DLL hijacking vulnerabilities in Nirsoft tools - <AUTHOR> http://borncity.com/win/2020/04/16/dll-hijacking-vulnerabilities-in-nirsoft-tools/ <comment><USER2> I wouldn't really call this a vulnerability, it is a common caveat when dealing with basically any Windows software. If you have write access to the program directory of a piece of software, you can inject code into it through DLL hijacking techniques. But you can also just replace the binary itself with a malicious one, which is an even simpler attack, and the techniques described in this article can't prevent that.

<comment><USER3> Only sometimes - one easy attack is to trigger a web browser to download a .dll file, which doesn't let you overwrite existing files but does get new files on the load path of programs being run out of the download folder. (This was an easy attack on how many people run PuTTY, for instance.)

<comment><USER4> That's why you usually provide your programs in zip files (like nirsoft seems to do) so they decompress to their own folder.

<comment><USER5> Unfortunately the zip files don't have top level directories, so the default download, extract, run "happy path" would leave them loading any DLL sitting there in the downloads folder.

``` $ unzip -t processactivityview-x64.zip Archive: processactivityview-x64.zip testing: ProcessActivityView.exe OK testing: ProcessActivityView.chm OK testing: readme.txt OK No errors detected in compressed data of processactivityview-x64.zip. ```

<comment><USER4> The windows zip extract dialog gives the name of the zip file as the default target directory

<comment><USER5> I'm not sure which dialog you're talking about. Whenever I've extracted a zip file in Windows using Explorer, it's been using "Extract all" or "Extract here". I don't even see a way to get a dialog on my win 10 VM.

Those two options result in whatever's in the zip file being dumped into the same directory as the zip file itself. If the archive contains a top level directory, a directory appears. If it's just an exe and a chm and a readme, like the Nirsoft zips, then those files appear next to the zip archive.

<comment><USER2> There is only "Extract All", and that opens the dialog. Perhaps you also have 7-Zip installed which creates an "Extract Here" option that dumps the files in the current directory.

<comment><USER5> I do have 7-zip installed here. I could also be mixing memories across a few Windows versions. I know I've caused files to be extracted without a dialog in the past, which irritated me a great deal, on a vanilla system. But it's entirely possible that's a vista-era memory at this point.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> > I sent him multiple mails about his STARTER ERRORS, but the guy is __* deaf > and dumb: NO reaction!

Is it necessary to write things like this about an individual in a blog? I mean, the guy made these tools and gave them away for free. You're not a customer. It's up to him to reply to your emails, and it's fine if he doesn't.

</comment><comment><USER7> I am not sure to understand the actual level of "danger".

If I get this right, you should have a malware running in the background, waiting for the Nirsoft tool execution, in order to have a malicious .dll be copied in the folder (the author suggests "normally" the "Downloads" one is used) from which the tool is run.

Of course possible, but shouldn't be there other tools to avoid that a malware is running?

<comment><USER8> A website can just force a download of a dll into the downloads folder and most people wouldn't notice it. If you then download the tools and run them you run the code in the dll as well.

<comment><USER7> Maybe, but then most people wouldn't use any of the Nirsoft tools.

On the other hand - personally - but not because of particular security measures, only for convenience, I tend to run those tools from within the .zip file (opened in 7-zip) i.e. in practice in a "random" directory created on the fly, i.e. something like \7zO6BD1.tmp (inside the users Temp folder).

Besides AFAIK/AFAICR all tools are available in .zip files, I don't think that the "common" user will open the .zip in the "Download" folder and routinely extract its contents in the same "Download" folder (as opposed to a path _like_ C:\Nirsoft\<name of the tool> or similar).

</comment></comment></comment><comment><USER9> "It rather involved being on the other side of this airtight hatchway."

[https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...](https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31283)

<comment><USER10> Raymond Chen in this article seems to rather minimize the severity of arbitrary code execution attacks allowed by buffer overruns.

His logic is also faulty since he conflates 'End-User' permitted capabilities (what the App correctly allows the user/ request to do) with Application permissions to the OS.

Really this seems like it might be blinded by too many years of C/ C++ & immersion in stale campus group-think.

<comment><USER9> it's not arbitrary, this program execs what the user asks it to exec. if some non user can get it to exec something the user doesn't want it to exec, then yeah, it can be a problem. but a non user has to go trough the user to have the dll in place, so the problem is the user and the vector social engineering, not a vulnerability.

</comment></comment></comment><comment><USER11> Just a reminder that powers agencies [0] [1] and malware have exploited dll hijacking on software as specific as Notepad++ , and also some common software used by technically inclined people, so a targeted attack at Nirsoft is not so unthinkable.

[0] [https://stackoverflow.com/questions/43044855/explanation- how...](https://stackoverflow.com/questions/43044855/explanation-how-dll- hijack-of-notepad-worked-please)

[1] [https://www.ghacks.net/2017/03/09/notepad-7-3-3-update- fixes...](https://www.ghacks.net/2017/03/09/notepad-7-3-3-update-fixes-cia- vulnerability/)

<comment><USER2> I think this is pretty misleading because the Notepad++ 7.3.3 update doesn't really improve the security of the product in any way. Those agencies used DLL hijacking as a convenient technique to inject code into Notepad++ but they could have just as easily accomplished the same thing by replacing the binary with a malicious one instead. The change in the 7.3.3 update was basically for political purposes only.

<comment><USER3> > _Those agencies used DLL hijacking as a convenient technique to inject code > into Notepad++_

From the linked posts, it was rather not convenient at all.

> _they could have just as easily accomplished the same thing by replacing the > binary with a malicious one instead_

From the linked posts, they were going via a shared downloads directory, so they could not have.

Occam's Razor implies there was actually something to the attack and it wasn't that some bored attacker took the long way around for fun.

<comment><USER12> > From the linked posts, they were going via a shared downloads directory, so > they could not have.

Do you mean the Stack Overflow answer? That looks like original research to me. Yes, Windows will by default try loading DLLs from the current working directory, but:

1\. it has lower priority than the program's own directory, and Notepad++ ships with a copy of SciLexer.dll, and more importantly:

2\. Notepad++ specifically only looks for SciLexer.dll in the same directory as the executable itself: [https://github.com/notepad-plus-plus/notepad-plus- plus/commi...](https://github.com/notepad-plus-plus/notepad-plus- plus/commit/3fa8a89e76bf523cc4ea7ea1a111cb5ec8f21d4c)

> it wasn't that some bored attacker took the long way around for fun.

There are other conceivable reasons for putting the hijack inside a DLL, e.g. because you're more likely to inspect the executable. But permissions wise, it was no easier than modifying the executable.

</comment></comment></comment></comment><comment><USER13> I mean you're downloading an exe and giving it admin access.

That's already carte Blanche.

Whether any of that can be leveraged further by messing with the contents - DLL or otherwise - is academic.

</comment><comment><USER14> As far as I remember, the "DLL hijacking" is a serious issue when the program like Microsoft Word searches for the DLL exactly at the location of the user file to be opened and exactly after the user selects the file: if you e.g. open a .DOC file from the Documents folder and an attacker placed in the Documents folder his own DLL, that DLL would have been then loaded too by some unpatched versions of Microsoft Word.

I don't see such a scenario described in this article, so it can be that the issue here has much less potential to be misused?

There is also a system-wide solution for all programs at once: SafeDllSearchMode registry entry.

[https://www.fortinet.com/blog/industry-trends/a-crash- course...](https://www.fortinet.com/blog/industry-trends/a-crash-course-in- dll-hijacking.html)

</comment><comment><USER15> Too much fuss, too little substance.

> _It is sufficient for the Malware to place DLLs with the expected names in > the relevant folder._

That "relevant folder" is a system directory (like c:\windows) that requires admin rights to modify.

<comment><USER16> Wrong. Windows dll are first looked in the folder the application is in.

<comment><USER17> Well, unless the application modifies the search order. But that's precisely the reason why applications should not be installed in and run from user- writable directories, like, say, your downloads folder, or Appdata.

</comment></comment></comment><comment><USER18> I'm a bit confused - these aren't long running tools, but are tools you use once or twice for troubleshooting. I'm trying to work out a scenario where this would be a major issue.

<comment><USER3> Wait, why does that make a difference? If an attacker can get you to run privileged malicious code once, they've won.

This seems like the Windows-land equivalent of the old GNU ldd bug - it's rare that you use ldd and rarer still that a sysadmin runs it as root on a user- provided binary, but once they do, the user can immediately escalate privileges (and use whatever means they like for persistence).</comment></comment>


Scroll through this history of data storage - <AUTHOR> http://techpageone.dell.com/history-of-data-storage/

<comment><USER2> This is pretty cool but the last item is pretty ridiculously out of place, also the chronology isn't strictly linear and it seems to skip over some important advancements.</comment>


Google App Engine is Dead Again - <AUTHOR>

And so is code.google.com which hosts the status update page. I've seen this movie before didn't I? <comment><USER2> It seems it was down for 20 mins at 11pm Eastern time.[1] Service has resumed, but an assessment of the cause has yet to be provided as of 2am.

