what to think and an army of heads bobbing.

Monsanto is not an outlier here.

</comment></comment><comment><USER19> Reminds me of the time when Andersen Consulting changed it's name to Accenture:

[https://newsroom.accenture.com/subjects/accenture- corporate/...](https://newsroom.accenture.com/subjects/accenture- corporate/andersen-consulting-announces-new-name-accenture- effective-010101.htm)

<comment><USER20> Or when Blackwater, a private military company, rebranded to "Xe Services" after murdering a dozen-plus Iraqi civillians.

<comment><USER21> ... after being held (somewhat) accountable for murdering a bunch of Iraqi civilians. It's not like they came forward and confessed to wrong doing immediately after. Who knows what they were involved in before that incident.

<comment><USER20> It took me a minute to understand your implication here. Yes, it took them a while to make that PR move of a name change. I'm sure it was all carefully orchestrated, and was not in itself an admission of guilt or an apology. In fact there was a prior rebranding which kept the Blackwater name but changed the logo to look _more_ like the scope of a gun, which is not exactly the move a company would make to distance themselves from the negative light of being mercenary thugs.

</comment></comment></comment></comment><comment><USER22> It's easy to see why: anecdotally, most people I know see Monsanto in a negative light. Bayer would love to be rid of that stigma.

<comment><USER23> It's not as bad as the stigma of IG Farben, but yeah, the brand definitely has some negative connotations.

<comment><USER24> I am German and "IG Farben" means nothing to me. Monsanto on the other hand is popular to hate and omnipresent on and off the web.

<comment><USER25> That's really interesting... I guess they've managed to repair their brand domestically? But for me, I'm Australian, and the first thing I think of is (of course) "gas chambers" when I see the name... I would assume many in the US, UK etc. would do the same.

<comment><USER26> I'm from the UK and don't recognise the name at all. If I was to associate an existing corporation to the Nazis, the first name in my head would be Hugo Boss.

<comment><USER27> Also Volkswagen and Fanta.

And I suppose IBM warrants a mention for doing business with Nazis.

<comment><USER20> I didn't know about the history of Fanta until just now looking it up on wikipedia. Very weird that such a drink would still be marketed (even with a "75th Anniversary Edition" special formulation). There really is no shame in profiting from just about anything.

<comment><USER28> Why wouldn't or shouldn't they market it? Coca-Cola Germany improvised a new soft drink during the war and called it Fanta, and later it was adopted by the parent company. It's not like they helped build the gas chambers or anything.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER29> I didn't know before today that Monsanto was owned by Bayer. But now that I know, I am not surprised.

<comment><USER30> Recently acquired I believe.

<comment><USER31> First sentence... "Germany's Bayer (BAYGn.DE) will wrap up the $63 billion takeover of Monsanto (MON.N) on Thursday"

<comment><USER29> Oops, I should have read the article first...

</comment></comment></comment></comment><comment><USER32> I'm surprised the Monsanto name has lasted this long. It seems to nearly universally be synonymous with "evil corporation".

</comment><comment><USER33> Bayer itself is associated with so much bad. From Neonics to thalidomide, to the HIV infections (new to me).

[https://en.wikipedia.org/wiki/Neonicotinoid](https://en.wikipedia.org/wiki/Neonicotinoid)

[https://en.wikipedia.org/wiki/Colony_collapse_disorder](https://en.wikipedia.org/wiki/Colony_collapse_disorder)

[https://www.theguardian.com/society/2014/nov/14/-sp- thalidom...](https://www.theguardian.com/society/2014/nov/14/-sp-thalidomide- pill-how-evaded-justice)

</comment><comment><USER15> Monsanto has always been unfairly hurt by their name. You can't have an argument about GMOs on the internet without somebody mentioning Agent Orange or some other completely irrelevant nonsense.

</comment><comment><USER34> Huh... Bayer I didn't know Bayer own Monsanto. Bayer the one that gave HIV infected medicine to Japan and other markets after US blocked it.

[https://www.ncbi.nlm.nih.gov/pubmed/24785997](https://www.ncbi.nlm.nih.gov/pubmed/24785997)

Geez... it make sense now.

</comment><comment><USER35> This reminds me of Macrovision, famous for its numerous data copy protection schemes, especially for VHS, being renamed to Rovi Corporation, then absorbed into TiVo.

</comment><comment><USER36> They should bring back the IG Farben name.

</comment><comment><USER37> Yeah, but will they retire Monsanto's _tactics_? That's what really matters.

<comment><USER38> no, they're already using Bayer tactics, which are no better.

</comment></comment><comment><USER39> I was looking into Monsanto's history with PCBs recently (now Bayer's history), and was half-joking that they'd pull the old "Phillip-Morris into Altria" trick. :-\

> _Bayer was expected to rid itself of the target's name. Monsanto, the > largest - though not the only - maker of genetically modified seeds, has > been a lightning rod for environmentalists' opposition to the technology._

> _The U.S. seed maker has also drawn criticism for pursuing its intellectual > property rights with farmers, many of which depend on its seeds, more > aggressively than its peers._

These are the only criticisms of Monsanto mentioned in the article. But there are a _lot_ more.[1]

I guess they want us to forget that Monsanto knowingly[2][4] sold & dumped toxic PBCs for literally decades? Especially since many of those municipal lawsuits are just coming around[3], the documents proving they covered it up leaked last year[4]?

Or that they manufactured Agent Orange, poisoning thousands of American soldiers and millions of Vietnamese? And that the Vietnamese got nothing because it wasn't "intended" to kill people[5], despite Monsanto knowing about the toxic effects of dioxins in Agent Orange?

[1] [https://en.wikipedia.org/wiki/Monsanto_legal_cases](https://en.wikipedia.org/wiki/Monsanto_legal_cases)

[2] [https://www.commondreams.org/headlines02/0101-02.htm](https://www.commondreams.org/headlines02/0101-02.htm)

> _In 1966, Monsanto managers discovered that fish submerged in that creek > turned belly-up within 10 seconds, spurting blood and shedding skin as if > dunked into boiling water. They told no one. In 1969, they found fish in > another creek with 7,500 times the legal PCB levels. They decided "there is > little object in going to expensive extremes in limiting discharges." In > 1975, a company study found that PCBs caused tumors in rats. They ordered > its conclusion changed from "slightly tumorigenic" to "does not appear to be > carcinogenic."_

[3] [https://www.forbes.com/sites/legalnewsline/2017/01/11/west-c...](https://www.forbes.com/sites/legalnewsline/2017/01/11/west- coast-super-tort-against-monsanto-could-spread-to-other-states/)

[4] [https://www.ecowatch.com/monsanto- pcbs-2470957270.html](https://www.ecowatch.com/monsanto-pcbs-2470957270.html)

[5] [https://www.nytimes.com/2005/03/11/nyregion/civil-lawsuit- on...](https://www.nytimes.com/2005/03/11/nyregion/civil-lawsuit-on-defoliant- in-vietnam-is-dismissed.html)

Previous settlements: [https://www.nytimes.com/2003/08/21/business/700-million- sett...](https://www.nytimes.com/2003/08/21/business/700-million-settlement- in-alabama-pcb-lawsuit.html), [http://www.stltoday.com/news/local/metro/st- louis-jury-order...](http://www.stltoday.com/news/local/metro/st-louis-jury- orders-monsanto-to-pay-million-in- latest/article_08e25795-0d36-5155-999c-c6bd954a6c2e.html)

<comment><USER40> Monsanto has been bought/split up a few times since then. It really isn't even close to the same company any more.

The name has been tainted so bad I'm really surprised they aren't going to spin off something with the name, just so they can be fully rid of the name.

<comment><USER39> I see someone's already been fooled. That's why this trick persists of course. Ala-kazam, no more accountability!

> _Monsanto has been bought /split up a few times since then. It really isn't > even close to the same company any more._

And they'll reorganize in the future too, so should the public stop caring about corporate crimes altogether? After all, companies will just re-arrange themselves back into Dr. Jekyll and all will be well... /eyeroll

Welcome to the biggest loophole in liability-based or reputation-based enforcement of so-called "corporate ethics."

"Don't fret Virginia! The cancer's incurable, but the company that caused it has a foolproof plan to fix things..."

</comment></comment></comment><comment><USER41> I hope this is not just an attempt to side step the bad name.

</comment><comment><USER42> Monsanto hate is one of the objectively stupid memes of the web, so good for them.

