Easier browsing of Hacker News...for me - <AUTHOR>

http://nirmalpatel.com/#hnsplitview
HN SplitView is a bookmarklet that adds a link labelled "SPLIT VIEW" to each post on the Hacker News website. This link allows the user to open the post and the discussion page side by side in frames. Simply drag the link for HN SplitView to your toolbar or add it as a favorite.
I've been using this and it makes it easier for me to browse. I hope that other members of the HN community find it useful. I've tested it under Safari and FF. Let me know if you guys have any problems.
EDIT: It doesn't add the link for posts like this one or those of the "Ask HN:" variety. <comment><USER2> So I went to add this splitview thing to my Greasemonkey script for Hacker News, only I did the same thing without hitting your site for the frameset (completely clientside js). It works quite nicely, but for some reason I had to resort to something I consider quite ugly.

Can someone please look at the code below (and read my comments in it) and tell me why the three addEventListeners that I have commented out won't work? I'd really really like to know why I am being retarded and how to fix it, as the solution I ended up with seems unnecessarily ugly.

View code here: <http://userscripts.org/scripts/review/25039>

Or if you don't care about it being ugly and just want to use it: <http://userscripts.org/scripts/show/25039>

But I'd really appreciate help with figuring out the issue with the addEventListeners.

<comment><USER3> Disclaimer: I've never used Greasemonkey (now an Opera user) and have only spent a few minutes trying to figure out how it interfaces with the browser. I know my way around JS though.

That said, after doing some testing I think your issue is that the page isn't completely loaded before the addEventListener is called. Changing the addEventListener line to a simple element.onclick = function(alert) triggers an error in the browser; so does trying to ask about the element's onclick function. Putting in an alert box in place of the addEventListener line pretty clearly demonstrates that the page is still loading when the code is being called on the links. Firefox is a little touchy about that.

I'm still working on it, lemme see what happens if I wrap up your script's initialization section into a document.onload, or something similar.

Edit: Also, elements are being returned as XPCNativeWrapper objects [<http://developer.mozilla.org/en/docs/XPCNativeWrapper>]. I'm totally unfamiliar with those; maybe that's interfering with the event attachment somehow?

Edit: Yeah, looks like it. I wasn't sure, so I had to test, but references to elements from directly inside the code body get the XPCNativeWrapper objects, which provide protection for some properties. But, code called from a setTimeout doesn't get those objects, and gets direct access to the elements. Not sure how to fix that right since I've never encountered that before.

<comment><USER2> Yeah I learned about the XPCNativeWrapper objects last night too. Basically GM has access to every object (from window/document on down) as one of these for security purposes (so the target page can't redefine standard methods). Due to the vagaries of the way they are implemented, you can't call the onclick/onkeypress/etc methods directly. It actually states in the documentation that addEventListener is the preferred (and only working) method.

You can supposedly get access to the underlying JS object from the XPCNativeWrapper object with the wrappedJSObject property and then act on it, but it's a big security no-no. I tried it anyway to no avail.

Your thought on the page not being loaded is kind of where I ended up too. However, my understanding was that GM ran user scripts _after_ the window.onload finished, but I could be completely wrong here. If I assign all the links id attributes in the GM script and then manually add event listeners in my Firebug console, they work fine. Also, you'll notice that later in my script I add click listeners on other items (buttons and links) that work swimmingly, so it's either entirely arbitrary or I'm missing something _very_ obvious.

Thanks for looking at this, I'll look forward to any other thoughts you have.

EDIT: Looks like I was very wrong about the GM script executing after the window load event. I have been playing with wrapping code in a load event listener and have indeed got it working that way. Thanks for the suggestion! I'll hopefully have something polished and posted soon.

<comment><USER3> Yay! Glad you got it sorted out. I was stumped, and finally ran out of time to keep tinkering with it. Even with the code firing after the page was done loading, I still couldn't get it working right.

| You can supposedly get access to the underlying JS object from the XPCNativeWrapper object with the wrappedJSObject property and then act on it, but it's a big security no-no. I tried it anyway to no avail.

The other wrong way that I found out about was the unsafeWindow object; same kind of deal, gives you direct access to the page.

</comment></comment></comment></comment><comment><AUTHOR> UPDATES: For greasemonkey/kit users. Clicking Split View links in the right frame will now not cause internal splitting.

UPDATES: I can't edit the main post anymore so I thought I would try and summarize the updates here.

Oompa posted a Greasemonkey script here: <http://userscripts.org/scripts/show/28371>

I modified to work on multiple pages under hacker news, you can find it here: <http://userscripts.org/scripts/show/28372>

The bookmarklet still works and is located at the URL in the post.

The bookmarklet will not continue adding SPLIT VIEW links after it has been used once.

</comment><comment><USER4> very nice, and very useful...can you make it a one click thing? right now I have to click on the bookmarklet and then click on split view. If it was just one link that would be awesome. I wonder if this can be tweaked to work from within Google Reader, hmmm..I'll tinker with that a bit.

thanks again!

<comment><USER5> I turned this into a Greasemonkey script for any Firefox users.

<http://userscripts.org/scripts/show/28371>

If the author doesn't like it, PM me, and I'll delete this post and the Userscripts.org post.

<comment><AUTHOR> <http://userscripts.org/scripts/show/28372>

I just modified it so that it would prompt for install when you clicked Install Script. GreaseKit for Safari doesn't have an Install User Script option...work in progress.

<comment><USER5> I don't understand what you changed? Can you please elaborate?

<comment><AUTHOR> I just wrapped your code in a closure so it would run immediately. This makes GreaseKit or Greasemonkey prompt you to install. This way you don't have to go and install it manually.

Thanks for turning me back on to userscripts!

</comment></comment></comment></comment></comment><comment><USER6> This script assumes that I visit news.ycombinator.com to read news. I'd prefer a Firefox extension that compares the addresses of web pages I visit with links in the news.ycombinator.com RSS feed. That way I'd be notified that there's a discussion thread about the page I'm currently viewing.

</comment><comment><USER7> Wah NirmalBhai, wah.

Btw, There s one minor bug. If I click the bookmarklet more than once, it adds "|SPLIT VIEW |" more than once.

| SPLIT VIEW | SPLIT VIEW | SPLIT VIEW | SPLIT VIEW | SPLIT VIEW

<comment><AUTHOR> Fixed.

</comment></comment><comment><USER8> i was thinking about proposing this as a feature. because when dealing with submissions, the constant is that i look at both the article and the comments

</comment><comment><USER9> On Opera, it says "Unsupported browser". Why not?

<comment><AUTHOR> I had modified the bookmarklet to allow opera but it doesn't like the code on my splitting page. I'm not sure why though. It's pretty tame JS. Opera also doesn't show me any errors in the Error Console.

</comment></comment><comment><USER10> This is brilliant.

</comment><comment><USER11> i'm too retarded to install this but not too proud to admit it.. it sounds like it scrolls 2+ windows with one control:

xcroll

</comment><comment><USER12> Simple, but effective. Awesome.

</comment><comment><USER13> wow this is so useful. kudos =]

My first bookmarklet too, really.

</comment><comment><USER14> I love you, nirmal.

</comment><comment><USER15> 10 /10</comment>


Aliens: Colonial Marines AI fixed by a single letter - <AUTHOR> https://www.resetera.com/threads/aliens-colonial-marines-ai-fixed-by-a-single-letter.55247/ <comment><USER2> I know the games industry has a reputation for "crunch time" and that bugs may creep in when the deadlines come, but this seems too sloppy to believe, despite the notoriety of ACM's development under Gearbox's aegis. The game's AI must have been worked on by several dedicated programmers who at some stage signed off on it being functional. When people -- ideally, the QA team, but also the public after the game was rushed to publish -- started complaining en masse about clearly broken AI, did no one on the dev team have a clue that the AI had likely regressed due to a bug, and make an effort to root it out?</comment>


A Super-Material You Can Make in Your Kitchen (Starlite?) - <AUTHOR> https://www.youtube.com/watch?v=aqR4_UoBIzY <comment><AUTHOR> I'd like to have a chemist take on this. Thanks.</comment>


Thinking about a Decentralised Reddit Alternative - <AUTHOR> https://medium.com/@CM30/discussing-a-decentralised-reddit-alternative-e8a845e96fb2 <comment><AUTHOR> Or perhaps more accurately, here are my thoughts on how a forum based, federated Reddit like system could be the future of social media and potentially make centralised sites like Reddit obsolete.

It would be very heavily censorship resistant, give a lot of control to community users rather than venture capitalists and completely kill any 'lock in' effects to name but a few.

</comment><comment><USER2> Aw, hell just bring back CompuServe.

I'm serious. Moderated communities with clear rules (usually "no advertising, no personal attacks") and organized sections.

And sysops could clean up after the community, by putting messages where they belonged and pruning threads.

Damn, I miss it.

<comment><USER3> Usenet newsgroups could be created as _moderated_ groups.

rec.humor.funny was a well-known example.

<comment><USER2> Oh yes, that too!

The key element is moderators who knew what they were doing.

</comment></comment></comment><comment><USER4> This existed 30+ years ago. Ever hear of Usenet? Unfortunately, as the masses invaded the Internet, its popularity waned...

<comment><AUTHOR> Yeah, I remember Usenet. Definitely had a structure similar to this.

But I think the difference is that Usenet required a separate client to access, at least until those online readers like Google Groups came out after it was mostly dead.

Maybe something like this could work better with sites accessed through plain http?

