"TikTok is a data collection service that is thinly-veiled as a social network." - <AUTHOR> https://old.reddit.com/r/videos/comments/fxgi06/not_new_news_but_tbh_if_you_have_tiktiok_just_get/fmuko1m/ <comment><USER2> I wouldn't be surprised by any of this, but the reddit post reads too... reddit-y, I guess? I mean, I could easily write a post like that without actually doing anything. Where's the proof? I want to _see_ these analytics payloads. I want to _see_ how they disassembled the app. So far, though, there's not a lot of proof, just some statements about analytics data and "I'm a nerd who figures out how apps work for a job".

<comment><USER3> Oddly, lots of this stuff just seems wrong. On Android, so maybe that's the discrepancy, but he's going on about GPS pinging while the app doesn't even request the Location permission.

<comment><USER4> From their Privacy Policy...

>We automatically collect certain information from you when you use the Platform, including internet or other network activity information such as your IP address, geolocation-related data (as described below), unique device identifiers, browsing and search history (including content you have viewed in the Platform), and Cookies (as defined below).

>We collect information about your location, including location information based on your SIM card and/or IP address. With your permission, we may also collect Global Positioning System (GPS) data.

>You can switch off GPS location information functionality on your mobile device if you do not wish to share GPS information.

The above makes it sound like you have to turn off GPS for everything. They could likely be skirting different methods for collecting this. and the only way to prevent it is turning off gps at the device level not app permission level

>We use the 'Region' you select in Settings to customise your TikTok experience. When you use the Platform on a mobile device, we will collect information about your location. In certain jurisdictions, with your permission, we will collect Global Positioning System (GPS) data and mobile device location information. If you do not wish to share your precise location with us, you can switch off location services via the settings on your mobile device

>5\. Where we store your personal data. The personal data we collect from you may be stored on a server located in Singapore or the United States, outside of the country where you live. We maintain major servers around the world to bring you our services globally and continuously.

</comment></comment></comment><comment><USER5> Isn't all social media is ultimately data collection service ?

<comment><USER6> The author explicitly says: "For what it's worth I've reversed the Instagram, Facebook, Reddit, and Twitter apps. They don't collect anywhere near the same amount of data that TikTok does, and they sure as hell aren't outright trying to hide exactly whats being sent like TikTok is."

<comment><USER7> But is it so really?

Last year there were articles about how Facebook sdk collects data from each app that integrates it, even before you login with Facebook. To me it still looks like a much wider data collection than what a single app can do.

<comment><USER8> imo, this is even more eye-rolling situation - [https://github.com/facebook/facebook-ios- sdk/issues/1374](https://github.com/facebook/facebook-ios-sdk/issues/1374)

</comment></comment></comment></comment><comment><USER9> I'm confused by this. Aren't apps sandboxed fairly hard? How would TikTok get any data outside of what's allowed by Apple/Android's app APIs? If they're getting more information than that, isn't that up to the OS to limit?

<comment><USER10> I think one of the more recent allegations (past few days) is that it may be copying the clipboard of iPhones. I've only seen evidence that it was making an API call that can be used maliciously. It's definitely suspect given the value of the intel.

</comment></comment><comment><USER11> I have only heard bad things about TikTok so far, and wouldn't let my kids use it. A couple of weeks ago, there was a story about presence of sexual predators preying on children and TikTok's utter lack of moderation.

</comment><comment><USER12> Isn't Google and Microsoft doing the same? As far as I remember, Google Maps is almost secretly collecting user location data and sending it home.

A good solution would be to fix Android and don't let any app access phone number information, any hardware identifiers, location. But instead we see posts like this suggesting to ban TokTok instead. Why?

</comment><comment><USER13> Remote code execution is huge. Why does google allow this on their app store?

<comment><USER3> I guess because it's run with the permissions of the parent app so it doesn't really matter. You can download and exec all the code you want but it won't really help you do anything if you have the permissions and resource limits of the parent anyway.

<comment> yjftsjthsd-h Google is, in fact, breaking such functions, which is a pain for those of us who users _do_ have a legitimate use for it: [https://github.com/termux/termux-packages/wiki/Termux-and- An...](https://github.com/termux/termux-packages/wiki/Termux-and-Android-10)

</comment></comment></comment><comment><USER14> As opposed to Facebook?

<comment><USER15> From the linked post he makes a direct comparison to facebook, and its pretty daming for TikTok:

"For what it's worth I've reversed the Instagram, Facebook, Reddit, and Twitter apps. They don't collect anywhere near the same amount of data that TikTok does, and they sure as hell aren't outright trying to hide exactly whats being sent like TikTok is. It's like comparing a cup of water to the ocean - they just don't compare."

<comment><USER14> the apps themselves don't go to such abusive extent, but that's because they get all the information from the innumerable sites across the web that embed Facebook tracking code.</comment></comment></comment>


Twitter Signup Form using HTML5 & CSS3 : Form Validation in HTML5 - <AUTHOR> http://www.nikesh.me/blog/2010/05/twitter-sign-up-page-using-html5-and-css3-no-js/

<comment><USER2> That markup is really ugly (tons of div's along with unnecessary clearfix div's and weird classes).

I noticed there was a comment on there that's now removed that linked to: <http://bradshawenterprises.com/tests/formdemo.php> which is a much better and cleaner example.

Article: [http://www.bradshawenterprises.com/blog/2010/fancy-forms- htm...](http://www.bradshawenterprises.com/blog/2010/fancy-forms- html5-css3-js/)

<comment><USER3> A better and detail article you can find here ... [http://dev.opera.com/articles/view/opera-9-5-the-next- genera...](http://dev.opera.com/articles/view/opera-9-5-the-next-generation- of-web-s/)

</comment></comment><comment><USER4> I appreciate the effort on spreading the word about HTML5 and CSS3, but there are things in these articles that bother me a lot.

Overuse of CSS3 animations brings back the 'skip intro' flash experience of the 90s, and I'm terrified that since it's a new toy, there'll be a tendency to overuse it.

In this specific example, the speed of the animations (too slow) hinders usability and becomes distractive.

<comment><USER5> It's like anything else, you just need to use it in moderation.

</comment></comment><comment><USER6> That's neat but it doesn't work in non-HTML5 browsers. Should't the goal of something like a registration page be to target as many people as possible?

<comment><USER3> I just want to show the power and features of HTML5.Because HTML5 is the future of web. isn't it ?

</comment></comment><comment><USER7> Eh - I expect better from Hacker News. The HTML coding of Twitter could be better. On top of that, making a whole post on something as tame as form validation is sad. Sure it may seem neat because HTML4 and HTML5 both suck, but anything looks good compared to crap.

</comment><comment><USER8> How do things like this end up on the front page? The non HTML5 code in here isn't great, and when I tried in Safari the behavior was exactly the same as it was in FF, with the exception of the right corners being rounded and the select style fading in on click. There was 0 validation.

<comment><USER9> you need to be running webkit (or chrome?) nightlies / latest builds

<comment><USER8> ok fair enough, -1 for me not reading closely.

point remains</comment></comment></comment>


California teacher pension debt overwhelms school budgets - <AUTHOR> https://calmatters.org/articles/california-teacher-pension-debt/ <comment><USER2> Fortunately for the teachers, Californians have a very short memory.

All the teachers need to do is survive for the four-to-five years it takes Californians to forget what they have voted for. Then they can roll out a Proposition or local bond measure scolding voters for not funding education. Techies and other knowledge workers in particular respond very well to this kind of prodding which is why these measures pass reliably every four to five years but tend to fail if done too frequently. The unwise teachers in my town, Los Gatos, recently tried to shake down voters before the buildings promised by the previous bond measure were constructed.

The same is done with transit funding...I can't remember how many times a Measure or Proposition has passed that has promised to "finally" address transit funding...until four years pass and it is time to "finally" address it again.

<comment><USER3> Do you really think of teachers as a community of people who try to perpetrate scams on the general public? I'm trying to count on one hand all the teachers I know who are sitting fat the money they bilked from the voters, but I'm just not getting very far. Perhaps a more plausible explanation is that education funding measures reoccur repeatedly because public education is chronically underfunded as a standard budget item?

<comment><USER4> I'm sorry, but my mom made $125,000 pre tax as a teacher every year in NY and retired with a very similar pension payable to her and her husband until death.

I am their son. I am college educated, I make $50,000 per year on average and I've been laid off 3 times over my 6 years of post college employment. I have never been offered a 401k, which is a particularly ineffective retirement tool anyway.

How are teachers underfunded again? Maybe in certain underfunded neighborhoods, but not all. And their employment is pretty secure.

<comment><USER5> I don't have a problem with the salary. What I have a problem with:

1\. Pension spiking. Happens for teachers, though not as much as other public employees.

2\. The pension should be funded from investments, not some optimistic guess as to the return on those investments.

3\. It should be easier to fire a bad teacher. I realize this is hard, but we've all heard the stories. In my excellent school district, you apparently have to be caught sexting teenagers to get fired, even though a lot of people had reported the offensive behavior, many times over many years. While most of my son's teachers are excellent, a few of them shouldn't be anywhere near students of any sort.

