I Just Poured Water on my Scanner - <AUTHOR> http://www.cpushack.com/2015/03/29/i-just-poured-water-on-my-scanner/ <comment><USER2> I remember having to use special oils to use some high magnification microscope lenses in a process known as 'oil immersion microscopy'. I didn't read much about how it worked before but I assume it is the same process. There was no other way for me to get the magnification I needed to count the reletive number heterocyst cells in strands of cyanogenbacteria for my biology coursework.

I would suggest to the author that they buy some microscopy oils as they will have a higher refractive index to water.

[https://en.wikipedia.org/wiki/Oil_immersion](https://en.wikipedia.org/wiki/Oil_immersion)

</comment><comment><USER3> If the scratches are on the glass it could work even better to use a liquid with the same refractive index as the glass. That should make the scratches go away completely.

One option is glycerin as can be seen in this video: [https://www.youtube.com/watch?v=pNWCB_GoQA4](https://www.youtube.com/watch?v=pNWCB_GoQA4) (maybe it only works with pyrex glass ?)

Another option is to mix to fluids together, one with a higher index of refraction and one with lower. That way you can tune it to your particular scanner (although I would think most are the same).

How you see if your mix has the same refractive index as the glass I haven't figured out yet.

<comment><USER4> Similarly, you can scrub some scratched up glasses with toothpaste to fill in the air gaps. Good as new (at least until it rains).

<comment><USER5> That doesn't work the same way, that polishes the edges of the scratches so they're not as distinct.

</comment></comment></comment><comment><USER6> Clickbait title, of course.

For film scanning, this is known as a wet-gate transfer.[1] It's standard procedure for digitizing old cine film. The working fluid used has the same index of refraction as the film backing, so scratches disappear.

The guy who's photographing ICs just needs a toy-grade digital microscope.[2]

[1] [http://www.arri.com/archive_technologies/archive_challenges_...](http://www.arri.com/archive_technologies/archive_challenges_and_solutions/arri_solutions/wet_gate/) [2] [http://www.amazon.com/ThinkGeek-P510002-Digital-Blue- Microsc...](http://www.amazon.com/ThinkGeek-P510002-Digital-Blue- Microscope/dp/B000059TF3)

</comment><comment><USER7> As the article points out, this is not a new technique. Increasing your resolving power by immersion of the target object in a liquid medium is actually used in ICs manufacturing.

This is because resolving power is directly proportional to numerical aperture, which is in turn proportional to the refractive index of the medium between the imaging device and the target object.

As a result, it works both ways: you can use it to increase resolution while _either_ sending _or_ receiving beams of light. For instance, the same technique is also used in light microscopy.

In the end, this is a clever and straightforward hack.

<comment><USER8> You are talking about immersion lithography. It replaces the air gap from the final lens of the lithography system with water which has greater IOR. AMD has been using it for a while, probably before the 45 nm node. Strangely enough Intel was not using it until the 32 nm node. It's the same hack with oil immersion lenses, basically, for the optical microscopes.

<comment><USER9> If you didn't watch this video before... [https://youtu.be/NGFhc8R_uO4?t=15m50s](https://youtu.be/NGFhc8R_uO4?t=15m50s)

<comment><USER10> This is a great presentation on the evolution of transistor manufacturing processes. I didn't know how a transistor worked before watching this video, yet was engaged by the technical narrative of the semiconductor industry overcoming one physical constraint after the other.

</comment></comment></comment></comment><comment> Brian-Puccio Fluid mounting things to scan them is something that photographers have been doing for a while. The higher-end Epson flatbed scanners (which is really a low-end film scanner) have fluid mount options [0] while fluid mounting for drum scans [1] (high-end film scanners) is the norm unless you get a flexframe model from Hasselblad which doesn't use glass (so no need for a fluid). Plus wet mounting your scans helps with the Newton rings issue.

[0] [http://www.photo-i.co.uk/Reviews/interactive/Epson%20V750/pa...](http://www.photo-i.co.uk/Reviews/interactive/Epson%20V750/page_7.htm) [1] [https://www.youtube.com/watch?v=aCHS5yiF4Mc](https://www.youtube.com/watch?v=aCHS5yiF4Mc)

<comment><USER11> I'm not convinced that the flextight (talking about what used to be Imacon, right?) options are a complete substitute for wet mounting, because wet mounting will reduce the appearance of scratches on the film itself, but eliminating the glass doesn't fix that particular problem.

<comment> Brian-Puccio I'm sorry, I should have posted more clearly. Yes, you will reduce film scratches (and Newton rings and glass scratches) if you wet mount. You will only reduce Newton rings and glass scratches if you use an Imacon/Hasselblad since there is no glass to scratch or produce Newton rings. So, yes, I do think that a wet mounted drum scan will still get you the best quality.

</comment></comment></comment><comment><USER12> This is super common amongst film photographers - it's a wet scan. Works wonders. Some of the fanciest "drum" scanners out there work this way exclusively.

</comment><comment><USER13> "The markings are laser etched directly onto the surface of the silicon die."

That's the package, not the silicon die.

<comment><USER14> It's both! [http://i00.i.aliimg.com/wsphoto/v0/1639827880/Free- shipping-...](http://i00.i.aliimg.com/wsphoto/v0/1639827880/Free- shipping-5PCS-QG80331M500-SL9BE.jpg)

<comment><USER14> Assuming someone downvoted because they didn't understand or felt I didn't explain enough... That chip in the picture (the intel QG80331M500, the chip in question) is a flip chip package; instead of using wire bonds to connect to pads on the die, it has solder balls like a BGA package. The chip is soldered down to a carrier PCB and an underfill glue/sealant is applied around it, so the only thing exposed is the bare back of the die. There is no plastic package to laser-engrave, the engraving is done right on the silicon.

</comment></comment></comment><comment><USER15> I was hoping to see scans of the actual silicon, but I guess that requires more exotic equipment. It seems to me that imaging the chips would be easier and better using a DSLR and a good macro lens.

<comment><USER16> Zeptobars has some nice shots of silicon dies. As a random example [http://zeptobars.ru/en/read/Nordic-NRF24L01P-SI24R1-real- fak...](http://zeptobars.ru/en/read/Nordic-NRF24L01P-SI24R1-real-fake-copy)

I estimate that those images are taken with equivalent of about 60000 DPI. Even with that sort of resolution you can't really resolve the details in the smaller features.

In comparison typical macro lenses have 1:1 magnification, so e.g. D800 DSLR with 36MP sensor would have theoretical maximum of roughly 5000 DPI, and I would expect the reality to be quite a bit harsher than that.

</comment></comment><comment><USER17> This article was on the home page for a while with the title "Immersion scanning", a pretty dull one. Thanks to whoever changed it to "I just poured water on my scanner"! Makes a much more intriguing and appropriate title.

<comment><USER18> I disagree. It now sounds like 100 other clickbait titles - "The 10 best ways to lose weight!", "The one true way to scan that the manufacturer doesn't want you to know!"

<comment><USER19> I assumed it was an intentional tip of the hat to the "I just put my laptop in the oven" hack.

</comment></comment></comment><comment><USER20> I don't understand. Why not just use a decent resolution digital camera to take a picture of the chips?

<comment><USER21> I don't see how that will help.

Wouldn't it be harder to try to get a good picture of the chip in such an angle that you could read the etching?

I assume this angle will most likely be "from the top", such that it basically turns into a scanner, and then it's easier to do it with an actual scanner.

<comment><USER20> But with the camera you have control over the lighting, and can move the lighting such that the etching has more contrast.

I'll just assume that they tried the camera and the scanner works better.

</comment></comment></comment><comment><USER21> Besides being a very interesting hack, this made me laugh:

"(and contained as to not get IN the scanner, as that does NOT help the process)"

Not sure why but this seemed really funny in the technical context.

</comment><comment><USER22> That's a really cool technique! Though it looks like his scanner glass is scratched to hell and back (I wish they'd make the glass more scratch resistant.) My exact scanner type, too. I would say it's definitely fast at 300dpi; but it takes well over 90 seconds for 600dpi (full scan, chip scan would be faster of course), never dared try 1200dpi.

Also too bad I can't use use this trick when scanning cardboard boxes and manuals.

<comment><USER23> > Though it looks like his scanner glass is scratched to hell and back

I don't think the scratches are on the scanner, since they're in the same location on both images and the CPU had to be moved to be placed in water.

<comment><USER22> I tried to compare the two to rule that possibility out, but it's possible I'm mistaken. That would be good though, I'd hate to think they were scanning things with all that scratch damage getting on every picture.

</comment></comment></comment><comment><USER24> I don't see resolution improving all that much, only contrast, as a quick and dirty photoshopping can show:

[http://i.imgur.com/cGAPhgn.png](http://i.imgur.com/cGAPhgn.png)

<comment><USER25> The contrast of the engravings on just the chip is what was improved the most, not the resolution itself.

And speaking only for myself, there are still a number of markings in your photoshopped image which I am unable to read, which can be clearly read on the immersed image.

</comment></comment><comment><USER14> That's a solid improvement, but I bet they could get better results with some other machine vision tricks. Diffuse on-axis lighting [1] would probably be a good approach for this application; it's good at making subtle markings on flat surfaces stand out.

[1] [http://www.microscan.com/en-us/products/NERLITE-Machine- Visi...](http://www.microscan.com/en-us/products/NERLITE-Machine-Vision- Lighting/Smart-Series-DOAL-Illuminators.aspx)

</comment><comment><USER26> Some holographers use Xylene as an index-matching fluid. Other suggestions here including decalin and sugar water:

[https://books.google.com/books?id=tiGP9MrVs90C&pg=PA242&dq=i...](https://books.google.com/books?id=tiGP9MrVs90C&pg=PA242&dq=index+matching&hl=en&sa=X&ei=s4QZVZXZFIHTggSB24DYDQ&ved=0CCoQ6AEwAg)

</comment><comment><USER27> I'd be curious whether you'd be able to reduce the noise (not the same as lensing, obviously) if you used tape like this: [https://www.youtube.com/watch?v=nRoL2q-tU-Q](https://www.youtube.com/watch?v=nRoL2q-tU-Q)

I've never had to scan things like your process so I have no clue; just a thought.

