Main is usually a function – when is it not? - <AUTHOR> https://jroweboy.github.io/c/asm/2015/01/26/when-is-main-not-a-function.html <comment><USER2> The reason that I use C many of times is not because of its speed but because it (almost) completely reveals it inner working even when there is clear reason not to do so.

(1) Though it is bad for most of time but still I feel more contended sometimes with it, especially for complex code.

(2) Even if this transparency is at superficial level with optimising compilers, but there are very few high level optimisation applied to C code and that too in the form of loop unrolling, tail call optimisation, loop interchange etc.

<comment><USER3> For this type of stuff, I rather use a Macro Assembler.

<comment><USER4> For this type of stuff, I use... _NOTHING_. _NOTHING AT ALL_. I DON'T DO IT. _BECAUSE IT IS INSANE_.

Gloriously, wonderfully insane, though. My compliments to the chef.

</comment></comment></comment><comment><USER5> Reminds me of this 'Hello World': [http://stackoverflow.com/questions/15182496/why-does-this- co...](http://stackoverflow.com/questions/15182496/why-does-this-code-using- random-strings-print-hello-world)

I bet these two ideas would go well together.

<comment><USER6> The seed for the random number generator is not executed though.

<comment><USER5> I was thinking more along the lines of making the main function (array) call some other function which does this in such a way that it looks like you implemented a random number generator but it actually prints "Hello World". And you could hide the fact that 'main' was a piece of code by making it the initial seed for for the random number generator and using macros in a separate header file to rename it to something like 'SEED'.

</comment></comment></comment><comment><USER7> Next challenge... make it a real string!

[https://0xcd80.wordpress.com/2011/04/29/linux-x86-shellcodin...](https://0xcd80.wordpress.com/2011/04/29/linux-x86-shellcoding-104/)

[https://code.google.com/p/alpha3/](https://code.google.com/p/alpha3/)

<comment><USER8>
      const char main[] =
        "UH\x89\xe5\xb8\1\0\0\0\xbb\1\0\0\0g\x8d"
        "5\x10\0\0\0\xba\r\0\0\0\xf\5\xb8\x3c\0\0\0"
        "1\xdb\xf\5Hello World!\n]\xc3";

<comment><USER7> I should have been more clear -- something more alphanumeric than ASCII.

</comment></comment></comment><comment><USER9> Not sure the title's question was answered. At the end he just said _" And all this time we've been ignoring the warning message about main not being a function :)"_

I remember 20 years or ago writing my first C/C++ function where I popped out to inline ASM. I was like, wow! I'm in complete control of this box! (It was mostly copied code. My ASM-foo is weak) I really liked the fact that I could either code in these really abstract types -- or be concerned with what the stack looks like on entering a function. So I _think_ I know the answer to the question.

Instead of ignoring the error, I was thinking that you could just mangle the link file and make the entry point whatever you want, right? I could have a program that consisted of "void x", then continue along the lines of the articles with the number list.

Heck, once you start pulling the threads apart like this, the entire structure falls apart. Your source code could look like anything you want it to look like. And that's cool.

</comment><comment><USER10> I believe you could get around the problem of finding the address of the string by pushing 4 (8?)-byte pieces of it onto the stack and then doing "mov esi, esp".

On the topic of "executable ASCII", the EICAR test file is an interesting example: [http://en.wikipedia.org/wiki/EICAR_test_file](http://en.wikipedia.org/wiki/EICAR_test_file)

<comment><USER11> There is another known trick :

Place your string after a "call" instruction, then when you are inside the call, the address of the string is on the stack, you can pop it in any register you want.

</comment></comment><comment><USER12> I like this little project of how one person delved into the fun.

But as far as the TA goes, most people who have an interest in C and programming will look at the source and say to themselves "Oh, byte values of machine code being executed, yes very clever but do the assignment again properly."

<comment><USER13> If that is the case then the education system is thoroughly broken. It is obvious that a person who took the time to do that learned far more than they would than had they copied one of millions of Hello World examples from the internet.

That being said, I wouldn't rule out a bored TA opening the file not seeing a printf and assigning a grade based on submitting something.

<comment><USER14> Not at all; TAs are paid poorly, have other more interesting work (i.e., their research) to do, and spending the time to deal with 'clever' is not a good usage of time. Sure the student learnt more, but that doesn't mean this is what they should have handed in. Have fun on your own time, but don't waste the TAs time.

<comment><USER13> We might have to agree to disagree. If TAs aren't interested in students diving deeper into the course material then I'm not sure they should be paid at all.

But perhaps the less radical approach would be to pay them enough such that they can take the time to judge the work on it's merit.

<comment><USER14> >But perhaps the less radical approach would be to pay them enough such that they can take the time to judge the work on it's merit.

I assume you have not TAed: I'd like to agree with you, but the realities are it is poor pay for crappy work. Most students don't care about their work. Most students seem to be unable to follow basic instructions. I go out of my way to help students if they care and stay late at labs for these students, but I have no patience for wasting my time because someone wants to show off and deliberately make my life harder. As is, when I'm being paid for 6hrs of lab + marking/week, and I am already spending 8+hrs a week because students can't format their assignments properly, don't write in complete sentences, etc, I have zero interest in patting this guy on the back. Instead, I have to do more work for no pay so he can feel clever.

</comment></comment></comment></comment></comment><comment><USER6> I wonder if one could write a header file containing definitions that would make the following possible.

      char main[] = {
      	movl(1, eax),
      	movl(1, ebx),
      	movl(message, esi),
      	movl(13, edx),
      	syscall(),
      	movl(60, eax),
      	xorl(ebx, ebx),
      	syscall(),
      };

Obviously there are some technical difficulties like handling literal values and code sections, but it could be a fun hack, and I've love to see what someone could come up with.

<comment><USER15> It's possible, but once you're not obfuscating the code - and already depending on OS details when you assume that global data can be executable, whether const or not - I think you may as well just use the inline assembler feature of your compiler. Well, if there is one... MSVC bizarrely doesn't support on x86-64 what was a perfectly good feature on x86.

<comment><USER16> It's not bizarre: inline asm hurts performance and requires more effort from compiler authors than is worth it in our modern age of intrinsics.

<comment><USER15> I admit I'm not too familiar with the old MSVC inline assembly system, but the way GCC/Clang do it certainly allows emitting identical code to what you can get with intrinsics, although using naive constraints might hurt you. However, the main reason I personally use inline asm is not for performance, but to access instructions which are not provided as intrinsics or require special register handling. For example, I recently wrote some code that did syscalls directly (because it was patching memory so the normal syscall functions might not be accessible); I could have linked a separate .S file, but inline assembly made the output look much nicer. Or, while I haven't written this myself, it can be used to write out nops which zero-cost tracing facilities will then patch, something which separate assembly files cannot do.

As for effort from compiler authors, I'd like to hear more about why it is supposedly so hard. (MSVC is also the compiler which has to prioritize their choice of C++11-17 features to implement over the years, while the competitors have _complete_ C++11 and 14 implementations. I guess that's somewhat ad hominem on the team, but ...)

<comment><USER16> Theoretically they lead to identical code, but I believe a block of inline ASM results in constraints on surrounding code and prevents some types of compiler optimisation.

</comment></comment></comment></comment></comment><comment><USER17> See also [http://www.ioccc.org/1984/mullender.c](http://www.ioccc.org/1984/mullender.c) (30 years ago). Hint at [http://www.ioccc.org/1984/mullender.hint](http://www.ioccc.org/1984/mullender.hint)

<comment><USER18> Not having access to a PDP-11 (maybe this works on an emulator?) is it cheating to ask what the output of this program is?

<comment><USER17> According to [http://www.ioccc.org/faq.html](http://www.ioccc.org/faq.html), it is equivalent to

      main(){
        int i=512;
        do
          write(1,"  :-)\b\b\b\b",9),usleep(i);
        while(--i);
      }

So, it moves a smiley on the screen, at increasing speed.

</comment></comment></comment><comment><USER19> I'm impressed with the authors efforts, and share much of his pain when it comes to doing weird things with C.

For other obfuscated fun, see this poem/tree printer in 505 bytes[0], or this program:

        main(G){10<putchar(11^--G?89-(0x1F&2846984999544829581>>5*G):10)&&main(2+G);}

[0] - [https://github.com/lelandbatey/tiny_tree_printer](https://github.com/lelandbatey/tiny_tree_printer)

<comment><USER20> OK, your one-liner is simple enough that maybe it's worth a few minutes to unpack it here.

Let's begin with that big constant. The values of

      89-(0x1F&2846984999544829581>>5*G)

for successive choices of G are: 76 69 76 65 78 68 66 65 84 69 89 74 87. "Obviously" these are character indices; the characters are L,E,L,A,N,D,B,A,T,E,Y,J,W. (I remark that Leland was the first name of the founder of Stanford University and conjecture that the author of the code works at, or studied at, Stanford. And then I look up at the username of the person who posted it and feel a bit stupid.)

Now, what's the argument to _putchar_? It has the form

      11^--G ? thing1 : thing2

so it decrements G, and then if the result is anything other than 11 it evaluates thing1; but if the result is 11 it evaluates thing2 instead. In this case, thing1 is our LELANDBATEY generator and thing2 is 10 (= newline).

So far, so good. One more step out. What comes before the && inside _main_? It looks like this:

      10<putchar(stuff)

and the return value from _putchar_ is (barring I/O failures) the same as what's fed into it. So, putting the above together, when G isn't 12 we'll decrement G, write out a character from LELANDBATEYJW (indexed by G), and this thing will be true; when G _is_ 12 we'll decrement G, write out a newline, and this thing will be false.

Nearly there. Now the whole thing looks like

      main(G) { thing_above && main(2+G); }

so when G isn't 12 it will decrement G, write out a character from LELANDBATEY, and immediately call _main_ with G+2 (which is 1 more than G started out as); but if G is 12 on entry to _main_ it will decrement G, write out a newline, and then return (perhaps to a previous stack frame which will also return, and so on until exit).

OK. So, I guess this program is intended to be invoked with no command-line args. Then G (= argc) will be 1. We'll write out characters 0, 1, 2, ..., 10 of the LELANDBATEY string (getting exactly that far) at which point G will be 12 on entry to the next _main_ call. Newline, exit. Done.

