Ask HN: How would you teach web development to college students? - <AUTHOR> I've be working with a few other students to create HackBU [1], an organization at Binghamton University designed to teach web development and create a "hacker" culture.
We have 300+ people signed up and only 1/3 are CS majors. The plan is to hold weekly workshops with 45 minutes of lecturing and 2 hours of "office hours." We'll be organizing trips to hackathons and eventually host our own 24-hour hackathon at the end of the semester.
So, HN, how would you structure such a program if you were planning it?
Or, what would you like to see as a student?
[1] http://hackbu.org/ <comment><USER2> Speaking of what I would love to do as a college student, I think it would be awesome if a professor was doing something as a challenge against me.

Meaning, I think a lot of time students are told to learn by the professor explaining some of the most basal subjects that we all take for granted anyways (like server architecture, HTTP, etc) and not getting to the juicy cool stuff that we can all do with the web.

What my thought would be is that at the beginning of the semester, the professor took a few days and built a website she thought that the website should exist (it doesn't matter what the website was, just that it was created by them in a matter of days).

Then the entire course was the professor taking the students through all of the design decisions that she made and along the way taught the students how to be a hacker and how to build things on the web.

The challenge would come in the fact that the professor would have a running track of how many users/views the site had and as it grew, the professor could talk about the design optimizations and server architecture in a way that the students would normally experience it.

<comment><USER3> While a cool idea, this places a lot of overhead on a professor who most likely already has a bunch of other stuff they need to get done (even at tiny liberal arts colleges).

Expanding on your idea, collectively, or in small groups, students could build that website. From the idea stage to the production stage.

<comment><USER2> I do completely agree that there is a lot of overhead on the professor, but I tend to believe that any professor that would like this idea would be able to rationalize spending a weekend to be able to explain what she created all semester. I can't imagine a cooler lesson plan than detailing your design decisions as you made them.

<comment><USER3> Presuming it takes a weekend to solve some sort of problem that at least some other people have. Presuming they're not only a couple weeks ahead of their students in the course's material.

</comment></comment></comment></comment><comment><USER4> I have been wanting to set up a similar program at another university. With 300+ students you have something good going. Your idea of organizing trips to hackathons is marvelous.

What language are you hoping to get them started on? Python? Scheme? I have been wanting to start with Scheme... but that is because I read PG's essay and got bitten by the bug.

Keeping the lecture time down to 45 minutes sounds wise. Students are already swamped with class hours so keeping the weekend time burden down is probably the right move.

Perhaps you could set up teams that could compete with each other through a series of programming challenges? You could find a local business who would sponsor a prize, or a restaurant that would offer a dinner for the winning team.

Be sure to post updates on your group's website. Other people, like myself, are wanting to do the same thing at other schools and would be encouraged to hear about your progress. Your website could also link to the students' work on Github once they are ready to step into their first real projects.

Your program sounds exciting! Keep us up to date.

<comment><USER5> > Perhaps you could set up teams that could compete with each other through a > series of programming challenges? You could find a local business who would > sponsor a prize, or a restaurant that would offer a dinner for the winning > team.

I like this idea. Through my experience in several student orgs, it seems that the best way to get people to stay involved is competition and prizes. Personally, I would much rather see students be self driven, but there's a hump of "oh I'm too busy to do this" (or something of the sort) that most students need to get over before taking a huge interest in it.

<comment><AUTHOR> Good point.

I replied to kendalk and mentioned that forming teams and having competitions might be overwhelming in the beginning, but maybe it makes sense to two individual semester semester-long prizes for a CS major and non-CS major that build the coolest product.

<comment><USER4> In addition to having a prize for a CS major and a non-CS major, you could have one that is specifically for a new beginner to programming. Some students have been hacking since they were in junior high but have a different major. I started with a Commodore VIC-20 and BASIC but I wasn't a CS major in college.

</comment></comment></comment></comment><comment><USER6> I don't think web development is the hard thing to teach as much as problem solving well.

I would have them build anything and everything with the caveat that no matter how good they were (or weren't) the quality of their code would suck looking back in 5 years and to start with bad code, and incrementally add concepts like switches, functions, etc., much like very young coders did at age 10-15 when building anything, in any way was cool beyond belief. Solving problems better and better is the fuel of continuing to learn to develop better for me, but we all have to start somewhere.

Therefore start solving interesting problems. And keep solving them until you get better at it.

<comment><USER7> > I don't think web development is the hard thing to teach as much as problem > solving well.

True, but there's a lot to be said for having first-time programmers (and especially college students) do Web development. It's a familiar environment, which means that they'll know that they're doing something relevant and practical, rather than abstract. They'll be excited to see that they can create Web sites and applications, just like "real" programmers with more experience.

Part of the fun of programming is the immediate feedback that you get from your work. Nowadays, making that immediate feedback happen in a Web browser strikes me as a smart way to go if you're going to get them hooked.

<comment><USER6> I don't disagree with what you've said in any way.

Programming is simply clear step by step thinking to make something happen. Focusing too much on the syntax and strategies in the beginning can be a distraction from the raw and immediate feedback from your work.

</comment></comment></comment><comment><USER8> Sounds pretty cool. You might want to look at MIT's winter term (one month) web programming competition/class for some inspiration: [http://6.470.scripts.mit.edu/2014/](http://6.470.scripts.mit.edu/2014/).

They do a mixture of lectures, office hours, and guest speakers, and culminate with a final submission for prizes. Not everyone has to enter the competition and there is also a rookie flight and an experienced dev flight so everyone can participate. Gathering corporate/start-up sponsors to get prizes for a contest seems to be a good way to spur interest and motivate people to learn (at least it was for me).

<comment><AUTHOR> Great, thanks! I've been looking at David Malan's CS50 web programming lectures at Harvard and found them useful as well.

[https://cs50.harvard.edu/lectures/9/m](https://cs50.harvard.edu/lectures/9/m)

</comment></comment><comment><USER9> I would focus on JavaScript. No CoffeeScript [1]. Start with basic HTML and CSS on the frontend; nothing fancy with HTML/CSS yet, just a couple of workshops. Then basics of JavaScript. Then jQuery (leave the DOM for another day). Then you can consider branching out into _select_ (can't cover them all) advanced topics like D3.js, HTML5 canvas, SVG, WebGL (using three.js).

You may find that that's all you can cover in a semester. If not, I think it's important to also cover the server-side. Start with jQuery AJAX calls against an already created RESTful API to teach the basic request-response HTTP model. Then have students implement the API (no database needed) in Node.js. If you still have time (I doubt it), introduce the concepts of databases with MongoDB [2].

Python and Ruby are great ecosystems, but if you still have to teach JS, I feel like it's a bit hard on beginners to juggle multiple languages. Also, I'm divided on the utility of teaching a huge framework like RoR/Django vs. a lighter framework like Sinatra, Flask, or Express.js (node).

[1] You want to minimize cognitive overhead, especially with 2/3 non-CS- majors. And since anyone learning CoffeeScript needs to know JS, you might as well start with JS.

[2] MongoDB is a lot quicker for hacks than SQL.

</comment><comment><USER10> First make it work, then make it pretty.

Solve problems that matter to them.

Get to useful, first. ( _Their_ definition, not yours.) Then dig and build further.

I've experienced too much pedagogy that takes weeks or months to get to anything that really interests the student.

There is also too much that is "plug and chug", where one never learns more than how to follow a list and assemble components, without understanding them nor the platform on which they run.

My preference would be to engage them with something of interest, and then let that interest motivate the journey further into the details and the context.

If this doesn't interest them, they are probably in the wrong class. (Even if they "need" this for their "career".)

P.S. It's much more motivating to teach someone who is interested in and excited by what they are accomplishing. I mention this with respect to keeping "a few other students" \-- as well as yourself -- engaged in your project.

So... make it engaging for your audience, and thereby make it engaging for yourselves.

Good luck.

</comment><comment><USER11> I'd probably structure it a lot like a bootcamp. Check out Flatiron, gSchool, or Dev Bootcamp's curriculum for some good ideas. To summarize, though, typically it's a few weeks of learning a high-level language (Python or Ruby). From there, it's typically a solid couple of months of learning the corresponding framework (Django or Rails). All the while, sprinkling in some JS and CSS magic.

