Package Management: The problem with using version ranges - <AUTHOR> https://www.lucidchart.com/techblog/2017/03/15/package-management-stop-using-version-ranges <comment><USER2> Please note: I can speak only for the Node.js npm/Yarn ecosystem.

This article is terribly outdated. Version ranges are great and the only way to manage correctly your dependencies without having tons of duplicates. Also they are a security guarantee, because with them you can get security fixes "automatically".

Yet there have been problems, that's why both Yarn and npm@5 implement a lock file which gives you all the guarantees of a range-less package management with the power of a range-based dependency tree.

If module developers following this (IMHO not lucid) article start bundling specific versions in their npm packages everyone will suffer. It's as stupid as it get.

Please, do your research before calling out on practices.

<comment><USER3> Getting security fixes automatically is not a good thing.

Too many open source projects fail to ensure non-breaking changes or long term support of multiple release versions.

So either you rely on greatest(>) that has no guarantees to not break and not just patches (~), you try patches and a new release is effectively end of support or you rely on greatest, fail to do a regular audit and realise the dependency is no longer in active development and will receive any updates (which upon typical discovery would require a change of dependency used).

Security isn't just about vulnerability, and I don't like to ask it (because it isn't universal), but is not a risk of system failure often worse than a risk of system vulnerability? It depends somewhat on how critical the system is and defaulting to explicit versions instead of latest is probably a better practice in my opinion.

I've done development using NodeJs and on the JVM and found I had far fewer problems with Java dependency management.

<comment><USER4> > Too many open source projects fail to ensure non-breaking changes or long > term support of multiple release versions.

Relying on those projects is not a good thing.

<comment><USER5> When such big names as Gnome can't pull it off, then what projects can one rely on?

<comment><USER6> For example React doesn't ever introduce breaking change by surprise.

<comment><USER7> I think that should be qualified with "intentionally". Angular is supposed to be following semver but often has "regressions" in point releases which they fix in a following point release. Usually fairly quickly but it is still not guaranteed.

</comment></comment></comment></comment></comment></comment><comment><USER8> Yet another package management "advice" article from the point-of-view of a developer and not a maintainer.

You try maintaining an ecosystem where every dependency constraint is a hard specific version. You'll spend 80% of your time fiddling with bumping versions. Fuck that shit.

<comment><USER9> Well, someone has to do the work.

But version pinning is probably the best way at the moment.

This way the maintainers can use ranges and the developers can pin what they really need in the end-product.

There are more developers than maintainers, so this scales much better.

<comment><USER10> > There are more developers than maintainers, so this scales much better.

Wrong comparison. The majority of software is built, deployed, maintained and used by entirely different organizations over years.

Companies doing end-to-end CD and running their software only internally are the minority.

This kind of bad practices from few developers turns into countless hours of work to maintain systems years later.

</comment></comment></comment><comment><USER11> Paul Draper from TFA totally ignored the perspective of a packager.

It would be a completely unacceptable situation for application A1 to depend on DB abstraction library v0.8651, A2 on v0.8653, A3 on v0.8670, A4 on v0.87…

How do you ship this to your distro users? Almost always there is no easy way to install several libraries of the same name but different versions in parallel, and it's never supported by the distro auto-packaging tools.

Patching to use the latest version of the dependencies and verifying the patched version works ok is a huge burden on package maintainers. The application author knows the code much better!

The current solution of specifying minimum versions of dependencies exists not because we like the suffering caused by occasional breakage. No, it exists because it is a practical, working solution for the real world that is the best balanced trade-off.

<comment><USER12> The problem is that nobody really tests all the versions they specify in a dependency list. They just install the dependencies, and if everything works, commit the file.

In PHP we usually have a version range in libraries' dependencies and lock file that specifies exact dependency versions for the entire application. So you can be sure that you get tested combinantion of libraries.

<comment><USER10> > The problem is that nobody really tests all the versions they specify in a > dependency list

Some do. Some others target the versions shipped in a stable Linux distribution.

And even if the upstream don't test some combinations of versions, distributions will test what they ship.

<comment><USER12> > Some do.

How can they check future versions of libraries that will match the range?

</comment></comment></comment></comment><comment><USER13> In npm all packages have their own dependencies so specifying a specific version sort of works. In Maven for example the dependency tree is flattened by the package manager so that at runtime there can only be a single version of libA. This is just how Java 8 and below works, you simply cannot import two versions of com.example.Foo at the same time. This will change in Java 9 with Jigsaw though. OSGi was a way to workaround this problem in <= Java 8. npm also has a "flattening" feature to save disk space but this is a completely different thing, an implementation detail that is never visible to the packages themselves.

<comment><USER14> Just want to point out that Jigsaw/Java 9 will not support multiple versions out-of-the-box. (disclosure: I'm currently authoring Java 9 Modularity for O'Reilly)

</comment></comment><comment><USER15> I can only imagine the amount of new version conflicts that this would generate (I've already seen more than I'd like) if we would no longer go "1.8.0 has a feature that we depend on, so 1.8.0 and newer". Every time every dependency gets an update, every dependent package would need updating too (or at least its metadata). Hell no.

Perhaps go for a range + last tested version, e.g. "1.9.7 worked" so when 2.0 comes out and breaks, you know what to use instead.

<comment><USER2> That's how semver ranges work, in fact saying `^1.3.12` means "I tested for v1.3.12 and I want all non-breaking updates that come afterwards".

<comment><USER16> Well, if you already know which updates are non-breaking, of course you have solved this problem.

<comment><USER15> Indeed.

If you change the output of "ls", you know everything that uses ls will break and you can bump a major version. But if you change e.g. the date format to include a timezone (visible when -l is specified), does such a change really warrant a major version bump? It's just a minor change but it might still break things. Or maybe if you refactor some stuff in curl, the curl-dev package might suddenly be incompatible with something that depended on it.

</comment></comment></comment></comment><comment><USER17> If specific version are used then you can end up with multiple versions of the same dependency which can cause additional problems if they're passed around. In compiled languages you end up with errors like "can't assign typeA to typeA because they are different types", when they are different versions of the same type.

Not sure how node would handle the same type of error but I'm guessing it would involve subtle compatibility issues.

<comment><USER2> You would have no errors except when dependencies expect to be "the only one", in "peer dependency" style.

</comment></comment><comment><USER18> This is right: unless you use exact versions, ideally vendored or cached in a local package server, you do not have even basic reproducibility.

However.

The reason people use ranges is because they don't want to handle the administrative burden of tracking upstream changes and updating their software.

The OWASP Top 10 (2017 draft) shows that using known-vulnerable components is a common security weakness in software. Nobody sets out to do this, but the flipside of having access to massive troves of dependencies is that you have dozens, hundreds, perhaps thousands of dependencies you might not know about.

I've worked on Cloud Foundry Buildpacks. A large amount of effort has gone into exactly this problem: tracking upstream versions, pulling new ones immediately, building them and testing them. But it's at varying levels of sophistication.

For some dependencies, you get structured data. NodeJS publish an index.json file[0] which is fairly trivial to keep up with. But for other sources, which I will leave unnamed, it's necessary to do flaky, unreliable HTML parsing to detect new releases. Data about what's been found so far is kept in a ci- robots[1] repo to ensure atomicity and simplicity (I'd prefer a Concourse resource that emits versions one by one, but that's just me).

What's needed is a uniform way to describe available versions of software packages. Uniform across all the major tributaries of versions: package managers, distributions, the works. If it becomes possible, as Buildpacks have after a great deal of effort, to automate fetching and testing new dependencies, then the need for ranges vanishes. You can rely on your CI/CD to run each dependency change through its paces and update the firmly fixed list for you.

[0] [https://nodejs.org/dist/index.json](https://nodejs.org/dist/index.json)

[1] [https://github.com/cloudfoundry/public-buildpacks-ci- robots](https://github.com/cloudfoundry/public-buildpacks-ci-robots)

</comment><comment><USER19> Something like Haskell Stack fixes a lot of problems with versions but it is not suitable for all situations. It is a lot of work to produce a curated set of packages that work. But most of the time things just work so people work around it the rest of the time.

<comment><USER20> It's not stack but stackage you are referring to.

Stackage puts considerable effort on the whole community to ensure that packages remain compatible, and forces package publishers (developers) to update their packages in a timely manner (otherwise the package will be dropped from the snapshot). That works in the Haskell community, but I'd be hard pressed to believe any javascript developer who has a package on npm.org would put the same amount of effort into keeping it up to date.

<comment><USER19> Package manager is stack and the online repo is hosted at stackage. You manage packages from stackage using stack. You probably can't do it in a larger community like JS or Python because it is too big. Haskell is at the right size to do such things.

<comment><USER20> Not all Haskell packages (those in hackage.org) are in the stackage snapshots. Stackage is opt-in, there must be a maintainer willing to resolve the occasional build failures.

That means there is no such thing as 'too big', because the number of all existing packages in a ecosystem doesn't matter. It's the commitment that counts, and that's what I don't see in the JS community.

</comment></comment></comment></comment><comment><USER21> What I would like to see is support for existing package managers like rpm and deb that could be mirrored from these language repositories (e.g. Python, Ruby, Perl, etc). This would be more difficult for packages that have external language bindings, but a source rpm/deb package could work).

</comment><comment><USER12> PHP's package manager (composer) has a lock file that contains exact versions of packages and can be commited to the filesystem. So we don't have problems with version ranges.

</comment><comment><USER22> It's sad to see many people quoting npm as a good example while version ranging has been mastered by package managers on Linux and earlier Unix systems for decades.