<comment><USER4> Yep, that's true about the separate client. We could keep NNTP behind the scenes (for site-to-site communication / federation...) End users would never have to deal with it.</comment></comment></comment>


21 XMPP use-cases and the best ways to achieve them - <AUTHOR> https://www.erlang-solutions.com/blog/21-xmpp-use-cases-and-the-best-ways-to-achieve-them.html <comment><USER2> Sad, neither MongooseIM, nor ejabberd use proper Erlang/OTP SASL release system, so hot updates can be done with relup ([http://erlang.org/doc/man/relup.html](http://erlang.org/doc/man/relup.html))

Smaller modules can be upgraded from Erlang shell, but it's seems to be impossible to update a server without shutting it down.

<comment><USER3> MongooseIM (and ejabberd) are too big and complex to allow full hot code reloading. Moreover this feature is quite rarely used in any Erlang software.

<comment><USER4> I'm not sure how you've measured how often hot code reloading is used? I use it for almost all of my production pushes.

However, I agree that it's generally hard to use it for third party software; upgrades would either become cumbersome because you have to follow the same piecewise upgrade process the developer followed, or the developer would have to do a lot of extra work to ensure upgrades between releases were solid; the recent addition of atomic loading of multiple modules would probably help.

<comment><USER3> I could point to this: [https://stackoverflow.com/questions/31080970/erlang- hot-code...](https://stackoverflow.com/questions/31080970/erlang-hot-code- loading-not-widely-used)

</comment></comment></comment></comment><comment><USER5> Good introduction to modern XMPP.

Is there a cross platform, desktop client that strives to implement these XEPs? Something like Conversations.im for Android.

<comment><USER6> Gajim [1] implements a lot of modern XEPs (directly or through easy to install plugins), including OMEMO. I don't know how well it works on non Linux systems (they provide Windows binaries at least).

[1] [https://gajim.org/](https://gajim.org/)

<comment><USER5> Yes, feature-wise Gajim is one of the best. Unfortunately the UX is pretty bad :(

<comment><USER3> Indeed Gajim is quite stuck in the past, and I regret to say this as it hurts me, since I used to be a hardcore fan.

Conversations indeed is very decent.

</comment></comment></comment></comment><comment><USER7> I realise this isn't actually relevant to the article content, but it seems weird that the TOC doesn't contain links to the relevant section. I know it's pretty short so I can scroll through it quickly, and numbered so I can even just ctrl+f it, but I don't think I should have to do either of those things.

</comment><comment><USER8> XMPP protocol is so open, that different implementations offer so distinct features, so the lowest common denominator barely includes sending messages to each other.

<comment><USER3> One cannot not say something is "so open that..." ;-)

But indeed, XMPP is open, very open.

And indeed the major clients usually rely on the old era's ways of thinking messaging... They a far from contemporary, not only talking of features, but also the UX (User eXperience) and the general philosophy.

I would recommend the reading of XEP-0387: XMPP Compliance Suites 2017 (and its successors): [https://xmpp.org/extensions/xep-0387.html](https://xmpp.org/extensions/xep-0387.html)

But I insist, this one is quite good, honestly: [https://www.erlang- solutions.com/blog/21-xmpp-use-cases-and-...](https://www.erlang- solutions.com/blog/21-xmpp-use-cases-and-the-best-ways-to-achieve-them.html)</comment></comment>


Ask HN: What you wish you'd known before getting into Rust? - <AUTHOR> <comment><USER2> 1- Why I didn't start sooner? 2- I should have (fully) read the book first: I dismissed it at first thinking "yet another half baked piece of documentation". Not the case at all. It has help me understand why my code doesn't work _and_ why are things done this way, the reasoning behind the decisions and the compiler's rules. 3- I shouldn't have been so eager to integrate external crates into my projects (I mean, during the learning phase); while most of them are good, have nice APIs and `cargo` makes it incredibly ease to use them, they sometimes abstract away concepts that (IMO) I should understand well first, then use the external crate, knowing what it does and more or less how it does it. The evidence for me was that I had to spent some time reading the crate's code just to make my code work. 4- I should have keep going at it (eventually, I did). Speaking from myself, with a background of years using Python/JS, the compiler/borrow checker/lifetimes are important concepts that I just simply fail to understand at first (and I can't yet claim that I understand them now). It actually depressed me a bit for a while. But I kept going until I realized that for some aspects, I still was trying to use Rust like I would use Python. Learning Rust has changed how I think about Python, which I still love, but now I'm aware of _a lot_ that can go wrong now, but I have no control in Python code. Rust made me aware of that because is constantly making you aware of all the possibilities, (this could succeed or not, this could be something or not). Finally understanding why the error and how to make it work was a huge payoff. 5- I should have been more aware of all the methods of the Result/Option enums. Returning these enums everywhere feels like I'm going to have an explosion of boilerplate code, but actually, the `match` syntax is really concise, the `?` operator cuts down a lot, but, their methods provide a lot of useful ways of "chaining" transformations between them that really cuts down on boilerplate and code nesting.

Something I like to do a lot now, is running Clippy in "pedantic" mode to learn more. IMO, the pedantic rules are not there to follow them to the letter, but I do read them in case the might hit to some improvements. Clippy in general is great, and have learn quite a bit about idiomatic Rust thanks to it.

PS: 7- For the Linux folks that have `/tmp/` mounted using `tmpfs` with `noexec`, Cargo (for some reason) likes to put and execute a few build scripts for the crates being installed, and it took me a while to realize why Cargo installs where failing, I simply didn't remenber about my `/tmp` setup, because `ls` still reports that the execute is set for the script. I know have this (Fish) alias to tell Cargo to use a different temp directory: `alias cargo='env TMPDIR=$XDG_RUNTIME_DIR cargo '`.</comment>


Facebook CPO Chris Cox Donates $1M to East Palo Alto Tech Group - <AUTHOR> http://techcrunch.com/2015/03/09/facebook-cpo-chris-cox-donates-locally-with-1m-gift-to-east-palo-altos-live-in-peace/

<comment><USER2> Wow, so are we going to force him to resign as well?</comment>


Quickly add send-feedback for electron apps - <AUTHOR> https://github.com/electron-elements/send-feedback <comment><AUTHOR> The send-feedback electron-element allows you to quickly add send feedback functionality into your electron app. It allows you to set it up in a way you can either send a request to backend with report, or redirect to a site or just send the feedback to a email address.

The UI is fully customize-able although it have a pretty good UI out of the box. It is the first electron-element in the electron-elements github org. We hope to add more electron elements which are web custom elements, if you have one open a issue at [https://github.com/electron-elements/electron- elements](https://github.com/electron-elements/electron-elements) to move it into the org.</comment>


Founders At Work: Uncovering The Truth Behind A Hotmail Founder's Claims - <AUTHOR> http://www.techcrunch.com/2009/02/23/founders-at-work-uncovering-the-truth-behind-a-hotmail-founders-claims <comment><USER2> This is what I was afraid of. Do we really need to see a tacky, funhouse rewrite of every little bit of startup gossip the day after?</comment>


Ask HN: What are the Under the Hood technical changes in Windows 10? - <AUTHOR>

All that I read about Windows 10 is the inclusion of the Start Menu and how Metro apps can run in windowed mode.<p>However, what are the big technical, under the hood changes? Surely there must be some. <comment> T-A I guess the Universal Windows Platform [1] and Continuum [2] are what Microsoft would point to first.

[1] [https://msdn.microsoft.com/library/windows/apps/dn894631.asp...](https://msdn.microsoft.com/library/windows/apps/dn894631.aspx) [2] [http://www.theverge.com/2015/5/6/8560195/microsoft- continuum...](http://www.theverge.com/2015/5/6/8560195/microsoft-continuum- for-phones-windows-10)

</comment><comment><USER2> .NET Native [1] promises to speed up C# code so that it is comparable to C++. Universal applications stand to benefit as the page says, and I assume that traditional .NET desktop apps can take advantage of it as well.

[https://msdn.microsoft.com/en- us/vstudio/dotnetnative.aspx?f...](https://msdn.microsoft.com/en- us/vstudio/dotnetnative.aspx?f=255&MSPPError=-2147217396)

<comment><AUTHOR> .Net Native is a feature of the .net framework and not Windows 10...</comment></comment>


What language is R written in? - <AUTHOR> http://blog.revolutionanalytics.com/2011/08/what-language-is-r-written-in.html

<comment><USER2> The graph plotting lines of code vs. time is interesting. The lines for C and R steadily, almost linearly, grow over time. But the line for Fortran comprises long level periods punctuated by sudden jumps.

I assume that these sudden jumps represent existing Fortran libraries getting attached to the R system, and that organic growth of R is nearly all in R and C.

</comment><comment><USER3> Note that an R line of code can potentially be equivalent to many lines of C code - more frequently than the opposite.

</comment><comment><USER4> C</comment>


When Chinese children forget how to write - <AUTHOR> http://www.bbc.com/news/blogs-china-blog-28599392 <comment><USER2> This will seem like an odd analogy, but for those unfamiliar with kanji to see what's happening here, I might suggest grabbing a pen and trying to draw Mickey Mouse or Bart Simpson, or some other simple iconic figure that's always drawn a certain way. Even though you could recognize it easily, and can recall the general shape and some of the individual features, unless you've practiced it you're not sure how many lines you need or where they connect. And if you just wing it, you'll probably get enough parts right that others can guess what you were drawing, but the result will look way off, even to you.

For me at least, that's approximately what it feels like to be unable to remember how to write a kanji.

