Apple becomes No. 3 PC maker in US with industry-leading 21% growth - <AUTHOR> http://www.appleinsider.com/articles/12/01/11/apple_becomes_no_3_pc_maker_in_us_with_industry_leading_21_growth.html <comment><USER2> And that doesn't even include iPads

</comment><comment><USER3> The biggest issue with the presentation of numbers like these, assuming numerical accuracy, is equating an Apple PC with a Dell PC. Not only are they apples and oranges (pun intended), it also puts a zero-sum total into the conversation. If anything, the specific quarter numbers aren't nearly as important as the trailing 8-12-16-however-far quarters to consider the trend of where things are headed.

Because Apple devices have a premium price point against those from HP and Dell, there's a natural market effect where the ceiling of Apple customers exists that doesn't apply to HP and Dell. What we don't know is where that ceiling exists, since Apple continues a near-linear trajectory growth line.

Additionally, I'm not sure that growth is a negative to HP and Dell, i.e. a customer chooses Apple OR HP/Dell, in a one-or-the-other scenario. Simply showing Apple growing it's market share here doesn't necessarily mean HP or Dell shipped fewer units.

Nonetheless, Apple is the only one on the list making material gains with its products, not anyone else.

<comment><USER4> * Simply showing Apple growing it's market share here doesn't necessarily mean HP or Dell shipped fewer units.

Simply, HP & Dell shipped fewer units. Evidence: Gartners' chart headings. One of which read, "4Q10 Shipments" the other, "4Q11 Shipments". But I went to art school, maybe a decline in shipments doesn't mean they sold fewer units?

Looking forward to your thoughts.

<comment><USER3> Missed those numbers, didn't see them for some reason (blaming it on coffee, at the moment.)

As for art school, they obviously set you up with snarkiness. :-)

</comment></comment></comment><comment><USER5> I guess HP will make it into the text books. Way to screw up.

</comment><comment><USER6> Interesting that even after these good results, Apple can still only claim an 11% market share in the US.

<comment><USER7> Remember that they are only 1 manufacturer. The other 89% is split up amongst the other PC manufactures. Toshiba, Sony, Lenovo, HP, Asus, Dell, Acer, Samsung + rolling your own and all the minor retailers.

So on average the other manufacturers have about the same market share.

<comment><USER8> I wouldn't call those companies manufacturers though as most of the work is outsourced to ODMs. [http://en.wikipedia.org/wiki/List_of_laptop_brands_and_manuf...](http://en.wikipedia.org/wiki/List_of_laptop_brands_and_manufacturers)

</comment></comment></comment><comment><USER9> What I'll be interested to see is whether the same will be true one year from now. The current product line-up still has Jobs' magic touch all over it & I'm really eager to see the quality & innovation of the post-Jobs projects.

</comment><comment><USER10> Having purchased a new laptop for the family over the holidays, in general, the low end of the laptop market appears to have moved upward by about $1000 due to Netbooks having established a fairly stable price low end of approximately $250.

What I observed was that the $249-$299 laptop segment of a couple of years ago is now largely $349-$399...i.e. cheap laptops are no longer competing with netbooks and any $300 laptops are a combination of Atom (or equivalent) processors and a big case.

</comment><comment><USER2> And that does not even include iPads, I'd guess.

</comment><comment><USER11> I cannot wait for their next earnings report.

</comment><comment><USER12> This is presenting half-truths. They are not really "industry" leading. Lenovo leads worldwide with a 23% growth. Apple had the most growth in US only. They are probably not even on the map worldwide. So this whole "Apple is industry leading" thing is pretty misleading.

[http://www.blogcdn.com/www.engadget.com/media/2012/01/rld.jp...](http://www.blogcdn.com/www.engadget.com/media/2012/01/rld.jpg)

<comment><USER13> Funny, I could have sworn I saw "in US" in the title. Perhaps I need new glasses?

<comment><USER14> Change the rose tint on your next pair :)</comment></comment></comment>


How Many Linux Users Are There (Really)? - <AUTHOR> http://www.linuxplanet.com/linuxplanet/reports/6671/1/ <comment><USER2> What matters is the percentage of your target users that are Linux users. Although Mac & Linux are small shares in the general population, they are over represented in the population we are all trying to sell to. Our startup sees over 15% from Linux and over 30% from Mac/iPhone hits, and we're getting in the thousands a day. Those people are out there and they're buying our product.</comment>


Uber's Didi deal dispels Chinese 'El Dorado' myth once and for all - <AUTHOR> https://theconversation.com/ubers-didi-deal-dispels-chinese-el-dorado-myth-once-and-for-all-63624?utm_medium=email&utm_campaign=Latest%20from%20The%20Conversation%20for%20August%2011%202016%20-%205412&utm_content=Latest%20from%20The%20Conversation%20for%20August%2011%202016%20-%205412+CID_bb6ca2410efbc829298428202cfd42c4&utm_source=campaign_monitor_us&utm_term=Ubers%20Didi%20deal%20dispels%20Chinese%20El%20Dorado%20myth%20once%20and%20for%20all <comment><USER2> A lot of this is just the problems in any foreign market. It's the same in the US - how many Americans shop at Baidu's US ecommerce site? Or use Weibo or vKontakte?</comment>


In a Highly Complex World, Innovation From the Top Down - <AUTHOR> http://www.nytimes.com/2007/07/29/business/yourmoney/29ping.html?ex=1343361600&en=59209d9c55f8aef6&ei=5090&partner=rssuserland&emc=rss

<comment><USER2> The author is in search of generalizations where none exist. The closed nature of the Mac and the iPod says more about the personality of one individual -- Steve Jobs -- than it does about some larger trend. The statement that "new technologies are becoming so complex that many are beyond the possibility of democracy playing a role in their development" is belied by Linux and other large-scale open-source systems, which are every bit as complex and as impressive as anything produced by "corporate or government initiatives overseen by elites."

There are plenty of successful examples of both top-down and bottom-up approaches to innovation in the marketplace today. Innovation is alive and well, especially in the high tech world, and attempts to put the great diversity of innovation happening today into one of two tidy academic cubbyholes seems like a waste of time.

</comment><comment><USER3> There is a huge confusion in this article. It tries to equate distributed innovation ("democratized") with government mandated research into things like stem cells (also "democratized" in the literal sense of mandated by a democratic government).

That doesn't even make any sense, to confuse the two.

I have to agree with another comment about finding generalizations where there are none. Painting with a rather broad brush: all technologies are developed by elite teams top-down or distributed.

What about elite, distributed teams? Yah-know -- like the set of all startups :-P

</comment><comment><USER3> Look to the openMoko for distributed innovation from a mobile device -- and the opening of the spectrum.</comment>


How to Train Your OpenAI Five - <AUTHOR> https://openai.com/blog/how-to-train-your-openai-five/ <comment><USER3> I'm still kind of disappointed with how much hubbub came out of these games. I watched most of them and it just in general felt like mediocre dota even against the pro team. I'm not saying I am amazing but I wish this article came out sooner to kind of put a reasonable contrast in the stuff that was coming out. While I enjoyed the idea of the drafting phase it is hard to not look at the hero pool available and see only two or three reasonable lineups (both of OG's lineups trying to take advantage of invis heroes were both weak in general in the current version), and I think the shown drafts display that. It's hard not to feel like that OpenAI solved the problem of that limited hero pool and ended up with a superior team to humans who weren't familiar with that version of the game.

I don't think that's a wrong outcome, but people trying to frame it that OpenAI beat OG at their own game in the same lines as go, chess, or checkers seems misleading. I think I am just still feeling sensitive to the sentiments and outcome that ended up being the outcome of systems which got on the press pipeline like watson. I wish it was more celebrating how they were able to create this ensemble learning environment, so I'm hoping for that more detailed analysis especially how they were able to adapt (and hopefully not throw away) the learning they did after some of the really large patches.

<comment><USER4> There are so many ways in which I feel this argument breaks down.

* OG would absolutely handily win against any non-professionally-contracted dota team under the exact same challenge conditions. (i.e.: OpenAI Five's test was about as good as they could give it at this stage.)

* OG's play within the scope of the game was novel, in that they were deliberately picking strategies that OpenAI Five didn't "understand" (i.e.: creep skipping) and still lost.

* OpenAI's play was novel, even within the constraints of the pool: No human team would pick the 4-core + CM lineup that OpenAI favoured. Even if you played with that limited hero meta, 4-core would likely _not_ end up being a deliberate strategy picked by human teams with any frequency.

* OpenAI's play in all team fights was _demonstrably_ better, playing exactly up to the limits of the heroes they were using and no further. (It is, in fact, OpenAI's teamfight which won them the game.)

* A number of the reductions and restrictions in hero-pool were to allow for OG to have a fighting chance: All heroes with controllable illusions or clones were banned because OpenAI had too much of an advantage in "micro".

If you sum all of those things up, I think it looks painfully obvious that OpenAI Five, if trained against the full hero pool, would completely and utterly dominate gameplay at the professional human level. It wouldn't even be close.

<comment><USER5> > A number of the reductions and restrictions in hero-pool were to allow for > OG to have a fighting chance: All heroes with controllable illusions or > clones were banned because OpenAI had too much of an advantage in "micro".

This one is not so certain. One of the OG players (Notail) mentioned after the game that the AI definitely had a few weaknesses such as:

* AI didn't bother checking the trees after the splitpushing hero disappeared from the map.

* AI doesn't handle invisible units well.

* AI has poor warding.

He said he regretted not exploiting these weaknesses more. There are certain splitpush ("rat Dota") heroes that potentially could have helped OG to the detriment of AI e.g. Antimage, Furion, Morphling, Juggernaut, etc. Instead, what we saw was OG using a non-traditional split push hero (Viper) from the limited hero pool try to split push, which failed because the hero got ganked too often (Viper does not have natural escape mechanism unlike many of those splitpush heroes above and he didn't itemize for splitpush e.g. Shadowblade first item) and it doesn't push very fast. With these splitpush heroes and well-placed observer wards, I think a splitpush-based lineup could possibly take the game.

OpenAI's play was very impressive. I did not see this coming after OpenAI lost to some of the weaker pro teams at last year's TI. However, I would give OG even chances at winning a longer series (Bo5 or Bo7) over 5 or 7 days where they could learn from OpenAI's playstyle and figure out strategies on how to exploit them similar to how in longer Dota 2 tournaments, we see initially successful strategies on Day 1 get countered by the tournament final. Another analogy is the 1v1 bot that OpenAI released. When released, even pro players would lose to it. However shortly after, the combined intelligence of the Dota 2 community discovered an exploit where if you lead the enemy creepwave into the jungle, the AI bot glitches out and the human player eventually wins [1].