They're usually able to churn out some pretty decent full-stack programmers after 3 months, or so (granted they meet a lot more frequently than 3 hours per week). You'll have to be super diligent about giving them assignments, but the nice thing is that there are so many resources around Ruby and Python... Codecademy, Treehouse, Rails for Zombies, etc.

Come back and let us know how it worked out!

<comment><AUTHOR> Thanks!

My main concern is that 2/3 of the people signed up don't have any programming experience, so it will be hard to keep it interesting for CS majors and slow enough for everyone else.

We were thinking of starting off with HTML/CSS since it's not taught in classes then progressing to a server-side language + framework.

I've recommended all of the non-CS majors to go through the JavaScript Codecademy lessons over break to learn the programming fundamentals so they can keep up when we dive into Ruby and RoR (or some other language/framework).

<comment><USER11> Not sure this is a legitimate concern though... The experienced CS majors will be able to blaze through HTML/CSS just as they would be able to blaze through Ruby. I also think they'll find themselves sufficiently occupied helping their classmates and/or implementing more challenging projects.

It's fine to start with HTML, but recognize that it's a markup language, not a programming language. Aside from that, you'll be able to cover most of the HTML/CSS within the span of a week (hopefully faster with the CS majors).

</comment></comment></comment><comment><USER12> Having been a back end developer for years, and more recently moving to Django, I think teaching a good framework is a good way to go.

For me I can often see multiple (often hacky) approaches to getting something done, but looking through the docs, it seems that the Django developers have made the decisions for me, and they probably have more experience than me.

Looking back through my old code, I did a lot of things manually (reversing URLs) when I read a bit more in the docs, I see the Django developers have put something in to do that already. Usually a lot more cleanly than my solution.

</comment><comment><USER13> Hi, I'm a non-CS major at BU on a throwaway account. Don't worry, you're not alone.

We can SSH onto an Ubuntu server named HARVEY to test Linux versions mySQL, PERL, PHP, Python, Ruby and display our own web pages.

[http://harvey2.binghamton.edu/](http://harvey2.binghamton.edu/)

We also have access to an FTP site for software like Mathematica, Maple, and Matlab, and there is another page for access to a bunch of VMs that have certain software packages on them. Look at ssl.binghamton.edu.

<comment><AUTHOR> Thanks! I'm aware of Harvey but is there anyway to configure a domain name? Feel free to reach out at firstname.lastname@example.com.

</comment></comment><comment><USER14> As a student I would love to learn how to secure a website on frontend and backend. Too many tutorials skip this part, like which algorithms to use for hashing passwords. It sounds simple, but every month some major site has a breach and we find out passwords were stored plain-text.

</comment><comment><USER15> This was the video that I watched 6 years ago that got me into web dev and eventually actual programming: [http://www.youtube.com/watch?v=GwQMnpUsj8I](http://www.youtube.com/watch?v=GwQMnpUsj8I)

<comment><AUTHOR> Great, thanks! I'll take a look.

</comment></comment><comment><USER16> I would tell them to build a website with XYZ features. A very simple page. Tell them to use Google if they don't know how to do something.

</comment><comment><USER17> First I would ditch any notion of teaching back end programming and focus on front-end only [0]. The things you can do with, and are required to learn and master to be good with, HTML/CSS/Javascript are so extensive and deep that alone could be overwhelming to people new to web development. So, first and foremost just focus the course on frontend technologies (and feel free to use things like Coffeescript or Clojurescript instead of Javascript, they probably make better teaching languages than the wtf-laden JS).

Also, if 2/3 are non-CS majors, you're going to need to teach basic problem- solving and analytical thinking skills. Teach and reinforce the basic problem solving process of taking a complex problem (or programming objective) and breaking down into its component parts, solving each, finding multiple solutions if possible, then building it back into a whole again. Set expectations of multiple possible answers, of hacking at the problem till you start grokking it, etc. It's not about getting that one right answer, it's about getting something that works then continually improving it. Learning programming carries a lot of frustration which can be very off-putting and demoralizing, so ingraining the expectations, problem-solving skills, and habits needed to overcome that is crucial (and also a super general life skill).

Look into using platforms designed for teaching like Processing [1] and its JS version Processing.js [2]. Also see if you can find teaching-oriented stuff around D3.js and/or Canvas. Programming visualizations is one of the more fun and rewarding pure front-end web activities students can do, plus makes for nice portfolio sites, and there's a legit job market for it.

Finally, consider adopting Salman Kahn's approach of the "inverted classroom" \- have the students watch video lectures or read the texts for homework, and spend every second of classtime programming with teacher/expert supervision and guidance. The old days of sitting in a classroom being lectured at and then having to go home and do the actual practice on your own without immediate feedback are a total anachronism now, imho.

[0]: Though I might make an exception for Scheme per the essay "A Scheme Story" linked at the end of PG's essay "Beating the Averages" ([http://paulgraham.com/avg.html](http://paulgraham.com/avg.html)).

[1]: [http://processing.org/](http://processing.org/)

[2]: [http://processingjs.org/](http://processingjs.org/)

[3]: [http://d3js.org](http://d3js.org)

[4]: [http://updates.html5rocks.com/tag/canvas](http://updates.html5rocks.com/tag/canvas)

<comment><USER18> I totally back the inverted classroom approach. Coming prepared to the class will make an enormous difference in how well the students who aren't familiar with the subjects will be able to keep up. It attenuates the individual variation in learning speed and allows students to take as much time as they need in private to understand the material.

</comment></comment><comment><USER19> So, this is web development in general, not specifically CS software engineering, or electrical engineering, right?

Some thoughts, mostly motivated by experience of both what I'd wish I'd known and also in mentoring at Rails Girls and similar community events:

~

Spend some time to explain _how_ the modern web works. Go to "[http://www.example.com"](http://www.example.com") and talk about the series of requests that are made (socket, IP, DNS, HTTP server, these things). Pull up a debug console and show the traffic. Talk in broad strokes about page parsing, layout, whatever, but give a high-level idea of how all the pieces fit together. Do this first, so everything later kind of has a framework to fit into.

(This is similar to how you start with logic gates and build up to ALUs and eventually coomputers in good computer engineering/science curricula.)

~

Next, talk about stacks and gross areas of division, but keep it simple: this is the front-end (the browser), displaying a page and maybe running a script; this is the backend, the web server which decides what pages to send; this is the database, which stores data. It won't be helpful to go into more recent developments like single-page apps or Meteor or Websockets or whatever just yet.

~

Then, you can kind of split into two or three ways:

You can talk about server technologies, like PHP or Rails or Node or whatever, or just dumb file serving with Nginx or Apache or Sinatra or whatever the Python equivalent is these days.

You can talk about HTML/CSS, and talk about how we style HTML content and organize pages into divs. Show off a grid system, show floating, show the box model and padding and margins and all that stuff. Show basic form usage.

You can talk about client-side scripting, about attaching event listeners and using jQuery or vanilla JS to play with the DOM. Show off some simple code letting people mark stuff on a Google Map (API is well-documented and pretty easy to use and is tangible). Maybe let people play with something like Three.js or Kinetic.js.

~

Last, talk about things like using Github and SSH to log into a server. Talk about where to find help (man pages, Stack Overflow, lmgtfy, etc.) Basically, _solve IT problems last_ if you can avoid it--learning how to sysadmin (even just for local development) is annoying and tedious, and will distract from the previous, more interesting and enjoyable topics.

~

Hope that helps.

EDIT:

Make sure that students are actually _doing_ stuff for everything after the fundamentals lecture: write a static homepage, write a pong game, write a simple message board, etc.

Doing is learning here.

<comment><USER3> I don't know that explaining all of how the web works initially would catch the interest of the 2/3s of the people who aren't CS majors. A lot of people would probably get bored really quickly and stop showing up.

<comment><USER19> OP wanted suggestions for how to teach it--was just relaying what I thought would be useful.

A simple "How to set up your own website" would be a good opener, and you could get Blue Host (over in Provo) to probably sponsor hosting.