<comment><USER6> "...It should be easier to fire a bad teacher.."

This is a problem with most public employees though. It's not necessarily unique to teachers. Try to fire a bad cop for instance. Just won't happen. Or a bad database analyst at your State's Department of Administration or whatever. You just can't do it.

<comment><USER7> A DMV employee slept several hours a day every day for years and wasn't fired.

[https://www.usatoday.com/story/news/nation- now/2018/07/24/ca...](https://www.usatoday.com/story/news/nation- now/2018/07/24/california-dmv-worker-slept-thousands-hours-job-report- says/830618002/)

</comment></comment></comment></comment></comment></comment><comment><USER8> > All Government employees should realize that the process of collective > bargaining, as usually understood, cannot be transplanted into the public > service. It has its distinct and insurmountable limitations when applied to > public personnel management. The very nature and purposes of Government make > it impossible for administrative officials to represent fully or to bind the > employer in mutual discussions with Government employee organizations.

\-- Franklin D. Roosevelt, 1937 [http://www.presidency.ucsb.edu/ws/?pid=15445](http://www.presidency.ucsb.edu/ws/?pid=15445)

<comment><USER9> Unfortunately, we haven't figured out how to make teaching career-worthy without collective bargaining. Perhaps the best case study for non-union teaching is the workforce of adjunct teachers at universities. Talk to some adjuncts about their "careers." Disclosure: I was an adjunct for one semester at a big ten university, many years ago.

<comment><USER10> >adjunct teachers at universities

There is a glut of adjunct candidates with a PhD and a postdoc who can't get TT but there are relatively few with teaching degrees. The oversupply of adjuncts happens because they are the unsuccessful seekers of a much better job -- tenured professor -- but there is no similar situation for teachers. The economic analogy therefore won't fit, because the supply of teachers will respond to price signals more than the supply of adjuncts.

<comment><USER9> Indeed, but the requirement for a teaching degree is actively defended by the union, and is on a tenuous footing. It's not required for private K-12 schools, where pay and benefits are in fact drastically lower. The government of my state (Wisconsin) has moved to relax teacher licensing requirements for public schools.

When I was an adjunct, I had no interest in getting onto the tenure track, or in teaching as a career. I was simply new in town and needed a job.

</comment></comment></comment></comment><comment><USER11> California progressives have a sort of "feast the beast" strategy. Provide massive benefits on loan. When those loans come due, raise taxes to pay for them. Repeat until the government fails due to overconsumption.

Why can neither side just follow a sane general strategy of setting taxes and choosing the best benefits to fit under the revenue generated?

<comment><USER5> _California progressives have a sort of "feast the beast" strategy_

Why is this just a progressive thing?

<comment><USER12> It's in contrast to the conservative strategy "starve the beast".

<comment><USER13> IIRC conservatives don't have a great track record of following through with this.

</comment></comment></comment></comment><comment><USER14> So long as public schools are treated as places that exist to provide guaranteed jobs to members of the teachers' unions, do not be surprised to see American students continuing to score lower on international tests than students in countries that spend a lot less per pupil than we do.

\- Thomas Sowell

<comment><USER15> What kind of "guaranteed job" are you talking about? As a teacher, I could be let go without cause for my first three years and, subsequently, after two poor performance reviews. Tenure merely requires the district to _attempt_ to coach the teacher before firing them. I've seen teachers forced out of the classroom simply because they don't mesh with the personality of management.

Whatever horror stories about rubber rooms come out of NYC are not indicative of the reality on the ground most places.

<comment><USER16> How long did it take to fire Mark Berndt? His behavior had been flagged for decades but the school couldn't take action. Why did the school district choose to pay him $40,000 to drop his appeal when he finally was fired? Because even a case where a teacher was found to be feeding semen to blindfolded students, the job protections were so strong that that the district knew it was the cheapest and easiest way out to just pay him off.

I left California 3 years ago, so maybe this has changed, but at that time there were countless stories about "teacher jails" where Los Angeles would send teachers who should have been fired, but the process is so expensive and fraught with appeals and obstructions that it was cheaper and easier to keep them on the payroll - permanently. They would isolate them so they couldn't have contact with students, but they'd go on paying them to go sit in empty offices - for years.

The argument that tenure only adds requirements for coaching sort of whitewashes over the practical challenges presented when a district needs to let a teacher go.

<comment><USER17> > How long did it take to fire Mark Berndt? His behavior had been flagged for > decades but the school couldn't take action. Why did the school district > choose to pay him $40,000 to drop his appeal when he finally was fired?

Because of management negligence (and worse) in dealing with, documenting, and preserving documentation of earlier incidents, including the district at one point systematically destroying records relating to sexual abuse at district schools.

The problem was not the rules requiring documented cause for firing, the problem was management repeatedly covering for him and other abusers, including by destroying evidence.

Management misconduct doesn't justify giving more arbitrary power to management. Though, of course, that's what management likes to argue for whenever its own misdeeds are at issue.

<comment><USER16> But once it came out, once he was actually caught feeding semen to students, it was STILL hard to fire him.

Sure, you can make a case that management failed to document his previous behavior so they had to start over from zero and document, counsel, coach, whatever the contract requires, but once he was actually busted for ejaculating in kids food - how is it reasonable that they couldn't fire him on the spot?

<comment><USER17> > But once it came out, once he was actually caught feeding semen to students

He wasn't actually _caught_ (or even formally accused of by the district in its dismissal charges) doing that. Everything that came out and was cited as the basis for his dismissal was the result of a photo lab reporting pictures, and in the charges for dismissal what is identified as being on the cookies is "an unidentified milky-white substance". Notably, none of the reports of sexual abuse that students identified were made around the same time to school officials, or even the reported sexual context of the events in the photographs used as the basis for dismissal charges, were even referenced in those (exceedingly nonspecific) charges.

The management failures continued into the suspension and firing process.

</comment></comment></comment></comment></comment></comment><comment><USER18> When I read articles such as this, where there are previous commitments that were not sufficiently backed by the committers, I cannot help but feel 1) Government services are ponzi schemes and 2) It seems only just to plunder the wealth of the those who made the commitments in order to hold them to their words.

</comment><comment><USER19> A potential solution: make school year round, eliminate the unnecessary summer learning loss, and have new teachers pay into social security and a 401k like other workers do. No more separate system, students will perform better, and frankly I think parents will appreciate having more frequent short student vacations through the year rather than one large summer and winter chunk like we do now that causes problems with childcare and nutrition for low-income families. The big reason teachers don't get social security is because they do not work year round so the payout would be a fraction of what teacher pensions pay out - with year round school we no longer need to compensate in this way to make teaching a viable career.

<comment><USER20> That's not remotely true. Even a full social security payout wouldn't come close to the public employee union pension plans - in California it probably wouldn't be 1/4 of it.

In CA, teacher can retire making ~100k/yr, and get 105% of that as a pension for life. Do you really think one of the most polioactive lobbying groups in the state would let that disappear?

[1] [https://www.forbes.com/sites/andrewbiggs/2015/08/28/californ...](https://www.forbes.com/sites/andrewbiggs/2015/08/28/california- teacher-retirement-benefits-are-hardly-modest-but-calstrs-doesnt-want-you-to- know-that/)

<comment><USER19> My idea would be that they would not rely entirely on Social Security, they would be funding a 401K alongside some sort of reasonable match from the state instead, much like the deal people in the private sector get.

<comment><USER17> > they would be funding a 401K alongside some sort of reasonable match from > the state instead, much like the deal people in the private sector get.

While it may be a surprise for people who have worked in high demand fields, lots of workers in the private sector have no 401k offered, and of those that do, lots don't have any employer matching offered.

</comment></comment></comment></comment><comment><USER21> _Teachers don't get social security, and unlike firefighters or police officers, most retirees earn modest pensions of about $55,000 a year._

This seems like the most important sentence in the entire article.

Why are California teachers paying into a separate pension system rather than Social Security like everyone else?

What would it take to decommission STRS for CA teachers?

<comment><USER20> > unlike firefighters or police officers, most retirees earn modest pensions > of about $55,000 a year.

That's a very misleading statistic - it represents an average service time of about 24 years, barely more than half of a career. Full-career retirees average 105% of their final year's pay in pension benefits, or about double what's quoted here.

[1] [https://www.forbes.com/sites/andrewbiggs/2015/08/28/californ...](https://www.forbes.com/sites/andrewbiggs/2015/08/28/california- teacher-retirement-benefits-are-hardly-modest-but-calstrs-doesnt-want-you-to- know-that/#acc59ec6d3d2)

<comment><USER22> > _That's a very misleading statistic_

Is it?

It sounds like you're not arguing that "most retirees" don't get that amount, but that they don't deserve the amount they get.

</comment></comment></comment><comment><USER10> Proposition 13 affects this situation in two ways: it reduces tax revenue and it drives up the price of land, both of which cost money for the school system.

</comment><comment><USER23> Governments seem to be increasingly enamored with paying for shortfalls by issuing debt instruments such as bonds, then when the bonds come due issuing ever-larger bond packages to cover the previous bonds plus the new debt. When does this cycle break down? Is it when nobody is able to buy bonds any more? Especially at the federal level I really struggle to understand the bond market, particularly with such low returns. Who are these willing participants in poor returns with bonds?