</comment><comment><USER28> This sounds a lot like how an oil is used to look at slides in medical labs.

For example, it may be standard procedure to smear a sample along the slide, place it on a stainer, retrieve it later, put some oil on it, and the lens of the actual microscope will come in contact with the oil.

</comment><comment><USER29> Fixing it on the top surface is good, but there's still another air-gap between the bottom of the scanner glass and the head. A bit harder to fill that gap with water though.

</comment><comment><USER17> Dont chips get destroyed when powerful light (like the one in the scanner) hits them? Or is the point of scanning chips just to get their specs on file and not to preserve them?

<comment><USER30> There are some kinds of chips that can be reset by certain kinds of light ([http://en.wikipedia.org/wiki/EPROM](http://en.wikipedia.org/wiki/EPROM)). Apart from that, packaged ICs aren't generally damaged by light that isn't at a laser-like intensity.

</comment></comment><comment><USER31> I wonder -- does scratch removal software help in such cases?

It seems to do wonders with certain cases of slide scans, so I wonder if it helps with these kinds of wet-mount scans as well.

</comment><comment><USER32> Wet mount scanning can do a world of good. Some examples: [http://www.scanscience.com](http://www.scanscience.com)

</comment><comment><USER33> Pretty slick trick I must say...

</comment><comment><USER34> aaaaaand it's gone.

<comment><USER35> It's just to get rid of the air gap between the glass and the chip. The intent isn't to break the scanner.</comment></comment>


Seven months later, Valve's Steam Machines look dead in the water - <AUTHOR> http://arstechnica.com/gaming/2016/06/its-time-to-declare-valves-steam-machines-doa/ <comment><USER2> Well, those machines are basically insurance against MS locking out third- party stores. They don't need to turn a huge profit; they need to recoup costs and be ready to scale up if shit hits the fan.

So really the question is, are Valve making their money back? If yes, cool, they have free insurance. If not, that insurance is being paid for and obviously there's a cost/benefit analysis to be done. I don't think this piece answers that. It suggests they might have got something south of $750m, which seems high enough to be quite profitable. A better article would have cross- referenced this with any financial data on Valve that they could find, to see if they're actually losing money on these machines.

<comment><USER3> Valve doesn't manufacture Steam Machines, OEMs do. Are the OEMs making their money back? Well, Valve has disclosed that 500k Steam Controllers have been sold (as the article notes) which is a hard upper bound on the possible number of Steam Machines sold since each Steam Machine comes with one Steam Controller. Practically speaking, probably less than a third of them actually sold with Steam Machines and that third is spread across all the OEMs making Steam Machines. So, no, probably not enough to make it worthwhile for any of them.

Valve isn't a public company so they're not obligated to provide any financial data, meaning that there's none available for deeper analysis.

</comment></comment><comment><USER4> It's... nice? to have the option of purchasing a Steambox with SteamOS pre- installed, if you're unable (or unwilling) to build your own PC and install SteamOS or other Linux flavor. The problem I see, apart from having an underpowered PC or over-priced gaming rig, is the fact many popular games are not available on SteamOS. Also, there is the problem that games are optimized for D3D, which puts you in the Windows camp. Yes, you can get better performance out of OpenGL, but if 90% of your market is Windows, why bother? Ported games generally have poorer performance.

I am hoping that the Vulkan API will be adopted by the games industry to act as a bridge between the two (Windows/Mac and Linux) performance-wise. Microsoft's plans to turn the PC into a glorified tablet or console walled garden is annoying enough. Now they're playing the same trick they pulled on XP users to "upgrade" to Vista, by releasing games that are "exclusive" to Windows 10 on their UWP (Universal Windows Platform). So far, it doesn't seem very consumer-friendly[1].

[1] [http://www.pcgamer.com/why-pc-games-should-never-become- univ...](http://www.pcgamer.com/why-pc-games-should-never-become-universal- apps/)</comment>


Mining data to understand Street Fighter's balance and meta-game - <AUTHOR> http://gamasutra.com/blogs/EduardoGraells/20141217/232531/From_Game_Balance_and_MetaGame_to_Matchup_Prediction_Understanding_the_Street_Fighter_Tier_List.php

<comment><USER2> Discussion of the source article: [https://news.ycombinator.com/item?id=8724582](https://news.ycombinator.com/item?id=8724582)</comment>


Show HN: Slowpal.com - Free Your Paypal Account from Report Hell - <AUTHOR> http://slowpal.com

<comment><USER2> A couple of things: \- Where are the pretty graphs? That's the first thing I expect from a dedicated reporting tool. \- When the UI has infinite scrolling, you need to make the footer sticky, or get rid of it entirely.</comment>


Why Is Email Your Achilles' Heel? - <AUTHOR> https://medium.com/@heedy_team/why-email-is-your-achilles-heel-fc1e90cf0d84 <comment><USER2> I don't get it. The problem is that fraudsters might get access to your life via your email account and the solution is to give some U.K. outfit access to... your Email Account?

<comment><AUTHOR> you are spot on - I agree, there is limited trust atm. What could this little "outfit" do to convince you to try its services?</comment></comment>


FP Complete's online Haskell IDE is now free for community use (try it) - <AUTHOR> https://www.fpcomplete.com/

<comment><AUTHOR> I'm super excited to submit this. Hacker News was really open to messing with Haskell when I announced "Try Haskell" ([http://tryhaskell.org/](http://tryhaskell.org/)) a while back. Loads of people said, "yeah, great, but now what?" This is a nice next step.

I'd recommend:

1\. Open Learn You a Haskell in a window: [http://learnyouahaskell.com/](http://learnyouahaskell.com/)

2\. Open up anything that takes your fancy from the tutorials: [https://www.fpcomplete.com/school/starting-with- haskell](https://www.fpcomplete.com/school/starting-with-haskell) (they have interactive snippets)

3\. Open up the IDE in another window.

Start learning and playing!

It's a full IDE with sweet Haskell-specific features like built-in Hoogle and type information of any sub-expression. This is SOOO nice for learning.

Similar to Github, for _extra_ features there's a 9.99/mo upgrade. And coming next month is external editor support for the hardcore Emacs/Vim/Sublime. I work at FP Complete, so if you have questions, feel free.</comment>


Timothy Leary Video Games Unearthed in Archive - <AUTHOR> http://artsbeat.blogs.nytimes.com/2013/09/27/timothy-leary-video-games-unearthed-in-archive/?smid=tw-nytimes&_r=2

<comment><USER2> Also of note: the unknown Keith Haring drawings in some kind of color version of MacPaint (I want to say it was probably PixelPaint as I'm pretty sure MacPaint was only monochrome...)

[https://twitter.com/mennerich/status/380734234299621376/phot...](https://twitter.com/mennerich/status/380734234299621376/photo/1)

</comment><comment><USER3> I remember playing one of these, I guess the one that got released: Mind Mirror. I just remember that in the beginning you start off as a little sperm and you have to swim.</comment>


The Best Shower Clock: A Casio Watch - <AUTHOR> https://masonsimon.com/2018/05/27/the-best-shower-clock-a-casio-watch/ <comment><USER2> I love my Casio watches. I have an F-91W and a B640W.

The F91-W is super light and you basically can't even feel it on your wrist. Sadly after three years the pin holding the lock in place broke, and I still have to change it (I am using the other one).

I'll probably join the G-Shock bandwagon soon, I'm intrigued by the bluetooth- enabled G-Shock watch.

<comment><AUTHOR> I used to wear two at a time as a kid :P

Have you seen [https://www.gq.com/story/watch-of-the-week-casios-neon- core-...](https://www.gq.com/story/watch-of-the-week-casios-neon-core- digital)? I had one once and wore it till it broke. Great for 80's nostalgia

<comment><USER2> BTW, regarding the link: meh, it's not nostalgia for me, I just find them very practical and also being very cheap but feature-full I don't have to worry too much if I lose it or it breaks.

It's just a super effective watch. Which happens to look slick and cool.</comment></comment></comment>


How do you market your startup on a shoestring? - <AUTHOR>

Since launching a startup (http://infostripe.com) earlier this year I have been learning a lot about how things truly work online. I've been around the internet since the mid nineties, I have worked in web development throughout that time (for a government) and have intensely followed tech news, podcasts and events very closely as an interested observer. I have gotten a lot out of that practice but it was truly when I tried to reach out with my own thing that I discovered the height and depth that is the 4th wall of the marketing underbelly.
We are not yet in a position to spend what resources we have on a lot of things so it has been a grassroots campaign to reach out to tech punditry, journalists, bloggers along with some minor experimental spends on Adwords, Stumbleupon and Facebook Ads. This has been somewhat successful on small scale but we have run into some interesting observations.
- It seems to matter who you know more then what you are if you have little to spend. - Tech journalism is in some corners a vapid recycling of the same daily hot air with very little investigative instinct. - There is a lot going on each day online and getting heard is tough. - Spammers have made us all afraid of each other and new things.
So the question, How do you market your whatever as a small yet unfunded startup on a shoestring? <comment><USER2> Make a better landing page. Yours is just super confusing. "Or or or" doesn't work. _What_ do you do exactly?

I know you're asking about marketing, but alternatively, it's possible that nobody really wants what you're building (whatever that is). Do you have people really using it?

