Consul 1.0 Released - <AUTHOR> https://www.hashicorp.com/blog/hashicorp-consul-1-0/ <comment><USER2> I use Consul at work, and I do like it, but I have to ask a kind of obvious question; why would I use Consul over something that's more industry-standard like Zookeeper?

I'm not asking this passive aggressively, I mostly want to know what features it adds over a vanilla Zookeeper setup.

<comment> jake-low I found this article [0] a couple weeks ago and found it informative. Basically Consul has service discovery built in, while Zookeeper et al. expect you to build service discovery on top of the primitives they provide (assuming you need it).

[0]: [https://www.consul.io/intro/vs/zookeeper.html](https://www.consul.io/intro/vs/zookeeper.html)

<comment><USER3> This article is biased because it was written by Consul author.

I'm big fan of Zookeeper, and agree with parent that is not only industry standard, but it is very robust and battle tested.

Having said that, this is not what Zookeeper was meant to. ZK is coordination service, if you have a distributed service that you need to coordinate and you don't want any single point of failure ZK is the choice.

ZK can be used for service discovery, but that's not the proper use, you could equally set up a single database node, or MongoDB cluster to accomplish essentially the same thing.

So specialized service is better, but I also don't like how Consul solves service discovery. If you think about it, SD doesn't require strong consistency, it is not a big deal if all nodes won't learn about each other at the same time, arguably that's actually preferred.

By removing strong consistency (the only reason why ZK is even compared to Consul) we could have a better SD that's also more scalable.

<comment><USER4> _If you think about it, SD doesn 't require strong consistency, it is not a big deal if all nodes won't learn about each other at the same time, arguably that's actually preferred._

Can you go into more detail about this? Each computer has its own Consul agent that monitors the health of services running on it. You also get configuration from the agent on the individual computer. All of the agents communicate peer to peer and with the server don't they? Isn't that eventually consistent? I'm just starting to use Consul for configuration and haven't started working on the service discovery part yet.

<comment><USER3> Yes, but that's only to detect whether node is up or down, the health checks are still strongly consistent and go through the servers.

Because of this design, the don't get benefits of any of them.

Side note, KV is actually strongly consistent, which is what is desired, the thing is that since KV comes with consul it encourages people to use it.

One just need to keep in mind, that Raft and Paxos expect all nodes to be updated on every change (e.g. if you have 5 server node cluster all 5 nodes need to "sign on it" before it is accepted). This is counter-intuitive since adding nodes to cluster makes it actually slower (the goal is correctness and resilience not performance). Basically you just need to keep in mind to not use KV for some write heavy operations. Serving configuration files generally is fine.

<comment><USER5> In both paxos and raft you only need a quorum to sign on it. In the case of raft/consul it's the majority. Which means, you need 3 of 5 nodes to sign on it.

Also, key value store _reads_ are usually done locally, from the agent, which goes over gossip and is eventually consistent.

Health checks are _also_ eventually consistent. They are done by the local agent, and through gossip are sent to the masters group.

<comment><USER3> I'm aware that Paxos and Raft require odd number of nodes. My point was that the more nodes you have the slower the cluster is, because increasing number of the nodes doesn't increase performance but resilience. With 3 nodes you can afford to lose at most 1 node, with 5 -> 2, with 7 -> 3 etc.

> Also, key value store reads are usually done locally, from the agent, which > goes over gossip and is eventually consistent.

That's not what the documentation says. The KV is using raft, you can relax some guarantees for reading by having clients use consistency=stale, but you're still communicating with the server, except in stale you only communicate with one instead all of them.

> Health checks are also eventually consistent. They are done by the local > agent, and through gossip are sent to the masters group.

Also that's not what the documentation says. Gossip is used for adding/removing nodes and the overall health of the node (whether host is reachable) is also done through gossip, but the actual health checks (whether a service is running) is done through consensus protocol.

I still want to emphasize that using consensus protocol for SD is not a good idea. Let say you're running in AWS and follow the best practices which is spreading your servers over multiple AZ. Let say you use us-east-1 which has 6 AZ.

An AWS starts having network issues (like few months ago) and 2 AZs have network issues and can't communicate with the rest. The machines are still running, just can't communicate. It just happens that on 2 of those AZs you run 2 out of your 3 consul servers. Even though all the machines are healthy and running your Consul cluster is down, even for the remaining 4 AZs that don't have any problems.

<comment><USER4> _That 's not what the documentation says. The KV is using raft, you can relax some guarantees for reading by having clients use consistency=stale, but you're still communicating with the server, except in stale you only communicate with one instead all of them._

How do you come to the conclusion that you're communicating with the server? When I'm doing any type of communications with consul via the API I'm always communicating with 127.0.0.1/....

<comment><USER6> Local agents forward to your central consul servers.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Big thanks to the Consul team! We have been using it for a year with basically 0 maintenance.

* Decent REST API

* K/V store

* Service discovery

* Single Go Binary

* Geographical failover

* Load balancing

A real Swiss knife.

Haven't tried different things (e.g: ZooKeeper) but don't feel very compelled to since everything just works.

</comment><comment><USER8> HCL - why inventing another config/markup language? There TOML, yaml and dozen others.

<comment><USER9> It's really quite a nice config language -- I much prefer HCL to any of the alternatives. Has comments (unlike JSON), is properly nestable (unlike TOML), is extremely human readable and not too verbose, has a built-in pretty printer, etc.

I wasn't ever really a huge YAML fan. It's way too ambiguous and sensitive to whitespace. One erroneous space is way more likely to mess up your YAML file than your HCL file.

It's not perfect, but I actually would like to see MORE systems using HCL, not fewer.

