How to get on the front page of Hacker News (in 7 lines of Python) - <AUTHOR> http://tommy.authpad.com/how-to-get-on-the-front-page-of-hacker-news

<comment><USER2> This is bad Python:

\- "isgoodtime" is a magic variable that changes depending on when it is imported. It should therefore be either a function or method on an object.

\- "if isgoodtime == True" should be "if isgoodtime:" (although this would probably change to "if isgoodtime():"

\- words in functions should be separated by underscores, e.g., is_good_time, to_great_content

<comment><AUTHOR> Oh my god it's TERRIBLE Python, it's just a joke. Theoretically I have "written" is good time in another file and imported it here, checking to see if datetime.datetime(datetime.now()) is in a good time, but I just wanted to write it so it was understandable as a joke.

Also, I'm just terrible at writing code. See previous post on tommy.authpad.com

<comment><USER2> Yeah, I know. As a Python guy with a minor case of OCD, I sometimes feel compelled to critique code, even when I know the code was written in jest.

Sorry for being a pedant :)

<comment><AUTHOR> You're a gentleman and a scholar, keep fighting the good fight.

</comment></comment></comment></comment><comment><USER3> Funnily enough, I usually don't even look at the front page. My feed reader picks up all articles on hacker news. For me, you're best off not posting on the weekends cuz my reader fills up and sometimes I just dump it, but more often then not, if you post it here, I'll at least see the title! For me, it's more important to choose an interesting and relevent title. That said, I'm probably not a typical use case.

</comment><comment><USER4> I don't understand the "good time" aspect. Are you saying that people are more likely to read at those times? Aren't they more likely to post at those times as well?

<comment><AUTHOR> So that's what I originally thought, but you have to think of it in terms of pickup ratio more than anything, and that's higher with higher traffic overall since it means more people on "new".

It's a bit counter intuitive. Reminds me of learning to count cards in blackjack: if there are more high cards, doesn't that mean the dealer ALSO is more likely to get high cards?

<comment><USER4> Do you have any evidence of this or is it just your supposition?

People used to think the same thing about posting on Ask MetaFilter, and when people actually looked at real data, they determined that the number of people interacting with a post was roughly the same no matter when it was posted, because of the phenomenon I mentioned—in a community where everyone can post, times where the audience is bigger also mean bigger competition for attention.</comment></comment></comment>


Did wine cause a full-scale revolution in Armenia? - <AUTHOR> http://www.bbc.com/travel/story/20190129-did-wine-cause-a-full-scale-revolution-in-armenia <comment><USER2> Ha, well, sort of.

For better or worse, Yerevan is certainly becoming more cosmopolitan in the center. A younger part of the diaspora that never lived in Armenia seem to be spending time in Yerevan, with capital to be able to open the likes of wine bars, coffee shops and fancier bars.

The piece talks about wine but it's not as if booze from the region had a poor reputation before. Armenian & Georgian wine, Armenian cognac, all pretty reputable in the region.

It's not the wine, it's the _wine bar_ that's different here. History seems to be littered with change that occurs when thinkers, talkers and dreamers can meet openly in public.

<comment><USER3> > History seems to be littered with change that occurs when thinkers, talkers > and dreamers can meet openly in public.

So true. Thanks for reminding this to all of us.

</comment></comment><comment><USER4> I visited Armenia back in 2007. We visited a very rural town deep inside the mountains with no other towns nearby. The night sky was unbelievable. With zero light pollution, the stars, planets and the galaxy were clearly visible. It was under this unbelievable sky that I tried their home made wine. I've since started enjoying wine on a different level but that experience will never be replicated.

</comment><comment><USER5> >Armenia claims an enviable history.

Armenia's history makes Russia's "And Then It Got Worse" look delightful.

</comment><comment><USER6> I've just been to Georgia and been very impressed, and can't wait to go to Armenia soonest. I would not be surprised if this hugely diverse region with a long history, delicious food, and friendly peoples becomes one of the next digital nomad hotspots (like SEA, Medellin, etc.).

<comment><USER7> I've been reading blog posts about Georgian food lately, and their cuisine and food practices and ingredients seem interesting and somewhat different from those of other countries. A lot of use of walnuts, for example, not just to eat as nuts, but in the form of paste added to various dishes. Also a lot of use of greens and herbs.

culinarybackstreets.com and roadsandkingdoms.com are the sites on which I've been reading that stuff, plus after that, googled some more for Georgian food blogs, etc.

<comment><USER8> I forget which region of Italy it originates from, but there is a wonderful walnut, sage and rosemary pesto, which is quite unusual if you're only used to the basil and pine nut variety.

<comment><USER7> Wow, thanks, must try that out. Only had the basil and pine nut kind so far, and like it.

</comment></comment></comment></comment><comment><USER9> This being hacker news, I thought there was a revolution in Armenia because people started running Windows applications on their Linux computers.

</comment><comment><USER10> Armenia and Georgia look like fascinating places, at a real crossroads both culturally, and in terms of the climate and geography too.

</comment><comment><USER11> No, it didn't. [https://en.wikipedia.org/wiki/Betteridge's_law_of_headlines](https://en.wikipedia.org/wiki/Betteridge's_law_of_headlines)

</comment><comment><USER12> Armenia was incorporated to the Ottoman Empire in the 16th century, not in the 20th. [https://en.wikipedia.org/wiki/Ottoman%E2%80%93Safavid_War_(1...](https://en.wikipedia.org/wiki/Ottoman%E2%80%93Safavid_War_\(1532%E2%80%9355\))

<comment><USER13> The article doesn't state otherwise, it just states when it turned to massacre...

<comment><USER12> Hm maybe; I think "Ottoman occupation in the early-20th Century turned from oppression to mass killings" has a slightly confusing word order, probably "in the early-20th Century" should go at the end?</comment></comment></comment>


A simple double pendulum simulation - <AUTHOR> https://github.com/IamMayankThakur/double-pendulum <comment><AUTHOR> I am a newbie here. Just tried my hand at a simple simulation. Would like some comments and feedback.</comment>


How To Sell A Digital Comic - <AUTHOR> http://www.warrenellis.com/?p=14383

<comment><USER2> I used to read comics as a kid on and off, but stopped at some point. I then got an iPad and learned about Comixology and figured I'd pick up an issue or two from my childhood. Well, a couple of hundred digital comics later I am fully committed to reading comics again, almost 100% digital.

Comixology's app makes the buying and reading process so easy and enjoyable, that I thoroughly look forward to Wednesday's new releases. Their "Pull List" companion app and website are great too. I can create my pull list for the week and have it emailed to myself.

One thing I really like about Comixology's ethics is they aren't trying to kill the traditional comic book store. Their app has a feature to locate the nearest comic book store to your location, and has helped me find a bunch of stores I didn't know existed, which have earned my money. They even have a program where your comic book store can set up a Comixology store front and sell comics through that platform and make some money.

On a side note, Dark Horse opted (from what I understand) to use their proprietary app for their comics and my experience there has been completely different. The app runs extremely slow, and crashes often. I bought a couple of Usagi Yojimbo book, read them and deleted the app. The experience was too clunky to deal with.

<comment><USER3> The same happened with me.

I think there's another important thing to note, and that is that many comics go out of print, and if we don't digitize them, we lose some true treasure of comicbooks as a result.

I think a lot of people pirated comics for this reason. Especially outside the U.S.

That said, having all my comics on a digital device or in the cloud instead of a row on my shelf just feels _weird_. But the upside is that owning content digitally means that the publishers can update it constantly, as some did with retina-resolution comics.

<comment><USER2> Your point of out of print books is very true, and for another reason. Unless I can hunt down a 50th printing of the first appearance of Spider Man or the first Captain America, odds are I would never get to read them. Having a digital copy for $1.99 and seconds away is a very comforting thought.

The other upside of having all you comics in the cloud and accessible by one device is that you don't end up with 50 long boxes of comics that you have to store.

I do still buy some comics in print, those that I find truly beautiful, or when I find one in a comic book store that I want to support. And it is important to note that Comixology doesn't have every comic book ever, there is still a huge percentage of books that haven't made there way to the digital space.

</comment></comment></comment><comment><USER4> How to sell a Digital Comic (to me): Don't use DRM.

I'll buy the fuck out of Digital Comics if I have some reasonable assurance that I'll get to keep those files forever. I feel super, super hesitant on buying any digital media with DRM these days, even from major players. I do buy a few TV shows, but I internally rationalize that it's roughly equivalent to a cable subscription (which I don't have) and in the meantime, those particular digital purchases act sort of like a DVR.

I bought one movie and its sitting in the menu list, taunting me, telling me that I'll never have access to it in a few years time. Not doing _that_ again.

<comment><USER2> That is something that concerns me as well. I don't know what Comixology's DRM technologies are, or if they even have any. I haven't looked, but it would be nice to know that I can export those books that I have paid for to another DRM free format, like PDF.

<comment><USER5> The storage format is proprietary and some kind of obfuscation of the image data is done.

According to the ToS, you don't own a license to the comics, so you can't export them, or even hold onto the comics if comiXology disappears.

<comment><USER2> Damn, didn't realize that. But to be honest, it won't change my habits. I enjoy reading comics, not the actual comics themselves. I don't "collect" them, I just buy and read them, and will probably never reread a book.

</comment></comment></comment></comment><comment><USER6> It's not just comics; at least one major US publisher of trade fiction isn't bothering to optimize their book covers for legibility at Amazon thumbnail size (120x80 pixels). Even with authors biting their ankles on the subject and ebook sales heading towards 60% of the total.

<comment><USER7> So true.