[1] [https://groups.google.com/d/topic/google-appengine- downtime-...](https://groups.google.com/d/topic/google-appengine-downtime- notify/TYEvpd8PtUk/discussion)

</comment><comment><USER3> I don't understand Google.. they have best cloud infrastructure on web, and still their cloud products are s*it

It's unbelievable that Amazon is leader in cloud business and not Google

</comment><comment><USER4> I am just curious, how many people here on HN uses google app engine?

<comment><USER5> I use it but only for personal projects, nothing commercial.

<comment><USER6> wow! they have A User!!!! :)

</comment></comment></comment><comment><USER7> Google App Engine died for me long ago with their technology lock-ins and horrible pricing structures.</comment>


Why Journalism Tools Gather Dust - <AUTHOR> http://slifty.com/2012/12/why-journalism-tools-gather-dust/

<comment><USER2> Slifty:

Here's the thing—everyone, in every enterprise-level business has deadlines. In news media, there is confusion over auteurship and who drives production. It's similar to music business and movies.

As a result, the businesses while have their entire existence dependent upon control of market are very reluctant to disruptively innovate.

I think, if there was a new media professional journalism school or movement, this would be less of an issue. The more I think about it, we're looking at similar to what Hollywood did before the rise of film school directors—personal control requires control of tools.

In media in general, presentation is a necessary part of identity. Branding is key. Therefore, the tools that create that are frightening to distribute. Good tools, as you know are build from the ground up over time, with both en eye towards future development providing foundation and current need and relentless opposition providing shape.

The Times is pretty progressive, but they're in the seat of Microsoft or Apple—the company can create a standard, but there's little pressure to embrace it.

</comment><comment><USER3> This isn't something that only happens in your industry -- you'll see it in most sufficiently large enterprises. Effective software reuse, while certainly a noble goal, is very hard to accomplish.

<comment><AUTHOR> I did assume as much. I'm curious, since so many in J-orgs are trying to change the status quo, if there are success stories that are worth paying attention to.

</comment></comment><comment><USER4> the dust is spreading from the journals to their tools ;)

<comment><USER2> It's not dust, it's the emergence. Journalism as an occupation is a required aspect of liberty. Journalism as a business is essentially reactive and has not successfully shifted in monetizing new media. Until it does, it will stay stuck in old patterns.

</comment></comment><comment><USER5> I can tell you now that I've been out of grad school for around a year or so:

Many companies are not product-focused. The goal of producing a good product using sensible techniques is only a small part of what happens. Companies are mainly social relations, specifically fiefdoms. At the top of the social hierarchy is an organization which can produce a "good enough" product to earn an income to keep the company afloat, while supporting the back-stabbing that goes on at the high levels.

Competing viciously for those dollars are hundreds of individuals. Their work is optimal when they bring the company, the commons, or the social fabric nearest to the brink of destruction. These people really don't care about sharing. If a company is not doing well, it doesn't make sense to them to utilize new techniques (such as sharing software) to make it better. They would rather loot the company and move on.

This is especially true of companies which have reached maturation separately, then been artificially bonded, such as the two newspapers you mention. From the outside, they may appear as two large pools of positively-charged molecules and you're wondering why the negatively-charged (connotations not implied here) molecules of software don't simply attract and stick. The reason is that the companies are not uniform entities... They're deeply complex structures with all kinds of spikes, moats, alarms, etc. to keep foreign entities, such as uncertainty and loss of control - away.

It doesn't matter if that friendly visitor coming to their door is a good Samaritan who wants to give out free cookies and teach them how to make cookies more efficiently or more deliciously. They already have reliable ways to make enough money and any newcomer is only going to disrupt how that flows. To make _more_ money, they prefer social means, not technical ones. Why mess with - or even consider - software and other work when you can hire, fire and deceive people through antisocial practices of marketing, human resources, the stock market, etc.? Software is too wild - anyone (even teenagers for crissake) can write it and it's too powerful. So don't stake the business on software, stake it on social relations.

If your goal is to make a better product, find a better system of social relations. If you want to make your technological solution work, appeal to the antisocial tendencies in the hierarchy.</comment>


Ask HN: Preference? Keyword Search or Semantic Search - <AUTHOR> I'm thinking about self-service portals on websites here.
When you search in a help desk or a knowledge base, which gives the best results according to you?
Do you prefer something that is keyword + synonym like Algolia, or something that works kind of like Google (semantic understanding)? <comment><USER2> Keyword search, if it goes poorly, just feels like I need to work harder to find the right keyword, not an actual failure of the system. Whereas when semantic search goes bad, it is infuriating and entirely the fault of the computer (especially when I've given it the precise word I need it to look for and the computer "thinks" it "knows better")

...or at least that's how the medium-to-savvy users will tend to feel about it. In making your decisions you need to think not just about what users think/say they want, but also how they'll react to the system's failure modes.

<comment><AUTHOR> That's what we've noticed in our user trials of our system. There's nothing a user can do to make it work.

</comment></comment><comment><USER3> For self-service style portals I highly prefer a mix of keyword based search and good overall navigation, on this class of sites I usually know what I'm looking for and - at least from experience - common implementations of automatically induced semantic searches just seems to add noise without actually getting me closer to what I'm looking for.

Please note that my viewpoint is largely inspired by technical queries as opposed to generalized search though. In theory I'd love a mix of both with priority on keyword results under the presumption that semantic metadata is mostly curated by humans.

<comment><AUTHOR> Hmm. I'm thinking about a feature which could re-use a customer service rep's email reply as solutions in a DB.

Of-course the sensitive info could be blacked out or the rep could willfully not add it to the solutions DB.

</comment></comment><comment><USER4> Semantic based search systems are really great at finding the original intent behind queries. Not everybody is good at finding the right keywords to express their ideas or intent. In such a scenario, semantic meaning based querying rewriting helps a lot.

However, semantic search is a hard machine learning problem and it requires a good volume of search queries so that they can be mapped to the results returned and mine for patterns.

What's the middle ground? You can show a machine learning based "related searches" as a hint in the sidebar. That way, you can help the user construct their search phrases.

Shamless plug: if you like Algolia but would like to host the search engine yourself and don't want to manage Elasticsearch, take a look at Typesense: [https://github.com/typesense/typesense](https://github.com/typesense/typesense)

</comment><comment><USER5> Keyword is simpler to implement and should be fine, but be sure to follow up at least the head queries to make sure they're getting to the right content. Things like tracking the query through to the eventual contact page, so your support reps can inform your search index; ex people who search for X need the info on faq page Y. It's a waste of your customers' time and your reps' time when the customer gave you a good enough search term, and you didn't give them the information they could have used to fix their problem without opening a ticket.

<comment><AUTHOR> What do you think about reusing ticket info? Like a feature where a rep can optionally add a BCC email ID while replying to a client that saves the response to the search database. Can help increase content without disturbing the workflow?

Private info like name, email Credit cards, pins can be blacked out.

</comment></comment><comment><USER6> In cases where I have a very specific error code or issue I'm looking into I prefer keyword based search, but in most situations where my search is broad or I am not exactly sure what is causing an error, semantic search gets me to an answer quicker.

Although between the two, I think I use keyword searching more an a regular basis. Even in semantic search engines, I tend to use a lot of quotes to get some keyword based results.

<comment><USER7> I prefer using a real search engine to get me the keywords to search for. Then I can find exactly what I want in the keywordsearch. With a sematic search engine on a small ammount of data I mostly find nothing or everything and have to scan through a lot of pages to maybe find what I'm searching.

</comment></comment><comment><USER8> I prefer a semantic-guided keyword search. The query itself is keyword based, but having semantic based suggestions can help fill in some keywords I'm missing. It's as resource intensive as a regular semantic search, bridges the knowledge gap for users who can't fully describe their query, but gives full power to those in the know. Best of both worlds.

</comment><comment><USER9> Keyword search I find works good. Semantic search, if implemented at all, should be an optional feature with special syntax for describing the semantics, rather than trying to interpret arbitrary text and then it won't work.

</comment><comment><USER10> I absolutely prefer keyword search. Semantic results are nothing but infuriating, particularly when I'm searching for something specific and the engine substitutes my query for something interpreted.

</comment><comment><USER11> Google started out w/ algolia-style and then gradually added in semantic over time, you need large datasets for good quality semantic search

</comment><comment><USER12> I prefer semantic, but it needs to be _good_ semantic search. If it's done badly, the semantic results can sometimes be rather noisy. With keywords, the onus is on the user to know what to ask for (but you can't always count on that being the case).</comment>


The anatomy of a door-to-door Taobao delivery - <AUTHOR> http://theanthill.org/taobao-delivery <comment><USER2> As someone who lives in Shanghai, this is an interesting look at how it works. However, as an expat who can't speak Chinese yet, this website is one of the larger sources of my frustration.

Need something simple and don't know where to get it? If you ask anybody, the only answer you ever get is "TaoBao."

The issue is the way their page is coded, it's immune to machine translation. Images have critical text that isn't translated and often the page loads elements after translation has finished, leaving just enough Chinese to prevent a foreigner from using the page. I've set aside an hour before to make an account but I could not complete the task.

