Can you buy your own train? - <AUTHOR> https://www.citylab.com/transportation/2019/03/private-rail-car-fan-owners-amtrak-cuts-trains-are-cool/584971/ <comment><USER2> One thing my late father wanted to do was start his own rail line, one without the track. When Oldsmobile closed there were suddenly a lot of executives in Lansing having to make the commute every day to downtown Detroit. My Dad located some combination train engine passenger integrated car units that had been in storage since the late sixties. He simply wanted to rent the track.

Even at a pokey 50-55 mph he could get to downtown Detroit 30-45 minutes faster than driving because of traffic congestion. He demonstrated that the demand was there. But sadly the railroads wouldn't even take a meeting.

<comment><USER3> I've always wished for a network of rail flatbed cars that make high-speed runs from state to state.

You could drive onto one of the flatbeds (from a ramp) in your car, then ride the train from center-of-a-state to center-of-the-next-state. After a brief layover (for cars to get off and new ones to get on) the train would depart for the next state.

It just seems like a decent way to enable medium-speed, long-distance travel. And wherver you went, you'd have your car when you arrived.

<comment><USER4> Are you familiar with the auto train? [https://m.amtrak.com/h5/r/www.amtrak.com/auto- train](https://m.amtrak.com/h5/r/www.amtrak.com/auto-train)

<comment><USER3> I hadn't seen that. Thanks!

</comment></comment></comment></comment><comment><USER5> The problem isn't having the train, it's having permission to use the rails.

Having worked at a railroad, I will say it's comically easy to steal a train, for instance. They all have the same key, which is basically just a plastic rod.

The argument of the railroads is... okay, you have our train. Now what? You either go forward or you go backward, and we know where both those directions go.

<comment><USER6> You can also go really fast and intentionally derail the train, which is both a monetary and (depending on where you can get to) a security concern, or crash into another train on the same tracks (possibly a passenger train).

<comment><USER7> Except that you don't control the signaling or the switching, meaning you can't choose where to go and you will very quickly be noticed and depending on the level of signaling automation either stopped completely or at least shunted to the place you can do least damage.

<comment><USER8> Are the switches protected any better than trains? Can't you just walk up to them at the right time and switch them manually with some standard tool?

<comment><USER9> [https://media.ccc.de/v/28c3-4799-de- can_trains_be_hacked](https://media.ccc.de/v/28c3-4799-de- can_trains_be_hacked)

edit: There's more!

[https://media.ccc.de/v/32c3-7490-the_great_train_cyber_robbe...](https://media.ccc.de/v/32c3-7490-the_great_train_cyber_robbery) (and this one has English)

</comment></comment></comment></comment></comment><comment><AUTHOR> Somebody should Airbnb this. Who wouldn't want the opportunity to cross the United States in their own personal rail car? No airports to deal with, no impersonal hotels. Sounds like a retirement dream.

<comment><USER10> How much are you willing to pay? There are (a very few) luxury train trips in Europe. Maybe $5-10K NY-SF or NY-SEA would cover it in the US? It's totally doable if there were a market; basically upscale the long-haul Amtrak routes with higher-end accommodations and food. The evidence suggests there's not the demand.

<comment><USER11> I think it's partially a chicken-or-the-egg problem. Honestly, I didn't even know these private rail cars existed until this article. I feel like if the Kardashians took a cross-country tour in one of these things and Instagrammed it that it would be all the rage.

<comment><USER10> You need a critical mass of volume though. You can get pretty nice suites on Amtrak today on the long-haul routes. It's admittedly not luxury in the sense of really first-class food and everyone dressing up but probably a nice slow travel experience so long as you don't care too much about arriving as scheduled. I'm not convinced there's that big a market for don't care about cost + don't care about time.

</comment></comment></comment></comment><comment><USER12> These "extreme railfans" occasionally make the already atrocious Amtrak service unbearable for the rest of us. Case in point: we once tried to take the Coast Starlight from Oakland to Los Angeles. The train was delayed out of Oakland by more than 3 hours, and into LA by about 5 hours (the difference between a 7 PM arrival and a midnight arrival). The crew had to change in an unexpected location, and conductors left the train unstaffed toward the end of the route.

The train had had two extra private cars tucked on to the end of it in Portland. When we looked at this particular train's schedule, we found that it started to fall behind schedule when it stopped to hook up those private cars (conductors confirmed this to us). That schedule gap started at 2 hours and grew to 5.

I know I'll never ride that Amtrak route again, and this experience soured me on all of Amtrak in general (except maybe for the NW Corridor - I know it's run differently).

We took the trip before the March 2018 memo that the article quotes: "These operations caused significant operational distraction, failed to capture fully allocated profitable margins, and sometimes delayed our paying customers on our scheduled trains ... one-time trips and charters are immediately discontinued." To us, that's too little too late, Amtrak's brand is ruined.

<comment><USER13> Clearly you had a bad experience, but considering that Amtrak obviously kept an eye on the issue, determined a fix and resolved it to make sure it doesn't happen again -- wouldn't that make you _more_ likely to take Amtrak in the future? Not all companies are as pro-active about fixing problems.

Just not sure why their brand would be ruined considering the one issue you had with the service was proactively resolved.

</comment></comment><comment><USER14> The one thing I've concluded about being in tech is that if I get rich, I need to put a model train line on my retirement property. But unlike everyone that gets 1/8 or 1/6 scale, I want to commission a 2 scale train.

<comment><USER15> Meaning twice as big as an ordinary train?

<comment><USER14> Exactly. I think it's a hilarious concept that deserves to exist somewhere.

<comment><USER16> Forces me to start thinking about what "model" means in "model train"... Would a 1-scale train be a "model"?

<comment><USER17> It's a purely semantic argument, but I think if it can perform the function of the original, it's no longer a model.

</comment></comment></comment></comment></comment><comment><USER18> I looked into this a few years ago and found that it would cost about $350k to get started. It did look promising, and I read through all of the regulations and inspection certifications required, the requirements from Amtrak, and decided I just couldn't do it. It was a fun fantasy for a few months though.

Autonomous luxury RVs will fill a bit of this niche, and at a much lower cost.

<comment><USER19> Zeppelins.

<comment><USER20> Just have to make sure to fill up on helium, not hydrogen.

<comment><USER21> After a century of better engineering, can't we make hydrogen bags that can contain leaks and flames better?

<comment><USER22> Is there even the appetite to try, from a PR perspective?

</comment></comment></comment></comment></comment><comment><USER23> In the gilded age owning your own rail car was like owning your own private jet. A lot of moguls owned one or more. Rockefeller was too cheap to buy one, but one of the railroads gave him one to curry favour with him. THAT is power.

</comment><comment><USER24> > "I'm not in this business to make money off of it," says Lowe, a 33-year > veteran of the airline industry. Some trips he has taken, he says, have cost > him more money than the dollars spent on tickets by passengers in the Amtrak > trains his cars are hitched to at the end.

It costs him more than the entire train of passengers? $3.67/mile is insane.

<comment><USER25> $3.67 per mile is just the "cost of gas". I bet he has to pay to get the train from storage to the spot where they'd pick it up, do the same on the other end to come back home, and do it again to get back to his parking spot.

</comment></comment><comment><USER26> There was even a hackathon on Prague (Czechia) - Kosice (Slovakia) train a few years back. It's quite easy (but not very common, for sure) and not so expensive to rent a car or a whole train in CZ (from the train companies). There are also some historical trains for rent (run by enthusiasts, usually).

<comment><USER27> There's also the yearly Tweakers Express from Amsterdam (NL) to Cologne / Köln (DE) [https://www.youtube.com/watch?v=vkOFnvxkZLc](https://www.youtube.com/watch?v=vkOFnvxkZLc)

<comment><USER28> >Tweakers Express

That has a very, very, different connotation in American English.

It sounds like the name the scrap yard gives to the regular who always shows up towing doubles with a minivan.

</comment></comment></comment><comment><USER29> This really seems like an intriguing hobby. I'm honestly somewhat shocked this is a service that Amtrak offers at all.

<comment><USER30> Another interesting service Amtrak offers is its relatively low-cast shipping. If you're willing to bring your boxed stuff to the station, and pick it up on the other end.

[https://www.amtrak.com/express-shipping](https://www.amtrak.com/express- shipping)

There's a 500-lb limit on each shipment, between more than 100 cities. An option for those not in a hurry, or who want to avoid driving the stuff.

<comment><USER31> Huh. Looks interesting, but there are some odd limits. The 3 feet by 3 feet by 3 feet seems unusually restrictive, but I suppose if you can palletize the shipment then you get 60" x 48" x 60" (1.5m x 1.2m x 1.5m).

The main restrictive thing, to me, is the list of prohibited items. Everything from stamps to watches to poles, perishables, office equipment (calculators, computers, printers, telephones...), medicine, liquids, furniture, mattresses, appliances, electronic equipment of any kind (explicitly mentioning TVs, radios, stereos...) engines, motorized vehicles, fragile articles... the list goes on.

I literally can't think of anything that would fit those requirements that would be large or heavy enough to need to be moved by Amtrak.

</comment></comment></comment><comment><USER32> The problem with buying your own train is that you don't own the rails that you are dependent on. At least in Europe you have to submit a letter to an agency and request timeslot reservations some time in advance if you want to go for a ride.

<comment><USER33> From the article, it looks like the American way is to own a carriage or two, and attach them to a passing Amtrak passenger train. This is disruptive to Amtrak's passengers (!).

