Chris Lattner on Swift and dynamic dispatch - <AUTHOR> https://lists.swift.org/pipermail/swift-evolution/Week-of-Mon-20151207/001948.html <comment><USER3> The part of this (really excellent) writeup that caught my attention was this:

 _someone writing a bootloader or firmware can stick to using Swift structs and have a simple guarantee of no dynamic overhead or runtime dependence_

There seems to be a pretty strong implication here that Swift could be used to write firmware/bootloaders, and other low level constructs - <USER2> operating systems. Has anyone worked with Swift yet on that type of project?

<comment><USER4> Except for the minor part that it's not true.

The performance variations in Swift are (as of now) much larger and less predictable than the overhead of dynamic messaging in Objective-C, and the latter can always be removed by using IMP-caching or converting to a C function.

<comment><USER5> The claim is not about Swift in general, but of a limited subset of the language: _" someone writing a boot loader or firmware can stick to using Swift structs and have a simple guarantee of no dynamic overhead or runtime dependence"_

Based on what I know about Swift (reading Apple's manual, a tiny bit of experimenting, and decent knowledge about how compilers work), I would expect Swift to compile purely statically, like C, for this case. Performance may still be lower because the compiler is newer, but I wouldn't expect performance variations.

And of course, the standard library may not be optimal for this use case. The implementation of strings, for example, may be too dynamic for embedded work.

<comment><USER4> My measurements were also with a limited subsets: integers, floats and arrays.

Depending on compiler optimization settings, you get from 30% to 1000x (yes, 3 orders of magnitude!) slower than C. Yes, technically that's not "dynamic" overhead, but from where I stand that's still orders of magnitude more variability and unpredictability (for reasonable values of "predictability") than even byte-coded Smalltalk.

<comment><USER6> If you're using arrays, you've departed from the limited subset in question. They're structs on the outside but complicated on the inside.

<comment><USER7> I wonder why the designers of Swift decided to make arrays structs on the outside but complex on the inside. Why not make them objects, i.e. reference types, as in Java and .NET?

<comment><USER6> Because having collections be value types makes them _really_ nice to work with.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> People interested in Swift at this level should also read Lattner's comment on /r/rust about the possibility of extending Swift to include Rust's statically checked ownership and borrowing concepts:

[https://www.reddit.com/r/rust/comments/3vadg8/swift_is_open_...](https://www.reddit.com/r/rust/comments/3vadg8/swift_is_open_source/cxnu2kk)

<comment><USER9> If you read that though, it is not something that's a high priority for the team. Basically, 90% of devs won't need or want some of these features. Unless Apple decides to have a focused effort around recoding the core of OS X into Swift which would require these changes, it's hard to see when the language would gain these options.

Don't get me wrong, Swift is an awesome language, but I see Rust as maintaining a position as a systems language equivalent to C. Where Swift will possibly start supplanting Java/Go/C++/Python use cases.

<comment><USER10> As someone that would like to see C replaced by something better and has always been a fan for Wirth influenced languages, Swift has actually a better position to achieve that than Rust.

The reason being that Apple, like it happened to OS vendors that adopted C and later C++, can allow themselves to push the language into the developers regardless of what they think they should use.

All the systems languages that have survived in the mainstream, have done so by being adopted by an OS vendor.

<comment><USER11> Out of interest, in what way do you consider Swift a Wirth-influenced language?

Go seems a closer cousin to Wirth's languages. Its strict type coercion, value copying semantics, package system, lack of OO, use of ":=", type declarations with "type", "var", GC, colons, etc. are all reminiscent of Wirth's languages, especially Oberon. (Robert Griesemer worked with Oberon under Wirth at ETH Zürick, so there's a clear relationship.)

Another highly wirthian language is Nim, though its influence comes via Delphi/ObjectPascal.

<comment><USER10> > Out of interest, in what way do you consider Swift a Wirth-influenced > language?

In the context that system programming languages shouldn't sacrifice safety, except when needed and be explicit about it with constructs like unsafe/SYSTEM and so on.

Swift is very explicit when doing C style tricks, e.g. UnsafePointer<>.

There is more to Wirth school of languages than just syntax.

<comment><USER11> The only "safe" Wirth language I know about is Oberon-2, which has bounds- checking of arrays, sentinels and runtime-checking of pointers — though no compile-time checking. Is this what you're referring to?

I like Wirth, but his type systems were always super simple, and as far as I know, he never innovated at compile time safety in the way that, say, Rust or Haskell do. Again, Go seems a better analogue; anything that needs to deal with unsafe pointers needs to use the "unsafe" package.

<comment><USER10> Not sure what you mean with runtime-compile time checking of pointers.

Wirth type systems weren't always super simple, not when compared with C style ones.

Wirth has designed Pascal, Modula-2, Oberon, Oberon-2, Active Oberon and Oberon-07

He has contributed to Extended Pascal, Object Pascal, Component Pascal.

Also worked on Algol compilers and some of its dialects, Mesa and Cedar while at Xerox PARC.

His work had an influence in Ada, Modula-2+ and Modula-3.

Some of the type safe things that Modula-2 in 1978 already offered, that C still doesn't do today:

\- Type safe enumerations

\- Bounded checked arrays

\- Arrays indexed by enumerations

\- Type safe sets

\- Range typed integers

\- No implicit conversions

\- reference parameters instead of pointers for function/procedure calls

\- tagged records

\- low level coding/assembly intrisics require use of the SYSTEM package

The only thing lacking was automatic memory management, which we later introduced in the Oberon family.

However as you can see from the list there are a whole class of errors that aren't possible.

If you like to research old stuff, have a look at B5000 system, which used Algol as their system programming language in 1961.

Common to his languages and Xerox PARC ones, was the idea that you can do systems programming in higher level languages, provided the language provided some unsafe path that needs to be explicitly mentioned.

But type safety should precede "performance at any cost" mantra.

Something also mentioned by Hoare on his ACM Award speech in relation to Algol in 1980.

"A consequence of this principle is that every occurrence of every subscript of every subscripted variable was on every occasion checked at run time against both the upper and the lower declared bounds of the array. Many years later we asked our customers whether they wished us to provide an option to switch off these checks in the interest of efficiency on production runs. Unanimously, they urged us not to - they already knew how frequently subscript errors occur on production runs where failure to detect them could be disastrous. I note with fear and horror that even in 1980, language designers and users have not learned this lesson. In any respectable branch of engineering, failure to observe such elementary precautions would have long been against the law. "

The problem is that younger devs never learned any of this and probably the only thing they know about Wirth languages is some braindead Pascal compiler.

<comment><USER11> Oberon-2 had runtime-checking of pointers: It could check the validity of a pointer and immediately panic rather than return garbage or crash with a page fault. Similarly with arrays.

Wirth did some nice things with type safety, of course (I've always liked his type-safe set/range types), but he never was much into type _systems_. For example, his set and range types were hardwired into the language; you couldn't build a set-like type yourself, or build something that acted as a range, or overload any of the standard function such as inc() or min(), or indeed any type coercion. With the exception of Oberon-2's (limited and highly Go-like) notion of abstract classes, nothing was polymorphic, every type was only "itself" and their purpose was always entirely about holding data. This is what I mean by his type systems always being "simple". He was attacking practical engineering problems, not type-theory problems.

Go is exactly the same. Swift isn't; it has generics and sum types and protocols and OO and pattern matching and lambdas and a bunch of other stuff that Wirth would probably find too complex (his last few languages tended towards mercilessly removing features).

I don't disagree that Wirth's languages are more advanced than C, though!

<comment><USER10> > Oberon-2 had runtime-checking of pointers: It could check the validity of a > pointer and immediately panic rather than return garbage or crash with a > page fault. Similarly with arrays.

Ah, but this was a property of any sane systems programming language with automatic memory management.

> With the exception of Oberon-2's ....

How well do you know Active Oberon, Zonnon and Component Pascal?

They extend Oberon(-2) with abstract classes, generics, tasks (active objects), type extensions, method definition signatures.

Also many consider his work as influence in Ada and Modula-2 successors, whose type systems are not very far from C++ ones.

Incidentally he became disillusioned with these language variants and went with a minimalist view (Oberon-07) that makes even Go look like a complex type system.

<comment><USER11> Sure, Active Oberon is pretty advanced, and Modula-3 had all sorts of things, including generics — but to my knowledge Wirth was not directly in those languages (or with Zonnon or Component Pascal), and he was unhappy with their complexity. (He apparently prefers the entire language's grammar to fit on a single screen.)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> I feel like Swift reduces the runtime availability of dynamic dispatch by default... so for things like live programming or runtime hacking Swift is worse than Obj-C.

I envision a future similar to the "Smalltalk dream" where one can build apps live, with minimal recompilation and where dynamic dispatch should be the default. I think this scenario is less ideal for "systems programming" but for areas when one is snapping together UI components and data sources I think it's ideal. Perhaps someone here can come up with good counter examples why this isn't the case?

Finally, I think static dispatch, as is favored by Swift, tends to paint one into a corner down the road... but it's possible Swift has enough leeway so that this isn't the case?

<comment><USER13> Snapping together UI components and data sources has existed for a long time, but it always seems to fail to be popular outside of niche uses. That's often due to the overhead of runtimes and the unsuitability of generic UI components when you get into the nitty gritty of the application being designed. Of course, that doesn't mean it can't be done, just an observation that the attempts I've seen over the past 20 years or so haven't been very good, ultimately.

I've often been curious why programming by manipulating metaphors on screen is seen as an ultimate goal in the evolution of programming languages. It seems a bit like creating a book by sticking pre-generated paragraphs together.

On your final point - static dispatch doesn't prevent you from making your own dynamic dispatch mechanism in the language.

<comment><USER14> > It seems a bit like creating a book by sticking pre-generated paragraphs > together.

But books are not tools or machines, whereas software applications are (not counting art & entertainment, generally.)

Nobody creates every screw and electrical component from scratch when designing and assembling other tools and machines.

"Programming by manipulating metaphors on screen" would be more akin to using predefined mathematical symbols and formulas, and just putting in the numbers and variables related to the problem you want to solve or the task you want to perform.