<comment><USER10> HCL is not used in the rest API though. So we have to integrate our apps using _both_ HCL and JSON. It's also schemaless, which means we have to guess the API using various "samples".

<comment><USER9> Which REST API?

<comment><USER10> [https://www.consul.io/api/catalog.html](https://www.consul.io/api/catalog.html)

</comment></comment></comment></comment></comment><comment><USER11> How many people are actively working on it and maintaining it? From my experiences with Vagrant and Packer, I get the feeling that there is not much development effort (by Hashicorp employees) allocated to the free Hashicorp products so I hesitate to even consider using Consul.

Vagrant and Packer feel like early alphas and while there is little competition, I do not feel comfortable using them. Because of this bad experience in the past, I have not even tried out Consul and Vault and am unlikely to do so in the future.

<comment><USER12> I don't know the answer to your question but while Vagrant and Packer both have been pretty bad experiences for me, Consul, Nomad, Vault and Terraform are very different products and all pretty actively worked on. I am using them all at the moment and am very happy.

Consul seems like a very mature product and development has maybe slowed down, but I think this is mostly because it is mature and looks like HashiCorp does not feel the need for feature bloat.

</comment></comment><comment><USER13> Consul is a dream for most Operations Engineers. At work we have used it in production for almost 3 years with basically no maintenance except dropping a new binary for the old one when we update the versions. We use it for service discovery, feature flags, consul lock for deployments and use the KV as a config store. It is also our backend for Vault and stores all the encrypted data. Thank you HashiCorp and the Consul team for an amazing achievement.

</comment><comment><USER14> We used it heavily, but are switching away since it's not that stable inside kubernetes. Also some features are unnecessary if you have k8s already. Like you have a k/v store and you have service discovery already.

I wasn't part of that discussion though. Thus I'm curious. Anybody got a different point of view on Consul in k8s?

<comment><USER15> Did you try 0.9.3 under k8s? We did some work specifically targeting k8s by enabling pods with servers to get restarted with new IPs, even all of the servers at once. That required Consul to be configured with -raft-protocol=3 to benefit in 0.9.3. That's the default now in 1.0, so both of those versions should be much more stable under k8s.

I'd be curious if you ran into other kinds of issues on k8s and if you tried 0.9.3 with the required raft protocol version set before you gave up.

</comment></comment><comment><USER16> Changelog - [https://github.com/hashicorp/consul/blob/v1.0.0/CHANGELOG.md](https://github.com/hashicorp/consul/blob/v1.0.0/CHANGELOG.md)

</comment><comment><USER17> This is only tangentially related but is anyone using Spring Cloud + Consul? Is the integration of the two in a good spot now?

<comment><USER18> We are a Java shop and use Consul (as a docker container) for our service discovery. Spring Cloud Consul plays well with Consul. The REST APIs are what makes Consul stand out. We have an in-house monitoring service querying consul apis for service removals & healthy service counts and send an alert if there are no more healthy services, so that our docker can spin up one just in time.

Another feature that we use is the KV configuration dynamic reloading. So all your yml configurations are in Consul and can be updated and propagated to all of your services on the fly.

Now the problem we face is Spring Cloud Consul project is maintained by a very few people, so if there is an issue, we have to workaround than waiting for a fix.

</comment></comment><comment><USER19> For Service Discovery, why should I use Consul over Eureka?

<comment><USER15> Consul's documentation has a comparison at [https://www.consul.io/intro/vs/eureka.html](https://www.consul.io/intro/vs/eureka.html).

</comment></comment><comment><USER20> Congrats.</comment>


YaST is being rewritten in Ruby; Geeko gets a nosejob - <AUTHOR> http://opensuseadventures.blogspot.com/2013/06/yast-is-being-rewritten-in-ruby-geeko.html

<comment><USER2>
        Largely this is due to the simple fact that SUSE has many proficient Ruby developers.

This strikes me as very pragmatic and doesn't surprise me. I had one of their developers as speakers (and martial arts instructor) at my conference (eurucamp[1]) and he was really good. He built some of their internal toolchain. Definitely someone I would trust to not pick an implementation base for its hype value.

[1]: <http://2013.eurucamp.org/>

</comment><comment><USER3> Why would they create an scripting language just to develop YaST? The language feels very familiar though, check [http://doc.opensuse.org/projects/YaST/SLES10/tdg/id_ycp_func...](http://doc.opensuse.org/projects/YaST/SLES10/tdg/id_ycp_function.html)

Here is the full reference. [http://doc.opensuse.org/projects/YaST/SLES10/tdg/Book- YCPLan...](http://doc.opensuse.org/projects/YaST/SLES10/tdg/Book- YCPLanguage.html)

<comment><USER2> Well, SuSE is german. And germans have an interesting case of NIH. For example, they invent scripting languages for their syslog deamons:

<http://www.rainerscript.com/>

<comment><USER4> That's kind of a racist comment and being German, I'm vaguely offended. However, I wouldn't fully disagree with you. This is almost the text book definition of NIH: <http://en.m.wikipedia.org/wiki/Lennart_Poettering>

<comment><USER5> In his defense, systemd does solve some fundamental problems with sysV-style init. Incrementally improving the disparate sysV init systems to be more concurrent and robust would likely have benefitted the community less, and at the end of the day it still would not have looked like the familiar init system sysV users are used to.

</comment></comment></comment></comment><comment><USER5> The big win that YaST brings is a common configuration and management interface across multiple UIs. Back when I used OpenSUSE, I had LXDE, KDE, and headless/CLI boxes which could all be administered using roughly the same interface.