<comment><USER43> Why is hating Monsanto stupid? Or are you just saying people bandwagon on hating them? I've seen a few too many documentaries on the terrible things they do in the farm industry that put consumers' and farmers' wellbeing at risk. Monsanto milk isn't even allowed in Canada because of the hormones they (are/were?) putting in cows. They've basically cornered the soybean market through litigation. Let the hate live on, IMO.

<comment><USER42> One example: The main thing they're hated for is patenting GMO seed varieties in support of their roundup pesticide product line.

Roundup works by making seed varieties that work just like normal plants but are immune to the roundup pesticides. So a farmer can place pesticide on a field, and it will only kill weeds, not their crops.

The "hate evil Monsanto for destroying nature" bandwagon ignores that:

1) 99% of anti-gmo stuff is anti-science fear mongering. There are very few good general anti-GMO arguments.

2) Farmers _love_ roundup because it increases crop productivity per acre sustainably.

3) Using roundup greatly decreases the amount of pesticide needed per acre of crops, since it can be targeted so much more precisely. So it makes the world's water supplies and crops cleaner overall.

4) Because round-up seeds are so great, farmers sometimes try to grow it without paying licensing fees (because why would you if you can get away with it?).

5) Monsanto is very legally aggressive defending its seed patents, since why would anyone pay to license their seeds if you can just steal it? Monsanto spent a lot of money developing the science for roundup seeds.

6) Monsanto has never sued someone for accidentally having round-up seeds (cross contamination). They have an amazing win rates on their lawsuits specifically because they only target cut and dry cases.

7) But the bandwagon is against the evil Monsanto, so people are overly credulous on the farmer side.

The vast majority of things Monsanto is criticized for play out just like the above.

As a separate example, check out this Quora answer for, "Is Monsanto evil?": [https://www.quora.com/Is-Monsanto-evil](https://www.quora.com/Is-Monsanto- evil). And let me know which side seems more reasonable to you.

Documentaries are an awful way to disseminate accurate knowledge. It's 90% emotion driven, and almost always has a narrative to tell that they're not going to want pesky facts to get in the way of.

<comment><USER44> > 5) Monsanto is very legally aggressive defending its seed patents, since why > would anyone pay to license their seeds if you can just steal it? Monsanto > spent a lot of money developing the science for roundup seeds.

Or, alternatively: Farmer Joe plants heirloom seeds that are quite rightfully his. Farmer Bob plants patented GMO seeds, which then cross-pollinate with Farmer Joe's heirloom crop. Next year, Monsanto sues Farmer Joe into oblivion (or otherwise forces him into pay-pay-paying them forevermore) for "stealing their technology."

<comment><USER42> "6) Monsanto has never sued someone for accidentally having round-up seeds (cross contamination). They have an amazing win rates on their lawsuits specifically because they only target cut and dry cases."</comment></comment></comment></comment></comment>


Google will take another shot at low end android - <AUTHOR> http://www.theverge.com/2015/8/9/9123151/google-will-take-another-shot-at-low-cost-android-one-initiative

<comment><AUTHOR> I think Google trying this hard is interesting thing. If they can manage to deliver a decent $50 smartphone, it will put a dent in the Indian market for sure. I come from very rural part of India where I can see potential for it. People will be more willing to invest $50 in their first smartphone rather than $100 which is current price range for decent smartphones.</comment>


Reflections on ESLint's success - <AUTHOR> https://www.nczonline.net/blog/2016/02/reflections-on-eslints-success/ <comment><USER2> I just switched from JSHint to ESLint to try it out. So far I haven't noticed too much difference (I use it with SublimeLinter)

Wasn't aware of the custom rule thing... Does anyone have any examples of good custom rulesets?

<comment><USER3> The Airbnb styleguide and matching ESLint preset is quite popular and very complete: [https://github.com/airbnb/javascript/tree/master/packages/es...](https://github.com/airbnb/javascript/tree/master/packages/eslint- config-airbnb)

<comment><USER4> To add to this, Mozilla have their own ESLint preset: [https://dxr.mozilla.org/mozilla- central/source/devtools/.esl...](https://dxr.mozilla.org/mozilla- central/source/devtools/.eslintrc)</comment></comment></comment>


The Daring Mission That Thwarted a Nazi Atomic Bomb - <AUTHOR> https://www.nationalgeographic.com/news/2016/06/winter-fortress-neal-bascomb-heroes-of-telemark-nazi-atomic-bomb-heavy-water/ <comment><USER2> An important fact that is buried in the article: Nazi Germany never had plans to build a bomb; they only had an exploratory program which concluded that they should not. To say that a clandestine mission thwarted their program is ludicrous. The Nazis themselves decided that a nuclear weapon program would take far too many resources and abandoned it.

That's not to take away from the accomplishment of the Norwegians, just from the implication of the sensationalized title of the article and book.

Source: [http://blog.nuclearsecrecy.com/2015/11/13/when-did-the- allie...](http://blog.nuclearsecrecy.com/2015/11/13/when-did-the-allies-know- there-wasnt-a-german-bomb/)</comment>


First fully sandboxed Linux desktop app - <AUTHOR> http://blogs.gnome.org/alexl/2015/02/17/first-fully-sandboxed-linux-desktop-app/ <comment><USER2> It's really nice to see that happening, but every time I raised the subject with the Gnome team to see how we could run VLC in it, it's a no-go.

Indeed, for a complete media player, I need:

\- access to files not directly opened by the user (playlists, MKV, DCP, MXF),

\- access (and unique probably) to raw devices read-only (DVD, AudioCD, Blu- Rays, webcams-v4l2, SDI, DVB),

\- direct access to raw audio output,

\- access to X11 for YUV output, or at least a direct OpenGL context,

\- access to network.

For access to files and network, there seemed to be a solution with a manifest to get $home access; for audio, a solution might come with kdbus and pulseaudio; but for the others, they refuse blankly, saying that my "use case is irrelevant and dangerous".

I hope this will evolve (maybe it already has), but so far, it's a bit hard to make a complete media player, tbh.

<comment><USER3> It all depends on what your goal is. Allowing to run VLC as a bundle with more or less full access is certainly possible. However, that is not really "sandboxed" in any fashion.

For instance, once any client has any kind of X11 access they can snope any kind of keyboard events, including your password at the unlock screen.

If we want to support the full functionallity for a media player in a sandboxed way we need to start looking into each requirement and designing a safe way to access each item. This is gonna be a lot of work, but I don't see any way around that.

For your exact list:

Files access can either be granted to the app fully or partially. But we also want some kind of file selector service that runs in the session (outside the sandbox) that grants some kind of access to files the user chose.

Raw device access will not happen by just having the app open the raw device nodes. Instead we'll have some kind of service in the session that (via user interaction or "remembered" grants from the user) virtualizes access to these things. This could be all from e.g. passing a file descriptor of the opened dvd device to a complete replacement of the subsystem. For an example of the later, for webcams see the pulse-video project: [https://github.com/wmanley/pulsevideo](https://github.com/wmanley/pulsevideo)

Is raw audio output necessary? Why does not pulseaudio work?

OpenGL access is supported

Network access is (optionally, but i think this will be on for most apps) allowed

<comment><USER2> > It all depends on what your goal is.

Well, we've seen sandboxes on other desktop platforms (OSX, WinRT, ChromeOS), and so far, they all are horribly limiting. So, I'm making sure the same does not happen on Linux, before we get kicked out of our own platform.

> kind of file selector service that runs in the session (outside the sandbox) > that grants some kind of access to files the user chose.

This is not enough, as explained above.

> Raw device access will not happen by just having the app open the raw device > nodes. Instead we'll have some kind of service in the session that (via user > interaction or "remembered" grants from the user) virtualizes access to > these things.

Well, this is a deal breaker so far. Are you going to do a pulsedvd, a pulsecd, a pulsedvb, a pulsesdi for all the access modules? Playing encrypted DVD requires direct access, as far as I know.

> For an example of the later, for webcams see the pulse-video project: > [https://github.com/wmanley/pulsevideo](https://github.com/wmanley/pulsevideo)

Something using GStreamer in Vala to get indirect access to webcams? I don't see how this could even work: how do you control brightness or other webcam controls from two applications, how do you get direct H26x access with preview synchronized? (And asking someone to use a competitive project to get video input is also a bit rude, but that's beside the subject)

> Why does not pulseaudio work?

libpulse requires X, as far as I know.

> OpenGL access is supported

Through Wayland? How do I get YUV surfaces? What about overlay? What about VDPAU/VAAPI? I guess this will get a lot of improvement, because wayland, wl_scaler (et al) are very limited, so far.

We'll see how it fares, but from the past interactions, the answers were pretty dismissive; and therefore, I'm not that optimistic about the outcome.