Even most popular genres of games could be made entirely from wiring up predesigned components together in a visual environment, without writing any code at all. You would just supply your own graphics and sound and other content.

<comment><USER15> I think your vision of these tools is far more sophisticated and capable than the current reality. It's certainly been an industry dream to produce tools that work at the high level you've described, but they have very limited domains and thus far, less than impressive results.

</comment></comment></comment></comment><comment><USER16> I'm definitely a novice programmer but that entire post is a foreign language to me.

On what level do these concepts impact me? Performance? Managing large code base? Easy, hard, impossible to do something?

<comment><USER17> Chris Lattner is a compiler author (LLVM/Clang, Swift), so this post is most definitely talking about compiler semantics that is pretty low level stuff that isn't really visible to the end-user (the programmer of the language), except for in C++.

When a compiler is compiling a program, and you make a function call (lets say `int x = obj.compute()`), the compiler has to know where the code for that function is. In C (and C++ to an extent), this is easy, functions aren't very fancy and compiler can just go to that place in memory which doesn't change during runtime. These types of functions are called "static functions" and the compilers method of calling these functions is called "single dispatch". Since the code that runs is very predictable, its easy for the compiler to optimize the function call.

In other languages (like Ruby, Java, Swift), a statement like `int x = obj.compute()` has multiple meanings if `obj` can be subclassed. For example, if you have an inheritance structure like (Dog, Cat) > Mammal > Animal, `obj.compute` could mean the compute function on Animal, Mammal, Dog or Cat. At compile time, the compiler may have no idea of knowing which definition of `compute()` to call. So during runtime, it will analyze the type information and call the correct function. These are called "virtual functions" and they are called with a "dynamic dispatch". Because there are multiple functions that could run, actually predicting what will run on the machine is hard.

Dynamic Dispatch function calls are generally slower than static ones, and a compiler would prefer static calls. Chris goes over the many different methods languages attempt to make dynamic calls faster - and Swift, thanks to its simple programming model, (AFAIK) gets "smart" about function calls and can make single dispatch calls when needed (Java can do this to, but what makes Swift "cool" is that it doesn't need a Just In-time Compiler (JIT) to do so).

What all this means to you (the end user) is that you can use all these fancy functions in Swift without having to worry about performance. The overhead of a function call may be something you have never considered (I certainly don't think about it), but I'm sure its something compiler geeks obsess over.

I may be 100% wrong here, I'm not a compiler author, can only make a guess from C/C++ experience, and I've never used Swift before.

<comment><USER18> Thank you for the explanation!

</comment></comment></comment><comment><USER19> How does the presence of C++'s placement new() affect devirtualization opportunities? I'm sure Chris knows what he's talking about, so I'd like to hear more.

<comment><USER20> I was going to write a response but bdash over on reddit did a great job, so I'll just link that: [https://www.reddit.com/r/programming/comments/3wla9f/chris_l...](https://www.reddit.com/r/programming/comments/3wla9f/chris_lattner_author_of_the_swift_programming/cxx7k0m)

One interesting note is that, the last time I looked into this, the compiler _is_ allowed to assume that multiple sequential vtable calls do not replace the vtable, allowing the vtable lookup to be cached. But that is not true for some arbitrary external-to-the-compilation-unit function that.

<comment><USER21> In practice neither GCC nor Clang seem to be willing to believe that the vtable is immutable. See [https://goo.gl/y0cx1r](https://goo.gl/y0cx1r), for example, which shows only the first of two calls being devirtualized. The call to fprintf within B::work is sufficient to cause to both compilers to reload the vtable pointer, preventing devirtualization of the second call.

Interestingly enough, when a use of placement new is visible to the compiler it can prevent the conservative behavior mentioned above. In [https://goo.gl/Y8rwYG](https://goo.gl/Y8rwYG) the vtable store that placement new conceptually generates allows Clang to devirtualize the second virtual call. GCC doesn't appear to catch this case.

<comment><USER20> Thanks for digging in! I saw the same thing with clang last year, in the context of Emscripten, where we were hoping to eliminate the redundant vtable loads as a JS code size optimization.

</comment></comment></comment></comment><comment><USER22> Can someone elaborate on what methods JIT uses to boost perfomance as compared with AOT compilation? Do modern JIT compilers use statistics about what code actually got called to optimize call dispatch? Where can I find more info about this topic?

<comment><USER23> JITs do know the call target. This is a quote from "A JVM does that?"[0]:

      C++ avoids virtual calls – because they are slow
      ● Java embraces them – and makes them fast
      ● Well, mostly fast – JIT's do Class Hierarchy Analysis
      ● CHA turns most virtual calls into static calls
      ● JVM detects new classes loaded, adjusts CHA
      – May need to re-JIT
      ● When CHA fails to make the call static, inline caches
      ● When IC's fail, virtual calls are back to being slow

\----

There are several misconception about Java in the write-up. The real reason there won't be a bootloader is the need for the Java runtime and the need to GC. Unoptimized virtual calls won't affect any bootloader for that matter (and you can/should use static and/or private methods for the inner loops)

[0]:[https://www.youtube.com/watch?v=uL2D3qzHtqY](https://www.youtube.com/watch?v=uL2D3qzHtqY)

<comment><USER24> He doesn't say you won't see a Java bootloader because of unoptimized virtual calls, he says it's because the runtime is too big. CL: _It also means that Java doesn't "scale down" well to small embedded systems that can't support a JIT, like a bootloader._

<comment><USER23> _OTOH, since the compilation model assumes a JIT, this means that purely "AOT" static compilers (which have no profile information, no knowledge of class loaders, etc) necessarily produce inferior code. It also means that Java doesn't "scale down" well to small embedded systems that can't support a JIT, like a bootloader._

This the quote. He talks about the JIT only, no runtime mentioned.

<comment><USER24> He might somewhat tersely be conflating JIT and 'runtime'as whole - see the mention of classloaders but his meaning is clear, it's about size rather than performance. 'It also means' etc.

<comment><USER25> > it's about size rather than performance.

The tradeoff really: what he's saying is that you can JIT java to get speed but you'll lose size (resident), or you can AOT compile java to improve size but then you lose speed because calls may not be possible to devirtualize (unless you have PGO maybe? You'd lose some speed and size to guards and duplicated dispatch though)

<comment><USER24> You can't really AOT compile java and have it be java and it seems fairly obvious to me he's talking about size and runtime-related things, in which he throws in a JIT (i.e. the compilation model 'assumes' a JIT). I think he's just being slightly loose with his terminology because he's just replying on a mailing list without expectation that random nerds on an internet forum will be talumidcally dissecting his semiotic intent.

<comment><USER25> > You can't really AOT compile java and have it be java

Of course you can.

> and it seems fairly obvious to me he's talking about size and runtime- > related things

I'm not sure why you're so intent in reinterpreting his rather plain words (and insulting people when they don't agree with your broad reinterpretation).

Lattner is literally just noting that an AOT-compiled java program has no knowledge of java's dynamic semantics (classloader &al), so it can't devirtualize calls and must necessarily pay the dynamic dispatch cost, in the same way e.g. messages in objective-c can't be devirtualized. In essence, an AOT java is slightly better than a straight interpreter but not by much.

The _whole essay_ is about static versus dynamic dispatch and how languages provide for those, it's not exactly a stretch to assume that when Lattner talks about _inferior code_ that's what he's talking about: bootloader = no JIT = pervasive dynamic dispatch = slow, you don't have to bring your own pet issues into that.

<comment><USER26> Not nearly as bad as an interpreter, especially if you do whole program optimization. In fact, Android switched from the Dalvik JIT to ART, which compiles AOT-ish.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER27> Does this really buy you that much? For most programs the runtime is going to be dominated by loop execution. If you're in a situation where the all the objects have the same type and the compiler could switch in static dispatch the computer's branch predictor should catch on very quickly and the performance gains won't be that high. In cases where you have heterogeneous objects the branch predictor won't be able to catch on but the compiler will be forced to stick with static dispatch anyways.

I suppose there is a bigger gain where you can inline static functions or optimize the calling convention.

<comment><USER28> Inlining is often called the mother of all optimizations. On its own, it doesn't gain you much compared to any other optimization, but once it's done it enables much, much more.

There's a reason languages like C that default to static dispatch on value types are so much faster without much effort.

</comment></comment><comment><USER29> Good writeup. What is a checked downcast?

<comment><USER19> In this context, it's a runtime check inserted by the compiler to be sure that an object retrieved via a generic interface matches the more specific type the caller expects.</comment></comment>


Company makes cheaper solar wafers, wins $150M loan from DOE - <AUTHOR> http://bostinnovation.com/2011/06/20/mass-solar-co-wins-150m-loan-from-dept-of-energy/

<comment><USER2> Here and Now (NPR) just did a story on how the military is using solar power, right now, to provide electricity for remote bases and soldiers on the field. The military's adoption of solar power is providing the scale that solar companies need to improve manufacturing needs and drive additional R&D.

The initial motivation is that it reduces the stress on their energy (read: oil) supply chain, but they've found that adopting solar is also cutting down on the number of batteries each soldier has to carry to power the gadgets that have become part of modern warfare.

<http://hereandnow.wbur.org/2011/06/06/military-solar-power> (the meat of the story is actually in the audio, the text is just a brief summary)

</comment><comment><USER3> I want to root for companies like this in the way that other people like to root for sports teams.

</comment><comment><USER4> Now, I just hope that they too won't move their production base to China after taking the DOE grant like Evergreen Solar had done after taking the $43million grant from MA. Link: [http://www.nytimes.com/2011/01/15/business/energy- environmen...](http://www.nytimes.com/2011/01/15/business/energy- environment/15solar.html)

<comment><USER5> Bit of a flame bate comment.

China's gov wanted to be #1 in solar and their factories were undercutting Evergreen solar so it was either move the factory or go bankrupt. My uncle worked at the factory and while he doesn't like it (he lost his job) he agrees with the reasons.

</comment></comment><comment><USER6> I for one, am in favor of the DOE accelerating innovative companies in breakout industries.