</comment><comment><USER3> Use your friend ask them advice and to promote word by mouth ,, spend more time networking and do Favour to other people who can help u with marketing ,,,, but more important keep asking for help never stop !!!!

</comment><comment><USER4> Is this meant to be for mobile devices only? You can start with getting your usability right. A narrow column of content on a blank screen is not ideal for consuming the said content.

<comment><AUTHOR> Yes it is primarily intended for mobile and small screens. That it works in any browser is a value add.

<comment><USER4> I would say, if you are not relying on an app market for your distribution, a full blown web version is your best bet. My not backed with any data whatsoever observation is, mobile web traffic is still too small to use as the sole medium of a marketing effort.</comment></comment></comment>


Ask HN: Can you do this? - <AUTHOR> I have a lot of trouble answering when asked by an employer or recruiter "are you able to build/code/create/etc specific thing x?" and it is something I have never done exactly, but could probably work out how to do after either eventually figuring it out myself or doing a 5-20 minutes tutorial online.<p>Curious how you guys answer this question. <comment><USER2> I would recommend relating it to something that you have done that is similar or, at least, in the same general area.

Something along the lines of "Yes. I have done such and such and I could use the same approach to research the problem. I could also make use of my knowledge of tool whatever".

Fundamentally you want the answer to be positive, to show you understand what it would take and to show that you have some relevant experience/skills.

</comment><comment><USER3> When I ask recruits this question, the only answer I like is "yes" because I look for attitude.

Even a "yes, but" is acceptable because I know that they will have to learn on the job.

The follow up question is then an open-ended conversation about how they might begin to better understand the problem or research the solution.

If I get a flat "no, I can't" then I'm pretty sure I don't want that person on my team.

I hire learners and thinkers, not automatons.

<comment><AUTHOR> My stock answer is pretty much "I can't, I will figure it out". I guess I get concerned because sometimes that's on someone's dime, and not in my own free time.

<comment><USER3> Everyone I hire, including myself, is learning on the company dime.</comment></comment></comment>


The Absurd Things I Heard Through the Vents in My Prison Cell - <AUTHOR> https://www.themarshallproject.org/2016/08/04/the-absurd-things-i-heard-through-the-vents-in-my-prison-cell <comment><USER2> Relative Accused of Raping 2 Boys

Article from: Albuquerque Journal (Albuquerque, NM) | June 14, 2003

Albuquerque police have arrested a man suspected of raping two young male family members.

Jeffrey Dylan, 30, is charged with four counts of criminal sexual penetration of a minor, Metropolitan Court records said.

The mother of the boys, ages 4 and 5, told police her 4-year-old told her Dylan had sexually abused him May 25, records said. …

[https://business.highbeam.com/2872/article-1G1-103396858/rel...](https://business.highbeam.com/2872/article-1G1-103396858/relative- accused-raping-2-boys)</comment>


Async I/O for Python 3  - <AUTHOR> https://www.dropbox.com/s/xknbe58zcvjhzhv/PyCon2013.pptx <comment><USER2> Sigh, another Async framework.

Yes it has nice features such can replace the reactor/hub thing. Has futures/promises/deferreds. That has all been done before in Twisted. Yields are cute and there was monocle, I wouldn't say it exactly took off : <https://github.com/saucelabs/monocle>

Twisted has inlineCallbacks that use yields as well. Just import Twisted into stdlib then and use that.

I am surprised that gevent was dismissed. Ok, there is also eventlet, if someone doesn't like gevent. Monkey patching is scary? Is it really _that_ scary? Most sane and portable IO code probably runs on that today. Why? Because there is no need to create a parallel world of libraries. Write a test does it pass? Does it handle your use case? I'll take not knowing if my green threads switch tasks and add another green thread lock, instead of doubling my code size with yields, callbacks and futures.

Let's talk about Twisted (sorry couldn't resist WAT video reference). I remember for years searching for parallel libraries to parse exotic protocols. Regular Python library is there, but no, can't use that, sorry. Gotta go find or write one that returns Deferreds. You add a single Twisted module in your code, good luck! -- it ripples all the way to the top through your API and you are doomed being locked into the Twisted world forever.

When gevent and eventlet came around it was like a breath of fresh air. This is what sane concurrent IO looks like in Python:

<http://eventlet.net/doc/examples.html>

My fear is that many will just say fuck it, I'll just use Go/Rust/Erlang for IO bound concurrent problems.

It is nice having a benevolent dictator, except when he goes a little crazy, then dictatorship doesn't sounds so much fun anymore.

<comment><USER3> Sane is in the eye of the beholder.. gevent _looks_ nice, but I'd be very diffident when it comes to actually supporting it in production. It monkey patches the standard library and messes with CPython internals to achieve what it does, infinitely increasing the chance it will conflict with some other piece of code (for example, that bizarre ancient internal propriety library you're using that started life in Fortran, etc)

In the case of async I'm glad to see a from scratch implementation for the standard library. It's a weird area that necessitates some constructions that there is no really standard Python style for. You only need to look at Twisted and e.g. its method chaining to realize this stuff would need a thorough sanity rework before it ever became standard anyway.

Also, most other implementations take the approach of building their own little world. This is definitely true of Twisted. You write code for Twisted, not for Python. Gevent at least doesn't suffer from this.

<comment><USER4> I used gevent at first for a project that needed Async I/O and it worked really well, but then I switched to Erlang and I realized how poor a choice Python is for such tasks. The language really needs to be designed from the start for it (like Go, Rust, Erlang &c... Haskell wasn't designed from start for it but because of it's functional purity, bolting it on was "natural" but - it isn't so for Python IMHO).

<comment><USER5> Yeah, if you're going to have to do async to be performant than it better be pretty pervasive throughout all the libraries. Bonus points if the language supports syntax to make async easier as well. Node is beating out Python for server stuff not simply because it is "async", but because it is so much FASTER. The speed of V8 vs. CPython is a big part of that. In fact, vanilla JS doesn't have much to make async programming particularly easy: it has verbose function declaration and no yield mechanisms. Even library-level solutions like promises are merely 'OK'.

Still, it is easier to build a fast server that can handle streams in Node than it is in Python. Async Python? I'll just stick to async JS in that case.

<comment><USER2> I think there is another issue here. Python world has watched as Node.js has been eating its lunch on the server side and they decided, ah, surely that is because Node.js has async, if we add that too, everyone will love Python again and come crawling back. They are not saying, I think that is written between the lines.

Except one thing, as you pointed out, people use Node.js -- 1) it is JS 2) V8 is fast.

<comment><USER6> The reason why you getting so many downvotes is because your comment is not just silly but flat wrong. Twisted, Tornado were around before nodejs. There are also async frameworks that make writing async code the same as synchronous code. I like tornado but I am using nodejs for my current app because of the libraries. This is where nodejs really shines, the community and libraries are awesome. Twisted has a lot of libraries but it has so much going on that many developers find it too complex. Tornado is a much simpler async framework to adapt to and allows you to run twisted libraries.

Twisted's inlinecallback's and tornado's gen module gets rid of all the async spaghetti code. This is hard to do with nodejs but I still chose nodejs because the available libraries made my project quicker to develop.

<comment><USER2> Sorry I didn't express myself correctly (see my reply to akuchling below).

Basically yes, Python had Twisted for years, it had Diesel, Monocle, Tornado, and some other ones. I am aware of those and as you've read my comment you saw that I used Twisted enough to know its ins and outs (5 years).

> There are also async frameworks that make writing async code the same as > synchronous code.

Yes there is inlineCallbacks and I used. Node.js also has async (<https://github.com/caolan/async>). But you don't address the main problem that I raised -- fragmentation of libraries. Python is great because it comes with batteries, and then you can find even more batteries everywhere, _except_ if you use an async framework like Twisted, which, percolates all the way through you API code. Once your socket.recv() returns a Deferred(), that deferred will bubble up all the way to the user interface. So you now you end up searching or recreating a parallel set of libraries.

> Twisted has a lot of libraries but it has so much going on that many > developers find it too complex.

It is too complex with too many libraries for those who want to take it up but it is not complex and doesn't have enough libraries if you are in it already -- every library you use has to be Twisted now. That's the danger of inventing a new framework.

Yes it will be standard, but there is already a practical standard -- eventlet and gevent. This is somethin Node.js doesn't have. I will personally take monkey-patching and the danger that my function will context switch inside while doing IO over using Twisted. I saw a practical benefit from it at least.

<comment><USER7> I have a question for you since you have a lot of experience with async. Eventually node.js will have generators (when V8 implements ECMAScript 6) which should allow node.js to have something like gevent. What kind of effect do you think this will have on the node.js world?

<comment><USER2> If it has generators it will make it easier. I remember being happy about finding out Twisted has inlineCallbacks. I basically let you not have to split your logical function into multiple functions simply because it has to to do some IO.

Before it used to be code like:

        def processShoppingCart(...):
           d.addCallback(_cb1)
           return d # (d is a Deferred)

       def _cb1(...):
          d2.addCallback(_cb2)
          return d2 # d2 is a another Deferred

etc.

Which with generators and inlineCallbacks turns into

        @someDecoratorThatEnableUsingInlineCallbacks
        def processShoppingCart(...):
           .. do some work ..
           yield <some_io_function_like_check_db>
           .. do some more work ..
           yield <some_io_other_io_function>
           ....

You get the idea. I am not too familiar with Node.js but I imagine it will help quite a bit.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Perhaps the video makes more clear the rationale. E.g.

      Possible solution: "Standardizing gevent solves all its problems".
      One of the responses: "I like to write clean code from scratch".
      Another: "I really like clean interfaces".

So I'd prefer that the BDFL work with the gevent folks to get it cleaned up and integrated while adjusting it to expose a "clean interface".