The big fail, though, is that most of the development effort goes into YaST, making it sort of awkward to script these things or change them manually using the CLI. It wasn't until switching to Arch Linux that I really felt like I understood how to configure my system without pointing and clicking.

</comment><comment><USER6> Does this mean they need to ship an additional scripting runtime?

<comment><USER7> I think OpenSUSE already ships with ruby by default, but I'm not 100% sure. (SUSE tends to be everything-and-the-kitchen-sink. It's certainly not a minimalist distro.) It certainly means it would now be required on even the most minimal SUSE installs, though.

</comment></comment><comment><USER8> What are they using for the GUI? That has always been a bit of a ruby weakpoint.

Also packaging into executables

<comment><USER9> I would assume that they will be continuing with Qt, Gtk and the web frontend.</comment></comment>


Microsoft: Windows 7 UAC is fine, don't worry, we don't want to talk about it, OK? - <AUTHOR> http://technologizer.com/2009/02/04/microsoft-windows-7-uac-is-fine-dont-worry-we-dont-want-to-talk-about-it/

<comment><USER2> As a member of a household that has become the de facto PC repair shop for our circle of friends, I'm glad Vista's UAC is extra paranoid. Sure, it's annoying at first and it hasn't saved my PC from anything (yet), but for casual users it will save them from self-inflicted problems down the road.

<comment><USER3> I'm not so sure. After becoming conditioned to having to click the "Allow" button over a long period of time, it might become rote for people to allow even the most detrimental processes (having become accustomed to UAC's paranoia). It seems likely that the average user who would be afflicted by such maladies (spyware, viruses, etc.) couldn't tell the difference between a malicious and non-malicious process.

Even if they could recognize these processes as dangerous, would UAC really do all that much to protect the computer? Although it does reduce the potential for damage, it doesn't inhibit one from acquiring a virus in the first place.

Of course, if a person is messing around with their own system files, I'm not sure how effective a warning box will be in preventing whatever it is that they're doing. UAC seems to be a textbook case of "security theater."

<comment><USER2> It's not meant to be a stop all. It's designed so that users is notified what is being executed. For an average user, I believe if he does not know what it is, chances are he will press cancel, unless people have a lot of faith in processes they do not understand.

It's not perfect, but its better than the alternative. of friends coming to our house with their PC's having no idea what they did to it.</comment></comment></comment>


The End of Poverty - <AUTHOR> http://paul.kedrosky.com/archives/2010/01/the_end_of_pove.html

<comment><USER2> The picture is still pretty much bleak. The major changes in China and India are skewing the picture and the $1/per day definition of poverty is also questionable. Go to the link below and press play to see some visualizations of similar statistics.

[http://graphs.gapminder.org/world/#$majorMode=chart$is;shi=t...](http://graphs.gapminder.org/world/#$majorMode=chart$is;shi=t;ly=2003;lb=f;il=t;fs=11;al=30;stl=t;st=t;nsl=t;se=t$wst;tts=C$ts;sp=6;ti=2007$zpv;v=0$inc_x;mmid=XCOORDS;iid=phAwcNAVuyj1jiMAkmq1iMg;by=ind$inc_y;mmid=YCOORDS;iid=phAwcNAVuyj2tPLxKvvnNPA;by=ind$inc_s;uniValue=8.21;iid=phAwcNAVuyj0XOoBL_n5tAQ;by=ind$inc_c;uniValue=255;gid=CATID0;by=grp$map_x;scale=lin;dataMin=194;dataMax=96846$map_y;scale=lin;dataMin=23;dataMax=86$map_s;sma=49;smi=2.65$cd;bd=0$inds=)

</comment><comment><USER3> Yes, but USA for some reason is rapidly becoming more poor an unequal.</comment>


Google's Eric Schmidt says government spying is 'the nature of our society' - <AUTHOR> http://www.theguardian.com/world/2013/sep/13/eric-schmidt-google-nsa-surveillance

<comment><USER2> It was the nature of the Soviet Union and Eastern Bloc countries to spy on its citizens. We, the United States, were supposed to be better than that. We were, but we're not any more.

It is our choice as developers, creatives, et al to decide if we as individuals will do work that will directly lead to spying on our fellow citizens.

</comment><comment><AUTHOR> Well, as they say in England, 'He would say that, wouldn't he?'

Someday perhaps all the links between Google and the NSA will be revealed, and we'll find out Schmidt's role in it all.

</comment><comment><USER3> And the Schmitz is right on this one.

"Our society" always had an incredible desire to know stuff about other people, and the more mundane the better.

"We" are just bunch of nosey a __holes, everything from the guy next door, the generic office gossip to the latest b-list celebrity meltdown.

People in government just happen to have both free time and large sums of money.

</comment><comment><USER4> Given Google's close ties to the State Dept I could see why he feels that way

</comment><comment><USER5> Google is scared more countries will follow Brazil's lead and demand they host data on their citizens locally. I understand the costs could be big for that, but I almost want it to happen (in EU, too, where it wouldn't need to be in the every country anyway) as punishment to US companies for agreeing with this level of spying, without fighting back much against it, because they thought there would be _no consequences_ to that, and no cost to them.

So yes, I do think they deserve that to happen to them, and as a foreigner I'd feel a lot safer if my data couldn't be accessed at will by the US government. At least I can help change the government in my own country.

