How to take over the computer of a Maven Central user - <AUTHOR> http://blog.ontoillogical.com/blog/2014/07/28/how-to-take-over-any-java-developer/ <comment><USER3> At Open Whisper Systems, we wrote a small open source gradle plugin called "gradle-witness" for this reason. Not just because dependencies could be transported over an insecure channel, but also because dependencies could be compromised if the gradle/maven repository were compromised:

[https://github.com/whispersystems/gradle- witness](https://github.com/whispersystems/gradle-witness)

It allows you to "pin" dependencies by specifying the sha256sum of the jar you're expecting.

<comment><USER4> That's interesting, doesn't Maven offer a checksum option to begin with? I feel like just the other day, someone was saying "who ever uses checksums anyway," but a package manager run over insecure methods seems like the perfect time to do so.

<comment><USER5> From the article:

> When JARs are downloaded from Maven Central, they go over HTTP, so a man in > the middle proxy can replace them at will. It's possible to sign jars, but > in my experimentation with standard tools, these signatures aren't checked. > The only other verification is a SHA1 sum, which is also sent over HTTP.

<comment><USER4> I agree that they aren't checked by default, you'd need to implement it (as the parent commenter seemed to be doing with their gradle plugin). Regarding the sums being sent over HTTP as well, seems that you'll need a checksum for your checksum. Ultimately, though, it just seems that it'd be best to avoid this while it's over HTTP.

</comment></comment></comment></comment><comment><USER6> For Leiningen at least the goal is eventually to be able to flip a switch that will make it refuse to operate in the presence of unsigned dependencies. We're still a ways away from that becoming a reality, but the default is already to refuse to deploy new libraries without an accompanying signature.

Edit: of course, the question of how to determine which keys to trust is still pretty difficult, especially in the larger Java world. The community of Clojure authors is still small enough that a web of trust could still be established face-to-face at conferences that could cover a majority of authors.

The situation around Central is quite regrettable though.

<comment><USER7> Leiningen also uses Clojars over HTTPS by default, I believe, so even without a web of trust, Clojars is still more secure than Central.

<comment><USER6> Technically true, but practically this doesn't mean anything.

No one uses Clojars on its own, so if an attacker were able to perform a MITM attack, they could inject a spoofed library into the connection to Central even if the library should be fetched from Clojars.

</comment></comment></comment><comment><AUTHOR> It's not specifically named in the article, but the software shown with the firewall popup is Little Snitch, and it's great:

[http://www.obdev.at/products/littlesnitch/index.html](http://www.obdev.at/products/littlesnitch/index.html)

</comment><comment><USER8> The project to offer ssl free to every user of Maven Central is already underway. Stay tuned for details.

<comment><USER9> Author here.

Brian are you speaking as a representative of Sonatype, or are you a 3rd party?

<comment><USER8> As a representative of Sonatype.

The reality of cross build injection has been discussed for many years, I even linked to an XBI talk in my blog post announcing the availability of SSL.

The reality is that prior to moving to a CDN, it was going to be pretty intensive to offer SSL on the scale of traffic we were seeing. The priority at that time was ensuring higher availability and providing multiple data centers with worldwide loadbalancing.

On our first CDN provider, they could not perform SSL certificate validation and thus were themselves susceptible to a MITM attack. So the decision at that point was to run SSL off of the origin server. We wanted to make it essentially free but wanted to ensure that the bandwidth was available for those that cared to use it, hence the small donation.

The situation is different today with our new CDN, they can validate the certificates all the way through and that's how we intend to deploy it.

We won't be able to enable full https redirections for all traffic since this would cause havok in organizations that are firewall locked and for tools that don't follow redirects. Each tool would need to adopt the new url. I've already suggested this change occur in Maven once we launch.

<comment><USER10> I am not familiar with Sonatype and what relation it has with maven, but have you considered adding BitTorrent protocol to maven? This might help reduce traffic considerably.

</comment></comment></comment></comment><comment><USER11> SSL would have partially mitigated this attack, but it's not a full solution either. SSL is transport layer security -- you still fully trust the remote server not to give you cat memes. What if this wasn't necessary? Why can't we embed the hash of the dependencies we need in our projects directly? That would give us end-to-end confidence that we've got the right stuff.

This is exactly why I built mdm[1]: it's a dependency manager that's immune to cat memes getting in ur http.

Anyone using a system like git submodules to track source dependencies is immune to this entire category of attack. mdm does the same thing, plus works for binary payloads.

Build injection attacks have been known for a while now. There's actually a great publication by Fortify[2] where they even gave it a name: XBI, for Cross Build Injection attack. Among the high-profile targets even several years ago (the report is from 2007): Sendmail, IRSSI, and OpenSSH! It's great to see more attention to these issues, and practical implementations to double- underline both the seriousness of the threat and the ease of carrying out the attack.

Related note: signatures are good too, but still actually _less_ useful than embedding the hash of the desired content. Signing keys can be captured; revocations require infrastructure and online verification to be useful. Embedding hashes in your version control can give all the integrity guarantees needed, without any of the fuss -- you should just verify the signature at the time you first commit a link to a dependency.

[1] [https://github.com/polydawn/mdm/](https://github.com/polydawn/mdm/)

[2] [https://www.fortify.com/downloads2/public/fortify_attacking_...](https://www.fortify.com/downloads2/public/fortify_attacking_the_build.pdf)

<comment><USER12>
      Why can't we embed the hash of the dependencies we need
      in our projects directly?

There's a lot of stuff in Maven, like the versions plugin and the release plugin, to update dependencies to the latest version. This stuff is useful for continuous integration and automated deployment, especially when your project is split into lots of modules to allow code reuse.

With code signing, you can (or hypothetically could, I don't know if anyone does this) check the latest version is signed by the same key as the previous version - whereas just pinning the hash wouldn't allow that.

I agree pinning the hash is useful if the signing key is captured.

<comment><USER11> I typically find that in practice, strong links between a project and its dependencies are not a drawback.

If large amounts of your code change across different projects at the same time, those projects don't have a very stable API nor are the evidentally actually developing separately, so there's no major reason to pretend they are isolated or introduce a binary release protocol between them. Projects like this will probably find the greatest ease of operation by just sticking to one source repository -- otherwise, commits for a single "feature" are already getting smeared across multiple repositories, and stitching them back together with some hazy concept of "latest" at a particular datetime isn't helping anyone.

The biggest indicator of over-coupled projects that are going to face friction is when ProjectCore depends on ProjectWhirrlyjig, but the Whirrlyjig test code still lives in ProjectCore. This tends to make it very difficult to make releases of ProjectWhirrlyjig with confidence, since they won't be tested until getting to ProjectCore. If projects are actually maintaining stable features on their own in isolation, this shouldn't be what your flow looks like.

Projects that _are_ well isolated generally don't seem to have a hard time committing to stable (if frequent) release cycles. Furthermore, it actually encourages good organizational habits, because it actively exerts pressure against making changes that would cross-cut libraries or make it difficult to create tests isolated to a single project.

In contrast, tools that regularly update to "the latest" version invariably seem to bring headaches down the road.

Getting "the latest" is ambiguous. It means that your build will not be reproducible in any automated way, whether it's one week or one hour from now. It's a moving target. Can you do a `git bisect` if something goes wrong and you need to track down a change?

Getting "the latest" also doesn't take into account branching. This is something a team I'm currently on is poignantly aware of: feature branches are used extensively, and when this concept spans projects, we found "latest" ceases to mean anything contextually useful.

If you're working on projects where a CI server is actually part of the core feedback loop (say your test suite has gotten too unwieldy for any single developer to run before pushing), then a fetch "latest" can be helpful to enable this during development. But even if jenkins informs you the build is green, it's important to remember this won't be reproducible in the future; you should make an effort to get back to precisely tracked dependencies as soon as possible.

mdm deals with this by letting you use untracked versions of your dependency files... but it will consistently _show that_ in `git status` commands, so that you A) _know_ that your current work isn't reproducible by anyone else and B) everyone is encouraged to make an effort to get back on track ASAP.

</comment></comment></comment><comment><USER13> Perhaps as a stopgap Maven Central (or a concerned third party?) could publish all of the SHA1 hashes on a page that is served via HTTPS. This would at least allow tools to detect the sort of attack described in the article.

</comment><comment><USER14> This is a horrible policy made by sonatype. A better alternative of mavencentral should be created...

<comment><USER15> It is not the fault of Sonatype. We should not trust Central right away. If I worry about malicious artifacts from Central, I must host my own repository and manage artifacts myself. And that way, I can just map other repositories I trust more.

<comment><USER16> Trusting Central > Trusting everyone on the network path between you and central.

</comment></comment></comment><comment><USER17> Evilgrade ([https://github.com/infobyte/evilgrade](https://github.com/infobyte/evilgrade)) is a similar tool that works on a wider variety of insecure updaters. Perhaps a module could be written? Maybe one already exists, I haven't played with it in a while

</comment><comment><USER18> I'm torn on how I feel about security being a paid feature in this case. Here the onus is being placed on the user, yet many won't be conscious of the choice they're making.

The _tiff_ mentioned in the article was interesting to read. > [https://twitter.com/mveytsman/status/491298846673473536](https://twitter.com/mveytsman/status/491298846673473536)

<comment><USER19> There's two problems with this that I see. The first is, as you said, that a lot of people won't even realize they need to pay for secure downloads.

I also feel like in the case of something like a package manager, this potentially harms the wider community in ways that charging for features in a specific piece of software doesn't.

