How to handle Linux system integrity and secrets on physical product? - <AUTHOR> I'm working on a IOT physical product that runs Linux and will be sold to customers. This product has a server with a SSD and contains source code in addition to secrets used to communicate with a backend.
The product is early on in the development stages and we currently use LUKS. Our technicians enter in the decryption password to unlock these servers at the beginning of the day.
When this product makes it to production, providing our customers with the decryption key is definitely a no-go. We need to guarantee that our source code and secrets are protected in addition to ensuring that the system hasn't been tampered with.
What are some common ways to handle this in physical products? Any links or tips on this topic would be massively appreciated! <comment><USER2> This is a very hard problem to solve. It isn't possible to prevent a well- resourced determined adversary from getting into such a device (iPhones are some of the most well locked-down devices in the world, and there are still jailbreaks). For ordinary hardware you're probably looking at using something like a TPM, which can be used to decrypt drives based on the state of the bios and hardware. Your best bet is to have trustworthy customers and strong legal protections. If that's not good enough, a TPM will be the next best thing. Have a look at the red hat documentation on how to set up a TPM for LUKS. Also be sure to set up secure boot correctly with a custom key and lock the BIOS.

[https://access.redhat.com/documentation/en- us/red_hat_enterp...](https://access.redhat.com/documentation/en- us/red_hat_enterprise_linux/8/html/security_hardening/configuring-automated- unlocking-of-encrypted-volumes-using-policy-based-decryption_security- hardening)

Edit: I'm reading through your question again. In terms of secrets used to communicate with a back end, it's very very very important that the secrets used for each device/customer are different, and can be revoked. If you've got something like AWS access keys in there, don't. Use per-user secrets that aren't the keys to the kingdom.

<comment><AUTHOR> Awesome, thank you for the detailed response! This all looks promising. It appears that our mobo has a TPM connector and they sell a TPM module. I'll look into this further!

</comment></comment><comment><USER3> There's multiple steps involved in this, but some of the important ones are:

\- encrypt all the contents of your flash (e.g. with LUKS)

\- store the key in a crypto hardware module

\- Typically you'd then have a System on Chip which supports a secure boot with a fused certificate key as hardware root of trust. Each subsequent phase of the boot process needs to be attested by the previous phase to maintain this chain of trust. Have the boot process pull the key for your Flash partition and unlock the flash

\- Ensure your board is fully locked down, so no debug access, no boot overrides, no sideloading, ....

\- make sure the key can't be accessed with the same process privileges as the server running on the unit, for when someone inevitably pops it

\- select a SoC with protections against side channel attacks and fault injection (glitching), not some 0.3 USD microcontroller

</comment><comment><USER4> While there are some good recommendations here, I would defintely hire an expert (either in-house or some external contractor) to design and test the final solution.</comment>


How I cut my Webpack bundle size in half - <AUTHOR> http://jmduke.com/posts/how-i-cut-my-webpack-bundle-size-in-half/ <comment><USER2> In regards to date management, has anyone ever replaced moment with date-fns: [https://date-fns.org/](https://date-fns.org/) ? It seems to be the lodash for dates, in which you can do selective imports.

<comment><USER3> As a further alternative, I keep wondering what's left to further standardize towards Intl.DateTimeFormat [1][2] to leave it to the browsers to know the local locale?

I suppose for me and my projects perhaps the biggest usages of Moment are actually for the "humanizing" formats time until/time since (the things like "20 minutes ago"/"3 days from now"). The locale data for those likely may never be standardized into Intl. (~I also don't see equivalents of those functions in a quick skim of date-fns docs, fwiw.~ ETA: Of course I spot it soon after posting the comment; formatDistance)

[1] [https://developer.mozilla.org/en- US/docs/Web/JavaScript/Refe...](https://developer.mozilla.org/en- US/docs/Web/JavaScript/Reference/Global_Objects/DateTimeFormat)

[2] [http://caniuse.com/#search=intl](http://caniuse.com/#search=intl)</comment></comment>


The Sourcehut Project Hub - <AUTHOR> https://sourcehut.org/blog/2020-04-30-the-sourcehut-hub-is-live/ <comment><USER4> Like many others I too admire Drew's work. But one thing I appreciate the most is the visual style and usability of Sourcehut. I don't know what it is exactly (am not a UX or visual designer myself, although work with them a lot), but to me it is one of the most aesthetically appealing sites I visit.

<comment><USER5> I find the text a bit hard to read (and it seems at least one other commenter mentioned the compressed line-height).

What I do notice is that the site loads very fast (sub-1s w/ cache disabled via devtools to simulate first visit, and sub-50ms otherwise). That alone deserves big props.

<comment><AUTHOR> I am very proud of our performance :)

[https://forgeperf.org/](https://forgeperf.org/)

<comment><USER6> I think Codeberg.org is not doing the (normally very fast) Gitea any favors here, because it's hosted on Hetzner in Germany. Lighthouse may only throttle the connection further.

Where are the tests being run from?

Is there any way to control for network latency (maybe subtract the ICMP rtt from the tests?)

You might consider comparing it to other Gitea instances like [https://try.gitea.io/](https://try.gitea.io/) (Digital Ocean / USA), [https://mirror.git.trinitydesktop.org/](https://mirror.git.trinitydesktop.org/) (Czech Republic) or [https://gitea.com/](https://gitea.com/) (China), but I guess Codeberg is probably the most representative instance for public use.

<comment><AUTHOR> This has been brought up many times, but latency and bandwidth is controlled for with Lighthouse. The same tests have also been run _from_ Germany without appreciably different results. It's also easy to run the test suite yourself if you have an hour of compute time to spare:

[https://git.sr.ht/~sircmpwn/forgeperf](https://git.sr.ht/~sircmpwn/forgeperf)

The goal here isn't to compare forge software (that would require a completely different approach to level the playing field), but to compare hosted options. The test suite is easily extended with other hosts or pages, and a few people have tested against their own Gitea instance - usually it ranks somewhere just above the middle of the pack.

</comment></comment></comment></comment></comment><comment><USER7> Drew, congrats! I love the principles you hold fast too.

Q: does this mean pricing is no longer optional?

[https://sourcehut.org/pricing/](https://sourcehut.org/pricing/)

<comment><AUTHOR> Payment is still optional, and SourceHut is still considered an alpha. This completes only one of a few important milestones blocking the beta.

And, thank you for the kind words :)

<comment><USER7> Well, don't wait too long before you charge :)

I realize we can all make optional payments but I'd love for you have committed reoccurring revenue you can count on.

(I say this as a huge admirer of what's you're working on and accomplished)

<comment><AUTHOR> We have enough :) Not a lot, but enough, and a little more than that. You can keep an eye on the financial reports if you want to see for yourself:

[https://sourcehut.org/blog/2020-04-13-sourcehut-q1-2020-fina...](https://sourcehut.org/blog/2020-04-13-sourcehut-q1-2020-financial- report/)

Note that I have secondary income sources, and we also make some money from lending our staff out as part-time consultants. It's not important to me to maximize the earning potential of SourceHut. The mission is to make the free and open source ecosystem better, not to make our own pockets richer.

<comment><USER8> I have a hard time telling if I admire your mindset more than your work or the opposite… :)

</comment></comment></comment></comment></comment><comment><USER9> Drew, Consider adding a line-height on .content of 120%. Should make it a little bit easier to read.

<comment><AUTHOR> Good suggestion, thanks.

</comment></comment><comment><USER10> I love sr.ht but for the love of God can we please have an easily deployable Dockerfile for selfhosting? I'm almost positive its lack stems from Drew's ideals of how software ought to be distributed but it would really help with wider adoption. Sometimes you don't have he luxury of dealing with a NixOS or straight Debian system or you're running containers-only because of company policy and so on and so forth.

<comment><AUTHOR> This was brought up a couple of times, start here for the response:

[https://news.ycombinator.com/item?id=23037904](https://news.ycombinator.com/item?id=23037904)

<comment><USER10> Let me be real with you for a second in one of those let's pretend we've just taken a bunch of psychedelics and all the structures that prop us and our beliefs and ideals have collapsed: I really think you should reconsider your position on this. Containers are ok, they are not a threat; the kinds of people who are going to be selfhosting your stack are the same kinds of curious, investigative people who will debug when it all falls down. Those people do not need to be pushed through a manual series of commands as a hazing ritual.

I'll be just as real with you that I'm not going to be the one to maintain it. It's in the best interest in the platform's broader adoption I make my plea. Because people like me will just flounder on the rocks of the GitHubs of the world. And that's not a future either of us really want.

<comment><AUTHOR> It's not a hazing ritual, it's a necessary series of learning steps which equips you to be a _good_ sysadmin of your new instance. Whatever did we do before Docker? The world must have sucked back then!

<comment><USER11> Not to be snarky but Docker (+ Hub) is mostly just packaging with some isolation to avoid conflicts, right? So why would you recommend packages from "regular" package managers (as seen in the installation instructions) but not Docker? (This is a serious question, maybe I am missing something.)

<comment><USER12> Because Docker is a really shitty way to package applications. You don't package the application, you package an entire linux distro, with it's packages, and your application into a single opaque blob. Normal package managers just package your application in a more simple manner which works in conjunction with your OS, not on top of it.

<comment><USER11> It makes sense to package and isolate the base system since it avoids any "hidden state" that could influence the behaviour of your program and introduce hard-to-debug errors.