The dilemma is similar in the iBookstore, but over there iBooks Author is at least partly to blame. What appears to be a book cover (called a "title page" in iBA) actually appears full-size on an iPad only for a few seconds when a book is opened. The title page mostly appears as a thumbnail either in the store or in a reader's library. However, it's not actually a different image; the same image is scaled down to thumbnail-size. And yet there's no indication that the title page will ever appear thumbnail-size during the design process. You have to preview the book on an iPad to see it that way.

</comment></comment><comment><USER8> The author makes the assumption that people use Comixology for discovery of new titles, but the vast majority do not. There are many blogs and magazines for that type of discovery. Comixology is used primaryly to buy and read what you've discovered elsewhere. Comixology works, which is why Comixology and a few other comic apps usually rank in the top 25 grossing apps for the iPad.

<comment><USER9> > _The author makes the assumption that people use Comixology for discovery of > new titles, but the vast majority do not. There are many blogs and magazines > for that type of discovery._

I don't use any blogs or magazines for "that type of discovery". And not many people do, because of lack of time, except if they are scene-obsessed teenagers.

I _do_ however check new titles and stuff in Comixology, and ocassionaly buy some I haven't read.

<comment><USER8> Not many people like you do, but reading a blog or magazine is not regulated to scene-obsessed teenagers. Moreover these so called scene obsessed readers contribute to the majority of sales. Comic book fans represent the majority that count in this case not the occasional reader with not time for your so called comic book scene. To illustrate outsiders may think HN readers are tech obsessed minority, when compared to general population they are, but the traffic HN readers can provide is significant to a tech based startup.

<comment><USER10> >Not many people like you do

How do you know this? Any hard data you'd care to share?

</comment></comment></comment></comment><comment><USER11> You know, I totally love Warren Ellis and his writing (for the most part, there are some duds) - and he makes an excellent point here.

But it would been great if he took those five minutes to create a visual example of how he thought it could be better. Because even as he explai a it I can't quite picture how a cropping of the cover would actually be better.

As a comic lover and buyer - a thumbnail version of a full cover seems more enticing to me than a cropped one. It's what I'm used to (moving from print) and I can tap it to view info and a larger cover. I can't picture how a cropped version would be better. Possibly a shot from inside the comic but sometimes covers are part of the fun.

<comment><USER9> He's not talking about adding cropping.

He is talking about optimizing the cover image for Comixology cover display.

What he said, is that even with (i.e _despite_) cropping, the iD cover images still look better than the comic covers ("It's not a great way to display their covers. And it's obviously a little bit reduced here. They cropped the damn covers into squares themselves, so the logo is truncated in almost all images.").

So, what he asks for is larger legible titles, the heroes showing better in the small thumbnail display, etc, instead of a plain shrank version of the actual cover.

</comment></comment><comment><USER12> I'm a bit confused. At least compared to the given magazine covers, they comic covers look amazing and present a ton of information.

What is he suggesting would work better and where can I see an example of it?

<comment><USER13> He's suggestion creating better thumbnails for the issue, instead of just shrinking the cover. The icon for MS Word is not a scaled-down picture of the box; you don't create a banner ad for your website by taking a screenshot of the site.

There's no reason the thumbnail for a comic has to be a scaled-down version of the optimized-for-print-and-shelf-space cover.

I'm thinking something like the right-hand thumbs on this page: [http://www.comixology.com/DC-Comics-Digital-Sneak- Peeks-10-3...](http://www.comixology.com/DC-Comics-Digital-Sneak- Peeks-10-3-12/digital-comic/DIG002161)

</comment></comment><comment><USER14> I only knew of Warren Ellis because of his webcomic FreakAngels:

<http://www.freakangels.com>

which, ironically considering the title, is free (though it does have a print version and associated merchandise)

Now that I read his bio on Wikipedia I realize he's a big name:

<http://en.wikipedia.org/wiki/Warren_Ellis>

</comment><comment><USER15> It's questionable whether you need to sell the comic itself. Look at MS Paint Adventures, ala Homestuck. The comic itself is done for free, the author, Andrew Hussie, lives comfortably off the side sales (merchandise and the like)

And that's not even counting the 2 million dollar Kickstarter for the game... that's one hell of a dedicated fandom. The average marketer would kill for something like that.

<comment><USER10> Did you even read the article?

This isn't some generic advice on how to sell a comic -- it's about a very specific aspect of the process. Your comment is _completely irrelevant_ to anything Ellis had to say here.

<comment><USER15> Admittedly no, I was going off the title.

</comment></comment></comment><comment><USER16> The UI of the fashion magazine isn't very useful.

The comic one is more useful and looks just as good.

The main flaw in the comic one is that the title text below is truncated with a ellipsis "…". Apple has been doing this a lot, but it is still as terrible a practice as when we had 8.3 file names in MS-DOS.

</comment><comment><USER17> On the example that's supposedly good, I can read, without putting in excessive effort (but trying some!) seven covers, or 1/5th of the total.

Of the comics, I can read every single one, and they all look pretty good to me.

I had to re-read this article several times to make sure he was actually praising the top image and criticizing the bottom image rather than the other way around.

</comment><comment><USER18> How about titling the link NSFW, some of us have jobs....

<comment><USER19> Setting aside for a second I couldn't find much that would be too risky for most workplaces, you clicked on a link was about comics _while you were at work_. What, honestly, did you expect to see?

Also, I'd find it hard to be sympathetic were you sacked for browsing a social media site and reading about how to sell comics _while you were at work_.</comment></comment>


Lo-Fi decentralised Uber clone via Facebook groups - <AUTHOR> http://www.stuff.co.nz/national/10664676/20-sober-driver-taxi-page-shut-down

<comment><AUTHOR> [https://www.facebook.com/groups/354103174706185/](https://www.facebook.com/groups/354103174706185/)

What would be the best way to integrate additional stuff into these facebook groups to replicate the features of Uber?

eg. Driver feedback, current active drivers, GPS coords of driver locations?</comment>


Ask HN: Career guidance - <AUTHOR> Hi All,
I have started my professional career as a Full stack developer a year ago after my undergrad. I am working in a pretty good company with decent pay. But I am confused with long term plans in my career. I am a person with no specific domain interests and I like to read/try everything tech (ops/backend/frontend). I can't decide whether I want to do Masters in any specific domain or switch my stack as a change or keep my current stack going and learn it better. As of now I am following third option, to know my current stack better. I have been attending local meetups/conferences for the same. I try to take out some time after my job, but I don't see myself being good at managing that and regret it.
I am happy to hear any general advice or your experience. Thanks. <comment><USER2> Make a product. Retain as much ownership in it as possible. If it fails, make another one. Rinse and repeat until the product(s) make enough money for you to live on.

It doesn't even have to be a tech product...

<comment><AUTHOR> That is a good advice. Thanks.</comment></comment>


Haskell Concepts in One Sentence - <AUTHOR> https://torchhound.github.io/posts/haskellOneSentence.html <comment><USER2> A monad is any data structure which implements bind. Bind is a higher-order function with two parameters - one is the data structure to be transformed, the other is a function which maps over elements in the data structure. However, unlike a normal map, each result of "bind" sits in its own version of the original data structure, which then have to be combined back into a single data structure. The way in which the data structures are combined is what makes each monad different.

For example, List is a monad. Suppose we had a List of Ints, such as [5,3,4]. If we were to run bind over this list, we would need a function that takes an Int and returns a List of something. We could use "show", the function which converts Ints to Strings (a String is technically a List of Char. Since this is a List, we're good). If we call bind using [5,3,4] and show, we get ["5","3","4"] which are then combined to "534".

We can check with the interpreter (>>= is bind):

Prelude> [5,3,4] >>= show

"534"

<comment><USER3> > each result of "bind" sits in its own version of the original data > structure, which then have to be combined back into a single data structure

That doesn't make sense to me. Let's say I have the list [5,3,4], to me that means each application returns a three element list [f(5),x,x], [x,f(3),x], and [x,x,f(4)] then the bind function takes these lists and turns them into [f(5),f(3),f(4)].

What makes this function a monad?

<comment><USER4> In this case "data structure" refers to List, not a specific size or type of list.

For example, suppose you have a list of ints, and want to bind a function, show. We have types:

      [5,3,4] :: List Int
      show :: Int -> List Char

That is to say, [5,3,4] is a list of ints, and show is a function that takes an int and returns a list of characters.

In this case, we would have

      [5,3,4] >>= show
      f(5) ++ f(3) ++ f(4)
      ['5'] ++ ['3'] ++ ['4']
      ['5','3','4']

where "++" is list concatenation. The idea here is that when we apply show, we get back 3 different Lists, and want to combine them into a single list.

<comment><USER3> So bind is flat map in other languages? If join is a function that take a list and appends its elements together join ( [[1], [2], [3]] ) -> [1,2,3]

then bind is join(map(f, x))?

bind just seems like a terrible name.

For some reason Haskell users try to make things sounds as academic as possible.

<comment><USER4> >For some reason Haskell users try to make things sounds as academic as possible.

Probably because Haskell ended up being the language for academics. If you want to do programming language research in an ML-type language use Haskell. If you want to make a product, use OCaml. Not entirely true, but pretty close.

>So bind is flat map in other languages.

In the case of a List, yes, but there are other datastructures that implement Monad. This type of thing happens a fair amount in Haskell. It is not that uncommon to see code like:

        instance Monad List where
            (>>=) = flatMap

That is to say, the implementation of the interface is just another function that has a more domain specific name.

There are other monads with a bind that cannot be understood as flatMap.

For example, the Maybe datatype is Haskell's version of Optional. For example, if a variable is of type `Maybe t`, it either contains a single value of type _t_ , or no value. It is common to use Maybe without using it as a monad. However, Maybe does implement the Monad interface. In this case, bind is defined as follows:

        x.bind(f) =
          if (x.hasValue()) then { return Just(f(x.value)) }
          else { return Nothing() }

where Just and Nothing are two constructors of Maybe. If we view 'no value' as analogous to null, then this bind function is null propogation.

