Quick notes about the bash bug, its impact, and the fixes so far - <AUTHOR> http://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-bug-its-impact.html <comment><USER2> This is a perfect example of why you should never, ever put special magical values in-band with a facility which has a different purpose normally.

I know it's tempting and in many cases, it will save you a lot of work, but it will eventually lead to data corruption, or, way worse, a problem like this one here.

People in the office complain about my annoyed remarks when they succumb to the dark side and use some special values. My question "but what if a real value is ever sent that looks like one of these magic values?" is usually countered with "but who's ever going to send this value?".

This bug here is providing me with a perfect answer to that question: "Security researchers, or worse, bad guys".

There are so many ways of transferring functions to subshells that don't involve magic values in a free-form key/value store, but all of them would have been more complicated, so people chose the quick hack.

And now the sh*t has hit the fan :(

<comment><USER3> _My question "but what if a real value is ever sent that looks like one of these magic values?" is usually countered with "but who's ever going to send this value?"_

Have experienced the same situation so many times with CSV... "Who's ever going to have a doublequote in their name?" At least there is an escaping facility in most formats.

I haven't seen any "how this was discovered" for the bash bug, but my bet is that someone needed to store "() {" in an environment variable in a shell script. It's not inconceivable - the first thing that comes to mind is a shell script that generates shell script functions.

 _There are so many ways of transferring functions to subshells that don 't involve magic values in a free-form key/value store, but all of them would have been more complicated, so people chose the quick hack._

I'd say the problem is more that they chose to use the name of the function as the name of the environment variable; this would not have been an issue if it stuffed all the function definitions together in an environment variable with a special name, like BASH_FUNCS. Shells already interpret environment variables with special names in certain ways (e.g. PS1, PROMPT_COMMAND), up to and including command execution, so this way would fit with that model far better.

<comment><USER4> I was just looking at [http://stackoverflow.com/a/941390/2517719](http://stackoverflow.com/a/941390/2517719) on monday, and I completely missed the implications.

</comment></comment></comment><comment><USER5> Reminds me of this:

"Nobody really knows what the Bourne shell's grammar is. Even examination of the source code is little help." — Tom Duff

[http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.41....](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.41.3287&rep=rep1&type=pdf)

Sounds like a time-bomb for exploitable unexpected behavior.

<comment><USER6> > Ree88. J. Reeds, ''/bin/sh: the biggest UNIX security loophole,'' > 11217-840302-04TM, AT&T Bell Laboratories (1988).

<comment><USER7> Do you have a copy of or link to that article? Or are you just pasting a citation with a cute title? I have stumbled across that citation a couple of times but I have never been able to find it.

</comment></comment></comment><comment><USER8> Someone really needs to interview Stephane Chazelas and ask them how the heck they found this flaw in the first place (after 15 years).

</comment><comment><USER9> I thought the patch wasn't that effective? Is there a PoC that runs on a patched system anymore?

Edit: found one [https://news.ycombinator.com/item?id=8365216](https://news.ycombinator.com/item?id=8365216)

</comment><comment><USER10> So has a new patch come out? I hacked up a temporary patch that fixes this last night after the new PoC was released, but I'd rather have something from upstream.

<comment> f- There is an unofficial patch that takes a much more reasonable approach:

[http://www.openwall.com/lists/oss- security/2014/09/25/13](http://www.openwall.com/lists/oss- security/2014/09/25/13)

</comment></comment><comment><USER11> So only servers actually executing bash with input from browser (cookies etc) are affected (like CGI)?

<comment><USER12> Plus any DHCP client that runs shell scripts using parameters from The Evil DHCP Server, for example.

</comment></comment><comment><USER13> Could we fork bash to make this "feature" configurable?

<comment><USER13> Replying to myself just to point bash doesn't seem to be up to date in the "official" repository at gnu.org. Are distros maintaining their own forks?

<comment><USER14> Distros typically maintain a set of their own patches that go on top of the officially released source.</comment></comment></comment>


Kotlin: statically typed programming language that compiles to JVM & JavaScript - <AUTHOR> http://kotlin.jetbrains.org/ <comment><USER2> I don't know why would I want to use this and not Scala. Sure, Scala might have some complexity, but it's easy to learn and for me it's as productive as Python.

I found this comparision: [http://confluence.jetbrains.net/display/Kotlin/Comparison+to...](http://confluence.jetbrains.net/display/Kotlin/Comparison+to+Scala) so basically Kotlin seems to be a "watered" Scala.

<comment><USER3> For some people, after looking at Scala a bit, being "watered" might be a good thing. Kotlin doesn't have as many syntax surprises as Scala does.

That being said, the one really cool feature Kotlin has that Scala doesn't is the ability to build strongly-typed builder DSLs:

[http://confluence.jetbrains.net/display/Kotlin/Type- safe+Gro...](http://confluence.jetbrains.net/display/Kotlin/Type-safe+Groovy- style+builders)

You simply can't accomplish this in Scala with the same elegance.

<comment><USER4> That Kotlin page calls them "Groovy-style", perhaps because many of those working on Kotlin (e.g. James Strachan, Alex Tkachman) used to develop the Groovy Language.

But doesn't Ruby also have those builders? Wouldn't it be easy enough for Scala to implement them in a library if they haven't already? Wouldn't Python also provide this type of syntax? E.g. a possible translation into Python from the Kotlin code on the linked page...

        html:
          head:
            title {"XML encoding with Python"}
          body:
            h1 {"XML encoding with Python"}
            p {"this format can be used as an alternative markup to XML"}

            // an element with attributes and text content
            a(href = "http://python.org") {"Python"}

            // mixed content
            p:
              "This is some"
              b {"mixed"}
              "text. For more see the"
              a(href = "http://python.org") {"Python"}
              "project"
            p{"some text"}

            // content generated by
            p:
              for (arg in args) arg

So what are they called "Groovy-style" builders for?

<comment><USER5> Presumably because, among the languages (and standard libraries) you mentioned that have implemented this pattern, Groovy is the language that is most tightly associated with the JVM (which Kotlin is obviously targeting).

<comment><USER4> > Groovy is the language that is most tightly associated with the JVM

That could've been very true 6 years ago, when Groovy 1.0 was released, but I'd have to challenge that for 2012 (and 2013).

</comment></comment></comment></comment></comment><comment><USER6> The obviously emphasis here with Kotlin is that you can also compile it to JavaScript. Which may be a smart move for Kotlin.

One reason why I chose Node.js over Scala for my current personal projects is that I prefer programming in the same language on the client and server.

That being said I've never used Kotlin and can't compare it with Scala, which I have used for my personal and commercial projects.

<comment><USER7> from the other direction, it looks like haxe [<http://haxe.org>] is planning on adding a java target. fantom [<http://fantom.org>] already does both java and js too. it's a pretty well-filled ecological niche.

also, if you like single-language stacks, give opa [<http://opalang.org>] a serious look. it's essentially based on ml, with a javascript skin, and offers strong static typing and easy integration of front-end and back-end code.

<comment><USER8> I'm glad you brought Opa up. I saw it a while ago and thought it was interesting, until I saw the license it used (AGPL).

Thankfully, your comment made me seek it out again and I saw they also added MIT for the framework part, so that apps can be licensed in any language. Will have to try it out now that they have given users that choice.

</comment></comment></comment><comment><USER9> Doesn't look like something I would like to write me code in frankly. It does say it is for 'industrial' application whatever that means. I would think this would be for robots, but then why javascript?

Obviously I am not target group.

</comment><comment><USER10> If this isn't a scientific targeted language, you should change that to "byte code" or better yet, "bytecode"

Code is a mass noun when talking to the computer profession.

The science professions still use the (now thought by the computer professions to be archaic) form "Codes"

</comment><comment><USER11> I like this one! Superficially, the syntax looks like the marriage of Go and Scala.

</comment><comment><USER12> or just wait for Java 8(coming in 2013); java 8 supposedly cuts down a lot verbosity and is sprinkled with functional programming features.

<comment><USER11> I think you can use Java 8 features in the latest build of the JDK. Not sure, though.

</comment></comment><comment><USER13> Language without proper IDE(Eclipse) support isn't worth much for me.

ps. i'm not cool enough to use notepad, vim etc.

<comment><USER14> This language is from the people who work on intellij, so it should have good IDE support in intellij. I haven't tried it myself though.

<comment><USER15> Jetbrains frustrations with implementing Scala support in IntelliJ were at least part of the motivation for Kotlin.

Since they've designed it with tool support in mind from the beginning I expect Kotlin to seriously outstrip the other JVM languages in IDE integration.

</comment></comment></comment><comment><USER16> They're pretty honest by saying that the point of Kotlin is to drive IntelliJ IDEA sales (I did buy my licence 70% off during their doomsday special).

However it's a bit weird: they're creating a language that, basically, "needs" an IDE, so they can sell that IDE. I don't doubt they did put a lot of stuff in their language at which IDEA was good (e.g. @NotNull / @Nullable which IDEA was able to check in real-time on partial ASTs etc. which apparently made it into Kotlin right from the start).

I'm sure there's going to be quite some "refactor xxx to use pattern yyy", making IDEA "great" to work on Kotlin.

But are these really the features we want? A language that is "flawed" by design so that we can be sure we _need_ an IDE to develop in it?