(In case it isn't clear: it outputs "LELANDBATEY\n".)

No offence, I hope, but this is _really tame_ compared with typical short- short IOCCC entries. Here's an example from the 22nd IOCCC. It's short enough to tweet.

      char a;float b,c;main(d){for(;d>2e3*c?c=1,scanf(" %c%f",&a,&c),d=55-a%32*9/5,b=d>9,d=d%13-a/32*12:1;a=2)++d<24?b*=89/84.:putchar(a=b*d);}

See [http://www.ioccc.org/2013/endoh3/hint.html](http://www.ioccc.org/2013/endoh3/hint.html) for more about this; it interprets tunes written in a simple musical notation and generates raw audio data.

<comment><USER19> The one-liner I posted is really meant to be just understandable enough to someone who's taken a solid first year computer science course with C and is looking for more. At least that's where I was approximately when I first found it. So yes, it's mean to be tame, more of a brainteaser than indecipherable.

Also, I wrote a program to generate these. So here's one for you:

        main(O){10<putchar(5^--O?77-(31&2278424678>>5*O):10)&&main(2+O);}

In fact, I originally found this style of tiny C program on Hacker News nearly two years ago. Here's the link to the original: [https://news.ycombinator.com/item?id=5524428](https://news.ycombinator.com/item?id=5524428)

</comment></comment></comment><comment><USER21> I remember something similar that enabled you to embed machine code in VB6 programs, which involved a magic constant that was sort of an entry point into a string containing opcodes. I don't remember the specifics, it's been a while, but nowadays it's very likely a horrible no-go anyway because you're executing data.

Still, was a nifty trick that allowed you to get more performance out of a language that wasn't very fast to begin with.

<comment><USER22> I remember QuickBasic (the precursor of VB: VB 1.0 was effectively QB 8.0) had a CALL ABSOLUTE statement, which let you execute machine code in a string. I used it to great effect in graphics demos, once upon a time.

</comment></comment><comment><USER23> Wait, what kind of company forces one of their programmers to take an intro level comp sci course? If you're going to let people hire someone to do a job, maybe you should either trust their judgement or have someone senior work with them to fix obvious defects?

I don't know, something about that just didn't sit right with me.

<comment><USER24> That's almost certainly not what happened here. He was probably doing a Masters or something in a related field which had this requirement.

</comment></comment><comment><USER25> On a possibly comparable note: in C++, programs can be run entirely from the constructors of static global objects ... letting one write a program with

      #include "X.h"
      X x;
      void main(){}

</comment><comment><USER26> This is very cool. For the next assignment, work in a Duff's Device.

[http://en.wikipedia.org/wiki/Duff%27s_device](http://en.wikipedia.org/wiki/Duff%27s_device)

</comment><comment><USER27> I recall from somewhere:

       int main = 0;

This code compiles (cleanly!), but segfaults.

<comment><USER6> I think that sets the address of main to NULL, so it segfaults as soon as `_start` jumps to `main`. It's known for being one of the smallest compilable C programs.

EDIT: Your original post contained

      int main=0;

<comment><USER15> Not quite - what matters (normally) is the address of the symbol, not the bytes located there, since in the case of a real function those bytes would be the instructions. So this will either execute the bytes at &main as instructions (4 zero bytes, and whatever follows), or, more likely, crash due to memory protections, as described in the article.

<comment><USER28> Yup. You can get a working program with the simple:

      const int main = 0xC3;

...which is just a return. Or you can get fancy and make it exit successfully by clearing eax first:

      const int main = 0xC3C031;

</comment></comment></comment></comment><comment><USER29> > My problem solving process is typically the same thing I imagine most > programmers do.

I'm afraid I may be a victim of Poe's law here, but this attitude is... distressing. It completely discounts the value of problem solving, which, once upon a time, was the entire point of the profession.

<comment><USER30> It does not. It just moves what "the problem" is.

An example of that is the article itself which leverages the gained information from SO to solve the real problem.

Also arcane knowledge is not the same thing as problem solving.

<comment><USER29> > If not solved, try a different query and repeat.

I'm not sure if you even bothered to read the article... since that was the very next sentence. I, too, wanted to give the author the benefit of the doubt and assume it was mere information gathering, which is a good thing, but the next sentence shows that the intent is to solve the problem from start to finish with Google.

</comment></comment></comment><comment><USER31> In python it is still a function but it is also an object?

<comment><USER32> Well more properly python doesn't have a "main" function. You just directly execute the initial script, which will import other modules, define functions and classes, etc, and finally (hopefully) execute something.

</comment></comment><comment><USER33> Wouldn't this be considered academic fraud? His coworker turning in code that he didn't write?

<comment><AUTHOR> Probably not, since this isn't a case where my co worker can just copy paste my code and hope it works for two reasons. The first is I am not entirely sure their testing environment is using 64 bit linux, it could be 32 bit linux since I'm not in the class, I just assumed its 64bit so I could test it on my machine. The next reason is they don't actually have a Hello World assignment at all! The reason I wrote this article is so I could share something I learned, and my co worker (who has already completed the first half of the semester's assignments) could use this as a starting point for how to write his own version for an assignment.

<comment><USER34> > The first is I am not entirely sure their testing environment is using 64 > bit linux, it could be 32 bit linux

Maybe it's ARM, or MIPS, or… Followup problem: write a sequence of bytes that performs a jump on one architecture, and something harmless or reversible on the other(s).

</comment></comment></comment><comment><USER35> Not working on Mac, but I'm gonna tweet it anyway :)

<comment><USER36> I spent a bit getting it to work on OS X. The ASM becomes:

        movq $0x2000004, %rax  ; // BSD syscalls are divided into classes.
        movq $1, %rdi          ; // 64-bit registers use %rdi instead of %ebx
        lea message(%rip), %rsi; // Relative Address of message
        movq $13, %rdx         ; // Same Length
        syscall                ; // x86-64 ASM syscall

        movq $0x2000001, %rax  ; // Exit Syscall
        movq $0, %rdi;
        syscall

        message: .ascii "Hello World!\n";

<comment><USER37> Nice. Thx.</comment></comment></comment>


Delta built the more efficient TSA checkpoints that the TSA couldn't - <AUTHOR> http://www.theverge.com/2016/5/26/11793238/delta-tsa-checkpoint-innovation-lane-atlanta <comment><USER2> > Rather than having TSA agents use hand-pushed carts to bring empty trays > from the exit back to the entrance of the line, the new lanes use an > automated conveyor belt system.

Every time I travel and I see a TSA agent lumbering back from the secure side with a set of carts I shudder inside. That's got to be one of the most depressingly monotonous jobs.

Forget the massive efficiency angle, you could sell this as a security boost. Rather than having an individual go back and forth through the secure zone, just send the trays in one direction on a conveyor.

> And instead of having travelers stack up behind one another to drop off > their belongings to be scanned, there are five different "divestment points" > so faster travelers can drop off their bags and move on without waiting for > a slower person in front of them.

Can someone explain this? Is it five drop off points inbound into the bag scanner per lane or the entry line splits into five lines after the outer check?

> Delta says it spent more than $1 million on the system, which it thought up > and deployed in less than two months

On a federal budget scale, that's a rounding error.</comment>


Show HN: Checkbot for Chrome, a web crawler that tests SEO, speed and security - <AUTHOR> https://www.checkbot.io/ <comment><AUTHOR> Hi! I'm the developer behind this. Checkbot is a local web crawler that spiders your site for broken links, duplicate content issues, unminified resources, redirect chains, mixed content errors, insecure password forms and 50+ other tests.

There's a guide on the website that explains the best practices Checkbot tests for: [https://www.checkbot.io/guide/](https://www.checkbot.io/guide/). I'm hoping web developers find the extension useful for checking and optimising their sites.

By the way, if you'd rather not grant the permissions needed, you can always open a new Chrome window and sign in to Chrome with a temporary account with the button in the top right before you install. This keeps everything separate from your main account.

Checkbot is free during the public beta right now and I'm looking for any feedback you might have about it and the website. Did you find Checkbot useful? How often would you use it? Can you think of any improvements you'd like to see? Thanks!</comment>


HiddenApp goes AWOL? - <AUTHOR>

Remember HiddenApp, the app which helps vigilante Mac owners find their stolen laptop? It might have gone missing.
Recently a friend noticed a charge on his credit card statement. "Flipcode Ltd" was not a familiar name. A little googling later, it appears Flipcode is the company behind HiddenApp. They had a promo around Christmas 2010 where you could get the app for free, and enjoyed viral fame when someone liveblogged the hunt for their stolen Mac.
Worryingly, HiddenApp appears to have fallen off the radar. They don't have a contact page, but the Privacy page includes a business name and phone number. Sadly for my friend, the phone rings off. The postal address is a PO Box, which though not uncommon, doesn't help us locate them. A Companies House lookup reveals only the address of their online accountants. This wouldn't in and of itself be worrying, unless you needed to get hold of them.
There has been no response, automatic or otherwise, to emails in over a week. The website copyright footer says 2010. The more you let your imagination run away with you, the worse the situation looks. With no blog posts in almost two months, and no activity on Twitter since June 1st (which mentions an address in Watford, UK), @replies have gone unanswered. It's hard to identify any company activity in the support forum.
Whilst HiddenApp may well be alive and well (it seems to function OK), you have to wonder whether it's safe to use a service that itself has gone incognito. Had we not investigated, we might not have discovered the inactivity until it was too late. Indeed, does it even work with Lion?
If security is freedom from care, anxiety or doubt, right now there's enough cause for concern to move away from HiddenApp. Has anyone heard from Flipcode? Should we be moving towards Prey?
Summary:
No email response
 No phone response,
 No tweets,
 No blogs,
 No address,
 No forum activity <comment><USER2> Love Prey. The amount of times I've lost my phone while out and about, to find it was home all along is appalling.

Go with Prey, it's open source so if the company goes, you can still use it.

