Microsoft's new Surface Pro has 13.5 hours of battery life and LTE option - <AUTHOR> https://www.theverge.com/2017/5/23/15674198/microsoft-surface-pro-price-features-availability <comment><USER2> I assume not the Core i7 version, because likely the lower-end versions with this battery life are based on "Core M", (now renamed Core i5 or i3).

This is why this stuff is always quite misleading. You have to read between the lines to actually get it. What they typically mean is "up to x hours or performance, with a specific version of this model". But they write the marketing stuff in a way that makes you think _all_ versions are capable of that.

Same with the pricing: "only $800" \- but you have to pay $150 more or whatever the keyboard costs, more for the pen, and so on. But in the commercials they show you the full package.

<comment><USER3> Whenever I read "up to" I find it sobering to substitute with "no more than".

"Up to 13.5 hours of battery life" becomes "No more than 13.5 hours of battery life". "Up to 100,000 people affected" becomes "No more than 100,000 people affected". & cetera</comment></comment>


CodeFights out of beta - <AUTHOR> https://codefights.com

<comment><USER2> Is the arrayMinimum function deliberately wrong? I hope so...

</comment><comment><USER3> Nice! Luv it...</comment>


DC Subdomain Hacked - <AUTHOR> http://mobileinaug.dc.gov <comment><USER2> The timing... They should use their skills to somehow support the global fight against COVID-19

There are bigger problems to solve right now

</comment><comment><AUTHOR> Right. Could have helped with the covid data crunch and got paid.

<comment><USER3> How do you get paid for the data crunching? Is there a paying folding@home alternative or did you mean something completely different?

<comment><AUTHOR> There is a nonprofit teaming up with the us government to pay data scientist for taking the covid data set and answering questions. I know it was going 2 weeks ago. There are probably still some unanswered questions. The bounty was like 1.000 a question.</comment></comment></comment>


Fabulous: I made a Fabric script to help with django deployments on EC2 - <AUTHOR>

I hate deploying django apps for the first time. It takes way too long to configure the server. I tried Chef and Puppet but they are too complex for my needs.
So, I decided to make it a little bit easier for me by making a Fabric script (fabfile) that creates an EC2 instance and get it ready for a django app. I just published this after working on it all night last night.
What do you think? Would you use this? How would you make it better?
https://github.com/gcollazo/Fabulous <comment><AUTHOR> <https://github.com/gcollazo/Fabulous></comment>


System design interview questions for IT companies - <AUTHOR> https://github.com/checkcheckzz/system-design-interview <comment><USER3> This is awesome, thanks! The "highscalability.com" posts are so fun to read.

EDIT - <USER2>

</comment><comment><USER4> Leave the testing until the end? Is that best practice in some places still?

<comment><USER5> > Leave the testing until the end? Is that best practice in some places still?

What testing, we'll let the end-user find the bugs and then fix them in the next version.

</comment></comment><comment><USER6> Reading a bunch of random tech articles makes someone capable of designing systems, now? I don't think so. Without years of hands-on experience, the odds are that they'll just design a pile of mud.

Things like this are reasons why tech interviews are so difficult. People cram some knowledge and then have the faulty belief that they're actually capable of something. It's frankly offensive to people who have been doing it for 20 years.

<comment><USER7> Juniors tend not to be as good as seniors. Obviously. That's why you use questions like in the article to kick off a chat during the interview to look for whether someone might be a good junior to understudy a senior. You don't need to treat it as an exam with an exact answer to find it helpful.</comment></comment>


Ever Wondered What Would Happen if Your City was Nuked? - <AUTHOR> http://www.carloslabs.com/node/20

<comment><USER2> This doesn't take topography into account. I suspect that would be fairly important for some cities like San Francisco.

<comment><USER3> Indeed. While I haven't checked up on any recent research or findings, as of the '70s/80s it was thought that though Nagasaki was hit by a slightly more powerful bomb than Hiroshima, it suffered less due to its hilly terrain. (The biggest difference, though, was due to the latter resulting in a firestorm, and outside of perhaps Somerville, MA there are very few US cities with enough fuel per area for one of those to develop).

</comment></comment><comment><USER4> Another perspective: <http://www.johnstonsarchive.net/nuclear/nuclearwar1.html>

(kinda long, but worth the read)

</comment><comment><USER5> I really hope this isn't an Ender's Game kind of thing...

</comment><comment><USER6> In case anyone misses it (took me a bit to find), there is a weapon selector under the bottom left edge of the map to choose different sizes of nukes.

</comment><comment><USER7> It looks bad, but not as bad as I always imagined.

<comment><USER8> These are relatively tiny nukes coming in one at a time - the sort of thing we might see if attacked by North Korea or Iran in 10 years. The fusion weapons used by the USSR were fifty to five thousand times as powerful.

<comment><USER9> do you think that the 0.5Kt test in North Korea was a success of a small nuke, not a failure of a bigger one :)

<comment><USER10> I do - North Korea isn't going to nuke anybody, ever. They need insurance that the US won't invade them.

</comment></comment></comment></comment><comment><USER11> It's hard to compare the magnitude of each bomb because it keeps changing the zoom level every time I click 'Nuke it!' again.

edit: also, why is the fallout so distorted when changing wind directions between east/west and north/south?

<comment><USER12> Uncheck the autozoom checkbox to keep the same perspective.

</comment></comment><comment><USER13> Tsar Bomba is my favorite. Is the developer making a political statement by defaulting the map to D.C.?

<comment><USER14> The default city changes on page load. Try refreshing, it's not always D.C.

<comment><USER15> Yeah, for me the first default city was Beijing.

<comment><USER16> Mine came up as Hiroshima...I couldn't bring myself to click "Nuke It".

</comment></comment></comment></comment><comment><USER17> Remember, with all of the smaller nukes, you're suppose to get smothered by like 8 warheads at the minimum. Well, says the Cold War anyways.

</comment><comment><USER18> I think it would hot and windy. And a bit noisy as well.</comment>


Ask HN: Tips for learning maths - <AUTHOR>

I've got a pretty heavy maths workload at college this year and I'm finding it difficult to learn everything, has anyone any tips as to how to approach learning new techniques (e.g. I'm learning how to solve systems of differential equations this evening) they're a dime a dozen at the moment and I'm constantly forgetting them, I feel there should be a better way than just drilling questions but currently I've not really thought of any better way. In general I find the techniques easier to understand and remember when I've got a good understanding of what they should be used for, alas my teachers tend to gloss over the why and focus on the how.
How did you approach learning maths? Did you find any particular approach to be especially effective? <comment><USER3> 1) Here's a thread on LessWrong on how to learn math: <http://lesswrong.com/lw/2ub/discuss_how_to_learn_math/>

2) Here's a discussion on learning math on HN: <http://news.ycombinator.com/item?id=108723>

3) This is Cal Newport's advice on acing technical courses: [http://calnewport.com/blog/2008/11/14/how-to-ace-calculus- th...](http://calnewport.com/blog/2008/11/14/how-to-ace-calculus-the-art-of- doing-well-in-technical-courses/)

His advice to a new MIT student: [http://calnewport.com/blog/2011/04/28/on- becoming-a-math-whi...](http://calnewport.com/blog/2011/04/28/on-becoming-a- math-whiz-my-advice-to-a-new-mit-student/)

<comment><AUTHOR> These links are, just brilliant, I'd say I have a passion for maths to begin with, but these really make my mind blaze with possibilities, motivation to learn is just important (or more so) as learning how to learn!

</comment></comment><comment><USER4> _In general I find the techniques easier to understand and remember when I've got a good understanding of what they should be used for, alas my teachers tend to gloss over the why and focus on the how._

Several authors I can recommend who write good expository books on mathematics to explain the why are

Ian Stewart

John Stillwell

Keith Devlin

William Dunham

Timothy Gowers has a book about mathematics in the Very Short Introduction series

[http://www.amazon.com/Mathematics-Short-Introduction- Timothy...](http://www.amazon.com/Mathematics-Short-Introduction-Timothy- Gowers/dp/0192853619/)

that should be helpful to you.

On the particular subject you are studying right now, see if Hubbard and Hubbard's book Vector Calculus, Linear Algebra, and Differential Forms: A Unified Approach

<http://matrixeditions.com/UnifiedApproach4th.html>

helps your understanding.

</comment><comment><USER5> Math professor here.

It is good if your teachers explain the why, but it is even better if you fill it in for yourself. Read your lecture notes, or your textbook, with a critical eye. "Why are they doing it this way? Why would anyone think of this?" etc. If you think your book or prof is being obtuse, try to figure out why you think that way. I curse at math books sometimes...

Instead of refreshing the correct technique and then solving the problem, try solving the problem without first recalling how to do it. Perhaps you will figure out the solution and invent the solution method yourself. If you are more like me, you will fall flat on your ass and produce five pages of calculations that go nowhere. In either case, you should then read the book's explanation and you are much more likely to remember it.

And that happens to everybody. I am constantly having to relearn stuff. If you think it's difficult --- good, you're doing it right.

<comment><AUTHOR> Thank you, you've given me the confidence/will power to persevere! "Why are they doing it this way? Why would anyone think of this?" etc. If you think your book or prof is being obtuse, try to figure out why you think that way. I curse at math books sometimes..." Excellent advice, I'll stick to this.

</comment></comment><comment><USER6> Try a book Adventures in Numberland. It's not a mathematics manual, but written in plain language explaining pretty much everything to simpletons, like me. I'm not saying you're one, but the author is a mathematician, so you might get more out of it.

Amazing stuff. I now understand much about the patterns in numbers that I had no idea even existed, and how they can be used to simplify complex concepts.