And it's not packed into a single opaque block: You can specify an image to derive your image from and Docker will overlay-mount your image on top of the base image, avoiding the need to store multiple copies of a base image.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> Hey ddevault, thank you for work, especially Sway and Wlroots. Is there any plan to distribute Sourcehut as a docker image for installation? I personally self-host a number of applications myself (using Docker+Traefik), and would like to move to Sourcehut from SCM Manager.

<comment><AUTHOR> Thanks for the kind words :)

However, there is no Docker turn-key installer, and no plans to make one. I elaborated on this here:

[https://news.ycombinator.com/item?id=23037232](https://news.ycombinator.com/item?id=23037232)

But, I've also long acknowledged that if someone else wanted to make a set of third-party Docker images, it would be feasible, and I wouldn't be bothered by it (so long as you didn't ask me to support it).

<comment><USER13> I see, thanks for the reply. I didn't make my own only because I don't usually have time to maintain and monitor for new updates; but if updating it is as simple as `apk update`, then that shouldn't be a problem.

</comment></comment></comment><comment><USER14> Happy for you Drew, I've been following you on and off for a few years, feels good to see someone being able to live off the kind of work you do.

I like the minimalist approach of many aspects of your work. And the whole website using no JavaScript is also very nice to see.

Have you thought about adding some opt-in JavaScript to enhance the user experience?

<comment><AUTHOR> There are 2 or 3 small touches of JavaScript here and there which make conservative enhancements. But, it's a base design requirement that all features have to work without JavaScript - and once they do, adding JavaScript doesn't often seem very compelling.

</comment></comment><comment><USER15> Great to see things progressing. We're currently self-hosting gitlab, and the relatively tight coupling of repo and issues/issue boards is an itch for us.

How is the self-host story for sourcehut (paid or gratis)?

Is there a turn-key variant with turn-key upgrades a la gitlab omnibus installer?

<comment><AUTHOR> The self-hosting story is pretty good(TM). It's not turn-key, and there is not an installer. You need to run through the steps manually, which are documented here:

[https://man.sr.ht/installation.md](https://man.sr.ht/installation.md)

Most people get this done in an hour or two, sometimes with the help of #sr.ht on irc.freenode.net. It's also often made easier by the fact that you can skip any services you don't need, like paste hosting or wikis. By making you go through the steps and set it up, it makes sure to leave you with an understanding of the pieces and how they fit together, so you're better equipped to deal with it if/when it breaks and to adapt it to your particular circumstances. After you set it up, upgrades are usually pretty painless, you just run `apk upgrade` and it takes care of the rest. In general, I think this approach makes a lot more sense than the turn-key Dockerized approach.

<comment><USER15> Thank you - I followed a link that said "open source" and it took me to a list of repositories (which is nice, we all like open source) - but I apparently didn't land on the install-link (to be fair, I didn't look very hard).

I'm not sure I'm a fan of many approaches I've seen (gitlab omnibus is not a docker install, BTW).

You appear to be supporting alpine Linux - and also Debian derived systems - via packackes?

Packages, obviously, is a nice way to install software... If I wanted an appliance - I should set up an alpine vm, install source-hut components I like, point it at a managed postgres instance and a smart mail host - <USER3> assume I'll only ever need to do rolling updates via apk - and distro upgrades via alpine?

Is running on Debian likely to be as smooth?

<comment><AUTHOR> If you remember where you found that link, let me know, so I can update it.

>Packages, obviously, is a nice way to install software... If I wanted an appliance - I should set up an alpine vm, install source-hut components I like, point it at a managed postgres instance and a smart mail host - <USER3> assume I'll only ever need to do rolling updates via apk - and distro upgrades via alpine?

Yeah, that's about right. Upgrades are done just by running your normal package manager updates.

>Is running on Debian likely to be as smooth?

The Debian repository is community-maintained, but the maintainer does a good job and a few people have reported sucess using his packages. We also set it up so that upstream releases automatically update the Debian repo. You'll have to depend on him for support, though, not me - his nick is dlax and he hangs out in #sr.ht on irc.freenode.net; and his email is given on the package page. He's a helpful fellow.

Alpine Linux is indeed the officially supported platform, though, and I highly recommend it. I wouldn't dream of running a different system in production, Alpine is simple and reliable and it's easy to fit the whole thing into your head.

<comment><USER15> Thank you.

> If you remember where you found that link, let me know, so I can update it.

I belive it was the "100% free and open source" link in this very post:

[https://sourcehut.org/blog/2020-04-30-the-sourcehut-hub- is-l...](https://sourcehut.org/blog/2020-04-30-the-sourcehut-hub-is-live/)

Which goes to: [https://git.sr.ht/~sircmpwn/?search=sr.ht](https://git.sr.ht/~sircmpwn/?search=sr.ht)

Which does indeed link the repos - which is good - but from a mindset of "how do I self-host?" maybe a bit bare bones.

Looks like if one follows any of the repo links - the install info is at the bottom. May be an artifact of me being on my phone.

As I said, I didn't look very hard.

I really appreciate the no-nonsense/no hype vibe - but at the same time, I really do want a "here's a sane way to get up and running" front and center.

Now, obviously there's a hosted offering - but at my current company we have a few projects that we feel more comfortable self-hosting due to the nature of some of our customers. For some, we avoid third parties, where we can.

<comment><AUTHOR> Thanks for the tip! I've updated that URL to the following, which is much more helpful:

[https://sr.ht/~sircmpwn/sourcehut](https://sr.ht/~sircmpwn/sourcehut)

</comment></comment></comment></comment></comment></comment><comment><USER16> This is excellent. The great thing about Sourcehut is that if you have extra git remotes, you can keep working like nothing ever happened if the site goes down. Issues and patches are decentralized over email.

The Project Hub looks like an excellent way to tie together all the separate Sourcehut services to better compete with other "complete" VCS-based collaboration suites like GitHub and GitLab. In the future, it would be really cool to expose an API to allow adding "custom" services that aren't part of Sourcehut.

It's good to see Sourcehut focusing on project discovery, since this is the area where GitHub excels at the most. When I search for a small CLI/TUI utility, I often run these filters:

\- filter out weblangs, frontend-oriented languages, and languages with heavy runtimes (JS, TypeScript, CoffeeScript, Vue, CSS, HTML, Dart, Purescript, Livescript, Elm, Swift, JVM languages, .NET languages, Vala, QML, etc.). I have several shortcuts for many combinations of languages so I don't have to type them out every time.

\- filter repos below a certain size (a repo above 10mb is probably full of bloat).

\- If applicable, filter out repos whose last commit was before a certain date.

\- If applicable, filter by topic

\- If it concerns a recent technology, I can filter repositories created after a certain date.

\- If I want to try a smaller project that isn't cursed with mainstream success, I filter repositories below a certain number of stars.

For instance, if I feel like my MPD setup is missing something, I might search:

      mpd stars:<150 pushed:>2019-01-01 size:<8000 -language:purescript -language:livescript -language:vue -language:javascript -language:typescript -language:coffeescript -language:elm -language:dart -language:java -language:scala -language:kotlin -language:clojure -language:groovy -language:php -language:objective-c -language:objective-c++ -language:swift -language:css -language:HTML -language:haxe -language:csharp -language:fsharp -language:"jupyter notebook" -language:powershell -language:cuda -language:assembly -language:tex -language:batchfile -language:erlang -language:elixir -language:emacs -language:vim -language:plpgsq -language:julia -language:xslt -language:systemverilog -language:verilog -language:hcl -language:tsql -language:jsonnnet -language:gdscript -language:r -language:smarty -language:freemarker -language:nix -language:saltstack -language:"visual basic" -language:"visual basic .net" -language:plsql -language:"rich text format" -language:dockerfile -language:vala -language:QML -language:actionscript -language:matlab -language:alloy -language:cobol -language:graphql -language:m4 -language:qmake -language:fish -language:opencl -language:json -language:rmarkdown -language:xml -language:markdown -language:applescript -language:puppet

The result [0] shows quite a few nice utilities. If I want to go even more minimal, I could filter out Ruby and even Python projects.

It would be great to have a FOSS implementation of an advanced project search utility that isn't limited to (or even part of) any particular hosting provider. Maybe ActivityPub could help facilitate connecting and indexing project metadata from different hosting providers.