I wonder how much effort it would be to keep their site the way it is, but smooth out the experience just enough to allow machine translation.

<comment><USER3> If you want some help with navigating it I can probably help, drop me a line.

<comment><USER2> Thanks for the offer, though I actually prefer to only ask for help when I need it. Otherwise, my apartment will fill up with cheap Chinese goods, like the Shanzhai iPhone 6 I bought 2 months ago for absolutely no good reason. :P

</comment></comment></comment><comment><USER4> While Taobao can be a treasure trove, an important warning is that around 90% of the brand-name items are fakes. As long as you're not after brand names, there are a lot of great bargains. If you want to buy geniune imported goods, better use T-Mall or JD.com. Neither of which will 100% guarantee you authentic goods, but the chance of getting fakes is much lower because sellers have to put up large deposits before selling.

<comment><USER5> I think most people living long enough term in China to grapple with the language are well beyond caring about brand names. :)

<comment><USER4> It's not so much about appearance as about safety. Do you want your replacement laptop power supply to burn up? Are you sure that chocolate was made to the same standards as those of the brand owner? Even for clothing, North Fakes are highly unlikely to live up to the quality of the real deal.

<comment><AUTHOR> These are good examples.

I bought an extra laptop power supply for my Macbook Pro from Taobao. It cost 16 USD, and works well and looks like the original. It's probably of reasonable quality, but without the big brand behind it, I don't feel comfortable leaving it on unattended.

I've never thought to buy chocolate from Taobao, and I probably never will, unless it's from the official Tmall store of the brand owner, e.g. [http://godiva.tmall.com/](http://godiva.tmall.com/)

I heard about a guy who bought a fake North Face jacket from the Silk Market or Yaxiu or somewhere similar. It rained a few days later and the jacket was soaked through :(

<comment><USER4> I had a fake Lenovo power supply burn on me. Couldn't tell it was a fake except by the price being pretty low.

I purchased "Toblerone" chocolate on Taobao and it came unboxed (just a foil wrapper) and didn't taste the same.

I've seen fake clothing that lasted for years and was probably worth the price paid, but I've also seen too many items fall apart. Personally, I won't buy fakes, but I will by Chinese brands if the reviews are good. We have a few items with Chinese names, like a blender and juicer, that were half the price of other brands but quality is quite decent.

</comment></comment></comment></comment></comment><comment><USER6> Loved the story of the couple and the author's analysis. Would enjoy more if done so.

</comment><comment><USER7> Im live in australia and speak only english and I regularly search and have occasionally bought items from Taobao, including bicycle wheels, motorbike parts and something else that escapes me right now.

I use chrome with auto tranlation turned on, i first translate my keywords in google translate and then paste these into the taobao to search.

I'd buy more things if i could find a reliable third party onseller to deal with - the last one was an incredible ripoff when it came to posting ground freight.

If anyone has a reliable onseller, im open to suggestions!

<comment><USER8> well, i'd love to help. But the shipping isn't that cheap for oversea customer. Drop me a line if needed.

<comment><USER7> I'd definitely be interested in talking further, tweet me @chriscbourke - I've been toying with a few ideas for a curated marketplace for international orders, i'll run them by you if you're interested!

</comment></comment></comment><comment><USER9> Great to see someone going into detail on this- the Taobao experience is awesome. There are a few flakey carriers but over all- nothing even close in the US. It's become my favorite thing about living in China.

<comment><AUTHOR> I usually buy only from sellers which have already sold lots of the particular item in question, with good feedback. The ability to see sales volume and feedback for a particular _listing_, and not just a particular SKU or particular seller, really makes my life easier.

A few of the things I've bought from Taobao recently:

Bluetooth receiver for headphones $16: [http://item.taobao.com/item.htm?id=38718297406](http://item.taobao.com/item.htm?id=38718297406)

48v 20Ah lithium battery for electric moped $192: [http://item.taobao.com/item.htm?id=16566200878](http://item.taobao.com/item.htm?id=16566200878)

Ultrasonic jewellery cleaner $19: [http://detail.tmall.com/item.htm?id=13861247309](http://detail.tmall.com/item.htm?id=13861247309)

Waterproof bluetooth speaker $6.36: [http://item.taobao.com/item.htm?id=39374503285](http://item.taobao.com/item.htm?id=39374503285)

Bluetooth adapter for amplifier $3.75: [http://item.taobao.com/item.htm?id=20525099344](http://item.taobao.com/item.htm?id=20525099344)

Custom-made venetian blinds ~$10: [http://item.taobao.com/item.htm?id=15785435641](http://item.taobao.com/item.htm?id=15785435641)

Google Cardboard $4: [http://item.taobao.com/item.htm?id=39893565312](http://item.taobao.com/item.htm?id=39893565312)

All of the prices above are in USD and include shipping.

<comment><USER10> Are you saying they would ship to US? Maybe I am misunderstanding it. As long as you can speak the language, they will ship to US?

I am big fan of Amazon and got addicted to Aliexpress...

<comment><AUTHOR> Sorry, I should have been clearer :(

These prices include delivery to _Beijing_. I converted the CNY prices to USD only to make them easier to understand.

I have heard that some Taobao vendors do ship internationally, but I have no knowledge of this, and have only heard it indirectly from overseas Chinese. If you don't speak Chinese, then dealing with unusual requests or customisation can be hard, because it's all done through the online chat system, and 99.99% of vendors only speak Chinese.

</comment></comment></comment></comment><comment><USER5> Speaking of Strawberry Music Festival, there's one next week (October 2nd and 3rd) in Dali ... anyone fancy a trip to Yunnan for an HN China meetup? :) Feel free to get in touch, email in profile.

</comment><comment><USER11> Nice, I wish we could have Taobao in the West, or at least be able to browse it in English. I've read elsewhere that many Chinese run Taobao stores as a "national hobby".

<comment><AUTHOR> I've heard that some people browse and buy using Google Translate. I imagine it's difficult (because listings include lots of text embedded in images) but better than nothing :)

<comment><USER8> Google Translate is not as much as reliable for English to Chinese translation.

<comment><AUTHOR> You're right, but I was suggesting using it for Chinese to English, not English to Chinese.

For product descriptions written in Chinese (especially long ones), an automated English translation can be good enough for the reader to make a purchase decision.

<comment><USER8> Yeah, seems you have experience to deal with that. However, big sellers tend to use photos instead of text description

</comment></comment></comment></comment></comment><comment><USER12> There's nothing like the taste of lead paint in the morning.

</comment><comment><USER13> great story. thanks for posting</comment>


Obama Signs Patent Overhaul Legislation - <AUTHOR> http://www.pcworld.com/article/240153/obama_signs_patent_overhaul_legislation.html <comment><USER2> "[The legislation] would change U.S. patent rules by giving a patent to the first person to file for it, not the first person to create a new invention."

Can anyone explain how this relates to prior art? If you're filing a patent for something that you're not the first person to invent, then isn't there inherently going to be prior art related to your patent, rendering it not new and non-obvious?

</comment><comment><USER3> > Reducing the backlog of patents at the USPTO "is essential to encouraging > innovation and bolstering the U.S. economy."

Can someone explain to me this "correlation"?

<comment><USER4> Lobbying dollars at work.

</comment></comment><comment><USER5> I have a bad feeling about this.</comment>


Preliminary Results Show: Solar Panels Are Underwhelming - <AUTHOR> https://arstechnica.com/science/2018/09/solar-panels-replaced-tarmac-on-a-motorway-here-are-the-results/ <comment><USER2> Specifically, when used as/on roads.</comment>


A Guide to Crypto Currencies - <AUTHOR> https://mycrypto.guide <comment><USER2> I recommend Perry G Mehrling [Columbia], (free) course on coursera [1] called Economics of Money and Banking. It provides a great context for how the current monetary system works. This context helps a bunch when comparing it to crypto.

[1] [https://www.coursera.org/learn/money- banking/home/welcome](https://www.coursera.org/learn/money- banking/home/welcome)

<comment><USER3> Thank you for sharing. Crypto is an interdisciplenary field, and we (folks on HN) view it through the lens of CS, at the exclusion of the other ways to approach the field.

Any other courses / topics you recommend?

<comment><USER2> [1] Federal Reserve Economic Data (charting) - Treasure trove of data.

[2] Balance sheet of the fed

[3] Access to all the flows of the US Money System

[4] Monthly Treasury Statement (MTS) - The Bank money flows of all accounts of the US Government

[1] [https://fred.stlouisfed.org/](https://fred.stlouisfed.org/)

[2] [https://www.federalreserve.gov/releases/h41/](https://www.federalreserve.gov/releases/h41/)

[3] [https://www.federalreserve.gov/releases/z1/current/](https://www.federalreserve.gov/releases/z1/current/)

[4] [https://www.fiscal.treasury.gov/fsreports/rpt/mthTreasStmt/b...](https://www.fiscal.treasury.gov/fsreports/rpt/mthTreasStmt/backissues.htm)

</comment></comment></comment><comment><USER4> Don't read guides. They won't help you. Try to use the stuff. Get some money on the exchanges, on MyEtherWallet, use the Ledger Nano, invest in some ICOs, use the Etherscan API, etc.