</comment><comment><USER7> Learning the proof instead of memorizing the equation sometimes helps. What sort of math courses are you taking?

<comment><AUTHOR> I'm doing introductions to Linear Algebra, Vector Geometry. Calculus - <USER2> along those lines, mainly applied maths with some complex numbers thrown in for good measure!</comment></comment>


The death and rebirth of Duke Nukem Forever: a history - <AUTHOR> http://arstechnica.com/gaming/news/2010/09/the-death-and-rebirth-of-duke-nukem-forever-a-history.ars <comment><USER2> I remember learning that Mark Felt was deep throat - so unbelievably exciting, albeit momentarily, that such a generation-long mystery had been solved.

A DNF release won't quite be as well publicised, but for me it will have a similar feeling.

[Edit: Why yes, I do have a therapist, why do you ask?]

</comment><comment><USER3> Nice summary on DNF from Ars. The best in-depth best on DNF is this one by Wired:

<http://www.wired.com/magazine/2009/12/fail_duke_nukem/all/1>

One of the most interesting saga's in software dev

</comment><comment><USER4> I wonder what this means for the actual developers... In an industry that measures you by how many titles you've shipped, this has got to hurt.</comment>


To hack an Android phone, just type in a really long password - <AUTHOR> http://money.cnn.com/2015/09/16/technology/android-hack/index.html <comment><USER2> This can happen only because of a design flaw in the security architecture of Android (L). Unlike iOS and like traditional PCs, the disk encryption key is always in memory when the device is booted and nothing is really protected if you get a device in that state. It's an all-or-nothing proposition. On iOS, there are different encryption keys that are used to protect different classes of information. Specifically, when an iOS device is locked, the operating system loses a key that can decrypt files that are of a certain protection class that are not supposed to be readable when the device is locked. Only by entering the password when unlocking the device (or reloading it from Touch ID memory), that key can be derived again. The effect is, for example, all your mail can be protected and rendered unreadable while the device is locked.

With this security architecture, no bug in the password "gatekeeper UI" can lead to you being able to read the protected information if the device gets locked successfully.

<comment><USER3> Jesus, why do Android engineers keep getting security so wrong so often? And they even bragged so much about how L is (finally) getting storage encryption by default, which they promptly killed after the Nexus 6 launch (because apparently they are stupid and launched the device without hardware accelerated encryption, even though the chip supported...ugh).

We still haven't heard anything about it being re-enabled in Android M again (or ever). Also, I remember reading about Android <4.4 (optional) storage crypto being seriously broken as well.

It's unfortunate because many people probably _still_ believe they are getting default storage encryption. Heck, all the _new_ stories on encryption and the FBI still (falsely) mention how Android is encrypting the storage by default. It reminds of media sites saying Skype is P2P and secure against eavesdropping years after Microsoft announced it changed its infrastructure to a centralized wiretap-friendly model, just like everyone else.

The gap between iOS and Android in terms of security (and privacy, too) seems to only be increasing every year. If they keep this up I may finally switch to an iPhone after years of being an Android-only user.

[https://medium.com/@FredericJacobs/apple-ios-9-security- priv...](https://medium.com/@FredericJacobs/apple-ios-9-security-privacy- features-8d82d9da10eb)

And that's even without mentioning the horrible update problem that Android has. I've just learned to live with that by installing custom ROMs after my phone stops being supported a year into its life-cycle, which is obviously not ideal in terms of security nor is it something I should _have_ to do to get better security.

<comment><USER4> "Jesus, why do Android engineers keep getting security so wrong so often?"

Security is hard. Really profoundly hard, not just superficially hard.

And despite the fact that nominally I'd expect to get upvotes for stating what you'd think would be the groupthink consensus, my observation is that in the field, even engineers explicitly tasked with security still often think it's really easy and they're really good at it, so there's no great need for them to budget lots of time for it. This turns out poorly. I do not toss this around lightly because it's become cliche to just fling it around without much care, but there's a lot of real, no-foolin' Dunning-Kruger effect operative in this area.

(Your test for Dunning-Kruger on this matter is: If you're told you need to secure something and you're going to be personally responsible for its security, do you A: Say "Oh, that's easy, I'll 'just'..." followed by pretty much any series of words, or B: get the cold flop sweats, _regardless_ of how easy it may superficially seem?)

<comment><USER5> > Security is hard. Really profoundly hard, not just superficially hard.

Indeed. There is an army of naked celebrities dancing around the internet today because of an "iOS" hole that didn't even involve the device OS at all.

Picking on specific features to announce "Apple is more secure" is very much missing the point.

That said, yeah: I'm not a big fan of Android's security architecture either, though it has been improving rapidly.

<comment><USER6> > though it has been improving rapidly.

This is an important factor, and maybe the fatal flaw in android's carrier relationships. Google is always very fast to push a fix out, but the carriers always drag their feet in getting the fix to the actual devices.

<comment><USER5> It's really not. We're talking about security architecture here (which rolls out only with OS releases) and not security bugs (which get rapid patches on all but the most negligent of OEM devices).

Having a better security architecture works (to stretch the metaphor) like immunization: past a certain adoption level you reach a "herd immunity" state where the marginal benefit to an attacker of a specific flaw drops rapidly to zero even though there are still "old" devices out there in the market in small numbers.

Basically, the market refresh cycle is still at something like 18 months, so even given that OEMs are slow new Android releases are reaching the public in large numbers fairly promptly.

<comment><USER6> That is actually a great point, hardware refresh is such that updates get performed regularly. Also, this exploit requires hardware access to the phone, which is generally considered game over in any respect.

It would be beneficial if carriers could come up with updates faster however. I've seen Verizon drag its feet on more than one occasion, especially with phones that are a generation or two behind.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Only thing that comes in my mind... [http://i.imgur.com/rG0p0b2.gif](http://i.imgur.com/rG0p0b2.gif)

<comment><USER8> Windows 9x was never secure, and I believe that screenshot was taken from Windows 98 or 98SE (hard to tell which).

Arguably this is a bug in HP's printer driver. But the fact Microsoft exposed printing to begin with was misguided.

I will say, even then, Microsoft intended for businesses and schools to utilise Windows NT 4.0 for this type of scenario. Unfortunately for them 9x become too popular for its own good, so people were buying machines with it and then having it log into AD (which was never really secure scenario, NT is designed for this, 9x wasn't).

<comment><USER9> You could do similar in SBS2003.

</comment></comment></comment><comment><USER10> There was a small and relatively unsuccessful F1 racing team around about 10 years ago, who's name I shall not say here. Internally such teams were known as "pit dodgers".

When it came to the design of their gearbox, the work was outsourced (as much of it is in F1 unless you are Ferrari).

The primary gearbox designer did most of the work, however reverse gear proved to be a problem, but rather than fix the problem, it was left to the junior designer who couldn't solve it either, who also left it pretty much unfunctional. This was based on the concept that:

a) Reverse is rarely (if ever needed) (sidenote: disqualified if used in the pits during a race)

b) The "pit dodger" team was unlikely to last the entire race anyway, so the gearbox didn't need to standup to a full race duration anyway. The effort put in to designing the components (i.e. precision) can be reduced to match the expectation of success and failure rate of other third party components. Design and production time can be saved and extra profit made.

Thus lies the lesson of the emergency call feature, or any other feature that designers feel don't really require that much attention because they are rarely used. These features are often handed to junior developers and engineers, because of the fact that people have a tendency _to deem lesser- used features as unimportant_.

Which is fine of course until you have an emergency and you desparately need to make that emergency call because your, or someone else's life, depends on it. Or you need to reverse out of the way of a damn F1 car coming towards you at 150mph down a straight and you are sitting in the middle of the track. WTF, reverse doesn't engage....oh shiiiiiiit....

TLDR: Features that are very infrequently used are not always the features of least importance.

<comment><USER11> Emergency call is one of the features that must work for a device to pass certification (numbers: 911, 112, and, a third one I cannot remember). In that sense, this is not an unimportant feature.

However, AFAIK, not being able to make regular calls without using a password isn't part of certification testing.

<comment><USER12> I think "0118 999 881 999 119 7253" was the third one you were looking for.

<comment><USER10> Great reference: [https://www.youtube.com/watch?v=ab8GtuPdrUQ](https://www.youtube.com/watch?v=ab8GtuPdrUQ)

</comment></comment></comment></comment><comment><USER13> Note this is for password-protected phones only, PIN and pattern protected phones not affected.

The original vulnerability is here, for those preferring to skip CNN and go straight to it: [http://sites.utexas.edu/iso/2015/09/15/android-5-lockscreen-...](http://sites.utexas.edu/iso/2015/09/15/android-5-lockscreen- bypass/)

<comment><USER14> How ironic that this bug affects the only really secure locking method. Neither the pattern nor the pin are really safe to protect a device as both are easily snoopable.

<comment><USER15> Imo the pattern lock is really secure if you make it hidden at lockscreen.

<comment><USER16> Recently there was a report around the pattern lock being the least secure and having the least amount of variation between passwords.

Edit: Unfortunately I can't find the specific study I was looking for, so I'll have to add my own [citation needed]

<comment><USER17> Well, internally the pattern password is literally stored as numbers, just like the pin. So If you go top right to middle right then to middle, then to bottom middle, your pattern will be saved as 3658. It's less secure than a pin, because obviously with a pattern lock a 3 can only be followed by a 2,5 or 6, and no number can repeat, so it's easier to crack than a pin.

<comment><USER18> My pattern left a trail on my screen pretty much telling you my password. You'd have to guess on the direction a couple times, but you'd get it fairly quickly. I think the pattern lock is really just a way to keep kids off your phone. Greasy fingers on glass are way too telling.