<comment><USER24> Buyers like government bonds because they are low risk of default. At the federal level, the risk is nearly zero. The yield of a bond is a reflection of the demand (inversely proportional), which itself is a reflection of risk (also inversely, so yield is proportional to risk).

The federal government funds itself through bond sales and taxes. They could choose to do all of one or all of the other.

But they could just keep rolling over debt into more bond sales, in perpetuity, since the dollar is just a concept, and not a voucher for anything physical. There is essentially no risk, beyond the dollar itself becoming worthless. So if you need to park a million dollars for a few weeks, treasuries offer a nearly zero risk option.

So government could run completely off bond debt. It might even be fairer than taxes... the poor usually don't have a million dollars they need to park. Government funding would come from the rich.

The reason for taxes is power. You can use taxes to control and direct the population.

Before the US federal government believed they had the right to make drugs illegal, they controlled them through taxes. You had to buy a tax-stamp to move marijuana, but the government would rarely sell any such stamps. The drug itself was not illegal, but not having the stamp on it was. [1] Later they just went ahead and declared it "controlled" and didn't bother with the stamp shenanigans.

Also taxing removes the leverage that bond buyers have (which would be the decision not to buy). China owns a lot of us treasuries, and routinely uses that as a bargaining chip.

Ultimately the fed uses a mix. Bond sales for monthly adjustments in spending, taxation to control the populace. And there are various economic theories on which is better, but I doubt anyone with such pure motives actually controls any policy.

[1] [http://www.druglibrary.org/Schaffer/hemp/taxact/mjtaxact.htm](http://www.druglibrary.org/Schaffer/hemp/taxact/mjtaxact.htm)

</comment></comment><comment><USER25> Better title: Systemic Budget Mismanagement Comes Home to Roost.

</comment><comment><USER26> mirror: [https://web.archive.org/web/20180809161052/https://calmatter...](https://web.archive.org/web/20180809161052/https://calmatters.org/articles/california- teacher-pension-debt/)

</comment><comment> andy-x "Teachers don't get social security, and unlike firefighters or police officers, most retirees earn modest pensions of about $55,000 a year."

$55,000 is a modest pension? That is a lot more than social security is paying. Maybe we should move teachers to SSA?

<comment><USER17> > $55,000 is a modest pension?

Yes, it is, especially compare to public safety pensions it is compared to.

> That is a lot more than social security is paying.

Social security is a minimal safety-net pension designed to mitigate crushing old age poverty (and it's barely adequate even to that task) in the event of absence or failure of workplace-specific retirement plans, not a primary retirement vehicle.

> Maybe we should move teachers to SSA?

You want the Social Security Administration to take over delivery of classroom education from state and local agencies?

<comment> andy-x Nope, I want to fix broken system. I'm not saying teachers should get SSA and nothing else, like with many other businesses 403(b) should be available for them. Point is that their future pension should be paid with their current investment, not some future obligations.

</comment></comment></comment><comment><USER27> Of course they do. As the article says, teachers don't get social security and sacrifice current pay for future pay.

This is California's voters not wanting to pay for promises they made.</comment>


Canadian whistleblower on why he exposed 'problematic' Facebook data misuse - <AUTHOR> http://www.cbc.ca/news/technology/cambridge-analytica-facebook-review-data-users-1.4581847 <comment><USER2> Always suspected Facebook quizzes had ulterior motives.</comment>


Andreessen-backed virtual workforce MobileWorks (YCS11) does 1M tasks in year 1 - <AUTHOR> http://techcrunch.com/2012/08/14/mobileworks-seed-new-direction/

<comment><USER2> I really like seeing all of these companies like MobileWorks, Exec, Uber, et al that are solving problems that are very challenging but in more of an operational way than technical (although technology obviously plays a large role).

</comment><comment><USER3> I'm impressed with the accuracy of MobileWorks over mechanical Turk (or pure MT- not sure if MW just filters workers heavily). I tried a receipt transcription task where I fed the same instructions and same photo to both services. Out of the box, MW was 100% while MT was about 90% for the same cost.

<comment><USER4> As Anand said we have a separate workforce. We have a bunch of algorithmic and social elements that we have developed for improving quality. In fact,we have written an IEEE paper on how to improve quality in crowdsourcing.

[http://www.cs.berkeley.edu/~bjoern/papers/kulkarni- mobilewor...](http://www.cs.berkeley.edu/~bjoern/papers/kulkarni-mobileworks- ieee2012.pdf)

</comment></comment><comment><USER5> Where do they hire their workforce from? Are they overseas or American workers?

[edit] The main reason I was asking this, was I find it really surprising that you're able to hire skilled/educated workers at an outsourcing rate. It's even more surprising that you're finding them organically through press. I'd imagine most TechCrunch readers are over qualified for that kind of work. Kudos to you for making it happen though.

<comment><USER4> TechCrunch is not the only press we get. A TV station in Jamaica covered us and we got a lot of workers from there.

Even when we are in press in the tech circles we get a lot of worker growth by the workers are referred from the work at home or stay at home mom forums. My guess is that someone reposts about us at the more appropriate forums and that sets the ball rolling.

Having said that we have seen that some very qualified people (who might be reading techcrunch or MIT tech review) have joined our workforce.

<comment><USER6> how much it is the average salary currently?. I mean for somebody doing 40 hours/week.

</comment></comment></comment><comment><USER7> This is awesome stuff. I am glad that they are attacking the accuracy angle since for a lot of tasks I care a lot about accuracy and not so much on saving the last $.

</comment><comment><USER4> We are also launching a new and improved API today. <https://www.mobileworks.com/developers/>

</comment><comment><USER8> I do a lot of crowdsourcing (see here <http://weusethat.com/metaoptimize>) and I'm curious to use MobileWorks.

What is the pricing for small jobs?

I have a lot of small jobs, so "contact us for a quote" isn't appropriate when my jobs change often.

<comment><AUTHOR> Pricing is $5 per worker per hour.

<comment><USER8> Is there a way to achieve "guaranteed" high quality on non-easy tasks?

I have a binary classification labelling problem. The labels are very unbalanced (95% no, 5% yes). Answering each question takes a few minutes of web research.

I ran this job on CrowdFlower with gold standard data for quality-control, and using 5 annotators for each question. Nonetheless, I received 99% no answers.

Right now I have about 1000 instances to label. There could be more in the future, if I am confident that I will get high quality labeling.

<comment><AUTHOR> Yes: you can achieve high quality with only a few respondents because the workforce is higher quality and the data is reviewed by a human in the crowd.

Drop us a line and we'll set it up: firstname.lastname@example.com

</comment></comment></comment></comment><comment><USER9> I've worked with everyone on their founding team at Cal and they are all amazing! Kudos to MW team :)

</comment><comment><USER10> Anand, congrats on the milestone!</comment>


NoteHub API - <AUTHOR> http://www.notehub.org/api

<comment><USER2> Some hopefully constructive criticism. :)

\- I'd recommend using HMAC rather than plain MD5 to generate signatures. Using MD5 alone exposes you to length extension attacks.

\- You should consider putting a timestamp or nonce in the signature parameters to prevent replay attacks.

\- The fact that you're able to validate that MD5(password) is correct implies that you're storing passwords insecurely.

\- Consider switching your API endpoints to use HTTPS and sending the password unhashed. Hashing the password is not helping you here: since you're using the hashed value for authentication, any attacker who has it might as well have the actual password. Luckily, I don't believe this is as useful without also knowing the PSK, but it's still a design smell.

<comment><AUTHOR> Thanks a lot for you comments!

> Using MD5 alone exposes you to length extension attacks.

Since NoteHub is anonymous, my concern is not the security, but spam protection only. The Publisher Secret Key + signatures is just a mean to allow 3rd party tools post to NoteHub without captha. That's all.

> The fact that you're able to validate that MD5(password) is correct implies > that you're storing passwords insecurely.

Absolutely, the only reason I hash the passwords in the web client and advise in the API to send hashes and not plain passwords is only to kind of protect users' passwords in the context of insecure transport layer.

> Consider switching your API endpoints to use HTTPS

HTTPS costs money. NoteHub is a free toy tool, a pastebin for one-off notes. I feel like, a fancy security would be an overkill for 99% of all use cases.

</comment></comment><comment><USER3> This looks very nice, but its somewhat inconvenient to write with the preview on top, as it makes the textarea jump around as I type. I think that side-by- side or putting the preview on the bottom would make more sense.

<comment><USER4> [http://dillinger.io/](http://dillinger.io/)

</comment></comment><comment><USER5> Nice updates! Alas, the service seems to broke: whatever I try to create a new note, I get "Bad Request". Care to have a look? Much appreciated, and thanks a lot!

[https://github.com/chmllr/NoteHub/issues/8](https://github.com/chmllr/NoteHub/issues/8)

</comment><comment><USER6> Very useful. I just managed to hide panel see [http://www.notehub.org/2014/1/13/where-is-the- panel](http://www.notehub.org/2014/1/13/where-is-the-panel)

Seems like a feature to me.