I'm still using IDEA and still doing some Java programming.

But I'm more and more investing time in Clojure / Emacs and, honestly, there's more pleasure to develop with these than with IDEA / Java. I don't know why IDEA / Kotlin would be any better.

To me it seems that, from the start, it's a language arguing for its own limitation.

P.S: what about concurrency? does it offer lock-free concurrency? Because there's no way I'm moving back to using explicit 'synchronized' keywords and having fun with deadlocks...

<comment><USER4> > A language that is "flawed" by design so that we can be sure we need an IDE > to develop in it

All languages are flawed by design.

Assembly language is flawed so we need a higher level language like C, with easier to read syntax. C/C++ is flawed by requiring us to manage heap memory so we need a managed language like Java/C#. These and Kotlin are flawed because we need some visual help like name lookups and pattern refactorings.

<comment><USER17> "Flawed by design" doesn't mean "the design is flawed". It means "it is designed _to be flawed_ ".

</comment></comment></comment><comment><USER18> Sorry for this test :(</comment>


What happened to Xiaomi? - <AUTHOR> https://www.techinasia.com/talk/happened-xiaomi <comment><USER2> Xiaomi is moving toward an IoT company instead of a mere smart phone company. You can buy cheap but well designed air cleaner, clean robot, water purifier, etc in China and they're building the social buzz around its famous hunger marketing technique.</comment>


Khan Academy: The Illusion of Understanding - <AUTHOR> http://theeducationscientist.blogspot.com/2014/02/khan-academy-and-illusion-of.html <comment><USER2> Luckily not a single student ever left traditional education with a single misconception about anything, or else this would seem like a ridiculously slanted article.

edit: on re-reading, he's still clearly using Khan and MOOCs as eye-catching buzzwords, symbolic of "bad education", but a) he mention (in passing) offline education having similar issues, and b) he intends to talk about how online education could fulfil his pet theory of learning in another article, so it's not quite the usual reactionary post, although it does lean that way.

<comment><USER3> The reason I'm confident that in the long term MOOCs will succeed where traditional education fails is not that MOOCs will come out of the gate a superior product. The reason is that MOOCs can be tuned and developed over time in a way that a classroom experience can not, because every class room experience is too unique, delivered live, unrecorded, etc. It will take time for this to happen, but it is likely inevitable, and eventually the idea of flinging out an "education" into a room, where it shall disappear forever with no feedback or development, will be considered as archaic as the horse buggy.

(And also people can't seem to help comparing the perfect conventional education that _does not exist_ to the worst of MOOCs, which may feel good, but is not relevant.)

<comment><USER4> I watched video tapes in the early 80s and before that, professionally produced film strips. Even film strips with 33RPM vinyl records, before tape. Also I saw a couple really old analog film movies in my youth. Currently, youtube videos and DVDs are supposedly popular. Why didn't they replace traditional classroom education using the same criteria you're applying to MOOCs?

You may be correct about outcome, but the reaction mechanism is lacking.

I'm a classically self educated well rounded kind of guy, so I feel education is developed from within not a mechanical external process much like weightlifting. The idea it merely requires butts in seats, and the result depends on what technique someone else applies to those seated butts, is more likely to disappear. Or at absolute most, perhaps "necessary but not sufficient".

<comment><USER3> "Why didn't they replace traditional classroom education using the same criteria you're applying to MOOCs?"

For the same basic reason that the computers of the 1980s didn't replace newspapers the way computers of the 2010s are; too hard to use, too expensive, not enough availability. The tech for editing a course may have existed but it wasn't wide-spread and easy, so there was not a feedback loop of improvement going on. Imagine being the teacher in 1980; you've recorded your lectures, you sent them away to be "edited", three months after your course was recorded they come back, you sample a couple of them just to see how they came out (you _certainly_ aren't going to watch them all), and that's it. Even if you find an error, you're going to have to shrug your shoulders and at most issue a paper errata; you certainly aren't capable of going back and fixing it yourself, nor is anybody else going to pay for the skilled labor necessary to do so. For a feedback loop to occur there's a certain base level of ease that has to exist.

Only now do we have a world in which an instructor can give some bit of instruction, get a question from a student about something, and simply click "edit" to go back and fix whatever weakness in the original instruction the student's question reveals almost as quickly as they could answer the question in the first place. Run something like Physics 101 through that process over the course of 4 or 5 years and you'd quite likely end up with the best possible Physics 101-type course that could be developed. (The next step after that is fundamental rewrites of how we teach physics at all, but that will take longer.)

And indeed I'd suggest that we're still in the very early phases of that, too; it's going to get easier and more widespread. Once we start _building_ educational resources over time instead of firing them like one-shot ammunition, the improvement feedback loop is all but inevitable.

<comment><USER5> Curiously, with MOOCs replacing OpenCourseware, we've shifted to an environment that's a little bit harder to iterate on. Editing text is easy. Editing something someone said in the middle of some video can be harder (continuity issues, availability of the original speaker, audio environment, etc).

Quite a few MOOCs have shifted up a notch in their production values recently. When you've flown to another country to interview a famous scientist for your MOOC, it's probably a bit trickier to make a minor edit to what was said next year.

<comment><USER3> "Editing something someone said in the middle of some video can be harder (continuity issues, availability of the original speaker, audio environment, etc)."

That's part of what I was thinking when I said this was early days. While the problems can't be completely glossed over, there's some stuff we can do to mitigate those problems.

An interview would be a primary source; of course you can't edit that, but good odds you've got some sort of summary that is part of the core course, where the interview is immediately available as a primary source. The summary would be as fungible as anything else, and the interview ought to be treated as a primary source and archived. (Possibly with one pass of audio cleanup, but not something to be modified wiki-style.)

On the topic of Wiki, some sort of editor-driven Wiki could help too. Many Montessori schools already adapt the idea of having the older students teach the younger, I believe; as MOOCs evolve it's very easy to imagine harnessing the students themselves to start fixing the courses they've already taken. They'd move from an isolated course to an integrated part of the whole education. Again, like I said, I fully believe these are the early days of a revolution, and writing MOOCs (and more generally, online education in general) off now is like writing off the automobile because it's a great deal less convenient in every way than a horse, and smells worse and is more expensive to boot. Yes, that was true... at the beginning....

</comment></comment></comment></comment></comment></comment><comment><USER6> The guest author is Professor of Education at the University of Texas at Arlington. It's good that educational research continues around the world. For the moment, it's especially important that education research focuses on what happens to young pupils in conventional classrooms, because they far outnumber older students who use MOOCs to learn. In that respect, I think the title "Khan Academy: The Illusion of Understanding" is unfair, because there are plenty of learners with illusions of understanding leaving the elementary schools of my country and yours, even though those learners have hands-on experiences in the classroom.

Michael Shayer in Britain[1] has been doing great research for years about how early experiences of children shape their understanding of the world. He has discovered that many of Piaget's findings about how children proceed through developmental stages in understanding no longer replicate in current children, because children today have different kinds of early life experiences from children in Piaget's era. What happens as society changes over time is that some experiences that used to be commonplace become rare, and other experiences that used to be rare become the most influential experiences in children's development.

The best way to gain intuition about Archimedes' principle (the example given in the blog post kindly submitted here) is probably to do the experiment repeatedly with differing experimental conditions and careful observation. The history of physics around the world shows that for centuries great thinkers could be badly confused about very elementary principles of physics. Galileo did the world a favor by insisting that physicists do more experiments to check their hypotheses. Teaching elementary pupils to hold their conclusions about the world tentatively and with an attitude of testing out everything they believe is the best kind of elementary teaching. Whether by video or in person, good teaching encourages learners to draw on their life experience between lesson sessions to test out ideas and to see what ideas are really correctly understood.

[1] [https://kclpure.kcl.ac.uk/portal/en/persons/michael- shayer(5...](https://kclpure.kcl.ac.uk/portal/en/persons/michael- shayer\(5c4f7363-ab67-4fe8-a3a7-3228d757fdbf\).html)

</comment><comment><USER7> As the responses to this HN post demonstrate so clearly, an intuitive understand of what Archimedes Principle means in the real world is not something that is easy to acquire: I'm sure most of the commentators on this HN post are intelligent people who probably did well at school, yet the majority of the responses here are completely wrongheaded.

If it isn't transparently obvious that the water level will neither rise nor fall but stay exactly the same then you don't _really_ understand Archimedes Principle.

The author's question therefore is: how is the Khan academy approach supposed to improve on this situation? A bare explanation of Archimedes Principle clearly isn't enough, nor is the ability to parrot said explanation after viewing the explanation it as many times as required for the viewer to learn the required words. How then is a learner going to acquire authentic understanding from Khan academy videos?

(Note that traditional education has clearly failed here too! But that's a side issue: the question here is why should we expect Khan academy to do any better?)

<comment><USER8> > If it isn't transparently obvious that the water level will neither rise nor > fall but stay exactly the same then you don't really understand Archimedes > Principle.

Surely it will overflow once the ice melts. At about 4C the water will reach it's lowest point, and then rise and start overflowing at about 8C.