</comment><comment><USER6> Same guy who soundproofed his apartment and doesn't even want a doorman.</comment>


Life as a drone operator - <AUTHOR> http://www.theguardian.com/world/2015/nov/18/life-as-a-drone-pilot-creech-air-force-base-nevada <comment><USER2> " _At this level of security you didn't even call them people anymore. And they were probably doing stuff that only operatives would do. When they went home to their families in the evening they became people again, and when their little children looked up to them with their sweet shining eyes and said 'Daddy, what did you do all day today?' they just said, 'I performed my duties as an operative,' and left it at that._ "

— Douglas Adams, _Mostly Harmless_

</comment><comment><USER3> Speaking of drone operators...

If you can take the low-budget effects, I recommend watching the movie Sleep Dealer[1]. It is probably the best cyberpunk[2] film ever made; unfortunately, it never got a lot of attention.

The film deals primarily with telepresence, with an emphasis on the remote operation of drones. Not just military drones, either; drones also enable "out-of-sight, out-of-mind" workers.

[1] [http://www.sleepdealer.com/](http://www.sleepdealer.com/)

[2] A lot of people confuse cyberpunk with flashy tech and network shenanigans; Gibson describes cyberpunk as stories about the _interstitial_ \- the people caught in the cracks of "legitimate" society (consensus reality).

<comment><USER4> thanks for this recommendation, this sounds really interesting. Would you stay it stands on the level of Primer for quality/budget film making?

<comment><USER3> While Sleep Dealer had a bigger budget than Primer's $7000 (I still loved primer), as you can see in the trailer/etc they were obviously limited in the CG they could afford. I think they work around that limitation quite well.

A mostly-spoiler-free example might be the "simstim social media" service: by looks it's pretty cheesy, but in concept it's a _perfect_ caricature of modern monetized youtube. (from 2008, well before the modern "youtuber" phenomena).

Some people may not like that it's in Spanish (subtitled).

As a long-time fan of everything "cyberpunk", I stand by my claim that Sleep Dealer is the best cyberpunk film ever made - even if the filmmakers were dreaming somewhat larger than their budget.

</comment></comment></comment><comment><USER5> The ability to remotely kill and then go home to your family has to make the impact on operators (the ones with a conscience) so much worse. The buffer time of a flight back from a real deployment, however short, at least seems like it'd provide some time for reflection/rationalization/compartmentalization.

The fact that these operators get shit on by their associates for being out of harm's way and expressing reservations about their mission can't be helping either.

<comment><USER6> We found out in the 1970's that flying home from Viet Nam was still too fast and still too much of an abrupt culture shock for many returning soldiers.

Long slow boat rides and a quiet, personal welcome home seem to have the most success in easing people back to normal.

That is, of course, as long as the theater/front wasn't actually _IN_ the country you also happened to live in and call home. Small detail easily forgotten.

</comment></comment><comment><USER7> I'd just like to point out that they don't write an article about the guys that say "yeah, it's war but you carry out your orders whatever they are"

<comment><USER8> Ah, the Nuremberg Defense.

<comment><USER9> Aaaand we're Godwined.

Soldiers follow orders. The Nazis followed orders. Therefore all soldiers are Nazis. Well done. Congratulations.

These people are not following orders 'whatever they are'. They're not attacking schools because the Taliban's leaders children go there, unlike oh, I don't know, say the Taliban who massacred 150 children at a school in Pakistan because soldier's children go there. They have rules of engagement defining how to determine if an order is legitimate and acceptable, which they are following, but of course the article never mentions that. Now fair enough, there are troubling incidents described in the article, but we're only get individual perspectives, nothing is really corroborated. I'd like to see more independent oversight of the drone programs. But flinging about Nuremberg analogies is hardly justified.

<comment><USER10> The problem is that the US is using drones to kill people inside countries with whom they are not at war. If you declare war on a country, that does give you certain rights under the laws of war. But if there is no declaration of war, you can't go around abducting or killing people in foreign countries just because they are deemed suspicious.

And declaring war "on terror" won't cut it either; that's basically equivalent to saying, "we are potentially at war with any country any time, when it suits us." Nor will saying "they're the bad guys and we are good," which is kindergarten-level argumentation. Or "we know they're terrorists but we can't share the evidence, just trust us."

The media discusses the details of drone operations all the times, but omits to have this much more fundamental discussion about violating the borders of sovereign countries.

<comment><USER9> > ...you can't go around abducting or killing people in foreign countries...

Actually, yes you can. Suppose that country, Pakistan, is complicit in those drone strikes, allowed drones to operate from it's territory for a time and provides intelligence to facilitate them? The (former) Yemeni government also explicitly permitted drone strikes to be carried out on it's territory.

Governments have always had the right to carry out attacks in order to prevent imminent threats to their country, and terrorists planning attacks does count. There is a clear legal framework.

You can reasonably argue that this is wrong and that it doesn't matter how imminent the threat is or what those people are doing, they cannot be attacked even if the government of the territory they're in says that you can. That's an argument you could make, I suppose. But as it stands, as a statement of fact that's not what international law says.

[http://www.cfr.org/counterterrorism/targeted- killings/p9627](http://www.cfr.org/counterterrorism/targeted-killings/p9627)

<comment><USER10> Actually, the article you quoted does not seem to support your claims. There is a legal framework for targeted killings, but that framework belongs to American and not international law.

Quoting from your article:

>Philip Alston, the former UN special rapporteur on extrajudicial, summary, or arbitrary executions, condemns the U.S. claims of self-defense as overly expansive, stating that "if other states were to claim the broad-based authority that the United States does, to kill people anywhere, anytime, the result would be chaos."

</comment></comment></comment></comment></comment></comment><comment><USER11> If you're interested in this topic I highly recommend the 2014 film Good Kill.

</comment><comment><USER12> Wow, this is heavy. Good article.

