Why Git sucks? - <AUTHOR> https://enux.pl/article/en/2014-01-21/why-git-sucks <comment><USER2> > In Git, you can checkout neither a single folder nor a file.

Yes, you can. It's called sparse checkout[1] and not that hard. Also, you can subtree merge[2][3] directories back and forth preserving all the history and merging back if you wish (cutting a directory out of the repository to a separate one and putting it back). It's pretty easy to do in git>2.0 because there is a builtin _subtree_ command[4] for it.

[1]: [https://www.kernel.org/pub/software/scm/git/docs/git-read- tr...](https://www.kernel.org/pub/software/scm/git/docs/git-read- tree.html#_sparse_checkout)

[2]: [https://help.github.com/articles/about-git-subtree- merges](https://help.github.com/articles/about-git-subtree-merges)

[3]: [http://git-scm.com/book/en/Git-Tools-Subtree-Merging](http://git- scm.com/book/en/Git-Tools-Subtree-Merging)

[4]: [https://news.ycombinator.com/item?id=3926683](https://news.ycombinator.com/item?id=3926683)

<comment><USER3> The actual meaning here is "clone" a single folder or file, not checkout.

<comment><USER2> There is no practical difference. Yes, you clone and have the whole repository on the disk, but after a sparse checkout you only have to deal with the files you are interested in.

The only problem can be with Facebook-sized repositories, but I believe in modularizing that big of a system instead of storing everything in one vast repository.

</comment></comment></comment><comment><USER4> Used both SVN and GIT on different types of projects. Gotta admit, it's been a little harder to get used to GIT. It has a more complex interface and ways of doing things.

However, it feels like comparing SVN to GIT is like comparing horses to automobiles at this point.. Yes, a horse can heal minor damages without a mechanic, your car can't. And it can swim if need arises, good luck with a car on that.

Woudn't choose a horse for anything serious though. Maybe for fun and sports.

<comment><USER5> Nitpick: It's just Git, it's not an acronym.

I agree git has a more complex interface - I think I've read it described as "not quite user-hostile, but only expert-friendly", which I think fits.

That said, I think the model of how commits work is far more intuitive than anything else I've come across. A commit is just a diff and a pointer to the commit that came before it, and a branch is just a pointer to a particular commit.

<comment><USER6> Nitpick: A commit is not a diff, it is the entire tree. Any diffs you see are computed, not stored.

You can export a commit as a diff+pointer-to-prev-commit, but when git imports it, it gets turned back into a full tree.

<comment><USER5> That's true. I simplified for the sake of not delving too far into the details, because it makes sense at the smaller level. It's also true that a commit isn't always just one pointer to the commit that came before it, in a merge there are two pointers, from commit_head and merge_head

</comment></comment></comment></comment><comment><USER7> > Impractical for single repository of libraries

Submodules?

I actually think an entire repo of libraries is the wrong way to go. With the git model, we have however many repos acting as the source for these libraries. This repository that contains all of these submodules can then be the arbiter of which version should be included in the release.

> Yes, some will say - but this is good - centralization is bad... Well, it > depends. If you can spend time to figure out who is who, then it will work > for you.

And this problem doesn't exist with SVN? Sure, maybe if you are the sole publisher of all these libraries it might be ok, but with most real world examples, there exists multiple contributors. Now they need to go through you when there needs to be a specific update to that library. With git, the maintainer of the repo of libraries(submodules) just updates the specific submodule to whatever release works for their tastes.

Most of these complaints sound like an SVN user having some pain when trying to think in git.

</comment><comment><USER8> I think my main problem with git (though I use it) is that things that should be simple are mind numbing hard. At 2:00am when I working, having to read pages and pages to decide if git pull is the right thing is just painful.

I never felt that type of pain with SVN, it more or less just maps to directories.

To each his own I wish there was the right way to use git in 50 words or less. If I need to read a book to correctly use it ... grrrrrrr.

<comment><USER9> Some people like git pull, but I prefer git fetch. This gets all's the history from the remote repo without applying any changes. Then you can run something like 'git rebase -i origin/master' which is where I think git can really shine.

There is an excellent link out there that explains git in layman's terms. I think it's called git for hackers or something of the sort. It's much easier than the docs in my opinion.

<comment><USER7> Best practices are to not use pull unless you certainly know you should.

Things should be fetched then merged with two separate commands.

<comment><USER10> Pulling is equivelent to doing a fetch then a merge. Unless you plan on doing something between the two steps (like inspecting FETCH_HEAD yourself), then there is no advantage to not simply pulling.

Of course, if (like thrush) you do not plan on doing a merge, then you will need to do the fetch manually and do what you do want to do. Although, git pull does have a --rebase option, but I am not sure if you can pass the -i flag to it.

Having taught people how to use git, I found that it is easier to not show them the pull command until they are used to doing fetch && merge.

</comment></comment></comment></comment><comment><USER11> These are extremely superficial reasons to criticize git, leading me to believe that the author knows very little about git internals. I'll take the first critique and leave the second to someone else...

You can't pull a portion of the repo because the current state of the repo is built from the tree of commit diffs... This and the fact that git itself is a hash database leads to very efficient use of space. If you want a single folder within a repo, why isn't that folder its own repo?

Between that, the passive aggressive ;-) and the unfortunate advocacy of SVN... ugh.

<comment><USER12> _leading me to believe that the author knows very little about git internals_

Needing to know about the internals of git is a flaw of git, not a feature.

<comment><USER11> Why would you use a tool you don't understand? What if it breaks?

</comment></comment></comment><comment><USER13> Sounds like the author has a workflow problem here. Most of the reasons given of why Git sucks could be from the OP's inability to adapt their workflow.

SCM is a matter of choice; there is no right or wrong answer and people need to get over being right.

<comment><USER14> > SCM is a matter of choice; there is no right or wrong answer

That really sums it up. The right answer comes from seeing what you need and using whatever tool fits the job.

</comment></comment><comment><USER15> A benefit of git, for which I can forgive a lot of git's flaws, that was not mentioned in the conclusion is the light-weight branching. The ability to quickly make a branch, experiment, branch off that, merge back, cherrypick commits from another branch, etc. makes me more efficient by spending less time worrying about affecting stable code with experimental changes.

<comment><USER16> Yup this is exactly it. For developers fluent in git, it is a very real part of their development cycle (branching, rebasing, etc). What I've seen of most SVN (and going back to CVS) is that their SCM is more or less just an archiving tool. A place after you've done all your hard work you use it as a fancy rsync tool to back it up. I don't see a lot of SVN users making svn the same part of their workflow the way git devs do. Maybe it's just the developers I work with though.

</comment></comment><comment><USER17> re: the "Impractical for single repository of libraries" section... The author seems to think the only way to manage many different plugins is to split them into different repos: "If you have e.g. 100 plugins, you should have 100 repos."

Many times, 1 repo works perfectly fine for 100 plugins. As for wanting to only work with a subset of the files, the way git wants you to do that is to branch and change the subset you want to change (someone else has already pointed that out too here in the comments). What to split into how many repos is often a very subjective call, and depends on team, respository size, and workflow.

A real-world example where 1 repo works perfectly fine is the Linux kernel. Within one repo, you have all sorts of drivers for all sorts of hardware, and you have arch-specific support for a dizzying amount of processors and variants. The repo takes a while to clone the first time since it's kind of big, but thereafter works perfectly fine as you whizz between branches and jump between tags.

On some level, I understand the author's frustration with git, since it's quite a paradigm shift from centralized repos like Subversion. I made that shift myself once, and at first I didn't like being forced to play by git's rules of the universe (or more correctly, the DVCS rules of the universe). I have come to deeply appreciate those new rules over time.

There are, in fact, valid criticisms of git. One that comes to mind is the complexity and amount of operations... looks like others have already commented on this sort of criticism.

</comment><comment><USER18> > I can't also see any practical solution for a separation of concerns. Some > users could e.g. work only on translation and need only to checkout XML > files and push them back to the repo. With Git, that would have to be a > separate repo.

I am far from being good with Git yet but why couldn't the translator simply branch out and only merge back his XML files ?

<comment><USER19> Perhaps the issue is that there's no technical barrier to them messing around with something else, perhaps by accident. (And if you try to deal with this by playing around with filesystem-level write positions in the repo, then they can't pull down new versions of the rest of the project either.)

The only really clean solution is to use submodules (or the newer variation on the theme, git subtree). But those aren't entirely smooth either.

<comment><USER20> The idea of Git is that everybody has their own local copy of a whole repo so it doesn't really matter what they do with it or if they mess it up. If other people want to merge the changes to their repos they will see what was changed and what wasn't so if you get pull request from "XML only guy" you just verify if only XML files were changed. You seem to think about it in terms of one master which isn't Git way.

<comment><USER19> And you're thinking about a workflow in which no one ever uses "git push". If most devs do, and "the XML guy" can't (because someone else needs to look over his commits), that's a headache, which could be solved technically.

Come to think of it, it could be solved technically even with git -- the XML guy's repo gets a pre-commit hook that verifies that he's committing changes only to the files he's allowed to edit. (We're now requiring him not to mess with that hook, but if that's a problem, maybe they shouldn't have source code access at all. The point is that now a tool is doing the checks, which frees up the humans for things that really do require human judgment.)

</comment></comment></comment></comment><comment><USER21> I just wanted to say that even if you don't read this article, this discussion here on HN is very enlightening for people who tend to only use a small subset of git operations in their day-to-day small-team dev tasks (like me).

</comment><comment><USER22> Git is overrated.