<comment><USER3> >> kind of file selector service that runs in the session (outside the sandbox) that grants some kind of access to files the user chose. >This is not enough, as explained above.

Well, its hard to say that as this kind of stuff is not designed yet. Better to say that the requirements of VLC on the design of this are more complex than just the "allow access to single-picked-file" semantics. Hopefully we can take this into account when we look into the details here.

> Well, this is a deal breaker so far. Are you going to do a pulsedvd, a > pulsecd, a pulsedvb, a pulsesdi for all the access modules? Playing > encrypted DVD requires direct access, as far as I know.

Some of these need not necessarily be as complex as you imagine though. They could very well be some kind of thin service that enumerates the real devices and hands over the opened FD to your app after having verified that it is allowed.

> libpulse requires X, as far as I know.

Libpulse can optionally be built with X, but this is really only used to read back the pulse socket name from the x root property. It works just fine without X (witness the non-X, but pulseaudio using demo in the blog post for instance).

OpenGL access is via DRI, but yeah, output to the screen will have to happen via wayland. That could use subsurfaces with YUV surfaces, and it is then up to the compositor to use overlays if possible (i know weston does this for instance).

For VDPAU etc, i don't really know.

<comment><USER4> Maybe I'm missing it but I don't see how DRI is really sandboxing OpenGL.

Note: I helped write the OpenGL sandbox in Chrome and it's certainly possible I don't know the details of DRI enough to understand how it sandboxes but I do know what we had to do to sandbox OpenGL in Chrome, that includes re-writing shaders since we can't trust the driver, clearing buffers since OpenGL doesn't and so you can read other processes' data, and many other things and as far as I can tell DRI isn't doing things like that.

<comment><USER3> At the moment we grant all of /dev/dri, but long term we want only the render nodes accessible. That gives us no modesetting or DRM master capabilities, only rendering.

It is true though that the drivers could very well have leaks in them, but the userspace sandbox is not the place to fix that, it is the drivers themselves. The intent is for the dri driver APIs to give guarantees about client separation, but I'm sure it needs work.

<comment><USER4> The drivers will never be fixed. Chrome doesn't trust them. It's not in their interest to fix them since sales are determined by performance not by security.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> The future is here! Maybe the lack of a heavily regulated, but ultimately non- curated aggregation of low quality application that safely do nothing has been holding back Linux on the desktop all these years.

P.S.: systemd now allows logging in via your Facebook account on every machine, per default since Ubuntu Timid Tamandu!

<comment><USER6> In the light of the NSA hacking revelations, we should recognize that the systems we're using are fundamentally insecure. With Linux, we should be able to improve security while maintaining user control. I think this is a step in the right direction.

<comment><USER7> To be fair, this has exactly zero effect on the NSA hacking your machine, especially if the hard disk firmware is compromised.

<comment><USER8> Only if the firmware is compromised before you install the OS. It adds a significant hurdle to any malware gaining write access to your hard drive's firmware.

</comment></comment></comment></comment><comment><USER9> This is not really true

[https://www.usenix.org/legacy/events/atc10/tech/full_papers/...](https://www.usenix.org/legacy/events/atc10/tech/full_papers/Potter.pdf)

which was turned into

[https://www.google.com/patents/US8589947](https://www.google.com/patents/US8589947)

<comment><USER10> chroot existed before 11 mag 2010

<comment><USER9> apparently you think usenix atc is unaware of chroot as well :)

</comment></comment></comment><comment><USER11> Do these sandboxes requiring bundling all the necessary dependencies a la Windows applications? I sure hope not.

<comment><USER12> I am not sure why Linux people tend to think this is bad. It is how you ship robust software that doesn't break. Linux "solves" this issue by having all kinds of things break all the time and just accepting that breakage and saying "no really things usually work fine".

<comment><USER13> The main argument against this kind of bundling (apart from higher disk usage) is about security updates of libraries. E.g. if many applications ship their own copy of OpenSSL and another vulnerability is discovered, you have to update every application individually. And it is unlikely that all developers/vendors will provide such updates fast enough.

But if all applications use the same OpenSSL that is managed by dpkg+apt (or something similar), a single update will fix all applications.

Personally, I don't think that this problem can be solved without losing the advantages of bundling (robustness, reproducability, binary portability to other distributions).

<comment><USER14> Right, but there's a difference between things that the OS is expected to provide (OpenSSL, GTK, etc) which the app should not bundle, and things like libpng which the app basically should bundle.

e.g. Windows supplies KERNEL/USER/GDI as builtins, but doesn't supply libpng.

Pretty much the whole point of an OS is to provide a guaranteed stable base. Anything that isn't guaranteed or stable should be bundled with the app.

<comment><USER15> If libpng has a new vulnerability discovered, how do you make sure it is fixed in all the apps that bundle it?

[http://www.cvedetails.com/vulnerability- list/vendor_id-7294/...](http://www.cvedetails.com/vulnerability- list/vendor_id-7294/Libpng.html)

</comment></comment></comment></comment></comment><comment><USER16> While I'll admit that my personal project, subuser.org isn't yet at the stage of 100% sandboxed, this title is excedingly misleading. There are lots of projects that have done this allready: [http://www.jann.cc/2014/09/06/sandboxing_proprietary_applica...](http://www.jann.cc/2014/09/06/sandboxing_proprietary_applications_with_docker.html), [https://github.com/Kagami/kagome](https://github.com/Kagami/kagome)

<comment><USER3> The title is a bit hyperbolic, true. There have been various ways to try to contain desktop apps over the years. But I wouldn't call them "apps" really, they may get the sandboxing aspects down, but they don't have the simple-to- install, well-integrated behaviour that you'd want for something like an "app" system. Most of them basically run the app in its own VNC or Xserver instance, with zero interaction with the rest of the session.

</comment></comment><comment><USER17> Sounds like a browser to me. FTFY:

* Is independent of the host distribution

* Has no access to any system or user files other than the ones from the runtime and application itself

* Has no access to any hardware devices (GL rendering supported)

* Has restricted network access

* Can't see any other processes in the system

* Can only get input via standard APIs

* Can only show graphics via DOM/Canvas/WebGL/SVG/MathML

* Can only output audio via Audio Tags/Web Audio/MSE

* plus more sandboxing details

</comment><comment><USER18> This is actually quite similar to using LXC containers to run GUI apps. Something like Wine would be a good candidate to run in a container, perhaps others too. And you can use both privileged and unprivileged containers for this.

I have a guide on running accelerated GUI apps in both privileged and unprivileged containers: [http://www.flockport.com/run-gui-apps-in-lxc- containers](http://www.flockport.com/run-gui-apps-in-lxc-containers) and here's one more by Stephane Graber, lead developer of LXC using only unprivileged containers: [https://www.stgraber.org/2014/02/09/lxc-1-0-gui-in- container...](https://www.stgraber.org/2014/02/09/lxc-1-0-gui-in-containers/)

</comment><comment><USER19> I've been working on getting web-based X11 working for a while now...

[http://youtu.be/vca13X1TpIw](http://youtu.be/vca13X1TpIw)

It works very well but I can't release it yet because there's an underlying problem and the author of this article pointed it out very clearly:

> because X11 is impossible to secure

So imagine the scenario: You want to have a single server that hosts desktop environments for multiple users over the web. X11 is multi-user! No problem, right? Wrong.

Your little web server daemon is going to run as some user. Let's say that user is root to keep things simple. So now your root user needs to spin up an X11 server for each user (so their sessions are separate). But that won't work so well because the X11 servers will all be running as the same user (root). This means that each user can mess with each other's applications, log their keystrokes, etc.

So what do you do? Well, you can just create random, one-time user accounts in /etc/passwd and spin up X11 using those accounts but now your little daemon _has_ to run as root. Also, you now have to keep track of and maintain not just all those temporary users but all the files owned by those users. You also need to keep track of which user had what account and when (for auditing purposes). You also have to worry about UID conflicts (especially with external systems) and some other less common scenarios (e.g. LDAP integration with sudo).

Another option would be to give each user their own container and run X11 inside of that. Except now the application can't get access to OpenGL acceleration and shared memory access (so your little deamon can capture the screen) becomes complicated. Then there's the fact that if you want to give the users access to more applications those applications will need to be installed inside each user's container. You can do some tricks with mounts in order to work around that problem somewhat but it's complicated. REALLY complicated!

For now I've decided to just assume the daemon will be running as a single user (doesn't matter which one) while I work on some other things (e.g. improving audio support) but very soon I'm going to have to come back to the multi-user security problem. It's not easy to solve.