</comment></comment></comment></comment></comment></comment><comment><USER19> Previously, any crash in the Keyguard (which used to reside in the same process boundary as the system_server) would have taken down the OS, and a (soft) reboot would have ensued. Now that the Keyguard runs in its own process, any crashes now only gets rid of the Keyguard window and exposes whatever window is behind it (usually a launcher window).

I wonder if the actual fix is to have the "watchdog" ping the Keyguard's process for a heartbeat like it does so with other services within the system_server... That way, any flaw / crash in Keyguard and you essentially loose access to the OS too (until it come backs up from the reboot, and starts from a clean slate).

<comment><USER20> NT has a neat feature for essential processes: you can tell the kernel, "if I ever exit, for whatever reason, panic the system and reboot immediately". There's little room for error with a system like that. It wouldn't be that hard to implement this feature in Linux too.

(Of course, you need to have special privileges to mark your process as critical.)

<comment><USER21> In Linux, if PID 1 ever goes down the kernel panics. You could put a watchdog in your PID 1 that will take it down if the timer isn't tickled for a certain period of time.

<comment><USER22> Systemd has a couple of nice features around this: init can open the hardware watchdog and ping it as required, so if init ever stops then the machine will reboot. At the same time, services can be set up to need to write to their own watchdog. So if a service dies, either init will notice and take appropriate action, or init will also have died and the hardware watchdog will reboot the system.

Also -- and this has been useful to me on a laptop -- init will configure the watchdog as a last-resort to kill the system when shutting down.

</comment></comment></comment></comment><comment><USER23> "But phones will remain vulnerable until they're updated with the latest software patch."

So never then.

<comment><USER24> This is the number one problem I have with Android. Once I buy an Android phone I pretty much expect 6 months of updates. Maybe longer if it is a really big bug. Sure some OEMs have made "promises" to provide 2 years of updates but that updates don't come out all that quickly, often several months after it hits the main AOSP line.

If you want an iOS like experience with Android you have to buy a Nexus phone of which the Nexus 6 sucked balls due to its size.

I wish Google hadn't killed the Play Edition phones. I would love a choice of phones running stock Android, maybe with a few extra, optional, apps from the OEM similar to what Motorola does. A Galaxy S6 running stock Android with a guarantee of update within 2 weeks of it hitting a Nexus would be my perfect phone.

<comment><USER25> Just select your brand based on their ability to update phones for a couple of years past purchase. Nexus phones are kept up to date. Motorolla too. LG seems to be on that track, but History will tell. Samsung also pledged to update for two years.

<comment><USER26> Or just don't buy phones with an OS that the OS developer can't actually patch. Buying Android is buying poor security.

<comment><USER25> That is false. As long as the OS is updated, it does not matter whether it is the OS developer, or the equipment manufacturer, publishing the update.

I wonder, if Apple delegated OS update publishing onto third parties, if you'd keep your position. The Jobs distortion field extends beyond the grave, it seems.

</comment></comment></comment></comment></comment><comment><USER27> OS X had a curiously similar screensaver vulnerability back in the early days. On 10.2.6 and earlier, attempting to submit a very long string (>65,537 characters if memory serves) into the screensaver password prompt would crash the screensaver and drop to the desktop.

Making exploitation much easier was how around the same time Cocoa widgets got emacs-style bindings like ctrl-k, ctrl-y, ctrl-a. Through combining these shortcuts an attacker could quickly and exponentially increase the input string length.

I never saw it documented online but I remember applying this same trick to logonwindow and OS X dropping into the so-called 'secret >console mode' \-- full screen terminal, Linux-style.

Background: [https://www.securemac.com/macosx-screensaver- security.php](https://www.securemac.com/macosx-screensaver-security.php)

</comment><comment><USER28> I know you can just put a limit on it, but a string much less than 1MB in length entered into an edit field can crash a device with probably 1GB or more RAM? If there's a fixed-length buffer somewhere that's being overflowed, it's absurdly large for a password; and if there isn't and it's actually dynamically allocated, that's still pretty sad. I just can't help but ask "what were the people who designed and wrote this code thinking?"

This bug just happens to have been brought up in a security context, but if other text edit fields elsewhere in the OS and apps will cause crashes too when fed long strings, that's not just a security issue.

</comment><comment><USER29> Reminds me a little of JWZ's "on toolkits" ([https://www.jwz.org/xscreensaver/toolkits.html](https://www.jwz.org/xscreensaver/toolkits.html)).

Writing lock screens is hard!

</comment><comment><USER30> Summary:

1\. Only affects stock Android 2\. Only works with password protection (PIN, pattern = OK) 3\. Already patched

<comment><USER31> "Already patched" isn't really as meaningful on Android as it is on, e.g., iOS where the average user can expect to (and frequently does) update their operating system.

How many phones are still vulnerable to StageFright?

<comment><USER32> The bug appears only on stock devices which are commonly updated. OEMs provide their own lock screens which aren't vulnerable.

So in this case "patched" is pretty meaningful.

<comment><USER33> How do you know they aren't vulnerable ;)

</comment></comment></comment></comment><comment><USER34> I wonder if my kids found something similar to this on their Kindle Fire Kid edition. I have parental controls enabled but sometimes the tablet is still running after the predefined cut off time. I remember seeing one time that the PIN entry was popped up with a really long string of numbers in it. They are very very young and wouldn't be able to Google something like this so it was trial and error if they found it.

<comment><USER28> That's a good thing. It means your kids are natural hackers. :-)

<comment><USER34> I'm totally OK with this too! :D

</comment></comment></comment><comment><USER35> Not working on my S6. Can't paste nothing on password entry dialog.

<comment><USER36> It was fixed in 5.1.1 build LMY48M ([http://sites.utexas.edu/iso/2015/09/15/android-5-lockscreen-...](http://sites.utexas.edu/iso/2015/09/15/android-5-lockscreen- bypass/))

<comment><USER37> It's interesting how most Nexus devices only have a LMY48M image [https://developers.google.com/android/nexus/images?hl=en](https://developers.google.com/android/nexus/images?hl=en) but the razorg skipped that and has LMY48P (which I flashed yesterday, phew!). Also, the 2012 Nexus 7 is still stuck at LMY47V.

</comment></comment></comment><comment><USER38> I seriously would like to know why did not they implement a limit of characters on that field.

</comment><comment><USER39> I can't understand in the first place, why copy & paste is active on a password screen that should lock the whole device at all!

Of course, deactivating copy&paste would not be a valid solution for this, but the paste feature also could potentially leak user data to unauthorized persons. The copy feature could by accident reveal the password at places where they do not belong.

<comment><USER40> The copy is occurring on the phone number input, not the password screen.

<comment><USER39> I understood that.

When they activate paste, I guess copy is active to ... (but I don't own such a phone)

<comment><USER40> It's very common for password fields to accept paste but not copy. I don't see why you would assume that.

<comment><USER39> Ok, I don't see, why they should accept paste at all!

<comment><USER40> Have you ever used a password manager? As a general rule they should definitely accept paste.

<comment><USER39> A password manager for a locked device? Does that make any sense?

I do not have an Android phone or a password manager, but I still do not get the point here. The device is locked, so how do I access the password manager?

<comment><USER40> _As a general rule_ password fields should accept paste. 99% of them are not on locked devices.

When you said "they" I thought you were talking about password fields as a whole, not this single field.

And even then, any OS could be run in a VM, so why not accept paste, it won't hurt anyone.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER41> If you have physical access to the device, aren't all bets off anyways?

<comment><USER42> Not theoretically, at least.

Even attackers that can read your RAM perfectly can be thwarted by encrypting things and unloading the keys from memory.

<comment><USER43> Those attackers could instead install a hardware based touch screen logger or write a similar attack in software and write it directly to your phone's flash. It's more complicated, but it's still true, once someone has physical access, all bets are off.

<comment><USER42> Yes, a device which has been accessed physically shouldn't be trusted anymore (theoretically) but I was talking about the case of a booted device being stolen by an attacker, not the case of one having been returned.

In practice, If you can detect intrusion and the device has a secure boot system, wipe the device and issue it new keys, re-encrypt all data to the new keys with some backup cold-stored keys.

</comment></comment></comment></comment><comment><USER44> I have a galaxy S6 running android 5.1.1 with device encryption.

The lock screen only accepts a password of 16 digits long.

So.... Only some devices effected?

EDIT:

On further research its fixed on 5.1.1.

Kind of a stupid fix? Just limiting the size on the input password field?

Also I notice that you can no longer copy paste from the emergency call screen.

<comment><USER45> I tried this on my HTC One and I found that I couldn't copy anything from the emergency call screen either.

</comment></comment><comment><USER46> __facepalm __

The year is 2015. The basic security of basic devices remains more fucked than ever.

</comment><comment><USER47> I tried this on my phone last week when I read the article. One I can't cut/paste on my Note 4 Lollipop (At the emergency password screen). Two if you even try to cut/paste or take longer than a second to the phone locks and you have to start over on the password.

Maybe it's because I use the finger print reader and password is for emergency. On my phone this hack seems virtually impossible after 10 minutes of trying really hard to get it to work.

</comment><comment><USER48> Not working with my cell phone

<comment><USER49> Perhaps your computer doesn't get overloaded</comment></comment>


First look at YC Demo Day - <AUTHOR> http://dondodge.typepad.com/the_next_big_thing/2007/08/boston-vcs-gets.html <comment><USER2> I personally liked anywhere.FM on first use. There may be other sites that provide the same features, but I don't know them. My first instinct is to use the website to share my music with my brother who lives on another continent

</comment><comment><USER3> _"... The companies were much higher quality than I expected. The founders were nearly all coders and hackers but did a surprisingly good job at presenting their idea, target market, and business model ..."_ ~ Don Dodge

Is YC being embraced by the larger VC community?