</comment><comment><USER13> There is a Dutch short tv movie about this: [http://www.npo.nl/duivelse- dilemma-s/30-11-2011/POW_00416089](http://www.npo.nl/duivelse- dilemma-s/30-11-2011/POW_00416089)

About what it takes to kill at work and be a dad at home.

</comment><comment><USER14> I could've sworn I've already seen this same topic written about at least once over the past several years. Why does the Guardian think this is new?

<comment><USER15> The drone operators they interviewed are the same guys who wrote a letter to Obama recently calling the drone war "a recruitment tool for ISIS".

[http://www.theguardian.com/world/2015/nov/18/obama-drone- war...](http://www.theguardian.com/world/2015/nov/18/obama-drone-war-isis- recruitment-tool-air-force-whistleblowers)

</comment></comment><comment><USER16> > The number was 1,626.

Wow, that's more than half as many people as were killed in the 9/11 attacks. We should have this thing wrapped up by Christmas.

</comment><comment><USER17> Well, fully autonomous AI-operated drones are inevitable. Remote operated drones can be jammed. Autonomous drones can't. I think AI programmers won't have even that much concern about kills.

<comment><USER9> Not for this kind of work. A self-flying drone isn't that much of a problem. They largely fly themselves already. The human operators are needed to evaluate the images coming from the drones, identify and prioritize targets and take the decision exactly where and when to attack. No AI in existence can automate those tasks.

<comment><USER18> >No AI in existence can automate those tasks.

I think thats unlikely to be true a decade from now.

<comment><USER9> People have been saying that for more than 50 years.

</comment></comment></comment></comment><comment><USER19> If not for these high tech weaponry, A LOT of us who post on this website would be required to serve in an army. And if unlucky, called upon to try to kill someone. And if really unlucky, end up KIA or WIA.

Because of these high tech weapons, wealthy western nations are able to maintain their sovereignty without requiring all fit males to serve in uniform for 2-3 years.

The alternative to not having these high tech weapons is a man shooting another man to death.

War is terrible. But that's life.

<comment> jon-wood The alternative is to stop believing the west has all the answers and should impose them on the rest of the world, by force if necessary. We've been involved in countless wars, and few of them have resulted in the world being a better place to live.

<comment><USER17> So, female genital mutilation, sex slavery and stoning are all just cultural differences to be ignored? On some occasions, the West has the answers.

<comment> jon-wood Not at all. They're abhorent practices that we should be campaigning to end.

You don't change people's minds by turning up and dropping a couple of Hellfires on them. All that achieves is pissing off their family, and making them less receptive to your arguments. Would you be receptive to someone telling you they know better on matters of morality after they blew up your brother?

<comment><USER19> There will be wars. Not just over what West has done to ME. It will be over money, water, power, etc etc.

And without those high tech weapons, a lot of warm bodies would be required to pick up a gun and shoot to kill. Close enough to see without the aid of zoomed image on a screen.

I'm talking beyond just what West has done or not. Or what ME has done.

It's terrible. But again, that's life.</comment></comment></comment></comment></comment>


Opting out of behavioral ad tracking may get easier - <AUTHOR> http://arstechnica.com/web/news/2010/10/opting-out-of-behavioral-ad-tracking-may-get-easier.ars <comment><USER2> I have always wondered why browsers haven't led the fight against excessive user monitoring, especially Firefox. Rather they abdicate this responsibility to plug-ins that do not have widespread adoption.

I told people to switch to FF because it was a safer experience and certainly a better browser. Now we have a lot of bullshit methods to continuously track users. Where are you now supposedly superior browser?</comment>


Draggable Physics Animation Demo - <AUTHOR> https://www.greensock.com/draggable/

<comment><USER2> Please, please, please do not use skeuomorphic spinning knobs on your web pages. They're horrible to use. Right now you're thinking, "but if you implement them this way, they're fine!" No, no they are not. Physical knobs work well because we have opposable thumbs. We can roll the knob between our thumb and forefinger in a way that provides gratifying tactile feedback. There are no methods to achieve this with a mouse pointer interacting with a knob.

</comment><comment><USER3> Until the perpetual license is less than $750/dev I just don't see enough value.

They've mentioned elsewhere that they're working on updated licensing, I hope they do.

</comment><comment><USER4> It amazes me how GreenSock has made the swift from As3 to HTML5.I really thought they would just give up but nop, they made the transition pretty easily.

<comment><USER5> I'll be interested to see how they prevent theft of their source. It doesn't take long to get around obfuscation and such. If a person takes their HTML libs and slightly modifies the code and releases as an open source alternative to GreenSock... just curious how they'd go about combating that. Obviously they'd have to go after the site owner, but I don't think most site owners know what underlying frameworks go into their sites functionality. If they have thousands of sites using a port of their code and it was developed in India by a small team found online or something... where does the hammer fall?</comment></comment>


SingPath is the most FUN way to practice software languages - tea-anemone http://www.singpath.com/eli/index.html

<comment><AUTHOR> Could be nice to have one or two examples before having to sign up. I will not give my gmail and/or facebook information without being sure I would use the site.</comment>


Visualizing US and Russian Arms Sales Since 1950 - <AUTHOR> http://thesoundingline.com/map-of-the-day-visualizing-us-and-russian-arms-sales-since-1950/ <comment><USER2> Blogspam of

[https://vimeo.com/286751571](https://vimeo.com/286751571)</comment>


Pre-steal this book - <AUTHOR> http://sethgodin.typepad.com/seths_blog/2008/12/pre-steal-this.html <comment><USER2> I felt a bit of a connection to this post. Over the past several years I've seen things and thought of ideas that I've written off as not viable or outright crazy (or at least against the current trend), only to see people do them themselves a year or two on.

