Ask HN: How to Handle a New Manager? - <AUTHOR> I've been working at my current company for a little under a year, and in a few weeks my team is getting a new manager. This is my first job and I've never experienced a manager transition, so I wanted to know if there are any things I should do, not do, or just be aware of. What have some of your experiences with manager transitions been like, and what did you do about the transitions that looking back, made your path better or worse at those companies? <comment><USER2> It can be a blessing or a curse, I've found that my job satisfaction is very much dependent on my manager more than the company I'm at. Looking back, I'd tell my past self to spend more time understanding the psychology of the new manager and how to operate and thrive under those constraints.

In one situation, there was a personality issue, and half the team left within three months. Personality issues are hard to correct, I knew the writing was on the wall and should have been more aggressive in switching out.

<comment><USER3> This is true.

</comment></comment><comment><USER4> The relationship between a manager and his or her direct reports is often cited as the single biggest factor in determining job satisfaction. Try to make the relationship a good one, and hope that they do their part too.

With the benefit of hindsight in similar situations, I would suggest trying not to jump in too heavily on things (like taking sides in a technical debate, volunteering for specific projects, etc) until you understand your new manager's objectives and how they evaluate performance.

The corporate culture, and the reason why the new manager was brought in, both matter. If it's just because the old one moved on and a new one was hired, and there's a strong corporate culture, things will likely continue on pretty normally for you as a junior report. If they were brought on for another reason or it's a smaller company, you could be in for some dramatic changes.

In any case, read up on how to "manage up". Here's a few Harvard Business Review articles that should help, and then you can go from there:

[https://hbr.org/2015/01/what-everyone-should-know-about- mana...](https://hbr.org/2015/01/what-everyone-should-know-about-managing-up)

[https://hbr.org/2014/12/how-to-handle-your-first-meeting- wit...](https://hbr.org/2014/12/how-to-handle-your-first-meeting-with-a-new- boss)

You should be able to tell within a few months how things are going - if you aren't happy or aren't getting positive feedback from the new manager, start job hunting. At 1-2 years into your first job you are likely at a good point to start looking for a new position with a nice bump in salary anyway.

</comment><comment><USER3> I've had 10 or so manager changes in my 8 years. They are all a little different. Most are not a big change if your company has policies about performance management and they follow them (this could be biased since the time per manager for 10 manager in 8 years is small). Most big companies have a lot of policies, which can make the transition smooth by maintaining consistently.

Another point is to rely on your department head. Usually they hire people similar to themselves or to the people they have previously hired. So the incoming manager should be somewhat similar to the outgoing one unless the department head is looking to make a big change. If you like your department head and old manager then the new one shouldn't be terrible.

Your progression will probably slower if there are a lot of manager transitions in your career. The manager doesn't get to mold you to their image of what defines the talent level for the next role. If they don't have a big hand in your professional development they might be less inclined to feel like you deserve the promotion. (After 8 years I'm only a midlevel dev. Maybe I just suck though)

All that said, my experience has been that changes are usually negative. There are a lot of managers out there and very few of them truly have your best interest in mind and have the pull to influence the situation for your benefit. The chances of you getting one of these good ones might be 1 in 5.

</comment><comment><USER5> I found myself in the same situation recently. I've worked for the same company in the last four years, and always had the same manager. Now that we were finally working properly as a unit (we started as a very small team and grew more recently as well), due to a change of CTO, we were forced a new manager (because he wanted someone he knows better, i.e., control better). I did my best to look on the bright side of it for the last 4 months, but now I've reached my tipping point, I'm already in interviews for other companies.

Hope you have better luck than me.

</comment><comment><USER6> I've been on both sides and the best thing to do is to try to make it a good relationship with good communication. Do this finding out how they like to be communicated to (I had a boss that would NEVER read email, but would respond instantly in Slack). Also, be flexible and open to change. Best of luck. I hope it's an easy transition for everyone.

</comment><comment><USER7> Make sure they like you. Try to like them.

Be aware of most of the hard work you did in the past is going to be worth almost nothing in terms of getting a promotion, unless you have other employees telling tales of how you saved the day. It's almost like moving to a new team: a fresh start. If you were having performance issues, now is the time to start producing and showing how awesome you are. If you worked hard, now is the time to keep doing it because what you did may not count since it was not seen by manager.

</comment><comment><USER8> I've had great managers, horrible ones, and some in between. Their leadership skills did matter, but nowhere near as much as how open our communication was. My best jobs were the ones where we talked. A lot. So talk to them. It will improve your job in almost all cases.

</comment><comment><USER9> Start looking for a new job. You've got maybe 3-6 months. Less if they brought the person in as a hatchetman/woman.

Imagine you are big name act like Taylor Swift. You would not let some outside rando choose a manager for you, would you? When a manager chooses a manager for you they don't do it for your benefit.

<comment><USER10> OP hasn't said anything about the cause of the manager transition. For all we know, it could be just that their old manager left for a better opportunity, and they back-filled the role.

My advice - help the manager as much as possible while you evaluate them. It'll probably be fine, and you'll learn to work with them -- they may even make the team better. If not, start looking.</comment></comment>


If you're visiting family over the holiday, turn off Internet Explorer.  - <AUTHOR> http://www.f-secure.com/weblog/archives/00002080.html

<comment><USER3> Follow the OP's advice: don't remove IE unless it is unused! You may lose a convert by removing it without explanation.

My parents navigate the Internet by clicking the arrow next to the address bar, and clicking the webpage they want to use. The last time I tried converting them, they also used work-related webpages with ActiveX controls, which no sane browser would ever support. Tech is slow outside of the tech industry.

My parents' Chrome usage would be a play in three Acts:

Act 1: _Confusion_. "Where did my Sites go? The ones that were on top. I used to click something to click the sites, but now that's gone. There's no arrow! I have to open History? I didn't have to do that before. Where did my Homepage go? What's a 'tab'?"

Act 2: _Judgement_. "I had this the way I like it before. I don't think I can get used to using this. And I couldn't use the Work system, so I have to keep switching between things."

Act 3: _Trashbin_. "That Google thing? I uninstalled that. We didn't like it. And we couldn't use it for Work."

As they say, the best user interface is the one you already know how to use.

<comment><USER4> Use IETab for those specific websites, seamless support.

<comment><USER5> Not seamless in my experience. There is one site in particular that I need to use whenever my domains need renewing; the javascript menus didn't work in the IE tab, but was just fine viewed from IE itself. Not a clue why.

<comment><USER6> I've had the same problem with a couple government websites up here in Canada (don't ask why our Canadian Gov websites aren't compatible yet... incredibly frustrating).

Installed a fully secured suite of FF in a law office w/IETabs. Forms wouldn't load in it. Chaos ensued.

None of them ever used FF again and now tell everyone it's "that crappy program tech support installed".

Now I didn't uninstall IE but I hid the icon. Lesson learned. Just leave the icon in their quicklaunch with FF on the left of it. Instruct them to use the orange icon because it's safer and faster. If they don't use it and their computer gets fubar'd you can just tell them that you told them so and fix it up for them.

<comment><USER7> I worked for Public Works and Services Canada, and all our sites must be compatble with IE 6 and Firefox 3.0 before they are pushed to production.

</comment></comment></comment></comment></comment><comment><USER8> As a developer who's deeply tied into web technologies, I cannot help but grin at this post. Unfortunately, I know where this is going to lead, however. My mother visits a site that embeds WMV-based videos for her Russian TV shows. It was not until she purchased a new MacBook that I realized that this was the site she visits 90% of the time she's on the Internet. I thought installing Flip4Mac would solve her crisis, and it partially did, video and audio came in through Firefox as expected. With that said, seeking within the video does not work as naturally well as it does in IE. In fact, it doesn't work at all. The end result was I purchased my mother VMWare Fusion 3, a copy of Windows XP, and ended up having to tutor her on the usage of a virtual machine, the mechanics between how to seamlessly work with the two operating systems, etc. I still get daily tech support calls that eat up a lot of my personal time, now not only for the MacBook, but for VMWare Fusion, Windows XP and IE/Safari usage.

The web developer in me loathes IE for obvious reasons which will not be reiterated here for the billionth time. The son in me kind of wishes my mother just had a simple netbook running windows xp, IE, and nothing else.

<comment><USER9> You can install Windows XP on a Macbook.

<comment> rm-rf And install all it's vulnerabilities on your Mac?

<comment><USER9> Yes. And its ugliness.

</comment></comment></comment></comment><comment><USER10> Better yet, why not install Google Chrome and replace their Internet Explorer link with a link to Google Chrome? Just make the link have IE's icon so that they don't wonder where the internet has gone.

They will marvel about how you "made their internet faster." I like to make it even easier for people by making two different links: one called "Internet" which takes them to Google, the other called "Email" which takes them to their web email. The results are instant simplification, security improvement, and general betterment of the web by migrating more people to the Webkit rendering engine.

<comment><USER11> My tip is to simply install an IE-simulating theme for firefox: <https://addons.mozilla.org/en-US/firefox/addon/4129/>

Then install the following extension to change the titlebars: <https://addons.mozilla.org/en-US/firefox/addon/57/?id=57>

Finally a bit of desktop shortcut renaming and icon-customisation, and mother will never be any the wiser!

<comment><USER12> It's kinda sad... but I've actually done exactly that before.

</comment></comment></comment><comment><USER13> Current 0-day or no, you'll be doing much more good in the long run if you replace the pre-installed acrobat reader with a 3rd party viewer.

<comment><USER14> It's not even preinstalled, so it shouldn't be that difficult. Foxit and Sumatra PDF are both great choices.

<comment><USER15> If they are a regular computer purchaser (i.e. buy from a manufacturer like hp, dell, etc.) it most certainly is preinstalled along with and old version of java and an old version of flash for their convenience.

<comment><USER14> Wow, I didn't know this was the case. I always immediately image the hard drive, then wipe it and install Linux. I was under the impression that Java, Flash, and Adobe Reader had to be manually installed. Isn't it bad security- wise to bundle old versions of them? If the user puts off upgrading, they could easily get hit by an old vulnerability.