<comment><USER5> I feel a bit dumb asking this, but your explanation doesn't make it clear to me why you can't think of a bind on Maybe as a flatMap on a List with 0 (Nothing) or 1 (Just) elements. Could you elaborate further on how thinking of a bind on Maybe as null propagation eliminates it also being interpreted as a flatMap on a restricted-size list?

<comment><USER6> You're right, maybe is equivalent to the type of lists with at most one element. There are however monad instances which are genuinely different.

For example the state monad is defined as

      F(X) = S -> S*X

I.e., a value of type F(X) is a state transformer which takes a state argument of type S and produces the new state and a value of type X. In this case, bind is sequencing of state transformers.

Using the state monad you can write code that looks like it uses a global variable of type S, while being completely pure which makes testing and refactoring easier, and of course doesn't pollute the rest of the program.

</comment></comment></comment></comment></comment></comment></comment><comment><USER3> My general problem with Haskell articles and such: they are written as if you already understand Haskell. They make total sense if you know the language, but if you are trying to learn are mostly useless if not more confusing. Or even worse, they devolve into dense academic prose even when writing introductory articles.

Sometimes they even use Haskell as if you already know it to try to explain it.

I'm still looking for a basic article that describes monads well. My first few languages were all functional too, so that isn't the problem. I even still use APL derivatives.

<comment><USER7> Read this: [http://learnyouahaskell.com/chapters](http://learnyouahaskell.com/chapters)

Just don't skip chapters and read from the beginning to the end.

<comment> alok-g You advice here may be good; am not questioning that. However, question does come why can't there be a shorter explanation for people who already know programming. Most people are unable to explain it well, or at all, leading me towards a belief that they don't get it themselves as yet.

<comment><USER7> You can explain what a monad, for example, is, in one sentence, but it is useless if you don't show how it is used.

Similarly, you may know what eigenvector, or derivative function, is, but without practice you can't understand why you may want it.

<comment> alok-g I'm not looking for a single sentence explanation or definition. I'm willing to read more, and the structure you suggest of showing precisely worded definitions along with positive and negative examples would be great! However, I would not want to start with reading how to install a compiler, how to add two numbers in Haskell, etc.

I have similar issues elsewhere when people start with hello worlds and getting started in introductions to projects and programming languages without spending enough time on what the thing is about.

</comment></comment></comment></comment></comment><comment><USER8> I'm still kind of having problems with monads. Funnily enough, I recently found an article explaining what monoids are: [https://fsharpforfunandprofit.com/posts/monoids-without- tear...](https://fsharpforfunandprofit.com/posts/monoids-without-tears/)

        You start with a bunch of things, and some way of combining them two at a time.

        Rule 1 (Closure): The result of combining two things is always another one of the things.

        Rule 2 (Associativity): When combining more than two things, which pairwise combination you do first doesn't matter.

        Rule 3 (Identity element): There is a special thing called "zero" such that when you combine any thing with "zero" you get the original thing back.

        With these rules in place, we can come back to the definition of a monoid. A "monoid" is just a system that obeys all three rules. Simple!

Long explanation overall in the article, but based on 6th grade math. I understood it, and it stuck. Could someone extend the monad explanation from here? Maybe I'll finally get it :)

<comment><USER9> Start with a functor--a parameterized type with fmap. Maybe t, Either e t, [t], IO t, State s t, and so on.

Consider a monad m and a function, a -> m b. Frequently you want to feed another monadic value, m a, into that function.

A monad gives you a function, >>=, that lets you take m a and feed it into a -> m b.

So any function that does IO, that looks like a -> IO b, you can take an IO a and plug it into a -> IO b. Any function that manipulates a state, you can take State a and plug it into a -> State b. This is the heart of a monad: gluing monadic functions together.

The meaning of >>= depends on the monad you're in. You also need return :: a -> m a, which can take a thing and put it in a monadic value.

There are monad laws also. A lot of times there's several ways to manipulate monads to do something, and the laws are needed to make sure they're all equivalent. For everyday monad use the laws aren't terribly important to remember, and GHC's linter will helpfully point out when you can use them.

That's my attempt at a short explanation. The "monad tutorial problem" has been weighing on my mind. The only way I ever understood monads was by reading and rereading the definition and examples. Tutorials never taught me anything.

<comment><USER10> I'm still slightly confused. The author suggests that a monad is composed of 3 functions. It seems to me you've shown 2 of these functions.

a -> m b

>>=

What is the third function? Did I misunderstand you?

<comment><USER4> The author is mistaken. There are only two functions necessary for a monad: >>= and return

Also, the type of return is `a -> m a`. The type you cite `a -> m b` is a parameter to >>= (which has type `m a -> (a -> m b) -> m b.

The author might be refering to a quirk of the Haskell monad interface, which has to additional functions:

">>" which can be easily defined in terms of >>=. I assume this is part of the interface so users can override it with a more efficient implementation, but every implementation I have seen just uses the default one.

"fail" which is an error handler. This is being depreciated as a function of Monads, and moved into its own MonadFail typeclass. This also has a default implementation that just throws an exception.

<comment><USER11> I suspect the third function is the one for running the monad. It's different for each one, so it's not part of the type class, but you do need it to use a given monad. (Except IO, though even it has unsafePerformIO)

<comment><USER4> What is the function for running Maybe, or List?

</comment></comment></comment></comment></comment></comment><comment><USER12> Monads are not complex. A monad is a box. Any monad has two functions (plus others, imagine this is a minimal interface): bind and return.

You can put anything in the box. It's TARDIS-like.

`return` replaces the thing that was in the box.

`bind` replaces the box.

Most monads have a number of functions that can only be executed over boxes. This is because the boxes have special metadata (for example, someone has been scribbling state underneath the box). The 'get' function from the State monad just tells you to read the gibberish on the box instead of unpacking the box. The 'set' function scribbles more stuff on the bottom of the box.

Useful monads then provide a function to put things into the box, work with the box and then throw the box away (or inspect it by itself). These are the functions called 'runWhatever' for example 'runState', which lets you put an apple in the box, put a shipping label onto the box and then eventually separate the apple and the shipping label into each hand, throwing the box in the bin.

You can put anything in a box. Even more boxes. And when you're inside the box, you can't really tell how deep you are. If you're in the bottom box you can't actually see that you're in 20 layers of boxes, and this is why Monads are so powerful for creating libraries and frameworks.

<comment><USER13> Thanks for your explanation. I confused as to why so much discussion and blog posts surround the topic of monads as if they were very difficult to understand then?

I would be curious to get your thoughts.

Also I didn't understand the word TARDIS-like.

<comment><USER12> The TARDIS is a box from doctor who that is bigger on the inside (holds a small pocket universe inside). You can put anything inside the TARDIS.

My explanation of Monads approaches them from a practical angle rather than a theoretical angle. It won't help you make your own, but it will help you appreciate why people make them.

<comment><USER13> I see, thanks for the explanation. That's a good analogy. Cheers.

</comment></comment></comment></comment><comment><USER14> IMO the most accessible resource for learning functional concepts like Functors, Applicatives and Monads is the free online book: [https://github.com/MostlyAdequate/mostly-adequate- guide](https://github.com/MostlyAdequate/mostly-adequate-guide)

It uses Javascript to explain everything from scratch. Pure-functions, currying, composition, functors, monads, applicatives and so on.

Its free, so check it out. Reading it and understanding the concepts completely changed my whole coding style in the last couple of month. I hope functional javascript becomes more mainstream and we will soon call this stuff 'standard'. Its just too convenient to stack a Future on top of a Reader and get dependency injection + async function handeling without any boilerplate code.

P.S. Since ES6, javascript is wonderful. Functional code often really looks like lisp. Pity that we don't have macros (yet, and actually there is a way (sweet.js).

P.P.S. If DrBoolean got you hooked. You might want to check Ramda and fantasy- land. The former is a more functional minded underscore/lodash, the latter a specification (and community) for algebraic data structures in javascript to which a lot of new libraries adhere to.

<comment><USER15> Your comment made me read this book. This book changed my life. A biiiillion thanks !!!!

</comment></comment><comment><USER16> To everyone new to haskell and confused: Don't judge haskell based on these definitions. They appear strange and crazy, but when you actually do stuff most of them turn out to be quite intuitive.

My advice is to ignore these things. Don't read a million monad tutorials. Just play around and code something, you don't have to understand the monad- definition before you can use the do-notation. Try to ignore them. After a while you get an intuition and then the definitions will make sense.

<comment><USER17> I've found parser combinators to be a fun and useful way to play around with monads, since it's pretty easy to implement your own monads this way, and what better way to understand something, than to actually make it?

<comment><USER16> i agree! They are also surprisingly useful and not incomprehensible like Regex.

</comment></comment></comment><comment><USER18> I see traces of OP getting to understand the joke "A monad is just a monoid in the category of endofunctors, what's the problem?" :)

</comment><comment><USER19> This is a good start and might be useful to other beginners. From the vantage point of someone who already knows what the words mean, I can fill in the gaps in your definitions but unfortunately, a beginner might not be so able.

Here are some suggestions on how you might close some of those gaps a bit (I think allowing yourself to go over a sentence here and there should be ok).

You use fmap more than once without having defined it.

Currying: You need to define partial application.

Map and filter, I'd use collection instead of list. There is more nuance but that is good enough at this level.

Morphisms generalize the concept of function. They can be thought of as capturing structure (such as a set equipped with + and 0) preserving maps (which is something analogies try to do).

lazy evaluation could do with mentioning thunk, then you'd have to define what a thunk is, of course.

Fold: Folds are a lot more interesting and it's not clear what you mean by your given definition. I suggest defining it in terms of structural recursion.