I know I'm not the only one. But, perhaps, for some of us it takes enough of these events to occur before we start to feel confident about our ideas - while those who naturally have confidence by the bottle are out there, "pre- stealing" our ideas and having a lot of success with them.

Lesson for me from all of this? Be bold, "just do it", be _really_ fast, and actually listen to your gut instead of writing it off as nuts.

<comment><USER3> Re that last sentence: Well said, Peter.

</comment></comment><comment><USER4> I couldn't pre-steal Gladwell's next book because I have no idea which pseudo- intellectual thesis he'll concoct based on a very small, very carefully selected sample of anecdotes. And even if I did, since I don't write for the New Yorker people would feel free to call BS on me and wouldn't feel intelligent just for reading my well-written pap.

<comment><USER5> Well-enough written schlock is always in demand. So, mine wikipedia and blog!

<comment><USER4> Right you are. Let's figure this out.</comment></comment></comment>


Audio White Paper - TMOS Redefining The Solution - <AUTHOR> http://devcentral.f5.com/weblogs/interviews/archive/2009/09/22/audio-white-paper-tmos-redefining-the-solution.aspx <comment><USER2> Sorry for the nitpick, but if posting from here could it be _TMOS, redefining the solution [Audio]_ , kinda like we do for [video] or [scribd]? There's been a few links from this web site and I always think I'm about to read a white paper on the subject of digital audio. Not your fault, just a friendly request.</comment>


Outsourcing 2.0 - <AUTHOR> http://it.toolbox.com/blogs/future-of-work/outsourcing-20-36359

<comment><AUTHOR> By definition, start up ventures are understaffed. How does outsourcing work for you?</comment>


Y Combinator Applicant Video Collection - <AUTHOR> http://avsquid.com/wiki/ycombinator_applicants

<comment><USER2> Would the YC team mind sharing which of the "accepted" W11 bunch submitted a video in lieu of / in addition to their applications?

I was a YC applicant once - 2007 as a single-person founder. Although I personally would never do a video, it is an interesting idea.

<comment><AUTHOR> I did this same page last funding session and submitted it to Hacker News: <http://news.ycombinator.com/item?id=1862327>

Most of the applicants submitting video will gladly tell you which video is their and discuss it, which is one of the fundamental ideas of the site. I'm applying with AV Squid again this funding session.

</comment></comment><comment><USER3> Wow, I really see what PG meant about scripted videos now. After a few takes I unintentionally created a script in my head. I had to walk away from it for a couple days and ended up doing my video on my next take.

Finally, it sounded like me instead of a robot.

</comment><comment><USER4> It is inspiring to see a lot of young and super excited people super passionate about providing a social twist to the world.

</comment><comment><USER5> Hey, I have a video for you to add to the list of Summer 2011 applicants.

<http://gamerhighway.posterous.com/>

</comment><comment><USER6> Why doesn't the site say what startup corresponds to each link?

<comment><AUTHOR> Because the videos generally don't have that information.

</comment></comment><comment><USER7> you should prune the 404's.

thanks for posting this, though. some of these are hilarious and great examples of what not to do!

</comment><comment><AUTHOR> This link is actually part of my ycombinator application idea. It has some "stealth" features that I haven't yet implemented. I also applied last funding session and have continued to work on this. Anybody got any feedback?

</comment><comment><USER8> Hey you found our video! We're the fourth one (Moral Fibers).

<comment><USER3> Love the passion, but you might want to rerecord it. The high pitch squeal is unbearable.

<comment><USER8> Thanks! And sorry for the high pitch squeal, our web dev/hacker extraordinaire is working on it as we speak.

</comment></comment></comment><comment><USER9> Hey you found our video too! (We're the SpotHero one)</comment>


Can we go electric before it's too late? - <AUTHOR> https://www.citylab.com/transportation/2018/10/where-americas-charge-towards-electric-vehicles-stands-today/572857/ <comment><USER2> "Transportation makes up the largest share of emissions."1)

Transportation is still only 28%, slightly more than a quarter. Electricity & "industry" account for 50%.

Further, I remember a discussion with the president of Mercedes who was pushed for cleaner cars. He mentioned that one ocean-going freight vessel pollutes more than 450k cars combined (here is an article in that same trend (2).

I love the notion of quiet, electric cars, but the "industry" that pollutes these cars, and the "electricity" that is needed to charge these cars still accounts for 50% of the pollution. So, until ocean freighters are cleaned up, the net effect on pollution will likely be zero.

1) [https://www.epa.gov/ghgemissions/sources-greenhouse-gas- emis...](https://www.epa.gov/ghgemissions/sources-greenhouse-gas-emissions) 2) [https://www.dailymail.co.uk/sciencetech/article-1229857/How-...](https://www.dailymail.co.uk/sciencetech/article-1229857/How-16-ships- create-pollution-cars-world.html)

<comment><USER3> Yeah. Instead of burning gasoline for our cars, we will burn oil/gas for electricity for our cars.

<comment><USER4> Even if that were the case, it's still an efficiency improvement.

Large turbine power plants + electric motors with regenerative braking is still about twice as efficient well-to-wheel as gas powered cars.

[https://matter2energy.wordpress.com/2013/02/22/wells-to- whee...](https://matter2energy.wordpress.com/2013/02/22/wells-to-wheels- electric-car-efficiency/)

<comment><USER3> Sure, electric cars are an improvement, but they aren't the end-all-be-all of climate change. The bulk of the problem is out of the hands of individual choice.

<comment><USER4> Yes, there's definitely more to be done. Electric cars go hand in hand with moving to renewable electricity sources as well. It's easier to change what's on the other end of the grid than it is to stick solar panels, wind turbines, and nuclear reactors on cars.