<comment><USER7> If they are truly breakout industries, do they need taxpayers' money? If they are promising, where are the VCs?</comment></comment>


"The Dream of Internet Freedom Is Dying" - chris-at http://techcrunch.com/2015/08/05/the-dream-of-internet-freedom-is-dying/?ncid=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29 <comment><USER2> I would add that the "Secret law" also encompasses the private deals struck between various organizations that have the full force and effect of law.

For instance, I am often asked about the standards for DMCA takedowns and monitoring of content. I cannot turn to laws and cases. I have to glean information from patterns of activity. Youtube does X, and the MPAA aren't screaming mad about Youtube these days, so perhaps we also need to do X. Or, megaupload was doing X Y and Z. But a dozen other website were doing X and Y without a peep from US authorities. So I guess Z is the touchstone even though Z isn't mentioned anywhere in any law or case and wasn't even around when the laws were written.

<comment><USER3> Youtube spent several years fighting a lawsuit against Viacom until they settled last year. If whoever you're giving advice to doesn't have Google's cash to defend themselves, don't tell them to copy Youtube's actions.

<comment><USER2> My advice goes one step further: Don't do user generated content without an ejection plan, a means to extract all the money and shut the doors instantly should you catch the eye of the mpaa or their ilk.

</comment></comment></comment><comment><USER4> The dream could come back. In my opinion.

Defeating legal threats:

\- Design server architecture so can be migrated from one country to a different one without censorship. Now is easy, with VPSs, you can move infrastructure in few hours, if you do automated deployment.

Defeating cost threats ("run your own software like a 'megacorp' "):

\- Services running on cheap hardware handling 10-100x more users per server than current high language implementations (back to CGIs/Fast-CGIs on native code, instead of PHP/.NET/Java/NodeJS/Python/Perl).

\- Filesystem-less storage (start server, load filesystem to optimized in- process RAM DB), so following steps can be avoided: disk cache, filesystem tree search, multiple memory copies, etc.

\- Separate persistent and non-persistent data, so most operations don't need to hit the disk.

\- Abstraction over those low-level systems so people with high-level capacitation can build a massive-scale web application.

<comment><USER5> Attempting sorely technical fixes to political problems is a delaying tactic, nothing more.

Imagine a law like this: "You must be able to positively identify any person creating content on a service you control".

 _Nothing_ you have suggested does anything at all to address that in anyway other than to try to make it harder to enforce. That method has been tried for 20 years, and is quickly becoming harder and harder.

It's already extremely hard to buy a VPS with even pseudo-anonymity - <AUTHOR> require credit cards, which means a law enforcement agency can retrieve your details trivially.

<comment><USER6> i know of two iclandic outfits that accept bitcoin and anonymous registration. Nobody can trace my VPS to me.

<comment><USER5> If you think Bitcoin keeps you anonymous in an age of ubiquitous network monitoring and growing work on Blockchain analysis then you have missed the point completely.

<comment><USER6> someone's never heard of a bitcoin laundry and mail2tor.

<comment><USER5> Don't you see? This is _exactly_ the point I'm making.

I agree 100% that there will continue to be ways for _extremely_ careful people to do this kind of thing. But the counter-measures and counter-counter- measures continue to ratchet up and at each step it more and more people are left behind.

That's why I said _Attempting sorely technical fixes to political problems is a delaying tactic, nothing more._

<comment><USER6> somebody's never heard that security is a moving target.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Publishing has been decentralized by the web.

Communication has been decentralized by email.

Money and contracts has been decentralized with bitcoin.

Social hasn't yet been effectively decentralized, but it will be.

Decentralized is better when it comes to individual choice, curbing abuse of power, and resilience (no single points of failure).

But it's way worse when it comes to security. And no one's been able to decentralize security effectively yet, because a single top-down entity with an economy of scale has more resources to secure itself than expecting EVERY little host and their dog to upgrade to the latest version of Wordpress.

<comment><USER8> Social has been decentralized. I socialize with friends across a dozen digital platforms now.

Email, phone calls, SMS, WhatsApp/Viber/Kik/Snapchat, Facebook, Skype, Twitter. Then throw in a dozen other communities, ranging from Hacker News, to Stack Overflow, to Reddit or Imgur, and so on.

Social has been substantially decentralized. The only way it can be argued that it hasn't, is if you consider any corporate ownership of a platform to be by default non-decentralization (as opposed to having numerous available platforms being the decentralizing aspect).

<comment><USER9> Email - logged and retained by service provider.

Phone calls - tappable, metadata logged and retained by service provider.

SMS - logged and retained by service provider.

Skype - activity logged and retained by service provider.

Twitter - activity logged and retained by service provider.

You were saying something about decentralization?

<comment><USER10> It's not all that easy or cheap to decentralize the last mile. Things were not any more decentralized when most people used dialup, and they were definitely more centralized when the main users of the internet were on a few campuses.

<comment><USER9> Absolutely true. Getting a phone tap and the equipment required to monitor an active modem connection was sufficiently onerous for local and federal law enforcement that it was reserved for active investigations of high value targets. Hell, they couldn't even be arsed to track Mitnick down when he was on the Most Wanted list, it took a phone company tech and a pissed off security analyst from California to finally bring him down.

</comment></comment></comment></comment></comment><comment><USER11> I don't have the energy nor the motivation, but I would really love to make a p2p internet which could be as easy to use as bittorrent.

Of course security is a problem, but I'm sure that making things public by default would make it easier, and security is not always mandatory, you can always use something which isnt entirely secure and use it well within its limits.

<comment><USER12> [http://ipfs.io/](http://ipfs.io/)

</comment></comment><comment><USER13> Wu users need to also accept responsibility. We handed over control to "Facebook, Twitter, GMail, Amazon, etc" as part of our Faustian bargain to get everything for free and put advertisers in the drivers seat. The invisible hand works for the customers, not the products.

<comment><USER14> Dvorak keyboard?

</comment></comment><comment><USER15> I think it's a side effect of the eternal September. There was a time in my life when I had to convince people that email was important. Now, it's old news and even the slowest adopters have seen the light provided by the internet.

One day, someone will invent something cooler than the internet, and no one but the super technically minded will use it, and it will be a new spring. But September will still be a few months away.

</comment><comment><USER16> It's ironic to read about Granick advocating a free, open and decentralised Internet the same day we've been discussing how we're heading Straight for AOL 2.0: [https://news.ycombinator.com/item?id=10008769](https://news.ycombinator.com/item?id=10008769)

The writing's on the wall.

<comment><USER17> The writing has been there for a while but many are too distracted to stop and read.

</comment></comment><comment><USER18> Apparently the Black Hat audience is very conservative and pro-government. And likes Keith Alexander.

I guess the author has been attending a different conference than me.

<comment><USER2> Perhaps attendees there as spies now outnumber actual enthusiasts. Perhaps they can now spy on each other and leave the rest of us alone.

</comment></comment><comment><USER19> I've just had a simple idea while thinking about the conflict between privacy, freedom, law and democracy and its effect on the Internet. How about designing a new set of protocols that would be using the highest degree of available cryptography and obfuscation, minimizing leaking of traceable information, but having a democratic voting mechanism in its core (Paxos-style?) for "de- privacing" sources of information/traffic shall the majority of users decide (in cases clearly violating laws in grave matters etc.)? Direct democracy- style. How much of a pipe-dream would that be? What would be deficiencies of this approach and how could they be addressed? Is this even technically doable in a de-centralized fashion? Would apathy or malice of general population be the main risk?

The motivation is that nobody would like to have all their private matters out in the open (which is a fact nowadays), but we need an efficient way to enforce reasonable laws (like preventing child abuse, selling hard drugs, illegal arms etc).

<comment><USER20> > but we need an efficient way to enforce reasonable laws (like preventing > child abuse, selling hard drugs, illegal arms etc).

We have that. All those crimes take place in meatspace. Which is where the police exist, too. Tell the police to do their jobs and detect actual crime, not thought-crime.

</comment></comment><comment><USER21> We've been helping to kill that dream when we pushed for net neutrality. We played right into it. Getting to the circus on time (i.e. watching king of thrones after torrenting it) was so important we had to hand over the Internet to the FCC.

We no longer route around the damage. We intend damage.

</comment><comment><USER22> Has anybody found the speech?

<comment><USER23> Probably won't be out until whenever they decide to release this years talks on YouTube.</comment></comment>


A question about Amazon EC2/EBS Billing - <AUTHOR>

Hey guys,
Quick question.
The EC2 pricing page says that Elastic block store is $0.10 per GB-month of provisioned storage. But I'm wondering what happens if I only use it for a few days? How would I be billed for that?
As I understand it, every instance I launch will have an EBS to hold the OS, etc?  So I'm wondering how much it will cost for each instance I launch?  It seems expensive it they round up to am month of storage charges for just an hour's usage. <comment><AUTHOR> Ok, it is hourly. At least according to this: [http://serverfault.com/questions/197379/amazon-ebs- charges-c...](http://serverfault.com/questions/197379/amazon-ebs-charges- calculation)

Sorry for the bother.</comment>


How enterprises use functional languages, and why they don't [pdf] - <AUTHOR> http://homepages.inf.ed.ac.uk/wadler/papers/how-and-why/how-and-why.pdf

<comment><USER2> The author of the linked paper, Philip Wadler, is just phenomenal.

[http://homepages.inf.ed.ac.uk/wadler/](http://homepages.inf.ed.ac.uk/wadler/)

> _" I was a principal designer of Haskell. With Simon Marlow, I developed a > type tool for Erlang. I am a founding member of IFIP WG 2.8 Functional > Programming, and served as editor-in-chief of the Journal of Functional > Programming."_</comment>


What "The Tipping Point" Missed About the Spread of Ideas - <AUTHOR> http://nautil.us/blog/what-the-tipping-point-missed-about-the-spread-of-ideas

<comment><USER2> As to virality - I like Henry Jenkins ideas. After I googled it now I found that he wrote a book on that subject ([http://nyupress.org/books/9780814743508/](http://nyupress.org/books/9780814743508/) )- but I had just read this on his blog.</comment>


Vista Equity to Buy Tibco Software for $4.3B - <AUTHOR> http://www.reuters.com/article/2014/09/29/us-tibco-software-m-a-vistaequity-idUSKCN0HO11Y20140929 <comment><USER2> To employees of Tibco - as with any private equity buyout, Vista's goal is to shed the weight, reduce expenses, and streamline the company and then sell it for a higher price later. What that means for you is that your company will most likely be moved to Texas, as is what happened when Vista bought my last company this year. They will also slowly lay off workers every few months, and morale will most likely drop. So get out those resumes.

