Automated snare drum made to the order of Aphex Twin (2014) - <AUTHOR> http://logosfoundation.org/instrum_gwr/snar2.html <comment><USER2> Aphex Twin is probably one of the few artists I have consistently liked and gone back to listen to over the years.

I don't know anything much about music, but I feel out of electronic music past and present his works are the most dynamic and interesting. Most other stuff I kind of like but it gets old so move on to other things.

<comment><USER3> Anyone know of great albums similar to his songs Avril 14th or Aistsan[102]? I have little musical context if this is a dumb question.

I like all his albums but those songs are really some of the most relaxing sounds I have heard.

<comment><USER4> Avril 14th is one of my absolute favorite songs. It's my go-to song when I need to just relax and push away from reality for a bit; one of the few I can just put on repeat and be happy with.

<comment><USER5> I just discovered the violinist Daniel Hope recently, and in the following album: [http://www.danielhope.com/listento/for- seasons/](http://www.danielhope.com/listento/for-seasons/) you will find a beautiful cover of Avril 14th (Spotify link: [http://open.spotify.com/track/3MjbuOV1RDEdXfyJwuzzOS](http://open.spotify.com/track/3MjbuOV1RDEdXfyJwuzzOS))

</comment></comment></comment></comment><comment><USER6> Dada Machines have a Kickstarter for a set of MIDI-controlled solenoids that can be used to a similar effect. (Not affiliated, just a backer.)

[https://www.kickstarter.com/projects/1481744082/dadamachines...](https://www.kickstarter.com/projects/1481744082/dadamachines- music-machines-for-everyone)

<comment><USER7> This was a really interesting project to explore. The videos were well- produced and whet my appetite for playing with this a bit.

It's probably something I can do more cheaply with an Arduino, assuming I don't count the value of my time.

</comment></comment><comment><USER8> Shameless self promotion: Over here at SonicRobots we are working on electronic music and robots as well [http://sonicrobots.com/tripods/](http://sonicrobots.com/tripods/)

We also got a huge list of music robot projects for anybody who wants to read more about that stuff [http://learning.sonicrobots.com/list-of-music-robotic- projec...](http://learning.sonicrobots.com/list-of-music-robotic-projects/)

</comment><comment><USER9> Based on the timeline [0] I'm guessing that these were used in his album Computer Controlled Acoustic Instruments pt2. I assume that this robot is used on the track snar2 [1] and perhaps others.

[0] - "15.01.2015: Aphex Twin announces a release using Robosnar as well as our HAT robot."

[1] - Listen to an unauthorized upload here: [https://soundcloud.com/xiao-bao- ming/02-snar2](https://soundcloud.com/xiao-bao-ming/02-snar2)

<comment><USER10> Which is a fun and enjoyable album. (e.g., [http://pitchfork.com/reviews/albums/20156-computer- controlle...](http://pitchfork.com/reviews/albums/20156-computer-controlled- acoustic-instruments-pt2-ep/))

<comment><USER11> I found it an interesting concept but pretty lacklustre as a piece of music, especially after the incredible Syro.

What's there is nice, but hardly any of the ideas develop beyond "hey, look what I did with these instruments". More like a demo than an EP.

<comment><USER12> I read speculation somewhere that the first track of that album is the finished product, and the other tracks are works in progress or mood/jam palettes or investigatory scraps of various parts, some of which went unused. When I listened through with that in mind it made sense (and made the album more approachable), and the track titles may indeed support that theory. But, as with all things Aphex Twin, we are left to interpret on our own -- who knows?

</comment></comment></comment></comment><comment><USER13> Go on, give us a snare rush

[https://en.wikipedia.org/wiki/Snare_rush](https://en.wikipedia.org/wiki/Snare_rush)

</comment><comment><USER14> If you liked this, you might also be interested in Squarepusher and Z-Machines "Music For Robots". It has significantly fewer technical details, however.

[https://www.youtube.com/watch?v=7MluikyEQF4](https://www.youtube.com/watch?v=7MluikyEQF4)

</comment><comment><USER15> Please also note "The absurdity of copyright" by Dr. Godfried-Willem RAES:

[http://logosfoundation.org/copyleft/copyrigh.html](http://logosfoundation.org/copyleft/copyrigh.html)

</comment><comment><USER16> Really interesting writeup. The contraption has parallels to some of what we do with software: automating a legacy system without completely reinventing it.

For such an accomplished practitioner, the author made one glaring mistake:

> We will use one solenoid on each side of the snares, thus doubling the force

Clearly they have a system with one solenoid pulling from each end of the same thing. This does not increase the force at all. Pulling on a rope with one end fixed is just as good as pulling on both ends (from the rope's perspective there is no difference).

<comment><USER17> Couldn't it mean that the inner solenoids are active in pairs, so the two most external ones hit at the same time?

That would mean hitting in the same direction on two different spots on the diameter of the circle, effectively doubling the force...

</comment></comment><comment><USER18> The Hit AnyThing bot is pretty cool too. You can hear them both on "Computer Controlled Acoustic Instruments pt2 EP" (2015).

[http://www.logosfoundation.org/instrum_gwr/HAT.html](http://www.logosfoundation.org/instrum_gwr/HAT.html)

<comment><USER19> What a neat project. I've wondered about the robots for that album, cool stuff.

</comment></comment><comment><USER20> Very cool write up. If you like this, and aren't familiar you should definitely check out Pat Metheny's orchestrion: [http://www.patmetheny.com/orchestrioninfo/](http://www.patmetheny.com/orchestrioninfo/)

</comment><comment><USER21> If you like this you might also like [http://FelixsMachines.com](http://FelixsMachines.com) by my friend Felix. From a good few years before this one :)

</comment><comment><USER22> An outfit called Polyend has commercialized the concept with something they call PERC, though I don't believe they have something capable of engaging and disengaging the snare like this contraption.

[http://polyend.com/perc-pro-drumming-machine/](http://polyend.com/perc-pro- drumming-machine/)

[Not affiliated]

<comment><USER23> FYI - Aphex Twin owns this / several of these and speaks very highly of them.

</comment></comment><comment><USER24> Awesome! I just started building a robotic band with rasberry pies and a bunch of selonoids :)

</comment><comment><USER25> Video? :(

<comment><USER26> I've been searching, so far coming up empty.

Would love to see a video of Richard James sending midi data to that snare that was meant for a completely different instrument, maybe one of the melodies from Windowlicker :-P

<comment><USER27> Even though I think this was video trickery mostly, I often wonder if the later experiments with computer controlled instruments were partly inspired by this Monkey Drummer video [https://www.youtube.com/watch?v=u1ZGIrNf71Q](https://www.youtube.com/watch?v=u1ZGIrNf71Q)

<comment><USER26> Hadn't seen that before, thanks for the link!

That video is funny, perplexing and frightening all at the same time! I was a little relieved to realize the human appendages were added digitally ([https://en.wikipedia.org/wiki/Monkey_Drummer](https://en.wikipedia.org/wiki/Monkey_Drummer)).</comment></comment></comment></comment>


Emotionally Expressive Text to Speech - <AUTHOR> https://www.sonantic.io/ <comment><USER3> This is fascinating.

But I'm very curious what the emotional "parameters" are? There are literally at least a thousand different ways of saying "I love you" (serious-romantic, throwaway to a buddy, reassuring a scared child, sarcastic, choking up, full of gratitude, irritated, self-questioning, dismissive, etc. ad finitum). Anyone who's worked as an actor and done script analysis knows there are 100's of variables that go into a line reading. Just three words, by themselves, can communicate roughly an entire paragraph's worth of meaning solely by the exact way they're said -- which is one of the things that makes acting, and directing actors, such a rewarding challenge.

Obviously it's far too complex to infer from text alone. So curious how the team has simplified it? What are emotional dimensions that you can specify? And how did they choose those dimensions over others? Are they geared towards the kind of "everyday" expression in a normal conversation between friends, or towards the more "dramatic" or "high comedy" of intense situations that much of film and TV lean towards?

<comment><USER4> I've always imagined that this tech would need a markup language. Instead of a script that an actor needs to interpret, the script writer (or an editor, or a translator) would mark up the text.

<comment><USER5> There is Speech Synthesis Markup Language (SSML). Amazon Polly and Google text-to-speech supports it, although the best neural-model based voices only support a small subset.

<comment><USER3> Ah thank you, that's very interesting.

So that's not markup along "emotional" lines, but rather along "technical" attributes such as speed, pitch, volume, pause between words, and so on.

Obviously coding those things in XML manually would be a nightmare. Now I find myself wondering if 1) these technical parameters can be used to synthesize speech that does sound like a reasonable approximation of emotion (or if they're insufficient because changes in resonance and timbre are crucial too), and 2) if there are tools that can translate, say, 100 different basic emotional descriptions ("excitedly curious", "depressed but making effort to show interest", etc.) into the appropriate technical parameters so it would be usable.

Anyways, just a fascinating area of study.

</comment></comment></comment></comment><comment><USER6> Hey HN - Zeena Qureshi (Co-Founder and CEO at Sonantic) here.

Thanks for your thoughts and feedback thus far! I'd be happy to answer questions (within reason) about our latest cry demo / emotional TTS! Feel free to fire away on this thread.

<comment><USER7> Saw your YouTube videos a few days ago and was very impressed.

Clearly you can't give away too much on your "secret sauce" but is there any insight you could share on two questions:

1\. Do the individual voice talents need to express the emotion types you use or can you layer it on after? (ie do they have to have recorded say "happy" to get happy outputs or can that be added to neutral recordings retrospectively)

2\. What are the ball park audio amounts you need per voice? 10 hrs, 20 hrs or more?

<comment><USER6> Hey! Thanks so much. Yea, can't go into too much detail here, but I will say that more def isn't always better when it comes to the size of datasets. :) We aim for quality over quantity in order to achieve natural expressiveness from our actor recording sessions.

<comment><USER8> > more def isn't always better when it comes to the size of datasets

This sentiment definitely gives you lots of credibility, only those who have seriously endeavored in this space are able to acknowledge just how true this is.