[1] [https://www.reddit.com/r/DotA2/comments/6t8qvs/openai_bots_w...](https://www.reddit.com/r/DotA2/comments/6t8qvs/openai_bots_were_defeated_atleast_50_times/dliundl/)

<comment><USER6> Not sure I buy the argument that humans can learn to beat an AI by exploiting its weaknesses. This argument has been made many times. Kasparov said something similar when he lost to Deep Blue, yet not too long after that chess engines became unbeatable.

<comment><USER7> That argument will fail if the game is "solved", OpenAI with current limited same-kind-of-heroes hero pool is far from it. OpenAI current heroes pool is just about exact execution/coordination, which in and of itself is amazing nonetheless but strategical heroes like ember spirit/arc warden/nature prophets are those that bring Dota2 to much higher strategical levels.

<comment><USER6> Well maybe, but so far we have seen that AI improves quickly enough that other factors are irrelevant.

</comment></comment></comment></comment></comment></comment><comment><USER8> I was making slides to discuss this model in my deep learning class tomorrow. From what I can find on the model, it isn't _that_ complex -- [https://d4mucfpksywv.cloudfront.net/research- covers/openai-f...](https://d4mucfpksywv.cloudfront.net/research- covers/openai-five/network-architecture.pdf).

The real trick seems to be just massive amounts of self-play. This model had the human equivalent of 45,000 years of experience playing DOTA 2, with 250 years of experience per day.

<comment><USER9> Outsider here. How do you measure the equivalent experiences of a model? Tens of thousands of years ...... how is that possible? Does any timing trick involve in your training/evaluating phase?

<comment><USER4> The game has an in-game clock, and there are regular "timed" events that take place throughout the game that are basically a hard cap on when you can realistically win the game. (i.e.: To earn gold & experience, you must kill 'creeps', and waves of creeps spawn every 1 minute in game. You'll need a certain amount of gold & experience to have the in-game strength to take down defensive towers.)

An average human game lasts 30 to 45 minutes. If OpenAI simulated 1,000,000 games, that'd be over 28 years of non-stop gameplay to a human.

<comment><USER9> It makes me wonder, what to do then if an game of interest does not have such timing mechanism? To put it another way, how to train the agents as fast as AlphaGO (no timing issues at all) or OpenAI Five (in-game overclocking) if the environment can only be simulated in the same time scale?

Any thoughts?

</comment></comment></comment></comment><comment><USER10> It's not full scale DotA (limited hero pool makes a huge difference imo) but it's still incredible.

Obviously, this limited rule set is not pure DotA, and so the humans we're at a slight disadvantage.

The results of letting anyone play against it will be the huge test - AI often fails to "cheese" strategies, and this will be a good test of whether any exist. I'm excited to see the results.

<comment><USER11> They told they didn't choose all heroes as the AI was already much better at micromanaging the creeps. Limiting the selection apparently gave humans a better chance to win.

<comment><USER12> (edited for more info) That's incorrect. Each team has strategies and preferred heroes and OG won the international ( a sort of world championship ) by ignoring trends and sticking to a limited preferred hero pool. Since then, they've been consistent at underperforming vs. other human team.

So by limiting the amount of heroes, humans are clearly at a disadvantage. In the last international, from the hero pool, 110 heroes were picked and 98 were banned.

The micromanagement claim seems fair when it comes to illusions.

</comment></comment></comment><comment><USER13> There's a line between puff-up marketing and being actively misleading and OpenAI continually crosses it.

With only 25 heroes allowed (of > 100) they were unable to get >5k MMR...nowhere near pro level. What are they at with the full hero pool? 3k?

I'm not trying to cast aspersions on their AI work - it's obviously an incredibly hard problem. But instead of admitting that they failed to make a competitive team, they instead play a stripped down game that's easy for their bots' limited strategies, and then publish triumphant marketing releases claiming mission accomplished.

<comment><USER14> This is such a pessimistic view of things. As the hero pool expands, the training challenge increases at the rate of n^10. So going from 16 to 25 - <USER2> have ~100x blowup in hero combinations, likely requiring significantly more compute to train.

<comment><USER13>
      OpenAI Five is the first AI to beat the world champions in an esports game, having won two back-to-back games versus the world champion Dota 2 team, OG, at Finals this weekend.

That's their opening sentence, and it's actively misleading.

<comment><USER15> It's pretty sad people excuse this. Every single press release OpenAI have made in the history of this project has been actively misleading.

What they've achieved is actually impressive, too, so the deception is doubly annoying.

</comment></comment></comment></comment><comment><USER16> I think what people don't get when they want to celebrate this is that there is no dominant strategy for a game like this. To play optimally you need to adapt your plan according to what your opponent goes. If anything, there is evidence that this AI, as well as the Starcraft one, don't do this. They just have a world view of what works best and try to do that. And then it kind of works because the AI is much better at micro.

It would be very ineffective if this AI had to input everything through a human body somehow. Now to be fair, it would be very difficult to not win on micro. There's no real set of constraints I can think of that would make it a fair match.

Ideally they should probably be shifting to a game where micro just isn't as big of a differentiator. Or, consider moving to a game where a strategic player issues commands and human players execute them. Off the top of my head I can't think of anything that really fits that build.

Alternatively, spy party (an incredible game) could be an excellent candidate as it requires deception, and a strategic awareness of what the other player is thinking. And, at a high level of play, micro is practically flawless.

<comment><USER17> Dominant strategies in the game theoretic sense work regardless of what you do.

Chess is a strategy game with no micro. So is anything turn based.

<comment><USER16> and that's why I said there's no dominant strategy. It does not exist.

Chess has no micro, but also has no hidden state. You don't really need any concept of what your opponent is thinking to play optimally.

<comment><USER17> Poker ... has dominant strategies. Has hidden state.

</comment></comment></comment></comment><comment><USER18> I'm intrigued by their "5k" with 25 hero mention. Are the bots worse because they have less proportional training time or because the extra hero abilities are making it more difficult to rely on their deathball strat? Considering how every public performance of openAI has shown nothing but relentless aggression Id speculate that it's the latter.

</comment><comment><USER19> As continues the trend, people constantly write off the next improvement in AI as "not that big of a deal" or "not actually AI because X" or "underwhelming". I suspect they'll be doing this all the way up until AGI.

<comment> squeaky-clean It's underwhelming because the titles are misleading, not because the achievements aren't impressive. Beating humans by outhinking them and still using human-like reflexes and all game resources available is like 1000-cool- points, and beating them as they are now is 500-cool-points. Yes it's an incredible achievement, but they get you into the article with a misleading line, and so it's to be expected that all of your hype is deflated as you read, rather than building up your excitement. I just with they'd be honest about the shortcomings in their AI.

It's like the joke from Futurama about why humans don't watch the Robot Blernsball League (basically future-baseball).

Bender: Now Wireless Joe Jackson - there was a blern-hitting machine.

Leela: Exactly! He was a machine designed to hit blerns. Wireless Joe Jackson was nothing but a programmable bat on wheels.

Bender: Oh, and I suppose Pitch-o-Mat 5000 was just a modified howitzer!

Leela: Yep.

</comment></comment><comment><USER17> "In total, the current version of OpenAI Five has consumed 800 petaflop/s-days and experienced about 45,000 years of Dota self-play over 10 realtime months..."

Clearly very exciting and a remarkable achievement but does anyone else marvel all the less when such colossal resources are needed?

Obviously it's not entirely brute force but it seems much too brute force to be considered "intelligent".

<comment><USER20> Given how many years of brute forcing through the solution space it took for evolution to pre-train a human brain, I'm guessing we are not intelligent either.

<comment><USER17> Well less than that for one and to do a whole lot more, at a far lower wattage :)

</comment></comment></comment><comment><USER21> Has openai released the code for how they are training the models?</comment>


$22 Billion In Gold, Diamonds, Jewels Found In Indian Temple - <AUTHOR> http://www.npr.org/blogs/thetwo-way/2011/07/05/137627235/some-22-billion-in-gold-diamonds-jewels-found-in-indian-temple <comment><USER2> Incredible to think that I used to walk around this place almost every other day while I was in school.

On another note; the kings of the old Travancore (who built this temple) were known for living a very austere life compared to the other Maharajas. They did invest in a lot of infrastructure during their time; mostly during the last half of the 19th century and early 20th century. There was an urban legend in my city (according to my grandmother) that in the event of an emergency the kings of Travancore had enough wealth to pull back the country out of it. This probably was it. I wouldn't really blame the kings for storing this under the vaults; it was intended to be used for famines and such; it wasn't as if they enjoyed any of this. The complicated history of Travancore is probably the reason why it stayed hidden for so long.

What happens to this now is the big question. There's going to be a big argument amongst the secularists, the spiritualists, the archaeologists and finally the government regarding this.

Atleast it made my city famous :)

</comment><comment><USER3> Am I the only one who had flashes of being a little kid watching Indiana Jones pop into his head after reading this?

It would be nice if they could use the gold for something beneficial to the people of the area (improve roads or schools or something), but its naive of me to think they can easily sell this stuff. Maybe loan the treasures to museums for a fee?

<comment><USER4> It belongs in a museum!

<comment><USER5> They have top men working on it.

<comment><USER6> Who?

</comment></comment></comment></comment><comment><USER7> >$22 billion [...] is likely a conservative estimate [...] the panel is simple counting and weighing the valuables. "Their value, including antique value, is not being assessed"

A quick back of the envelope calculation indicates $22 billion corresponding to 450 metric tons of gold. This is an immense quantity: India's current gold reserve is about 615 tons [1], and there were recent years when it dropped under 400. I will take this report with a grain of salt until it receives very strong confirmation.

[1][http://en.wikipedia.org/wiki/Gold_reserve#Officially_reporte...](http://en.wikipedia.org/wiki/Gold_reserve#Officially_reported_gold_holdings)

<comment><USER3> The find includes gems too, diamonds, etc. So those push up the value immensely, and command a higher value per kg than gold (I'm assuming).

<comment><USER7> The article mentions gold coins and gold statues encrusted with gems, and that they're estimating the value by weight only. Since the encrusted gems can't be weighed separately, and furthermore the value of a precious stone strongly depends on quality not just weight, the estimate can only be based on the weight of the precious metal, IMO.