<comment><USER3> Right, suggestions on how to teach it, when most of the audience doesn't have a technical background...

As for "How to setup your own website", I think that shouldn't be the _first_ thing, but close to the first thing. I think making simple HTML pages (and maybe a tiny bit of CSS) would be better first.

Also, I don't know if Binghamton has hosting for students, but some colleges do. It might be worth asking, even if it's not generally available, you have a sizable number of students, and you're doing something the University might like and think looks nice publicly.

</comment></comment></comment></comment><comment><USER20> I recommend doing some Googling and book spelunking through all the existing mass of stuff that exists from which one can learn web development. Adapt, apply, repeat. This is also a good strategy/pattern that can be learned for other topics/fields as well.</comment>


Show HN: Deepfence ThreatMapper – A powerful vulnerability scanner - <AUTHOR> We are super excited to release the community edition of our product to help DevSecOps teams -- Deepfence ThreatMapper ! Deepfence is a unified platform to protect kubernetes, virtual machines and serverless workloads at runtime.
We have packaged a subset of important features of the platform in this edition. Essentially, you can visualize kubernetes clusters, virtual machines and container images in real time and scan them for vulnerabilities. You can also scan an unlimited number of container images by integrating with popular registries.
This community edition comes with batteries included and should be ready to use by small startup teams as well as enterprises teams. Hence the edition comes with built-in integrations for Slack, PagerDuty, Splunk, SumoLogic, ELK and more.
For more details about the features and installation instructions, refer to our page at https://github.com/deepfence/ThreatMapper. There is a live demo available as well. Try out our product and don't forget to send us your feedback. We'd love to hear from you to improve our product! <comment><USER2> The project is available here

[https://github.com/deepfence/ThreatMapper](https://github.com/deepfence/ThreatMapper)</comment>


An Arkansas man complained about police abuse. Then officials ruined his life - <AUTHOR> https://www.washingtonpost.com/news/the-watch/wp/2018/07/10/an-arkansas-man-complained-about-police-abuse-then-town-officials-ruined-his-life/ <comment><USER2> This is not the first video of misbehaving police officers that I have seen... The commentary at the end of the article explains it all: police officers are trained to act like this. The fact that the number of arrests is a measure of how well the department works, is also not helping.</comment>


Physics puzzles - <AUTHOR> https://www.lockhaven.edu/~dsimanek/puzzles/puzzles.htm <comment><USER2> The Harvard physics problems of the week are a great set too: [https://www.physics.harvard.edu/academics/undergrad/problems](https://www.physics.harvard.edu/academics/undergrad/problems)

<comment><AUTHOR> Ah, we used Morin's excellent book in my undergrad physics class. =)

</comment></comment><comment><USER3> Reminded me of TIM[1] mechanic puzzles series for DOS. It's incredible how advanced games looked in the beginning of 90s having just a handful of memory.

[1] [https://www.dosgamesarchive.com/play/the-incredible- machine/](https://www.dosgamesarchive.com/play/the-incredible-machine/)

<comment><USER4> To all who click this... please be careful of your sound level before you do. The game right as it started loading made an extremely loud noise and scared me half to death.

<comment><USER5> THANK YOU!!!

</comment></comment></comment><comment><USER6> I believe with the first puzzle Leonardo intended the wheel to appear to rotate clockwise. This is why the ball on the right hand side is at the center of the wheel. This is also why there are blocks filling the outer corners but not the inner corners: the balls will fall violently into the outer corners, and roll gently into the inner corners. The "extra" ball is just illustrating the need for blocking the outer corners: the extra ball is shown stuck in such a corner.

The drawing wants to lead the viewer into believing that the force of the ball falling to the right and hitting the bottom of the wheel will cause the wheel to turn, lifting all the other balls a small distance. The energy lost from one ball falling a great distance is equal to the energy gained from many balls rising a small distance. This seems to me to be the error the drawing means to invoke.

</comment><comment><USER7> These remind me of engineering exam questions - maybe if they'd called them "puzzles"...</comment>


Campher: Perl embedded in Go - <AUTHOR> https://github.com/bradfitz/campher/ <comment><USER2> Sounds useful, and campher.c looks like a piece of code that should be easy to repurpose for writing bindings to Perl in other languages.

</comment><comment><USER3> This is one of the most awesome thing's I've ever seen. I guess it would be a bad idea to use it for production code... Too bad though.

<comment><USER4> Am I missing something?

My C days was a long time ago, but this looks like simple and elegant stuff to me. What would be the problem with production code? The Go language?

<comment><USER5> I think it might have a bug or two yet. Perl is reference counted and Go is garbage collected. Keeping those two synchronized was a bit tricky and I still fear I messed it up somewhere... I need to re-read the Perl docs on when I'm supposed to up & down the Perl refcounts.

<comment><USER6> There's no better way to find the bugs than to use the code in production ;-)

It was a great talk, BTW.

</comment></comment></comment></comment><comment><USER7> It's pretty easy to embed Perl in another language. Check out perl4caml ...

<http://git.annexia.org/?p=perl4caml.git;a=summary>

</comment><comment><USER8> Not to steal any thunder, but thought I'd point out Leont's great C++ perl bindings. <https://github.com/Leont/libperl-->

He has type safety and easy import/export of objects baked in.

</comment><comment><USER9> :(</comment>


Ask HN: Any Sydney based startups looking for some extra hands? - <AUTHOR>

Hi Everyone!
Are there are any Sydney based startups looking for developers?
Thank you :) <comment><USER2> You should try Silicon Beach (Oz) as well - [https://groups.google.com/forum/?fromgroups=#!forum/silicon-...](https://groups.google.com/forum/?fromgroups=#!forum/silicon- beach-australia)

</comment><comment><USER3> Hey man! We're on the lookout. We're based in Kirribilli. We're flying under the radar at the moment so I'll email you with details :)

<comment><AUTHOR> Cheers!

Thank you :)

</comment></comment><comment><USER4> There sure are, what are your skills? Send me your details if you're interested in working on some very deep problems

<comment><AUTHOR> Sure! my email is jason[at]safetyscissors.co</comment></comment>


NetBSD support for psutil - <AUTHOR> http://grodola.blogspot.com/2016/01/netbsd-support-for-psutil.html <comment><USER2> Slightly off-topic, but for anyone unaware, NetBSD is a wonderful operating system (it happens to be my favorite). Rock-solid reliability, very organized file system, great package manager (pkgsrc), and compatible with virtually every platform imaginable, you can see the full list here: [https://www.netbsd.org/ports/#ports- tier1](https://www.netbsd.org/ports/#ports-tier1)

<comment><USER3> I recently started testing NetBSD in a virtual machine on my PC. I really like it, although there are some things that annoy me with it.

I would like to use it as my primary OS but it won't boot on my hardware. I've considered installing and running it inside of a hypervisor but I don't know if that is wise.

<comment><USER4> Its fine in a hypervisor. It has excellent Xen support, but you can use others too; it has all the virtio drivers for KVM for example now.

What is the issue with your hardware?

<comment><USER3> I am not at home, but as I recall, the kernel freezes during boot for both the 32 bit and 64 bit versions. The 32 bit version of OpenBSD also freezes during kernel boot but the 64 bit version does not. I know it is not an EFI issue as legacy booting is turned on.

<comment><USER5> Odd that it won't boot. What hardware are you running and which kernels have you tried? Any way for you to capture a trace?

This probably isn't the best forum to give you a hand. Can you hit one of the IRC channels or mailing lists?

<comment><USER3> It's an older Dell Dimension, one of the very last Core 2 Duos CPUs. I am not too worried about it at this point, as I am going to replace early next month. Hopefully, my next computer will fair better.

</comment></comment></comment></comment></comment></comment><comment><USER6> > psutil.cpu_count(logical=False) always return None.

Out of interest why would this be the case? Don't know much about NetBSD.