If so, this is a further tick of approval of the YC techniques used to get startups to market. The quoted comments are a remarkable turn-around in opinion from Don Dodge ( _'Since when does growing $4 Billion a year = Dead?'_ ) and It's great to see the candidates flexing their skills of _persuasion_. Selling the idea(s) as much as building it.

How much effort went into making sure other VC's could also see the new recruits?

<comment><USER3> maybe I should have read this ~ <http://www.innoeco.com/2007/08/demo-day-at-y- combinator.html>

</comment></comment><comment><USER4> Congrats to all the founders, the launched betas look promising.

</comment><comment><USER5> I just don't understand why some of these guys are so hell bent on disparaging YC. Whether YC is right or not, time will tell and it's YC that has to worry about it. But, what do _these other people_ gain out of it?

</comment><comment><USER6> Which team is doing video dating?

<comment><USER7> They're one of the ones that aren't launched yet. 3/4 of this batch aren't launched yet.

<comment><AUTHOR> Can we get some hints here? That's like the third best thing after not making it ( the 2nd being we reviewed our product and made it better)

<comment><USER8> RTFA. the blog post lists a 2-3 word blurb for each company in the first paragraph.

<comment><AUTHOR> Dude. I need more than that. Anyone could have predicted that. Thats not info

<comment><USER9> Obviously they haven't launched, but you can imagine that a video dating site is a lot like OKCupid, except everyone has the capability of sending video messages and doing live video chats. They also get to sell webcams, for those that don't have them.

</comment></comment></comment></comment></comment></comment><comment><USER10> "A stock-picking community?" Worthio two-point-oh?</comment>


Imogen Heap releases single on Ethereum-based Mycelia - <AUTHOR> http://www.theguardian.com/music/2015/sep/06/imogen-heap-saviour-of-music-industry <comment><USER2> Went to alpha.ujomusic.com, greated with:

>The UJO MUSIC Prototype is optimized for Chrome on the Desktop.

People says that Safari is the new IE, but I have come across too many Chrome- only sites to think otherwise.

<comment><USER3> Also note that "is optimized for ~" is now a euphemism for "content is only available for ~".

I'm not quite sure to like that semantic shift.

<comment><USER4> Well, _in my days_ I read "is optimized for Mozilla 1024x603" as "I am not savvy enough to make IE align my stuff correctly but I am an armchair open standard freedom fighter condescending enough to stick my W3C-validate logo in the face".

</comment></comment></comment><comment><USER5> Singer Imogen Heap releases single on Ethereum (blockchain-based) service Mycelia

<comment><USER6> Thanks for this. It's a continuing problem with HN that submitters assume everyone knows the same things they do, and leave out vital context.

<comment><USER7> It's been a continuing problem with tech sites since the beginning of tech sites, not just HN.

But yeah, this is really frustrating.

</comment></comment></comment><comment><USER8> What I don't understand is: Is the music in the blockchain? Is the music on everyone's computer but only accessible for whose with a key? Does this not make a blockchain too big? Can you have subsets of the blockchain locally? When you buy this album can you stream from these subsets of blockchains like with Popcorn time? Its' not really explained in this article...

<comment><USER9> Exactly, good questions, that's what I was wondering as well!

After looking around, I think this is complete bullshit. I mean, it's a normal website with a normal HTTP download. The only difference is that the payment method is Ether.

So I think calling this "blockchain-based" is sensationalist.

<comment><USER10> This definitely _is_ blockchain-based. Specifically, this project is using an ethereum smart contract to record the release of a piece of creative content along with a list of contributors to the realisation of that content. These contributors will be automatically and transparently paid a portion of the revenue each time someone purchases that content. My understanding is that currently the content is hosted on amazon s3, but future plans would use something like ipfs.

Some data on the ethereum contract including stored values and transactions: [http://frontier.ether.camp/account/c7696b27830dd8aa4823a1cba...](http://frontier.ether.camp/account/c7696b27830dd8aa4823a1cba8440c27c36adec4)

</comment></comment></comment><comment><USER11> How to actually get the song: [http://blog.ujomusic.com/2015/09/get- ether/](http://blog.ujomusic.com/2015/09/get-ether/)

<comment><USER12> I use Bitcoin every day, and these steps will rule out 99.999% of users from being able to get any etherium (and hence buy this music)

The biggest problem with bitcoin is getting "normal" people to acquire even small amounts without going thru too many hoops, Coinbase and Circle are doing a good job there

<comment><USER13> How is coinbase/circle solving the hoops?

The only steps I want to go through are

1) Register an account (email/password)

2) Choose amount of bitcoin and destination

3) Pay

<comment><USER14> Chat with your local legislator. Anti-money-laundering laws exist.

</comment></comment></comment></comment><comment><USER15> This article really buries the lead.

<comment><USER16> please do be more specific

<comment><USER17> You have to scan through about ten garbage paragraphs describing the current state of the music industry before it starts talking about the story in the headline.

</comment></comment></comment><comment><USER18> Long term fan - if you ever get to see her live, it's well worth going along. Her gloves are amazing. Allows her to combine something akin to composing while she's also playing instruments. Fascinating to watch.

<comment><USER19> musicians do this all the time

<comment><USER20> She does it well. Just saying ;)

</comment></comment></comment><comment><USER21> "Imogen Heap invents _a really complicated way to pay for 1 song._ "

I'll pass.

</comment><comment><USER22> My favorite song by her: [https://www.youtube.com/watch?v=eAKh26bfkpw](https://www.youtube.com/watch?v=eAKh26bfkpw)

Beautiful usage of a vocoder.

Yes, I know it's OT…

<comment><USER23> Since we're already OT, I'll add that she was actually using something more like a harmonizer than a vocoder[0].

A vocoder takes the formants from a singer/speaker and applies them to a carrier signal which provides the pitch. So you could for example use a piano as the carrier signal, resulting in a sound that is still very recognizably piano-like but "sings" whatever you do, ignoring the pitch of your voice.

A harmonizer is really one or more pitch shifters that take the original singing and move the pitch up or down a certain number of steps while retaining (more or less) the timbre or texture of the voice. The altered pitch(es) can track the original or be fixed to certain notes. The altered pitches are mixed with the original signal to create harmonies. (AutoTune is in fact a pitch shifter married to pitch recognition algos that nudge the pitch back to where it should be.)

Some harmonizers let you use a MIDI keyboard to determine the pitches that will play. With this kind of setup it's often referred to as a voice synth: you can play chords on a keyboard that result in copies of your own voice re- pitched and played back simultaneously. This is basically what she used to create that song.

None of this (hopefully interesting) aside changes the gist of the original statement: Hide and Seek is a beautiful song, and Heap's voice is a perfect match for the instrument because of her range and tonal flexibility.

[0][http://duc.avid.com/showthread.php?t=288785](http://duc.avid.com/showthread.php?t=288785) (forum link because the original article 404s)

</comment></comment><comment><USER24> I got all excited that IH had released some music Eduardo Kac style by encoding it with CRISPR in mycelium or something. From 8-bit to RNA-bit.

Silly me, it's some block-chain thing. Drat.

</comment><comment><USER25> >When was the last time you bought a CD or a record?

August 2015. Is that a trick question?

</comment><comment><USER26> Doesn't the song being on YouTube defeat the purpose?

</comment><comment><USER27> This article is begging for a TL;DR summary. 18 paragraphs before they get to the first mention of Ethereum or blockchain.

</comment><comment><USER28> Also [https://news.ycombinator.com/item?id=10335389](https://news.ycombinator.com/item?id=10335389).</comment>


Jobs That No Longer Exist - <AUTHOR> https://www.ranker.com/list/jobs-that-no-longer-exist/coy-jandreau <comment><USER2> Besides the inaccuracies in this "article" the copyright notice underneath the photos is a joke. Showing Marry Poppins with the copyright notice "imgur" just leaves you speechless.

<comment><USER3> I once read through a (printed) community-service-related publication and noticed that the images were apparently "(c) Google Images".

On the one hand I wonder if I'm staring at malicious compliance masquerading as plausible deniability, but then the thing with google image search happened, and... I don't know anymore.

I REALLY REALLY miss the "find similar" button in GIS though.

\--

As for the article itself, this appears to be standard pinterest/facebook-rate fare - writing to generate ad impressions.

The "why it went away" in #18 is patently false.

I'm honestly impressed at the ads and tracking, at least; the ads are served without iframes and don't use 100% CPU, and the continuous tracking (? that seems to be what it is) is only using a few Kbps.

<comment><USER2> Haha, totally. I am honestly impressed how that "article" made it to hackernews.

</comment></comment></comment><comment><USER4> FARMERS

The Job: plant seeds, pick or pull the edible part of the plant when ready.

Who Did It: most Americans, families of men, women, and children.

Why It Went Away: hubris, the onset of the apocalypse, functions replaced by insecure machines.</comment>


Stephen Colbert lambastes Amazon over blocking, delaying Hachette books - <AUTHOR> http://arstechnica.com/business/2014/06/stephen-colbert-lambastes-amazon-over-blocking-delaying-hachette-books/

<comment><USER2> I think it's pretty hard to take a stance in this case. On one hand, Amazon wants to keep prices low for customers, but don't want to pay the subsidy from their pocket anymore. On the other hand, Hachette doesn't want to pay part of that subsidy either, and they threaten the authors that if Amazon has its way they will have to get a smaller royalty (because they aren't willing to lower their costs).