<comment><USER3> It is actually a bad analogy, because when you draw Mickey Mouse you're using your right brain. This is also the case for a beginner in kanji, because he'll be considering it as a drawing.

When you really learn the kanji (or Han characters to be more generic, kanji being the Japanese name), you end seeing them with their components, and you'll be using your left brain to write them - just like when writing English.

<comment><USER2> It's the best analogy I can think of, perhaps you have a better one. Note that when I say "draw Mickey Mouse" I mean the rote reproduction of the standard iconic character - not the creative act of drawing an original picture. A well-known corporate logo might be a better example but I couldn't think of any complex enough.

As for left-brain/right-brain, I doubt that's a useful distinction here (if indeed it's useful anywhere). But that aside, I don't think it's correct to suggest that native speakers process Han characters just like English. See for example: [http://brain.oxfordjournals.org/content/123/5/954.full.pdf](http://brain.oxfordjournals.org/content/123/5/954.full.pdf)

</comment></comment></comment><comment><USER4> Language Log has many posts about what they call character amnesia, for example this one:

[http://languagelog.ldc.upenn.edu/nll/?p=5669](http://languagelog.ldc.upenn.edu/nll/?p=5669)

</comment><comment><USER5> Is there any real advantage to having such a complex system rather than (some level of) a phonetic one like most other languages? Obviously there are cultural reasons we would still like to be able to read old text and not lose that, but in general the Chinese system just seems like pain for very little gain...

<comment><USER6> Yes there actually is! English is a language that really favours the writer while Chinese favours the readers. Most of the time, you can read Chinese a lot quicker because the characters are all the same size (although they might have different complexity), and there is generally a lesser need for linking words to ease the awkwardness of sentences, unlike English, because each Chinese character carries more of a "concept"/"theme", where as english words usually have quite precise definitions, and have more specific places where the words would actually make sense.

This is just my opinion as a native Chinese and English speaker, but I'm sure other bilingual English/Chinese speakers would tend to agree.

<comment><USER7> A quick search seems to indicate it's almost a tie, overall. That is, Chinese readers end up reading at about the same speed add English readers. It seems like an unintuitive result though. From my own mild studies of Japanese and the kanji, the few kanji I can read, it feels like the information just jumps right into my mind.

Also apart from the actual reading, which may be a tie, I'm not sure the complexity cost overall, e.g. teaching, fonts, IMEs, etc. are actually worth it. What would a designed writing system look like? I think a properly phonetic/syllable approach like Hangul or even the Kana might be correct.

<comment><USER6> Well another thing with Chinese characters is that they are usually made up of parts, and these parts generally carry a theme. For example, if I have never seen a specific Chinese character, I can usually decipher its definition easier than English words because of the parts the Chinese character consists of. This is similar to roots in English, but these parts are less specific, and are recycled and reused in many more characters.

I agree that Chinese is not the easiest or best language when all practical aspects are considered, and this is one of the reason simplified Chinese was invented, but the social hurdle to completely adopt a different language or change it even more dramatically would be far bigger than the nuisances that the language may have.

<comment><USER7> Really? I've been studying the kanji and well this is true enough to build up a framework to jog memory, it didn't particularly seem enough to have much predictive power. I can say "oh, I can see how those 3 concepts could be related", but only after-the-fact. Maybe it gets better when one knows over a thousand.

</comment></comment></comment></comment></comment><comment><USER8> "...many Chinese people consider the creation of Chinese calligraphy to be one of their primary contributions to civilisation..." \- is this really true?

Anyway there are no reasons to oppose the natural process of more advanced languages displacing the less advanced ones, apart from political (avoiding cultural assimilation).

<comment><USER9> Chinese calligraphy carries far more artistic dimensions compared to non- symbolic languages. My grandmother has accrued such a beautiful Chinese font style over years of practicing calligraphy and being reporter on battlefields. Her ink writings/letters have been passed down to my parents and taken good care of as family treasure brought overseas. Being Chinese British I still occasionally use them as copybook to practice. Even though all everything about her was told as stories, her handwritings, those strokes & circles, speaks a decisive, brave and clever woman.

Each character needs to be written in balance itself. Like architecture all characters itself has a firm pillar stroke and together they also need to fit into structural of the whole paragraph. Positive or negative, aggressive or passive meaning can also be expressed by same strokes but sharp or round in the right place.

</comment></comment><comment><USER10> I'm sorry "English", but the whole idea of "spelling bee" is ridiculous to begin with, and excuse me "China" \- same goes for you, but in writing...

Give me sane language with small alphabet, and whatever you speak is whatever you write (and vice versa).

Just kidding!</comment>


Ask HN: What projects do you recommend to reinforce topics in computer science? - <AUTHOR> I see that the college websites usually have a lot of starter code for people to get started on projects. Some are accessible, most are not.
In lieu of that, for self learners, what projects would you recommend that self learners implement to reinforce / cement what they have learnt when they learn computer science?
For example, UCB 61c has a project to implement Neural Networks in RISC-V - https://inst.eecs.berkeley.edu/~cs61c/fa19//projects/proj2/
Subjects I'm looking for include (but not limited to)
* Algorithms / Data Structures
* Computer Organization / Architecture
* Computer Networks
* Operating Systems
* Databases
* Compiler Design
* Distributed Systems
These can be projects which can have multiple topics involved from a particular subject, or projects involving topics taken from different subjects, or projects involving a particular topic in a particular subject. For example, a project to learn about Comp Org/Arch or multiple projects to learn about topics in Comp Org/Arch like caching/pipelines/concurrency etc.
Big or small, I hope we can collect some project topic wise / subject wise which with enough motivation and googling, self learners can implement and learn from the experience.
NOTE: If I have missed out on any subject / topic, it is due to my ignorance. Please don't restrict yourself to the subjects I have mentioned above. <comment><USER2> Build a file system or language, The learning will be intense</comment>


Not cool, Reddit - <AUTHOR> http://www.stochasticgeometry.ie/2010/03/09/silently-banned-reddit/

<comment><USER2> This isn't really news.

Reddit does do 'shadow-bans' in the case of egregious spammers. Moderators are soon going to be able to do temporary, sub-reddit specific shadowbans as well.

Looking at his account (<http://www.reddit.com/user/MarkDennehy/submitted/>), he looks like a spammer. He only submits links to his own sites, and rarely comments.

Scrolling down through his submission history, I can see (for the subreddits I moderate, such as /r/business), that his submissions have an incredibly high rate of spam-filter failure (meaning that they get caught by the automated spam filter and never shown.) This is because they look like spam.

The point of Reddit is to submit interesting and informative links, as well as participate in discourse; not repeatedly submit your own articles to as many subreddits as possible.

If you look like a spammer, and talk like a spammer... well....

</comment><comment><USER3> Cache link as it source appears to be down: [http://webcache.googleusercontent.com/search?q=cache:EeZYEWV...](http://webcache.googleusercontent.com/search?q=cache:EeZYEWV3Xn8J:www.stochasticgeometry.ie/2010/03/09/silently- banned-reddit/+http://www.stochasticgeometry.ie/2010/03/09/silently-banned- reddit/&hl=en&client=safari&gl=us&strip=1)

Basically, guy got inexplicably banned from the site, and is having trouble getting back on.

<comment><USER4> Reddit does secret hellbans? That's awful! I'm glad I hang out on HN instead.

EDIT: Arc seems to have eaten my <sarcasm> tags. Truly an inferior-lisp.

<comment><USER5> Everything seems to point to HN being much much worse about doing that than Reddit.

</comment></comment></comment><comment><USER6> This is pretty old. Here's the discussion about this on Reddit: [http://www.reddit.com/r/reddit.com/comments/bbc58/silently_b...](http://www.reddit.com/r/reddit.com/comments/bbc58/silently_banned_from_reddit/)

</comment><comment><USER7> This was addressed a year ago:

[http://www.reddit.com/r/reddit.com/comments/bbc58/silently_b...](http://www.reddit.com/r/reddit.com/comments/bbc58/silently_banned_from_reddit/c0lyabo)

</comment><comment><USER8> ... a year and a half ago.

</comment><comment><USER9> This is a one-year old story. What's the "news" angle?

</comment><comment><USER7> It sure would be nice if he actually said what his username was.

<comment><USER10> Seems to be this acc. <http://www.reddit.com/user/MarkDennehy/submitted/>

<comment><USER11> Looks spammy to me.

<comment><USER7> But don't you want to know the best cans to wear?

/snark

Look, there is a fine line between promoting your own articles (It's _totally_ okay to link to your own stuff), and spamming.

Linking the same thing across a bunch of subreddits and having it receive no upvotes? That's spam.

</comment></comment></comment></comment><comment><USER12> Judging from his submitted stories, it looks like he pretty much exclusively linked and x-posted to his own blog(s). (<http://www.reddit.com/user/MarkDennehy/submitted/>)

The FAQs DO have a section on that:

" _It's not strictly forbidden to submit a link to a site that you own or otherwise benefit from in some way, but you should sort of consider yourself on thin ice. So please pay careful attention to the rest of these bullet points_ " <http://www.reddit.com/help/faq#Whatconstitutesspam>

Plus lots of the posts had 0 points, so it seems pretty conclusive to me.

And arguing the "more or less karma points"... come on. Really??? So not only did OP not read the FAQs, he doesn't know how reddit works and how many accounts the average redditor has.</comment>


Calling Bullshit - <AUTHOR> https://callingbullshit.org/index.html <comment><USER2> Certainly an idea with good intentions, but how many people are honest enough with themselves to acknowledge that they're easily fooled? And if the end result is healthy skepticism about all the stories with positive spin, is that enjoyable? Would I put time, work, and money into leaving the Platonic cave? (I mean, I would, but I don't know if that's common.)