The way X11 was engineered just assumes that each user has their own processes and if you _do_ have multiple users all their applications will be running under different accounts.

<comment><USER9> I use this all the time these days [https://github.com/kanaka/noVNC](https://github.com/kanaka/noVNC)

related to what you are trying to do?

<comment><USER19> noVNC is similar to what I'm working on, yes. Except it implements the VNC protocol in JavaScript which isn't the greatest when it comes to bandwidth efficiency. It's also not very flexible; it only works when sharing an entire desktop (not individual applications or windows).

As an example of the efficiency difference, when viewing an entire desktop with a single terminal application running 'top' Gate One used up 1/10th the amount of bandwidth as noVNC when I last performed benchmarking (I had them both displaying the same exact desktop; both Gate One and novnc running simultaneously).

Also, noVNC CPU utilization goes through the roof if you try to do something like play back a video. When playing back a video inside Gate One the gateone.py process only eats up about 8% of a single core of my laptop's i7 (4th gen). That's with loads of debugging enabled (I tested it just now with SMPlayer playing Big Buck Bunny somewhere at ~1024x768 resolution).

My benchmark goal is to be able to play Minecraft @30fps (~1024x768) remotely using an AWS/Rackspace/OpenStack server. I've already achieved that except the audio delay sucks (~2 seconds) so that's what I'm currently working on (had to write my own Opus/WebM audio encoder).

<comment><USER9> yes, vnc is not made for video (or audio, but that's obvious). a decade ago the lab I was part of was working on that issue.

[http://systems.cs.columbia.edu/projects/thinc/](http://systems.cs.columbia.edu/projects/thinc/)

maybe something here is of interest to you (code is probably way outdated though)

</comment></comment></comment></comment><comment><USER20> I have mixed feelings on the idea of sandboxed apps.

On the one hand, I want to be able to run untrusted applications safely. And in a larger sense, I think that it might be a hopeless endeavor to try to get users to only run trustworthy applications on their machines.

On the other hand, I want to have full access to my system, and sometimes that means having full access to it through applications (jbk's VLC use case is a good example of that). And sandboxes are far from perfect (this may improve, but right now existing sandboxes still have lots of holes). Sandboxes may be just security theater at this point (although as I said, this might change).

</comment><comment><USER21> >> we have to use Wayland instead of X11, because X11 is impossible to secure.

Yet X11 was designed in the prime example world of a mult-user OS, UNIX. Hmm.

>> We also need to use kdbus to allow desktop integration that is properly filtered at the kernel level.

Didn't I read an article on HN recently talking about a vulnerability in Windows and the subject of too close a relationship between the kernel and the end user graphics came up?

<comment><USER13> This isn't about isolating users from each other, but isolating different applications running as the same user from each other. X11 (and Unix itself) was not designed to do this.

Also, kdbus has nothing to do with graphics.

</comment></comment><comment><USER22> How hard would it be to make something like:

This program wants to access your camera, mike, //home/personal, connect to irc://botnet.com, and install these dependencies: spyware1, 2, 3 Are you sure you want to install/run [insert innocent program]?

I think that would be an better option then sand-boxing everything.

Is it even possible for the OS to know if a program is using the webcam?

</comment><comment><USER23> So a seriously limiting concept from mobile/web world is making it into Linux as well? Soon we won't be able to do anything with our computers, but we will be "perfectly safe". Everything I dislike about iOS is now becoming mainstream. Disclaimer - I wrote a book about cryptology including TPM, secure boot loaders, PKI, etc. another one about 3D graphics and am very aware of the issues and trade offs. But sandboxing is a charming but ultimately silly solution that ultimately removes any capability from the hands of users and slows everything down - it already negatively affects graphics performance of browsers (tainted canvas anyone? how long would WebGL shader hack to bypass this work until we are forced to accept 100 pixels/second performance with sandboxing?). There are even rumors that Skylake is going to be slower and more power hungry than Broadwell due to SGX (we will see soon I guess). Is it really worth it?

</comment><comment><USER24> The cargo-culting continues.

</comment><comment><USER25> Slightly off topic but what happened to the 'Android as Linux desktop' initiatives?

</comment><comment><USER26> want this on embedded devices...bundling apps on embedded linux is real pain.

<comment> iso8859-1 I don't think this will help you. It sounds more like you need something like buildroot or 0install.

<comment><USER26> well. i want to do some testing on a legacy app. The app runs fine on old veriosn of firefox and old OS but i want to try it on a recent distribution and remove firefox dependancy as a next step. Isn't it fits with sandboxing way of app development.?

</comment></comment></comment><comment><USER27> Y U No Docker ?

</comment><comment><USER10> better later than never

</comment><comment><USER28> I think this blog post highlights my beef with going ultra secure and not trusting the user.

security will stifle application innovation. Making cool things hard, and awesome things impossible.

<comment><USER13> It's not about "not trusting the user", but about the user not having to trust the author of the application.

<comment><USER29> The result is still the same though.

<comment><USER13> No. Why would it? The user can still grant full access to the machine to applications they trust (like they do now). In fact, the traditional Unix security model (root vs. regular users) was about "not trusting the user" and securing the machine from the user. This "new" kind of sandbox is about the user being able to apply different levels of trust to different applications.

<comment><USER28> I can see this being useful for running proprietary and non free software. However, we should strive for all software to be free software instead. Because if I download free software, I have the community of developers to vouch for it. If I download proprietary software, I can't really trust it.

<comment><USER30> My answer to that is "heartbleed". It is irrelevant if you trust the developers - sometimes those developers will make mistakes. Sometimes those mistakes will be serious.

The less privileges your applications run with, the less likely it will be that exploits will affect you.</comment></comment></comment></comment></comment></comment>


Could Harvesting Fog Help Solve the World's Water Crisis? - <AUTHOR> http://www.newyorker.com/tech/elements/could-harvesting-fog-help-solve-the-worlds-water-crisis <comment><USER2> This solution would have negative disruptive impacts.

Harvesting fog would effect dependent microclimates & ecosystems, by taking water out of the air.

This also has an affect of causing a greater concentration of the water to be held by big institutions (corporations & government). This creates a social power imbalance, concentrates the economy to global institutions, & reduces autonomy of the people who live on the land.

Plundering & profiteering off the commons & reducing autonomy in the guise of humanitarian efforts.

\---

re: better solutions, after all harvesting fog is a "solution".

Regenerate the ecosystems. Encourage small scale regenerative agriculture, that utilizes native plants in polycultures to restore ecosystems and stimulate local health, novelty, & economy.

Restoring local ecosystems has a positive effect on the local watershed.

Reintroducing wolves to Yellowstone caused the river to flow again & had positive fundamental impacts on the local ecosystem.

[https://www.youtube.com/watch?v=ysa5OBhXz-Q](https://www.youtube.com/watch?v=ysa5OBhXz-Q)

<comment><USER3> > Harvesting fog would effect dependent microclimates & ecosystems,

 _Any possible method_ we use to collect water from our surroundings will affect dependent microclimates and ecosystems. The same could be said about building reservoirs, or even collecting rainwater. The question is "to what extent"? Unless you can present some evidence that fog harvesting is truly disruptive, I'm going to assume it's not much different from collecting rain, ie. has minimal impact. I haven't found any papers suggesting differently. Surely these things aren't very efficient, and therefore any one of them is pulling a tiny fraction of water out of the air. I mean, just think about the height of a fog cloud, and realize they are only scraping a bit of water out of the bottom 10 feet of that air column! Certainly it must be better than draining the Colorado river before it reaches the ocean, as we do currently.

> This also has an affect of causing a greater concentration of the water to > be held by big institutions

Plastic nets that can be erected by anyone, anywhere are somehow worse in this regard than _a centralized municipal water supply_?! Or a dam that takes millions of dollars to build? Quite the opposite. These things are practically the definition of a decentralized technology.

And, cool video, but your proposed "better solution" seems nonspecific and naive. The problems are different in every ecosystem, and therefore, so are the solutions. These nets are only practical in certain environments which receive regular fog, and wouldn't make sense in Yellowstone. Likewise, all the wolves in the world won't make it rain more in the Atacama. The problem is precipitation, not erosion.

<comment><USER2> Thank you for your response. I would like to take back the inferences I drew re: centralizing supply. I'm a bit sensitive over some governments making rainwater collection illegal & ecosystem-friendly landscape design; due to some of my affected law-abiding friends having issues with it.

> The same could be said about building reservoirs, or even collecting > rainwater.

That's true. Responsible water stewardship requires systemic discipline that is case-specific.