<comment><USER15> That is pretty much the main point of my comment is that they bundle these old versions and so many people just click no when java asks to update (I haven't seen a popup for flash so I don't know how many answer yes to that) and adobe only has a tray icon when the reader needs to update (which is perpetually there on so many machines).

One of the biggest annoyances for me with new windows laptops is that many of the manufacturers no longer send the windows cd to reformat if they send a cd at all it is to recover back to the condition with all crapware installed.

HP now has a recovery manager to create recovery disks for you and the last hp computer I saw had to create 5 dvds in order to recover to that state (which would probably require something like a 6 hour reinstall).

It is a sad state if you ask me that you get this now because it allows manufacturers to take away cost by bundling shareware with the computer, just a few years ago toshiba was still shipping legitimate windows cds which allowed you to reformat to normal windows.

<comment><USER14> > HP now has a recovery manager to create recovery disks for you and the last > hp computer I saw had to create 5 dvds in order to recover to that state > (which would probably require something like a 6 hour reinstall).

And you can only create one set of recovery discs. I was creating recovery discs one time several years ago and the burn process failed. I had no way to start over. I never needed Windows on that computer, but if I had, I'd have had to fork over another $50 to Lenovo to get a set of discs.

That's why these days I just use Clonezilla to image the entire hard disk before Windows can even boot up for the first time. From that image, I can always restore Windows to its exact original state, and it's generally a hell of a lot faster than installing from optical media. Not to mention I can make as many copies of that Clonezilla image as I want, and store it wherever/however I want (local backup vs. offsite backup, optical media vs. hard drive vs. tape drive).

<comment><USER15> Well it at least seems to verify discs now.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> Actually my parents are using a Debian box with Chromium. I found it is a lot easier to manage remotely than a Windows box; it's really low maintenance; they won't grab malware and the Gnome desktop can be really dumbed down - <USER2> only left the window switcher, shortcuts for chromium and skype on the panel and on the desktop, time and date, volume control.

<comment><USER17> Have you somehow got Flash working correctly or don't they use it?

I've never seen a Linux system running Flash as "smoothly" as Windows do. That's on Arch, Fedora and Ubuntu on fairly modern computers with decent specs. 32bit seems to be better than 64bit but it's still slow and buggy.

<comment><USER18> I've never seen flash run smooth on any os

<comment><USER17> Fair enough, but it's got much better performance on Windows than on Linux.

<comment><USER19> Sure, but it's still definitely usable on Linux, as much as we'd like to avoid using it. YouTube, Zynga, and most other sites that laypeople use that depend on Flash work acceptably.

</comment></comment></comment></comment></comment><comment><USER20> Saw this bug on a security researcher's tweet couple of weeks ago: <http://seclists.org/fulldisclosure/2010/Dec/110>

Today found a great write up about how to exploit it here: [http://www.breakingpointsystems.com/community/blog/ie- vulner...](http://www.breakingpointsystems.com/community/blog/ie- vulnerability/)

I have no idea what any of it means. If anyone has any good links that teaches newbie concepts to these things, please do share. Thanks.

</comment><comment><USER21> Is IE8 really so bad?

<comment> rm-rf The more interesting question: Is IE8 significantly worse than the alternatives?

I think not.

All major browsers on all common operating systems have exploitable vulnerabilities often enough that switching browsers will not solve the problem.

<comment><USER22> But all major browsers are not targeted with the same vigor. IE is targeted much more vigorously because the criminals stand to gain much more from their efforts than if they target, say, Opera.

Also, Chrome's sandboxing is designed to assume the browser will have exploitable vulnerabilities, so there are two hoops that the exploit must jump through instead of just one. In this latest IE vulnerability there is only the one hoop and then on most machines the exploit has acquired administrator privileges.

<comment> rm-rf Because of it's market share? Perhaps.

</comment></comment></comment></comment><comment><USER23> I convinced them to switch to a new iMac.

Mission accomplished.

</comment><comment><USER24> That frozen-industrial-wasteland photo of Helsinki is awesome.

</comment><comment><USER25> Uh...Chrome Frame?

</comment><comment><USER26> 1\. Remove all shortcuts to Internet explorer from the start menu, mydocuments, desktop, and search menus.

2\. Install latest version of firefox, use IE themes.

3\. Make a shortcut to start firefox, but change the icon to internet explorer, the retarded blue 'e' symbol.

4\. Make sure you get all the bookmarks copied over.

5\. Make sure any buttons, keys or special behavior moved to equal features on firefox.

6\. Also put some firefox shortcut icons around the start menu and desktop.

They won't even notice anything is different, and if they do, tell them they had to radically update it so that it would be more secure and faster.

If they were tech savvy enough to notice what you were doing, they would have the skill to change it back, and most likely would be already using firefox.

<comment> rm-rf And then Firefox will announce a zero-day. What will you have gained?

<comment><USER22> You'll have gained more time to obtain a fix, because Firefox vulnerabilities are not attacked as swiftly and as broadly as IE vulnerabilities.

<comment> rm-rf I haven't seen any evidence of that. Do you have some data that you can share?

One thing that I have noticed is that Mozilla tends to push Firefox fixes out as soon as they are ready, rather than waiting for a monthly patch cycle. For a home user, that's probably good (but annoying). For a corporation, it's royal pain.</comment></comment></comment></comment>


A Git Horror Story: Repository Integrity With Signed Commits - <AUTHOR> http://mikegerwitz.com/docs/git-horror-story.html <comment><USER2> Code gets reviewed for production at 6am by a guy freshly rousted out of bed who committed some of it four hours earlier, and who is doing this at the insistence of a "frantic" colleague, the fix involves "a bunch of commits" from more than one person, and his main worry is that he might be held responsible for a hidden back door maliciously inserted by his coworker? That's like driving home drunk with your headlights off and worrying that your car could get blown up by a drone because of eroding limits on the use of military force against civilians. I realize it's hypothetical, but man, fix your glaring problems first before you worry about unlikely scenarios.

<comment><USER3> This does a great deal to explain why Facebook's release engineering ignores most attempts to push something out-of-band unless they can justify on the basis of real breakage for the users. (Cf. HotFix Bar)

</comment></comment><comment><USER4> I'm not sure what this 31 a4-pages story is saying beyond 'webs of trust are hard'. Nor am I sure what the first several long-winded pages add - they don't demonstrate a concrete problem, yet they are referenced to several times with the words 'as demonstrated by the story in the beginning, ...'. The summary at the bottom doesn't have a whole lot less information than all the content before it, and doesn't lead the reader to believe for the first 10 minutes that some ground-shaking vulnerability disclosure is imminent.

<comment><USER5> It's a detailed exploration of git object signing.

It's not trying to describe a "ground-shaking vulnerability". There is a current, known issue with display of git signature verifications, and he's including it in his article. That's _not_ the _point_ of the article.

The point is an exploration of options for securing your repository history. That's it.

<comment><USER4> Well then maybe (actually, not "maybe", but "certainly") the title should be "a detailed exploration of git object signing", and not link bait like "a git horror story". But of course the first title, while much more accurate and informative, would not draw nearly as many website hits, so the author deliberately set out to mislead people with the title, in order to get more hits/reads. This sort of misrepresentation of content is what makes the web much harder to explore and the continuous stream of content much harder to keep on top of for the information consumer, and therefore should be called out and chastised.

But then again, I'm just an old grumpy man who is much faster to criticize and be negative than he should be, so who am I to cast judgement? Do I ameliorate or exacerbate the situation with posts like my previous one or this one? I don't know, maybe I'm part of the problem in that way. Either way, I much preferred (so are my motivations selfish? Is that good or bad? I think good, but how do I _know_?) the old HN when submissions like this one would be labeled for what they were.

<comment><AUTHOR> I'm sorry that you feel that way. You have understandably misinterpreted my intent. The title was not intended as bait, nor was the story. Rather, I enjoy writing and was hoping to appeal to readers that have difficulty reading dry material (which is the material I tend to write), while at the same time providing something to relate to in order to put the article into context. The title itself was a play on a television series --- American Horror Story --- that my girlfriend once fell asleep to as I was hacking late one night. The story was intended to augment the actual useful material (code samples and explanations), not obscure it, which it appears to have done.

Please notice that this article is segregated from the rest of my blog with no glaring/obvious links to it. This was intentional. I posted this article in the hope that it would be useful to others, not because I would gain any benefit from doing so.

I will take your comment into consideration for future articles.

<comment><USER6> FWIW, I read the article because of the attractive title you gave it. I found the beginning exciting and the rest quite informative. If you had titled it more boringly, I wouldn't have chosen to read it.

</comment></comment></comment></comment></comment><comment><USER7> Warning -- This article posts a longwinded first person account and finally ends with "this scenario is purely hypothetical". So it sounds like it is talking about a security vulnerability with git that really happened (signed commits or tags being broken, perhaps?), and it's actually an article saying you should use signed commits if you can't control access to your repo.

</comment><comment><USER8> `git tag -s` is all that's needed. The primary problem in your horror story is that you GPG signed a commit with a tag when you shouldn't have. When you tag with GPG, you are saying you _do_ trust the history. You didn't review the commits you were signing with the tag and that's were you made your mistake.

Linus himself is against GPG signing commits.

[http://git.661346.n2.nabble.com/GPG-signing-for-git- commit-t...](http://git.661346.n2.nabble.com/GPG-signing-for-git-commit- td2582986.html#a2583316)

Ultimately a human being has to be responsible for reviewing code. Once it's reviewed, you can tag and sign it. No GPG signature is going to make up for not reviewing your code.

</comment><comment><USER9> Interesting solution, but is this really a problem? The only situations I can think this applies to are large-scale open-source projects with many maintainers, and even more people submitting patches. For closed-source projects without external patch submissions, this is really only avoids the security threat of someone sitting at your computer and committing malicious code to your repository, which (to me) doesn't sound like much of a threat. (At least, if that _is_ a threat, rogue commits to your git repo are only one part of your problem, and door locks would probably be a better, more broadly beneficial solution than implementing this.)

<comment><USER10> Yes of course, creating a backdoor or sabotage via revision control is a really good attack vector (like really). Recently several large open source projects had shady forged commits, so it's safe that say that anything private is also being targeted.

<comment><USER11> Apart from Ruby, which?