As a side note, a friend of mine has PhD in early childhood education and says that teaching children skills like these is extremely effective. I hope society will do more of that.</comment>


Go 1.11.4 and Go 1.10.7 are released - <AUTHOR> https://groups.google.com/forum/#!topic/golang-nuts/roXeikSHhE0 <comment><USER2> well, they did screw up the previous one :(</comment>


Mozilla ports simplified private browsing app to Android - <AUTHOR> https://www.helpnetsecurity.com/2017/06/21/privacy-focused-browser-android/ <comment><USER2> I love Firefox Focus on iOS and use it everyday. It's the "anti-tabitis", "rinse and repeat", private browser. I load up a few sites, one after another (no tabs), read some stuff and then hit "Erase" to clear everything! It's definitely a "focus"ed experience for me (excuse the pun).

Even on iOS, it could do with some improvements, like responding to standard screen swipe gestures for back/forward, adding a share sheet to make it easier to export the current URL, etc. This may just be my experience alone, but it also feels slower and "heavier" (battery wise) than Safari.

In case "tabitis" sounds unfamiliar - [http://www.urbandictionary.com/define.php?term=tabitis](http://www.urbandictionary.com/define.php?term=tabitis)

</comment><comment><AUTHOR> Ad block preloaded is a nice feature. Was having issues getting OperaMini setup properly. Mozilla Focus has a build set ready for use!</comment>


Txqr: Transfer data via animated QR codes - <AUTHOR> https://github.com/divan/txqr <comment><USER2> "...written in Java, Python or JavaScript. That means the code is not cross- platform..." [1]

wat. I need an explanation how these implementations are not "cross-platform" yet his Go implementation is.

1 - from the author's blog post at [https://divan.github.io/posts/animatedqr/](https://divan.github.io/posts/animatedqr/)

<comment><USER3> I can only suggest his definition of cross platform may actually mean "works on iOS in compliance with Apple policies".

While those all will work well on major PC OSes and for the most part on Android devices, Apple's policies are quite strict about running compilers and interpreters on device last I checked. Meaning you need compiled code in some way, shape or form.

<comment><USER4> Apple removed the blank ban on interpreters more than five years ago. The restriction now only applies to interpreters running user-provided/dynamic code. If you're bundling it with the application, as you would here, it's allowed -- and many popular games rely on this.

<comment><USER5> This isn't true at all. You still can't run Unity outside of AOT mode, for example.

<comment><USER6> Somehow Kivy applications are allowed permitting a bundled python interpreter... I've never looked into the rules but know of examples in the app store.

</comment></comment></comment></comment></comment><comment><USER7> Hah, cool! This reminds me of an old 4chan thread where people were trying to get free file storage on YouTube by uploading video's of QR code sequences with files encoded into them. Much less useful than Txqr, but fun nonetheless.

<comment><USER8> YouTube _is_ essentially "free file storage", just for a very specific file format.

Some software for the ZX Spectrum was distributed in a similar fashion, by being broadcast in audio format:

[https://en.wikipedia.org/wiki/ZX_Spectrum_software#Others](https://en.wikipedia.org/wiki/ZX_Spectrum_software#Others)

I suppose if you uploaded a recording of that to YouTube you could do a similar thing, although I can't seem to find any examples at the moment.

<comment><USER7> > YouTube is essentially "free file storage", just for a very specific file > format.

Right. A platform for audio/video or in this case extremely inefficient file storage.

> Some software for the ZX Spectrum was distributed in a similar fashion, by > being broadcast in audio format:

That's fascinating, thanks for sharing!

</comment></comment></comment><comment><USER9> Another excellent library/system for data-transfer via QR codes is QRLoop: [https://github.com/gre/qrloop](https://github.com/gre/qrloop)

It comes with this nifty demo of text->animated QR code: [https://qrloop.netlify.com/](https://qrloop.netlify.com/)

<comment><USER10> Nice, thanks for the link – I did pretty extensive search, but haven't found this one. I like how similar was path from naive implementation to the fountain codes as with txqr.

</comment></comment><comment><USER11> Great stuff! QR code is optimized for low error rates when the channel is a digital camera-based, single photo capture. If one uses a code designed for multiple capture over time (some video code), the transfer speed could be increased significantly. Thinking of it like a very noisy fibre optic channel, there's plenty of room for improvement.

<comment><USER11> Also, as a practical aside, two mobiles devices could use their screens and front-facing cameras to negotiate a secure session for key-exchange, etc.

<comment><USER12> Isn't this essentially how Apple Watch pairing happens?

<comment><USER10> Nope. Apple Watch pairing is unidirectional and low-bandwidth, and uses extremely cool patented technique with hiding data in luminance changes. It's exploiting the fact that human eye is so much more sensitive to the chrominance changes, rather than luminance, but computers is not. [http://www.iphonehacks.com/2015/05/new-apple-patents- explain...](http://www.iphonehacks.com/2015/05/new-apple-patents-explain- particle-cloud-pairing-method-used-for-apple-watch.html)

</comment></comment></comment></comment><comment><USER13> I am reminded of QR codes for kernel panics.

[https://lwn.net/Articles/503677/](https://lwn.net/Articles/503677/)

This should be a standard and could be the Kermit of H2M and M2M systems.

It would be interesting to try bidirectional transfer using the front facing cameras with two phones pointed at each other.

<comment><USER14> I would also love to see a two-way version of this.

Bluetooth and wifi are way too finicky for local "data dump"-style communication, whereas every Android/iOS phone has a front camera and a screen.

P2P applications like Secure Scuttlebutt etc. could really use a reliable local exchange without the wireless headaches.

</comment></comment><comment><USER15> What's the transfer speed, are there practical file size limits? Do you have to wait for it to loop or can the reader pick up in the middle of the stream?

<comment><USER16> That's a good question! But for something under 100Kb it should be pretty quick. Curious to know how long it takes for a whole MB.

Update: Actually, I was too optimistic : [https://divan.github.io/posts/animatedqr/](https://divan.github.io/posts/animatedqr/)

<comment><USER17> There was a follow-up post[1] where the author switched to fountain codes (a type of erasure coding that is perfect for this use-case) and apparently the speed is now closer to 25kbps. Pretty neat.

[1]: [https://divan.github.io/posts/fountaincodes/](https://divan.github.io/posts/fountaincodes/)

</comment></comment></comment><comment><USER18> Reminds me of Backer32, a piece of hardware that stored data on VHS tapes as black and white squares.

[https://youtu.be/TUS0Zv2APjU?t=815](https://youtu.be/TUS0Zv2APjU?t=815)

<comment><USER19> Never knew about this, but of course it exists! In the digital video tape world, it was common to do backups to tape. The old Flame/Inferno systems would do archives to D1 by laying down all of the video elements including the mattes as video, and then save the actual project code as data afterwards. When played back, it would look like black&white snow/noise. Maybe it was at the beginning, don't remember exactly. However, at the time, I had just assumed it was just noise, but now wonder if the black&white patterns was the data like a QR code. A blank VHS tape would display static as well, but a blank digital tape would not. That's what made these archives stand out to me.

</comment></comment><comment><USER20> I understand the challenges involved, but if an algorithm were fault tolerant enough to handle a flip book of qr codes, one could manually animate a file transfer. :)

<comment><USER12> Print the QR codes in infrared or ultraviolet ink on the pages of a regular book and move information secretly across borders.

</comment></comment><comment><USER21> Cool - I did something similar long ago although I don't maintain it anymore. [https://itunes.apple.com/us/app/qrsplice/id513008119?mt=8](https://itunes.apple.com/us/app/qrsplice/id513008119?mt=8)

</comment><comment><USER22> Reminds me of the Travelers TV show when the Historians are getting an update.

</comment><comment><USER23> Me and a friend put together this basic idea a few years ago at a hackathon. At the time we thought it was very funny to code something so useless (no offense to OP). Looks like we missed out on some sweet HN karma!

[https://github.com/AFFogarty/QRTransfer](https://github.com/AFFogarty/QRTransfer)

</comment><comment><USER24> This oddly overlapped with just learning about bitcoinfibre [1], which uses forward error correction (FEC) to fill packets with extra data to speed up network transfers by preventing retransmissions.

[1] [http://bitcoinfibre.org](http://bitcoinfibre.org)

</comment><comment><USER6> I had already begun using QR codes to provide signed urls to images (graphs showing data and the like). Something like this permits transferring the graph image directly. Walk up to a smart device and retrieve its data without any convoluted pairing process.

<comment><USER12> Back in the early days of smartphones (iPhone, iPhone 3, iPhone 3GS era), Marshall Field's flagship department store in Chicago experimented with this.

Each display window had a bunch of stickers on it, similar to QR codes. You could use the app on your phone to point your camera at one of the stickers and get more information about different products on display.

They also tried something similar with a different app and some kind of Bluetooth connection.

All of this was still early days, so it didn't work very well. It would probably be OK now that the technology has matured.

</comment></comment><comment><USER25> I've been contemplating writing this same thing for the past few years. Thanks! Although the security implications to many businesses that think they've locked down their end clients will be huge. Most SIEMs looking for data exfiltration will analyze email attachments, outbound network connections, etc. This is a new vector that's extremely hard to police. Can you scale the QR codes up to higher resolution, increasing the bandwidth you can transfer over the video interface?