</comment><comment><USER7> What's the deal with MD5 (both for signatures and password hashing)?

<comment><AUTHOR> Spam/flood protection.

<comment><USER8> I think it was more of a question of why md5 versus something a bit stronger like sha256?

<comment><USER9> So that it would be easier for the NSA to crack it?

</comment></comment></comment></comment><comment><USER10> Just stumbled across it, nice work BTW.</comment>


Graal.js: High-Performance JavaScript on the JVM by Christian Wirth - <AUTHOR> https://www.youtube.com/watch?v=OUo3BFMwQFo <comment><USER2> Graal uses the OTN licence.

It states:

 _License Rights We grant You a revocable, nonexclusive, nontransferable, royalty-free and limited right to (a) use one (1) copy of the binary portions of the Programs and any Supplemental Programs for the sole purpose of internal non-production and non-commercial evaluation and testing of the Programs, including, developing no more than a single prototype of each of Your applications; and (b) if provided by Us at our sole discretion, view the source code portions of the Programs internally for the purposes of evaluation and testing only (collectively, "Authorized Use")._

 _All rights not expressly granted above are hereby reserved. If You want to use the Oracle Technology for any purpose other than as permitted under this agreement, including but not limited to distribution of the Oracle Technology or the application You develop or any use of the Oracle Technology or the application You develop for Your internal business purposes (other than the Authorized Use), You must obtain a valid Oracle license permitting such use._

[http://www.oracle.com/technetwork/licenses/early-adopter- lic...](http://www.oracle.com/technetwork/licenses/early-adopter- license-2299792.html)

<comment><USER3> >(a) use one (1) copy of the binary portions of the Programs and any Supplemental Programs for the sole purpose of internal non-production and non- commercial evaluation and testing of the Programs, including, developing no more than a single prototype of each of Your applications;

How could someone with any dev experience think this is reasonable, let alone enforceable?

<comment><AUTHOR> You can get most of this with the gpl2 plus classpath exception at the university of linz site. Or the relevant openjdk repository. the other version has autovectorisation and this graal.js. But the team hopes to opensource that too. So once it's production ready the license will change to the standard oracle jdk or openjdk one as you wish.

[http://lafo.ssw.uni-linz.ac.at/builds](http://lafo.ssw.uni-linz.ac.at/builds)

</comment></comment></comment><comment><AUTHOR> The great team keeps on surprising me in nice ways. If this js and java integration works as nice as demonstrated we could use a js frontend on our java backend without going via json objects over the wire but in one process.

<comment><USER4> this appears to be the main benefit, bringing node code closer to existing java based stacks.</comment></comment>


I like strong typing and compilation errors - <AUTHOR> http://ayende.com/Blog/archive/2010/05/05/i-like-strong-typing-and-compilation-errors.aspx?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+AyendeRahien+%28Ayende+%40+Rahien%29 <comment><USER2> People tend to pick one side or the other of this issue and then argue for it. It's rare for anyone to change their mind, and even when they do, it's usually just a boolean toggle to the opposite position. Most people believe (even if they don't say it) that the opposite camp is, basically, stupider.

The entire subject is remarkably evidence-free. That's surprising; you'd think (on the surface, at least) that it could be studied objectively. Of course, we all have our individual experiences as programmers, but those aren't worth much as evidence, because we interpret our experiences to suit our pre- existing belief. Indeed, we don't even notice experiences that contradict it. (I've seen static typing proponents go on about how compilers catch bugs and then spend hours tracking down an InvalidCastException.)

In light of the above, I'm more interested in hearing what people have to say in favor of the position they _disagree_ with. The debate is too tiresome otherwise, entirely predictable.

Although I currently favor dynamic languages, I recently started the thought experiment of asking myself, when fixing a bug, whether a good type system would have caught it. Certainly there are times that the answer is yes (though not always). The difficulty, of course, is whether the aggregate benefit would outweigh the cost.

<comment><USER3> I don't really have a strong preference either way. The bulk of my professional work is in JavaScript with a fair amount of Python and C++ thrown in. I dislike the C++, but that's probably because the type system is brain dead rather than because the type system is static. I do most of my hobby hacking in Haskell, which has about the strongest type system imaginable. I'm hacking on a programming language of my own design, which will have static typing, but not to catch errors. I want static type inferencing because it lets the compiler generate usable, machine-checked, cross-referenced, auto- updating _documentation_ from my source code, without having to update this myself.

I've found that I rarely have type errors in dynamically typed languages, _as long as I program as if they were statically typed_. For example, if my JS function _only_ takes strings or objects with certain fields, I just document those and I almost never make mistakes with them. However, if I start defining functions that return string|int|bool, _then_ I start getting confused. Do this often enough and it becomes essentially impossible to reason about my program.

Ironically, I've found that a good portion of my bugs in statically typed languages are type errors, in the form of null pointer exceptions. Haskell's Maybe type is the way to go here; yeah, it makes looking things up in a dict inconvenient, but I can't count the number of bugs I've avoided by being forced to deal with nulls up-front and not having them pollute the rest of the program.

</comment></comment><comment><USER4> I'm glad I actually read the article, because while I too like strong typing and compilation errors, but I don't want to be associated with programmers who do things like this:

> _Today I had to modify a piece of JavaScript code. The code used return a > single string, and I needed to modify it to return an array of objects. > Using C#, it would have been easy, change the return type, hit the compile > button, fix the errors, rinse & repeat until it compiles._

The compiler does not save you from having to think, and like InclinedPlane says, compilation doesn't 'prove' correctness, only shows you that the compiler could at least sludge its way through your code.

The code should pass some mental unit tests of expected inputs and outputs before you even make the change.

<comment><USER5> It is interesting to observe that TDD (or our intelligent IDE) actually makes programmers never think. They tend to develop in more ad-hoc way: Google some example code snippet, change the order and play around with some parameters, fix the Eclipse "syntax error" hint and try it out until it works.

EDIT: yes, it is just plain wrong, no excuse. But I am trying to point out that it truly happened and I am curious about why or how.

<comment><USER6> Hogwash.

No good developer does what you describe, no matter what tools they use.

<comment><USER7> Good? No. But making a living writing code, maybe even important code? Far more likely than you'd like to think.

<comment><USER6> > But making a living writing code, maybe even important code? Far more likely > than you'd like to think.

I've _never_ seen developers who work this way: not in industry - not even in college.

In my experience, the "mess around with the code arbitrarily until it works" style described by liuliu is the programmer's equivalent of a moral panic. Everyone talks about it and laments it, but it doesn't really happen.

</comment></comment></comment></comment></comment><comment><USER8> I don't see the need for the invasive change. Given the problem that he had I would have written a new function that returned the more complex data structure, converted the old function into a wrapper around the new one, then called the new function in my new code.

Much simpler. Much safer. Much less chance of breaking existing code. (Decent unit tests could help verify this.) And you avoid duplication of logic.

If I wished to convert existing code to use the new function, I could do that at my leisure. Furthermore if someone happens to be developing code in another branch or at another site which expects the old function to be there, I don't break them.

<comment><USER9> If you're refactoring a lot then your method leaves you with huge amounts of extra code, which makes maintainability much harder, because you've got multiple levels of indirection.

<comment><USER8> If even your internal modules are clearly separated into public interfaces and internal stuff, then most refactorings won't need that level of care.

</comment></comment></comment><comment><USER10> I find it rather risky to change something and expect compilers to catch all the errors.

Anyway, the non-typed languages I use tell me the line of code where the error occurred. Isn't that equivalent in this case?

<comment><USER11> No; The line has to be executed for the error to show up in a dynamic language.

Think of types as logical propositions, and type systems as theorem provers. The stricter and more powerful the type system, the more exact and precise the proof will be, and the more you can be guaranteed that things won't go wrong.

<comment><USER10> Of course it has to be executed, but it's either something that you are going to execute yourself (as in pushing a button) or at least you are making an easy way to trigger this function. If you are testing such code you make sure to run it.

I understand that strict typing works by guaranteeing _some_ things won't go wrong, but I can't see many meaningful situations where it wouldn't generate a runtime error in a scripted language, or at least results that make the source of the error painfully obvious.

<comment><USER12> > If you are testing such code you make sure to run it.

Ahh, but that's not the problem. It's easy to test the code your changing, it's a much harder problem to find and test all the code that depends on that code. Having the compiler spit out every instance everywhere that you need to fix due to a new type-mismatch makes this significantly easier.

Some dynamic languages will happily convert values from one type to another even when that's not the desired result -- you might not get an error at all, just some bad data you might not find until much later.

<comment><USER13> >Some dynamic languages will happily convert values from one type to another even when that's not the desired result -- you might not get an error at all, just some bad data you might not find until much later.

This happens with algol style static languages too (And is one of the reasons I find people arguing for Erlang instead of python more persuasive than those instead arguing C++ instead of ruby).

You are confusing _strong types_ with _dynamic variables_. Most of the algol languages have weak to medium type _strength_.

For instance, python has _much stronger types_ than C. However, it's variables are all dynamic references.

</comment></comment></comment></comment></comment><comment><USER7> If you rest on the premise that merely because your program _compiles_ it is also _correct_ then you will face a career full of frustration and mediocrity.