Amazon has a lot of power, and they could easily start abusing it either soon or in the future, but for now I think they are fighting in the interest of the customer. Hatchette on the other hand, is acting much like the big music studios - threatening that the authors/artists will be the ones to lose, and _not them_.

The truth is the publishers and big studios are becoming increasingly more threatened with extinction, and in the future there won't be room for them to take the _majority_ of revenue from a book. Either they adapt to take a much smaller cut, or they will go bankrupt.

That's why I think Amazon is on the right side of history here. I also think Amazon is on the right side of history, because I don't think most ebooks are worth $15, which is what most of these publishers want them to be at (going by the deal with Apple).

Either way, Amazon won't be subsidizing their ebooks by $3+ forever. They will eventually raise the prices, and I don't think that will be good for _anyone_. Not Amazon, not the authors, and not the publishers either, as there will be a lot fewer ebook sales. I think the $9.99 price point played a huge role in getting people to read e-books (remember when reading ebooks wasn't anywhere close to the acceptable way of reading a book?).

What's the ideal scenario here? It's for ebooks to remain $9.99 (or less) and for Amazon to end the subsidies (which would make things easier for their competitors), which of course means the publishers will have to take that $3 cut themselves (I don't think the authors should take any cut, as they already get pretty low royalties from the big publishers). If you agree that this is the ideal scenario, then you agree that Hatchette is in the wrong here.</comment>


Ask HN: Getting insights via google search on Camel on a stick. - <AUTHOR> http://abcnews.go.com/Travel/slideshow/photos-state-fairs-food-favorites-camel-stick-8276151 I'm trying to analyze data from Google on the amount of press that a vendor at the Minnesota State fair got this year using Google.  So far i'm unable to get anything using Google insight or anything.
The vendor debut a new delicacy at the state fair called "camel on a stick" and i'm helping in getting him a better idea on feedback which has been great in the press but we need something substantial. for example it went from 400 hits on google prior to its debut to over 54,000 hits after its debut.
HN community i ask for your help in this endeavor thank you. <comment><AUTHOR> I'm trying to analyze data from Google on the amount of press that a vendor at the Minnesota State fair got this year using Google. So far i'm unable to get anything using Google insight or anything.

The vendor debut a new delicacy at the state fair called "Camel on a Stick" and i'm helping in getting him a better idea on feedback which has been great in the press but we need something substantial. for example it went from 400 hits on google prior to its debut to over 54,000 hits after its debut.

HN community i ask for your help in this endeavor thank you.</comment>


Ask HN: Where to find remote PHP jobs? - <AUTHOR>

I've been developing with PHP/MySQL/Apache/Jquery stack since 2009. I'm looking to get some more clients, particularly to work on LAMP stack type of projects. So far I've tried craigslist, reddit but I find it tough to find remote based projects other than one time gigs (which I'd still be okay with if they were at least 4+ weeks worth of work).<p>Any other recommendations to landing remote PHP gigs? <comment><USER2> Have you looked at Stack Overflow Careers 2.0, specifically for jobs tagged with php [0]? Quite a few of the listings are for part-time positions, if you want something steady but not full-time. Do you check out the monthly Freelancing post on HN [1]?

[0] [http://careers.stackoverflow.com/jobs/tag/php](http://careers.stackoverflow.com/jobs/tag/php) [1] [https://news.ycombinator.com/item?id=7970372](https://news.ycombinator.com/item?id=7970372)

<comment><AUTHOR> I was wondering where the Freelancing thread was for this month, I missed the bus on it I guess.

It's a shame that I can't logon stackoverflow via OpenId because my account was connected through there. I was very active on it.

</comment></comment><comment><USER3> 2006

But seriously, why are you limiting yourself to PHP and jQuery? JQuery especially - really odd considering you could easily work with any framework if you have the JS background...

<comment><USER4> Are other frameworks really that popular? I was assuming AngularJS was still a niche (outside of HN)?

</comment></comment><comment><USER5> I've been told by some of our devs here that there are more Drupal jobs than Drupal developers if that's your kind of thing.

<comment><USER6> This is definitely true. We're always on the lookout for Drupal devs, although we don't hire remote workers.

<comment><USER7> May I ask where you are located? Just curious. Edit: looking to move from my current city.

<comment><USER5> I currently live in Colorado and judging by the 3000 people that showed up the the Denver DrupalCon, you should be able to find work here.

<comment><USER7> Hey, thanks for the info! Where I am in Michigan things are still looking a bit shaky, and I'm tired of waiting!

</comment></comment></comment></comment></comment><comment><USER8> We're hiring - send us a message: [http://www.NetizenCorp.com](http://www.NetizenCorp.com)

We have several commercial clients that have systems based heavily on PHP that we are supporting and have been having trouble finding _qualified_ PHP talent, so remote is definitely an option for us.

That same goes for everyone else here. We're looking for solid PHP talent and trying to avoid having to outsource overseas for it. I had a job posting up but it just came down recently out of frustration from the lack of quality applicants - I can re-post again.

UPDATE: Position has been re-posted: [http://www.netizencorp.com/careers](http://www.netizencorp.com/careers)

<comment><USER9> > _Entry Level_

> _4-5 years of web development experience_

C'mon, man.

<comment><USER10> A common problem with PHP jobs is Entry Level salary for devs with 4-5 years of web development experience. That could be keeping the qualified candidates away.

</comment></comment></comment><comment><USER11> Jobmote has a curated selection of PHP jobs published elsewhere: [http://jobmote.com/tag/php](http://jobmote.com/tag/php)

</comment><comment><USER12> Shoot me an email - I have a long-term client I need to hand over. Email in profile.

Also - in general I've found craigslist to return the best leads. Typically takes at least one meeting in person though.

You can also work through recruiting firms - they often get temp jobs they're happy to intro you too. If you do good on your first job, they'll keep sending you to more.

</comment><comment><USER13> Elance and Odesk is where I started w/same stack. Strive for 5.0/5.0 reviews and leverage those into more expensive work.

</comment><comment><USER14> I've had some success through [https://gun.io/](https://gun.io/).

You can also score some projects on elance, but most of the time I would get good projects from networking. If you can build out MVPs, try going to different tech meetups and see if people are in need of some dev work.

<comment><AUTHOR> I can't ever seem to get replies on gun.io. Not sure what they are looking for but it was frustrating experience

</comment></comment><comment><USER15> In Sacramento, I've had success landing long-term PHP contract gigs by placing on Craigslist a well-designed Markdown resume rendered to HTML, with links in the top section to other formats (PDF, Markdown source, lowest common denominator plaintext) along with links to my GitHub page and my oDesk profile.

</comment><comment><USER16> Have you looked at LanceList.com? They list all the useful, curated freelance services. [http://www.lancelist.com/#curated](http://www.lancelist.com/#curated)

YunoJuno Toptal Matchist Gun.io OnSite Crew WorkMob 10x Management

</comment><comment><USER17> With those skillsets you'd make for a ninja-like WordPress developer. I could give you work all the time especially with low-level knowledge as well as being able to work with front end designers.

<comment><AUTHOR> Couldn't find an email address in your profile. I left my portfolio website and at the bottom there is my email address.

[http://appsonify.com](http://appsonify.com)

</comment></comment><comment><USER18> Jobmote.com

Stackoverflow remote jobs

Angelist remote jobs

weworkremotely.com

authenticjobs.com

</comment><comment><USER19> try freelancer.com there are millions of php projects, sometimes they hire for the long term projects, and there is more like freelancer.com like odesk.com elance.com etc...

</comment><comment><USER20> phpclasses.org/jobs

weworkremotely.com

twitter

</comment><comment><USER21> [https://www.wfh.io](https://www.wfh.io)</comment>


Show HN: Anythings – Get Your Smart Things To Work Together - <AUTHOR> https://anythings.co <comment><AUTHOR> The fragmentation of platforms has been one of the major headache in the consumer IoT landscape. I am happy to propose a solution to it with this website.

Anythings.co is a place for IoT Lovers to find the best new smart devices and their compatibilities.

You can list your smart things on the website, see how they work together and find new compatible devices. For example, you would see that you can control the temperature with your voice using your Nest Thermostat with your Amazon Echo through IFTTT.

I would love to have your thoughts on the website. I am happy to answer any questions you have.

Quentin</comment>


Faroo: Peer-To-Peer Web Search - <AUTHOR> http://www.faroo.com/hp/p2p/p2p.html <comment><USER2> At first I thought, awesome, finally an open distributed search engine.

...Oh wait, you want me to install your closed source code on my computers, to give you all my personal data and CPU cycles for you to own and use as you like. (Which you "promise" won't be exploited or abused).

Make no mistake, this is a voluntary botnet for a single party to use to build a company on. This voluntary botnet will provide search engine services from a central point so they can keep the majority of profits without the overhead of paying for resources like every other for-profit company.

This is not Peer-2-Peer it is Peer-2-Company. Also they are late to the party on this approach, Microsoft already tried this with Bing: [https://googleblog.blogspot.com/2011/02/microsofts-bing- uses...](https://googleblog.blogspot.com/2011/02/microsofts-bing-uses-google- search.html)

This model is just begging for people to troll them by releasing tools to poison their database with nonsense data.

They should build a -real- open p2p distributed system (the blockchain is not perfect but a good example). Short of that if they want to be a for-profit centralized search engine, fine. They should go buy some servers and databases they can directly control. and try to be a closed source competitor to duckduckgo.

<comment><USER3> > They should build a -real- open p2p distributed system

what's stopping you?