</comment><comment><USER26> I can't think of any actually useful applications (the one given only makes vague sense if you pretend bluetooth doesn't exists), but it's a cool demo anyway and the linked blog posts are excellent.

<comment><USER27> Offline data sync from an old device to a new one. Many phone carriers provide for something similar in a QR code. My team has an app we developed that has a similar function because the private keys and all of the wallet items are exclusively offline. We show an qr code today. The issue we have hit lately is that the amount of data we have is more than a single code. Depending on the number of wallet items the users have. The animated QR is a good solution for this.

If someone is interested in how we got an amazingly small QR using base-91 and some other cool methods here is a good read with demo code

[https://docs.google.com/document/d/1B7AJDVu5ei6c7ZuHRiTvQ_q8...](https://docs.google.com/document/d/1B7AJDVu5ei6c7ZuHRiTvQ_q8816JgdGID0IxKdnUS1U/edit?usp=sharing)

<comment><USER5> Why not just use a single code for bluetooth/wifi hand shaking? Wouldn't that be more efficient by any metric and almost as compatible? What device has a solid camera and no wireless communication?

<comment><USER28> Why not both? There is always the potential that there is an actual _reason_ to upgrade - and borked motherboards where any such modules are damaged as a potential reason.

<comment><USER5> >Why not both?

User confusion and the fact that high quality camera tech and OCR aren't exactly cheap.

</comment></comment></comment></comment></comment><comment><USER29> Cool concept, but won't it cause epileptic attacks due to flashing images?

</comment><comment><USER30> In the science fiction novel Snow Crash an image containing random white and black pixels contained a virus that could infect any developer that would see the image: [https://www.amazon.fr/Snow-Crash-Neal- Stephenson/dp/14915150...](https://www.amazon.fr/Snow-Crash-Neal- Stephenson/dp/1491515058)</comment>


Show HN: Calenvy.com – YC alum launches new scheduling app powered by email - <AUTHOR> https://calenvy.com <comment><USER2> You want access to read my company emails? As a sys admin, this is abhorrent.

Consent to Access Your Email Conversations and Files BY UTILIZING THE SITE, CONTENT, FILES AND/OR SERVICES, YOU CONSENT TO ALLOW NOTED TO ACCESS EMAILS IN YOUR EMAIL ACCOUNT. BY POSTING FILES, AUTHENTICATING YOUR EMAIL CREDENTIALS OR SHARING MESSAGES, YOU CONSENT TO SHARE ACCESS TO THE CONTENT OF THOISE FILES AND THOSE MESSAGES WITH OTHER USERS IN YOUR ACCOUNT.

</comment><comment><USER3> Come on fellas, you don't even have a screenshot or a text-based list of reasons why I should spend my valuable time signing up for an account?

Why should I trust you guys with my critical data?

Adding some combination of "YC-alumni/backed" to showHN titles is a pet peeve that seems similar to click bait titles. It's like name dropping in-lieu of properly describing the offering.

</comment><comment><USER4> I hope this works seamlessly in my emailing/scheduling workflow, or better yet replaces it entirely. Some quick feedback:

1\. Terms of service seem over-bearing (see @whydoineedthis)

2\. Show me a demo before making me provide personal info (email) and consent.

3\. Yellow button on yellow background, ugh

4\. "Made with happiness and abundant goodness." Cool, prove it. Show me who's behind this.

</comment><comment><USER5> Some Critique :

1) The twitter account seems suspended and github link is also dead at the end.

2) I had to scroll and read the fine print in second block to understand what this is about.

3) No privacy policy or any information about the founders

<comment><AUTHOR> This thread is interactive with the site, so any comments could result in changes within minutes.

1) Fixed 2) I need a screenshot at the top showing how it schedules meetings for you powered by email. Its like Posterous, only for scheduling. 3) the project is going to be open source, so hopefully soon we'll have info on the founders.</comment></comment>


ASK HN: 300k engineers How do you get there? - <AUTHOR> <comment><USER2> They got a job at FAANG and stuck around.

<comment><USER3> Yeah I think part of the prerequisite is that they either contribute more than 300k of wealth or are plausibly a threat that can statistically do more than 300k in damage.

<comment><USER4> The threat is more likely. "Keep your friends close but your enemies closer"

</comment></comment></comment><comment><USER5> I was just reading the below when you posted this.

[https://www.sfgate.com/bayarea/article/middle-class- budget-S...](https://www.sfgate.com/bayarea/article/middle-class-budget-San- Francisco-300-000-13741570.php)

Sounds insane

<comment><USER6> I can't even fathom being out of touch enough to spend $6k per year on clothing and then go on telling someone I live paycheck to paycheck.

Edit: Not to mention owning a $60k luxury SUV and still being dumb enough to take the standard deduction when you clearly have enough expenses to itemize.

<comment><USER7> Yeah, that whole expenditure sheet is absolutely insane. $2K mortgage/$1.9K interest? You've gotta be shitting me.

I'm sorry but, if you're paying that much for a house (and everything else) that $300K is "paycheck to paycheck" then it's time to re-evaluate where you live. All of those costs could be cut completely in half, at the very least.

Budgets are funny, as every single person is different and yet thinks they have it figured out. I also recognize the irony in my previous statement.

</comment></comment></comment><comment><USER8> My total comp is hovering around 300-310k

1.5 years out of a B.A. from a State School. I taught myself machine learning and focused on providing performance from bare metal to algorithms

<comment><AUTHOR> That's cool and looks like you are more into music. Are you making the transition or are you doing both in parallel? May I ask how you get ML work.

<comment><USER8> I went to school for Computer Engineering, I'm just tangentially into music. I got into ML by doing a few hackathons throwing stuff together, then I got a undergrad research position doing static analysis. That helped get me the job I have now.

</comment></comment></comment><comment><USER9> Get competing offers from a few big tech cos at the same time. You will clear 300k. So basically, master leetcode

</comment><comment><USER10> Truth is its a very typical salary + equity package for established cos and competitive late stage startups in Bay Area. With CoL it's comparable to making $150k in almost every other major market outside maybe NY.

</comment><comment><USER11> You get there by giving back 40-50% to California. The more you give away, the more you earn :)

Joke aside, 5 years of experience get you $300k total compensation per year at a hot company in SF Bay Area.

</comment><comment><USER12> How about fully remote? Anyone?

</comment><comment><USER13> Z

</comment><comment><USER14> Luck.</comment>


Goat Simulator heads to Steam April 1 - <AUTHOR> http://www.polygon.com/2014/3/4/5471470/goat-simulator-heads-to-steam-april-1

<comment><AUTHOR> Direct link to their trailer: [http://www.youtube.com/watch?v=JN2QUhaKN2Q](http://www.youtube.com/watch?v=JN2QUhaKN2Q)

This is beyond ridiculous and I love it.

</comment><comment><USER2> I was envisioning less destruction and more standing around eating things. But goat-based destruction's good too I guess. I'd just hope that everything in the environment is edible.

</comment><comment><USER3> Looks like a fun env destruction game... but now the only thing that could surprise me is a blockbuster PETA animal slaughterhouse game.

</comment><comment><USER4> This appears to be the dumbest thing I've seen so far this year.

That said, I laughed. And I'm glad there's an ecosystem like Steam to make the widespread distribution of this kind of silliness a lot easier.

Goat Simulator might not be for me, but I hope there's somebody else out there with a game idea who is inspired to act on it based upon seeing this.</comment>


Docker's 404 error page - <AUTHOR> https://get.docker.io/404

<comment><USER2> Small nitpick, but _this_ is the Docker 404 page: [http://www.docker.io/asdf](http://www.docker.io/asdf)

The one you found is the 404 page for their script download.

</comment><comment><USER3> I assume entire responsibility for this; and the associated confusion which ensues when doing e.g. "curl get.docker.io/blah | sh" :)

</comment><comment><USER4> What's so special about this?

</comment><comment><USER5> And?

<comment><USER6> Container analogy, is a bit of fun and is a nice alternative to a plain page - does everything on hacker news have to be super-serious?</comment></comment>


Google makes the power of BigQuery available in Sheets - <AUTHOR> https://techcrunch.com/2019/04/10/google-makes-the-power-of-bigquery-available-in-sheets/ <comment><USER2> IMHO, this is the biggest news to come out of Google Next. Putting large volumes of data in the hands of analysts, in a safe way, is an impressive feat.</comment>


LLVM patch to fix half of Spectre attack - <AUTHOR> https://reviews.llvm.org/D41723 <comment><USER2> Page was down when I tried to read it, but it's archived here: [http://archive.is/s831k](http://archive.is/s831k).

Its hard to get your head around how big a deal this is. This vulnerability is so bad they killed x86 indirect jump instructions. It's so bad compilers --- all of them --- have to know about this bug, and use an incantation that hacks ret like an exploit developer would. It's so bad that to restore the original performance of a predictable indirect jump you might have to change the way you write high-level language code.

It's glorious.

<comment><USER3> Is glorious the right word for it? We're going back to the stone ages where processors couldn't predict the targets of indirect jumps. More generally, this seems to me like an attempt to patch out of what is really a class of attacks leveraging fundamental assumptions about high-performance CPU design. Before, OOO just had to preserve correctness and (some of) the order of exceptions and memory operations. Now, it has to preserve (some of) the timing of in-order execution too? Where does this path end?

<comment><USER4> Legitimate question: on any non-shared non-virtualized system is there any reason to enable these workarounds _besides_ running sandboxed applications such as javascript in a web browser (or flash/java applets/Active X, but those are not really super popular nowadays)?