Other problems include:

o Complex, confusing terminology including multiple non-obvious names for various components.

o Huge number, about 148, of commands with many sub-commands that often do non-obvious, even unrelated things.

o git rebase enables users to rewrite history which subverts what should be the main, if not only, function of a version control system.

o Git has been bundled with code review systems like Gerrit which encourages developers to rebase heavily to create a false history presenting themselves as fantasy 10X programmers who don't make mistakes, debug, engage in trial and error, or all the other things developers actually do. When a bug does slip through as if often does despite the supposed quality-control benefits of code review, then reconstructing what happened from the rebased "history" can be a nightmare.

o There are numerous commands to do similar, overlapping but nonetheless different tasks. If for example you want to back up to earlier versions of code you can do git revert, git reset --hard, git reset --soft, git checkout -- <SHA>, git checkout <SHA> \-- all of which do different but overlapping things.

o A supposed virtue of git is that it makes it extremely easy to create "branches." This often leads to a proliferation of branches, making locating changes and reconstructing the history of changes extremely difficult. A change can occur on a local branch on one developer's computer, be rebased into another local branch and then finally rebased or merged into the shared "master" branch.

o Cryptic hexadecimal SHA for identifying commits instead of sequential numbers for individual files as well as snapshots of the entire project. Even if you track down the tricks to compile the SHA into a program or file name, the SHA is not sequential making it difficult to know which version of a file or group of files is in a program.

o These many flaws in git and its command line interface have resulted in a proliferation of third-party add-on tools like the Android project's repo utility, gitk, magit in Emacs, sourcetree, many of which fail to fully wrap the complexity of Git forcing users to both master the wrapper tool and the Git command line especially on more complex projects. Some of these GUI/wrapper tools like Android repo seem to have serious bugs as well.

o Lack of backward compatibility with RCS-style version control systems like Subversion. Instead of building on 30+ years of success and experience with RCS-style version control systems, but extending them sensibly for distributed projects, Git took a "reinvent the wheel badly" approach.

o A fanatical, cult-like following apparently mesmerized by Linus Torvalds that is unable to recognize or acknowledge the many obvious problems with Git.

Yours truly,

Bit by Git

<comment><USER23> Sounds like you were bit by rebasing, rather than by git itself.

Yes, the API is large and complex. But git itself is easy to learn, and extremely powerful. Whatever situation you might have gotten yourself into, git probably has a good way to handle it.

There's one rule I abide by, which makes my git usage sane: no rebasing. Everything stays in the history, and there's _no reason_ to squash commits into one giant context-less commit.

The only common case in which rebasing is valuable is in getting rid of meaningless commits constantly merging the latest master into a feature branch.

<comment><USER24> I don't get the "rebasing sucks" argument about why git is bad, at all. Most professional arenas will have a source control best practices document, how hard is it to say "no rebasing allowed"? Just because a feature exists does not mean it has to be used or even should ever be used.

</comment></comment></comment><comment><USER25> You could only come up with two things that no one ever runs in to?

Git has tons of problems but neither of these are important problems.

</comment><comment><USER26> It's impressive how a software became a defacto standard when things like mercurial or SVN existed long before it.It's not just hype or Github,though it helps.It's the distributed nature of the software that makes it powerfull, also the fact that git itself is more like a protocol than a piece of software.But git dont work for every use cases though( big binary blobs ),so there is still room on the market for such cases.

<comment><USER14> Mercurial was created around the same time as Git was (April 2005), and both projects were announced in the Linux kernel mailing list.

You're probably referring to Bitkeeper, which did exist (and was available commercially) before these new VCS's.

</comment></comment><comment><USER27> > I also see no way this would work for branching. You would have to change > all your submodules.

`git submodule foreach`

</comment><comment><USER28> Use Magit, it's great.

</comment><comment><USER29> I'm a fan of using the right tool for the job. If you can't use git effectively or it just doesn't fit into your workflow, then, hey, don't use it.

But, having used both, I'd actually like to know... Why are these things (that the author is claiming git can't do) so important? For instance, is checking out a partial tree ever necessary? Is it that you'd want more granularity over what subsets of the repo you are storing locally? Is it that you don't want to have to set up a bunch of (sub-)repositories?

I ask because... I once worked on a codebase that was so absurdly huge most of us couldn't store it all on disk at once. And it sucked. Hard. I WISH it had been started as a bunch of distinct submodules, with extension points baked into the core build system so it would be easy to add/remove sections of the codebase. But the product predated git. And SVN for that matter. (Granted, the majority of the issues we suffered -- nightmarishly complex build systems, lack of transparency into what changes are being made, a bottleneck of devs lining up to commit changes -- were caused by _process_ issues, not source control. But the source control did absolutely nothing to _help_ either.)

I really understand the frustration when it comes to git. It took me a _LONG_ time to wrap my head around why it works the way it does, because I wanted/expected it to work like SVN, where the repository is like a giant tree of files reflecting exactly what I see on disk, with different branches of code getting their own branch of the tree. Instead, git was this concise, magical pile of data structures that somehow kept causing me to break things whenever I strayed too far from a basic commit & push workflow.

But then I changed jobs a couple times. And, for some reason, I no longer found git a huge pain. In part because it just started becoming more natural and I knew what kinds of things to avoid, but also because I decided to sit down and really learn what I was doing. For one thing, I began making more active use of rebasing. Initially so I didn't need a ton of useless merge commits to keep up-to-date with the master branch, but eventually as a way of tidying up my work on a feature branch (i.s. squash, reorder, amend, etc) to make the set of changes concise and easy to follow. When working locally on a new feature branch, my commit log went from looking like this:

> okay one more try at part A [tests pass]

> fixing typo [tests pass]

> one last thing for part C [tests fail]

> part B bugfix [tests pass]

> fixing bug in part C [tests fail]

> finishing part B [tests fail]

> trying this again (feature A) [tests fail]

> part C, work in progress [tests fail]

> part A, I think [tests fail]

...

To this (more or less):

> part C [tests pass]

> part A (final implementation) [tests pass]

> part B [tests pass]

> part A (initial implementation) [tests pass]

...

Depending on who you are, you'll either love that, or you'll scream at my lying, revisionist git log before wrenching out your eyes and hurling yourself out a window. But, for me, for the team I was working with, and for the codebase I was working on, it worked WONDERFULLY. I found myself feeling like I really controlled the readability of my changes. Each of those commits could be submitted individually for code review with no problems, and even though I was wiping out a ton of minor changes, I could still preserve a record of alternate implementations in case we wanted to refer to them later.

Anyway, this post has become a long ramble. But, suffice it to say, I've found git to be very freeing. I just had to give up any expectations about how the process would work, and let myself start forming a new process around the power and flexibility that git offers. I believe I could say the same for mercurial (though I don't have much experience on it). And I don't think I can say as much for SVN, though I'm sure it does have a few advantages. And if you're workflow really can't change... SVN certainly works for what it is. It's just not something I'd ever like to go back to.</comment>


SXSW cancels panels on harrassment in gaming following harrassment - <AUTHOR> http://www.billboard.com/articles/events/sxsw/6745021/sxsw-cancels-two-panels-gamer-harassment <comment><USER2> In addition to it just sounding weird to my ears, this is why I'll never refer to myself as a gamer.

Hobby communities usually do not have any news presence, because the default behavior is, "${Hobbists} are doing their own thing without bothering anyone." Major news coverage occurs when something negative happens e.g. Gamergate, and the only way for a hobby community to recover in the eyes of the public is for those directly responsible to get their comeuppance. Therein lies the issue: it's a gaggle of immature brats acting out via the internet.

Now people who play games regularly or are at least interested in a specific game (say Street Fighter or Smash) have to put up with stuff like this. The only thing you ever read in news is something about Gamergate or Grand Theft Auto causing mass shooting. The games themselves were causing unjustified negative coverage to begin with. Now the participants are fueling the fire.

</comment><comment><USER3> [https://hn.algolia.com/?query=SXSW%20cancels&sort=byDate&dat...](https://hn.algolia.com/?query=SXSW%20cancels&sort=byDate&dateRange=all&type=story&prefix&page=0)</comment>


Topology of decisionmaking – are you secretly managing by metric? - <AUTHOR> http://www.chrisstucchio.com/blog/2014/topology_of_decisionmaking.html <comment> dj-wonk > Elementary topology shows that a good decision-making process is equivalent > to managing by metric.

I have not checked the proof, but I think what the author means by "equivalent" is that it comes up with the same result, without regards to computational complexity, much less human and organizational psychology.

I would not expect the computational and informational costs to be the same for both. Shifting the order of computation may not matter, functionally speaking, but can affect efficiency in many cases. For example, some decisions are easier to make if you can defer gathering detailed information until later in the process: for example, you can prune low-scoring alternatives cheaply at the beginning.

Humans also often need to dig into a problem in order to explore the parameter space. This is roughly analogous to "knowing it when you see it."

</comment><comment> dj-wonk > Yet in the real world, many people oppose metric-based management.

It seems to me that few organizations and even fewer people use mathematically rigorous decision-making. Some people realize this, some do not. I think some people oppose metric-based management out of self-preservation -- it involves hard thinking and some degree of formalization of their criteria. Specifying your criteria can box you in and give you less flexibility.

</comment><comment> dj-wonk Question: the article does not directly mention the "independence of irrelevant alternatives" (IoIA) concept: [https://en.wikipedia.org/wiki/Independence_of_irrelevant_alt...](https://en.wikipedia.org/wiki/Independence_of_irrelevant_alternatives)

I wonder if the author's assumptions imply IoIA. I am inclined to think so, but have not proved it.</comment>


The Sad State of Entitled Web Developers - <AUTHOR> https://medium.com/swlh/the-sad-state-of-entitled-web-developers-e4f314764dd#.24vxub7et <comment><USER2> Many web developers just know how to glue together framework components. I recently installed a Nest, attaching the requisite wires from the existing AC system; I have no right to call myself an HVAC technician. However, you see a lot of the same happening with web developers that can't go much further than copy and paste code from a blog post or Stack Overflow. The difference is of course that they are being paid good money and are supposed to know how to move beyond the basics.

I believe we'll see a purging in a few years, similar to what we saw when the bubble burst in 2000/2001.

</comment><comment><USER3> [https://news.ycombinator.com/item?id=10891771](https://news.ycombinator.com/item?id=10891771)</comment>


Are Indian High Schoolers Manning Your IBM Help Desk? - <AUTHOR> http://www.cringely.com/2012/07/23/are-indian-high-schoolers-manning-your-ibm-help-desk

<comment><USER2> I doubt it, most jobs done in US when outsourced, it is given to graduates, many a times STEM grads who are over qualified for it.

Even in india BPO/KPO/Call centre jobs are looked down upon by youth, reason being working in shifts, career progression is slow, does not require high skills. These jobs as stop gap arrangement, till they get a more stable IT job.