</comment><comment><USER23> there's one solution in the article that's valid: version lock files. these are a must have for any reasonable deployment strategy.

now when you talk about actually developing the software, this is a completely different set of requirements and that one is best served with very coarse grained (but safe) version ranges. different tool for a different use case.

</comment><comment><USER24> I feel like this is describing a solved problem, and what's more, the author knows the solution. Lock files eliminate the issue of mysterious build failures and allow almost trivial creation of automated canary builds to detect problems early.

</comment><comment><USER25> This is about using open version ranges. Closed ranges are slightly less evil, though errors can creep in, too.

<comment><USER2> Very nice point. If you look at all npm examples in the article it shows the _> = M.m.b_ pattern which is never found in the wild. You'll find _~M.m.b_ for VERY old packages and _^M.m.b_ for modern ones (last 4 years). Those let the minor and build increase, but not the major.

</comment></comment><comment><USER26> How come this is not already obvious to everyone?

I completely agree with the article. Version ranges are evil. Avoid them at all cost.

<comment><USER27> One reason is that many developers work with package managers / languages that are INCAPABLE of handling multiple versions of the same dependency. Without this you quickly get version deadlocks without semver.

Another reason is that many developers are obsessing on getting the latest version of their dependencies for fear of security issues or just missing out on the latest and greatest - and they often completely ignore retesting the application since they now have someone to blame if it fails (that other developer should not have pushed the breaking change with a minor version bump!)

I agree with you that it should be the standard to have fixed versions and update your dependencies at a time of your choosing so that everything can get tested properly - but it seems to be an uphill battle.

<comment><USER10> > many developers are obsessing on getting the latest version of their > dependencies for fear of security issues

Getting the latest version is how you get new vulnerabilities.

Various software distributors, including some Linux distros let software bake in for this reason and can be even faster than the upstreams in developing and applying patches to known vulnerabilities.

Also, unfixed but known vulnerabilities are less dangerous: security and system engineers can work around them, also IDS/IPS can detect and often block attacks.</comment></comment></comment>


JDK 8 M7 update - <AUTHOR> http://mail.openjdk.java.net/pipermail/jdk8-dev/2013-May/002419.html

<comment><USER2> does anyone have experience with openjdk on windows? how well does it work for everyday end-users?

<comment><USER3> As of Java 7 openjdk is the basis for the official Oracle release of Java, and constitutes the reference implementation of Java SE. So if you've used any recent JDK release then you've used openjdk.

<comment><USER4> I think there are still some proprietary closed-source bits in the Oracle Java SE releases though.

I'm no expert, but I thought I'd read something to this effect when looking this up recently. (Just in the past couple days.)</comment></comment></comment>


Ask YC: Would you rather work from home or live in office? - <AUTHOR>

This question is for the former & current YC'ers (and other startup founders).
I had this debate with some founders tonight in Cambridge regarding one guy who just moved into town.
Situation: you are a Web 2.0 startup moving to Cambridge from out of state. Would you recommend getting a residential apartment and working from home, or getting an office and sleeping on the couch/cot at night?
I had my opinion, but I'll save it to hear yours first. <comment><USER2> I'd always recommend an apartment for a small startup with little money. Even if you don't live in it, I'd recommend getting an apartment as an office. Apartments are cheaper and nicer to work in. The only advantages of offices are that the can hold more people (not an issue for a young startup) and that they seem more professional. But having a good product is more important than seeming professional, and you're more likely to get one if you work in a good place.

</comment><comment><USER3> _"... Would you recommend getting a residential apartment and working from home, or getting an office and sleeping on the couch/cot at night? ..."_

You mean you get a choice? Apartment every time. Why?

Unless you can get a good office, your apartment is going to be more comfortable, close to the essentials fridge, terminal, bed (not needed if you fall asleep at the terminal) and kitchen. A determinant factor is also access to a internet connection.

Your time is only 3months. By then you will have created something and require a new office. Then again if you do get an office make sure it is just a bit better than home so you (and others) stay there. Read Joels article which comments on Phill Greenspuns, "Managing Software Engineers" ~ <http://www.joelonsoftware.com/news/fog0000000170.html>

</comment><comment><USER4> Get an apartment with your cofounders and set up a "home office", making sure that your office qualifies for the home office tax deduction.

<comment><USER5> Also make sure their aren't zoning or HOA or other restrictions on running a business from a residence.

If you do not have much traffic this may just be a matter of keeping your mouth shut.

</comment></comment><comment><USER6> Get a home office and a third place (<http://en.wikipedia.org/wiki/The_Third_Place>). Having recently left my former employer and taken the plunge, I've found myself strangely having the highest levels of productivity sitting for a few hours at a coffee shop with free Wi-Fi.

</comment><comment><USER7> Not a YC founder (yet, hopefully), but we work from home. Our rooms are separated from our work area though so I don't know if you'll have enough space for that type of situation. No matter what you do, mentally or physically prepare for work (even if it means just brushing your teeth). Also, remember to exercise.</comment>


Top-level domain .design just got released - <AUTHOR> https://twitter.com/Rathbone/status/598161436498464768 <comment><USER2> intelligent.design is taken already..

</comment><comment><USER3> pepsico.design mcdonalds.design generalmotors.design

The explosion of TLDs is just a way to extort money from big companies.

If a designer really wants to promote themselves, they should just put up a ".com" page with the normal kind of white hat SEO.</comment>


Cookie banner frustration to be tackled by EU - <AUTHOR> http://www.bbc.co.uk/news/business-38583001 <comment> open-source-ux > _European Commission vice-president, Andrus Ansip, said it was now proposing > simpler rules, "so that internet users do not have to click on a banner > every time they visit a website"._

If you accept cookies via a banner pop-up, you won't see the banner again until you clear cookies for that site. So what is Andrus Ansip proposing that is different from the way sites already behave?

> _Also, banners would be scrapped for cookies that do not invade users ' > privacy, such as those remembering shopping cart history or counting website > hits._

What is meant by 'invasive privacy'? At some point a user will need to sign in to make their purchase. Is that deemed worthy of a cookie alert since the users' identity has now been established? And what does counting website hits mean? Does that mean any website that includes analytics, no matter how intrusive, is exempt from cookie alerts?

The cookie law may have been well-intentioned but it demonstrates how badly informed, and out-of-touch the EU Commission is on digital matters. When will the Commission actually appoint someone who understands the internet? The current European Commissioner for Digital Economy and Society, Günther Oettinger, had no experience whatsoever of the 'Digital Economy' before he took up the role. It clearly shows.</comment>


Linus Torvalds still wants the Linux desktop - <AUTHOR> http://www.zdnet.com/linus-torvalds-still-wants-the-linux-desktop-7000032805/

<comment><USER2> Whilst I agree that Linux on the desktop isn't a kernel issue, there is one area of the desktop experience that kernel hackers could help improve, and that's the sound stack. Linux could really do with throwing all the existing solutions in the bin and starting with a fresh approach, something that scales from low latency audio production needs to network audio streams. At the moment we have a kludge of different solutions (ALSA, JACK, PulseAudio, probably even have some OSS use out in the wild).

To those that suspect it would be too much work, there's ongoing efforts to improve the graphics stack (DRM/DRI, Wayland, Gallium), I don't see why we can't have the same for audio.</comment>


Ask HN: Alternative to svn diff? - <AUTHOR>

Often I need to work on a remote machine via ssh for work. I have no problem using svn on the command line other than when I need to diff two revisions of a file.
I find the output hard to read and sometimes it just tells me that the entire old file was removed, and the entire new file was added, really giving me no information about what was actually changed.
It would be great if there was some command line tool that would give me a little bit nicer output (something that's easier to read than the traditional pluses and minuses).
Has anyone else encountered this problem and/or found a good solution? <comment><USER2> How about some visual diff tools? It depends on the platform, but there are some really nice ones out there. If you're using Linux, try out meld. This guy has a nice little script for diffing SVN stuff: [http://www.toolsforteams.com/roller/blog/entry/svn_diff_with...](http://www.toolsforteams.com/roller/blog/entry/svn_diff_with_meld)

For Windows, I hear Beyond Compare is great, though I don't know if it has SVN integration...

For Mac, maybe <http://www.versionsapp.com/> does what you need?

</comment><comment><USER3> I personally like to use vimdiff when viewing changes. A quick google shows some easy to follow instructions for setting it up:

[http://blog.tplus1.com/index.php/2007/08/29/how-to-use- vimdi...](http://blog.tplus1.com/index.php/2007/08/29/how-to-use-vimdiff-as- the-subversion-diff-tool/)

<comment><AUTHOR> This looks promising. Unfortunately I can't use any GUI tools because the server doesn't have a GUI installed.

<comment><USER3> Um, vimdiff is a command line tool... I run it in my terminals all the time...

</comment></comment></comment><comment><USER4> Take a look at

      svn help diff

Specifically, you can pass arguments down to diff itself.</comment>


Sensor Tower owns ad blocker and VPN apps that collect user data - <AUTHOR> https://www.buzzfeednews.com/article/craigsilverman/vpn-and-ad-blocking-apps-sensor-tower <comment><USER2> This is literally, one among many reasons (ha!), why I use Firefox. Every other browser vendor is a for-profit entity, and as such will limit good ad- blocking measures as Safari and Chrome have done recently with their new "security" policies.

This is also why I don't use a VPN I don't run (or certainly not one that hasn't been audited with a good reputation), and I certainly would never fucking dream of using a free VPN unless all the traffic over it is absolutely worthless.