Perhaps the whole thing will make more sense once Guido provides more detail, but I'm underwhelmed and confused.

<comment><USER9> I find that unlikely: Guido doesn't like gevent.

Though yes, it's a nice thought.

<comment><USER10> Guido has been resisting the stackless stack slicing assembly technique since I first learned about Python and Stackless Python in 1999. That's obviously never going to change.

<comment><USER2> That reminds me of one of those famous Roman Emperors that all is well and good as well as they make rational decisions, then eventually they turn senile or mad, and everyone realizes how dictatorship is not that much fun sometimes.

<comment><USER10> From a certain perspective it is a rational decision. Because the CPython API relies so heavily on the C stack, either some platform-specific assembly is required to slice up the C stack to implement green threads, or the entire CPython API would have to be redesigned to not keep the Python stack state on the C stack.

Way back in the day [1] the proposal for merging Stackless into mainline Python involved removing Python's stack state from the C stack. However there are complications with calling from C extensions back into Python that ultimately killed this approach.

After this Stackless evolved to be a much less modified fork of the Python codebase with a bit of platform specific assembly that performed "stack slicing". Basically when a coro starts, the contents of the stack pointer register are recorded, and when a coro wishes to switch, the slice of the stack from the recorded stack pointer value to the current stack pointer value is copied off onto the heap. The stack pointer is then adjusted back down to the saved value and another task can run in that same stack space, or a stack slice that was stored on the heap previously can be copied back onto the stack and the stack pointer adjusted so that the task resumes where it left off.

Then around 2005 the Stackless stack slicing assembly was ported into a CPython extension as part of py.lib. This was known as greenlet. Unfortunately all the original codespeak.net py.lib pages are 404 now, but here's a blog post from around that time that talks about it [2].

Finally the relevant parts of greenlet were extracted from py.lib into a standalone greenlet module, and eventlet, gevent, et cetera grew up around this packaging of the Stackless stack slicing code.

So you see, using the Stackless strategy in mainline python would have either required breaking a bunch of existing C extensions and placing limitations on how C extensions could call back into Python, or custom low level stack slicing assembly that has to be maintained for each processor architecture. CPython does not contain any assembly, only portable C, so using greenlet in core would mean that CPython itself would become less portable.

Generators, on the other hand, get around the issue of CPython's dependence on the C stack by unwinding both the C and Python stack on yield. The C and Python stack state is lost, but a program counter state is kept so that the next time the generator is called, execution resumes in the middle of the function instead of the beginning.

There are problems with this approach; the previous stack state is lost, so stack traces have less information in them; the entire call stack must be unwound back up to the main loop instead of a deeply nested call being able to switch without the callers being aware that the switch is happening; and special syntax (yield or yield from) must be explicitly used to call out a switch.

But at least generators don't require breaking changes to the CPython API or non-portable stack slicing assembly. So maybe now you can see why Guido prefers it.

Myself, I decided that the advantages of transparent stack switching and interoperability outweighed the disadvantages of relying on non-portable stack slicing assembly. However Guido just sees things in a different light, and I understand his perspective.

      [1] http://www.python.org/dev/peps/pep-0219/
      [2] http://agiletesting.blogspot.com/2005/07/py-lib-gems-greenlets-and-pyxml.html

<comment><USER2> Thank you for the providing all the background! I didn't know all the historical context.

> or custom low level stack slicing assembly that has to be maintained for > each processor architecture.

Yeah I would personally also say that the advantages of writing the equivalent assembly for a handful of architectures outweigh re-writing / re-inventing high level library code dealing with concurrent IO.

I think Guido and a few others have decided to focus on some things rather than others and the Python ecosystem will suffer in the long run based on these decision. The ability to write beautiful concurrent IO code without a whole new async framework, is better, even if means breaking some C extensions, writing assembly, or not supporting exotic CPUs.

Programming world is not going to get less concurrent over time. Concurrency will spread more and more. There is already some momentum with gevent and eventlet and it is something that Node.js doesn't have -- and I see Guido turning away and making something worse.

</comment></comment></comment></comment></comment></comment><comment><USER11> As Guido mentions, @coroutine/yield from is very similar to C#'s async implementation (with some differences like type safety).

Since Guido has the barest of descriptions on how this works, you may find the C# async description useful. [1]

[1] [http://msdn.microsoft.com/en- us/library/vstudio/hh191443.asp...](http://msdn.microsoft.com/en- us/library/vstudio/hh191443.aspx)

<comment><USER12> Just to check if I'm understanding the presentation right, will the implementation involve compiler magic to turn this:

        @coroutine
        def getresp():
            s = socket()
            yield from loop.sock_connect(s, host, port)
            yield from loop.sock_sendall(s, b'xyzzy')
            data = yield from loop.sock_recv(s, 100)
            # ...

into this, similar to how C# does it? (let's pretend multi-line lambdas exist for a minute)

        def getresp():
            s = socket()
            loop.sock_connect(s, host, port).add_done_callback(lambda:
                loop.sock_sendall(s, b'xyzzy').add_done_callback(lambda:
                    data = loop.sock_recv(s, 100).add_done_callback(lambda:
                        # ...
                    )
                )
            )

Or will the `yield from`s bubble up all the way to the event loop and avoid the need for that?

<comment><USER2> No magic there.

It is Eventlet and Gevent have that magic. Here is how that looks:

        def getresp():
            s = socket()
            s.connect((host,port))
            s.sendall(s,b'xyzzy')
            data = s.recv(s,100)

Compare that to any of the above. This is what is thrown away in favor of 'yield from' and @coroutine mess coupled with a completely parallel set of IO libraries.

<comment><USER10> Well... There actually are a completely parallel set of IO libraries, it just happens that the interface can be identical to the existing blocking interfaces because of the greenlet stack slicing magic... So it only appears like there are not a completely parallel set of IO libraries.

But that's just a nitpick.

<comment><USER2> > So it only appears like there are not a completely parallel set of IO > libraries.

Right on. That's the great part -- both a simple way to program and re usability of libraries.

So far, I see library ecosystem fragmentation as the biggest issue of all and nobody seems to want to talk to it.

Academically all the yields and co-routines look so cool, in practice when you need 5 libraries to help with some task, and now you have to re-write them -- not so cool.

</comment></comment></comment></comment></comment><comment><USER13> Still puzzled why the primary inspiration for this is Twisted, which has some really ugly APIs.

<comment><USER14> Some people stick with what they know. Twisted is horrible to work with though

<comment><USER15> that rhymed!

</comment></comment></comment><comment><USER9> A minor gripe (seperate from all my other gripes, which other people have already talked about):

"...run code in another thread - sometimes there is no alternative - eg. getaddrinfo(), database connections"

Just thought I'd mention that async-supporting DNS libs do exist (eg. gevent ships with C-ares), and in particular I've used async postgres database connections in both C and gevent. The code to gevent-ise psycopg2 connections is about 10 or 15 lines, iirc.

<comment><USER16> > The code to gevent-ise psycopg2 connections is about 10 or 15 lines, iirc.

Because psycopg2 has supported async OOTB since 2.2 by exposing a pollable socket: [http://initd.org/psycopg/docs/advanced.html#asynchronous- sup...](http://initd.org/psycopg/docs/advanced.html#asynchronous-support)

There are limitations though, as noted by the docs: COPY and LOs don't work.

</comment></comment><comment><USER17> >> "@coroutine / yield-from are very close to async / await in C# 5"

Cool to see languages learning from one another.

</comment><comment><USER18> Reading that presentation, it seems that Python has way too many Asyncronous I/O libraries/frameworks on its hands (not to be inflammatory though, I see it as a chance).

I really wonder why that is not the case in Ruby. I mean there are some, but there's mostly confidential and there doesn't seem to be much interest around them. Especially not to the point that the project leader would take a stab at it.

Good on Python anyway, competition is good.

</comment><comment><USER19> This powerpoint viewer would be much nicer to use if I could hit spacebar to skip down a page.

</comment><comment><USER20> Does anyone have a link to the video? Or for various PyCon 2013 videos in general?

<comment><USER21> AFAIK, all PyCon 2013 talks were recorded and are being processed. Once they're finished the videos will be uploaded here:

<http://pyvideo.org/category/33/pycon-us-2013>

</comment></comment><comment><USER22> Wait, Guido is proposing implementing INTERCAL'S COME FROM? (as yield from)?

<comment><USER23> For anyone curious, INTERCAL was originally a joke language which included a COMEFROM instruction that acted like GOTO in reverse: <http://en.wikipedia.org/wiki/COMEFROM>

Python's "yield from" hands off execution to a sub-generator: <http://www.python.org/dev/peps/pep-0380/>

</comment></comment><comment><USER24> I think it's a great idea. I haven't tried Twisted and having to install some 3rd party component to get it working doesn't sound tempting, however being supported by default, does.

</comment><comment><USER25> dropbox.com is blocked at work. Anyone have an alternate link? I can see it on my cell phone, but generally pptx don't display well on 4 in screens.

</comment><comment><USER14> If Guido still worked at Google would this have been hosted on google docs and I would have been able to read it without Office?

<comment><USER13> I am reading it in the browser on Linux, so I'm pretty sure Office isn't required

<comment><USER14> Doesn't work on this ipad. And I hate using a laptop in the bath.

</comment></comment></comment><comment><USER26> Why does Guido think this is general purpose enough to add to Python but that the scientific features to make it competitive with R aren't? Is he envious of node.js?

<comment><USER27> The scientific community is not that interested in merging into the stdlib.

Also, the main point of this is to allow for different async libs to find some common ground to stop the madness of having twisted-specific, tornado- specific, etc... The scientific community does not have this pb because everybody uses numpy.</comment></comment>


The curse of the upvote - <AUTHOR> http://unalone.net/2008/08/the-curse-of-the-upvote/

<comment><USER2> This problem has already been solved in various forms.