</comment><comment><USER3> Fact is that a university is not the only place where you can get post high school education in India. Training diplomas and skill based vocational education s very prevalent here. Rest assured that no jobs at technical setups are going to fresh out of high school students.</comment>


Sean Corfield, Clojure Contrib, and "real world Clojure" - <AUTHOR> http://mostlylazy.com/2011/11/08/episode-0-0-1-sean-corfield-clojure-contrib-and-real-world-clojure/ <comment><USER2> Nicely done!

One of the things I've seen happen to a lot of technically-oriented podcasts is they become irregular and then eventually disappear.

I think with a topic like Clojure you have a lot to discuss, since it's rapidly evolving. If you can't find people to interview or the community has been otherwise slow, you can always talk about facets of Clojure (threading & STM, etc).

</comment><comment><USER3> I listen to a lot of podcasts and its fantastic to have one about clojure. Sometimes this kind of podcaste (spezially new ones) have a stif tone but I liked the conversationel interviewing style in this one.

The only bad thing I have to say is the length. I like it if the podcasts are longer.

<comment><USER4> Glad you liked Chas's interview style!

Length is a tricky one. I rarely get time to listen to a whole hour in one go so I actually prefer 20-30 minute episodes. Looks like the average length of all the podcasts I have in iTunes (427 episodes of various shows) is ~35 minutes so that covers quite a range of lengths.

<comment><USER3> The german podcaster Tim Pritlove does Shows that sometimes take up to 4h. Because the guest had a couple hourse to explain a topic you could really get understand the topic and thanks to that I picked up Lisp (actually Dylan).

If you speak german and are intressted in PLs:

Dylan: <http://chaosradio.ccc.de/cre031.html>

Lisp: <http://chaosradio.ccc.de/cre084.html>

C++: <http://chaosradio.ccc.de/cre063.html>

</comment></comment></comment><comment><USER5> I liked the part where you talked about Clojure/West (<http://clojurewest.org>).

<comment><USER5> :)

</comment></comment><comment><USER6> Nice interview

<comment><USER7> Thanks, glad you liked it. This should just be the start of things. :-)</comment></comment>


AppMakr Launches for Windows Phone & Android (get in private beta) - <AUTHOR> http://go.appmakr.com/wp7-android

<comment><USER2> Link isn't working...</comment>


Autho.me API And Python Demo - <AUTHOR> http://sheddingbikes.com/posts/1294445127.html <comment><USER2> Here's what you're thinking when you see this: "Oh, neat, this is Zed Shaw telling me he's made something that will get me secure login that doesn't send passwords to my service using crypto that he feeds users through Javascript! I can't wait until it's ready to use!"

Here's what Zed Shaw says this is for: application developers who are so uncertain as to whether they can hash passwords properly that they'd rather outsource that service to someone who can hash passwords properly... and nothing else.

Here's what I think: if every piece of this is served via SSL, or if you don't really care about account security but just don't want to be keeping a database of passwords just so people can leave comments on a CMS, you stand a chance of not making your service less secure by using it --- not a very good chance, but a chance.

If, by the way, you serve every piece of content on any page that touches this API or that could ever be cached and touched by a page that touches that API through SSL --- which is what you _have to do for this to stand any chance of being secure_ \--- you already have a secure channel to send passwords to your application.

Personally, I think it's so easy to safely store passwords† and there are so many moving parts in this design that I can't fathom why anyone would opt into it. This is a project that at first glance appears to offer immense value, but really offers a truly marginal bit of value.

I'm really tired of being down on Zed Shaw. It's really nothing personal. I'll go a step further and say that this is one of the very few SRP implementations I've seen that didn't have a variant of a common auth bypass flaw. It's not bad code. But unfortunately, Zed is wading into the fever swamp of Javascript crypto, and it's worth calling this out just so other people don't have the impression that This Is Something We Do Now.

† <http://codahale.com/how-to-safely-store-a-password/>

<comment><USER3> Actually, no that's not the point of autho.me. I know you keep thinking it's about me making a secure authentication that competes with bcrypt+ssl. It's actually for the purposes I laid out in the blog post:

1\. An easy to setup secure auth system that's at least as secure as the others available. Not more secure, but just as secure. For example, your attack of protecting against content modification applies to _all_ login systems. Every last one. Phishing also applies to _all_ of them. I'm trying to tease out what ones are particular to autho.me and cover those.

2\. The ability to manage users across multiple domains and organizations.

3\. The ability to share or trade accounts with other trusted partners. This one is dubious because I don't know how users will like it. Really gotta figure out the usability of this.

4\. An easy way to do 2-factor authentication with phones.

So, don't be blinded by the SRP. That's just there to make the other features work. I'd also say if you're going put up specific attacks, then you should give ones that aren't also attacks against the things you promote. If you evaluate autho.me from the point of view of an infinitely capable super hacker who can always modify content, then all logins are vulnerable.

I'd also like demonstrations of actual javascript turing completeness or mathematic failures that aren't handled by Tom Wu's SJCL. If there's flaws in Javascript's math such that it causes failures, then I'd like some concrete examples that don't require "infinit super hacker injects code" attacks.

In otherwords, I'd like demonstrations of the SRP data that's publicly sent and an attack against it because of a failure in javascript mathematics, sjcl, or my code.

Anyway Thomas, I don't take it personally, even if you are a bit sensationalist about it.

<comment><USER2> Why not read Nate Lawson's blog post? This will be the second time I've recommended it to you. One of the reasons I'm not going into too much depth is, why would I recap all of Nate Lawson? You're doing crypto dev, you should be reading him already.

Your invocation of SJCL is also a bit of a straw-man. SJCL doesn't do straight-up number-theoretic crypto; even the AE cipher modes it offers avoids it. You're doing SRP in Javascript. You also keep calling it "Tom Wu's SJCL". You're saying that because "Tom Wu" is the name on SRP. Tom Wu didn't write SJCL. The SJCL authors, for what it's worth, claim "the best security which is practically available in Javascript", follow by a parenthesis, followed by the word "Unfortunately", followed by more words you should read.

The two factor stuff, by the way? News to me as of this post. Twilio and 2-factor auth is a good idea (note though that I'm biased, as my friend Dug is doing something very similar --- <http://www.duosecurity.com>).

<comment><USER3> I did read his post, but there isn't a single actual demonstration of his claims that javascript math is flawed:

[http://rdist.root.org/2010/11/29/final-post-on-javascript- cr...](http://rdist.root.org/2010/11/29/final-post-on-javascript-crypto/)

All of his exploits talk about attacks that are just browser attacks, but nothing that says what you're saying about an actual exploit in the math of javascript. His attacks also assume an infinitely capable attacker who can always alter content, which is pointless because all browser based security, even your own proposed bcrypt, is vulnerable to all of his attacks.

Also, my invocation of SJCL is not straw man, it's the actual library I'm using, so if you're going to do an exploit that takes advantage of a flaw in javascript math, then that's what you'd use. It's a concrete thing to focus on as an attack vector. That's sort of the inverse of "straw man".

Finally, if you are saying that this is the first time you're hearing about the Twilio 2-factor auth then you didn't even read the blog post.

<comment><USER2> No, Zed, I'm saying the post we're commenting on is the first time I've heard about you doing 2-factor auth. Why would you think I would comment on a post I hadn't read?

You keep talking about "the math of the Javascript". You're a smart guy. I think you know that we're not saying the math in SJCL is wrong. I don't know what "just browser attacks" mean; you're asking the browser to implement cryptography, the browser is relevant.

Nate does talk about "the math of Javascript", by the way.

<comment><USER3> I know he talks about it, but he doesn't really. He starts talking about it, and then switches to a browser environment attack.

The main crux of my disagreement with you is that you say: Doing javascript in the browser makes it more vulnerable to an exploit than just doing bcrypt+ssl passwords. However, if someone can exploit the browser (XSS, content modification, etc) then _no_ login system is safe.

In other words, you're pimping bcrypt+ssl as a better alternative because it's NOT vulnerable to browser environment exploits, but it is. Every browser is.

A browser environment exploit is all the things you keep bringing up: cache poisoning, SSL exploits, phishing, XSS attacks, content modification, etc.

<comment><USER2> You think maybe he's making it up?

:)

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> It appears that Zed Shaw does not like openId. I agree with him that it is certainly no panacea, but the risks can be minimized to a large extent if used properly.

I use openId to login to HN. So when I submit my Google openID, in principle, HN can redirect me to a fake Google site where I may unknowingly type in my password. The big loophole is that I have no control over which site I am redirected to by HN.

However if I were to log into google _first_ and then visit the HN login page that problem disappears. If all goes well HN redirects me to Google which remembers that I am already authenticated and directs me back to HN. OTOH if HN sends me to a malicious site it will ask for my password and give itself away as a malicious site.

I am no security expert, and corner cases of vulnerability surely exists. But some simple guidelines can mitigate the risks quite a bit.

One point raised in the article is that

      By comparison, OpenID assumes the User and a Third Party
      is more trustworthy than the Customer. I personally find
      this bizarre since it's saying that someone is going to
      log into a potentially dangerous site, and simply using
      OpenID makes that alright.

I wont go on to claim OpenID makes everything alright. But I like the feature that I as a user get to choose who I trust with my password, 2nd party, third party or some N^{th} party. So it does not seem that _"bizarre"_ to me.

<comment><USER3> I don't have any problem with OpenID itself, and in fact I worked on the PIP project at Verisign briefly. That statement is more about the difference in design, that OpenID has been marketed as some kind of protection against evil sites. It's an evil site, no amount of OpenID is going to protect you.

I also disagree with the idea that OpenID protects against phishing, since well, if one site can be phished then an OpenID site can too. Phishing is a failure of usability in the browser, so all websites are vulnerable to it.

Basically, my objections with OpenID are more in how it's marketed as some protection against things which really aren't a protocol problem or can't be solved by OpenID.

<comment><USER4> Ok that clears the air :)

I agree that if as an user I trust the "customer" to take me to my OpenId provider then it provides no protection against phising. I totally agree that phishing is not a protocol problem and cannot be solved at a protocol level.Thankfully I wasn't exposed to that marketing, so to me OpenId was mostly an issue of convenience. However the common modality of breaking OpenId security can be mitigated if I login to my OpenId provider first.