... How many of these things install root certs where even after you've canceled your subscription you're still accepting their bullshit?

On the other hand, this could make for a hilarious experiment using adversarial neural networks to troll the assholes mining data from the VPNs.

<comment><USER3> > Every other browser vendor is a for-profit entity, and as such will limit > good ad-blocking measures as Safari

I thought Safari introduced support for Content Blockers _specifically_ to avoid ad blockers from phoning home and passing potentially sensitive information to the ad blocker's writer.

Lots of people then got quite cross that their favourite blocker had been blocked.

<comment><USER4> That is exactly the bullshit they want you to believe. Restricting your ability to install/modify software on your computer because bad software could harm you. You have been bamboozled.

<comment><USER5> ... This entire discussion IS about bad software that DOES harm you, and you rag on the measures to specifically protect against something like that? What the heck?

<comment><USER4> Yes, I'm not saying there is no harmful software, I'm saying these kind of "protections" are the wrong solution. The same people who install blindly any add-ons will also install any exe-files if the promising website tells them to because the browsers add-on-system does not provide the required mechanics.

So the next step is to disallow exe-files. But of course you can let the exe- file get signed for a "small" fee...

<comment><USER6> > The same people who install blindly any add-ons

Like Facebook?

Should installing the Facebook app on your phone allow them to intercept any network requests your web browser makes?

<comment><USER4> Sure, if the app asks for that permission and you allow it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Haha, I quietly called them out few years ago: [https://news.ycombinator.com/item?id=17823292](https://news.ycombinator.com/item?id=17823292)

Their CEO is one shady dude. Evasive. Knew his company was sitting on a shady foundation and just kept it going.

Large companies buy Sensor Tower's data.

<comment><USER8> SimilarWeb is another company with millions of funding that is sitting on a shady foundation as well.

<comment><USER9> Can you elaborate?

<comment><USER8> They own a bunch of chrome extensions that track all the websites you visit and queries you enter into google

</comment></comment></comment></comment><comment><USER10> This is basically a MITM proxy, which I'd say is really _essential_ for true adblocking and content filtering, especially on the locked-down mobile platforms and with the rise of HTTPS. The question is then who runs the proxy and whether you trust them.

I've been doing the same with Proxomitron for years, although in that case I run the proxy, I certainly trust myself, and --- I'm not sure about whether these apps even have such a feature --- I can modify how/what it filters/blocks at any time.

<comment><USER11> It should be entirely possible to run the MITM proxy completely on-device, in which case you don't need to trust anything.

<comment><USER12> How do you block the app from phoning home with the data? You have to trust it not to do that.

<comment><USER13> I use two devices. The first runs a kernel+userland I can edit and acts as the gateway/AP and DNS server for the second, which runs some commercially- motivated, "locked-down" consumer OS.

<comment><USER14> What hardware are you using for the gateway/AP? What's the backhaul, a USB LTE modem? Do you carry it in a handbag with a USB battery pack?

I've been thinking about doing this and scrapping all but one of my data plans, and having a robust default-deny whitelist of allowed IPs/netblocks/hostnames on the phone vlan/ssid, but haven't worked out all the details yet.

How are you doing it?

<comment><USER13> The gateway is a small form-factor computer with a rechargeable battery, e.g., a netbook or laptop. The AP is a SBC that the preferred kernel, e.g., NetBSD, OpenBSD, Linux, etc., supports. The AP draws power from the gateway's battery via USB.

Regarding LTE modems, I do not use a data plan on "locked-down" mobile devices for personal use. Somehow I have been able to survive on WiFi alone.

<comment><USER14> So you carry around a laptop powered on all day when you are out? What about battery life?

I'm looking at something like a raspberry pi zero, using the built in wifi to serve as an AP, powered from a large-ish USB battery pack, something that could run 18h+, with a USB LTE modem. Ideally I could get it small enough to strap to an ankle or something so I don't need to bring a bag.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> > Armando Orozco, an Android analyst for Malwarebytes, said giving root > privileges to an app exposes a user to significant risk.

Root certificate ≠ root privileges

<comment><USER15> It's true for both!

<comment><USER11> It is, but this isn't the first time mainstream news has confused certificates with privileges. (Remember the Facebook VPN thing?)

</comment></comment></comment><comment><USER16> Most of them are using your connection to sell access to residential proxies: oxylabs (NordVPN), luminati (Holla) etc.

<comment><USER17> Good related article, in case anyone still thinks well of NordVPN:

[https://medium.com/@derek./how-is-nordvpn-unblocking- disney-...](https://medium.com/@derek./how-is-nordvpn-unblocking- disney-6c51045dbc30)

<comment><USER18> That article isn't good at all. It jumps to conclusions that are not at all justified.

<comment><USER19> How about this?

[https://medium.com/@xianghangmi/resident-evil- understanding-...](https://medium.com/@xianghangmi/resident-evil- understanding-residential-ip-proxy-as-a-dark-service-dea9010a0e29)

</comment></comment></comment></comment><comment><USER20> Does this break "California Consumer Privacy Act" of 2020?

As far as I now, companies are now legally obligated to give California residents the opportunity to see how their personal information is being tracked, how it's being sold, and how to opt out.

</comment><comment><USER21> I've built more than one VPN network over the years - and I don't use the ones I built. My philosophy has always been that I can't trust the network after I no longer own it - and if the code isn't open.

The hard reality is that you have no way of knowing what's being logged if you don't have full access to the servers. I've always pushed for leaving VPN servers on operating systems running in read-only, on read-only disks, and open to the world (i.e customers who log in). It's one of the best forms of real transparency that I can think of.

Funny, I never won that one.

<comment><USER22> Why not start your own virtuous VPN company.

<comment><USER21> It's not a business I'm interested in running.

</comment></comment></comment><comment><USER23> Proprietary ad blockers cannot be trusted. It is better to use something like AdAway and Firefox with uBlock Origin.

<comment><USER16> Even that setup fails: [https://blog.dnsadblock.com/you-are-still-being- tracked-even...](https://blog.dnsadblock.com/you-are-still-being-tracked-even- with-ad-blockers-installed/)

<comment><USER24> Already fixed in uBlock Origin: [https://github.com/gorhill/uBlock/releases/tag/1.25.0](https://github.com/gorhill/uBlock/releases/tag/1.25.0)

<comment><USER25> Looks like sites use first party trackers too for some reason, see the pixel at the end of another posted article: [https://www.the-tls.co.uk/articles/the- opt-out-illusion/](https://www.the-tls.co.uk/articles/the-opt-out-illusion/) (it's fully packed with trackers though).

</comment></comment></comment></comment><comment><USER26> > " Apple and Google restrict root certificate privileges due to the security > risk to users. Sensor Tower's apps bypass the restrictions by prompting > users to install a certificate through an external website after an app is > downloaded."

Seems like it will be open and shut case, quickly banning the apps and hopefully Sensor Tower entirely, especially given the other details of the article explaining they've already banned apps from Sensor Tower for previous violations.

<comment><USER8> if they ban their apps, would the certificate still be installed in your phone if you installed it previously?

</comment></comment><comment><USER27> What is current best-practice ad blocker for iOS Safari? AdGuard? Ad-Blocker Pro? I've tried Firefox but besides their tracker blocking ads are still prevalent.

</comment><comment><USER28> I guess that's one way to get gacha games' player stats.

</comment><comment><USER29> Anyone in Europe suing based on GDPR regulations?

<comment><USER30> Unfortunately, GDPR doesn't give you the right to sue. Enforcement is only possible via (hollowed out) data protection agencies.

</comment></comment><comment><USER31> Sensor tower is a mobile intelligence tool. Correct me if I am missing something, but what is a big deal here? And when you use free apps, obviously they sell your data (or with a high chance), they are not charities. But in return, you get hassle-free ad-blocking or VPN. It looks like a fair deal to me. Or you can find a good one that will be expensive, or do it yourself (paying the same or more, just with your time).

And there is a huge difference between what they can do and what they actually do. In coffee shops and other places, surveillance systems can be used to steal your passwords and logins etc. But I strongly suspect each and everyone has entered their personal details while been recorded bt the surveillance system for many times. Or just in public place where someone can see, etc.

<comment><USER32> How about the huge difference of knowing that you give away your data and not knowing? There is nothing "fair" about it and just the fact that they are now gone from the stores should...I don't know...maybe make you think about that a bit?

PS: just because there are worse situations, doesn't make this a good one.

<comment><USER31> I meant general practice done legally, e.g. stating this in their policy and showing when you run the app for the first time that it will sell their not personal data in exchange for free service.

The concept is fair as some are willing to pay with money, some are ok to pay with their data. Hiding the fact that you will sell data obviously deserves the punishment.

<comment><USER32> And that's the big deal here.</comment></comment></comment></comment>


What If Everything You Knew About Poverty Was Wrong? - <AUTHOR> http://m.motherjones.com/politics/2014/03/kathryn-edin-poverty-research-fatherhood

<comment><USER2> That would be an interesting sim game. Not to make light of a lot of peoples misfortune, but it would give some people the opportunity to walk in others shoes. To mimic wanting a child, in order to get a new life you need to have a baby.</comment>


The Summer of Drones - <AUTHOR> http://summerofdrones.com/

<comment><USER2> I've organized a Mini Nodecopter event in London and another is on this weekend in Bath, UK. They are, in my experience, some of the most exciting hackdays I've been too, bringing software and hardware hacking together to command flying robots!

</comment><comment><USER3> Gonna make this happen in Los Angeles.

<comment><AUTHOR> Will there be drones playing forkmaster?