It's quite antithetical to how some ML folks like to think.

</comment></comment></comment></comment><comment><USER9> My daughter is dyslexic and would love to play things like stardew valley, pokemon or even animal crossing but being text only makes them such a slog for her.

The same goes for sub titles, she'd be perfectly fine with a robot voice for the actors if they sounded real enough like this.

Game changer.

<comment><USER6> Thank you for your comment. One of the reasons we founded Sonantic was to improve accessibility so we are right there with you! We plan to do this by reducing the barriers (both financial and logistical) of voiced content for everyone from indie developers to big AAA studios. We've already begun to see progress on this through partnership with initial customers during our beta.

<comment><USER10> Is your TTS process necessarily ahead of time, or can it be done at runtime with all the flexibility (templating, generative text etc) that brings?

<comment><USER6> That's the holy grail right there, isn't it? :) We're definitely working towards runtime but still some work to be done there to account for additional complexities and balance trade-offs re: speed, quality, accuracy etc. of the rendered output.

</comment></comment></comment></comment><comment><USER11> This site has to have one of the worst cookie choice decision popups: [https://imgur.com/a/YLsGadP](https://imgur.com/a/YLsGadP)

<comment><USER12> GDPR has reverted the web to Geocities. It's popup hell.

<comment><USER13> It's not GDPR. It's all the tracking website owners put there.

The fault is with the owners of the sites.

</comment></comment></comment><comment><USER14> Hi Zeena, I love this! I just filled out your form.

I was just mucking around with Nvidia's latest, called flowtron, and I know from that experience there's a significant amount of work between getting a tech demo out and launching a usable product, whether API-based, or with some visual workflow like your video shows.

One thing I think worth considering on the commercialization front is whether or not the core offering is the workflow niceties around your engine, the engine-as-API, or both. I'm just a random person on the internet, so take these thoughts with a large grain of salt, but thinking about it, it seems to me that prioritizing integration with say unity, unreal engine, video compositing tools, blog posting tools are all interesting and viable market paths. The underlying networks are going to keep improving for some time, so you're really trying to buy some long term customers.

Some stuff that's obvious, but I can't resist:

I could off the top of my head imagine using this for massively reducing the cost to develop games, for script writers pulling comps together, for myself to create audio versions of my own writing, for better IOT applications inside the home... I'd really love to be able to play with this.

There still isn't a truly non-annoying virtual assistant voice; when the first tacotron paper came out, I was hopeful I would see more prosody embedded in assistants by now, but the longer we live with siri and google, the more sensitive I think we are to their shortcomings. I have a preference for passive / ambient communication and updates, so I would place a really high value on something that could politely interrupt or say hello with information.

At any rate, congratulations, this is cool. :)

</comment><comment><USER15> Impressive next step for text-to-speect. Wish there was some simple real demos. I also work on the same thing using DL- and hope to open source the "emotional part" of it.

We soon can create emotionally expressive youtube videos with synthetic actors..

<comment><USER6> Thanks for your comments and nice to hear you're also working on TTS! We have a few more samples (without background music) further down on our homepage and plan to add a full dedicated subpage in time!

</comment></comment><comment> yc-kraln I have a comment and a question:

The comment: I noticed that your demo video also had "emotional" video layered on top of the dialogue. This could be considered manipulative; perhaps consider sharing a naked version so we could attempt to interpret the emotion based solely on the text to speech engine.

The question: You mention you met at EF. I was wondering if, beyond bringing you together, you found EF to be worth the cost of admission?

<comment><USER16> > The comment: I noticed that your demo video also had "emotional" video > layered on top of the dialogue. This could be considered manipulative; > perhaps consider sharing a naked version so we could attempt to interpret > the emotion based solely on the text to speech engine.

Close your eyes

<comment><USER17> The music is still there and has an obvious effect.

I thought the demo was impressive, but these things do seem like an effort to distract from (or more accurately bolster the effect of) the core technology.

Though maybe the right call since this is less a strict technical demo and more a way to drive interest/marketing.

The 'high levels of expressivity' comment was more of a flag to me, it's a meaningless phrase alone but it's suggested as an obvious answer. It feels like a mysterious answer [0].

I recognize though this is a marketing video, the core tech demo is cool, and I'm probably being unfairly critical. Flags like that make me more skeptical than I would otherwise be by default.

[0]: [https://www.lesswrong.com/s/5uZQHpecjn7955faL/p/6i3zToomS86o...](https://www.lesswrong.com/s/5uZQHpecjn7955faL/p/6i3zToomS86oj9bS6)

</comment></comment></comment><comment><USER18> The prosody sounds nice. But two of the longer samples have a lot of vocal fry, and the third sounds like the voice has a stuffy nose and/or a slight lisp. I wonder whether those mannerisms were chosen to camouflage artifacts inherent in their current implementation.

<comment><USER19> Or the mannerisms where chosen to express that the system can produce real voices and not just perfect ones.

<comment><USER6> Yep. Each of our TTS models is based on a real actor's voice that has its own nuanced characteristics. Some voices are naturally rougher / croaky while others smooth. As in real life, our differences are what make us unique. Some voices will work better for certain character profiles / scenes - it's up to the user to decide.

</comment></comment></comment><comment><USER20> Between this and Lyrebird there seem to be a high number of cutting edge TTS solutions being worked on in the private sector. Does anyone know why there haven't been much advancement with the FOSS libraries?

<comment><USER21> I'm convinced that the barrier to entry in this field in terms of technologic and financial investment is too high for FOSS projects to compete with the commercial solutions

We don't see FOSS pharmaceutical research for instance, I believe for the same reason. The amount of coordination needed and the impossibility to separate TTS projects into sub-parts could also factors.

<comment><USER22> [https://voice.mozilla.org/en](https://voice.mozilla.org/en)

"Common Voice is Mozilla's initiative to help teach machines how real people speak."

<comment><USER23> The problem with Common Voice is the same resource problem plaguing open source efforts in general - for TTS data, it's not just the size that matters, it's also the quality.

For something like Sonantic, you need clean recordings from professional actors in proper recording environments (not to mention the in-house expertise to then filter these down to curate the training/test datasets). That costs money. A million people with laptop microphones will just never get there.

</comment></comment></comment></comment><comment><USER24> Recommending editing the video down to 43-60 seconds.

It would be nice to try with actual text inputs right on the page, that this doesn't exist is tiny flag.

A great choice to work with voice actors, because there isn't any 'pure' TTY that's good enough in the most general sense, having the actual voice actor as a working basis will help.

Perhaps for small game houses, they can just use something off the shelf, big houses can use a customized voice, and then not worry if they have to make tweaks or changes, they don't have to do a whole production.

<comment><USER6> Thanks for your feedback! We felt that this storyline / length was best in order to showcase the two different actor's artificial voices and build up to the actual cry.

As you've mentioned, we do work with real actors to create our TTS and take misuse of their (artificial) voices very seriously. Because they sound so lifelike, we've made the decision not to allow public access/personal use at this time.

Lastly, your assessment is spot on regarding standard vs custom voices. Lots of interest for both!

<comment><USER25> TTS=text-to-speech, so it's quite reasonable to showcase that chain instead of an edited video.

Not diminishing the quality of your product, just pointing out an obvious expectation of the audience that it's presented to. Perhaps, there could be a way to test-drive it directly, with limited choices or combinations of the input text.

<comment><USER6> Fair point. We will definitely consider adding something like this to the site. Thanks for the suggestion!

</comment></comment></comment></comment><comment><USER26> Very cool demo, but the quality of the vocoding is not state of the art, and it's audibly artificial, which is probably why you covered it up with the obnoxiously loud music.

Next time be honest about what you have when presenting it; every human with functioning ears is attuned to the sound of speech. This sort of technology would be amazing for narrative video games even with the less than perfect vocoding.

</comment><comment><USER27> Sounds nice but difficult to judge with the background music.

<comment><USER28> I get the criticism (and "you need to find out for yourself" at ~0:44 sounds somewhat robotic), but given that it's aiming at the entertainment industry, where you will have background music most of the time, it also seems like a fair choice of representing real-world usage (where background music might always hide the imperfections a bit).

</comment></comment><comment><USER29> Is there any pay-to-use or open source voice for Hebrew?

Amazon's Polly English voice, Matthew is pretty nice. But they don't have Hebrew. Also Google doesn't have Hebrew. Bing has some attribution requirement that I haven't fully investigated.

<comment><USER30> Here is one, עלמה רידר [https://www.almareader.com/](https://www.almareader.com/) (not nearly as emotionally expressive as this one though).

</comment></comment><comment><USER31> This is very impressive.

I wonder if attaching this to a modern-day Elisa will improve the Turing test scores? Emotional load can reduce the requirement for semantic coherence.

<comment><USER32> "Emotional load can reduce the requirement for semantic coherence." - <USER2> insight

</comment></comment><comment><USER33> @sonantic Seems you don't do real-time yet?

If so, have plans for a Web Speech API plugin? I'm about to release a reader demo based around it. [https://developer.mozilla.org/en- US/docs/Web/API/Web_Speech_...](https://developer.mozilla.org/en- US/docs/Web/API/Web_Speech_API)

</comment><comment><USER34> As a non-native-speaker, I understood exactly four words from the monologue in the vid. Which _might_ be on par for some movies, often having actors whisper and breathy-voice through the whole thing (ahem House of Cards cough). However, for actual TTS like webpages and audiobooks, the 'Dina' voice works much better.

</comment><comment><USER35> Hey Zeena- will there be options to make the voices more unreal? The use case I imagine is for a character with a damaged vocoder or a broken speaker. Other glitchy affectations could be useful too.

</comment><comment><USER36> History has shown us that technological advancement of this kind will be adopted first by ...

Obvious application: H-anime. Reduced parameters for the "emotion" as well.

</comment><comment><USER37> the video [https://youtube.com/watch?v=zwYiDraKtSA](https://youtube.com/watch?v=zwYiDraKtSA)

</comment><comment><USER30> If this could generate well-done audiobooks instantly from a text, that would be fantastic. All e-books could have an audiobook version overnight.