One of the principles of regenerative agriculture & similar philosophies (i.e. permaculture) is to create edge effects to create the context for a more robust ecosystem. Pooled water, especially when designed to maximize edge effects (i.e. increasing the circumference of the shore), is a tech that contributes to creating robust ecosystems.

Harvesting fog seems to fit in many circumstances.

> These things are practically the definition of a decentralized technology.

Well said & I agree. Harvesting fog seems like a legit tech option in concept.

> And, cool video, but your proposed "better solution" seems nonspecific and > naive.

I was illustrating an example of how a small change has ripples. If history is any guide, tech (technology & technique) has unexpected benefits & drawbacks. Every ecosystem is different. As you said...

> The problems are different in every ecosystem, and therefore, so are the > solutions.

</comment></comment></comment><comment><USER4> For those that are interested in data science, there is this related challenge: The Tableau Foundation Challenge: From Fog Nets to Neural Nets [https://www.drivendata.org/competitions/9/](https://www.drivendata.org/competitions/9/)

</comment><comment><USER5> ...World's Water Crisis

Is there a crisis? There seems to be about as much rain as in the past. Maybe the psychological need for pools and golf courses has increased.

<comment><USER6> And a lot more people than before

</comment></comment><comment><USER7> They already have "fog catchers" in Atacama desert, see for example [http://www.bbc.com/mundo/noticias/2015/05/150521_atrapaniebl...](http://www.bbc.com/mundo/noticias/2015/05/150521_atrapanieblas_chile_desierto_lp)</comment>


Ask HN: Need help to figure out if we have product-market fit or not? - <AUTHOR> I am Anthony, solo french founder of LiNote. We build a digital assistant for family caregivers.
I am really confused if we do have or not reached product market fit.
Things that makes me thing we do have it: - 360 People love our product and pay monthly. - Our monthly churn is around 3% - Oldest customers have the product for more than 30 months. - Customers talk about it with their GP, nurses, etc. - We grew 3X year over year with 3 people only.
Things that makes me thing we do not have it: - We are growing at 5-10% monthly only - Knowing how much people talk about it, we only sell 25 units a month for a B2C product.
PMF definition is quite fuzzy. Not knowing we have it might slow us down a lot. Thinking we have it might kill us.
So guys, I would love to hear your opinion about it: Is it PMF ? <comment><USER2> Michael Siebel[0] said in YC Startup School that you have product market fit if (and only if) you can't keep up with the demand for your product and you don't have time for anything else except closing sales. If it's not there yet, it's not product market fit.

[0] [http://www.michaelseibel.com/blog/the-real-product-market- fi...](http://www.michaelseibel.com/blog/the-real-product-market-fit)

</comment><comment><USER3> You can make use of the 40% rule to verify it. [https://en.m.wikipedia.org/wiki/Product/market_fit#The_40%25...](https://en.m.wikipedia.org/wiki/Product/market_fit#The_40%25_rule)

<comment><AUTHOR> Thx for the suggestion. I will check with that.

</comment></comment><comment><USER4> If you're asking, probably not, numbers seem low for B2C too</comment>


Road to React: The One with Hooks - <AUTHOR> https://www.roadtoreact.com/ <comment><AUTHOR> Hi everyone!

Yesterday I released the new "The Road to React"-book. It's a complete rewrite of the previous book from 2017 which has been downloaded by more than 50.000 people over the last 3 years. It's also thanks to you, the HN community, that it got popular in 2017 [https://news.ycombinator.com/item?id=13170837](https://news.ycombinator.com/item?id=13170837)

In the complete rewrite, readers will learn how to create a modern React application with Hooks with features like sorting, data fetching, client- and server-side search, and pagination. In addition, there are chapters about TypeScript integration, styling, performance optimizations, and testing. If you are just about to learn React or want to get up to speed with the latest concepts, this book is for you!

The book comes with three packages: 1) Book as PDF, MOBI, and EPUB 2) Online Reading Mode 3) 80 Extra Modules about React related topics such as state management, React with Webpack, and React Hooks.

Really looking forward to hearing your feedback!</comment>


Researchers identify sleep as a reason why personality traits predict longevity - <AUTHOR> https://digest.bps.org.uk/2019/05/01/researchers-identity-sleep-as-a-key-reason-why-personality-traits-predict-longevity <comment><USER2> I understand this is correlation not causation, but we have tons and tons of evidence for the negative effects of sleep deprivation.

Color me highly skeptical that there are negative effects associated with sleeping 8.5+ hours, up to say, 11 hours. Beyond 11 hours of sleep, I can see an argument being made for physical morbidity from lack of movement etc. But 8-9 hours of sleep nightly - my guess would be that people who get only 7 hours of sleep tend to be more successful, have jobs and families, and access to health care. Whereas those sleeping 10 hours a night are less likely to have the income to get health care when necessary.

In other words, I'd be interested to see studies which test the hypothesis that sleep deprivation has a causal effect on morbidity, while excessive sleep only has a correlation.

<comment><USER3> Let me reveal some of my personal health for this discussion.

I was diagnosed with minor sleep apnea, and my doctor prescribed an anti- snoring mouthguard (a $1000 device that is basically a mouthguard with a screw in it... ugghhh). Costs aside, the device works, and I've been getting LESS sleep recently.

Why? Because 7ish hours of sleep is all I need now... because I'm not getting minor "self-wakeup events" during night. Before this mouthguard, I needed 9ish hours of sleep to feel rested.

The mouthguard definitely works (for my case anyway. I did some research and its apparently because I've got a large tongue or something, which means my snoring / sleep apnea could be cured by a mouth-guard forcing my jaw into a different position). Apparently, other cases of sleep apnea can only be solved with a CPAP, while still other cases of sleep apnea can be solved with a simple "sleeping backpack" (to prevent sleeping on your back).

\</comment></comment><comment>---

Undiagnosed Sleep Apnea is associated with longer sleep, less-restful sleep, and a variety of ailments like obesity and high-blood pressure. I don't think cause-and-effect has been figured out yet (maybe obesity causes sleep apnea, or maybe vice versa).

It is quite possible that excessive sleep is correlated with a variety of sleep-issues, like Sleep Apnea. People who fix their sleeping issues may live longer, higher quality lives.

<comment><USER4> I suspect I may have a condition similar to yours. I googled anti-snoring mouth guard and came back with $50-100 solutions, but no "bolt" inside that I could see. What differs between these and yours? Can you give more details eg a brand, a picture, or better description?

Thanks!

<comment><USER5> I have to warn you that I spent a lot of money on one of those and it simply did not work.

CPAP was my salvation.

Glad to see it works for some people, but for me I felt scammed by the doctor that after a while simply said "you should find a way to control your jaw while asleep, it's a mental thing".

<comment><USER6> The doctors at the sleep center were happy to prescribe the CPAP machine (which their "partner" business supplied), as well as prescribing sleep meds and scheduling regular checkups on me.

Interestingly enough, at the end of my sleep study the technician commented to me that I appeared to have a deviated septum and perhaps I should have that looked at. The doctor who reviewed my study didn't mention that and never suggested I see an ENT for a second opinion.

Instead, I was pitched an implanted device that would ostensibly "cure" the apnea (no thank you!).

I did see an ENT, did get surgery and now sleep soundly. I've never gone back to that sleep center where they were only interested in extracting as much money from me as possible.

</comment></comment></comment></comment><comment><USER7> > _the research showed that too little or too much sleep was associated with > increased risk of dying – approximately 65 minutes more than, or under, the > average nightly sleep duration (7 hours in this sample) was associated with > a 10 per cent increased risk of dying over the course of the study_

This seems inaccurate on the high end. Under 6 hours has repeatedly shown to be bad. But over 8 hrs and 5 min? If the average REM sleep cycle is 1.5 hrs, then your only "perfect" window is 7.5 hrs of sleep - 9 would be detrimental?

Other data suggests otherwise:

[https://www.nichd.nih.gov/health/topics/sleep/conditioninfo/...](https://www.nichd.nih.gov/health/topics/sleep/conditioninfo/how- much)

<comment><USER8> I usually feel like I need 9 hours sleep after a good workout. Am I doomed?

<comment><USER9> Take note that what sleep researchers count as hours of sleep is not the same as what we colloquially count as sleep.

Let's say you get in bed, lights off, at 11 PM and wake up at 7 AM. Most people would call that an eight hour night of sleep. But in reality it takes the average person 20-30 minutes before actually falling into sleep. The average person also wakes up four or more times a night, sometimes for ten minutes or longer. Often we don't even remember all the times we get up. A lot of people also awaken before their scheduled wakeup times, and spend 20+ minutes in pre-dawn twilight.