<http://forkmaster.com/>

</comment></comment><comment><USER4> I submitted an app for a Toronto event - if anyone else has done so, let me know!

<comment><USER5> I have some friends who are organizing a related event in Toronto. Ping me in email if you're interested (email@example.com)

</comment></comment><comment><USER6> Yay for a crazy summer!

</comment><comment><USER7> I am planning to put one together in the southeast! Hoping to find sponsors and interested hackers!

<comment><USER8> It's getting harder for you to go wrong, shubb is waiting in SE UK and I'm here for you in SE US. Wherever you are, I doubt you'll have too much trouble getting people to come control flying robots.

</comment></comment><comment><USER9> Anyone keen for Perth, Australia?

<comment><AUTHOR> I realize it's very far away, but there is going to be an event in Sydney. Ping me at firstname.lastname@example.com if you'd like me to connect you with the organizer!

<comment><USER9> I'll see if I can get enough people interested to run one here, otherwise I might fly across. Cheers!</comment></comment></comment>


The Exceptional Beauty of Doom 3's Source Code - <AUTHOR> http://kotaku.com/5975610/the-exceptional-beauty-of-doom-3s-source-code

<comment><USER2> This is also great if anyone is interested.

[http://fabiensanglard.net/doom3/index.php](http://fabiensanglard.net/doom3/index.php)

</comment><comment><USER3> I've always found the "don't waste vertical space" rule to be particularly important when I'm reading code.

I've also always hated frames in IDEs.

I think I used too many small monitors...

</comment><comment><USER4> If you're using multithreaded code having the getters/setters can be very useful for debugging blocks.</comment>


How I decide between many programming languages - <AUTHOR> https://drewdevault.com/2019/09/08/Enough-to-decide.html <comment><USER2> Man, if one of Go's pros is "good package manager", I'd hate to see what terrible package managers he's experienced. Seems weird to call out Java package management as a con in comparison.

I love Scala's type system, though, I suppose if I didn't have a very good CS degree I'd hate it. I think it strikes a good balance between powerful and usable.

<comment><USER3> Java doesn't come with a package manager out of the box so most projects seem to go with Maven. If you've tried to understand a project with multiple pom.xml's then for me putting it in the con is a good call.

<comment><USER4> While this is true, it's not an inherent problem of maven, it's an inherent problem of dependency management is f*cking difficult™.

<comment><USER5> Maven is inherently bad too, though

<comment><USER6> In which way exactly? Having worked with many, many different package managers, I've come to appreciate Maven's way of doing things. Even though it has many drawbacks:

\- XML structure is verbose

\- Plugin architecture makes standard behaviour opaque

\- Default HTTP with no package signatures is recipe for security problems

\- "Stages" seem arbitrary and it's not always clear which stages are performed.

\- Community seems to move to newer systems such as Gradle (and SBT for Scala).

But, there are also strengths. The configuration format can be extended easily using the plugin architecture. This provides a huge opportunity to extend the functionality.

It is battle hardened over time, which means it is very stable and it has a huge plugin architecture.

<comment><USER5> Well, I think you've covered the issues I was going to mention!

</comment></comment></comment></comment></comment></comment><comment><USER7> > C++

> Pros: none

> Cons: ill-defined, far too big, Object Oriented Programming, loads of > baggage, ecosystem that buys into its crap, enjoyed by bad programmers.

This is just rubbish. Fair chance the author wrote this with the help of C++ (your OS or browser maybe?). And I enjoy C++ and it's eco system as well, compared to other languages. So that makes me a bad programmer? I'm surprised people are taking this post serious.

<comment><USER8> 'there is widely used software written in language x' != 'language x is good'

C++ definitely has its uses (and for a long time was best-in-class for many of them) but it is largely being superseded by other options (not necessarily Rust).

<comment><USER9> Just as an example it's really hard for me to do low level CUDA GPU programming in any other language.

I'm trying hard to use Julia, but understanding its PTX output is really hard for me, and also I don't know how to use the matrix multiplying GPU instructions.

Rust's PTX output is not supported, so I haven't really tried it.

</comment></comment></comment><comment><USER4> Look, I'm wary of negative comments on HN myself, but this is just a bunch of

<Language I know way too little about>:

<Simplistic or incorrect summary of a few blog posts I saw a while ago>

</comment><comment><USER10> I have tinkered with dozens of languages, yet, when I can choose a programming language and money is on the line, I always ask the following questions:

\- Does it have a standard and a good track record for backwards compatibility?

\- Is it memory safe? (Bound checking, no pointer arithmetic, etc.)

\- Does the runtime have automatic memory management in the form of a tracing GC? How tweakable is it?

\- Does it have kernel thread support?

\- Does it have a centralized package repository?

\- If typed, will the type system assist me in defining the business domain? Does it have type inference?

\- If dynamic, will the development experience allow me to experiment, inspect and redefine stuff at runtime?

\- Can I distribute my programs as a binary or dump everything onto an image?

\- Can I go low level when it matters? How's the FFI experience and overhead?

\- Does it run on the major operating systems?

Things I don't care about: Syntax, static vs dynamic typing / OOP vs FP religious wars, community size or "niceness", library count, logos, on- boarding experience aka the possibility of hiring cheap juniors.

Cute mascots are nice though. We need more of that.

<comment><USER11> What answers do you come up with for these questions?

<comment><USER10> No perfect answer yet but I am mostly programming in Go and Common Lisp these days.

I am looking forward to multicore OCaml and maybe I give F# a go.

</comment></comment></comment><comment><USER12> The list may be entertaining, but displays little in the way of objectivity. For instance, OOP is a major con of C++ (even though many people write C++ all day without any of it) but isn't even mentioned with regards to Java and C#? Really?

<comment><USER13> > OOP is a major con of C++

Not sure what _exactly_ you mean by this, but many people use classes and objects all the time in C++, and see it as a pro rather than a con.

<comment><USER12> I was quoting the original article, not expressing an opinion on OOP.

<comment><USER13> Oh shoot, sorry for the confusion. I guess that's a sign I need to go to sleep...

</comment></comment></comment></comment><comment><USER14> It seems Drew DeVault is highly opinionated and the opinions are more than 10 years old.

<comment><USER15> Drew is also one of the most insanely productive programmers currently, serving as lead developer of Sway, wlroots and SourceHut and as CEO of sr.ht.

<comment><USER10> While I like and use his work, I do think there are hundreds of thousands of programmers out there that are as productive and have as much impact, just that they don't happen to do open source.

</comment></comment></comment><comment><USER16> It's under the "I don't like line", but I came away from this feeling like I should look into Ruby.

<comment><USER17> All the jobs which recruiters send me all day long seems to tell me to look into ruby. Or do loads of people start projects in ruby, then leave for something else?

<comment><USER18> I don't see quite as many ruby jobs today but they're still out there.

Ruby has been very focused on increasing performance the past few years. A few major teams ran away from Rails because it's really easy to build functional things in Rails that won't scale, which gets attributed back to Ruby performance. I think that was enough to scare people away from using ruby at all

GitHub and Shopify both use Rails, among many others.

</comment></comment></comment><comment><USER19> One rule of thumb that's worth following is to never waste your time reading blogpost like this. If you ever saw a blogpost structured like this, just close the tab.

</comment><comment><USER20> While a useful and entertaining comparison, I feel like a major difference is between "unicorn" languages (languages having only a single implementation and runtime/ecosystem) vs. standardized languages having multiple compilers/implementations such as C and JS (and LISP), though people are throwing JS's advantage of being standardized and one of the must ubiquitous languages around away by choosing not-quite-JS languages such as TS and coffescript before that as the first thing when they're about to start a project).

</comment><comment><USER21> > _Haskell and every other functional-oriented programming language in its > class, such as elixir, erlang, most lisps, even if they resent being lumped > together_

Was nice talking to you, have a good day mate

</comment><comment><USER22> "C ... statically typed"

C is just an assembler with macros, so I think this is a bold statement...

"Haskell and every other functional-oriented programming language in its class, such as elixir, erlang, most lisps, even if they resent being lumped together"

The set of problems I would try to solve in Haskell and the set of problems I would try to solve in Erlang are disjunct. And its not just about the language, it is the whole ecosystem around it.

"Scala ... Java derivative"

???

I'm not sure if this post was an attempt of some kind of humour or not.

<comment><USER11> > C is just an assembler with macros

No. Can we put this dumb meme to rest? 1972 C was just an assembler with macros. 2019 C has been a major focus of highly complex compiler research and engineering for decades.

Sure, if you write broken code, C will happily access illegal memory if that's what the input program tells it to. But it will do so _efficiently_ ;-)

</comment></comment><comment><USER23> I thought this list was hilarious (despite some of my preferred languages being on the never use list). I'm surprised to see so many people taking it so personally/serious.

If this list really offends you, I would suggest you haven't been programming very long, you don't know many other languages (than the ones on the shit list), or both. Maybe the list is a little hyperbolic, but didn't you pick up on the tone?

</comment><comment><USER24> What's the issue with Java package management? If that's a Java con, what should be said about Python's?

<comment><USER25> Is there any wide-spread language with a better package/library management than maven?

</comment></comment><comment><USER26> Bemusing, though lumping all functional languages together makes me balk a bit. There's a big difference between static and dynamic functional languages. Haskell and Ocaml have a different feel than lisps/Elixir/Erlang with the latter group being much more practical in state management imho.