Category: It's worth defining what objects mean to a category. As well, explicitly mentioning the laws of identity, composition and associativity rather than just the nebulous wording of configuration would be beneficial.

Functor: A more useful foundation is in thinking of functors as morphisms between categories.

Types: There is much more to types than this. Wrong in the correct direction is to think of types in terms of sets. Better yet, as propositions.

Type Classes: Since you mention parametric polymorphism, you should also mention ad-hoc polymorphism and how type classes and interfaces are examples.

algebraic data types: There's a lot more to algebraic data types than this. After defining sum types and product types elsewhere, you can talk about why such types are called algebraic.

parametric polymorphism: what is a type variable?

monoid: Moniods also need an identity element, and giving examples is always useful: natural numbers: +,0 or strings: +,"". One reason monoids are of special interest to computing is because they possess associativity, which is useful when parallelizing.

</comment><comment><USER20> It'd help beginners if there was a sentence explaining what fmap is.

<comment><USER21> In Haskell and PureScript, `fmap` is a method in the `Functor` class, which is defined by

       class Functor f where

         fmap :: (a -> b) -> f a -> f b

for which instances should satisfy `fmap id = id` (and you get `fmap (g . f) = fmap g . fmap f` for free). If you can find a type for which you can implement `fmap` and satisfy the laws, then you have an instance of `Functor`.

That's the precise and short definition. It assumes the following knowledge:

0\. How partial application works and the . works.

1\. How Haskell's type-classes work (`Functor`).

2\. How Haskell's methods work (`fmap`).

3\. How Haskell's higher-kinded types work (the `f`).

So good luck explaining `fmap` in one sentence unless you already know Haskell and understand its type system to a confident degree, which depending on your background can take weeks to months.

<comment><USER20> There's often no need to explain everything in detail to get the gist.

</comment></comment></comment><comment><USER22> Jargon from the functional programming world in simple terms! [http://git.io/fp-jargons](http://git.io/fp-jargons)

</comment><comment><USER23> We should probably add a sentence about not using fixed margins that will make the text body 1/5th the width of my screen.

<comment><AUTHOR> My apologies, I nixed the hardcoded 100px margins and used percentages instead.

</comment></comment><comment><USER24> This is all useless for someone without haskell experience.

</comment><comment><USER25> > A monad is composed of three functions

Actually just two (bind and return). And three laws which are typically not captured in the type system and which must therefore be tested separately.

</comment><comment><USER26> One simplistic but useful analogy I've found is that monads are a way to control program flow with functions. A monad is to functional programming what if/else is to imperative.

It may not cover all the nitty gritty about what is and isn't a monad. But it gets you a long way to understanding why you might use them.

</comment><comment><USER27> A monad is a wrapper type designed to alter the semantics of chains of operations performed on its wrapped values.

</comment><comment><USER28> Question to JS people using Redux. Are the middlewares used to control side effects in actions considered monads? The action returns a description of the side effect, and the middleware handles the actual doing, leaving the programmer to focus on the pure aspects.

</comment><comment><USER29> These sentences are nice, but I feel like more definitions and some re- ordering could make the document as a whole more meaningful.

For example, Lift is defined way before Functor, and fmap is never defined so I had no idea what Lift was about despite that nice concise sentence.

</comment><comment><USER30> What an excellent distillation!

It isn't uncommon to see someone w̶i̶t̶h̶ ̶a̶ ̶f̶r̶a̶g̶i̶l̶e̶ ̶e̶g̶o̶ explain this stuff in a way that is needlessly complex and full of jargon that scares folks off.

Thanks for the great work here. We need more of this kind of thing in the FP world!

</comment><comment><USER31> There is an adage that if you see a lot of advertising for a medicine (think hair regrowth formulas, or pills of reflux disease) you know that none of them are any good.

This page makes me wonder about monads in the same way.

<comment><USER32> Do you think any of those is paid in any way?

</comment></comment><comment><USER33> Article appears to be in flux; definition of lazy evaluation changed.

<comment><AUTHOR> My change is reflected in my use of "Last Updated 3/25/2017" and in my commit message. Thank you for ensuring transparency.

</comment></comment><comment><USER34> whats the third function for a monad? bind return and...?

<comment><USER4> Haskell does have "fail" as part of the Monad typeclass. But it is being depreciated and moved into the MonadFail class.

Haskell's Monad also has >> and >>= both defined as part of the typeclass itself; instead of making >> a normal function. The typeclass does provide a default implementation of >> in terms of >>=.

But you are correct. In general all you need for a monad is bind and return.

[http://hackage.haskell.org/package/base-188.8.131.52/docs/Prelude...](http://hackage.haskell.org/package/base-188.8.131.52/docs/Prelude.html#t:Monad)

<comment><USER35> That's all you need to make the compiler happy, but it's not a monad without satisfying the laws too

</comment></comment></comment><comment><USER36> I'd modify the monoid line to include associativity and identity:

A monoid is a a type with an associative function and an identity function

</comment><comment><USER37> The problem when starting out with Haskell is that you can't google type errors.

</comment><comment><USER13> This is brilliant, thanks for sharing.

</comment><comment><USER38> Hmm. They certainly have a naming and explanation problem in Haskell land. Some impressions from a few of these better explanations.

"A monad is composed of three functions and encodes control flow which allows pure functions to be strung together."

Gibberish compared to claim that monads just execute functions in a specified order. Aka an imperative function or procedure by one definition I've seen a lot. Of course, that monad definition might be wrong, too.

"A recursive function is a function that calls itself inside its own definition."

That's a recursive definition lol. Must have been a joke.

"A monad transformer allows you to stack more than one monad for use in a function."

We've had composition of procedures for a long time. Perhaps Haskell could've called it a MonadComposer?

"Lift is an operation on a functor that uses fmap to operate on the data contained in the functor."

fmap-apply() or something like that?

"Optics(lens and prisms) allow you to get and set data in a data type."

Getters and setters. My early OOP/C++ books are finally more intuitive than something.

"Map applies a function to every element of a list."

foreach(function(), list)

"A predicate is a function that returns true or false."

A boolean function.

"Filter applies a predicate to a list and returns only elements which return true."

Syntactic sugar for a foreach(function, list()) where the function on each member is an If (Conditional) is TRUE Then AddElementToNewListThatsReturned(). Yeah, even the description of imperative version is getting long. This might be a productivity boost.

"A morphism is a transformation from any object to any other object."

A cast from one object to another? Or one with an actual conversion function and/or check? The functional name seems more accurate, though.

"Algebraic data types are a method to describe the structure of types."

Ahh, they're just structs. Wait, what is a type exactly? And therefore what is an abstract... oh darn...

"Free monads allow the transformation of functors to monads."

A functor is an object that can be fmaped over. We covered map. Maybe the same. A monad is either an ordering of functions or something composed of three functions and encodes control flow composed of pure functions. Free monads are apparently an unknown thing that can transform objects that can be fmaped over into something composed of three functions with encoded control flow of composed, pure functions. I heard a lot of good Masters and Ph.D. proposals before this one. This is good, though. Especially quantifying the unknown aspects with a lot of NSF-funded R&D.

"A lambda is an unnamed function."

"Types are an inherent characteristic of every Haskell expression."

"Currying uses partial application to return a function until all arguments are filled."

"A category is a collection of objects, morphisms, and the configuration of the morphisms."

Ok, I just have fun with that one. Author did good on a lot of them. I'm just going to leave these here as quotes to add to Free Monads in... The Advanced Course: Haskell in Two or More Sentences. They provide anywhere from no information at all to the uninitiated to extra confusion inspiring taking or avoiding Haskell courses. :)

<comment><USER39> Pure functional programming means that everything a function does has to be part of the return type. That means you often get functions like

        a -> Maybe b

Instead of throwing an exception or returning null to make the possible failure part of the return type. Chaining failable functions would be incredibly annoying, though:

        let a = tryRead
        if isNothing a
        then Nothing
        else
          let b = tryParse (unwrap a)
          if isNothing b...

In imperative code you could flatten this with early returns but that still is a common pattern, so lets abstract this!

        tryRead >>= tryParse >>= tryProcess

The magic sauce is in the >>= combinator, pronounced bind or andThen. It returns Nothing instantly if it receives Nothing, otherwise it unwraps it and calls the next function.

There are a lot of other things that we could encode in a generic type tacked onto the return value and which we want to chain like this.

Futures in async io, passing around config/state instead of having global variables or the order in which ffi/io is run (the use case you have heard of most) would be a couple examples. You can even abuse bind to add things like implicit backtracking on failure!

So the really cool thing about monads is that you can add new behavior to functions without implementation details leaking during composition!

The cool thing about lenses is that they enable getters/setters for things like entries in a hashmap or all string fields in a struct at once.

<comment><USER38> "So the really cool thing about monads is that you can add new behavior to functions without implementation details leaking during composition!

The cool thing about lenses is that they enable getters/setters for things like entries in a hashmap or all string fields in a struct at once."

Good reply. Yeah, I definitely see these as beneficial.</comment></comment></comment>


Linus Torvalds: "Do No Harm" - <AUTHOR> https://lkml.org/lkml/2017/11/21/356 <comment><USER4> I wrote the email that prompted this quite civil response. I'm very pleased with the outcome, because I think this clear statement of his position is a lot more useful for people to work with, rather than just assuming Linus hates security or something.

I interpreted his response in practical terms as essentially being the following. Patch set merge 1 has "report" as default and "kill" as a non- default option. Patch set merge 2 has "kill" as default and "report" as a non- default option. Patch set merge 3 removes support for "report". This way we have the best of both worlds: we eventually reach the thing that actually adds real security benefit, which makes security folks happy. And we don't break everybody's computers immediately, allowing time for the more obvious bugs to surface via "report", which makes users and developers happy. Seems like a reasonable process to me.