[0]: [https://github.com/search?o=desc&q=mpd+stars%3A%3C150+pushed...](https://github.com/search?o=desc&q=mpd+stars%3A%3C150+pushed%3A%3E2019-01-01+size%3A%3C8000+-language%3Apurescript+-language%3Alivescript+-language%3Avue+-language%3Ajavascript+-language%3Atypescript+-language%3Acoffeescript+-language%3Aelm+-language%3Adart+-language%3Ajava+-language%3Ascala+-language%3Akotlin+-language%3Aclojure+-language%3Agroovy+-language%3Aphp+-language%3Aobjective-c+-language%3Aobjective-c%2B%2B+-language%3Aswift+-language%3Acss+-language%3AHTML+-language%3Ahaxe+-language%3Acsharp+-language%3Afsharp+-language%3A%22jupyter+notebook%22+-language%3Apowershell+-language%3Acuda+-language%3Aassembly+-language%3Atex+-language%3Abatchfile+-language%3Aerlang+-language%3Aelixir+-language%3Aemacs+-language%3Avim+-language%3Aplpgsq+-language%3Ajulia+-language%3Axslt+-language%3Asystemverilog+-language%3Averilog+-language%3Ahcl+-language%3Atsql+-language%3Ajsonnnet+-language%3Agdscript+-language%3Ar+-language%3Asmarty+-language%3Afreemarker+-language%3Anix+-language%3Asaltstack+-language%3A%22visual+basic%22+-language%3A%22visual+basic+.net%22+-language%3Aplsql+-language%3A%22rich+text+format%22+-language%3Adockerfile+-language%3Avala+-language%3AQML+-language%3Aactionscript+-language%3Amatlab+-language%3Aalloy+-language%3Acobol+-language%3Agraphql+-language%3Am4+-language%3Aqmake+-language%3Afish+-language%3Aopencl+-language%3Ajson+-language%3Armarkdown+-language%3Axml+-language%3Amarkdown+-language%3Aapplescript+-language%3Apuppet&s=stars&type=Repositories&utf8=%E2%9C%93)

</comment><comment><USER17> Congratulations to everyone involved and using Sourcehut! It is good to see viable, free alternatives to Github rising. The developer ecosystem becomes weaker if almost everyone get trapped in a corporate monoculture.

Personally, I trust fossil-scm for my side projects. Albeit based on a completely different design philosophy, I recommend to check it out for everyone eager to look outside the box.

</comment><comment><USER18> Thank you. I spent ten minutes looking for a project index when I discovered sourcehut today, and failed to find one.

Am I blind, or is there no link to [https://sr.ht/projects](https://sr.ht/projects) from the main sr.ht or sourcehut.org pages? What is the expected path of discovery?

</comment><comment><USER19> Bravo! Congrats! Thank you!</comment>


College Is Actually Worth It - <AUTHOR> http://www.huffingtonpost.com/edward-lando/extraordinary-professors-_b_2618676.html

<comment><USER2> If you can learn what you want without stepping foot in a college, and if you can convince an employer that you know it as well as a college grad, then go for it. Otherwise, you're going to need to go to college. It's that simple.</comment>


Philip Roth: An Open Letter to Wikipedia - ezequiel-garzon http://www.newyorker.com/online/blogs/books/2012/09/an-open-letter-to-wikipedia.html

<comment><AUTHOR> This is a response by a person who works for the Wikimedia Foundation (a personal response, not an official response): <http://quominus.org/archives/979>

"There's only one problem with this: Roth's open letter is at best the (justifiably) aggrieved and confused ramblings of a man ignorantly discussing what he does not understand or remember..."

It's long and probably worth reading to get a more balanced view of the situation.

<comment><USER2> I found the rebuttal fascinating. Neither Roth, nor Oliver, has even a smidgen of compassion for the other party's point of view.

Philip Roth clearly doesn't "get" the fact that anyone can sign up and try to edit Wikipedia claiming to be God if they want, and those edits must be rejected because well they really could be anybody.

Oliver clearly doesn't "get" the fact that some people are so used to being who they are, and so untainted by the deeper deceptions and pranks of the Internet, that they clearly think that simply corresponding should be sufficient. Certainly it was when written letters were taken why not now?

And when two proud people with orthogonal world views disagree, well it just gets ugly and stays ugly sadly.

Wikipedia could do with a way for 'primary sources' to provide them with information that they can both verify and use, so perhaps Philip could write them a letter in his own hand and sign it and they could digitize that and store it as the referenced source. It always helps to know that people who aren't used to the Internet don't realize just how easy it is for dogs [1] to troll you.

[1] [http://en.wikipedia.org/wiki/On_the_Internet,_nobody_knows_y...](http://en.wikipedia.org/wiki/On_the_Internet,_nobody_knows_youre_a_dog)

<comment><USER3> _Wikipedia could do with a way for 'primary sources' to provide them with information that they can both verify and use_

They have a way to verify a primary source - use a secondary source.

 _perhaps Philip could write them a letter in his own hand and sign it and they could digitize that and store it as the referenced source_

Wikipedia intentionally does not pursue original research, which this certainly is.

<comment><USER4> > They have a way to verify a primary source - use a secondary source.

I honestly cannot tell if this was meant to be a joke?

<comment><USER2> Its confusing isn't it? In Wikipedia speak you need someone other than the 'primary source' reporting on the information 'from' the primary source. Kind of like link authority in page rank. So if someone says "I'm the VP at JC penney and our web site is www.eatmybits.com" that is a 'primary' source but its not verified by anyone else, but if the New York times says "Oh look, JC penny just changed their primary URL to www.eatmybits.com" then that secondary source, quoting a primary source, gets approved. Its the whole 'someone we trust has vouched for something you are saying, so we kinda sort of believe it to be true.'

The whole thing is made worse by Wikipedia editors who tend to speak in a short hand which as time goes on gets more and more opaque.

All of it being a result of volunteer efforts to curate a source of 'facts.'

<comment><USER4> Thank you. I honestly don't know quite what to make of the whole situation. I understand the issues of making the project function well enough, I think, but the implementation saddens me.

I'd like to think that even if I were 100% sympathetic with wikipedia policy, I'd still be able to see how petty, stupid and embarrassing quominus's rant was. It strikes me as pure, but of course unintentional, self-parody on so many levels. And of course I'm saddened because I can see that there's a personality type that would think quominus's spite and the fixation on fiddly minutia instead of the big picture is brilliant and great... and they're probably the sort of people who edit Wikipedia articles.

</comment></comment></comment></comment></comment></comment><comment><USER5> From Wikipedia:

On September 7, 2012, Roth wrote an open letter to Wikipedia in the The New Yorker in which he dismissed critics' earlier suggestions that his novel was inspired by Anatole Broyard.[13] He said that he had used an incident in the life of his friend, Melvin Tumin, professor of sociology at Princeton, and created everything else about his character, Coleman Silk. Roth used details from Tumin's experience in the events that led to Silk's resigning from the college.[13] Roth acknowledged that he had met Broyard, but wrote that he barely knew him.[13] He said, "I've never known, spoken to, or, to my knowledge, been in the company of a single member of Broyard's family. I did not even know whether he had children."[13]

Bliss Broyard, the daughter of Anatole Broyard, posted a response on Facebook:

"I think it's completely reasonable that Roth should be allowed to have the last word on who inspires his characters and even obfuscate about the sources if he wants to… BUT I don't think it's reasonable that Roth gets to dictate what conclusions other people draw about his characters, which is effectively what he was trying to do with his objection to Wikipedia's description of the book as 'allegedly' having been inspired by my dad."[14]

She said her father had introduced her to Roth at a literary party when she was 22:

" 'Bliss,' my father said, rather pompously, 'this is one of our most important American novelists.' He [Roth] turned to regard me. 'So lithe and pale,' he pronounced. 'Like a ghost.' It was a brief encounter—one I'm not surprised that he might have forgotten—but I am sure you all can understand why I haven't."[14]

<comment><USER6> Surely he isn't trying to dictate what conclusions other people draw? He is simply trying to state facts as he sees them and help those who have drawn inaccurate conclusions based on speculation or lack of evidence.

<comment><USER7> If you read to the end of the article, you come across an an interesting comment that might be of relevance here:

"If you think Phillip Roth, one of the greatest living writers, wrote this 2,648 word piece to get a remark on Wikipedia changed, I think you've missed his point.

\- GREGPOMEROY

<comment><USER8> Right. He wrote it because it was a paying gig, it fed I his ego, and he likes writing.

<comment><USER9> Maybe he actually cares about the future of culture, recognizes that Wikipedia is extremely relevant, and wants to make a difference. Maybe he thinks more people outside current 20-somethings should care about this issue, and is thereby inviting them to join in the conversation.

Attribute no more malice to any one else than you attribute to yourself.

</comment></comment></comment></comment></comment><comment><USER10> I really don't understand how Wikipedia feels like a "secondary source" is meaningful: most secondary sources (newspapers being a great example) just print whatever they are told by random non-expert or highly biased primary sources; I have seen this first-hand while talking to reporters doing interviews with me on various topics. In practice, the fact checking departments, even for headline stories in the physical version of the paper for the largest publications in the country, end up just calling the primary source to get a clarification: so, if an article about Roth were to have ended up in the New York Times, Roth himself actually would have been consulted on whether or not it was true, and yet somehow going through that intermediary makes the situation more credible to Wikipedia... insanity.

Further, many secondary sources are actually themselves based on Wikipedia as their primary source: if you then are willing to cite secondary sources as verifications of information that is then posted to Wikipedia, it is highly trivial to end up with self-reinforcing information loops; in addition to there being multiple highly-cited examples of this, I have seen it happen first-hand with a friend constructing such a situation (which eventually got noticed and deleted, but only due to a highly suspicious editor that attempted to track down whether the sources were actually using Wikipedia as their reference; had it been slightly more vague I bet we would forever be stuck with that particular misinformation).

I will even argue that the idea of using secondary sources at all is short sighted: the very secondary sources that Wikipedia is attempting to cite are slowly dying out due to Internet replaces that happen to include Wikipedia itself. In another decade, the source material for remotely credible secondary sources is likely to have dwindled to almost nothing: we will be left with things more akin to wikis and blogs and the kind of broken thought streams that are characteristic of today's Twitter and Facebook: we are (quite sadly, I will argue) quite likely to no longer be allocating such funds to centralized larger sources like the New York Times or the Wall Street Journal to keep them operational.