</comment></comment></comment><comment><USER8> Current reports (see BBC online) mention amounts in the 100s of millions, not billions. That said the latest today was that they had to stop when they forced a door only to find an all iron door just behind it. They are taking a break so that the local supreme court and other authorities can talk things over (most likely preliminary division of the spoils?)

<comment><USER9> A small correction, you should be telling 'local court' not 'local supreme court'. Supreme court is the highest court of law in India and this opening of vaults of temple is being supervised by the Supreme court.

</comment></comment><comment><USER10> So these vaults haven't been opened in over a century, and the only reason they're being opened now is because someone is concerned with how a trust fund is managing them? Excuse me, managing how? I guess that's the question, but it still makes me laugh.

<comment><USER11> The Wiki article uses "security" instead of "management". If I were a judge and someone told me $22B in treasure wasn't behind miles of lasers, I might take some judicial liberties too.

</comment></comment><comment><USER12> I really resent the way that the dollar amount is cited rather than the historical, cultural, and spiritual value. It's totally awe inspiring nonetheless!

</comment><comment><USER13> This is just from one of the two vaults unopened in like 150 years, and its still in progress. They still do not have full permission to do inventory on second untouched vault.

If I was the royal family, I'd buy Facebook.

</comment><comment><USER14> History of the temple [https://secure.wikimedia.org/wikipedia/en/wiki/Padmanabhaswa...](https://secure.wikimedia.org/wikipedia/en/wiki/Padmanabhaswamy_Temple)

</comment><comment><USER15> Am I the only one freaked out by this passage? Wasn't this like the opening scene from the "The Mumy"?

"The panel managed to open the sixth vault but found an iron wall inside it, reports the BBC. The sixth vault has a snake on the front door and quoting an unnamed royal family source, it reports that opening it "might be a bad omen." The Guardian reports that the sixth vault has "special locks" but experts should be able to examine them and open it by Friday."

</comment><comment><USER16> Feels adventurous to live in the vicinity of this temple :-). A bit like watching Indiana Jones.

<comment><USER17> What do you make of the whole tug of war on who gets to control the wealth?

</comment></comment><comment><USER18> Better demolish the bloody temple and errect sth meaningful there.

</comment><comment><USER19> The last time I checked India's debt is $310+ billion. A lot of this treasure would be ornaments, which would seem repeated if kept in museums. They might as well auction this off to pay debt. Handing such massive wealth to people will only result in it's disappearance :P

</comment><comment><USER20> India had thousands of such temples for example, Somanatha etc. from which Arabs, Mughals and the crazy British took from it. When British came to India, india was the richest country and when they left India, India was the poorest country. Whites people have bad culture.

<comment><USER21> I'm an Indian and a hindu. I've been to that temple. It's really sad to think that there would thousands of people around that temple who would go hungry as we speak and this temple has wealth that will pretty much stay locked up for the rest of humanity. It'll never get invested. No next google would come from thiruvanandapuram because of this. People would go on their lives living in terrible houses, driving terrible vehicles on atrocious roads. And Hindu fanatics would organize protests at the first mention of using this for any practical purpose.

<comment><USER17> Considering local government corruption, I'd actually be happy if it wasn't used for 'practical' purposes if the government gets to control all this wealth.</comment></comment></comment>


You are not their customer: realities of the media environment - <AUTHOR> http://enfranchisedmind.com/blog/posts/you-are-not-their-customer-realities-of-the-media-environment/ <comment><AUTHOR> The consumers are the product -- the advertisers are the media publisher's customers.</comment>


Embedded linux device drivers - <AUTHOR> Hi guys,
I have a dillema about device drivers written for an embedded linux. So, as far as I know, a device driver lies in kernel space and it creates a node under the /dev file system, through which the user can access a physical device ( theoretically). Now, what exactly defines a device driver? I see this like layered structure. Starting from bottom, we have a physical device (GPS,GSM,or any kind of device connected to a board).An upper layer we have the core (those interfaces which implements the protocols like I2C,UART,and so on).An upper layer is so called the device driver which uses the sub-layer (core) to communicate with the physical device.Both the newly created device driver and the I2C, UART, SPI and so on, creates a node under /dev. Now, do we need to create a device driver which uses the core library as long as it exposes its data to user space ?I mean, in this case we can use an user space application which plays the role of the driver reading/writing to /dev/Ttyxx ?
Please give me a clear picture about device driver.
Thank you, Best Regards, <comment><USER2> HN is possibly not the best place to ask questions such as these. You'd probably get better answers and also be able to have a follow up discussion by posting this question to a osdev or Linux kernel related mailing list (search for osdev or kernel newbies or even the dev mailing list for the distro of choice).

All that said, to answer your question in brief, you have the right idea - even within the device driver layer you have various levels of abstraction. Whether you ultimately choose a certain level of abstraction is really specific to what you would like to do. If you find that an existing kernel module that provides a easy to work with interface via a device node, just make a userspace tool or library to suit your needs, if not, create your own kernel module.</comment>


BuzzFeed ends Republican ad deal over 'hazard' Trump - <AUTHOR> http://www.bbc.com/news/world-us-canada-36462756 <comment><USER2> This post should have been titled, "You'll never believe what Buzzfeed's CEO said about Trump".</comment>


Tone Analyzer - <AUTHOR> https://tone-analyzer-demo.mybluemix.net <comment><USER2> This looks interesting.

Is the system using "1-grams"? i.e., is it not context aware? For instance, it's picking up "can't blame" as anger, taking only into account "blame".

It's also picking up the "inferior" in "Our product is in no way inferior" as being negative - but given context, the word is clearly not being used in a negative way.

<comment><USER3> For these two examples I would agree with the tool. Neither of those two sentences are positive and uplifting.

<comment><USER2> I'd have to disagree. I'm not saying they're positive and uplifting, but I wouldn't consider them negative!

</comment></comment></comment><comment><USER4> According to the analyzer, "Kill the unbelievers and wear their skins as crowns." is mostly open and agreeable.

</comment><comment><USER5> It's broken. I've pasted in Bukowski and H.L. Mencken and they come up as open and agreeable.

</comment><comment><USER6> according to the analyzer, "not interested" is 50% cheerful and 50% agreeable :)</comment>


Top Ten Lessons I've Learned About Managing An Online Forum - <AUTHOR> http://www.seorefugee.com/seoblog/2007/02/06/top-ten-lessons-ive-learned-about-managing-an-online-forum/ <comment><USER2> 11- stay on top of spam or die. And for heaven's sake don't sprinkle ads throughout. Better yet: 11- have a look at news.ycombinator :)

</comment><comment><USER3> I thought 11 was "write up a quick top 10 list about your site and get it Dugg, driving up your Google ranking." :)

</comment><comment><USER4> digg won't necessarily drive up your Google rankings but it can drive traffic to your site which, if you have something to offer, is a good thing, right?</comment>


The biggest thing with small patches (2004) - <AUTHOR> https://lkml.org/lkml/2004/12/20/255 <comment><USER2> I think this is great advice. While I've only contributed to a couple open source projects and haven't lead my own large ones, I completely agree. There's more to submitting patches than writing the patch- understanding contribution guidelines (code style, documentation, testing), responding to feedback, etc, these are all extremely important in actually contributing to a project. And having even just that little patch merged in feels great when you're starting out.

Plus, no one wants to make a big helpful functional contribution only to be thrown away because they weren't aware of how the community operates. Small patches have a low risk as far as learning about how to contribute, even if the patch is rejected for whatever reason.

Though this seems somewhat obvious, it's nice to have it stated and validated by the leadership of one of the largest open source projects.

</comment><comment><USER3> Great attitude. Linus has had plenty of heated moments on the mailing lists, but 1) he's often right and 2) his venom is usually reserved for experienced developers that really should know better. Glad to him being so open and accepting with newbie kernel hackers.

<comment><USER4> > Linus has had plenty of heated moments on the mailing lists, but 1) he's > often right and 2) his venom is usually reserved for experienced developers > that really should know better

Also, his gain attention specifically because they're _available_ , whereas most companies don't make all their internal emails visible to the public (which Linux does).

One of the few uncensored corpora of emails that we have is the Enron Corpus[0] - if you look through them, you'll see a lot of profanity, vitriol, etc. that helps put Linus's rants in perspective.

Also, the "Linus rants" are rather cherry-picked - they make the rounds here periodically (sometimes years after the emails were originally sent), but that's not to say that it's representative of a typical email that one is likely to receive from Linus.

[0] [https://en.wikipedia.org/wiki/Enron_Corpus](https://en.wikipedia.org/wiki/Enron_Corpus)

<comment><USER5> I think you're overestimating how often that sort of vitriol happens in a workplace. I've been a developer for 16 years now and I've had very strong opinions about development for a long time. I can't remember the last time I made things personal, especially over email.

I think Linus's behavior is often reprehensible. He gets a pass from many because of who he is, which is sad.

<comment><USER6> No, it is not. Who you are should matter, we don't want to stop a major advance in tech just because the one who will lead its creation may be a prick.

<comment><USER7> You've turned the logic around. The statement being made is more like: "It isn't OK to be a prick just because you created a major advance in tech."

</comment></comment></comment></comment></comment><comment><USER8> That makes a lot of sense. If I look at any project I've contributed to, it always started out with something small. Taking the time to make a small PR that makes a tiny improvement:

\- shows you care about improving the project; you took the time to improve something small that others would ignore

\- lets you test the waters. Are the project owners receptive of changes? Is it pleasant trying to contribute to the project? Or do they ignore your patch and don't reply for 2 weeks. You wouldn't want to spend a lot of effort just to find that out.

\- gives you a chance to become familiar with the process, the tools, gain practice, and hopefully get rewarded with your change being accepted

For example, my first CL to Go was a trivial change:

[https://codereview.appspot.com/97280043/patch/40001/50001](https://codereview.appspot.com/97280043/patch/40001/50001)

But without having done that (and having a good experience) I couldn't have been working on more complicated changes like [https://codereview.appspot.com/142360043/](https://codereview.appspot.com/142360043/) now.

</comment><comment> vezzy-fnord Seems like it's good to remind people every now and then that Linus is a human with empathy, since a lot of them really don't understand the reasons for when he rants, and then start to draw conclusions.

On a related note, Theo de Raadt rants need far more attention than they currently get.

<comment><USER9> This ^. Theo rants with a whole lot more venom than Linus does as well. You'll start by pointing out a bug that needs to be fixed and suggest a fix. He'll end up insulting your mother for allowing you to be born.