I think your concern is that my OpenId provider itself might be a phishing trap. Yes, if I fall for that, then all bets are off. But ideally I should be typing its url on my browser or going from a bookmark.

<comment><USER3> You're also forgetting that the OpenID provider could be storing passwords and things wrong too, or that they've been hacked and someone's collecting them in-transit. Really, any attack against a non-OpenID site is available to an OpenID site, but with the added problem that nobody has to know.

For example, if google had a security breach (ehem China?) and passwords got snarfed for a period of time, how would you or a customer site know?

In addition to those attacks, there's economic attacks available from the provider. One day Google can just decide they don't like you and _poof_ there go your users. For a customer this is a pretty big problem that they all must worry about.

And, all of those attacks are pretty much available to any login system.

<comment><USER4> Yeah that's what I meant by "phishing trap". In retrospect not a good choice of words, "compromised" would have been better. I am letting it remain as it is because you commented on it.

I think a better way to express my opinion about OpenId is this: say I trust that the probability a particular site will not be compromised is _(1 - \epsilon)_. Then OpenId lets me maintain and transfer that value of trust over authentication transaction with other sites. As the saying goes, it is as strong as the weakest link.

There are protocols by which one can boost the level of trust beyond that _(1 - \epsilon)_ but I have not come across a easy to use deployment of one such.

</comment></comment></comment></comment></comment><comment><USER5> Interesting; I appreciate the many, large warnings not to use this in anything serious.</comment>


Uber CEO on Khashoggi killing "We've made mistakes too,right, with self-driving" - <AUTHOR> https://twitter.com/BNONews/status/1193698590641860608 <comment><USER2> It's not a mistake it is a plot to murder to a journalist. If the CEO of Papa Johns, whose company actually makes money, can't say bad words about minorities then why is it this moron thinks he can justify the murder of journalists.

</comment><comment><USER3> Someone's promised the Sauds a return on their Uber investment

</comment><comment><USER4> That talk was a mistake. Values have been burned to the ground.

</comment><comment><USER5> I'm strongly in the camp of, cutting up a journalist into pieces with a bone saw isn't a "mistake".

</comment><comment><USER6> Millenial company CEOs statements sounds like some tangerine dream overdubbed with millennials chitty chatting about themselves for a sociology project.

<comment><USER4> FYI Travis left already & I'm pretty sure he isn't a millennial either.

</comment></comment><comment><USER7> > I didn't read that part of the CIA report

ffs you are a CEO of a major public company and make 100s of millions per year. 99% of your job description is to be a thoughtful bulshitter yet that's the best you've got?</comment>


Introducing Google Analytics Premium - <AUTHOR> http://analytics.blogspot.com/2011/09/introducing-google-analytics-premium.html

<comment><USER2> Reportedly costs $150k/yr, flat. [http://www.adweek.com/news/technology/google-breaks-paid- ana...](http://www.adweek.com/news/technology/google-breaks-paid-analytics- new-product-135327)

<comment><USER3> It's actually $100K/yr paid monthly.

</comment></comment><comment><USER4> As much as I like Google and their products, but "Dedicated Customer Service" seems really unbelievable to me considering their past of absolutely horrible stories of (paying) users trying to contact them. That said, I'm interested to see if this might change now that they explicitly advertise with it.

<comment><USER5> Considering that each paying customer could cover two to four customer service reps' salaries, I think this one Google product that won't have that problem.

<comment><USER6> Two to four? Have you seen Google's benefits? One to two!

<comment><USER7> AFAIK google doesnt really give their cust service reps the full google benefits treatment.

</comment></comment></comment></comment><comment><USER8> Yet another internet product not available globally. They don't need to license anything from the music or movie industry, so it the rest of the world does expect some sort of reasonable explanation of this limitation, especially when they write "we're now ready to make it available to all interested clients".

<comment><USER9> I attended the Analytics Partner Summit a few weeks ago and this issue was brought up. It was speculated that they don't have enough support personel to handle customer problems across the globe.

You have to remember they are going after enterprise clients so expectations of service are very high.

<comment><USER10> Google has support personel? Sure doesn't feel like it when dealing with them

<comment><USER11> I imagine it feels different dealing with Google when you're paying them six figures or more.

</comment></comment></comment></comment><comment><USER12> "Prices varies per region and will be as follows: $150,000 USD (US), $150,000 CAN (Canada), or GBP 90,000 (UK) per year (billed in monthly increments)"

According to Stefan Keuchel (Google Germany): <https://plus.google.com/101607164549546362845/posts> (pricing in the comments.

</comment><comment><USER13> They did not list any prices, so I know it's going to be expensive, anyone has any idea how much it will cost ?

<comment><USER14> None of the authorized resellers seem to list prices either, making me think it may be intentionally confidential.

<comment><USER15> Startup rule #313: If you have to ask a reseller how much it costs, you can't afford it.

<comment><USER16> On that note, perhaps a start-up can buy a license and resell analytics on the back-end (probably against TOS however).

</comment></comment></comment></comment><comment><USER17> Wow, Google just got all up in Adobe/Omniture's face with this. Keeping in mind the total cost of an Omniture installation including licensing + professional services (since the product is tedious to use).

The disruption in the analytics space is really nice to see lately.

</comment><comment><USER18> When Google begins charging $150K/yr for something like this, you know there is room for someone in the market to disrupt Google.

Does anyone remember how much Urchin used to cost before Google acquired and made it free?

<comment><USER19> I think Urchin was under $100/mo at Rackspace, but I also think Rackspace had some sweetheart deal since they invested a ton of money at a critical juncture. We used to install it an awful lot, so it couldn't have been that expensive.

</comment></comment><comment><USER20> Really happy to see that Google Analytics has a monetization strategy. Hopefully they will start paying to the needs of their users more (and not let it keep on stagnating).

<comment><USER21> Of their premium users, sure. _You_ still aren't paying them anything.

<comment><USER20> We are paying for a competitor product - which had the realtime support. We will seriously consider paying for Google Analytics when it comes time to renew licenses. And yes, we are hoping that by then they will have a version of their product that is between Free and $150K.

We are not paying them anything. But, we do want to pay them especially if it means that the product will keep getting better (and that it will not get axed).

I trust people more when I know where they are (or planning to) make money. If I don't see it - they have few reasons to be good.

</comment></comment></comment><comment><USER22> I could actually read faster then watching that video.

</comment><comment><USER23> I couldn't find a mention of Flash, canvas, HTML5 etc. so I can only assume this still uses their Flash charting. In this day and age that's really disappointing and short-sighted on Google's part. By not being able to view the charts (in fact, most parts of an analytics page) in an iPad or iPhone, they're forcing users to buy shotty third party apps and making other people rich.

<comment><USER24> FWIW, you could just as easily blame Apple for your complaint. There is no a priori reason to believe that Google should go out of their way to support a single platform from a competitor that is missing a piece of functionality; and, if they were, there is no a priori reason to believe that that platform should be Apple's iPad and not Microsoft's Internet Explorer 8 (which is missing Canvas instead of Flash, a much more reasonable limitation given how often both technologies are actually used).

<comment><USER23> Missing support for the canvas tag really isn't relevant when IE offers VML and others offer SVG. There are some okay cross browser charting libraries out there, Raphael etc. And then there are the absolute stunners such as Highcharts, which has been a pleasure to work with.

For a technology-driven company to revamp aspects of their product whilst ignoring what is a widely held complaint, it just boggles the mind. I don't see how the decision to use Flash can be defended in this day and age, regardless of whether Metro IE10 drops support for Flash or not.

<comment><USER24> "For a technology-driven company to revamp aspects of their product whilst ignoring what is a widely held complaint, it just boggles the mind."

FWIW, you could just as easily hoist Apple with that particular petard.

<comment><USER23> Apple at least pretends to be limited by technology, eg: battery life for Flash. It would take about 15 minutes to prototype it with a jQuery date selector and Highcharts supporting legacy desktop browsers and mobile devices alike. Nothing about it is remotely difficult.

But if it's competition they fear (in an entirely different SBU), why not address the shortcomings that drive people to use Mint and other analytics services?

I really can't believe I'm having this argument (and downvotes to boot). I've converted many Flash and Silverlight applications back to HTML5/JavaScript. I only ever really get stuck at File IO, which is irrelevant here. Maybe I should have taken that job offer at Google.

<comment><USER24> "...why not address the shortcomings that drive people to use Mint and other analytics services?"

FWIW, the main selling point of Mint over Google Analytics is "up to the minute reporting" (or at least, it was, before Google "addressed" that particular shortcoming). As someone who used to find Analytics "only able to tell me stuff I wish I knew yesterday", I'm now super-excited to dive in.

</comment></comment></comment></comment></comment></comment><comment><USER25> They should add real-time updates to the offer.

<comment><USER26> Realtime updates are free for everyone now.

<comment><USER27> This is not true or misunderstood. Even now, as I look at on of my dashboards, the last reported hour was 13:00 -- it is 17:30. As well, there is no data for three of the morning hours, where this asset has not been down and sees millions of impressions a day. No to mention, the feature page for this new product states, "Processing: data freshness within a maximum of 4 hours 98% of the time," [1] which is not too far off a typical day with a non-premium plan.

[1] <http://www.google.com/analytics/premium/features.html#tab0=3>

<comment><USER28> "We just turned the reports on for a number of you, and over the coming weeks, everyone will have access to Real-Time. If you can't wait, sign up for early access here: <https://services.google.com/fb/forms/realtimeanalytics/>. We'd love to hear about how you are using (or planning to use) Real-Time, so please share in the comments."

[http://analytics.blogspot.com/2011/09/whats-happening-on- you...](http://analytics.blogspot.com/2011/09/whats-happening-on-your-site- right-now.html) /via <http://news.ycombinator.com/item?id=3053483>

</comment></comment></comment></comment><comment><USER29> Given this, the App Engine price increase, and the G+ nymwars stance I sense a real march towards monetization with Larry Page as CEO.

</comment><comment><USER30> Google products are free--long enough to destroy a poor startup. Shame on Google.