<comment><USER14> That's not the premise he's making. He's saying it's more convenient. Also, I would think twice before referencing ayende and using the phrase "...[ayende] will face a career full of frustration and mediocrity."

<comment><USER7> I don't doubt that this is just one tiny aspect of Ayende's development practices, and in that context it's not necessarily even bad practice.

The problem I have with Ayende's statement is that it can seem like advice, and there are a huge number of inexperienced developers for which that advice is incredibly dangerous outside of the proper context.

</comment></comment></comment><comment><USER15> Strong static typing is great. You can cut your runtime bug count by 70-80% easily if you know what you're doing, which provides an enormous increase in productivity. Also, type discipline seems to lead naturally to better architecture. You have to build your data structures and functions from the ground up, which tends to kill a lot of the sloppy thinking and nonexistent architecture that you sometimes see in the dynamically-typed world (although this can't be blamed on the languages, because a lot of users of such languages write great code).

Dynamic typing wins on prototypes and small projects, but for a project of more than 2000 lines, I'd be hard-pressed to see a case where dynamic typing wins.

Of course, I'll add the caveat that _good_ dynamic typing is essential. Most people think dynamic pwns static because they're most familiar with Java and Python, but Java has shitty static typing (you have to declare types, and moreover end up needing to subvert the type system to do anything interesting) whereas ML and Haskell have awesome type systems.

<comment><USER8> Interesting. You say that after 2000 lines, people are better off with static typing. But then you make it clear that this is only true if, instead of comparing widely used static and dynamic languages, you compare widely used static languages with best of breed statically typed languages that are not actually in wide use.

Where would you say that the trade-off is between dynamic and static if you stick with widely used languages? (From your comments about Java I think you'd choose Python.)

Where would you say that the trade-off is between dynamic and static if both are represented by best of breed representatives? Something like Erlang or your favorite Lisp?

How does it change things if we take into account the widespread availability of useful libraries for some languages but not others? (The infamous "CPAN argument" for Perl being an extreme example.)

<comment><USER15> _Where would you say that the trade-off is between dynamic and static if both are represented by best of breed representatives? Something like Erlang or your favorite Lisp?_

Lisp is a great language, but I still think static typing wins at a certain point for large projects. Type signatures (which are automatically inferred) provide a certain amount of documentation, and static typing also makes for cleaner and inherently more comprehensible interfaces.

When you have multiple programmers, when a lot of time is spent debugging, and when internal APIs become essential, static typing begins to show its strength. People can't just change interfaces willy-nilly and expect everyone else to adapt; the compiler catches this.</comment></comment></comment>


Success with OpenSolaris + ZFS + MySQL in production - <AUTHOR> http://blogs.smugmug.com/don/2008/10/10/success-with-opensolaris-zfs-mysql-in-production/

<comment><USER2> This article sums up a lot of good points about Solaris. Userland is a joke, package management is awful, just installing and using the OS is an exercise in frustration for folks spoiled by the lovely tools available in a Linux system, but some of the core technology is amazing. He's not even mentioning the _other_ mind-bendingly great technology that Solaris offers: Zones. Zones are the most efficient and stable way to run many virtualized servers. Because they share a kernel and most system services, Zones can be extraordinarily lightweight, while still providing exactly the level of isolation you want. While Xen on Linux is nice, the smallness of Zones is a killer feature. Linux has vservers (and the somewhat broken fork OpenVZ/Virtuozzo), which use the same model, but the stability and capability of it leaves a lot to be desired. And, of course, Sun stands by Zones...problems actually get fixed, whereas serious memory management bugs have existed in OpenVZ/Virtuozzo for years (possibly also in vservers since they're derived from the same original source, though I haven't seen it, so far).

Anyway, a lot of Linux folks have written off Sun based on an old understanding of what Sun has to offer. If they continue to work on fixing the userland and the package manager (ideally replace pkg with RPM/yum or deb/apt, since both are remarkably better), and solve the driver issue (Linux has dramatically more drivers than Solaris...which makes a difference...a lot of folks like to have their target platform on their desktop, I know I do, and that's just not reasonable with Solaris), OpenSolaris could become a serious contender.

Oh, and dtrace. Holy crap, how awesome is dtrace? Can't forget dtrace. Sun has some serious engineers.

<comment><USER3> Yeah I second that; Sun has amazing engineering. I got to dig around in the kernel code for Solaris during my operating systems class and holy crap their scheduler is well designed.

</comment></comment><comment><USER4> I love Don's technical posts on smugmug. All the gory details, no pulled punches, no equivocating about what hardware/software/services are or aren't working for them.

And ZFS on Linux would be huge. I just hope Sun is on the path.</comment>


A single-molecule room-temperature transistor made from 14 atoms - <AUTHOR> http://www.kurzweilai.net/a-single-molecule-room-temperature-transistor-made-from-14-atoms <comment><USER2> Thread from last time: [https://news.ycombinator.com/item?id=15070596](https://news.ycombinator.com/item?id=15070596)

</comment><comment><USER3> IBM posted about this back in June or is this something smaller? [https://www.ibm.com/blogs/think/2017/06/5-nanometer- transist...](https://www.ibm.com/blogs/think/2017/06/5-nanometer-transistors/)

</comment><comment><USER4> Nitpicking, but:

"... cobalt (blue) and sulfur (yellow) atoms (left) and ethyl-4-(methylthio)phenyl phosphine atoms, ..."

I haven't heard of that last element!

<comment><USER5> Phosphine stands for the compound PH3.

<comment><USER6> Yeah, but it's not an element, therefore isn't an atom.

<comment><USER7> Considering they used atom twice, I'm pretty sure they meant molecule.

</comment></comment></comment></comment><comment><USER8> It's funny, I looked at the diagram and went "that's not a transistor". Then the actual words from the team involved called it a diode, and talked about it as a junction.

So...it isn't a transistor at all.

<comment><USER9> Well, sort of. A transistor is something with an 'on' state and and 'off' state (and a whole range in between for analog purposes). This one apparently also has an 'on' and an 'off' state but the mechanism by which they change the state does not really spell 'transistor' though if there is an electrical way to do it it might qualify.

The relevant bit from TFA:

"The device can reliably switch from insulator to conductor when charge is added or removed, one electron at a time (known as "current blockade")."

So it is more like a FET and the charge placeholder would be the gate. It's not clear to me whether or not they had anything wired up to that spot or how they added or removed the electrons.

</comment></comment><comment><USER10> From my understanding many years ago, solving the heat dissipation problem is the real problem behind higher transistor density. Is that still the case?

</comment><comment><USER11> So this is the end of the road?

<comment><USER12> I wait for the 13 atoms version.

<comment><USER13> But what about the 7 bridges road?</comment></comment></comment>


United States Government Censorship of Fuck Nazis Virtual Lapel Pin - <AUTHOR> https://rubin.io/blog/2017/09/01/usg-censorship-fuck-nazis/ <comment><USER2> Tbh, hosting it as a .US domain was bound to cause a problem at some point. Unless this is exactly what the site author expected, and is using the expected outcome as a platform to bash the US Government?</comment>


Ask HN: Bootcamp for self-taught developers? - <AUTHOR> I'm a self-taught web developer with about 3 years experience, and I feel I have a pretty good grasp on the tools I need for my day-to-day job. But I never attended university and would like to get a deeper understanding of computer science. I've done a few moocs, and they are definitely very useful, but I'm wondering if there are any accelerated "bootcamps" that teach either computer science fundamentals, or maybe more advanced programming topics. The bootcamps I'm aware of focus on beginners.<p>Does anyone know if something like that exists? <comment><USER2> If you're looking for a good shortcut get the Imposters Handbook:

[https://bigmachine.io/products/the-imposters- handbook/](https://bigmachine.io/products/the-imposters-handbook/)

The author, Rob Connery, has got a number of online courses out. I've attended a few and he's an exceptional instructor. Least this self taught developer understands him:>). Good luck!

<comment><AUTHOR> Thank you for linking this. I've gone ahead and purchased the ebook and will start working through this. If nothing else, it looks like it will cover a lot of the topics I was hoping to learn in a course setting, so should be a good prep at least.

</comment></comment><comment><USER3> Maybe not exactly what you're looking for, but check out the Recurse Center, [https://www.recurse.com](https://www.recurse.com)

Not a boot camp, it encourages "self-taught". If you go, you'll be pursuing those more advanced topics at your own pace. But you're sure to meet like- minded folks and learn from them as well.

I learned about RC through Hacker News posts, so its fitting I pass along the recommendation this way.

<comment><USER4> I'm a RC alum (Fall 2012), and I strongly recommend it if you have that kind of time. I am also self-taught, but the time spent in the Recurse Center was definitely time well spent. I do wish I could take a sabbatical from work to do a second run, I have a much better idea of what I would like to focus on during my time there.