<comment><USER21> I mean, he lists "functional" as a pro and a con, using a fancy font for emphasis. Like another commenter posted: guy seems very opinionated, but his article lacks any profound stance on... anything? Oof

</comment></comment><comment><USER27> Interesting! I'd have put PHP and C++ at the very top of the list, then reverse the whole list. As a rule, I'd much rather start with a language that makes it easy to spot massive vulnerabilities, and then move towards a speedier and more volatile language where needed.

<comment><USER28> >I'd have put PHP and C++ at the very top of the list, then reverse the whole list.

I know what you probably meant, but if you put them at the very top of the list and then reverse it whole, they'll end up at the bottom again. Just saying.

<comment><USER27> No, that's exactly what I meant! I find PHP to be a bag of confused inconsistencies thrown together. While I have no disrespect to the people who put up with this on a daily basis, I'd never choose it for a new project. Similarly, C++ has never really appealed to me - its idea of OO seems misconceived, and it doesn't seem necessary - my current favourite for this niche is Nim

<comment><USER12> Thankfully, there's nothing mandatory about OO in C++. I mostly just use C++ as an incremental improvement over C - not "C with classes", but C with constexpr, a bit more type safety and a few other niceties. Nim is better in some ways, but often not really an option for me.

</comment></comment></comment></comment><comment><USER18> Among the other criticisms, Ruby hasn't been hip for a while. Bootcamps started offering nodejs, meetups are more diverse, fewer conference topics on Ruby. One major local conference had such low attendence last year they were going to cancel it this year.

It's a very low quality post.

<comment><USER18> I didn't mean this as a criticism of Ruby, either. I'm a Ruby/Rails dev and still enjoy the language, even if it feels like it's fallen out of favor

</comment></comment><comment><USER29> I respect this person a lot for the person's C programming skill, and open source involvement but I have to say I often end up disagreeing with his opinions about more "complex" languages.

</comment><comment><USER30> Strange that the availability of developers who can actually be recruited for the given languages isn't listed as a factor.

<comment><USER31> Any programmer worth their salt should be able to adapt to a new language when they start at a new project/company. Hiring processes that target people who know language X are just dumb, except for very short-term/time sensitive work.

<comment><USER32> Seems like a lot of corporate environment has settled on:

"We hire programmers that can use myriad of different languages (except Lisp off course, no one want's to deal with Lisp) and then you also have to know Java because in fallback situation you'd be useless in their time constraint setting //goodbye" that kind of thing, did I get this wrong?

</comment></comment></comment><comment><USER33> Easy.

The main platform language used by the target platform requested by the customer.

</comment><comment><USER34> that's one tiny tiny benefit of classical OO, so many languages shared very similar constructs, you could think in "UML" (cough) and not worry about the language per se.

</comment><comment><USER35> nice read, could maybe use a section, when to decide not to use any programming language, but just available system tools

</comment><comment><USER36> TL;DR

Post: How I decide between many programming languages

Pros: Unintended humour

Cons: waste of time, exceedingly bad example of anything technical

<comment><USER37> Unintended?

</comment></comment><comment><USER38> "every PHP programmer is bad at programming, the language is designed to accommodate them with convenient footguns (or faceguns) at every step, and the ecosystem is accordingly bad. No, PHP7 doesn't fix this. Use a real programming language, jerk."

This guy seems like a real open minded person who did his research and shared his opinion after making strong points. /s

<comment><USER39> yep, stopped reading after this. How can this be objective if you think that everyone is a "bad" programmer that uses this or that language, wtf.

Pros for PHP could be, it's templating capabilities with HTML, easy to use DB interfaces and the entanglement with the web/HTML/web-server in general. Nowadays you don't really write these kinds of apps anymore where your backend returns whole HTML Pages but that doesn't mean it's a bad language.

<comment><USER40> Same. Also I'd add low entry barrier and maturity of interpreter.

Of course, this comes at a price. But saying PHP has no pros is quite subjective

<comment><USER41> Calling it "subjective" is being pretty nice. It's just an obviously incorrect statement.</comment></comment></comment></comment>


Show HN: I opensourced my distributed cron SaaS when no one signed up - <AUTHOR> https://github.com/dosyago-corp/cronstorm-opensource <comment><USER2> "ok" is not an ok commit message ;).

Regarding setup, you should probably provide an example with mocked keys that we can copy-paste.</comment>


Show HN: LeadsDaily – Handpicked project leads, delivered to your inbox daily - <AUTHOR> https://www.leads-daily.com <comment><USER2> Heya campingalert,

I went here: [https://www.leads-daily.com/about](https://www.leads- daily.com/about) \-- to find more information. I got a 404. Womp womp.

I'd definitely like to know more about what you're doing and if it'd be helpful to me.

Happy Friday.

<comment><AUTHOR> Hey!

Thank you for the response. I updated it :)

</comment></comment><comment><USER3> why so expensive?</comment>


Show HN: Earl - Crowdfunded Backcountry Survival Tablet - <AUTHOR> http://www.meetearl.com

<comment><USER2> I probably don't go hiking enough to personally really need this, but I love the idea of a tough eInk device.

</comment><comment><USER3> This thing would be clutch in the Seattle weather right now!</comment>


The Portuguese Bank Note Crisis of 1925 - <AUTHOR> https://en.wikipedia.org/wiki/Alves_dos_Reis#Banco_de_Portugal_plot <comment><USER2> This is a tremendous story; I was first told of it many years ago and it's informed my thinking about authenticity ever since. I recently managed to find a copy of "The Man Who Stole Portugal" to read the whole definitive account with all its absurd details. The total obliviousness of the British printers was key to the whole thing; once they'd been convinced they were dealing with the Right Sort of Chap, who simply confirmed their prejudices that Portugal was corrupt and disorganised enough to have banknotes collected in person.

<comment><USER3> Exactly. The whole scheme relied on everybody, even his accomplices, truly thinking that they were dealing with an official.

<comment><USER4> Like the Madoff case, the fact that the people around him benefited from the scheme in the short run (including the printers, who made a profit on printing) surely didn't hurt.

</comment></comment></comment><comment><USER3> The most terrifying part:

> _The final phase of Reis ' scheme was to buy controlling interest in the > Bank of Portugal, a step which would allow him to retroactively make his > fiction about Bank approval true. With control of the bank, the entire > counterfeiting could be swept under the rug, ensuring that there would never > be any evidence of the fraud._

<comment><USER5> I recommend reading up on how FED got created.

<comment><USER6> Is this something specific I'll find in [https://en.wikipedia.org/wiki/History_of_the_Federal_Reserve...](https://en.wikipedia.org/wiki/History_of_the_Federal_Reserve_System), or do I have to add "lizard people" to the search terms?

<comment><USER5> Wikipedia article is fine. All the facts are there, if you prefer more narration I like this one: [https://www.youtube.com/watch?v=mQUhJTxK5mA](https://www.youtube.com/watch?v=mQUhJTxK5mA)

<comment><USER6> Could you clarify a couple _specific_ facts you're looking to point out, instead of asking us to watch a 21 minute video from some random YouTuber?

<comment><USER5> I do recommend reading about it or watching, but what I was aiming at, is that if Reis would have succeeded, it wouldn't really be much different from the system that we have in the US today and how it got created. It was done with perhaps a bit more finesse but it's basically the same thing.

edit: I can't reply below, but the text is not that long and it's about how money works which is likely relevant to you regardless of your wealth. I suppose short abstract would be that somebody with [power/money] decided to create more money out of a thin air and succeeded. FED is not responsible before congress, the president or pretty much anybody. I'm not interested in conspiracy theories. The facts are wild enough.

<comment><USER6> > FED is not responsible before congress, the president or pretty much > anybody.

This is just silly.

The Fed reports to Congress twice annually. The Chair and Board of Governors are nominated by the President and confirmed by the Senate. Their authority stems from an act of Congress, which Congress can revise/repeal, and permits the removal of the Chair or Governors by the President for cause.

For an example of Congress's authority over them: [https://en.wikipedia.org/wiki/Federal_Reserve_Reform_Act_of_...](https://en.wikipedia.org/wiki/Federal_Reserve_Reform_Act_of_1977)

Hell, they're even subject to FOIA. [https://www.federalreserve.gov/foia/about_foia.htm](https://www.federalreserve.gov/foia/about_foia.htm)

<comment><USER5> Just check any of those hearings. Quick googles:

[https://www.youtube.com/watch?v=n0NYBTkE1yQ](https://www.youtube.com/watch?v=n0NYBTkE1yQ)

[https://www.youtube.com/watch?v=dX2qvbznGKM](https://www.youtube.com/watch?v=dX2qvbznGKM)

You can easily find more. They can just flatly refuse to provide any info and AFAIK there's still no law that would stop them. And as far as I understand there won't be any, because money is power and they create money.

Notice that I'm not saying those are some associated evil doers (or that they are not). Societies, economy, politics, it's all very complex. But I still stand by what I wrote earlier.

<comment><USER6> > They can just flatly refuse to provide any info and AFAIK there's still no > law that would stop them.

So, taking your second clip as an example, Congress wrote a requirement to disclose that information into Dodd-Frank about a year after that clip was posted. It's actually a _perfect_ example of Congress regulating the Fed, which you falsely allege is impossible.

[https://www.frbdiscountwindow.org/Pages/General- Information/...](https://www.frbdiscountwindow.org/Pages/General- Information/faq)

> In accordance with the provisions of the Dodd-Frank Wall Street Reform and > Consumer Protection Act (Pub. L. No. 111-203), the Federal Reserve has > changed its practices with respect to disclosure of discount window lending > information. Effective for discount window loans (primary, secondary, and > seasonal credit) extended on or after July 21, 2010, the Federal Reserve > will publicly disclose the following information, generally about two years > after a discount window loan is extended to a depository institution.