<comment><USER11> This is, in essence, a new product from Google. What has been free continues to be free.

<comment><USER30> For now.

<comment><USER11> Google likely benefits hugely from providing the service for free. The massive amount of data it provides about user behaviour across the public Internet must be hugely valuable to them.

<comment><USER31> I always thought the real goal of Google Analytics was to upsell me into using Adwords, and to prove once and for all that there's no point in optimizing for any search engine except for google.

<comment><USER32> the real goal of free Google Analytics is to get people to place the javascript tracking snippet on their webpages so they can collect data for Ads and now paying customers.</comment></comment></comment></comment></comment></comment>


jQuery or CSS3 transitions? Speed comparison + brief empirical explanation. - <AUTHOR> http://css3.bradshawenterprises.com/demos/speed.php

<comment><USER2> I did this same experiment with D3 (animating the outline-color and background-color for 1s with ease-in-out), and I got performance nearly identical to CSS.

<http://bl.ocks.org/d/1616423/>

A lot of this gain is likely from using requestAnimationFrame, but there could be other optimizations in D3, such as a single timer loop for all transitions. So, I think it's misleading to say you can't do fast transitions in JavaScript. It might just be a need to optimize jQuery.

But still, I definitely prefer to use CSS transitions when possible, because the performance is generally better and I like the declarative syntax.

<comment><USER3> Raphael also suffers when animating many elements, here is a question I answered about a week ago on StackOverflow and I ended up solving with d3.js:

[http://stackoverflow.com/questions/8239235/smoothly- animate-...](http://stackoverflow.com/questions/8239235/smoothly-animate- attribute-changes-to-3000-raphael-objects-at-once/8731150#8731150)

But recently I went through Raphael's source an I saw an implementation on requestAnimationFrame, perhaps Mike can shed some light on what is different. Great work on d3.js by the way!

</comment></comment><comment><USER4> Why is everyone missing this? JQuery is a library that provides a consistent API across browsers. In a future release couldn't they detect CSS3 animation support and update the animate function to use them if supported?

Some projects are already doing this:

[http://www.benbarnett.net/2010/09/01/enhancing-jquerys- anima...](http://www.benbarnett.net/2010/09/01/enhancing-jquerys-animate- function-to-automatically-use-css3-transitions/)

Sounds like it should go into mainline jquery pretty soon.

<comment><AUTHOR> Exactly - hopefully this will happen one day. Having used that plugin though it doesn't work perfectly on all code (jQuery Cycle + that for instance doesn't always work as expected). Any mention of transitions seems to result in a wontfix if you check through the jQuery bug tracker.

<comment><USER4> I suspect what is holding it up is both browser support and the time required to get it right. Maybe they don't use animate but provide a separate wrapper.

Keep in mind, the specs are rather large. When people talk about CSS "animations" there really talking about at least 3 specs, maybe 4. CSS 2D transforms, CSS 3D transforms, CSS transitions and CSS animation. There is a lot of work to get it right and tested in a nice JS wrapper, not to mention making it work with an existing JS based API.

</comment></comment></comment><comment><USER5> Sure, native tweening is fast and great, but don't show it by performing a false comparison.

The CSS transition is performing a single tween on a CSS rule; the div tags just inherit the result. The jQuery test is performing inline style tweens ... on every div! First of all you're performing redundant/duplicate calculations. Second of all, you're throwing away all performance gains you had by having shared css render style objects.

A better test would of been to update the style sheet via JS.

</comment><comment><USER6> Not a very good example. For me the CSS3 version isn't smooth either (in chrome). And generally the transition should be more eye-catching to make your point.

<comment><USER7> I'm in chrome on an air, and the difference is very clear. Probably hard to come up with something that'll work for everyone...if he exaggerates it too much, it'll risk blowing up phones!

</comment></comment><comment><USER8> In FireFox the problems are either with the timer or how fast a screen is drawn.

On an old laptop, changing the opacity, or set a different color of the same amount of divs takes about 50ms. The next timeout or interrupt, is on average 200ms later. The first screen draw is the slowest with 350ms.

I used absolute position for the divs, so that the browser doesn't have to recalculate the page after each update.

</comment><comment><USER9> I'd like to see a comparison between CSS3 and html5 canvas performance, as for a simple animation in this example, I think Canvas may be more applicable.

<comment><AUTHOR> The difficulty with canvas is that it can't really be dropped in to a site in the same way. A site that makes use of slides and fades using a JS library could patch the library to use transitions instead with only a few lines of code (well a few hundred perhaps). Using canvas requires dropping the accessibility benefits as well as having to replicate all the elements manually on canvas.

I agree though, this contrived example would surely work better with canvas.

</comment></comment><comment><AUTHOR> Also, I'd really appreciate some help in explaining the discrepancy here. I've had a go at the bottom of the page, but if anyone has any input I'd be keen to get it as correct as possible.

<comment><USER7> Agreed, the analysis doesn't make things too clear. If you look at the code, all the CSS element does is add a class to the containing div. The jquery version has to animate each square.

From his explanation, browsers are smart enough to not only batch (how I'm thinking of it) css animations to all elements, but they also know what part of the screen will change and only have to redraw that.

The jQuery one just spends too much resources changing the properties of all those boxes to have any time to actually redraw the screen.

<comment><AUTHOR> The selector is applied to all the boxes, not just the outside one. The point here is that jQuery doesn't work well for doing lots at once really.

</comment></comment></comment><comment><USER10> maybe i am not getting something here but isn't this obvious? native c++ will be faster than javascript (which also compiles to c++ (i believe?) but does not have hardware acceleration and is single threaded [in case of jquery atleast]). Libraries (like jquery) were made to fill in the gaps that css or js had. now that the gaps are filling up, jquery becomes a redundancy (atleast for basic animations like that of css) So what is the need for testing? or maybe i am missing something?

<comment><AUTHOR> This is part of a tutorial, the idea was to give some evidence for justifying the use of transitions where possible.

It also might get more people to realise that jQuery isn't the answer to everything, and animation is definitely not one of it's strong points (right now anyway!)

<comment><USER10> Yes, i see it now, there seems to be some confusion as to the need of the article. It makes more sense in a tutorial perspective and is needed to pull people off of jquery. Thanks for clarification. :)

</comment></comment></comment><comment><USER11> My apologies if I come across the wrong way, but this doesn't take an article to explain.

CSS3 transitions and keyframes are hardware accelerated and in most cases native to the browser.

Doing anything with javascript and the DOM is single threaded and expensive.

If you are using jQuery, look at cssHooks for nice fallbacks to js animations if you feature detect for particular effects.

<comment><AUTHOR> I agree - this is part of a tutorial, and these examples are really to prove this point.

Animations using javascript were great when we didn't have anything else, but nowadays they should only be used in browsers without support.

What would be really cool would be a DOM method that tied into the animation code that powers transitions.</comment></comment>


Apple's 16-inch MacBook Pro image appears online - <AUTHOR> https://www.cnet.com/news/apples-16-inch-macbook-pro-image-appears-online/ <comment><USER2> What a huge disappointment. looks like the same crappy keyboard and same useless touch bar. I'm due for an upgrade at work, and I was really hoping this would be a no brainier so I wouldn't have to go evaluate all the possible Linux options. uuggghhh.

</comment><comment><USER3> And what is the huge difference?!</comment>


Google's Varian: Search scale is 'bogus' - <AUTHOR> http://news.cnet.com/8301-30684_3-10309375-265.html

<comment><USER2> I like Varian's discussion of this pair of anecdotes he thinks of in answer to a question:

"Q: Is innovation in the Valley as high as it was 10 years ago?"

"Varian: I'll tell you an angle that I think is different from 10 years ago, and that's what I call the micro-multinational.

"One day I bumped into a friend of mine, and asked what she was up to. She said, I've got a company. And I said tell me about it, and she said there are 12 people, three in New Delhi, two in Mountain View, and there's somebody in Spain.

"And then two days later I ran into another guy, and he said I've got a company, and there are four people in Italy, two people in the Czech Republic, one in Spain, and three in San Francisco. And I said, whoa, what is this? A trend! It's two of them!"

He goes on to discuss why this trend is happening and what it may mean for the Valley.</comment>


PyPy Status Blog - STM update: back to threads? - <AUTHOR> http://morepypy.blogspot.com/2012/05/stm-update-back-to-threads.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+PyPyStatusBlog+%28PyPy+Status+Blog%29 <comment><USER2> How is this at all different from simple locking?

<comment><USER3> If you use a lock, then only one thread can enter the locked region at the same time.

If you use a sufficiently advanced STM, and have an atomic region, then two threads can enter the same region, as long as they don't use each other's memory. You may think, why synchronise if they're not using each other's memory? Well it can be extremely hard to work out a priori if two threads are using the same memory or not. In fact for some problems, such as many graph problems, working out what memory they're going to use is the same problem as the problem that you're trying to solve in the first place.

STM is like having a single lock for every single word in your memory, and then magically always acquiring every lock that you will need at the start of the transaction in a determinate order, so that you don't get deadlock.

If two threads enter an atomic region, but do access each other's memory, then the transaction is silently aborted and restarted. Ideally these aborts are rare and the program runs very much in parallel.

A more concrete example - in Java if you have a hash table you will usually lock during all reads and writes. If you used STM, and two writes accessed different buckets of the table, then there's no need to lock. The STM works this out for you.

<comment><USER2> Ah, thanks for the clarification. From the post I gathered that the atomic region locked the entire data structure, and that any thread would wait, I didn't realize it was a specific data region.

That sounds pretty nice, then. I'm looking forward to see the sort of speedups possible with this.

<comment><USER3> Well take a look at any of the copious literature on the subject:

This paper shows some example speedups, but generally doesn't give anything to compare to. Find papers that reference this paper, to see more examples.

C. C. Minh, J. Chung, C. Kozyrakis, and K. Olukotun. STAMP: Stanford transactional applications for multi-processing. In IEEE International Symposium on Workload Characterization, 2008.