I did the mistake reading too much about all this crypto stuff for too long actually doing nothing.

Once you do something it clicks and you understand the whole picture much better and you read automatically stuff that matters and which gives you a deeper context.

Edit: Why the downvotes?

<comment><USER5> Great advice for people with a disposable income.

Some people just want to understand.

Want to donate money to me so I can play around with it? Thanks!

<comment><USER6> I doubt you need a lot of money just to get your feet wet. Anyone's entertainment budget would suffice.

PS: at the risk of sounding pedantic, anyone with any income in a jurisdiction with less than 100% tax has "disposable income". See: [http://www.investopedia.com/terms/d/disposableincome.asp](http://www.investopedia.com/terms/d/disposableincome.asp)

<comment><USER5> Considering my income is $0, I suppose my statement was correct.

<comment><USER7> considering your income is $0, maybe you should fix that first.

but in any case, what's your point?

<comment><USER5> Being a student is enough of a job, thanks.

Your assumption that I should have a job on top of this, without knowing my life or financial situation, is evidence that people rarely consider lives apart from their own on websites such as this.

</comment></comment></comment></comment></comment></comment><comment><USER8> For a quick video intro I recommend this video from 3Blue1Brown ("youtube mathematician") [https://www.youtube.com/watch?v=bBC- nXj3Ng4](https://www.youtube.com/watch?v=bBC-nXj3Ng4)

IMHO the best intro to Bitcoin and cryptocurrencies in general.

</comment><comment><USER9> Reading the introduction one question came to me: do the Big Five (Google, Amazon etc) show interest in blockchain technology and/or cryptocurrencies ? Google has invested in at least 2 companies that I know of (?)

<comment><USER10> I was wondering the same thing ... I know Microsoft has sponsored some Ethereum events and that is it. Perhaps blockchainization of the majority of their core business would impact revenue negatively?

Another thing that I am wondering is the lack of coverage on the blokchain technology on HN, I see articles every where except here?

<comment><USER11> > Another thing that I am wondering is the lack of coverage on the blokchain > technology on HN, I see articles every where except here?

Blockchain has become a word like AI, in that marketers have learned that inserting it allows them to capitalize on hype even if the use of the block chain is either overengineering or unnecessary.

</comment></comment></comment><comment><USER12> This is missing byteball under the [https://en.wikipedia.org/wiki/Directed_acyclic_graph](https://en.wikipedia.org/wiki/Directed_acyclic_graph) (that iota branded as "tangle") non blockchain using cryptocurrencies.

<comment><USER13> I like byteball, more than IOTA, because of the supposedly private blackbyte state.

Sleeper right there

</comment></comment><comment><USER14> Does anyone know a good way of determining global net savings held in depository institutions? So basically fiat held on deposit globally? And stated in USD?

</comment><comment><USER15> Opinion request: What are the up-and-comers for popular adoption? Monero, Ripple, EOS, Ethereum?

<comment><USER16> This is of course an opinion, but I've been following Ripple pretty closely. It's taking a much different approach than BTC or Ethereum in the sense that its getting the banks involved, and operates using a "web of trust". This results in much quicker transactions.

You can also convert between currencies, assuming you can trust the third party. This isn't that much of a stretch when you consider that we already do it in markets like Coinbase's exchange (GDAX).

They market themselves as the "bridge currency" in the sense that you in addition to sending money, it can easily bridge between multiple currencies. USD sort of fits that niche at the current moment, when you look at forex markets, most currencies (with some exceptions) are compared against USD.

<comment><USER15> Good points. The fact that they are giving the big players a good reason to get involved seems like it could dominate if those same big players decide to promote it.

</comment></comment></comment><comment><USER17> lot of biased (or to be blunt, incorrect) information from a quick glance.

There is a lack of protocol depth understanding from the author. Most of the recommendations seem to serve as market "advice" if you want to call it that.</comment>


Cartesio – Low-cost Cartesian plotter robot - <AUTHOR> https://robottini.altervista.org/cartesio-low-cost-cartesian-plotter-robot <comment><USER2> I don't understand the decision not to use CoreXY. I have a very very similar plotter that also cost me next to nothing using essentially the same BoM as this. It's directly descended from this one [0]. It can absolutely fly, I've spent some time tweaking it but I can reliably and accurately drive it at something like 20cm/s. That's largely a factor of the low inertia of the CoreXY design, which keeps both the main steppers stationary during operation.

Anyway, plotters are dope and to anyone thinking of building one of these, I highly recommend a CoreXY based design.

[0] [https://www.thingiverse.com/thing:1514145](https://www.thingiverse.com/thing:1514145)

<comment><USER3> Not sure if this is a dumb question, but what is CoreXY?

<comment><USER4> [https://corexy.com](https://corexy.com)

</comment></comment></comment><comment><USER5> Plotters are addictive and lovely - look for #plottertwitter on twitter.

I've always loved this spray painting printer (poor quality video, unfortunately):

< [https://youtu.be/V4aXw0Zotzw](https://youtu.be/V4aXw0Zotzw) >

The people that made AxiDraw also helped put together a kid's kickstarter plotter "Sylvia's Watercolor Bot" which is fun. They also have a plotter that draws on eggs...

I don't have an AxiDraw, but I'd be willing to bet the differentiator from homebuilt is the rigidity of the platform and being able to get very consistent results. (Personally, I'm a fan of 80s pen plotters from HP and Rolond.)

</comment><comment><USER6> FYI, if you already have a 3D printer, you can totally use it as a 2D plotter (if that's not obvious).

And you can totally use a fountain pen if you feel like it.

In action: [https://www.instagram.com/p/BlQHk43gwra/](https://www.instagram.com/p/BlQHk43gwra/)

Final result: [https://www.instagram.com/p/BlJHawZgFi1/](https://www.instagram.com/p/BlJHawZgFi1/)

Same, with a ballpoint: [https://www.instagram.com/p/BlJ8dgmAaTA/](https://www.instagram.com/p/BlJ8dgmAaTA/)

<comment><USER7> How do I do this? Installing the pen and adding some initial gcode to raise the Z axis above the bed so the nozzle doesn't touch isn't a problem, but what generates the drawing gcode?

<comment><USER6> I wrote code that generated this particular G-code for the Dragon curve.

In general, there's software to convert PostScript or DXF to G-code (used with e. g. engraving machines).

The G code to move in XY is simple enough (G0 x y) that you could write a converter yourself.

<comment><USER7> G code is simple, I'm just not sure how simple reading the curves would be. I worked around this by exporting as a png and having Cura slice that, then writing a script to extract a single layer. It works beautifully, now I want to see if I can make PCBs with it, it would be a revolution.

</comment></comment></comment></comment><comment><USER8> Is there a practical use for this? I'm thinking if my 3d printer does I could repurpose it for this.

<comment><USER9> I've spent the last several years working with this scale of robot at my start-up. The practical use is mobile phone, tablet, and general touchscreen testing. In some products, such as automotive head unit displays or any medical device with a touchscreen, there are legal and company policy rules requiring that functional testing of a device must match human actions as closely as possible. Which means you can't _only_ test the device through USB or some other back-end developer interface. In other cases, performance/latency testing teams want to test a touchscreen device as a black box, meaning with no extra instrumentation running on the device-under-test, to get good real world performance data. In all these cases that means a capacitive tablet stylus, instead of a pen, is attached to the end of a robot like Cartesio.

<comment><USER10> Huh, that's really interesting to learn. I'll file it in my big file of "Never thought about it, but makes sense"

(sorry, nothing otherwise constructive in this comment)

</comment></comment></comment><comment><USER11> This looks like the logical next step after building a brachiograph!

[https://brachiograph.readthedocs.io/en/latest/](https://brachiograph.readthedocs.io/en/latest/)

[https://news.ycombinator.com/item?id=21281525](https://news.ycombinator.com/item?id=21281525)

</comment><comment><USER12> I wonder if we might see a resurgence of these plotters ala 3d printers.

A tronxy x1 is $85 right now for a full small form factor 3d printer.

<comment><USER13> a review of the tronxy x1 [https://www.techradar.com/reviews/tronxy-x1/2](https://www.techradar.com/reviews/tronxy-x1/2) check aliexpress or similar for the $89

self upgrade to make it better: [https://www.reddit.com/r/3Dprinting/comments/81xkut/tronxy_x...](https://www.reddit.com/r/3Dprinting/comments/81xkut/tronxy_x1_before_and_after_selfprinted_upgrades/)</comment></comment>


How to write a "Malcolm Gladwell Bestseller" - <AUTHOR> http://blog.jgc.org/2010/06/how-to-write-malcolm-gladwell.html

<comment><USER2> Gladwell is a fantastic storyteller.

Unfortunately, this isn't obvious to many people, who seem to think he's a scientist or a journalist, despite no claims on his part for these qualifications or assertions that his work stands up to the rigors of those disciplines. They have decided that he is one or both of these things, and since he isn't, he does not fare well when assessed along those lines.

He writes very well, his books are interesting, his anecdotes are carefully selected and edited. His conclusions are meant to spark conversation, not end them.