For any other non-sanboxed application you pretty much have to trust the code anyway. Privilege escalation is always a bad thing of course, but for single user desktop machines getting user shell access as an attacker means that you can do pretty much anything you want.

As far as I can see the only surface of attack for my current machine would be a website running untrusted JS. For all other applications running on my machine if one of them is actually hostile them I'm already screwed.

Frankly I'm more annoyed at the ridiculous over-engineering of the Web than at CPU vendors. Because in 2017 you need to enable a turing complete language interpreter in your browser in order to display text and pictures on many (most?) websites.

Gopher should've won.

<comment><USER5> > on any non-shared non-virtualized system is there any reason to enable these > workarounds

Does the non-shared non-virtualized system have any encryption keys in memory that you want to protect?

Do you use full-disk encryption or ssh to other machines or use a cryptocurrency wallet?

<comment><USER6> These questions are only relevant if you're not controlling and trusting all the code you're running that system. For a consumer system this is true if (and basically only if) you're running a web browser on that system.

If you're confident in the software you're running on a non-shared hardware, both Meltdown and Spectre are non-issues requiring no mitigation. This is a narrow class of systems, but it exists.

<comment><USER7> > If you're confident in the software you're running on a non-shared > hardware...

and that you won't be hit by a remote execution vulnerability.

<comment><USER6> That's what being confident in the software means.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> _When using these patches on statically linked applications, especially C++ applications, you should expect to see a much more dramatic performance hit. For microbenchmarks that are switch, indirect-, or virtual-call heavy we have seen overheads ranging from 10% to 50%._

Ouch! This is independent of other performance hurts, like from the kernel syscall overhead that was the hot topic yesterday. This is pretty crazy.

<comment><USER9> That's bad. A single 5% hit might not be the end of the world, but 5% here and 10% there and another 5% over there in the common case adds up badly enough. Doubly-pathological cases (indirect calling-heavy code calling lots of syscalls)... a 50% slowdown and a 30% slowdown combines to a 60% total slowdown. Yeowch.

Will be intrigued to see how processor manufacturers respond to this. If they were even slightly relaxed about it prior to disclosure I expect there's going to be some very hurried attempts to engineer some solutions pronto. This is the sort of thing where it might even be worth throwing away all of your future roadmap plans and just getting a revision of the current chips out there ASAP, whatever that may do to the rest of your roadmap.

<comment><USER10> Sounds like it could be great for processor manufacturers. In the age where CPUs don't get faster, there's finally a reason for customers to buy new CPUs again!

<comment><USER11> Not really, once a program is compiled with -retpoline, new hardware won't bring back reliable branch prediction.

I'd hope maybe, just maybe, this would be enough to put a focus on compilers producing code that ends up using processor-optimized paths chosen at runtime, to avoid "overheads ranging from 10% to 50%".

Though, in this case, that would essentially mean making the entire executable region writable for some window of time, which is clearly too dangerous, so I guess the 0.1% speedups from compiling undefined behavior in new and interesting ways, will continue taking priority.

I mean, it's a compiler flag right, obviously whoever's going to run a program on an unaffected platform will take the effort to recompile everything with the flag removed.

Just the same way every serious application currently provides different executables for running on systems where SSE2, SSE4.1, or AVX2 is present.

<comment><USER12> Not quite - lots of "serious" applications these days are written to target JIT compilers, which would be capable of switching retpoline on and off depending on need.

<comment><USER11> Funnily enough, I ended up not including a PS starting with "A sufficiently smart JIT, however..." ;)

</comment></comment></comment></comment></comment></comment><comment><USER13> This is brutal for all interpreted/JITed languages and all statically compiled languages with dynamic dispatch. I can hardly imagine worse news for performance oriented engineers. And what's worse is that dynamic libraries will probably need to be rebuilt with these mitigations in mind, so nearly everyone will pay the cost even if they don't need it.

I feel bad for all of the engineers currently working on performance sensitive applications in these languages. There's a whole lot of Java, .NET, and JavaScript that's about to get slower[1]. Enterprise-y, abstract class heavy (i.e.: vtable using) C++ will get slower. Rust trait objects get slower. Haskell type classes that don't optimize out get slower.

What a mess.

[1] These mitigations will need to be implemented for interpreters, and JITs will want to switch to emitting "retpoline" code for dynamic dispatch. There's no world in which I don't expect the JVM, V8, and others to switch to these by default soon.

</comment><comment><USER14> This mitigates spectre variant #2, branch target injection. We also have a mitigation for meltdown, namely KPTI. Is there a known mitigation for spectre variant #1, bounds check bypass?

Maybe I'm being naive, but would a simple modulo instruction work? Consider the example code from [https://googleprojectzero.blogspot.com/2018/01/reading- privi...](https://googleprojectzero.blogspot.com/2018/01/reading-privileged- memory-with-side.html):

        unsigned long untrusted_offset_from_caller = ...;
        if (untrusted_offset_from_caller < arr1->length) {
         unsigned char value = arr1->data[untrusted_offset_from_caller];
         ...
        }

If instead we did:

        unsigned char value = arr1->data[untrusted_offset_from_caller % arr1->length];

Would this produce a data dependency that prevents speculative execution from reading an out-of-bounds memory address? (Ignore for the moment that a sufficiently smart compiler might "optimize" out the modulo here.)

</comment><comment><USER15> A new thing that's going to become a standard part of systems engineering: deciding whether any given system needs to run with or without these kinds of protections. Do you want the speed of speculative execution or do you want Meltdown/Spectre protection? In some cases lack of protection is fine. But figuring out the answer for any given system is often going to take expert- level security knowledge. Security is all about multiple layers of protection, and even a non-public facing machine might benefit from these layers depending on the context.

<comment><USER16> Spectre relies on tricking the CPU into branch predicting its way into accessing protected memory, no? Is it not possible that we can keep most of the performance benefits of speculative execution by somehow having a built in "Hey, never _ever_ speculate that I'll want to access this region of memory" sort of thing?

<comment><USER17> I read an ars technica article that this would be a possible solution but isn't right now because the hardware to check access rights isn't fast enough yet

</comment></comment></comment><comment><USER18> It has an interesting performance impact on calls to dynamic libraries. One alternative approach would be to avoid the indirect calls through not using '-fPIC --shared' when building shared libraries but '-mcmodel=large --shared'. This causes the relocations to happen at the direct calls and not through a GOT.

The obvious drawback that it effectively disables sharing code in memory, it would still allow sharing code on disk though. So it would be a middle ground between the current state in dynamic and static linking.

[https://www.technovelty.org/c/position-independent-code- and-...](https://www.technovelty.org/c/position-independent-code- and-x86-64-libraries.html)

</comment><comment><USER19> This patch apparently implements this mitigation: [https://support.google.com/faqs/answer/7625886](https://support.google.com/faqs/answer/7625886)

<comment><USER20> And once one knows the technical background, one is better positioned to consider the response of Linus Torvalds to the idea that the entire Linux kernel be recompiled for all x86 CPUs with a compiler that implements this.

* [https://lkml.org/lkml/2018/1/3/797](https://lkml.org/lkml/2018/1/3/797) ([https://news.ycombinator.com/item?id=16066968](https://news.ycombinator.com/item?id=16066968))

<comment><USER2> This would be more interesting if the attack that the compiler mitigations was designed for wasn't cross-vendor, cross-architecture.

</comment></comment></comment><comment><USER21> I, for one, am eternally grateful for the incredibly bright people who take the time to patch this sort of stuff.

<comment><USER22> And the people who invented computers, programming languages, the internet, and all the learning resources, that allow me to get a paycheck writing extremely high level application code that feels like a coloring book in comparison. Truly the shoulders of giants.

</comment></comment><comment><USER23> I have a hunch that the era of side-channel attacks is only now dawning, and that we should expect many more painful exploits and cumbersome mitigations in the coming years.

What do people more knowledgeable in the field think about this?

<comment><USER24> What about users who only execute trusted code?

All of these attacks assume you are running something you don't trust on your CPU, whether it is another user's program, a non-root executable, or a JavaScript program from a website.

When do we stop hacking processors, kernels, and compilers and revisit our assumptions of what we can and can't do securely.

<comment><USER25> Define "trusted"? Who do you trust to do your verification, and how much does it cost?

<comment><USER24> Well, critical applications, like flight systems, run on a different ecosystem and are verified. (And it costs a lot.)

But my usecase might be a physical computer that isn't networked which does data science with some programs and prints out results.

These patches are focused at Amazon and cloud providers that are in the business of running separate individual's applications on the same machine.

In the consumer world, the slope would be browser scripts and user applications that aren't running as super. But even then, do you download and run software that you expect might steal information or damage your computer?

These are fundamental security questions. Creating rings and sandboxes are what create the assumptions of privacy and security.

</comment></comment></comment></comment><comment><USER26> RISC-V impact? With all the reports of these attacks, I have not seen mention of risc-v. Since they are in the process of finalizing a lot of specs including memory model and privileged instructions, I wonder if there will be last minute changes to mitigate these vulnerabilities.

<comment><USER27> At the risk of being a HN self-parody, I've also been wondering what this means for the Mill...

[https://millcomputing.com/docs/prediction/](https://millcomputing.com/docs/prediction/)

<comment><USER28> The only speculation done on the mill currently is on whether it will ever be released, so I think they'll be safe.

</comment></comment></comment><comment><USER29> I remember doing tricks like this in 6502 assembly and in other early processors. Amazing that to stop these attacks you have to come up with clever tricks again. Back in the 80's I would have never imagined this type of attack being something to worry about.