</comment></comment></comment></comment><comment><USER4> The fact that threads are one of the most widely supported and frequently chosen models for concurrency programming should be a clue that they are at least not a bad choice. I applaud the PyPy project for trying something different, but also doing it in a way where they did not paint themselves into a corner with a less-than-ideal solution.</comment>


Finland tax authorities matching Bitcoin transactions and bank transfers - <AUTHOR> https://metropolitan.fi/entry/tax-authorities-in-finland-matching-bitcoin-transactions-bank-transfers-to-collect-tax-on-crypto-trading-profits <comment><USER2> All they're doing is looking for bank transactions to crypto exchanges in citizens' accounts. What this article doesn't tell, is that the current cryptocurrency taxation in Finland is unreasonable. You pay 30-34% tax on any profit, but you can not deduct losses.

If you had bought 1 BTC at $1000, another at $14000, and sold both at $3000 you would owe $600 in taxes even though you lost $9000.

You can imagine how people feel about paying these taxes, when they are so obviously flawed and unjust. Some people may owe hundreds of thousands in taxes even if they made no actual profit.

<comment><USER3> _You pay 30-34% tax on any profit, but you can not deduct losses._

Whether you made a profit or not doesn't have to be a consideration as far as tax goes. You pay a percentage of the capital amount when you choose to liquidate your asset. It's effectively a wealth tax. There are lots of taxes around the world that work this way. It _sucks_ if you've made a loss, but that's not really the government's problem.

<comment><USER2> That doesn't sound right. The authorities in Finland specifically tax gains made with cryptocurrencies. You only pay tax if you make profit on any individual trade. But you can not deduct trades that made a loss.

It's not exactly a wealth tax, but it's also hard to consider a capital gains tax because you can't deduct losses. Treating other investment products this way would probably have horrific results, because it heavily disincentivizes taking on any risk.

<comment><USER4> If you buy stocks in a publicly traded Finnish company, then you're taking on a risk in the hope of making a profit. But you are also putting your money at work in the Finnish economy, stimulating job creation and growth. Everybody wins, hopefully.

If, on the other hand, you put down your money in bitcoin or at the online blackjack tables then you're gambling, not investing. Win or lose, your gamble creates zero domestic growth. Why should any government incentivize that?

<comment><USER5> What if you were to invest in a publicly traded non-Finnish company, let's say Apple? How do you think the government should treat that?

<comment><USER6> Apple might be a bad example, but I can't imagine them treating investing in, say, a German company different than a Finnish one. That would be discriminatory and would not be allowed under EU law.

</comment></comment></comment></comment></comment></comment><comment><USER7> It sort of sounds like they're treating Bitcoin transactions like a non-EEA lottery. If you win, you pay your taxes, and if you lose you don't get to deduct the cost of your ticket.

Honestly, this doesn't bother me.

<comment><USER8> Do you also get taxed if paid in bitcoin

Why not just do a 10% wealth tax on all of a person's assets on top of their income tax

<comment><USER7> I'm not in Finland or an expert on their taxation rules - my statement was based on a quick read of some of the information I found, but I would assume that if you chose to get paid in bitcoin than yes, you would have to determine the value of the bitcoin when you received it and pay taxes on it. When you cashed it out you would either have to pay taxes on the gains or eat the losses.

</comment></comment></comment><comment><USER9> I believe this is called "competent". I know we don't see much of it but ... there it is.

</comment><comment><USER10> Having an immutable public ledger should make collecting taxes easier.

<comment><USER11> …if you can match addresses to people.

<comment> grey-area Pretty trivial for a nation state, given sufficient motivation.

<comment><USER12> Not if it's something like Monero.

<comment><USER13> They can still require mandatory reporting when real money enters and leaves the system. Everyone is going to need to convert currency into Monero or vice versa and governments routinely require disclosure information at such points.

<comment><USER12> Yes, for sure. But there can be a secondary market if people accept Monero directly, so you don't have to convert.

<comment><USER14> It always surprises me how casually crypto currency enthusiasts treat wilful money laundering and tax fraud.

<comment><USER15> They're almost as bad as the "sovereign citizen" crowd, more numerous, and just as sanctimonious. Maybe Blockchain has a future, but this current crop of money launderers and thieves don't. Between the SEC in the US and tax authorities elsewhere, it's a just a matter of time before having an immutable ledger of these activists is shown to be a really bad idea.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> > _The old truth seems to stand: You can 't avoid death or taxes._

Even if there were nothing but cryptocurrency, tax authorities have ways of estimating someone's income from investigating their lifestyle. That is to say, find people who are leading lavish lifestyles (living in upscale neighborhood, driving expensive cars, taking expensive vacations, ...), yet claim low income. That's just very inefficient to do if you have to actually put gumshoes onto individual people because you have no electronic access to any transactions.

</comment><comment><USER17> "The taxman"? The original title was "Tax authorities in Finland matching Bitcoin transactions & bank transfers to collect tax on crypto trading profits".

<comment><USER12> Yes, but "the taxman" makes you click so you can see if it's _your_ taxman.

<comment><USER18> Or if you're a Beatles fan.</comment></comment></comment>


CALMzone launch suicide prevention campaign - <AUTHOR> https://www.thecalmzone.net/2015/11/big-news-calm-and-lynx-launch-bigger-issues-campaign/ <comment><AUTHOR> I'm submitting this partly because suicide is a significant cause of death for the HN demographic, but also because it's an innovative use of Twitter.

> Deliberately provocative, the #BiggerIssues advertising campaign juxtaposes > comparatively trivial topics that are getting a huge amount of public > attention with the issue of male suicide. Vegan meatballs recently tweeted > about by Professor Green, for example, get more attention than the issue of > male suicide.

They find tweets about trivial stuff that got a lot of attention, and compare those to tweets about suicide.

Here's a link to the hashtag: [https://twitter.com/hashtag/BiggerIssues?src=hash](https://twitter.com/hashtag/BiggerIssues?src=hash)

(Professor Green is a singer, and a patron of the charity "CALMzone" (campaign against living miserably, a charity that aims to reduce male suicide). His father died by suicide, and he made a programme for BBC. [http://www.bbc.co.uk/iplayer/episode/b06mvx4j/professor- gree...](http://www.bbc.co.uk/iplayer/episode/b06mvx4j/professor-green- suicide-and-me#group=p02q33dg) )</comment>


Everything is Unix - <AUTHOR> http://www.linux-mag.com/id/7569 <comment><USER2> Disclaimer: I am a web developer, so these criticisms include myself.

I feel like so many folks (me included) in the web development community are constantly re-learning new (old) techniques that we all really should have realized long before now.

Though I don't think I would change a thing as I've learned a lot over the past decade that I probably never would have if it not for this community.

Sometimes I just get a sense of deja vú, like none of this is new...

This whole "Unicorn" business for example. I read about this last week, and thought to myself, "Ok... hasn't Apache been doing this with 2.0 for years?"

So isn't this just re-implementing the wheel... yet again, but in Ruby?

<comment><USER3> Of course it is reinventing the wheel. And people will continue to post ebullient posts about it until they start studying formal cs theory and stop mistaking the implementations details ("java gets closures! c# gets lambda expressions! new web stack for perl!") as the interesting bits.

It's just a given that the majority of the ideas posted to programming blogs are just old ideas in new contexts.

</comment></comment><comment><USER4> This article sure is timely. I've been working on a ruby project for a while now and I'm just about to get it live. The key for me was two things: 1. Forking. Sounds silly, but man oh man did this increase performance. 2. Relying on a unix tool instead of going with a ruby gem.

Now I admit that I'm locking myself into a unix environment, but I really don't have the time or skills to make this project OS agnostic. If it is an eventual success, I may have to pay off some of that technical debt, but that is a problem I wouldn't mind having.

<comment><USER5> _Now I admit that I'm locking myself into a unix environment,_

Unless you are making an application for users to install, I don't see how this will be problem. Effectively, the only significant OS you are locking yourself out of is Windows and Unix you can get for free and install anywhere.

<comment><USER2> I developed a Ruby application a few years ago with a similar structure on OS X to be deployed on Ubuntu servers. All the forking and child process signaling worked like a charm in both OS's.

So yeah... you're locking yourself out of Windows. Consider it a smart move :)

</comment></comment></comment><comment><USER6> You shouldn't have to call fork() yourself. Most languages have either language level or library level solutions that abstract that away for you. You want to abstract it away because very soon you'll find yourself wanting to manage the forked processes in much the same way these other facilities do it for you. Even when I'm working in C, I almost always use Pthreads instead of calling fork() directly. The only time I call fork() is when it's soon followed by an execve().

The same goes for file locking. Using files for synchronization is primitive, error prone and slow. As soon as you find yourself managing the lock files to deal with crashed programs ("stale locks" as the author calls them), you might as well trade it in for better abstractions.

Perhaps the most valuable part of implementing this kind of stuff by hand, using only systems services, is the appreciation you gain from having access to the same functionality in your language or from well designed libraries.

</comment><comment><USER7> I am not sure why this has gotten so much attention lately? I don't see anything out of extraordinary to drop to low level to accomplish something that is unusually complex or requires high performance...

Also I am not sure what is with this new tendency to call everything unicorns and ponies? It's intellectually degrading, and depressing to read such articles.

<comment><USER8> I think "[old school unix] has gotten so much attention lately" because of accidents in the timing of computer science culture and its victories.

The Linux / BSD driven revival of Unix happened, un-fortuitously, just when object-orientation, graphics, UML, patterns, etc, were hitting their peak, largely because they were super successful in dealing with problems in graphic interface design. So these oo approaches became dominant in curriculums and paradigms far beyond their applicability, and no one bothered to study the classics of the previous generation like APUE etc.

Smalltalk and C++ begat Java, begat Ruby/ Python, and now we have a whole bunch of server-side programmers who know how to inherit from multiple base classes but don't know what fork() really does; when these young people (ahem) discover how well their grandfather's Unix addresses many of their current server-side problems, well, they are thrilled.

Let's just say it's the same thing as a twenty something discovering Sly and the Family Stone vinyl in the basement... Yeah, it rocks.

</comment></comment><comment><USER9> His contrived example of "atomically creating a file" is kind of strange. If you would want to see which of several processes wins at creating a file, just use if(-1 != (fd=open("filename",0666,O_CREAT|O_EXCL)){ .. } which is guaranteed to suceed only for one program. Or you'd open it without O_EXCL and try locking it. Creating several file and atomically renaming it "over" the old file yields you nothing, because whenver you try to access it afterwards, you have no guarantee that it's not being overwritten just afterwards by another one of the processes.