</comment></comment><comment><USER5> Interviewbit has a programming track [https://www.interviewbit.com/courses/programming/](https://www.interviewbit.com/courses/programming/) and interview problem sets you can practice with to build your algorithm skills [https://www.interviewbit.com/amazon-interview- questions/](https://www.interviewbit.com/amazon-interview-questions/)

Or find a suitable advanced pile of material and pick out of it what you want to learn [https://functionalcs.github.io/curriculum/](https://functionalcs.github.io/curriculum/)

Or your next vacation, go to Raleigh, NC and pay this ex-CMU Professor to personally teach you whatever topics you want [https://calculem.us/classes/](https://calculem.us/classes/) he's now a freelance compsci instructor

</comment><comment><USER6> I attend Holberton school which begins with bash/C, build your own printf from system calls, build your own shell, etc. I come from a background in physics/hardware eng and have gotten lots of value out of it.

</comment><comment><USER7> I'm part of a team creating content at Codecademy to fill exactly this need. It is currently part of our Pro feature.

The courses cover computer science data structures but we will be adding algorithms in the near future.

[https://www.codecademy.com/learn/paths/computer- science/](https://www.codecademy.com/learn/paths/computer-science/)

If you are already familiar with Python, you probably want to skip to the 7th unit.

Feedback is appreciated!

<comment><USER8> It's too bad my "browser isn't supported".

</comment></comment><comment><USER9> You should checkout [https://bradfieldcs.com/](https://bradfieldcs.com/)

<comment><AUTHOR> Wow, this looks like a great resource. I'm not currently in the bay area, but this looks perfect otherwise. I'm going to look into this a bit more, thanks!

</comment></comment><comment><USER10> I finished a boot camp this past spring, full time, 3 months. I really wished it was full time 6 or 9 months with some CS light stuff.

I'm sure they wouldn't get a lot of customers, but I would have loved it.

</comment><comment><USER11> [https://www.42.us.org](https://www.42.us.org)

</comment><comment><USER12> Lambda school. 6 month, full time, covers both basics and advanced stuff.

<comment><AUTHOR> I hadn't heard of Lambda school, but this looks like a great option. The fact that it's available online, and available after work hours is really appealing. Do you have experience with Lambda school?

</comment></comment><comment><USER13> You should check out Lambda School's Computer Science Academy.

7.5 months long full-time, live remote classes, free until you're hired.

[https://lambdaschool.com](https://lambdaschool.com)</comment>


JS Inheritance is awesome, and you're doing it wrong - <AUTHOR> https://coderwall.com/p/sd9lda

<comment><USER2> I feel like this abuses Object.create.

It should be used to ease constructors into being children of other constructors, it shouldn't be used when you only have one constructor.

> "So make a constructor, lazy ass."

        var wizard = {
            hasMagic: true
        };
        function Wizard (name) { Object.create(wizard) }

That is madness, or maybe I misunderstand.</comment>


Memory leak in Go http standard library? - <AUTHOR> http://stackoverflow.com/questions/21080642/memory-leak-in-go-http-standard-library

<comment><USER2> Stack Overflow questions with interesting answers are good bets for HN, but Stack Overflow questions about individual bugs with _no answers_ aren't; they seem more like attempts to game Stack Overflow, and, at the very least, crud up HN. I actually flagged this.

<comment><AUTHOR> I didn't think it would be interpreted that way. My bad. It seems like it's not a leak in the http library, just allocating memory and not releasing it sooner than expected.

</comment></comment><comment><USER3> [https://groups.google.com/forum/#!forum/golang- nuts](https://groups.google.com/forum/#!forum/golang-nuts) is the best place to ask Go related questions, not HN.

<comment><USER4> I would argue that a serious memory leak in one of the core functions of such a popular and trending language is news worthy.

<comment><USER3> It's highly unlikely that there is a memory leak.

<comment><USER5> I've been running the code he posted with ApacheBench and I'm not seeing any issues.

</comment></comment></comment></comment><comment><USER6> Go provides very adequate profiling tools for debugging this type of problem.

[http://blog.golang.org/profiling-go- programs](http://blog.golang.org/profiling-go-programs)

FWIW, I did `ab -n 1million -c 100` with your program on Windows/amd64 and memory grew from from 3.4MB to 3.9MB.</comment>


Why is America running out of water? - <AUTHOR> https://www.nationalgeographic.com/science/2020/03/partner-content-americas-looming-water-crisis <comment><USER2> This is literally labeled as an ad partner content for dish detergent

<comment><USER3> Hah, weird. Is this sentence in the last paragraph their angle?:

> And every American can save more water at home in multiple ways, from taking > shorter showers to not rinsing dishes under a running faucet before loading > them into a dishwasher, a practice that wastes around 20 gallons of water > for each load.

<comment><USER4> or we could just wash dishes in the sink.

</comment></comment></comment><comment><USER5> Summary - more people, more farming.

BUT. This appears to be different from before, where there was water, just in the wrong place, now the US appears to be coming close to using 100% of the available resource.

</comment><comment><USER6> Ban lawns, or at least watering them. Increase the use of aquifers and natural water reserves on site.

<comment><USER7> Almost all the water problems are due to agribusiness usage.

If you reduced all consumer usage of water to zero, it would barely make a dent.

California can solve its consumer water problems with a couple of desalinization plants. Farming in the Central Valley, however, would basically need to be shut down to stop draining the aquifers.

<comment><USER8> Exactly.

This is equivalent to the "we have to convert to electric cars because of climate change!" which will also barely make a dent in carbon emissions (unlike, say, converting the world to nuclear power plants).

<comment><USER7> > This is equivalent to the "we have to convert to electric cars because of > climate change!" which will also barely make a dent in carbon emissions

Even if electric cars were carbon-equivalent, moving a million point sources of pollution (internal combustion engines) to a single point source of pollution (a power plant) is _way_ better for us all.

</comment></comment></comment></comment><comment><AUTHOR> [https://en.m.wikipedia.org/wiki/California_water_wars](https://en.m.wikipedia.org/wiki/California_water_wars) : California water wars.

Relatedly on a more entertaining note: Chinatown..1974 movie by Roman Polanski [https://en.m.wikipedia.org/wiki/Chinatown_(1974_film)](https://en.m.wikipedia.org/wiki/Chinatown_\(1974_film\))

And Cadillac Desert by Marc Reisner: [https://en.m.wikipedia.org/wiki/Cadillac_Desert](https://en.m.wikipedia.org/wiki/Cadillac_Desert)

</comment><comment><USER9> If humans really wanted to solve this problem, they could quite easily. The ocean is full of water. All you have to do is desalinate it and pump it.

Would it be expensive as fuck? Yes. Would it require tons of work, and new technologies to be invented? Of course!

If we really wanted to do it, though, we could. I refuse to believe that this isn't true.

<comment><AUTHOR> There is the issue of brine.

Further the ocean is a delicate and unique eco system of its own. It has its own habitat and balance and equilibrium.

Desalination doesn't come without its costs and it's not just about the money.

Sea steading, desalination etc are not really robust solutions. Control human population or control consumption. The planet isn't expanding and resources are not infinite.

<comment><USER9> Of course brine is a problem. I never said it wasn't. All I'm hearing, though, are challenges that may require out of the box thinking.

Controlling human population and consumption simply isn't going to happen, so you might as well give up on that idea. At best, you will merely slow down the problem for a while.

<comment><AUTHOR> I think controlling human population is the only solution. Depopulation will happen anyways. When it does, we would still need resources and if we burn it up ..and we are a super apex predator..faster than it can renew, we are basically shooting our selves in the foot.

It's like sitting on the top most branch and sawing the trunk of the tree. Daft! Slow burn of resources and working with burning renewables only will ensure humanity and species survival. Otherwise the planet will survive. We won't. Because when we hit carrying capacity, there is a dearth of resources..we will start killing each other. Oh! Oops! Already happening!

</comment></comment></comment></comment><comment><USER10> Maybe once we don't need as much oil we can repurpose the pipelines to pump water from the areas that have no shortage to the rest of the country so we can expand our usable territory?

<comment><USER11> Costs to flush out and decontaminate the pipes would not be insurmountable. That along with different liquids have different demands on pipes, pressure, chemical reactions (corrosion) and then the viscosity factors. Maybe that pipes suited for oil are not suitable for water carrying, or not as ideal.

</comment></comment><comment><USER12> Cause Nestle is hijacking your water</comment>


The Most Wonderfully Ridiculous Movie Computers (2012) - <AUTHOR> https://www.wired.com/2012/10/movie-computers/ <comment><AUTHOR> I was researching a comment for another post and I came across this photo of the legendary DEC PDP-8:

[https://en.wikipedia.org/wiki/PDP-8#/media/File:PDP-8e,_insi...](https://en.wikipedia.org/wiki/PDP-8#/media/File:PDP-8e,_inside,_2.jpg)

That got me thinking that it might have been an inspiration for movie computers, and, here you go...</comment>


An Indian politician used AI to translate his speech into other languages - <AUTHOR> https://www.theverge.com/2020/2/18/21142782/india-politician-deepfakes-ai-elections <comment><USER2> He translated the speech in the video!

(From the title I was expecting that he translated only the written version, and I was expecting that the translation has a funny embarrassing mistake, or something like that.)