Social features may not be worth it if you want the best content. The guy who made delicious purposely didn't include "community" features like ratings or comments. <http://simon.incutio.com/notes/2006/summit/schachter.txt>

Or from the recent dark knight/godfather episode on IMDB..

 _"...in these types of situations their cognition or cooperation failed because the members of the crowd were too conscious of the opinions of others and began to emulate each other and conform rather than think differently."_ \- <http://news.cnet.com/8301-13515_3-10000650-26.html>

Even Dawkins weighed in on this back in 1997 - [http://www.simonyi.ox.ac.uk/dawkins/WorldOfDawkins- archive/D...](http://www.simonyi.ox.ac.uk/dawkins/WorldOfDawkins- archive/Dawkins/Work/Articles/1997-11-16trialbyjury.shtml)

I think what we need is an adsense for content.

<comment><AUTHOR> That's what I like about del.icio.us. There are some things is DOESN'T do, but that's because it doesn't have to. It tackles one problem with a few social aspects, and it handles it perfectly.

AdSense for content? What do you mean by that?

<comment><USER2> It's just been kicking around in my head. Serving targetted 'ads' that link to interesting websites might work considering the numbers of people who go to digg/reddit etc. Arranging it chronologically as everyone does is horrible. I'm sure I've missed a lot on HN because I wasn't here.

But there's a branding problem & I don't see anyone spending months on something that google/stumble/delicious can duplicate with a small script.

</comment></comment></comment><comment><USER3> "Voting, for now, is here to stay."

Translation: voting is temporarily permanent. Nice writing.

<comment><USER4> I always usually write things like that.

Yeah, no.

<comment><USER5> "Are you sure it probably won't be a robot I know?"

"Definitely probably not."

</comment></comment></comment><comment><USER6> This has been discussed a lot, but one element you left out is that the "wisdom of the crowds" doesn't work as well if you can see how people already voted (although you hint at it with a comment about a few downvotes being followed by many more). It creates a 'cascade' rather than genuinely independent assessments.

<comment><AUTHOR> The solution I came up with was just hiding the number of votes either way. Bump up good things and lower bad things, but otherwise keep it normal. It's not a perfect solution, but at least it stops the groupthink and leaves us with the dilution problem.

<comment><USER7> thesixtyone.com, a social music site, has a clever way of dealing with this: You can "bump" a song, but it costs you "points," which you see a return on if the song becomes popular. It turns upward momentum into a currency instead of something tossed around in large amounts.

<comment><USER8> But that only exacerbates the problem. People will start to vote for what they think others will like instead of what they personally like.

<comment><USER9> But that's how the stock market works. :) Trying to do better than that is futile.

<comment><USER8> The stock market wouldn't work either if users of the products companies make would act like investors. Just imagine what they would buy :-)

</comment></comment></comment></comment></comment></comment><comment><USER10> I think think the upvote concept has merit but I agree, it's flawed by votes for popular stories just because they're popular.

In order to avoid the groupthink problem a simple solution might be to hide the number of votes an article has received until you've voted either up or down/neutral. Obviously without a visible vote count you could still tell an article was doing well by its position on the site, but without the number of votes visible, there would be less of a tendency to vote something up just because everybody else is doing it.

</comment><comment><USER11> Good summary of the voting problem and how the masses are dumber than small groups. Ironically, I upvoted it.

<comment><USER12> It's ironic if you really are smarter than the masses. But that's what the masses think about themselves: [http://bps-research- digest.blogspot.com/2008/08/why-we-think...](http://bps-research- digest.blogspot.com/2008/08/why-we-think-were-better-than-rest-its.html)

<comment><USER13> It's a bit more nuanced than that. One of the social sites I briefly used counted clicks more then upvotes. Predictably, being a 30ysh year old male, I usualy clicked on links promising pictures of (more or less necked) women. In less then two weeks most of my personalized content was either porn or lolcats.

The moral of the story: while I do enjoy the ocasional porn and lolcat, it's definitely not what I want from the net (also why I didn't use the site for more then 2 weeks). It's just that it was much easier for their algorithm to categorize those things then the much more abstract "interesting", or even the somewhat less abstract "programming".

edit: It's not that social sites are doomed. It's just they're damn harder to get right then just digg, and they're still in infancy.

<comment><AUTHOR> Yeah. I have high hopes for social sites. But it's why I prefer sites trying new models (like what Facebook was like before it went overboard) rather than sites that try to be "like Digg but for X."

</comment></comment></comment></comment><comment><USER14> The solution to this, I think, lies in niche sites--this is why over the next few years small sites for specific audiences will become more and more important. Instead of one Youtube, we'll have dozens of video sites catering to specific niches. The same thing goes for news aggregators. As people learn to distrust the wisdom of the crowds, the Long Tail will become even more important as the thousands of smaller sites become more important than the few large ones.

</comment><comment><USER15> Does the author think we are so boring as a community that all we ever want to read are purely factual and though-provoking articles that we must sit down for a half hour and read? Don't get me wrong, I love these kinds of articles, but hackers in general are not 100% serious people who want to _seriously_ discuss hacking 100% of the time. Cartoons _can_ be relevant and they might actually make me laugh too.

</comment><comment><USER16> I love a good voting discussion. It's the most broken system (along with it's cousin, recommendation engines) on the web today.

Two comments:

1) What if, instead of quantitative information, we gather qualitative information? Slashdot doesn't ask you to vote up, it asks you to categorize the material. I like this much better.

2) Wouldn't it be fun to create an elitist site constructed solely around debating/discussing hot issues? You'd have to channel the ability of the audience to respond emotionally, but I bet you could come up with something like "Pop Wars" and it'd be a hoot. You could have ranking (special titles), virtual goods (rewards, do-dads, etc), and better yet, the system would drive to the top the most emotionally engaging and reasoned discussion of the hour. Something to pull you in and make you think (and participate). Not just a yes/no hot/cold POS. More like a battle where the audience categorizes the arguments, not approves or dissaproves of the contents of them. Email me if you'd like to discuss further.</comment>


The unique problem with U.S. health care - <AUTHOR> https://www.axios.com/us-health-care-private-insurance-employment-b34153c8-bfd6-449f-9e06-3bafc2ccc0a6.html <comment><USER2> Definitely true that the treatment of employer-managed health care is a barrier to startup innovation.</comment>


The Devil's Dictionary of Programming - <AUTHOR> http://programmingisterrible.com/post/65781074112/devils-dictionary-of-programming

<comment><USER3> A DSL - where code is written in one language and errors in another - <USER2> bitterly true... :(

<comment><USER4> As Dave Thomas (of OTI not pragprog) said: It's no good unless you can debug at the level of the abstraction.

</comment></comment><comment><USER5> "framework — A product with the business logic removed, but all of the assumptions left in."

That made it worth reading all by itself.

</comment><comment><USER6> No hat-tip to Stan Kelly-Bootle's "Devil's DP Dictionary"?

</comment><comment><USER7> A more accurate title would be "The Devil's Dictionary of Silicon Valley".

</comment><comment><USER8> my personal fav " hackday — A competition where the entry fee is sleep deprivation and the prize is vendor lock in"

</comment><comment><USER9> Thank you so much for the laugh!</comment>


Virtual Bitcoin Mining Is a Real-World Environmental Disaster - <AUTHOR> http://www.bloomberg.com/news/2013-04-12/virtual-bitcoin-mining-is-a-real-world-environmental-disaster.html

<comment><USER2> Given that all work takes energy, it seems vastly stupid to call "a disaster". It also costs money to click cows, watch cat videos, make toast, and cuddle babies. Relatively speaking the impact is low. The intrisic value is based in the difficulty of obtaining it, like many other assets.

</comment><comment><USER3> Unless I am mistaken, the majority of energy that goes into generating bitcoins (and any computation) is generally lost as heat.

It would be interesting if a bitcoin miner could replace a large building's furnace with their equipment, using the "waste" energy to provide heat to offices/apartments.

</comment><comment><USER3> I wonder if any large bitcoin mining operation has thought about locating themselves in Denmark:

<https://news.ycombinator.com/item?id=5547979>

As bitcoin mining boxes can be spun up at a moments notice, they could be used to take advantage of the "free" electricity that is generated when Denmark's wind turbines are producing more electricity than there is demand.

</comment><comment><USER4> If new bitcoins were worth billions, billions in energy would be wasted mining them.

(the denomination of newly-created bitcoin is adjusted to keep the growth rate at the prescribed amount regardless of how much CPU power is dedicated to mining. So regardless of the bitcoin price, the energy needed to mine new bitcoin is close to the value of bitcoin created. Otherwise mining would be a free lunch.)

</comment><comment><USER5> US dollar and economy prospered for last 40 years with its power to print paper money without anything to back it. with 2 trillion dollars debt, US Paper money is now worth the paper and this bubble will burst someday , so people are going behind a currency with some Mathematical principles .

</comment><comment><USER6> So this is turning real coal into imaginary value. Great.</comment>


Rayo's Number - <AUTHOR> https://googology.wikia.org/wiki/Rayo%27s_number <comment><AUTHOR> This number is the result of a "large number duel"[1] between MIT Associate Professor Agustin Rayo (The Mexican Multiplier) and Princeton Associate Professor Adam N. Elga (Dr. Evil)[2]. Possible the world record largest number by some standards.

[1] [https://www.scottaaronson.com/writings/bignumbers.html](https://www.scottaaronson.com/writings/bignumbers.html)

[2] [http://tech.mit.edu/V126/N64/64largenumber.html](http://tech.mit.edu/V126/N64/64largenumber.html)

</comment><comment><USER2> So its clear:

It's the smallest positive integer bigger than any finite positive integer, "named" (defined, so some formula without explicitly writing it out) by an expression in the language of first order set theory with a googol symbols (10^100) or less.