</comment><comment><USER10> _waidpid()_ ???</comment>


Ask HN: Touch Typing - <AUTHOR> I am trying to use current social isolation time to learn to touch type. I have been typing using 4 fingers at best for the last 15 years, so I have lots of bad habits. Unfortunately, my home office mode requires me to write a lot. I cannot simply stop everything and focus on slowly getting proficient with touch typing.<p>Do you have any hints on how to learn touch typing while having to produce large quantities of written content? At the moment I can invest about 1h a day for practicing. <comment><USER2> How about following a tutorial such as [https://www.typingclub.com/](https://www.typingclub.com/) while trying to apply what you learn to your everyday typing</comment>


How to Send Email Like a Startup: Chapter 1 - <AUTHOR> https://www.sendwithus.com/resources/guide/#chapter-1-welcome-emails

<comment><USER2> Useful article (y)</comment>


Snowden's Rubik's Cube - <AUTHOR> https://da5is.com/snowdens-rubik-s-cube-79274593806b <comment><USER3> I'm sure the nerds here will find ample opportunities to tear this movie apart, but keep in mind that the "average American" (a) doesn't know much about Snowden, other than "he stole secrets and hid in commie Russia, so he must've been working for them", and (b) just believes what the government says. To counter the powerful voice of the government, you need an equally powerful voice like Hollywood. Maybe this movie will make the average American think more about the issue, and it might even cause some to change their views about Snowden. If it does, this movie has served its purpose, and kudos to Stone.

<comment><USER4> This movie is made by Oliver Stone right? Judging by prior work like _The Doors_ (Jim Morrison) and Alexander (Alexander the Great) I don't have high hopes.

Oliver Stone likes to destroy characters on the big screen paying attention to the flaws rather than the charisma of his charactes. Jesus, I didn't remember a single battle scene from the movie "Alexander" and this guy went from Greece to India on horse battling his way out. He is considered one of the biggest strategic minds in history. He was the only leader I recall who changed the faith of battles consistently by making swift, unexpected moves with his cavalry hitting the enemy where he least expected it. Being gay[2] is not the reason why Alexander was named "Great".

[1] In the case of Alexander he admitted that it was a huge failure, but I'm not sure if by failure he and I mean the _same_ thing, probably not.

[2] Sexual relationships amongst men were a very natural thing in ancient Greece, especially between soldiers. Indeed Alexander was married twice AFAIK.

<comment><USER5> No director is perfect. Oliver Stone had a few duds, but he also made some excellent movies: JFK, Any Given Sunday, Platoon, Talk Radio, Wall Street...

If you have to criticize him, you could say that his recent movies have not been up to the bar he set in the '90s -- but it definitely was a _very high_ bar.

I'm much more worried about Gordon-Levitt playing Snowden, from the trailer he looks pretty bland.

<comment><USER6> I've been impressed with Joseph's other recent work like "hit record". For me personally I can't think of anyone better for the role.

Also maybe relevant is his opinion not an opinion after meeting Snowden for research on the role:

> "Now, as he would say, it's not for him to say whether it was right or > wrong. That's really for people to decide on their own, and I would > encourage anybody to decide that on their own. I don't want to be the actor > guy who's like, 'You should listen to me! What he did was right!' I don't > think that's my place. Even though that is what I believe – that what he did > was right." [1]

[1] [http://www.ew.com/article/2015/09/18/joseph-gordon-levitt- sn...](http://www.ew.com/article/2015/09/18/joseph-gordon-levitt-snowden- russia)

<comment><USER4> tbh I don't like the choice but I consider Gordon-Levitt a good actor. I don't have high hopes but I have to say that is unfair to judge an actor by a trailer.

</comment></comment></comment></comment></comment><comment><USER7> This movie looks like is has a good chance of doing a better job than even The Imitation Game at ruining and fundamentally misrepresenting a topic I care about and a person I respect.

<comment><USER8> The Imitation Game was bad?

<comment><USER9> It gets a fair amount of hate on HN for taking narrative liberties with Turing's actual life story. I won't deny that it does, and anyone who's genuinely interested in Alan Turing would do better to read about him and his work.

But the movie is a dramatization, not a documentary. Because of that, it got the general, non-CS-major public to care about Alan Turing. I'd say that's a pretty decent accomplishment.

I actually had a conversation with my mom about Alan Turing after she saw the movie. That's saying something. She still needs help browsing the web beyond AOL. She thought computers were "unhealthy" and borderline "dangerous" until very recently. I'm pretty sure she thinks her router contains the entire Internet on it. These are the kinds of people who need to be exposed to Turing, and "Imitation Game" breaks through to them. Great. I'll take that as a net-positive.

<comment><USER10> I don't know much abt Turing but watching the movie, i can see the dramatized in Cumberbatch's acting and the plot, and Knightley.. I agree w this comment that "if you like to see Cumberbatch and Knightly acting, you will enjoy it". Cumberbatch is too Cumberbatch and the plot is too Hollywood and stereotyped

</comment></comment></comment></comment><comment><USER11> This raises an interesting question: how did Snowden get the documents out of the NSA? I don't recall reading much about how this was accomplished. Has that been discussed/reported anywhere?

<comment><USER12> Snowden wasn't 'on-site', AFAIK he had remote access as a private contractor.

One of Snowden's main revelations was how little oversight there was.

He was motivated to come forward by the abuses he saw the NSA database put to, rather than its mere existence.

Snowden has reported his colleagues reguarly exfiltrated 'dirty pictures' from the NSA database. Snowden says 'nudies' were a 'commodity' traded around his colleagues.

If one can trivially sneak out dirty pics without oversight then...

Of course if Snowden could do it for the best of reasons, it is hard to believe moles and foriegn agents don't have similar access.

<comment><USER13> Do the people with that kind of access simply not understand the power they have? If Snowden had access, surely there are at least dozens of other 20-somethings running around able to read the correspondence of almost anyone in the country. Are we to believe that they really are so self-disciplined the only thing they'll look at are nude photos? Why haven't we seen industrial and political fallout from these guys?

<comment><USER14> I worked for a well known computer software company, and one of the close by teams worked on a photo-sharing web-app, which also allowed for private albums.

While analyzing the metadata someone discovered that a certain rare and expensive camera model was used almost exclusively to shoot models, including nude ones. Searching the storage for pictures made with that camera model became a popular activity in that team :)

So it's pretty easy to trivialize privacy breaches and rationalize it as "no harm was done"

<comment><USER15> It's hard to believe that it would be worth violating your users' trust for some nudes. The internet has enough free racy pictures to last anyone a lifetime.

<comment><USER12> Its not inconceivable employees may feel less burdened by trust than owners.

Perhaps the illicit nature of the trust violation adds something beyond the legally available porn.

Evidenced by the criminal risks voyeurs still take to get creepshots, upskirts,

</comment></comment></comment></comment></comment></comment><comment><USER16> I just watched the trailer. Clichéd brilliant patriotic dude saves the day. Bonus: Movie OS. This is gonna be such a great bad movie.

<comment><USER17> Actor's forced Snowden deep voice is hilarious. He's trying so hard, and yet it sounds like a 12 year old trying to sound older.

Also expect at least two forced action/drama scenes that never happened.

They are staging the Hong Kong hotel meeting, of which real footage exists, as if it were an action scene.

<comment><USER18> Wait for the french/german TV miniseries remake in a few years (not anything announced yet, but you just know one will be made), it will likely have a higher quality and accuracy.

</comment></comment></comment><comment><USER19> First time the actual character is more handsome than the actor ;)

<comment><USER4> Hah! First thing I noticed! :-)

</comment></comment><comment><USER14> The cube sequence doesn't make sense to me.

What kind of guard will let a cube not pass through the system like that? If I were that guard I would find that cube throw highly suspicious.

And while we are at it, wouldn't it be easier to hide the microSD card under the tongue for example?

And lastly, where exactly are you supposed to stick that card into in the facility? Even low-level security companies glue all USB/card reader inputs.

</comment><comment><USER20> Interesting, I hadn't realized this was a cube already in existence. Neat!

I've broken a few rubix cubes in my day and so many of them have hallow squares so I'm not surprised you could hide stuff in one. Hell if you customize one you can probably get it to hold a huge amount of data.

<comment><USER21> These cubes actually come completely apart to replace the springs. You could probably put a good 4-5 micro-SD cards in the middle plastic ball, but it's not exactly a quick operation. But, yeah, quite a bit of empty space in them.

<comment><USER22> Springs in a Rubik's cube?

<comment><USER21> Yes, they provide the tension when you rotate the cube. The speed cubes come with different springs that can make it looser or tighter - in the center is this white ball that houses the springs where you screw in the center tiles. If it wasn't such a pain to open back up, I'd take some pics of that part of it. You can see the white ball on the official site here: [https://rubiks.com/store/product/rubiks-speed- cube](https://rubiks.com/store/product/rubiks-speed-cube) (disclaimer - <USER2> original article is mine)

</comment></comment></comment></comment><comment><USER23> If you X-rayed the cube with the card on top or bottom, I wonder if the card would be distinguishable? I imagine that, if the cube was on one of the sides, it'd be practically impossible to see.

<comment><USER24> On the side, you might see a slightly brighter line. Here's an xray of a uSD card:

[http://rusolut.com/wp- content/uploads/2014/02/msd1xray.jpg](http://rusolut.com/wp- content/uploads/2014/02/msd1xray.jpg)

And an xray of a rubiks cube:

[https://c1.staticflickr.com/5/4138/4859926370_10d2a0d071.jpg](https://c1.staticflickr.com/5/4138/4859926370_10d2a0d071.jpg)

Overall, doubt you could see it without looking very carefully.

<comment><USER25> I just had some teeth X-rays at a pretty regular dental clinic here in Taiwan. They were showing me the results and explaning what they have found. I was totally amazed how thing that look super-light tiny shadows for me at one place they say "we must check", while elsewhere they were "nothing". What you see totally depends on the expertise you have and I think it wouldn't be hard at all to spot things that for us outsiders are just "maybe a little bit lighter".