</comment><comment><USER3> Had never heard of Prey - wish I had! I just removed Hidden off my Mac. I've always been a bit wary of stolen tracking services (inc. Undercover), but the fact this service is open source shows a transparency level not seen from these other companies. Thanks for the tip.</comment>


Building a recommendation engine, foursquare style - <AUTHOR> http://engineering.foursquare.com/2011/03/22/building-a-recommendation-engine-foursquare-style/

<comment><USER2> _By setting some constraints on which scores were significant, it was possible to build the resulting similarity matrix in less than an hour on a 40-machine cluster_

40 machines!?! Wow. We compute our recommendations at Grooveshark in a couple hours on a crappy 2-node Hadoop cluster. hah. We have about as many songs as they have venues, so I have no idea why they need so many nodes. Or maybe we're just extraordinarily harsh in our constraints. I loved this writeup though. Its great to see how other companies tackle these difficult problems.

We also have that problem of a "cold-start" and another one which we call the "coldplay" problem. For them it would be something like McDonalds I guess.

<comment><USER3> For the "coldplay" problem you may want to use an inverse band frequency weighting (much like in IDF for text). Bands that are extremely popular won't give you any useful signals. As far as the cold-start... yep, that's a beast and using social data may help. For example, are you using stuff from Facebook/Twitter once you have users sign in? You could crawl out band/artists name from their data.

This gives me an excuse to try grooveshark. I've been curious for a while. :)

update: I didn't see any recommendations based on what I've like on Facebook or Twitter. This would be a good "warm" start. Note: I'm working on stuff like this, but don't mind sharing this simple idea. :) Quora does a great job of this pulling in data from your Twitter network.

</comment></comment><comment><USER4> Very cool.

10M venues is a lot, and a really hard to believe number.

For example, Yelp lists ~13k restaurants in NYC (3.5k in Chicago, 4.5k in SF)

In the top 10 categories for venues, Yelp NYC has 40k VENUES (restaurants, shopping, food, health, spas, nightlife, and some more).

Either 4square has 250 cities like NYC, a fundamentally different definition of what a venue is, or Yelp is SERIOUSLY missing a lot of places (like on the order of getting only 10% of the venues in each city).

People have written about the data sparsity problem in the Yelp dataset as compared to Netflix (<http://www.stanford.edu/class/cs229/proj2009/Fennell.pdf>) for using CF techniques, I'm very interested to hear what people will think about the 4square implementation.

I'm skeptical, but I really hope it works, because I have very average food far too often on recommendations from friends with dissimilar palates...

<comment><USER5> Foursquare has way more places in their database, based on my usage of both Yelp's and Foursquare's iPhone apps.

Yelp is based on reviews of businesses. Whereas Foursquare is based checking into places. Therefore, Foursquare's domain is much larger.

I'm not sure if Foursquare or Yelp add places to their database or if it's 100% user-driven. In Yelp's case, it takes more effort to add a place becuase you need to (or at least you feel like you should) also write a review. Whereas for Foursquare, you can just add your home. Or "RainApocolypse 2011," of which I am two days away from becoming the mayor.

<comment><USER4> Reduced friction for adding places is a plausible reason for why 4square might have more venues, but what I was getting at is the order of magnitude of the difference.

10 MILLION places is a ton. Like I said above, thats like 250 NYC's. Even given 4square's reduced friction to add venues, the fact that they've probably launched in more cities, and inclusion of arbitrary venues ("Hey I checked in at the tree that's 10 paces west of my house!"),

I don't think 4square is lying. Now I'm just wondering how useful those venues are. (I am also pretending that Yelp has better than 10% coverage of venues that users care about). Incidentally, either way, you've got to think that 10mm venues has to wreck the data sparsity problem as well.

For reference, the venue count of 3 large american cities:

\- NYC 47228 \- SF 38656 \- Chi 19079

I'd be surprised if Yelp had even 1.5mm venues. Would love if someone could corroborate/dispute this fact. While there is certainly a disparity between the two and Yelp, I'd imagine that the "useful" venues (those that people want recommendations for) aren't your home or rainapololypse2011. Adding those into the dataset actually makes 4squares job _harder_ with respect to teasing meaningful data out of the dataset.

If my phone ever recommends your house though, I just may come a knockin'.

</comment></comment></comment><comment><USER6> Regarding the issue of user-based feedback ranking (the Per Se vs. Shake Shack problem), it may not be such a negative thing to have results skewed due to "unequal" ratings. Culinary ratings often are a result of many factors that civilian diners may not consider necessarily important or even relevant. Looking to Foursquare to show search results based on user approval, which often is submitted on a knee-jerk reaction after dining, may be the best thing for a prospective diner. After all, Per Se and Shake Shack may have 5 stars rewarded to them by the same diner, but unless this diner is making hundreds of thousands a year (or is Thomas Keller), they would likely recommend Shake Shack as the spot to eat to their Foursquare friends. To me, hedging this data will end up producing results along the lines of more traditional culinary recommendation systems, and may be devaluing the Foursquare recommendation engine.

</comment><comment><USER7> Anyone else used Mahout? What are your experiences with it?

<comment><USER2> We tried using it a while ago when it was first getting started. It was a pain to use back then but afaik it has advanced quite a bit and after seeing this post I'll be taking another jab at it. If you want an out-of-the-box recommender, Mahout is good while providing many other Machine Learning algorithms that can be run at scale.

You definitely need to have some technical knowledge though. One thing that I don't like about things like this is that if there is a bug and you don't understand the software (or the math) you won't be able to troubleshoot.

This is why I tend to write my own for the specific task at hand.

<comment><USER8> Agreed, it has a very steep learning curve. Once you understand it (and understand how to think in map-reduce), it's pretty awesome -- and easy to extend. Rolling your own definitely makes the learning curve easier, but you can miss out on some of the M-R efficient algorithms that are built in it.</comment></comment></comment>


Show HN: Askama – Type-safe, compiled Jinja-like templates for Rust - <AUTHOR> https://github.com/djc/askama <comment><USER2> There's also Bart ([https://github.com/maghoff/bart](https://github.com/maghoff/bart)), inspired by Mustache. Like Askama, it's typesafe and compile time generated.

<comment><USER3> Hi! I'm the author of Bart. AMA :)

Askama and Bart seem to be pretty similar in use (compile time, based on a struct definition) except for the template languages. Askama is rich, while Bart, like Mustache, is deliberately more restricted. ("Logicless", they would call it. I don't know how to quantify that.)

</comment></comment><comment><USER4> I just wish rocket and diesel got the new tokio goodness, then Rust will probably replace flask in my workflow.

<comment> d--b wow, I must have missed a generation, I have literally no idea what you're talking about.

<comment><USER5> [http://tokio.rs/](http://tokio.rs/) : async io

[https://rocket.rs/](https://rocket.rs/) : a web framework

[http://diesel.rs/](http://diesel.rs/) : ORM/Querybuilder

</comment></comment></comment><comment><USER6> Django/Jinja/Stencil should be the de facto standard for all templating systems so developers can port their work to any platform without sweat.

Kudos for porting Jinja to Rust.

<comment><USER7> Jinja yes, django not so much.

<comment><USER8> It's essentially the same syntax

<comment><USER7> Kind of but not really, Jinja let's you do a lot more. {{(x or y)|filter(z)}} for example, or even just {{function(a, b, c)}}.

Django is far more restrictive in what you can put between the braces. I think one of the design goals of it was that designers with little programming knowledge could write the templates, which is a noble idea but leads to frustration as anyone who has maintained a large django app will tell you.

<comment><USER9> I think part of the motivation for the limitations was to stop people from putting too much business logic in their templates. You can of course implement any kind of tag or filter you want and just use that. Or indeed just use Jinja if you want. Django's templates are perfectly fine and I still prefer them over the similar alternatives.

<comment><USER7> Yeah, I understand the motivation but it doesn't help when you just want to call a model method with just a single argument.

They are also dog slow :(

</comment></comment></comment></comment></comment></comment><comment><USER6> > Because Askama will generate Rust code from your template files, the crate > will need to be recompiled when your templates change.

Being Swift a compiled language just like Rust, why can we modify the templates (Stencil, Mustache) in Swift without recompiling the app but not in Rust?

<comment><USER10> Stencil and Mustache do that because they _don 't_ compile to Swift, but load and parse templates dynamically. That kind of template language implementation of course exists for Rust as well. (And the other way round, you could have a system that's like this submission for Swift, if there isn't one already)

<comment><USER6> That's exactly the point, why do that in Rust when it can be done without the need for compiling it? That's the explanation I want to hear. Having to recompile the whole app just to test changes in the template is absurd in my handbook.

<comment><AUTHOR> My main reason was type safety; getting early feedback from the compiler is really valuable to me.

I don't see compiling them as a big downside, either. What problems do you see with that?

Tera ([https://github.com/Keats/tera](https://github.com/Keats/tera)) exists already if that's more your cup of tea.

</comment></comment></comment></comment><comment><USER11> This looks awesome, if I'm understanding this right there's type checking with the template at compile time(I.E. if "name" in the template isn't found in the Rust struct it's a compile failure).

<comment><AUTHOR> You understood it right.</comment></comment>


Redis as an LRU cache (and the mystery of port 6379) - <AUTHOR> http://antirez.com/post/redis-as-LRU-cache.html

<comment><USER2> Be sure not to check some photo if you're at you're office.

<comment><AUTHOR> added a warning about the not-safe-for-workness of photos. thanks.

<comment><USER2> Is there a charity or a cause you like that we can donate to to thank you for Redis?

<comment><AUTHOR> Thank you tptacek, this is definitely a cause that I like:

<http://en.wikipedia.org/wiki/Emergency_(NGO)>

</comment></comment></comment></comment><comment><USER3> LRU = Least Recently Used

wikipedia link: <http://en.wikipedia.org/wiki/Cache_algorithms></comment>


'Sign in with Apple' button terms and conditions are raising concerns - <AUTHOR> https://9to5mac.com/2019/06/05/sign-in-with-apple/ <comment><USER2> WOW!

> Sign In with Apple will be available for beta testing this summer. It will > be required as an option for users in apps that support third-party sign-in > when it is commercially available later this year.