<comment><USER38> It's kind of odd that they are not pitching this as the primary use case. Seems much more plug and play than game voicing

<comment><USER39> It needs a human to annotate the text with the desired emotion.

Ideally, it would be able to infer the emotion from the text itself, but I think that level of sophistication is a long way off.

Edit: Actually, this might be a perfect candidate for some sort of crowdsourcing. Imagine Wikipedia pages containing hidden annotations for the proper text-to-speech "tone/cadence/whatever" of each sentence or paragraph.

<comment><USER40> This is a really cool idea— amazing to think about something like goodreads taken to the next level where people are sharing their emotion markups for texts. Imagine how you could try different mappings to see which ones you liked...

</comment></comment></comment></comment><comment><USER41> Can't hear the voices over the music.

<comment><USER42> I hear them if I concentrate to isolate the voices out of the music. And you can pick up on quite noticeable flaws, especially in cadence and intonation. What somebody described as vocal fry sounds more like synthesis artifacts. The bare samples further on the page also highlight issues in cadence.

This is obviously an early demo, but this isn't yet to the level you could narrate an audio book - those little problems will quickly become noticeable.

</comment></comment><comment><USER43> Any plans to support languages other than English? This would be huge in the foreign language instruction field.

<comment><USER6> Yes! Supporting additional languages (and dialects) is definitely in our roadmap.

</comment></comment><comment><USER44> I could see this being used for RPG games to fix the choice deficiency that has been caused by going for fully voiced dialogue. Also, making Hitler read copypastas even more convincingly.

<comment><USER45> As good as even not-top-shelf voice actor talent is a really high bar. I keep my eye on this space because there are a number of things I do where having even just decent "radio voice" TTS would be useful (and better than I can do myself). But nothing is really there today. In some respects, it's better than I can do myself but certainly not consistently.

<comment><USER44> The bar really isn't "has to be good out of the box", if it requires some tweaking on a line to line basis that would probably be ok and still much, much cheaper and much quicker to iterate on than voice actors for these high volumes of speech. In a lot of these games the existing voice acting is often consistently poor (literally everything Bethesda ever released comes to mind); certainly quite a few notches below the average AAA voice acting (which is occasionally bad, but on average good).

<comment><USER45> Fair enough. I'm not really much of a gamer.

One of the other challenges with using outside voice talent is that it can be inconvenient/expensive when you need to add/change something. I've been involved with podcasts using an external host and one of the negatives with that process is that if you discover a minor mistake/glitch in the narration late in the process you can't easily fix it.

</comment></comment></comment></comment><comment><USER46> This is amazing! I was looking something like this to come up for a long time. Finally someone did it!

</comment><comment><USER47> Applied the form. Really cool.

I want the know the price and when can we use it in production.

</comment><comment><USER48> Is there an actual demo?

</comment><comment><USER49> Borh Cool and creepy!

<comment><USER6> O_o

haha thanks, we'll take that as a compliment!

</comment></comment><comment><USER50> Wow sounds very real</comment>


Facebook Cuts Oculus Rift Price to $499 - <AUTHOR> https://www.bloomberg.com/news/articles/2017-03-01/facebook-s-oculus-cuts-virtual-reality-headset-price-to-spur-sales <comment><USER2> [http://store.steampowered.com/hwsurvey](http://store.steampowered.com/hwsurvey)

According to the survey, it seems FB wants to claw back their lost market share before more VR entrants become an issue.

<comment><USER3> That's some interesting data. Nvidia is really killing it lately.

</comment></comment><comment><USER4> Ahm... ok, so it's 500$ now instead of 600$.

If you really want it, those 100$ won't make a difference.

If 600 is too much for you, 500 will most likely be too much as well.

If we get in the neighborhood of ~ 350, it'll look different.

But that article is a ridiculous PR fluff piece.

<comment><USER5> It's 500$ plus the cost of a computer capable of driving it.

<comment><USER6> Most likely PC VR buyers already have at least average computer. The only thing they will lack is GPU and maybe RAM. GPU upgrade would cost them 200$, so total would be 500+200=700$ and only if they don't already have any sufficient GPU for 2D gaming.

<comment><USER7> Assuming their computer is upgradable and not a all-in-one.

</comment></comment></comment></comment><comment><USER8> This comes as Intel reduced their CPU prices a few days ago and Nvidia reduced their GPU prices yesterday. Competition is good!</comment>


Could Exercising in Frigid Temperatures Make Us Healthier? - <AUTHOR> https://text.npr.org/s.php?sId=681259440 <comment><USER2> What is reported here has been demonstrated many times via autogenic training [https://en.m.wikipedia.org/wiki/Autogenic_training](https://en.m.wikipedia.org/wiki/Autogenic_training)</comment>


Espple – Apple 1 Emulator with PAL RF Output - <AUTHOR> https://github.com/hrvach/espple <comment><USER2> Wow this is awesome.

'High frequency modulated video signal is generated internally (via I2S/DMA) and all you need is a single piece of wire to play antenna. Even though it's extremely weak, it can still be picked up on your TV in the same room.'

</comment><comment><USER3> Native Chromecast</comment>


The Future of Books vs. The Future of Reading - <AUTHOR> http://powrightbetweentheeyes.typepad.com/pow_right_between_the_eye/2009/12/to-paraphrase-john-lennon-in-a-most-blasphemous-manner-so-this-is-christmas-and-what-have-you-boughtin-my-case-over-the.html <comment><USER2> In a few words, then, the coffee-table book is the wave of the future. As one who has not purchased a Kindle, I find this less than comforting.</comment>


Amazon's Interview Questions And Why I Don't Work At Amazon - <AUTHOR> http://www.xyhd.tv/2013/10/industry-news/amazons-interview-questions-and-why-i-dont-work-at-amazon/ <comment><USER2> It's not a serious post... but I have interviewed with Amazon and their questions are a big part of why I don't work there. (The other reason is that when I asked people what they were working on, they all said they were rewriting all the Perl code in Java "because Amazon is a Java company" \- apparently that was the biggest business need at the time)

Rather than go into great detail on why I don't like their questions, I'm going to pick out one that stands out as an example. It starts:

"Suppose I want to <description of some user story>, so I want you to design a system that <vague description of an implementation method>."

Okay, I'm thinking, done this before a lot of times, it's bland but not an unreasonable way to find out how somebody approaches problems. But they haven't finished talking, and they add one more sentence:

"Make sure you show me the objects and classes that your system will use."

This is the point when I try not to let my disappointment and irritation show. It's not just that they've completely prejudiced the question, by forcing it down one particular design path, it's that they've made it clear this is not a test of my ability to design systems, it's a test of my ability to mimic their design of the system. Worse yet, in one stroke this destroys any hope of finding out how the candidate thinks; instead, it just measures how well they can think along certain lines.

I don't have a problem with object-oriented designs - I'd probably have done things that way anyway. But I do have a problem with companies that hire based on conformity to groupthink. I don't want to work with a group of people who were selected based on their performance at this kind of question.

<comment><USER3> FYI Google's codebase is also heavily Java. I'm not sure if it's a good idea to judge companies/projects based on the language they use. [Edit: Okay, maybe I misunderstood that part]

Did the other interviewers also ask similar questions?

<comment><USER4> asuffield didn't malign Java: he seemed to imply judgment about the fact that the company seemed to be converting working code from LANGUAGE1 to LANGUAGE2 for the purposes of being a LANGUAGE2 company.

<comment><USER2> In particular about this being the only major project they were working on. They didn't just rewrite, they stopped doing everything else in order to prioritise it. The mind boggles.

</comment></comment></comment></comment><comment><USER5> I personally don't think this post is a serious compilation of question that get asked at Amazon considering the stature of the company nevertheless i think an interview at amazon will never be complete without rigorous test of candidates problem solving skills and/or the specific capabilities that he is applying for. Also the kind of questions that are mentioned in the article are the kind of questions HR's ask to confuse the candidate and the sole purpose of these questions is to check the candidates presence of mind and how he tackles those questions.IMHO Amazon is a great company to work at there is no doubt in that.

<comment><USER6> This data would suggest otherwise[0]. It is the company with the second shortest tenure from the report, with an average of only 1.0 years.

[0] [http://www.businessinsider.com/companies-ranked-by- turnover-...](http://www.businessinsider.com/companies-ranked-by-turnover- rates-2013-7)

<comment><USER3> Hmm. I think data showing hiring vs time for companies would be more relevant than average tenure of an employee.

i.e. The faster a company grows, the less likely/harder it is to maintain culture and enforce hiring/recruiting standards - I can see how that may lead to shitty interview questions.

<comment><USER5> yaa average tenure never makes sense at all, i agree with you on your point.

</comment></comment></comment></comment><comment><USER7> I just interviewed and got a job offer with Amazon as a college hire. The entire interview was literally a single long-ish (a few hours) coding project in the language of your choice. No HR nonsense, no questions about my weaknesses or challenges I have faced. It was quite refreshing from other interviews. I wrote code, wrote tests, wrote documentation, got a job, no bullshit.

<comment><USER8> I've heard this is a relatively new phenomenon at Amazon; it's great that they're moving in this direction.

</comment></comment><comment><USER3> I don't think this post fits well with the HN guidelines - [http://ycombinator.com/newswelcome.html](http://ycombinator.com/newswelcome.html)

It seems superficial and cynical, and doesn't seem to have anything useful to say. (Also, the post is tagged as 'Industry News'...??)

</comment><comment><USER9> For what position?

I worked for Amazon, and looked over the list of allowed/prohibited interview questions on the internal wiki. I did not see any of these question. Furthermore, they are against asking puzzle-type and behavioral questions.

<comment><USER10> Hmm, when I interviewed for an internship at Amazon, they asked me a behavioural question or two. Might have been that I had no previous experience and they needed to gauge how I worked with people somehow. Or that wiki isn't strictly followed by interviewers?

</comment></comment><comment><USER11> I interviewed for Lab 126 (like everyone else on the internet). I was really excited about the prospect but the guy giving the interview had an attitude problem and was completely uninterested in the process.