Lighten up.

<comment><USER3> I haven't read any of his books, though I got many recommendations from friends. Which one should I start with? (don't care much about relevance to startup/business, as long as its a good book)

<comment><USER4> I've read all of them (I think?) but _The Tipping Point_ is still my favorite. Always thought it might be interesting to model the ideas in it using some sort of multi-agent system.

<comment><USER5> You would probably like Linked by Barabasi -- it is similar, but Barabasi is an academic (my barabasi # would be 2!)

</comment></comment></comment></comment><comment><USER6> Well, this may sound obvious to many but I think #1 should be "Become a regular reader of few psychological and social academic journals". I guess this alone can give you few ideas to write essays. Now my question is that, anyone know if journals of repute(related to psychological and social) can be accessed online?

<comment><USER7> The Society for Judgement and Decision Making has been publishing an online journal for about 4-5 years now. Very respected Editor and Assoc. Editors and certainly some interesting papers in there. <http://journal.sjdm.org/>

Also, I've found it useful to build a list of researchers whose work I find interesting, then trawl Google Scholar for them; this usually turns up some free sources that would be otherwise hard to find in the noise.

</comment></comment><comment><USER8> How to read a "Malcolm Gladwell Bestseller": start in the middle; read 20 pages or so; see sloppy reasoning and general lack of substance; don't read it or any of the author's other books again. You'd save yourself a lot of time if you did that, jgrahamc.

<comment><USER9> The sloppy reasoning/lack of substance are features, not bugs. He isn't a serious intellectual gladiator, he is a merchant who makes soundbites that educated, upper middle class people can use to sound intelligent and well read.

As long as people view them as such it is not problem. My frustration is when people cite Gladwell's ideas as either 1) the basis for strategic decision making at a business 2) the grounds for a major public policy decisions.

On a side note, I'd love to see this kind of breakdown for a lot of the shows on NPR, especially This American Life

<comment><USER10> As an interesting book countering the "blink" concept is a book called "Think!: Why Crucial Decisions Can't Be Made in the Blink of an Eye" - [http://www.amazon.com/gp/product/1416531556?ie=UTF8&tag=...](http://www.amazon.com/gp/product/1416531556?ie=UTF8&tag=benmeadowcrho-20&linkCode=as2&camp=1789&creative=390957&creativeASIN=1416531556)

</comment></comment></comment><comment><USER11> It probably also helps to be a talented public speaker and he is reputed to be a very good one.

[http://blogs.ft.com/rachmanblog/2010/02/the-secrets-of- malco...](http://blogs.ft.com/rachmanblog/2010/02/the-secrets-of-malcolm- gladwell/)

Generally speaking lot of bestsellers, fiction or non fiction, can be synthesized as:

\- give to the reader pre-digested, easy, spoonfuls of information.

\- give to the reader something to quote so that he can appear smart to his friends.

\- try to be appealling enough to be interviewed on TV.

<comment><USER12> He also did great at The Moth with a personal story.

<http://www.themoth.org/podcast>

He's also done one or several Ted talks. I recommend the one on spaghetti sauce.

</comment></comment><comment><USER13> FWIW, one could argue that many of these elements are also present in a book like Godel Escher Bach.

\- _Your book is actually going to be a collection of essays drawn together by a loose thread._ \- "strange loops"

\- _Each of your essays is going to revolve around a single idea_ \- pretty much every Achilles and Tortoise chapter

\- _Illustrate the idea with stories about real people_ \- Godel, Escher, Bach

and so on...

I don't know about the rest of you, but I read Gladwell and Hofstadter because they are entertaining in an brain-stimulating way. When I want raw non- embezzled science, I read scientific papers. In both cases, I'll come to my own conclusions.

I don't get all this passive-agressive "holier-than-thou" attitude towards Gladwell being famous I've been seeing lately. Who cares if he's famous?

<comment><USER5> 'I don't get all this passive-agressive "holier-than-thou" attitude towards Gladwell being famous I've been seeing lately. Who cares if he's famous?'

It reminds me of what PG said about this in his "why to not not start a startup" -- he is successful for what he does and they don't think he should be because he writes about things he doesn't do professionally or something.

</comment></comment><comment><USER14> The way to "read" Gladwell is to get the talking-book and have him read it to you as you commute to work/home. He's a great storyteller - in both word and voice. And he delivers his own material extraordinarily well. I've listened to all 3 of the books mentioned and am currently enjoying his collection of NYer essays "What the Dog Saw". His essay on Ron Popeil was terrific. Word of warning though ... you might find yourself sad to arrive at your destination and just sit in the car an extra few mins to finish a section!

</comment><comment><USER15> The Long Tail by Chris Anderson seems to fit the criteria extremely well. He must have figured out the MGB method before you.

</comment><comment><USER16> Getting away from criticizing or praising Mr. Gladwell, many, many authors have noticed that an effective way to write multiple best-sellers is to find a formula that works and stick to it. Michael Crighton is said to have read many best sellers and made notes about their structure so that he could develop his own formula for writing a best-selling novel.

</comment><comment><USER17> If you are the type of reader that accepts everything you read as fact, then pointing out a formula isn't going to change that now is it?

Most popular TV shows are written on a 3 act formula yet you can still find them engaging, germane, and thought provoking.

In short formulas do not equal thoughtlessness.

</comment><comment><USER18> So basically, writing a "Malcolm Gladwell Bestseller" requires _a shitload of work._

</comment><comment><USER19> Author misses Gladwell's largest advantage: he became a bestseller because he had laid the groundwork with years of writing magazine articles - built up an audience and alliances with huge, influential publications like the new yorker, NYT, etc.

</comment><comment><USER20> He missed "get a funky haircut".

<comment><USER21> Malcom Gladwell cuts his hair?

</comment></comment><comment><USER22> _books actually contain very few ideas. But these few ideas are chosen to be interesting to a general reader, to be understandable by a layman_ \- take almost any religious books - it is the same collection of short stories for a layman, which illustrate one simple idea at a time, so the formula was a thousands years old. =) Some of them were poetry in original language.

btw, famous books by Dale Carnegie are brilliant adoption of that style.

bbtw, in many cases of such writers (compilators) the first book is the best one. The Tipping Point (and, of course, How To Find Friends) is really enjoying one.

</comment><comment><USER23> This article is very strange. It's pretty cynical about Gladwell but his details on him aren't all negative are they? Gladwell sure is good at telling stories and proving points! It has to be a formula. A formula of what pretty much equals good writing and research.

<comment><USER24> Entertaining writing, maybe, but certainly not good/education writing. And certainly not good research.

Side note: He may have solid research, but it doesn't come out in the writing.

<comment><USER25> Perhaps the sad fact is that being entertaining and being accurate are conflicting goals. Who wants to listen to a complex explanation for why the "fifteen minutes of videotaped conversation" method (<http://en.wikipedia.org/wiki/John_Gottman> )for predicting the likelihood of divorce is flawed due to overfitting issues (see [http://www.stat.columbia.edu/~cook/movabletype/archives/2010...](http://www.stat.columbia.edu/~cook/movabletype/archives/2010/03/shooting_down_b.html) for details)

Gladwell doesn't let complex facts get in the way of a good story.</comment></comment></comment>


DA: Internet mogul hit girlfriend 117 times over a half-hour period  - <AUTHOR> http://www.sfexaminer.com/sanfrancisco/attorney-for-internet-mogul-gurbaksh-chahal-call-domestic-violence-charges-overblown/Content?oid=2540544

<comment><USER2> Hitting someone with your hands and feet isn't hacker news worthy. You can let me know when you see an abusive tech mogul outsourcing domestic violence to A.I.</comment>


37Signals on naming your company: don't use an "oogle bazoogle" type name - <AUTHOR> http://tl.justin.tv/clip/96f2bc84e8a

<comment><USER2> Another tip I'd like to add is not ending your company name in -'icroSoft.'

<comment><USER3> Or with random numbers like say "38" at the start.</comment></comment>


Job: Elite C Hacker for OpenDNS - <AUTHOR> A friend of mine at OpenDNS (SF-based startup) is looking for someone to fill this position:
Company: OpenDNS Job Title: Senior C Programmer -- Elite Hacker / Engineer Types Description: Elite C { Hacker | Software Engineer | Programmer }
The Opportunity:
OpenDNS is looking for an experienced unix (linux, openbsd, freebsd or solaris) software developer to join our engineering team. This is an opportunity to join an early-stage startup where you will be instrumental in architecting and developing software for next-generation Internet services.
You will be expected to work with us to design, code, test and deploy sound engineering solutions to complex problems. You will probably write code in C, but you should speak some scripting languages too.
The ideal candidate will be familiar with coding within a complete system and not just inside an IDE. Current and former OS hackers (linux kernel, freebsd, etc), database hackers (postgresql, oracle, mysql, etc), and popular daemon hackers might be great fits.
Some problems you might work on include:
- Helping collect, process and store large (LARGE!) data sets of DNS data. If you can chop a trillion rows of data without sweating, we want to talk to you. - Working on signal/noise algorithms to detect malicious traffic on the Internet and proactively stop it before it reaches its destination. - Optimizing network routing topologies to better traffic engineer data as it traverses our global network.