I see the "well your electric car is just burning coal/oil/gas anyway" argument repeated pretty often despite being an oversimplification and usually wrong.

</comment></comment></comment></comment></comment><comment><USER5> What most of us forget is that we can manufacture gasoline and diesel fuel in carbon neutral ways. (From algae or other plant-based materials.) It's just currently much more expensive than pumping oil from the ground.

So, we don't need massive adoption of electric cars to solve the problem. We can also figure out how to manufacture conventional fuels in environmentally friendly ways.

<comment><USER6> Isn't the issue to do with consumption of gasoline rather than production? Burning carbon based fuels releases large amounts of carbon, no matter how you've produced it

<comment><USER5> When you produce fuels by biological means, the carbon in those fuels is captured from the atmosphere.

Thus biological fuels are carbon neutral. No new carbon is added.

(For the same reason, if you heat your home with wood, the only new carbon comes from the energy used to cut the wood down and transport it to your home. The carbon released from your chimney is neutral because the tree captured that carbon from the atmosphere while it was growing.)

<comment><USER7> That's a little simplistic. The state of the carbon is incredibly important - keeping it locked in a tree, ice or the ground instead of floating around in the atmosphere is kind of the entire goal.

Heating with wood unlocks all that essentially inert carbon into wide spread particulate, so it's no more carbon neutral than burning coal you collect by hand. You're also depleting the carbon absorption side by harvesting the tree

</comment></comment></comment></comment><comment><USER8> I imagine we'll need pretty substantial upgrades to our electrical grid if we want electrical charging to be ubiquitous.

A typical home peaks at 15-30 kW, whereas a single DC fast charger can use as much as 62 kW or 500 kW.

Even a L2 charger uses something like 6.6-19.2 kW; if you tried to retrofit a Wal-Mart parking lot to have L2 chargers at every parking spot you'd probably need to build a new electrical power plant next door.

<comment><USER9> I doubt we'll see every space getting a charger, in fact as EVs/PHEVs become more common I would expect to see the free charging parking spaces go away (they're supposed to be an incentive to get people to switch, but if everyone already has...).

<comment><USER10> I see the free charging spaces at my local Target packed full of cars. I was wondering who would have time to spend there all the time until I realized some of them are Uber drivers. They get electric cars so they can charge for free waiting for their next customers. I'm guessing Target was hoping they would be actual customers who you drop by to shop while charging. I'm sure some time in the future they will be changed to have a fee once EVs become more common place.

</comment></comment></comment><comment><USER11> "Catastrophic climate change" is no longer my primary concern here. I don't think we're going to avoid that. My big concern now is Peak Oil. If major producers like Saudi Arabia and Iran peak and start petering out, then demand will quickly outstrip supply, before widespread electric vehicles are viable in the market.

What happens to the world if the price of gasoline spikes 50-100% in a mere year or two?

<comment><USER12> I'm highly skeptical that peak oil will happen from lack of supply. I'm betting it will happen from lack of demand. Petroleum extracting technology gets better, and is always increasing viable reserves of existing oil fields.

<comment><USER11> That's what I'm hoping will happen - that EVs will lead to a big drop in demand before Peak Oil leads to a drop in supply.

But hope is not a strategy.

</comment></comment></comment><comment><USER3> Even though 100 companies are responsible for the bulk of climate change, lets keep painting it as the moral failure or greed of the general masses.

<comment><USER11> This reads far too much like a Facebook virtue signaling meme, rather than a supported fact.

Not saying it's wrong, just saying the standards are (usually) higher on HN.</comment></comment>


Printable True Bugs Wait Posters - <AUTHOR> http://natashenka.ca/posters/ <comment><USER2> Pro tip: when you develop with gcc, don't settle for anything less than

        gcc -ansi -pedantic -Wall

At university I often had people coming to me and asking, "my program compiles correctly, but it keeps crashing / doing weird things; what did I do wrong?". I always said, "add '-ansi -pedantic -Wall' to the compile flags and come back to me when you cleared that wall of warnings down to nothing". Every single time the problem was directly or indirectly caused by the things that were in the warning messages.

It's a shame that the default choice of GCC flags make this compiler pretty much useless for work.

The warnings are there to help you. You can choose to ignore them and that's fine, _as long as you do it deliberately and with a damn good reason_ , not because you don't even know they're there.

<comment><USER3> You can go further and specify a particular standard, plus extra warnings not included in -Wall:

        gcc -std=c99 -Wall -Wextra -Werror

I'm not sure if -pedantic is still beneficial in that case. The gcc documentation had a list of every warning category, and which parameters enable each warning. This SO question was also interesting: [http://stackoverflow.com/questions/11714827/how-to-turn- on-l...](http://stackoverflow.com/questions/11714827/how-to-turn-on-literally- all-of-gccs-warnings)

<comment><USER4> A tiny comparison: -Wall -pedantic gives me:

      warning: C++ style comments are not allowed in ISO C90
      warning: ISO C90 forbids mixed declarations and code

-Wall -Wextra gives me:

       warning: unused parameter 'type'

For me, -Wextra is much more useful for finding messy code.

<comment><USER2> Use both of them. The last warning is about messy code, but the first two will help you keep the code portable.

</comment></comment></comment></comment><comment><USER5> Half the people in this thread seem to have missed the point. This article is not supporting 100% abstinence of these functions. It is doing exactly the opposite - and showing up people who say "never do this" or "that is always wrong" as being as ridiculous as those who blindly support abstinence from sex. This kind of tunnel vision, learning by rote, and refusal to teach what is really happening, is exactly the same stupid attitude that creates bad programmers, as it creates unbalanced teenagers.