<comment><USER3> >What that means for you is that your company will most likely be moved to Texas, as is what happened when Vista bought my last company this year.

I'm guessing you worked for ACTIVE Network or Omnitracs. From a PE standpoint it's a great move to cut costs. You can pay less in rent and really save money on salaries through the lower cost of living in Dallas and from many of the employees that will quit because they don't want to move.

Really unfortunate to work for these companies when they are bought and moved though, if you're lucky enough to not get laid off in the first place.

<comment><USER2> Yea after experiencing the buyout and watching it unfold over a year it got me more interested in how these deals work. One major question is - is the cost savings of hiring a worker in Texas with less experience at a 30% savings worth it if you're losing a few years of knowledge of internal workings and products? Very debatable and probably changes position by position, company by company. Also a buyout has a significant impact on general morale as everyone is now job hunting and wondering which week the layoff announcement is coming.

<comment><USER3> >One major question is - is the cost savings of hiring a worker in Texas with less experience at a 30% savings worth it if you're losing a few years of knowledge of internal workings and products?

Maybe not. But even though the new employee might not be as productive there is a very real increase in EBITDA from a decrease in expenses. Greater EBITDA leads to greater valuation. Then all you have to do is show consistent mid single digit percentage revenue growth a few years in a row and convince the public markets/equity analysts the whole thing won't fall apart anytime soon and you can cash out in an IPO.

For most PE firms it seems that it's really about hacking the financials. If comparable firms are selling at 15 times EBITDA, and your EBITDA grows from $200M to $250M over several years due to reorg savings and consistent revenue growth, you can rationalize that the company is worth $3.75B ($250M*15) now instead of $3B ($200M x 15).

Very interesting stuff. If anyone reading this works at a PE firm and is willing to let a finance geek pick their brain please give me a shout at my e-mail in my profile.

<comment><USER4> I'm not saying there are no inefficiently run companies in the world, but these PE buyouts all seem to follow the same plan.

Buy a company, pay yourself a fat fee. Force the company to borrow a ton of money and pay yourselves back. Start cutting costs. Some is fat, but much of it (like Mark Hurd slashing R&D at HP) is cutting R&D or sales in ways that don't hurt for long enough for the PE firm to cash out. It's a hell of a business model, particularly when it seems like these PE firms often financial engineer themselves into a position where they succeed financially whether the acquired company succeeds or fails.

It seems to often work out well for the PE firm, and much less well for the company, customers, and employees.

<comment><USER5> [http://www.newyorker.com/magazine/2012/01/30/private- inequit...](http://www.newyorker.com/magazine/2012/01/30/private-inequity)

 _" Having already piled companies high with debt in order to buy them, many private-equity funds had their companies borrow even more, and then used that money to pay themselves huge "special dividends."

..As if this weren't galling enough, taxpayers are left on the hook. Interest payments on all that debt are tax-deductible; when pensions are dumped, a federal agency called the Pension Benefit Guaranty Corporation picks up the tab; and the money that the dealmakers earn is taxed at a much lower rate than normal income would be, thanks to the so-called "carried interest" loophole."_

</comment></comment></comment></comment></comment></comment><comment><USER6> Looks like a great deal for Tibco'ers.</comment>


Intel Shows Ray Traced Wolfenstein on a Laptop - <AUTHOR> http://www.tomshardware.com/news/wolfenstein-ray-tracing-knights-ferry,11282.html

<comment><USER2> May be interesting, but the pictures don't look very interesting to me. Perhaps because there's not enough detail?</comment>


Introducing Gab.ai: The People First Social Network - <AUTHOR> https://regated.com/2016/08/introducing-gab-ai-people-first-social-network/ <comment><USER2> This has the same problem that voat does: does their definition of free speech include stuff that they find distasteful, like terrorism or child love? I would wager that they'll find themselves quickly having to censor their network once people start showing up there and push the limits.

I'm reminded of the exodus of /r/fatpeoplehate from reddit to voat. If you build a network where people can be assholes, you'll have a hard time growing it beyond a small network of seed assholes.

<comment><USER3> Promotion of illegal activities, or content that is illegal in itself, is a reasonable line to draw.

<comment><USER4> Hate speech is illegal. Does that get removed too?

<comment><USER5> If it's illegal in the chosen jurisdiction(s), yes.

The question to this argument is particular is almost always "What constitutes hate speech?" Some people think it's literally anything that _could_ make someone feel bad (whether it does or not). Some people think unless you are actively advocating for murder or genocide it's not. Most reasonable people are in the middle, but most reasonable people also disagree on whether or not putting a picture of a fat person online and making fun of it meets the standard.

</comment></comment></comment></comment><comment><USER6> The solution to the problems of echo chambers and walled gardens is not to build another echo chamber or walled garden, but to build something that returns control to the user.

In this respect, decentralization is the key. A decentralized network cannot easily be censored, but people can choose not to view the content they don't want to see on a decentralized network.

Gab just seems to me to be another walled garden. If it's anywhere near as successful as other networks, it will encounter the same problems. If it's not, then it won't matter.

<comment><USER7> Yup. Whatever replaces twitter will be an open-source decentralized system that ends at the API layer with multiple competing client implementations. So, not Gab.

But I do like to see a bit of momentum in the tech world against neoliberalism, I think it's healthy for everyone. The "censor all competing ideologies" cultural authoritarian nonsense has gotten out of hand.

<comment><USER6> I do sometimes wonder how much of this is made worse by keeping competing views in walled gardens. If you look at Twitter historically they've not been great at censorship.

Consequently it's easy for views you may hold abhorrent to end up in your feed, along with the typical OTT reactionary crap resulting from it being a poor medium for nuanced conversation (ie the 140 character limit).

This leads to calls on the garden maintainer to censor content, which then gets out of hand, resulting in people being banned rather than content being taken out via say, downvoting.

Having an open, distributed and federated approach means that it's harder to block content, but it's also harder for content you don't like to end up in your feed, and easier for you to censor it, rather than relying on a central authority to perform that task for you.

</comment></comment></comment><comment><USER8> The only thing I've heard about this is that a bunch of white nationalists were talking about migrating here after being banned from Twitter for harassment. If that's what their community is like, I'd have zero interest.

<comment><USER8> ...but I did NOT know that their actual logo is a Pepe the Frog. Good grief.

</comment></comment><comment><USER9> For context, the founder of this site was in the news recently for being banned from YC:

[https://techcrunch.com/2016/11/12/pro-trump-ceo-gets- booted-...](https://techcrunch.com/2016/11/12/pro-trump-ceo-gets-booted-from- y-combinator/)

<comment><USER2> gab.ai's creator from the article:

> All of you: fuck off. Take your morally superior, elitist, virtue signaling > bullshit and shove it. I call it like I see it, and I helped meme a > President into office, cucks.

I have a hard time seeing how people like this can expect others to be tolerant of behaviour like this. You don't get a free pass to be a dick for "freedom of speech" issues. Even McDonald's has a basic "no shirt, no shoes, no service" decency policy.

<comment><USER10> Being a bully was never acceptable, not recently or before the era of political correctness. I don't envy their capability of moral distortion. For the white grande superior nationalists it seems as if it's a time where critiquing and calling them out for their bigotry and moral incoherence is willingly confused with attempts of censorship and proto-fascism. When he says "shove it", it's a bitter sign of relinquishment from someone who has nothing to lose because he has no arguments anymore to fight the system that doesn't seem to exclusively cater to him anymore.

</comment></comment></comment><comment><USER11> "Introducing social news aggregator based on cool tech that has instantly become alt-right shithole"

<comment><USER12> Is it based on "cool" tech? It's just Laravel and Vue.js...

</comment></comment><comment><USER13> This website is known for being associated with white supremacist groups (the so-called "alt-right").

<comment><USER14> I immediately logged off (forever) after just signing up and seeing the "news feed".

It's like r/The_Donlad on steroids.

</comment></comment><comment><USER15> You get the users you're willing to tolerate. If you advertise your site as an uncensored paradise, don't be surprised when it becomes overrun with assholes. Look no farther than Voat to see how poorly this will go.

That said, some of the fixes they are implementing would be nice to see in mainstream networks. More transparency about how the products and algorithms work would be wonderful, especially with regards to FB's News Feed and Twitter's Trending.

</comment><comment><USER16> ello 2.0

</comment><comment><USER17> Browsed for five minutes, saw 2 swastikas...

It's interesting how certain platforms sort of attract certain undesirable elements from people.

I wonder if there's correlations to features that platforms have to what sort of people end up using the platform?</comment>


Microsoft Malware Classification Challenge - <AUTHOR> http://www.kaggle.com/c/malware-classification/data

<comment><AUTHOR> roughly 400 GB of malware samples (after decompression, 190 GB testing samples, 185 GB training samples) available for participants to access (after registration)...

Take a look and have fun...</comment>


Water extraction on Mars for an expanding human colony - <AUTHOR> http://fermatslibrary.com/s/water-extraction-on-mars-for-an-expanding-human-colony <comment><USER2> Needs for net in-situ production, by section:

1) Drinking, hygiene, "everyday living": 0.07 kg/hr/person

2.1) Regolith processing: negligible.

2.2) Manufacturing: 0.04 kg/hr/person

2.3) Perchlorate remediation: negligible.