<comment><USER6> Technically paying for an auth token is not sufficient. The token cannot be used directly by Maven or Leiningen, but only by a Nexus proxying repository manager. Not a big deal if you work at a professional Clojure shop, but a huge hassle if you're freelance or just getting started.

</comment></comment></comment><comment><USER20> Exposing your users to MITM attacks in order to encourage donations? Pure evil.

<comment><USER21> That's a little paranoid. Let's see, we'll completely ruin our rep and our core business activity just so you're forced to donate--not to us, but to this open source group over here. Dude, put down the pipe.

<comment><USER22> Isn't it exactly what they are doing, though? The only reason you would want HTTPS is to prevent MITM attacks. By making it a premium feature, they are making MITM attack mitigation a premium feature.

</comment></comment></comment><comment><USER23> My main experience with Maven has been downloading some source code, and having to use Gradle to compile it. It went and downloaded a bunch of binaries, insecurely. There were no actual unsatisfied dependencies; it was just downloading pieces of Gradle itself.

I would've much rather had a Makefile. Build scripts and package managers need to be separate.

<comment><USER5> > Build scripts and package managers need to be separate.

This. Especially when there's broken links, you're gonna have a bad (and long) time.

</comment></comment><comment><USER24> jCenter is the new default repository used with Android's gradle plugin, I haven't used it myself yet but it looks like the site defaults to HTTPS for everything: [https://bintray.com/bintray/jcenter](https://bintray.com/bintray/jcenter)

<comment><USER25> Full disclosure - I am a developer Advocate with JFrog, the company behind Bintray.

So,jcenter is a Java repository in Bintray ([https://bintray.com/bintray/jcenter](https://bintray.com/bintray/jcenter)), which is the largest repo in the world for Java and Android OSS libraries, packages and components. All the content is served over a CDN, with a secure https connection. JCenter is the default repository in Goovy Grape ([http://groovy.codehaus.org/Grape](http://groovy.codehaus.org/Grape)), built- in in Gradle (the jcenter() repository) and very easy to configure in every other build tool (maybe except Maven) and will become even easer very soon.

Bintray has a different approach to package identification than the legacy Maven Central. We don't rely on self-issued key-pairs (which can be generated to represent anyone, actually and never verified in Maven Central). Instead, similar to GitHub, Bintray gives a strong personal identity to any contributed library.

If you really need to get your package to Maven Central (for supporting legacy tools) you can do it from Bintray as well, in a click of a button or even automatically.

Hope that helps!

<comment><USER26> You mention both Bintray and Groovy. Look at the Bintray download stats for Groovy [1] and it reports 170,000 downloads in the past month. But 100,000 of them happen on just 6 days, 40,000 of those on just 1 day (18 July). Click on country and see that 120,000 of them came from China. Comparing the numbers suggests 100,000 downloads of Groovy from Bintray during July were faked. Another 900,000 downloads of Groovy were faked during April and May. I'm not sure I trust JCenter when the 2 technologies you recommend for it have together been used to fake _one million downloads_.

[1] [https://bintray.com/groovy/maven/groovy/view/statistics](https://bintray.com/groovy/maven/groovy/view/statistics)

[2] [http://groovy.codeplex.com/wikipage?title=Blog07#2](http://groovy.codeplex.com/wikipage?title=Blog07#2)

<comment><USER25> I am not sure how the fact that Bintray is DDOSed from China (and still fully operational without any interruption) dismisses your trust in Bintray.

I am also not sure how you figured out those are fake downloads. For sure the script that DDOSes Bintray from China won't use Groovy, but it's a still a valid download. Not for showcasing how popular Groovy is (they factor out those things when talking about the numbers), but for the raw statistics - <USER2> sure. The file was downloaded, wasn't it?

Please elaborate?

</comment></comment></comment></comment><comment><USER27> The biggest problem with this policy is that new users, or even experienced ones, are likely not aware of it. This is a very serious problem that should be addressed quickly.

edit: and with websites everywhere routinely providing SSL, it seem crazy that it has to be a paid feature for such a critical service.

<comment><USER28> Funny thing is that CERT doesn't have a problem with shenanigans like this. They are more concerned with buffer overflows than by-design stupidity.

</comment></comment><comment><USER29> So in principle, it's doing the same thing as:

        $ curl http://get.example.io | sh

which we all know is bad. But in this case, it's hidden deep enough that most people don't even know it's happening.

<comment><USER30> Downloading from HTTP is not an issue (as far as integrity is concerned) if maven were to validate the downloads against some chain of trust. But apparently it is not.

Now I am wondering what tool actually uses those .asc files that I have to generate using mvn gpg:sign-and-deploy-file when I upload new packages to sonatype...

<comment><USER6> Running `lein deps :verify` does this.

<comment><USER31> How does it know what the correct signing key is?

edit: Looked up answer myself. Lein downloads whatever key the signature claims to be made with from public keyservers. How does this provide any additional security over not bothering to verify signatures?

<comment><USER6> The difference is that you could track down the keys either directly from the author or by someone who has already personally verified and signed the author's key. In practice this is very difficult, and using a key that you haven't gotten your friends and co-workers to sign is not any better than skipping the signing altogether.

<comment><USER31> Even if you have carefully installed the correct key from the author, if your download is intercepted and an attacker sends you a bogus artifact and signature it looks like Lein will just retrieve the attackers key from the keyserver and validate the signature.

<comment><USER6> This is true; at the time of implementation so few Clojure libraries were signed that taking it the rest of the way was not a clear win.

But clearly the job isn't finished; even if Clojure developers do a good job of signing packages and signing each others keys, (which is not generally true today) it still needs to distinguish between signed packages and trusted packages. Hopefully the next version can add this. But as with anything that requires extra steps from the developer community, a thorough solution is going to take time.

</comment></comment></comment></comment></comment></comment></comment><comment><USER32> All of Maven central is only 180gb, according to [https://maven.apache.org/guides/mini/guide-mirror- settings.h...](https://maven.apache.org/guides/mini/guide-mirror- settings.html)

How hard would it be to just mirror it to S3 and use it from there via HTTPS?

<comment><USER6> > How hard would it be to just mirror it to S3 and use it from there via > HTTPS?

Trivial.

Now ask: how hard would it be to pay the bandwidth charges, assuming it were a public bucket. I don't know the answer, but it's a much more interesting question.

<comment><USER32> Yes, a very interesting question. It'd be very expensive.

It occurs to me that BitTorrent technically solved the problem of high bandwidth costs long ago; millions of people transfer 1.1TB files around every day without worrying about bandwidth costs at all.

Can we come up with a similar system for jars? Why are we still relying on central servers for this at all?

</comment></comment></comment><comment><USER33> If I understand this correctly, maven based builds can contain dependencies on libraries hosted on remote servers. golang build system has (or had) something similar too. Witnessing this trend take hold is astonishing and horrifying in equal parts. Not just as a security problem (which is clearly obvious) but also a huge hole in software engineering practices. How can anyone run a production build where parts of your build are being downloaded from untrusted third party sources in real time? How do you ensure repeatable, reliable builds? How do you debug production issues with limited knowledge of what version of various libraries are actually running in production?

<comment><USER34> It's fairly easy to setup a local server containing all your jars and still use maven or ivy. I do that at my current employer.

<comment><USER33> But in that case why maintain two separate repositories? One for "our code" and one for external. I'm assuming the code in these repositories is open source... right? Why not simply check in the version to be used right in your local SCM?

<comment><USER16> There are a bunch of different SCMs. It's nice to decouple "hold released builds at specific versions" from your general development repository.

</comment></comment></comment></comment><comment><USER35> npm has the same problem of sending packages over http, but it's even worse since on average each node package uses about a billion other packages and because injecting malicious code in JavaScript is incredibly easy.

And to be clear, just http here is not the issue. It's http combined with lack of package signing. apt runs over http, but it's a pretty secure system because of its efficient package signing. Package signing is even better than https alone since it prevents both MITM attacks _and_ compromise of the apt repository.

In fact, apt and yum were pretty ahead of their time with package signing. It's a shame others haven't followed their path.

<comment><USER36> npm by default uses HTTPS, and has for more than 3 years. It's a little confusing because the loglines all say "http" in green, but if you actually look at the URLs being downloaded they are all to [https://registry.npmjs.org/](https://registry.npmjs.org/)

</comment></comment><comment><USER37> I wrote a Maven plugin to avoid this.

It's available under MIT licence: [https://github.com/gary- rowe/BitcoinjEnforcerRules](https://github.com/gary- rowe/BitcoinjEnforcerRules)

</comment><comment><USER28> luarocks has the same problem. You don't need SSL, you need the packages to be signed.

</comment><comment><USER38> I wonder how many enterprise apps have been backdoored through this flaw over the years by now.

<comment><USER28> I'd immediately backdoor the rt.jar and the compiler so that future binaries have the backdoor. Trusting trust ...

</comment></comment><comment><USER39> Sorry to nitpick, but you might wanna fix this typo: s/pubic/public :)

</comment><comment><USER40> Yeah have you ever wrote code on the play platform? There is your proof of concept at least on earlier versions static injection using annotations ... It's also how spring works and almost all dynamic ... Hell you can jit your code don't even need to compile it into a class the run time can do it for you ... That why I always compile my jar files so they can't be read as a compressed file anyway pretty cool sounds like you could have a lot of fun with someone doing this ... You could turn there computer into anything you want using Java command line functionality .... I.e. System.get(os.name) if windows do this if OS X do this if lunix do this using Java.lang.runtime.exec then after you open the back door to there computer time for socket connections and getoutputstream etc... Anyway point being java is a cross platform lang so there is a world of possibilities and most of the time they are running this from an IDE so if you inject a sudo call who knows what could happen

</comment><comment><USER41> The vulnerability even has a name: Cross-build injection attacks. I wrote about it some time ago [1], [2]. The complete answer includes verifying the (now mandatory) PGP signatures [3] of artifacts in Maven Central. But you need a web-of-trust for that and the whole process is rather impractical currently.