<comment><USER5> Though, I think that the time between PSM1 and PSM2 will be significant. Usually default options are changed once basically all distros compile with another option without widespread breakage. And once no LTS kernel with PSM1 is supported, you merge PSM3.

Might take years but atleast the airplanes keep flying instead of crashing their computers and consequently themselves.

<comment><USER4> > Though, I think that the time between PSM1 and PSM2 will be significant.

Indeed you're probably right there. Fortunately security-focused distributions and individuals would be able to change the defaults in the interim.

</comment></comment></comment><comment><USER6> Background: the "kernel self protection project" (KSSP) recently upstreamed the Grsecurity/PAX reference counting implementation which prevents a certain class of security bugs from being exploited.

Grsecurity is a security hardening patchset for Linux that makes _deliberate_ trade-offs in favor of security, sacrificing availability if necessary. This, aside from the political issue, is the main reasons why it's hard to upstream it. Linus has called some of their mitigations "insane" before precisely for that reason. Grsecurity will rather terminate userland programs or, in some rare cases, panic the kernel if it finds itself in an undefined state. This is exactly what you want if you care about security, but it's not a trade-off everyone is happy with (including Linus).

Unfortunately, Grsecurity/PAX is not (and probably won't ever be) involved in the KSSP project, and the KSSP developers do not understand the code nearly as well as the Grsecurity team does. This lead to a situation where the new code caused a crash that they weren't able to fix in time, so they disabled the feature in the last minute.

I've been using Grsecurity for years until they stopped making it publicly available, and I remember many bugs that were uncovered by PAX_REFCOUNT and yes, occasionally panicked the kernel where a vanilla kernel would run just fine. They usually found and fixed those within hours.

Grsecurity/PAX have invented many of the modern exploitation mitigations, probably second to none. Some have even been implemented in hardware. Their expertise in building modern defenses is astonishing (their latest invention, the control flow integrity mechanism RAP, is a work of art).

Linux could be the most secure kernel, instead, it's fallen way behind Windows - which has much better defenses than Linux nowadays thanks to Microsoft's ongoing battle with rootkit writers. Go figure.

If the large companies who use Linux _really_ want to improve kernel security, they need to work with Grsecurity and not against them. It's beyond me how this isn't happening already.

<comment><USER7> > Grsecurity will rather terminate userland programs or, in some rare cases, > panic the kernel if it finds itself in an undefined state. This is exactly > what you want if you care about security, but it's not a trade-off everyone > is happy with (including Linus).

I'd also like my kernel to halt whenever an assertion does not hold, for the sake of keeping my sanity; not just for security.

Why would you _not_ want this?

<comment><USER8> Linux is used in so many critical systems.

What happens when a security bug stops the ventilating machine of a person lying in hospital bed, or halts the screen of a surgeon.

Not to mention voting machines, ISP's, telecoms.

For me having all those stopped, when properly exploited, looks more like a very scary DoS attack vector.

Imagine a security f*ck up, like Heartbleed, but this time with an option to halt kernels / systems.

<comment><USER9> Hooold it. Some of those things are not like the others.

\--

I pity the engineers working on ventilation machines and the like. Medical devices are insanely hard to get right; that's neck and neck with aviation testing. I'm reminded of SQLite3's "aviation-grade" TH3 testsuite, which apparently has 100% code coverage. Let's be honest; Linux's monolithic design can't really attain that.

I would never use Linux for a medical device. I say this as someone who just happens to only be running Linux on every machine in the house right now (and I have for years, it's just how things have worked out, it's not at all novel or whatever, my point is that I'm totally comfortable with it). I'd use L4 or something instead. In a pinch I'd use a commercial kernel with tons of testing. Maybe I'd even use Minix; I'm quite sure a lot of people in industry are seriously looking at it now Intel have pretty much unofficially greenlit it as a good kernel (lmao).

\--

Voting machines, on the other hand; I'd totally use Linux for that, because the security/usage model is worlds apart. Here, I WOULD ABSOLUTELY LIKE FOR THE TINIEST GLITCH TO CRASH THE MACHINE, because that glitch could be malware trying to get in.

The user experience of a voting machine is such that you walk up to it, identify yourself, and push a button. Worst case scenario in this situation is that you do some involved process to ID yourself and then the unit locks up, so you have to redo the ID effort on another unit. That is, for all use cases, not going to be a problem.

(I think that's the first time I've used all caps in years!)

\--

Telecom systems... those are also a totally different world. See also: Erlang. In this situation you would likely want a vulnerability to literally sound a klaxon on a wall, but have the system still keep going.

I'm reminded here of an incident where a country's national 3G system was compromised (not the US, somewhere else) by hackers and the firmware of the backend systems was hot-patched (think replacing running binary code - the OS allowed it, it was REALLY hard to even notice this was happening) to exfiltrate SMS messages and cause calls to certain numbers to generate a shadow call (which ignored mic input) to an attacker-controlled number as well.

Telecoms is a classic case of massive scale; nowadays a single telecom switch might be routing thousands of calls through at a time. Yeah you don't want even a single machine to go down. But you DO want VERY thorough debugging, auditing and metrics.

(Which apparently don't exist.)

\--

As for a Heartbleed-esque catastrophe, apparently one is going to be announced for Intel ME at the upcoming Blackhat(?) conference in December. I can't wait to hear about it myself.

<comment><USER10> Many medical devices run Linux. Most (AFAIK) patient monitors run Linux; GE and Philips (the biggest is business) both run on Linux. Those are the devices that keep you alive during surgery, make sure that those who are born too early (I don't know the English term here) are doing ok, monitor you state while you are in ambulance etc.

<comment><USER11> No...

Many medical devices run Linux as a _User-Interface_... (or Windows for that matter).

The actual safety-critical portion of these systems is rarely running Linux, but rather on a bare-metal micro.

<comment><USER9> That makes a lot of sense.

I'm reminded of a UAV doing the same thing. It ran L4 for low-level control, realtime scheduling, and security, and then virtualized Linux on top of that.

Sounds unbelievably clunky on the surface, then you realize it's a remarkably useful way to abstract everything cleanly.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> It's interesting to see this laser focus on a particular kind of user. If you're running Linux on a server, you're a user, but unless you're very irresponsible you would probably rather your programs crash than give away private information. Your interface is to a cluster of machines where individual crashes are probably not that big a deal.

If you're running Linux via Android, you're a user, but mostly you're a user of actively developed apps on top of an actively developed OS, usually pegged to specific kernel versions. Your interface is to that layer on top, and given that its code is written by app developers and hardware vendors who will ship anything that doesn't crash, you probably want security bugs to crash.

It seems to me that the kind of user Linus means when he talks about "the new kernel didn't work for me" is a user of Linux without any substantial layers on top, where kernel updates happen more often than userland software updates, and where individual crashes have a significant impact. In other words, users of desktop Linux.

But I wonder if that focus on desktop Linux really reflects the majority of users. And, if not, perhaps it might make sense to have "hardening the Linux kernel" as the first step if it makes "raise the standard for the layers built on top" the endpoint.

<comment><USER13> >you would probably rather your programs crash than give away private information

Crashing on a security issue is a good thing for every kind of user. Crashing on a latent bug that _COULD_ be exploited (maybe not possible at all) is a totally not desirable situation. The problem here is that hardening methods lack the ability to make that distinction.

<comment><USER14> > Crashing on a latent bug that COULD be exploited (maybe not possible at all) > is a totally not desirable situation.

How do you square this with the reality that "keep on truckin" is generally the path from bugs to security exploits, and has been shown to be over and over in the wild?

<comment><USER13> Bugs will happen, that's a natural law of computer science, if you keep on trucking over them you will be delivering buggy software that is likely to cause problems. Even if you chase them down and correct them all, your software is still going to have bugs, that's a fact of life.

Should code containing bugs be allowed to run? If the answer is no we must ask ourselves how much software we have today that is completely bug free (that will be 0%).

I still think these proactive approaches are good to disclose possible exploits, but killing processes just because they might be exploitable is a very long shot.

</comment></comment></comment></comment><comment><USER15> Very pragmatic. He sees software in the overall context of getting a job done with a computer, imperfect though it may be, instead of dying because it was not perfect.

Unlike a segfault from a user space program that indeed merits a 'kill', the kernel should strive at all costs to keep running, since kernel panics are so much more inconvenient.

<comment><USER16> Absolutely not.

If "do no harm" is a principle, then the kernel should ensure that no harm is taking place.

If flaws within the kernel allow _harm_ to occur while otherwise normal transactions are occurring then it is absolutely preferable to panic and shut down over allowing that potential harm to occur.

To suggest otherwise, that detected errors that allow harm should be allowed, is pure insanity.

Linus is unquestionably wrong in the regaurd.

<comment><USER17> A thought experiment that comes up in Kernel design classes is what should happen if the OS was running the flight-control software for an Airplane you are on? If there was a bug in the kernel, perhaps a double free or a memory leak, what should happen?

A panic would result in the airplane falling to certain doom. But if it were to keep running, it may be a security vulnerability. Being absolutist in either direction of the discussion will lead to absurd scenarios where you would make the wrong decision.

<comment><USER18> > double free or a memory leak, what should happen

Both offensive and defensive programming is important in safety critical programs and I get your point, but those things you mention don't' happen in safety critical systems.

There is no dynamic memory allocation. RTOS used will support "brick wall partitioning" for memory, processing and other resources. Different systems can run in the same OS but they cant' compete for processing time, locks or memory access. Everyone has been dealt the resources they can have from the start. It's not possible to run out file descriptors, memory if you allocate them statically from the start.

Assertion errors or monitoring errors in safety critical systems usually cause reset or change into backup system. If the program state is large and reset is not safe, retreating to some earlier state (constant backups) is likely.