The European way is much less disruptive (the private train will fit in around whatever is already scheduled), though having to rent or own a locomotive and driver in addition to the carriage must be significantly more expensive.

I don't know about elsewhere, but in Britain there are fairly regular trips by private steam trains, or other old trains. A relative used to take these trips every few months.

People who aren't interested in the train itself can just rent an ordinary, modern train. Again in Britain, this happens for cases like a large group of football supporters (probably in the official fan club) who need to travel a long way for a match. Presumably, this isn't much different to hiring a bus with a driver.

<comment><USER34> The problem is in America we don't have open access to the tracks.

They are all owned by different railroads vs the UK were they're all owned by one (formerly government) organization.

Here in the US, even if you could rent a locomotive and crew, you'd have to get permission from each individual railroad whose tracks you wanted to cross.

</comment></comment></comment><comment><USER35> One of those things on my bucket list, to ride across the country in my own rail car.

Reading the article and how dependent the whole thing is on Amtrak though makes me wonder if we're talking to the wrong railroad. The freight folks have a better system for building custom consists and sending them around the country.

<comment><USER36> The problem with hooking up to freight trains are numerous. First, the ride is bumpy. Freight trains add/remove cars throughout the journey, which generates large bumps.

More troublesome, though, are freight rail yards. They don't have potable water hookups, wastewater disposal, or other passenger amenities. And they are notoriously dangerous at night. Drifters, break ins, no lighting... it's no place for your family to sleep. Plus they are located on the outskirts of town, making disembarking difficult. Passenger rail yards accommodate for all of these issues.

</comment></comment><comment><USER37> Travel like the Queen: [https://en.wikipedia.org/wiki/British_Royal_Train](https://en.wikipedia.org/wiki/British_Royal_Train)

</comment><comment><USER22> In the UK, there's a privately-owned steam train that runs on the National Rail network. It was built from scratch starting in the 90s and completed around 2008. You can read about the history of the project here [https://www.a1steam.com](https://www.a1steam.com)

The aspect of it that I found most interesting is how they solved engineering and manufacturing problems. These issues were commonplace in the heyday of steam, but few-to-no companies have the capacity or skills to complete them in the modern day.

It fun imagining what the equivalent will be for our generation. An iPhone which no-one knows how, or has the capacity, to recreate in less than 100 years!?

Edit: spelling

</comment><comment><USER27> This reminds me of a story about the philosopher Wittgenstein missing the train and deciding to buy a train for himself instead.

Googling the story does not turn up many results. Does anyone know if this is in fact true?

<comment><USER38> Googling "Wittgenstein missing train" returned me page 44 of "Ludwig Wittgenstein" by Edward Kanterian from "Critical Lives" series, which attributes this story to David Pinsent's diaries, but talks about "hiring entire train" instead of buying it:

[https://books.google.ru/books?id=yfeJH-1KcD8C&pg=PA44&lpg=PA...](https://books.google.ru/books?id=yfeJH-1KcD8C&pg=PA44&lpg=PA44&dq=Wittgenstein+missing+a+train&source=bl&ots=XLPJ7lT8xc&sig=ACfU3U0qkKZVxNSFomfE1gE10mYfvvupQA&hl=ru&sa=X&ved=2ahUKEwiFsv_LsKPhAhURs4sKHb2aBc4Q6AEwDHoECAcQAQ#v=onepage&q=Wittgenstein%20missing%20a%20train&f=false)

Bing returned this HN thread and a link to the relevant part of Wikipedia article where this is also stated and "Portraits of Wittgenstein, Extracts from the Diary of David Pinsent 1912–1914" are referenced:

[https://en.wikipedia.org/wiki/Ludwig_Wittgenstein#Sexual_ori...](https://en.wikipedia.org/wiki/Ludwig_Wittgenstein#Sexual_orientation_and_relationship_with_David_Pinsent)

</comment></comment><comment><USER39> There's a private car club that does daily runs on one of the commuter rails lines in Chicago. I used to see it from time to time when my commute took my over the line it's on.

</comment><comment><USER40> >$3.67 per mile

Well _there 's_ your problem. Raise the price! You'd think a senior fellow at the _Cato Institute_ of all places would have thought of that.

<comment><USER41> You can't expect that raising prices is going to cut it as Amtrak is very inefficient like many, if not most, state-owned companies [that even receive subsidies], though.

</comment></comment><comment><USER42> "Trains not boats" \- my new startup mantra

</comment><comment><USER43> So can't a private railroad company build new tracks? For instance we know that traffic is bound by a interstate highway to get from City A to City B. It clogs with traffic due to a aging bridge and losing lanes.

Can my railroad company, acquire all the land necessary to build a station on both sides and track between them and then start to fan out from there?

Besides the property owners who can stop me?

<comment><USER44> Getting mostly straight line access between A and B is going to be amazingly difficult, and more so as you get closer and the property owners get more and more stubborn, because you're invested. 99% of a rail route isn't very useful, and doing a jog around a stubborn parcel owner isn't very possible.

Realistically, you need eminent domain, a frontier environment, or a super motivated population.

</comment></comment><comment><USER16> > For this, they pay Amtrak $3.67 per mile

That seems too cheap. For many routes and cars, if you even half-fill the car, you're paying less per person than you would for an ordinary ticket on that route.

</comment><comment><USER45> So as I understand it Amtrak doesn't own the track. Could these owners not negotiate access with the track owners? They could use vintage engines also, if that's their thing.

<comment><USER46> I'm sure there are some sort of rules on mixed consists of freight and passenger, the freight railroads also wouldn't have access arrangements to use station facilities. If you're talking about buying a locomotive and running a completely private consist, that would work, but you would have to start your own private railroad company, get FRA certified crew, and satisfy the Class I host railroads that your company was able to follow their rulebooks and not be more trouble than you're worth to their traffic.

It's probably doable though, there are some very short Class 3s with only a few employees that use small portions of Class I tracks and yards.

<comment><USER47> > I'm sure there are some sort of rules on mixed consists of freight and > passenger

It could work if you are willing to travel slowly. Freight trains don't travel very fast (25/mpg ish), while Amtrak tries to go in 50/mph ish range.

This causes them a lot of scheduling trouble.

But if you are willing to travel at the same speed as freight it would be a lot easier to accommodate.

<comment><USER48> Passenger trains tend to travel faster than freight, true. But 25 MPH? No. Not on major lines, anyway.

You can probably find statistics that give you a number that low (or even lower), but I think they include dwell time in yards, not just road time.

<comment><USER47> I sat in one that got stuck behind freight traffic (according to the announcement).

25 MPH is what I remember, with short bursts of faster speed.

It was much faster before we got stuck behind the freight.

PS. The statistics I found actually said current average is 20!!

</comment></comment></comment></comment></comment><comment><USER28> Well that sure makes my pneumatic tired hobby seem financially sound.

</comment><comment><USER49> "Lokomotywa z ogłoszenia" :)

</comment><comment><USER50> The WSJ had a recent article about how sleeper trains are making a comeback (might be paywalled):

[https://www.wsj.com/articles/dream-vacations-the-new-age- of-...](https://www.wsj.com/articles/dream-vacations-the-new-age-of-sleeper- trains-11553255489)?

</comment><comment><USER51> I have a difficult time caring about the demise of a hobby for the obscenely rich.</comment>


Google Glass developers: We're still flying half-blind - <AUTHOR> http://news.cnet.com/8301-1023_3-57613489-93/google-glass-developers-were-still-flying-half-blind/ <comment><USER2> What's new? Console manufacturers have been doing this forever. As an example, when working on an [intended] Kinect launch game, my studio routinely liaised with other studios to discuss how best to implement X feature and Y feature because Microsoft simply refused to release any details. We strongly suspected it was because they themselves weren't even sure!

Anyway, is this even a bad thing? Presumably - hopefully - Google will take the natural groove that developers have found themselves in and use that to design the APIs that are missing/coming. It's not like the product is even close to being on the shelves.

<comment><USER3> That's what happens when you're working on a product that is, for all intents and purposes, still in alpha status nevermind beta. Google can't offer guidance because the API and best practices haven't been nailed down yet.

You can't even argue that Google perhaps debuted Glass too early, because it's still an invite-only device. It's the chicken-egg problem with bootstrapping a new device ecosystem. Google needs testers and developers to finish the product, but testers and developers need a finished product to work with.

</comment></comment><comment><USER4> From the article, a quote trying to justify facial recognition apps:

 _" What I'm most fundamentally interested in is this idea of maximizing human potential," she said. "We could do expression recognition, and use it to teach autistic children how to recognize expressions." Another helpful scenario she described for facial recognition would be to help Alzheimer's patients remember people that they know they ought to recognize, but have forgotten."_

Yeah, sure, I'm all for helping autistic children, but it's pretty damned obvious that non-invasive non-troubling uses of facial recognition on Glass are going to be the edge case rather than the rule.

</comment><comment><USER5> I feel like Google is missing its window of opportunity here, about one year ago there was a massive hype surrounding the Google Glass (from my perspective at least). And then nothing, a bunch of people got their hands on them and after the initial feedback, nothing.

The last time I heard about Glass was because someone got fined for driving while wearing them in California sometime last month.

<comment><USER6> That's partly how they bungled Wave, IMO. Too much hype too early.

But in this case, all they need to do is announce a price, release date, and all the improvements that the consumer version will have, and people will be interested. As long as there's no direct competition, the opportunity remains.