[1] [http://branchandbound.net/blog/security/2012/03/crossbuild-i...](http://branchandbound.net/blog/security/2012/03/crossbuild- injection-how-safe-is-your-build/) [2] [http://branchandbound.net/blog/security/2012/10/cross- build-...](http://branchandbound.net/blog/security/2012/10/cross-build- injection-in-action?src=archive) [3] [http://branchandbound.net/blog/security/2012/08/verify- depen...](http://branchandbound.net/blog/security/2012/08/verify-dependencies- using-pgp/)

<comment><USER42> Instead of going WOT, why not just get a specific SHA hash, instead of a specific version?

<comment><USER41> Sure, you could obtain a hash out-of-band and pin to that. Not much more convenient given you have to do it for all transitive dependencies and Maven- plugin dependencies as well.

</comment></comment></comment><comment><AUTHOR> Thanks to whomever changed the title; I didn't like the original title, but couldn't come up with a better accurate one.

</comment><comment><USER43> This is indeed a problem that needs to be addressed at some point. The MITM possibility has been mentioned before at SE [http://stackoverflow.com/questions/7094035/how-secure-is- usi...](http://stackoverflow.com/questions/7094035/how-secure-is-using-maven)

</comment><comment><USER44> So if they need some money, what is a better revenue model for them?

\- charge some token amount of money to projects (harms the ecosystem, probably not a good idea)

\- charge some amount for projects to host old versions, or for users to access old versions (same idea as the first, just less so)

\- charge for access to source jars

\- paid javadoc hosting

\- rate-limiting for free users (the "file locker" model; particularly effective at convincing people sharing an office IP into paying up)

Any others?

<comment><USER9> They claim the money is a donation to a open source software project, so they don't even need the money.

</comment></comment><comment><USER45> For those of you in the Python world concerned about such a thing, check out Peep: [https://pypi.python.org/pypi/peep](https://pypi.python.org/pypi/peep)

It's a pip wrapper that expects you to provide hashes for your dependencies in requirements.txt.

There was a lightning talk at PyCon this year, it seems super easy to use (though admittedly I'm not using it regularly yet).

</comment><comment><USER46> The problem goes deeper. That firewall (Little Snitch) updates itself over port 80, so most likely unencrypted.

</comment><comment><USER47> > When can this happen? If you ever use a public wifi network in a coffee shop

Just don't do this. There is no such thing as a free lunch (or wifi).

<comment><USER48> I do it. I always thought, "What's the harm? Everything important is over SSL these days". Apparently not!

</comment></comment><comment><USER49> What firewall is that? Looks nice.

<comment><USER50> [http://www.obdev.at/products/littlesnitch/index.html](http://www.obdev.at/products/littlesnitch/index.html)

</comment></comment><comment><USER51> We store jars in git repo...

</comment><comment><USER52> I understand the need to raise money for projects, but the attitude[1] that security is an optional "premium" feature needs to end.

It should be no different from shipping broken code. You can't just say, "oh, well we offer a premium build that actually works, for users that want that." Everybody needs it.

Evernote made this mistake initially when SSL was originally a premium feature. They fixed it.

Granted, there are degrees of security but protection from MITM attacks is fundamental. (Especially for executable code!)

[1] [https://twitter.com/mveytsman/status/491298846673473536](https://twitter.com/mveytsman/status/491298846673473536)

UPDATE: @weekstweets just deleted the tweet I was referencing where he described security as a premium feature "for users who desire it" or words to that effect.

<comment><USER53> But will users in aggregate pay more when extra effort and resources are expended on security? Will you?

If the answer is no, then the smart developer has no financial incentive to do so, and every reason to segment security out as a premium feature.

Maybe MITM vulnerability counts as broken code. But as always, markets win. I don't think the status quo will change until users consider security assurances worth hard dollars.

<comment><USER52> By that logic, smart developers have no financial incentive to fix bugs unless it's for a paid upgrade.

Think through that a little more and I think you'll find there is long-term ROI in the form of customer trust and goodwill. You'll buy the product because it works and won't hurt you, and basic security should be part of "won't hurt you".

<comment><USER54> >> By that logic, smart developers have no financial incentive to fix bugs unless it's for a paid upgrade.

Right! And that's actually a valid model. Ask HP about what it'll cost to upgrade the firmware on your enterprise server..

<comment><USER52> It's valid, but the claim was that it's the _only_ valid model for smart developers, which is false.

</comment></comment></comment></comment></comment><comment> foo-licious It's java who cares?</comment>


Successful Innovators Don't Care About Innovating - <AUTHOR> http://blogs.hbr.org/2014/10/successful-innovators-dont-care-about-innovating/

<comment><USER2> This is rather obvious. It is like saying, people who are at point A and are trying to get to point B don't care about traveling, it's a byproduct. Innovation isn't an end, it is a means, typically applied to complex or difficult problems.

</comment><comment><USER3> "Innovating is a byproduct."

Extremely simple but powerful phrase.</comment>


Fixers Know What "Repairable" Means – Now There's a Standard for It - <AUTHOR> https://www.ifixit.com/News/35879/repairability-standard-en45554 <comment><USER2> Now that this is a standard, I'd hope that e.g. public institutions (but also enterprises, in an attempt to present themselves as sustainable) start adjusting their internal rules for office equipment.

"Any device bought for operation in our company must be category B or above" is quite a bit easier to verify than "it should kinda be repairable..."</comment>


Merg.io: API first code merge tool - <AUTHOR> http://merg.io/ <comment><USER2> Probably you should explain why this is better than, let's say, just invoking kdiff3 unattended ;-)

<comment><USER3> kdiff3 doesn't have semantic capabilities, AFAIK.

And I suppose you can invoke the API from anywhere, without depending on a kdiff3 installed (or any other tool installed locally).

<comment><AUTHOR> That's it. Call it programatically from your machine regardless of having anything installed.

</comment></comment></comment><comment><USER3> It says C / Java will be supported. Any plans to support more languages in the future?

<comment><AUTHOR> Yeah more are coming. JSON/Js for example.</comment></comment>


Against Camel Case - <AUTHOR> http://www.nytimes.com/2009/11/29/magazine/29FOB-onlanguage-t.html <comment><USER2> Despite what you might expect, there is actually a fascinating article behind this poorly-titled link; it starts at the fifth paragraph.

</comment><comment><USER3> It might be folly to try to argue with language anti-evolutionists, but when spacing was added to scripts (according to the author, most recently during the middle ages), minuscule and majuscule were not consistently used at the beginning of sentences. One could make the point that we only really need spacing OR case differences, and don't need both.

<comment><USER4> Indeed, Paul Saenger, the scholar I quote in the article, writes that during the transitional period, capitals were sometimes used to mark word boundaries in run-together text. Unexpectedly, though, the last letter of a word was more often capitalized than the first.

<comment><USER5> I'm not sure whether you're aware of this, but many older scripts, including all of the Semitic scripts, actually write letters entirely differently when they appear at the end of a word. Given that the monks who began employing majuscule and minuscule would surely have been familiar with Hebrew script, I'm hardly surprised they initially went to making the last letter significant instead of the first.

<comment><USER6> Not all Hebrew letters are different when they appear at the end of a word, just 4 out of 22 letters (if I remember correctly) do.

<comment><USER7> It's true of Arabic, though; see <http://en.wikipedia.org/wiki/Arabic_alphabet#Primary_letters>.

</comment></comment></comment></comment></comment><comment><USER8> _[In the New York Times] Thereafter every brand name was permitted up to three idiosyncratic majuscules._

Um, what? It's a brand name. Either you render it correctly, or you don't; there are no typographic decisions to be made unless you're committed to mangling it in the first place, right?

<comment><USER9> A press release from a typical company will throw as much glitter on their own brand name as possible, and usually butcher the surrounding language a bit too:

"the new FRISBEE [TM] brand Flying Disk..."

If a writer takes this literally, a copy editor has to tone it down or else the brand name will dominate the article text and make it look like an ad, too: "It's a Frisbee." Fun variants include meaningless alternating caps, or a single lowercase 'i' inside an otherwise all-caps word.

Newspapers want to use the brand name, not the logo or an ASCII attempt at one; and in decades past, fixing the caps helped comprehension rather than hurting it. They considered capitalization part of presentation, not content. (Shouldn't a brand name survive an all-caps typeface?)

<comment><USER10> In the USA you can't use the brand name as a noun, or the owner risks losing legal control over the mark. Hence "FRISBEE [TM] brand Flying Disk."

<comment><USER9> Only if it's used casually as a generic term. Keeping it uppercased proper noun (Frisbee) respects the trademark as far as the law is concerned, so that was the Associated Press guideline. Adding [TM] lets the owner emphasize that the trademark was applied for, (R) means it's fully registered, but neither symbol is required for mentioning the brand in print -- just simple capitalization is enough to respect the trademark.

</comment></comment></comment></comment><comment><USER11> I won't go as far as the author but I think camel cased names are going to look pretty dated in the future.