<comment><USER7> Because psutil uses the OS APIs, NetBSD (and OpenBSD) don't expose the physical core count (number of actual CPU cores), only the logical one (including "hyperthreading" virtual cores)

</comment></comment><comment><USER8> currently hackernews link is looping back to the page itself

</comment><comment><USER9> great work @grodola !!</comment>


Ask HN: How should I deal with constant anxiety problems? - <AUTHOR>

Well, exactly three weeks ago on that Saturday night, I had an extremely bad panic attack for the first time. I basically had racing thoughts that I was going psychotic and whatnot. I decided it would be a good idea to see a psychologist.
I went there and thankfully she assured me that I wasn't going crazy. I also went to a doctor and he assured me that I didn't have any physical problems. However, the anxiety still going on, and although it has gotten significantly better, peace hasn't returned to my life.
Since this place seems like the most educated place on the Internet, what should I do? <comment><USER2> I find meditation to be the best cure when I'm particularly anxious about something. At first I just spend a few minutes trying to completely empty my mind. This can take significant practice if it doesn't come naturally. Then I start into a visualization of the powers of 10 video (yeah, I know it's cheesy but it works!). During that visualization I try to focus on my minute position in the universe, and by the end I'm usually incredibly calm. Whole thing can take less than 10 minutes and I can go from being a wreck to calm.

That's just my routine. Everyone who meditates has their own. It's just kinda whatever works for you. I highly recommend checking out the hundreds or thousands of sites on the interwebs that teach basic/beginner meditation. It's well worth a shot.

Best of luck buddy... getting a grip on your anxiety probably won't be easy, but is absolutely necessary for good mental and physical health.

</comment><comment><USER3> Try: * daily exercise * meditation * new hobby - learning a new skill/hobby will provide you enough distraction to worry about anything else.

<comment><USER4> Great suggestions, I would also make sure you are getting enough sleep. If caffeine or other drugs are keeping you up, try and phase them out and see if you can go to sleep instead of staying awake worrying. You don't mention if there has been any changes in your life but it's normal to react to a significant change (e.g.death of a relative or close friend, end of a long term relationship, loss of job or other significant financial setback, etc..) with stress.

</comment></comment><comment><USER5> Take a break from computers. I notice an increase in stressful thoughts when I do too much programming. When I take a break from programming all the stressful thoughts vanish. I know "taking a break" from programming can be hard, especially if it's your job and you have financial obligations. In my experience taking a break of non-trivial length (1 - 6 months) has substantial rewards. I quit my comfy job around the middle of last year. I took 6 months off and am now back in a similar job. I feel far better everyday and I'm at least 1.5x as productive. I hope your situation will lend itself to a break like this.

</comment><comment><USER6> It would be good to read into Anxiety disorders[1] to get a feel of what sorts of coping mechanisms exist so you could benefit from the good ones, and avoid the bad. It's also helpful to monitor exactly what happens when you get spikes of anxiety; note the situation, your previous state, and any other details you can, even if you don't think they're pertinent. The more data you can obtain, the easier it will be to identify your ailment, chronic or not.

1: <http://en.wikipedia.org/wiki/Anxiety_disorder>

</comment><comment><USER7> What worked for me was proper diet and exercise. I used to suffer from pretty bad panic attacks that would occur randomly, and it was really debilitating. The thing that really helped me was taking up jogging. Some form of daily exercise is essential. Also, cutting out caffeine completely helped a lot.

Good luck - it might take awhile to get back to 'normal', but keep at it!

</comment><comment><USER8> <http://en.wikipedia.org/wiki/Anxiolytic>

Perfectly normal people with anxiety problems take them.

<comment><USER9> Effexor, lowest dose possible, cleared me up. I almost couldn't leave my house before.

Try exercise and better diet first though maybe.

</comment></comment><comment><USER10> Don't be scared of a panic attack. Let it wash over you. Attempt to get to the root cause of it.</comment>


Here's why Apple doesn't listen to its shareholders - <AUTHOR>

<comment><USER2> Fix the link. [http://tech.fortune.cnn.com/2012/12/12/apple-shareholders- di...](http://tech.fortune.cnn.com/2012/12/12/apple-shareholders-dividend- repurchase/)</comment>


Benchmarking Apache Kafka, Apache Pulsar, and RabbitMQ: Which is the Fastest? - <AUTHOR> https://www.confluent.io/blog/kafka-fastest-messaging-system/ <comment><USER2> The original title of the article is "Benchmarking Apache Kafka, Apache Pulsar, and RabbitMQ: Which is the Fastest?"

As for messaging systems, there is no mention of NATS[0] or NATS Streaming. For a system with durability similar to Kafka, LiftBridge[1] utilizes NATS and would be another alternative to look into.

[0]: [https://docs.nats.io/](https://docs.nats.io/)

[1]: [https://liftbridge.io/docs/overview.html](https://liftbridge.io/docs/overview.html)

<comment><AUTHOR> The article actually makes the following claim "We found that Kafka delivers the best throughput while providing the lowest end-to-end latencies up to the p99.9th percentile. At lower throughputs, RabbitMQ delivers messages at very low latencies." And the url is ending with "kafka-fastest-messaging-system"

However, to avoid confusion I will edit the title to match the original title.</comment></comment>


Inside ThinkGeek, Where Mythical Meat Can Make Millions - <AUTHOR> http://www.wired.com/magazine/2010/09/mf_thinkgeek/all/1

<comment><AUTHOR> I had no idea ThinkGeek was owned by VA Linux (who has since changed their name).

VA Linux was one of the INSANE 1999 stocks that I remember the best, clamoring to buy in at $200/share on IPO day for a company trying to raise $115,000,000 or so by going out @ $30.00 a pop.

This for a company doing ~$14m gross if I remember correctly.</comment>


Developers: When using Frecency, please consider the context - cool-RR http://blog.ram.rachum.com/post/33095461928/developers-when-using-frecency-please-consider-the

<comment><AUTHOR> > When using Frecency, please consider the context

When inventing nonce words that have no real purpose, that conceal more than they reveal, hang your head in shame.

<http://en.wikipedia.org/wiki/Nonce_word>

A quote: "A nonce word is a word used only 'for the nonce' —to meet a need that is not expected to recur."

<comment><USER2> When slamming an author of an interesting article over nonsense, hang your head in shame.

<comment><AUTHOR> To the degree that the article depends on a silly, invented word that will be forgotten in a week, to the same degree the criticism has merit.

<comment><USER3> did you read the article? the point he's making is a valid one that in no way depends on the existence of the term "frecency", as long as the concept it embodies is remembered.

</comment></comment></comment></comment><comment><USER4> Firefox gets this right. Frecency combined with machine learning. It's why Firefox's Awesomebar still can't be beat.</comment>


Dropbox automatically searches for illicit files - <AUTHOR> http://gizmodo.com/dropbox-refuses-to-explain-its-mysterious-child-porn-de-1722573363

<comment><USER2> This isn't news, wasn't it known long ago Dropbox was hiring people who are really, really good at image processing? This was discussed on HN many many months ago.

<comment><USER3> Keep in mind that they may have been using image processing people for Carousel[1].

[1]: [https://carousel.dropbox.com/](https://carousel.dropbox.com/)</comment></comment>


You Should Be Freaking Out About Privacy - <AUTHOR> https://www.nytimes.com/2019/12/20/opinion/privacy-surveillance-video.html <comment><USER2> Ironic that they require a login, or that one not read in "Private Mode". Yes, I understand that "Newspapers" need to make money, and that websites need advertising to generate revenue.

I just find it ironic that an article about privacy requires either registration or non-privacy in order to read it.

      $ wget $URL -O x.html
      $ lynx -dump x.html | less

Interesting read.

<comment><USER3> I've started to understand this better at some point. We're sufficiently bound with conditions now that to even start talking about privacy requires us to play by the rules - hence login requirement. Hopefully we're not too deep in the swamp yet, so we can get to the hard surface before it's too late.</comment></comment>


Crowdsourcing Your Way to Average - <AUTHOR> http://www.w2lessons.com/2011/02/crowdsourcing-your-way-to-average.html

<comment><USER2> Crowd sourcing operates by certain rules, many of which aren't well understood.