I remember reading busy beaver numbers can be defined in a language with millions of symbols, so this number is pretty impressive.</comment>


Life Below the Surface of the Earth - <AUTHOR> http://fivebooks.com/interview/tullis-onstott-life-surface-earth/ <comment><USER2> Amazing article, all sorts of things I didn't know.</comment>


Show HN: Go HTTP Request Router Benchmark - <AUTHOR> https://github.com/julienschmidt/go-http-routing-benchmark

<comment><USER2> It's currently very hard to digest any information from this. Some bar-charts would be helpful.

<comment><USER3> Or just sorting the results by performance, rather than alphabetically.

</comment></comment><comment><USER4> Would be great to see a benchmark of how much time is actually spent in routing compared to all the other disciplines involved in responding to a HTTP request. For any interesting application, I suspect routing will be the least of your troubles in regards to performance.

<comment><AUTHOR> For most web-apps this is definitely true. But an efficient router doesn't hurt either. If the router scales well, the routing part will never become your bottleneck. If the router is also memory efficient, it can reduce the amount of time the Garbage Collector needs.

<comment><USER5> The point was that the routing part is highly unlikely to become your bottleneck in any case.

</comment></comment></comment><comment><USER6> I am so glad to see the benchmarks' source code here. So often these "performance" blog posts get written in a completely unreproducible way. A core element of the scientific method is that others can reproduce your experiment to validate or disprove your results.

</comment><comment><USER7> So the one you recommend is the one you wrote yourself?

<comment><AUTHOR> I'd recommend Goji to most users. The one I wrote has better performance, but also less features.

<comment><USER8> Goji does very well given it includes a request context implementation as well. I've been porting over an existing net/http + gorilla/mux app and like its design.

</comment></comment></comment><comment><USER9> Thanks for the benchmark, I didn't know half these projects existed.

One thing that affects Gorilla mux is that this test is putting all the routes at the top-level instead of constructing subroutes based on the logical route hierarchies.

Certainly the fact that HttpRouter constructs that prefix tree for you is a huge feature, and the speed is impressive, but it's not a typical/canonical usage of Gorilla mux.

I don't know if that's the case with the other routers or not.

<comment><AUTHOR> Contributions are welcome ;)

<comment><USER9> Yeah yeah yeah ;)

</comment></comment></comment><comment><USER10> What about Revel framework?

<comment><AUTHOR> Revel is a bit too magic. It is hard to benchmark the routing alone.

</comment></comment><comment> juliendsv-mbm What about Negroni ?

<comment><USER11> Negroni doesn't have a router built in, and these benchmarks are only looking at the router components.</comment></comment>


Show HN: Superhuman for Code - <AUTHOR> https://metacode.app/?hn <comment><USER2> I highly recommend putting some more information on the landing page. Screenshots are kind of helpful, but this just looks like multi-screen search?</comment>


Urban Airship Closes $5.4 Million Series B Funding Round - <AUTHOR> http://techcrunch.com/2010/11/02/urban-airship-closes-5-4-million-funding-round-to-help-power-mobile-apps/

<comment><USER2> Incidentally, does anyone know of any proper airship startups? :-) Here's one: <http://www.facebook.com/home.php?#!/AirshipVictoria>

</comment><comment><USER3> I <3 PDX</comment>


Coronavirus / Covid-19: A Panic Free Guide for Parents (YC S19) - <AUTHOR> https://bravecare.com/illnesses/coronavirus# <comment><USER2> This is great! A really even discussion of the situation and concrete ways to make sure kids stay safe.

Far too much fear mongering content online already, thanks for keeping it informative!</comment>


Claims that China's Transit Elevated Bus Is a Scam - <AUTHOR> http://en.yibada.com/articles/149103/20160807/china-s-transit-elevated-bus-money-making-scam-designed-fleece.htm <comment><USER2> Previously discussed here: [https://news.ycombinator.com/item?id=12231132](https://news.ycombinator.com/item?id=12231132)

</comment><comment><USER3> Chinese media is a scam. This is probably also a scam but the Chinese media is only reporting it as such because someone refused to pay them off.

Much better link: [http://shanghaiist.com/2016/08/08/straddling_bus_locked_up.p...](http://shanghaiist.com/2016/08/08/straddling_bus_locked_up.php) / [https://news.ycombinator.com/item?id=12251379](https://news.ycombinator.com/item?id=12251379)

</comment><comment><USER4> (1) New ideas are often met with skepticism. I had found a promotional video that showed a better explanation of the tech involved. The rails was clearly there, as were the normal tires. What's seems like it will add the most complexity to is how there's going to be an elevator that rises up into the station and docks with it. There were other parts that look ingenious, such as traffic signals underneath the bus to communicate with the cars driving under there. [This is not the video I originally saw, but it is an English voice- over to a presentation about it: [https://www.youtube.com/watch?v=Hv8_W2PA0rQ](https://www.youtube.com/watch?v=Hv8_W2PA0rQ)]

(2) I find it ironic that the state-sponsored Chinese media is warning people against it. Given their past history, I actually don't know if that is sincerely a warning to people not to invest in a scam, or yet another example of propoganda.

(3) And then, it isn't as if the Chinese business community have a high standard of ethics. I get that there are probably a lot of great companies in China, but generally, the culture tends to skew towards cutting corners and corruption.

I guess the question is, if we pretend the technology, on it's own merit, was attempted within say, the US, would it work out? There would be a lot of political push-back against adopting it, but I don't know if that necessarily means the technology itself is a bad idea.

<comment><USER5> > I guess the question is, if we pretend the technology, on it's own merit, > was attempted within say, the US, would it work out?

Where in the US? Most cities have power/phone/cable wires crossing the street somewhat randomly. There are also bridges that this won't get under. There are also stoplight and signs that hang over the roadway.

You can probably find a newish quiet residential neighborhood in the suburbs without all that in the way. However traffic is generally not a concern in those places. Thus I'm going to say even if technically it works perfectly, and turns out to be a great idea with no other concerns it will be many years before cities redesign themselves enough to make it work.

I can see a city like Las Vagas putting something like this on the strip as a publicity stunt. It would only go a couple miles, but it is feasible to rebuild a few miles of street to make it work. Assuming the above, it is feasible. You time the cross streets signals so that there is no cross traffic. Cars can drive under it no problem. There needs to be something to ensure cars don't turn into a tire, but seems solvable. If we just assuming running one back and forth down the street it is easy. If you want to run more than one you need to handle turn around with no traffic - this thing will need more room to turn, but since it is a dedicated line you can close a low traffic intersection for that (or since it is on rails just go up and over - maybe around a block... lots of options)

Of course once you look at the above you say "it can be done, but I think there are more conventional alternatives that make more sense." I think the for anything where this makes sense a monorail is better: known technology, and since it isn't at ground level there is no safety issues.

</comment></comment><comment><USER6> It was vapourware. It became real. It turns into a scam.

</comment><comment><USER7> The website hijacks you clicking on text and opening and advertizement window.

By the way, the bus won't work because it is higher than cars only, no trucks, no regular buses etc. I think modifying current infrastructure to pass only cars under specified height (and raising height for this over-bus) will be more expensive than the bus itself. Easier to just build a second level road.

<comment><USER8> > Easier to just build a second level road.

Lol wut? Easier to build a second level road than put a few gantries in to prevent vehicles over a particular height enter a road? I think not.

This bus isn't going to be used as a general bus that drives around the city. It's more likely going to be used down a single stretch of road, acting as a shuttle from one end to the other so people don't get stuck in traffic on it.

</comment></comment><comment><USER9> I can think of many scams designed to fleece investors that are often discussed on this very site, and are in the US.

</comment><comment><USER10> maybe if the website this is hosted on wasn't so broken, I would be able to make an informed comment!

<comment><USER11> There was another submission with a link to Jalopnik

[https://news.ycombinator.com/item?id=12250494](https://news.ycombinator.com/item?id=12250494)

[http://jalopnik.com/is-the-chinese-traffic-straddling- bus-a-...](http://jalopnik.com/is-the-chinese-traffic-straddling-bus-a-scam- it-looks-1784979121)</comment></comment>


Ring of Bitcoins: Why Your Digital Wallet Belongs On Your Finger - <AUTHOR> http://www.wired.com/wiredenterprise/2013/03/bitcoin-ring/

<comment><USER2> This is a horrible idea. This is the Bitcoin equivilent of walking around with the entire contense of your bank account, in cash.

If someone mugged him, those Bitcoins are gone. No reversing of payments, nothing. At least on a computer his wallet could be encrypted.

</comment><comment><USER3> I have a feeling bolt cutters will suddenly become even more popular among thieves.</comment>


The book you're holding might be a fake – storytelling with data - <AUTHOR> http://www.storytellingwithdata.com/blog/2017/3/30/the-book-youre-holding-might-be-a-fake <comment><USER2> that is crazy. I have started buying more kindle books these days.</comment>


Inception Explained: a really cool scrolling animation of the plot - <AUTHOR> http://www.inception-explained.com <comment><USER2> This was really well done. I'd just like to point out a few things, as someone who's watched Inception way too many times:

1) It is never said that 3 levels is the maximum depth of a dream until Limbo occurs. My interpretation has always been that Cobb and Ariadne hooked up a shared-dream machine to Fisher's dead body, which brought them into Limbo.