<comment><USER7> The density change in the liquid water due to heating / cooling over the likely temperature range is tiny compared to the result of going from ice to liquid water. But I'll award you pedantry points nonetheless :)

The precise outcome requires knowing the volumes and shapes of the ice and water components, their initial temperatures and the temperature of the ambient environment so that you can calculate the path of the water volume over time as the ice has melts. In order to make that calculation you'd still have to make use of Archimedes Principle in order to know that you didn't need to worry about how much water was displaced by the floating ice in your calculations, which was the original point.

</comment></comment></comment><comment><USER9> The article conflates two separate connotations of "better" which are commonly applied in educational contexts. When we talk about better teachers like the author and Mr. Kahn himself, "better" refers to the average effectiveness of the teacher's methods on individual students. We would for example control for class size and socio-economic status of the students when deciding whether the author was a better teacher than Mr. Kahn himself.

But what "better" often means in terms of educational infrastructure is more access. We would measure the effectiveness by looking at the institution's effect on an entire population. Here we can look for the effects of access and raw numbers matter. A MOOC course could produce a significantly lower average achievement among individual students but produce orders of magnitude more highly successful outcomes.

It appears likely that they do based on my anecdotal experience. If there are 100x teachers and again I believe that there are in the context of adult education, then MOOC's can be better in both senses. Mr. Kahn may not be a 100x teacher, but he is a 100x educator.

Dan Grossman of University of Washington has taught "Programming Languages" on Coursera. I took the second section. Here: [http://www.youtube.com/watch?v=1T4IQrOJr5U](http://www.youtube.com/watch?v=1T4IQrOJr5U) he talks about data he collected from the first session. Particularly interesting are what "number of students" and "passing" mean.

</comment><comment><USER10> WTF people!? Why is everybody discussing what the water is going to do when the article is about online education?

To stay on topic: I agree with the article, watching videos often leaves you with feeling of understanding but being unable to answer questions which require actual comprehension

<comment><USER5> At one of the keynotes for the Association for Learning Technology back in 2007, the speaker had a variation on this question. His point, if I recall, was a little different --

As normally asked, the question is code for "parrot the Archimedes principle back to me". But on a realistic "hot summers day" there's not just the Archimedes principle. There's evaporation that can remove water from the cup. There's wind, and occasional movement of the ice cubes as they melt and slip over each other in the glass, that could cause spillage if it's really that full that it's on the verge of overflowing. As could interruption of the surface tension (e.g., condensation in just the wrong spot at the edge of the glass, causing the water in the meniscus to spill over.) The initial temperature of the water being unstated, its density will also change a very small amount, potentially in either direction.

Often when we ask our students scenario questions as teachers, we are essentially asking them to identify which taught principle we have flagged this question as being about, and base their answer on that, ignoring all other factors.

If the student answers "A. It goes down", did they fail to grasp the Archimedes principle, or are they a pedant grumbling that over that length of time there will be evaporation so it won't be _exactly_ the same?

Take the question out of the context of a course, and suddenly the educational point of it can change. Is the person asking you this a physics teacher checking your understanding of Archimedes principle, or an ALT conference pedant checking whether you understand that in uncontrolled environments where bumps and spillages can occur you can't blindly expect the ideal result you'd get in a textbook?

The peril comes when questions are used outside of a teaching context. For example in technical interviews, where the same question can sometimes be a signal for many different teaching points, each expecting subtly different answers, and the interviewee does not know which the interviewer has in mind.

<comment><USER11> _But on a realistic "hot summers day"..._

That's an excellent point and a flaw of many "reasoned conclusions" thought experiments. There's a world of difference between _contemplating_ what might happen (which is a useful first step) and _experimenting_ to see what actually _does_ happen.

In the case of your hot summer's day instance, there are a number of things which could confound the experiment: how do you distinguish between water inside the glass (from the initial water + ice), and that on the outside (mostly from condensation, but possibly also from spillage)? How could you control for this? How might you run the experiment repeatedly? Etc. Actually, a chemistry lab where students each mix known weights of water + ice at specified temperatures and observe what happens, then collaboratively compare results might make for a useful group + parallel experiment exercise.

And that's just for ice water. In a field I've got some interest in (practical and applied economics) there's an even greater tendency for assumptions and ideal circumstances to get constructed.

</comment></comment></comment><comment><USER12> Suppose we remove an ice cube of mass 10g.

The ice cube was previously floating and was therefore displacing 10g of water.

If we let our ice cube melt, we will have 10g of water than we can add back to the glass.

The net result is that the water level remains the same.

<comment><USER13> Exactly.

I've had this discussion many times w.r.t. global warming, and am amazed so many people, including scientists, just don't get it. The level the seas would rise is not so much dependent on floating ice (north pole) since the displacement is exactly the same, but on ice that was on top of land (e.g. Greenland, Antarctica, etc.).

<comment><USER7> Absolutely, although it's worth noting that loss of floating polar ice will change the albedo of the earth, so there's a positive feedback loop there that may result in further warming & consequent melting of land-based ice elsewhere.

So melting of the floating polar ice will not directly result in raised sea levels, but 2nd round effects of the melt might do so.

<comment><USER14> I don't see any clouds in your picture.

</comment></comment></comment></comment><comment><USER15> I think we don't understand anything about how to teach.

Formal education started at least 4000 years ago (earliest writing is at least 4,000 year old, and I think you need a formal education to have scribes who can read and write). I don't think we have done any substantial progress in how to teach in that time frame, at least compared to how much progress we have done in most other subjects: medicine, math, engineering, metallurgy, you name it. heck, we are still discussing what methodology we should use to teach reading & writing, and we have had 4000 years to figure what's the best way.

On the other hand, anyone who has had a good teacher can attests that teaching quality can vary by a huge amount. So my theory for good education is: 1) find good teachers (which probably includes "pay them well") 2) let them do their stuff

Anybody who tries to do something better than the above should be able to explain why their pet theory has not been discovered before.

<comment><USER16> Don't let them "do their stuff". Have double blind randomised controlled studies (or as close as you can get) to test various teaching methods. The. Implement the good methods.

This has not been done because people have a built in desire for "fairness" and splitting a country or state into two groups means one group is getting a worse education. (Even though we don't know before the experiment starts which group that is)

</comment></comment><comment><USER17> Schools find it easier to get students to memorize facts and techniques instead of getting them to really think and understand. This is a particular problem with Lecture-based learning, and it applies not just to middle-school students, but to Harvard students too:

[http://harvardmagazine.com/2012/03/twilight-of-the- lecture](http://harvardmagazine.com/2012/03/twilight-of-the-lecture)

</comment><comment><USER18> Eric Mazur's Peer learning process [https://www.youtube.com/watch?feature=player_detailpage&v=Ww...](https://www.youtube.com/watch?feature=player_detailpage&v=WwslBPj8GgI) kind of highlights the problem and a solution for the same. Namely, Flip the classroom. Ask questions that highlight the knowledge gap within the students. Let students debate among themselves and then actually provide the solution.

Though this is not sufficient, it at least improves the ability of the student to reason about the problem and question the models they have built around their heads on the given subject.

</comment><comment><USER19> I think it would go down... here's why.

When water freezes, it expands. That's what full bottles in a freezer burst, as do pipes in winter. So 1 gram of water occupies less space in the glass (1 ml) than 1 gram of ice.

According to Archimedes' Principle, a floating object will displace precisely as much water as its weight. Which is why a log of wood floats - the water it displaces weighs more than the wood itself.

If 1 gram of ice is floating, it means it has already displaced 1 gram of water. When 1 gram of ice becomes 1 gram of water, it will occupy less space.

As the ice melts, the level of water comes down.

<comment><USER19> Or maybe the ice above exactly replaces the level of water, and on the whole it stays the same. The more I think about it the more confused I get, which seems to be the point of the article.

</comment></comment><comment><USER20> The author's paper on the topic ([http://sloanconsortium.org/sites/default/files/6-Schwartz_0....](http://sloanconsortium.org/sites/default/files/6-Schwartz_0.pdf)) makes for interesting reading as it expands on the five requirements he states are necessary for authentic understanding.

Though having read it, the only conclusion I can make is that I don't really understand anything about the subject.

</comment><comment><USER21> I disagree with the article's assertion that, because I'd forgotten Archimedes' principle, I never truly understood it. I'd successfully worked the problem far enough to realize that my missing piece of information was how much of the ice cube stayed below water, then I watched the video and reacquired that information. No problems here, and the KA video was plenty sufficient for my needs.

</comment><comment><USER22> Whenever I read these pieces, I always think that the establishment is getting worried. Whilst there are good points to be made, such inflammatory and sensational headlines make me think "Now why are they so upset about this?" \- and unfortunately I often feel that it's because they feel threatened someone is walking on their patch.

</comment><comment><USER23> Interesting and challenging article about most current online education offerings. It would be interesting to see if the problems of maintaining engagement in a MOOC were at least partly due to students realizing that some or all of the requirements for authentic understanding were not being met.

As I understand it, there is a different MOOC philosophy that has not gained much support (probably because it's much harder to scale) - the connectionist approach. Perhaps that would support some of the requirements.

(PS: interesting that many of the comments here try to rise to the ice-cube challenge...)

</comment><comment><USER24> Khan might not be perfect, but it is still pretty high quality. The lessons are certainly higher quality than most of what I encountered in school.

</comment><comment><USER25> ok, water expands when it is frozen and contracts when it melts, so the question is by what factor to allow for the water to either overflow or not.

and are we talking about icecubes floating in the glass or filling up the glass so they are standing on each other (like a cube skyscraper) from the bottom of the glass?