As an Apple user I like this a lot but damn... That is going to ruffle some feathers. Does this mean Spotify must now offer a signin with Apple button? (since they do FB signin)

</comment><comment><USER3> I've been reading a lot of discussion about the Apple Sign In in the past few days and none of the comments mentioned the following: if you use Apple Sign In, you will only be able to use it to access your account(s), because it will (if I understood correctly) generate different email addreeses for each OAuth consumer service. Right now, if I want to, I can log in using either Google or Twitter as long as the web app supports it, because Google and Twitter both give the service the same email address. Now, I realize the whole point of this is giving more privacy to the end user, but it also locks in the end users to use only Apple Sign In for all services they logged in once via Apple Sign In. As somebody mentioned it already in a different thread, it would've been so much better if there was an open standard for this...

</comment><comment><USER4> As others have said, what Apple is doing here isn't so much "anti-competitive" as filling a regulatory void with consumer- and privacy-friendly requirements/suggestions -- something that is possible in a practical sense because of their natural monopoly over their own platforms.

<comment><USER5> _"Reuters notes that Apple has a second requirement– sorry, 'suggestion' which goes beyond this.

Apple Inc will ask developers to position a new "Sign on with Apple" button in iPhone and iPad apps above rival buttons from Alphabet Inc's Google and Facebook Inc, according to design guidelines released this week."_

If done by the hand that feeds you, the line between "suggestion" and "order" is fairly thin, and 'order' could be interpreted as misusing the power they have to push a new 'product'.

</comment></comment><comment><USER6> This is going to kill all social network startups. It's almost impossible to go viral without Facebook invite feature.

<comment><USER7> Good. Hopefully we can move past the era of their destructive business models.

<comment><USER6> that means less competition, zuck is probably happy now, he already has all the data</comment></comment></comment>


Letter-heads - <AUTHOR> http://simurai.com/projects/letter-heads/

<comment><USER2> Interesting idea but I was totally caught off-guard by the automatic tweet posted when I clicked on the little birdy in the middle. Really not cool. Deleted the tweet immediately. At least let someone know you're going to be posting a tweet so that they can decide if they're game.

<comment><USER3> Sorry. In the middle used to be a font switcher, but it didn't turn out that well, so I replaced it with a custom tweet button. Yeah, maybe it would be less intrusive to move it to the bottom.

Edit: done!

<comment><USER2> Awesome! Thanks for taking my tip on-board! Other than my initial reaction to the tweet, compliments on a pretty sweet idea!

</comment></comment></comment><comment><USER4> Clever idea.

I think it's based on the artwork [1] of Tim Noble and Sue Webster [2] who create images using the silhouette from scultures made from rubbish.

1: [http://en.wikipedia.org/wiki/File:Miss_Understood_and_Mr_Mea...](http://en.wikipedia.org/wiki/File:Miss_Understood_and_Mr_Meanor,_1997.jpg)

2: [http://en.wikipedia.org/wiki/Tim_Noble_and_Sue_Webster](http://en.wikipedia.org/wiki/Tim_Noble_and_Sue_Webster)

<comment><USER5> The creator [1] says it's inspired by Kumi Yamashita.

[1] [http://simurai.com/projects/2011/03/11/letter- heads/](http://simurai.com/projects/2011/03/11/letter-heads/)

<comment><USER4> Yep, so it is.

[http://www.kumiyamashita.com/portfolio/profile/](http://www.kumiyamashita.com/portfolio/profile/)

</comment></comment></comment><comment><USER6> Pro tip: looks like refreshing the page gives you different faces.

I wonder if these are pre-compiled or is there some algorithm at play that makes these dynamically?

<comment><USER7> You don't have to refresh the page, you can just click again to get a different face.

</comment></comment><comment><USER8> Very interesting! Would love to read about how you did this.

<comment><USER3> The source is on GitHub to check out: [https://github.com/simurai/simurai.github.io/tree/master/pro...](https://github.com/simurai/simurai.github.io/tree/master/projects/letter- heads)

To create the head shapes, the position and rotation of each letter is defined with CSS transforms (see heads.css). To get the right values, it's mostly trial and error. But to make it a bit easier, I created a little helper script that let me drag/rotate each letter with the mouse and then copy the value to be used for those CSS transforms.

</comment></comment><comment><USER5> [2011]

</comment><comment><USER9> Seems like a genetic algorithm would be a great fit to produce a letter arrangement given a target silhouette

</comment><comment><USER10> Just when you thought you knew it. BAM...something new!

</comment><comment><USER11> Worked surprisingly well on mobile!

</comment><comment><USER12> Very cool!

</comment><comment><USER13> Extremely well done!

</comment><comment><USER14> _mind-blowing_</comment>


Apple's New CarPlay Turns Cars Into iPhone Accessories  - <AUTHOR> http://techcrunch.com/2014/03/03/apples-new-carplay-system-will-turn-tens-of-millions-of-cars-into-iphone-accessories/

<comment><USER2> More specifically, it turns cars into yet another piece of expensive vendor lock in. Could they have developed an open standard for sharing touch screen and display events? Yep. Will they instead lock it all away behind patents?</comment>


Postmortem on yesterday's joke site, 4000 unique visitors in 18 hours - <AUTHOR> http://ianterrell.com/post/4633273692/what-ive-learned-from-blankdd-com

<comment><USER2> good post with insights on the site traffic etc..appreciated the rails/heroku discussion. What is with the hacker submissions tho!? submitting drop table lines etc...geez ppl....whyyy

<comment><AUTHOR> Everyone's gotta get their lulz somehow. :)</comment></comment>


SEOMoz - <AUTHOR> http://hn-books.com/Books/SEOMoz.htm <comment><USER2> How is this still getting upvoted, it's practically unreadable borne out as no-one's commented on it.

The hn-books.com posts are starting to feel like a spam site now. All the links on the site are bit.ly to hide that they're referral links. Stop breaking the web, url shortners are there to work around twitter deficiencies.

<comment><USER3> Warning: my reply is a bit strong, but it's aimed at the community and not at your, relatively mild, complaint.

I have an issue with the way people define "spam" as anything they don't like. Spam is a real and serious problem, and we dilute the importance of fighting it when we call anything remotely commercial as spam.

A blog has the right to make money. How? Typically ads and affiliate offers. As long as there is disclosure for both, I see nothing wrong with their use. OP wrote a review of a product and then submitted it to HN. People liked the review and therefore up-voted it. I think that's totally fair. Or are you suggesting that the OP is gaming the site?

The lack of comments may be explained by the fact that people didn't have much to add about the product, they are afraid of being labelled as SEO people, or they are simply toying with SEOmoz after reading the review.

HN-Books.com looks like a site dedicated to (mostly) book reviews. I don't see 10 posts a day from it, so I think it's totally okay.

I'm not crazy about bit.ly either in principle (for the reasons that you said) but again, the OP is definitely within his rights to use that service if he wants. Redirect links can be used for tracking purposes, for convenience, or very honestly for increasing one's conversions rates. Even in the latter case, I fail to see a problem with it.

If you don't like the content, ignore it (and if it's bona fide spam, then flag it by all means). If you like the content, but not the conditions under which it is provided, use AdBlock and don't click on the links. Screaming "spam" every time "commercial-ish" blog entries are posted is uncharacteristic and unbecoming of a community of entrepreneurs.

<comment><USER4> It would be one thing if it was a book review. This is a product pitch page for $99/month SEO monitoring software.

A post I would like to see is how a minimal amount of search engine knowledge + Google analytics can help you more than a $1188/year on an SEO app.

<comment><AUTHOR> Nobody is trying to "pitch" you anything. Take a look in the search tab on the page: this is a product that people on this site already recommend to each other.

The whole purpose of the site was to take things you were already recommending to each other, write up a comprehensive review, put all the information available in one place, and then provide links to get it if you want. The article clearly states that you can do this without using the tool. It also states you can use the tool for free.

The purpose of HN, last I checked, was for people to try out different things and share them with each other. I don't mind criticism. If you have it, bring it. I criticize people all of the time. I want to do better. Please tell me how I'm screwing up.

But when you criticize somebody, the point is to help them make their work better. I am doing this to help the community. If you don't like it, tell me what I can do to help the community in a better way. You want more of a warning about outgoing links? Fine. You want free ebooks reviewed? Fine. You want step-by-step instructions on how to use tools that startups use? Fine. Don't want any kind of commercial activity? Fine, go ahead and suggest it, but I'm going to tell you to go climb a tree. But don't just throw out snarky comments and imply things that aren't true about somebody's else's character and reason for doing something. That really sucks.

I have thought about the proper tone for my reviews for some time, and I posted a long blog article about my ethics and what appeared on hn-books or not ( [http://www.whattofix.com/blog/archives/2011/02/media- morals-...](http://www.whattofix.com/blog/archives/2011/02/media-morals- an.php)) To summarize, I only talk about things you guys already use and like, and I only choose things that have a great reputation in the community. That means that there aren't going to be many negative reviews. That doesn't mean I'm pumping, or pitching, or anything else. I'm simply sharing. It is the nature of the site to collect the best of the best.

This thing is a hobby for me. Last I checked, there's a voting system right up top there for things on HN you don't like. So use it. Why so much ugliness? We're supposed to be helping each other. I post something in good faith and folks tell me I'm using bit.ly to hide affiliate links? That I'm reviewing a tool so I can "pitch" it? Come on, guys. We can do better than this.</comment></comment></comment></comment>


Three big myths about MapReduce - <AUTHOR> http://www.dbms2.com/2009/10/18/three-big-myths-about-mapreduce/

<comment><USER2> Strawman. Of course mapping followed by reducing isn't new, nobody serious ever claimed that it was (the Dean & Ghemawat paper certainly doesn't). Systems dedicated to performing map-reduce operations using giant clusters of commodity hardware over tera/petabytes of data are, though, if for no other reason than that the presence of and resources to economically store that much data have only recently become widely available. MapReduce, as a term, refers to those systems, not just the act of mapping and reducing.

</comment><comment><USER3> For the longest time, after I read about MapReduce, I wondered what the big fuss was about. MPI has equivalent functionality (Broadcast/Scatter and Reduce) along with many other useful high-level communication functions. It does restrict you to a limited (and unpopular) set of languages for web programming though.