Finally, I will point out that it ignores the heritage of an encyclopedia: as far as I understand, the way the great encyclopedias were written actually did involve conscripting the world's great minds to write what were in essence summary articles of various parts of their fields so that people in other disciplines, or even the lay person, could rapidly get a general understanding of the subject matter. (One specific place I got this impression was from reading a book about Thomas Young, who wrote a number of articles for the Encyclopedia Britannica). Yet, now, the encyclopedia that has become the de facto standard--I will argue entirely due to technology and community, and not due to the dictates that it claims are so holy--requires information to have first been published in sources like newspapers, rather than sources like academic journals... it is honestly highly depressing.

</comment><comment><USER11> Didn't this already make the aggregator rounds a few months ago when it first came out?

<comment><USER9> If it did, it's still okay to post it now. Have you heard about Marcus Aurelius's Mediations? They're great. You should read them. (Hint: not the first time that's been said in a public forum, or "news aggregator", if that's what you want to call it.)

<comment><USER12> Marcus Aurelius and Phillip Roth's open letter in the same breath? You have cajones I'll give you that!</comment></comment></comment>


About the ZipCPU - <AUTHOR> http://zipcpu.com/about/zipcpu.html <comment><USER2> In addition to the ZipCPU itself, the zipcpu.com website has many useful blog posts for the beginning FPGA developer. I've found it to be a great resource. Mr Gisselquist (a.k.a. ZipCPU) is an active contributor to a number of FPGA forums and, in my experience, is always helpful to newcomers.

</comment><comment><USER3> I'm curious, is there any commercial application for running Linux on a CPU implemented in FPGA, as opposed to any (presumably cheaper and faster) normal CPU? Some kind of custom modification this would allow you to make?

I've always thought of FPGA's as being for custom parallel computationally intensive tasks that run side-by-side with a normal CPU. So just curious if ZipCPU is just for fun, or something more?

(Or is there even something security-related about being able to verify not just the code, but the CPU it runs on, in this case?)

<comment><USER4> Sure, it happens all the time if you want a full os on a core that's tightly integrated with some custom hardware, but you don't want an ASIC (for reconfigurability, or just low volumes).

<comment><USER5> I'm not a hardware engineer, but my understanding is that some FPGAs include an entire cpu core as part of the chip? This seems much more efficient than designing your own.

<comment><USER6> It's almost always more efficient to use an existing CPU if it fits your use case than to design your own. Even if it doesn't, it is often more efficient (time wise) to adapt your use case to the hardware you have available, or write software to resolve the feature you want in hardware but don't have. Only the especially nutty build their own CPUs (I'm especially nutty too)

<comment><USER4> Even if you're not designing your own, dropping a little Microblaze or NIOS down can simplify your design considerably.

<comment><USER6> Oh I know it can, my comment was more tongue in cheek not dismissive :)

</comment></comment></comment></comment></comment></comment><comment><USER7> Strange that there's no mention at all of RISC-V. RISC-V also runs on FPGA, right?

Does it really justify yet another RISC instruction-set?

Impressed that there's apparently already a GCC backend though.

<comment><USER8> The project was started in Sept 2016 which was also the same month that I was first porting Fedora to RISC-V. Given the momentum behind RISC-V and also the huge amount of software now available it would obviously make sense to use a RISC-V compatible design. However hobbyists can do what they want, there's no reason to force someone who wants to design their own CPU to do it in any particular way.

<comment><USER9> I actually started the project almost a year earlier, and made _many_ mistakes before finally presenting at ORCONF in September of 2016.

That said, I am considering a RISC-V compatible design. I just haven't committed to doing so.</comment></comment></comment>


Reverse-engineering the flag circuits in the 8085 processor - <AUTHOR> http://www.righto.com/2013/07/reverse-engineering-flag-circuits-in.html?m=1

<comment><AUTHOR> I find stuff like this fascinating and marvel at how it's even possible to do via visual inspection alone.

It's also sobering to think about how long it would take using a similar process to understand a modern, 20 nanometer chip.

<comment><USER2> I always look at things like this and say that I wish I understood every step of the process, from electrical theory to fabrication.

I have the same approach to software, but I have to keep reminding myself that the things I'm trying to understand took hundreds of people to complete. It's an incredibly annoying internal struggle. I have no idea how to deal with it aside from grinding it all out until I die.

<comment><USER3> Author here: I don't understand every step of the process either :-) But old chips like this at least seem theoretically possible to comprehend in their entirety. I expect it would be pretty much impossible to reverse-engineer and understand a present-day processor with billions of transistors instead of thousands. But I could be surprised - 35 years from now people may be reverse- engineering Xeon chips for fun. And perhaps posting about interesting things they found in Intel's random number circuitry.

</comment></comment></comment><comment><USER4> Thank you for this this great article!

I am currently trying to learn more about the hardware and lower-level aspects of computer, and this was a really interesting read.

You may be interested in checking out an emulator for original IBM computer my friend wrote:

[https://github.com/Alegend45/IBM5150](https://github.com/Alegend45/IBM5150)

It's in really early stages of development, and the BIOS barely boots. Nevertheless, I enjoy reading the code and trying to understand how it works.

I am trying to help him out with it, but I know very little about this kind of stuff (I am just starting out learning about hardware), so I haven't been of much help.

Since you are knowledgeable in this subject area you can help him hack on it if you're interested!</comment>


Applying the Universal Scalability Law to Organisations (2015) - <AUTHOR> https://blog.acolyer.org/2015/04/29/applying-the-universal-scalability-law-to-organisations/ <comment><USER2> If you want to go deeper ( _much_ deeper) on Little's Law, Kingman's Formula and their friends, I highly recommend working through _Factory Physics_ by Hopp & Spearman. It's a thorough coverage and is packed with useful insights.</comment>


Research points to Google auto-complete favoring Clinton - <AUTHOR> http://sptnkne.ws/chad <comment><AUTHOR> Ordinarily wouldn't link to an article like this on Sputnik but the author and the academic work he does is solid (he also indicates he is a Hillary supporter). I noticed some of the trends myself when looking at trends.google.com last month, didn't realise could be policy.

Of particular interest are his experiments on the impact of curated content on decision making, something of increasing importance in our algorithmic lives given who controls the algorithms.</comment>


The 111M Record Pemiblanc Credential Stuffing List - <AUTHOR> https://www.troyhunt.com/the-111-million-pemiblanc-credential-stuffing-list/ <comment><USER2> So in the past I've advocated password algorithms (sometimes called password formulas):

[https://penguindreams.org/blog/password- algorithms/](https://penguindreams.org/blog/password-algorithms/)

I felt like they could bridge the gap between a regular person who is weary of having to look up every password using a password manager (although a lot of them make it easier with browser plugins and phone apps, but it's still an extra step).

However, in light of the recent Gentoo vandalism, it seems like a user had their password formula figured out. Algorithms do guard against credential stuffing; that particular person was most likely specifically attacked. If you have a strong formula, it should take at least 7 or 8 passwords to begin to figure it out.

At a minimum, if you have non-tech friends who use a single password for everything, start them off easy: You should use a manager. It's the only way to guard everything. But if they don't want to go that route, at a bare minimum, recommend that they need three passwords. One that's highly secure for banks, employment and government. One insecure for everything else. And finally one for your e-mail which should be shared with nothing!

Password algorithms are a step up. It's a trade off of course: you are protected against credential stuffing and you don't need a manager; you can have a different password for every site without having to memorize a hundred password; only the exceptions to stupid password rules. The trade off: your algorithm probably sucks and if you're targeted specifically, someone can get to everything.

Every aspect of security involves trade offs. The various password management choices, along with their advantages and disadvantages, should be taught in high school.

<comment><USER3> As someone technically literate but doesn't use a password manager: I sign up for a lot of services on one device (home laptop) and then need to use them on another device (work laptop, phone). How does a password manager work for this?

I currently have about ~15 different passwords I use. I know which to use based on how long I've been using the service. Why is this strategy ineffective?? At most a hacker could get 3-4 of the services I use, and even then they'd need to find each of those services out of the hundreds I use. I also have 4 different emails I use for logins.

<comment><USER4> I use Google Smartlock, and it functions across all my (android) devices quite well. It does sort of rely on your being all-in on the Google ecosystem. At work we use LastPass, but since I only use it on the desktop in a browser I can't speak to how it works across devices.

<comment><USER5> LastPass works for multiple devices, including mobile - you can sync to 1 LastPass account, too.

</comment></comment></comment></comment><comment><USER6> These data breaches where the source isn't known can be frustrating. As someone who already uses unique passwords for everything, there's not much I can do (change 500+ passwords?). And I can understand Troy's argument[1] for not sharing the leaked password, so that doesn't leave many other options.

I guess I'll just start going through my saved passwords and use them to delete all of the old accounts I rarely use, maybe with a little help from the GDPR.

[1] [https://www.troyhunt.com/here-are-all-the-reasons-i-dont- mak...](https://www.troyhunt.com/here-are-all-the-reasons-i-dont-make- passwords-available-via-have-i-been-pwned/)

<comment><USER7> My solution for this is to use a unique email address for each site/ service. That way if I see that firstname.lastname@example.com has appeared in a breach, I know both where the leak came from and which password to change. Also helps identify the source of any spam emails...