He insisted on grilling me on a metaphor in my personal statement as if it were literally true. I honestly don't know if he was trying to piss me off, or was (slightly) autistic and didn't understand metaphors. Once I'd gotten him off that, I mentioned I had a friend who worked at Lab 126, which he was also completely uninterested in. When your interviewer isn't interested in the fact that someone you worked with for 5 years works down the hallway from him? You're not getting that job. It was pretty clear a decision had been made against me before the interview ever took place and Amazon was just wasting my time.

Left a bad taste in my mouth.

</comment><comment><USER12> if all the numbers from 1 to 250, but one, were written in random order (no spaces) how _would_ you find the missing number?

FOR EXAMPLE, 132456789101113 is 1-13 and not very random. most answers below have misunderstood me (well, less now that some have been deleted in shame... ;o)

you can get the digits, just by seeing what is missing. but then you seem to be left with a rather tricky partition problem. so i guess dynamic programming? is there a better way?

would it help to pick out unique combinations (if the pattern 249 occurs just once, it must be 249, unless it is the missing number)? how far would that get you?

i guess since you know the missing digits you should check for each permutation - you might get lucky and not find one.

is there some cute trick? something involving suffix trees?

[edit: anonymoushn has a good point - it's not guaranteed unique]

<comment><USER13> Add them all up, subtract that from the actual sum of 1-250 and voila. Optimization bonus: you don't need to do the second sum, there's a closed form (I don't remember what it is, but I do remember Gauss came up with it as a kid).

<comment><USER14> Doesn't this only work if you have spaces between the numbers?

</comment></comment></comment><comment><USER15> Interviews are a horrible test of how someone will perform on the job. Never in work life are you required to come up with a solution immediately. Those types of solutions are almost always wrong. It's only after deep thought and 100s of hours toiling on a problem from every angle that an elegant solution that simplifies presents itself. But sadly, the only way to know if someone is capable of that is to actually hire them for a trial week or 30 days and see how they do and immediately fire or sign for a longer term contract.</comment>


New York fines Infosys $1M for work visa violations - <AUTHOR> http://m.timesofindia.com/business/india-business/new-york-fines-infosys-1million-for-work-visa-violations/articleshow/59291339.cms <comment><USER2> It's interesting reading the comments from the article. It appears to be majority of Indian commenters and the majority are negative towards Infosys. Many are saying the same thing US tech people have been saying. These big companies fake education credentials and skillsets to gullible US companies. They are body shops, hire people with no experience and present them as skillful. They are taking the visas away from the real qualified Indian talent.

It's been 20+ years, when are US CIO's going to wake up?

<comment><USER3> I too am perplexed by this. I sadly believe this trend will continue until some serious regulatory consequences are implemented.

</comment></comment><comment><USER4> That'll teach em.

<comment><USER5> $1M is nothing for such a huge company...</comment></comment>


Busy Building Things, a new brand for startups - <AUTHOR> http://busybuildingthings.tumblr.com/post/18395579055/just-shipped

<comment><USER2> I've got your Real Artists Ship poster and it's great! [http://www.busybuildingthings.com/products/real-artists- ship...](http://www.busybuildingthings.com/products/real-artists-ship-print)

</comment><comment><USER3> Love the idea of a life style brand for those who make things! I've got your biggest sized poster, looks beautiful right above my desk.</comment>


AOL CEO Fires Somebody for Pulling Out a Camera in a Meeting About Layoffs - <AUTHOR> http://www.theatlantic.com/business/archive/2013/08/aols-ceo-just-fired-somebody-for-pulling-out-a-camera-in-a-meeting-about-layoffs/278541/

<comment><USER2> Most of the comments here are missing the obvious point: it's bad form for managers to publicly admonish their subordinates, let alone publicly firing them (always a sensitive topic). The CEO could have said "no filming please" and then fired him later. He could have even asked the executive to be removed from the meeting if he was concerned he was a leaker.

IMO the CEO should have gotten the executive's side of the story before making a decision like that. It's got to hurt morale even more to see how expendable people at any level are.

<comment><USER3> I think he was trying to make an example out of him. Perhaps he already knew that Abel was leaking company information? (A fireable offense) This just seems like a very well calculated move.

Anyone referring to a part of the organization as loserville isn't worried about morale.

<comment><USER4> If indeed the individual was leaking company information, it would make this an _even more poorly calculated move_.

Firstly, you may know this individual was leaking company information, but the rest of your employees do not. So what is, to you, a righteous punishment would seem to _everyone else_ as arbitrary and vindictive. A display of force may be a calculated move, a display of force that appears random and arbitrary, is just stupidity.

So you just rightfully fired someone while dropping morale through the floor because it looks like you're out for random blood.

<comment><USER3> I think he had a point that he was trying to get across, and did it very efficiently.

I'm not defending what he did by any stretch, just trying to understand it and propose an explanation. When work environments are hostile like that, you either put your head very far down, or you get your resume onto the market.

</comment></comment></comment></comment><comment><USER5> Maybe I'm old fashioned but I think the story is that someone thought it was OK to randomly start filming a company meeting - one where they were discussing future layoffs & partnerships apparently.

edit: don't know if they were filming or taking still shots - either way.

<comment><USER6> Because two wrongs make a right? If you're a person with character, you handle the impropriety of others in a mature and professional way.

Then again, if you're a person with character, you don't refer to your business meetings as a "locker room" or use terms like "loserville."

<comment><USER7> > _you handle the impropriety of others in a mature and professional way._

Sure, and sometimes the mature and professional way is to fire somebody.

(Now, the execution of that was less than ideal, but a firing in general was not entirely out of line.)

<comment><USER8> Execution and Result are not independent things. Firing someone in a professional, mature, tactful way is a _different thing_ than what the CEO did. They're not just different styles: the firing of a person is an act intended to have a particular business outcome, and those different routes will have _different_ outcomes.

To quote Steven Brust, "The relationship between ends and means isn't one of justification, it's one of proscription."

<comment><USER7> I don't approve of the execution, but I cannot condemn the decision to fire.

</comment></comment></comment></comment></comment><comment><USER9> Please could someone with knowledge of UK employment law say what the difference here would be? I'm guessing the guy is still firable, but with a more formal process?

<comment><USER10> Why are open questions being down-voted? Is there something wrong with the questions?

</comment></comment><comment><USER11> Somewhat off topic, but I found it incredibly ironic the time (at our company, not AOL) I was told not to take pictures of a slide deck being presented at an all hands (I could barely make it out from where I was, and I would use my iPhone to zoom in) - given that every single person (numbering in the hundreds) on the conference call was able to just screen shot each and every page of the presentation.

People are weird about camera's "visibly" in their presence. Have you ever noticed how places like Starbucks will go absolutely batshit if you take out a zoom lens (like a 70-200 on a Canon SLR), but not blink an eye if you snap pictures with your iPhone.

I wonder if anyone in audience was wearing GoogleGlass at the time...

<comment><USER12> "Have you ever noticed how places like Starbucks will go absolutely batshit if you take out a zoom lens (like a 70-200 on a Canon SLR)"

no, not at all, maybe it's different in different parts of the country, but if you start shooting with a long telephoto inside a coffee shop its pretty rude to the people there.

If you want to take photos in coffee shops use a more discreet camera and a 35mm lens, not a telephoto, it will look less creepy.

<comment><USER13> Extending this, a normal power lens by definition "sees" about what your eye can see, a telephoto much, much more.

<comment><USER11> Inside a though, zoomed out, in dark light - my telephoto lens is pretty much useless. People are just put off by the sheer physicality of the lens, not so much what it is doing.

Likewise, (getting back on topic) - the poor guy fired at the AOL event wasn't fired for what he was doing, so much as the fact that he was visibly doing it.

</comment></comment></comment></comment><comment><USER14> It seems harsh, but in the same it's inappropriate to snap photos of a meeting with so much impact.

<comment><USER15> Isn't it reasonable to think that is a _most appropriate_ thing to memorialize?

</comment></comment><comment><USER16> Is there a problem here? You shouldn't be recording a video like that on your phone.

<comment><USER17> It's shitty behaviour by the filmer, certainly, but it is also terrible that firing someone in that manner is even legal. (In the UK it would not be, misconduct must be handled by verbal then written warnings. Only a narrow range of "gross misconduct" can result in immediate termination - and even then it wouldn't be handled with "you're fired.")

<comment><USER18> what a god-awful process an employer has to go through to fire a bad employee. That's a terribly bureaucratic law that only protects bad employees.

<comment><USER19> What's awful is that you seem to think you shouldn't have to do those things to fire someone. Just a verbal, a written, then fire. What's so awful about that? Do you want to be able to fire someone on less than 3 warnings[1]?

And yes, I understand there are some things - like maybe bringing a gun to work or punching a co-worker is auto-termination on the spot. But besides those outrageous things, you should be able to give a person a fair chance if it's a performance issue.

1.Depends on what is a "warning". At $LARGE_TELECOM, you get 2 warnings. First is verbal/email. The 2nd warning is in the form of a 6 month probation. That's a 6-month-long warning. If you haven't figured out how to succeed by then, I think you're now fair-game of getting fired.

<comment><USER20> (Shrug) As long as it's legal for me to quit with no prior notice, it should be legal for the company to fire me the same way.

I really don't understand the European notion that a private-sector job is some sort of government-sanctioned entitlement.

<comment><USER19> That implies that an individual person has the same resources as a Company. If you just quit, it's assumed you know what you're doing. And I'm guessing you're probably assuming a certain privilege that others may not have. If you're on HN, you probably are among the people who are paid well, have savings and can get another job in no more than 6 weeks. There are a lot of people out there who aren't as fortunate; who will be stricken with horrible- hardship if they're job just disappears.

You quitting without warning won't harm a big corporation as a whole, but a bigcorp firing a person without warning has a chance of nearly destroying that person depending on what job and situation we're talking about. Especially in USA where health-insurance is connected to employment. A sudden dismissal can really cause someone to die.

<comment><USER20> _That implies that an individual person has the same resources as a Company._

No, just the same rights. "Privileges" should have no place in the law.