<comment><USER12> Wordpress <http://wordpress.org/news/2011/06/passwords-reset/>

</comment></comment></comment></comment><comment><USER13> This describes pretty exactly why security questions are hard.

It's not as easy as using tool x and generate key y... its more than using software, if you want security, you have to think about the whole stack, down to the access rights that each part of your hardware has.

There are good and best practices, but with IT Security, using the best practices in one place and just plain forgetting to unlock you PC when you go to the toilet at the office is more than enough...

People are allowed to be afraid when asked security questions.

<comment><USER5> > _just plain forgetting to [lock] you PC when you go to the toilet_

You're not even trying. Physical access, game over, the lock is irrelevant.

You fear what you don't understand, and you don't understand because you're afraid to learn. You have simply crafted a vicious cycle for yourself, and are making the world that much more unsafe by spreading your fear and acting as if everyone should share in your fear.

<comment><USER13> I'm not spreading fear, since i consider HN a place where people are educated enough understand the problems in it security.

Yes, once someone has hardware access, its devilishly hard to secure an environment, but just stating that its impossible is as wrong as security systems that ask their users too many questions to which they most likely have no good answer/no doubtfree answer.

There are systems which work pretty securely, i have worked with several educated security experts to create security infrastructures in companies.

I'm not saying that i don't understand the problems or don't want to learn solutions to them, i'm trying to defend the position of the user that can't be asked to learn about all the caveats of it security, since it is one of the most complex problems in computer science.

No, not every front-end developer that has to check-in his html und js files can be asked to understand all principles of it security.

</comment></comment></comment><comment><USER14> tl;dr : You can GPG sign git commits with -S option. This makes things more secure

<comment><USER15> But it's not a cure-all

<comment><USER14> Yes. "more secure" ≠ "100% secure"

<comment><USER15> And sometimes, "more secure" == "less secure than before due to complacency"

</comment></comment></comment></comment><comment><USER16> The article puts forward a false dilemma by implying your only choices are (a) squashing all of the commits into a single patch, (b) examining the end point and then only signing the end point (with the risk that there might be some bad stuff hidden in some of the intermediate commits), and (c) examining and signing every single commit.

In fact what we do in the kernel community is most patches are in fact reviewed via e-mail. This increases the likelihood more people will look at the patch and notice any potential problem, and more importantly, the e-mail archive introduces an additional external record of the proposed change. After each patch in a patch series is reviewed, in isolation, with each change small enough that it can be easily reviewed in a mail reader, and with especial attention made to maintaining bisectability, the maintainer who will ultimately by signing the git pull request will apply it into his or her tree.

For larger changes and for larger subsystems where we have submaintainers, it is the maintainer's responsibility to make sure the submaintainer sends a signed pull request. At that point the submaintainer is assuming full responsibility for the set of patches which he or she is sending to the upper- level maintainer, just as the maintainer assumes responsibility for the patches he or she sends to Linus.

In the case where the submaintainer does not send a signed pull, or the maintainer does not have full trust in the submaintainer (either for social or technical reasons), it is the responsibility for the maintainer to check each and every commit for correctness. If he or she can't do that, he shouldn't accept the pull request; instead, he might request that the patch series be sent to the mailing list so everyone can review the patch series.

One of the things which follows from this is that for me as a kernel or e2fsprogs maintainer, github pull requests are not particularly useful. Most of the time I have no idea who the person is that initiated the pull request, because the primary community is on the mailing list. Worse, the pull request only gets sent to maintainer, which makes the maintainer the review bottleneck. If the patch series is sent to the mailing list, as individual commits, with no requirement to jump to a browser, it allows the review workload to be distributed to other developers on the mailing list.

As far as I'm concerned, a github pull request is the same thing as a patch sent via private, personal e-mail. I'm going to review it very carefully, and only apply it if I _know_ that it is clean. Typically the review involves extracting the commit as a diff, and as has been discussed in other places, github doesn't encourage properly formatted commit descriptions, so I end up needing to extract the diff, and then reapply it with an appropriate commit description. So for me github pull requests generally represent negative, not positive value, because of the quality control and quality assurance requirements of the code bases in which I work.

<comment><AUTHOR> The style of review you mentioned (which I made a brief mention of in the article) still falls within the three merge options. In the case above, maintainers seem to be doing option b or c, depending on trust. Instead of signing the merge commit, the pull request is signed. One of the downsides to this is that it does not extend the signature to the repository and requires the users to consult the mailing list. That said, I'm rather fond of the Linux and Git style of code review and would recommend it in addition to what was recommended in the article (with the former only being necessary if its benefits are desirable).

Thank you for the detailed explanation; it did help to clarify details I assumed, but was uncertain of.

<comment><USER16> No, there's no need to consult the mailing list, except if you want to see the "legislative history" of the review process.

The person requesting the pull signs the pull request by signing the git tag. The GPG signature on the git tag covers the complete history of up to that point in the tag, so there's no need to sign each and every git commit, as you propose. When the upstream maintainer (or Linus, at the top level) accepts the pull request, git will automatically create a merge request that contains a copy of the git tag's GPG signature in the merge request. (After this point, the git tag can be discarded). When Linus releases something, he signs a git tag for the overall git repository, and everyone can check that.

So for example, when I am satisfied that everything in the ext4 tree that I want to push to Linus is OK, I create a signed tag named "ext4_for_linus", and send him a git pull request, which is created using the "git request-pull" command. This creates an e-mail message contains the URL of my git repository and the name of the signed tag. When Linus accepts my pull request, the resulting merge commit will contain a copy of my GPG signature from the git tag. This signature signs my name to the commit id of the git tag, and the chain of SHA-1 hashes inherent in git guarantees that the entire commits back to the beginning of time came from me. Of course, my changes will branch of something like v3.3-rc2, which is in Linus's tree, so what is being signed that is of interest is my new changes between v3.3-rc2 and the tip of the ext4 tree.

Once Linus has accepted my pull, I'll reuse the ext4_for_linus name for the next GPG-signed tag for the next 2-3 month development cycle, since the important bit (the GPG signature) is preserved for long-term posterity in the merge commit. But what's important to note here is that the signature in the merge commit is signed by _me_ , since it contains the contents of what I pushed to Linus, even though the merge commit was created by Linus when he accepted the pull request by merging in my changes into the repository. What Linus signs is the GPG tag for the actual released kernel (i.e., v3.3).

See? So there's no need to refer to the mailing list to validate the pull request or to establish after-the-fact accountability. The mailing list is just used for review purposes. But of course the review is a critical part of the acceptance process.

<comment><AUTHOR> > the resulting merge commit will contain a copy of my GPG signature from the > git tag.

Ah, I see. Thank you for the clarification.

It was not overall integrity of the trees that I was bringing into question. While the code review process may be a problem for certain organizations, I am not doubting that process for the kernel. With such a process in place, signed tags are likely to be sufficient, yes.

Note, however, that one of the points I was trying to make with the article was proof of authorship (to prevent someone from committing as you, much the same way as you would want to prevent someone from fraudulently sending an e-mail or message through any other means). It is for this reason that the workflow you described is not a complete alternative, but would be an excellent means of augmenting the review process for any project.

That said, author identity is not a concern for most projects, in which case, based on the quoted portion of your comment above, my arguments do not necessarily apply (assuming that all commits that are not yet ancestors of a tag _are_ ancestors of a signed merge, as mentioned in your comment).

Might I ask how the maintainers deal with issues of identity? If they encounter a commit in your pull request that appears to be from a well-known contributor, do they verify his/her identity before merging, or do they not care?

<comment><USER16> We do have a ring of trust which we established recently, which is rooted in cross-signed keys belonging to Linus Torvalds, Dirk Hohndel, Peter Anvin, and myself. We all know each other quite well, both in person and via conference calls, so that was easy to set up after the kernel.org security breach. All keys in the key ring is signed by at least two, and preferably more, other trusted keys, all leading up to the root keys.

But that's only important from the perspective of knowing that a particular public key belongs to a person, which in turn is only really important when a maintainer wants to know whether or not the person who signed the git tag really is the submaintainer who is claiming to have signed the git tag.

Most of the time, we don't really worry about identity; what we worry about is the correctness of the commit. Especially for patches being sent via e-mail, I really couldn't care less whether the identity of the person sending the e-mail was Christoph Hellwig, or his evil twin. I'm still going to review the patch very carefully, because we all make mistakes. That's my job as the maintainer; to ultimately be a crap filter, and to reject crap, no matter whether it's written by someone famous or some nobody.

So when I send a pull request to my upstream maintainer (which in the case of ext4 is Linus), he really doesn't care about the identities of the authors in my pull request, because it is _my_ reputation which is on the line; I'm the one who signed the git tag pointed to by the pull request. Just if it gets by me, and then it gets by Linus, it's ultimately Linus's reputation which is on the line.

So that's why your question is a bit ill-formed. Someone who is above me in the maintainership hierarchy isn't really going to care much about the identities of those who are below me in the maintainership hierarchy. The trust relationship is fundamentally between me and Linus, and then I have trust relationships between me and those developers below me. So Linus doesn't care about the identities of those which are two levels below him in the maintainership hierarchy, so long as he trusts me to have done my job properly. Of course, if Linus discovered that I had been blindly accepting pull requests from my downstream without doing proper quality control, then he'll yell at me and he might refuse to take future pull request from me (or at least threaten to do so). But normally, there's no need for him to verify the identity of the authors of commits in my pull request; he only needs to verify _me_ , and to verify that he trusts my technical judgement and quality control checks and processes. If decides he doesn't trust me or my technical judgement then he won't accept pull requests from me; and in that case he would be absolutely right to do so.

</comment></comment></comment></comment></comment><comment><USER17> So what does this means is if someone compromise their GPG key (more or less easy) and get his passphrase (not difficult) they can sign all kinds of commits and make it look like he did it. Great

Security is only as good as the weakest link.

Also, don't make it look like it's more secure when it may not be

</comment><comment><USER18> From what i've read, the problem is that an attacker can add commits with forced Author information into a central repository to frame somebody else.

Wouldn't the signing of all commits as they are committed solve this problem? (ie. rather then trusting Author information from the commit, trust the signed-by information to give author information?)