<comment><USER4> I'm not the individual you're responding to, but probably a mix of time, money, and interest. You don't need to make a better version of something for your criticism to be valid.

</comment></comment></comment><comment><USER5> So would it be fair to say that effectively Faroo works by:

1\. Scanning your browser cache for the sites you visit.

2\. Setting a ranking to the sites in your browser cache, based on how frequently you visit the site.

3\. Merging this site + ranking information with other Faroo users in a search index.

4\. Distributing the search index in a distributed way, perhaps all nodes only having a fraction of the total index to prevent storage issues.

If that's a simplified version of what is happening then I could see it working. If I've misunderstood something let me know.

<comment><USER6> That's pretty accurate and quite scary, mostly because it will start pulling off bio's from PornHub now instead of Wikipedia and that can never end well.

</comment></comment><comment><USER7> It appears they are relying on a combination of not documenting their ranking algorithm and updating it periodically to prevent spammers from flooding the system with bogus "attention" signals. I'll leave determining the likelihood of this approach being successful as an exercise for the reader.

<comment><USER8> So... security through obscurity?

</comment></comment><comment><USER9> I found this a little problematic:

 _FAROO indexes only pages which are located in the Internet, but no Intranet pages or HTTPS protected pages_

If it simply can't see HTTPS pages, it'll leave a large chunk of the internet invisible to the search engine. I understand the reason for this, but it's a technical limitation they'll have to find a way past to make it useful as more and more sites encrypt by default.

<comment><USER6> It indexes pages you visit, it does some MITM/Browser snooping but at least it's not intrusive enough to do SSL stripping.

</comment></comment><comment><USER10> Sorry but where can I try FAROO without downloading an app or connecting to an API?

<comment><USER11> [http://www.faroo.com/](http://www.faroo.com/)

<comment><USER12> Query: _sed split file by pattern_

Result: _No results were found._

<comment><USER13> _python string_ also has 0 results. It doesn't seem like this is quite ready yet.

The website also added a new page to my browser history for every character that I typed in the search box, which is kind of a pain (also, it's slightly amusing that it added so much to my browser history when the search engine presumably gives weight to websites that occur frequently in its users' browser history).

</comment></comment></comment></comment><comment><USER14> Something similar was posted to HN a while ago[0]. However, it was made specifically for indexing scientific papers without keeping all the content. Totally open source and runs in the browser. I feel like a more generic implementation could be done well, but hasn't been so far.

[0]: [http://juretriglav.si/an-open-distributed-search-engine- for-...](http://juretriglav.si/an-open-distributed-search-engine-for-science/)

</comment><comment><USER15> Sadly, by its very nature, it misses a lot of the "long tail" of rarely- visited sites that Google et. al. can crawl.

</comment><comment><USER16> We tried using various for an all we developed and its results were fairly poor, so we had to switch to bing.

</comment><comment><USER17> Gene Kan ([https://en.wikipedia.org/wiki/Gene_Kan](https://en.wikipedia.org/wiki/Gene_Kan)) also had the same idea, until he shot himself while working on a distrubted peer to peer real time search engine in front of his computer I think.

I heard about him when I watched a documentary about Napster.

No documentary about Gene Kan exists. He is virtually unknown but his work was an important contribution.</comment>


GLASS/Seaside Success Story - <AUTHOR> http://andreas.mindclue.ch/blog/seaside+project+live

<comment><USER2> When I used Seaside about two years ago I was fantastically productive with it. It abstracted away HTTP more than the current popular toolkits like Django and RoR by using continuations. It was also awesome to edit things live without having to recompile anything.

However... when I needed to debug something remote on a running server it was a nightmare. Because everything is based around the Squeak environment it was impossible to SSH in and poke around. The box I was on didn't have a GUI setup so I couldn't use something like VNC (better box would have helped, but still...)

So I found Seaside to be pretty awesome, except the difficult in working with a running server and the lack of docs killed it for me.

<comment><USER3> If you run Seaside in a VisualWorks server, you can load the old DST packages and do remote debugging with the GUI debugger.

If your code isn't compatible with that library (it is kind of old), then you can run your server under VNC. This gives you a nice "pseudo-headless" mode but still allows you to debug and tweak with the full development environment.</comment></comment>


Twitter and One Time Pad Encrypted Messages - <AUTHOR> https://twitter.com/otp9 <comment><USER2> Interesting. Can't tell form that page what exactly is going on, but it reminds me of something I did with del.icio.us some years ago with a project called De.linque.nt

[http://www.artima.com/forums/flat.jsp?forum=123&thread=1...](http://www.artima.com/forums/flat.jsp?forum=123&thread=115451)

<comment><USER3> How could you even suggest that rot13 is similar to one time pad encryption? They could not be more different. One is kindergarten crypto, while the other is mathematically proven to be unbreakable.

<comment><USER2> _How could you even suggest that rot13 is similar to one time pad encryption?_

That's a really good question, and I'm glad I never did it. My code used rot13 for demo purposes (as explained in my post); actual usage involved a proper crypto JS lib (as explained in my post).

Some assembly required, though. I left it up to users to decide what crypto lib they wanted to use.</comment></comment></comment>


Ask HN: Do people read tech how-tos blog in 2020 - <AUTHOR> With YouTube becoming the next big thing and there's ton of content to learn about. I just want to know if people still read tech blogs? <comment><USER2> Reading is faster than video watching, at least for me, so yes!

Some things are better explained visually though, for example when I started learning flash in highschool I watched video tutorials because I needed to learn the UI, and learn how to do visual stuff. Also when I started learning java in uni I watched one of those java in 1 hour on YouTube because I needed to see with my eyes how a "real" programmer codes, what tools they use, how things should be layer out, where the buttons are, and things like this. But after that I stopped and used written text exclusively, first giant books, then blogs and stack overflow of precise problems.

I don't necessarily intend to go to how-to blogs, it's just that they are the ones that pop up when I search things. Even started my own with things that I don't want to forget.

<comment><AUTHOR> Awesome. Also, I am learning vue and react js. Earlier I was reading official documentation that ends up on I couldn't understand a single thing. But then I switched to YouTube things were far better clear.</comment></comment>


Twitter wants feedback on its proposed deepfakes policy - <AUTHOR> https://arstechnica.com/tech-policy/2019/11/twitter-wants-your-feedback-on-its-proposed-deepfakes-policy/ <comment><USER2> The moral panic around deepfakes is hilarious to me.

Especially on a platform like Twitter where a tweet of a screenshot of a headline with no source (that possible has no source) will have thousands of upvotes and angry responses which is much more alarming and something that already exists today.

For example, every once in a while on r/PoliticalHumor you'll see a screenshot of a tweet that Trump didn't even write, yet everyone responding will take it at face value. Deepfakes are a red herring and a distraction from a ubiquitous phenomenon we might never solve.

Requiring deepfakes to have a disclaimer to me is like training people that it's safe to insert their credit card info on a website as long as they see the https lock icon in the navbar. Instead, people should be trained to be eternally vigilant and to be skeptical even if there is no "this is fake" disclaimer.

We're long past screwed.

<comment><USER3> Agreed. In general, it feels like modern America lacks critical thinking skills when it comes to discerning obviously fake information from real.

<comment><USER4> nothing to do with America, it is worldwide and thousands years long.

</comment></comment></comment><comment><USER5> > The issue of what to do about them hit the spotlight in May when a video of > House Speaker Nancy Pelosi (D-Calif.) that was heavily modified

From what I recall, one video was slightly slowed down, the other was just a montage of various clips joined together. I am not sure either constitutes serious modification or doctoring.

<comment><USER6> Yeah, calling that video a "deepfake" sounds like someone has no idea what they are talking about.

</comment></comment><comment><USER7> On the subject of the dangers of deepfakes, the most recent episode of The Blacklist addressed deepfakes in a storyline I found quite interesting.

Basically (spoilers ahead), this researcher creates a sentient AI and the AI promptly decides that sentient AI is a danger to humanity and tries to kill a few of the top AI researchers. Ok, kinda unrealistic.

The more realistic part? To get one of the AI researchers killed, a deepfake video is created of that researcher saying something along the lines of "over the years at X corp I've seen the worst of humanity, too much evil, it's time to end it all" accompanied by him strapping on a bomb vest. The video is released and everyone freaks out. He doesn't notice, goes to work, gets surrounded by cops while holding a small black device (his phone), and the police shoot and kill him thinking it's a detonator.

I'd always considered deepfakes in the context of making false political statements which could eventually be disproved. Worst case, a bunch of people think the wrong thing for a while. This use case of forcing rapid response without time for validation or refutal is quite a bit scarier and one I personally hadn't considered before.

<comment><USER8> >To get one of the AI researchers killed, a deepfake video is created of that researcher saying something along the lines of "over the years at X corp I've seen the worst of humanity, too much evil, it's time to end it all" accompanied by him strapping on a bomb vest. The video is released and everyone freaks out. He doesn't notice, goes to work, gets surrounded by cops while holding a small black device (his phone), and the police shoot and kill him thinking it's a detonator.

To be fair, I can imagine this happening in the US without a deepfake video. Just look at all the instances where the cops are called because of a "suspicious person" and end up shooting an unarmed civilian. Random example: [https://en.wikipedia.org/wiki/Shooting_of_Charles_Kinsey](https://en.wikipedia.org/wiki/Shooting_of_Charles_Kinsey)

</comment></comment><comment><USER9> By attempting to police this aren't they lending credence to the instances that they failed to detect? "See it's [not marked as fake/it's on twitter]! It must be real."

Seems better that we all just adjust to the fact that we can't trust what we see (we never could anyway).