Put another way, as an employer, why should I lose my rights of free association simply by partnering with one or more other people in a corporation?

<comment><USER19> Ah, then we simply cannot agree. The ability to exercise a right is just as important as the right itself. The sudden termination of a job is more difficult for the employee than the employer in almost all cases so the law should help balance that out. Either it's harder to fire people or the government needs to arrange for basic-income & healthcare for the unemployed.

<comment><USER21> You should be able to get unemployment insurance for at least 6 month after you are fired - in most cases it's enough to find a new job. There is problem with very low cap on unemployment payout (~2k/month which is not enough to live in many parts of the country) that has to be fixed but otherwise it's not like you will starve the next day.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> That's really bad form by Armstrong. For all he knew, the guy was taking a snapshot to post on the company blog as part of his job or something. Or maybe he was just checking his phone.

At the very least, if you fire somebody over that, you at least announce "no filming please" and fire him privately afterwards.

<comment><USER3> I doubt that there is any business reason for taking pictures of an execution. Armstrong would know if there was. He caught a leaker in the act. The question is how do you handle it? If you want to make an example, you do it on the spot. If you want to be professional, you tell him to put the camera down and do it later.

If you refer to a part of the company as "loserville" then you're not too worried about appearing professional.

<comment><USER23> > If you refer to a part of the company as "loserville" then you're not too > worried about appearing professional.

He was citing the press they were getting, or at least that's how I took the article. This is not the type of thing you announce on a public phone call (that people _may_ get laid off) because all of your employees are now going to be job surfing irregardless of what division they are in.

</comment></comment></comment><comment><USER24> My cousin was in that meeting, apparently the back story is that he was responsible for a design that everyone is against.

He says he was probably going to be fired anyway.

</comment><comment><USER25> Wouldn't multiple divisions of AOL go ahead and publish the Photo if someone took a similar picture of another company?

Take TechCrunch for example. Wouldn't they publish a Photo of MSFT having layoff's if someone sent them a picture?

<comment><USER7> Why shouldn't they publish such a picture?

You are trying to suggest some sort of hypocrisy here, but I'm not seeing it. Expecting loyalty from your employees and expecting loyalty from employees of other companies to _their_ company are entirely separate issues. If somebody gets a photo of MSFT layoffs, that is MSFT's problem, not TechCrunch's.

</comment></comment><comment><USER26> Sadly, I probably would have had the same reaction. Between the stress of things not going well and the stupidity of others, I start to get a short fuse.

I'm not sure I would have fired the guy, but I suspect I would have at least said, "Put that f'n camera away before I shove it up your ass". Actually, saying that would probably be worse.

</comment><comment><USER27> "You can't fire me! I'm being laid off!" (Though I'm sure there was more to it than that...)

</comment><comment><USER28> My bet is that traffic to job postings increased dramatically from AOL office networks after that meeting. :)

</comment><comment><USER29> Isn't a meeting with 1000 people pretty much public anyway? Media reports aren't making patch look like 'loserville', patch simply is 'loserville'.

<comment><USER30> It was a conference call. There is zero chance to keep it from being recorded. The next one will still be filmed/audio recorded, but with a little more discretion.

</comment></comment><comment><USER31> Maybe it's the new normal among the power elite/police forces/NSA.

</comment><comment><USER10> Was the person under NDA? Forbidden from filming beforehand?

The most of you seem to be leaping to the defense of the CEO for something that could've been a personal action based on a perceived slight instead of a corporate policy.

Out of the 1,000 or so there, wonder how many others started to record as soon as that went down. To also start recording would've been my immediate reaction.

<comment><USER32> I don't know anything about AOL specifically, but I've worked for a handful of BigCo's. All have required signing some sort of agreement at the start of employment which explicitly forbids leaking confidential information. So it's very likely that this person was under an NDA. What may be surprising to people who haven't worked at a BigCo is that due to legal implications, often times companies actually have guidelines about what should be discussed in recorded formats versus in person/phone.

<comment><USER10> True that, from my POV I received requests on an event by event basis. Many of these people probably had to sign as part of employment.

</comment></comment></comment><comment><USER10> AOL is a public company. It's actions at large events are public unless explicitly noted otherwise.

What is large? Stagehand here, 1000+ is large. I've been made to sign agreements for smaller venues.

Edit: To elaborate, smaller venues can easily close doors. Not so much in auditoriums or arenas. Concession is selling goods, other building customers are milling about right behind your event's curtains. Employees of the building are milling about as well, waiting for your talking to be done with.

Pipe and drape is not a privacy filter. You are often in a private space used by the public.

Rather pissed edit: Now that I think about it, this guy is at the helm of a company that sells out people's privacy to anyone with cash and legal assurances. He is firing someone for using a camera while booming his voice over a PA[1] system much like those my friends and I have handled over the years. Screw him.

[1] [http://en.wikipedia.org/wiki/Public_address_system](http://en.wikipedia.org/wiki/Public_address_system)</comment>


Incredibox - Background music for programming.  - <AUTHOR> http://www.incredibox.com/en/#/application <comment><USER3> I can hack/design for hours without even knowing it while listening to Kap Slap.

It also helps you run a 5K faster than you might have originally imagined :)

Anyone who likes remixes/house/dubstep I'd encourage you check it out! The spring break mix is an hour long and it's full of goodies.

<http://soundcloud.com/kapslap/kap-slap-spring-break-mix>

p.s. I'm only evangelizing this stuff so much because honestly if I set out to run 10k I'll listen to this and it will help me get there more than anything else. Or if I wanna kill a new comp or a handful of bugs, [PLAY] and it sucks me in like a vortex.

<comment><USER4> Love this, any more recco's?

<comment><USER5> If you're looking for more mashups, check out Girl Talk, Milkman, and Super Mash Bros.

If you're looking for similar electronic music sets, here are a couple I've been digging lately:

Kaskade's set from Coachella, soundboard recording. [http://www.themusicninja.com/live-set-full-kaskade- coachella...](http://www.themusicninja.com/live-set-full-kaskade-coachella- free-download/)

Porter Robinson's BBC Essential Mix - [http://soundcloud.com/edmtunestv/porter-robinson- essential-m...](http://soundcloud.com/edmtunestv/porter-robinson-essential- mix-live-from-hull-bbc-radio1-01-28-2012)

Knife Party's BBC Essential Mix - [http://soundcloud.com/edmtunestv/knife- party-essential-mix-l...](http://soundcloud.com/edmtunestv/knife-party- essential-mix-live-from-hull-bbc-radio1-01-28-2012)

Luvstep 2.5 (There are several other mixes in this series, though this one is my favorite) - <http://soundcloud.com/dirtysouthjoe/luvstep-2-5>

Straight Bass to the Dome - <USER2> <http://soundcloud.com/cberra88/straight-bass-to-the-dome>

<comment><USER6> If you like Knife Party, you might like the band's main project (Knife Party is a mini-project by two band members from a group named Pendulum.) They do fantastic drum and bass. Immersion, their most recent album, may be their best.

The Island Pt. II: <http://www.youtube.com/watch?v=CBIYl88Zwyc> Witchcraft: <http://www.youtube.com/watch?v=AooMCiV2eb4>

Their other albums, In Silico (Showdown, the Temptest) and Hold Your Colour (Slam, Blood Sugar) are also fantastic. My favorite band, personally.

<comment><USER7> That explains why I like both Knife Party and Pendulum's sound. Set Me On Fire is an awesome Pendulum track.

</comment></comment></comment></comment></comment><comment><USER8> I think the comments here are responding negatively to the title of the post. True, you're probably not going to spend the rest of the day coding to the music you make in incredibox. But this app is still very cool for what it is: a fun, easily accessible experiment in making music with loops.

I put together a couple of little songs that sounded pretty cool, and the experience was simple and enjoyable. I give props to whoever made Incredibox, and think this general direction is promising for casual music making, an activity that could benefit all of us.

<comment><USER9> Agree. This app made me smile, a rare thing while coding.

<comment><USER10> This app also made me smile, but I have to disagree with you - I often can't stop smiling while coding. The feeling of satisfaction when something works out really is unrivalled. Each to thier own though!

</comment></comment></comment><comment><USER11> My go-to for programming music is Groove Salad on SomaFM, a San Francisco institution going on 12 years. <http://somafm.com/play/groovesalad>

<comment><USER12> I was all about Groove Salad until I found <http://di.fm/>

<comment><USER13> DI and The Crystal Method were my gateway into electronic music. Over a decade later and I haven't looked back.

</comment></comment></comment><comment><USER14> <http://musicforprogramming.net/> is much more useful.

<comment><USER15> Thanks, exactly what i was looking for.

<comment><USER16> have yall seen Console.fm ? Crawls the web to find the most trending electronic music and sorts by genres.

<comment><USER17> I have now! cheers :)

</comment></comment></comment></comment><comment><USER18> I think this is a mighty clever app; I'm not really sure why there are so many negative comments.

It would be nice if the url changed with the sample combinations though. It looks like you can record a chunk of the sound and share that, but I'm far more interested in sharing the exact combination that I come up with than I am the sound itself. I'd love to just send a link to a friend so that they could not only see the combination in action but also dive in and make it their own.

</comment><comment><USER19> IMHO I really do not know how this nerve-racking sound can be endured while programming. Besides it basically is just this classic on steroids:

[http://svt.se/hogafflahage/hogafflaHage_site/Kor/hestekor.sw...](http://svt.se/hogafflahage/hogafflaHage_site/Kor/hestekor.swf)

</comment><comment><USER20> I really like listening to online streams like soma.fm or di.fm when coding. Not just because their sounds are great (they are!) and put me into the zone (they do!), but because it keeps me motivated when I get the inner urge to click around the interwebs. Why? Because I _know_ that while I'm listening and trying to stay focused on my coding, somebody else somewhere in the world is listening to exactly the same tunes at the same moment _and is being productive_. That really keeps my motivation to produce stuff high!

</comment><comment><USER21> This is really fun. I like the vocals a lot and I like the interface to control each track. The title is incorrect because I don't think the intent of this app is for programmers to make background music to work to.