<comment> FLUX-YOU >early processors

Early processors had speculative execution? I thought this had been added to Intel/AMD/ARM about 20 years ago?

<comment><USER8> I guess he means the retpoline. On the 6502 there is no indirect jump instruction, so you need such tricks just to achieve an indirect jump at all.

<comment><USER30> There's an indirect jump instruction. It's not very good though, and has a notorious bug with addresses ending in 0xFF.

<comment><USER8> Gah, you're right. Guess my memory is fading. There is indirect JMP, but no indirect JSR or indirect branches. And the indirect JMP as you say is not very useful.

</comment></comment></comment></comment></comment><comment><USER31> This brings to mind Ken Thompson's "Reflections on Trusting Trust"[1] -- after all, all I have to do to write code with the exploit is be able to remove the patch and rebuild the compiler and build some executables.

Trusting in a compiler you hope was used to build all the executables on your system isn't trustworthy enough to be the final solution.

[1] [https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html](https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html)

<comment><USER32> Every modern compiler usually has extensions that allow for bits of assembly to be inserted alongside the usual C or C++ code.

Unless the compiler is also patched to either disallow inserted assembly, or to modify the inserted assembly (this being both hard and dangerous), someone who wants to exploit the bug will just add their own inserted assembly code that exploits the bug, and a patched compiler won't help one bit in that case.

</comment></comment><comment><USER33> Just as a FYI, according to:

* [https://lkml.org/lkml/2018/1/4/432](https://lkml.org/lkml/2018/1/4/432) * [http://xenbits.xen.org/gitweb/?p=people/andrewcoop/xen.git;a...](http://xenbits.xen.org/gitweb/?p=people/andrewcoop/xen.git;a=blob;f=xen/arch/x86/spec_ctrl.c;h=79aedf774a390293dfd564ce978500085344e305;hb=refs/heads/sp2-mitigations-v6.5#l168)

It appears that Skylake and later can actually predict retpolines? Some hardware features called IBRS, IBPB, STIBP (not a lot of details on this are out there) are supposedly coming in a microcode update.

</comment><comment><USER34> The problem I see with this concept is ROP mitigations like Intel's control flow enforcement don't seem compatible with intentionally using tweaked addresses with ret. The address they inject won't match the shadow stack and the program will be terminated.

<comment><USER35> This is true, and so far, nobody has a better idea. (IE i would expect that unless someone comes up with one, that hardware CFE in its current form dies and won't happen for Intel until the processors are changed in a way that mitigation is not needed)

</comment></comment><comment><USER36> Isn't it the case that the Itanium architecture would not be vulnerable to Spectre because it moves the onus of branch prediction from the CPU to the compiler?

<comment><USER37> Assuming the compiler knows what it's doing :)

<comment><USER36> That was always the problem with the Itanium compilers. They were crap because they couldn't benefit from the years of tuning traditional architectures enjoyed.

<comment><USER38> Also the compiler had to be absolutely brilliant to rewrite the serial branching code most programmers wrote to work with the EPIC model. They had some good results optimized math-heavy code but the general purpose code ended up with too many nops waiting on results.

</comment></comment></comment></comment><comment><USER39> I can't help thinking of how the early-ITS approach to security (not only was there none, but looking at other users' work was a deliberate feature) was embraced by its users. I'm way too young to remember, but it rings a bell somewhere down my heart.

There's a lot of prominence being given to all kinds of damage malicious users might inflict, and ways to prevent or mitigate, but little to the _malice_ itself. Whence does it arise? What emotions drive those users? What unmet needs?

Meanwhile, when these slowing-down patches for Sceptre and Meltdown arrive, I intend to _not_ run them, to the possible extent. I intend to keep aside a VM with patches for critical stuff, like banking or others' data entrusted to me. But I don't want my machine to be slowed down just because someone, sometime, might invest effort in targeting these attacks at it. Given how transparent I want to be with my life, that's a risk I'm willing to take.

<comment><USER40> Most attacks aren't targeted at specific people. Hackers don't want to read your emails, they want your credit-card information, digital account passwords, or to compromise your computer to use in their botnet.

Sure, you might not have anything you want to hide in your life, but the drive-by javascript doesn't care about your secrets - it'll hack you anyway. Best-case scenario, you lose access to a bunch of accounts you used to use and need to create new identities from scratch. Worst-case, they clean you out financially, steal your identity, etc.

</comment></comment><comment><USER41> retpoline seems to be a novel concept. Can anyone ELI5?

Also, any insight about performance impact here?

<comment><USER2> An indirect jump is when your program asks the CPU to transfer control to a location that your code itself computes: "jmp %register". Compare to a direct jump, where the destination of the jump is hardcoded into the jump instruction itself: "jmp $0x100".

Most programs have indirect jumps somewhere. Higher-level languages with virtual function calls have lots of indirect jumps, because they parameterize functions: to get the "length" of the variable "foo", the function "bar" has to call one of 30 different functions, depending on the type of "foo"; the function to call is read out of a table at some offset from the base address of "foo". Or, another example is switch statements, which can compile down to jump tables.

What we want, to mitigate Spectre, is to be able to disable speculative execution for indirect jumps. The CPU doesn't provide a clean way to do that directly.

So we just stop using the indirect jump instructions. Instead, we abuse the fact that "ret" is an indirect jump.

"Call" and "ret" are how CPUs support function calls. When you "call" a function, the CPU pushes the return address --- the next instruction address after the "call" \--- to the stack. When you return from a function, you pop the return address and jump to it. There's a sort of "jmp %register" hidden in "ret".

You abuse "ret" by replacing indirect jumps with a sequence of call/mov/jump, where the mov does a switcheroo on the saved return address.

The obvious next question to ask here is, "why don't CPUs predict and speculatively execute rets?" And, they do. So the retpoline mitigates this: instead of just "call/pop/jump", it does "call/...pause/jmp.../mov/jmp", where the middle sequence of instructions set off in "..." is _jumped over_ and not executed, but captures the speculative execution that the CPU does --- the CPU expects the "ret" to return to the original "call", and does not know how to predict around the fact that we did the switcheroo on the return address.

How'd I do?

<comment><USER42> Pretty well, thanks. What I'm wondering is: The attack is using the data fetched into the cache from a speculative indirect jump to do a timing attack and discover what's in the former, correct? Why can't the CPU mark the cache area it fetched in the speculative jump as "stale" and discard it? Why wouldn't that fix the problem?

<comment><USER43> I don't know any way to leave enough breadcrumbs to do that in four clock cycles, do you?

</comment></comment></comment></comment><comment><USER44> Note for a true fix to the BTB poisoning attack you would additionally have to disable SMT/HT.

See here: [https://news.ycombinator.com/item?id=16070304](https://news.ycombinator.com/item?id=16070304)

</comment><comment><USER45> Maybe some future architecture will allow software to tell CPU which regions it considers to be secret from the point of view of each other region.

Something like that could allow the CPU to speculate agressively while preventing information leak exploits.

<comment><USER32> The CPU hardware already has that feature. It is the VM paging system and the permissions assigned thereto.

The bug here is that the CPU is not aborting the speculation when fetches occur to addresses marked as "access denied". Instead the fetch happens and a line of normally inaccessible memory is put into cache by code that should not be able to get it read into the cache normally.

One hardware fix would be to plug that hole. Speculative reads get blocked when they encounter permission denied errors from the paging system and do not change the cache state. That blocks the Meltdown attack, but not the Spectre attack.

<comment><USER45> I thought about that too... AFAIK currently paging system is not generally accessible to userland programs like browsers. They would need some way to setup different contexts for untrusted javascript code and the internal services that the javascript can call.

Also maybe the context switching would need to be made faster, because you would need to do that whenever eg javascript calls browser interfaces.

</comment></comment></comment><comment><USER46> This is horrible, really _really_ horrible. And I'm not talking about the bug itself, but the mitigation --- which is basically "stop using indirect jump and call instructions and recompile all your software". The latter is beyond unrealistic.

It also sets a very bad precedent: I understand people want to mitigate/fix as much as possible, but this is basically giving an implicit message to the hardware designers: "it doesn't matter if our instructions are broken, regardless of how widespread in use they already are --- they'll just fix it in the software."

<comment><USER47> > it doesn't matter if our instructions are broken, regardless of how > widespread in use they already are --- they'll just fix it in the software.

What are any other options? It's _hardware_ , that cannot be patched. Of course they will change chip designs going forward, but what else do you suggest folks do with the billions of chips that exhibit this problem?

</comment></comment><comment><USER48> It's noted in the patch that one would have to recompile linked libraries, which seems impractical, unless a distro decides to build everything with this flag.

<comment><USER49> Not just linked binaries, also the whole underlying OS, and, critically, the compiler itself. Otherwise you could replace the 'proofed' construct with one that is not proofed against the bug.

<comment><USER50> Why would you need to recompile the compiler? Both variants only provide read access.

<comment><USER49> Ah right, of course. Sorry, in the midst of doing a pile of stuff I should not be commenting on this without studying it further, I figured that the first level read access would allow you to dig up the secrets required to give you write access which would then allow you the free run of the whole system, but if you are still on the other side of a virtual machine then that won't do any good unless that virtual machine can be escaped as well.

</comment></comment></comment></comment><comment><USER51> As Alex Ionescu has put it:

> We built multi-tenant cloud computing on top of processors and chipsets that > were designed and hyper-optimized for

> single-tenant use. We crossed our fingers that it would be OK and it would > all turn out great and we would all profit.

> In 2018, reality has come back to bite us.

This is the root of all the problems.