2.4) Plant growth: 0.003 kg/hr/person

2.5) Habitat maintenance: 0.01 kg/hr/person

Total: 0.123 kg/hr/person

=====

In-situ sources:

3) Atmospheric processing (MARRS): 0.02 kg/hr/person

4.1) Robotic extractor (MISWE): 0.2 kg/hr

4.1) Bore hole digging rover w/ microwave heating: 0.3 kg/hr

4.2) Hothouse: 2.08 kg/hr (implied from Table 3)

=====

Questions abound. Why are important quantities such as 2.2) and 3) estimated per person when their link to population size is very unclear? Why is the reserve in Fig. 1 an afterthought (sufficient for 6 months minimum consumption at best) when mission frequency is stated to be two years? Etc.

<comment><USER3> > Why are important quantities such as 2.2) and 3) estimated per person when > their link to population size is very unclear?

The answer for 2.2) seems to be that this water would be mostly related to concrete production for habitat construction/maintenance. More people means more construction/maintenance.

See: "Concrete production will most likely use the most water out of all the manufactured materials because that water isn't easily reclaimed. And, although there may be more need for manufactured products towards the early stages of the colony, the amount required will be normalized to the amount of people in the colony."

The explanation for 3) appears to be that this water is a byproduct of oxygen production, which occurs in proportion to oxygen consumption, which should be proportional to population size.

See: "This amount relates to the water that would be extracted from the atmosphere during the process of extracting the required oxygen for breathable air (Wieland, 1998)."

<comment><USER2> Yes, I've seen the explanations in the paper but it's still confusing.

2.2) New construction should depend on population _growth_ not population levels. In table 1, the population growth rate varies between 20% and 100% per mission, so it's hard to see the ratio (new construction)/population staying constant.

3) This assumes that a) all oxygen is produced from the atmosphere, none from the soil, plants etc. b) there will be no oxygen demand from manufacturing etc. Both assumptions seem quite tenuous.

</comment></comment></comment><comment><USER4> The .6 kg/hr/person figure for water is pretty generous - that works out to 3.8 gallons/day/person. As any burner could tell you, you only really need about 1 gallon of water per day for survival. Spending 2.8 gallons per day on hygiene is quite luxurious when you consider that you have to crack that water out of regolith. Taking a 1-gallon sponge bath once a week and drinking the rest would cut it to < .2 kg/hr/person - before reclamation!

<comment><USER5> That includes water used for growing food. I don't think they're being generous at all. You don't grow your own food at Burning Man. :P

<comment><USER4> Incorrect - the 0.6 number is purely for personal survival. They cite the number when including plant maintenance, regolith processing, etc, as 1.2. See the article:

> "The amount of water needed for extended human survival is around 0.6 > kg/hr/person which includes water for consumption, hygiene, and everyday > living in space (Bobe et al., 2007; Horneck et al., 2003, 2006). This > estimate is based on space station living and, assuming water consumption is > less in a micro-gravity environment, would increase up to 0.7 kg/hr/person > to account for living with gravity. The amount required if demands from a > growing colony (regolith processing, manufacturing, perchlorate remediation, > plant growth, habitat maintenance, etc.) are added to human needs is > estimated at 1.2 kg/hr/person."

</comment></comment></comment><comment><USER6> It boggles my mind, with the understanding and technology we have, that we have not leveraged our entire world economy to the single goal of establishing human colonies off world and sending generation ships to nearby stars.

It is the single most beneficial act to the survival likelihood of the human species that seems available to us.

<comment><USER7> It boggles my mind, with the understanding and technology we have, that we have not leveraged our entire world economy to the single goal of eradicating poverty of the world.

<comment><USER8> There goes the "but we have so many problems down here" argument again. Starting a Mars colony would require the efforts of a few thousand people and cost a few percent of world GDP. Eradicating poverty would require the cooperation of millions of people, many of whom would sooner murder each other, and more than half of world GDP. So not only are the two projects not mutually exclusive, a Mars colony is actually _much_ less difficult.

<comment><USER9> Depends on what the goal is.

If your Mars colony is just a PR^H^H national pride game - you've got a handful of people, some high-school kids' plant experiment and the Little Box with the Antenna some TLA agency asked you to leave behind - then sure, it would be no more expensive than the SDI, the Libyan war or any other stupid boondoggle we can apparently afford.

If you want an actual self-sufficient colony, you've got a much bigger project. I don't think we know what is actually required to create a self- sustaining technical culture in space, because we've only really done it by accident and not in space. But this: [http://www.antipope.org/charlie/blog- static/2010/07/insuffic...](http://www.antipope.org/charlie/blog- static/2010/07/insufficient-data.html) is as decent a hand-wavey starting point as any. And it is quite a bit more resource-intensive than a few kilopeople/few percent of organized human output.

<comment><USER8> The comparison to those stupid boondoggles doesn't really do the scale we're talking about justice. A few percent of gross world product is 4 trillion dollars per year. That's more expensive than the entire Second World War. That's enough money to fund NASA for two centuries. That's enough money to launch the mass of the empire state building into LEO _twice_ using current disposable rockets.

</comment></comment></comment></comment></comment><comment><USER10> I really don't get it! Could someone please explain this to me:

\- Why do humans today work so hard so that some other members of homo sapiens species can inhabit another planet? Those creatures, you, everyone you know and the entire species will be gone. Why bother to do that or anything at all? What is the end game?

\- Is the decision to care about humans going to Mars made by careful & rational consideration which resulted in conclusion that members of homo sapiens species should be on Mars and that there is an objective moral duty to do so? Why pick homo sapiens species instead of some other animal species? Is it objectively true that a bio-chemical process known as a homo sapiens has intrinsic value and that everyone should work to sustain it?

<comment><USER11> The human race is a race of explorers, and always has been. We will go to Mars because it is there.

And if you really feel that mankind is on the same level as every other animal on the planet, despite no other species having built skyscrapers, gone to the moon, or printed their language, then that's not even really a conversation worth having.

<comment><USER10> You are only saying that certain bio-chemical structures reshuffle atoms in a different way, which in most cases suits their survival. You're judging a fish by its ability to climb a tree. Also, you make it seem that there is an objective scale which measures 'levels' [of greatness, I assume]. But, there is no evidence that such a scale exists. You pick these arbitrary shuffling of molecules, like building skyscrapers or going to another rock[Mars], as great or progressive. That is the result of having an unjustified bias towards your own species. Many animals can do things humans can't do and vice versa. But, that is just a difference, not an objective superiority or inferiority.

<comment><USER8> Why do these discussions always end up turning into pseudo-philosophical nihilist pity parties?

We can define greatness however the fuck we want, because as far as we can tell we're the only self-replicating assemblage of molecules that knows or cares what greatness even means. So if, during whatever time we're not spending making more copies of ourselves, we decide we enjoy shuffling molecules into a particular arbitrary pattern, who the fuck is going to tell us that isn't greatness? When you ask why we should bother making copies of ourselves on a _different_ pile of dirt than the one we're currently on, you might as well be asking why we should go on making copies of ourselves at all. There is no endgame. There is only doing interesting shit, doing boring shit, and death. I choose interesting shit.

<comment><USER10> I don't even know why people then write papers, do research or discuss things when they could call someone dummy or label what they are talking about as 'pseudo-X'. What is 'pseudo-philosophical' about the questions asked? It is your reply that is a diatribe devoid of any substance.

      'We can define greatness however the fuck we want, because as far as we can tell we're the only self-replicating assemblage of molecules that knows or cares what greatness even means.'

Hmm, this is not cool. I sense emotional rage from the beginning. 'Greatness' or 'great' is actually well-defined. What you're writing is that many humans can use language. That's obvious. Fish can swim, birds can fly, some fungi inhabit radioactive space. It's all shuffling of particles.

      'So if, during whatever time we're not spending making more copies of ourselves, we decide we enjoy shuffling molecules into a particular arbitrary pattern, who the fuck is going to tell us that isn't greatness?'

It's not greatness, because greatness cannot apply to almost everything. Imagine that every email you ever get is labeled as 'important'. Well, if every is important, then labeling it as such become useless and just clutters you subject line. Same with the word 'special'. If everyone is special, the no one is. These words, like greatness apply to minority of things or otherwise they become useless. So, since shuffling atoms is done all the time everywhere, labeling that as greatness makes no sense.

      'When you ask why we should bother making copies of ourselves on a different pile of dirt than the one we're currently on, you might as well be asking why we should go on making copies of ourselves at all.'

Yes... and?

      'There is no endgame. There is only doing interesting shit, doing boring shit, and death. I choose interesting shit.'

These 3 activities and events are also shuffling of particles. So, fundamentally, there is no distinction between them in the end. Since death requires the least amount of effort, it would be the best choice for creatures looking for an easy way out.

<comment><USER8> Sorry about that aggressive comment, it was intended to be humourous.

</comment></comment></comment></comment></comment></comment><comment><USER12> Can you just imagine 128 people on Mars?

Definitely not within my lifetime.

Probably not within the lifetime of anyone alive today.

Politicians would rather spend money on wars.

</comment><comment><USER13> Good, now once we extract water here are the next steps to take: [https://teespring.com/mars-colonization](https://teespring.com/mars- colonization)

<comment><USER14> Nothing against you, but why are link shorteners still allowed on HN? I feel like they are an easy attack vector for malware, and don't make life any easier for us as readers - in fact, they make it significantly harder because I have no idea what I'm clicking.

<comment><USER13> You're right, sorry, I edited the comment.</comment></comment></comment>


Riot.im: The Big 1.0 - <AUTHOR> https://medium.com/@RiotChat/the-big-1-0-68fa7c6050be <comment><USER2> I've been using Riot daily for several years, and this 1.0 version seems to work really well. Like any major UI change it's going to take me a while to get used to the slightly different mechanics. Overall it looks more modern than the prior versions.

</comment><comment><USER3> Looks like lots of nice improvements! Glad to see this!

Once there is a way for me to have assigned moderators on my instance able to click / tap to see the ip addy, user agent, associated instance, of users in the room, with the ability to ban them and add a note in an admin/moderator panel..

with the added ability to open list of bans, reasons, and add or remove instances, ip addys, subnets, cidrs, hostnames..

Then I will be bringing a few hundred users to use this instead or wisechat and realchat.

Looking forward to using this one day!