As Ken MacLeod put it in "The Star Fraction", written in 1995 and set in the mid-twenty first century:

"The name [FreeSpace] had once seemed trendy, but now dated us painfully - 'very TwenCen', as I'd overheard someone say..."

<comment><USER12> > As Ken MacLeod put it [...]

Ironic name, don't you think?

</comment></comment><comment><USER13> This is infuriating coming from the Times. Are they similarly disgruntled with FedEx? AmEx? Camel-case capitalization is used to create enforceable trademarks. It is the unfortunate truth that legally enforceable trademarks have to be substantially not generic, and this leads itself to quirky names like Kleenex and ex-lax.

This is particularly bothersome: "I could print it here to show you, but I refuse to allow my prose to be so disfigured." Camel-case names are not Voldemort; you should not talk about not talking about them. If Cain is so concerned, he should do the simple thing and call it a mobile phone, or a music player.

This is journalistic drivel, and tarnishes my opinion of the Times.

<comment><USER14> Columns are the words of their author, not the newspaper. They don't necessarily agree with the opinions of the paper.

On the same note, columns aren't news items or reports. They are opinion pieces. To call it "journalistic drivel"—or "journalistic" at all—is unjustified.

Columns are meant to give opinions. It's not unusual to see columns written with the intent of giving an opinion that's opposite to the one held by average readers. The opinion of the newspaper's editors is usually given in the editorial.

<comment><USER13> > To call it "journalistic drivel"—or "journalistic" at all—is unjustified.

You're right, and in retrospect I'm surprised that I used that word. These days I expect this sort of inane rant from someone's blog that I will ignore in the future, not "nytimes.com". Maybe blogs have made opinion columns irrelevant? I can see how papers might have been boring in the past, but today we have an infinite tap of ranting idiots... maybe the papers should stick to journalism?

</comment></comment></comment><comment><USER15> I always thought it was camelCase and PascalCase. Googling gives me a handful of articles that support that distinction, but wikipedia doesn't make the separation.

Is the term PascalCase widespread, or does everyone just call it CamelCase?

<comment><USER10> I'd once heard the difference described as BactrianCase and dromedaryCase :)

</comment></comment><comment><AUTHOR> An online bibliographical supplement: [http://www.steamthing.com/2009/11/the- kneecapping-of-interca...](http://www.steamthing.com/2009/11/the-kneecapping- of-intercapping.html)

<comment><USER16> I much prefer William Safire's treatment linked from that bibliography: [http://www.nytimes.com/1997/07/20/magazine/jammedtogether- na...](http://www.nytimes.com/1997/07/20/magazine/jammedtogether-names- inc.html)

Safire seems to treat the whole thing with a sense of playfulness and levity, as if he realizes that the very purpose of a language is to evolve. Crain's article is preachy and disdainful- he might as well shoo us with a broom and tell us to get off his lawn.

<comment><USER17> The tone you call 'preachy and disdainful' I find humorous and self-aware. Likewise the conceit of refusing to print any camel-case terms. "I could print it here to show you, but I refuse to allow my prose to be so disfigured": it's a parody of a grumpy-old-man routine. I assume he's sincere in his distaste for inner caps, but he plainly recognizes that it makes him sound like an old codger, and he's playing that up for comic effect.

<comment><USER16> That could be, and I certainly did a double-take when I saw this his blog is called "Steamboats are ruining everything." Still, at first blush, any winking and/or nodding was lost on me, and I usually pick up on that kind of stuff.

<comment><USER18> I thought it was pretty clear when he added the part about letting the dog sleep on the sofa.

</comment></comment></comment></comment></comment><comment><USER19> I guess he's grateful he's not German

<comment><USER20> Huh? Where are camel cases used in German?

<comment><USER21> They're not, but many german words run together. See <http://www.crossmyt.com/hc/linghebr/awfgrmlg.html> for humourous examples.

</comment></comment></comment><comment><USER14> Camel casing in brands can be confusing when writing.

Is it Paypal or PayPal? Microsoft or MicroSoft? Moneybookers or MoneyBookers? Macintosh or MacIntosh? Altavista or AltaVista? Wikipedia or WikiPedia? And so on, and so forth.

Some you can remember. Others may require you to look them up every time.

But well—we already have to worry about spaces and dashes, so I suppose worrying about one more thing isn't so bothersome.

<comment><USER22> The worst is the Walmart brand, which is controlled by Wal-Mart Stores, Inc. They use both forms in their communications depending on which is being referred to.

</comment></comment><comment><USER12> "Heresy became easier to communicate, and Saenger postulates that word spacing eventually made possible phenomena like irony, pornography and freedom of conscience."

</comment><comment><USER23> I've always associated Camel Case with Perl. So much so that I assumed the name derived from the Camel Book. But I suppose it's just were I first saw it used extensively.

Anyway this quote from the article sums up my feelings on both Camel Case and Perl.

"is regressive — in fact, medieval"

<comment><USER24> Actually perlstyle suggests avoiding Camel Case:

      While short identifiers like $gotit are probably ok, use
      underscores to separate words in longer identifiers.  It is
      generally easier to read $var_names_like_this than
      $VarNamesLikeThis, especially for non-native speakers of English.

</comment></comment><comment><USER25> It must be a _really_ slow day on Hacker News - how has this got four upvotes?

Really, seriously, can someone tell me why this is even the vaguest bit interesting or intellectually stimulating to them? I would honestly be interested in hearing an opinion other than mine.

<comment><USER26> Because we use camel case in programming, and we are curious what non programmers think of it.

<comment><USER25> Really? Do you _really_ care what non-programmers think of CamelCase? Why not ask them what they think of using braces, or indentation?

Clearly people think my question detracts from the value of HN because they're downvoting it, but to me it's worth it to investigate a place where the opinion of the "community" differs so radically from mine.

I have zero interest in finding out what people think of summation notation, or bra and ket notation, and, quite frankly, I find it inconceivable (and I _do_ mean that, unlike Vizzini) that programmers would care what non- programmers think about CamelCase.

Still, you're being up-voted, I'm being down-voted, so obviously people really are interested in that. I'm mystified, but I'll accept it as a data point.

ADDED IN EDIT after reading the comment by benatkin to the above:

I am genuinely surprised, confused and puzzled. I'll have to re-think my model of what the HN readers think satisfies PG's outline of "On-Topic":

        Anything that good hackers would find interesting ...
        gratifies one's intellectual curiosity.

I'm going away to ponder the response, feeling somewhat bruised and punished by the "community" I thought I understood and felt at home in.

<comment><USER27> _feeling somewhat bruised and punished_

Let go of that like you drop a filthy sock! Think of it this way: If you _never_ disagree with what others put on the front page, how often are you going to be truly surprised? How often are you going to read something that you didn't know you liked until you clicked on it?

I like to think that a certain number of articles I detest is a necessary complement to enjoying a certain number of "Wow, I'd never thought of that" moments on HN.

I hope that perspective helps you shrug off the odd time you get downmobbed for calling out an article that doesn't "gratify your intellectual curiosity."

<comment><USER25> Thank you for taking the time to reply, and I agree with the points you make. I do expect to be surprised occasionally by the articles that make the front page. I do expect there to be articles I hate, and continue to hate after reading them, and I do expect that there are articles for which I change my mind and learn something.

What I didn't expect was for people to down-mod me heavily simply for expressing an opinion that was different to theirs. I thought people would ignore or reply. I have always regarded down-modding as reserved for things that don't belong here, and I thought legitimate questioning does belong here.

Clearly I was wrong. The conclusion is that people down-mud me purely because they disagreed, and couldn't be bothered to articulate their reasons. That's why I'm disappointed, and feeling set upon.

I had hoped and expected that people would value contributions, even if the opinions expressed differed from their own. I thought the article was a complete waste of time, said so, and honestly asked why people thought otherwise. For that I got hammered.

I'm disappointed.

It won't stop me from reading and contributing, but it has made me stop and reconsider some things. I'll certainly be less open and more wary.

<comment><USER28> I voted your post down because you were rude and condescending. Here's an another (more respectful) way in which you could have written your post:

"I see that this story has a lot of upvotes, but it's not a story that I found particularly interesting. Could someone give me their perspective on why they liked this article?"

You also did what is often done to a large number of articles posted to HN: You asked a variant of "why is this hacker news?!," the answer to which is always the same: "because X number of people found that it gratified their intellectual curiosity and voted it up." It gets old after a while, but I personally wouldn't object to someone repeatedly asking the question as long as they were respectful and truly interested in the response rather than asking it as a way to complain.

<comment><USER25> Hmm. If you found that rude and condescending - and I don't doubt your word - then I'm rather pleased I didn't write what I first thought, and instead toned it down to what I thought was comparatively constructive. Obviously not by enough.

I'll take your comments on board - thank you for taking the time to explain.

<comment><USER29> I agree with sounddust (I can't just upvote, because my upvotes aren't registering). Although I personally wasn't offended by your attitude (I've gotten used to people having that attitude on HN), your comment was objectively prejudicial: "even the vaguest bit interesting". Not neutral or impartial, which are ideals of the intellectual gratification you seek here...

My personal response is to reply factually, simply ignoring the tone in a comment, as the guidelines imply (with the "2+2=4" example) - and not to downvote unless it's egregious.

But maybe it's fortunate in the bigger scheme of things that you were downvoted - because of this feedback you got. Each little change improves the site as a whole.