I've literally been blown away at how the OpenBSD community stays together with such an outspoken leader. Then I realize this is technology :)

</comment></comment><comment><USER10> Small patches are the "hello world" of open source. They give you a chance to get familiar with and work through the contribution pipeline before you push something sizeable through.

There's little useful about "hello world" _as a program_ , but it ensures you've got your toolchain working correctly, which is a necessary precondition for doing real work. Trivial patches are like that.

</comment><comment><USER11> Ten years later, how is the Linux kernel community doing in terms of cultivating new contributors?

<comment><USER12> Better than any other open source project. Linux is, I believe, second to Wikipedia as the largest collaborative project in the history of the world.

(Although, unfortunately, they hide the report behind an email wall, so here's a summary.)

[http://www.zdnet.com/who-writes-linux- almost-10000-developer...](http://www.zdnet.com/who-writes-linux- almost-10000-developers-7000020717/)

</comment></comment><comment><USER13> Reminds me of Lawrence of Arabia. "Big things have small beginnings" I've contributed tiny bug fixes and the feeling was great. I did that, me.

</comment><comment><USER14> That's a good attitude. If I find myself heading an open source project, I'll take that advice with me.

<comment><USER15> You should! One of the biggest challenges for any open source project is to figure out how to become multi-generational and turnover-proof, instead of fizzling out when the initial developer generation moves on. There are a lot of lessons to learn about organization and governance to get to that point, and about how to recruit and imbue newcomers with a sense of shared responsibility and emancipate them to step up and take on that responsibility.

I used to process many of the developer access rights requests for the KDE community for some time and wrote a few of the documents regulating that process, along with baking some of the things we learned into the KDE Manifesto. It took us a lot of thinking about the trust mechanics involved and has definitely been among the most rewarding things I've done in FOSS so far. And I'm really happy we've consistently been one of the largest organizations to participate in things like GSoC and Code-In (in number of students) and try to do a lot of mentoring in general.

</comment></comment><comment><USER16> Is it just me or is the main reason this is being upvoted so much is because Linus said something without a bad attitude? This isn't a rhetorical question, I honestly want to know.

<comment><USER17> Although I'm not a kernel developer, I strongly suspect that Linus' common reputation is driven by cherry-picking his nastiest rants and then exposing _only those_ to the vast majority of current developers hanging out social channels who will never in their career look at kernel source code.

<comment><USER18> I think, to some extent, Linus cultivates this image himself. Reminds me of Richard Feynman threads here on HN: [https://news.ycombinator.com/item?id=8030010](https://news.ycombinator.com/item?id=8030010)

Someone commented (not sure it was on HN) that Feynman also cultivated a different, more "rough", image in public than he actually was in the real life.

</comment></comment></comment><comment><USER19> That, ladies and gentlemen, is how you grow a community.

</comment><comment><USER20> I completely agree. The only thing that's topped getting a tiny patch of my own accepted (into pylibtiff) was someone getting me to put a python module I'd written* onto pypi. Both were great feelings, and it's extremely important to encourage such highs in new people contributing to open projects (Linux kernel or random bibtex editor alike.)

* the library was in fact just a python wrapper for some C++ code, but that's where leverage for the original author starts, in bindings.

</comment><comment><USER21> Woah, mentoring Linus had a good day!

<comment><USER22> Yes, this ended up in an unexpected place.

</comment></comment><comment><USER23> You need good set of unit tests if you want to survive managing open-source project.

<comment><USER24> How would you unit test device drivers?

<comment><USER23> Virtual machines...

<comment><USER25> You may want to rethink your statement. How are virtual machines going to help in unit testing drivers that work with real hardware?

<comment><USER23> You sound like my old boss :-) I used VMs to develop USB drivers with great success.

At my university we wrote basic operating system, VESA and SATA drivers were mostly developed using VMWare.

And it is possible to connect PCIe devices to VMs, but it requires lot of work.

<comment><USER26> This only works if you already have a virtual machine with a high quality model of the hardware you're trying to test the driver for. For core PC devices like VESA and SATA this is mostly OK (though you still have a high risk of introducing opposing bugs in the device model and the driver which cancel each other out, so it can't replace testing with real hardware entirely). But it won't scale to the huge range of drivers for more or less obscure hardware which the kernel has these days -- writing a device model is about as much work again as writing the device driver, maybe more, and often devices just don't have enough documentation to write an accurate model. Nor is it likely to identify regressions like "we accidentally reverted the fix for this hardware bug that only affects rev 0 SCSI adaptors from manufacturer X".</comment></comment></comment></comment></comment></comment>


Intel AMT on wireless networks - <AUTHOR> http://mjg59.dreamwidth.org/48837.html <comment><USER2> The management engine can talk to ethernet cards _directly_ , without using PCIe or the OS, via SMBus, look at the thing labelled "SMLink0" on Figure 5-2 on page 38 of [http://www.intel.com/content/dam/www/public/us/en/documents/...](http://www.intel.com/content/dam/www/public/us/en/documents/datasheets/200-series- chipset-pch-datasheet-vol-1.pdf)

Indeed, the ethernet controller's datasheet that shows that it can send ethernet traffic over SMBus: [http://www.intel.com/content/dam/www/public/us/en/documents/...](http://www.intel.com/content/dam/www/public/us/en/documents/datasheets/ethernet- connection-i219-datasheet.pdf)

Is there something similar with wireless LAN cards?

<comment><USER3> Yup. It's the 'vPro' option on Intel wireless chips.

<comment><USER4> I'm pricing out a Thinkpad T570 and they gave me this choice: [http://i.imgur.com/M7OShL6.png](http://i.imgur.com/M7OShL6.png)

I wouldn't take it even if it's free.

Dell actually _charges_ you for adding vPro.

</comment></comment></comment><comment><USER5> Anyone know if Intel phones are affected by this bug?

<comment><USER6> Phones don't use Core chips, so almost certainly not.

</comment></comment><comment><USER7> Signally distributed blocked gophers</comment>


Steve WOZNIAK on future of iPhone, asks "How was so and so's baseball game?" - <AUTHOR> http://blog.tvdeck.com/2010/11/romil-patel-founder-of-tvdeckcom-asks.html

<comment><AUTHOR> What does everyone think about the possibility of being as small as the iPod nano? Interesting to see if everything in this Skype conversation will come true.</comment>


Ask HN: Anyone used G-WAN web server? - <AUTHOR>

http://gwan.ch - Are these speeds/resource usage even plausible? <comment><USER2> That entire website seems to be made up of absolutely hilarious claims. Some highlights: _Existing software will be obsolete within 5-10 years!_

 _An engineer, used to resolving problems qualified as "impossible" by all others, has developed a technology which outdoes everything else by several orders of magnitude, and has implemented it in the "most strategic software product of all", the Application Server_

 _RFC 2617 makes it obvious that its design (Verisign and Microsoft, 1999) was purposely flawed to sell (Verisign) SSL certificates that delegate the whole security chain to... Verisign (Certificate Authority) and Microsoft (the CA repository, in charge of CA queries and CA validation)._

 _Why make your own KV store when so many others already exist? – For the same reason that G-WAN was needed: they just do it wrong._

The FAQ also informs us that we need to run it on Ubuntu LTS, because all other releases are "beta".

It is an amusing read though. Love the "G-WAN RULEZ" badge too ;-)

</comment><comment><USER3> Let's say the benchmarks are accurate, and it really can serve twice as many 100 byte files as nginx. Is your entire application based around serving as many 100 byte files as possible? No? Then the benchmarks as meaningless to you.

</comment><comment><USER4> I found an interview with the creator:

[http://www.salem-news.com/articles/august082011/g-wan- intern...](http://www.salem-news.com/articles/august082011/g-wan-internet- ew.php)

and here are the discussion forums g-wan, it seems that at least some people are using it:

<http://forum.gwan.com/></comment>


Transparency vs Asymmetrical Information (on Google) - <AUTHOR> http://www.seobook.com/transparency

<comment><USER2> Ok... since nobody else has commented I'm assuming this isn't very interesting to most people.

I at least found the read interesting. I admit, I disagree on a lot of points, but Google does need to work on their public image.

Instead of elaborating, if you've read the article, please reply with your reaction. (I'm not sure anyone will.)</comment>


The stability of the bicycle (2006) - <AUTHOR> http://scitation.aip.org/content/aip/magazine/physicstoday/article/59/9/10.1063/1.2364246 <comment><USER2> For a modern / control systems perspective, check out [pdf]:

[http://www.control.lth.se/media/Staff/KarlJohanAstrom/Lectur...](http://www.control.lth.se/media/Staff/KarlJohanAstrom/Lectures/BikeTalkKTH2006.pdf)

</comment><comment><USER3> David E. H. Jones is a.k.a Daedalus, the crackpot inventor of the eponymous column in New Scientist and Nature in years gone by.

To those of you who are fans of Randall Munroe's What-If I heartily recommend the out of print classics The Inventions of Daedalus and its sequel The Further Inventions of Daedalus which are in a losely similar vein.

Last I heard (a few years ago) he was still alive and a documentary largely about his ingenious "perpetual motion" machines was made. I hope he's still hearty but fear he may have passed.

</comment><comment><USER4> > It seems a lot of tortuous effort to produce in the end a machine of > absolutely no utility whatsoever, but that sets me firmly in the mainstream > of modern technology. At least I will have no intention of foisting the > product onto a long-suffering public in the name of progress.

</comment><comment><USER5> Bicycles are surprisingly stable as long as they are able to maintain some momentum.

minutephysics had a great video about this too:

How Do Bikes Stay Up?: [https://www.youtube.com/watch?v=oZAc5t2lkvo](https://www.youtube.com/watch?v=oZAc5t2lkvo)

<comment><USER6> Well, both the article and the video say that there is more than one factor for reaching stability, not only momentum.

I think that this is the current status, knowing that the bike does not fall by the simultaneous combination of several factors. When analyzing the problem mathematically, it can be found that there are additional stability factors that do not even have direct physical meaning.

</comment></comment><comment><USER7> This article was originally printed in 1970.