Requirements:
- A proven track record of getting software out the door and working well with a team. - Extensive network programming on a unix platform. - Comfort moving around a unix environment and using tools (for example) like make, strace, gdb, awk, sed, etc. - Experience with some or all of the following protocols: DNS, HTTP, SMTP. - Familiarity with various techniques for logging, storing and queuing data on a network, disk or memory system.
Bonus Points:
- BS or MS in Computer Science or related field. - Experience developing software to interoperate within the specs of various RFCs. - Experience with network routing protocols including BGP4 and OSPF. - Experience with non-SQL database systems - Familiarity with SQL (We use MySQL) - Familiarity with PHP. - Involvement in any Free or Open Source software projects. - Quick Skill List (aka, keyword fodder for craigslist searching) - C, libmemcache (memcached), Sockets, Network Programming, DNS, SVN, CDB (libcdb), hadoop, sawzall, BigTable, djbdns, apache, freebsd, debian, etc.

<comment><USER2> 415 287 7721 if you have questions. or david {at} opendns.com</comment>


Should C programmers learn C++, Go or Rust? - <AUTHOR> https://ds9a.nl/articles/posts/cpp-rust-go/ <comment><USER2> C programmers should keep their skill at C and wait for a suitable job. While waiting, you can do the "cash-crop" programming.</comment>


Peter Thiel wants to stop aging and live forever - <AUTHOR> http://venturebeat.com/2014/10/08/billionaire-peter-thiel-may-want-to-live-forever/

<comment><USER2> I bet He will failed!</comment>


Ask HN: Is Facebook interview is all random - <AUTHOR> Here is the text from one of the interviewer who clear the fb interview "The second interview was very hard they asked me a leetcode hard question and I was only able to solve it because I did the exact question before. Complete luck there. Personally I think it was unreasonable to expect someone to solve that difficult of a question in 30 minutes. The overall acceptance rate on the question on Leetcode is around 20%." https://leetcode.com/discuss/interview-question/563659/facebook-ml-engineer-santa-monica-pending <comment><USER2> Yes, that's how it works. Memorize all the problems ahead of time.</comment>


Ask HN: Tools for reversing? - <AUTHOR> Hello I would like to learning reverse engineering, and I would like to know what kind of tools would you recommend a beginner to use, I know there is IDA pro but the license is way too expensive for me right now, and there is GDB, is is there any plugins that can be helpful and any other tools you recommend? <comment><USER2> [http://x64dbg.com](http://x64dbg.com)

[http://radare.org/r/index.html](http://radare.org/r/index.html)

[https://github.com/joxeankoret/pyew](https://github.com/joxeankoret/pyew)

[https://inguma.eu/projects/bokken](https://inguma.eu/projects/bokken) (hasn't been updated in a while)

[http://www.capstone-engine.org/showcase.html](http://www.capstone- engine.org/showcase.html)

[https://en.wikibooks.org/wiki/X86_Disassembly/Disassemblers_...](https://en.wikibooks.org/wiki/X86_Disassembly/Disassemblers_and_Decompilers) (free/open-source stuff towards the bottom of the page)

</comment><comment><USER3> What about good old ollydbg? Or just grab Kali and read the docs on the tools included with that

<comment><USER2> Only prob is development has seemed to stall on it and it only supports 32bit Windoze versions so no official support for anything past XP.</comment></comment>


Ask HN: Think GPS like system but local - <AUTHOR> Hey, actually i need to measure distance several points which will have barriers between them like human body and cloths etc...
I was thinking about infrared sensor but they can't pass through the body.
GPS does work to find distance between two points.
But can i setup a local gps in a room so it gives me accuracy in millimetres instead of meters like with ordinary GPS? If so, how? Can you suggest anything better?
Distance between two points is limited to 8 feet max. <comment><USER2> Differential GPS will get you 10cm accuracy. Getting into the mm range is a whole other thing.

[https://en.wikipedia.org/wiki/Differential_GPS](https://en.wikipedia.org/wiki/Differential_GPS)

</comment><comment><USER3> Wow, there aren't sensors which already are capable of measuring distance between two points with error less than 1mm. (With barriers in between)

I am kinda shocked at the state of affair.

</comment><comment><USER4> it really shows that you didnt even think about it once :D

look at how gps works (its really simple) then look at some passive systems and some active ones

you will see why noone made an elegant solution yet

<comment><AUTHOR> Can't believe there isn't already a system which is capable of offering error within 1 millimetre.

<comment><USER5> Can't believe?

Because triangulation with signals from orbit passing through the atmosphere is trivial?

<comment><AUTHOR> I am not taking about GPS.

I need GPS like system with satellite confined in a room capable of resolution within 1mm error.

<comment><USER3> I think there are several systems like LIDAR with less a millisecond error.</comment></comment></comment></comment></comment>


Standalone WebGL, or a browser for the Oculus Rift - <AUTHOR>

Is anyone interested in working with me on a project, which is basically a web browser built for the Oculus Rift?
My idea is simple - build a native app (using spidermonkey or v8) that lets you take your WebGL project and run it without a conventional browser.
What would be different about this vs. existing attempts at making browsers do VR?
- no 2D UI (or DOM, or stylesheets)
- this project wouldn't take 40 minutes to compile, unlike the major browsers
- much better integration with Oculus features (such as the changes in rendering in the 0.4 SDK, etc.)
Right now, all I have is a fork of Elijah Insua's WebGL-standalone project (which hasn't been updated in three years).
https://github.com/maxharris9/WebGL-standalone
I've spent the last couple of days messing around with it, and while it doesn't work very well yet, it is a start. If anyone is interested, I'll post build instructions. <comment><USER2> I have a friend that has been doing this for his masters disposition for the last 2½ years. I won't say how he's been realizing his idea, but he's come really far.

<comment><AUTHOR> Could you put me in touch with him? (On Twitter, I'm MaxHarris9)

I think this is really exciting!</comment></comment>


Words 2 Final Beta (the serious version) now available for free download. - <AUTHOR> http://www.newnet-soft.com/blog/words-beta-final

<comment><AUTHOR> Would love to hear what you guys think about it.</comment>


Harry – A Tool for Measuring String Similarity - <AUTHOR> http://www.mlsec.org/harry/ <comment><USER2> What does "small tool" mean here? There seem to be a wide number of different comparisons.</comment>


Adventures in Cocotron (cross-platform Cocoa apps) - <AUTHOR> http://macdaddyworld.com/2008/10/27/adventures-in-cocotron/

<comment><USER2> FYI: This article is over a year old.

Luckily, it appears cocotron is still active: <http://code.google.com/p/cocotron/source/list></comment>


Has James Gates Discovered Computer Code in String Theory Equations? [2012] - <AUTHOR> http://www.transcend.ws/has-james-gates-discovered-computer-code-in-string-theory-equations-welcome-to-the-matrix/

<comment><USER2> This is a link to Gate's layman writup of the work [http://www.onbeing.org/program/uncovering-codes- reality/feat...](http://www.onbeing.org/program/uncovering-codes- reality/feature/symbols-power-adinkras-and-nature-reality/1460)

Hamming codes are in the equations, which he thinks is a sign that someone put them there. Or alternatively, perhaps its impossible for an information preserving universe to exist without them (anthropic principle)

</comment><comment><USER3> Can somebody who is not brain dead (as the author of the article seems to be) summarise what Gates actually means? I can't watch the video because I'm at work and the article itself is completely devoid of meaningful content.

<comment><USER4> Well, you see, first you get some really good pot and a few tabs of acid, and then…

</comment></comment><comment><USER5> I think it is reasonable to assume that the observable universe is an "emergent property" of some fairly simple and straightforward "rules". But therein lies a great difficulty - even if/when we get to the rules they will be very difficult to relate to the physics we observe.

The fact that the underlying "rules" might be simple and thus might be conceived of as some sort of program hardly leads one to the conclusion that reality is a computer simulation.

<comment><USER6> Isn't this basically what Stephen Wolfram was describing in "A new kind of science"?

</comment></comment><comment><USER7> It's not quite as spectacular as it sounds[1].

I've not read the paper, but it seems as if they've just found a convenient way to describe supermultiplets in 1D using doubly even codes[2].

[1] [http://arxiv.org/abs/1108.4124](http://arxiv.org/abs/1108.4124)

[2] [http://planetmath.org/evencode](http://planetmath.org/evencode)

</comment><comment><USER8> Nope, and here's why: If you take a valid code and flip one bit, you get an invalid code. But if you take a particle and (somehow) change one attribute, you get a completely valid particle. It's impossible to change just one attribute at a time, but you can wander around the graph and eventually arrive at every point.

<comment><USER9> Like [https://en.wikipedia.org/wiki/Lights_Out_%28game%29](https://en.wikipedia.org/wiki/Lights_Out_%28game%29) ?

But I don't see how your explanation is compatible with their claim that found a neat structure like a "doubly even self-dual linear" ECC. _If_ their claim is that all transitions maintain that structure, then you are guaranteed to stay inside the structure no matter how long you wander around the graph.