With some luck, I'll have a working version of W3 version of crowd sourcing up and running within a year, which will hopefully solve some of the problems mentioned here.</comment>


DHS creates fake university, arrests foreign students for attending - <AUTHOR> https://www.usatoday.com/story/news/nation/2019/11/27/university-farmington-ice-arrests-more-fake-michigan-college/4317788002/ <comment><USER2> Can someone explain how is this even legal ? Isn't this entrapment ? And what's the objective of this sting operation anyways ?

It's not like students on F1 Visa know what is legal and what isn't, especially with US immigration laws being so complex. They usually rely on the grad school Visa office to tell them if they're allowed to do something like where they can work and what paperwork needs to be filed.

Instead of doing the actual work of publishing clear rules, explaining the law, inspecting universities and ensuring compliance, DHS ruined students lives after they took their money.

<comment><USER3> What's egregious is they even got fake accredition.

That said, I think the people who signed up should have suspected a fake university given there were no actual classes. These people were probably merely looking to maintain legal immigration status without actually doing the needful work.

</comment></comment><comment><USER4> And happily cashes their tuition..

<comment><USER5> It's like they want to prove that no crimes committed while on federal payroll can ever get you prison time.</comment></comment>


Computer Architecture Essentials [video] - <AUTHOR> https://www.youtube.com/watch?v=yOa0WpMwzWk <comment><USER2> It also seems like this particular video is part of a larger (82-video) playlist on "Extreme Scale Computing" training that they did there at the Argonne National Lab (it'd be nice to be smart enough to work there :-).

Link to the full playlist: [https://www.youtube.com/playlist?list=PLGj2a3KTwhRb6LNVucPkw...](https://www.youtube.com/playlist?list=PLGj2a3KTwhRb6LNVucPkwdpzg9OHd8jli)

<comment><USER3> Thank you so much, you made my day.

I am going to download all of them and watch all of them. Again,thanks.

<comment><USER4> The videos and thumbnails and a little bit of additional metadata take about 38GB in total for anyone wondering.

A couple of the videos were not available in my country due to some copyright stuff so the exact size will vary depending on what country you are downloading from.</comment></comment></comment>


Why Google(or everyone else) will eventually fail. - <AUTHOR> http://geekrage.tumblr.com/post/5237818153/why-google-or-everyone-else-will-eventually-fail

<comment><USER2> Indians seem to be fixated by college/educational institution pedigree. Get over it. Code, hack away and prosper. Forget everything else.</comment>


HoneyMap Offers Real-Time Glimpse of Cyber Attacks as They Happen - <AUTHOR> http://betabeat.com/2012/09/the-honeymap-offers-real-time-glimpse-of-cyber-attacks-as-they-happen/ <comment><USER2> The countries that show the most hits are the ones that have the most honeypots. Thus showing the attacks geographically, while cool-looking, doesn't provide a lot of value.

Maybe they could normalize the regions by including the ratio of honeypots to Interent-connected computers.</comment>


SeaMonkey 2.53.1 - <AUTHOR> http://www.seamonkey-project.org/ <comment><USER2> > Web-browser, advanced e-mail, newsgroup and feed client, IRC chat, and HTML > editing made simple—all your Internet needs in one application.

emacs on xul

In all seriousness though I have a hard time imagining why anyone would want this ... both from a developer standpoint and a user standpoint. The recent change history is a bunch of "most of ABC other Mozilla product's code has been pulled in for X.Y.Z version, go read those notes to see what is new" and describes cherry-picking bugfixes from arbitrary versions of Firefox (60, 72, ...?)

Sounds like an absolute maintenance nightmare (or perhaps a labor of masochistic love, depending on how you look at it) of constantly cherry picking other upstream stuff into one single app for what looks like a relatively small gain. If you had no choice (ie, what linux distribution maintainers spend a lot of time on) sure, go for it, but I can use Firefox, Thunderbird, etc... as standalone apps and still have them connected using my local OS and regular old open web technologies.

</comment><comment><USER3> > The current Mozilla Gecko codebase has seen a flow of constant major changes > and api removals in the last 2 years and is no longer really usable for our > needs. By the end of the year the SeaMonkey project is expected to be > completely independent of Mozilla

Wow, that's... something. Keeping a browser engine of that size maintained independently is going to be quite a task.

<comment><USER4> It's simply not possible without a large well funded team.

<comment><USER5> I really don't understand this. All my current browsers don't need more features. They didnt 5 years ago either.

<comment><USER3> There are security updates, for one.

Plus there are a bunch of CSS improvements and the like in the last five years. If you don't keep up with the competition your users are going to see broken sites eventually.

</comment></comment></comment></comment><comment><USER6> Always glad to see interest in SeaMonkey spread! I am writing this from an instance installed on Slackware. I use it as my daily driver at work, switching to Firefox occasionally when I need to sync with things I do on other machines.

I don't really use it often but I love that it still comes with Composer for WYSIWYG html. It's been a while but when I used it a lot about 5-7 years ago it wrote really clean, standard compliant html which made it great for quickly prototyping look and feel before diving into writing any code for new pages/sites.

Having used the stock Slackware version, which is usually just a bit behind, I'm excited to see what " _our biggest release in a few years and incorporates many changes and fixes from the underlying platform code_ " looks like!

<comment><USER7> > I don't really use it often but I love that it still comes with Composer for > WYSIWYG html.

I tried it for the first time a few weeks ago (I never do web/HTML stuff). Seamonkey Composer crashed when I tried inserting a <video> element.

> Having used the stock Slackware version, which is usually just a bit behind, > I'm excited to see what "our biggest release in a few years and incorporates > many changes and fixes from the underlying platform code" looks like!

According to the release notes ([http://www.seamonkey- project.org/releases/seamonkey2.53.1/](http://www.seamonkey- project.org/releases/seamonkey2.53.1/)) it is mainly features removal and breakage :-/ The least one can cay is that they are not chatty about the positive changes and features those underlying changes may have brought.

<comment><USER6> Yeah, I went and read some stuff on Wikipedia about it after posting. Apparently Composer is considered unsupported now and only gets occasional updates because it's used as the underlying html editor in Mail.

And yes, I was mildly disappointed when I downloaded and ran this as I saw no real visual difference or changes to the UI and preferences.

So I guess Composer is not much of an option for "real" work these days. Still cool to see an alternative browser out there that's at least mostly capable of handling the "modern" web...

</comment></comment></comment><comment><USER8> Just installed. _Looks_ like it's still in the xul/xpi era. Was hoping that this could be reasonably secure alternative to Waterfox and that I'd be able to install xul/xpi extensions. Seems not.

EDIT: I was able to convert xul/xpi addons with: [https://addonconverter.fotokraina.com/](https://addonconverter.fotokraina.com/) which is quite awesome. Info here: [http://forums.mozillazine.org/viewtopic.php?f=40&t=2834855](http://forums.mozillazine.org/viewtopic.php?f=40&t=2834855)

<comment><USER9> _> Was hoping that this could be reasonably secure... and that I'd be able to install xul/xpi extensions._

These two objectives pull in opposite directions. The more you get of one, the less you're going to get of the other.

<comment><USER8> Care to elaborate? I still mourn the death of XUL. The extensions that really meant something are now gone or available in versions that are much worse than their predecessors.

<comment><USER10> Here's a random writeup I found after some googling. I'm pretty sure that I've recently read a better description of how and why they removed XUL, but I can't find any specific overviews that seem better than this one:

[https://github.com/mozilla/firefox-browser- architecture/blob...](https://github.com/mozilla/firefox-browser- architecture/blob/0b353dfe69765d8357079f6f4f9425e4c03e4b7f/text/0003-problems- with-xul.md)

The short version is that XUL is a mozilla-specific implementation of functionality that can be accomplished with standard html5/CSS/etc., and thus using specifically XUL to handle the UI is inefficient from a developer standpoint, which can also introduce bugs, etc. as developers are forced to work on/use a technology with which they're not familiar.

XUL is being replaced with (was replaced with?) the standard HTML5 engine, which is continually being improved, updated, secured, optimized, etc. IIRC, there's no reason that an extension couldn't do what it did in XUL, so the likelihood is that the lack of those extensions isn't directly related to Mozilla removing XUL, but rather extension developers re-implementing their extensions in HTML5 for Chrome, which is a vastly more common platform for browser extensions in my experience, instead of re-implementing their extensions in HTML5 for Firefox.