<comment><USER19> _but those things you mention don 't' happen in safety critical systems._

Errors in logic happen everywhere.

<comment><USER18> _those_

dynamic memory allocation errors don't happen when there is no dynamic memory allocation.

</comment></comment></comment></comment></comment></comment><comment><USER20> "without users, your program is pointless, and all the development work you've done over decades is pointless.

.. and (then) security is pointless too, in the end."

He tends to get really mad when kernels dev inconvenience user space devs. Perhaps one of the reasons Linux succeeded was because of this fanatical customer focus - if linux is the platform, user space developers are the customers.

<comment><USER21> This.

Not breaking user space is fundamental to the success of most operating systems today. I read this article I cannot seem to find about Microsoft employees spending months replicating "wrong" behavior in <oldwindows.. win95?> so that applications still ran on <newerwindows... win98? win2000?>. Users don't want to see their applications crashing.

I wish I could find this article again, it's very relevant to your comment.

<comment><USER22> It reminds me of the hack Microsoft did to make simcity work in Windows 95. [https://news.ycombinator.com/item?id=2281932](https://news.ycombinator.com/item?id=2281932)

</comment></comment></comment><comment><USER23> I think the earlier message drives the points home in more familiar Linus style:

[https://lkml.org/lkml/2017/11/17/767](https://lkml.org/lkml/2017/11/17/767)

"Some security people have scoffed at me when I say that security problems are primarily "just bugs". Those security people are f*cking morons."

Gotta love the guy. :)

<comment><USER24> The person at the other end of the conversation would disagree with this sentiment:

"Thanks. Still, I'd prefer Linus yell at me than other folks trying to do similar work. If I can shield anyone from this abuse, then maybe they won't give up on kernel security development. Digging Linus's actionable feedback out of the ad-hominem attack can be challenging." [1]

[1] [https://twitter.com/kees_cook/status/932694978366619648](https://twitter.com/kees_cook/status/932694978366619648)

<comment><USER25> >Digging Linus's actionable feedback out of the ad-hominem attack can be challenging.

They're not really that separate. He's being totally disingenuous and still letting his own fragile ego get involved.

<comment><USER23> > He's being totally disingenuous and still letting his own fragile ego get > involved.

Who is?

<comment><USER25> The person complaining.

</comment></comment></comment></comment></comment><comment><USER26> That's a consequence of an "old" issue in the IT security field - <USER2> researchers and developers sit at opposite sides of the table, they've got different concerns and agendas.

Pick some security researchers; now tell them to build any nontrivial piece of software; I doubt they'd be able to do it, and if they succeed their software will be full of bugs, including security ones.

Security is part of the correctness and of proper building of the software, so it should be integrated into software development. Security experts can (and should) still exist, but the current state, where the infosec people appear to rule, is pointless - exactly because the same infosec people wouldn't be able to deliver better software than current developers.

I highly regard somebody _who can write a software without security bugs_ ; I don't regard as highly somebody who shows me the bugs, but would be unable to write that software at all.

Let's turn the infosec objective: not to undiscover security bugs, but to write software without security bugs. Then we're at the same side of the table.

<comment><USER6> That's not a fair (or useful) assessment. Obviously, the narrow-minded security people you describe exist, but they're a minority. Many security people are developers who specialized in security, and are very much capable of building software.

The kernel code is question is exactly what you ask for - instead of finding and fixing single bugs, it's a mitigation that prevents _all_ occurrences of a particular class of bugs.

<comment><USER27> When I was looking to learn about how to systematically make secure software, I did not found all that great actionable information. There is a lot about particular hacks and vulnerabilities, lists of popular vulnerabilities categories etc. There are was one book dealing with architecture and such I found. Development quite clearly is not focus of security research.

A lot of advice, especially that found on blogs, was literally naive and felt like something written by someone who never even seen larger team working.

<comment><USER28> As a infosec guy who was a software developer, its non-trivial to write actionable general security advice.

There is an entire academic field of study on making network related security blunders hard (lang-sec). It generally boils down to do all your parsing in one spot and a small set of features are evil.

What is really needed is a site where one can pick a bunch of features that your software project has/wants and then it gives semi-tailored advice on what to do, what to watch out for, or that you need to rethink things (eg: rolling your own TLS implementation=world of hurt).

</comment></comment></comment></comment><comment><USER5> >It's that the code has been RUN BY USERS for months. If it's been [...] in grsecurity for five years [...] It only means that hardly anybody actually ever ran it.

Subtle burn towards Grsec, I laughed a bit.

In all seriousness, I think Linus is somewhat on the right track. Security Patches should foremostly not break anyone's workflow (maybe except the evil haxor's workflow) and rather print a warning until the exact implications of a full Terminator-mode patch is understood. Because people won't upgrade to kernels that break their workflow and a warning in the kernel log is better than a vulnerable kernel.

</comment><comment><USER29> I'm reminded of a recent security fix for IE11 that Microsoft pushed out earlier this year:

[https://developer.microsoft.com/en-us/microsoft- edge/platfor...](https://developer.microsoft.com/en-us/microsoft- edge/platform/issues/12349663/)

It killed printing from iframes completely. Great that they solved the security problem, whatever it may have been. They also broke a major piece of browser functionality that a lot of enterprises rely on fundamentally. Hell, even printing shipping labels from eBay was broken, and so was hilariously Microsoft Dynamics 365. And our own product.

And the first response by Microsoft on this very link? "Won't Fix" and keep a major bit of fundamental browser functionality - printing a document - <USER3> working. "Do No Harm".

<comment><USER30> Because there is a workaround, applications just need to be updated.

"Either use Print Preview instead of print button or if currently using window.print() in javascript change this to document.execCommand('print', false, null)"

<comment><USER31> > Because there is a workaround, applications just need to be updated.

What actually happened: people reverted the patch. In the real world, you can't expect timely or even correct response from vendors you rely on. It sucks, but it's how it is.

<comment><USER32> Then after you get compromised in some way, you will start to look for better vendors.

<comment><USER31> Only if the cost*risk of a future compromise is > cost of replacing the product. This is rarely going to be the case for business critical software.

</comment></comment></comment></comment></comment><comment><USER33> Some security folks tend to have tunnel vision. They are focused on their own little patch and the first instinct is to control and shutdown with zero concern for usability. job done. bye. But that's too self serving and lazy.

And if that's what they want fine, release your own app or distro and let people who need/desire that level of security choose security over everything else without trade-offs.

The worst thing is a kind of entryism and trying to impose yourself on people operating under different constraints. That's why you always need a strong manager to balance interests and this is the role Linus is playing. More often that not with this kind of imposition something comes out of the blue, and you are left squandering hours to fix things and get back up and running.

</comment><comment><USER34> A few points:

1) failing loudly is better than failing silently. A memory corruption issue (or a bad refcount, etc.) is not a benign issue that only becomes relevant under carefully crafted exploit conditions. You need the carefully crafted exploit to get the system back into an attacker controlled state (I.e. code execution); by itself (with non-malicious inputs, usually something random or slightly atypical — enough to not have been noticed yet, but typical enough that some program does it) the system is likely to either panic immediately (same result as with pax) or to corrupt some memory, in which case you will have a lot of strange behaviour to track down later (users will probably blame them on hardware or on their user space, so you might never see them. for example a recent OSDI paper showed that ext3/4 had several real world data corruption bugs. If these aren't as frequent as the recent bcache issues, no one notices).

2) When I was doing research projects (into memory defenses on the kernel) about 3 years ago, there was no (commonly used, that I saw) automated testing infrastructure in the kernel. This makes catching regressions, especially in drivers for rare hardware, hard to catch. While tests aren't a panacea, i think Linux overestimates what fraction of problems Code reviews will catch.

3) the "don't break user space" strategy is already failing. Every mainstream distribution and embedded vendor stays on an old kernel branch. Big deployments do staged rollouts and extensive burn in tests. This isn't just because the kernel, but because of extensive abreaking changes everywhere (compilers, standard libraries, etc. all need to change sometimes).the last time this happened, IIRC it was some audio bug in a strange configuration. In my experience, running a non standard Linux audio confit causes countless breakages, so an additional one in the kernel that might save my personal data from being exfiltrated is worth it. Most users have average (and therefore well tested) setups, which means thy won't see breakages as often.

Perfect software doesn't exist, and even MSFT backed off maintaining religious backwards compatibility (note that Microsoft's approach was not to flame at developers and hinder new development, but through extensively building compatibility shims. Often, these came with trade offs strongly in favours or security, e.g. UAC).

Breaking user space is ok; users already expect breakage, and the cost of the additional breakages is low (to users and to society as a whole) compared to the cost of security breaches [citation needed, but Linux kernel security is relied on in a lot of places].

<comment><USER35> So one of Linus' main points in this series of posts is that failing loudly is actually not always better than failing silently or quietly, and it's really annoying when people come in making that assumption without thinking. This is also something that he is constantly repeating and ranting about, and it's arguably one of the reasons why Linux is so successful.

Think about a smartphone - do most users want it to crash and reboot, even if some error (which could end up being a security issue) occurred? The answer is no, absolutely not. The crashing and rebooting itself isn't really that helpful. Reporting the bug to the Linux developers _would_ be helpful.

Some people do want the frequent crashing behavior and that's okay, but it's not okay to make that decision for everyone.

Also, users might expect minor breakage if someone somewhere makes a mistake, but that doesn't mean it's okay. That's like saying if someone always washes their hands before eating, it's okay if they get sick, because they were expecting that they might get sick.

<comment><USER30> Interesting that you mention smartphones, because that is exactly what Google has made to their Linux fork.

Every Android app that misbehaves, just gets killed without warning.

The scenarios where this might happen, have been increasing since Android 7.