<comment><USER10> I was thinking more like a Drunkard's Walk[1]. Eventually, every possible location (state) will be visited.

[1] [http://en.wikipedia.org/wiki/Random_walk](http://en.wikipedia.org/wiki/Random_walk)

<comment><USER9> If you have an integer random walk and the step sizes are multiples of 3, you cannot reach a location that is not a multiple of 3. The ECC structure they described is similar to the set of multiples of 3: for example, an analog computer trying to simulate such a walk would periodically round the location to the nearest multiple of 3 to counter the effects of noise. The rounding does not change correct computations (becase they would already be multiples of 3), but it increases the likelihood that the result of the computation is correct.

</comment></comment></comment></comment><comment><USER11> wouldn't the more obvious conclusion be that the Hamming codes are a reflection of the universe instead of the other way around....

</comment><comment><USER12> You can test for a computer simulation: [http://www.simulation- argument.com/](http://www.simulation-argument.com/)

</comment><comment><USER13> Yes, I'm sure our Universe runs on $hitty assembler code (or maybe it's C and Java?) :-)

</comment><comment><USER14> Why I am reading this crap?</comment>


Cloud SQL for PostgreSQL adds high availability and replication - <AUTHOR> https://cloudplatform.googleblog.com/2017/11/Cloud-SQL-for-PostgreSQL-adds-high-availability-and-replication.html <comment><USER2> This blog post is confusing, and I'm having trouble figuring out what they're talking about in the Cloud SQL documentation. What are these regional disks? Why should I care about them as a customer?

Their mention of replication makes it sound like they are behaving similarly to RDS' Aurora instances ie. they store data using something like Google Cloud Storage, and replicas all read from the same storage location instead of doing "real" logical replication, and data modifications are handled using copy-on- write.

If anyone can explain, I'd really appreciate it.

<comment><AUTHOR> My understanding is that there are two VMs running in different zones within the same region, the primary, and a failover. Instead of writing to a zonal disk (the standard behaviour for a non-HA Cloud SQL instance), the primary's writes go to a new Regional Disk. The regional disk is replicated synchronously between two zones, rather than writes going to a single zone.

The obvious question you're having here is "Won't that be slower?" and the answer is yes it will necessarily be slower due to physics. However on the Google Cloud public Slack ([https://gcp-slack.appspot.com](https://gcp- slack.appspot.com)), it was mentioned that networking for zone to zone is similar to machine to machine, so this is likely to not be an issue.

If the primary instance fails (either because of machine/rack/zone failure), it will stop sending heartbeats and the failover will try to mount the regional disk and become the primary. Because all writes are synchronously replicated, no data loss occurs, although your service will be unavailable until failover completes.

> Their mention of replication makes it sound like they are behaving similarly > to RDS' Aurora instances

I don't think anything this fancy is happening, to my understanding it is just a disk that happens to be synchronously replicated to two zones. Under the covers they may be doing some smart copy-on-write stuff, but that isn't exposed to the user.

From the sound of the blog post they plan to unveil regional disks sometime soon, so we may get more info then.

<comment><USER3> > From the sound of the blog post they plan to unveil regional disks sometime > soon, so we may get more info then.

Someone from Google confirmed this in a comment: _" Regional Disks will first be used by managed services like Cloud SQL, but watch for a future announcement about Regional Disks as a public feature"_.

</comment></comment></comment><comment><USER4> Is anybody here who has used both AWS RDS and Google Cloud SQL? Any feedback/comparison? Any special points one should consider while moving from RDS to Cloud SQL?

<comment><USER5> I use both. From an application perspective, i haven't noticed a difference. The Google console is much easier to use however. The one big difference i know of is that on google cloud sql, they dont give you super admin.

<comment><USER4> Thanks for the info. Planning to try out Cloud SQL soon.

</comment></comment></comment><comment><USER6> Been looking forward to this as well. RDS is a solid service but it's good to have competition. Will be great to see PostgreSQL adoption widening and growing with 2 major cloud provider offering it as managed service.

<comment><USER7> MS Azure also provides Postgres now [1]. And also does Alibaba Cloud [2]. They even have a special version of it – something for analytics/warehousing [3]. So at least 4 big cloud providers have Postgres!

1) [https://azure.microsoft.com/en- us/services/postgresql/](https://azure.microsoft.com/en- us/services/postgresql/)

2) [http://www.pgconf.asia/JP/wp- content/uploads/2016/12/Postgre...](http://www.pgconf.asia/JP/wp- content/uploads/2016/12/Postgres-on-Alibaba-Cloud.pdf)

3) [https://www.alibabacloud.com/product/hybriddb- postgresql](https://www.alibabacloud.com/product/hybriddb-postgresql)

</comment></comment><comment><USER8> Awesome news! My job involves using the current mysql cloud SQL with replication, and boy does it suck. Every schema change (even adding an index) causes the replica to get stuck behind and never catch up. Apparently this is a 'documented limitation' and deleting/recreating the replica is the supposed solution.

Urgh. I'm hoping this is a mysql issue and pg doesn't suffer from this.

<comment><USER9> I would assume this has to do with MySQL's lack of transactional DDL, but I haven't looked into it at all. I actually don't mind MySQL as much as people complain about it, but I haven't dealt with any cases that requires more than a single read replica.

</comment></comment><comment><USER10> Good news, it's a pitty that it's still in beta. I would love to use it for a project that should run in production and so on i'm "stuck" with VM running postgress and replication with repmgr and barman. it works, but it's a lot of work to set it up and mange it.

</comment><comment><USER11> Awesome! Was creating an instance today and saw the welcome addition. Had to do a double take.

</comment><comment><USER12> Since there are some GCP folks here occasionally: is there any ETA for PostgreSQL going GA in Google Cloud?

Would love to use it, but can't use it in beta.

</comment><comment><USER13> I am currently starting a project using heroku (node.js/postgres). Is there any reason to try out app engine with cloud sql instead?

<comment><USER14> If you know Heroku and you're not worried about its price then stick with it. Move to GCP when Heroku becomes too expensive.</comment></comment>


Screw social media and get back to work - <AUTHOR> http://mashable.com/2012/11/02/social-media-work-productivity/

<comment><USER2> Good points here, but I have been seeing some great gains from social media.</comment>


HN is penalizing Tor users - <AUTHOR> I am unable to use mobile apps for HN since I use Tor full time and HN wants me to constantly complete captchas to prove I am human.<p>I am human. Thanks. <comment><USER2> What browser are you using? We fixed our Tor handling long ago. Would like to understand what you are seeing.

<comment><USER3> (Not the OP.) I'm using Tor Browser on a desktop/laptop. I'm seeing different problems:

(1) Rate-limiting: My regular account (this is a throwaway) has thousands in karma, but after around 4 comments I still get the 'you're posting too fast' rate limiter. Perhaps HN could disable rate-limiting after the Tor user has a certain amount of karma.

(2) Comments seem penalized, starting in the middle of threads instead of at the top. This issue has come and gone a couple of times (it's happening now on my regular account). It seems to stop when I have had an interaction with the mods; I wonder if they notice and disable it. It seems to restart after I get several downvotes in a short period; perhaps that triggers some algorithm which decides that comments over Tor are shady.

(3) Registering accounts requires a captcha and is frustrating, though something I rarely have to deal with. To register this throwaway account I got a captcha, completed it, approved. HN said the username as taken, and when I entered another username the process started over - another captcha. Then the username was too long, so I started over again.

<comment><USER4> I suspect these are not related to your use of Tor. Note that jgrahamc is at Cloudflare, not HN, and was asking about the Cloudflare interactions people on Tor are having, as the CAPTCHA the OP is speaking about is implemented by Cloudflare.

I am currently rate-limited, I have been on rate-limiting before, and I've had my rate-limiting disappear. This has more to do with how happy (or unhappy, as the case is) the mods are with your commenting habits than what browser you are using. I do not know if your rate limit penalty has an expiration date or if they manually remove you, HN mods rarely if ever discuss rate limiting, but it is almost surely to curb what HN mods consider poor quality comments and ensure they don't overwhelm a discussion.

<comment><USER5> It's not so uncommon that we discuss rate limiting. We do that all the time when people email us and I've posted not infrequently about it: [https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme...](https://hn.algolia.com/?sort=byDate&dateRange=all&type=comment&storyText=false&prefix=false&page=0&query=by:dang%20rate%20limit). People are welcome to ask questions, though as the site guidelines ask, it's better to do that by emailing us.

Being rate limited is annoying, so I appreciate the even-handedness in what you wrote.

</comment></comment></comment></comment><comment><USER4> HN isn't "penalizing Tor users", but HN does use Cloudflare.

94% of the requests Cloudflare saw over Tor were malicious[1], but rather than block Tor, they implemented a couple of ways to prove you are part of the 6%, including a browser extension[2] that can get you out of the CAPTCHAs.

[1] [https://blog.cloudflare.com/the-trouble-with- tor/](https://blog.cloudflare.com/the-trouble-with-tor/)

[2] [https://blog.cloudflare.com/cloudflare-supports-privacy- pass...](https://blog.cloudflare.com/cloudflare-supports-privacy-pass/)

<comment><AUTHOR> Malicious how? No one is going to stop bots scraping the site so why penalize humans?