</comment></comment><comment><USER7> I do have access to glass, but I'm not going to hack on it at the office and the price tag is just too steep for me to justify taking a pair home to hack on in my free time (especially with their lack of prescription support). That seems to be where they're falling flat, it's too early to base a business or startup after and it's too expensive to get the enthusiast/hacker support they seem to be expecting.

Also, I really wish they weren't so strict with their facial recognition ban. I'm useless in social situations because I'm terrible with faces (if I see someone out of the context I met them I will not recognize them). For someone like me, even if it was restricted to my own personal database and required approval of the person I was interacting with (NFC or BLE touch for instance), it would heavily level the social playing field.

<comment><USER8> The face recognition thing actually makes sense since the camera quality isn't that great and it's fixed focus. You'd have to get unreasonably close to someone to actually get it to work. I've tried, it just needs time for the privacy/UX issues to be resolved.</comment></comment>


Tmuxp – Manage tmux workspaces through Python objects - <AUTHOR> http://tmuxp.readthedocs.org

<comment><USER2> Related is Tmuxinator[0] of which I've been a big fan.

Looks like tmuxp gives pythonistas a more robust interface [1], although I'm not sure I'll ever need to unit test tmux configs.

[0]: [https://github.com/aziz/tmuxinator](https://github.com/aziz/tmuxinator)

[1]: [http://tmuxp.readthedocs.org/en/latest/about.html#difference...](http://tmuxp.readthedocs.org/en/latest/about.html#differences- from-tmuxinator-teamocil)

</comment><comment><USER3> Could anybody comment on the practical difference between tmux and using a tiling wm?

<comment><USER4> 1) Your work will survive the need to restart your WM, or X itself. Pretend for a moment that you run NVidia drivers, which kill X hard, and you're dumped to GDM or similar with no warning. Your state is preserved.

2) Your work/state can be remotely accessed, assuming e.g. you work primarily on a desktop, and you wish to go home, and pick up where you left off, via VPN.

<comment><USER5> You can also use it to run things like a daemon. For instance rtorrent does not have a daemon mode because you can use screen or tmux to "hide" it by running it in tmux and then detaching. You can then re-attach to the processes to interact with them later. You could probably do this with tags in a tiling WM. I like to do this with rtorrent and pianobar (command line www.pandora.com client).

</comment></comment></comment><comment><USER6> Why should I use tmux over screen?

<comment><USER7> 𝗩𝗶𝗱𝗲𝗼:

• [http://www.youtube.com/watch?v=QxTse5Elq8s](http://www.youtube.com/watch?v=QxTse5Elq8s) ❝Screen vs. tmux faceoff❞ (Jon Jensen, 2012 UTOSC)

𝗥𝗲𝗮𝗱𝗶𝗻𝗴𝘀:

• [http://tmux.cvs.sourceforge.net/viewvc/tmux/tmux/FAQ](http://tmux.cvs.sourceforge.net/viewvc/tmux/tmux/FAQ) (Notably, the section entitled ❝How is tmux different from GNU screen?❞ at the top.)

• [http://unix.stackexchange.com/questions/549/tmux-vs-gnu- scre...](http://unix.stackexchange.com/questions/549/tmux-vs-gnu-screen)

• [http://www.wikivs.com/wiki/Screen_vs_tmux](http://www.wikivs.com/wiki/Screen_vs_tmux) (Incomplete and lacking, but leaving this link here anyway.)</comment></comment>


"Here's my private key, try stealing my Ether!" – blockd's marketing stunt - <AUTHOR> https://blog.cotten.io/heres-my-private-key-try-stealing-my-ether-he-dared-reddit-19ef4526721c <comment><USER2> In not an expert, but the analoguy that came to mind seemed worth sharing.

It sounds like a gas fee can be reframed as a "bribe" in this case, for your security, and if the attacker paid a higher "bribe", well...

And since the gas fee apparently goes to the remote miners, it sounds like you are otherwise bribing the network for your own security, hoping to not have your bribe beaten? Maybe the attacker can't know what your gas fee was, but the article outlined a possible DoS attack in which, in a span of 15 seconds, they could (incrementally?) surpass your gas fee without knowing what it is.

Am I seeing this wrong? Something about this approach doesn't sit well with me.</comment>


Numbers don't lie–it's time to build your own router - <AUTHOR> http://arstechnica.com/gadgets/2016/01/numbers-dont-lie-its-time-to-build-your-own-router/ <comment><USER2> The one killer feature his proposed solution doesn't have that everything else does-wireless. You have to buy additional equipment (a standalone WAP, or if you want to get really daring, a PCI/USB wifi card) to make it have something every home router has already.

</comment><comment><USER3> I got excited when he mentioned "old-school"... then he said Ubuntu. Give me a break. The only thing old-school about this is his wired-only design.</comment>


Ask HN: Im a noob at marketing,what are some good resources to bump up downloads - <AUTHOR> <comment><USER2> I can recommend you to join [http://thecmoclub.com/](http://thecmoclub.com/) marketing community. This is a perfect place for those who are interested in the marketing industry through collaboration of leading marketing officers.

</comment><comment><USER3> Assume your talking downloads of an app in app store?

<comment><AUTHOR> Yeah for both, iOS & Android</comment></comment>


Ask HN: Are Branches (SVN/Git) Evil? - <AUTHOR>

Recently, I had a discussion with two colleagues (who are far more experienced than I am and whom I respect a great deal). The topic of the discussion was Branching Strategies and when to use them. They made the argument that good developers do not need branches, if I recall correctly the statement they made was "If you need branches, your development process is broken."
Their reasoning for this statement is that all code changes can be made in small increments and be done in such a way to preserve existing behaviour while allowing new development to occur. This can be achieved in a number of ways, for example if/else statements where the else branch contains the new feature but is not executed (except when the dev changes the expression to return false). By this line of reasoning, it follows that any new or dev commits which lower the quality or reliability of the code will be in some code-path which is deactivated and so they won't actually lower the quality.
In summary, my argument for branching was you can use branches to help to ensure release quality (ie: have branches for master, release and development) by segregating changes in SCM according to whether they are under active development, ready for release or currently in production. Their counter argument was that ALL changes in SCM should be production-quality and be ready to release at any second (and if not, you should change your dev process).
What do you think HN, are branches indicative of a "broken development process"? <comment><USER2> Simple answer, no.

If you're using if/else all over the place instead of a branch, what's to stop you from forgetting to remove one when you decide your new work is 'production ready'?

At the easiest level, I'd suggest using branches for new development. Bug fixes, new features, etc. Keep the work small; branches are cheap. Once its reviewed or tested merge it back into the master branch. This way 'in development' and 'complete' are abstracted to a level above code.

Also, imagine your project has 30 developers, or more. Would the strategy of if/else everywhere still work well?

<comment><AUTHOR> Thanks a lot for this answer. Good point about keeping the branches small and about having only two.

The team I work on is quite small, so I can see how not using branches can work. I've worked on larger teams and I can't imagine how we would have managed those changes without an excellent branching model (git-flow).

<comment><USER2> And that's the other thing: use what works for your team. If you have an idea on how to make it better, try it. If something isn't working well, change it.

</comment></comment></comment><comment><AUTHOR> I thought I'd throw and update on this.

[http://martinfowler.com/bliki/FeatureBranch.html](http://martinfowler.com/bliki/FeatureBranch.html)

After reading this article, I now realise why having only one branch is desirable for a small team using CI. The development style should use things like feature toggles to ensure that code paths are not activated.

Branching, as I've thought of it, relies on the SCM to segregate features instead of developing robust and modular features that can be swapped in/out willy nilly.

</comment><comment><USER3> With svn, maybe. With git, pretty much everything _is_ a branch.

<comment><AUTHOR> I do miss git -- for exactly this reason ;)</comment></comment>


Show HN: H4X – protecting your private parts - <AUTHOR> https://medium.com/tidefoundation/protect-your-private-parts-4f7c6102171a <comment><USER2> funky encryption tech! ShamirSS SHA2 Argon2 elGamal and lots more!</comment>


The Invasion of Poland Was the First Battle of World War Two in Europe - <AUTHOR> https://en.historylapse.org/invasion-of-poland <comment><USER2> The real, but forgotten, start of WW2 was the Japanese invasion of China in 1937. The Chinese then held off the Japanese for eight years till September 1945.

<comment><AUTHOR> you are correct, that's why the title of the post mentions Europe. we also cover the japanese invasion of China here: [https://en.historylapse.org/japanese-invasion-of-china- durin...](https://en.historylapse.org/japanese-invasion-of-china-during-the- second-sino-japanese-war), [https://en.historylapse.org/china-defensive-war- against-japa...](https://en.historylapse.org/china-defensive-war-against- japan-resisting-alone), [https://en.historylapse.org/second-sino-japanese-war- a-war-o...](https://en.historylapse.org/second-sino-japanese-war-a-war-of- alliance) and here [https://en.historylapse.org/japan's-defeat-in-the-second- sin...](https://en.historylapse.org/japan's-defeat-in-the-second-sino- japanese-war)

</comment></comment><comment><USER3> What about the invasion to Czechoslovakia?</comment>


Ask HN: I can't tell why my site is showing malware warning. - <AUTHOR>

UPDATE: we took down our site for now. Thanks all.
UPDATE: STAY AWAY FROM OUR SITE, it seems like it's compromised for real (even though all the official signs point to the opposite). I have asked WPEngine to turn it off  immediately.
----
Hello HN, I hope there's some googler here who can help me.
My website http://balsamiq.com has started showing a malware warning in Chrome (and intermittently in Firefox as well) about 20 minutes ago.
The interesting thing is that the Google Diagnostics page here: http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http%3A%2F%2Fbalsamiq.com%2F&client=googlechrome&hl=en-US says we're clean.
Also, Google Webmaster tools says we're clean as well, so there's no way to request a review for them.
Also, http://www.stopbadware.org/home/reportsearch doesn't show anything for balsamiq.com.
OK so if my site is clean, which I think/hope it is, why it showing the warning and what can I do about it?
Sorry if this is not really "news" but I hope there's someone here who has had this issue before... <comment><USER2> Hi

I work at Google helping webmasters. Hopefully there won't be a next time, but for reference, your best bet is to post in our forum specifically about this type of issue: [http://www.google.com/support/forum/p/Webmasters/label?lid=2...](http://www.google.com/support/forum/p/Webmasters/label?lid=2fe2a8ee8e37c08e&hl=en)

For your specific case, unfortunately it can be anything. Start at the HTML and JS and see if it's different in ways you don't expect. Check for obfuscation techniques like base64 encoded PHP code, or JS code in libraries that is not in the original distribution. It really can be anything. Also check your .htaccess, any CMS and its plugins, etc. Really check everything.