</comment><comment><USER22> Every once in a while all of them pause in sync. Try using distinct primes for the length of a musical cycle to create a different sound. Not sure how it would for beats, but I know visually this is useful.

<comment><USER23> Great and fun application, but these little pauses at the "seams" between the loops are REALLY throwing me off.

You can't stomp your feet to this for more then one whole loop. Too bad, I loved the idea and the implementation!

</comment></comment><comment><USER7> OK, so no one's going to mention Above & Beyond's Group Therapy Miami set for this year's Winter Music Conference?

[http://soundcloud.com/edmtunestv/above-and-beyond-live- group...](http://soundcloud.com/edmtunestv/above-and-beyond-live-group- therapy-miami-wmc-22-03-2012)

[http://soundcloud.com/edmtunestv/mat-zo-live-group- therapy-m...](http://soundcloud.com/edmtunestv/mat-zo-live-group-therapy- miami-wmc-22-03-2012)

[http://soundcloud.com/edmtunestv/arty-group-therapy-miami- wm...](http://soundcloud.com/edmtunestv/arty-group-therapy-miami- wmc-22-03-2012)

[http://soundcloud.com/edmtunestv/andrew-bayer-live-group- the...](http://soundcloud.com/edmtunestv/andrew-bayer-live-group-therapy- miami-wmc-22-03-2012)

[http://soundcloud.com/edmtunestv/boom-jinx-live-group- therap...](http://soundcloud.com/edmtunestv/boom-jinx-live-group-therapy- miami-wmc-22-03-2012)

Or Pretty Lights' The Hot Shit radio show?

[http://soundcloud.com/prettylights/pretty-lights-the-hot- sh-...](http://soundcloud.com/prettylights/pretty-lights-the-hot-sh-t-16)

You're welcome.

</comment><comment><USER24> Trying to be not petty but I posted this weeks ago and nobody really cared:

<http://news.ycombinator.com/item?id=3804637>

In any case, I really like how they explain how to user can actually use it. I dont know what everyone else thinks, but I feel like everyone in the age braket 18-30 wants to be a dj at a party.

<comment><USER25> Should be a lesson for you, marketing matters. Your title didn't get people to click and enjoy.

<comment><USER24> One caveat, my headline can only ask people to click, though enjoyment/fulfillment is mostly dependent on individual preferences, right?

</comment></comment></comment><comment><USER26> Achievement 3 is awarded for "find the right combination," but there are 137980 combinations (assuming order doesn't matter) and I'm not that patient. :x

<comment><USER27> Are you not a hacker?

<comment><USER26> Not in Flash. If it were an HTML5 application I'd have been breaking it apart.

<comment><USER28> TLDR: The combination is using the first of each sound type

Method:

1\. grabbed the .swf file (Chrome Developer Tools -> Network -> one of the 6 .swf files)

2\. used the incredible tools to extract and disassemble from <https://github.com/CyberShadow/RABCDAsm>

3\. with luck came across \incredibox-0\incredibox_fla\MainTimeline.class.asasm lines 24827-24840

Took me longer to write this post than to figure it out, but, I am guessing I got lucky. I only decided to attempt checking this out as I started playing around with the RABCDAsm couple hours ago. I've little to no idea how to read those .asasm files yet, but I'm learning more about them.

Edit: extra spacing

</comment></comment></comment></comment><comment><USER29> This is terrible. Music should stimulate the mind, not dull it. Creepy little men "singing" is not going to make me more focused, but a nice piece of Baroque will certainly do the trick.

</comment><comment><USER30> 1) Go to pandora

2) Start a new channel

3) Type "abakus"

4) vote up/down as desired

5) go on and be productive with an awesome, low-key background soundtrack

<comment><USER31> Alternatively, grooveshark.com for people currently outside of the U.S.

<comment><USER32> Why outside the U.S.? I'm in the U.S. and it seems to work fine.

<comment><USER33> Pandora doesn't work outside the US because of copyright difficulties. However, grooveshark doesn't seem to worry too much about this, and as such it's available outside the US.

</comment></comment></comment></comment><comment><USER34> My favorite is <http://somafm.com/play/suburbsofgoa>

</comment><comment><USER35> Since people are suggesting online stations here, Notch (he of Minecraft fame) often listens to <http://www.di.fm/electro/> and somehow I got addicted to it as well while watching him code his Ludum Dare entry. Kinda high energy though.

<comment><USER12> I've been a paying subscriber to di.fm for years. It's great.

Honestly, I barely know what the different station names mean; I just flip through the stations until I find one that has a beat/sound that matches what I'm looking for at that moment.

</comment></comment><comment><USER36> I like to listen to my turntable while coding. Getting up every ~15 minutes to flip/change a record actually helps me focus because it gives me constant tiny breaks. The mindless nature of the task also doesn't interrupt my thoughts but does give me a change to stretch my legs.

</comment><comment><USER37> Great thing. Although I don't think it is the best music to code by, especially as it just loops and loops! I made a similar 'remixer' in about 2003 for my university dissertation, although mine was networked so you could mix with a friend ;) Love the art style though

</comment><comment><USER17> I've recently been digging Weird Ribs - Frontiers album which can be obtained free from his bandcamp.

<http://weirdribs.bandcamp.com/track/space-tourist>

If your into minimal/ambient/experimental.

</comment><comment><USER38> This is freakin' awesome guys! Android/IOS app and maybe facebook will buy you for 1B ;)

</comment><comment><USER39> Late to the party on this, but I highly recommend the imaginatively titled musicForProgramming(); over here: <http://musicforprogramming.net/>

</comment><comment><USER40> I'm partial to <http://8tracks.com>. Users have posted a ton of "study" mixes and "workout" mixes that I find perfect for when I an designing or coding.

</comment><comment><USER41> I would like to take this opportunity to make this shameless plug. I use it to play background music while programming. An app that is a full music player but in your browser and 100% html5. It plays local music like vlc or windows media player. It also runs entirely offline and in background (close the tab or browser and music still plays).

[https://chrome.google.com/webstore/detail/fddboknafkepdchido...](https://chrome.google.com/webstore/detail/fddboknafkepdchidokknkeidnaejnkh)

<comment><USER42> Looks interesting. Do you have the original URL for those of us not on Chrome?

<comment><USER41> Well the app is a packaged app. It's just like software. So it is not hosted on any server. I am working on making it a web app but that means it won't be working in background.

<comment><USER42> Ah, I see. Thanks. I thought it was a hosted web app.

</comment></comment></comment></comment><comment><USER43> Really bad title, really awesome app.

</comment><comment><USER7> With all the dubstep links here, I'd be remiss if I didn't include Philly's own Dubsef:

<http://soundcloud.com/dubsef/dubsef-filthwater-mix-www>

<http://soundcloud.com/dubsef/dubsef-broverload-vol-2>

<http://soundcloud.com/dubsef/dubsef-all-your-bass-are>

</comment><comment><USER44> I think it's funny how [negative] some of these comments are. I think the negative reactions here are a perfect example of Louis C.K.'s joke/rant: [1] "Today's Tech is Wasted on the Crappiest Generation"

[1] [http://videosift.com/video/Louie-CK-on-Conan- Oct-1st-2008?fr...](http://videosift.com/video/Louie-CK-on-Conan- Oct-1st-2008?fromdupe=We-live-in-an-amazing-amazing-world-and-we-complain)

Edit: angry -> negative

<comment><USER15> Which angry comments?

<comment><USER45> It's funny, i'm 2/3 of the way down this thread and so far most comments have been of the "i can't believe all these negative comments" ilk. I haven't seen one negative one yet. I guess they're lower down... i think HNers should have more faith in the upvote/downvote process.

<comment><USER46> true, same experience here often. I'm often reading things here after they've been on for a while, and I often have to read over comments complaining about other people being negative... I would probably agree with them, if only I would have seen any negativity besides the comments about negativity ..

</comment></comment></comment></comment><comment><USER47> Excellent. Love the interface. Very well-thought out.

</comment><comment><USER48> I enjoy listening to live streams from clubs around the world thanks to time difference and <http://www.awdio.com> . On friday afternoons (in Europe) I ended the working week with electro/house from <http://www.awdio.com/yumla>. Now i'm in Asia myself and this doesnt work anymore :(

</comment><comment><USER49> :( You guys put us to 300MB/s

<comment><USER50> That would explain why it was transferring <100kB/sec.

</comment></comment><comment><USER51> This (or at least the shuffle mode) reminds me of AlgoMusic, a music generator for the Amiga that, back in the day, provided me many hours of coding music:

<http://www.youtube.com/watch?v=gyUnXjVgx44>

I'm going to throw Incredibox into shuffle mode for a while to see how long it takes me to switch back to Daft Punk.

<comment><USER52> I can't believe your the only one in this thread that mentioned shuffle mode. Very neat.

</comment></comment><comment><USER53> 128 bpm just ain't enough these days. ;) Coding at 150 bpm always helps with some electronic music (eg. hardstyle) [http://gaming.operationreality.org/groups/music/forum/topic/...](http://gaming.operationreality.org/groups/music/forum/topic/what- song-are-you-listening-to-right-now/?topic_page=7&num=15)

</comment><comment><USER12> I'm surprised no one mentioned the Buddha Machine -- a physical box that loops sounds and beats to make a similar sort of music: <http://www.fm3buddhamachine.com/v2/> This site reminds me a bit of the iPad app, which lets you work half a dozen virtual machines.

</comment><comment><USER54> There's some really nice links here. Thanks everyone!

I'm old school :) <http://livephish.com/radio/listen.m3u>

Some good stuff here as well. <http://www.radioio.com/genre/eclectic- specialty/>

</comment><comment><USER55> BBC Radio 1 Essential Mix does it for me: <http://www.bbc.co.uk/programmes/b006wkfp>

The best DJs from around the world produce mixes every week. Pretty much always top notch stuff that usually doesn't have a lot of lyrics.

</comment><comment><USER56> Wow, this application has gone even further. I saw it I think two years ago (or last year?) and you couldn't do that much with it.