</comment></comment></comment><comment><USER36> So tl;dr - fixing a security bug is rarely the end of the story, fixing the root cause is far more important. And don't piss off the users.

<comment><USER37> If your security patch kills users' buggy processes or even crash their systems then you are a «bad security person». Please report the bad access first so users and developers of their software have time to fix the bug. Upgrades disabling users' software are a big no-no. After all security is meaningless for a non-working system.

<comment><USER16> I'm so glad that backwards thinking concepts like this are dominant, otherwise we might actually have secure software!

Think about it, an open-source OS is choosing backwards compatibility over security. This would have caused quite the stir in the 90's Linux community.

<comment><USER37> Security is meaningless if your system doesn't work. Makes sense for me. Or your car is forbidden from starting after an upgrade because you might run over someone tonight. It's a trade-off.

</comment></comment></comment></comment><comment><USER38> This is the most insightful Linus writeup yet. His others are good too, but this just hits the spot. Great!

Funny note, this post could have been a textbook sort of material. At the end he even says please. The only thing that breaks it is the reference to touching oneself :)

</comment><comment><USER39> No security person is likely to argue that DOS attacks aren't a security issue. They get CVEs all the time! A patch that denies the user the ability to use the service introduces a security issue. Bad usability IS a DOS attack.

</comment><comment><USER40> With respect to [https://lkml.org/lkml/2017/11/21/356](https://lkml.org/lkml/2017/11/21/356) and this thread I just want to get #CVEs on all the things so we can figure out the scope of the problem, and then look at what we need to do to "fix" "it" (assuming "it" is a real problem, dunno without data).

</comment><comment><USER41> Quick question - doesn't Linux driver model (they run in kernel-space) create a giant attack vector because of that?

<comment><USER42> Lots of drivers on Windows, OS X and Linux run in kernel space simply because kernel-to-user-and-back context switches are expensive and so kill performance.

I believe the exceptions are printer and scanner drivers (these run in user- space CUPS in OS X/Linux), some filesystem drivers (basically, FUSE-backed) and cheap-ish USB drivers.

<comment><USER41> The logic behind why it is done like that I get. Just wondering as You said is it possible to push at least the most bug-prone and exploitable ones to user- space

<comment><USER15> I don't see how you can convert a kernel-space driver to a user-space one without significant rewriting, and in some cases it may not be possible at all.

<comment><USER41> What about some abstraction/interfacing layer/driver that would take care of exposing some kernel functionality an average driver needs and provide additional validation?

<comment><USER5> Drivers need to do things that are inherently unsafe.

The driver responsible for you harddrive needs to instruct the SATA controller to copy a piece of data from disk to a specified memory location.

The kernel has no understanding of the process without the driver and is therefore incapable of preventing abuse.

You can _somewhat_ prevent this using various methods but those cost performance.

And keep in mind the abstraction itself already costs performance and this doesn't even allow easy extending of the abstraction if necessary.

While microkernels that do run everything in userspace are nice in theory, you usually pay in CPU cycles compared to kernel-mode drivers.

</comment></comment></comment></comment></comment></comment><comment><USER43> Body for this message unavailable

Cache: [https://web.archive.org/web/20171122005241/https://lkml.org/...](https://web.archive.org/web/20171122005241/https://lkml.org/lkml/2017/11/21/356)

</comment><comment><USER32> Is there no way to make this an argument at boot time?

Something like, `ksecerr=log+kill`

</comment><comment><USER44> Related to this from a couple days ago: [https://news.ycombinator.com/item?id=15738392](https://news.ycombinator.com/item?id=15738392)

</comment><comment><USER45> I wish Wayland developers would share Linus' mentality.

Right now it restarts once every 36 hours in average, killing all my windows and programs.

X11 didn't behave as bad.

</comment><comment><USER46> Wow, Linus still has it. That was an _excellent_ email. Go Linus, that's some full on management chops on display.

</comment><comment><USER19> _Because the primary focus should be "debugging". The primary focus should be "let's make sure the kernel released in a year is better than the one released today"._

Is he starting to sound like illumos engineers or what? Better late than never, but it took him long enough.

</comment><comment><USER47> A dumpster is not a bug, it's a social issue - [http://www.mit.edu/hacker/hacker.html](http://www.mit.edu/hacker/hacker.html)

</comment><comment><USER48> Linus: Do no harm! Except against security people. I'd like to harm them _a lot_!

</comment><comment><USER49> do you want to know why your (random big company) does not do software development that well. when was the last time you saw an email like that from the chairman of the board to all employees? with Please in it. and long winded explanations?

companies need to chnage

<comment><USER50> This is what I was thinking when I was reading. Linus has been thinking carefully about this for a long time. He has taken this piece of software and he has nurtured it for years. He has protected it. He made sure that it is coherent and maintainable. He has put forward as set of guiding principles.

I haven't seen this in the companies that I have worked for, middle and upper management don't have any insight over the products they are building. They just care about dates and getting projects done. There are not insights. There is no long term thinking. There is no awareness of the technical debt that is building up. Their only solution is to throw more money (and people) to the projects.

<comment><USER51> I 100% agree with Linus here, buuuut Linus doesn't have to make money for his company, and isn't personally responsible for the salaries of people in the company. He doesn't have to sit in meetings and explain why sales are down 10% this quarter, or keep assuring investors that their money is safe. Those upper-management people do solve problems, its just that they're solving problems in an environment that isn't based on logic, and is fundamentally unfair.

</comment></comment></comment><comment><USER52> The first thing I did when starting to read Linus' answer was to Ctrl-F for badwords. I am really happy he's blossomed from that teenage angst colorful name-calling era.

Way to go, man!</comment>


Google for India: Building India-first products and features - <AUTHOR> https://www.blog.google/topics/next-billion-users/building-india-first-products-and-features/ <comment><USER2> Data in India is really cheap. You pay <$7 for 30GB of data and the speed is not bad at all (about 20-30Mbps)!

<comment><USER3> Is this country-wide or only at limited areas?

<comment><USER4> The prices posted by OP seem to be referring to the carrier Reliance Jio. Their network speeds were great initially(20-30mbps when other carriers we're hardly at 5-10mbps). The speeds have deteriorated significantly now. The network seems to be reeling under the load of it's huge user base.

<comment><USER5> It depends on the area, I have used it in multiple cities and except one location (problem with all networks there) all else was good. There is an option in the jio app to register complaint about slow network, I have had some luck with that.

</comment></comment></comment></comment><comment><USER6> I am wondering how does one uses Google maps while driving a two wheeler. I have driven a Yamaha in India for years and juggling a phone definitely seems risky.

<comment><USER7> Get a snug helmet and put your phone inside against your cheek!

<comment><USER8> Or just use earphones maybe?

</comment></comment></comment><comment><USER9> Tez had excellent marketing. Every time you referred a friend, you and your friend got Rs. 51 (less than $1). Every time you transacted (some min. amount) they gave out scratch cards. In my circle even those who were skeptical initially gave in to the temptation.

<comment><USER10> that's not excellent for india, that's standard. nearly every service over there gives out free money as standard SOP since indians love deals. did i say love? i meant they will literally use your service even if it never delivers 75percent of the time as long as you give them a good deal. they'll complain but they'll use it. however also demonstrated that indian users will jump shit asap to the competitor offering the better deal so retention is really really really hard in india

</comment></comment><comment><USER11> > And Indians are using more data than ever before—4GB on average every month, > projected to grow to 11GB per month in the next four years. Cheaper data > through carrier innovation and greater access to public WiFi such as Google > Station makes the richness of the internet more accessible to Indians.

This has to be the worst PR news from Google I have ever read. For one, taking credit for something they have not delivered. Anyone and everyone in India will tell you the whole thing has to do with Reliance Jio and not much to do with Google wifi at all. Though given the cost of spectrum in India it remains to be seen if the data plans remain cheap. They have already increased from 309 for 3 months to 459 for 3 months ie more than 48% increase (surprisingly plans are still cheap compared to the old plans).

Then it talks about Android Go, even though there is a full fledged release page. Tez already exists with it's own PR page.

So, the only two things are:

> The Google Assistant for the JioPhone

Even after reading twice I don't understand what is special about this other than the carrier branding.

> Two-wheeler mode in Google Maps comes to India first

This looks promising though with even bigger risk than the general maps. So kudos, I guess?

<comment><USER12> I can't say about the other stuff but tez is surprisingly awesome. Tez + UPI + Adhaar just blows away everything I've seen. This has potential to cut out the cc middlemen completely.

<comment><USER13> I' have to agree. UPI (Tez/BHIM etc.) is so awesome and a pleasure to use, I don't even like credit card payments anymore. Wonder why the USA doesn't have anything like that.

<comment><USER14> I'm curious, have you never seen failures happen? I've seen it happen a few times - a payment to a merchant times out and they don't receive it till days later. By then you've already paid twice and its difficult to recover the money. This isn't a problem with credit cards where you can simply issue a charge-back. Until UPI has a grievance redress system, it will struggle to gain mainstream acceptance.

That's not the only issue. Operating this system isn't free. For now, no transaction fees are being levied but banks are eagerly awaiting the day that the RBI will allow them to. 1-2% of a txn might not seem like much, but it'd be a tough sell to consumers asking them to pay more when they could use cash instead.

<comment><USER13> I've made numerous (at least more than 100) UPI transactions, but haven't seen a single 'failure' as such. Yes, there's been delay at times, but it's just that, a delay. It's a little inconvenience at that time, but it's comparatively much rarer (and less frustrating) than OTP SMS not received problem for a credit card transaction which I just started hating. Most of the times, UPI (Tez) transactions are instant for me.

About 1-2% charges, if they ever start using it, wouldn't it still be better than credit cards? Most merchants don't charge extra for those (but some do even for credit cards).