That should identify the issue. Once you do, fix it, and try to understand why it happened. Was your FTP password compromised? Was it a known vulnerability in your CMS? Was it a rogue plugin you installed by mistake? Identifying the attack vector is very important as you will need to close it too. Otherwise all your hard work fixing the site will be undone in no time.

Also be sure to check any other parts of your site: the attacker might have entered through one CMS (say a forum) and compromised another (say a blog).

That's basically a summary of what you need to be doing. We have a very detailed guide about dealing with hacked sites: [http://www.google.com/support/webmasters/bin/answer.py?answe...](http://www.google.com/support/webmasters/bin/answer.py?answer=163634) . It recommends quarantining the site and returning HTTP 503. That's a very good first step.

And if you need more help, seriously, the forum I linked to above has a great community that knows a lot about identifying and fixing these issues.

Hope this helps, Pierre

<comment><AUTHOR> Hello Pierre, thanks for chiming in, I appreciate it.

So it appears that we were in fact compromised. The problem is that the Webmaster tools didn't show this until a good 30 minutes after the browsers started complaining. How can this be? Now I feel terrible for posting this in the first place, I would hate to compromise anyone! :(

<comment><USER3> As soon as we detect malware, that info starts getting sent to various places (e.g. the safe browsing lists that browsers use). But the data can take a while to get everywhere; in this case, it sounds like it made it to browsers a little before webmaster tools. That's unfortunate, but in general we wouldn't want to hold off showing the info in the browsers for any reason, because more users would be infected.

It's a pain to get hacked, but on the bright side it will probably help you harden security in the longer run. Some quick, simple tricks (e.g. use an .htaccess file to make a whitelist of IP addresses that can access your /wp- admin/ directory) can give a lot of protection.

<comment><AUTHOR> Wow a reply from Matt Cutts himself! _blushes_ :)

Thanks for the explanation, and it makes sense. One thing I would suggest is to update the docs to point this out!

"Please trust the warning over what Webmaster tools says as they might take a while to update".

Love the idea of the .htaccess for /wp-admin/, I'll make sure the WPEngine guys implement that for our site.

So sorry for this whole hoopla everyone, and thanks for the help.

<comment><USER3> Happy to try to help, and good point about whether we should update the docs.

P.S. This incident aside, nice job on the site--bootstrapping is cool, and I like the idea of lo-fi mockups that are quick and easy to make.

</comment></comment></comment></comment></comment><comment><USER4> Peldi, something similar to this happened to me for a number of years (I've run my own WP site for 6 years now); every 3 months or so, no matter what I did to lock the site down it would get reinfected with malware.

It got so frustrating that I toyed with just taking the site down permanently a few times because I couldn't handle the maintenance burden psychologically (it was such a downer to be fighting the same fight every few months for 2 years).

BUT, I finally found out what had happened, apparently there are some f-ing ingenious ways people can hide hacks in your WordPress site.

I outlined all of my steps here: [http://www.thebuzzmedia.com/finding-and- removing-hidden-word...](http://www.thebuzzmedia.com/finding-and-removing- hidden-wordpress-hacks/)

The basic trick boils down to uploading a fake HTML or image file that is actually a PHP script that hides in your server folder and is executed by the running process every few weeks which then infects all the other files (adding in JS headers or footers to every template file).

 _Another_ nasty trick is to use the same mis-named file uploaded into your /uploads directly, but to register it as one of your WordPress plugins. So if you search the WP database plugin table for non-PHP extensions you might find a "plugin" registered as "/uploads/2011/06/profile.jpg" when in reality it is a PHP file and not an image that WordPress is executing.

The blog post outlines how to find and remove them, I'd also recommend against running WordPress with permissions that don't allow _writing_ except for the /uploads directory.

This means no more automatic updates inside of WordPress, you'll have to do them yourself (same for plugins) but it also means no more hacks getting through and writing themselves to your DB or file system. They can even upload themselves but then cannot effect the system in anyway because the executing process has no write perms.

It has just been a lot easier for me to run in that fashion and keep everything up to date manually.

Hope that helps!

</comment><comment><USER3> Sorry to hear that you got infected. You're getting good advice from pierrefar and others here, but here's one other tip: once you get your site back up, you can doublecheck that you're not infected by using the "Fetch as Googlebot" feature in Google's free webmaster console.

When you use Fetch as Googlebot, we actually send a crawler to your site, fetch the page you request, and then show you exactly what Googlebot saw. It's an extra way to tell if you've gotten rid of the hacked junk.

</comment><comment><USER5> FWIW, I just visited your site and it contained some compressed JavaScript at the top and a broken link to http: // gsdgsd.freewww.biz/showthread.php?t=72881717 (slightly obfuscated to avoid accidential clicks). It was gone after a reload, so I can't give you any more information.

<comment><AUTHOR> wow this is definitely a hint. The WPEngine guys are looking into it now.

<comment><USER6> Happened to seven WP sites I maintain. It's a script and someone got into an account. The script finds all .php and .htm files and adds stuff to the top. If you only have wordpress files, it's an easy fix - reset the password and get a different template.

<comment><USER7> What does the attack do for those who visited the site trying to figure out what was going on?

<comment><USER5> The malicious script only inserted an iframe with a broken link, so I wouldn't worry to much.

<comment><USER3> I would still worry a bit. Some hackers will show a broken link if you're accessing a page directly with no referrers, for example. But if you come in with a referrer or from a search engine, then they might return the malware payload.

If a site was showing up recently in our malware list, it's practically certain that an actual user downloaded malware via the site.

</comment></comment></comment></comment></comment></comment><comment><USER8> Chrome uses a bloom filter[1] to check a URL against a list of known malware sites. It's possible your URL, by coincidence, has become a false positive.

However the article also mentions that once found in the bloom hashes, Chrome checks in with HQ if the URL is malware or not, probably to avoid false positives. Maybe these servers are down, and Chrome by default marks all (false) positives as malware without checking with HQ.

Keep in mind that this is the web security's equivalent of saying "my program doesn't work because there's a bug a in the compiler", it should be pretty low on the probability list.

[1]: [http://blog.alexyakunin.com/2010/03/nice-bloom-filter- applic...](http://blog.alexyakunin.com/2010/03/nice-bloom-filter- application.html)

<comment><USER9> Firefox uses a filter that doesn't give false positives [1]. If your site is blocked (even intermittently) there, it is in Google's malware list.

[1] Actually, the odds are 1 in 2^128 if Google's servers are up, and 2^32 if Google's servers are down.

</comment></comment><comment><USER10> The only part that is relevant to you is the last part:

"In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message."

So maybe you sourced some external javascript or advertising that contained something bad.

Edit: what does that obfuscated code at the top of the html do? <http://pastebin.com/u3T3wJcG>

Edit2: I think it's a bit irresponsible to post a page that has been marked as containing malware to a highly trafficked website. You could have at least run it through some alternative scanners first.

<comment><AUTHOR> We are asking WPEngine to turn off our server immediately.

</comment></comment><comment><AUTHOR> Hello everyone. Our site is back, clean and the malware warnings are gone. The guys at WPEngine.com dealt with this very quickly and professionally today, you should check them out.

I wrote a little status update here if you're interested: <http://pastebin.com/V3jwaL1Q>

On one hand I feel bad for posting this and possibly infecting people as a result. On the other we now all have a wonderful collection of tips for securing Wordpress websites. This community is _truly_ valuable. Thanks all.

Peldi

<comment><USER3> Glad to hear the malware warnings are already gone--thanks for providing an update!

</comment></comment><comment><USER11> Overwrite core WordPress files first. Run WordPress Exploit Scanner to root out anything in the database, and WordPress File Monitor as a tripwire going forward.

<http://wordpress.org/extend/plugins/exploit-scanner/>

<http://wordpress.org/extend/plugins/wordpress-file-monitor/>

That's what I did when I had this same issue happen to me on my WP installs (yeah, the same hole infected other sites on the server). These plugins showed me what files on my server had be changed and where the offending code was.

How old is your WP install? The hole could actually be in a plugin you are using. That was the case with me.

Also, TimThumb.php was recently in the news as having a security hole in it.

For good measure, here is the Hardening Wordpress article from WP: <http://codex.wordpress.org/Hardening_WordPress>

</comment><comment><USER12> I used to see this type of problem at Google.