<comment><AUTHOR> Note that Signed-off-by (as added by -s) is different than -S (GPG-sign). The -s option simply appends the "Signed-off-by" line to the commit message, so this can also be forged.

The GPG signature cannot be forged (access to the private key is needed).

</comment></comment><comment><USER19> Thank you for taking the time to write this up in such detail and for making it an enjoyable read too.

</comment><comment><USER20> I can't read this. If there's a vulnerability in the sequence of events described at the beginning, it needs to be called out more explicitly. If I wanted a mystery, I'd pick up some Agatha Christie.

</comment><comment><USER21> This part bothers me:

git log --pretty="format:%H$t%aN$t%s$t%G?" "${chkafter:-HEAD}" --first-parent \ | grep -v "${t}G$"

What of the case where some smartass decides to

$ git commit -am 'Yet another foo G'

So long as it doesn't have a bad signature, it will give an empty string, right? So how do I know where the G came from?

<comment><AUTHOR> I do appreciate the attention to detail. Fortunately, even if "G" were appended to the commit message, grep would fail to match (and remove) it: a tab is output directly before %G? (which, as you mentioned, could be an empty string). This ensures that there will always be characters after the subject.

That said, it could be terribly confusing when viewing the output. For that reason, perhaps another character after the tab (before the %G?) would be a good addition.

<comment><USER21> Is there no way to sneak a tab into the message?

<comment><AUTHOR> Indeed there is, but there will always be a tab after that tab. Consider this commit message:

      Foo\tG

This would result in the following output:

      ... Foo\tG\t

<comment><USER21> Ok, that makes more sense. It's hard to see whitespace, so I didn't notice a tab lurking just before the newline.

<comment><USER21> Wait... if I can sneak a tab in there, what if someone hid a _newline_ in there, too?

Would you not end up with

      foo\tG
      \t

And break the regex? Or is there absolutely no way to smuggle a \n into the message?

<comment><AUTHOR> %s inserts the "subject", not the entire commit message. The subject is considered to be the first line of the commit message (I forget if there is a character limit), so a newline would simply be considered the delimiter (and would not appear in the output).

Otherwise, you would be correct --- that would have rendered the check useless.

<comment><USER21> Ahh, you're right. I get a little paranoid when dealing with user-supplied strings, but usually that's a good thing :)

<comment><AUTHOR> Absolutely; your critical thought and inquiry is a very positive thing.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> Wouldn't this be solved with a merge commit? If I can see where a commit merged in, I could prove that I didn't author it, as I don't have access to the other author's machine.

</comment><comment><USER23> Very good and long read; should wake up a few people

</comment><comment><USER24> An interesting article, but I would prefer the author presented the issues first in a VCS agnostic way (as they are not specific to git) and then introduce the hypothetical scenario using git.

Actually these issues are not even specific to VCS, but security of most digital information.</comment>


Deep-sea gigantism - <AUTHOR> https://en.wikipedia.org/wiki/Deep-sea_gigantism <comment><USER2> One reason of this is the water; other reason is that terrestrial ecosystems has been wiped of all the big fauna by humans. No humans = more big species of animals.

Horned turtles, haast's eagles an moas in Australia,

Glyptodonts and geant sloths in South-America

Right whales, mamut, rhinoceros, black bears, lions, leopards, hyaenas, jiraffes, geant deers, wild horses... Europe is lacking of practically all his megafauna level</comment>


Is the tech bubble real? Technology/Industrial ratio at all time low. - <AUTHOR> http://blogs.reuters.com/felix-salmon/2011/07/22/chart-of-the-day-techs-vs-industrials/

<comment><USER2> Note that P/E ratios are sensitive to leverage (e.g., share buy backs create higher P/E ratios without altering fundamental profitability by increasing leverage), so the trend towards low leverage among the largest tech companies could explain some of this.</comment>


Ask HN: What are alternatives to Google products? - <AUTHOR> <comment><USER2> Besides using Apple or MSFT product suites which can get you out of pretty much everything from Google. There are the following

1\. Search: bing, Duck Duck Go.

2\. Android: Lineage OS

3\. Drive: Dropbox

4\. Cloud Services: AWS

5\. Email: yahoo,yandex,gmx, tutanota,protonmail, etc.

6\. Maps: HereMaps, NavMii, OpenStreetMap, Waze

<comment><USER3> Just wanted to point out that Google bought Waze in 2013.

</comment></comment><comment><USER4> Microsoft Office Microsoft Edge Hotmail Windows Phone Azure Bing

</comment><comment><USER5> Which ones? Google has a vast array of products from enterprise grade cloud services all the way to small consumer applications.

</comment><comment><USER6> check [https://nomoregoogle.com](https://nomoregoogle.com)</comment>


Ask HN: Functions: how long is too long? - <AUTHOR>

First I was going to ask how long you think a function should be, but there are lots of cases where using short functions is convenient.
Instead I'd like to ask what's the longest you'll let a function get in a given language before you break it up?  Why?
I have very little experience coding commercially, but I try and never let any function get >1 screenfull, which is 50 lines for me. <comment><USER2> Too long is when you need more than once sentence to describe what a function does or when the function name gets too long.

That's a pretty good indicator because it shows that you could 'abstract' something out and make it an individual routine.

Err on the side of caution, better to have smaller functions than larger ones, unless you have a very good reason not to.

And if performance is your worry and you work in 'C' then inline is your friend.

</comment><comment><USER3> I don't find that it's useful to have any limits on the _length_ of functions; I have code with functions (even main!) are hundreds of lines long.

I do, however, find that it is essential to limit the _width_ of functions, and if my code doesn't comfortably fit into 80 columns when using 8-column tabs, there's a clear sign that it needs to be broken up.

In general, nested loops are far more of a problem than simple "do X, then do Y, then do Z" code.

<comment><USER4> Interesting! Personally I find that once a function is too long it needs refactoring either into an object or more functions although with web stuff one tends to end up with much longer functions. can we have an example of one of your long functions as to what it does?

<comment><USER3> _can we have an example of one of your long functions as to what it does?_

Sure. main() in [http://www.freebsd.org/cgi/cvsweb.cgi/src/usr.sbin/portsnap/...](http://www.freebsd.org/cgi/cvsweb.cgi/src/usr.sbin/portsnap/phttpget/phttpget.c?rev=1.14) is over 400 lines long, and it

* Looks up a server's DNS entries,

* Connects to the server (trying multiple addresses if necessary),

* Constructs HTTP requests and sends them to the server,

* If less than one HTTP request is pending, blocks until it can finish writing a request,

* Reads HTTP response headers,

* Reads an HTTP response body and writes the data to disk,

* Prints a status line,

* if the server sent an HTTP/1.1 response, loops back to the top to continue sending more requests and reading more responses using the same TCP connection,

* and if the connection broke, closes it and loops back to the top to open a new connection and continue downloading.

I separated out the bits which could usefully be put into their own functions (e.g., constructing an HTTP request, or reading a \r\n terminated line from a socket), but there was no point dividing up the rest.

<comment><USER4> Thanks a lot.

</comment></comment></comment></comment><comment><USER5> A general rule I hear is screen +~50%. Once you go beyond that, a study I read a while ago (apologies, no links) showed a huge leap in error, they believed stemmed from our difficulty remembering complex / random things. With my own testing, I'd say it fits pretty close. On-screen is pretty limiting, but 2x screen gets harder to be _certain_ about _everything_ in it, all the time. My error ratio is definitely best when I keep my functions below 2x screen height.

That, and once you get into the hundred+ lines of code, you are probably doing something that's more easily summed up as a couple pieces. Using multiple pieces also has the advantage of it being very easy to rapidly change / experiment with your code.

</comment><comment><USER4> It is probably too long at 50 lines. Turn the question around, what must the function return and start from there. The function should do no more than necessary to achieve the goal stated as the return of the function.

<comment><AUTHOR> 50 lines is long as I'd ever let it get, not how long I try to make a function. I think hearing from people about why they had to write long functions is like listening to an airplane's black box. It could provide insight on what a language does poorly.

</comment></comment><comment><USER6> Personally, I tend to restrict functions to 1 screen length. This is not based on any good programming practices list, it's just that I like being able to see the entire function in one view.

</comment><comment><USER7> I'm not saying this is right, but at my place of work, our c# coding standard says a maximum of 25 lines. It also says maximum line length of 110 spaces (including 4 character tabs).

</comment><comment><USER8> If the function starts to feel difficult to work with, then it's too long.

</comment><comment><USER9> I still aim for the old school

7 +- 2

not including declaratons</comment>


Show HN: Tweet about your product to the followers of your competitor - <AUTHOR> https://targetcompetitor.com/ <comment><USER3> This may be legal but it certainly isn't ethical. Companies that use your service will likely suffer brand damage as a consequence.

<comment><AUTHOR> I thought of like a version of cold emailing but more targetted. Just a little hack to get users. Not sure if this isn't ethical. But I am open to shutting it down if everyone thinks it's not ethical :) This isn't our primary product, just stumbled on the idea while I was exploring growth tactics.

</comment></comment><comment><USER4> Twitter has a new policy that states if you're blocked by a small number of people in a short space of time then your account will be shadow-banned (you can tweet but it won't show up in people's timelines). This is probably a quick and easy way to get caught out by that.

<comment><USER5> Quick fix: create new account that will check if tweets are visible to that user.

<comment><USER6> If your marketing strategy involves throwaway Twitter accounts (or spamming strangers via Twitter), you're doing it - for any definition of "it" - wrong. Come up with something better; it's not hard.

<comment><USER5> You obviously do not work in marketing.

<comment><USER6> Or I do but I've read and agree with [http://sethgodin.typepad.com/seths_blog/2008/01/permission-m...](http://sethgodin.typepad.com/seths_blog/2008/01/permission- mark.html) (and the book, short though it is) and other experts. Godin says it perfectly:

> … the new power of the best consumers to ignore marketing. It realizes that > treating people with respect is the best way to earn their attention.