BTW: I was thinking that net 2 downvotes, from 1 to -1 (and now 3 downvotes, to -2) is not indicative of the opinion of the community as a whole ... but given that many people vote to adjust a comment score to where they think it should be, maybe it is representative.

<comment><USER25> I've up-voted sounddust for you.

I come from a background where the ideas of neutral and impartial are independent of those of intellectual gratification. In mathematics one has strong opinions and can state them clearly, and in reply, people can tell you you're wrong without it being mistaken for a personal attack. I guess I just let that leak over into here - now being in business I usually keep it under wraps.

That's what I meant elsewhere when I said I would be less open. In future I won't be so blunt in my opinions, as am in math, and wrap them more, as I do in business.

We've done this to death I think - I really appreciate the feedback. Thanks.

<comment><USER29> Thanks! I don't want to prolong the agony - but I'm curious about about "neutral and impartial" vs. "intellectual gratification."

If one's opinions and emotions distort the facts, it is difficult to have intellectual gratification, because one cannot see clearly. To me, intellectual gratification requires absolute honesty, as in science (as Feynman says). In other words, the problem isn't that someone is offended, but that one's own vision is distorted.

Perhaps in mathematics this isn't so important because the mathematics itself is already impartial. :-)</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


Sendgrid customers beware - your site may have been removed from Google. - <AUTHOR>

Hello,
We are Sendgrid customer (whitelabel) and tonight we have received notification from Google that our site has been removed from the SERPS due to phishing. Quick examining revealed that CNAME we have pointed to Sendgrid server resolves to some weird site.
I am hoping that this gets resolved quickly - getting removed from Google is big deal for us.
I know there are lots of Sendgrid users on HN so I am hoping everyone is awake to deal with this issue :/ <comment><AUTHOR> This is the thread on Google Webmaster Forum. So far 2 customers affected:

[http://www.google.com/support/forum/p/Webmasters/thread?tid=...](http://www.google.com/support/forum/p/Webmasters/thread?tid=530ed76549167add&hl=en)

</comment><comment><USER2> Hi, this is Jacob, from the Support Team at SendGrid. We caught the phisher, and the URLs shouldn't be resolving any more. If you're seeing a URL that's still resolving, please email it to us at email@example.com If you can attach the whole original email file, that'd be fantastic too.

</comment><comment><USER3> I had an issue too. Sendgrid is responding well to this issue. They have been in constant communication with my team.</comment>


SVG Jigsaw Generation in Clojure - <AUTHOR> https://blog.bonnieeisenman.com/projects/clojure-puzzles/ <comment><USER2> When working on a jigsaw generation project a few years ago, I was surprised to find basically no resources describing the process of procedurally generating the "nubs". There isn't much to it, I suppose, but I had to tinker with my implementation for a bit before I got it looking (mostly) right. The nubs in the second example here are similarly just a little bit different than what you'd see on a brand-name puzzle. Definitely looking forward to checking out the clojure code for this.

Results here: [https://github.com/alanbernstein/pyzzle](https://github.com/alanbernstein/pyzzle). I guess I could write up a blog post with some diagrams on how that generation works, but there are so many TODO items in the code I'd rather work on first...

<comment><USER3> When I did this I just drew a bunch of different puzzle-piece edges, making sure that they all had corresponding Bezier control points (easiest way to do this is to draw one and then move the points around in the copies without adding or changing the types of any points), and then treated then generated linear combinations of these. Did you have a different way?

My goal was to cut a puzzle with two different solutions. It worked, but it turns out that a puzzle with two different solutions has many, many partial solutions (especially if you can't distinguish front from back!) and it's pretty frustrating!

<comment><USER2> I drew one archetypal shape, then add random noise to the spline control points for each instance. That means, to get the results looking right, I had to tweak the archetype, and the 2D noise variance, potentially separately for each point. I ended up with something reasonable, that looks a little off sometimes, and also never varies too far from the expected shape, like real puzzles do.

A tangent on the "multiple solutions" thing - some large commercial puzzles are (evidently) larger than the maximum die size, so they are cut with multiple copies of the same pattern. A 5000-piece puzzle might have four copies in a 2x2 grid.

</comment></comment></comment><comment><USER4> A bit off topic but I liked that you don't force the newsletter or recommended articles in your blog. The links are there and I can visit them if I like them, but I don't feel forced. This is the way it should be. Thank you!

<comment><USER5> The author is not the OP.

<comment><USER4> I know, but maybe the author comes around :)

</comment></comment></comment><comment><USER6> Very nice write-up! I'm surprised it was this simple (which is a compliment!), and I learned about "Whimsy pieces" :)

</comment><comment><USER7> When I've tried to cut a jigsaw with a laser, the kerf between pieces was too large and it fit together a little too loosely to have that satisfying "snap" when pieces came together.

Has anyone had/fixed that problem?

</comment><comment><USER8> > Add more curves and it gets even better!

Honestly, I think it looks better before adding more curves. :|</comment>


CUPP crams ARM inside of a MacBook Pro, makes it run Android with a button press - <AUTHOR> http://www.engadget.com/2011/02/14/cupp-crams-arm-inside-of-a-macbook-pro-makes-it-run-android-wit/ <comment><USER2> I would prefer if they just make a ARM laptop. Seriously, why aren't there any decent ARM laptops? I know there are a few ARM/MIPS laptops out there but they are all either old(new platforms are much more powerful) or comes locked.

<comment><USER3> _Seriously, why aren't there any decent ARM laptops?_

Because demand is extremely low? If it can't run a mass-market OS, anything you make is going to be an extremely niche product.

I like the idea of an Android laptop, but I wonder how well off-the-shelf Android applications would perform on a 16x9 landscape screen with a hardware keyboard and a hard-to-use touch surface.

<comment><USER2> I think Android is more optimized for touch-screen devices but I was hoping Chrome OS will bring more ARM laptops to the market. Now it seems like that's not gonna happen, but Windows 8 being ARM compatible should bring more ARM laptops to the market. Sadly that won't happen any time soon.

</comment></comment></comment><comment><USER4> Dell tried this with the LatitudeON feature which shipped in several variations on Latitude laptops. In their version, turning the ARM OS on automatically hibernated the Windows OS. In any case, for some reason, it has not caught on (Dell has also had trouble meeting shipping dates, as they are using a custom Linux distro from DeviceVM, rather than using Android). I almost bought a new Dell just for that feature, and in polling other business users whose machines had the feature in one form or another, I have yet to find someone actually using it. Poor marketing and perhaps targeted at the wrong market. One challenge is whether to power up the hard drive. If you leave it unpowered and just have the ARM and some RAM, you lose the ability to access data on the hard drive, but powering up the hard drive increases the power load materially.

<comment><USER5> > In any case, for some reason, it has not caught on

It's Dell. How passionate are people about new features in Dell products? I don't even know who Dell's CEO is. Dell is boring office stuff.

On the other hand, if Apple would have introduced such a feature we would be hearing from it on TV news. And all tech bloggers would jerk in a circle, etc.

<comment><USER6> Hint: he founded the company and named it after himself.

</comment></comment></comment><comment><USER7> I fully expect Apple to begin doing this across their entire laptop line as a precursor to a full migration to an ARM-based MacOS/iOS hybrid.

<comment><USER8> Assuming that you're being serious, I doubt that they would make such a move. While Apple markets their computers as being simple enough for anyone to use, they have a large section of power users that use their laptops heavily for things like Photoshop and video editing. I don't think that either of those will be performant in the near-term on ARM.

<comment><USER7> nVidia's Tegra 3 (due this year) is a quad-core ARM with a GPU capable of accelerated 3D, HD resolution, and 13800 MIPS which I believe is faster than a Core 2 Duo.

[http://www.brightsideofnews.com/news/2011/1/23/nvidia- thinks...](http://www.brightsideofnews.com/news/2011/1/23/nvidia-thinks-world- domination-tegra-2-3d-in-january2c-tegra-3-by-fall.aspx)

The 64-bit ARM chips will be better.

</comment></comment></comment><comment><USER9> Am I wrong in assuming that if you don't power down your x86 system then it will still draw power when you toggle the switch? It seems more like a nice solution for people who dual boot win/osx and linux.

I applaud the novel use of the optical drive space and I'm excited for the time when hardware shrinks past the usable threshold and we can cram more components in a 13" laptop form factor.

<comment><USER8> What components though? I think that the reduction in size would be used to make the form-factor even smaller (possibly just thinner/lighter if they wanted to keep the screen size).

<comment><USER10> Batteries.

</comment></comment></comment><comment><USER11> Why Android and not Arm desktop linux (assuming there are some)?

<comment><USER12> Because Android is more mature as a consumer operating system.

(Yeah, I know.. Unix is 30+ years old and Android is 3. But you can't get Angry Birds for Linux, and the power management on Linux isn't great etc etc..)

<comment><USER13> Android runs on Linux.

<comment><USER12> Do you seriously think that either I or the OP didnt realize that? The OP even says "why not desktop linux"!

The question is why Android rather than Linux. Saying Android is Linux doesn't explain anything at all.

<comment><USER13> I don't know, it's hard to say what you don't realize, but I'll expound upon my comment. Do you really think the power management would be all that different in a laptop (rather than a phone) running Android? They'd both be using the Linux kernel, and people already complain about their Android phone battery life (but people complain about _every_ phone's battery life). And if one really wants to run Angry Birds on their Linux laptop (or any laptop that the Android SDK runs on), it is entirely possible to wrap the emulator and/or port Dalvik, to run Android apps as first class desktop app citizens. In fact, I'm surprised no one has done this already.