<comment><USER26> FTA:

When examining the ice you note that the cubes rise just above the surface of the water (like glaciers in the ocean), _but do not extend to the bottom of the glass_.

</comment></comment><comment><USER27> So it would overflow, right, dependent on how much of the cubes extend above the surface?

<comment><USER28> It's a trick question. The question creates doubt because it asks you to choose between two wrong options. [Edit: no, it gives all three possibilities; I speed-read through that. Thanks to others for pointing that out. However it then does predominantly focus on the question of "up or down?", which isn't the right question.]

Ice is lower density than water, which is why it floats. As the ice melts, the runoff from the above-surface ice will raise the water level -- but the shrinkage from the below-surface ice will lower the water level. Assuming the above-surface and below-surface ice melts at the same rate, the water level will remain unchanged.

(Note that if this were a glass of hot water in a cold room, then you'd get non-uniform heating of the ice. The subsurface ice would melt first, causing the level of the water to lower, until the above-surface ice melted, at which point the water level would return to its original level. On the other hand, a glass of cold water in a hot room would initially overflow while the above- surface ice melted, and then its water level would lower when the subsurface ice melted. So the answer to the original question is, depending on context, either "neither" or "both".)

<comment><USER29> It isn't a trick question. The article gives all three possibilities.

<comment><USER28> You're right - I speed-read through that.

</comment></comment></comment></comment><comment><USER4> "If you answered "Yes" to this last question, then you just experienced the Illusion of Understanding first-hand."

Bzzt wrong it could mean you're thinking like an engineer instead of a scientist. And its not binary, so fuzziness would be partially one or the other reason at the same time.

Possible engineering challenges all contributing a really small delta, all of which add up to so few sig figs a good engineer can't predict what will happen to the water level:

1) You don't know how well mixed the cup is. I assure you, especially on the "summer day" in the article you can get a spread of 20 or more degrees in that cup. So the liq at the bottom is already way past the max density temp and expanding while the top still has some ice.

2) You don't know the starting temp of the water and ice. In addition to #1 above, the ice in my freezer is well below 32 and who knows the starting temp of the water. Maybe its barely melted meltwater or maybe its out of the tap or maybe the coffee maker. So its going to go thru some wild temp and density swings based on unknown initial conditions.

3) The pix shows massive condensation on the glass AKA they're running the experiment in New Orleans not Phoenix also in written form they're running it in the summer. Realize that there's nothing magic about surfaces and condensation... if a sq inch of 32F surface condenses 1 teaspoon per 5 minutes, the top will condense just as well as the sides. On the other hand if you run this in an environment with a dew point below 32F like where I am today, then water will steadily evaporate away depending on the intensity of energy striking the surface, although not too fast.

4) Ice stacks up nicely and clogs pipes. So you'd need more like a slushy to make sure that icecubes are not mechanically sticking up above the surface by being jammed by the cup walls. The supplied pix strongly indicates the middle ice cube is mechanically jammed way above flotation level. One thing for sure, liquids don't have much shear strength and thats going to eventually melt and drip down and raise the water level... how much, who knows.

5) How does water surface tension vary WRT temp? I donno. Probably does, a little. So how much the level can go up or down before it drips is a mystery. You might be able to tolerate a rise of 0.1% if the surface tension enables a "lens" above the top of 0.2% because of increased temp. Or maybe it goes the other way and surface tension drops so "just barely overflowing" at 32F means a flood (well, at least a drop...) at a liquid temp of 40F.

Its probably possible to very carefully engineer the perturbing contributions to a low enough, or counteracting against each other enough, level (oh the pun) such that the science principle will be demonstrated. Or given way the heck more engineering data, a properly engineered answer might be provided, maybe with enough sig figs to mean something. Or maybe not enough sig figs to mean anything. I'm feeling the latter.

</comment><comment><USER30> I find that I have the opposite problem. I think I know less than I actually know. Sometimes I feel (as a mathematician would) that I don't understand something unless I can _prove_ it, assertion by assertion and line by line.

I dropped out of grad school after one year, and it seemed like a bigger risk/deal than it was. My sense is that the major benefit of having a PhD (especially from a top school) is the confidence that comes with it. It gives you faith that you know _enough_ to tackle the interesting problems, and an assurance that people (usually uninformed people, often without the educational credentials they overvalue) won't try to peg you down as not up to it. Socially, it gives you the right to be an expert, which is not the same thing as expertise but just as valuable (if not moreso) in the work world.

So, even in traditional education, I'd argue that much of the benefit earned (maybe 85%) is confidence, both your own and others' in you. You can get a lot on your own by reading the papers and books, but you never get that official approval or that "proof" that you learned _the right stuff_.

Oh, and the answer is that the water level stays exactly the same. Archimedes' Principle is that a floating object displaces as much water as it weighs. When melted, the iceberg (90% submerged) takes up as much space in the water as the submerged part occupies.</comment>


Free Will is an Illusion - <AUTHOR> https://m.youtube.com/watch?v=9uRTjfhIf4M <comment><USER2> So all upvotes are meaningless!</comment>


Ask HN: What Firefox/Chrome extensions do you use? - <AUTHOR> A lot of people seem to boost the web navigation experience through browser extensions/plugins. So, what do you use, and why do you use it? <comment><USER4> No one mentioned _Xmarks_ (almost all browsers) to sync bookmarks and tabs between browsers

 _OneNumber_ (chrome) which checks for Gmail, GReader, GVoice and wave for updates.

Then I would recommend _Boomerang for Gmail_ (both FF and Chrome) that allows you to postpone an email to send to whenever you want.

 _Google Dictionary_ (chrome): double click a word and it shows you the definition - really unobtrusive

 _Lazarus:Form recovery_ (chrome) - if you were typing some text in a textArea/field and the browser crashes it can easily put the text back in when you open the page again.

 _Rapportive for Gmail_ (chrome, but i thinks it also works in FF) - shows you details about senders, social networking accounts, etc

 _Stop Autoplay for Youtube_ (chrome) - great if you like to open many videos in tabs and dont want to hear them play all at the same time

<comment><USER5> Xmarks has been _essential_ for me when fiddling between multiple devices and OSes. Quite handy.

</comment></comment><comment><USER6> Chrome: JSONView & XML Tree are awesome. I also use Rapportive w/ Gmail.

Firefox: Firebug, YSlow & Web Developer toolbar for development. I also use ForecastFox for weather and occasionally S3Fox to check something on S3.

<comment><USER7> I tried Rapportive with Gmail... I wanted to love it, but I couldn't.

</comment></comment><comment><USER8> Adblock - After using it for a while, it becomes impossible to NOT use it, and still retain focus. Every page contains something that is fighting for your attention when it's not in use.

Firebug - Incredible client-side development tool.

Show anchors - Reveals anchors (<a> tag) in the page, making it easy to make more precise links into pages.

Tamper data - Makes it possible to modify browser requests before submitting them to the server. Great addition to Firebug as a development tool.

</comment><comment><USER9> I used to have a lot more extensions installed on Firefox, but right now all I actually use is:

AdBlock Plus, Download Statusbar, and Tab Scope.

Although one personal 'hack' almost counts: I moved the bookmark toolbar up next to the system menu, to use up all that space and give me quick access to all the sites I read. I have about 14 folders up there, and the Readability bookmarklet. I'm nervous about FF4 because I don't know where I'll be able to put my bookmarks...

</comment><comment><USER10> Chromium:

Adblock + Browser Button for Adblock (obvious...)

Chromium Wheel Smooth Scroller (similar to iPhone kinetic scrolling)

Google Mail Checker Plus (obvious)

Instachrome (integration with Instapaper)

iReader (similar to Safari Reader)

Pinboard Tools (integration with Pinboard bookmarks service)

Reader Plus (changes the default theme of Google Reader among other customizations)

Redgur (shows all imgur stored images present on a page)

RSS Subscription Extension (obvious)

Search Preview for Google (website previews on search results)

Send using Gmail (mail_to integration with Gmail)

Stylish (similar to Greasemonkey but for CSS styling)

<comment><USER11> FYI, Google Mail Checker Plus already includes mailto integration with Gmail.

<comment><USER10> Thanks for the info. Never even realized. :)

</comment></comment></comment><comment><USER12> Adblock

builtwith - tries to tell you what tech sites use under the hood

delicious bookmarkts - <USER2>

docs PDF/powerpoint viewer - opens PDF links with google docs viewer instead of adobe

eye dropper

goo.gl url shortener

gmail checker plus

ireader - reading format

lastpass

linkpush - saves link for opening on android (has an app on anroid you open to get that link)

measureit! - measure pixels between stuff

rss subscription extension - adds fireefox like detection for RSS feeeds

stayfocusd - 30 mins of HN/facebook etc a day

<comment><USER13> That last one is awesome -- thanks for pointing that out to me.

To add one I haven't seen on here yet, Switchy!, which lets you quickly switch proxy settings under Chrome. It supports SOCKSv5, which last I had checked before I started using it there was no easy way to do with Chrome.

</comment></comment><comment><USER14> I use several Firefox addons, most of them have been already mentioned. However, one of my favourite addons has not been mentioned:

Quieturl

This addon transforms urls that are plain text into clickable anchors. Very very handy, I couldn't browse without it now.