<comment><USER11> > IIRC, there's no reason that an extension couldn't do what it did in XUL

XUL extensions were given full access to the XUL DOM for the entire browser, whereas WebExtensions are limited in their sandbox to known extension points rather than having full HTML DOM access to the entire browser.

Also, while WebExtensions still have access to messaging channels to websites/native code/outside applications, it is indirect (and permissions/sandbox mediated). XUL extensions' XPCOM (like Microsoft's COM) gave a much direct path both in to the HTML DOM of individual websites and outward for native platform code to be written in languages like C/C++.

(All of the above of which include additional reasons why XUL/XPCOM may be security liabilities if your goal is a secure browser: free reign of the browser DOM, website DOM, and easier access to native code.)

</comment></comment></comment></comment></comment><comment><USER12> Wait, so SeaMonkey has a mail client that's based on Thunderbird but not Thunderbird?

<comment><USER13> It's complicated. Initially there was Mozilla Suite. Mozilla Suite consisted of a browser, a mail and an IRC client. Then Firefox came out as a simpler browser, without all that unnecessary stuff. And the mail component from Mozilla Suite became Thunderbird. But the Mozilla community liked the old Mozilla Suite, so they kept developing it after Mozilla gave up on it, under the name SeaMonkey. So today SeaMonkey Mail and Thunderbird still share lots of code, but technically speaking they aren't the same thing.

<comment><USER9> Nitpick: initially there was Netscape Communicator/Netscape 4 ([https://en.wikipedia.org/wiki/Netscape_Communicator](https://en.wikipedia.org/wiki/Netscape_Communicator)), which got open-sourced as Mozilla Suite when Netscape went out of business.

(Confusingly, there were many more versions of Netscape after 4, but Mozilla Suite didn't really derive from them. Netscape 6 and 7 were just contemporary versions of Mozilla Suite with some Netscape badging slapped on. Netscape 8 was based on early versions of Firefox, dropped the other non-browser "suite" components, and was only released for Windows. Netscape 9 was also a browser- only thing, but went back to being cross-platform.)

<comment><USER14> > but Mozilla Suite didn't really derive from them

I think it would be just slightly more accurate to say, that it didn't derive from them at all, as the original Netscape codebase was scrapped.

[https://en.wikipedia.org/wiki/History_of_Mozilla_Application...](https://en.wikipedia.org/wiki/History_of_Mozilla_Application_Suite#Rewriting_from_scratch)

</comment></comment></comment></comment><comment><USER15> I've never been a SeaMonkey user but I've always been impressed that it's still being developed and used, it's really cool in a time when we're moving to a new age of browser engine monoculture.

</comment><comment><USER16> [https://news.ycombinator.com/item?id=22085934](https://news.ycombinator.com/item?id=22085934)

<comment><AUTHOR> The previous discussion was for the beta release, this one is the final release.

<comment><USER16> Yup, got it. But from a internet forum perspective, it's going to be the same discussion. Submissions about incremental releases almost always turn out to be generic discussions about the project in general. Certainly the distinction between a beta and a final release doesn't show up as significant in threads, though of course it's quite significant from the project's point of view.

</comment></comment></comment><comment><USER17> I wonder how difficult it would be to compile this for Classic MacOS, given the abandonment of Classilla.

</comment><comment><USER18> Windows Defender doesn't like it:

Trojan:Win32/Detplock

Alert level: Severe

Status: Active

Category: Trojan

Details: This program is dangerous and executes commands from an attacker.

<comment><USER19> The 64-bit installer passes.

</comment></comment><comment><USER20> Oh, man. This is so good.

</comment><comment><USER21> Navigator rools!

</comment><comment><USER22> My windows defender indicates this has malware in the download.

<comment><USER23> So your malware guard by a giant known corrupt company indicates that you shouldn't install the competition. That's ... interesting.

<comment><USER24> No need for the tinfoil hats, it's probably an unintentional false positive.</comment></comment></comment>


Ask HN: What recent technologies have matured? - max-a

Fellow HNers.
I am thinking about creating a web app and would like to add some novelty to the process of development as the product I am thinking about (basically a specialized CMS) is nothing fancy.
I have used Ruby and written some node/express but I didn't like it, mainly due to poor documentation.
Also I would like to try some fancy front-end framework and am thinking about react with backbone.
What is hot? What is going to be hot? What went under the radar? Basically I would like you to recommend me a stack. <comment><AUTHOR> Openresty is underrated. I just don't understand why more people don't use it. It allows you to script nginx. How cool is that? Plus it comes with goodness of lua like the ability to return multiple values from a function which means that you can do something like

local res1,res2,res3 = ngx.location.capture_multi{ {"/api/1"},{"api/2"},{"ap1/3"} }

The above function runs in a non blocking synchronous manner. No http is involved it is all done internally and it's really fast. It can be very helpful if you are making multiple api calls from your code. I personally use it along with couchdb and I have never been happier writing code :)

There are already a lot of modules for openresty. Not as many as node js but plenty (and of a very high quality). It also has a framework built on top of it called lapis ([http://leafo.net/lapis/](http://leafo.net/lapis/)) so if you are used to mvc type of frameworks in other languages you should feel right at home with it.

</comment><comment><USER2> Learn meteor. It's hot. But I don't use it.

</comment><comment><USER3> Have a looks at [http://www.thoughtworks.com/radar](http://www.thoughtworks.com/radar)

<comment><USER4> That's a great site. Could use more background on a few items but it's a clear and opinionated (in a good way) 30,000-foot-view treatment of development tools and tech.

Thanks for posting it!</comment></comment>


Why the Russian Suicide Game Went Global - <AUTHOR> https://www.bloomberg.com/view/articles/2017-04-25/why-the-russian-suicide-game-went-global <comment><AUTHOR> The rates reported on the chart in the middle of the article are off by 10x. The rates are actually per 100K people.

This seems to be one of the worrying global trends. The rates in the U.S. are also on the rise [0].

0: [https://www.cdc.gov/nchs/data/databriefs/db241_table.pdf#2](https://www.cdc.gov/nchs/data/databriefs/db241_table.pdf#2)</comment>


The Society of Mind - <AUTHOR> http://aurellem.org/society-of-mind/ <comment><USER2> This is the first time I have heard that science states that free will is an illusion: "According to the modern scientific view, there is simply no room at all for freedom of the human will." [http://aurellem.org/society-of- mind/som-30.6.html](http://aurellem.org/society-of-mind/som-30.6.html)

<comment><USER3> Can you find any good arguments for the free will if you accept following two conditions:

1\. Randomness or probabilistic behavior is not free will.

2\. Argument does not assume entities outside our scientific world view.

Arguments that don't include soul, spirit or something like that try to equate free will with indeterminism. That's just wrong. Is there indeterminism is different question.</comment></comment>


Ask HN: Would you use an app that told you everywhere you had ever logged in to? - <AUTHOR>

I have an idea where users typed in their username and password (or multiple username and password combinations) and the app returned a yes/no for the top 100 (1000?) websites out there.
I "register/sign up" for 100's of services/products a year and at this point do not know who or where they are. I think it would be amazing to have a dashboard of every place I've ever logged into. Similar to the "app settings" page on Facebook/Twitter
http://www.facebook.com/settings/?tab=applications
Short of a password manager (1password etc), I don't believe this service exists, and certainly not one that automates logging in to 1000's of websites on your behalf. <comment><USER2> To be honest, I like the idea of it to some degree (very minor), but knowing me I probably wouldn't actually use it. I don't even go in to check which services I've granted access to via Twitter, Facebook, or my Google account.

That said, I already use a password manager so I don't believe I'm the target audience for the purpose behind this app. Truthfully at most, I'd maybe look at it once and never bother again. But even then I probably wouldn't if it required me to punch in my password to check. This is especially true for people who use unique passwords.

<comment><AUTHOR> Thanks for the response. The more discussion, the more the idea seems "fun" but in the end "trivial". The ultimate solution to this problem (if you can call it one) is to just start using a password manager.