Your site may have been hacked. Check the site:balsamiq.com search for injected hacked pages. Check also for injected text being hidden by CSS, and try if you can to view your site through a proxy like HideMyAss, to see if they are showing you one version of the page and showing users a different one.

Also, if Google knows your site's hacked, there should be a message inside the Webmaster Tools account for balsamiq.com - check there for more information.

<comment><AUTHOR> That's the thing, Google Webmaster tools says we're all OK! Maybe it just takes a while to notice internally?

<comment><AUTHOR> Update: Webmaster tools finally woke up and is reporting malware. I guess I should have just waited 30 minutes???? How can their outside systems be updated but not the admin pages they send me to in order to fix the issue? Grrr...

</comment></comment></comment><comment><USER13> Co-founder of WordPress here -- since no one has mentioned it yet: I would highly recommend VaultPress, it's designed exactly to protect against this sort of thing.

</comment><comment><AUTHOR> Update: the site is cleaned up and back up, we're just waiting for Google review.

</comment><comment><USER14> Do you run a Wordpress Blog? Is it up to date? There was a big "Hack" going around last month on the wordpress platform.

<comment><AUTHOR> Yes it's Wordpress, managed by WPEngine and updated (we're on 3.2.1 right now). The guys at WPEngine are looking into it, waiting for info from them as well (I'll report back here).

<comment><USER15> Like nodata said, you might want to take a look at third-party plugins / add- ons. My friend had an issue with using a third-party advertising company to run adverts on his site and firefox / chrome flagged the JS it embedded as malicious.

</comment></comment></comment><comment><USER16> FWIW The sophos anti-virus I'm forced to use at work says this is the problem:

[http://www.sophos.com/en-us//threat-center/threat- analyses/v...](http://www.sophos.com/en-us//threat-center/threat- analyses/viruses-and-spyware/Mal~HTMLGen-A.aspx)

It's probably wrong though!

</comment><comment><USER17> You could also use <http://sitecheck.sucuri.net> .

However, since the site is now disabled, it won't find anything...

*note that we see this type of malware on sites with vulnerable plugins or using that uploadify script.

thanks,

</comment><comment><USER18> What we have been seeing that web-malware that appears intermittently, only appearing to certain browsers and not appearing twice in a row to the same browser/IP, is usually pushed in via a FTP credential compromise.

The code often resides in template file, in config files and/or sometimes is also put into the database.

We've seen a lot of these kind of "intermittent" malware through the recent timthumb attacks on WP sites:<http://www.stopthehacker.com/2011/08/30/timthumb-malware/>

You've already got a lot of good information from the other responders, so I will not repeat the obvious, but great, points. Change password, check plugins..

</comment><comment><USER19> Maldet is an awesome open-source linux program that searches a directory for malware _signatures_. <http://www.rfxn.com/projects/linux-malware-detect/>

I've used it dozens of times successfully, and with WordPress sites, it's usually a PHP backdoor uploaded into wp-content/uploads, and then compressed JS added into a file somewhere. Run it with -a.

Good luck!

</comment><comment><USER20> Run this just in case (free) <http://www.qualys.com/forms/trials/stopmalware/>

<comment><USER20> to the person who downvoted me, why is running this or sucuri scanner a bad idea or bad advice when you suspect malware in your site?

<comment><USER21> Because it didnt find anything, while there were positive useful suggestions, and sightings of malware by actually visiting the site. What value is a link to a service that doesn't work?

</comment></comment></comment><comment><USER22> Can you share what the nature of the malware was?

I've updated my Balsamiq Mockups desktop app at around 10 hrs ago and now am concerned whether malware might have tagged along.

If the site is clean now, should I get a fresh copy?

</comment><comment><USER23> You should check out CodeGuard[1]. It is a great tool for issues just like this.

[1] <https://www.codeguard.com/>

</comment><comment><USER24> Also try masking your user agent as google bot. In the past i've seen people mask the results for google bots to build backlinks.

</comment><comment><USER25> Rename your wp-admin. Its a known target.

</comment><comment><USER26> You could run these commands on regular basis

grep -R "document.write(unescape" * > js_malware.txt

grep -iR --include " _.php" "[a-zA-Z0-9\/\\+]\\{255,\\}"_ > php_malware.txt

Once the commands complete, examine the .txt files and see if any files are compromised.</comment>


OpenStreetMap plugin for Unreal Engine 4 - <AUTHOR> https://github.com/ue4plugins/StreetMap <comment><USER2> And thus we get VR games like Slenderman stalking you, on the streets of your home town! Or GTA 6 - Your City. ARK or Day Z, but set in actual Detroit. Oh, what amazing gaming possibilities this unlocks.

And hopefully, self driving cars and quadcopters and other drone robots can use a 3d model of a city, to better navigate the real world. How about teaching a self driving car, with the GTA 6 - Your City game?

<comment><USER3> GTA My City would be an awesome game!

<comment><USER4> There were a handful of driving games set in real cities back when GTA 3 came out, but they died because real cities aren't designed for fun game play. It's interesting for like 5 minutes but then you start looking for something to actually do.

</comment></comment></comment><comment><USER5> The export function on osm.org is a pretty expensive operation on the live database and not the best way to download OSM XML data for most people. If you're looking for a city-sized extract, [https://mapzen.com/data/metro- extracts/](https://mapzen.com/data/metro-extracts/) is a good source. They have pre-built ones for commonly requested areas, or you can select your own bounding box.

<comment><USER6> There's also the continent/country/state level extracts on Geofabrik: [http://download.geofabrik.de/](http://download.geofabrik.de/)

Or you can use osmosis to cut a file down to any arbitrary area: [https://wiki.openstreetmap.org/wiki/Osmosis](https://wiki.openstreetmap.org/wiki/Osmosis)

</comment></comment><comment><USER7> That will be doable soon for Flightgear. It already supports OSGEarth:

[http://wiki.flightgear.org/Building_FlightGear_with_osgEarth...](http://wiki.flightgear.org/Building_FlightGear_with_osgEarth_Integration)

[https://www.youtube.com/watch?v=oe0kHoEtvYA](https://www.youtube.com/watch?v=oe0kHoEtvYA)

</comment><comment><USER8> Reminds me about this: SuperTuxKart

SuperTuxKart is a free, open-source racing game. This page is about generating 3D levels for the game, using OpenStreetMap data.

[http://wiki.openstreetmap.org/wiki/SuperTuxKart](http://wiki.openstreetmap.org/wiki/SuperTuxKart)

[https://youtu.be/smf9OCVzwMo?t=1212](https://youtu.be/smf9OCVzwMo?t=1212)

<comment><USER9> Mother of god, I _need_ to be able to race in STK in my area. I could race to a new destination before driving there, to ensure I don't get lost; kinda like that feature in Google Earth.

</comment></comment><comment><USER10> Before people get all excited: OpenStreetMap barely contains any 3D data. You can get a layout, and guess the height of the houses, if not tagged/stored in OSM, and they usually are not.

<comment><USER11> So OSM doesn't have much 3D data _now_ but I wonder if maybe that'll change if this sorta thing takes off. If the interface for contributing 3D data (terrain and buildings, say) is well done, and plugins and libraries start to get support then we could see some of the larger cities filling out pretty quickly.

<comment><USER12> There isn't really support for terrain in OSM. But there probably shouldn't be, there's not really any good way to collect a little bit of elevation data.

<comment><USER13> For what it's worth, most GPS chips report elevation (however accurate or inaccurate that may be). It could be as "simple" as using the elevation data in the existing traces, assuming they didn't strip that or fail to save it.

Then again, for common elevation data, there are loads of other good sources which can be used in conjunction with OSM, not sure about licensing though.

<comment><USER14> The problem with elevations from GPS chips are that they are ellipsoidal heights, that is the height from the surface of the ellipsoid used to model the earth. This can be very far from the elevation referred from mean sea level. I think SRTM is still the best way to get elevation data as mentioned by other commenters.

<comment><USER13> That explains a lot! After looking at some traces I started to suspect the same. I guess I should've RTFM.

</comment></comment></comment></comment></comment></comment><comment><USER15> > Keep in mind that many locations may have limited information about building > geometry. In particular, the heights of buildings may be missing or > incorrect in many cities.

How do they figure out the building heights at all then?

<comment><USER16> High-resolution LiDAR and IFSAR. You can download some US elevation data for free from the USGS[1], other countries may have similar datasets available.

[1]: [https://viewer.nationalmap.gov/basic/?basemap=b1&category=ne...](https://viewer.nationalmap.gov/basic/?basemap=b1&category=ned,nedsrc&title=3DEP%20View)

<comment><USER17> Australia has a high res lidar available for free, about 300gb, I've been wanting to import it into blender but need a new hdd/more space to do it.

I think the data was found here [http://www.ga.gov.au/scientific- topics/national-location-inf...](http://www.ga.gov.au/scientific- topics/national-location-information/digital-elevation-data)

<comment><USER18> [http://elevation.fsdf.org.au/](http://elevation.fsdf.org.au/) is starting to get data from LIDAR on a more local level, NSW/Sydney has some point cloud data up (presumably not just elevation but buildings/man made structures?) with more coming online every month until July 2018

</comment></comment></comment></comment><comment><USER19> Looks cool to me. A Quake/Unreal-like 3D-game, with realworld maps, could be cool :)

</comment><comment><USER20> Would assets built upon the exported XML be considered an "adapted database" in the license terms?