[http://socrates.berkeley.edu/~fajans/Teaching/MoreBikeFiles/...](http://socrates.berkeley.edu/~fajans/Teaching/MoreBikeFiles/JonesBikeBW.pdf)</comment>


The art of Benchmarking - <AUTHOR> http://www.javacodegeeks.com/2011/02/performance-anxiety-on-performance.html

<comment><USER2> Thanks for this. I ran into this problem when I tried timing some of the algorithms in Programming Pearls by writing Java code and got essentially random results.</comment>


Ask HN: Returning faulty hard drive with sensitive data, would you? - <AUTHOR>

I have a hard drive loaded with sensitive data that has failed.  It is within it's warranty period and made by a very well known manufacturer.  The problem is, do I send it back for a replacement and trust the drive in their hands?  Even if the drive is inaccessible to me, I'm sure at least some data could be retrieved by them.<p>Any insight from anyone that has been in this situation before would be appreciated. <comment><USER2> Have you talked to the manufacturer? Once they agreed to replace it they may not care what state it is in. They may agree that you can physically destroy it and ship them the remnants or something. You're probably not the first to ask.

Alternatively: What is the value of the data, measured by the cost to you if it is lost? If it is greatly in excess of a few thousand or something, and my first paragraph didn't give you satisfaction, why not just eat the cost of the drive and just replace it? Yes, I know not everybody has tons of money but if you're looking at real losses if the data leaves your hands, well, sometimes life hands you lemons.

<comment><AUTHOR> Sorry for the late reply. My main gripe is the draw next to my desk is now pretty much full of lemons, and 90% of them where within the warranty period but I done nothing as the drives contained sensitive customer data.

I'll have a word with the manufacturer, but really don't see them letting me smash the drive up before sending it to them :D Otherwise I'll take your advice and just eat the cost of another lemon.</comment></comment>


Snap Inc. Announces Second Quarter 2020 Financial Results - <AUTHOR> https://investor.snap.com/news/news-details/2020/Snap-Inc.-Announces-Second-Quarter-2020-Financial-Results/default.aspx <comment><AUTHOR> * Operating cash flow improved by $29 million to $(67) million in Q2 2020, compared to the prior year.

* Free Cash Flow improved by $21 million to $(82) million in Q2 2020, compared to the prior year.

* Common shares outstanding plus shares underlying stock-based awards totaled 1,616 million at June 30, 2020, compared to 1,553 million one year ago.

* Revenue increased 17% to $454 million in Q2 2020, compared to the prior year.

* Net loss was $(326) million in Q2 2020, compared to $(255) million in the prior year.

* Adjusted EBITDA was $(96) million in Q2 2020, compared to $(79) million in the prior year.</comment>


Facebook Blocking Political Posts (Andrew Yang)? - <AUTHOR> https://www.facebook.com/8607462/posts/10109107663226767?sfns=mo <comment><AUTHOR> I posted a screen shot of Predicit.org showing Andrew Yang in the Top 5 and it was flagged for violating facebooks community standards.</comment>


A Simple Unpredictable Random Number Generator (1986) [pdf] - <AUTHOR> https://pdfs.semanticscholar.org/c19b/91cdc1da67c52e606cd4752472ce0db83131.pdf <comment><USER2> I'm partial to the avalanche

[http://holdenc.altervista.org/avalanche/](http://holdenc.altervista.org/avalanche/)

<comment><USER3> There is a similar circuit utilizing a zener diode ([https://www.edn.com/design/analog/4420926/White-noise- source...](https://www.edn.com/design/analog/4420926/White-noise-source-flat- from-1Hz-to-100kHz)). This is very flat white noise and very wide band and works quite well (had it breadboarded a year ago).

<comment><USER4> The need for 18v seems like an annoyance.

In your link they supply it from a battery, but if you want this as a RNG for a computer you aren't going to want a battery...

You can use a regulator to supply it but the noise from the regulator will be a critical consideration since the noise from the regulator may be predictable to an outside observer. So that deserves a careful design.

This sort of design seems simpler to get right at least electronics wise, [https://github.com/waywardgeek/infnoise](https://github.com/waywardgeek/infnoise) but OTOH the underlying noise process is a lot less clear than a zener, and I would worry that it's picking up external RF.</comment></comment></comment>


Understanding OAuth2 and OpenID Connect - <AUTHOR> https://www.polarsparc.com/xhtml/OAuth2-OIDC.html <comment><USER2> This was a good article. The first section, explaining the reason why OAuth2 is a fit for certain data flow needs, was really strong. I liked the diagram of the flow as that made it clear what all the pieces were.

I think that if you need that separation between your resource servers and authorization server, the OAuth dance can be a bit complicated, you can just use a simple api key. But as soon as you start to allow outside access to your systems, I'd suggest using an OAuth server (disclosure, I work for FusionAuth, a free as in beer competitor to Keycloak, Gluu, etc).

Additional things that I wish had been in the article:

* Don't use implicit flow, use the authorization code grant with PKCE.

* Don't use resource owner password flow; it was designed to allow existing systems to bridge into OAuth and shouldn't be used in new systems today.

Both the implicit flow and the resource owner password flow are not part of OAuth 2.1--here's a post I wrote about it: [https://fusionauth.io/blog/2020/04/15/whats-new-in- oauth-2-1](https://fusionauth.io/blog/2020/04/15/whats-new-in-oauth-2-1)

* Also, storing access tokens should be done carefully in the browser (httponly, secure cookies is the best way). If you can't do that, then use a server side proxy to store the access tokens. Otherwise your access tokens might get stolen by code executing in the browser.

* OIDC is built on top of OAuth and has a standard set of claims. If you can get by on what OIDC defines, you can switch between identity provider implementations fairly easily.

<comment><USER3> Storing tokens in cookies would be against the spec wouldn't it? I'm not putting rfc6749 on some sort of pedestal, but it clearly states that the tokens are in the response body and not set in cookies.

Do you have any examples of Authorization servers in the wild doing this or front end SDKs that work with that?

I'm very curious, I'm doing an SPA security research project at work and I'm very interested in these stories and learning more.

I've seen some folks do refresh in an httponly cookie, and Access in the js space. I've seen another example (auth0) put the refresh token in a web worker and access token accessible in js.

And I've seen things like msal.js just say F it and make them all accessible to js.

<comment><USER2> Hiya,

Sorry, I was wrong. According to the spec you definitely have to send the access token back in the response body[0].

However, a client can store them as cookies (or, as you mention, other places, such as a service worker[1]). This is useful if the client is a single page application (SPA), which may need to present the access token to other resource servers.

RFC 6750 has something to say about how to store the bearer token [2]:

> Don't store bearer tokens in cookies: Implementations MUST NOT store bearer > tokens within cookies that can be sent in the clear (which is the default > transmission mode for cookies). Implementations that do store bearer tokens > in cookies MUST take precautions against cross-site request forgery.

So, I apologize. The authorization server wouldn't send the access token as a cookie. Instead, there'd be a server side proxy which would request the token and then send it down as a secure cookie. Again, best practice would be to keep the access token on the server side proxy and just send a session id down to the client, but that sometimes doesn't work. Here is a diagram illustrating that path (with the 'store' entity acting as the proxy mentioned above)[3].

0: [https://tools.ietf.org/html/rfc6749#section-5.1](https://tools.ietf.org/html/rfc6749#section-5.1)

1: [https://gitlab.com/jimdigriz/oauth2-worker](https://gitlab.com/jimdigriz/oauth2-worker)

2: [https://tools.ietf.org/html/rfc6750#page-13](https://tools.ietf.org/html/rfc6750#page-13)

3: [https://fusionauth.io/learn/expert- advice/authentication/web...](https://fusionauth.io/learn/expert- advice/authentication/webapp/oauth-authorization-code-grant-jwts-refresh- tokens-cookies)

<comment><USER3> Thank you for your replies and insight, it's really appreciated.

The way I see it with SPA and tokens in JS accessible space is that you're exposing your users to the possibility of token theft and user impersonation if someone is able pull off an XSS. This is not so different than using a session cookie that is not marked as 'httponly'. What's old is new again :)

I have also heard the argument that we shouldn't worry about token theft, because it's already too late if you're XSS'd, but I don't buy into that rhetoric(not saying XSS isn't incredibly bad).

Unfortunately I work in financial services, so we can't just skate by and assume that we're so uninteresting that an adversary with advanced capabilities wouldn't look to exploit our external or internal users somehow.

One another thing we're looking into is access tokens, like having the user re-authenticate or use a stronger factor(or multiple) to get the AS to grant them a very short lived, non-refreshable token to do their sensitive operation.

I'm going to check out the fusionauth blog for a bit more inspiration, if you're interested in continuing this discussion I would be interested in carrying it on.

<comment><USER2> > This is not so different than using a session cookie that is not marked as > 'httponly'.

The difference is a session cookie is tied to one server, but an access token could be used with many different APIs or other services. That said, an access token may expire more quickly, so the devil is definitely in the details.

> One another thing we're looking into is access tokens, like having the user > re-authenticate or use a stronger factor(or multiple) to get the AS to grant > them a very short lived, non-refreshable token to do their sensitive > operation.

That makes sense, for sure. You could definitely require MFA to get an access token and have it be short lived. At that point it gets to a question of UX and how much impact you want on your users, but I'm not familiar with all the requirements you have.

> I'm going to check out the fusionauth blog for a bit more inspiration, if > you're interested in continuing this discussion I would be interested in > carrying it on.

Please do! Happy to respond here or if you want to check out the FusionAuth forum (which I monitor), you can find it on the the website under the resources tab.

</comment></comment></comment></comment></comment><comment><USER4> I have wasted so much time on oAuth2 and OIDC the past month that I'm building a SaaS around it. (not wasted but took away time from the business)

I would have really liked to use auth0 or other authn services but not a fan of lock-in platforms, I want to export my db without enterprise plans.

The pricing model I'm thinking of is a pay per usage + a commission of the total usage per month.

Thank you @sjroot

<comment><USER5> Have you looked at Keycloak like the article suggests? Always thought a SaaS around keycloak would be a good idea.

<comment><USER4> Even through Keycloak is more mature than ORY ecosystem I went with the latter as I have more experience with Go than Java. I'm only writing integration, dashboard. When those thing are ready I'm going to open source and offer a free option until I add billing, at that point you can either go on-premise or just continue with us.

Ory will probably offer a cloud service in the near future but I'm just scratching an itch for now.

</comment></comment></comment><comment><USER6> For those who are looking for an alternative and are OK with _centralization_ of Auth which is somewhat different from the goals of OAuth, check out the CAS standard -- it's an alternative to SAML more so than OAuth.

It's so simple I wrote (and abandoned) a golang library that implements v1[2]. I didn't need the proxy abilities in v2 (and doubt most orgs actually do) and I use JSON in some places before it was in the standard but it was very easy to implement and thus I can say it's easy to understand. I've meant to convert the project to Rust for a long time but at this point I'll probably never get to it.