<comment><USER8> You can also do this with Gmail by adding a . Or two randomly in your email.

<comment><USER2> Gmail and other MTAs support +something in the e-mail address user part too. If you forget your password, you do have to dig through your e-mail and figured out which one you used, but this method does let you track down when someone sells/shares your e-mail address or 3rd parties.

<comment><USER9> You just have to remember the exact username/email you used in case you forget it. That can include the sitename itself, or some simple transform, but sometimes services change names... so make sure to keep records of exactly the email used for each service (or don't delete your email from them), forgetting that is worse than losing the password, since there's often no helpful recovery service they offer.

<comment><USER10> The bigger problem is MANY MANY sites don't accept the (+) in an email address.

<comment><USER11> Yes. More and more sites are using common frameworks and/or validation libraries where a + is not considered to be an acceptable part of the recipient name.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> If the term Credential Stuffing is new to anyone, we've done a deep dive into what it is and the tools that are used here: [https://breachinsider.com/blog/2017/credential-stuffing- how-...](https://breachinsider.com/blog/2017/credential-stuffing-how-breached- credentials-are-put-to-bad-use/)

We saw this pretty regularly at my old job, with attacks almost daily. They range from 'script kiddie' who just use the default tool settings and do it all from one IP making it easy to spot, to persistent attackers who would play cat and mouse with our live defences. They'd switch IPs using huge proxy lists found online every few minutes, as well as learn our alerting thresholds and attempt to fly just under the radar. For some reason though, they always seems to user UserAgents that were ancient, or weren't real, allowing us to identify attack traffic compared to our normal user activity.

<comment><USER13> Did you try to find attackers in the set of unconspicious UAs? If you did not try hard to look for more skilled adversaries, expect some to be hiding from your analysis. Once you don't see anything in a large range of skill/sophistication, you can assume there to be no adversaries that don't have the ability to pull a Stuxnet off. And if you need to guard against those, and have the ressources to do so, you already know this.

<comment><USER12> Agreed, based on other thresholds and alerts, we certainly saw some more advanced actors - using in-country home broadband lines to conduct the attacks. This made tracking and blocking them much harder, as there was a risk of blocking genuine customers who simply didn't conform to our idea of 'normal'. We ended up finding another way to fingerprint them, but thank you for calling that out, as you are entirely right that there is almost always someone trying to be truly covert.

If anyone is suffering with these types of attacks (or isn't and you think you're missing something) feel free to reach out, more than happy to help - email is in my profile

<comment><USER13> I hope you have more than one distinct way to identify these more sophisticated attacks, as you would want to be able to ensure there are no others that are only a few steps better than them.

As said, you need to vet a range of sophistication above the most sophisticated example you actually encountered, to assume there are no others that you could reasonably detect with the techniques you could deploy. Always make sure to know you'd see anyone who is only one level better than the best you encountered, where the size of such a level should be estimated from the density you see in the distribution of attacks.

You are also good if you don't automate defense with the best detection you have, so that you prevent an attacker from automatically judging the quality of your detection capabilities with you then believing the attacker got stopped when he just deployed a technique you can no longer see.

I.e., make sure you don't alert an attacker that you can still see him when you are just barely still able to do so, as you would not want him to up his camouflage to the point where you won't see him anymore.

</comment></comment></comment></comment><comment><USER14> Is anyone else annoyed by the native advertising for 1Password there, without any disclosures that they are affiliate links?

I've lost pretty much all of my respect for Troy Hunt as he went from maintaining a useful service to just being another ad for 1Password.

<comment><USER15> His website has always read as thinly-veiled content marketing for Cloudflare and Azure. If you can look past that at the actual informational content, and disregard the specific products mentioned, it's worth reading.

</comment></comment><comment><USER16> >the rapid rise of the rapid rise of credential stuffing attacks

Maybe I was wrong but I always thought that was the "point"...

At least in the sense that as far as profitability goes the point of hacking or gaining access to a list of hacked passwords from say a boring site like some image sharing site was that you then take that and use it to do more nefarious things like access banking stuff, more sensitive identity related things, spying, etc.

Obviously there are folks out there hacking away for their own enlightenment or fun, but ultimately anyone looking to do more than that, I always thought the point was credential stuffing all along, otherwise who cares what someone's Flickr username and password is?

</comment><comment><USER17> Where can I download the list? I want to see what password was shared.

<comment><USER18> He loaded them into this site to check: [https://haveibeenpwned.com/](https://haveibeenpwned.com/)

I'm not sure troy shares the lists - for obvious reasons.

<comment><USER19> His site is basically one big advertisement for 1password now. I would not trust it.

<comment><USER20> What do you distrust?

Do you believe he's lying about the existence of certain breaches? Returning false results for whether a password is compromised? Be specific: what untrustworthy things do you suspect him of?

<comment><USER19> Since his website is now an advertisement, it's wise to take everything he says with skepticism.. is he pushing the product, or is he providing good advice? What's his motivation for helping users when his main focus is on pushing ads?

As others have pointed out in response to me, he's incredibly dishonest in claiming that his website is funded by him on one page, but clearly he's being paid by a company selling something. He injects ads into email notifications without identifying them as such.

If someone is acting untrustworthy 50% of the time, would you still trust them 100% of the time?

<comment><USER20> So, what untrustworthy things do you suspect him of?

FUD is not useful.

</comment></comment></comment></comment></comment></comment><comment><USER21> Does IIIm mean 111m or 3m (roman number)?

<comment><USER22> Where do you see "IIIm"?

<comment><USER23> In the title right here on HN, it says 111M. Guess the HN font doesn't clearly distinguish between 1 and I clearly enough.

<comment><USER24> It's even worse on the site, they use [https://fonts.google.com/specimen/Vollkorn](https://fonts.google.com/specimen/Vollkorn)

</comment></comment></comment></comment><comment><USER25> what about an email-as-login authentication? click url link on your phone to log in.</comment>


Computer Utopias - <AUTHOR> http://chrisnovello.com/teaching/risd/computer-utopias/ <comment><USER2> I sincerely wish there had been a class like this when I was in school. The reading list here has some really fascinating stuff in it, several of which I'd never seen before, many of which are things that have inspired Eve. It's really exciting to see more people starting to dig into alternative ways of thinking about computation. More generally, it'd be nice to see more classes that encourage thinking about all the coloring we could do outside of the lines.

<comment><USER3> Hey! Thanks so much for the kind words! Your work was an inspiration for the course and everpresent in our conversations!!

</comment></comment><comment><USER4> Chris is a personal friend and really on the verge of something amazing. We talked about this very class in May and he's really pushing the boundaries on things - the collection here is a good start for someone to start to really think differently.

</comment><comment><USER5> Brings to mind Bret Victor's screed on the touch interface. Brilliant. Will be relevant for a long time to come, sadly. [http://worrydream.com/#!/ABriefRantOnTheFutureOfInteractionD...](http://worrydream.com/#!/ABriefRantOnTheFutureOfInteractionDesign)

</comment><comment><USER6> Looks really awesome, I echo ibdknox's sentiments - I'm a bit suprised not to see Pandora's Vox ([http://folksonomy.co/?permalink=2299](http://folksonomy.co/?permalink=2299)) by Humdog ([https://en.wikipedia.org/wiki/Carmen_Hermosillo](https://en.wikipedia.org/wiki/Carmen_Hermosillo)) on the reading list - I reckon you'd find it very interesting.

</comment><comment><USER7> This is an interesting link collection, but it's framed in the worst kind of academic prose. I wish the author had the intellectual courage to write more plainly.

<comment><USER4> This is how he is - he even speaks like this; there was never a lack of courage I am certain of that.

</comment></comment><comment><USER8> I could have done with a little less distraction in the presentation but the article collection is interesting.

</comment><comment><USER9> this guys website is awesome, his course looks awesome, and his projects & mission are admirable. consider me mancrushing.</comment>


Why Hiring Is So Hard in Tech - <AUTHOR> https://medium.com/javascript-scene/why-hiring-is-so-hard-in-tech-c462c3230017#.kn3vu6fvp <comment><USER2> yup. reminds me of [http://members.founderdating.com/discuss/5081/Do-you- think-I...](http://members.founderdating.com/discuss/5081/Do-you-think-I- could-fundamentally-change-the-technical-recruiting-industry-with-this-idea)</comment>


JavaScript ( (__ = $ + $)[+$] + ({} + $)[_/_] +({} + $)[_/_] ) - <AUTHOR> http://adamcecc.blogspot.com/2011/01/javascript.html <comment><USER2> Here's a converter from regular JS to using a subset of these characters: [http://discogscounter.getfreehosting.co.uk/js- noalnum_com.ph...](http://discogscounter.getfreehosting.co.uk/js- noalnum_com.php)

And the forum thread where this technique was explored at length: <http://sla.ckers.org/forum/read.php?24,33349,33405>

Superfun. :D

<comment><USER3> "jjencode" generates more short code: <http://utf-8.jp/public/jjencode.html>

And "aaencode" Encode any JavaScript program to emoticons: <http://utf-8.jp/public/aaencode.html>

</comment></comment><comment><USER4> This is pretty cool. Reminds me of a Defcon presentation that only used whitespace characters to encode the script (and a bit of boilerplate). I think it looks less suspicious than lots of symbols lumped together.