</comment></comment></comment></comment></comment><comment><USER14> And the arguments against getting rid of the optical bay just got more interesting...</comment>


The illusion of choice - <AUTHOR> http://i.imgur.com/k0pv0.jpg

<comment><USER2> The choice is not who the money goes to, its what it tastes like.</comment>


Supercomputer comes up with a profile of dark matter - <AUTHOR> http://phys.org/news/2016-11-supercomputer-profile-dark-standard-extension.html <comment><USER2> Paper at [http://www.nature.com/nature/journal/v539/n7627/full/nature2...](http://www.nature.com/nature/journal/v539/n7627/full/nature20115.html)

</comment><comment><USER3> This is an interesting result but I have trouble taking stock in it. QCD disagrees with proton mass by ~2%, and is insufficient to explain why He3 is a stable. I realize the 3body, and 9body (!!) problem are complex but when a theory disagrees with nature that fundamentally it casts doubt in my mind.

</comment><comment><USER4> Title is a bit clickbaity

> Thanks to the Jülich supercomputer, the calculations now provide physicists > with a concrete range in which their search for axions is likely to be most > promising.

They have a range in which a particle that MIGHT be what makes up dark matter MIGHT show up. The difficulty of defining a particle that only interacts gravitationally is not lost on me, but the title is still somewhat misleading.

<comment><USER5> They have calculated a falsifiable prediction for the nature of dark matter based on an extension to the standard model which addresses a known issue. Not clickbaity at all.

</comment></comment><comment><USER6> In particular, a profile of axion-based dark matter.</comment>


Is Bitbucket down? - <AUTHOR> We've been experiencing timeouts for a while now but their status page says all is good. <comment><USER2> > Degraded Performance

That's one way to put it

</comment><comment><USER3> unable to commit or use their web interface. status page shows spikes across the board.

</comment><comment><USER4> "Investigating - We are presently investigating service issues with Bitbucket resulting in degraded performance on the website and via SSH & Git via HTTPS. Next update in 60 minutes Jan 9, 13:47 UTC"

<comment><USER5> 19:15 UTC - All services and all repositories are back, but overall performance of the website, and SSH/HTTPS transactions will continue to be slow. We are in the process of fixing the overall issue with our vendor, but cannot currently give an accurate ETA for when this will be completed.

Slack is also down today. Could they share a vendor?

</comment></comment><comment><USER6> Their status page is updated to Partially Degraded Service now

<comment><AUTHOR> Funny their response graph has been literally off the chart for a while before they updated the status.

<comment><USER3> the charts have stopped updating as well. edit: i stand corrected, they are literally off the charts as you say haha

</comment></comment></comment><comment><USER4> Still down as of 9:44 EST.

[https://status.bitbucket.org/](https://status.bitbucket.org/)

Shows "Degraded Performance" on most things.

<comment><AUTHOR> Down again today, same outlook. So much for premium, managed services.

</comment></comment><comment><USER3> Andddd it's down again</comment>


DOJ petitions Supreme Court for right to track using GPS without warrant - <AUTHOR> http://legaltimes.typepad.com/blt/2011/04/doj-pitches-gps-surveillance-case-to-supreme-court.html

<comment><USER2> Very honestly, how can tracking via GPS (or cellphone GPS) be anything other than a gross violation of the USA Constitution's 4th amendment? How can the US DoJ not feel a little shame at advocating a legal position that requires twisting logic until it nearly breaks? How can the US Doj not feel highly shamed at doing this sort of thing?

After that, I have to ask what kind of weirdos work at the US DoJ? In order to want to track citizens all the time, you'd have to be a lot perverted. Do the strict entrance exams (a.k.a. "background checks") allow the DoJ to filter out honest, non-perverted people, and only let in twisted, evil, bluenosed snobs?

<comment><USER3> While I'm not in favor of warrantless wiretapping or GPS tracking, I'd appreciate you elaborating on your claim that they're twisting logic until it nearly breaks. Unfortunately, this request seems like another step down a slippery slope and not a huge break.

People at DOJ aren't perverted, they're trying to protect you and the country from criminals and terrorists. This is but one of many tools they feel they need to do that job well. You may disagree with their mission, and you may disagree with the tools they use to execute the mission, but calling the people working there "perverted" is an enormous stretch.

Many services, including ones lauded on YC, collect data about you that could be used to track you at any time without a warrant, and give that capability to other civilians. I hope that you think that is perverted, too.

As an example, check out cree.py - [http://redtape.msnbc.com/2011/04/just-how- creepy-is-creepy-a...](http://redtape.msnbc.com/2011/04/just-how-creepy-is- creepy-a-test-drive.html)

And hacking Color - [http://www.digitaltrends.com/mobile/color-hack-allows- users-...](http://www.digitaltrends.com/mobile/color-hack-allows-users-to-spy- on-anyone-from-anywhere/)

<comment><USER2> Well, you make my "perverted" point for my by citing "cree.py" - "cree.py" -> "creepy", a synonym for slightly perverted. Even the author(s) of "cree.py" thought that tracking someone is a bit weird.

</comment></comment></comment><comment><USER4> Can you blame them? After spending all that money on GPS units it would be a shame to let it go to waste.

/sarcasm. I was digging through DHS procurement contracts until 2am last night and I'm still feeling cynical.</comment>


Moves to survive and thrive in a downturn - <AUTHOR> https://www.nfx.com/post/28-moves-survive-thrive-downturn/ <comment><USER2> "How to lose your customers and ruin your business in a few shortsighted steps"

From making quick layoffs in a highly volatile economy to automating support inquiries during a time when customers more likely need personalized responses, I don't know if there's a single thing on this list that isn't the equivalent of shooting yourself in the foot.

> 10x your product.

And 1/10x your customer support! This is definitely the time people will buy the most expensive product with the least decent support.

> Turn fixed costs into variable costs.

So you can have more surprise bills!

But my favorite is:

> Be committed to building a high-performance culture. In a downturn, everyone > must perform. This becomes non-negotiable.

Ah yes, the "work hard or else" mentality that will definitely help you keep your top talent during a tough time when significant parts of your workforce are likely to get sick and need flexibility.

Let me make a different recommendation:

This is a _volatile_ time. Volatility works both directions, and it may mean both ups and downs. Focus on what differentiates you - and usually that means answering the phones when your customers call, having staff who can actually solve problems (eg, good talent who is happy to be working with you) and a real product that brings value.

Yes, there is value to being adaptable, and part of adaptability is letting go of non-value focused things. There are ways to do that without being a jerk to your employees and customers. Those who don't understand this are doomed to fail no matter what they do.

<comment><USER3> Dude, like what's your suggestion?

If your savings are cut in half, wont u make some life changes? If funding is twice as hard for half the amount, dont u make some tough steps?

<comment> Spartan-S63 If your company can't survive several quarters without fundraising, you probably haven't found your product-market fit and the value you're providing is probably suspect, in my opinion.

</comment></comment></comment><comment><USER4> After watching a number of downturns over the decades I've become prudent, even parsimonious in my approach to outgoings. The result is that even though my pay is average and I live where house prices are high, at times like these I don't have to lose sleep about losing my shirt. From a position of having missed out on ridiculous house price rises over the years, and driving my old car whilst so many other people swanned around in fancy new cars they could not really afford but for credit plans, it's extremely difficult not to feel like the chickens are coming home to roost for those that refused to learn the lessons of history. I mean, the GFC is barely a decade past!

<comment><USER5> I understand (and even reflect your choices with my own) but you are coming precariously close to sounding like the well-prepared ant smugly watching the hungry grasshoppers. Now is when we need you to double-down on compassion; your preparation was not just for your survival but towards a much bigger challenge!

</comment></comment><comment><USER6> Here's what works for me (I think/hope)

1\. Think of money put into index funds as an "expense"

2\. If investments are on fire, that's okay. You weren't gonna use them for the next 10 or 20 years anyway

3\. Invest in yourself

4\. Diversify your income streams. Even $2k/mo on the side can really help

5\. Cash savings. Never let a loss of income impact your livelihood

6\. Keep adding to savings even when you think you can't

7\. Your skills and your network are an asset. Use them

<comment><USER7> > even $2k/mo on the side can really help

Bought a house few years ago living on $2k/mo. Finished paying it off last year. Good spending habits go far

<comment><USER6> Congratz!

The number is of course contextual. $2k in SF is less than $2k in rural Europe :)

Where I'm from that $2k is what you'd call an engineering salary. Where I'm now, it's a nice solid bonus on top.

</comment></comment></comment><comment><USER3> NFX seems to put out very good tools to connect and pitch (SIGNAL is a gold mine of potential connections. I never noticed BRIEF before).

But has anyone successfully connected through the site? I am wondering if this is any better than a typical cold pitch email.

</comment><comment><USER8> What a bunch of vacuous pop-psychology marketing bullshit.

I guess we should be happy this guy isn't writing about his favorite Coronavirus treatment on Medium, like all the other telephone sanitizers are.

</comment><comment><USER9> As they say, never let a good crisis go to waste.

</comment><comment><USER10> Spam, flagged.</comment>


How I Got My Digital Life Back Again After An Epic Hacking - <AUTHOR> http://www.wired.com/gadgetlab/2012/08/mat-honan-data-recovery/ <comment><USER2> I almost feel worse about him being able to recover the data than I did about the original story. Firmware password being resettable by Apple is totally understandable (although ideally there would be a system specific disk key which couldn't be recovered, so any firmware password recovery deleted the drive).