> The name and identifying details of the depository institution;

> The amount borrowed by the depository institution;

> The interest rate paid by the depository institution; and

> Information identifying the types and amounts of collateral pledged in > connection with any discount window loan. This disclosure requirement does > not apply to collateral pledged by depository institutions that do not > borrow.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> The way he escalated faked credentials (the forged contract) into better credentials is great and a topic of great interest for computer security today. Using current political climate as a driver for operational security is genius.

The plan to gain control of the central bank in order to clean traces of the fraud was amazing too. How many other similar plans succeded ? Should we start looking into changes of control of similar institutions in other countries ?

<comment><USER8> I like to point that Mario Draghi, the head of the European Central Bank, with the notable task to deal with Greece's debt problem, used to be at the head of Goldman Sach's division responsible of the loans toward countries exactly at the time when Greece was cooking its books.

<comment><USER9> Also worth pointing out Mario Draghis son was also a European Sovereign Credit/Interest Rates trader at Morgan Stanley before he left to join a hedge fund a few years back. No such thing as inside information outside of equity markets! [https://www.bloomberg.com/news/articles/2017-02-08/giacomo-d...](https://www.bloomberg.com/news/articles/2017-02-08/giacomo- draghi-said-to-exit-morgan-stanley-for-hedge-fund-lmr)

</comment></comment></comment><comment><USER10> This is, interestingly, not very well known in Portugal. The whole story is fascinating and the fact that he almost got away with it is very impressive.

Most people interested in national history know that the Estado Novo dictatorship was brought to power due to the increasing distrust in the first republic, but most don't know of this event, nor of the potentially very large role it had in eroding that trust.

<comment><USER11> Not very well known? It was even the subject of a TV series some years ago!

[https://arquivos.rtp.pt/programas/alves-dos- reis/](https://arquivos.rtp.pt/programas/alves-dos-reis/)

<comment><USER12> I'm portuguese and had never heard of it. That TV show is from 2001, so already a bit old. Otherwise it's not a very talked-about story.

<comment><USER13> I'm in my early 40s and I remember when it was aired, but younger people were probably watching kids TV at the time.

There were some other similar stories that made it to the TV, like Dona Branca, Capitão Roby or Ballet Rose.

</comment></comment></comment></comment><comment><USER14> I can't recommend The Man Who Stole Portugal by Murray Teigh Bloom enough. I loved this book.

The most curious aspect about all this is that he seems to have had a positive influence on the Portuguese economy. It was a sort of QE. The subsequent regime locked the Portuguese economy back into its ossified ways.

<comment><USER15> Reading the story, it seems to me that had he succeed in controling the central bank, he would be a celebrated successful businessman and Portugal would have been much better off.

I also find it interesting that the people who caused his downfalls were acting legally but, in my view, were at least as morally corrupt as him. They were poweful, rich men using their power, political ties, their journals and journalist to vilify them and acting to protect their monopolies. It just reinforces the fact that law, right and wrong are not very well tied together. They're mostly there to keep the status quo for the elite.

</comment></comment><comment><USER16> Reminds me of the plot of one of the episodes of Firefly.

The crew discovers (via underground connections) that a food production facility has very lax security. In this universe, the vacuum-sealed nutrient packs require authenticity much like bars of gold.

Now, they _could_ break in, steal a few pallets and sell it on the black market - but obviously, the theft would be noticed, and the serial numbers could be noted down as contraband etc..

What they _actually_ do is convince the night shift that they are not needed, and convince the afternoon shift that the protagonists are actually the night crew. They then produce the nutrient packs themselves and simply walk out with them.

Since the night crew never showed up, there is no mismatch with their records, since they obviously didn't produce anything.

<comment><USER17> As someone who has watched _Firefly_ quite a few times, I don't recall this episode. The only thing that comes close is "Ariel", where they steal medical supplies off a core world hospital, but that's straight up theft.

I don't recall all the details of the film _Serenity_ , but the plot described does not ring a bell. Are you sure it was _Firefly_ you were thinking of?

Note: I have not read the comics, if it is one of them the plot appears.

<comment><USER16> Oh my god, I remember now that this wasn't actually canon. I'm so sorry.

This was actually from a great crossover fanfiction, "Browncoat, Green Eyes" [0].

It was so vibrant in front of my mental eye, too.

[0] [https://www.fanfiction.net/s/2857962/13/Browncoat-Green- Eyes](https://www.fanfiction.net/s/2857962/13/Browncoat-Green-Eyes)

</comment></comment></comment><comment><USER18> Ridiculous History covered this recently: [https://player.fm/series/series-2148552/the-portuguese- bank-...](https://player.fm/series/series-2148552/the-portuguese-bank-note- crisis-how-one-lucky-forger-almost-destroyed-a-nations-economy)

Crazy how much he got away with, for so long, effectively just on confidence and skill.

</comment><comment><USER19> What amazes me is that at some point he didn't try and take his winnings off the table - convert to pounds or dollars - and head for the hills.

<comment><USER3> From tfa:

"Reis then proceeded to launder the bills into gold-backed foreign currencies and smaller denominations of Portuguese currency."

So sounds like he did launder the money successfully, but he stuck around for the final part of his plot: gain a controlling share in Banco de Portugal to retroactively make his fiction become true.

<comment><USER20> I think your parent was talking about the fact that he knew he was going to be arrested and instead of fleeing like Hennies decided to fight it.

<comment><USER21> Interestingly Reis may have made the right choice: Hennies ended up dying in poverty before Reis even finished his prison term.

The only one that seems to have come out relatively unscathed was Marang, everyone else finished badly (including the printer in London).

</comment></comment></comment></comment><comment><USER22> Does anyone else feel it is an interesting coincidence that his name was Reis? Until 1911 that was also the name for common currency in Portugal, then replaced by Escudos at a rate of 1000:1. Is/was this a common name in Portugal?

<comment><USER23> It's a decently common surname

</comment></comment><comment><USER24> You can buy one of these "fake" bills for about $1300.</comment>


Ask HN: WiFi Access Point(s) for Home? - <AUTHOR> Currently running an Apple Time machine in bridge mode from a ubiquity edgerouter lite. Would like better coverage (3 story house) and faster speeds. Big family lots of devices. Recommendations? Ethernet cabling on basement and main level but not upstairs. <comment><USER2> I have 3 TP-Link EAP-245 access points, an Omada Cloud Controller and a simple 8-ports POE switch. The coverage and stability is up to par with the Unifi AP- AC-PRO and software is pretty good, also. I can highly recommend them: much lower price point and a lifelong warranty.

Having said that, without a cable you're not going to get a decent throughput on the upper floors. Don't bother with WiFi repeaters as they'll extend the range at the cost of bandwidth.

</comment><comment><USER3> Have tried a simple Wifi repeater? It works quite good in most situations.

<comment><USER4> wifi repeaters are the worst you can do...

</comment></comment><comment><USER5> Ubiquiti AP are pretty great. Have 3 of them at home and great coverage on a 3 level home.

<comment><AUTHOR> Do you have to mount them upside down on a ceiling? Or can you do tabletop?

<comment><USER6> They are intended to be mounted on a ceiling or wall, and have antenna radiation patterns designed for that use. Putting them in any other orientation will likely make them less effective.

</comment></comment></comment><comment><USER7> Ubnt amplifi is the easy (and well working) solution.</comment>


Contrast Rebellion - <AUTHOR> http://contrastrebellion.com/

<comment><AUTHOR> On many of today's web sites I need to inspect HTML and reset their font color to black; otherwise I can't read them.</comment>


Everything You Always Wanted to Know About Events but Were Afraid to Ask - <AUTHOR> https://linuxnetworkstack.wordpress.com/2013/11/15/all-you-wanted-to-know-about-events-but-were-afraid-to-ask/

<comment><USER2> It's draft of the article</comment>


Bitcoin: Alive and here to stay? Or slowly fading away? - <AUTHOR> http://thenextweb.com/insider/2012/09/02/bitcoin-alive-stay-or-slowly-fading-away/

<comment><USER2> You can't really use transaction volume as any real measure of the bitcoin economy. It's quite normal (and recommended) for owners to transfer their coins between multiple wallets for a variety of reasons.

There's no way to tell from looking at the transaction history whether transactions represent actual exchanges or just a holder moving coins around internally.

<comment><AUTHOR> _It's quite normal (and recommended) for owners to transfer their coins between multiple wallets for a variety of reasons._

I've been trying to follow most of the Bitcoin stories submitted here on Hacker News, but I have somehow missed that advice. What are some of the links to user tips for using Bitcoins? What are some of the reasons for transferring Bitcoins between multiple wallets owned by the same owner?

<comment><USER3> Presumably to make it harder to track down transactions to individuals?

<comment><USER4> Money laundering, buying illegal stuff, you know pretty much the only reasons for real people (other than hacker enthusists) for using BCs. The high volatility mixed with low trade volumes make the currency's value as a hedge against the dollar painfully useless. If people wanted a 'safe' currency, BC is the wrong answer, CHF is a far better choice. But, my hypothesis is that Bit Coiners want untraceable transactions for nefarious reasons. I'm not against bitcoin, but let's not be delusional and pretend that it's main benefit is stability. It seems that many bitcoin users are under the delusion that their $100 purchases at Amazon are of interest to the authorities. The people that most need financial anonymity are the ones that should least likely get it.

The last thing I want is for North Korea to start settling transactions with Syria using bitcoin, but that's exactly what bitcoin will be used for if it isn't already.