2) Why are there 2 Limbos? There's the one Cobb and Ariadne follow Fisher and Mal into (which has the architecture of the Limbo that Cobb and Mal shared all those years ago). There's then the Limbo that Cobb and Saito share, where it looks like Saito architected the environment (Asian influences). And if they were the same Limbo, why was Cobb washed up on a shore with no memory of how he got there in Saito's Limbo?

3) In the Limbo that Cobb and Mal shared, all they needed to do was kill themselves to wake up. Why then was the defibrillator needed to wake Fisher up from death in Limbo to Dream 3?

<comment><USER3> The reason there are two passages through what seem to be limbo is that Inception is Christian allegory. If you look at the structure of the film you can see Nolan using the opening and closing heist sequences as allegorical bookends to demonstrate Cobb's character development. In the first Cobb is a faithless and money-oriented thief who embraces violence and selfishly abandons his team when this fails ("every man for himself"). At the end Cobb takes a "leap of faith" when he rejects Mal, whose seduction of him is framed as a temptation of faith ("you don't believe in one reality anymore.... so choose to be here"). Cobb reaffirms his faith in his children "up there", rejects violence even when he is attacked and then sacrifices his own life to save Saito.

So you're not supposed to worry too much about the logic of the dream levels, since all dreams are basically metaphors for life: mazes where people "get lost" and from which they need to "die to wake up". The only thing that makes limbo _special_ is that it is particularly symbolic. Nolan is presenting a metaphor of life itself as a Penrose staircase, and portraying faith as the way out. When Ariadne shatters the mirrors that trap Cobb in a recursive chain, the image is symbolic: she is a gift from Cobb's father ("ask and ye shall receive") and her role in the film is to guide him out of the maze that is the mortal world. This is presumably why she is the character who accompanies him to immigration.

For more evidence that this is intentional, look at the overwhelming creation imagery and the narrative emphasis on father-son alienation and reconciliation (with Fischer as with Cobb). Look at the curious way Michael Caine seems to be playing God when he shows up in Paris. And then look closely at the ending, which shows us neither a dream nor reality. What Nolan presents is symbolic: we see Cobb's judgment and forgiveness of sins at immigration, and then his reunion with his family in the heavenly garden. The film closes with Cobb ignoring his totem (as a crutch of faithlessness it is no longer needed) and then his son James (who represents faith and like his sister shares an apostolic name) telling him that they are building a castle on a cliff.

A what? That last bit circles back to the opening shot of the children on the beach. It is a bookend reference to Matthew 7.24 and the parable of the wise and foolish builders. The contrast (beach -> cliff) reinforces Cobb's character journey while telling us that the ending is NOT a dream (something reinforced by the lack of the water imagery associated with the other dream levels). It also reinforces the parallels Inception creates between the buildings of limbo and the sandcastles on the beach, and explains why all are ultimately washed away by water just as death washes away life in the Christian parable.

Brilliant movie.

<comment><USER4> This is post-rationalization if I've ever seen it.

<comment><USER3> Any act of film/literary analysis obviously requires thinking about something after you've seen/read it. The harder you think the better, and what you need to look for when evaluating arguments are evidence of internal consistency, plausibility and authorial design.

So where is the problem? Nolan himself has said in media interviews that the significance of the top is that Cobb walks away. He's also remarked on the centrality of creation imagery in the film and explicitly stated that "there's a relationship between the sand castle the kids are building on the beach in the beginning of the film and the buildings literally being eaten away by the subconscious and falling into the sea." Funny how he even specified the _beginning of the film_ in that quote. No-one is post-rationalizing those words into his mouth.

Frankly, there's tremendous power to any interpretation that leads one independently to the same conclusions the director later makes, all the while explaining away what are inconsistencies under other readings (why Mal is bad, why the continual biblical references, why there is so much damn water in the dreams, etc. etc. etc.). The fact that Nolan is using fairly conventional symbolism (water = death/subconscious) is just icing on the cake.

<comment><USER5> So the importance of the top at the end - one of the most debated points - isn't whether it falls or not, but the fact that Cobb having spun it doesn't bother to check?

<comment><USER3> Exactly. The totem is "an elegant solution for keeping track of reality." And reality is the garden on the cliff, something emphasized not only by the comparison of life to a dream and dreamers to "figments" and "shades", but much more directly in such lines as Cobb's father urging his son to "come back to reality" when none of the characters are even dreaming.

We know Cobb doesn't need his totem by the end, because his rejection of Mal at the climax is an expression of faith. To understand the implicit alternative, look to the parallel heist sequence which opens the film. There we had a very different Cobb place his faith in the "reality" of Mal when he lowered himself out the window above a fatal fall. Nolan emphasizes that this is the wrong decision by showing us Cobb's immediate (biblical) fall, blasphemy and then betrayal and loss. Death destroys the world by water as foreshadowed in the parable that opens the film.

At the end of the film the logic of this sequence reverses. Cobb resists Mal's temptation to stay with her in limbo. He rejects her for the first time ever, telling Mal she is not "real" where even moments before he was expressing lingering doubts to Ariadne ("how can you know"). And whereas his lack of faith had previously led to his defeat, here his expression of it leads directly to Fischer's symbolic reconciliation with his father. And while the film presents another death sequence as required by Matthew 7.24, this is but prelude to a heaven sequence that breaks the endlessly circular logic of the dream world / penrose staircase. The rules are violated because they no longer apply: Cobb is free of the maze.

<comment><USER6> Your explanation has just made the movie more interesting to me. Until now I thought it was quite idiotic, but your revelations do make sense.

Though I still think that the ending scene is badly handled. If the point is that Cobb doesn't care any more about the outcome of the spinning top, then Nolan should have just slided from the image of the top to Cobb and his children.

By zooming in on the top and cutting the shot right before it should falls, it just adds this unneeded baggage of questioning whether all that happened is real or not. Like some sort of magic trick. "Do you doubt what you've just seen?" And I just didn't find that that was the point of the movie.

<comment><USER3> I think that's a really good comparison, because it really is a magic trick, isn't it? I think most good heist films are in the sense that the pleasure is in the misdirection: what makes them satisfying to watch is being "in on the game" -- seeing all of the clues arranged in plain sight and watching how the director pulls it off.

So Inception might not be for everyone since it's heavy on narrative and light on character development (we don't see _why_ Cobb changes, he just does), but there's all of this wonderfully meta sleight-of-hand just below the surface as Nolan tells us how he is making the film. Even beyond the symbolism, the very rules he outlines for how to create dreams apply equally well to the film itself (make the plot a paradoxical maze, get the audience lost in it while you plant ideas in their heads, and make the message stick by forming it around a core message of positive emotional catharsis). And yet we are still surprised, or I was at least!

Anyway, hopefully if you see it again you'll like it better next time. I personally think it's hands-down one of the best films in the last decade, and it's a real pity it got shunted off at the Oscars when it should have swept the field.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Am I the only one who gets annoyed when people think inception was some stupid-deep, hard-to-understand movie?

It was (I thought) very straight-forward. The bigger problems with the movie come from the plot holes pointed out by Pewpewarrows. Do those holes perhaps contribute to the confusion?

<comment><USER8> You're not alone.

If you want a movie with _actual_ complexity, watch Primer. Oh, you'll probably think you get it the first time through, because the writing is great. Then you'll rewatch it a couple times and see just how much you missed, because the writing is _brilliant_.

<comment><USER9> They're not up to Primer's level of complexity, but for bending your brain a little, try:

eXistenZ (<http://www.imdb.com/title/tt0120907/>)

Naked Lunch (<http://www.imdb.com/title/tt0102511/>)

(And other David Cronenberg movies. While I'm at it, although it's completely linear, I'm going to plug: "Crash" (<http://www.imdb.com/title/tt0115964/>).)

Jacob's Ladder (<http://www.imdb.com/title/tt0099871/>) is almost a great brain-bending movie, but for some damn reason at the very end there's a, "Let's explain what _really_ happened!" scene. F'idiots. (I recommend stopping the movie when you get to the scene where the Jacob and his son (played by Macaulay Culkin) dreamily walk up a back-lit stairway together. Let the movie percolate in your brain for a while. Then, start the movie up again and see how they ruined it.)

<comment><USER10> All great movies. Some others (with varying degrees of sophistication):

The 13th Floor (<http://www.imdb.com/title/tt0139809/>)

A Scanner Darkly (<http://www.imdb.com/title/tt0405296/>)

Brazil (<http://www.imdb.com/title/tt0088846/>)

Time Bandits (<http://www.imdb.com/title/tt0081633/>)

Dark City (<http://www.imdb.com/title/tt0118929/>) - A little disappointing at the end though =/

<comment><USER8> I really enjoyed Dark City. The directors cut is best, though, because it doesn't give away the twist at the beginning like the theatrical cut did.

</comment></comment></comment></comment></comment><comment><USER11> While these scroll sites are pretty cool... I don't know if its the javascript library or maybe that is the affect the site's creator wanted but it doesn't feel smooth.

Maybe because of the scroll speed the animations have fewer frames to animate which makes it look choppy? I'm not sure.

<comment><USER12> I found if you use the mouse scrollwheel rather than the keyboard it was much smoother.

<comment><USER11> I was using my mouse scrollwheel though... :(

</comment></comment></comment><comment><USER13> Perhaps someone here can explain something that has annoyed me since I saw Inception. Falling (accelerating under gravity) is meant to "wake you up". Whilst falling you feel weightless - almost by definition (if you and the weighing machine are accelerating in sync, you apply no pressure to it). For some reason falling causes the loss of gravity in the dream world, and there's that whole scene about "recreating gravity". But since falling is indistinguishable from being weightless, what is stopping the dreamers from waking up? And why does weightlessness only go one level down?

<http://en.wikipedia.org/wiki/Weightlessness>

<comment><USER14> Because it's not the falling, it's the jolt of landing. When in free fall, you are not actually accelerating. In terms of landing, though, it doesn't matter if you hit the ground or if, say, the bottom of an elevator hits you.