<comment><AUTHOR> Sorry, Probably I should've added `deepfake` in the title that might have hinted that it's a video.</comment></comment>


Google's detected and defeated a steep rise in Android mobile bank bank fraud - <AUTHOR> http://qz.com/514720/google-just-revealed-its-android-security-team-detected-and-defeated-a-steep-rise-in-mobile-banking-fraud-in-russia/ <comment><AUTHOR> A lot of data behind this story from Google and Kaspersky Lab - Often finding a corroborating time series data source limits reporting as more than hearsay; however - Google and Kaspersky's data in this case align to confirm that banking trojan apps in Russia have nearly been exterminated.</comment>


Hexo, OpenShift and CloudFlare - <AUTHOR> https://nmaggioni.xyz/2016/06/22/Hexo-OpenShift-CloudFlare/ <comment><USER2> Going through the same thing.

He could have saved a rule. Just have "www.nmaggioni.xyz/*" redirect to "[https://nmaggioni.xyz/$1"](https://nmaggioni.xyz/$1"). That takes care of both [http://](http://) and [https://](https://).

Also, I'm using Gitlab pages which provides a build step after pushing.</comment>


Thread about UK's Covid-19 response by Anthony Costello - <AUTHOR> https://twitter.com/globalhlthtwit/status/1238425621375651840 <comment><USER3> Here's more detail: [https://www.itv.com/news/2020-03-12/british-government- wants...](https://www.itv.com/news/2020-03-12/british-government-wants-uk-to- acquire-coronavirus-herd-immunity-writes-robert-peston/)

The article mentions that "...allow the virus to pass through the entire population so that we acquire herd immunity, but at a much delayed speed", but also that they don't plan to delay football matches.

I don't understand, do they think that more conservative strategies will slow the virus down "too much"? They mention fear of "constraints on freedom of movement" being lifted too soon, maybe a more rational approach is to just not lift them too soon, rather than encourage gatherings like football matches. Given the numbers in Italy & China, I would argue that several football matches could potentially lead to thousands of simultaneous hospitalizations, which seem to be the biggest problem in e.g. Italy. What am I missing here?

</comment><comment><USER4> One of the problems that the UK government is going to face is that their under-reaction has completely destroyed any faith people had in the government's ability to deal with this.

People already don't view Boris Johnson as a safe pair of hands. Just to give a flavour of that, supermarket shelves are already consistently devoid of rice, pasta and other likely targets for stockpiling. The government has entirely failed to address this. As well as that, businesses are aggressively pursuing their own emergency mitigation plans despite what the government are saying. The company I work for moved all non-essential personnel to working from home as an immediate reaction to Boris Johnson's speech - <USER2> telling people not to come in tomorrow even if they had no actual ability to work from home. Essentially there are large organisations now that are completely disregarding the govenrment response and taking matters in to their own hands.

Finally it's important to note that late last year the government announced _enormous_ spending plans for the health service in a massive reversal of a decade of policy. The problem is that it takes such a long time to actually see any results from that spending that we're going to be coping with this emergency with the least equipped health service that this country has had in decades.

Finally, you have to add the multiplier - because there are so many reasons to be concerned about this, panic will make everything 10x worse.

</comment><comment><USER5> 9\. So in addition to the >1M dead this strategy likely entails (several 100k in the case of a fatality rate below South Korea's 0.6%, which sounds completely unachievable), what long term damage scenarios for the survivors has been factored into the analysis?</comment>


Ask HN: What 4K monitor for the new Mac Mini would you recommend? - <AUTHOR> Hey there, I was thinking to replace my MacBook Pro 2012 with a Mac Mini., so I would need a bigger external monitor so here's the big question: what >24'' and >4K monitor would you buy?
It seems that Apple recommends LG monitors but the UltraFine 5K is quite expensive. Are there cheaper but good alternative products at the moment?
According to this post (https://bjango.com/articles/macexternaldisplays/) it seems that a Dell UP2715K could be a good alternative to LG, but it seems that it is not available anymore for sell.
Thank you in advance for your precious advices! <comment><USER2> Very happy with 2x LG 27MU67-B (there seems to be a slightly new model out: LG 27UD68P-B). Those are 27", 4k. I do programming, very little design, no gaming.

With macMini you probably want external speakers as well, the internal sound is no match to a macBook.</comment>


Say no to your client - <AUTHOR> http://www.starwebapp.com/wp/say-no-to-your-client/

<comment><USER2> I do not agree on this. I think this is a step in the wrong direction. Who knows exactly what to build from the beginning? I think it is more important to constantly talk to your client and whenever something is decided that changes the amount of time you have to put into get stuff up and running, communicate that back to the customer and tell him/her how it affects timeline and pricing for the solution.

</comment><comment><USER3> did we just re-invent waterfall? a lot of clients don't actually know what they want. when you get them to agree to something without some kind of prototype in front of them, you're wasting everyone's time ...

</comment><comment><USER4> in addition to the other comments: this is why you need evolutionary database design.</comment>


Why I use the MIT licence (by author of Rack) - <AUTHOR> http://chneukirchen.org/blog/archive/2009/08/why-i-use-the-mit-license.html

<comment><USER2> I use the MIT license for all my projects because it's simple and sensible. I want to code and not worry about the politics. The MIT license gives me that.

<comment><USER3> It might be simple, but I don't agree that using a permissive license is apolitical. Understanding this, passing your views off as "pragmatic" seems dishonest.

The OP links to djb's site - he seems to conflate rejecting EULAs (which I agree with) and rejecting copyright on software; am I reading him correctly? (I mention him here because nobody can claim his stance is pragmatic at all.)

<comment><USER2> I mean "politics" in the sense that the MIT license is concise, unlike the GPL.

<comment><USER4> The phrase "public domain" is even more concise.

<comment><USER5> Unfortunately, it's also legally questionable in a great number of jurisdictions, so you have to use the MIT license instead.

<comment><USER6> Perhaps we can have a "public domain license," then. Attaching it to a project would go something like: "This software is in the public domain, as that term is defined under USC yadda-yadda. If your local law does not define the term similarly, then consider the conditions of USC yadda-yadda to be the terms of the license of this software to you."

<comment><USER7> That would actually pretty close to the MIT license, in practice. There are major benefits to not inventing yet-another-license, and using something that everyone is already familiar with.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I totally agree. When you put something open source, generally the more people use it the better. GPL often just causes problems. MIT is simple, and lets anyone do anything. If I open source something, that's what I use. Otherwise I keep it closed.

</comment><comment><USER9> _I realize "bad guys" don't cease to exist—whether they "steal", don't share, lock up code, or have business models in mind you don't like. But it's not my fault they are that way, and neither it is my job to "teach them lessons"._

I don't think any significant body of code is written or licensed for punitive reasons. The difference between the MIT and copyleft licenses such as CC-BY-SA or the GPL is that the MIT license does not protect your users from hostile middlemen.

<comment><USER10> Please elaborate? Middlemen as in people making my code malicious and pass it off as my code? How would that work?

<comment><USER9> If a middleman takes your code, compiles it, and then distributes it to the user, then that user has no access to the source code to the version installed on their system. This is one of the events the GPL is designed to guard against.

In an ideal world, everybody would provide their users the same rights they received from the copyright holder. The only licenses required would be MIT/BSD style. I would love this; a simple license, in my opinion, is better than the enormous complexity of the GPL. However, since in the real world people can and do restrict user's rights to source code, the GPL is still needed.

<comment><USER10> But wouldn't it kind of be the user's own fault if he installs software he doesn't see the source for? Also, how would the GPL protect the user, if the criminal does not mind doing illegal things anyway (like distributing malicious software)?

<comment><USER9> _But wouldn't it kind of be the user's own fault if he installs software he doesn't see the source for?_

I don't believe that blaming the victim is a healthy attitude to life. "The rape was her fault for wearing those clothes" is for banana republics and history books, not modern times.

 _Also, how would the GPL protect the user, if the criminal does not mind doing illegal things anyway (like distributing malicious software)?_

I didn't say it was a criminal act, and the software does not have to be malicious. Assuming the middleman makes _any change at all_ , no matter to what purpose, then the user no longer has access to the source code for the application they're running. In my opinion, this is unacceptable, and I try to avoid contributing to software under a license which allows proprietary distribution.

<comment><USER5> _I don't believe that blaming the victim is a healthy attitude to life. "The rape was her fault for wearing those clothes" is for banana republics and history books, not modern times._

I am _not_ a victim. I am willfully and with full knowledge of the implications entering into an economic exchange that I believe to be of benefit to myself.

</comment></comment></comment></comment></comment></comment><comment><USER11> _First, I live and code in Germany, where you can't place things into the public domain without already being dead for a long time._

Is that true? In Germany you're forbidden to make stuff and give it away?

<comment><USER12> In Germany (and some other jurisdictions), you're forbidden to unilaterally disclaim responsibility for something you've written, which the public domain implies. Instead, you can only assert that there's no warranty (for example) via license (and/or contract, I guess?). Explicitly placing things in the public domain has a history in the US, but actually is not directly supported by law even there, only precedent.

</comment></comment><comment><AUTHOR> The main reason I use MIT is so that I can use my open source code in my own commercial endeavours without "infecting" that commercial codebase, which needs to remain closed source.