<comment><USER21> The decision for the OSM license switch was a questionable one. If you're in the US, the (federal) copyright statutes contain no sui generis provisions for databases. I.e., there is effectively on copyright protection for the kinds of things you'll be pulling from OSM, so long as you can guarantee that the data you're pulling is limited to the attributes that wouldn't meet the threshold for creativity. This includes all the boring but most useful stuff: coordinates, dimensions, building height, street layout.

This is not legal advice.

<comment><USER22> The Open Database Licence (as used by OSM) is expressly a contract as well as a copyright and database rights licence, so it applies in the US even when copyright doesn't. (I'm choosing not to pronounce here on whether applying copyleft/share-alike to geodata is a good idea...)

<comment><USER23> IANAL, but seems doubtful that they can enforce that contract; some servers (that the OSM project links to) don't even mention it when you download the files, let alone require an explicit mark of your agreement.

Copyright is different, in the sense that in the absence of a license, the default terms in the law actually prohibit one from copying stuff, hence one can't claim ignorance.

<comment><USER22> Enforceability of clickwrap is a long-disputed topic. But I think it's fair to say that anyone who intentionally disrespects the wishes of the volunteers who are providing them with the best source of free geodata in the world is a first-rate idiot.

</comment></comment></comment></comment></comment><comment><USER24> Does UE4 support paging landscape?

<comment><USER25> Yes, a UE4 world can be divided into a grid and the engine will manage loading/unloading areas as necessary. There's a caveat with this however, as each segment is effectively a separate level so you have basically no choice but to import your terrain as a chunked hieghtmap instead of using the terrain tool as meshes can't span multiple levels.

</comment></comment><comment><USER26> We are doing something like this for hackerexperience.com :) hope to see more games with real world interaction!

</comment><comment><USER27> I would love to try this on for size just as a desktop application for practical puposes. Would be nicer under a freely licensed engine though.

</comment><comment><USER28> The next installment of XCOM is going to be sweet!

</comment><comment><USER29> Any similar thing for Valve Counter Strike engine (whatever it is)?

<comment><USER30> That's the Source engine. As far as I know it's not open source. It's a very heavily modified quake 3 engine if I remember correctly, so you could get the open source ioquake3 (or with media, since ioquake3 is just the source code without any game sprites/sounds/etc.: Open Arena) and work in there.

</comment></comment><comment><USER31> Start the countdown to moral panic about the opensource first-person shooter that is set in Washington DC, NYC, or Chicago, and which is contributing to gun violence.

</comment><comment><USER32> _Unreal_ Engine 4, not Unread.

<comment><USER33> I was really excited, sounded so promising :)

</comment></comment><comment><USER34> Have any example renders?

<comment><USER35> Here's a brief flyover and zoom out of Brooklyn:

[https://twitter.com/mike_fricker/status/809221803931484161](https://twitter.com/mike_fricker/status/809221803931484161)</comment></comment>


How Rust 1.26 more than tripled the speed of my code - <AUTHOR> http://troubles.md/posts/the-power-of-compilers/ <comment><USER2> The code in the blog post does not match what is actually benchmarked. The reason `u256_full_mul` is so much faster than the inline assembly version is that it omits the upper part of the result, due to how the benchmark is done (cf. [https://github.com/paritytech/bigint/blob/44a3133030306d9fcc...](https://github.com/paritytech/bigint/blob/44a3133030306d9fcc9865b2e8e8368f6992cc98/benches/bigint.rs#L114-L115)). There should be 16 full 64x64->128 multiplications (unless you're doing Karatsuba, which is not the case here) in a full 256-bit multiplication, but I only count 6 in the benchmark's inner loop (plus 4 64x64->64 multiplications). No wonder it's faster.

The disassembly for the Rust output of `u256_full_mul` at the end is also terrible, and it looks like the output of a debug build. There's no reason an optimizing compiler should be outputting `pushfd` and `popfd` in performant code. The benchmarked loop does not have those instructions.

<comment><USER3> PUSH/POPF* instructions push the flags register to save comparison results when you need to reuse the registers containing the original comparison arguments. They're well-pipelined, integrated with the stack engine and very fast on modern CPUs, and I've definitely seen the compiler emit them (more on i686 than x86_64 to be fair).

I won't speak to the quality of the generated code otherwise, but this bit of evidence by itself doesn't seem persuasive.

( _edit: pbsd is right: per Agner Fog, these guys are slow. It 's likely that the L/SAHF trick is the one I was remembering._)

<comment><USER2> Where are you getting that from? `pushfd` is OK-ish, but `popfd` is microcoded, requires 9 uops, and can only be issued once every ~20 cycles. That's not what I would call well-pipelined.

You could probably achieve the same result (assuming you want to avoid adc instructions, for some reason) by using setc r8 plus shr r8, 1 to get the carry back.

<comment><AUTHOR> If you use `-C target-cpu=native` (Rust's equivalent of `-march=native`) you get code that uses `mulxq` in order to avoid `pushf`/`popf`. [https://gist.github.com/Vurich/5cb83c773e90fc7a463ccb58e1dad...](https://gist.github.com/Vurich/5cb83c773e90fc7a463ccb58e1dad4e3)

<comment><USER2> It's still doing it, but now it uses `lahf` + `sahf` instead to (re)store the flags. These are better than pushf + popf for sure, but they cannot be used in general code because some early x86_64 chips forgot to implement them.

<comment><USER4> If your general code is only intended to be used on newer versions of Windows, you can. Windows has required it since 8.1.

</comment></comment></comment></comment></comment></comment><comment><USER5> The behavior with "m" is quite strange. In theory, it should produce a memory operand pointing directly to where the function argument was passed on the stack, rather than copying it to registers and then back onto the stack. I can reproduce this with Rust nightly:

[https://play.rust-lang.org/?version=nightly&mode=release](https://play.rust- lang.org/?version=nightly&mode=release)

However, Clang appears to do the right thing with equivalent C code:

[https://godbolt.org/g/B1sjfS](https://godbolt.org/g/B1sjfS)

This is strange because Rust and Clang both use LLVM for their backend.

Looking at the LLVM IR produced, Rust's IR straightforwardly corresponds to the source code: a load instruction (to evaluate `self_t[0]`) whose result is passed to an asm instruction:

        %0 = getelementptr inbounds %U256, %U256* %self, i64 0, i32 0, i64 0
        %1 = load i64, i64* %0, align 8
        tail call void asm sideeffect "mulq $0", "m,~{dirflag},~{fpsr},~{flags}"(i64 %1) #1, !srcloc !0

But Clang's omits the load, and transforms the "m" constraint to "* m" (without the space, bah HN formatting):

        %2 = getelementptr inbounds %struct.U256, %struct.U256* %0, i64 0, i32 0, i64 0, !dbg !24
        call void asm sideeffect "mulq $0", "*m,~{dirflag},~{fpsr},~{flags}"(i64* nonnull %2) #2, !dbg !26, !srcloc !27

Hmm… seems to be related to this Rust bug: [https://github.com/rust- lang/rust/issues/16383](https://github.com/rust-lang/rust/issues/16383)

</comment><comment><USER6> > especially since the original code used highly-optimised assembly > incantations from our resident cycle wizard.

He/she might be cool, but I think someone familiar with assembly optimisation would think to look at the generated assembly as well, after noticing the speedup is not what you expect. Don't go hand-writing assembly routines thinking your code is fast without actually checking whether your code is fast. :)

<comment><AUTHOR> They're certainly familiar with assembly itself, but the `asm!` macro and the related constructs in Clang/GCC is its own beast and has a lot of footguns (like GCC allocating registers as overlapping by default). I don't begrudge them writing suboptimal assembly, since it already beat our Rust implementation by a significant margin.

</comment></comment><comment><USER7> Are you sure those are missed optimization opportunities where llvm copied values to registers as temporary storage instead of a direct copy to the destination register? I saw use of the temporary registers below the lines in question. Perhaps it was just a cheap copy of the value to a register which will be used later because the original destination register was clobbered.

Also I would hazard a guess that pushing flag state into a register is a lot faster than the stack.

Finally, it'd be interesting to see the original hand-rolled inline assembly used with "r" instead of "m" to see how llvm stacks up against the intended version without the redundant memory load/stores.

<comment><AUTHOR> Great catch, you're absolutely right. LLVM is smarter than me once again.

</comment></comment><comment><USER8> "decreased the execution time by a factor of 3"

So article is about a flew in previous versions of Rust not supporting 128-bit numbers on x86_64. But title makes it sound like "switching to Rust was the breakthrough". Or am i paranoid about it..

<comment><USER9> The original title is the more precise "How a Rust upgrade more than tripled the speed of my code". Also I think mentioning the version made it clear that it's about a specific version, not about rust in general.

<comment><USER10> Maybe they should change it to: "How an upgrade to Rust 1.26 more than tripled the speed of my code"

</comment></comment></comment><comment><USER11> Happy to see alternative language features reducing the need for inline assembly, not just with the 128-bit integer support in 1.26 but also with the stable SIMD support coming in 1.27 (so crates like [https://users.rust- lang.org/t/jetscii-now-works-with-future-...](https://users.rust- lang.org/t/jetscii-now-works-with-future-stable-rust-1-27-0/17426) can at last work on stable). Sadly the current implementation of inline assembly is so inextricably tied to LLVM that there's resistance to stabilizing it in its current form, though in this case I think the perfect is being allowed to be the enemy of the good^W good-enough^W janky-but-acceptable.

</comment><comment><USER12> There's a proposal to introduce a double wide mul which should make this much more ergonomical to solve.

[https://github.com/rust-lang/rfcs/pull/2417](https://github.com/rust- lang/rfcs/pull/2417)

</comment><comment><USER13> What other factors played a role in your decision to use rust over other languages when 128bit arithmetic played such an important role you wrote inline assembly for it?