<comment><USER13> I haven't seen the film since it came out, so I may be mistaken. Didn't Cobb demonstrate to Ariadne that you wake up when you sense yourself falling? By tipping Arthur's chair over as he was dreaming? Arthur (if it was that character) didn't fall on the floor, there was no jolt. Also, doesn't the van land in the water, and no one wakes up?

<comment><USER14> According to the Inception Wiki, we're both right.

> One method used to awaken from a dream within a dream is called a "kick", > which is the sensation of falling, hitting water, or a sharp jolt that can > startle the sleeper awake.

Although I still think it's terribly inconsistent, if the details matter. There's too many different kicks with too many subtle differences and similarity for me to go into in a reasonable-length post.

</comment></comment></comment></comment><comment><USER15> Check out #5 for another illustrated version of the plot, and one that predates the movie:

[http://www.cracked.com/article_19021_5-amazing-things- invent...](http://www.cracked.com/article_19021_5-amazing-things-invented-by- donald-duck-seriously.html)

</comment><comment><USER16> I don't understand how this is a "cool animation". In both Chrome and Firefox it does nothing by default. Pressing up or down moves the page by a single (useless) frame. Pressing page up or page down moves it by some random number of frames. Again totally useless, since it often ends up in a middle of some fade-in or fade-out. The scroll wheel is no better. Nor the scroll bar. What am I missing?

The content might be interesting, but it's impossible to tell since this might be the worst way of presenting data I've seen this year. Which is quite an achievement, congratulations :-)

<comment><USER17> "Space" mostly works here, although the frames don't come off well aligned.

</comment></comment><comment><USER18> If you want to go deeper: <http://www.youtube.com/watch?v=ginQNMiRu2w>

</comment><comment><USER19> This froze my entire computer (newish macbook pro) and and I had to restart. Also didnt have that much stuff open, anyone else?

<comment><USER20> No problems here but I'm on a beefy machine: FF11, 64 bit Win7, quad core i5, 8GB ram, SSD drive - frankly I'd cry if a website was able to slow/crash that.

<comment><USER21> I use chrome on an 64 bit Win7, i7 2600K with 16GB ram and a 35/35 FIOS connection and plenty of flash sites slow things down to a crawl. Honestly, I cant help but wonder what exactly some developers expect people to use.

<comment><USER20> I don't think it's a question of what they expect. More like they have no idea how to program and Flash has let them get away with it. Seriously, there is no other sane reason why you should experience slow downs on a machine with that spec (assuming Flash can even harness most of that power).

</comment></comment></comment></comment><comment><USER22> Out of curiosity, does anybody have an estimation about how much money the link (which I assume to be affiliated) may generate?

<comment><USER23> The "Buy the DVD on Amazon" link?

My guess would be: not much.

</comment></comment><comment><USER24> Can someone explain how its done?

<comment><AUTHOR> It's powered by John Polacek's Scrollorama (<http://johnpolacek.github.com/scrollorama>) jQuery plugin.

</comment></comment><comment><USER25> The first illustrated version of Inception is here [http://disneycomics.free.fr/Ducks/Rosa/show.php?num=1&lo...](http://disneycomics.free.fr/Ducks/Rosa/show.php?num=1&loc=D2002-033&s=date)

</comment><comment><USER26> This is even more confusing than the film :)

</comment><comment><USER27> i get a spammy access-restriction warning (see screenshot: [https://img.skitch.com/20120321-86btw83e3gcnea6x4prr8wcj75.p...](https://img.skitch.com/20120321-86btw83e3gcnea6x4prr8wcj75.png) )

</comment><comment><USER28> that's probably really cool on a fast computer.

</comment><comment><USER29> So does the top stop spinning or not!?

<comment><USER30> Mal either died or kicked up a level. She used the top as a totem, not Cobb, and multiple people knew the properties of it. The top could not measure dream or reality while in Cobb's possession. His own dreams would render that totem useless.

</comment></comment><comment><USER31> The webpage is very garbled in IE9

</comment><comment><USER32> So how does this work in VMWare? :P

</comment><comment><USER33> Great way to make some quick cash via the affiliate link.

<comment><USER34> You've been downvoted, but personally I feel that this is why this site is interesting.

I do disagree that was a 'quick' way to make cash however.

But the idea of producing an 'explained' website with a very nice and subtle affiliate link is excellently executed. I'd have thought the HN crowd would appreciate that.</comment></comment>


Security of software repositories (yum, maven, npm, cpan, etc.) - <AUTHOR>

As background, over the last couple of weeks I re-watched an old-favorite, Austin Powers (I was once Dr. Evil for Halloween) and I read A.I. Apocalypse (http://aiapocalypse.com/) by William Hertling, which involves malicious viruses taking over millions of computers and them becoming self-aware.
This got me thinking about how an evil genius (or government agency) might try and infect or control millions of machines for nefarious purposes which led me to wonder about all the software that auto-updates or auto-fetches whether through yum, maven, npm, cpan or even chrome and firefox.
So my question is, how secure are those mechanisms?  Would it be possible to install malicious versions of popular open source libraries?   I understand there is signing and such, but what about getting something in the build before signing happens (e.g., alter the checked out code).  Like, say blackmailing a build engineer or hijacking a build system?
I'm asking because I've been using these systems for years and never really considered how to know if library X is actually 'clean'.  I suspect many software developers are like this - just running 'apt get' or 'npm install' or 'yum update' or 'mvn' or 'brew install' or ... what have you.
Have other developers wondered about this?  Do the security heads at these repositories lose sleep over this?
P.S.  I'm not an evil genius or government agency.
P.P.S.  Of course, who would admit to being an evil genius or from a government agency? <comment><USER2> Software is usually verified by some form of hashing scheme like md5, sha-1, or sha-2.

Windows used to run on md5 till it was proven it was horribly broken. A collision could be generated for the typical md5 having two programs have the same md5 disabling the security guarantees it usually provided. Part of stuxnet was believed to be able to overcome the installed package checking mechanisms.

SHA-1 has taken over for verification for a lot of sources including many linux packages. As for it's security it is debatable to a certain extent. There are efforts to port things to sha-2 but it hasn't been officially done yet I think.

Malware persistence is a focus on the malware persisting on the computer or network after infection. It is a very big field considering most organizations use apps from many different software vendors.

When you install an app it can be in source form but it also may contain many different binary(compiled sources). This is problematic. A good example is Hadoop (famous for computing big data problems) contains lots of pre-compiled .jars(java sources compiled).

Static analysis and verification became the go-to standards for a lot of study on verifying binary integrity. But every format and packaged store is different and has different levels of security. There are also more advanced methods or protecting like capabilties(monitoring based on what the apps have access to). A very good minimal for this are some of the libraries released by google including shipshape: [https://github.com/google/shipshape](https://github.com/google/shipshape)

Many companies can no longer get away with just installing a firewall or relying on security products because security is now an "inside problem." Where the software they download from their cloud service(openstack for example) comes from many different vendors. Another example is docker(also many different vendors used to package apps together but provide isolation from the system).

SHA-1 has not been known to be broken, however there are some strange attacks that show that it might be possible it is overcome-able through other means. A prime questionable of how it is overcome example is ssh ebury ([http://www.welivesecurity.com/2014/02/21/an-in-depth- analysi...](http://www.welivesecurity.com/2014/02/21/an-in-depth-analysis-of- linuxebury/) ). SSH ebury seems to be unique in that it during regular execution of the program despite there being no noticeable changes to the user alas from running specific shell commands that are not normally run by regular users it looks not infected/safe.

As for companies installing older versions of software with known remote code execution vulnerabilities or other types of vulnerabilities that are very severe, I do not know of many services or open source software that checks against this! There are however many continuous integration services. Continuous integration services if not done from your company though has problems on verification as well.

A good monitoring practice would be to use homebrew(usually available for most operating systems) to monitor and track what is installed on a regular basis and have some form of whitelist.

Network Traffic analysis for companies is major headache as well. Traffic can be compromised in many different ways. Wikipedia covert channels is a good explanation of some of the complexity involved. There are many tricks for data ex-filtration that make it basically undetectable by normal means (they require some level of active-monitoring). Almost all anti-virus now include network Man-in-the-middle traffic monitoring to do their work.

Anti-virus companies generally have two methods of classifying software as good-ware vs. bad-ware. One is whitelisting and the other is blacklisting. Whitelisting is a selective list of good software. Blacklisting is a selective list of bad-ware. Both methods are generally debatable for which is better. Despite the fact that your anti-virus itself could be compromised usually having an anti-virus provides some level of security.

People despite all this realize that running a company without using pre-made opensource code is rather ridiculous as so much runs on the app stores or third party software sources(outside your company's control).

Security in many cases can be thought of as a castle with multiple walls or layers of defense, but your firewall as being your main wall of defense is a bad decision, because a wall is just what makes your castle stand up to some attacks, it doesn't actively patrol your inner walls for insider threats. Companies need active monitoring systems for access control logs espeically since many common interactions can seem malicious but are just part of people's daily jobs now.

A lot of security is moving to "anomaly detection" where anomalies are jolts of irregularities in the normal business day. Some things that are bad can be parts of normal activity, but done over a longer basis or with extended activity may be hazardous to businesses (a good example is Denial of service attakcs). While anomaly detection is a good trend with smart systems it also suffers from the same "packaging and extending attack surface" like everything else.

This is a short overview of how security works in general, though if you have any questions feel free to ask.</comment>


Use the admin to manage drip campaign emails using querysets on Django - <AUTHOR> https://github.com/zapier/django-drip <comment><AUTHOR> Zapier first-draft before it became the Zapier we know</comment>