It also clearly shows that without File Vault, the remote wipe feature is basically worthless. With File Vault, it's redundant.</comment>


Student data-mines himself, sells the info - <AUTHOR> http://www.fastcompany.com/3009602/what-if-we-thought-more-often-about-being-tracked-online-man-stalks-himself-to-find-out#3

<comment><USER2> <https://cayova.com> will be offering something similar - you can opt into a program where they sell on your stats, the same as facebook do, but share the profits of the sale with you.

</comment><comment><USER3> Reminds me of [http://blog.stephenwolfram.com/2012/03/the-personal- analytic...](http://blog.stephenwolfram.com/2012/03/the-personal-analytics-of- my-life/).</comment>


Looking for a gud startup Java/JEE/Python/Android - <AUTHOR>

Hi All,
 I am a java/jee developer, residing in NCR India & having 4-5 yrs of experience (Enterprise java and mobile java) and looking for a new startup to join and doing something different. My Passion involves doing coding, learning new things, specially about technologies. Looking out for some great answers from great readers. write to me at firstname.lastname@example.com <comment><AUTHOR> hi</comment>


Making Angular.js real-time with Websockets - <AUTHOR> http://blog.pusher.com/making-angular-js-realtime-with-pusher/

<comment><USER2> This is a great introduction, defiantly something we're going to experiment with.

<comment><USER3> Glad to hear it! Let us know how you get on.

</comment></comment><comment><USER4> Code in the examples look mangled (html entities)</comment>


TwitHire, job board for Twitter - <AUTHOR> http://twithire.com

<comment><USER2> TwitHire - because everyone wants to hire "an insignificant or bothersome person".

Yeah, I get it. You're using Twitter and you wanted a short name so you dropped the 'ter', but still...</comment>


23 Things Only 90s Sysadmins Will Remember - <AUTHOR> https://discoposse.com/2018/03/20/23-things-only-90s-sysadmins-will-remember/ <comment><USER2> PCMCIA = "People Can't Memorize Computer Industry Acronyms"

Oddly, that's one I had memorized. It actually stands for PC Memory Card International Association. (That one I didn't memorize; I had to look it up.)

</comment><comment><USER3> Ghost... such fond memories. I was like black magic to be able to pull a drive running out of space, ghost it to a new larger drive, while resizing the partition, and stick it back in the server and just boot it up.

</comment><comment><USER4> Few if any of these would be limited to 90s sysadmins. If you were an office worker in the 90s this stuff is almost all familiar.

<comment><AUTHOR> Very true! Hard to imagine how commonplace this stuff all was and now it's like a museum

</comment></comment><comment><USER5> We still use Lotus Notes at work, except that it is called IBM Notes nowadays. Some legacy applications are still in process of being ported to Sharepoint (which is itself in process of being migrated from 2013 to 2016). Happy to say we do use Outlook for a few years instead of Lotus.

Regarding ZIP drivers, I had such drive in my personal computer. There were several variants of hardware, both in allowed ZIP disk size and formatting. Some ZIP disks were Mac-formatted and no way to get those working on Windows. I wonder if that was a technical or artificial limitation.

<comment><USER6> I had both types and was able to reformat them to windows.

</comment></comment><comment><USER7> The nostalgia is super high in this one. I still have all my AOL & Netscape CD's laying around somewhere. As well as some old zip drives, floppies and my original Gateway desktop along with an old IBM machine.

I should dust them off and see if they still run.

I didn't even realize at the time T1 meant 1.54mbps; we definitely take for granted the speed today (currently at 250mbps for roughly ~$60USD/mo).

Great article :).

</comment><comment><USER8> Score one for the 3270 emulation. I worked for a small company in the mid 90s whose software was used to connect to the mainframes that airlines used for scheduling. We provided software that allowed for dial-up access to those systems from home (among other things). The core software was built in Delphi and was basically a dialer married to a 3270 emulator.

</comment><comment><USER9> After reading this, I was surprised to learn that in the 90s I was a sysadmin.

</comment><comment><USER10> Apart from EBCDIC and 3270 emulators, which are uncommon but in daily use in IBM-addicted environment such as banks, disk imaging software is still relevant.

</comment><comment><USER11> Is it a competition? I made 20/23 in this quiz.

<comment><USER12> I think it's a trick for Cambridge Analytica to gather data on your political segmentation preferences.

<comment><AUTHOR> Shhhh ;)

</comment></comment></comment><comment><USER13> ESF, B8ZS.

<comment><AUTHOR> Nice! Classic memories :)

</comment></comment><comment><USER14> Great article. Hacker News paydirt!</comment>


Solar Sail Spacecraft which could cover 3.6m miles per day passes test - <AUTHOR> https://www.express.co.uk/news/science/1164792/space-news-NASA-latest-solar-sail-aliens-planetary-society <comment><USER2> Scott Manly did a video explaining it:

[https://www.youtube.com/watch?v=Wg2Juylb9nY](https://www.youtube.com/watch?v=Wg2Juylb9nY)

I guess it was launched too close to Earth to maintain orbit (intentional due to the launcher's limits and other missions) and will eventually burn up as it's periapsis dips too low. The angle of eccentricity of the orbit means that the craft can only lower it's periapsis using light pressure from the sun.</comment>


Fake Facebook likes back again? - <AUTHOR> https://www.facebook.com/TexasHoldEm/likes

<comment><AUTHOR> I am not sure if i missed some free prizes zyngas poker page - but the peak looks strange: [http://pagedata.appdata.com/pages/facebook/texas-holdem- poke...](http://pagedata.appdata.com/pages/facebook/texas-holdem- poker/56531631380)</comment>


Fast LSTMs in PyTorch - <AUTHOR> https://lernapparat.de/fast-lstm-pytorch/ <comment><USER2> Has anyone tried similar things with CompiledWrapper and XLA on Tensorflow? Is it even possible?

</comment><comment><USER3> This is so awesome. Makes me really excited for the future of PyTorch—being able to define symbolic deriviatives in a python subset is super cool</comment>


Intel's Xeon Platinum 8284 CPU: When 300 MHz Cost $5,500 - <AUTHOR> https://www.anandtech.com/show/14656/intels-xeon-platinum-8284-cpu-when-300-mhz-cost-5500 <comment><USER2> Hah. "300Mhz? that was between PPro and P2, they didn't have Xeon then" ... and then go read the article and realize that yes, i really would've been more interested in reading about 20 year old Intel secrets than modern ones.

</comment><comment><AUTHOR> Does anyone know what is the reason for this many SKUs? Marketing, production issues, or both?

<comment><USER3> Chips with fewer working cores or lower frequency are definitely easier/cheaper to produce and customers have a range of different needs. Xeon SP is ~90% of the server market so that's a pretty large and diverse market.</comment></comment>


Is Facebook killing your iPhone's battery or are you? - <AUTHOR> http://blog.gotenna.com/post/131775543810/is-facebook-killing-your-iphones-battery-or-are <comment><USER2> From yesterday:

"We recently heard reports of some people experiencing battery issues with the Facebook iOS app and have been looking into the causes of these problems. We found a few key issues and have identified additional improvements, some of which are in the version of the app that was released today."

[https://www.facebook.com/arig/posts/10105815276466163](https://www.facebook.com/arig/posts/10105815276466163)

<comment><AUTHOR> Yes, apps (like Facebook's) which are drawing lots of current in the background is part of it -- but the point of our team's hacking into the iPhone was to find out what else really affects your phone's battery. It's not just background apps updating.

Nothing we discovered in the lab is 'revolutionary' \-- everyone knows your battery gets used up more when the screen is brighter, and when your phone is trying to find a tower or router to connect to, but we just wanted to put some numbers behind it.

Hope it was useful; we had fun breaking open an iPhone regardless ;-)

</comment></comment><comment><USER3> The article doesn't seem to address the actual cause that the articles linked at the top highlighted, background updating. The Verge article especially was all about background processing issues which the tests and power saving advice don't seem to address at all.

<comment><USER4> You're right, it's almost as if the piece was written purely as content marketing to promote the gotenna ;) Interesting nonetheless!

<comment><AUTHOR> Lol, we did these lab tests before we thought of turning what we learned into a post (if we had really been strategically content marketing, we wouldn't have posted this at 8 pm on a Friday night haha). Mostly, we wanted to break open an iPhone — that's what happens when a hardware team is in TGIF mode ;-)

In any case, it's not just background apps updating. Although yes, that's part of it. We wanted to learn more beyond what the iOS battery-monitoring feature will give you -- which is which apps are consuming which % of your iPhone's battery, both when you're actively using them and when they're running in the background.

For our own purposes, we were particularly interested in the interaction of location services and Bluetooth-LE which are required for own product to be useful. We threw in general "futzing" and screen brightness as well out of curiosity. And while our team knew that trying to connect to towers & routers ate your battery a lot (easily observed by just turning your phone into Airplane Mode -- can last for weeks!), we had no idea it could be as much as 250 mA every few seconds!

</comment></comment></comment><comment><USER5> This isn't exactly related to the article, but I think this post is an amazing example of how to write an interesting blog post yet, at the same time tie it to what you are selling and make people want to know more about your product without directly telling them to.

<comment><USER6> I was thinking it was an amazing way to avoid telling people why the product hasn't shipped yet. They've been doing pre-orders for more than a year. Sometime in there it went from $149 a pair to $199 a pair. I admire the desire to make something "absolutely perfect", but perfect products don't ship.

<comment><AUTHOR> We started shipping earlier this month, which is why the price went up from the prior pre-order discounted number.