Here it is: [https://www.defcon.org/html/links/dc- archives/dc-16-archive....](https://www.defcon.org/html/links/dc- archives/dc-16-archive.html#Kolisar)

[https://www.defcon.org/images/defcon-16/dc16-presentations/d...](https://www.defcon.org/images/defcon-16/dc16-presentations/defcon-16-kolisar.pdf)

</comment><comment><USER5> For those like me who stumble upon this type of js expressions for the first time and are scratching their heads, John Resig (of jQuery fame) attempted some basic explanations in this old HN post:

<http://news.ycombinator.com/item?id=1154338>

</comment><comment><USER6> Great use of JavaScript's weird + operator.

The whole trick stems from the fact that !$ == false and !$+$ == "false"

<comment><USER7> Wow, I knew the + operator was weird, but didn't realise it allowed you to do stuff like that.

What I don't get though, wouldn't you still need to call eval() on it to do anything with it? Or does javascript do a 'implied eval' when you try to call a string?

<comment><USER7> Ah found the answer to my own question in the reddit thread about the same thing: <http://www.reddit.com/r/programming/comments/f6xto/_/c1dr729>

<comment><USER8> This is what is missing in the article, thank you

</comment></comment></comment></comment><comment><USER9> I'm missing the purpose. Can someone explain?

<comment><USER10> Some people think that they can secure their sites against XSS by regexing all the "bad JavaScript" out. If the "security software" sees "document.cookie", then it stops the script from executing. (Or it just replaces it with the empty string, etc.)

Problem is, there are a lot of ways to say document.cookie, and a blacklist is going to miss one of them.

Moral of the story: if people can execute scripts on your page, you're 0wned. Everyone competent knows this, but sometimes the less competent are slow to realize this.

So, the script that the article describes is for their benefit. Good luck writing a regex to stop this one...

(There are also even simpler "exploits", if you regex document.cookie to the empty string, then "document.document.cookiecookie" regexes to "document.cookie". Ooops.)

<comment><USER11> > Problem is, there are a lot of ways to say document.cookie

Could you give an example?

<comment><USER12> Using the converter linked above[1] I can convert

        alert(document.cookie)

to the equivalent

        ([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()[(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]])(([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()[([][[]]+[])[!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+([][[]]+[])[+[]]+((+[])[([][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]+([][[]]+[])[+!+[]]+(!![]+[])[+[]]])[([][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+[][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()[(![]+[])[+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()+[])[!+[]+!+[]]]((![]+[])[+!+[]]+[+[]])[+[]]+(![]+[]+[][[]])[+!+[]+[+[]]]+(!![]+[])[!+[]+!+[]+!+[]]])

        [1] http://news.ycombinator.com/item?id=2129815

<comment><USER13> How would you protect against that ? is encoding the output enough ?

<comment><USER14> Sanitize both input and output. Make sure everything outputted is encoded. < to > > to <, " to &quote;, etc. As long as all they can write is normal characters then you're safe [1].

[1] Or rather, safer. There are always obscure ways to get around almost everything. So you really have to take care to exactly the situation you're in at the moment.

<comment><USER15> Sanitize everything, use multiple redundant sanitizer libraries (there are several out there that handle different things), and use a whitelist, rather than a blacklist, based approach. If you want to allow the use of <a> tags, enforce that they adhere to the exact format of a safe <a> tag, otherwise encode or strip them. One look at the XSS cheatsheet page should be enough to convince any sane developer of the futility of a blacklist-based approach.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> The perfect gag gift for a new dev team member. "this is an example of our coding style"

<comment><USER17> Is it bad that I first tried to interpret it as Perl, even though it was clearly labeled as JavaScript?

</comment></comment><comment><USER18> If all those blackhat-efforts could be put to better use somewhere.. although its fascinating what _can_ be done. They are truly creative in their own way. :)

</comment><comment><USER19> I'm a little confused. It seems like he didn't need to call the sort function in order to call the alert function. Is this correct? He could have built the alert call in the same manner and just call it by itself. I assume the sort function was thrown in there for a larger example?

<comment><USER20> The reddit link in the post right above yours explains that sort is used to get a reference to the "window" object since sort returns "this" and by assigning it to a variable it returns the default context which in this case is "window".

</comment></comment><comment><USER21> Searching for this string on Google, as I have no access to blogspot, I fell down on <http://asdfg.jodi.org> (js art, NSFW and may kill your browser). It is related, somewhat.

</comment><comment><USER22> I saw these long back in a forum that listed such expressions for all printable characters; I am unable to locate them now. Can someone help? Thanks!

<comment><USER23> See Paul Irish's comment: [http://adamcecc.blogspot.com/2011/01/javascript.html?showCom...](http://adamcecc.blogspot.com/2011/01/javascript.html?showComment=1295666584419#c4861796849333913434)

</comment></comment><comment><USER24> I wonder if you could use this in an interview...

<comment><USER25> This is great idea, if your goal is to not hire anyone.

<comment><USER26> except HN readers

<comment><USER27> How many of them can understand this?

<comment><USER28> Before or after this article was posted?

</comment></comment></comment></comment></comment><comment><USER29> This post makes me feel dumb. :(

</comment><comment><USER30> Well, that was interesting.

</comment><comment><USER31> why he needed $=[$=[]] and not just $=[[]]

<comment><USER32> The second $ (which is actually the first assignment) was used as as an alias to [] before the first $ gets assigned. I guess to reduce the number of characters.

<comment><USER31> it actually increases the number of chars.

inner $=[] will be overwritten by outer $=[$], which is the same as $=[[]]

or am i missing something?

<comment><USER32> It doesn't get overwritten until the rest of the expression has been evaluated, thus $ == [] for all the uses of $ within the expression.

<comment><USER31> still not clear.

the code unobfuscated is: (a=[a=[]]['sort'])()['alert'](1)

my argument is that this is the same, and less chars (a=[]['sort'])()['alert'](1)

I can't see any benefit of the encapsulation of the array assignment there.

edit: also, just noticed that my previous comments i was writting $=[[]] when i was thinking of $=[], but both works the same, and are still less chars :)

<comment><USER32> Ok here's the best I can do:

(lines are numbered in order of execution, with explanations of each line)

        ($=[                // 14: $ = Array.prototype.sort ([]["sort"] = Array.prototype.sort)
            $=[]            // 1: $ = []
        ][
            (__= !$+$ )[    // 2: __= "false" (![]+[] = false+[] = "false")
                _=-~-~-~$   // 3: _= 3 (-~-~-~[] = -~-~-(-1) = -~-~(1) = -~-(-2) = -~(2) = -(-3) = 3)
            ]+              // 4: "s" ("false[3]" = "s")
            ({}+$)[         // 5: "[object Object]" ({}+[] = "[object Object]")
                _/_         // 6: 1 (3/3 = 1)
            ]+              // 7: "o" ("[object Object]"[1] = "o")
            ($$=            // 12: $$ = "rt"
                ($_=        // 9: $_ = "true"
                    !''+$   // 8: "true" (!''+[] = true+[] = "true")
                )[_/_]+     // 10: "r" ("true"[3/3] = "true"[1] = "r")
                $_[+$]      // 11: "t" ("true"[+[]] = "true"[0] = "t")
            )               // 13: "rt"
        ])()[               // 15: window (sort() = window)
            __[_/_]+        // 16: "a" ("false"[3/3] = "false[1]" = "a")
            __[_+~$]+       // 17: "l" ("false"[3+(~$)] = "false"[3+(-1)] = "false"[2] = "l")
            $_[_]+          // 18: "e" ("true"[3] = "e")
            $$              // 19: "rt"
        ](_/_)              // 20: alert(1) (window["alert"](3/3) = alert(1))

[] is assigned to "$" in step one. Several of the steps between 2 and 11 reference "$" to save one character rather than typing

If you wanted to remove the a=[] you'd have to include a bunch of "[]"s inline, e.x.:

        ($=[][
            (__= ![]+[] )[
                _=-~-~-~[]
            ]+
            ({}+[])[
                _/_
            ]+
            ($$=
                ($_=
                    !''+[]
                )[_/_]+
                $_[+[]]
            )
        ])()[
            __[_/_]+
            __[_+~$]+
            $_[_]+
            $$
        ](_/_)

Replacing the no-alpha variable names with letters might help:

        (F=[
            A=[]
        ][
            (B= !A+A )[
                C=-~-~-~A
            ]+
            ({}+A)[
                C/C
            ]+
            (D=
                (E=
                    !''+A
                )[C/C]+
                E[+A]
            )
        ])()[
            B[C/C]+
            B[C+~F]+
            E[C]+
            D
        ](C/C)

Notice both "A" and "F" were "$". The original code reused "$" to save a character.

I'm not sure I can make it any clearer.

<comment><USER31> wow that was sure detailed.

but i'm still not convinced of the steps :)

($=[][(__=!$+$)[_=-~-~-~$]+({}+$)[_/_]+ ($$=($_=!''+$)[_/_]+$_[+[]])])()[__[_/_]+__ [_+~$]+$_[_]+$$](_/_)

here i kept $, only step 11 required [] instead of $

i'm guessing step 14 is actually executed earlier... or that undefined has the same effects as [] for most of those stringfying hacks. Update: no, undefined trhows an error. so step 14 is earlier... let me replace all that with a eval function that also stores the run order. then i will post the correct ordering.

<comment><USER32> No, step 14 is definitely executed after the rest of that expression. Steps 2, 3, 5, 8, and 10 assume that $ equals [].