Basically, a marketer trying to force their stuff on people - <USER2> marketing - either doesn't understand their value proposition well enough to spot ways that it can actually help customers, or is too lazy to act on those ideas.</comment></comment></comment></comment></comment>


Ask HN: What is the best alternative to Angular JavaScript framework? - <AUTHOR> Hey everyone,
Since angular 2.0 is moving into a weird direction i.e use of a totally different language called AtScript.What are other alternative that a developer  should invest their resources and time in?
Thanks <comment><USER2> EmberJS is a great alternative to Angular, and is often considered its primary competitor. To summarize, Ember is basically Rails for the front-end. It emphasizes convention over configuration, and it was designed to aid in the construction of "ambitious web applications", i.e. Javascript-heavy single- page apps that need best-in-class routing and composable views all the way down.

Companies using Ember: [http://emberjs.com/ember- users/](http://emberjs.com/ember-users/)

The getting started guide: [http://emberjs.com/guides/](http://emberjs.com/guides/)

The command line tool you should use to initialize your Ember projects (not yet mentioned in the getting started guide but it will be soon): [http://www.ember-cli.com/](http://www.ember-cli.com/)

</comment><comment><USER3> I really like KnockoutJS, having used it on multiple projects, both personal and professional. Many will say that it can't really be apples-to-apples compared with Angular since it's technically MVVM, it lacks many of Angular's features, like dependency injection etc. etc. And that's all true. But, the end result for me is that I'm able to rapidly build sophisticated client apps. I'd have to dig up the links, but there are some pretty complex front-end apps i.e. website builders and the like, that were developed using KnockoutJS.

<comment><USER4> Do you do databinding? I like KnockoutJS too, but to me it is purely limited to making a page more interactive, not much with back-end integration.

<comment><USER5> Knockout doesn't have built-ins to wire up UI actions automatically to CRUD calls, but the portion of that you end up having to implement is usually extremely small.

As far a wiring up objects to knockout observables you have two options:

1) use the mapping plugin. I tend to stay away from this, as it makes everything on objects observable. Not bad per-se, but I like more control.

2) define your own model...its easy: [https://gist.github.com/jdc0589/c48c2355302390ad954b](https://gist.github.com/jdc0589/c48c2355302390ad954b)

</comment></comment></comment><comment><USER6> React, which is "just the V in MVC"

Combine that with Reflux[1], which is a more opinionated framework around it. It's conceptually a little different than the Flux pattern that Facebook recommends, but the changes make sense after you have some insight into the Flux pitfalls.

Stir in some react-router[2].

It's still not as full featured as Angular or Ember, so you'll need to adjust your expectations there.

On that note, the Ember team has stated[3] they're going to to take the best ideas from React, so it's probably a good idea to keep an eye on that project as well.

Mithril[4] also looks React-ish and interesting.

1: [https://github.com/spoike/refluxjs](https://github.com/spoike/refluxjs)

2: [https://github.com/rackt/react-router](https://github.com/rackt/react- router)

3: [https://docs.google.com/presentation/d/1afMLTCpRxhJpurQ97VBH...](https://docs.google.com/presentation/d/1afMLTCpRxhJpurQ97VBHCZkLbR1TEsRnd3yyxuSQ5YY/edit#slide=id.p)

4: [http://lhorie.github.io/mithril/](http://lhorie.github.io/mithril/)

<comment><USER7> Will all due respect, what are the odds that a single guy has "insights into Flux pitfalls" that the gigantic creator of React, that is deploying the tech for _billions_ of people, has missed?

<comment><USER8> Flux, as prescribed by Facebook, involves a couple singletons and implementing an action requires coordinated changes across 3-4 files. Many people find this undesirable.

The important part about the pattern is the unidirectional data flow, which limits the amount of code you have to search through in order to track down a bug. How to go about making this happen varies and there are quite a few 'Flux' libraries bouncing around the React ecosystem.

</comment></comment></comment><comment><USER9> Mithril might be worth looking into. It's similar to React in terms of providing a unidirectional data flow pattern for code organization, and it comes with a few other useful tools out of the box (e.g. routing, ajax, promises), despite being smaller in terms of byte count.

It's designed to leverage generic knowledge as much as possible, as opposed to introducing a large amount of framework-specific terminology that no one else uses and that may be out of flavour in 3 years.

I've heard people say they were able to get up and running in less than an hour, so even if you don't ultimately use it, I think it's worth investing some time into looking into it.

<comment><USER10> Thanks for your work on Mithril. I haven't had the opportunity to use it professionally, but I'm using it for a hobby project and it's really great to work with.

For those looking for real world uses of Mithril, one site I know of that has a bunch of visitors and uses Mithril is the MELPA Emacs package repository: [http://melpa.org](http://melpa.org)

<comment><USER9> [http://lichess.org](http://lichess.org) is also using it on its chess boards. The developer said he was moving everything else over to it as well.

<comment><USER11> Do you think Mithril can be integrated in meteor?

Edit: I just found a blog post on that. [1]

[1] [http://lhorie.github.io/mithril-blog/mithril-and- meteor.html](http://lhorie.github.io/mithril-blog/mithril-and-meteor.html)

</comment></comment></comment></comment><comment><USER12> Note that the weird direction is not final yet - Angular 2.0 is still a ways off, you don't actually have to use AtScript to build your applications (ES6, ES6 + Traceur annotations, CoffeeScript, Dart, AtScript should all work), and the funky HTML attribute syntax is still under debate because most browsers don't actually support .setAttribute() with bracketed attribute names.

Besides, 1.x works and will keep functioning fine for years to come. You won't be required to update or change your tech stack if 2.0 is ever released.

I'd defer looking around until 2.0 is actually released, 1.x will do until then.

<comment><USER13> Thats exactly what you DONT want to do. "hold out, use angular for the time being" Once 2.0's released we can all just spend the next 6 months rewriting our entire application so it works again!

I disagree with pretty much everything you've said here!

<comment><USER14> I think you should look at a timeframe also. If you write an application today in Angular 1.x you could probably contiue to use it for about 18-24 months. It is really hard to know which frameworks will still be maintained in 24 months time and it is not unheard of rewriting the application anyway after that time. As for the actual rewrite from Angular 1.x to 2.x I think Google will create scripts that help with the rewrite making it go much faster than 6 months. They actually have a LOT of internal applications written in Angular 1.x and would probably not want to spend the whole of 2016 rewriting everything.

</comment></comment></comment><comment><USER15> [http://vuejs.org/](http://vuejs.org/) is similar to Angular in some aspects, but smaller and simpler. From it's site: Philosophically, the goal is to provide the benefits of reactive data binding and composable view components with an API that is as simple as possible. It is not a full-blown framework - it is designed to be a view layer that is simple and flexible. You can use it alone for rapid prototyping, or mix and match with other libraries for a custom front-end stack. It's also a natural fit for no-backend services such as Firebase.

</comment><comment><USER16> Use EmberJS. Great framework with a good core team that really listen to the community.

Further details: [http://t.co/GKoBKpIReq](http://t.co/GKoBKpIReq)

Backward compatibility is always in mind.

<comment><USER17> We're using Ember and have been for a couple of years now and it's come a long way in that time. 12 months ago I'd have struggled to recommend it but it's improved significantly.

What I would say is that like most frameworks it makes things easy when you do it the way it wants you to and will fight you like crazy when you don't. The downside with Ember, probably more than most, is the way it wants you to do things isn't always as obvious as it might be. There is a way and you're going to be able to do what you want to do but you're probably going to have to dig a bit and it might not be intuitive.

Short version: expect something of a learning curve.

</comment></comment><comment><USER18> EmberJS is a great alternative. It's a bit more involved and all-or-nothing, but you gain so much in return.

Mainly:

* Consistant project structure. * Great toolchain. * Ember-Data

\---

If you're starting to learn EmberJS or are making a new project, start out right using Ember CLI. It's the defacto way of building Ember applications.

<comment><USER17> Worth pointing out now that Ember Data is still in Beta. It's a late Beta so you're probably safe but it's not impossible that it will change.

</comment></comment><comment><USER10> Mithril. [https://lhorie.github.io/mithril/](https://lhorie.github.io/mithril/)

<comment><USER19> Agreed. Also, combined with [https://www.npmjs.org/package/msx](https://www.npmjs.org/package/msx) it feels even more modern with jsx templating

<comment><USER10> I really dislike JSX and I don't see the appeal. Mixing HTML/JS just seems like an awful idea. Mixing the two is one of the reasons I hate Angular templates.

</comment></comment></comment><comment><USER20> I am using Backbone.Marionette. I like it because it is simple. Marionette helps you to write consistent codes and avoid javascript chaos even when your project gets bigger. You probably have to write more codes than Angular to archive the same thing, but the effort will pay when your project becomes big because you know what you are doing. No magic exist.

</comment><comment><USER21> Of course as all questions related to development, the answer is definitely "It depends."

That's also why there are so much alternatives of MV(VM|C) platforms out there.

You can ask yourself a couple of questions when you start your project that will help you what framework will best fit you :

1\. Is it a huge single-page app that needs client-side url handling?

2\. Do you have plenty of DOM manipulation?

3\. Are you going to have a REST API backend?

4\. Do you plan to support IE <9 or you want the cutting edge?

5\. Do you plan to use jQuery or plain ("vanilla") javascript will be your DOM manipulating library? ( Actually this one is also a question that should be answered, considering your application requirements ).

When answering all of those you can have a second round of questions :

1\. What you and your team are experienced in.

2\. What is the current market of developers and the popularity of your framework? ( people that have experience with Knockout are less than Backbone experienced ones - e.g. ).

That will give you not only the best alternative framework to Angular, but the right framework for your project.

</comment><comment><USER22> "AngularJS 2.0 itself will be written with AtScript, but then transpiled to ES5. You can write your AngularJS 2.0 app with ES5, ES6, AtScript, CoffeeScript, TypeScript, etc. Angular 2.0 apps will run in today's browsers, and even better as ES6 features land"

</comment><comment><USER23> We've decided to go with React + Flux. Using Flux and CommonJS (since react plays well with it) allowed us to split all our code into small npm modules that do one and only one thing. Never had easier time managing client-side app code and a bunch of collaborating developers.

</comment><comment><USER24> You're asking two different questions:

1) What is the best alternative to Angular?

2) What should developers invest their resources and time in?