<comment><USER14> What other languages are sensible options for when you need to work with inline assembly?

<comment><USER15> From just reading the discussion so far, I'd like to see how a naive implementation in Julia would do (Julia does type inference, and some quick duck-duck-ing indicates that unsigned 128 bit int is the biggest regular number type - before having to go to bigint).

[ed: ok, from a skim, I see this is actually about 256bit multiplication - which makes me curious how just using bigints and * (mul operator) would work in Julia.

Also, I don't get this:

> u256_mul multiplies two 256-bit numbers to get a 256-bit result (in Rust, we > just create a 512-bit result and then throw away the top half but in > assembly we have a seperate implementation)

How do they know the result will fit in 256 bits? Sounds like they know more about the arguments than both having to be 256 bits long?

Or do they want multiply and shift?]

<comment><USER16> Julia has `widemul` which takes two `Int64` and produces an `Int128`. It is also not to hard to actually add your own primitive type for `Int256` (with the caveat that it needs support from LLVM, which I haven't checked)

</comment></comment></comment></comment><comment> Const-me Their assembly implementation can be improved, at least when targeting modern hardware.

Here's an article explaining how to use new instructions to implement large integers multiplication: [http://www.intel.com/content/dam/www/public/us/en/documents/...](http://www.intel.com/content/dam/www/public/us/en/documents/white- papers/ia-large-integer-arithmetic-paper.pdf)

<comment><AUTHOR> If you use Rust's equivalent of `-march=native` you get faster code that can target modern hardware. We would have to get another factor-of-two speedup for the maintainance burden of using inline assembly to be worthwhile.

[https://gist.github.com/Vurich/5cb83c773e90fc7a463ccb58e1dad...](https://gist.github.com/Vurich/5cb83c773e90fc7a463ccb58e1dad4e3)

</comment></comment><comment><USER17> >"When Rust does a * b when a and b are both u64 the CPU actually multiplies them to create a 128-bit result and then Rust just throws away the upper 64 bits."

Is that right? Wouldn't that answer look like nonsense? I would have guessed it tossed the lower 64bits so it looked like rounding by truncation at least.

<comment><USER5> By the way, it's only on x86-64 that the CPU's multiplication instruction _always_ returns both the upper and lower 64 bits (in two different registers).

On, say, ARM64, there are two separate instructions: MUL is the normal one that takes two 64-bit inputs and produces one 64-bit output (the lower half of the product), while UMULH ("Unsigned Multiply High") performs the same multiplication but gives you only the upper half. This way, in the common case where you don't care about the upper half, the CPU doesn't have to waste time calculating it.

<comment><USER18> I wouldn't say that it's only x86. MIPS does the same thing, but doesn't even stick the result in the GPRs, you issue a multiply, and the result ends up in the hi and lo registers that you have to mfhi and mflo to move back into GPRs.

<comment><USER5> Oh, good point, I've seen that before but forgot about it. Though to be fair, that's 32x32->64, not 64x64->128 :)

<comment><USER18> The combined HI and LO are 64x64->128 on Mips64. You just have to use dmult instead of mult.

</comment></comment></comment></comment></comment><comment><USER19> Could this be compared with C/gcc and C++/g++? Because this is what Rust is aiming to displace.

<comment><USER20> Sure; this is exposing LLVM's support, so it should be the same as clang.

</comment></comment><comment><USER21> * compared to Rust 1.25

<comment><USER22> An unnecessary distinction as it can quite be easily inferred from the current title. Despite this there seem to be a lot of people nitpicking on semantics of the title in this thread. It's unnecessary noise and detracts (and distracts) from the real conversation.

<comment><USER23> It's not just this thread. HN is absolutely obsessed with nitpicking titles and yes, it's distracting and detracts from actual discussion of the topics.

The moderation team here tacitly encourages it by catering to it. I've seen some threads go through 2 or 3 title changes as people find something new to complain about.

Really it's almost a form of editorializing in itself - the title of the article is what it is, people here just think they know better than the author.</comment></comment></comment>


Vanity - an Experiment Driven Development framework for Rails - <AUTHOR> http://github.com/assaf/vanity

<comment><USER2> This looks cool, but I have one question: what is the source of the Ruby 1.9 dependency? I'd love to use this on a couple apps I host at Heroku, but they're on 1.8.6.

</comment><comment><USER3> I dig it. Nice work on the logging/reporting. One preference: I'd like the alternatives to be blocks to execute, not just simple variable options.

</comment><comment><USER4> What is the advantage over google website optimizer?

<comment><AUTHOR> Some good comments here (<http://apps.ycombinator.com/item?id=812764>) about GWO versus more specific A/B testing tools.

The linked comment was by Patio11 (<http://apps.ycombinator.com/user?id=patio11>), who also has an A/B testing framework for Rails that's worth mentioning (<http://www.bingocardcreator.com/abingo>). I don't know how ABingo and Vanity compare.</comment></comment>


Why Django Sucks, Except When It Doesn't - <AUTHOR> http://coffeeonthekeyboard.com/why-django-sucks-except-when-it-doesnt-664/ <comment><USER2> 99% of the time, for 99% of web apps, the benefits of doing things the "right" way are just never going to show up. Start with the easy, fast way.

-Perfect. Django gives you tons of Batteries and support - which is by far the fastest way to launch the MVP.

I would also like to add - we can never solve everyone's problem!</comment>


Viva Chile They Left No Man Behind. - <AUTHOR> http://online.wsj.com/article/SB40001424052748704361504575551830474342068.html

<comment><USER2> You know watching that rescue reminded me of the US we used to be. No bullshit, get it done. I was impressed and kind of sad at the same time. It was awesome to see what people working together to achieve a common goal with no politics can do. Chileans should be very proud they out America'ed the US. It is good to see that somewhere in the world hero's and champions still exist. Chile showed the world how to have hope and strength again.</comment>


US invaded by savage tick that sucks animals dry, spawns without mating - <AUTHOR> https://arstechnica.com/science/2018/08/us-invaded-by-savage-tick-that-sucks-animals-dry-spawns-without-mating/ <comment><USER2> That sheep and how the ticks 'attacked' the investigators and the owner when they entered the paddock sounds terrifying and like something out of a horror movie. How do you protect yourself from 100 ticks trying to suck the blood out of you until you die?

</comment><comment><USER3> I'm never going outside near nature again. Cities are good for some things :)

</comment><comment><USER4> Sounds like the chupacabra.

<comment><USER5> That literally translates to sucking-goat in Portuguese.

</comment></comment><comment><USER6> this is why we need super strong borders with import/export inspection, with fumigation and quarantine. Kind of like California's fruit inspection point, but more serious.

</comment><comment><USER7> Just fucking great :)

</comment><comment><USER8> savage.</comment>


Ron Conway is a Silicon Valley startup's best friend - <AUTHOR> http://tech.fortune.cnn.com/2012/02/10/ron-conway-sv-angel/ <comment><AUTHOR> Ron's specialty is emergencies. He spoke at YC on tuesday, and about 80% of his stories involved a startup running into some horrible problem that he managed to fix working behind the scenes. He wasn't bragging; that's just what Ron's life is like. Then on thursday Jack Dorsey came to speak, and told everyone about a point early in Square's history when they ran up against what appeared to be a brick wall. Then he paused, during which everyone wondered what ingenious solution he had come up with, and continued "so I called up Ron Conway," and the whole room burst into laughter.

I advise every startup that wants to make it really big to get Ron as an investor. Having Ron in your cap table is like having a fire extinguisher onboard.

<comment><USER2> He only looks at companies from trusted sources so finding those sources and having their ears leads to grabbing his attention. How does someone get on Ron's radar when they aren't in the valley? Is it a stretch to assume he has sources coming from outside the valley as well?

<comment><AUTHOR> The best way to get the attention of any investor is through other people they've funded. Fortunately in Ronco's case that means you have lots of options.

</comment></comment></comment><comment><USER3> I thought Ron was a total bully. Doesn't he threaten shareholders and makes them bend to his will all the time? I don't know a lot about him, but I heard he's tough to deal with.

Can anyone share any more Conway stories?

<comment><USER4> The most common Ron Conway/SV Angel story is that as a portfolio company, you email one of the partners (most of the time NOT Ron himself; he's for emergencies), ask for an intro to a company, or advice, and you get their best effort (which is always successful, and usually successful beyond what you expected -- when you want a Director, you end up with an intro to a VP or C-level). This is boring, but day in/day out, it's probably the most common story.

The only people I've ever heard about him bullying are his own shareholders, or people who are doing bad things to tech companies -- shareholders know what they're signing up for (and if he makes them a lot of money, in exchange for a couple phone calls to fix problems in the future, they don't mind at all).

<comment><USER5> Ron doesn't have shareholders, so I'm not sure what you mean.

<comment><USER4> I meant "LPs in the fund", sorry.

(I guess I've also heard about him going to bat very aggressively for his portfolio companies with later-round investors, too.)

</comment></comment></comment></comment><comment><USER6> The power of being a power user on HN: I posted this article 9 hours ago, only 2 votes. This was posted 2 hours ago by PG and it took off :)...

</comment><comment><USER7> Can we entertain Ron Conway's constant hawking and lobbying with Mayor Ed Lee?

My opinion is that it's a bad thing. He's getting deeply in bed with government and virtually buying his seat in local government and I'm uncomfortable with that. We're doing just fine, thank you. (I don't appreciate that he often speaks for the broader tech community on matters of policy, either. We're a diverse lot.)