<comment><USER15> I use QuickDrag to do this and more:

      * Drag images to download them
      * Drag text urls to open in new tab
      * Drag text to search on google

Highly recommended.

<https://addons.mozilla.org/en-US/firefox/addon/6912/>

</comment></comment><comment><USER16> AdThwart (never fails) : [https://chrome.google.com/extensions/detail/cfhdojbkjhnklbpk...](https://chrome.google.com/extensions/detail/cfhdojbkjhnklbpkdaibdccddilifddb)

AutoPagerize (awesome) : [https://chrome.google.com/extensions/detail/igiofjhpmpihnifd...](https://chrome.google.com/extensions/detail/igiofjhpmpihnifddepnpngfjhkfenbp)

Google Translate (v handy) : [https://chrome.google.com/extensions/detail/aapbdbdomjkkjkao...](https://chrome.google.com/extensions/detail/aapbdbdomjkkjkaonfhkkikfgjllcleb)

Shareaholic (mainly for the instant short goo.gl urls) : [https://chrome.google.com/extensions/detail/aapbdbdomjkkjkao...](https://chrome.google.com/extensions/detail/aapbdbdomjkkjkaonfhkkikfgjllcleb)

Smooth Gestures (speeds things up) : [https://chrome.google.com/extensions/detail/lfkgmnnajiljnolc...](https://chrome.google.com/extensions/detail/lfkgmnnajiljnolcgolmmgnecgldgeld)

Smooth Scroll (easier on the eyes) : [https://chrome.google.com/extensions/detail/cccpiddacjljmfbb...](https://chrome.google.com/extensions/detail/cccpiddacjljmfbbgeimpelpndgpoknn)

These could all come standard in my view and most people would appreciate it.

<comment><USER17> FWIW, smooth scrolling is implemented (by default) in the lastest Windows dev channel build.

</comment></comment><comment><USER18> Chrome (main browser) Extensions:

* AdBlock

* Firebug Lite for Google Chrome

* Minimalistic Google Reader

* RSS Subscription Extension (by Google)

\--

Firefox (for development, where some extensions in Chrome aren't available) Add-Ons:

* Firebug

* JSONView

* Live HTTP Headers

* Modify Headers

* Page Speed

* User Agent Switcher

* Web Developer Toolbar

* YSlow

\--

I also have a folder of bookmarklets on my toolbar in Chrome:

* Google Analytics: Last Week

* Huffduffer: Add

* Instapaper: Add

* Pinboard: Add

* Twitter: Remove @mentions

* Readability

* Inject jQuery

</comment><comment><USER19> I forget what it is called, and am on my mobile now, but I use one which loads the next paginated page below the one you are viewing, so hacker news becomes one long page for me. only loads the next age when you get down the page. love it.

also one to tweet the page I am viewing. I use twitter as more of an annotated favorites/bookmark list than anything else: twitter.com/liamjford

<comment><USER14> I think you're talking about AutoPager, useful addon indeed.

<comment><USER4> Indeed, it's great. It just works on all sites with next/previous buttons.

</comment></comment></comment><comment><USER20> I think I'm the only person that doesn't use adblock.

Anyways on chrome: ireader, google reader "note in reader", hckr news (never noticed what it does though), and delicious. Using the dev channel build of chrome.

On FF: Treeview, someone on hn suggested it to me and I'm really hoping something similar comes to chrome. I'd use firefox more but still experience it memory leaking/crashing too much.

</comment><comment><USER21> Firefox:

Wappalyzer <http://wappalyzer.com>

Adlock Plus <http://adblockplus.org/en/>

Flashblock <http://flashblock.mozdev.org/>

NoScript <http://noscript.net/>

Firebug <http://getfirebug.com/>

</comment><comment><USER22> Firefox: \- Firebug (my life wouldn't be same (or sane) without it) \- Remove cookies for site (one click to remove all cookies for current domain, essential when developing cookie based sites) \- FireGestures (lets you go back, reload, close tabs, etc. by preconfigured right click gestures - <USER3> feature invented by Opera I believe, I can't browse without it) \- AdBlockPlus (I hate to admit this but a news site I visit frequently is so loaded with flash ads that my machine almost becomes unresponsive upon visiting)

Chrome: I try to find the same extensions as for Firefox but: \- Firebug lite was missing the "Net" panel last time I checked \- I haven't found a gestures addon that doesn't suck \- I haven't found a remove cookies for site add-on

So migrating to Chrome has been quite hard for me.

PS. Yes, I'm a web developer

</comment><comment><USER23> Firefox: Adblock, Flashblock, Leechblock, Firefox Sync, Tab Kit, Copy Plain Text.

Edit: oh, also Readability.

</comment><comment><USER24> NoScript, possibly the best thing about FF.

Firebug, pretty handy.

Tamper Data, for viewing HTTP headers and tampering with them.

ShowIP, shows the current website's IP.

leetkey, great for text transformations, various encoders/decoders.

Screengrab, for taking screenshots.

Scrapbook Plus, for archiving pages (can also do some light crawling with it)

Mozilla Archive Format, also for archiving pages.

Delicious Bookmarks, for bookmarks.

AppTab, to make tabs sticky.

OptimizeGoogle, to make Google searching better.

UnPlug, for downloading embedded content.

DownThemAll, for downloading things.

HTTPS-Everywhere, redirects to HTTPS versions of certain websites.

ErrorZilla Plus, makes error pages more useful.

Those are the best ones, I use various other extensions depending on what I'm doing. I have a few addons deactivated at any given time.

</comment><comment><USER25> Firefox:

Web Developer Toolbar, Firebug, DownThemAll!, ColorZilla

Frankly, all I ever use Firefox for anymore is testing/development and big or multifile downloads (DownThemAll! is kind enough to autosuspend and resume with the often wonky wifi I'm usually connected to).

Chrome:

Web Developer Toolbar, Readability, Flash Blocker

The version of the Web Developer Toolbar for Chrome is extremely limited, but it fills a few holes in the built-in developer tools. I'd love to have a download manager comparable to DownThemAll! for Firefox, but the Chrome API prevents most of the features I like from being implemented. Oh, well.

</comment><comment><USER26> I don't use Chrome (privacy issues), but for Firefox,

* Flashblock

* Greasemonkey

* Firebug

* It'sAllText (which allows the use of an external editor)

* A few mostly inconsequential ones, like IdentFavicon, etc.

I find that flashblock takes care of most of my ad-blocking needs, and the rest I can do with a local DNS server. The re-emergence of badly behaved Javascript (Remember when all we had to worry about was scrolling/blinking text and alert() boxes? Those were the days.) is what prompted me to install Greasemonkey; I've got a little script that wipes iframes and kills window.XMLHttpRequest, for example

<comment><USER27> > I don't use Chrome (privacy issues)

Which one? You do realize it's open source so if you found anything we're not aware of by looking at the code please do tell. Also do you own a mobile phone? Because if you care about privacy, a mobile phone is much worse than chrome.

<comment><USER28> Chromium is open source, Chrome includes Google's special sauce. Now, I don't think Google is abusing this privilege, but I just wanted to point out the difference.

Google is a company that makes money by knowing everything about people, and then presenting ads to them. A browser is a great way to be able to follow a user wherever they go, even after they leave Google's sites. I'm not the op, but I block google analytics for the same reason.

</comment></comment></comment><comment><USER29> I have a lot, but Ultimate Chrome Flag is my favorite.

The reason it's my favorite is because it displays in the URL bar the pagerank of the site I'm on. It's like an instant credibility check whenever I'm browsing or reading an article. In fact, browsing without it (say on my phone or in my newsreader) now feels like an incomplete experience.

My favorite extensions in Firefox are tied, Firebug and the Web Developer Toolbar. I'm sure if either got a full-fledged extension in Chrome, it'd probably be my new favorite extension.

<comment><USER16> Nice but where does it get the information? Is it anonymized?

There is no official PageRank lookup.

<comment><USER29> I wasn't sure where it got the PR (though I assume it's from one of the many 3rd-party services, since the PR is fairly well known). So I went digging. I found this in the extension source code:

      this.getQueryUrl=function(){
        var b = "http://toolbarqueries.google.com/search?client=navclient-auto&hl=en&ch="+getGoogleChecksum(this.domain)+"&ie=UTF-8&oe=UTF-8&features=Rank&q=info:http://"+this.domain;
      }

Also, this is what the extension says about privacy [1]:

 _This extensions's privacy policy is no different than WOT or any other service or extension that is designed to bring you information on the sites you are visiting. Example, when you search on Google, it will always track your IP. It doesn't access your private data. Chrome shows a warning for all extensions that access browser tabs._

[1] [https://chrome.google.com/extensions/detail/dbpojpfdiliekbbi...](https://chrome.google.com/extensions/detail/dbpojpfdiliekbbiplijcphappgcgjfn)

</comment></comment></comment><comment><USER30> Firefox.

It turned out I couldn't live without Ubiquity. Still under development, although officially it's on hiatus.

The Add-On Compatibility Reporter, so I can run edge versions of extensions.

Firemacs (for sensible Emacs bindings)

TabKit (tabs on left side and tree style, with grouping and so on) and Ctrl- Tab (LRU tab switching, plus thumbnailed tab display and switch to tab by name-typing). All other tab organization systems pale in comparison.