For 1), like drinchev says, it heavily depends on your usecase. If you're making a 'regular' website i would opt for plain old backend HTML rendering combined with simple Javascript and maybe a bit of jQuery. But if you're making a 'webapp' that's very dynamic, a framework like Angular or React might be a better option.

Considering question 2): invest your time in learning Javascript, and whatever language you think might be useful. It's good to know as many frameworks as possible, but in the end language knowledge is far more useful than framework- specific knowledge.

</comment><comment><USER25> If you don't mind straying off the beaten track, you should try Nadeshiko. It's available for both Ruby and Go. Be warned that it's still a work-in- progress.

[https://github.com/kirillrdy/nadeshiko](https://github.com/kirillrdy/nadeshiko)

[https://github.com/kirillrdy/nadeshiko- ruby](https://github.com/kirillrdy/nadeshiko-ruby)

[https://github.com/kirillrdy/nadeshiko- examples](https://github.com/kirillrdy/nadeshiko-examples)

</comment><comment><USER26> Ractive [1] is like React but simpler IME. I prefer tools that do one thing well.

[1] [http://www.ractivejs.org/](http://www.ractivejs.org/)

</comment><comment><USER27> A combo of Backbone.Marionette (composite app architecture) and Backbone.Stickit (data binding) has served me well for the past 2 years. Also, while Marionette is under active development, the core team has a policy of breaking deprecated features out into separate libraries that can be mixed into your existing project if you want to stay current with updates.

</comment><comment><USER28> You might check the comments at [https://news.ycombinator.com/item?id=8679245](https://news.ycombinator.com/item?id=8679245) for alternatives (React, for example, seems to be gaining mindshare), but this may also be a good time to reflect on the broader implications (as many are doing there as well).

<comment><USER12> Do note that React is just a view library; you'll need something like Flux or your own framework or library of choice to actually make an application with it.

<comment><USER29> I respectfully disagree. You'd need flux when you have too many stores talking to each other. Not every app becomes complicated enough to warrant that. You can get started with using an EventEmitter based Store and later refactor into actions and dispatchers if required.

And React is not just the 'V' in MVC. I've seen everyone repeating it (including the official docs), and I'm still not sure what it is trying to say. I wrote about it in a previous comment: [https://news.ycombinator.com/item?id=8653517](https://news.ycombinator.com/item?id=8653517)

</comment></comment></comment><comment><USER30> I have just gotten started with meteor.js and I am liking it. I find the documentation to be lacking (or maybe I have not found the documentation everyone else uses), and there is probably just as much 'magic' going on as angular, but I like that the framework as a whole has more features, i.e. the cli or deployments.

</comment><comment><USER31> I'm in the same boat and am curious, how is Dart and Polymer.dart? I watched a few videos from Google I/O, etc. and am really impressed with how much more sane Dart seems to make the frontend development world. Anyone gone down the path of Dart & Polymer.dart and had any major regrets?

</comment><comment><USER32> I speak not from a position of technical experience but a position of monitoring the ebbs and flows of the community and React with the Flux architecture certainly seems to be in the ascendant.

</comment><comment><USER33> [http://paperclipjs.com/](http://paperclipjs.com/) is nice as well, which is an even more boiled down version of vuejs

</comment><comment><USER34> [http://www.fse.guru/how-to-pick-a-frontend-web- framework](http://www.fse.guru/how-to-pick-a-frontend-web-framework)

<comment><USER35> That's one person's opinion. There are no reasons for his picks and they are not backed by any research among developers.

</comment></comment><comment><USER36> Ractive.js for the components, Backbone for Model/Collections, Router etc.

</comment><comment><USER37> I've been really enjoying Ampersand: ampersandjs.com

</comment><comment><USER38> Knockout.js?

</comment><comment><USER39> meteor and espresso.js are nice. react is cool.

</comment><comment><USER40> Not using client-side scripting

<comment><USER41> That makes about as much sense as "not using server-side scripting."

Personally, I have had great experiences building purely client-side rendered apps, with DB and other APIs exposed to the client via REST. I now consider HTML generation on the server (with separate rendering logic from the client) to be an antipattern -- done right, the same rendering logic should be usable on the client and server, and can prevent whole classes of bugs and frustration.

<comment><USER40> You make me very sad.

</comment></comment></comment><comment><USER42> The alternative for Angular framework is not using a framework.

As long as you keep tying yourself to a framework, you will encounter the same situation as Angular 1.0.

Don't do it.

Just pick libraries that does one thing well and wire them together yourself.

<comment><USER12> So you're suggesting to go back to the PHP era where everyone else was writing their own framework? Okay so yeah there's some good libraries out there that will make things easier, but you - and many others - are still telling people to basically write their own framework.

If that's not going to cause fragmentation and headaches for other developers that need to work on that project, I don't know what will.</comment></comment>


Show HN: Fursona Editor - <AUTHOR> https://fursona.app <comment><USER2> I never expected the day would come when an AI to generate furries would be the top entry on HN.

<comment><USER3> You underestimate the number of furries in tech.

<comment><USER4> It would have been wurst Edit: damn, edited

</comment></comment></comment><comment><USER5> This redirects to [https://colab.research.google.com/](https://colab.research.google.com/) \- you are identified by your google account (if any).

Perhaps we could change the URL?

<comment><USER6> It redirects to there because colab can be used to run the model.

You can visit the url in a private window and download the notebook without using google.

</comment></comment><comment><AUTHOR> Sit tight. Colab blocked the notebook without explanation for some reason. Working on updating the main URL to forward to the new notebook.

Here's a link to a working notebook: [https://colab.research.google.com/drive/1O5XbpMRU9i83mLAiTrM...](https://colab.research.google.com/drive/1O5XbpMRU9i83mLAiTrMufCqmImgTRI7A?usp=sharing)

<comment><USER7> HTTP status 569: Awoo Limit Exceeded

</comment></comment><comment><USER8> Not what I expected when I saw the title "Show HN: Fursona Editor". This is really cool. It kinda feels like sophisticated art theft in a way, but by that line of thinking you could argue that all creation of art is sophisticated art theft.

<comment><USER6> I think it's a transformative work (in both the literal and the figurative sense).

</comment></comment><comment><USER9> Notebook loading error There was an error loading this notebook. Ensure that the file is accessible and try again. Error loading [https://apis.google.com/js/client.js](https://apis.google.com/js/client.js)

[https://drive.google.com/drive/?action=locate&id=1h-y-- ip8qr...](https://drive.google.com/drive/?action=locate&id=1h-y-- ip8qrIc4RRG5aA-DJHHujYR0SLa&authuser=0) Error loading [https://apis.google.com/js/client.js](https://apis.google.com/js/client.js) Error: Error loading [https://apis.google.com/js/client.js](https://apis.google.com/js/client.js) at HTMLScriptElement.k.onerror ([https://colab.research.google.com/v2/external/gapi_loader.js...](https://colab.research.google.com/v2/external/gapi_loader.js:14:415))

</comment><comment><USER10> Is this anything but another "this face is not real" clone, i.e same model just different training set?

<comment><USER11> The "This Fursona Does Not Exist" site is such a clone, this is an interactive editor for exploring the latent space in that dataset.

<comment><USER12> Using the new Ganspace tool to find useful directions in said latent space, as well, rather than bootstrapping from linear variations or classifiers.

But 'just another generator' is a very "Dropbox is just rsync" sort of middlebrow HN dismissal. It takes a lot to make a model and site like TFDNE.

Here's just a very brief summary, skipping over lots of problems along the way. To make it, Arfa had to scrape all of e621. Then he had to hand-annotate several thousand images with the eyes/mouth/face bounding boxes to train a YOLO NN to detect faces, allowing him to crop them out of e621 as a whole. Because he did facial landmarks, he could align the eyes/mouth to the center of the image like FFHQ, throwing out weird faces. This data cleaning gives much higher face quality. Then with the cropped faces, he trained StyleGAN 2 to convergence on a TPU pod acquired through TFRC. (The StyleGAN 2 codebase does _not_ remotely support TPUs, or TPU pods, but Shawn Presser had spent a month adding support and debugging it and setting up infrastructure letting Arfa iterate on S2.) After experimenting with various levels of data cleaning and attempting conditional StyleGANs, he picked a final model, and generated 100k images. These images were then upscaled with waifu2x (itself increasingly a challenge to install since it uses Torch - the original, not PyTorch). Also, about 10k were generated with different psi settings to create 'weird' faces, since we knew from TWDNE how very much people enjoy weird and failed faces. Then a Hetzner dedicated server had to be set up to host it (GCP cloud bandwidth being ruinously more expensive by a factor of ~100). Arfa reused These Waifus Do Not Exist, but worked with the original maintainer to improve scroll control and optimize depiction. That just gets you a static website, of course. But once launched, he had to deal with an onslaught of criticisms and falsified DMCAs or accusations of plagiarism. Fortunately, that's over. But how do you edit? You can't just use a raw StyleGAN model. To enable editing even in a Colab notebook, you have to figure out what combinations of latent vectors do what. That requires setting up Ganspace and exploring hundreds of combinations that Ganspace deduces, in order to find interesting ones and play with them until you figure out what it 'means' and can give it a human- meaningful label. Then all of this has to be cleaned up, hosted, and turned into a usable Colab notebook. But wait, there's more! Apparently Google Colab will just disable notebooks for no apparent reason! So now he has to change the domain to redirect to a new (working?) notebook... And so on.

</comment></comment></comment><comment><USER13> So this generates cartoon character or something?

<comment><AUTHOR> Something like that.

<comment><USER13> Why are they only animals?

<comment><USER14> Fursona refers to "furry persona", I guess, and furries are described here:

[https://en.wikipedia.org/wiki/Furry_fandom](https://en.wikipedia.org/wiki/Furry_fandom)

<comment><USER13> Oh, thanks. That's... something else.

</comment></comment></comment></comment></comment><comment><USER15> I would like to know more about how the different options are selected. How do we know how to tune something like "fur color" in styleGAN? Can arbitrary options be added?

I'm very interested in all this, but still pretty new to machine learning in general.

</comment><comment><USER16> _> Click "Open in Playground" above (if you see that option)_

I don't see any button?