Stay tuned for a novel-length blog themed around something like, "Why Manufacturing & Supply Chain Are 100X Harder (& Take 100X Longer) Than Everyone Tells You". But I'm sort of still in PTSD mode. ;-)

<comment><USER7> Well done for shipping!

<comment><AUTHOR> Thanks! :-D

Our hardware team has been working on our next product for a few months -- that's why they found time to hack into iPhone batteries, lol, as work on the first product has been handed off to supply chain & manufacturing for the most part. ;-)

Meanwhile, the rest of the engineering team is working on firmware & software updates to make the hardware we're already shipping even better/more interesting (and of course, responding to first consumers' feedback).

But... you know what? Sorry for going on a tangent. All I really want to say is thanks, means a lot. Sometimes it's hard to enjoy these victories because you get so focused on the next uphill battle. ;-)</comment></comment></comment></comment></comment>


Mistakes with CSS Grid [video] - open-source-ux https://www.youtube.com/watch?v=0Gr1XSyxZy0 <comment> open-source-ux The list of mistakes with links to the segments in the video:

1\. Thinking CSS Grid is everything: [https://youtu.be/0Gr1XSyxZy0?t=6](https://youtu.be/0Gr1XSyxZy0?t=6)

2\. Using only percents for sizing: [https://youtu.be/0Gr1XSyxZy0?t=93](https://youtu.be/0Gr1XSyxZy0?t=93)

3\. Assuming you need breakpoints: [https://youtu.be/0Gr1XSyxZy0?t=189](https://youtu.be/0Gr1XSyxZy0?t=189)

4\. Getting confused by numbering: [https://youtu.be/0Gr1XSyxZy0?t=250](https://youtu.be/0Gr1XSyxZy0?t=250)

5\. Always using 12-columns: [https://youtu.be/0Gr1XSyxZy0?t=314](https://youtu.be/0Gr1XSyxZy0?t=314)

6\. Ignoring the power of rows: [https://youtu.be/0Gr1XSyxZy0?t=384](https://youtu.be/0Gr1XSyxZy0?t=384)

7\. Reaching for a framework: [https://youtu.be/0Gr1XSyxZy0?t=508](https://youtu.be/0Gr1XSyxZy0?t=508)

8\. Waiting for IE11 to die: [https://youtu.be/0Gr1XSyxZy0?t=639](https://youtu.be/0Gr1XSyxZy0?t=639)

9\. Hesitating, instead of playing: [https://youtu.be/0Gr1XSyxZy0?t=768](https://youtu.be/0Gr1XSyxZy0?t=768)</comment>


Joel Spolsky and Clive Thompson discuss the past, present, and future of coding - <AUTHOR> https://stackoverflow.blog/2019/09/17/joel-spolsky-clive-thompson-discuss-coders-software-programming/ <comment><USER2> > Joel: The big picture there is, the school system should have given up on > trigonometry and calculus a long time ago and started teaching statistics > and probability. The discrete math is a lot more useful.

I could probably be convinced to jump on that bandwagon.

<comment><USER3>
        > I could probably be convinced to jump on that bandwagon [dump calc, replace with stats]

I think, really, that the opposite needs to be done.

Math curriculums would do better to focus more on getting "the foundations" right. Starting with algebra, geometry, trigonometry and real analysis (calculus), and pursuing it rigorously for college-bound students. There should be a focus on mastery rather than covering a wide variety of stuff quickly.

Too many students get to college with a mathematical foundation that looks like Swiss cheese-- with many holes in basic skills: like fractions, exponents, trig (yes, even if they took calc in high school).

<comment><USER4> Why should geometry and trig be "the foundations" while statistics is not? Because that's the way it's always been? Sounds like a horrible reason to keep things the same.

<comment><USER5> Ever tried to teach an introductory Physics class without using geometry, trigonometry or calculus?

(Edit: for that matter, teaching statistics to students with limited exposure to calculus is not a very successful endeavour, either...)

There are a lot of things that mathematics is fundamental to besides data science, and schools need to address the requirements of all children, not just those who want to write (a very limited range of) software when they grow up.

<comment><USER6> I hated calculus until learning Physics. It was so abstract and seemed useless. I'd much rather be presented with a problem, like how far did this ball travel, then learn calculus as a tool to solve that problem.

I agree with you though that attempts to teach Physics without calculus are sorely misguided. It's ridiculous to force students to memorize kinematic equations that can be trivially derived from each other.

<comment><USER7> I got lucky enough to be able to take both Calculus and Physics concurrently from the local University rather than taking Physics without calculus from my high school. It almost seems like they should be taught as a single interdisciplinary class.

</comment></comment></comment></comment></comment></comment><comment><USER8> I have a very bleak outlook on coding after moving to the bay. The companies that win and get big do not put stock in writing good code. They want to move fast so they can beat people in the market. So you end up valuing people who can do whatever it takes to scale and keep things working while ignoring your tech debt until you're so big you can just hire 20k engineers to clean the mess up over the next two decades.

With this approach young engineers learn that clean code and everything people like Martin Fowler have been saying isn't going to get them promoted. So people learn bad practices and we all get collectively worse at coding.

I've spent so much energy trying to get people to care about code quality and qualitative improvements, but at the end of the day the people who got these companies were they are can just say there method works and there's no proof it would have gone better with better code or that they would have survived at all.

<comment><USER9> You're commenting about this on Hacker News, a site that--from a technical perspective--does almost everything "wrong", or using methods that have been obsolete for 10+ years. It uses tables for layout. It does "AJAX" by creating an <img> tag and setting the src= as the url to request. It has an awful url structure (e.g. item?id=20996837). And on and on, I could list so much more.

But you (and I, and thousands of others) still use the site and probably didn't even notice or care about any of that. This is one of the largest, most heavily concentrated technical audiences on the internet, and even though those are the exact people you think would be _most_ discerning about it, obviously nobody truly cares about how much isn't being done "properly". People will argue all day in the comments here about the right way to do things, but since they're here they clearly don't think it's important when deciding what they use themselves.

It's the same for everyone else, with every other site and product. As long as it works, the reality is that almost nobody cares how much of a mess anything is internally.

<comment><USER10> You've picked a poor example to prove your point because web development collectively jumped the shark and websites using technology from around 2006 are the most reliable and easy to use.

Back then usability, graceful degradation and progressive enhancement were appreciated by developers. Nowadays we have the complexity of Enterprise Java except with less reliability and in JS. And ads and tracking and virality everywhere.

</comment></comment></comment><comment><USER11> Totally unrelated to this topic, but I absolutely love Joel's "You suck at excel" youtube video, done in the same vein as the old "You suck at photoshop" tutorials someone made.

[https://www.youtube.com/watch?v=0nbkaYsR94c](https://www.youtube.com/watch?v=0nbkaYsR94c) I find it absolutely hilarious, and I can almost guarantee you'll actually learn something new you can do in excel.

<comment><USER12> I made this subsite: [https://excel.secretgeek.net/](https://excel.secretgeek.net/) to make it easier to share the video internally at work.

Sending a video about "Secrets of Mastering Excel" is less like to humiliate your colleague than sending them a link to "You suck at excel"

</comment></comment><comment><USER13> > _Funnily enough, lots of coders aren't that great at math, so long as you > remember to zero index, you're fine._

I would add "…and keep your ranges as lower-inclusive, upper-exclusive." Interestingly, both of these have related reason why: [https://www.cs.utexas.edu/users/EWD/ewd08xx/EWD831.PDF](https://www.cs.utexas.edu/users/EWD/ewd08xx/EWD831.PDF)

<comment><USER14> Except for SQL, where between means both inclusive Grr!

<comment><USER13> Yes, but you can always ignore BETWEEN and instead use the PostgreSQL range types with the @> operator.

[https://www.postgresql.org/docs/11/rangetypes.html](https://www.postgresql.org/docs/11/rangetypes.html)

</comment></comment></comment><comment><USER15> I'm curious: How did Joel Spolsky gain such clout and influence?

<comment><USER16> He co-invented the website which all developers use on a day to day basis?

<comment><USER17> He was famous before stackoverflow; the success of stackoverflow was attributed to it's creators having a large audience to seed it with questions and answers.

</comment></comment></comment><comment><USER18> I love Stack Overflow's podcast. Wonder what happen to that?

<comment><USER19> Which version? The early ones with Joel and Jeff were great. The later ones were overly produced and pretty terrible.

</comment></comment><comment><USER20> I loved Joel's old podcast, and I didn't discover it until last year. Is there any audio available for this?

</comment><comment><USER21> I like Andre Staltz's Future of Cycle.js (more about webdev in general): [https://vimeo.com/216975979](https://vimeo.com/216975979)

</comment><comment><USER22> Github-type companies become repositories of functions, and programmers pick the function they want and just do functional composition.

</comment><comment><USER23> Jesus Christ, is Ben Bova, not Ben Boba...

<comment><USER24> Jesus Christ is Ben Bova? Well, that's something new for me.

<comment><USER23> loool, feel into my own trap!

<comment><USER23> *fell

</comment></comment></comment></comment><comment><USER25> Ben Boba = Ben Bova + Boba Fett?

</comment><comment><USER26> Joel is a great speaker. I am 100% on board with whatever he says. He's awesome.

</comment><comment><USER27> A good presentation on the history of programming and how we got to where we are is

Bob Martin - The Future of Programming

[https://www.youtube.com/watch?v=ecIWPzGEbFc](https://www.youtube.com/watch?v=ecIWPzGEbFc)</comment>