<comment><USER10> That's well and true for people at HN, but I fully believe that the general public needs a lot more help.

</comment></comment><comment><AUTHOR> I like the idea of not necessarily removing content just because an algorithm or group of people say it's a deepfake. Apply a label and let people make up their own minds.

Of course if there's no transparency to the process or a known way to contest being classified as a deepfake, this could lead to other problems. And is a work of performance art -- an actor who can do a spot-on impression of someone -- a deepfake if meant as art?

</comment><comment><USER11> I worry that the moderation of deep fakes will only lead to deeper and deeper fakes, until no content on the internet can be trusted, and nothing left believable.

<comment><USER12> > until no content on the internet can be trusted, and nothing left > believable.

You seem to be under the impression that this is not already the case. Why is that?

<comment><USER13> > Why is that [not already the case]?

Because the internet/web was created by technical and mathematical oriented people - programmers, electrical engineers, researchers - who are typically much less committed to systemic deceit than marketers and propagandists. Consequently, much of the initial content was posted out of a genuine desire to inform rather than deceive people.

<comment><USER14> But the Internet was created literally _decades_ ago.

By now the marketers and propagandists have long taken over, social media was just one out of their many trojan horses.

"Content" has merely become an excuse to drive ad revenue and interactions up, lure users into signing up accounts, to harvest as much data about them as possible.

<comment><USER13> They said _no_ content and _nothing_ \- there's still stuff (and people) left over from the early days. If the internet had been designed by marketers and propagandists from the get-go, that would not be the case, so I think "because marketers and propagandists were not originally involved (and originally is suffiently recently)" is a valid answer to "Why is the internet not (yet) devoid of anything trustworthy or believable?".

<comment><USER14> _> there's still stuff (and people) left over from the early days_

Very little stuff and only a very few people, they've also been busy warning about this whole situation, even offering solutions [0] that sound rather fantastical in their probability of being realizable.

So while you are technically correct; There's still a little tiny bit of trustworthy content left on the www, it doesn't make really that much of a difference when 70%+ of the webs traffic is systematically routed past that to game the attention economy and facilitate mass-scale data collection.

[0] [https://www.theguardian.com/technology/2017/mar/11/tim- berne...](https://www.theguardian.com/technology/2017/mar/11/tim-berners-lee- web-inventor-save-internet)

</comment></comment></comment></comment></comment></comment><comment><USER15> Two things:

They must fully specify how they categorize content as misleading.

Deceit predates computers. Lies of omission and half-truths, misleading presentation of statistics (e.g. the ubiquitous pie chart of US federal spending that only shows discretionary spending). If they're setting themselves up as guardians, they should cover non-digital methods as well as deepfakes.

</comment><comment><USER16> From the survey:

> Misleading altered media does NOT include photos and videos that are edited > to remove blemishes or physical imperfections.

<comment><USER17> Yep. People use filters and image retouching a lot.

If Twitter wants users to pay attention to items of content which are particularly misleading, they need to avoid alert fatigue - i.e. these notices need to be rare and reliable.

<comment><USER17> NB: The only long-term solution to this conundrum that I can see is that people become genuinely confident and comfortable sharing who they are without self-editing and self-censoring, and that we collectively appreciate and understand that.

Until then -- and especially in the presence of rewards for narcissism (iPhones, Instagram, venues designed solely for vanity) -- filtering and editing your own self-image is at least understandable, and at worst rational or beneficial.

That leads to issues determining (and putting into writing) the difference between malign manipulation / generation of truth and the behaviour of a reasonable person.

</comment></comment></comment><comment><USER18> What if the tweets themselves are synthetic? Would those be deleted or is that already covered somewhere?

</comment><comment><USER19> I'd imagine if any video of that guy who didn't kill himself's alleged clients leaked somehow, anyone powerful who might be identified in a video would claim it was a deepfake.

</comment><comment><USER20> I run a network of social sites and we've had this functionality for a couple of years, and the thing is people - especially Americans - just don't care.

They _love_ being outraged, even when what they post is clearly labelled as fake they ignore it, and people commenting ignore it.

From the site perspective there's not much more we can do without driving people away, if you try to police content too much people will just go to another site.

But it does get pretty frustrating.

<comment><USER21> > They love being outraged

I find this too, and I'm fascinated with this aspect of our new online world. I wonder why and how. I'm guessing outrage is a way of feeling superior to other people, "How can they be so stupid, I'm so happy I'm smarter than them and know the truth!" (Trying to think if this would apply to online public shamers, I guess so.).

I'm guessing the loneliness, insecurities and FOMO created by online social networks has lead to this. Although it was TV before that, there are reports of how Bhutan's society suffering negative things after the introduction of TV in 1999 (e.g. [http://news.bbc.co.uk/2/hi/entertainment/3812275.stm](http://news.bbc.co.uk/2/hi/entertainment/3812275.stm) )

</comment></comment><comment><USER22> Maybe it's even more dangerous that a photo or a video can no longer be used as a proof in court. Deepfake technology gives plausible deniability.

</comment><comment><USER23> I think deepfakes will force us to think deeper into words and meanings, not just familiar faces. It's an inevitable invention.

</comment><comment><USER24> The thing I find most worrying about Deepfakes is the moral panic aspect. Although flagging them as shopped and why they think that would be unobjectionable and respectful "good citizenship".

Even the false positives would be good for both laughs and insights if say an art musuem exhibit which screws with perspective or scale results in being flagged as fake.

<comment><USER25> There's more to worry about screenshots of modifying a bit dom and spreading 'deepakery' like that, but then again no one cares anyway. Worrying snout deepfakes is truly a pseudo problem.

</comment></comment><comment><USER26> Every meme photoshop now needs a label?

<comment><USER27> From the original twitter blogpost:

> we propose defining synthetic and manipulated media as any photo, audio, or > video that has been significantly altered or fabricated in a way that > intends to mislead people or changes its original meaning.

'meme' is pretty broad so if it's literally just a screenshot of a faked tweet then Yes it would fall under this rule based on the broad language they are using. BUT I think that's still a good thing as long has the label/warning is unobtrusive yet at the same time it needs to not be used on every meme/image since then it would loose it's effect.

I'm very curious how they are going to differentiate between normal image mashups (memes, etc.) and false information alterations at least without human oversight.

The blog post has a survey for feedback so I encourage everyone to leave some since this most likely impacts everyone at least indirectly.

<comment><USER28> What if it's a photo of a montage of collage or authentic images?

It's artistic manipulation but it's not fakery.

Maybe they'll have s table with the hash of all verified images and anything not in there gets auto tagged as unverified/fake.

I think it's s losing proposition, but let's see what comes of it. Of course the downside is this benefits incumbents and harms challengers.</comment></comment></comment>


Adobe: Same code on five screens - <AUTHOR> http://www.androidcentral.com/adobe-same-code-five-screens

<comment><USER2> Well, honestly, if it's the same "works" as AIR for Linux in its current state, then it might be nice demo, nice screen to watch, but that's all. You can try, for example, StatusNet Desktop application (from identi.ca), and it feels like a crap. It's painful to install, not only you need AIR runtime (that's quite understandable), but there's an installator (like with Windows apps) that puts something (actually a lot of something) somewhere to /opt, and then, the application feels very alien, doesn't work well, lock itself all the time, and it isn't even "pretty". After seeing few of them, I can say that at least on Linux, AIR applications are nowhere close to the native applications (or possibly even web ones inside the browser!) in almost any aspect. I wouldn't recommend any of them, neither the environment itself (though better written apps could make some difference).

<comment><USER3> groovesharks desktop version runs nicely though

</comment></comment><comment><USER4> Too much of this and we will see apps that are based on the lowest common denominator of all platforms. Developers will get lazy and you will get iOS apps that don't do anything when you rotate the screen, have tiny icons/graphics. Desktop apps with no keyboard shortcuts (wait...isn't that Adobe Air already?), menus, hover events, the list goes on.

A neat tech demo, but in reality hardly anything developed in this manner is going to be able to compete with anything native on the platform, and the resulting time saved will be revenue wasted.

<comment><USER5> Those who forget history are doomed to repeat it. AWT, anyone?

</comment></comment><comment><USER6> Lots of people unimpressed here for some reason. I bet if this was an HTML 5 demo we'd all be falling all over ourselves to talk about how awesome it is, and we'd see some copies by the end of next week.

But because it's using flash...

I find this attitude kind of sad, this guy is demonstrating something that is the holy grail of cross platform development.

<comment><USER7> But why do you think the anti-flash sentiment exists in the first place?

When I bought my HTC Sense based phone, Flash was forced on me. I'd be generous to say I can play half the flash based videos I meet on the web. When I do manage to play something my phone heats up to a few degrees cooler than the sun and my battery drains at a rate of knots.

My desktop is a 64-bit, quad-core monster running Linux. Can I play full screen Flash videos? No. Throw a HD video at mplayer and it's runs as smoothly as silk and creates hardly a bump on my processor graph.

Holy grail of cross platform development? You must be kidding.

<comment><USER6> I wasn't aware that he was demonstrating a video in an flv wrapper. He was demonstrating an interactive app running on 6 different platforms running on a very wide variety of form factors.

I also can't play blue ray rips on my phone. Does that mean video isn't cross platform?

Thank you for exactly demonstrating my point above.

I _really_ don't understand why everytime somebody brings up flash the response is "well video in flash sucks!"

So what?

<comment><USER7> Well, I suppose my point is that Flash doesn't perform and so this video isn't in the slightest bit exciting.

Asking why people always bring up Flash video in these debates is like a robber asking why the breaking and entering has to be mentioned in his court case.

<comment><USER6> > Well, I suppose my point is that Flash doesn't perform...