<comment><USER4> MapReduce is about hiding explicit parallel primitives like threads and MPI from users (programmers): You only need to implement two functions map and reduce in a typical framework.

Yes, you can certainly implement MapReduce with MPI partially, but typical MapReduce framework like Hadoop also handles fault tolerance _transparently_ to users.

</comment></comment><comment><USER5> Good read:

 _Right now, this is a distinction pretty much without a difference. If you choose an implementation of MapReduce — like pure Hadoop (say in the Cloudera distribution) or Hadoop-Vertica or Aster Data's SQL/MapReduce – you're basically picking an entire technology stack. But those stacks are going to do a whole lot of changing and maturing in the near future – and as they do, it's likely that projects will interact or even combine in all sorts of interesting ways._

</comment><comment><USER6> A good point, but while Map Reduce is not new I feel it emphasized clarity and simplicity (at least for the problem of sorting), so that is probably why it markets easier than MPI or a database. I wrote a bit on this point some time ago: [http://www.win-vector.com/blog/2009/01/map-reduce-a-good- ide...](http://www.win-vector.com/blog/2009/01/map-reduce-a-good-idea/)</comment>


Inside a Chinese iPhone Factory - <AUTHOR> http://www.wired.com/gadgetlab/2010/11/foxconn-photo-gallery/ Contains pictures of the dorms where workers live. <comment><USER2> Sort of misleading title, more like "Inside a foxconn dorm"

an aside, it's a bummer that the photos, which appear to be 500px wide, are resized in the webpage to be 1000px wide making it look totally janky.</comment>


Joining a Startup Out of College is Hard (A Solution) - <AUTHOR> http://www.azeem.fm/2010/04/22/startup-out-of-college/

<comment><USER2> For most people, joining a startup as an employee straight out of college is a pretty bad career move these days. Your first job has an enormous effect on what options will be available to you down the road. A brand-name company like Google on the resume will open doors that a (likely failed) startup no one has ever heard of simply won't. You can always join a startup or found your own company later.

Prior to the dotcom crash, you could at least justify a startup on the potential upside, but with today's meager buyouts and non-existent IPO market even founders don't always end up with a life-changing payout. Employees should expect nothing.

<comment><USER3> Nah. It depends on what kind of career you want to go into, but the very best time to get into a startup is straight out of school. You don't have a family, or a house, or any of the other baggage that necessitates a steady paycheck and solid job security.

What kind of opportunities do you think you're passing up? If Google or Apple or Microsoft want you, you can always go back and reapply after your start up experience. Interesting doors open all the time.

My first 4 jobs were with startups, my career is fine, even though almost no one has ever heard of the tiny awesome companies I helped to build. I have little kids that need me around, so I found a steadier job in more established organization (which took exactly one resume, and one interview), but I plan on going back into the start up world when they're older.

<comment><USER2> YMMV, but in my experience resumes with 'top-shelf' names like Google or Microsoft on them almost always get a second look during the hiring process, even at startups. Hiring is an inherently uncertain process - association with success is usually taken as a proxy for quality. Of course, if your resume doesn't make the first cull you're not likely to find out why.

I worked for a couple of startups out of college. I agree that it's the easiest time to work for a startup, but it's also when you're likely to get the least out of the experience. Junior startup employees have no upside, typically below-market compensation, and don't tend to get the business experience required to start their own companies. Also - and perhaps I'm being cynical - but in hindsight I'm a bit leery of any startup that hires completely inexperienced staff. A startup is distinguished from a small company by its ambition to grow quickly. Hiring staff straight out of college means the company is prioritizing cash over growth, which suggests the founders are either short on capital or simply short-sighted. Neither bodes well for the company's prospects.

IMO, the best path for someone interested in startups is to work for a 'prestige' company out of college. Get some experience, build up a bit of capital, and find your co-founders. A successful tech company is the best environment to do that, and association with success will also make raising money easier.

</comment></comment></comment><comment><USER4> This seems more like a complaint from ivy league college grads about lack of wealth in the technology sector compared to the finance sector. Color me unimpressed.

<comment><AUTHOR> I don't really see it as a complaint. I'm just mirror-ing what I hear from a lot of people I went to school with; I work at a startup now and I love it. But I know that to attract the "ivy league" talent, or any talent for that matter, it is ideal to appeal to what they know.

And frankly, I think there is more than enough "wealth" distributed amongst VC funds to subsidize some portion of a kid's student loans for a year or two. Is that really that much to ask?

I just want more of my former classmates to be in technology, because they are really smart, and their talents get wasted at high frequency hedge funds and investment banks. So how do you get them? That's what I'm trying to answer; passion is a big part of it, but some people need a hook or starting point.

<comment><USER5> > _"passion is a big part of it"_

Right, and having known a lot of the "Wall Street" type engineers in college, I'm not sure if I really want them in my field.

Yeah, they're smart and bright (you kind of have to be in those environments), but I know more than a few who went into engineering position at major investment banks - soul-crushing, mind-numbing work that it is solely because of the compensation.

Maybe this is me being too startupy-self-important, but that speaks to a complete lack of passion, that you're willing to take on the IT equivalent of coal mining, where the only real upside to your job is the gigantic paycheck. On this side of the divide I'd rather have people who place an utmost importance in the, well, _work_ of their work - someone who will take a high- paying, rewarding position over a ludicrous-paying soul-crushing job.

This isn't some justification to pay people less - if we can sweeten the pot for new grads I'm all for it, but I'm not sure I really want to attract Wall Streeters to our side of the industry.

<comment><AUTHOR> Agree with a lot of what you're saying, but not all of it; I want whatever it takes to build amazing new companies that change the world, I don't really care who's doing it, as long as more phenomenally smart people are.

<comment><USER5> I disagree immensely - there's a certain mindset and culture that has contributed to the high-tech society that we see today. IMHO it is championed and built by people who care immensely about changing the world with their skills for the better, oftening making great personal sacrifices for their vision - this is a poor fit for someone who is demonstrated himself to be purely a gun-for-hire.

Phenomenally smart people spam people too, scam people also. Just because you're smart doesn't mean I want to work with you ;) There's a certain alignment of goals and values that has to happen, and I don't think that can work with the demographic you're talking about.

<comment><AUTHOR> Eh, can't agree with you here; too many obvious examples to the contrary. A lot of people realize their entrepreneurial streak later in life, I'd like to bring that moment of realization earlier and better institutionalize it as a career path, that's all.

"gun-for-hire"; I mean, we're talking about 22 year old kids at the end of the day right? heh

</comment></comment></comment></comment></comment></comment><comment><USER6> If you're after Brand Value, Security and Compensation, joining a startup is probably a mistake.

You're working at a company no one knows, with minimal money in bank, and compensated primarily in equity.

Basically you'll either join/start a startup, or always find an excuse not to.

<comment><AUTHOR> I disagree, I know plenty of students who just need that initial push.

Also, anyone who has worked at a startup at a junior level knows equity is usually meaningless, and you're lucky if you're getting more than a few bps after a certain point.

<comment><USER3> I don't come from an Ivy league background, but I did join a start-up directly after school instead of joining a more traditional company. I did it because it was interesting and seemed like way more fun, and also I could wear jeans and combat boots to work. Money was not a motivator, and the stock options were, of course, not worth the paper they were never actually printed on.

There are those people who feel the money draw, and that's fine, and then there are those who prefer a different set of challenges. They go to work for non-profits, they join start ups or become entrepreneurs, they take their Columbia degree to the wilderness to count mayfly populations. I'm not convinced a start up would necessarily want to attract the kind of person who prefers money and security.

</comment></comment></comment><comment><USER7> There's deeper issues not addressed by this article - why we've created a culture that so highly values 'brand-name resume builders', for one. And I'd argue that startup compensation needs to be rational even when competing sectors are not. But there's real potential in using the prestige (deserved or not) of a venture-capital firm as a recruiting tool.

As an aside, I hired Azeem at my startup after his post-college gig as an investment banker, and he thoroughly kicked ass as an employee. That doesn't come through in his blog post - I wouldn't want people who didn't know him to think he's still an investment banker!

<comment><AUTHOR> Heh, thanks Greg. I may have not expressed it clearly, but when I say "compensation", I mean something that compels the talent you're hiring away from other industries. I think something like student loan subsidies could be very doable for a VC fund with hundreds of millions of dollars in capital. It sends a strong and serious signal IMO.

I think that's what it's really about, the messaging. It's just easier to market the names of a lot of these VC funds and the experience/track record/millions of $s that come with them, than it is to market their portfolio cos. It's a better hook; and on the other side of it all, venture funds SHOULD care about developing junior talent, and actively building the next generation of founders, entrepreneurs, etc etc. I just can't possibly imagine how any of this ends up being a bad thing.

</comment></comment><comment><USER8> Azeem, I think you highlight an important topic. I joined Wall Street after graduating as well, because 1. It paid well and was "a good job", and 2. Was one of the opportunities that came up to campus and was easy to interview for. Outside of investment banks and large consulting shops, there wasn't much else.

I think the lack of connectivity between college undergraduates and companies that would like to recruit them, but can't easily, is a large inefficiency and needs a solution (I feel so strongly about it, in fact, that I left finance and founded CollegeJobConnect a year ago and have been pushing it forward ever since to provide just such a service).

A startup can be a great place to learn and develop yourself, and when you are just entering the professional world you can take a few risks with your career more easily (no wife, no mortgage, etc.). However, a startup can also be a difficult environment, so any college student needs to do their research before jumping in.

All in all, I believe it will make you a professional weapon and give you the experience and "get it done" skills that you won't find in other roles, but might require a cash give-up in the short term comparatively (consider it an investment in yourself).

</comment><comment><USER9> The part of working at a startup that I enjoy most is not working with I-bank/management consulting type people. My favorite part: "a rotational program between Sequoia's portfolio companies". Hilarious.

</comment><comment><USER10> 'Brilliance' and a degree from a name-brand institution can help one achieve success -- but is no guarantee. Never has been, and never should be.

Our wonderful system of capitalism and free markets make it such that one can bring whatever one has to the table: degrees, IQ scores, grit, sheer experience, connections, and even mere hope. Some are able to be very, very successful by applying only 2 or 3 of these. No single one is a guarantee.