<comment><USER13> And you have every right to do that with the GNU Public License too, by the way.

<comment><USER5> Only if you own the copyright for the entire body of work. If you receive external contributions, you must request copyright assignment from contributors to allow you (and only you) to use the work for any purpose under any license.

Pro-GPL arguments are full of these silly caveats.

"You can still sell the software" -- so can anyone else, or they can just give it away for free. Now what?

"You can use it under any license you want" -- only if you acquire full copyright for every single contribution.

"You can sell services!" -- end users don't buy "services" for consumer software.

"Non-GPL software is immoral" -- guess who buys the "services" that cover your development costs? Companies that ... sell proprietary software.

.. and just to demonstrate the total rational disconnect of the primary GPL advocate, Mr. Stallman:

<http://thread.gmane.org/gmane.comp.gnu.mingw.devel/2963>

<http://thread.gmane.org/gmane.comp.gnu.mingw.devel/2970>

<comment><USER14> > "You can use it under any license you want" -- only if you acquire full > copyright for every single contribution.

This is easy to do. _You_ are the end-point for accepting contributions. All you have to do is require assignment of rights to you in order to accept patches. This is obviously more difficult if you didn't do this to begin with and now have to track down all the past contributors, though.

> "You can sell services!" -- end users don't buy "services" for consumer > software.

Depends on what you mean by 'end user.' If the end users for my piece of software are law firms, then yes, they would purchase support contract/other services. Not every piece of software out there is developed for home desktop users.

> "Non-GPL software is immoral" -- guess who buys the "services" that cover > your development costs? Companies that ... sell proprietary software.

So the only entities that would purchase support contracts (or custom modifications) for software are proprietary software development houses?

<comment><USER5> _This is easy to do._

Did you ever try contributing to MySQL? Chances are very good your patch languished for years.

As a contributor, it's a bum deal. I don't like giving away the rights to _my_ work just to support _their_ business model or moral imperative.

 _Depends on what you mean by 'end user.' If the end users for my piece of software are law firms, then yes, they would purchase support contract/other services._

I literally mean "end user". The consumer who would like a piece of software to solve a particular problem on their desktop. Someone a little like me, who uses the software I'd like to write.

Of course, I don't actually _want_ to provide services -- I want to _write software_.

 _So the only entities that would purchase support contracts (or custom modifications) for software are proprietary software development houses?_

No, they'll just make up a large portion of your sales (from experience) if you're selling technically-oriented services.

<comment><USER14> > Did you ever try contributing to MySQL? Chances are very good your patch > languished for years.

That has nothing to do with the ease that the software _owner_ can create a system to not have to 'track down all contributors' when making a licensing change decision. Your original post implies that this is a barrier to entry.

> I literally mean "end user". The consumer who would like a piece of software > to solve a particular problem on their desktop. Someone a little like me, > who uses the software I'd like to write.

So you're suggesting that I can't sell support/services for my 'law firm software' because the paralegal/lawyers that are actually using it on their company desktops will not be paying out of pocket for services? Huh?

> Of course, I don't actually _want_ to provide services -- I want to _write > software._

No one is forcing you to. I'm not being 'Pro-GPL' here I'm just poking holes in your argument.

> No, they'll just make up a large portion of your sales (from experience) _if > you're selling technically-oriented services._

(emphasis mine) In your original post you seem to be applying that to _all software_ that someone might choose to make GPL.

<comment><USER5> _Your original post implies that this is a barrier to entry._

It is a barrier to entry. I provided one example, there are many others. Try participating in the OpenJDK development process. At every turn, you'll find that administering copyright assignment is, bluntly, a gigantic pain in the ass.

As you already noted, it's nearly impossible to put the cat back in the bag, if you fail to do this to begin with.

 _So you're suggesting that I can't sell support/services for my 'law firm software' because the paralegal/lawyers that are actually using it on their company desktops will not be paying out of pocket for services? Huh?_

No. I'm saying that _consumers_ won't buy services for _consumer software_. If you're selling enterprise support services, you're not selling consumer software to consumers.

 _No one is forcing you to. I'm not being 'Pro-GPL' here I'm just poking holes in your argument._

A standard argument for the GPL is that you can (should?) sell services, not software.

 _In your original post you seem to be applying that to all software that someone might choose to make GPL._

If you write software within a narrow band (enterprise, requires support, sold to non-technical organizations) you might be able to make the GPL work for you. Like I said originally: "lots of silly caveats".

<comment><USER14> > It is a barrier to entry. I provided one example, there are many others. Try > participating in the OpenJDK development process. At every turn, you'll find > that administering copyright assignment is, bluntly, a gigantic pain in the > ass.

IIRC, Samba requires you to assign over rights to contribute. Maybe take a look at their process.

While I will admit that I have no experience with large projects like OpenJDK, I'll venture a guess that the larger a project gets (and/or the more submissions it gets) that harder it is to manage.

GPL is not always realistic with out side effects, but that doesn't mean it's never realistic either (or that it can't be done if you accept the side effects).

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> It's possible that putting things in the public domain is no longer allowed even in the US. Peter Saint-Andre puts all of his work in the public domain, but he wrote an essay with links almost three years ago discussing among other things that it may not be legal <https://stpeter.im/index.php/2006/12/30/pd- howto/> . He has a lot of other writings about PD and copyright issues here : <https://stpeter.im/index.php/category/publicdomain/> . Note for those using IE; IE does not recognize his CA, you need to either click through or change the https to http.

</comment><comment><USER16> What Zed Shaw said</comment>


Go Library for the VMware vSphere API - <AUTHOR> https://github.com/vmware/govmomi <comment><USER2> One of the nicest parts of this library, to me, is the 'govc' command which it provides: [https://github.com/vmware/govmomi/tree/master/govc](https://github.com/vmware/govmomi/tree/master/govc)

It fits in really nicely with plain-old Bash scripts, and has some niceties such as being able to output dumps of data as both human-readable and to JSON for further manipulation/inspection (e.g. jq)

<comment><USER3> Govc is great. We use it all the time in-house at VMware. :)

</comment></comment><comment><USER4> > err = v.Retrieve(ctx, []string{"Datastore"}, []string{"summary"}, &dss)

I am no Go expert but is that sort of thing ([]string part) used commonly in Go? Sounds like the API would be better if it wasn't so "string oriented" for a lack of better term? This sounds like you are parsing random text which is fine at a lower level where it could be better abstracted out?

<comment><USER5> Not sure how familiar you are with the vSphere API but the whole thing is done over HTTP, which would explain why it's so string heavy. The SDKs VMware releases for various languages just papers over this.

<comment><USER4> I guess the least the API could do is provide some suitably named constants that represent the various elements such that the call becomes something like -

            err = v.Retrieve(ctx, VSphere.DATASTORE, VSphere.SUMMARY, &dss)

The constants can just be enums that map to the actual valid string representations. That way API user knows the full extent of the parameters and doesn't have to rely on arbitrary strings.

</comment></comment></comment><comment><USER6> Not sure why this is a "Show HN" post as this is the official VMware govmomi library?

It certainly is worthwhile to look at if you are into VMware and go, but should IMO just have been a normal submission.

<comment><USER7> Thanks. It isn't clear that the submitter is a major contributor to this project, so we've removed "Show HN" from the title.

</comment></comment><comment><AUTHOR> I found this library interesting (as a developer that uses Go and has access to vSphere at work). I'd seen the Python library but this looked easier to use. I'm thinking about creating an OpenFaaS function to clone/list VMs etc.

</comment><comment><USER8> I love the vSphere API. It's solid, complete, well documented (also available in Dash). The only time it's failed to do what was asked is when it crashed because I passed it a null instead of a value, or when there's something outside its control like a network issue. In case it's not obvious: for python there is the official pyVmomi project

<comment><USER9> Wow, I've never heard anyone say anything nice about the API before. In my brief experience with using it via pyvmomi it was almost completely undocumented. Or maybe just documented at such a low level that it didn't help much.

As someone else in this thread mentioned, the libraries are "string oriented" (for lack of a better term), but finding what string to enter is a pain. I'd have to make API call after API call, printing the objects each time, find the string I needed, do another API call to get the next string, and go on and on, like digging into a deeply nested data structure. Compared to AWS via boto, it's hard to imagine not hating the vSphere API, let alone loving it.

But it is good that some people like it, these libraries must be hitting their target market to some extent.

<comment><USER8> There's a 250+ page PDF "Programming Guide" for the vSphere SDK, on top of almost every Object/Type/Fault/Method etc documented, and a built-in API/object browser. What more do you want?

There are community samples for pyvmomi, multiple blogs explaining common use cases etc. But yes, sometimes it's quicker/easier to create thing in the UI and read back the values.

Maybe my standards are low.

EDIT: I also don't understand your "string oriented" comment. Do you mean the object IDs (MOIDs/morefs)?

In pyvmomi you can do this:

      vm = vim.VirtualMachine("vm-1297")
      vm._stub = service_instance._stub

You now have a VM object, not a string.

      vm.RebootGuest()

etc (yes you need some helper methods to lookup things by name etc, but various things by name are not unique)</comment></comment></comment>