Bitcoiners are the hacker equivalent of the Glen Beck types that hoard gold for the coming apocalypse.

<comment><USER5> You certainly know that North Korea leaders keep money in Swiss banks?

see, for example, [http://www.telegraph.co.uk/news/worldnews/asia/northkorea/74...](http://www.telegraph.co.uk/news/worldnews/asia/northkorea/7442188/Kim- Jong-il-keeps-4bn-emergency-fund-in-European-banks.html)

Bitcoin is not good for dictator states, because it allows people to fund initiatives like wikileaks w/o a risk to be punished.

</comment></comment></comment></comment></comment><comment><USER6> Bitcoin is off to a great start. I'm really interested in what direction it's going to go when governements start to notice more. Will countries try to outlaw it? Tax it? or leave it alone.. who knows.. What I do know is that it's going to get a lot more interesting. I'd really like to know where it'll be in 10 years.. but I can wait.

</comment><comment><USER7> I stopped reading at

 _As these peaks eventually become norms, based on Bitcoin's upward trend, we'll see $52.5 billion being moved per year._</comment>


Review My Wknd Project: Televite: Send Automated Phone Messages - <AUTHOR>

This is my first time posting so I'm not sure if I'm doing this right. I submitted my link before but it didn't work. Anyways, I have been working on creating a small project that lets you send fun automated phone messages. You can use it to send holiday greetings to your friends/relatives. I would really appreciate it if you can comment on what you think about this.<p>http://televite.totalengage.com <comment><USER2> "Sorry but your browser is not supported. Please use firefox to use this application"

You need a better pitch to convince me to switch to a different browser.

I'm on Chrome btw.

<comment><AUTHOR> I will be fixing this very soon. Can you please test in Firefox and give me your feedback?

Please keep in mind that it's only Alpha release for Firefox.

</comment></comment><comment><USER3> I can understand blocking IE users, but I don't understand why Chrome or other modern browsers should be blocked with no explanation.

<comment><AUTHOR> Yes. I forgot to mention that it only works in Firefox for now. I think it's because of the way i'm using JQuery. I will be fixing that very soon.

For now, please test it in Firefox. If someone can comment on why it would work in Firefox and not Chrome, please let me know.</comment></comment>


Apple reduces speed as batteries wear out, report suggests - <AUTHOR> https://www.theguardian.com/technology/2017/dec/19/apple-iphone-reduce-speed-old-batteries <comment><AUTHOR> Further discussion on reddit [https://www.reddit.com/r/iphone/comments/7inu45/psa_iphone_s...](https://www.reddit.com/r/iphone/comments/7inu45/psa_iphone_slow_try_replacing_your_battery/)</comment>


Ask HN: How to approach the annual perf review in a political environment? - <AUTHOR> i work in a highly political organization.
it's a typical performance review process: first i submit my comments about my work and my "goals" for the next year, then my boss adds their comments, then it gets filed away in an HR computer system. the de facto purpose of review is to justify (a) compensation matters and (b) personnel decisions -- this means the performance review can be a powerful weapon.
ideally, i would like to highlight my achievements in such a way that i avoid giving my boss any "rope" with which to "hang me" in their responses.
i have also considered opting out altogether (so that any comments made by my boss would not be based on anything i have written) though i'm not sure what the fallout would be.
how do you all go about walking these sorts of tightropes in your organizations? <comment><USER2> You don't trust neither your organization, your HR department, nor, most importantly, your boss. Are you sure you want to work in this setting?

<comment><AUTHOR> no, i don't want to work in this setting. but i want to manage my situation effectively for the time being.</comment></comment>


Joel Spolsky is (semi-)retired - <AUTHOR> https://www.joelonsoftware.com/2019/12/05/so-hows-that-retirement-thing-going-anyway/ <comment><USER2> For those that don't know, Joel wrote many really good software development related articles/blogs in the early to mid aughts. The archives can be found on his site. I'd recommend anyone read them who works on a software development team in any capacity (management, dev, DBA, QA, etc).

<comment><USER3> My favorite Joel article is: "Whaddaya Mean, You Can't Find Programmers?"

[https://www.joelonsoftware.com/2000/06/15/whaddaya-mean- you-...](https://www.joelonsoftware.com/2000/06/15/whaddaya-mean-you-cant- find-programmers/)

"Now, let's review some microeconomics. In a free market, it is almost axiomatic that the market always clears. That's a technical term that means that when somebody tries to sell something, if they are willing to accept the market price, they will be able to sell it, and when somebody wants to buy something, if they are willing to pay the market price, they will be able to buy it. It's just a matter of both sides accepting the market price."

<comment><USER4> The fact that different professions earn different amounts of money is, in fact, an indicator that the higher paying professions have a shortage of people able to perform the work. Working conditions and pay for programmers are incredible and would be a life changing improvement for most people. That the profession hasn't been flooded with talent is a strong indicator that there isn't enough talent out there.

<comment><USER5> > The fact that different professions earn different amounts of money is, in > fact, an indicator that the higher paying professions have a shortage of > people able to perform the work.

If we have 2000 people, we need 1000 doctors and 1000 secretary and it takes 8 years of training to be the former and 1 year for the later, won't doctors be paid more even without shortage to take into account risks and length of studies?

<comment><USER6> No, but the length of study and risk will generally cause the shortage at a particular wage.

</comment></comment></comment></comment></comment><comment><USER7> The HASH write up sounds awful like multi-agent simulation. I've recently had to return to looking at these things and in a "oh my god I need to do some MAS work" type panic I was relieved and gratified to find the the GAMA platform - so far I'm impressed.

[https://github.com/gama-platform/gama/releases](https://github.com/gama- platform/gama/releases)

wonder what HASH will add to this kind of thing?

<comment><USER8> David from HASH here. I know that panic all too well...

GAMA is great -- and we're big fans of the team! They've done an awesome job raising the profile, and improving perceptions, of ABM/MAS-type modeling.

We're approaching things in a rather different manner, with a specific view to decreasing the time and complexity involved in building real-world (versus toy) models. We'll be drip-feeding invites (and more info) in the coming days.

</comment></comment><comment><USER9> Dupe: [https://news.ycombinator.com/item?id=21723223](https://news.ycombinator.com/item?id=21723223)

</comment><comment><USER10> Given the plug-hole that StackOverflow is currently spiralling down, I really think adult leadership from someone like Joel is sorely needed. But I can see why he would not want to bother with it.

</comment><comment><USER11> Did Picasso retire? Did Pablo Casals retire? No. They painted or played till their dying breath.

Real programmers never retire. They just lose their bits.

Joel is a real programmer.

</comment><comment><USER12> The article's actual title is: "So, how's that retirement thing going, anyway?"

<comment><USER13> When you see something like this, mail firstname.lastname@example.com and they will fix it.

</comment></comment><comment><USER14> Hey Joel - check out the MagicShifter - it does everything you want to do, plus more .. like MIDI! Paint your own POV pics!

[http://magicshifter.net/](http://magicshifter.net/)

sources: [https://github.com/magicshifter/MS3000](https://github.com/magicshifter/MS3000)

You can solder a long strip of LED's (we had up to 500) and address the whole thing over a handy Wifi interface .. the MS3000 provides its own web-based programming/config interface too.

We added an Arpeggiator, and MIDI too (rtpMIDI as well as hard MIDI), because why not, and this means you can sync the LED strip to your drum machine with ease, Joel .. ;)

(EDIT: douchebaggery--)

<comment><USER15> This looks cool.

But "Everything Joels' trying to do with LED's, we already did with the MagicShifter" can read very negatively. Don't underestimate the joy of doing something yourself and making it happen.

Such as me making a version of "Simon" in an Altoids can: [https://blog.jgc.org/2012/05/simonoids-its-simon-in- altoids-...](https://blog.jgc.org/2012/05/simonoids-its-simon-in-altoids- can.html)</comment></comment>


Smarties: How the stocking staple got its name - <AUTHOR> http://www.bbc.com/news/uk-england-42244389 <comment><USER2> Tl;dr: no one knows how they came up with the name. It used to be called other things before branding became a thing. Board minutes don't detail where the name Smarties came from, just that it was decided.

The title is a misrepresentation of the article really, it should really be something like "Smarties: How the stocking staple came to be" since it's more a chronicle of its origins, than an account of how it got its name. Still an interesting read though.

<comment><USER3> It was an interesting article. Did the title really bother you that much?

<comment><USER2> Kind of, yeah. I liked the article and found it interesting, even said as much, but given the title I expected to learn how the name came about and I didn't. The article doesn't do what it said on the tin, as it were, interesting as it may have been.

</comment></comment></comment><comment><USER4> The packaging change the article is referring to was when Smarties used to come in a carboard tube, with a plastic lid at one end.

[http://l7.alamy.com/zooms/ae76784029684feb8d06d507f47ff7ad/c...](http://l7.alamy.com/zooms/ae76784029684feb8d06d507f47ff7ad/close- up-of-old-style-smarties-tubes-e2137c.jpg)

As a child it was fun to eat the sweets, then replace the lid and crush the tube to make the lid travel quite surprising distances

<comment><USER5> You can still do that with a Pringles [0] can - the pitch of the "boomp" will be quite a bit lower since the can diameter is larger.

[0] Potato snack chip ("crisp" for our UK readers) formed into hyperbolic paraboloids, which stack neatly in a cardboard tube

</comment></comment><comment><USER6> These are the European Smarties, not the american kind[1] which are more of a flavored chalk than a chocolate covered by a candy shell.