</comment><comment><USER11> Joining a startup out of college is not hard. As I grew up, I went through the educational funnel to these types of jobs (McKinsey, Google, etc) and I found myself disliking the people around me and (especially in the case of finance / manage consulting) disliking the work they were going to dedicate their lives to.

So I just never applied to work at companies I found distasteful. It was quite easy.

<comment><AUTHOR> But you didn't straight out of college, which is my point.

I am in the same boat as you.

<comment><USER11> I'm not sure what you mean. I never applied to any companies when I was in college. I was courted by a few tech startups and almost joined them because they looked interesting and fun - but at the beginning of my senior year I decided I should make money on my own and just started laying the groundwork for that. I basically spent the end of my senior year blowing off classes and iterating through ideas I thought might be profitable. After I graduated, I continued doing that. 2 years later, I have successfully bootstrapped a profitable company.

I don't think your solution will work. The people who should join startups don't prioritize brand value or the alleged security of working for a big company. They may prioritize compensation - but the startup world already answers that problem by allowing you to choose where on the risk scale you want to be (you can always start your own company if you're like me and very interested in compensation).

<comment><AUTHOR> Oh, I misunderstood what you said; apologies.

And I don't know if you're right; I work at a startup, and my search was almost exclusively relegated to VC-backed companies; in fact, manyt of my friends at startups went through a similar thought process. Given that, I would imagine it would work?

Everyone is an entrepreneur, some just need more help than others, that's all I'm suggesting.

</comment></comment></comment></comment><comment><USER12> Student Loan Debt = Why joining a startup out of college is hard (for some)

</comment><comment><USER13> This is the solution: a program where talented young people are mentored by the VC firm, under the condition that they work for startups (as founders or early employees) for the next 7 years. The VC does not necessarily fund their startups, but uses its contacts to ensure that the founder remains employed and able to survive. At the end of the 7th year, employee has the option of joining the VC firm as entrepreneur-in-residence.

People would be less afraid of the career risk involved in starting companies this way.

<comment><AUTHOR> That's a cool idea! I don't know if it works with that timing, and those constraints, but that's such a cool idea, just conceptually.

<comment><USER13> It's an excellent idea, but it has a flaw: it doesn't pay off in the short term. The only think the VC gains is a connection to someone who will be important in a few years.

I'd be pretty much an ideal candidate for such a program, but I'm pretty sure that if I proposed it to a top VC, I'd be laughed out of the conversation.</comment></comment></comment>


Chickens Agree: Left Means Less; Right Means More - <AUTHOR> http://www.nytimes.com/2015/01/30/science/left-means-less-even-for-chickens.html

<comment><USER2> "We cannot think of any other, and simpler, explanation for the behavior of the chicks" Dr. Rugani said in an email.

\--

Is anyone else skeptical about their findings? I am reminded of the Feynman story about the rat experiment by Mr. Young. [http://www.realclearscience.com/blog/2014/02/the_rat_experim...](http://www.realclearscience.com/blog/2014/02/the_rat_experiment_you_dont_know_about_but_should.html)

<comment><USER3> My favorite line from the article:

>The scientists trained 64 chicks to find a mealworm behind a plastic panel with five red squares on it (16 chicks were disqualified after showing "poor mealworm-following behavior," the researchers wrote).

<comment><USER4> agree, the 16 left-winged superbrain chickens with X-ray eyes where disqualified... :-)

</comment></comment></comment><comment><USER5> "a possibility that was raised by some studies that found that in Arabic- speaking countries, where letters and numbers are read right to left, the mental number scale was reversed."

This is wrong, despite Arabic being an RTL language, in Arabic numbers are written, and read [1], in the same orientation as in Latin, Left to right. e.g. So 1,230 is written in the same orientation in arabic.

[1] this applies to all numbers with more than 3 digits. things are a little more complex for 2 digits numbers. As in English and French 12, or 11 are speller as "one word", however 35 in Arabic is spelled five and thirty instead of thirty five.

[2] the "latin" numerals are actually arabic numerals. The current numbers used in Arabic speaking countries are suspected to be of Roman origin according the wikipida article [https://en.wikipedia.org/wiki/Arabic_numerals](https://en.wikipedia.org/wiki/Arabic_numerals).

</comment><comment><USER6> One thing that interests me, though the article and study don't touch on it, is that we as humans tend to visualize our number lines on the X axis (e.g. left and right), rather than the Y axis (up and down), Z axis (forward and backward), or W axis (ana and kata).

I know there are some writing systems in which writing is done up/down rather than left/right. I wonder how that influences the spatial visualization of numbers.

I also wonder whether other species might visualize numbers on something other than the X axis.

<comment><USER7> I heard once[1] that whether people visualize time on a left-right / x-axis or a back-front z-axis correlates to generally how organised they are.

[1]I don't have a source, so consider it "bloke down the pub" reliability.

<comment><USER8> I think that the ancient Greeks envisioned the future coming from behind them. Of course, they didn't have a notion x-axis, did they?

</comment></comment></comment><comment><USER9> Do people from RTL countries visualise numbers the same way?

What about their chickens?

<comment><USER10> In arabic the numbers are written the same way they are in english. This makes it very strange to watch someone type because they are typing from right to left, and then the computer switches from adding to the left to adding characters on the right of the curser when you start to enter a number.

I didn't interact much with Iraqi chickens, so I can't answer the second part of your question.

</comment></comment><comment><USER11> Are chickens generally right footed? Do they have a dominant foot?

<comment><USER12> Don't know, but I've heard all left-wings are chickens.

</comment></comment><comment><USER13> I visualize my numbers in boustrophedon.</comment>


JPMorgan says Bitcoin crash survival shows it has staying power - <AUTHOR> https://www.bloomberg.com/news/articles/2020-06-12/jpmorgan-says-bitcoin-crash-survival-shows-it-has-staying-power <comment><USER2> As a method of barter (and tax evasion via physical cash transactions), yes.

As a method of digital, non-anonymous payments? Bitcoin is definitely not the coin for that.</comment>


One app, one user, one ruby - <AUTHOR> http://blog.arkency.com/2012/11/one-app-one-user-one-ruby/

<comment><USER2> This is a trade-off. "Just use the full path to ruby" isn't a terribly convenient solution, because using the full path isn't the "Unix way". Putting your custom Ruby in the path is helpful, but in a server environment where I would assume you're using a lot of automation, that's going to take some tweaking. Users of RVM know this well.

I guess I don't really understand what the author is advocating? In "production", we don't run multiple apps requiring different Ruby versions on the same VM. Ruby 1.9 has been around for quite a while now, so there's not a lot of fragmentation. We only run one version of Ruby, but we install it to a location that a "stock" environment supports well. Usually it's prefix=/usr/local. Then we treat VMs as disposable containers. I don't build VMs by hand; I let my build tool do that, so upgrading infrastructure versions usually goes something like this:

* Update the build script and test with a local VM

* Build a new staging VM and migrate the staging instance there

* Once we're confident, do the same to production

</comment><comment><USER3> For some time I always create user deploy and install nginx through passenger on rbenv (if there is only one app on server) or create separate user per app and run everything using rbenv+unicorn+nging from apt. Works flawlessly. I can't agree more, that reating chef recipe is step forward.</comment>


My-stack.xyz beta – a list of opportunites all kind of creators - <AUTHOR> https://my-stack.xyz/ <comment><USER2> Content free, typos galore, captures back button. Avoid.</comment>


COVID19 Treatment Guidelines for Belgium,Netherlands,France,Italy,Switzerland [pdf] - <AUTHOR> https://web.archive.org/web/20200314093143/https://epidemio.wiv-isp.be/ID/Documents/Covid19/COVID-19_InterimGuidelines_Treatment_ENG.pdf <comment><AUTHOR> These are the updated (march 13th) interim treatment guidelines applied in Belgium for COVID19.

But the PDF also shows for comparison a clear view of the guidelines applied in Netherlands,France,Italy and Switzerland.</comment>


The United States of Starbucks - <AUTHOR> http://www.ifweassume.com/2012/10/the-united-states-of-starbucks.html <comment><USER2> That's awesome.</comment>


LambdaPiPlus: a small language for learning and hacking Dependent Types - <AUTHOR> http://lambda-pi-plus.github.io/ <comment><AUTHOR> Author here.

LPP is a small language with dependent types. The idea is that it's a small set of features for people who are just starting with DTs to learn, and it's also a small enough code base that if you're doing research with DTs, it can serve as a platform for testing new features.

It's been compiled to JavaScript, so you can try it in your browser, though right now there's no way to run programs, only to typecheck them. The error messages right now are pretty terrible, but this is partially intentional, since I'm working on new message generation techniques.

As you find issues (as I'm sure there are many), feel free to report them on Github .

I created LambdaPiPlus as the starting language for the research of my Masters Thesis, on the subject of improving error messages in dependently-typed languages. I found in my research that it's hard to artificially create poorly-typed programs that resemble what a programmer (especially a novice DT programmer) would write.

Part of my motivation for releasing LPP is to allow others to try it and, if they consent, collecting the source of small programs that fail to type-check. Source-code collection can be turned off by checking the box at the bottom of the "Try" page.</comment>


Pirate Bay Announces Global Anonymity Service - <AUTHOR> http://torrentfreak.com/pirate-bay-announces-ipredator-global-anonymity-service-090323/

<comment><USER2> The PirateBay is somewhat known for announcing new stuff which they don't do afterwards. So until I see the service I don't believe it...

see e.g. <http://thepiratebay.org/blog/49>, <http://thepiratebay.org/blog/69>

<comment><USER3> Have you seen the release date?

<comment><USER2> According to the article the April 1st is chosen because of the IPRED legislation that is going active on that day (see also: <http://en.wikipedia.org/wiki/IPRED>)

I know TPB has pulled some nice stunts when it comes to April Fool's jokes but because of this correlation I think they mean it. Even though the date isn't ideal... But I stand by my prior statement, that I will only believe it when I see it.

<comment><USER4> Well at least the IPRED legislation actually puts restrictions on prosecution. Companies will be forced to sue or not, and the use of any anonymity software to protect yourself will only make your chances of avoiding punishment better, because unless the company sues you in a short time then they won't be allowed to at all.