Add it altogether and an "eight hour night" may actually only constitute 6.5 hours of actual physiological sleep. The only way to know for sure how much sleep you get is to use a device specifically designed for the purpose.

<comment><USER10> Do you have any specific devices in mind?

<comment><USER11> I have a Xiaomi fitness band 2. As far as I can tell, the sleep metrics it reports are pretty good. I wouldn't attempt to compare its accuracy to an Apple watch, but the Xiaomi's battery charge lasts about a week and it cost $30.

<comment><USER12> I'm really impressed with Mi Band 2 sleep tracking. It correctly matches the time I go to bed, and get up. Also gets each time I wake up during the night, or when I'm reading before sleep. I'm not sure about the "deep sleep" recording, and maybe I'm being suggested, but in nights with low deep sleep I fell terrible. Just monitoring my sleep I improved it. Sorry that it does not have a smart alarm neither an alarm to go to bed.

</comment></comment></comment></comment></comment></comment><comment><USER13> I've always been interested in the direction of causation behind the claim "too little sleep is correlated with an increased rate of death". People talk about it like it's proven that lack of sleep causes death, but is it just that many health issues cause you to sleep more/less than average?

Applying that line of thought to the article, if you have a health issue that is causing you to lose sleep (e.g. due to pain or hormonal issues), is it unreasonable to think that might increase your neuroticism or decrease your extraversion?

I've no idea if anyone has ever managed to determine the direction of causation here, seems like these longitudinal studies don't have the ability to disambiguate.

<comment><USER14> If you're really interested, read the book Why We Sleep by Matthew Walker. The book references a ton of studies that show, definitively, getting less than 7 hours of sleep is hugely detrimental to your health.

The book actually talks about how psychiatric disorders cause insomnia which creates a feedback loop of getting less sleep, which amplifies the detrimental effects of the disorder, which in turn worsens the insomnia.

<comment><USER15> It does not show that at all, especially not "definitively". Matt Walker's career is based on fearmongering about sleep. The actual studies are quite mixed. Here's a recent one that showed little to no effect of short or long sleep lengths on cancer risk: [https://www.ncbi.nlm.nih.gov/pubmed/30463535](https://www.ncbi.nlm.nih.gov/pubmed/30463535).

Feel free to read the book, but don't do so without strong skepticism. In particular, the book never actually attempts to answer the question in its title, other than to present some vague, unfalsifiable theories. It presents tons of information, but no answer to the question.

<comment><USER14> There were parts of the book that I was definitely skeptical of, and after doing some research, found were not supported by any studies that I could find. So I will agree that you should remain skeptical about some claims... Really, you should be skeptical of anything you hear.

But the fact that under sleeping has serious detrimental effects on your health is supported by many studies.

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2845795/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2845795/) [https://www.ncbi.nlm.nih.gov/pubmed/8621064](https://www.ncbi.nlm.nih.gov/pubmed/8621064) [https://jamanetwork.com/journals/jamainternalmedicine/fullar...](https://jamanetwork.com/journals/jamainternalmedicine/fullarticle/486518) [https://jamanetwork.com/journals/jamainternalmedicine/fullar...](https://jamanetwork.com/journals/jamainternalmedicine/fullarticle/410883) [https://www.ncbi.nlm.nih.gov/pubmed/19109114](https://www.ncbi.nlm.nih.gov/pubmed/19109114) [https://jamanetwork.com/journals/jamainternalmedicine/fullar...](https://jamanetwork.com/journals/jamainternalmedicine/fullarticle/414701) [https://www.ncbi.nlm.nih.gov/pubmed/6878979](https://www.ncbi.nlm.nih.gov/pubmed/6878979) [https://www.ahajournals.org/doi/full/10.1161/01.HYP.00002173...](https://www.ahajournals.org/doi/full/10.1161/01.HYP.0000217362.34748.e0)

There are so many studies out there about this, I don't see how you can deny this fact.

</comment></comment></comment></comment><comment><USER16> I can't imagine that all that stress to min/max health outcomes through strict behavior changes is good for you or worth it in the long run.

I subscribe to some nutrition and fitness subreddits and I see people obsessing about minute details of what they eat, how much they sleep, obsessing to take control over every facet of their lives because of some study they read on the internet.

I contend that worrying about these things is counter productive. Of course you should get enough sleep, you should exercise regularly and generally eat healthy. Check with your doctor, but this will probably be enough to avoid life style inflicted harm long term.

Strict controls and obsessive attention to your everyday life to maybe postpone death by some unknown amount of time, probably not worth it. Death sucks, but it's inevitable and no amount of finessing health choices will change that.

<comment><USER17> I agree. Sacrificing your mental health for your physical health is counterproductive to the goal of whole well-being. Obsession is harmful. Moderation is key.

</comment></comment><comment><USER18> Based on my experience, I can say that after very difficult strength workout like rings, 1 arm pullups, iron cross, etc., there is a huge difference in recovery on the days that I sleep 11 hours vs. the days that I sleep 8 hours only.

On the other hand, sleeping less than 8 hours a day is devastating (check the book 'Why We Sleep' for details)

Moreover, I've read that this was known among 19th century strongmen (Eugene Sandow slept 11+ hours a day).

So whatever happens during sleep, we need more of it (if we stress our body more).

I highly doubt that in itself (sleeping more) is detrimental in any way.

<comment><USER19> I have also seen similar recovery benefits from longer (11+) hours sleeps. During a period of a few months I worked out heavily every day, and noticed better recovery and faster strength gains from the longer sleeps. One downside with the longer sleeps was that I would not get tired at the same time each night, so my sleep window moved later and later until I needed to skip a night's sleep to reset, so I was probably sleeping more than my normal rhythms required

</comment></comment><comment><USER20> Maybe "the indirect link between higher trait agreeableness and risk of dying" is due to others in their environment keeping them up and they going along with it even when they are tired.

<comment><USER21> I saw this with a partner. She was extremely agreeable and would compromise her own sleep to make time for others. I suppose that doing this over time adds up and extracts a toll.

</comment></comment><comment><USER22> I always sleep like a baby on weed, that must mean I will live forever (yeeey).

On the other hand, tomorrow I often feel tired throughout a day, even more then as if I slept 4-5 hours without a weed, which might mean I should start looking for a parcel (meh).

This study just gave me cognitive dissonance.

<comment><USER23> Weed withdrawal causes insomnia, especially in heavy/daily users. If you want to see how much sleep you actually get without being on weed, you should take an 8-week break first.

<comment><USER24> I recently took an 8 week break and I noticed sleep returning to "normal" after about 1-2 weeks. I had a couple nightmares while in REM rebound though which really sucked and never happens to me otherwise

<comment><USER22> My experience too. Around second week insomnia is away but dreams return... often not in a good way.

</comment></comment></comment></comment><comment><USER25> I find that people tend to believe there is a specific amount of time, or even range of time that is ideal. The body is massively complex and ideal sleep time is completely different on a person to person basis. You must understand that there is no ideal sleep for you that a study will be able to identify, you need to test your own hypotheses and decide for yourself.

</comment><comment><USER26> For anyone with sever deviated septum who has trouble sleeping because they can't breath through their nose which often causes excessive dry mouth, I highly recommend trying [1] _Nose Vents_.

Since using them I get much better sleep, don't wake up with dry mouth and a need to drink water all night. It only takes a few nights to get used to them. I use the largest silicone pair, despite the fact that it seems like its a tad to large, because it widens the nostril to ease breathing. Your mileage may vary.

[1] [https://www.amazon.com/gp/product/B0743KZK88/](https://www.amazon.com/gp/product/B0743KZK88/)

<comment><USER27> Thanks for the suggestion. I'd like to add that I use Breathe Right strips and they seem to help a lot.

</comment></comment><comment><USER28> It all seems to come down to sleep when looking at lifespan. Despite knowing about all the risks from not sleeping enough I still struggle to want to sleep a full 7 hours.

And as the article mentions I do see those links in my personality associated with people getting a lack of sleep.

<comment><USER29> I'm a natural night owl, and I love being awake while most people around me are asleep. However, with "normal" life/jobs, that is a recipe for chronic under-sleep.

However, once I started working for myself, following my own schedule, I found it quite easy to get 7-8 hours of sleep per "night". I go to sleep when I want, and I usually wake up when my body wakes me up. I almost never feel tired anymore.

So in my opinion, the problem is the forced schedule most people have to suffer.