And the rest: NoScript * Firebug * Web Developer Toolbar * Greasemonkey * IETab * Vacuum Places DB _

<comment><USER31> What features of Ubiquity do you use the most?

<comment><USER30> I'm usually making my own commands. I'm often making extra search commands. I use some of the clever integrations with maps and mail as-is.

For me it's the right interface for all kinds of pages that I would have to surf to, find the box, then enter some input. Instead, I just highlight text, ctrl space, type a word, and hit enter.

<comment><USER31> I have something I'd like your feedback on. It'll only take about 5 minutes of your time. If it's not too much to ask, could you shoot me an e-mail?

</comment></comment></comment></comment><comment><USER32> Gmail Checker (Official one by Google)

Rapportive

Chrome 2 Phone

Google Voice

Lastpass

Google Reader

Craigslist Comprehensive Cleanup

Craigslist Preview

Facebook Photo Zoom

Extension Gallery Inspector (Invaluable if you want to know what an extension is going to do BEFORE you install)

TackyNotes (I should note that I don't really use this, I just have it installed because I wrote it. I suppose the fact that I don't use it is a good indicator of why I've lost interest in developing it. They say it's best to write software to fix a problem you have or someone else has and I think that kind of missed the mark.)

</comment><comment><USER33> Chrome dev channel:

AdBlock

Aviary Screen Capture

Awesome Screenshot - (to capture the whole page)

Better Facebook Fixer

Chromey Calculator

DayHiker - For Google calendar. Check schedule and tasks from toolbar.

Docs PDF/PowerPoint Viewer (by Google)

Forecastfox Weather

Gmail Notes (Beta) - Add notes to conversations in Gmail and save these notes to Google Docs.

Gmail StrikeThrough - Enable StrikeThrough in Gmail or Google Apps Mail.

Gmail Unread Message Count in Favicon

Google Calendar Dynamic Icon - Changes the number on the Google Calendar favicon to reflect the current date

Google Chrome to Phone Extension

Google Mail Checker Plus

Google Voice (by Google

Graph Your Inbox - Visualize your Gmail data.

Novell Moonlight

Rapportive - (Disabled)

Speed Dial

Tab Sugar

</comment><comment><USER34> Firefox: Firebug, Pagespeed for finding slowdowns in my pages. WebRank toolbar for when I'm too lazy to open Market Samurai.

Chrome: Eyedropper for stealing a color. Nofollow eyes to make sure my pages aren't wasting pagerank. SEOQuake for when I'm too lazy to open firefox/MS. Ultimate Chrome Flag. I like seeing ips/locations/etc. Chromed Bird for my twitter accounts that are for business.

</comment><comment><USER35> AdBlock, FlashBlock, Readability and Instapaper. The web is an obnoxious assault on the senses. There is some useful stuff in between all those flashing billboards and neon lights so I block all of the distractions that I can. I wish there was a SocialNewsBlock plugin to get rid of all of those damn buttons everyone puts on their sites, too.

<comment><USER36> I know Readability is a bookmarklet but your comment made me search the FF add-ons for a Readability add-on that was applied to every page I visit automatically.

That might be a nice hack.

<comment><USER35> There is a readability extensions[1], but I don't think it is any more useful than the bookmarklet.

1: [https://chrome.google.com/extensions/detail/jggheggpdocamnea...](https://chrome.google.com/extensions/detail/jggheggpdocamneaacmfoipeehedigia)

</comment></comment></comment><comment><USER37> On chrome i use:

* Notscript (blocks javascript, not as good as noscript for firefox but imho still good)

* Adblock

* Navigate on paste (load webpage with middle click on linux)

* Type ahead find (just start typing to search)

* android2cloud (send urls from your mobile phone to your browser)

For Firefox:

* TabMixPlus (Multiple rows for tabs)

* NoScript (JavaScript blocker)

* AdBlock Plus

* FoxyProxy (easy managable proxys)

* AutoAuth (automatically submits saved http basic authentication dialogs)

* Locationbar² (easy access to url segments)

* Firebug

<comment><USER38> > AutoAuth

Just wanted to say thanks; this is the first time I've ever seen one of my extensions listed in a "What extensions do you use?" discussion.

<comment><USER39> It's such a heady experience, isn't it?

</comment></comment></comment><comment><USER40> I use many of the ones people have mentioned here, but in Firefox. Can't switch to Chrome because it doesn't have a good implementation of two of my favorite add-ons:

Stumbleupon - for whenever I need a distraction that even HN can't fullfil

Colorzilla - For getting colors of web pages; use this about a dozen times a day

</comment><comment><USER41> Vimperator - make Firefox more like Vim

</comment><comment><USER42> Just the important ones:

BetterPrivacy (LSO Cookie Remover)

Firebug (+ Firecookie)

Hackbar

NoScript

Tree Style Tab

Web Developer Toolbar

All of which have no (satisfactory) Chrome equivalent and thus prevent me from switching ;)

<comment><USER43> I couldn't live without Tree Style Tabs, which is one of the main reasons I haven't switched to Chrome either.

I considered switching to Lunascape, which is a browser that will let you use webkit rendering and firefox plugins, but it's Windows only :(

<comment><USER44> _I couldn't live without Tree Style Tabs, which is one of the main reasons I haven't switched to Chrome either._

I'm in exactly the same situation - I literally cannot stand to use a browser without that extension anymore, especially on a widescreen computer. I've tried to move over to Chrome, but the lack of that extension is the single blocking issue for me.

Step one when I get a new computer is to install Firefox; step two is Tree Style Tabs. Anyone that hasn't tried it is really missing out...

</comment></comment></comment><comment><USER45> The only one I use that hasn't been mentioned here yet is Venkman (JavaScript Debugger) for FireFox.

</comment><comment><USER46> For Safari:

 _Gmail Checker_ \- Adds an icon to the toolbar with a badge of how many new emails I have.

 _Helvetify_ \- Forces Helvetica Neue as the font for all websites.

 _Facebook Photo Zoom_ \- Zooms photo thumbnails on Facebook so you don't have to reload the whole page when you want to see a photo.

</comment><comment><USER47> On Chrome:

Adblock, RSS Subscriber (puts an RSS icon on the location bar where relevant and allows you to subscribe to the feed).

I also wrote my own delicious extension to easily add bookmarks into delicious.

On Firefox: Firebug, Adblock

I basically only use firefox these days for debugging web apps.

</comment><comment><USER48> What is the FF extension called that lets you type to search the addons you have and also lets you see a text list of all the addons you have (enabled and disabled). I used to have it but I switched computers...

</comment><comment><USER49> Since I like a fast, non-cluttered, browser I have only one addon installed in Chrome. "No More Tabs" protects me of opening 40+ tabs and telling myself all the time "Don't close it, you might need it again!"

</comment><comment><USER50> Firebug

Greasemonkey

S3Fox

ColorZilla

DownloadHelper

Vacuum Places

... and a shameless plug for Compass, a Firefox/Chrome/Safari add-on I wrote that adds a "table of contents" to various e-commerce sites to help you find stuff faster. Search for "compass" on the various extension galleries if you're interested.

</comment><comment><USER51> AdBlock Plus, ColorfulTabs, Downthemall, FaviconizeTab, Favicon Picker 3, Greasemonkey, Greasefire, IdentFavicon (obviously, I am into icons), Quickpagezoom, TabRenamizer

</comment><comment><USER52> Different at work and at home. Of the ones not already mentioned here my favorite is Add Bookmark Here. Adds some very simple functionality that is sorely missing.

</comment><comment><USER53> AdBlock Plus and FlashBlock. Mostly to avoid distractions.

I also occasionally use Helvetireader: <http://helvetireader.com/>

</comment><comment><USER54> I use lasttab in Firefox to get LRU tab switching. Until chrome gets it (and don't make me change my ctrl-tab muscle memory) I'm not switching.

<comment><USER55> It irritates me no end that the Chrome developers refuse to implement this. (And yes, in googling around on the topic, I did come across a blog post by someone involved explaining that this is a design decision on their part and not an oversight.)

As a workaround, I'll open a subset of most active tabs in a second window. Tabs I am actively switching between as I'm doing my work.

Then, I'll end up closing the Windows in the wrong order and have the subset saved for restoration rather than the full set.

Please, Chrome devs, just make MRU tab switching an option, regardless of what you personally think about it. It is a common work occurrence to need to frequently switch between different pairs or small sets of tabs within a larger context of numerous references/tabs.

P.S. Extensions can't substitute the behavior, because a security measure -- so stated -- Chrome no longer allows browser default shortcut keys, e.g. Ctrl Tab, to be hooked and overridden.

P.P.S. I'd welcome suggestions for good substitutes that use a different key combination or another paradigm that's easy to tolerate.

<comment><USER56> Drag the different pairs of tabs together and use Ctrl-Tab + Shift-Ctrl-Tab to switch between them?

<comment><USER55> I suppose. But I often use the overall tab order to retain a sense of context of the different tabs.

</comment></comment></comment></comment><comment><USER57> Chromium:

After the Deadline - Version: 1.2 Check spelling, style, and grammar in your browser

Boomerang for GMail - Version: 0.5.0 Allows you to schedule messages to be sent or returned at a later date.