[0]: [https://apereo.github.io/cas/4.2.x/protocol/CAS-Protocol- Spe...](https://apereo.github.io/cas/4.2.x/protocol/CAS-Protocol- Specification.html)

[1]: [https://apereo.github.io/cas/4.2.x/protocol/CAS- Protocol.htm...](https://apereo.github.io/cas/4.2.x/protocol/CAS- Protocol.html)

[2]: [https://github.com/t3hmrman/casgo](https://github.com/t3hmrman/casgo)

<comment><USER7> I really wouldn't advise to use CAS in 2020. It's an historical curiosity that stopped being relevant some years ago.

It's an old protocol to do single sign on within a company. It worked well and I've seen it used in large companies circa 2010, allowing to support sso in their internal web applications, for employees.

CAS is irrelevant now. The world has standardized on OpenID Connect (and SAML as second choice). Anything that's on CAS was migrated or is pending migration to OIDC.

As a developer you will have to deal with OIDC (and maybe SAML) for integrations with google auth, facebook auth, microsoft active directory. You really don't want to go for a dying ecosystem (CAS), that's a dead end for your career.

</comment></comment><comment><USER8> Are you implementing OAuth 2 or interested in learning more? I would _highly_ recommend combing through the OAuth 2.1 spec [1] as it incorporates the "best practices" that were added to 2.0 through additional RFCs.

[1] [https://tools.ietf.org/html/draft-ietf- oauth-v2-1-00](https://tools.ietf.org/html/draft-ietf-oauth-v2-1-00)

<comment><USER9> And here's a decent intro that de-mystifies things for those who feel very confused: [https://youtu.be/996OiexHze0](https://youtu.be/996OiexHze0)

</comment></comment><comment><USER10> May be worth mentioning--JWTs are not part of the OAuth. They're certainly used together quite a bit, but you can absolutely use regular session tokens too.

I say this as someone who thought JWT was a core part of OAuth and it only added to the perceived complexity of the implementation.

<comment><USER11> > _May be worth mentioning--JWTs are not part of the OAuth /OIDC standard._

JWTs _are_ a part of the OIDC standard; from the standard itself[1],

> _The primary extension that OpenID Connect makes to OAuth 2.0 to enable End- > Users to be Authenticated is the ID Token data structure. The ID Token is a > security token that contains Claims about the Authentication of an End-User > by an Authorization Server when using a Client, and potentially other > requested Claims. The ID Token is represented as a JSON Web Token (JWT) > [JWT]._

But your comment sounds like you're conflating OAuth & OIDC. (It is true for _OAuth_ that you're not required to use JWTs.)

[1]: [https://openid.net/specs/openid-connect- core-1_0.html#IDToke...](https://openid.net/specs/openid-connect- core-1_0.html#IDToken)

<comment><USER10> My bad, yes I meant only OAuth.

<comment><USER7> You were correct though, JWT was not part of the OIDC standard. JWT was created separately and added retroactively later as the standard token format.

</comment></comment></comment></comment><comment><USER12> The one thing that really bugs me about the OAuth flow is what is described as step 3. When the application who wants to access data on your behalf is redirected to a login page where the user enters credentials and grants access.

In many apps, these login redirects happen inside the app window, hiding the url. And even if the URL isn't hidden, there's suddenly a browser window inside my app and many unconscious "security checks" fail to load.

I'd much rather have the OAuth provider send me an email or get a notification that can be actioned within the OAuth providers app so that I know I'm not giving my credentials to something that looks like the OAuth providers sign in page.

<comment><USER13> I never understood this either. So many apps pop up a window to enter my credentials to Google or Facebook or whatever in a manner that just screams don't put your password in here you have no idea who's hosting this form.

</comment></comment><comment><USER14> I look forward to reading this, because I'm currently unconvinced it is possible.

</comment><comment><USER15> This was a really well-written post. I really liked the learn by doing approach accompanied by flow diagrams. It's easy to get lost in the weeks with OAAuth terminology and this really kept good focus. I also looked at some of the author's other posts on things Protobufs and Tries and found them similarly enjoyable. I look forward to reading future posts and hope you post them here as well.

<comment><AUTHOR> Thanks for the encouragement ... started posting to Hacker News starting this year and will continue going forward

</comment></comment><comment><USER16> The article briefly mentions that the Implicit Grant is a less secure and more simplified version of the Authorization Code grant, but then it doesn't elaborate (or it's possible I missed that bit). In an introductory article such as this, I think it's important to explain _why_ it's less secure -- otherwise the Authorization Code grant seems like an unnecessary complication.

<comment><USER8> The implicit grant returns an access token directly upon authorization being granted. By removing the additional network request, it can make your system vulnerable via manipulation of redirect URLs. if you're implementing an OAuth 2 server, you can address this by validating the provided redirect URLs, but you should be doing that regardless.

My advice is to just always use the auth code grant with the PKCE extension. TLDR of that extension:

1) client generates a "secret key" that it sends with the authorization request. 2) server associates that key with the authorization code it returns to the authorized client 3) client must present that key again in order to exchange the authorization code for the access token.

Prevents the authorization code from being intercepted and abused.

<comment><USER16> Oh, I wasn't clear: I understand the implicit grant and I indeed worked on the implementation of an authorization server in a past job (we validated redirect URLs, indeed!). My point is that OAuth flows are confusing enough for a beginner that it's important to explain why seemingly unnecessary hoops are there. This article doesn't (as far as I can see).

<comment><USER8> Yeah, I gathered you knew what you were talking about after I had already posted my comment lol. Just left it up in case any others have that question. :D

</comment></comment></comment></comment><comment><USER17> Would you think that, for an early-stage SaaS startup (enterprise B2B focus), the _optimal strategy_ for implementing AuthN/AuthZ would be to use a managed service (e.g., Auth0) for MVP development and after that (perhaps, during pilots phase) migrate to an open source solution (e.g., Keycloak)?

<comment><USER18> Do you need to provide access to third-party apps? If not you probably don't need oauth. Just use session cookies.

<comment><USER17> Thank you for your comment. Yes, I'm planning to allow running third-party apps on the platform (the exact delivery options and relevant architectural details are still under consideration). My understanding is that using JWTs is the current best practice and much preferred way for authentication vs. the session-based approach. The platform that I plan to build should be both highly scalable and highly secure. I think that session cookies is not the right approach for these requirements, even if I would not need to allow running third-party apps. I'm curious about what people here think about this and hope that they will chime in. (I also would need SSO, external IdP integration, clustering, MFA, maybe passwordless authentication etc., hence my preference for managed services like Auth0. The idea is to focus on my core competencies and outsource important but non-core services to relevant solid providers, based on availability and feasibility, at least, for the near-to- mid term.)

<comment><USER18> Personally I don't think it's worth worrying about scaling like that until you actually need to. There are other reasons to choose JWTs, but I don't think scalability is a good one early on.

<comment><USER17> Thank you for sharing your thoughts. I'm not worried about scaling and other aspects, but I do think about them. In my opinion, architectural decisions are the most important ones (across technological dimension) and fixing wrong or suboptimal architectural decisions is costly and/or difficult and sometimes outright not feasible.

<comment><USER18> True, but you can further break architectural decisions down into those that are easy to change and those that aren't. If something is easy to change you may as well implement the simple version first.

</comment></comment></comment></comment></comment></comment><comment><USER19> The main confusion probably comes from the name Oauth, which seems to suggest that it is about Single Sign On/authentication, while in reality it's about granting site A access to your data at site B.

<comment><USER20> That's what Oauth is though. Oauth is NOT a single sign-on technology, it's about granting access to data across services. OpenID is a single sign-on protocol built on top of Oauth.

<comment><USER8> > That's what Oauth is though.

Splitting hairs but no, Oauth has nothing to do with authentication. An introductory article like this should address the distinction between authentication and authorization in the first section IMO.

<comment><USER21> > the distinction between authentication and authorization

Distinction which is totally useless in practice as you certainly won't have authorization without authentication.

<comment><USER22> The distinction is irrelevant if you just consider that authorization (authZ) always happens after authentication (authN) _but_ it is important when you realize that different components/systems/protocols might be used in each.

At that point, the separation is more about capabilities/responsibilities than "does it happen?"

(This is what I do in my day job.)

</comment></comment></comment></comment></comment><comment><USER23> I really wish banks would read this.

</comment><comment><USER24> Can we update the link to point to the actual article?

[https://www.polarsparc.com/xhtml/OAuth2-OIDC.html](https://www.polarsparc.com/xhtml/OAuth2-OIDC.html)

<comment><AUTHOR> will be happy to change ... there doesn't a way to edit the post ... any suggestions ?

<comment><USER25> Email the mods using the address in the "Contact" hyperlink at the bottom of this page: firstname.lastname@example.com.</comment></comment></comment>


Turn a Web Browser into a WebRTC Web Application Server - <AUTHOR> https://github.com/sinclairzx81/smoke <comment><USER2> Doesn't it look similar to what SignalR is?</comment>


Parallela $99 18-core single-board computer now available for pre-order - iso-8859-1 http://shop.adapteva.com/collections/parallella/products/parallella-16

<comment><AUTHOR> So how would one take advantage of these extra cores? Are there any pre- compiled programs that do this already?

<comment><USER2> It's meant as a playground for people who want to learn to write those programs.</comment></comment>


World IPv6 day - <AUTHOR> http://server1.test-ipv6.com/ipv6day.html

<comment><USER2> Nobody is ready for IPv6 yet, and it's depressing.

I tried an experiment the other day, turning off IPv4 and using only IPv6 on a desktop at home. HN, Ars Technica, Twitter, Facebook... none of them even have an AAAA record. Google does for the main google.com site and for gmail, but not for Google Talk. Hell, even test-ipv6.com doesn't have an AAAA record.

<comment><USER3> There's a good reason test-ipv6.com doesn't have an IPv6 address. If your IPv6 is broken then you can't go to that site to test it :).

<comment><USER2> That makes no sense at all to me.

If your IPv6 is _working_ you can't go to the site to test it unless you also have working IPv4.

There is absolutely no reason why test-ipv6.com can't have both an A record and an AAAA record.

<comment><AUTHOR> Per the FAQ:

Q: Why is this web site reachable via IPv4 only?

You're right, there are no AAAA records, intentionally. A percentage of users are unable to browse sites that are dual-stack. If the users can't connect, then they can't be told they have a problem. This is a big problem facing content providers today; of which, I work at one for my $dayjob. As such, the main test page requires IPv4 (either native or translated).