<comment><USER28> I have the same kind of problem, I much prefer the nights, but am constrained by the "normal" job schedules. Also to compound the problem I do a side medical job at events which typically happen at late evening/night or on the other side sometimes start early in the day. It makes it hard to maintain a regular schedule.

</comment></comment></comment><comment><USER30> Article gave a harsh summary, then you go to the study and they give you an abstract that explains almost nothing more without a pay wall. I would rather have the data be free, and everything else pay. There's no way to know if this is a bad study without giving them money.

>Lower conscientiousness predicted increased death risk via the direct, indirect, and total effect of quadratic sleep duration. Although there were no other direct personality-mortality effects, higher neuroticism and agreeableness and lower conscientiousness predicted increased death risk via the joint indirect effects of quadratic sleep duration and higher daytime dysfunction.

<comment><USER31> > nothing more without a pay wall

As (almost) always, you can find the full article in Sci-Hub. It's not 2010 anymore.

</comment></comment><comment><USER32> Can someone be genetically blessed with not requiring 8hrs sleep?

How much sleep do we need and why?

A friend of mine is a security researcher and he has been awake for one entire week by napping barely 10min for the full week

<comment><USER33> You can be genetically blessed. The "gene variant 'p.Tyr362His'" let's one get by on less than 5 hrs of sleep. See: Margaret Thatcher. A friend of mine that got 2 Bachelors and 2 Masters degrees in 4 years might've had that, though he said he just got used to the lack of sleep.

source: [https://www.telegraph.co.uk/news/science/science- news/110061...](https://www.telegraph.co.uk/news/science/science- news/11006181/Thatcher-gene-is-key-to-needing-less-sleep.html)

<comment><USER34> Its kind of amazing to me that we haven't heard more, or maybe aren't seeing more, research into drugs or therapy which could reduce the amount of sleep people need. We'd be talking about the greatest boon to global productivity in the history of mankind, likely singularly more impactful than any other technology we've ever developed. The company which develops it could sell it for literally any price and they'd have people scrambling for it.

Not suggesting its easy, or possible, but its just surprising to me that I don't hear anyone talking about it. Modafinil might be the closest I've seen but its obviously not for long-term use. Google/Alphabet is pouring hundreds of millions into Calico to fight aging, but fighting Sleep feels like a much easier target that could have much more impactful consequences (extending life from 80 to 100 isn't nearly as interesting as giving a ~30 year old even 10% more time with their younger body and mind).

And once its solved we'll inevitably flip into a dystopian society where the poor either can't afford the drug and thus become poorer, or are the only ones taking it because they now have to work 22 hours a day, but Hey, we'll worry about that when we get there.

<comment><USER35> Why do you say modafinil is not for long-term use? I take it 7 times a week, have done so for years and my doctor tells me it's likely that I will be taking it as long as I need it (in my case: a lifetime, as it's treating a chronic condition).

</comment></comment></comment></comment><comment><USER36> I wonder whether the link between sleeping less and eating more (or for longer hours) has been studied.

What if you sleep only five hours but restrict eating to the same hours as someone sleeping seven hours?

If sleeping is about giving the body a break, it seems pretty obvious that not eating would be a major part of that.

</comment><comment><USER37> In other words, the wages of hustle are death.

</comment><comment><USER38> since everyone is so hot on correlation and causation in this thread: i've seen some nice looking charts of all(?) the ways causation might work between two variables that are correlated. they have maybe 14-16 nice little directed graphs to them.

anyone happen to remember/recognize what i'm describing and have a link to it?

<comment><USER39> I don't think this is what you are looking for, but, it put me in mind of the book Spurious Correlation that shows how easy it is for things to seem related:

[https://tylervigen.com/spurious- correlations](https://tylervigen.com/spurious-correlations)

</comment></comment><comment><USER40> Ok, so if I'm anxious or depressed but I sleep the optimal number of hours, I'll maximize longevity anyway?

<comment><USER41> I suppose it depends on the quality of sleep. AFAIK, anxiety and depression reduce quality sleep time, which reciprocates itself into worsening anxiety and depression.

Undiagnosed issues that cause the depression and anxiety in the first place often _also_ cause sleep issues (thinking food intolerances and underlying inflammation), so it's hard to extract data to separate the two symptoms.

</comment></comment><comment><USER29> Summary: 7 hours of sleep is ideal; +/\- 1 hour of sleep is related to increased risk of death.

Everything else in the article seemed to be a lot of assumption and guessing about why people got more or less sleep.

Perhaps the article poorly represented the content of the study...

<comment><USER42> According to a military study referenced by William Dement [https://www.youtube.com/watch?v=8hAw1z8GdE8?t=29m](https://www.youtube.com/watch?v=8hAw1z8GdE8?t=29m) it is 8h:15m +- 50min

<comment><USER29> I like this number better :). 7h is ok for me, but 8 feels so much better.

</comment></comment></comment><comment><USER43> i'm wondering if midday napping was factored in

<comment><USER44> A fitting username lol

<comment><USER45> I hope your's isn't.

</comment></comment></comment><comment><USER46> Garbage in garbage out. Their data is worthless</comment>


How We Built a Vectorized SQL Engine - <AUTHOR> https://www.cockroachlabs.com/blog/how-we-built-a-vectorized-sql-engine/# <comment><USER2> > A Datum now has a field for each possible type it may contain, rather than > having separate interface implementations for each type. There is an > additional enum field that serves as a type marker, so that when we do need > to, we can inspect a type of a Datum without doing any expensive type > assertions. This type uses extra memory due to having a field for each type, > even though only one of them will be used at a time.

> The Go templating engine allows us to write a code template that, with a bit > of work, we can trick our editor into treating as a regular Go file. We have > to use the templating engine because the version of Go we are currently > using does not have support for generic types.

Go's lack of an expressive type system continues to disappoint :(

<comment><USER3> I'm shocked that they chose a garbage-collected language to implement a database with. Golang is great for building servers, but this is domain with potentially much greater resource constraints.

How do they deal with GC pause? I'm sure that they have an answer, but they'd have so much more latitude if they had the facility to reason about this from the ground up. They've sort of painted themselves into a corner now.

C, C++, or Rust would have been a better match and given me more faith in their product.

<comment><USER4> A database _is_ a server. Your malloc isn't deterministic, either.

According to the Go Wikipedia article, as of 2017:

> Garbage collection pauses should be significantly shorter than they were in > Go 1.7, usually under 100 microseconds and often as low as 10 microseconds.

According to [1], "A trivial SELECT can take in the order of 0.1ms to execute server-side", i.e., 100 microseconds. Any I/O will of course significantly increase that.

This sounds like an entirely reasonable price to pay. Writing high-level functionality in C in 2019 would not give me much faith in their product.

[1]: [https://www.2ndquadrant.com/en/blog/postgresql-latency- pipel...](https://www.2ndquadrant.com/en/blog/postgresql-latency-pipelining- batching/)

<comment><USER5> Throughput optimization in database engines often relies on operation latency being _visible and predictable_ to the execution scheduler. Disk I/O has this property, a GC does not, so they are not comparable in terms of their impact on throughput. An important class of schedule-based architectural optimizations are rendered ineffective if you are running a GC in the background.

This only matters to databases that actually implement these optimizations. If a database does not then a GC has a much smaller impact. But it also means that, all other things being equal, the database will never be competitive with a non-GC design since those optimizations can provide an integer factor improvement in performance.

Also, many database engines aren't doing malloc() at runtime. 100 microseconds of CPU time is an integer factor larger than many atomic database operations in a fast database engine. An operation taking an order of magnitude longer than the scheduler would expect based on runtime state has real adverse consequences.

<comment><USER6> This is slightly missing the point. Lots of successful large scale databases have been written in garbage collected languages, including for example Cassandra and ElasticSearch. They're completely fine.

What's important to notice though is that what really matters about latency and predictability is _relative_ performance.

Now there is a category of databases that are built for speed of response first, some of which have some pretty spaced out architecture under the hood. Aerospike comes to my mind, together with ScyllaDB or Redis maybe. They trade off this speed with massive compromises in complexity, consistency and scalability.

GC would be disastrous for these, so they're all written in C(++).

The main premise of CockroachDB is geographic replication, durability and scalability while maintaining full consistence and serialization.

In order just to keep these promises, a large part of the design of Cockroach is that the DB needs to keep _waiting_ most of the time of any request until all geo replicated shards are consistent. We're talking dozens to hundreds of milliseconds here. And even if that wasn't the case, a full GC of 100 microseconds probably isn't even noticeable compared with the weight of complex SQL query planning and execution.