<comment><USER6> I wrote a little script to watch Tor traffic to my servers and way more than 94% is either clearly malicious or probably malicious. Malicious is clearly scans, bruteforcing attempts, and so on. Malicious is obvious most of the time when I look at the web logs. "Probably Malicious" is something like an odd single hit to an index page, really not quite sure what they're doing, but it's clearly not a person looking at the site. Tor traffic is almost never a person looking at a website based on what I see in my Apache logs.

Most clearly malicious traffic to my servers is not Tor, but most Tor traffic is malicious. This is what I see to my servers, you may see different traffic on your servers.

<comment><AUTHOR> Sweeping bans of users based on shared IP addresses should never be more than a very short term stopgap solution.

There are other ways to solve these problems. As just one example you could support protocols like U2F or FIDO2 that take brute forcing off the table, and the brute forcers go away.

As another example I offer free unix shell services to the general public. Lots of people were using Tor to create accounts for cryptocurrency mining. Instead of banning Tor I blocked all outgoing traffic to all major mining pools. The mining abuse stopped.

Try to find ways to remove the incentive for bad behaviour, rather than throwing out the good with the bad.

<comment><USER7> I appreciate the way you think. I'd love to hear you brainstorm on social problems using the same approach.

</comment></comment></comment></comment></comment><comment><USER8> Well, I think there may be too many peers using pretty limited number of exit nodes to access HN (or any other popular site), currently 1109 hosts, source: [https://www.dan.me.uk/tornodes](https://www.dan.me.uk/tornodes)

</comment><comment><USER9> Send an email to the mods email@example.com Perhaps they can solve your problem.</comment>


CSS vendor prefixes redux - <AUTHOR> http://www.quirksmode.org/blog/archives/2010/03/css_vendor_pref_1.html <comment><USER2> Ive always found that whenever you implement browser specific code, you always end up with a headache one or two years down the road. The big browser players can invent any specific stuff they want but as a developer its always best to stick with the standards. If you want to experiment on non-live code then great, but plan on future pain if you go live with browser specific css/js.</comment>


Domain hacks with unusual Unicode characters (2018) - <AUTHOR> https://shkspr.mobi/blog/2018/11/domain-hacks-with-unusual-unicode-characters/ <comment><USER2> > It could also be used for evading URl filters.

If the filter is a whitelist then it can't. If it's a blacklist then there are so many ways round filters already (e.g. redirect the link) so this won't help much.

</comment><comment><USER3> I don't want to rain on this person's parade, but I think this is a horrible idea. This is great for phishing but a really bad choice for your actual domain, because it's basically impossible to type out the URL (or even convey: it's "foo.tel but the 'tel' is small for some reason?") and you're already seeing a bunch of tools break on it. (To really drive the point home, the final link the article had a box in it on my computer.)

<comment><USER4> Except, it's equivalent to normal .tel. This URL points to the article above, with all the unhacking done client-side:

[https://xn--69f31l4t57c0mag4b613h.xn-- 7uh4898msjaso/🆆🆃🅵/](https://🅂𝖍𝐤ₛᵖ𝒓.ⓜ𝕠𝒃𝓲/🆆🆃🅵/)

(that's https;//🅂𝖍𝐤ₛᵖ𝒓.ⓜ𝕠𝒃𝓲/🆆🆃🅵/)

<comment><USER3> Cool, it has the exact same issue here as well. (It shows up as boxes.)

</comment></comment></comment><comment><USER5> Could this be used in a XSS attack where there are very limited characters to use after the src= tag, where it would resolve to a valid domain with more characters?

<comment><USER6> Potentially, depending on how the character counting is done (if it counts grapheme clusters instead of bytes I guess?)

</comment></comment><comment><USER7> You might be interested in this — an example where the company logo is the domain name, and vice versa:

[https://xn--bj8a.com](https://ꑮ.com) (ꑮ.com)

(Safari on macOS and iOS displays the symbol in the address bar.)

<comment><USER8> huh. that's an attack other browsers have fixed by using punycode. i wonder does safari have blacklist for homoglyphs but renders others as the intended glyph.

<comment><USER7> The whitelist for Safari on macOS is kept in a text file entitled IDNScriptWhiteList.txt, located at /System/Library/Frameworks/WebKit.framework/Versions/Current/Resources

ꑮ is from Yi script, which is obviously whitelisted.

</comment></comment></comment><comment><USER8> > Here are the single characters which can be normalised down to a valid TLD

only TLDs or anywhere in the name? i suspect this is special treatment for TLDs

</comment><comment><USER9> A work buddy got an emoji domain (.ws) but couldn't find an email server that could work with emoji domain email addresses.

<comment><USER10> He was probably trying to type emojis into form fields instead of punycode.

</comment></comment><comment><USER11> I'll admit this is pretty neat. Unclear if I will ever use this information, but I'll always know it now.

</comment><comment><USER12> Why does Unicode have different code points for same letter rendered with different type faces?

<comment><USER13> Accidentary math symbols. Sometimes there is semantic difference between 𝒎, 𝐦, 𝕞, m which will be lost in plaintext rendition of a formula. Yeah, you'd better be off with TeX for this specific purpose, but that's a valid point for having those font variations.

And it's not a generic modifier because those code points predate the expanse of emoji and all surrounding normalization of modifiers. Language tags are considered a bad idea, for example, so it's not all clear that it's necessary for Unicode to convey semantics as well.

<comment><USER12> Thank you. I should have figured this out myself. I've been postponing going down the Unicode rabbit hole.

Here's some relevant entries.

𝐦 217F SMALL ROMAN NUMERAL ONE THOUSAND [http://unicode.org/cldr/utility/character.jsp?a=217F](http://unicode.org/cldr/utility/character.jsp?a=217F)

[https://en.wikipedia.org/wiki/Mathematical_operators_and_sym...](https://en.wikipedia.org/wiki/Mathematical_operators_and_symbols_in_Unicode)

Whelp. That's a lot to ingest. I suppose if (when) I have to do Unicode for real, I'll need to find the 'ascii' command line tool equivalents for Unicode.</comment></comment></comment>


Ask HN: You're a founder, do you ignore recruiters? - <AUTHOR>

Like most people here I'm working to get my company up and running. But I come from a freelance background, and I still get plenty of calls and emails proposing jobs.
I'm in two minds as to whether I just politely tell them I am no longer in that industry and no longer available, or do I stall in case it all goes wrong and I need to get back on the treadmill to feed my family.
I also see good relations with everyone as a very good thing to have because you never know when you might just need someone or an opportunity (not a job) presents itself.
What's your thoughts? <comment><USER2> I just tell them exact truth. I'm dedicating everything I have to my company (Intercom), and as such I'm not listening to offers. If they want to check in in a year or so, it's no harm but the answer will be the same.

Firm politeness never hurts. But it has to be firm.

</comment><comment><USER3> I think you've answered your own question.

My opinion: There's almost always some $ threshold above which it makes sense to take on a freelance job. Choose your threshold and make it clear to any recruiters. It's always worth keeping good relations, as you say.

</comment><comment><USER4> Say you've raised your rates because the industry lately have been getting you A LOT OF WORK, then ask for a value that would be interesting to you($200+/h?). If the client runs away, you still have chance to get back to him after a while.

<comment><AUTHOR> This sounds alright in principle, but I could be shooting myself in the foot for later - I hate to go down on rate ever so setting the bar higher is probably not the answer.

I take the sentiment though.

</comment></comment><comment><USER5> Unlike some of my colleagues, I am polite to recruiters. I never know when they might put me in touch with an early stage hire, even if it's out of scope from what they're doing now. Also, you never know when you're looking to scale and having some relationships in place can be helpful.

Don't forget, that even though they can be annoying and a bit out of touch with what position reqs actually are, they're human too, and a little short but polite response about your situation can go a long way.

</comment><comment><USER6> Others have made excellent comments here. I want to add this:

\- Mention that unless it's for a certain price range, you're no longer in the market. However, you will keep them in touch when you're changing the policy again.

\- If the pricing/arrangement doesn't work for both parties, say you're happy to refer them to someone else who could use those projects.

Also, stay in touch with them regularly, but you don't need to go overboard on this, as you want to focus on your company.

</comment><comment><USER7> No because First, because you might know someone who WOULD be a fit for what they are pitching. Second, you can let them know if your company is looking or will be looking for someone with a skillset. Third, if they are someone in your industry there is the chance to learn a few things if they are a GOOD recruiter.

I wouldn't put a lot of time into dealing with them, but a minute or two won't kill you.

</comment><comment><USER8> Neither. You say that you're currently working on a project and they should contact you again in X months.

I usually say 3 months - but it depends on your confidence.</comment>


Washington state sues Comcast (for $100M) - <AUTHOR> http://arstechnica.com/tech-policy/2016/08/washington-state-sues-comcast-says-it-sold-near-worthless-service-plans/ <comment><USER2> Does the report mention that Washington State has been trying to serve papers for a few years now but is still on hold?

(Is against the rules to joke in comments?)</comment>