<comment><USER4> from a privacy perspective we really really don't want to leak client IPs and UAs to other users, even if they're moderators. in a disaster the server admin can get at this, however, and there is a /whois API (similar to IRC's) which server admins can use, but none of the clients hook up UI for it.

<comment><USER3> I love the privacy thing. With some chat clients I stopped using them, or turned off features to protect ips being leaked from each room participant to all the others in the room. It's important for safety and security.

I believe this is what would cause us to force the use of a stun/turn server if we switched to web sockets. I have seen nefarious users pull and use ip info from chat rooms in many ways for blackmail and worse.

I've also watched some of these wicked people use other tricks like share a picture in the chat room - then check their server logs to see which ips pulled the jpg request - then use that info to hack everyone's home routers, pull their pics, put them up..

So yes I get the importance.

However I can assure you that times are coming where people are going to need better blocking tools with these chat systems.

The main reason I have not started testing with the riot / matrix with my groups of users is becuase I would feel bad for those other people who run instances - as they would be flooded with a few groups of evil wicked trolls - and since there appears to be little moderation ability - it would quickly ruin the chats of all who allowed any user sign ups.

They are coming, it's just that matrix has not been pointed out as a ripe target yet. They will spam, for fun and profit. They will send bots, they will send dozens of humans to do it. Then they will post stuff to make everyone ill - nazi stuff, child prn stuff, all the things you don't want in your system and your other users will leave if they see it.

Whatever you do to ban them, they will return. If it's possible to come back with a new ip and a new email addy - they will be back with six identities before you finish banning the last one. They will register names that look like other's in your system. Heaven forbid you have not blocked blank space ascii/unicode characters..

When these groups of people find that it frustrates you to have your system turned into 4chan, then the real fun begins. Even if you can see their ips it won't matter, they have access to thousands of subnets.

Anyhow, I hope more moderation tools come to riot / matrix / etc - I would be fine with giving my appointed moderators the ability to click to block subnet and have the server do it even if the moderators could not actually see the ip of the individual.

The blocking is most important. Some of my mods look at ips to try to determine cases where someone is suspected of being an imposter and things like that - but that's not as needed. All of my moderators have made agreements with have about ips and personal info during the training process and get how important we take privacy.

I would think this is going to be extremely important with the federated options and such.

<comment><USER4> totally agreed on being able to block abusive users. but being able to spy on their IPs does not help much in doing so.

<comment><USER3> Anything we can do to make it easier to block bad users I am all in.

Perhaps we could have options to let moderators see hostnames or something instead? maybe even some kind of hashed code..

thing is we currently use mods seeing ips to determine imposters, and to determine when someone comes into the chat room with multiple usernames at the same time. This is not 100% solution sure, and it's legacy tools we are talking about - but it has been immensely helpful many times.

Some of the worst trolls will come in with a dozen usernames at the same time. When you kick one out of the room - the other 11 can still troll.

Being able to see an ip of different users can give clues as to whether or not other suspicious behavior is indicating more nefarious stuff.

So far being able to ban via ip subnets and cidr has been the most effective method for stemming most of the spam bots and abusive trolls we have encountered.

We do get some smart ones that log in with a dozen different ips from a vpn service - and that does make things much more difficult - it that does come at a cost to the troll as well - so it's worth doing.

I think the instance / server admin may need to view ips to unban if it's an issue - but maybe the moderators just need to see a numeric hashed representation so we can see that sally45 and billy 29 are not in the room from the same connection? Or hostnames or some other thing.

I am open to all ideas on this front. I have spent hundreds of hours dealing with banning chat room users and unbanning people on occasion.

So far the rudimentary moderation tools of the old realchat from 15 years ago are better than the modern chat systems we have tried out (rocket chat, riot, etc) - hopefully this will change soon.

</comment></comment></comment></comment></comment><comment><USER5> For authenticating multiple users, I wonder if you can do something GPG like where you generate a web of trust?

<comment><USER4> currently we're aiming for a web of trust between your own devices, and then transitively trusting other's devices once you've verified that user.

however, a GPG-style web of trust which lets transitive trust span over users is a bit questionable: all it needs is one party to be sloppy with keysigning and the whole things falls apart. It also leaks metadata in terms of who knows who like a sieve. So we're going to see how far we can get without it :)

<comment><USER6> I think I mentioned this before, but I think you should allow for the case where all participants in the virtual room physically meet. Think conference, or a meeting on business premises. They should be able to swap keys with each other efficiently, perhaps using NFC, and without having to have O(n^2) interactions. Yes it may not be super-secure but you can assume the security is already taken care of by the physical security of the meeting.

<comment><USER4> yeah, this is a good example where a temporary(?) web-of-trust could work. in retrospect, i think the cross-signing proposal ([https://github.com/uhoreg/matrix-doc/blob/cross- signing2/pro...](https://github.com/uhoreg/matrix-doc/blob/cross- signing2/proposals/1756-cross-signing.md)) has some thoughts about how transitive trust between users could work, but i'm failing to find it now.

I've raised a bug to track: [https://github.com/matrix-org/matrix- doc/issues/1886](https://github.com/matrix-org/matrix-doc/issues/1886) \- thanks!

</comment></comment></comment></comment><comment><USER7> Congrats to the Riot.im folks. The UI/UX was one of the only things that we found was holding a number of organisations we work with back from using it. Combined with Matrix, it's a wonderful tool.

<comment><USER4> thanks :)

</comment></comment><comment><USER8> You can't see the content of the room without creating an account now?

<comment><USER4> sure you can. [https://riot.im/app/#/room/#matrix:matrix.org](https://riot.im/app/#/room/#matrix:matrix.org) in an incognito tab does what it always did and lets you preview the room without signing up?</comment></comment>


Ask HN Staff: Could you build emoji support? - <AUTHOR> I'm tired of this: <comment><USER2> We strip the most distracting codepoint ranges: emoticons, dingbats, misc symbols, etc.

<comment><USER3> 🆃🅷🅴 🅵🆄🅽 🅿🅾🅻🅸🅲🅴 🅷🅰🆅🅴 🆂🅿🅾🅺🅴🅽

<comment><USER4> Please don't do this.</comment></comment></comment>


Security Advisory: Phusion Passenger and the CVE-2014-6271 Bash Vulnerability - <AUTHOR> http://blog.phusion.nl/2014/09/25/security-advisory-phusion-passenger-cve-2014-6271-bash-vulnerability/

<comment><USER2> Patch is out for CVE-2014-7169 on debian @ [https://lists.debian.org/debian- security-announce/2014/msg00...](https://lists.debian.org/debian-security- announce/2014/msg00223.html)

<comment><USER3> It tricked down to Ubuntu just now: [http://www.ubuntu.com/usn/usn-2363-1/](http://www.ubuntu.com/usn/usn-2363-1/)

</comment></comment><comment><USER4> How is Passenger affected? If there is an attack vector using Passenger I'm going to be even more worried than I already was.

<comment><USER5> Phusion Passenger author here. See [https://github.com/phusion/passenger/issues/1286](https://github.com/phusion/passenger/issues/1286) for details.

In short: Phusion Passenger sometimes spawns application processes (e.g. during startup). This spawning happens through bash. Some environment variables are set according to certain HTTP headers' values.

We've been hoping the entire day that bash is going to be fixed "any time now", but the fix still isn't released. If it's still vulnerable by tomorrow we'll release a temporary workaround that fixes it inside Phusion Passenger, by not setting those environment variables. However this workaround will break apps that relied on it.

Furthermore, this workaround will have no effect on any other software which may be vulnerable. The core problem is bash. Until bash is fixed, there's no way to get rid of this vulnerability completely.

Please note that Shellshock+Phusion Passenger does not grant you root access. Phusion Passenger lowers privilege before calling bash.

In the mean time, you can lower your risk by configuring a static process pool (passenger_min_instances N, passenger_max_pool_size N). That way you will reduce process spawning in Phusion Passenger to a minimum.

[EDIT] Looks like the bash patch is released in Debian 7. Other OSes may soon follow.

<comment><USER4> Ah yes, I see now. Environment variables are set based on the request. They seem similar to CGI – we're in trouble.

Is this necessary for any processing by Passenger or the web application, or is just for legacy compatibility? Can the env vars be disabled if they're otherwise unused?

Edit: I agree with everything you said. If the env vars aren't strictly necessary for most apps I would deeply appreciate a patch that disables them completely. This would be good to have, even if bash is fixed – because I don't trust it anymore to handle env vars properly after having seen some of the parsing issues.

<comment><USER5> We don't set environment variables/call bash on _every_ request. Only during process spawning. If you configure a static process pool so that no new process spawning occurs, you should be 99% safe.

In Phusion Passenger 5 we're not going to set any environment variables based on request data.

Still, at the end of the day, environment variables are supposed to be safe. Trying to patch software to not set environment variables, or trying to patch them to not use bash, borders insanity. There's only one right place to fix this, and that's in bash.

<comment><USER4> > We don't set environment variables on every request.

Are you sure? That's not what I'm seeing.

<comment><USER5> Yes. I wrote that code personally. Besides, setting environment variables on every request is not thread-safe and kills performance, so we explicit chose not to do that.

What behavior are you seeing that implies otherwise?

<comment><USER4> QUERY_STRING, REQUEST_URI and others are set according to the HTTP request in my environment. Could be Rack/Rails – I haven't checked yet.

Edit: Oh, I see now – you're right: they don't actually change on each request. Tested with %x{env > /tmp/env}.

Thanks for your clarifications!

<comment><USER5> Those are not _system_ environment variables (which is what is used to exploit bash). Those are _Rack_ environment variables, which are stored in an entirely different manner, and have no effect on bash.

We do set _system_ environment variables for REQUEST_URI, QUERY_STRING, etc, but only during process spawning. Which is why I suggested configuring a static process pool.

In Phusion Passenger 5, we will no longer set system environment variables for REQUEST_URI, QUERY_STRING, etc because of a major architectural overhaul. This also accidentally happens to work around Shellshock.</comment></comment></comment></comment></comment></comment></comment></comment>


$2,999 Mac Pro to go on sale in December - <AUTHOR> http://arstechnica.com/apple/2013/10/2999-mac-pro-to-go-on-sale-in-december-in-all-its-dalek-resembling-glory/ <comment><USER2> Mac Pro: 7 teraflops for a few thousand.