<comment><USER8> You should be able to click Runtime > Run all, or Ctrl+F9

<comment><USER17> It says that's disabled for shared playbooks. I guess you can step through it, haven't tried.

</comment></comment></comment><comment><USER18> I think I will forbear clicking any links on this page from work :)</comment>


About size_t and ptrdiff_t - PVS-Studio https://medium.com/@CPP_Coder/about-size-t-and-ptrdiff-t-a1654234d842 <comment><AUTHOR> This may be practically correct, but is semantically very very wrong.

size_t represents the size of objects in memory. So of course it scales with virtual memory space.

ssize_t is like size_t (same width), but signed. It's useful for routines that want to return a size_t or error (network routines like send/recv).

ptrdiff_t is specifically for the result of subtracting one pointer from another. Obviously it scales with pointer size as well.

<comment><USER2> ssize_t isn't standard C so it doesn't get you very far for portability.

<comment><USER3> POSIX gets you pretty far.

</comment></comment></comment><comment><USER4> Why do you need a "ptrdiff_t" type, why isn't "size_t" sufficient?

<comment><USER5> Also, why use the signed ptrdiff_t for a loop index that is never negative?

<comment><USER6> "size_t can store a pointer, it is better to use another unsinged integer type uintptr_t for that purpose " So he is actually recommending the unsigned version. Although there are some people (like the Google guidelines for C++) that recommend not using unsigned types because of overflows (which is arguable but it is a point)

</comment></comment></comment><comment><USER7> Let me enumerate the worst errors in this article.

1\. Their "headline" recommendation near the start is that you should write things like for (ptrdiff_t i=0; i<...; ++i) { ... a[i]; ... }. No, for this purpose you should almost certainly be using size_t rather than ptrdiff_t. The article nowhere gives any reason for preferring ptrdiff_t to size_t in this context. (There might be some; e.g., if you're processing that array in reverse order, you might want to test whether i>=0, and that won't give useful results if i is of an unsigned type. But you won't learn that from the article.)

2\. The article claims that size_t and uintptr_t are synonyms, and likewise for ptrdiff_t and intptr_t. I dare say in practice they're always equivalent types, but they certainly don't _mean_ the same thing and encouraging readers to think they do is a bad idea.

3\. Similarly, the article says that a size_t or ptrdiff_t "can store a pointer". There are -- as the article admits -- integral types actually guaranteed to be usable in this way, namely intptr_t and uintptr_t. There is no guarantee that you can do that with size_t or ptrdiff_t, and no good reason why you should try.

4\. The article says that ptrdiff_t "could store the maximum size of a theoretically possible array of any type". No, that would be size_t.

5\. The article lists things that size_t and ptrdiff_t are "usually used for". The difference between the two lists is that the one for ptrdiff_t includes "size storage", which is exactly backwards. (You'd think the name size_t might be a clue.)

6\. Those lists include, in both cases, "storing pointers". No: use pointer types for storing pointers, and if you really truly need to force them into integral types then use intptr_t or uintptr_t.

7\. In the second example of a "sleeping error" \-- the one with variables A and B -- the more fundamental problem isn't the failure to use size_t/ptrdiff_t, it's the fact that the expression A+B is of an unsigned type but is being used to hold a negative array offset. It's true that using size_t instead of unsigned will probably make the error go away, but the _right_ way to make it go away is never to have the equivalent of ((unsigned)-2) in your code to begin with. You want a signed type for that, and int will do just as well as ptrdiff_t.

8\. The final section of the article makes it clear that its real goal is to convince developers that (1) we should use size_t and ptrdiff_t if we care at all about portability and future-proofing, but (2) converting code to do so is too painful for human beings, so (3) you should buy their product.

It's maybe a bit unfair to classify that as an "error", but I don't think I would want to entrust static analysis of integer-type issues to software written by someone who could write this article.

</comment><comment><USER8> Nitpicks:

"ptrdiff_t type...ptrdiff_t will take 32 bits, on a 64-bit one 64 bits" \-- that's not really true as that would made it equivalent to size_t. So in reality its 31 bits and 63 bits.

<comment><USER7> Nope. It's 32 and 64, but it's a signed type (which is why it isn't equivalent to size_t). The range of possible values is still of size 2^32 or 2^64, it's just centred at 0.

[EDITED to add: Having said which, the above isn't really any wronger than the OP which is full of mistakes.]

<comment><USER8> What I meant to say is that the text for size_t and ptrdiff_t are identical, implying that the underlying types are identical. That is there is logical fallacy.

They author states "The type's size is chosen so that it could store the maximum size of a theoretically possible array of any type" and the same is said for ptrdiff_t, which is quit confusing.

Now I realise that in reality they both use 64 bits, it is somewhat strange to use the same text for both.

<comment><USER7> Yeah, the article is just terrible, and when it says a ptrdiff_t can store the size of any object it's completely wrong.</comment></comment></comment></comment>


Craigslist updates UI to search multiple neighborhoods at once - <AUTHOR> http://sfbay.craigslist.org/search/apa/sfc?query=&bedrooms=&nh=110&nh=15&nh=18

<comment><AUTHOR> They did something genuinely useful without taking away from the minimal experience.</comment>


Linguistic Analysis Says Newsweek Named The Wrong Man As Bitcoin's Creator - <AUTHOR> http://www.forbes.com/sites/matthewherper/2014/03/10/data-analysis-says-newsweek-named-the-wrong-man-as-bitcoins-creator/ <comment><USER2> We're talking about a man who doesn't have the Internet at his home (but uses public library computers), a home who writes this kind of email ([http://i.imgur.com/DB4oq5s.png](http://i.imgur.com/DB4oq5s.png)), a man with no previous experience with cryptography or economics theory, a man who stated:

 _" I have never communicated with bitcoins"._

Did this man create the first distributed digital cryptocurrency? No. Instead, here's what happened: Newsweek senior writer Leah McGrath Goodman went scouring a database that contained the registration cards of naturalized U.S. citizens (for the record, Nakamoto is the ~400th most common Japanese name). "A Satoshi Nakamoto" then turned up who had a physics/engineering background. She interviewed the man's family, fabricated a few quotes implying involvement with Bitcoin (or took the quotes out of context, which is equivalent), and published a clickbait story destroying the man's privacy.

That's it.

<comment><USER3> Pretty damning indictment of Newsweek if this is what passes for "investigative journalism" there.

<comment><USER2> We're talking about Newsweek here.

Remember the "Heaven is real!" cover? ([https://ksj.mit.edu/tracker/2012/10/heaven-real-doctors- expe...](https://ksj.mit.edu/tracker/2012/10/heaven-real-doctors-experience- afterlife))

Remember "The Fall of France"? ([http://www.huffingtonpost.com/anne- sinclair/france-newsweek-...](http://www.huffingtonpost.com/anne- sinclair/france-newsweek-article_b_4550066.html))

</comment></comment></comment><comment><USER4> The Cuckoo's Calling was identified as being Rowling's work due to the fact her lawyer leaked it, the fact this analyst is claiming credit for it (but is carefully worded to allow for multiple readings) doesn't give me a lot of confidence in their ability.

<comment><USER5> Yes, still, someone could leak "Book X is by Author A" regardless of it being true.

The main issue are the candidates. However, I believe that for this type of analysis exclusion of a certain candidate is much more reliable than finding the one who did it (as the article exemplifies)

</comment></comment><comment><USER6> There was a recent episode of House of Cards where the protagonists were exposed in the media over something. They came up with a false cover story, but they also deliberately bungled their response (asked another party to deny the claims completely, then somewhat contracted them in their own statement). The reasoning was that people would smell a cover up if everything was too neat.

I wonder if Dorian Satoshi used the same tactic. Once a journalist discovers him, he tacitly admits to being the Bitcoiner, then in his next public statement retracts this and says it was a misunderstanding. Now everyone's going about saying the real Satoshi would never have responded to the journalist like that.

Probably not but arguably it would be the best way to handle the situation if you wanted the story to blow over.

<comment><USER7> Given that he did at first admit to being previously involved, you just might be on to something..

<comment><USER8> His "admission" was very, very weak.

        "I am no longer involved in that and I cannot discuss it," he says, dismissing all further queries with a swat of his left hand. "It's been turned over to other people. They are in charge of it now. I no longer have any connection."

For all we know he was confused and thought she was talking about his previous, possibly classified, work.

<comment><USER9> Or the reporter was talking about his previous work, and took the quote completely out of context. Or the reporter was told to deliver the story, and just plain lied. Have you ever dealt with an actual reporter?

<comment><USER10> It's well-known that journalists get things wrong, but to outright swap the referent of a pronoun for a completely different one? Is that typical for reporters?

<comment><USER9> Far as I can tell.

</comment></comment></comment></comment></comment></comment><comment><USER11> What terrible UI on that website. I think in 2014 we know how to scroll already and don't need a full page pop-over to explain it.

<comment><USER12> I think Forbes recently rolled out their endless scroll to get recent with web UI standards. They're softening the blow to their less tech savvy users.

<comment><USER13> You can't document your way out of UI mess, so it's still failure on their side.

</comment></comment></comment><comment><USER14> Does anyone knows enough about the stylometry to judge if letters to editors and a letter to a local government can really be compared to a white paper? It seems to me that in tones, style and vocabulary, these are very different format which would not yield good result.

Has the expert actually ever tried his technique to infer the author of a white paper based on sample of correspondence?

<comment><USER15> I don't know about "stylometry", but textual analysis is definitely a field that is grounded in statistics and probability.

And here's an excellent textual analysis of Satoshi's writing -- really quite convincing: [https://likeinamirror.wordpress.com/2013/12/01/satoshi- nakam...](https://likeinamirror.wordpress.com/2013/12/01/satoshi-nakamoto-is- probably-nick-szabo/)

The verdict? Nick Szabo, a professor of computer science at GWU and trained attorney, with significant expertise in the digital economy and smart contracts. He's got a fascinating blog at: [http://szabo.best.vwh.net/](http://szabo.best.vwh.net/)

To be honest, I was convinced by this particular analysis back in December, but I haven't been passing it around because I respected Satoshi's desire for anonymity. However, now that an innocent man is being hounded and harassed, I think it's about time that the creator step up and claim his creation. We also need to know what happened to the Satoshi stash for this amazing project to move forward with greater certainty.