At some point, when the percentage of "broken" users has gone significantly down, I'll consider making test-ipv6.com dual-stack..

<comment><USER2> I stand corrected. That makes sense (even if it is frustrating).

</comment></comment></comment></comment></comment><comment><USER4> Great article in _Communications of the ACM_ , with a foreword by Vint Cerf:

"Successful Strategies for IPv6 Rollouts. Really."

The gist is that changing everything at once will probably fail because of how large the task is. Instead, change the web-facing load balancer to offer IPv6 to external customers, while translating to IPv4 for internal communication. That is the fastest way to get started.

[http://cacm.acm.org/magazines/2011/4/106582-successful- strat...](http://cacm.acm.org/magazines/2011/4/106582-successful-strategies- for-ipv6-rollouts-really/fulltext)

</comment><comment><USER5> We've been double checking bug reports and doing extra testing to make sure that Firefox is ready for World IPv6 day. If you find any problems with Firefox while testing IPv6 (or ever, really) please let us know at "bugzilla.mozilla.org"!

</comment><comment><USER6> That site seems to focus on client connectivity tests .. <http://ready.chair6.net> will do some basic server-focused tests (enter a domain/URL to test for IPv6 connectivity).

<comment><USER6> Examples of sites that get positive results would be: <http://ready.chair6.net/?url=arin.net> <http://ready.chair6.net/?url=he.net>

Examples of not-so-ready results: <http://ready.chair6.net/?url=news.ycombinator.com> <http://ready.chair6.net/?url=facebook.com>

(Granted, some of these tests are not relevant - say, where all you want to do is provide AAAA records for your web site.)

<comment><USER7> try <http://www.v6.facebook.com>

</comment></comment></comment><comment><USER8> Can someone from hn write up a post outlining what we as individuals and web entrepreneurs need to do in order to adapt to ipv6? Thanks

</comment><comment><USER9> Spoiler: It's not today.

<comment><USER10> It will happen on 8 June 2011. I still have to configure my core access (routers, firewalls) to try to enjoy this day.</comment></comment>


14 Things We Learned Creating a Million Dollar Hyperdeflationary Currency - <AUTHOR> https://old.reddit.com/r/CryptoCurrency/comments/bt0wi0/14_things_we_learned_creating_a_million_dollar/ <comment><USER2> "Even at the peak of the bear market, exchanges attempted to charge anywhere between $20,000 and $250,000; and those were the low-level ones." (listing fees)</comment>


Stephen Hawking: Human Survival Depends on Space Exploration - <AUTHOR> http://ca.news.yahoo.com/human-survival-depends-space-exploration-says-stephen-hawking-201506059.html <comment><USER2> Hawking is wrong. The population isn't "growing exponentially". In fact, it's set to level off mid-century and start decreasing. We're not going to just keep growing like bacteria until we all die.

Having said that, let me say a large extinction event is certainly possible - we may have barely dodged one in the late 1800s:

[http://www.theblaze.com/stories/has-the-earth-come-close- to-...](http://www.theblaze.com/stories/has-the-earth-come-close-to-ending-in- recent-centuries/)

But to plan for something like that we would be better off tunneling into the earth than trying to colonize Mars. The other planets will never be hospitable to human life, and there's no point in bothering with them until we have the technology we need to make the colonies independent. We're a long, long way from that, and sending more rockets to the moon doesn't get us any closer.

<comment><USER3> _In fact, it's set to level off mid-century and start decreasing._

Have these kind of predictions ever worked out?

Last time I checked there would always be an unanticipated war or invention to ruin the beautiful projections...

<comment><USER4> Do elaborate on how war or inventions will make more babies?

It's something I've certainly thought about quite a bit and would love to study more in the future, but the parent post was correct: The population in developed countries will be declining if there are no significant changes in how life longevity or increased birthrates (which can be affected by a lot of factors).

For more information:

 _Laurence J. Kotlikoff and Scott Burns (2004). The Coming Generational Storm: What You Need to Know about America's Economic Future'. MIT Press. ISBN 0-262-11286. Description and chapter-preview links, p. vii.

_ The Age Curve: [http://www.google.com/url?sa=t&rct=j&q=&esrc=s&#...</a>

<comment><USER3> _Do elaborate on how war or inventions will make more babies?_

Well, wars probably remove babies, same for the invention of the anti-baby pill. IIRC neither the wars nor the pill were predicted in the 1900s, just like we can't predict what will happen before the end of this century.

Some big asteroid impact might just end our population concerns for good. Or perhaps we defeat aging with bio-tech. Or designer-babies become so popular that everyone even in developed countries suddenly wants five.

I'm not saying any of that _will_ happen. I'm just wary of predictions reaching more than half a century into the future. After all: We're having this discussion on a medium that nobody 50 years ago would have imagined to exist (outside of SciFi books).

</comment></comment></comment></comment><comment><USER5> Space exploration is like selling off your stocks during a tech bubble: it's obvious it needs to happen sometime, but it's really hard to figure out when the right time is. Unfortunately, that means for-profit organizations underinvest. This is one of those cases where it really does make sense for government to encourage the sector with investment, although it seems like X-prize-type systems might work better than NASA-type systems.

</comment><comment><USER6> Unless we learn to live harmoniously with each other on this planet, why should we expand to other planets ? To perpetuate the same cycle of justified violence on ourselves and everything else? Look what happened to the Native Americans and all other indigenous populations, cultures, countries, when people brainwashed by a culture of greed and religiously, scientifically (eugenics), and more recently 'humanitarianlly' justified violence got in there to take their resources.

Is this way of life worth preserving? Maybe there is something better, maybe a self-sustaining, thriving way of life that is in harmony with nature and doesn't need continuous conquering, colonization, resource raping and pillaging in order to be maintained would be worth exploring first, before we think about jumping ship?

Maybe all this apocalyptic stuff is all BS, and it is just a sign we need to change something in the way we live, rather than we need to jump ship?

The problem is some people would like us to not change at all, or to change such that they can maintain or even increase their power and privileges (see carbon tax scam). This is where the problem lies.

The only thing we need right now is to wake up and separate wheat from chaff, inquire into ourselves, find our own truth of who we are and what we are doing here, and reject all theories imposed by any so called 'authority'.

Forget about space exploration for now, it's just another distraction.

Inner (and outer) truth is what we need right now.

<comment> mkr-hn Your comment sounds like a wordier version of "we should stop exploring space and solve all the problems on Earth." It doesn't sound any more compelling when you use more words to say it. We can continue to push our boundaries while working on improving things.

<comment><USER6> Nope, I'm not saying anyhting against space exploration. On the contrary. I actually did work as a contractor for NASA, and it was a dream of mine to work there. But I do have a problem with going there as an escape from the mess we can't face at home, and to rob and pillage some more - a pattern so common to our culture.

</comment></comment></comment><comment><USER7> I agree with Hawking. But we need to understand why space exploration isn't happening and what's being done about it.

Space exploration is different from earlier forms of exploration because the technological and financial requirements are a couple orders of magnitude higher than they have ever been. Also, we have yet to find natural resources up in space which would justify the expense of mining them.

That's why it isn't happening at the pace some people expected after Apollo.

But with the latest developments in orbital tourism, and a world population that's generally wealthier than it's ever been, tech and financial huddles will fall in time.

</comment><comment><USER8> Unfortunately colonization with conventional spaceflight is not realistic. It would be far easier and exponentially cheaper to try to colonize the dessert than any moon or planet in our solar system.

However, if we can figure out a way to travel very quickly without the use of fossil fuels than things start to get interesting.

<comment><USER9> Even at the speed of light the closest potential planets we could colonize at 4.5 years away. Now think about communication. Telling your parent's "hi" would take 4.5 years in either direction, even if we could ensure the signal gets back.

</comment></comment><comment><USER10> "People are like dung. When they're all together they smell really bad, but if you spread them out they fertilize the land." Forgot who the author of that quote was..

<comment><USER11> I've heard this about money - "Money is like manure. If you spread it around it does a lot of good. But if you pile it up in one place it stinks like hell."

See <http://www.quotecosmos.com/quotes/27137/view>.

</comment></comment><comment><USER12> Talk is cheap. We are pretty clear on what is required for space exploration on that level. How about he stops talking about it and instead comes up with the physics required for such endeavors:

      - Hyper drive/Warp drive or any other faster-than-light drives.
      - Shield generators providing the equivalent of 100km of atmosphere.
      - Sub-space communication devices or some other faster-than-light communication technology.
      - Inertial dampeners. IE gravity/anti-gravity generators.
      - Fuel and power generating devices to run the above technology.

and so on

<comment><USER13> A feasible cold-sleep system would solve a lot of these. As it means it matters a lot less how long it takes to get somewhere.

I was reading "A Deepness in the Sky" by Vernor Vinge the other day, and his portrayal of that was pretty good. Basically on a long trip the crew cycles being awake and "on watch". So there are always some people awake to deal with problems, but everyone only has to expend a year or two of their lifespan on the trip. (As an aside, great book)

</comment></comment><comment><USER9> Other than Mars, any future humans living on any "M" class planets that we discover will be one-way, multi-generational trips. Unless we can travel instantaneously throughout the universe, exploration is pretty pointless since it'll literally take decades (in each direction) to communicate with our colonies, never mind bringing resources back to Earth.

Either we're never leaving, a few brave souls leave, or we're all leaving. Really there's little incentive to leave unless the rest of your life, and your grandchildren's, and their children's lives are that much better off aboard a space ship than they are on Earth.

Hawking also recently stated that if we ever met "aliens" they would almost certainly be aggressive toward us, which I disagree with. Hawking definitely doesn't give much credit to the human race, or any other potentially intelligent life forms.

Unless instantaneous travel is possible (which it probably is, but not anytime soon), us and any other form of intelligent life in the universe are in the same boat.

</comment><comment><USER14> As a whole civilization is getting better. We are becoming less violent, less aggressive and more educated then ever.

As the author of freakanomics says "Its amazing statistically how many people 'Do the right thing.'".

Its also discouraging how Hawking does not back any of this with charts or numbers or something that would be convincing. I have to wonder if Hawking's agenda and outlook are from his own "selfish desires".

Certainly there are more achievable options then the immense challenges of space. Like underground infrastructure or mass gene therapy that allows immense intelligence for all (think Limitless for all).

Also have you noticed that most "dynasties" do not go out like a light switch. Its a very slow decline. Examples: Romans, Ottoman Empire, the Dinosaurs various music artists and athletic teams.