Cray X1 in 2004 5.9 teraflops[1] for only ~$40M USD[extrapolating from 2].

Mind boggling what to expect 10 years from now.

[1][http://en.wikipedia.org/wiki/Cray](http://en.wikipedia.org/wiki/Cray) [2][http://www.theregister.co.uk/2002/11/15/cray_flogs_x1_superc...](http://www.theregister.co.uk/2002/11/15/cray_flogs_x1_supercomputer/)

<comment><USER3> Original IBM PC: $2400 ($6000 in today's dollars) for 0.00477GHz, 0.000016GB RAM, no storage (cassette interface).

<comment><USER4> For years, it was a rule-of-thumb that your dream machine was always $5000.

Fully trick-out a Mac Pro, and that rule might still be true.

<comment><USER5> I would expect it to top out at significantly more than $5k

<comment><USER6> It doesn't matters, this is a halo product, it's main purpose is to showcase the company's engineering chops not being a sales success story like the iphone or ipad were.

Problem is previous such products like the G4 cube coexisted with the traditional and less pricey powermac, while this thing killed the old mac pro, leaving a lot of pros and their expensive expansions and accessories out in the cold.

<comment><USER7> > it's main purpose is to showcase the company's engineering chops

I agree with this, but I'd add that it's to show off their silky smooth blend of engineering and design. We all can go to NewEgg or a million other online retailers and build something which approximates the specs of this machine. Shit, almost two years ago I built a 32 core machine with 32GiB of RAM (could've added more RAM, didn't need it as problem was parallelizable and CPU-bound).

As for the sales successes, I really _want_ one of these, and I'm sure I'm not alone. I'm betting most individuals who buy these will be the types who also spend money on art. What I mean is, I could scrape enough loose change together to get one, but I have no use for it. My desire for one is purely emotional. It's _beautiful_. Just a hunch, but I think Apple's margin on this product fits more closely with the fine art consumer market than the mass consumer market.

<comment><USER6> That's the problem, the people who want this "as art" aren't nearly as many as those who bought the previous mac pro for work, so again you have the same problem the G4 cube had.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Quote: Dave Girard noted in his "Critical look at the new Mac Pro" that the machine has "a truly epic lack of expandability."

I totally agree.

As someone with a macpro1.1 I'm clearly looking elsewhere at this point. I take a lot of still photos and frankly I'm filling up 2 TB drives. Plus having a heavy bulky machine you can put a cable bike lock through makes it much less likely to be stolen..

The design is interesting though. I'm sure its crazy fast.

Just odd that you'll need an expansion chassis for more drive space.

Plus hdmi for external monitor support? Is every DVI monitor going to need an adapter?

<comment><USER3> The alternative is building a large machine containing vast empty space on the speculation that someone might fill it - leaving almost every unit significantly larger than necessary.

TB2 is fast enough that putting the storage outside the box makes sense. Makes upgrades easy: plug it in, rather than having to tear the box apart.

<comment><USER9> Or you can have a z820 which has much more space, cheaper, and has a much better warranty and support(next day engineer on site, for free.)

want two GPUs? sure. want 96 gigs or ram? go for it. want three fusion io cards? you betya.

<comment><USER10> On the other hand, if you prefer OS X as I do, you are SOL. :)

</comment></comment></comment></comment><comment><USER11> The design of the Mac Pro is certainly attractive, but since the only way to add on to it is through Thunderbolt, it seems a bit counterproductive. The sleek black tube isn't so sleek when you need to have a bunch of external drives sitting on your desk.

<comment><USER12> Thunderbolt cables are long enough that you could hide the drives elsewhere, if appearance is the main concern. This would still take up a lot less room on a desk even with a bunch of drives.

<comment><USER13> I'm seeing 98 feet. You could have them in a locked closet or cabinet conceivably. Expensive though.

[http://en.wikipedia.org/wiki/Thunderbolt_%28interface%29](http://en.wikipedia.org/wiki/Thunderbolt_%28interface%29)

Note: I haven't read the entire wiki or triangulated it so this is a quick take.

<comment><USER14> That's 9.8 feet, not 98.

<comment><USER15> _The first such optical Thunderbolt cable was introduced by Sumitomo Electric Industries in January 2013.[30] It is available in lengths of 10 metres (33 ft), 20 metres (66 ft), and 30 metres (98 ft). However, these cable only retail almost exclusively in Japan, and the price is 20–30× higher than copper Thunderbolt cables._

Copper cable is limited to 9.8 feet (aka 3 meters in the rest of the world), but optical cables can be up to 330 feet/100 meters.

That price looks nasty, though.

</comment></comment></comment></comment></comment><comment><USER16> I need to be upfront with my bias, I hate everything Apple. I also built and ran my own digital studio (Not Pro Tools).

This lack of expandability for the Mac Pro is like the criticisms of the Chinese worker conditions, not Apple's fault.

1) This is industry wide, look at Intel with the soldered cpu in the next generation.

2) This is what Apple users want, a simple "just works" for most.

3) Any production Machine has a million things connected to it. So the fact that you have to plug in a million wires into the thing is a mute point.

This is cheaper than I thought it would be. I still think anyone basing their video or audio off of Apple is insane since they have continued to show that they are more than willing to put pro users on the back burner for what 3 years and need I tell you the Final Cut Pro fiasco?

<comment><USER17> _So the fact that you have to plug in a million wires into the thing is a mute point._

It's not only _moot_ , we are also past the Statue of Limitations to be able to talk about this.

<comment><USER18> _...Stat_ ue _of Limitations..._

Was that a deliberate omission of the "t" to reference another eggcorn, or an example of Muphry's Law?

<comment><USER19> Muphry's huh?

<comment><USER18> [https://en.wikipedia.org/wiki/Muphry%27s_law](https://en.wikipedia.org/wiki/Muphry%27s_law)

<comment><USER19> Never knew. Thanks.

</comment></comment></comment></comment></comment></comment><comment><USER20> For those looking for expansion:

• (qty. 2) x8 + (qty. 1) x4 PCIe 2.0 w/ Optional built in drivebay for up to four (4) 2.5" SSD or SAS/SATA drives: [http://www.magma.com/expressbox-3t](http://www.magma.com/expressbox-3t)

• [http://eshop.macsales.com/shop/Thunderbolt/PCIe_Chassis/Merc...](http://eshop.macsales.com/shop/Thunderbolt/PCIe_Chassis/Mercury_Helios/) (See also [http://eshop.macsales.com/shop/Thunderbolt/](http://eshop.macsales.com/shop/Thunderbolt/) for other devices.)

• [http://www.sonnettech.com/product/echoexpresschassis.html](http://www.sonnettech.com/product/echoexpresschassis.html)

<comment><USER21> The fan in the Sonnettech is very noisy. I don't want that enclosure in my edit suites.

</comment></comment><comment><USER22> Another Mac Pro configuration [1]:

Available in December at $3,999

6-Core and Dual GPU

3.5GHz 6-Core Intel Xeon E5 processor

16GB 1866MHz DDR3 ECC memory

Dual AMD FirePro D500 with 3GB GDDR5 VRAM each

256GB PCIe-based flash storage

[1] [http://store.apple.com/us/buy-mac/mac-pro](http://store.apple.com/us/buy- mac/mac-pro)

<comment><USER23> The 12-core configuration is conspicuously absent. $10,000?

<comment><USER24> I doubt we'll see one. Not only that but the suspect geekbench scores for the new Mac Pro are timid.

Apple is hurting the Pro line. If they just gave it a normal form factor and the best current hardware, I think it would be a better people pleaser.

This is a mac-mini on steroids and I'm disappointed.

<comment><USER23> Apple announced 12 cores at WWDC, so I'm assuming it will ship but they just don't want to tell us the price.

</comment></comment></comment></comment><comment><USER25> Enjoy the specs while they're hot, as I doubt they'll update for another 3 or 4 years.

</comment><comment><USER26> Capable of driving three 4k video signals. Amazing. Why can't the new Mac Book Pro drive just one?

<comment><USER27> Since a triple monitor configuration is a de facto standard for pro users, pro configurations, etc., I would disagree with your characterization of "three 4k" as being "amazing".

I would characterize it as the absolute bare minimum to even be in this space.

I have 5 monitors attached to my 2009 pro (3x 2560x1600 main displays, a 1920x1200 offset on the wall, and a 1920x1080 "tv" cabled out to another room) and I've considered adding a sixth.

It's hard to say how many <4k displays you can add to the ports on the back _in addition to_ the three primary 4k displays, but it had better be more than "zero".

<comment><USER28> Are you disputing "amazing"-ness of 3 displays, or number of horizontal lines of resolution? Because I calculate your collection of displays at 7.08k, and 3 * 4k ~ 12k, or a 70% increase over your current count.

;)

<comment><USER27> Sure, but I set it up 4.5 years ago. And I didn't think it was amazing then, I thought it was just "normal".

And three (insert current high end display circa this year) monitors attached to this new mac pro will also not be amazing.

What will be amazing is if you can't add a 4th, 5th and 6th - of any resolution.

</comment></comment></comment></comment><comment><USER29> FYI for others looking for more specifics, there's now a specs page up (separate from the store):

[http://www.apple.com/mac-pro/specs/](http://www.apple.com/mac-pro/specs/)

And there is, indeed, a 12-core configuration option listed.

</comment><comment><USER30> As the owner of a recording studio (VO, music work), I'd say that it disappoints me that I'm expected to pay $3000 for a top of the line video editing machine. I wish they'd found a way to make a $2000 or $2500 musician/studio version that didn't have three 4k displays + two GPUs...

<comment><USER31> As the owner of a recording studio, you know that you'll be paying at least $3k, if not much more, for software to actually go on this thing. Most AV professionals I know spend much more on software than hardware.

<comment><USER30> Not really - I use hardware EQs, comps, etc. The only software costs are Reaper and a reverb (which I hope to replace with a Bricasti next year). I ended up dumping Pro Tools over about a two year period and switching back to all hardware. So it's a disappointment to me to see this pricing. It's as though they've said, "Musicians - they can just buy a regular Mac. The Mac Pro is for graphics and video people who need all this extra hardware."