If you still refuse to believe me, I give up.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER33> Perl puts that ugliness to shame.</comment>


Growing Sentences with David Foster Wallace - <AUTHOR> http://www.kottke.org/09/03/growing-sentences-with-david-foster-wallace <comment><USER2> Hmm, DFW's sentences are occasionally indulgent, but they don't sound like this. Here's a sample chosen (somewhat) haphazardly:

 _If we want to know what American normality is -- what Americans want to regard as normal -- we can trust television. For television's whole_ raison _is reflecting what people want to see. It's a mirror. Not the Stendhalian mirror reflecting the blue sky and mud puddle. More like the overlit bathroom mirror before which the teenager monitors his biceps and determines his better profile. This kind of window on nervous American self-perception is just invaluable, fiction-wise._

His style begs to be parodied but this is a facile attempt, in my opinion.

<comment><USER3> The difference between DFW and this article is that DFW writes really, really good sentences, that just happen to be incredibly huge. A parody most likely won't be as good unless the parodist is brilliant as well (see the "Oxen of the Sun" chapter in Ulysses).

</comment></comment><comment><USER4> You can do this to any sentence fragment. "Eleanor Rigby was lonely [1], like many others." Fuckin' Beatles.

It sure does help to have the ideas to back up the style, though.

[1] (Here I should mention a habit of hers I had long noticed but never commented on, which habit was that she would walk through churches after weddings, employing her falcate digits to retrieve the spent grains of the matrimonial offering.)

</comment><comment><USER5> It's worth taking a look at the results of the David Foster Wallace Parody Competitions:

<http://www.thehowlingfantods.com/parody.htm>

Making lighthearted jokes about Wallace's syntax and verbosity are the common first steps I've watched people make when they begin reading his prose, but it usually doesn't take very more reading at all for these people to see that even attempting to parody Wallace on a humorous, surface level would require the kind of introspection and effort that takes a near-lifetime and of the sort that probably isn't the most satisfying or healthy way for a person to spend their time.

</comment><comment><USER6> DFW's latest fiction in the New Yorker was really scary: [http://www.newyorker.com/fiction/features/2009/03/09/090309f...](http://www.newyorker.com/fiction/features/2009/03/09/090309fi_fiction_wallace)

</comment><comment><USER7> Man, I wish he would have written another epic work of fiction before he died. So sad. I loved Infinite Jest and Broom of the System.

<comment><USER4> You saw they're publishing The Pale King?

[http://www.newyorker.com/reporting/2009/03/09/090309fa_fact_...](http://www.newyorker.com/reporting/2009/03/09/090309fa_fact_max?currentPage=all)

<comment><USER7> Oh wow, thanks for the link!

</comment></comment></comment><comment><USER8> Compare DFW with authors like Albert Camus and Simone Weil and it becomes pretty clear a particular style has little to do with an author's perceived brilliance -- it's about ideas.

</comment><comment><USER9> Maybe the grammar section of my brain is slow today, but I didn't understand the "absolute construction" at the end.</comment>


Basic CS Reading List – M. Douglas McIlroy (2010) - <AUTHOR> http://www.cs.dartmouth.edu/~doug/booklist <comment><USER2> Are you sure this list is "Basic"? for example "Gedanken Experiments Concerning Flows at High Reynolds Number"?

This list seems more like a set of specialized studies for an 'elective' topic course.

<comment><USER3> They aren't real books. This is a joke.

<comment><USER4> The one by EWD appears to be real [https://www.cs.utexas.edu/~EWD/transcriptions/EWD03xx/EWD340...](https://www.cs.utexas.edu/~EWD/transcriptions/EWD03xx/EWD340.html)

Edit: Ok, I admit it's not a _book_...

<comment><USER5> The joke in this case is that it's the only one of these titles that's real. (Probably the only.)

</comment></comment></comment></comment><comment><USER6> My favorite is you have all these pun titles and then:

> The Humble Programmer - E. W. Dijkstra

Which is actually the title of that essay by Dijkstra! [http://www.cs.utexas.edu/users/EWD/transcriptions/EWD03xx/EW...](http://www.cs.utexas.edu/users/EWD/transcriptions/EWD03xx/EWD340.html) I guess this guy really doesn't think much of that essay?

<comment><USER7> I assume the joke is about Dijkstra and "humble".

[https://news.ycombinator.com/item?id=11796926](https://news.ycombinator.com/item?id=11796926)

</comment></comment><comment><USER8> Hilarious.

"The Fellowship of Bacchus - P. Naur" is especially amusing as Backus and Naur were reputed to not get on.

</comment><comment><USER5> These are hilarious. I'm sure I'm not alone in saying some of them zipped right past me. E.g. "The Fellowship of Bacchus - P. Naur" \- ???

<comment><USER9> Accordingly, I guess that "Trajan" (a real "Roman Emperor") is an interpolation of ACM Turing alum Robert Endre Tarjan, the developer of several important algorithms and data structures.

</comment></comment><comment><USER10> Briefing for a Recursive Descent into Hell - Benoit Mandelbrot

Brilliant!</comment>


Would you use it: A new address book? - <AUTHOR>

I've been thinking about a problem I had for quite a while now: Contact information that are out of date from people that I haven't talked to in a while or are missing altogether (like postal addresses) because I didn't add them.
Here is the core idea:
An app that works as a better address book but can automatically inform your friends or certain groups whenever you change your profile (job, address, phone number, website, important milestones etc.). The app will automatically push the update to their address books or send them a notification when they don't have the app installed. The same will happen, when they update their own information.
Would you use it? <comment><USER2> I'd love it if Facebook did this. But Facebook don't allow you to sync your FB friends' contact details onto your phone --- it's actually against their TOS for you to automatically extract your friends' contact details from facebook.com.

Would I use a standalone app that did this? Chicken and egg problem: you've got to make your app useful to me even if none of my friends use it.

If a particular friend also uses your app, can you mark their contact details as being guaranteed-up-to-date?

If a particular friend _doesn't_ use your app, can you remember when I entered their details and keep track of how stale they are? If I text them and the text doesn't get through, can you highlight their number as possibly not working any more?

<comment><AUTHOR> Thanks, mooism2. Good points. Would you use a new app that makes the "search contact(s) → call/write/message" faster and more beautiful?

If a friend also uses your app, can you mark their contact details as being guaranteed-up-to-date? → That is the idea that I want to build the app around.

If a particular friend doesn't use your app, can you remember when I entered their details and keep track of how stale they are? → Good point. One solution would be to regularly send them an email (maybe once every three months) with the request that to send you their updated information (via email).

If I text them and the text doesn't get through, can you highlight their number as possibly not working any more? → That wouldn't be necessary after they use the same network as well. Otherwise: Cool idea, I will add it to the list.

<comment><USER2> _One solution would be to regularly send them an email (maybe once every three months) with the request that to send you their updated information (via email)._

I wouldn't want the app to send this sort of communication in my name.

 _Would you use a new app that makes the "search contact(s) → call/write/message" faster and more beautiful?_

The standard ios app is quick and pretty enough for me.

</comment></comment></comment><comment><USER3> I can sync my contacts on my Android phone with LinkedIn, Facebook etc. So I can see all this information already.

What else does your app do?

<comment><AUTHOR> A couple of things.

\- The idea is to release the app on all platforms. So whenever you lose your phone, get a new one or work on different platforms you can just install the app and all your contacts get updated automatically (including a web interface if you need it).

\- I talked to many people about the But Facebook and LinkedIn does that already thing. I asked them if they share private contact information like your birthday, current address, or private phone numbers and most don't. This is where the app comes in:

I developed the app with the idea in mind to be able to delete my Facebook account without losing the contact information. The main benefit of the app will be to have an always up to date contact information, because everything else grows from here: organize a party, message a friend I didn't talk to in a long time, or send a postcard as a surprise because you can be shure that your friends added their address to their profile.

\- The app focuses on tight security, because nobody likes to make their contact information public.

\- The vision is: Instead of having hundreds of half synced contacts (some have only a website link or an old email address after I tried a facebook sync), you can build a contact network that is based on quality information and grows in quality over time with every new contact you add to the network.

</comment></comment><comment><USER4> Is this idea like Plaxo?

<comment><AUTHOR> Yes and no. The core idea is a lot like plaxo - keep your contact information up to date. But everything else should be a lot simpler:

\- The address book doesn't try to use automated updates from Facebook and Twitter. Instead it just shows what people add to their profile.

\- The app won't try to reinvent the address book. It is build on top of your existing address list and wants to It will just be faster to get to actions (call, message, search) and pair it with "self-updating" contact information.</comment></comment>


Ask HN: LinkedIn Distraction-Free Extension? - <AUTHOR> I'm thinking of building another extension to make Linkedin distraction-free and more pleasant to navigate.
I noticed most of the time, I'm focused on my feed rather than the right and left blocks.
Prototype here: https://twitter.com/leonagano/status/1253034869921325064?s=20
What do you think? Any other things I should consider? <comment><USER2> Personally I only use LinkedIn to get in touch with recruiters and be reachable and completely disregard the feed or any of the other Facebook-like bullshit they're trying to implement.

My workflow is to disable all e-mail notifications except those for incoming messages so that I receive an e-mail if someone messages me (and I can reply directly by e-mail too).