However, IPRED is only to enforce fair and just copyright laws. It protects people from being sued ridiculous amounts, but it will also likely increase the legal action taken. Possibly the worst part of this legislation is the overburden it will place on the legal system, there's enough problems with most countries court system that we don't need additional weight being placed by unnecessary and frivolous lawsuits.

Although on the other hand, I suspect most of these cases will end up going in front of a small claims court judge, which in most cases tend to be younger (basically it's where most judges start before going upwards), which may assist in beating the claims. If you get a 30 something judge then there's a high chance of them understanding technology, and equally a high chance that they themselves have 'pirated' something. They're less likely to tolerate BS and from what I know of the court system, if judges start seeing way too many cases from the likes of music associations it will start pissing them off, and when they're their decision is final it could end up good for the private citizen.

</comment></comment></comment></comment><comment><USER5> I'm all for anonymity but adding layers like this just slows down the whole download process...

</comment><comment><USER6> Other than speed, would there be any benefit to using a service like this compared to using TOR?

<comment><USER5> Data is encrypted... Tor is plain text which is a huge security risk as anyone running a Tor node can just sniff your traffic.

<comment><USER7> Tor encrypts data from your computer to the exit node; it's in the clear from the exit node to the server. Tor provides the same level of encryption as a VPN, but with anonymity.

<comment><USER5> Your right, I remembered read about this: [http://arstechnica.com/security/news/2007/09/security- expert...](http://arstechnica.com/security/news/2007/09/security-expert-used- tor-to-collect-government-e-mail-passwords.ars) and figured it was plaintext, my bad.

</comment></comment></comment></comment><comment><USER8> How is this different from any other VPN? I am assuming that VPNs normally don't keep logs or destroy them quickly. So I really don't see any major benefit, other than the price and the fact that it is being run by TPB.

<comment><USER9> From the article

"The weak link in any VPN/anonymity service is always their willingness (or otherwise) to hand over your customer data when pressured under the law. However, with IPREDATOR this should not be an issue since the service is promising to keep no logs of user activity whatsoever."</comment></comment>


1 Year, 11 Months at Google University - <AUTHOR> http://jmilinovich.com/1-year-11-months-at-google-university/?utm_source=pr&utm_medium=twitter&utm_campaign=hn

<comment><USER2> What's fascinating for a company like Google in SV is no matter how good things are, you have to constantly fight to keep folks like John from trying their hand at early stage life. Overall I think it's great for the ecosystem. This type of non-traditional churn (where employers not only have to be the best of the "Big Co.s" but better than doing something completely on your) own pushes everyone to create environments that are not only innovative and rewarding but also fulfilling.

Being a founder and now at Google (John and I started almost the same time and I know him well), I think what's notable about this post is when people usually write "Why I left Google" they are sometimes backhanded compliments or thinly veiled complaints.

What John is saying "I had a great time and learned a lot but I still think starting a company is more interesting".

<comment><USER3> Also he got stuck on the Internal Tools team, which is basically the gulag as far as getting noticed by the higher-ups and promoted.

<comment><AUTHOR> not true- I was on the Google Analytics team and the Google Offers team before that.

<comment><USER3> You mentioned "internal programs", I just assumed.

By the way, I worked at Google for 5+ years, then quit to do a startup. It's hard, but you're in good company. Word of advice: come up with a clever/funny answer ahead of time, because you're going to get a lot of "Wait, why would you quit Google?!?"

<comment><AUTHOR> That's great advice - the confluence of the opportunity, the team, and personal circumstance made this the perfect time for me to go after my dreams.

Cheers, John

</comment></comment></comment></comment></comment><comment><USER4> Less than 2 years is not enough time to really soak up the skills, experience, connections, and solving enough difficult problems for it to be maximum value.

I guess I now kinda get why he's doing it, but he's taking a huge risk with only 2 year of working experience total under his belt. Wish him the best!

<comment><USER2> I disagree. I think working at a large company for long periods of time can actually stifle your ability to be a great founder. You learn bad habits and your intuition can be deformed by things which help you become successful at Big Co but are useless in early stage companies.

Also, I'm at Google and I know John and his work really well. It's almost laughable to imply it was involuntary. John is an all star. The guy actually wants to do a startup because he find the challenge interesting.

</comment></comment><comment><USER5> "Building Authentic Relationships"? That sounds much better than the Javascript courses :)

Google does sound like an awesome environment, but, much like the post author, I'd like to try my hand at building a company.

</comment><comment><USER6> Against such effusive praise, I wonder why someone would leave after such a relatively short stint. (Maybe the next post?)

<comment><USER7> Agreed. Something seems off about this post. Having worked at Google and also having founded multiple startups, I understand the allure of startups. However, I have to say that in my experience, no one leaves a job that they are perfectly happy with in order to found a startup.

The decision to found a startup comes from a deep dissatisfaction with the status quo. Either because there is a problem you are so passionate about solving that you are willing to drop everything, or because you are dissatisfied with your existing work environment, and want to try to create your own.

<comment><AUTHOR> totally agree dlevine - in my case, life events happened that make me rethink my risk tolerance and ability to go for my dreams (read my prior post for more context)

<comment><USER6> Thanks for the pointer to extra context and good luck!

</comment></comment></comment></comment><comment><USER8> John's drive, focus, and passion will serve him well.</comment>


Ask YC: Best Practices for User Authentication - <AUTHOR> Hey, I'm wondering about the practices about authentication with regard to passwords.
I'm looking to exclude the HTTPS / SSL cert method, which is obviously the most secure method, but it's not completely within reach right now.
What I'm currently looking at is simply a Javascript SHA2 implementation that hashes the password before it is sent to the server. After reading a recent post (http://news.ycombinator.com/item?id=205420), it seems that this implementation isn't the best.
Here's what I got from that:

     +<comment>----+           +</comment><comment>----+
  +->|  SERVER  |</comment><comment>---->|  CLIENT  |
  |  +</comment><comment>----+   nonce   +</comment><comment>----+
  |       |                      |
  |  SESSION["nonce"] = "1234"   | SHA(nonce + password)
  |                              |
  +</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>+
 (sorry for ASCII drawing failure)
What is good practice for user password authentication without SSL? (Feel free to yell at me for not using SSL, but I'm currently not able to implement it.)
Thank you. </comment><comment><USER2> As was pointed out by tptacek, this approach is not secure because the javascript can be rewritten in transit. Also consider that javascript-based hashing will be extremely slow and could interfere with the user experience if the browser bogs down. And IE may show an error that performance is slow on your site.

There just is no way around it, the only way to be secure is use SSL to share secrets when you register. From then on you can just transmit an authenticator (stored in a secure cookie) comprised of an expiration timestamp, any identifying user data (like userID), and a non-malleable MAC digest of the expiration and userID. Doesn't protect against replay but it helps to enforce a short expiration for the authenticator. With this approach you'll only need to use SSL for the initial login.

This is the best explanation of web authentication I've encountered on the net [PDF]:

<http://prisms.cs.umass.edu/~kevinfu/papers/webauth_tr.pdf>

<comment><USER3> Depending on who you are, you could guard against javascript being rewritten by a man in the middle attack by running, say, a greasemonkey script that figures out when a password should be sent and hashing with the server domain automagically, so long as you can cache it locally. In this way, admins could secure clients against having their passwords stolen without any effort on the part of web-app writers, or users. Even a browser, say, Firefox, could do some version of this.

Really, digest authentication solves the same problem, but hardly anyone uses it.

<comment><USER4> I know you're just trying to add a layer here, but if you think this through, you'll probably see that GreaseMonkey does not win against content-controlled Javascript for its own site. Firefox has had a hard enough time just keeping content-controlled Javascript from breaking into Chrome.

As a simple example, note the fact that the "when the password should be sent" signal originates from content-controlled JS, which controls the DOM. Note also that with same-origin out of the picture, the content-controlled JS can choose to send the password whenever it wants.

<comment><USER3> Sure, it's not meant to be foolproof. I only wanted sometime to secure the login for the large number of sites taking passwords with plaintext. Right now it's completely a statistics game -- you can just stand outside someone's wireless network capturing packets. If it's insecure or WEP, you'll be able to recover the key, then grepping through with password=_ will eventually give you a password to use on their favorite sites.

I do think security is a matter of degree. And currently authentication is but a few removed from wide open.

<comment><USER4> This is why app developers should be using SSL. I have no smart-assed responses to an HTTPS login screen. No ad hoc hashing schemes required.

<comment><USER3> By the same logic, crackers shouldn't attack anything. But they do.

<comment><USER4> I'm not sure I see how that follows.

But to reify this a bit, do a little Google research on what the banking industry is dealing with regarding multifactor authentication. Nothing they are trying is working, and they're doing considerably more than Javascript hashing. The schemes being discussed here _are_ being attacked, successfully.

<comment><USER3> Not every app developer who could use SSL does, which can give away passwords shared with SSL sites.

By the same token, some hackers capable of cracking do so, though they, in some sense of the word, really shouldn't.

We're thinking about security from two different standpoints. If I lock my door, but my glass window has no bars, I'll still say it's more secure than a house with a door open. The issue, for me, is less that someone _can_ , but whether someone _will_. If I make it harder for someone to mess with me, maybe they won't.

<comment><USER4> I can't win that argument; it's semantic. Just remember that the _majority_ of the decision you're talking about belongs not you but your users. Don't offer a false sense of security.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> What's the difficulty with implementing SSL? If you're not already familiar with it, read the manpage for s_server, which is part of OpenSSL.

<comment><AUTHOR> No difficulty in implementing SSL, but I'm a student and don't have much money. Granted, this is a temporary solution until I'm able to get some money together for a dedicated IP and SSL cert.

<comment><USER5> You can do SSL very cheaply these days. GoDaddy has certificates for $15/year. Dreamhost gives you a dedicated IP for an extra $4/month.

<comment><USER6> Given the fact that how cheap it is these days to get SSL certificates and static IPs I would take the route of SSL rather than going thru this untested (read: not well tested) route of JavaScript encryption.