</comment></comment></comment></comment></comment><comment><USER15> This is a smart move for Google. There's a large market in India that isn't being used by them currently, so if they can catch that market, they'll definitely benefit from it.

I do find it interesting, though, that "India-first" features are being praised by most here, while "America-first" features would probably be looked down upon by most here as well. What do you think causes the different reactions between the two?

<comment><USER16> Literally every other Google product is America-first, just no need to market it as such.

<comment><USER15> If there's no need to market a product as America-first, then why is there a need to market these as India-first? Like they said in the article, the products made won't just help India.

<comment><USER17> Because Google is trying to build the monopoly they have in America in India as well. They are specifically targeting the market they hope to gain capture in.

A lot of users may prefer a locally-branded competitor because they feel it is properly tailored to their needs and culture. (I've specifically heard Yandex understands the interests and needs of Russian-speaking users better than Google, which is not a shock.) Presumably, specifying "India-first" is intended to convey that these apps are developed specifically for Indian users and their needs.

<comment><USER15> > Presumably, specifying "India-first" is intended to convey that these apps > are developed specifically for Indian users and their needs.

Oh, I understand this completely. It makes perfect sense for Google to focus on an emerging market to become a monopoly there, and I feel it's a fantastic strategy.

What I'm more curious about is why an Indian-first focus is met with fanfare and acceptance, while an American-first focus is met with derision and contempt against something anti-globalist, and that these two opinions often come from the same group of people. I just find it an interesting dichotomy.

<comment><USER17> Presumably the same way saying you're a "women's rights activist" makes you fighting for a good cause and saying you're a "men's rights activist" makes you a sexist, and saying "black lives matter" is fighting for a good cause, but saying "white lives matter" makes you a Nazi.

The language is preloaded with a lot of existing conceptions about the state of the world currently, and the sort of people who use each set of terms.

</comment></comment></comment></comment></comment></comment><comment><USER18> Remember Android One program? Google has commitment issues to their products/programs

<comment><USER19> Mi A1 was released in September [http://www.mi.com/in/mi-a1/](http://www.mi.com/in/mi-a1/)

</comment></comment><comment><USER20> > Google Go, a new app from Google Search

Sigh. Why do they pollute/confuse their existing products/projects? Go (Lang) was already difficult enough to search for on Google.

<comment><USER21> Maybe, because the average Indian user has nothing to do with the programming language. However, s/he understands the word Go even if s/he is illiterate?

<comment><USER22> And the average Indian users will be confused even more than developers, when they search for "Google Go" only to receive results about Go language.

<comment><USER23> I don't think so. I frequently search for golang related issues, but even then when I search for 'Google go', the golang website is on number 6 and has no other mention on the first page at all. It is the programming language which suffers from poor discover ability. For an average non programming indian, golang might not feature on the first page at all.

</comment></comment></comment></comment><comment><USER24> Sometimes I think twice before naming our company's projects since one may do it one day. My observation from news is that first letter is fundamental; I wouldn't name anything starting with G. Google is world brand indeed, but the name itself feels so ugl^W unnatural to me. Now they're locked into that Goo- gl thing.

Why do brands reuse naming schemes for new projects? If you can do the best, integrate and adrertise, isn't it better to drop pr weight and start over with completely new names?

<comment><USER25> Are you saying you're having trouble distinguishing between Google Great, Google Good, Google Gumballs and Google Great GoogleyMoogley? I thought the differences were obvious! /s

</comment></comment><comment><USER26> > Tez has processed over 140 million transactions from nearly 12 million > active users. There are more than 525,000 merchants already on Tez, using it > to take payments, pay their suppliers or transfer money to employees.

Add to that the insane scale of AliBaba (with AliExpress) and WeChat who together process over a trillion dollars yearly. India and South-East Asia have an insane number of people.

Not to beat a yet-alive horse, I'd love to see bitcoin (and other cryptocurrency) proponents tell the world how they are going to deal with _that_.

<comment><USER15> > I'd love to see bitcoin (and other cryptocurrency) proponents tell the world > how they are going to deal with that.

The price of cryptocurrencies are a function of supply and demand. A very large number of people wanting to get bitcoins combined with a limited number of bitcoins means the price would go up.

<comment><USER26> I'm not talking about price. I'm talking about scale

<comment><USER10> crypto scales with need - the number of nodes are increased and the blockchain balloons in size to keep up, just like regular banking transactions do. plus the core devs are very aware of scaling issues - since it's mentioned every time financial crypto is brought up

hardware is cheap, why would crypto scaling be an issue?

<comment><USER26> > hardware is cheap, why would crypto scaling be an issue?

Because the algorithms governing crypto may not be scalable.

Case in point: a simple game of CryptoKittens basically crippled Ethereum:

\- Etherscan has reported a sixfold increase in pending transactions on Ethereum since the game's release, by the Axiom Zen innovation studio, on 28 November

\- CryptoKitties has become so popular that it's taking up a significant amount of available space for transactions on the Ethereum platform

\- the CryptoKitties game accounts for over 10% of network traffic on Ethereum. As traffic increases, transactions become more expensive to execute quickly.

All this for a number of transactions that wouldn't even register on the radar of ... well ... any of the "more traditional" paying systems (including the pay apps like Tez, AliPay, WeChat etc.)</comment></comment></comment></comment></comment>


Anyone Who Does Not Do This, Will Be Fired.Thank You.Have a Nice Day-Jeff Bezos - <AUTHOR> http://apievangelist.com/2015/07/09/the-new-aws-api-gateway-anyone-who-does-not-do-this-will-be-fired-thank-you-have-a-nice-day--jeff-bezos/

<comment><USER3> Could someone edit the title and put spaces after the periods and around the dash? It's really bothering me.

</comment><comment><USER4> He was ahead of the curve.

APIs are definitely the way forward but there are still some hold outs - <USER2> increasingly, many of the social platforms such as Twitter and LinkedIn are putting limits on the type of data they share.

<comment><USER5> What benefit is there, really, to Twitter or Linkedin to allow other people to leverage their resources for free?

<comment><USER6> in my view, it's user growth. get more users consuming from your platform, then they can consume it across all their media and devices and on some of those transmission platforms or devices you can monetize.

<comment><USER5> Well, I presume that's why they offer an API, but does then allowing unlimited use outweigh the costs?

</comment></comment></comment></comment><comment><USER7> I still quote this in internal meetings, about decoupling our business components.</comment>


Show HN: Distraction Dimmer for Mac – increase your focus with a twist of a knob - <AUTHOR> https://hazeover.com <comment><AUTHOR> It's a fun redesign of "HazeOver" app I've been working on. The process involved designing a new "Dimmer" control knob, shooting a live demo video for trackpad gestures and creating a dedicated utility that synchronizes mouse clicks to the soundtrack beats. Hope you like the demo and the app.</comment>


Relicensing React, Jest, Flow, and Immutable.js - <AUTHOR> https://code.facebook.com/posts/300798627056246/relicensing-react-jest-flow-and-immutable-js/?utm_source=codedot_rss_feed&utm_medium=rss&utm_campaign=RSS+Feed <comment><USER2> And now we don't get a patent grant...

[https://twitter.com/ryanflorence/status/911353887918931968](https://twitter.com/ryanflorence/status/911353887918931968)</comment>


What'll happen to all the Kindle books when Amazon dies? - <AUTHOR> Whether it be in 50 years or 50,0000. <comment><USER2> I convert the .mobi files into .epub and keep reading.

[https://calibre-ebook.com/](https://calibre-ebook.com/)

</comment><comment><USER3> With the risk of offending someone: books worth being around in 50.000 years won't be "kindle only".

I love my kindle though, I use it daily and think it's a great device. You don't have to buy ebooks through amazon to read them on the kindle by the way. :)

</comment><comment><USER4> Good question, and that's the main reason I prefer to own physical books over Kindle books. I know that I own a physical book, but a Kindle book can disappear at any moment. Kindles are great while traveling though.

<comment><USER5> Do you often reread old books? I find that most books are only read once and then discarded, but it's hard to tell which ones are before buying.

<comment><USER6> I don't even have a concept of an "old" book or of "reading" a book, I just keep them around for inspiration, going back for some quote, rereading, showing someone, etc. I mean I also almost never finish them, or even try to read them in linear order...

<comment><USER7> It really depends on the type of book. muzani might be thinking novels, while you could be thinking textbooks.

</comment></comment></comment></comment><comment><USER8> Amazon decrypts them all to DRM-free files at the eleventh hour. Then individuals don't have a backup habit and so later end up losing their files anyway.

<comment><USER9> Yeah, I like how all the other other failed/failing companies have done likewise (/sarcasm)</comment></comment>


Hacked iPad Runs Google Chrome OS - <AUTHOR> http://www.padgadget.com/2010/10/01/hacked-ipad-runs-google-chrome-os/

<comment><USER2> is Google Chrome OS based on x86 architecture ? does the iPad have the ability to run OS X for example? i thought it wouldn't.</comment>


Ask HN: What makes an aggregator site great? - <AUTHOR>

What makes an aggregator site great? I am thinking of building one for a niche market but I thought I would get your opinion first. <comment><USER2> What market are you thinking of approaching?

We work with a lot in our space (group buying) and the ones that I see as most successful are those who make the user experience as delightful as possible. Where someone can simply put up an image, some copy and some deal details and then pile on deal after deal so the user has to keep scrolling through the webpage is backwards UX. If you can capture the best content available, and then surface that content in such a way that's intuitive and interactive to your end-user, you can build a great service.

How are you thinking about the monetization perspective?

<comment><USER3> Do you have any examples aggregation sites that you think pull off a good UX?

<comment><USER2> Kayak, SeatGeek, Yipit</comment></comment></comment>