</comment><comment><USER52> This was the fix I was going to suggest. Especially with AVX leakage.

Right now many function calls don't safely wipe registers and the new side channel caches found in Spectre. There really needs to be two kinds of function calls. Maybe a C PRAGMA?

The complier has parent function call wiping as a flag; the code has pragmas that over-ride the flag.

</comment><comment><USER53> The site is down for me. HN hug of death?

<comment><USER54> It was a bit slow but eventually loaded for me.

<comment><USER55> Yeah, same thing happened to me... slow as hell but I guess it's common due the severity of the issue. All people wants to see this at the same time.

</comment></comment></comment><comment><USER56> what about performance impact after new CPU architecture arrives? how is that going to work?

</comment><comment><USER57> Mill can't come soon enough.

<comment><USER12> What makes you think the Mill would be immune to these issues?

<comment><USER57> Mill has no speculative execution.

<comment><USER58> Uh, yes it does. It has no /out of order/ execution but it certainly has speculative execution. They mention quite often in talks how they predict EBB exits and not each branch. They even go so far as to follow that EBB exit chain to speculatively load code from DRAM several calls ahead, which is much more speculation than current CPUs are capable of.

You basically can't make a deeply-pipelined processor fast without speculative execution.

</comment></comment></comment></comment><comment><USER59> If this were 15 years ago, I'd say the site was SlashDotted.

</comment><comment><USER60> In other news, Intel has found that by not using a computer at all, though performance overheads increase 100%, this counter-measure does secure any previously available attack vectors.</comment>


Where does a tree get its mass? Richard Feynman explains. - <AUTHOR> http://www.youtube.com/watch?v=N1pIYI5JQLE <comment><USER2> I have seen this many times but it never gets old. I wish the Feynman style of teaching and explaining our amazing world were more available. His physics lectures are now available but kids would be extremely anxious to learn if teachers made basic science as fun as Feynman did. He was smart to tune his way of talking so his audience would understand no matter their level of knowledge (i.e. "jiggly motion" describing heated atoms).

I am hoping that the internet and such things as OpenCourseware will allow college professors, teachers and more to become stars of teaching because they know how to communicate and make it fun.

These people should be compensated much more and be seen by many more people such as MIT's Walter Lewin, Feynman and many many others hidden in the fold of our current traditional education systems.

<comment><USER3> It's not just his style, but how animated and excited he gets when he's talking about these things!

<comment><USER4> Agreed, Enthusiasm and Passion are contagious -- when someone cares deeply about something it's hard not be interested.

<comment><USER5> When I was studying for my degree, my favourite course was "Digital Signal Processing" and I'm pretty sure it was because the lecturer was genuinely interested and enthusiastic about the subject. Enthusiasm is very contagious and hard to resist. I think everyone in that course liked it and found it easy to learn, just because we had a teacher who was really enthusiastic about what he was teaching. If only everyone was like this...

</comment></comment></comment></comment><comment><USER6> One of my favorites:

Dick acted as a consultant for a company in Switzerland, which took him there every summer. About 1982 or so, I had business in Europe, and I met Dick in Geneva. We decided to kick around for several days. We did the shops and the countryside on the first day, and on the second day, he asked what I'd like to do. I said, "Well, if it isn't too much like a postman's holiday, I'd like to go over to CERN," which is the European particle accellerator, where so much particle physics is done, and where Dick used to work a number of years before. He said, "Sure." So we went over there, and Dick couldn't find his way around because the buildings had changed. We finally found our way in, and looked into a room where there were some physicists doing work on the blackboard. One of them spotted Feynman, and pretty soon there was a crowd gathered, and the director came in. He decided they'd take us on a tour. We went into a 007, James Bond cave underneath the ground, with all this wonderful high-technology equipment. There was a giant machine that was going to be rolled into the line of the particle accelerator. The machine was maybe the size of a two-story building, on tracks, with lights and bulbs and dials and scaffolds all around, with men climbing all over it.

Feynman said, "What experiment is this?"

The director said, "Why this is an experiment to test the change-change something-or-other under such-and-such circumstances." But he stopped suddenly, and he said, "I forgot! This is your theory of change-change, Dr. Feynman! This is an experiment to demonstrate, if we can, your theory of fifteen years ago, called so-and-so." He was a little embarrassed at having forgotten it.

Feynman looked at this big machine, and he said, "How much does this cost?" The man said, "Thirty-seven million dollars," or whatever it was.

And Feynman said, "You don't trust me?"

\-- excerpted from "No Ordinary Genius" by Christopher Sykes

</comment><comment><USER7> Why? [http://www.youtube.com/watch?v=MO0r930Sn_8&NR=1](http://www.youtube.com/watch?v=MO0r930Sn_8&NR=1)

</comment><comment><USER8> You can see better quality feynman here in the BBC archives: <http://www.bbc.co.uk/archive/feynman/>

It maybe for brits only though... I'm sure there are ways around that.

</comment><comment><USER9> "I've got to stop somewhere, and leave you something to imagine <giggle>."

A humbling exhortation, if ever there was one.

I loved reading his lectures (as opposed to the classes I was in) because he was interested in getting to the 'what's going on', not the 'here's the equation to know.' One of his autobiographies talks about his frustration in this area when he was talking about polarized light at a university outside the US. They had spent all day talking about polarized light in the classroom, but nobody could predict or explain what was going on when he took two polarized filters and stacked & rotated them.

<http://www.youtube.com/watch?v=MO0r930Sn_8>

That's a phenomenal video of him explaining how to ask questions. And does a great job explaining that, "Why?" questions aren't very good questions, without a context. And goes from there to 'everyday QED' with elegance and grace.

</comment><comment><USER10> Feynman's explanation of where a tree gets its mass starts here: <http://www.youtube.com/watch?v=N1pIYI5JQLE#t=2m12s>

</comment><comment><USER11> Without detracting from Feynman's genius, it is striking how simple physics is in comparison to biology.

<comment><USER12> Biology is just a layer of abstraction on top of physics. It's turtles all the way down...

<comment><USER11> what do you mean?

<comment><USER13> Turtles all the way down: <http://en.wikipedia.org/wiki/Turtles_all_the_way_down>

Fields arranged by purity: <http://xkcd.com/435/>

<comment><USER11> Where does evolution by natural selection fit into that xkcd:Purity sketch?

</comment></comment></comment></comment></comment><comment><USER14> Wish these videos were captioned.

</comment><comment><USER15> Thankfully since we've captured parts of Feynman in the form of writing, audio and video, even though he has died he will in all likelihood be teaching people for centuries more into the future. How awesome is that.

</comment><comment><USER16> The sound is too low for me to hear. Anyone know a cool trick to make things louder? I'm using Leopard.

<comment><USER17> Uh, I wouldn't know about Leopard; but Ubuntu can apparently go to "11". (<http://i.imgur.com/8E7Wx.jpg>)

</comment></comment><comment><USER18> They go to tree church on Sunday, duh.</comment>


Yellowstone National Park's Sound and Video Libraries - <AUTHOR> https://kottke.org/19/10/yellowstone-national-parks-sound-video-libraries-are-free-for-anyone-to-use <comment><USER2> Very cool stuff! I highly recommend that everyone visit Yellowstone, at least once in their life.

It's hard to believe a place so beautiful actually exists.

<comment><USER3> What would be the best time to visit YNP? I have a long vacation coming up in Nov - Dec and would like to visit though I am not sure if Winter would be a good season to visit. Any tips?

<comment><USER4> You may be interested in this lovely visualization:

[http://jordan-vincent.com/night-under-the-stars](http://jordan- vincent.com/night-under-the-stars)

It shows that Nov-Dec in Yellowstone has the lowest number of visitors in any type of accomodations. Also, average temperatures under 50F/10C for most of November and all of December - and those months will not have a winter's worth of snow base slowly melting off as it would in March, they'll just be cold.

Take that as you will: either the busy park will be blissfully quiet and it's a great time to go, or a lot of people think it's a bad time to visit.

Looks like Joshua Tree, CA and Big Bend, TX are more popular parks in those months.

<comment><USER5> Those are good months for the low desert in general. Good time of the year for Death Valley. The South Rim of the Grand Canyon is also nice in December IMO although there may well be some snow and it will be chilly on the rim. (Though mostly getting late in the year for the higher canyonlands parks.)

</comment></comment></comment></comment><comment><USER6> Dawn Chorus [https://www.nps.gov/yell/learn/photosmultimedia/sounds- dawnc...](https://www.nps.gov/yell/learn/photosmultimedia/sounds- dawnchorus.htm)

Coyotes Howl [https://www.nps.gov/yell/learn/photosmultimedia/sounds- coyot...](https://www.nps.gov/yell/learn/photosmultimedia/sounds-coyote.htm)

Wildfire [https://www.nps.gov/yell/learn/photosmultimedia/sounds- fire....](https://www.nps.gov/yell/learn/photosmultimedia/sounds-fire.htm)

<comment> d-sc I live in Montana - Coyotes howling are a bit spookier when they are outside your window. :)

</comment></comment><comment><USER7> This will be great for ambient music producers on bandcamp.

</comment><comment><USER8> This is amazing for relaxation as well. There are some tracks in there with a lot of rain as well as stream sounds. Very soothing.

</comment><comment><USER9> grizzly bear vocalizations: [https://www.nps.gov/yell/learn/photosmultimedia/grizzlysound...](https://www.nps.gov/yell/learn/photosmultimedia/grizzlysounds.htm)

pretty disappointed that no owl recordings were posted..</comment>