<http://www.hitlinkz.com>

<comment><USER7> Please don't spam your URL, especially not as your signature. That's (very) bad form.

</comment></comment></comment></comment></comment><comment><USER4> No security scheme delivered over Javascript is going to make a difference in a security audit. Your auditor is going to tell your prospective customer that anybody who controls the DNS, routing, the network, ARP, the browser --- or 10 other places --- can rewrite the Javascript in transit.

If you can't do SSL, just do plaintext passwords. It means you're being open with your users about the risk.

<comment><USER8> I'm no expert... but what if just the javascript was served via https? Maybe somebody ought to put an MD5 javascript library on an https server as a public service. Or would js hashing still be vulerable since the man-in-the-middle could change the nonce or something?

<comment><USER9> If you're going to serve Javascript over SSL, you need a full SSL setup including a valid certificate, etc. If you have that, you may as well just serve the login form itself over HTTPS, redirecting back to HTTP after logging the user in, and forget the Javascript altogether.

<comment><USER10> He means someone set up a a JS library over HTTPS on a server for _others_ to use. Like you would grab a JS library off of Google's HTTPS servers and use that on your non-SSL pages.

<comment><USER4> Uh... and the page that includes the JS, which is part of your app... comes from where?

<comment><USER8> Oh yeah, good point!

</comment></comment></comment></comment></comment></comment><comment><USER11> You've basically reimplemented HTTP Digest auth, although not quite as well.

The problem with your implementation is that the server needs to know the cleartext password. With digest auth, the server never has the clear password, (only a digest thereof) although it can use the digest to authenticate to other services with the same digest.

It doesn't really matter though, since passwords are very insecure and users know that. Nobody is going to give your web app an important password. If they do, and it gets compromised, it's their problem, not yours. (For secure authentication, look at how ssh uses public/private keys. Much better. Compromising the server's password database will never yield the private keys and hence is a complete waste of time for an attacker.)

Anyway, I tend to transmit passwords over SSL and then store them in the database hashed with bcrypt ([http://search.cpan.org/~zefram/Crypt- Eksblowfish-0.005/lib/C...](http://search.cpan.org/~zefram/Crypt- Eksblowfish-0.005/lib/Crypt/Eksblowfish/Bcrypt.pm))

<comment><USER12> The problem is that most users are not programmers, are not at all interested in computer security... So, no maybe most people here would not use an important password for yc news... But the average user doesn't think about this and knowing this can you really say that it's there fault for not being educated on computer security?

Anyway, since you do the right thing: SSL + bcrypt, good but don't say it's the user problem if the system gets compromised...

</comment></comment><comment><USER13> huh? whatever you do on the client machine you're still open to a man in the middle attack . hashing passwords simply make it more difficult for eavesdroppers to figure out the original password, and keep people from passing potentially sensitive information across the net in cleartext.

use SSL for things you need to keep secure, like credit card payments. If you can't set that up, outsource stuff to a payment provider like Paypal until you get your house in order. Otherwise be more clear about your security concerns in your write-up, so people know WHAT you are trying to solve instead of HOW you are trying to solve... something.

</comment><comment><USER14> In practical terms, just use HTTPS with rooted certs. It's not expensive for basic usage. And, if you're just doing a for-fun project you can always use self-signed certs.

If you want to go deeper down the rabbit hole check out SRP: <http://srp.stanford.edu/>

In terms of dealing more securely with data on your server, check out the book, Translucent Databases ( [http://www.amazon.com/Translucent-Databases- Peter-Wayner/dp/...](http://www.amazon.com/Translucent-Databases-Peter- Wayner/dp/0967584418) )

<comment><USER4> Stay away from SRP. Browsers don't support it natively, and there are (so far as I can tell) no peer-reviewed libraries for it for the major web stacks. SRP is easy to get wrong.

<comment><USER14> I did say to use SSL in practice, right?

Reading about SRP would help solve much of confusion people seem to be having in many of the discussions going on in this thread.

</comment></comment></comment><comment><USER15> Hashing the password on the client with a nonce provided by the server and checking on the server is good for login, but not registration. The server still needs the password (or a hash of the password and a salt) in order to compute the login hash for comparison.

The only truly secure way (that I can think of) is some sort of public-key encryption, either SSL or some JavaScript library.

<comment><AUTHOR> That's very true. Damnit. Not sure how I'm going to fix that.

I've looked into public-key encryption, and unless if I generate a new public and private key for every request to login, replay attacks are still possible.

<comment><USER3> If you hash the password on the clientside, say, and then use that as the password in your scheme throughout, then you don't need to transmit the password in cleartext, ever.

<comment><USER4> This is a win because, even though you're sending something _password- equivalent_ over the wire, at least you're not exposing a password that's used on other applications?

<comment><USER16> Can we have it both ways? Transmit a password-equivalent over the wire, without compromising the security of the password database?

How about using a cryptographically strong hash on the client side, transmitting that hash to the server, and then having the server perform another cryptographically strong hash on the hash it receives, and compare that against its database? This way, the server isn't storing the passwords in the clear anywhere, and there is still at least some protection against having users' passwords picked out of the air -- even, I think, during the user's initial registration.

I realize that any client-side code designed to do this can be compromised by a man-in-the-middle attack, forcing the user's password out into the open. This isn't meant to be perfect security, it's just meant to provide one extra layer of protection for the individual user's password(s), without compromising the database as a whole.

<comment><USER3> Yes, that is what I suggested.

<comment><USER16> Ah, I didn't initially read it that way.

It still leaves the problem of password sniffing over an unsecured network, but I think that could be solved by generating a salt on the server for each login request, and then transmitting that salt to the client, where it's used to re-hash the password-equivalent. That would also help protect against something like a DNS compromise, since effectively every user's password changes every time they log in.

There are still plenty of ways to break this scheme, but I think at this point it's Sufficiently Hard (tm) enough to be suitable for an online forum.

...and I imagine that somewhere, tptacek is screaming, "Just use SSL!"

<comment><USER3> I mean, there are a few standpoints here: if you're running a site, use SSL, if you're a user, don't reuse passwords or use something like PWDHash, or if you're working on a browser or you're an admin, consider a way, like PWDHash, of making it so that a password compromised at one site doesn't compromise any others.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER4> Also: any security scheme based off a simple hash function is going to require you to store cleartext passwords on the server side, meaning that any SQL injection vulnerability compromises, say, 10,000 user passwords.

<comment><AUTHOR> Actually, I made a mistake in the diagram. The password will be hashed first, then the sha2(nonce + sha2(password)). Passwords will be stored server-side as sha2(password).

Can't update the post now, though.

<comment><USER17> Your method for storing the passwords server-side is actually not very secure. Hashing the passwords without a unique salt is not a secure way to store them.

For one thing, every user with the password of 'secret' will have the same hash in your database. Secondly, if I were to steal all of your password hashes, I would just have to compute sha2 of every 6-8 (or whatever password length you are using) character string. With a 32 character salt, I would have to compute a sha2 of every 38-40 character string, making my job a more time consuming.

<comment><AUTHOR> The thing with a salt is that - would you include the salt in the Javascript hashing system? like sha2(nonce + sha2(password + hash)) ? If so, then the salt isn't really that useful - you can then just compute sha2 of 6-8 letters + salt.

<comment><USER12> The only usefulness of the salt is if somebody steals your database and uses a rainbow table to try to get the passwords. If you don't have salts for each users, then a pre-generated rainbow table for sha1 based on common passwords is going to be very efficient at getting the passwords for each account. If you use salt however, you are protected from the use of pre-generated tables since the attacker has to brute force all the combinations for each user. If you use sha1 or md5 it's still not too secure since sha1 and md5 are fast to calculate and getting faster with this : <http://nsa.unaligned.org/hw.php>

Read [http://www.matasano.com/log/958/enough-with-the-rainbow- tabl...](http://www.matasano.com/log/958/enough-with-the-rainbow-tables-what- you-need-to-know-about-secure-password-schemes/) from tptacek, it's very informative...

Of course, the big problem with the javascript way explained here is that you send sha2(nounce + sha2(password+salt)) This means, that anybody who get access to the database can send sha2(nounce + hash_from_database) So basically in this case using salt in the database prevent people from getting the password too easily (so it sorts protects the attacker from getting a password associated with an email address that he could try later on paypal), but it doesn't protect the account in any way...

And for those who think that it's unlikely for anybody to get access to the database, it happened to the reddit guys...</comment></comment></comment></comment></comment>


Golang Automatic Reloads - <AUTHOR> http://www.alexedwards.net/blog/golang-automatic-reloads

<comment><USER2> That's more of an automatic restart (kill and start the process again) than an automatic reload (update code within the running system). And surely there are non-go-specific tools which can already do that, aren't there?

<comment><USER3> Yup, such tools exist. I've used peat before for stuff like this:

[https://github.com/sjl/peat](https://github.com/sjl/peat)

</comment></comment><comment><USER4> CEL is a similar and more generic script: it can do that for any program and works on Linux and Mac.

[https://github.com/Dinduks/change-execute- loop](https://github.com/Dinduks/change-execute-loop)

</comment><comment><USER5> SIGKILL seems a little aggressive for a controlled process restart.

<comment><USER6> Not to mention the program sigkills itself before it attempts to `exit 0`...

<comment><AUTHOR> Genuine question - can a process kill itself?

The kill of go-reload was to make sure background processes get cleaned up, but I suspect one of the kill or exit in the close function is superfluous.

<comment><USER7> > Genuine question - can a process kill itself?

Sure. Send the signal, the signal handler - custom or default - handles it. This works whether the signal comes from another process or its own process.

</comment></comment></comment></comment><comment><USER8> Or rerun by skelterjohn [http://github.com/skelterjohn/rerun](http://github.com/skelterjohn/rerun)

</comment><comment><USER9> On Windows you can use something like this

[http://www.nodesoft.com/foldermonitor](http://www.nodesoft.com/foldermonitor)

(freeware)

<comment><USER10> Go also provides a syscall for ReadDirectoryChanges, and one really nice Go library that uses inotify/ReadDirectoryChanges is [https://github.com/howeyc/fsnotify](https://github.com/howeyc/fsnotify)</comment></comment>