1\. [http://caffeineplease.typepad.com/caffeine_please/images/200...](http://caffeineplease.typepad.com/caffeine_please/images/2007/11/12/smarties.jpg)

<comment><USER7> Both sweets are British originally.

Fizzers is the British name for the tablet sweets, and the original one. They were renamed Smarties when they were imported to the US, like how Harry Potter was renamed!

[http://idsgn.org/posts/parallels-fizzers-rockets- smarties/](http://idsgn.org/posts/parallels-fizzers-rockets-smarties/)

M&Ms are also just a copy of the existing chocolate Smarties.

<comment><USER8> And for fun, those things are called Rockets in Canada as we do have the chocolate Smarties.

</comment></comment></comment><comment><USER9> _In 2005, Nestlé axed its cylindrical tube, much beloved by collectors hoarding the lids imprinted with letters, aliens and football phrases, in favour of a hexagonal shape._

However, you can still buy the larger tubes (150g) which are still cylindrical. That size is now the one given to kids at Christmas.

<comment><USER10> Hmmm, Smarties in Australia used to come in a small rectangular box and you opened it at one of the ends.

I can't recall ever seeing Smarties in cylindrical tubes with plastic lids.

Feels like we missed out on some fun.

After M&Ms were introduced in the 80's, Smarties became less common. I remember thinking Smarties tasted better at the time, but now I feel Smarties have lower quality chocolate than M&Ms. Maybe it is just familiarity bias.

</comment></comment><comment><USER11> Are M&Ms called Smarties in Europe?

<comment><USER12> I don't know about other countries in Europe, but here in the UK, we have both Smarties and M&Ms (in fact, there is a massive M&Ms store in Leicester Square, London). Although they are similar, they are produced by different companies. Here's a page outlining some of the differences between the two sweets:

[http://www.candyblog.net/blog/item/head_to_head_smarties_vs_...](http://www.candyblog.net/blog/item/head_to_head_smarties_vs_mms)

</comment></comment><comment><USER13> In America, "smarties" are the cheapest, most hated, begrudgingly eaten, chalky Halloween candy imaginable.

[https://www.smarties.com](https://www.smarties.com)

The only thing worse than these chalk smarties are the Necco valentines day conversation sweetheart candies, that are roughly the same degree of chalkiness, but compressed to diamond-hard, tooth breaking unchewability.

This article is about M&M's which, I guess England... refers to as... smarties.

<comment><USER8> This article is NOT about M&Ms. While superficially similar, they are made by different companies. Smarties predate M&Ms by decades.

<comment><USER13> Yeah, and that's incredible, gee, but in America we just do not have any other word for this variety of candy coated chocolate thing, but oh my god brand names, wow.

What next? Bitching someone out about trademark law because they referred to a photocopy as a xerox? Watch out!

So yeah, awesome downvotes. Good job.</comment></comment></comment>


When a fire alarm rings, people do not act. They stand around. - <AUTHOR> http://interfsce.com/chronicles/2013/7/17/the-fear-of-change

<comment><USER2> This is well known. People tend to freeze when confronted with a novel situation. That is why there are fire drills, and why soldiers are drilled until obeying orders is reflexive.

When people freeze like this, they are not just idly goofing about, but are in a state of high tension and indecision, looking to see what everybody else is doing, or for someone who appears to know what must be done to take the initiative.

</comment><comment><USER3> I imagine something like this is going through the heads of many people:

 _Oh, an alarm is going off. Is this a drill? Must be, I don 't see anyone running or anything on fire. No one is telling me that I have to leave, so I'll just stay right here and carry on with my business. I don't really want to go outside only to wait 15 minutes to half an hour until they tell me the alarm was an accident._

Solution: Have someone go to the fire panel, see where the alarm was set off, go to the place where the alarm was set off, verify there is an actual emergency, make a live announcement on the PA system telling people to exit the building.

At the minimum, telling people to exit the building, even if it's an automatic recording that plays when the alarm was set off, is the best way to get people to comply. Telling people to exit is much more powerful than a noise and having people decide for themselves whether or not to exit.

</comment><comment><USER4> I don't think it's "fear of change", but rather that people in the civilized world, who live in urban areas, are rarely faced with dangerous situations and don't have developed a judgement of when a situation is dangerous. They are not in fear when a fire breaks, they are passive. Fear would make them think quick on their feet.

<comment><AUTHOR> Well I think mainly it's about how once we get into routine subconsciously it's really hard to change especially so when the situation is more dynamic hence intrinsically it's a fear for change. They can tell that the situation is perilous but they way they react is to stick to their prior routine.

</comment></comment><comment><USER5> This is odd, because every time I've been in a building when a fire alarm went off, people by and large got up and got out. Okay, so they generally brought their coffee with them, and sometimes their laptops. Maybe it was because there _were_ unannounced fire drills and occasional false alarms, so it wasn't really a novel situation.

</comment><comment><USER6> "Forensic reconstruction after a famous restaurant fire in the Beverly Hills Supper Club in Kentucky confirmed that many of the victims sought to pay before leaving, and so died in a queue."

This is surprising altruism.

<comment><AUTHOR> "We almost always try to exit a room through the same door we entered."

That was foreshadowed by this and I don't think it's so much altruism as it is routine.

</comment></comment><comment><USER7> maybe instead of just a loud sound, they should put a loud voice telling them the situation and what to do ... I guess some alarms do that</comment>


Shift's (YC S14) Debit Card Spends Digital Currency, Loyalty Points, and Fiat - <AUTHOR> http://techcrunch.com/2014/08/12/shift-is-developing-a-debit-card-that-lets-you-spend-digital-currency-loyalty-points-and-regular-money/

<comment><USER2> These companies are all like the virtual ISP companies that used to rent bandwidth from the ISP companies owning the physical wires. As you'd suspect, the big ISP oligopoly companies didn't want to undercut their own offerings, and the virtual ISP companies had to ask super high fees to remain profitable.

In the same way, this debit card will be more expensive to use than a regular debit card (The backbone providers MasterCard/Visa will want a generous cut) and this will consequently be a pointless product.

(hope I'm wrong)

</comment><comment><USER3> The first dozen companies that tried this idea couldn't make it work, so they've set a high bar for themselves.

</comment><comment><USER4> Way to go, Greg!</comment>


25 Chrome DevTools Tips and Tricks - <AUTHOR> https://www.keycdn.com/blog/chrome-devtools/ <comment><USER2> And by Tips and Tricks they mean the 101s of how to use dev tools? This article contains absolutely no new information to anyone familiar with DevTools.

The first "tip" is literally how to open DevTools, then they tell you about each tab... Then we're done. Where are the tips and tricks?

</comment><comment><USER3> Also, [http://devtoolstips.com/](http://devtoolstips.com/) and [https://umaar.com/dev-tips/](https://umaar.com/dev-tips/).

</comment><comment><USER4> I've found "replay XHR" to be invaluable when decoding JSON replies - it's in the network panel on the context menu

</comment><comment><USER5> Great article on Chrome DevTools-a must for all those aspiring Chromebook devs.

</comment><comment><USER6> Nice, I didn't know about workspaces before.</comment>


737MAX: Trim Cutout can be difficult to recover - <AUTHOR> https://www.satcom.guru/2019/04/stabilizer-trim-loads-and-range.html <comment><USER2> My thoughts as someone with not much aerospace engineering knowledge: FFS why on earth should it be so hard to just keep an airframe in controlled flight under benign weather and mechanical conditions??

Isn't this the equivalent of expecting my Mom to know to reboot her car's engine management computer in order to be able to steer away from an oncoming brick wall?

I guess I find it astonishing that this kind of mid flight debugging is even considered viable as an approach by the industry. Are they inspired by Armstrong's manual override feats on the Apollo 11 landing descent?

<comment><USER3> In theory, nothing here is obscure. Trim is a control that airplanes have that cars don't. It's a very basic control, it's right there on the control column. A mechanical or computer failure could cause the plane to mistrim itself, so one of the most basic emergency responses that every airliner pilot knows is how to disable the auto-trim and fix it manually. MCAS is a new way for mistrim to happen, but there were already many others before.

It sounds like the main issue is that Boeing didn't predict that MCAS would mistrim at such low altitude that you don't have time to disable the trim motor and perform the recovery before the ground intervenes.

<comment><USER4> > nothing here is obscure

Boeing chose to have the indicators that show the trim is on as a separate add on, not as a default feature (i.e. an indicator showing the trim is enabled). This is beyond unsafe, and unethical by all measures.

For a car it would be like having cruise control turn on automatically and accelerating (without telling you), and worse yet, when you brake to try to control your speed, it doesn't disable or do anything (pulling on the steering column did nothing). To disable you need to do something totally different (which is unnatural for a human).

I hope this error is costly to Boeing, and that the FAA learns from this experience. This should have never been certified.

<comment><USER3> > Boeing chose to have the indicators that show the trim is on as a separate > add on, not as a default feature (i.e. an indicator showing the trim is > enabled).

This is nonsense. The optional light was just an AoA disagree sensor. It doesn't provide any information about trim.</comment></comment></comment></comment>


There are currently two 8-year old children with 3 parents each - <AUTHOR> http://www.newscientist.com/article/dn712-gm-babies.html

<comment><USER2> The headline is a bit sensationalist. We're talking about mitochondrial DNA coming from a cytoplasm donor. This is not the nuclear DNA generally associated with the idea of parenthood.

<comment><USER3> Still, it is technically accurate. Few things are more satisfying the being sensationalist and technically accurate at the same time.</comment></comment>