Not to mention, that music video that he paid for made an utter mockery of the local political process. Frankly, it's disgusting.

Any other opinions? I'd really like to have an educated debate on this.

<comment><USER4> I suspect he's supporting Ed Lee because Ed Lee was very likely to be mayor, and has both pro-startup leanings himself, and, with Ron's guidance, could be more pro business.

Getting the mayor, whoever it is, to understand and support startups is a great goal -- the mid-market redevelopment, fixing the payroll tax (especially on options), etc. I'm sure Ron saw that a lot of his portfolio wanted to be in SF, and when they mentioned issues to him, he got involved. I don't really follow SF politics that much, but I think the payroll tax fixes and creating more commercial real estate are both supported by the vast majority of SF startups; the most debatable thing is probably sit-lie, but personally having lived around 6th/Market in the past, I strongly support a solution to aggressive panhandling, homelessness, etc. (mainly, better mental health and addiction programs)

His other personal charity/political interests seem to be totally benign -- UCSF Medical, various children's charities, etc., so I'm more likely to think his involvement in SF politics is for his portfolio (and the wider startup and business community), vs. much personal interest in politics.

Although Ron Conway for Mayor or CA Governor would be awesome.

</comment></comment><comment><USER8> Selfishly, I couldn't imagine an angel funding strategy that didn't involve begging him to be an early investor.

</comment><comment><USER9> What is truly amazing is that his approach makes so much sense, you'd think there were a lot more angels like him out there. On the other hand, it does take a lot of passion and effort, so I guess that explains it.

</comment><comment><USER10> I love the pic with Ashton Kutcher. Most people would say, "Wow, Ron Conway knows Ashton Kutcher?" Whereas anyone plugged into startup culture would say, "Wow, Ashton Kutcher knows Ron Conway?"

</comment><comment><USER11> _At those critical moments in a startup's life Conway responds quickly -- and so do those in his network. There was the time when a top executive at Tellme Networks, a telecommunications startup, e-mailed Conway in desperation at 11 p.m., as a business deal with Verizon (VZ) was falling apart. Two minutes later, Conway's reply came, in all caps: "AM ON IT." By the next morning Conway had arranged a meeting with the Verizon president, which led to a nine- figure contract with Tellme. Microsoft eventually bought Tellme for $800 million._

That's pretty badass.

</comment><comment><USER12> It's not what you know, but who you know.

</comment><comment><USER13> > _"Conway has invested in Groupon (GRPN), Twitter, Square, Dropbox, and > Airbnb -- and those are just the companies whose valuations top $1 billion > apiece."_

This is sort of like another guy I know, who has also invested in multiple billion dollar companies. That person is me, by owning shares in companies like Walmart, Coca-Cola and IBM.

Conway is a huge SV insider, thus many of these investments require nothing more than being in the right circumstances. There are lots of people who would have loved to throw some money at some of these tech darlings in their early days. But most people aren't able to.

Of course, I don't want to diminish the man's success too much; after all, we create our own circumstances.

<comment><USER14> If you're comparing buying shares on the public market for companies that are already worth billions of dollars to investing millions of dollars in companies that are worth a few tens of millions of dollars, then you should probably elaborate, because the comparison on its own is apples and oranges.

<comment><USER13> Here's the elaboration:

Groupon: not making money. Twitter: Not making money. AirBnb: Not making money. Linked in is, kind of, but may be overvalued. So what is so remarkable about making a claim of, "look at all the billion dollar companies this guy invested in"!. _Anyone_ can invest in billion dollar companies. There is nothing amazing about it. The fact that Conway's are tech sweethearts and he got in "early" is a product of him being a SV insider.

Sorry, but I'm not entirely impressed with what may turn out to be a second tech bubble and the people who get rich pumping then flipping the shares.

Edit: From Wikipedia: _"Some Valley observers, notably VentureBeat, have been critical of Ron Conway for his investments during the Internet boom, believing them to be "symbolic of the era's hubris."[6] Conway developed a reputation for throwing lavish cocktail parties and raising cash from a diverse group of celebrities, sportspeople, and political figures such as Henry Kissinger, Arnold Schwarzenegger, Tiger Woods, and Shaquille O'Neal, which he then ploughed into start-ups."_

Again, Ron may be brilliant, but making money as a tech investor during a tech boom doesn't require genius.

Finally, people seem to talk like getting these investors in your fund raising indicates that your startup is...something. The fact is, these guys are open about their model: throw money at lots of startups and hope that a few turn out. For example, the other day there was a hiring thread that said "money from top investors, including 500startups". To me, that means you're just one in a bunch that, according to the head guy at the fund, is probably going to fail.

As for the guy who said that these companies would have loved my money at the time Conway invested, I'm not sure about that. You go to Conway _first_ ; that's the advantage of being an insider.</comment></comment></comment>


New site up - <AUTHOR> http://www.myownsixwords.com Would love some feedback and spreading of the word<p>www.sxwrds.com for short <comment><USER2> I really like the interface, it's very simple and snappy. What was it made with?</comment>


Why the Best Companies and Developers Give Away Almost Everything They Do - <AUTHOR> http://www.themacro.com/articles/2016/05/why-the-best-give-away/ <comment><USER2> The article fails to mention that for many of these companies, selling software is not their business model. Their USP comes from the large piles of data they have, and the network effect of their product that ensures a lock in.

I'd be more interested in companies which sell software to end consumers/developers and open source it at the same time. Red Hat is one of the few which has done that successfully.</comment>


Ask HN: How do you handle data migrations in SQL databases? - <AUTHOR> There was a recent discussion about handling schema migrations (https://news.ycombinator.com/item?id=19880334). Following up on this, if you deploy a schema migration, sometimes there's a data migration that needs to follow. For example, I recently wanted to "promote" a field from a JSON column in a postgres database to a SQL table column. It's easy enough to add the new column, but what tools and patterns are out there for handling the data migration? <comment><USER2> I've used sqitch ([https://sqitch.org/](https://sqitch.org/)) in the past, happily.

Noticed that it released its 1.0 a couple of days ago ([https://github.com/sqitchers/sqitch](https://github.com/sqitchers/sqitch)).

<comment><USER3> This looks fantastic, thank you for sharing.

</comment></comment><comment><USER4> We use Django primarily so data migrations are built in.

For complex operations we use plain sql files.

Always test on staging with the live data and schema!

<comment><AUTHOR> Agreed on testing with real data. Even then, sometimes migrations can be brittle when unexpected data is loaded from a new environment.

I'm curious how folks who aren't using an ORM handle this. We've used Goose before for schema migrations, and can add .go migrations that handle more complex data-migration tasks. It always feels more brittle, and I wonder if there's a pattern that I'm missing here. Is there a better way for non-ORM users to handle data migrations?

<comment><USER5> What are the issues you are currently running into?

</comment></comment></comment><comment><USER6> In tools like rails migrations, you would just put the DML statements (INSERT, UPDATE, DELETE) right along with the DDL statements (CREATE, ALTER, DROP, etc.) in the migration file.

</comment><comment><USER7> Kinda off topic, but I always feel like this is an opportunity for databases to fix a leaky abstraction. I mean databases _are_ basically an abstraction over the storage mechanism, so why does the choice of json/column as an api have to be so tied to the storage?

<comment><USER7> Why can't I express my denormalization for performance reasons separately from my data model (like I do indexes) and let the database handle it?

<comment><USER8> You can. The public side of the schema of objects (views exclusively in many recommendations even back to the beginning of relational DBs) visible to an app are it's logical data model, the base tables and the way the views are implemented on top of them are a separate concern which can be isolated from that model.

</comment></comment></comment><comment><USER9> I come from laravel world, but lately I've been playing with Hasura as a backend, since javascript is easy to drop in anywhere I've started using knex for my migrations. Works pretty well for my use case.

</comment><comment><USER10> I'm in the Node.js world and knex.js and its migration feature has been flawless. I run it against an Heroku Postgres DB.

</comment><comment><USER11> If i can migrate the data both ways meaningfully, I just put the sql to do so in the Schema migration .sql files.</comment>


LocalVox Buys Postling - <AUTHOR> http://techcrunch.com/2012/11/01/localvox-buys-postling-to-give-smbs-a-one-stop-shop-for-social-media-management-local-marketing/

<comment><USER2> Some background: Postling was founded by an ex-Amazon product manager, David Lifson and the two original technical co-founders of Etsy, Haim Schoppick & Chris Maguire.

It was originally developed at Dreamit Ventures, the accelerator program in Philadelphia, in 2009. They worked alongside my startup (<http://parse.ly>), Jack & Russ of SeatGeek (<http://seatgeek.com>), Matt & Burak of Tidal (<http://tid.al>), and a few other early-stage companies.

After the summer in Philadelphia, they relocated to NYC just like we did. They are some of the nicest guys who worked tirelessly on their company for several years, building up a customer base and strong following in the market. They took a methodical approach: built an MVP, launched it to customers, and iterated it in response to customer feedback.

This acquisition is a nice, soft landing for the company and the founders.</comment>


Schneier: Details on a New PGP Vulnerability - <AUTHOR> https://www.schneier.com/blog/archives/2018/05/details_on_a_ne.html <comment><USER2> Not sure why anyone would suggest WhatsApp(or any FB tech) as a method of private communication.

I'd say encrypting raw text is perfectly fine in situations where secure communication is critical.

</comment><comment><USER3> Requires JS execution?</comment>