<comment><USER32> If all the heavy lifting in your studio is being done in hardware, why do you need a high-end workstation?

<comment><USER30> You really don't nowadays - the key things to battle are latency though, and that's often a metric of "How fast is your processing? How fast are your disks? How long are your cords?" The faster Xeons and the faster bus speeds will make big strides in that regard (thus keep your mic cable runs short and you'll be okay). However, the Mac Pro has been a studio staple since it's inception. I suppose we studio folks are surprised that we've basically been regarded as "not significant" by Apple. Unlike previous Mac Pros, this is not a machine built with "music studios" or musicians in mind. We aren't even considered. You'd be nuts to pay $3000 for a "base model" for a recording studio. You still have another $1000-$2000 that you'd need to spend for disk space, monitor, mouse, and keyboard. It's crazy.

</comment></comment></comment></comment></comment><comment><USER33> [http://tubelor.neocities.org/](http://tubelor.neocities.org/)

</comment><comment><USER34> As sweet as this design looks, I can only imagine what the same amount of cash could buy you for a DIY Linux box. Of course, the available software is not the same...

That said I'm a big fan of Macs; I own several. Great computers and the OS is stunning... so who knows.

<comment><USER35> I'd say the PCIe SSD, quad-core Xeon, dual FirePro graphics & 12GB ECC RAM are going to add up.

Of course, not everyone needs all of those things.

</comment></comment><comment><USER36> Random selection of USD prices for the base model from different Apple online stores, for the curious:

$4,053 in UK

$4,010 in Czech Republic

$3,880 in Australia

$4,257 in New Zealand

$4,300 in Sweden

So to US-based guys intending to buy one: hope you spend your ~$1k on something nice :)

<comment><USER23> Including VAT?

<comment><USER37> Yes those prices are including VAT.

So, $4053 - 20% ~= $3377, still an extra $378 because 'fuck you' :)

<comment><USER38> AU's GST is 10% so it's a $493 'fuck you' Down Under.

</comment></comment></comment></comment><comment><USER39> More I look at it and less I like it.

The design is weird and certainly not elegant.

Try to imagine it with 5 cables that come out from the "back" (a cylinder don't have a real back).

<comment><USER40> It's about the same size as their G4 Cube really. It had cables coming out of it's bottom and it's back, and that never detracted from an incredibly amazing piece of hardware. The internals are fairly similar too, oddly enough.

</comment></comment><comment><USER41> 7 terraflops in 11 pounds; looks like it would fit many carry ons or a decent sized backpack. Good luck explaining what it is to TSA though.

</comment><comment><USER42> That's awfully expensive for something with zero internal expandability that looks like a tiny wastebasket.

</comment><comment><USER43> So what's the future of the MacBook Air at this point?

Does the Retina MacBook Pro just keep getting thinner until the Air is obsolete? Is there some fundamental technical reason they can't keep iterating the Air thinner and put a Retina display on it? Or a business reason why that's not a priority?

<comment><USER44> The current MacBook Pro is probably the thinnest and lightest laptop possible with a Retina display. They've already taken out the spinning HD, optical drive, ethernet port, and removable battery, which are what they took out to make the original Air so thin and light.

If they want to make a Retina Air as thin and light as it is now, they need some sort of breakthrough. One option that has been mentioned is to power the Air with ARM instead of Intel--like an iPad. But that would that probably would require a heavy software translation layer to run OS X apps like Office or Photoshop.

</comment></comment><comment><USER45> The Mac Pro would be awesome...if it were the Thunderbolt dock to a meat and potatoes box I could store out of the way and expand whenever I saw fit.

If you want to innovate, give me a way to separate the things I need to use my computer FROM my computer.

</comment><comment><USER46> How much Mac software can take advantage of 2 gpus for processing, rather than 8 or more cores? I have a dual socket Mac at work with 12 cores total, not sure this would feel like an upgrade.

<comment><USER47> They mentioned all the Apple pro apps are getting updates to take advantage of the Mac Pro.

</comment></comment><comment><USER48> Disappointed in the GPU configuration. I would much prefer a single fast GPU like a D700 (same hardware as 7970, R9 280X) over two slower GPUs like the D300 (R9 270x) in the lower configurations.

And even the high end options -- the D700 is the pro version of a GPU currently retailing for only 300 dollars. Nvidia has the Geforce 780 and AMD has the R290x at twice that cost. Reportedly the GPUs are downclocked as well.

<comment><USER49> Isn't the point of the FirePro line that they come with ECC? I can sorta understand higher prices and lower performance from such things.

<comment><USER48> >Isn't the point of the FirePro line that they come with ECC?

I'm pretty sure they use regular ram, but even if were the case, I'd still prefer a single high end one.

</comment></comment></comment><comment><USER50> Anyone know: Is the 4-core version faster than the 6-core version for single threaded operations?

<comment><USER23> No.

[http://ark.intel.com/products/75779/Intel-Xeon- Processor-E5-...](http://ark.intel.com/products/75779/Intel-Xeon- Processor-E5-1620-v2-10M-Cache-3_70-GHz) max turbo 3.9 GHz

[http://ark.intel.com/products/75780/Intel-Xeon- Processor-E5-...](http://ark.intel.com/products/75780/Intel-Xeon- Processor-E5-1650-v2-12M-Cache-3_50-GHz) max turbo 3.9 GHz

<comment><USER50> So, what does that mean exactly? When are they not running in turbo? The 4 core is clocked higher in non-turbo, that makes no difference?

<comment><USER51> Turbo modes are opportunistic based on temperature and short-term power draw, so you can't be 100% definite about the speed the processor will run at. But generally speaking, when that 6-core processor is only running 4 threads, it will turbo up to the same speed that the 4-core operates at fully loaded, and they'll both hit the same peak for a single-threaded workload.

</comment></comment></comment></comment><comment><USER52> Hmm.. I wonder if it's going to be the end of December or the beginning.

<comment><USER53> Honest question: does it really matter? If you're obliquely referencing the holiday season, I have to think that the number of people for whom giving this as a gift is a viable option is basically a rounding error in Apple's customer base. I could be wrong, though.

<comment><USER54> "Before the end of the year" is important in this case not for holiday sales, but for 2013 tax reasons. I doubt even seriously rich people would be buying this as a gift ;-)

</comment></comment></comment><comment><USER55> My MBA is doing everything I need it too, for a fraction of that cost. So I'll totally skip this one.

<comment><USER56> You are quite obviously not in the target audience of this machine if all your computing needs are being satisfied by an MBA.</comment></comment>


Show HN: Rim – Aspiring vim-like text editor [Rust] - <AUTHOR> https://github.com/mathall/rim

<comment><USER2> A Readme with some screenshots I would find useful.

<comment><AUTHOR> Thanks, you're right. I did add a readme the other day. Maybe too little too late. :)</comment></comment>


Ask HN: How do I secure my REST API? - <AUTHOR>

I've recently built a REST consuming web-app with a user account system. While I'm choosing not to store sensitive data such as passwords (using Google/Facebook), I'd prefer to prevent just anybody from accessing the REST endpoints. What are some good ways of doing this? The app is using the MEAN stack.<p>Also, security is REALLY not my forte, and this side-project isn't monumental or anything, so I'm willing to sacrifice some security for brevity and ease-of-use. <comment><USER2> Usually you put a filter mechanism so some endpoints are restricted. This checks for a valid token sent by the client (by sending it back to facebook). If you find this procedure slow you can also use good old sessions (although some people consider this stateful and thus not appropriate (I am not in this camp).

</comment><comment><USER3> If your API is meant for other developers to build-upon, you use public-keys and registration, just like how you registered to use Google/Facebook login.

You should also sanity-check your GET/POST requests, to make sure they contain ONLY what is allowed.

There are many other things you can do, but I can't think of them right now.</comment>


According to Alexa, iLike has lost 70% of their Web site traffic since launching on Facebook - <AUTHOR> http://plentyoffish.wordpress.com/2007/06/13/facebook-ilike/ <comment><USER2> They've traded their independence and have become a sharecropper. :( They're now on Facebook's mercy. Facebook giveth; facebook taketh away?! Their investors should be worried.

</comment><comment><USER3> Makes sense. None of my nontechie friends realise that facebook apps exist outside of facebook. For example they think Twitter is some kind of useless clone of facebook status. I've yet to see a great facebook app that ads value to facebook.

</comment><comment><USER4> Would you exchange 4 million new users in one month for decline in Alexa ranking? Hell yeah!

iLike traffic actually shares the same exponential growth since all contents in their facebook app are served from their servers. Facebok does not host your app.

<comment><AUTHOR> What's interesting is that all the hype surrounding the explosive viral growth for Facebook apps such as iLike doesn't acknowledge a possible cost. Acquiring 4 million users isn't strictly additive, if it comes at the cost of cannibalizing your existing Web site visitors.

At first, I thought that iLike would only be able to monetize their Facebook users by driving them to their Web site. So, a big drop in Web site traffic seemed disastrous.

However, I see now that iLike is showing ads on their "Music Challenge" page within their Facebook app, so driving traffic doesn't seem necessary. (I'm assuming iLike is collecting this advertising revenue. Please correct me if I'm wrong.)

That's the real question then: How easy is it to monetize Facebook users? Is a Facebook user (who never visits the iLike Web site) just as valuable to iLike as a Web site user? If a Facebook user is less valuable, how many more Facebook users than Web site users would iLike need to come out ahead?

</comment></comment><comment><USER5> If you don't trust Facebook, then build a Facebook app with limited functionality to promote your full-featured service outside Facebook.

<comment><USER6> Aren't you then leaving room for a competitor to be more generous by letting users stay inside Facebook?

<comment><USER5> Why is that so important? Why does it matter if you sometimes need to leave Facebook?

<comment><USER6> I think given two otherwise similar services the one that's fully functional inside Facebook will get more users.

<comment><USER5> Unless the other one already has a lot more users.</comment></comment></comment></comment></comment>