You may stink a lot of valid points about Go, but this isn't one of them.

<comment><USER7> Cassandra has huge problems with JVM garbage collection, and it still isn't rid of them in the decades it has been in development. The reason for the scary warnings if your partition sizes exceed 100MB is garbage collection. The reason you can't tune it to use all your RAM on a modern box is garbage collection. Picking JVM implementations and tuning mostly seems to revolve around garbage collection and its trade offs. A common symptom of poorly maintained clusters is second long garbage collection pauses.

The trick with Go seems to be that programs don't seem to generate much garbage to collect, so I don't know if there is much use comparing with Java apps. But garbage collection overhead is certainly a major issue to be wary of for any application needing consistently low response times.

</comment></comment></comment></comment></comment></comment><comment><USER8> This is such a great post! Soooo many databases have implemented some kind of "column store extension" where they change the on disk representation and declare "look now we're a hybrid database". But the academic literature suggests that the bigger win for column stores may be in the execution layer. I love that Cockroach has taken the opposite of the usual approach and been so rigorous in measuring everything.

After doing all this work, is it your opinion that (hypothetically) a columnar on-disk representation would be a bigger or smaller win than a fully-built-our vectorized execution engine?

<comment><USER5> This is a complicated discussion because the relative performance is greatly impacted by design and implementation details. Broadly speaking, the execution engine and page representation designs are tightly coupled for performance optimization purposes. The kinds of optimizations outlined at the link will have a high return for most kinds of databases.

The term "columnar" covers a diverse set of architectures with very different operational characteristics. For OLTP (like CockroachDB), using a classic DSM- style columnar representation is going to offer poor write performance no matter what you do with the execution engine. On the other hand, if you are using one of the newer vectorized page representations (VSM) that are popular for mixed workloads, which are quasi-columnar but not DSM (nor one of the intra-page DSM hybrids like PAX), the loss of write performance may be minimal versus a classic row store (NSM) but with much faster query processing (faster than DSM for some types of queries). The execution engine design you would attach to any of these models is pretty different.

Note also that a practical limit on this kind of optimization is code complexity. While VSM-style on-disk representation and matching execution engine sounds like a nearly optimal hybrid of both NSM for write performance and DSM for query performance, an implementation that is general purpose and performs well across a diverse set of data models is _massively_ more difficult and complex to build in practice so most database designers avoid it at all costs due to the engineering overhead. These tend to be more common when the set of supported data models are very limited at design time. It is a research area that still offers a lot of opportunity -- the literature mostly ignores parts of the productive design space that intrinsically have extremely high implementation complexity (too difficult to produce code in support of paper publication).

</comment></comment><comment><USER9> Very nice post.

On another note: Kdb has figured out how to optimize the heck out of columnar data stores and vector processing. They would be my benchmark for these types of optimizations.

</comment><comment><USER10> A few Cockroach Labs engineers are hanging out on this thread - happy to answer any questions you might have about how we made Go go faster.

<comment><USER11> does Go's compiler emit SIMD instructions? it'd be cool to see the disassembly for the final, column order version since that loop would vectorize well. the same question goes for the speed-of-light benchmark -- there may be room to push even further there if it's doing a single multiply at a time.

<comment><USER12> It does not. You can use something like Avo to lighten the load a bit of writing those assembly routines. It takes care of register allocation, struct fields, and the necessary function stubs.

<comment><USER13> I was recently profiling some code in utf8 package and it caught my attention that some easily SIMDable code was lighting up in the flame chart. Kind of lame it can't do that

</comment></comment></comment></comment><comment><USER14> Didn't CockroachDB target OLTP workloads? What would the write performance be like for a columnar store for OLTP workload?

<comment><USER15> CockroachDB does target OLTP workloads. Note that the vectorized SQL engine covered in this blog post is execution-only (and used only for queries that operate on many rows). The storage layer remains row-oriented so the write performance is not affected. Rows are columnarized before processing by the execution engine.

</comment></comment><comment><USER16> A question I've never found a good answer to for columnar query engines is how to handle indexing.

For queries with very high selectivity it seems like any gains from increased cache-friendliness or SIMD would be erased by still needing to make random forward strides through the data.

The only solution I can really think of is to make the index point to a block of N elements and then take advantage of vector processing on the matching blocks. Have you run into this issue?

I haven't been able to find any examples of column SQL engine discussions that don't require whole-table scans.

<comment><USER17> One interesting solution is in Lucene — which isn't perhaps classically columnar, but something of a hybrid — which uses skip lists to allow random skipping through compressed index ("posting list") data.

</comment></comment><comment><USER18> When are they going through with a rename? This sub-optimal name is holding them back.

<comment><USER19> Why is this sub-optimal? People may not like Cockroaches but they definitely have a reputation for durability, which isn't a bad mental link for a database company. It also provides an identity & personality which is so often missing from modern companies. Maybe they've found they get more from those who really like it than those who really hate it (or maybe they just like it themselves).

<comment><USER18> It still has a negative connotation. That's unavoidable. People don't like cockroaches. From a marketing point of view, it is a very bad name. Unless the perception of cockroaches changes, which is rather unlikely.

<comment><USER20> If you pick a happy name, you get complaints that they sound too generic, sound like a medication name, etc. People also complain if your name ends in .com or .net, as apparently that sounds like something from the mid 90s.

People just like complaining about names.

<comment><USER21> On the other hand no one brings this point up about Oracle, PostgreSQL, SQL Server, MySQL, MariaDB etc.

People like complaining about names that they wish things didn't have.

<comment><USER20> I haven't used most of those, but SQL Server is a prime source of griping about names, as Microsoft keeps popping out strangely named variations. See: [https://en.wikipedia.org/wiki/Microsoft_SQL_Server#Editions](https://en.wikipedia.org/wiki/Microsoft_SQL_Server#Editions)

<comment><USER22> My problem with SQL Server is that the name is so generic it sounds more like a product category than a product. Its like naming a word processor "Text Rendering Engine". Microsoft seems to be generally terrible at naming things: I don't know how they expected people to keep .NET Core, Standard, Framework, and Mono separate, not even counting how bad a name .NET is in the first place.

<comment><USER23> It also has the advantage of slightly-less-technical people thinking it is _the_ SQL Server and there's no other options.</comment></comment></comment></comment></comment></comment></comment></comment>


Snowden persuaded other NSA workers to give up passwords - <AUTHOR> http://ca.news.yahoo.com/exclusive-snowden-persuaded-other-nsa-workers-passwords-sources-030552654.html

<comment><USER2> "...said a source close to several U.S. government investigations into the damage caused by the leaks"

This isn't the kind of stenographic journalism that Glenn Greenwald has been railing against at all!</comment>


Introducing the Rust crash course - <AUTHOR> https://www.snoyman.com/blog/2018/10/introducing-rust-crash-course <comment><USER2> Hopefully is going to be good. I am having hard time getting myself to study the official book. Something like might sold me.</comment>


Ask HN: What's the best font for technical blogging? - <AUTHOR>

Are there any recommendations what font size and font family to use for technical blogging taking in an account the tendency for bigger font sizes (like on medium.com)? After doing small research, I found advices that serif types of Times New Roman, Garamond and Baskerville are the perfect fit for technical writing. Can someone confirm that and share some thoughts re font size of an article body and a headline ? <comment><USER2> If you're going for readability make sure your font-size is in the 16-18px range.

Generous amount of line-height is also a good idea, closer to 2 than 1.5.

one word = whitespace

Serif can be nice but for a Sans Serif option, I like Open Sans.

headline I would go anywhere from 18px to 36px, depends on what type of look and feel you want to achieve.

Color wise keep it dark text on a light background with minimal use of a single accent colour. I like Red myself but blue is also good.

</comment><comment><USER3> I love Matthew Butterick's Equity Text and use that together with his Concourse (which I'm slightly less enthused about, but they were designed to fit together).</comment>


Ask HN: What is the best way to validate my startup idea? - <AUTHOR> <comment><USER2> From my experience as a serial entrepreneur, there are several ways to validate your product idea:

\- Create an MVP an show it to your friends and family

\- Validate the idea on some online communities like Reddit (www.reddit.com)

\- Cold-call some companies and ask if they have this specific problem

\- Use an online idea validation service like IdeaValid (www.ideavalid.com)

\- Find similar products which already exist

</comment><comment><USER3> An interesting essay that might be relevant, [https://blog.ycombinator.com/minimum-viable-product- process/](https://blog.ycombinator.com/minimum-viable-product-process/)

</comment><comment><USER4> Ask people to buy what you're selling. It's the only validation that counts.</comment>