Chromed Bird - Version: 1.8.5 Chromed Bird is a Twitter extension that allows you to follow your timelines and interact with your Twitter account.

ChromeMilk - Version: 0.9.6 Access your Remember the Milk tasks right from your Google Chrome toolbar

Docs PDF/PowerPoint Viewer (by Google) - Version: 2 Automatically previews PDFs, PowerPoint presentations and other documents in Google Docs Viewer.

FastestChrome - Browse Faster - Version: 3.1.2 Save time and enhance your productivity! Get quick definitions, auto-load next pages, search faster, and more.

Google Calendar Checker (by Google) - Version: 1.0.3 Quickly see the time until your next meeting. Click the button to open your calendar.

Google SSL Web Search beta (by Google) - Version: 1.3 Use Google Web Search and Suggest protected by SSL.

Google SSL Webcache - 谷歌加密快照 - Version: 1.21

IE Tab Classic - Version: 0.9.5 Internet Explorer inside Chrome

Mini Google Maps - Version: 1.0.2 Google maps in a click away.

OmniTweet - Version: 10 An experimental minimalist Twitter Client for Google Chrome.

PostRank Extension - Version: 0.1.4 Filter your Google Reader inbox with PostRank to find and read what matters. Or enhance Digg, Reddit, & search with PostRank.

Rapportive - Version: 1.1.1 Making email a better place

Secbrowsing - plugin version checker - Version: 1.7 Periodically checks that all your plugins are up-to-date.

Secure Login Helper - Version: 1.2 Attempts to help you login to sites using SSL if possible.

Send using Gmail (no button) - Version: 1.11.4 Makes the Gmail webmail your default email application (original Google extension repackaged without toolbar button, safer links)

Sexy Undo Close Tab - Version: 6.17 Undo your closed tabs (cleaner version) + new features

Stop Autoplay for YouTube. - Version: 0.10.7.30 Stops YouTube autoplay but allows pre-buffering.

Unsubscribe for Gmail - Version: 0.34 Rid your inbox of unwanted email subscriptions with the click of a button!

WiseStamp - Email Signatures for GMail, Google Apps and more - Version: 184.108.40.206 Empower GMail, Google Mail & Google Apps emails with dynamic email signatures. Add Twitter, Facebook, Digg and more. Multiple HTML signatures support.

</comment><comment><USER58> Chrome: StayFocusd Awesome Screenshot Capture Rapportive

Firefox Firebug Tamper Data YSlow

Bookmarklets Delicious Zemanta Read Later (instapaper) bit.ly sidebar

</comment><comment><USER59> FireBug, Delicious, Tails Export and Operator mostly cause I make sites not so much as consume them...

</comment><comment><USER60> In alphabetical order:

BetterPrivacy, Certificate Patrol, Firebug, Flashblock, iMacros, Sage, Tamper Data

iMacros is particularly useful.

</comment><comment><USER61> Firefox: Vimperator, Xmarks, Zotero, Firebug, Rainbow, Speed Dial, Moonlight.

Chrome: Vimium, Web Developer Tools

</comment><comment><USER62> try [https://chrome.google.com/extensions/detail/gkjgmeeoldebbdoe...](https://chrome.google.com/extensions/detail/gkjgmeeoldebbdoehhngapnlfmdbmiie) TweetRight - a new chrome extension for twitter users.

</comment><comment><USER63> I keep it simple. Xmarks, adblock (adthwart on chrome), and sometimes greasemonkey.

</comment><comment><USER64> Chrome: Awesome Screenshot Google Voice Session Manager Stumbleupon Gmail Checker

</comment><comment><USER65> Firefox: Delicious Bookmarks, Autopager, Greasemonkey, FoxClocks

Chrome: Google Voice, Google Mail

</comment><comment><USER66> Chrome: Polyglot to help me learn hanzi, and ProxySwitchy to bypass the GFW

</comment><comment><USER67> hckrnews for Hacker news:

        * Highlight new comments in a thread.
        * Collapsible comments

<http://hckrnews.com/about.html>

</comment><comment><USER68> Firefox (stuff I haven't seen on here yet): * Ubiquity * Fox to Phone

</comment><comment><USER69> FireBug, AdBlock and sometimes NetVideoHunter to download videos.

</comment><comment><USER70> FireFTP for Firefox.

Chrome.... probably FireFTP if it ever exists for Chrome.

</comment><comment><USER71> Chrome: LastPass, Google Voice, Google send to phone.

</comment><comment><USER11> Chrome:

AdBlock

FlashBlock

Google Analytics Opt-out (not sure why :)

Google Mail Checker Plus

iReader

Modified keyboard navigation for Chrome

Rapportive

-

Firefox: FireBug, YSlow, Page Speed.

</comment><comment><USER72> Chrome:

AdBlock

BugMeNot Lite

FlashBlock

KB SSL Enforcer

LastPass

QR-Code Tag Extension

Readability Redux

Smooth Gestures

SmoothScroll

Vimium

Webpage Screenshot

Xmarks

\</comment><comment>----

Firefox:

Adblock Plus

Add to Search Bar

Combine Buttons

Firebug

FireGestures

Flashblock

FlashVideoReplacer

Greasemonkey

Hide Menubar

HTTPS-Everywhere (Development branch)

LastPass

Menu Editor

OptimizeGoogle

Organize Status Bar

QuickRestart

Screengrab

Stop-or-Reload Button

Stylish

Tab Mix Plus

Tabs on top

User Agent Switcher

Vimperator

</comment><comment><USER73> Safari:

Shortly

ClickToFlash

</comment><comment><USER74> also use

ghostery

</comment><comment><USER75> <https://chrome.google.com/extensions/list/popular>

Next question.

<comment><AUTHOR> I don't understand. You use all popular Chrome extension?

My intention is to find out the extensions that hackernewsers use, not the popular extensions. Of course there will always be some intersections, but I doubt everyone here uses all popular extensions, and I doubt no-one here uses some good but unknown, unpopular extensions.</comment></comment>


Spyware backdoor prompts Google to pull 500 apps with 100m downloads - <AUTHOR> https://arstechnica.com/information-technology/2017/08/500-google-play-apps-with-100-million-downloads-had-spyware-backdoor/ <comment><USER2> Of course all this spyware is evil and wrong.

But let's look at what the spyware does:

 _makes it easier for apps to connect to ad networks and deliver ads that are targeted to the specific interests of end users_

...

 _The most serious spyware installed on phones were packages that stole call histories, including the time a call was made, the number that placed the call, and whether the call went through. Other stolen data included GPS locations, lists of nearby Wi-Fi networks, and lists of installed apps._

How is any of that distinguishable from what Google/Android does routinely? The only difference is that some people trust Google and/or their phone manufacturer with this. We don't "trust" spyware.

<comment><USER3> Informed consent. The difference is a privacy policy that says they're doing it.

Users volunteer their call history to Google Voice to get call forwarding and visual voicemail. Users volunteer their GPS data to get crowd-sourced traffic information.

<comment><USER2> I want to quibble with "informed consent", which many people use to describe this situation.

Yes, there is a privacy policy, and companies like Apple and Google take that policy seriously.

But, question 100 random iOS or Android users and ask them if they use Apple Maps or Google Maps. Many/most will say "yes". Then ask them if they realize that their phone is uploading their GPS location in real time to Apple or Google, and probably 90% will say "no".

So I don't think there is "informed consent" for most consumers. It's more like "this works, I love it, I don't want to know how it works". Google and Apple make an attempt at informing people by having them click on various agreements that nobody reads, but I'd call the result of that more "indifference" than "informed consent". When is the last time you ever read any of those things you clicked thru? For me it's probably been decades, perhaps as far back as the 1980s.

Stuff like Google Voice is another thing entirely. It's not really a mainstream product, it's more for geeks. The types of people who use it are generally quite cool about giving Google their personal information.

</comment></comment></comment><comment><USER4> So no word on whether the spyware authors can be identified and if they'll be prosecuted? Only teenage hackers can get in trouble?

</comment><comment><USER5> Does anyone have the list of affected apps? It doesn't seem to be in the original blog post.</comment>


HTML5 massively multiplayer puzzle - <AUTHOR> http://muchmala.com/

<comment><USER2> When I opened it I found a mostly-completed puzzle (race car image) which I could make some progress on, but I also found at least 3 pieces which were exact duplicates of each other — one in the right place and locked, and one movable but obviously identical to the locked piece. I'm also pretty sure that there were some places whose fitting piece wasn't on the board at all. If this isn't on purpose as chaff, then the puzzle is unsolvable due to this bug.

</comment><comment><USER3> _We are experiencing technical issues._

And it says loading, but it must be using some miraculous transport since there are no packets coming to my machine.

</comment><comment><USER4> It's quite nice but i suggest you to put the not placed pieces in a separat frame or something because it' a bit confusing

<comment><USER5> I think it would make it more difficult to switch between the puzzle and the pieces because it's so large. The visibility would improve if the outline of the puzzle pieces were removed for those that are placed correctly-

What I am missing is a way to see the full picture. That would help place some of the more difficult pieces.</comment></comment>


Channelsurfing.net owner arrested for linking to sharing sites - <AUTHOR> http://act.demandprogress.org/act/channelsurfing/?referring_akid=329.23654.oWjuYc&source=typ-tw

<comment><USER2> Yet another example of why doing a startup that involves sharing content should seriously think of basing their business outside the US.