It's very enjoyable because the loops are great.

Nothing to program to, as I enjoy alternative music (Limp Bizkit anyone?) and playing my playlists in iTunes while coding.

</comment><comment><USER57> "Find the right combination" huh? Kind of subjective, right? How do you do this?

[edit]: [http://www.howtocircle.com/2012/04/incredibox-find-right- com...](http://www.howtocircle.com/2012/04/incredibox-find-right- combination.html)

</comment><comment><USER58> Fun to have a little play around in, although I'm not sure how much programming I'd get done playing with this ;).

<http://www.incredibox.com/?music=4F9B48F2E5B02>

</comment><comment><USER59> I really like the interface. It's a joy to click around and building little songs!

But if you record a composition and instantly stop the recording, it will delete your whole composition. I think this isn't intentional.

</comment><comment><USER60> Sorry I prefer old school dj's, they still exists and I don't have to play with an interface ? I'll stay with <http://somafm.com/>

</comment><comment><USER61> How can I get at star 3?

<comment><USER62> Complete star 2 and remove all singers. Then add the first in each category, left to right. (How do I know this? Luck!)

</comment></comment><comment><USER63> I've wondered for awhile what some good programming music is. I know this could vary but what do some of your playlists consist of? Or even link up good Spotify playlists.

</comment><comment><USER64> Wow, incredibly addicting. I don't think it is something I would play around with every day, but I spent about an hour trying out different combinations.

</comment><comment><USER65> This is fun. I want to be able to share my mixes though.

<comment> sasha-dv How about this? <http://www.incredibox.com/?music=4F9C15381AD42>

</comment></comment><comment><USER66> I also like turn <http://turntable.fm/ambient_chillout_trip_hop2>

</comment><comment><USER67> Something happened on my computer where it took like 3 minutes to load. May be an issue with Flash.

Also wasn't able to drop anything.

Using Chrome on Ubuntu.

</comment><comment><USER68> My go-to coding music is the TRON: Legacy soundtrack, but this is turning out to be a pretty awesome alternative so far.

</comment><comment><USER69> SomaFM is the key. Cliqhop + Groovesalad. <http://somafm.com/>

</comment><comment><USER70> This is amazing, man. But it actually made me stopped coding, instead, I'm enjoying all the combinations.

</comment><comment><USER71> This many replies and no one has mentioned how creepy their hipster mutation mascot is?!

</comment><comment><USER72> This is so much fun. Thanks to whomever created this. Will give it a spin starting now.

</comment><comment><USER73> I am officially addicted. One can't make anything that sounds bad with it! So badass.

</comment><comment><USER74> Very cool! Next thing: randomly change the tunes every 3-4 mins :)

<comment><USER75> There's a shuffle button in the top right

</comment></comment><comment><USER76> This is incredibly cool. Having a blast messing with it.

</comment><comment><USER77> yeah, i found this to be super fun and i felt like a dj for about 10 mins while i made my beats. job well done.

</comment><comment><USER78> Flash Blocked!

</comment><comment><USER79> Props. This is a very cool project.

</comment><comment><USER80> I absolutely love it! I don't know what else to say.

I'm guessing there are plans to increase the number of different sound types?

</comment><comment><USER81> Hackers soundtrack :)

</comment><comment><USER82> the greatest thing about this app is the shuffle mode.

</comment><comment><USER83> this is excellent - needs to be an iPad app.

</comment><comment><USER84> great job ... beautiful interface!

</comment><comment><USER85> I love it.

</comment><comment><USER86> people still use flash?

<comment><USER87> You do now there is a place for rich media on the web and it is very popular. Don't you?

</comment></comment><comment><USER88> that was fun

</comment><comment><USER89> mind=blown.

</comment><comment><USER90> really good

</comment><comment><USER91> spettacolare</comment>


Bad SSL - <AUTHOR> https://badssl.com/ <comment><USER2> An incredibly useful resource, well maintained by some of the best people in the PKI space, recently quoted by US-CERT [1] and so quick to use that I try it before starting to use any browser.

A year ago it made me find out that the most popular iOS Tor browser doesn't check certificates at all. [2] (Use OnionBrowser instead.)

[1] [https://www.us-cert.gov/ncas/alerts/TA17-075A](https://www.us- cert.gov/ncas/alerts/TA17-075A) [2] [https://twitter.com/FiloSottile/status/765230315132559360](https://twitter.com/FiloSottile/status/765230315132559360)

For an easter egg, try to click on "Defunct"...

<comment><USER3> amazing, how does one get to know certificate security when its scattered over a gazillion of RFC's ?

</comment></comment><comment><USER4> I have no idea what I'm looking at. Do I need to enter a domain name some place? What domain is this telling me about? I scroll to the bottom of the page, it's telling me what browser and OS I'm on ... ok, maybe this page is showing me how bad my browser is at SSL?

Oh, these things are clickable. "This pages contains a lone password field not wrapped in a <form> tag." Um ... yeah? Oh, you're saying that my browser renders that and it probably shouldn't.

dh2048 is green let's click that. "dh2048.badssl.com uses an unsupported protocol. ERR_SSL_OBSOLETE_CIPHER"

Alright, I give up. I have no idea what I'm looking at.

Edited to add: If this site is reporting issues with my browser, why does it seem to say that Chrome supports dh2048 (this item is green on the page) but then following the link the browser complains that it's unsupported? Either the point of this site is not obvious, or it cannot be trusted to know the right things about my browser.

<comment><USER5> To clarify: this doesn't show what's supported and what's not, that's for you to find out by clicking things. It shows things in green that are generally considered secure. For example, 2048-bit finite-field ephemeral Diffie-Hellman (that's dh2048.badssl.com) is generally still considered secure, but Chrome doesn't allow it, so that's why you get that error even though the website shows it as green.

Chrome does so for tangentially related, mostly-fine reasons. Generally dh2048 doesn't really exist on much of the Internet: because clients that don't do ECHDE (only DHE) are also generally limited to 1024-bit FFDH. That's not as good (not totally busted, but not great either). Anything that does 2048 bit FFDH probably also does ECDHE, and ECDHE is much better from a performance perspective and marginally better from a security perspective.

The best classical attacks put P-256 at about 128 bits of security, and 2048 bit FF at about 112. Neither is problematic at present. FFDH has some other problems: because the other peer communicates the field over which you're going to work, a poorly configured or malicious peer could pick a bad field or a small subgroup. (That's a little esoteric, but since there's no good reason to keep it around anyway....)

<comment><USER6> Yea, it really should have a short description at the top. That alone would make the UI instantly more useful.

</comment></comment></comment><comment><USER7> Good concept, but the usability is bad

If you see the dashboard things are clearer, but there's a mismatch between connected/not connected and what they were supposed to do.

<comment><USER8> I think you're right but missing the context: badssl.com was setup as a resource for security engineers who are running tests. It's great for that and it allows the kind of fine-grained testing which anyone who is developing software, configuring firewalls or group policy, etc. would want — i.e. if you do anything which consumes HTTPS, why not take the time to add a step to your CI process which prevents accidental regressions?

The dashboard ([https://badssl.com/dashboard/](https://badssl.com/dashboard/)) is very new — see [https://github.com/chromium/badssl.com/issues/257](https://github.com/chromium/badssl.com/issues/257) — and as the person who opened that issue, my context was different: that conversation started among a group of U.S. federal government employees who are often in the situation of needing to use a MITM SSL proxy for compliance reasons and don't directly control it, often lacking even the ability to install software on their primary workstation (not without cause, given the threat model). Being able to run tests in a browser and send the helpdesk a single link saying "These three boxes should not be red, please file high- priority ticket with the network group" is really useful for getting changes through quickly.

<comment><USER7> Ah I see

It's an interesting concept and service, no doubt about it, but giving the test results as Pass/Fail would be more helpful ;)

<comment><USER8> I think [https://badssl.com/dashboard/](https://badssl.com/dashboard/) does a good job at that — you could probably do something like what SSL Labs does with a letter grade but I think the Good/Okay/Bad levels is probably the level of nuance you want for a simple "Should I learn more about this?" prod.

What I'd like would be for that to eventually become the default view with an advanced tab for people who want to drill down into the full list of everything available.

</comment></comment></comment></comment><comment><USER9> Really don't understand the people downvoting in this thread. Apparently a certain percentage of the population believes that if they don't understand the function of an artifact in the world, the maker of said artifact has failed.

It isn't quite projection; seems like more of some wildly misguided consumer- is-king impulse. Browsing academic libraries must be hell.

<comment><USER10> Posting something without explanation is bad taste :) I completely understand what this thing is for (easy testing of TLS clients) but I can understand the frustration of seeing a link without context.

<comment><USER11> Although the color-coding is odd; red doesn't mean insecure or even "dubious", even though it does sometimes... So using the site even for testing TLS clients seems a little non-obvious.

At least if the idea was that your client should accept green and reject red connections, the site has definitely failed.

If the idea was just to let you see what happens, then why the color coding?

<comment><USER10> Can you tell me which `red` is not insecure? (or not obsolete)

<comment><USER11> [https://mozilla-old.badssl.com/](https://mozilla-old.badssl.com/) negotiates to TLS1.2 ECDHE RSA AES128 GCM SHA256 for me (FF54) which is fine.

There may well be obsolete stuff that server _does_ support; but as negotiated, that's pretty much as good as it gets. It even has the new downgrade-prevention extensions on, so support for the old stuff shouldn't be a problem even _if_ your client accepts it (which it need not).

<comment><USER10> Yeah I see, this one is more of a server-side problem since it still allow SSLv3 connections.

</comment></comment></comment></comment></comment></comment><comment><USER5> In case you're wondering how you might use this: BadSSL is really convenient for checking clients. Is that weird version of Curl in that PHP webapp totally busted? Answer: probably yes -- although you can use this to find out how it's busted specifically in the context of TLS.

If you have a modern browser, whatever it does is probably fine. Also, consider using Chrome. (Yes, I know about the battery life issues.)