So I would encourage the real Satoshi to step up. I'm not at all convinced that Dorian Nakamoto -- albeit a pretty fascinating man -- is actually the creator of Bitcoin.

<comment><USER16> It's a weak tie between Szabo and Satoshi. Both write in cryptographer/academic/cypherpunk style. That's true of plenty of other likely Satoshis. Most of the specific phrases which link the two are fairly standard phrases within the community.

I do think Szabo is in a top-100 list of Satoshi candidates, and the most damning linkage is Satoshi's failure to cite Szabo, but it's far from conclusive.

<comment><USER15> Yes, but there are a few other things that I'm thinking about writing about. They may not implicate Szabo conclusively, but it's pretty clear (to me, at least) that Satoshi is an academic. In any case, it's not Dorian Nakamoto. I'm sorry he's having to endure this scrutiny (especially after what he and his family went through during WWII).

<comment><USER16> It could easily be an academic who is outside academia (e.g. Zooko), or a team of academic + non-academic.

</comment></comment></comment></comment></comment><comment><USER17> Her twitter posts at the bottom take the Newsweek reporter's credibility even lower if you ask me. A lot of people would have loved to talk with you pre- story, lady!

<comment><USER18> She doesn't come off well in those comments, but neither does the Forbes writer. Journalistic etiquette and best practice is to ask someone for comment if you're going to be writing about her. Ideally, you should make that attempt in earnest and in advance.

If, as alleged, he emailed her at 10:50pm the night before he went to press -- and then said "she could not be reached for comment" and/or "she did not respond" \-- he was being either lazy or disingenuous in that regard.

Her Twitter comments make her sound petty, but at least one of her complaints seems legitimate. She felt that she got railroaded here.

<comment><USER19> Welcome to pageview journalism. There is no etiquette, accuracy doesn't matter. Pageviews do.

In the past if you published crap you lost the high quality advertisers. Now advertisers just go where the audience is, like the Huffington Post and Business Insider. In other words, all journalists are gossip columnists now. Even better if they wrote for free.

<comment><USER18> There's certainly been a trend towards optimizing for pageviews and clickbait above all other considerations. That trend has had a horrendous effect on the average quality of journalism in this country, by dint of the brutal economics of pageview advertising. (In recent years, focus has shifted away from pageviews and toward shares, engagement, etc. But it's mostly the same shit, different day: pay writers as little as possible, crank out heavy volume, bait people with headlines, weave vanity metrics into ad dollars.)

But I see a bright spot in all of this. In a sea of crap, good content might glimmer on the surface, wherever it appears. There's been a serious backlash among the tech and journalism communities against content farms and clickbait. People are, once again, experimenting with quality. Whether quality will be able to last depends on whether anyone can figure out how to make money from quality, and that's the unfortunate truth of the matter. Meanwhile, content farming is a gravity well that seems to suck every new publication down into oblivion, slowly but inevitably. A tweak here, an optimization there, a formula plied and followed, and before you know it, you're writing emotionally manipulative headlines and minimizing costs (and quality), like everyone else. But wow, look at those shares and pageviews! :)

I guess I still have hope. Otherwise I wouldn't be involved in journalism right now. For my part: I don't trade in gossip. I don't write clickbait (though typically, and depending on the publication, I don't have editorial control over my headlines or promotional copy). I try to be interesting. I try to be thoughtful. I try to have standards. I have yet to make a serious living as a writer, and until that changes, writing will remain a part-time gig. But I'm an optimist.

I suspect that whoever figures out how to monetize quality writing will do it by reaching back to first principles, rethinking the idea of publishing altogether. Trying to prop up a digital business on the scaffolding of a centuries-old business model makes no sense.

</comment></comment></comment></comment><comment><USER20> "Linguistic analysis" and...pretty much every facet of evidence there is. Newsweek is such a joke.

</comment><comment><USER21> As a linguist and computer nerd I can't read articles like this without shouting inside my own head "NLP with no open source code is not NLP!" and then I can never trust the person again, like the author of this... analysis, so even if he's nailed it, and it's really Satoshi, to me it would be just a struck of luck and not a linguistic discovery per se IMHO.

<comment><USER22> Using a non-trivial computer program to conduct research and not disclosing the source is basically like leaving the Methods section of a paper blank. The code could literally be doing anything, regardless of what the author _claims_ it does. They don't even need to release it under a free license- just show it.

</comment></comment><comment><USER23> Would Dorian Nakamoto's writing style still be identifiable if he had the Bitcoin paper professionally edited? If he had that done on-line, it would have cost very little.

<comment><USER24> Who has other people edit their tex files...

<comment><USER25> It is pretty easy. If the editor works in word then you copy the tex and past it into word. Then tell the editor to not mess with the funny symbols and images etc. Use track changes and reject any changes that would mess up the tex.

Then just compile the tex to enjoy a beautiful laid out and professionally edited document.

</comment></comment></comment><comment><USER26> A new plan:

1) Invent a disruptive technology that threatens the foundations of governments and traditional currencies.

2) Deliberately create a corpus of writing that doesn't look like your natural writing style to linguistic analysis.

3) Have a confederate arrange to have the press "discover" you hiding "in plain sight."

4) Someone "debunks" the discovery through linguistic analysis and you get away scott free.

<comment><USER27> 1) Invent a disruptive technology that threatens the foundations of governments and traditional currencies.

2) Upload the idea at a semi-random time in the future, from a random location in a randomly chosen country, over a public network, using a computer bought with cash from a randomly chosen store. Have that computer link to it from as many places as possible.

3) Never speak about it.

\</comment></comment><comment></comment><comment>-

If a highly weight goal of yours is not being found, then you limit your interactions, since you know that you'll leak information whenever you interact with something. And you randomise as many data points as you can think of that someone might correlate with you.

Then again, Satoshi obviously isn't doing 3 - assuming the Satoshi persona is the person who invented it.

</comment><comment><USER28> The real Satoshi would have thought of linguistic analysis and taken appropriate action during his writing.

<comment><USER29> But is the "real Satoshi" a true Scotsman?

<comment><USER30> The real Satoshi is obviously Japanese and thus would have a katana available at all times.

[http://www.xkcd.com/225/](http://www.xkcd.com/225/)

</comment></comment></comment><comment><USER31> Linguistic analysis isn't a field I particularly trust. If they were analyzing his Reddit posts, I'd find that potentially an issue. People post quite differently on Reddit.

<comment><USER32> And a true paranoid could fake styles.

<comment><USER33> And would not use his real name.

<comment><USER32> I wonder if that was an accident that he couldn't back out of. A programming game that turned into, "Holy sh*t, this might go somewhere" but it was too late to turn into a synonym.

</comment></comment></comment></comment><comment><USER34> Maybe the author of bitcoin used the name Satoshi Nakamoto because he knew that journalists would find Dorian Nakamoto?

</comment><comment><USER35> Personally I hope we never find Satoshi. Chuck Norris was getting old anyway...

</comment><comment><USER36> I do not think it is him.

<comment><USER37> why

<comment><USER37> did I really get a downvote for asking why? wow. tough crowd.

<comment><USER38> People here can be picky about things like sentences, capitalization, and punctuation. Try asking "Why?" instead.

<comment><USER30> Personally, I'd go ask _why.

<comment><USER39> HN also doesn't like jokes.

<comment><USER30> Eh. My goal for karma is 666. Unfortunately, I seem to make a lot of good points.</comment></comment></comment></comment></comment></comment></comment>


Show HN: Pseudo3d old school racing game made with pure JavaScript - <AUTHOR> http://wagnerandrade.github.io/old-school-racing/

<comment><USER2> Very nice, but please don't rely on keys like 'y' being on a certain position on the keyboard – on my German keyboard, for example, it's where the US's 'z' is. Other keyboard layouts are even more different.

If you can't access the _physical_ layout of your keyboard (and using javascript, I'm not sure you can), using the arrow keys for all navigational things is really the best option.

<comment><USER3> This one should be safe for German keyboards, it only uses A and Z as far as I see.

For French keyboards, the common WASD layout is completely broken, but this game manages to stay quite usable since it's just two keys.

</comment></comment><comment><USER4> It runs very slowly for me, but the render quality is also very good for a road engine. I don't think I've seen one that shows such an enormous draw distance before.

</comment><comment><USER5> Very nicely done! I love these kinds of hacks :)

A small suggestion - can you make the camera smoother? It's a bit jarring when it's going right and it suddenly starts going left.

<comment><AUTHOR> Really, I felt it. I need to work in this kind of detail to get a better experience. This is the first prototype. Thanks!

</comment></comment><comment><USER6> Doesn't load for me:

        [blocked] The page at 'https://wagnerandrade.github.io/old-school-racing/' was loaded over HTTPS, but ran insecure content from 'http://github.com/wagnerandrade/old-school-racing/releases/download/0.0.1/old-school-racing.js': this content should also be loaded over HTTPS.
     wagnerandrade.github.io/:1
        Uncaught ReferenceError: Track is not defined (index):32

<comment> TD-Linux Load it with normal http, not https.

<comment><USER6> Does not work, github.io always redirects to https.

<comment><USER7> I suspect you have installed something like the 'HTTPS Everywhere' extension, which is doing that redirection to https for you. github.io certainly doesn't do it by itself.

</comment></comment></comment></comment><comment><USER8> also, [http://js1k.com/2010-first/demo/778](http://js1k.com/2010-first/demo/778)

</comment><comment><USER9> I love being able to drive in reverse at 300km/h.

<comment><USER10> This is a feature of Big Rigs, the "Best game ever."

[http://youtu.be/sVREUuuNIgg](http://youtu.be/sVREUuuNIgg)

<comment><USER11> Technically there's no upper bound on the reverse speed in that game. A curious decision.

<comment><USER12> "decision", heh!

<comment><AUTHOR> Obviously that it's a decision! :D Think that it's a tribute to Big Rigs... Hehehe...

</comment></comment></comment></comment></comment><comment><USER13> Reminds me a lot of Rad Racer on NES - nicely done!</comment>