I am betting that humanity will end in a slow boring decline.

</comment><comment><USER15> I'd _like_ to cheer for Hawking's position, but I find the opposing view really convincing:

[http://www.antipope.org/charlie/blog-static/2007/06/the- high...](http://www.antipope.org/charlie/blog-static/2007/06/the-high- frontier-redux.html)

</comment><comment><USER16> The problem with making predictions about a complex system (nonlinear system) like human civilization is that there are so many factors and variables that can affect the trajectory that accurate prediction is virtually impossible. You would think that, of all people, a physicist would appreciate that and thus refrain from making strong claims about the future trajectory of such a system.

<http://en.wikipedia.org/wiki/Butterfly_effect>

<http://necsi.edu/research/overview/prediction.html>

</comment><comment><USER17> It is a great worry for me, that we have stopped looking out into the space with the kind of fascination that we used to.

Unfortunately, most of the world's wealth and technology is somehow taking (pushing) us to our own end. With Nuclear weapons seeing ever more proliferation and irreversible climate change knocking on our doors, I feel that we might just not end up with enough time to save ourselves from Mass extinction.

</comment><comment><USER18> Good (but long) video of why NASA's goal should be colonization.

<http://vimeo.com/24260744>

</comment><comment><USER19> Constellation should be restarted.

</comment><comment><USER20> Is his new TV show worth watching?

</comment><comment><USER21> No. If we can't make it work here on earth, where we have everything we need, how are we going to make it work somewhere else? Before going into the galaxy, we have to fix ourselves and our society. And we can do it.

<comment><USER22> > Before going into the galaxy, we have to fix ourselves and our society

Space exploration, i.e. NASA, takes up 0.6% of the federal budget, and decreasing. The Great Society programs, Medicare, Medicaid and Social Security, take up 54% and increasing.

So, be happy: as a society, we've decided that an extra 1% on grandma's pension is worth more than a Moon colony and humans on Mars (quite likely to have been achieved with double the space exploration budget).

<comment><USER20> You've made an interesting point, but budget is a very poor measure of effort. Grandpa's pension mostly circulates on Earth, while NASA budget throws extremely hard to design and produce stuff into space.

<comment><USER23> Not really - a lot of the technology that NASA builds ends up being used in other areas, from materials science to computer engineering.

</comment></comment></comment></comment><comment><USER24> Land exploration lead to having many different kingdoms, which scaled wars up from inter-tribal wars to inter-kingdom wars. Later, world wars.

Space exploration will scale wars up from inter-continental world wars, to inter-world wars, which are much more massive.

<comment><USER7> Right now I'm sitting in Portugal, Europe, typing this on a laptop which was designed in America and manufactured in China. And we're not at war with one another at the moment. I believe there may have been a few consequences to exploration that were far nicer than war, trade chief among them.

<comment><USER25> Not only that, if we've become advanced enough to finally decide we should genuinely spend our efforts on exploring space, by then perhaps a humanistic consciousness could have emerged rendering war irrelevant.

</comment></comment></comment><comment><USER26> False. Humans are, by default, gonna fuck shit up. I don't care what planet we end up on. We're going to destroy ourselves before the lack of resources destroys us. That's just me tho.

<comment><USER27> The point being, space expansion would prevent the sudden eradication of the human technological culture. Politicians, warmongers, prophets and priests will continue to fuck things up, but distributed redundancy means not everything is destroyed at once.

<comment><USER26> I'm not sure why I'm being downvoted.

Anyways, who says Earth created "Politicians, warmongers, prophets and priests, etc.."? Kids fight among themselves without any of these lovely things to help them. As does everything in the living world.

<comment><USER28> You're being downvoted because you missed the point and continue to do so. Nobody said that earth created those things, or that going into space would somehow make us more compassionate. The point is that being spread out across interplanetary distances reduces the need for bad people to take truly drastic measures, and mitigates the damage that any particular disaster can do. Even if we a madman managed to blow up the entire world, as long as he can't do so to every world that humans are inhabiting simultaneously, humanity will live on.</comment></comment></comment></comment>


The Google Cemetary - <AUTHOR> http://9gag.com/gag/46430/

<comment><USER2> I don't like the tone of the article, suggesting that product failures are anything other than the natural course of events in software development.

Maybe I'm still upset about Wave...

<comment><AUTHOR> I agree. I thought it was interesting to see all the products in a graphical format but didn't like what was insinuated with the negative tone.</comment></comment>


Google/auto: collection of source code generators for Java - <AUTHOR> https://github.com/google/auto <comment><AUTHOR> [https://www.reddit.com/r/java/comments/55gg6t/github_googlea...](https://www.reddit.com/r/java/comments/55gg6t/github_googleauto_a_collection_of_source_code/)</comment>


Johns Hopkins investigating potential source of resistant pathogens: US farms - <AUTHOR> http://www.jhu.edu/jhumag/0609web/farm.html <comment><USER2> _one microbe can acquire genetic material from another microbe, even a microbe of a much different type, then incorporate it in its own genome and thus acquire resistance to an antibiotic it has not yet even encountered. It's as if bacteria are capable of downloading resistance from a gene database._

I think an analogy to BitTorrent is more precise. And scarier.

</comment><comment><USER3> According to the movie Food Inc. the nasty e coli in meat problem is from feed lots. It's a new acid resistant strain is harder to kill.

<comment><USER4> e coli in any form of meat is from contamination of the meat with fecal matter in the butchering process, is it not?

I assume cooking still kills all strains...</comment></comment>


Huge chimpanzee population thriving in remote Congo forest - <AUTHOR> http://www.theguardian.com/environment/2014/feb/07/chimpanzees-congo-forest

<comment><USER2> The comment about the prevalence of ground nesting is interesting. That was one of the first steps that led our ancestors out into the Savannah as far as I know. The trees no longer provide as much protection if you're not up in them.

And eating leopard! Are we sure we want to mess with them? We're going to find some poacher sometime soon stumbling out of the Bili forest, mumbling psychotically and covered in his friends' blood.

</comment><comment><USER3> Hopefully the Democratic Republic Congoese poachers don't check hacker news.

<comment><USER4> Judging by the article, the poachers are already there. It's just a matter of time. Heck, they even burned the researchers' camp to the ground.

</comment></comment><comment><USER5> relevant or not, but: [http://www.youtube.com/watch?v=uaQIKguggP0](http://www.youtube.com/watch?v=uaQIKguggP0) (sadly, they did not escape, I think)

<comment><USER6> At least they had the ride of their life.

Sorry, couldn't help it.

</comment></comment><comment><USER7> Check out this BBC documentary on Chimpanzees: "[http://www.youtube.com/watch?v=gTeLsEGPjdU"](http://www.youtube.com/watch?v=gTeLsEGPjdU"). Watching it was an experience that forcibly reshaped my world-view about our place in the World.

</comment><comment><USER8> Humans can be ugly.

<comment><USER9> Chimpanzees too. They love to hunt monkeys and eat them alive. They often gang up to attack individuals of their own species, eating their genitals and faces after beating them to a pulp. Knowing this, I don't feel sorry for endangered chimps in the same way that I'd feel sorry for Gorillas or Elephants for example, or even predators like lions.

<comment><USER10> Yeah, I watched an Attenborough piece that put them in sort of a bad light. I'm glad I don't have to worry about my neighbor stealing and eating my kid.</comment></comment></comment>


52 books in 52 weeks (with data tracking) - <AUTHOR> http://www.richardingram.co.uk/2012/01/52-weeks-52-ebooks/ Richard Ingram will read 52 books in a year, one per week. Last week he spend over 32 hours reading. All data, highlights and progress is saved at https://readmill.com/richardjingram <comment><USER3> An absolutely excellent book list. If all those books are available on Project Gutenberg (which it seems they are), this is one hell of an achievement as a civilisation, that we have managed to make freely available these foundations of educated thought.

<comment><USER4> Agreed on the list quality. About the second part of your comment - <USER2> works were probably all in the public domain before the great copyright lockdown of 1976 (and subsequent copyright extensions). Unfortunately "content owners" are going to find a way to extend copyright into perpetuity.

It feels like copyright law today is going where Real Property Law was circa 1600. "To content owners and the heirs of thy body in fee simple absolute... "

Edit: Don't expect to see any new works anytime soon.

</comment></comment><comment><USER5> How much time does he spend every day to read them? I'm always impressed by people who tell me they read a book in a few days. I understand that one can learn to read faster, but for non-technical books this always lead me to be unable to clearly envision the world it is taking place in. Just like a narrated movie. Even if I slow down I often can't remember the names and places in the book. In two hours I might read about 50 pages. Far too slow to even stand a chance doing the same challenge he does.

<comment><USER6> Like the OP, I'm finding myself spending more and more time reading on my nook color. Though the LCD is slightly less comfortable than my eInk Sony ebook, having wikipedia a touch away is really too great to explain. I've read many, many books over the last weeks. One or two a week (last week, Jules Verne' "le testament d'un excentrique", the week before Jack London's" people of the abyss" and Verne's "la maison à vapeur").

And I still have a huge shelf of paper books to read :) Thinking of it, I probably spend most of my time reading something anyway (I read tons of magazines, blogs, HN, reddit, etc. too). I'm a real book worm :)

You say that you're reading about 25 pages per hour, that seems really slow; are you sure you aren't sub-vocalizing? Do you by any chance make the words sound in your head (or even your glottis)? This is often the main reason why some people have altogether slow reading and poor understanding.

<comment><USER5> I'm hearing the words in my head in a voice that might suit the specific character. If I don't I feel something is missing immersion wise.

</comment></comment></comment><comment><AUTHOR> Check Richards data, progress and highlights at <https://readmill.com/richardjingram>

<comment><USER7> Oh, man... this alone makes me want to get a Kindle/iPad.

EDIT: Looks like it doesn't work with a regular ol' computer. Is there another site that has more multi-device support?

</comment></comment><comment><USER8> i wonder how many technical books the average HN'er reads per year. My own personal goal is to read 5 books a year

<comment><USER9> I wonder how many technical books anyone reads from start to finish.. for me very few have met that criteria

<comment><USER10> Agree. Although, I don't consider this to be a negative fact. Some chapters are relevant, others are not. This is quite common for technical books.

</comment></comment></comment><comment><USER7> >I've only just this minute taken a mere six steps to get from Jack Lemmon to Samuel Pepys

I wonder how often a path between two pages on Wikipedia is unique once its length is known. (You know, assuming no cycles were abused inbetween.)</comment>