(Curl-from-PHP can be bad for non-TLS reasons! It's a likely SSRF vector, and it often does things like TFTP and Gopher so it will helpfully let you speak all sorts of protocols.)

</comment><comment><USER12> I misclicked and realised how many times this has been posted

[https://news.ycombinator.com/from?site=badssl.com](https://news.ycombinator.com/from?site=badssl.com)

</comment><comment><USER13> I'm surprised to see so many negative comments. It's a super straightforward UI, you click on stuff to see how your browser treats that ssl (mis)configuration. This is a great resource, thanks for posting.

<comment><USER14> The UI is straightforward, true. Very simple. That's not the same as good. The comments here indicate that a great many people simply don't understand what they're looking at. That's bad. A straightforward, simple UI is useless if people don't understand what it's telling them.

<comment><USER13> I understand what people are saying, and I'm offering a contrary opinion, that I found the site useful as-is and I'm glad it was posted despite the fact that HN's rules on not allowing links to include any extra context are leading to some confusion.

</comment></comment></comment><comment><USER15> Used this in junnit tests. A callback to a specific host caused entire platform to hang 5-10 minutes or untill restart of different batch jobs but also dermed like Translations did it too. Turned out specific certificate with strong key would not be picked up by java provider but in stead fell down to our ncipher hardware box and Got stück. Now we Used httpclient but through Socks proxy and timeout does not Work Then. After That Bouncy Castle was put before ncipher as provider and was tested with all those Certs to avoid similar problems.

</comment><comment><USER16> I had no idea what was the purpose of this website until I found some explanation in the comments.

Adding offense to injury it actually shows unhelpful info if you put your cursor on the Badssl title on top of the page.

Allow to suggest a little modification here, replace the following:

 badssl.com

with

 badssl.com - manual testing of security UI in web clients

</comment><comment><USER17> So far it appears that latest Safari on macOS is fully vulnerable to pinning, would only alert about a revoked certificate on second access to the page (?), and doesn't care about insecure password/credit card forms.

</comment><comment><USER18> I created a complementary resource, [https://badtls.io](https://badtls.io) to allow for automated testing of TLS client libraries. It uses its own self- gendered CA root to allow for generating certificates that exhibit different edge case conditions.

A few practical differences are that badtls.io is designed to be easy to run locally and having simple Python scripts to generate new keys and certs.

For my TLS libraries I utilize both badssl.com and badtls.io to provide more diverse coverage.

<comment><USER16> Always wanted to see what a self-gendered CA root would be like ;P

</comment></comment><comment><USER19> [https://www.sslshopper.com/ssl-checker.html](https://www.sslshopper.com/ssl- checker.html) comes to mind

<comment><USER20> I'm actually more of a fan of [https://www.ssllabs.com/ssltest/analyze.html](https://www.ssllabs.com/ssltest/analyze.html) \- it gives you a whole lot more information (although does take longer).

<comment><USER21> Both of those sites are for checking remote servers. BadSSL is for checking what your client browser behavior is.

<comment><USER22> But SSLLabs does have a client test, it's even linked to from the BadSSL dashboard page.

[https://www.ssllabs.com/ssltest/viewMyClient.html](https://www.ssllabs.com/ssltest/viewMyClient.html)

<comment><USER23> It took me going to this page to understand what was going on, I assumed it was a web server test. The report was more pratical too, telling me what I'm protected against, not just a bunch of yes/no things that I have to go reference. I'm on a phone in portrait mode though so maybe it is just a formatting thing.

</comment></comment></comment></comment></comment><comment><USER14> If this is meant for general technical consumption, it's sorely lacking in usability. After several seconds, I guessed that it might be referring to something about my browser.

Some of the colours seem to indicate badness. Clicking on things provides no additional information, but then makes me wonder if it's meant to be an example of a bad webpage and there's nothing wrong with my browser.

Another failure of minimalism.

<comment><USER24> This site isn't meant for general technical consumption. I don't understand why you would think otherwise. Why does this page have to explain what all the different cyber suites are, how SSL handshaking works, or why some hashes are no longer considered secure for cryptographic purposes? There are plenty of other websites out there that provide SSL primers. This website doesn't need to do that.

This isn't a failure of minimalism, it's a pretty cool page for people who are curious about the different SSL weaknesses that have been discovered over the years.

<comment><USER23> It should at LEAST say it is targeting the browser for the tests, not someone's ssl site. I had no idea it was testing my phone until I went to the other test site link in the footer. I can't believe you go to such length defending the "UX" when it isn't even obvious what the test is for. Seriously.

<comment><USER24> The site has no such obligation. The site is for a very specific target audience: people who write web clients/web browsers. So the site isn't created for you, and it isn't meant for general consumption, and it doesn't have to explain anything.

It's a tool for web client developers, like it says in the github README. Which is one click away.

If the developers of this tool posted this as a SHOW HN, then yes, you'd have a point. But that's not what happened here.

<comment><USER23> Actually I am a developer and this is useful to my work so it is targeted exactly at someone like me. It would still help to have a description without going to github.

Just some /constructive/ feedback...

<comment><USER24> Sure, it would help, in that it would have saved you a single click.

If you had submitted the link to HN with a descriptive title, then there wouldn't have been any confusion here either. So you're complaining about the site not saying what it does (even though it says so right in the README) while at the same time submitting the link to HN with a title that doesn't say what the link is about.

As some /constructive/ feedback, do you appreciate the irony?

<comment><USER23> I didn't submit the link

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> Somewhat related: [https://www.howsmyssl.com/](https://www.howsmyssl.com/)

</comment><comment><USER26> Last week I made a comparison matrix against Badssl.com for different Crypto libs on OS X: [https://gist.github.com/kissgyorgy/54601c883891991f28e49ac1b...](https://gist.github.com/kissgyorgy/54601c883891991f28e49ac1be572be2)

</comment><comment><USER27> this must be really useful when developing your own browser

<comment><USER28> For me main use case is to test browsers our employees use and to educate users on examples. Previously I've been using ssl quality labs test history to find some bad ssl examples, but this is much more convenient.

</comment></comment><comment><USER29> Chrome on iOS fails revoked and pinning tests.

<comment><USER30> It's probably not helpful to think of this as "passing" vs "failing" but as a way to examine the behaviour so you understand it and aren't blind-sided. It's secondarily useful for demonstrating a particular behaviour in software (e.g. "Actually Chrome doesn't verify CRLs or OCSP") without needing to cook up your own tests or stumble onto a suitable site for testing each time.

The Chrome developers have an extended defence of why their browser behaves as it does for revocation, which is pretty interesting, and the long-term plan is OCSP-stapling, which fixes things, but understanding the badssl.com features as "pass" vs "fail" rewards the simplest possible check-the-boxes approach and that's unfortunate.

[https://www.imperialviolet.org/2014/04/29/revocationagain.ht...](https://www.imperialviolet.org/2014/04/29/revocationagain.html)

</comment></comment><comment><USER31> Regularly used to test client configurations and also as a training aid when teaching users about web security.

</comment><comment><USER32> No-subject is surprising to me. Why would Chrome allow that? Doesn't that open it up for MITM?

<comment><USER33> The certificate at no-subject.badssl.com has an empty subject field, but it still contains the subject domain name in the Subject Alternative Names (SAN) extension.

Using the original X.509 subject field for the domain name has been deprecated for some time, and modern TLS clients look at the SAN extension instead.

<comment><USER30> In particular, the usual algorithm is this:

1\. Does this certificate have at least one SAN dnsName or SAN ipAddress? If so, go to step 3.

2\. Look at the certificate Subject for a Common Name, is this definitely a valid Fully Qualified Domain Name or an IP address written out as ASCII text? If so, pretend we found exactly one SAN, with this dnsName or ipAddress in it, otherwise abort, invalid certificate.

3\. Check that one of the SANs we found matches the server we expected to talk to, for URLs in a browser this means exactly matching the name in the URL so e.g. even if www.example.com has address 10.11.12.13, a certificate for 10.11.12.13 is no good for URLs starting [https://www.example.com/](https://www.example.com/)

Getting rid of step 2 is a desired end state for popular web browsers, because that step is complicated, and complication increases the chance of making a mistake. Mozilla has signalled they intend to abolish step 2 for public trusted CAs (not any CAs added by the user) and Chrome has talked about the same. The public CAs have been required for many years to include a SAN, but the usual incompetence and inertia interferes in enforcing this. People who bought a "perfectly good" certificate which is missing SANs will invariably blame their web browser, not the certificate vendor who sold them a defective product.

Common Names are notionally limited to 64 characters in length, most FQDNs are shorter, but definitely not all of them, especially in some countries where long-winded names for things have a strong history like Germany. So this is another reason to stop trying to squeeze FQDNs into the Subject's Common Name.

Common Names remain useful for naming certificates that aren't for a TLS service, such as CA certificates themselves, or indeed personal client certificates, just not really for web sites.

</comment></comment></comment><comment><USER34> The fun thing is that the old SHA1 roots pulled from browsers also happens to be the SGC roots.

</comment><comment><USER16> Just noticed that this is an unofficial google product, part of chromium github repository.

</comment><comment><USER35> Shouldn't spoofed favicon link to http instead of https?</comment>


Ask HN: What the future lies for Vim? - <AUTHOR>

I've been using Vim for more than 10 years as my primary text editor and for everything I do.
We all know Vim development is slow and conservative to changes, there is Neovim for more progressive development.
So at this rate of vim development, what do you think the future of vim looks like?
There have been many converts to Neovim already; my question is, is the future of Vim good in your eyes? Would the community end up splitting? How is this going to affect Vim and plugin development?
Are you switching to Neovim or have you switched already?
Do you think Vim can still benefit from Neovim and refactor/fix some of its code? <comment><USER2> I don't have any complaints about vim as-is. It does everything I need.

If I'm given good reason to move, though, I don't have any loyalty to the original project. I'm here for the text manipulation, which I'm guessing is not changing, and the ubiquitous nature of vim. And that it is CLI so it can be run through tmux.

I haven't looked at many comparisons but I don't have much reason to switch yet.</comment>