</comment></comment></comment><comment><USER26> I'm sure you could grind out more space for the SD card with a Dremel tool to make it fit more seamlessly.

Or you could pop out a piece and you'd have room for dozens of MicroSD cards inside the pieces.

</comment><comment><USER27>
         "especially considering that cube wasn't released
         until 2013"

This cube is different than those released in the 1970s?

<comment><USER28> The colors are embedded tiles rather than stickers, and it's made to allow the sides to twist faster and more smoothly. [https://rubiks.com/store/product/rubiks-speed- cube](https://rubiks.com/store/product/rubiks-speed-cube)

</comment></comment><comment><USER29> RURIC: Redundant Userspace RAID of Inexpensive Cubes

</comment><comment><USER22> Why do Rubik's cubes have removable center tiles?

<comment><USER26> The Speed Cube has the removable center tiles to allow the tension to be adjusted:

[https://rubiks.com/blog/how-to-customise-the-rubiks-speed- cu...](https://rubiks.com/blog/how-to-customise-the-rubiks-speed-cube)

<comment><USER21> Also to make it much easier to grease the cube - if you do it as you stack the rows, you can get much more even distribution (and the cube will fly afterwards).

</comment></comment></comment><comment><USER30> On its surface, the movie appears to be praising Snowden. I am convinced it is intentionally shitty and is deliberately overly praiseful of Snowden so that viewers will find it annoying. The net result is that people leave with a negative opinion of Snowden the person. It just looks so over-the-top terrible from the trailer alone.</comment>


A First Course in Linear Algebra - <AUTHOR> http://linear.ups.edu/ <comment><USER2> This book spends three chapters on the mechanics of matrix operations before defining a vector space, and then it jumps into determinants.

IMO this is the wrong way to understand linear algebra, and the typical path of a lot of introductory text books. A better text: Axler's "Linear Algebra Done Right"

<comment><USER3> Definitely agreed.

As a math professor, I think you can get by without defining vector spaces -- I think it is a little bit difficult to come up with examples, other than R^n or C^n, which seem motivated and interesting to the beginner. The truly important example (IMHO) is R^n without a choice of basis -- but I think this can only be well motivated after you've seen a lot of linear algebra, not before.

Mechanics of matrix operations are not pleasant to teach, they make the subject seem like a bunch of contrived and confusing examples. Same for the "row echelon" stuff. Alright, you now have an algorithm for solving systems of equations... but presenting linear algebra as an algorithm sells it short.

What is really important in my view is the geometry of the subject, which is already very interesting in two dimensions. _Problem:_ Here is a linear transformation, given as a 2x2 matrix. Draw a picture which illustrates what this does to the plane. If you ask me, this is much more important than most of the crap that gets taught and tested in most courses in linear algebra.

<comment><USER4> This is how I learned linear algebra, as a series of algorithmic steps to perform to reach the solution. Only a handful of homework examples even hinted that matrices were powerful and useful. I learned the semester before that class how matrices can be used to represent physical locations and how multiplying these matrices can move you along the coordinate frames for the joints in a robot arm all the way to the end effector. In fact, you can take your final transformation matrix after you multiply each joint together and use that to translate your points in your native/world coordinate system into coordinates in your tool coordinate system. I later learned that matrices can be used for quantum computation/pyhsics and all sorts of other things like weather prediction, physics, graph theory, Bayesian networks, and so on.

Now that I'm out of school, I really want to learn how to properly use matrix algebra. I don't care about HOW to find a determinant or HOW LU decomposition works as I've already done those, but rather why I would want to perform that operation on the matrix in the first place.

The ability for matrices to model real processes is something that really fascinates me.

Do you have any other good reading material for someone like myself?

<comment><USER3> > Do you have any other good reading material for someone like myself?

I'm afraid I don't personally (I'm into abstract and theoretical math, which I'm guessing is not your cup of tea). But I should dig something up before I teach the subject again, so I would be as interested to read replies as you.

Gilbert Strang is an applied mathematician and also the author of a popular linear algebra book; I would guess that his books might interest you. But this is speculation, I haven't read any of them myself.

<comment><USER5> "(I'm into abstract and theoretical math)"

So what is a good Linear Algebra textbook from _that_ perspective? Assume someone has completed a course in Axiomatic Set Theory and is conversant with proofs etc, but now wants to get into Linear Algebra. Any textbook suggestions?

<comment><USER3> I'm _guessing_ "Linear Algebra Done Right" by Axler; I haven't read it yet but I heard good things about it and currently have it on order from Amazon. Hoffman + Kunze is the classic. For now, I don't know a book in the subject I really like, but I haven't looked very hard yet.

</comment></comment></comment></comment></comment></comment><comment><USER6> This is the best resource I've used for higher level math. I'm not sure why more people don't know about it because everything is VERY in depth with great examples and explanations.

<http://tutorial.math.lamar.edu/Classes/LinAlg/LinAlg.aspx>

<comment><USER7> I've used Paul's Online Notes for all my higher level math classes starting from Calculus 2. It has been more useful to me, even more than Khan's Academy. I like the little tricks and mnemonics that he teaches, especially in Linear Algebra. Example here: [http://tutorial.math.lamar.edu/Classes/LinAlg/DeterminantRev...](http://tutorial.math.lamar.edu/Classes/LinAlg/DeterminantReview.aspx). Much easier way of calculating determinants.

Another resource I've used is Patrick JMT's excellent videos found at: <http://patrickjmt.com>. He really goes over problems slowly. Best math teacher I've ever had.

</comment></comment><comment><USER8> On a slightly related note, if anyone is looking for more free resources for learning maths of various sorts, check out:

<http://mathbooks.reddit.com>

and/or

[http://people.math.gatech.edu/~cain/textbooks/onlinebooks.ht...](http://people.math.gatech.edu/~cain/textbooks/onlinebooks.html)

<comment><USER9> I'll post my favourite (sorted by topic - many of them free)

<http://hbpms.blogspot.com/>

<comment><USER10> See how everyone has their own favorite teacher / explanation? Let's aggregate them all.

[http://www.reddit.com/r/newschool/comments/wmu5q/read_this_h...](http://www.reddit.com/r/newschool/comments/wmu5q/read_this_how_newschool_works/)

</comment></comment></comment><comment><AUTHOR> Linear Algebra is a basis for so much in Machine Learning, and this is a free, open textbook that takes the beginner through the basics. I've not read it myself - I'm not the intended audience - but I've seen several reviews from people whose opinions I trust, and it seems to be well respected.

<comment><USER11> Honestly, I felt like linear algebra was the low point in my math career-- even behind axiomatic set theory. I still have nightmares about determining whether a set of vectors is linearly independent.

<comment><USER3> Linear algebra is frequently taught very poorly. I think most university courses in the subject are kind of watered down and reduced to algorithms you can memorize -- which, ironically, makes them tough going for the strong students.

</comment></comment></comment><comment><USER12> What impresses me is the accessibility of this textbook. Not only is it available online (via XML and MathML) but you can download the TeX source and multiple PDFs optimized for printing or on-screen viewing [1].

Bravo.

[1] <http://linear.ups.edu/download.html>

</comment><comment><USER13> Are there any linear algebra books which use machine learning as the motivating example? Or a book which teaches linear algebra and machine learning together?

<comment><USER14> Funny, I just spent last night implementing a "principal compnents analysis" using numeric.js, for a character recognition project. PCA / SVD seems like a great motivating topic.

btw, I couldn't use Singular Value Decomposition in numeric.js for PCA because the method, numeric.svd, uses the "thin" algorithm, and throws an error if there are more columns than rows. I calculate way more features (50-200+ columns) than I have training samples (rows, 10-30 written manually). without svd I had to use the "covariance method", which I guess can sometimes present approximation issues, but seems to be working well for me.

The purpose of the PCA is dimensionality reduction (google "curse of dimensionality"). I had used Mahalanobis Distance as a p-value score to detect outliers (p-val < 0.05), and it worked well when there were only 6 features. Curse of dimensionality makes MD useless when there are 50 or 100 features, and PCA reduces them to 3-10 features which carry the most information with the rest approaching zero. So I do MD on the projected (reduced) features, and its working great.

If I do it all over again I might try a "one-class SVM" (which, sadly, I had not heard of until only recently and very late in the project). SVM's are non- linear like most machine learning algos, but the linear PCA can still be used to complement other methods, eg to do pre-processing before feeding to a neural network.[1]

For deeper linear methods, check out the PCA-related extensions like Fisher Linear Discriminants or Projection Pursuit.

1\. "Many neural networks are susceptible to the Curse of Dimensionality though less so than the statistical techniques. The neural networks attempt to fit a surface over the data and there must be sufficient data density to discern the surface. Most neural networks automatically reduce the input features to focus on the key attributes. But nevertheless, they still benefit from feature selection or lower dimensionality data projections."

<comment><USER14> Just wanted to share something I ran into the other day in the course of research on PCA, a very cool motivating example, sports-related.[1] On page 13, they take some NBA player stats and graph the projection of the third PC (y-axis) against the second PC (x-axis). The third PC is a negative correlation of rebounds with assists and steals. Turns out to sort players roughly by height, placing Karl Malone (6'8") and Mugsy Bogues (5'3") at opposite extremes.

1\. Faloutsos et al, Quantifiable Data Mining Using Principal Component Analysis, 1997

</comment></comment></comment><comment><USER15> Anyone have any recommendations for linear algebra courses through Coursera or similar sites? It is a subject I've always been fascinated by but my self- directed learning endeavours have not yielded much usable knowledge.

<comment><USER16> MIT OCW has 18.06 Linear Algebra including lectures by Strang.

<comment><USER17> [http://ocw.mit.edu/courses/mathematics/18-06-linear- algebra-...](http://ocw.mit.edu/courses/mathematics/18-06-linear-algebra- spring-2010/video-lectures/)

I agree, it's very useful. He gives nice explanations of some of the decompositions and why they're useful.

</comment></comment></comment><comment><USER18> Khan Academy's lectures on linear algebra is more than enough for a hacker to get the gory math details and then jump into machine learning.</comment>