I appreciate the honesty of HN before trying to build out something that no one would use. I'll keep the ideas coming.

</comment></comment><comment><USER3> Only if it provided an "Unrollme" feature to kill the accounts with a few clicks.

<comment><AUTHOR> Good idea. I was also thinking a "change password" option would be helpful if you needed to bulk change passwords across all your services.

</comment></comment><comment><USER4> This only works if you use a small subset of usernames and passwords. A person who actually wanted to do this in a secure way would use a password manager and just record every username and password there.

<comment><AUTHOR> I agree - it actually just points the user to the fact they need a password manager.

I don't use a password manager, because for the most part, I feel as if it is already too late. I have registered for probably 100's of websites, most of which I used once (or a long time ago) and since have not accessed.

I think the value might be for users to tie up "loose ends" ie webservices that have your info, you don't know you are registered there, and maybe...don't want to be registered there anymore.

</comment></comment><comment><USER5> I wouldn't use it.</comment>


Modeling Adversaries with TLA+ - <AUTHOR> https://www.hillelwayne.com/post/adversaries/ <comment><USER2> Used TLA+ for security/availability modeling at a previous venture. Didn't find it added more value than other formal methods with less scope and ambition when it came to implementation, but I had very limited resources and we were greenfield so the experience probably wasn't generally applicable.

IMHO (from an implementation perspective): (1) If state is a pain to model, this may be a symptom you aren't placing interfaces in the right places (ie. scope is too broad). (2) If your system behavior departs from known models (ie. expected behavior under rigorously analyzed and easy to model consensus algorithms) then this may be a symptom of larger issues such as unrecognized state or edge cases, which are better tackled first. (3) A practical alternative to the theoretical model of 'safe' machines within the post would be an implementation model with a functional approach ... ie. if in doubt, reset to known state. (4) To model "bad" actors practically, you have to define them. To do so within meaningfully any complex (black box) multi-agent (networked) system, you need a good model of known "good" behavior for any given node. Building this is IMHO more useful than pie-in-sky theoretical modeling, because it allows the efficient (~fully automatic) deployment of practical countermeasures (anomaly detection on resource utilization, communication, etc.). To do this for near-arbitrary systems requires a tight CI/CD pipeline with above-average full stack security insight, for-purpose infrastructure and management level commitment to the additional resources it will cost. _Only_ when all that is done, model for concurrently compromised nodes at this level, because you've surpassed more immediate/pragmatic requirements.

<comment><USER3> > Didn't find it added more value than other formal methods with less scope > and ambition

For my own future reference, can you list a few other formal methods?

<comment><USER2> Well, for some definition of formal, both state machines and rigorously defined {interfaces|message sequences|protocols} (ie. those with specification-based, generative implementations of endpoints, validating middleware proxies, etc.).

 _There are two models of reality that I find to be the most useful ones, especially when writing programs. The first is functions, and the second is sequences of states._ \- Leslie Lamport

... via [http://github.com/globalcitizen/taoup](http://github.com/globalcitizen/taoup)

<comment><USER4> I find (variants of) QuickCheck [https://hypothesis.works/articles/quickcheck- in-every-langua...](https://hypothesis.works/articles/quickcheck-in-every- language/) are pretty good at finding at least a lot of the invariant problems that TLA+ finds, and if you're lucky your language has it integrated already. The F# implementation FsCheck is pretty amazing.

</comment></comment></comment></comment><comment><USER5> The author mentions the World and the Machine by Michael Jackson, I am guessing that is a reference to this paper?

[http://mcs.open.ac.uk/mj665/icse17kn.pdf](http://mcs.open.ac.uk/mj665/icse17kn.pdf)

<comment><USER6> I got the terms from _Software Requirements and Specifications_, which is a fun, if fluffy and meandering, read. I only skimmed the paper you linked but it seems to be a more thorough treatment than the book was.

[https://www.amazon.com/Software-Requirements- Specifications-...](https://www.amazon.com/Software-Requirements- Specifications-Principles-Prejudices/dp/0201877120)

</comment></comment><comment><USER7> > In the TLA+ formulation, and we can think of an adversary as an agent in the > system who can take a superset of the actions everybody else can.

Sounds a lot like a Dolev-Yao adversary, which is used in protocol verification tools like Tamarin.

</comment><comment><USER8> An review of the post is at [https://lemmster.de/tla-liveness- review.html](https://lemmster.de/tla-liveness-review.html)

</comment><comment><USER9> Anyone have a similar how-to for applying this to decision-making (eg. game theory) in TLA+, Python or similar?

<comment><USER6> I don't know any game theory so can't say much about the landscape, but I know people've modified PRISM to model games: [http://www.prismmodelchecker.org/games/](http://www.prismmodelchecker.org/games/)

Fair warning though: PRISM is... weird. You can analyze some crazy complex properties in it but you don't get basic affordances like "strings", "lists", or "functions that take parameters".

</comment></comment><comment><USER10> this is the kind of dark magic that is fascinating to read about and I hope there are people actually using it in the described way to design and implement safe systems and protocols. I haven't heard of any (not that I looked much).

<comment><USER11> Use of Formal Methods at Amazon Web Services [https://lamport.azurewebsites.net/tla/formal-methods- amazon....](https://lamport.azurewebsites.net/tla/formal-methods-amazon.pdf)</comment></comment>


Qiling Framework - Advanced Binary Emulation Framework - <AUTHOR> https://www.qiling.io <comment><USER2> Sounds like a nice project, but the descriptions are a bit strange. First, it talks a bit about securing IoT, but then it goes on to say it supports emulating Windows, macOS, Linux, and FreeBSD? Second, on the comparisons page it lists a number of projects but seems to miss some of the most obvious competitors and instead compares itself to things that are related to binary emulation but not really relevant? For example, angr (disclaimer: I have worked with multiple people that contribute to and use the project heavily) does binary emulation as well (using Unicorn, no less; Nguyen Anh Quynh knows this because he gets contributions to the project, especially for the Python bindings, to keep angr working), has a number of loader backends, and has a bunch of fancy hooking and tracing features very similar to the ones mentioned here (among other things), all available through a Python API just like Qiling.

</comment><comment><USER3> I would like to see a tool that combines "version control" and executable tracing, where you can take a snapshot of stack/heap and registers and allows you to move through each snapshot and see what changed, essentially allowing you to replay the execution instruction by instruction (with "proper" I/O result code/data simulation).

I know George Hotz was working on something like this before he got into the Comma AI thing and it really caught my eye, but I don't think there is anything out there that is "production ready" like say, IDA Pro or Ghidra or whatever.

Anyone know if such a tool exists? I imagine it would make mapping out vtables and such trivial.

<comment><USER2> Perhaps you're thinking of QIRA ([https://qira.me](https://qira.me))?

<comment><USER3> Yes - is there one for Windows by any chance?

Edit: This is the tool by George Hotz that I was referring to. I doubt it's really production ready given he likes to start and stop projects.

<comment><USER4> > I doubt it's really production ready given he likes to start and stop > projects

A likely good strategy for success in startups is productizing projects started by George Hotz. :-P

</comment></comment></comment></comment><comment><USER5> How does this compare to angr?

<comment><USER6> Angr is a static analysis and symbolic execution framework. It contains many components. It's built around Valgrind's VEX IR and provides an API that allows for lifting binaries from various architectures to a common IL. Angr also provides libraries to aid in CFG recovery, concolic testing, and other program analysis techniques. Angr does not do software emulation and is used mostly for static analysis.

Qiling is almost entirely dynamic. Qiling provides an API that allows you to instrument and emulate binaries. It's an extra layer on top of Unicorn (a library that can emulate CPU instructions using QEMU). Qiling contains ELF/PE/etc loaders and kernel syscall emulation. Think of it as qemu-user but with a Python API allowing you to install hooks, set breakpoints, read/write to memory, etc...

<comment><USER5> I've had no trouble using angr on real binaries, including self-modifying binaries.

> [Qiling] is an extra layer on top of Unicorn (a library that can emulate CPU > instructions using QEMU).