I think my counter question is then "doesn't perform compared to what?"

Compared to a natively compiled piece of software written in C or ASM? Yeah, it doesn't perform well at all.

Compared to Java? I'd say modern Java runtimes are faster in general.

Compared to Javascript? I'd like to see some benchmarks with modern runtimes like v8, but I'd wager that Flash (Actionscript) performs better.

Here's a rather old comparison benchmark. <http://oddhammer.com/actionscriptperformance/set4/>

According to this, ActionScript 3 and Flash Player 9 were approaching Java Applet speed in many of the tests.

Here's a newer one <http://jacksondunstan.com/articles/232>

In this test, Safari, FF 3.5.2 and AS3 all have about the same runtime. Every other browser tested run 2-9x slower.

And another followup <http://jacksondunstan.com/articles/534> The results are about the same.

Here's a very recent one (March 2010) with similar results. <http://www.themaninblue.com/writing/perspective/2010/03/22/>

Flash performs about as well as the very best Javascript implementations out there, and far _far_ better than most implementations of Javascript that live in the browsers that are actually being used in the world.

I understand your point, Adobe has provided some rather abysmal ports of Flash to platforms other than Windows. But on the platforms it has been ported to (no matter how flawed) it runs about as well as the best available implementation of Javascript on that platform.

As for video, Adobe, for some reason isn't offloading video decoding to your GPU. That could be problem of your platform, or a problem of Adobe. But just the same Javascript isn't rendering the video on your Linux box when you watch a video...you certainly wouldn't want that. Talk about bad performance!

But we aren't talking about video when we talk about HTML5 and Flash. Video is a separate and distinct problem. Flash didn't even support video until quite late in it's life cycle, it's an "oh yeah let's toss this in too" feature. We're talking about making interactive applications in those respective environments. And we're talking about those applications being cross platforms, running on multiple systems, on multiple platforms, in multiple form factors.

And for that, _right now_ flash is the better platform, it performs about as well in raw computation as the very best Javascript engines, has a better development environment, _is currently_ more cross platform than a similarly complex Javascript HTML 5 app, and is generally a more mature technology.

I can't even get a complex HTML 5 app to run the same on 3 different browsers on the same machine! Imagine targeting every major browser that run under Windows, OSX, Linux, iPhones, the iPad and Android devices with HTML5 technologies! It's simply not there _yet_.

</comment></comment></comment></comment></comment><comment><USER8> Gosh, I can feel my perfectionist side in big pain right now.

Adobe could have tried to pull a more subtle way than: "Welcome to lazy town!". So much for all those thinking the UI is important, and that maintaining the look-and-feel of the OS should be very important. :(

I find Adobe's strategy a bit naive (or more accurately only looking at the short-term). If you become the paladin of the lazy developers, you will get plenty of money at first, but you'll get plenty of bad reputation, and that can be really hard to get rid off (just as Microsoft).

<comment><USER6> > and that maintaining the look-and-feel of the OS should be very important.

I don't think maintaining the look-and-feel of the OS is very important. In fact I would go so far as to say that attempting to shoe horn novel interface requirements into local OS look-and-feel requirements is a detriment to interfaces.

A bad interface is a bad interface no matter what. Same goes for a good interface.

But I think that if you look around at most of the most successful pieces of software across all platforms (by pure volume), very few of them look anything like the prevailing look-and-feel guidelines for their host platform -- I'm talking about Office, Photoshop, Firefox, Chrome, iTunes, GarageBand, iLife...

iWork at least looks like a piece of software that conforms to the look-and- feel rules.

But then we get something like Aperture 3 which could be something running on just about any platform.

Most of the top iPhone apps could be running on anything with a big touch screen (and some of them are almost pixel identical across platforms): Pandora, Remote, Yelp, New York Times, Jott, Netflix, Shazam, etc.

People care about app consistency across platforms not local consistency with the OS.

Web apps blow the idea of local OS consistency out of the water. I won't even list million user web apps because we all know what those look like, and they pretty much look the same no matter the platform. Sites that try to "look like" some OS, end up looking rather silly to be perfectly honest.

No, maintaining the look-and-feel of the OS is not anywhere near the top of pretty much anybody's priority list these days.

<comment><USER8> I understand your point, but I think it's an exaggerate view. I am happy to admit that if there's a good reason a rule should be broken, then it's ok too: but you need to know what to do. Like all rules, once you understand them and know what you are doing, then it may make sense to break them.

But imagine a user that faces an interface that looks familiar but it's all different. Maybe the most external button in the title bar expand it. Or something that looks like a button has to be double clicked instead of clicked once. The point of having a consistent UI for the whole OS is that the user doesn't need to relearn a new interface for each product.

That said there are cases where the current UI is not good enough, maybe because the developer has a new, never done before idea. Then it's ok. Apple does it, for example, as do other mac developers.

The other exception is when it's a very specialised piece of software that is not for the masses but for a very specialised niche. I consider CAD applications, Photoshop and Aperture are like that. It's not _as_ useful to use the same look because they are software that has to be learnt anyway.

However... Firefox and Chrome do try as hard as possible to conform to the UI interface so I don't follow your examples there. And iTunes is loath by everyone as a awful piece of UI, so I wouldn't use it as an example either.

Similarly many people (at least on the Mac) hate the completely alien look Photoshop has, or Office. Microsoft did put a lot of effort with OS X to follow OS X conventions, and despite Photoshop not being a mass market product, Adobe has preferred to have a uniform cross-platform interface, and there's a lot of complaints for that.

So yes, if you have a novel interface requirement then you are more than welcome to break the OS standards. But otherwise if there's no need (from a user perspective) I don't think it's a good idea.

<comment><USER6> > Like all rules, once you understand them and know what you are doing, then > it may make sense to break them.

I actually agree with this whole heartedly. I think we're on the same wavelength here. Just like all good literature violates supposed rules of good form for the language.

But I think that following OS conventions is the wrong set of rules to learn and target. There are already good interface guidelines. It just so happens that some OSs (OSX) do a particularly good job at following _those_ guidelines.

It reminds me of this <http://catb.org/esr/writings/cups-horror.html>

_The meta-problem here is that the configuration wizard does all the approved rituals (GUI with standardized clicky buttons, help popping up in a browser, etc. etc.) but doesn't have the central attribute these are supposed to achieve: discoverability. That is, the quality that every point in the interface has prompts and actions attached to it from which you can learn what to do next. Does your project have this quality?_

A good interface can look like anything so long as it follows good GUI conventions. And fortunately most OSs follow pretty good GUI conventions so targeting the conventions of that platform _are_ in a way following good GUI conventions transitively. I just wouldn't limit myself as to say that the measure of important should be following OS conventions when it should really be following interface conventions. The CUPS story I linked to brings that problem directly to the forefront. They're already doing the appropriate interface rituals with respect to their OS. The problem is that they are not doing the appropriate rituals with respect to good interface design.

(I also agree that some tools, like Photoshop, have absymal user interfaces. But I think it's because they don't follow good interface conventions in general, not because it doesn't look like an OSX app or a Windows app [http://mrgan.tumblr.com/post/235455865/the-many-sliders- of-p...](http://mrgan.tumblr.com/post/235455865/the-many-sliders-of-photoshop- cs4)).

</comment></comment></comment></comment><comment><USER9> Sort of a neat tech demo, but two main issues with it:

1) In the real world, you're essentially never going to have a desktop app with the same artwork/assets as a mobile app. You're going to have a high res version for the desktop (designed with mouse and keyboard controls in mind) and a lower res version for mobile (designed with touch screen controls in mind).

2) Reversi is an incredibly oversimplified example.

Still, a neat tech demo.

<comment><USER10> Re: assets, you might not actually if all the assets are vector. It's not that uncommon in Flash, since originally it was just a vector animation tool.

<comment><USER11> I know a few people doing Flash on embedded devices. They tend to steer away from vector graphics and lean toward bitmaps because there's a performance hit.

<comment><USER12> Vectors can be drawn on start-up then cached as bitmaps.

[http://www.adobe.com/livedocs/flash/9.0/ActionScriptLangRefV...](http://www.adobe.com/livedocs/flash/9.0/ActionScriptLangRefV3/flash/display/DisplayObject.html#cacheAsBitmap)

</comment></comment></comment></comment><comment><USER13> That is actually pretty cool, and impressive that it's the exact same code.

Near the end of the video he says "There's no other technology available that lets you do this.". I'm not sure how accurate that is. I see no reason why this game couldn't have been made in html/javascript to run on all of those platforms from one codebase.

Could you do it with Mono too?

<comment><USER14> Or QT...

<comment><USER15> Or Java (I know Java's getting a bad rap these days, but for non JNI code, Java hasn't been half bad at developing code for multiple operating systems --- admittedly, Java doesn't go as far as the iPhone :/ and the jdk isn't exactly the same for Android)

edit: s/interfaces/operating systems. I don't know why I said the former...

</comment></comment></comment><comment><USER11> Countdown to HTML/JS reversi on 5 screens in 3... 2...

Update: its already done (works for me on Chrome, ipad and iphone at least). <http://davidbau.com/reversi/>

</comment><comment><USER16> Wonder whether there is any code of the kind "if (platform1) doA() else if (platform2) doB() ..." in there.

</comment><comment><USER17> It would be better if rotating the screen adjusted everything except the orientation of the board, so you could turn the screen around to look at the board from another angle.

</comment><comment><USER18> Hold on, didn't Jobs make all write native apps? How did this ever run on an iPhone or iPad?

</comment><comment><USER19> "and the look and feel is the same across all platforms"

This is why you fail.</comment>