</comment><comment><USER3> I've been accessing LinkedIn via Safari on both macOS and iOS and using [https://1blocker.com](https://1blocker.com) to block feed and notifications. Rules are synced on iCloud and applied in all devices. So far has been working well for a couple years.</comment>


Ask HN: Why do companies interview using Google Docs as a coding environment? - <AUTHOR> Why do companies like Google and Asana push developers into writing "production quality" code in a non-IDE like Google Docs during tech screens? <comment><USER3> During coding interviews, I'm looking for the following evidence in a candidate:

1\. how good is the candidate at problem solving?

2\. is the candidate able to think in code?

3\. are there any glaring syntax errors?

To assess the above three, a whiteboard, paper or Google Docs is sufficient. I'm not averse to using an IDE, just that the IDE's syntax checking hints will shift the candidate's focus to writing syntactically accurate code (#3) rather than on the problem (#1 and #2).

<comment><USER4> If all the interviewers were like that I'd be OK with using whatever they want. But one time I was doing a Python exercise on a google doc and I was missing a colon after an if statement. The guy had me for a couple of minutes trying to find my "error" without telling me it was syntax. The algorithm was correct.

The other problem I see is when you don't agree on something with the interviewer. One guy made me write some fictitious SQL queries on a doc and then asked me some questions. He was wrong about several things but we didn't have any way to test it. I was so shocked he didn't know that stuff that I had to tested after to see if I was actually wrong, but no.

</comment></comment><comment><USER5> I've never heard of this, and it's completely insane. It sounds like satire.

Stay away from companies that do this if you can. It indicates a deeply broken hiring culture.

<comment><AUTHOR> lol it's literally the initial tech screen for Google

</comment></comment><comment><USER6> I think we're going a little bit crazy with the complaints about the tech interview process lately (I'm not a fan as well). Now it's the shared scratchpad to blame as well?

It's just a shared buffer that works pretty reliably and no interviewer cares about your typos or lack of indentation.

</comment><comment><USER7> So, they're basically hiring humans to mimic the features of an IDE? Right, sounds like solid plan ...

Honestly, I have no idea why anyone would do this. What this will achieve at best is optimising for rote learning and selecting for people who are capable of writing syntactically perfect code unassistedly. This however is an unrealistic scenario during daily development work because that's - <USER2> other things - what an IDE is for.

Problem analysis, mapping requirements to code, finding solutions in a deliberate rather than haphazard manner - these actually relevant aspects of software development aren't assessed at all by such a 'process'.

</comment><comment><USER8> I'm part of my company's hiring guild. We are revamping the way we hire. Someone on the HR side proposed and almost got Google Docs as part of the tech screen and on site coding interviews. I successfully pushed back. The real goal is collaboration or collaborative editing, and that is just the first tool that jumps to mind. There are others. What I'm pushing for is just screen sharing (probably with zoom or hangouts) and the candidate uses their own computer or a loaner laptop.

</comment><comment><USER9> It shows mastery of the language, one could argue. With the tools available today it makes development a lot faster and easier. Functions have tooltips on how to use it, you can scroll through the available functions, libraries imported, and more. While it is unpleasant, it is an exercise that demonstrates your independence from dev tools.

</comment><comment><USER10> why do they care if you have memorized all of each languages specific apis when you can easily look them up on the fly with intellisense or similiar. My own pet peeve since being super dyslexic despite being a solid programmer I memorize very little just the general idea and capability of how different constructs generally work across languages.

<comment><USER11> For what it's worth, when I do coding interviews, I really don't care if the candidate calls the function at() or get() or find(), whatever that particular library in that particular language actually has, as long as their usage of the supposed function is appropriate in the language.

<comment><USER10> I've transitioned away from spending too much on coding and mostly ask stylistic open ended questions although I still do some coding when interviewing a candidate. As a dyslexic though the current industry white board interviewing process is a poor indicator of how I actually perform in the real world.

</comment></comment></comment><comment><USER12> I don't know if they are ok with you taking the liberty to make some changes to google docs.

There is an add on called Code Blocks that you can install on google docs for free. Huge language support - but don't expect it to be a fully functional ide.

Other than that, you'll want to turn off auto-capitalization, and spell checking from Tools->Preferences.

</comment><comment><USER13> Worse is better. It's an easy place to do collaborative editing. For google specifically, I think they leverage some google docs automation for capturing artifacts for hiring committee in their interview workflow.

<comment><AUTHOR> It's not though. They expect shit to run afterwards. As someone who primarily writes Python (whitespace matters) in Vim (it's universal), having to code in Google Docs is a horrifying experience

<comment><USER14> _They expect shit to run afterwards._

No reasonable interviewer expects you to write perfect code on a whiteboard or in a non-IDE editor. I'm sure there are plenty of unreasonable interviewers, which is an indicator that you don't want to work for them.

<comment><AUTHOR> That was my thought, but I got syntax complaints after my first tech screen with Google. Now Asana is asking me to do the same so I'm hesitant to even move forward.

</comment></comment></comment></comment><comment><USER15> Never heard of this, is this an actual thing?

<comment><USER4> Yes, happens very often.</comment></comment>


600K concurrent HTTP connections with Clojure and http-kit - <AUTHOR> http://http-kit.org/600k-concurrent-connection-http-kit.html

<comment><USER2> I'm pretty impressed, and especially by the apachebench test -- to serve a spike of 30K reqs/s while having 600K idle connections is quite good.

</comment><comment><USER3> Does anyone know how they managed to not only bypass the C10k limit, but bypass it by a factor of 60?

<comment><USER4> From what I understand C10K was mostly a RAM limitation. As system ram got bigger the limit has naturally risen. Here are some guys hitting a million in Erlang.

<http://blog.whatsapp.com/index.php/2011/09/one-million/>

HN discussion for the above link. <https://news.ycombinator.com/item?id=3028547>

<comment><USER5> From my understanding, the C10K concept is more a thread problem than a RAM limitation. It happens when each request create its own thread on server (as in Apache or IIS). Computer have problem to run 10,000 threads in same times: too much time is consumed by the OS to find the one thread that is not blocked/locked or waiting for datadabase results.

Node.JS solve this problem by doing all in Asynchronous way (in only one thread). GO solve this pb by doing clever threads (goroutine). Functional programming seems to be very good on this issue (no need of lock mecanism and light thread).

</comment></comment></comment><comment><USER6> Java NIO has amazing performance. I'm surprised not more JVM languages taking advantage of it.

<comment><USER7> Netty has become the standard library for NIO on the JVM and is used widely by programmers in various JVM languages. It's also refreshing to see high performance NIO systems written without using Netty for a change.

</comment></comment><comment><USER8> Earlier discussion, primarily about benchmarking: <https://news.ycombinator.com/item?id=5127251>

</comment><comment><USER9> So? Not really impressed. WhatsApp are getting over 2M concurrent HTTP connections with Erlang in a _production_ system. And this was 1 year ago. [http://blog.whatsapp.com/index.php/2012/01/1-million-is- so-2...](http://blog.whatsapp.com/index.php/2012/01/1-million-is-so-2011/)

<comment><USER7> The Whatsapp 2 million connection result was on a 24 core box with a ton of RAM. The Clojure benchmark was pulled off on a 4-core desktop. Also, Whatsapp connections are mostly idle, only a small fraction of users would be sending a message in any given second.

Edit: It looks like the test was run only on localhost, which also means that it artificially removes much of the processing and actual network I/O factors from the equation.

<comment><USER10> This is a good point, the exact hardware comparison is as follows:

           | Clojure | WhatsApp
      </comment></comment></comment><comment></comment><comment></comment><comment></comment><comment>---
      CPU  | i7-2600 | Xeon X5675
      Clock| 3.4GHz  | 3.07GHz
      Cores| 4       | 24
      RAM  | 16G     | 96G
      Conns| 600,000 | 2,000,000

It seems pretty clear that the performance increase is line with the better hardware specs.

</comment><comment><USER11> This does not measure 600k concurrent _active_ connections because each client only sends a request once every 5-45s. To see how many concurrent _active_ connections you can support you need to understand how much RAM each connection consumes and how much RAM is available to your application.

</comment><comment><USER12> Are they using the same box to run server and clients? I can't figure that out from TFA.

Wouldn't it be better if clients are running on different machine(s)?

</comment><comment><USER13> Does this process also have 600K threads?

<comment><USER14> No, it's evented, I think it's setup to use 4 worker threads by default.

[edit]

[https://github.com/http-kit/http- kit/blob/master/src/org/htt...](https://github.com/http-kit/http- kit/blob/master/src/org/httpkit/server.clj#L14)

[https://github.com/http-kit/scale-clojure-web- app/blob/maste...](https://github.com/http-kit/scale-clojure-web- app/blob/master/src/main.clj#L24)

</comment></comment><comment><USER15> Old news [1].

[1] <https://news.ycombinator.com/item?id=5127251>

</comment><comment><USER16> Y'know... that little "K" abbreviation on the end is a pretty important detail. I skimmed the article about three times, thinking to myself: "600 users... Really? Big deal."

It wouldn't hurt to actually emphasize "600,000" by explicitly expressing all of the zeroes.

<comment><USER17> "That little K abbreviation" is kind of a common thing... I'm not sure what your experience is, but in order to understand a lot of what gets discussed on the web in terms of performance, you'll need to improve your attention to detail.</comment></comment>