This is what is mostly confusing me -- angr has support for unicorn, so how is it different from angr's support of Unicorn?

<comment><USER7> Unicorn is a scriptable CPU emulator. What happens though when a program uses a system call? Qiling tries to fully emulate what the host (windows, linux, etc) should do. Emulating the systems an OS provides is not trivial. An OS provides networking, filesystem, loading a binary(ELF, PE, MachO) into memory, etc.

Using QEMU with full system emulation can do some of this, but you don't get the scriptable control and deep analysis capabilities of Unicorn.

angr, from what I gather, can be useful for targeting specific sections of code. If you've reversed a binary enough to know where to target, this is useful. For example, code such as as parsers which are typically complex and vulnerable or finding a specific input to reach a desired location (i.e. ctf challenges).

The problem qiling solves is that applications don't run in a vacuum, they are highly dependent on the OS they run on. Emulating each OS allows for dynamic analysis not possible with other frameworks. Some tools like Corellium provide great system emulation, but qiling has much better potential for analysis purposes.

The slides in the 'News' section of the page do good job of explaining in detail. [https://www.qiling.io/docs/Qiling- NullCon2020.pdf](https://www.qiling.io/docs/Qiling-NullCon2020.pdf)</comment></comment></comment></comment>


Cruise v. Guillory - <AUTHOR> https://www.scribd.com/doc/308408168/Cruise-v-Guillory-Complaint <comment><USER2> Reuters article on the topic: [http://www.reuters.com/article/us-gm- cruiseautomation-lawsui...](http://www.reuters.com/article/us-gm- cruiseautomation-lawsuit-idUSKCN0XC063) .</comment>


Reactive Joins in Meteor - <AUTHOR> https://www.discovermeteor.com/2014/01/31/reactive-joins-in-meteor/

<comment><USER2> This is a great article and seems to be really similar to a problem I had/have at work (not using meteor though, and we use a relational DB). We have a system where clients can set up arbitrary queries about data for a project management type system with live updates. For example, you could quickly create a to do list by setting up a query to find all the Tasks not in the "Completed" state where you are the owner. Then you can specify any fields you want to see about that item, like priority or description. When an update happens, the server checks to see if the changed item is fulfilled by the query filter and publishes either an addition/update with those fields included or a removal to the client who registered it.

I can imagine this scenario would scale much better using meteor to receive just the basic models (unjoined) but then doing the filter/joins on the client side (I don't use meteor, but from what I understand you can basically query the data you've received on the server from the client). That way, the server wouldn't bear the burden of running almost identical queries for multiple clients who only differ in their user ID's.

</comment><comment><USER3> Great article, have also been breeding on the Mongo/Joins issue for quite some time and solved it for myself using Meteor Live Queries and selective data dublication: [http://iamnotachoice.com/using-mongodb-requires-thinking- mon...](http://iamnotachoice.com/using-mongodb-requires-thinking-mongodb-live- queries-also-help/)

</comment><comment><USER4> Why not use backwards document references? Put the post id on each comment and query like Comments.find({post: post._id}, {limit: 30}) to get 30 comments. Why would you store all of the comments for a Post on the post itself?

<comment><USER5> That's exactly what we're doing (apart from the denormalization approach, which we don't really recommend). The problem is doing this in a way that A) is reactive (i.e. updates in real time) and B) efficient.

</comment></comment><comment><USER6> Great post, we were just talking about this stuff in the office today!

<comment><USER7> Liar ;).

<comment><USER6> Nah, we were really just talking about this today. We use minimongoid and we are using the has_many/belongs_to and I was curious how other people handled joins outside of the page.

;)</comment></comment></comment>


Code repositories and version control are gone - <AUTHOR> http://jobs.perl.org/job/11650

<comment><AUTHOR> Where does this rate on the Joel Spolsky work environment scale?</comment>


Ask HN: How can toxic behavior in open source communities be discouraged? - <AUTHOR> This post is inspired by the Capistrano author's post, in which he expressed a high level of dissatisfaction and burnout. What, as a community, can be done to re-engineer the human side of open source projects to strongly discourage such negative behavior and foster a more constructive, supportive environment?<p>It seems to be a recurring theme: developer creates something cool, gives it away, and then gets bled dry by the freebie parasites. <comment><USER2> Something I thought about the other day after seeing it on a GitHub project (can't remember the link, sadly) was to put your avatar/picture in the README. Most projects have an author or contact section, but my thought was that putting your picture there helps to remind people that you are a real person. Before you file a "this project sucks" bug or make a negative comment on twitter, hopefully you will remember that human element and skip the toxic behavior.

</comment><comment><USER3> IMO it boils down to how to give uses a 'reputation score' in a fair way that lets in new users, but detects 'rude people' so that their negativity can be filtered out. It's the most challenging problem in social media today, I think, because there are so many jerks out there making life miserable for the 'good people'. A workable approach may be using Facebook logins, so that people can't as easily hide behind anonymity, but then again I hate forcing users to be on Facebook just to use some other thing. Perhaps there is a business model here (business to be made), in a company that can validate that this is a 'real' person, eliminate anonymity, and perhaps be able to 'shame people into being nice online'. So that aspect of it of course comes down to how to verify true identity online.

<comment><USER2> Would be interesting to see some kind of reputation system on GitHub. I could give +1 to users that file good bug reports or submit pull requests. Community could vote down negative reports/comments. Since GitHub is becoming a defacto resume for some developers, this could encourage people to not be assholes if there is the possibility of a demerit showing up on their profile page.

</comment></comment><comment><USER4> > developer creates something cool, gives it away, and then gets bled dry by > the freebie parasites.

What are freebie parasites? Isn't the point of OS is it's free as compared to commercial where people are expect to pay?

Are people even sure this is a serious issue? The original post even says he doesn't think that's the reason he's burning out.

[edit] OK talk about how libreoffice is trying to deal with issues in general. [https://archive.fosdem.org/2013/schedule/event/challenges_li...](https://archive.fosdem.org/2013/schedule/event/challenges_libreoffice/)

<comment><USER5> I don't understand the OP's original phrase "bled dry by the freebie parasites". So I don't know how people who use code on github would be "parasites", nor how they would bleed anything dry.

Primarily open source software (or free software movement, whatever you'd like to call it) is free as in freedom, not _necessarily_ free as in beer.

</comment></comment><comment><USER6> It isn't nearly as bad as you think. I have no numbers to back it up, but most burnouts (my own included) happens because you work to hard and take on much more work and responsibility than you can handle. It is really easy to let free software consume way to much of your life. IME those kind of burnouts outnumber those caused by toxic behavior 1000:1.</comment>


Nomi Prins: The Left/Progressive Case Against the Fed - <AUTHOR> https://mises.org/library/nomi-prins-leftprogressive-case-against-fed <comment><AUTHOR> I figured I'd post this because it is nice to see individuals from all sides of the political spectrum 'gather' together and speak about political issues of substance. . .at the end of they day, though, we may all agree upon problems, but it is how we approach them for which we differ.</comment>


Apple's Amazing New Music App Hits All the Right Notes - <AUTHOR> https://www.yahoo.com/tech/apple-s-amazing-new-music-1347023806267446.html <comment><USER2> That's quite amazing. I wonder how well it does with vocals. My partner and I sing a lot of silly little songs and it would be great to have some auto- magical accompaniment.

Also, it would be even better to read a white paper on this. Anyone know of some of the ingredients that went into it?</comment>


Ask HN: Using affiliate for charity - <AUTHOR> I was reading my emails and wondering if it would be a good idea to create a service so that influencers and bloggers could use their affiliate links from time to time to donate to charities. The service would allow them to create such links in seconds and choose for which charity to donate the profits made by the link.
It could also be seen as a service to help charities promote giving through affiliate links.
Another idea: Making a Chrome plugin that would be a bit like Adblock, but instead of hiding the ad, would change the ID to give the revenue to the chosen charity.
What do you think about that? Do you have any other ideas? Would you be willing to participate if a project emerge of that? <comment><USER2> Pretty sure changing the affiliate id would be against most terms of service.

<comment><AUTHOR> Yes true ;)</comment></comment>