As JoeMullin says in the PaidContent article at [http://paidcontent.org/article/419-feds-campaign-against- pir...](http://paidcontent.org/article/419-feds-campaign-against-pirate- websites-leads-to-an-arrest/)

"The ICE campaign against websites has caused controversy over whether ICE has side-stepped due process. Compare the treatment of the creators of peer-to- peer sites that were ultimately ruled to be illegal, like Grokster and now Limewire. Entertainment companies had to engage in years of litigation to shut down those sites, and the idea of putting the creators of those sites in prison wasn't even on the table. McCarthy, on the other hand, will have to fight an uphill battle to keep himself out of prison—at no expense whatsoever to the sports leagues who, according to court documents, helped the government target his site. "

</comment><comment><USER3> FUD. "Share a youtube video. go to jail." That didn't happen, the individual in question _embedded_ copyrighted videos. He didn't just share links and he didn't just embed YouTube videos. On top of that nobody that has written about it seems to know exactly what he's being charged with so any conclusions about sharing a link to a website = ending up in jail is not substantiated. Yet someone went though all the effort to make some kind of reddit-worthy mob enraging site. Maybe if the author of demandprogress.org knows they should post the actual charges and some of the evidence and arguments. As it stands none of this seems conclusive or convincing for people who will require more than a big image of a clenched fist and large red type to get upset.

<comment><AUTHOR> There's definitely infringers in this story -- I just don't think it's him.

>That didn't happen, the individual in question embedded copyrighted videos

What's the difference between an embed and a link? It's just a semantic difference in the HTML, right? Both point to external media not hosted by him.

As I recall from what I've seen of his site, he simply embedded the justin.tv player on his pages (where he also placed ads). He would configure the justin.tv player to show various channels that he knew would be showing a particular game. Somebody else (or perhaps the same person, although if that's what the government is alleging, I haven't heard it), using a TV capture card, would encode the live video of some NCAA/NBA/NFL/whatever game and stream it to a justin.tv channel. Anyone could log into this channel via the regular justin.tv site and watch the same live video.

Channelsurfing.net just provided a quick link to a justin.tv channels that had the sports content.

So in all this, who's infringing copyright? Definitely the guy with the capture card. What about justin.tv? Maybe they're liable, or maybe they're protected by the safe haven clause. But someone linking to that content on justin.tv? No. Or even embedding the justin.tv player, pre-configured to show that particular justin.tv channel? Again, I don't think so.

<comment><USER4> Justin.tv is protected by the DMCA Service Provider exception b/c it did not actively filter content hosted on/through its servers. Channelsurfing.net did filter content -- indeed, it selected specific content for retransmission. That is why Justin.tv is not liable but the channelsurfing guy is.

As to why he's being charged with a crime...we'll find out when they release the charges against him. It may be as innocuous as tax evasion for not reporting the income from the ads on his site.

<comment><USER5> That's still a bit of a stretch. If I created a subreddit on reddit.com with nothing but links to justin.tv copyrighted content, who's liable then? I'm filtering content but I'm not hosting the content or even the links.

<comment><USER6> piguy314 posted a [dead] reply that shouldn't have been killed:

> 1 point by piguy314 3 hours ago | link [dead]

> Would your sub-reddit be a commercial enterprise who's sole source of > revenue was monetizing someone else's intellectual property illegally? Or > would your sub-reddit be a user-curated (not reddit curated) site that > engaged in substantial non-infringing uses subject to DMCA takedown rules... > Here is reddit's DMCA agent filing if you are interested > <http://www.copyright.gov/onlinesp/agents/a/advmp.pdf></comment></comment></comment></comment></comment>


XScreenSaver for iOS now available in the App Store - <AUTHOR> http://www.jwz.org/blog/2012/08/xscreensaver-for-ios-now-available-in-the-app-store/

<comment><USER2> Can't wait to hear the the rationalizations from all the people who backed up Apple on this one.</comment>


Good and Bad Technical Debt (and how TDD helps) (2013) - <AUTHOR> http://blog.crisp.se/2013/10/11/henrikkniberg/good-and-bad-technical-debt <comment><USER2> Nice article. I'm also a big fan of Acceptance Test-driven development. If anyone is interested in ATDD for web apps, they should check out Helium ([http://heliumhq.com](http://heliumhq.com)). (I'm one of the cofounders). It lets you write executable test scripts of the form

startChrome();

goTo("Google.com");

write("Helium");

press(ENTER);

click("Helium – Wikipedia");

assert Text("Helium is the second lightest element").exists();

This is Java, Python bindings are also available. Note how no reference to any HTML source code properties is required (thus the tests can be written in a TDD style, before the implementation).

I should also point out that Helium is a commercial product, so you (/ your company) has to pay to use it.

<comment><USER3> Does your product provide proper page objects? The way it's used in the examples (where the test specifies the direct page interactions) will quickly create difficult to maintain code. For example, [http://canvascode.wordpress.com/2013/11/20/maintainable- auto...](http://canvascode.wordpress.com/2013/11/20/maintainable-automated-ui- tests/)

<comment><USER2> Good question. The answer is no. You still need to write the page objects yourself. But it's much easier. Compare

driver.findElement(By.xpath("//input[@type='text' and @value='First Name']");

with

TextField("First Name");

Helium makes it much easier to identify the elements of the PageObject.

<comment><USER3> I just recommend instead using a custom data- attribute to identify your elements so you don't rely either on text, HTML structure, or CSS classes since all of those can change but may not affect functionality therefore should not break your test.

<comment><USER2> That's surely a good solution. It requires write access to the source code of the web application being automated though.

That's not to say that Helium is a silver bullet. It certainly always depends on the context. For instance, I know of a bank here in Austria that generates a lot of the Java source code for their internet banking app from an abstract model. They also generate page object code immediately from this abstract model, which is therefore always up to date and precise. This is one example where I would say using Helium would probably not pay off.

</comment></comment></comment></comment></comment><comment><USER4> There's a slightly different take on this that was presented last year at RailsConf

[http://confreaks.com/videos/2448-railsconf2013-of-buyers- and...](http://confreaks.com/videos/2448-railsconf2013-of-buyers-and-renters- and-keeping-a-roof-over-our-heads)

tl;dr: Different kinds of technical debt have different interest rates. Paying loan shark or credit card rates for a long time is bad. Paying mortgage rates is fine. Not having any technical debt means you over payed up-front.

<comment><USER5> That's probably about as true as saying "not having any financial debt means you overpayed up-front" \-- which is to say, yes, it's possible there's an opportunity cost which means you don't make an economic profit. But it seems to me this isn't always legible, and beyond that it's difficult to think of any situation in which it's more expensive to pay up front if you have the option.

A lot of times you _don 't_ have the option because your resources at hand are scarce compared to what you need/want to buy, so debt is part of the calculus of allocating your current and (hopefully) future resources. And that's fine. It seems to me that's different from saying "no debt means you overpaid up front."

Plus, that sounds like the kind of thing non-technical management might deploy to neutralize discussion without having to engage with the issues at hand.

<comment><USER6> If you over-engineer today and then fail tomorrow you'll lose a lot more out of pocket. If you build an MVP and then fail you'll lose a lot less. In the over-engineering scenario you will essentially have "overpaid upfront" when you do fail. The amount overpaid is relative to what you could have paid.

<comment><USER5> This strikes me as being a different problem that needs a different metaphor -- over _buying_ up front rather than overpaying. Or, as people sometimes say, scope creep.

</comment></comment></comment></comment><comment><USER7> These graphs are almost identical to the graphs of all too many Java generational garbage collection cycles I have seen in my life. Eden is the stupid stuff you do when figuring stuff out that hopefully never makes it into a commit unless shit gets crazy, survivor space makes it into a commit and maybe a release but hopefully gets cleaned up quickly, then once in a while you have a cleanup of the tenured generation.

This is when you eventually come back and do some bigger refactoring and cleanup to drop back down before you hit your ceiling. But you have to decide if you want to stop all other development while you do this, or if you can be smart and pull off tricks to coordinate doing the work while stuff still happens and/or parallelize it without having too much overhead. All without really knowing for sure where the ceiling is because other stuff is going on outside of your JVM.

If your major GCs can't successfully clean up your survivor space then you end up caught in a loop of endless GC attempts without making progress, looking for anything you can clean up or refactor to reduce TDD, with very little success. You start wondering if it is even possible or if you should just SIGKILL it all and start over.

Sadly, the TDD side of it doesn't fit into this analogy ... at least not yet. You could definitely work the dark side of TDD into this though... brittle, inflexible poorly factored tests that are in and of themselves technical debt and take up valuable memory you could be using to scrape by.

</comment><comment><USER8> Yep. Technical debt analogises to financial debt quite well. It's not as fungible, but similarly you can fall into debt, take on debt in a planned way, discover you're not as clever at managing it as you thought you were, etc.

I also highly recommend Denise from Dreamwidth's famous post on the subject, which is a great intro to the concept for not-so-technical people as well (it was written to explain to the user base what they'd been doing): [http://denise.dreamwidth.org/57248.html](http://denise.dreamwidth.org/57248.html)

</comment><comment><USER9> > All this begs the questions "yes, but How?".

No, it _raises_ the question.

Otherwise, a great article.</comment>