Perhaps, just like condoms, memcpy, strcpy, strcat are dangerous or ineffective 10% of the time. But that other 90% of the time, when used correctly, they are perfectly safe, fun and essential to learning and growing. Avoiding them completely does not create a healthy relationship between a language and its programmer. I realize that not everyone in this thread is a C programmer, but this prevailing attitude of saying "this should never be done/used" just because you're heard that from someone else, is a really petty, annoying, and persistent aspect of programmer culture.

<comment><USER6> I'm a beginner C programmer, maybe you can share your experience with me.

I've found bugs in libraries where sprintf was used instead of snprintf and it caused crashes. So I know from experience of cases where snprintf was a better choice than sprintf. And I've certainly coded a few off-by-one errors in my time so I can sure understand it's easy to get the destination buffer size wrong!

I'm not doing anything performance-critical with strings. Under what circumstances should I use sprintf instead of snprintf and what benefits will I see?

<comment><USER5> If you understand the difference between snprintf and sprintf, what trouble it can cause, and where to use it, it sounds like you're already doing great. What would be bad was if you had the blind notion that "snprintf is good" and "sprintf is bad" without knowing why.

As for an example of when you might want to use sprintf. If you compile to C89 (ANSI) snprintf isn't included in the standard so you're left with sprintf if you want your code to be portable.

A better example is strcpy though. A function which is completely normal and safe when used correctly, but someone with the wrong idea might use strncpy as a "safer" version and cause themselves more trouble for not knowing what is going on. As if to prove my point you can see someone advocating this exact thing in another comment tree in this thread. They've probably heard from someone that the "n" version of functions are safe. If they'd actually looked into it they'd realize strncpy doesn't do what you might think.

</comment></comment></comment><comment><USER7> Or even better, don't use C for string handling.

It's too much trouble for too little gain.

I think the areas where C is a good and effective solution are shrinking and safer languages are becoming more common and faster (even C++)

The C syntax, not its library doesn't allow for good string handling. String handling should be built deeper into the language, and, yes, even though it is possible to have safe C code, it's _very hard_. So try when it's worth it.

<comment><USER8> > safer languages are becoming more common and faster

> though it is possible to have safe C code, it's very hard

A dull knife is pretty safe for most people. It's still possible to shove it into your eye and blind yourself, but other than those extreme cases it won't cause much injury when used in the regular manner. However, it is also extremely inefficient at the purpose it was designed for: cutting things.

There are, of course, safer alternatives to a knife. EMTs use special tools designed to fit a seatbelt or cloth into a small slot and slice through without any risk to a person; they also have specially designed shears which make it difficult to cut flesh, but easily cut through nylon and leather. Utility knives have retractable blades to reduce injury, and other tools are designed to fit specific materials into slots and make cutting people impossible.

All of those are purpose-driven and application-specific solutions, however. For the most high performance and general purpose application, a really sharp fixed-blade knife is still the most precise and efficient tool for the job. When wielded correctly it is still safe and efficient. But the practitioner is not protected from harming themselves; it's expected that they know what they're doing. And really, it's not that hard to learn how to use it correctly.

But I totally get that it's easier to use a dull knife or scissors than learn all about knives, and it gets the job done.

<comment><USER9> "A dull knife is pretty safe for most people."

While your point is true, I want to object to your metaphor. I object for safety purposes. In fact, a dull knife is more dangerous than a sharp knife for most anyone who needs to cut things.

You need to press much harder with a dull knife and sometimes even to saw down into the object. You may even need to get a firmer grip on the object you're cutting to counter all that force. Those are very dangerous behaviors. A sharp knife that cuts easily is much, much safer.

<comment><USER8> Not true. A dull knife is dull; it's not dangerous at all because it basically can't cut anything. A half-dull or half-sharp knife is dangerous. It can cut, but you don't know how much, and variations in the blade make it unpredictable, in addition to the behaviors you defined.

<comment><USER10> I would describe a typical kitchen table knife as a "dull knife", and trying to use that for tasks to which it is not suited can certainly lead to injury.

</comment></comment></comment></comment></comment><comment><USER11> Obviously strcpy is dangerous, that's why I copy all my strings by hand with:

      while(*dest++ = *src++);

<comment><USER12> I really hope this was sarcasm. But if not...

There's nothing here to prevent a buffer overrun. If your src doesn't end in 0, or your dest is too small, you'll be reading memory you shouldn't and/or obliterating memory past your dest buffer. Your method is pretty much on par with an inlined strcpy.

<comment><USER13> That's the joke

</comment></comment></comment><comment><USER14> Develop your c code in OpenBSD. The linker admonishes you any time you use unsafe string functions.

         warning: strcpy() is almost always misused, please use strlcpy()

<comment><USER15> By default, Microsoft's C compiler will also give you warnings for unsafe functions. At least, it did the last time I used it a few years ago.

<comment><USER16> It still does. Microsoft also banned a lot of C functions from usage internally [1]. For codebases that need to build in VC and other compilers I'm not yet sure how to really solve this apart from _CRT_SECURE_NO_WARNINGS.

[1]: [http://msdn.microsoft.com/library/bb288454.aspx](http://msdn.microsoft.com/library/bb288454.aspx)

<comment><USER17> How about just taking BSD's functions and using them? strlcpy, strlcat, snprintf, etc. are all easily portable and libraries probably already exist for MS's compiler.

</comment></comment></comment></comment><comment><USER18> (Not a C person here, but I'll ask anyway)

What should I use instead of these things if they're so dangerous?

<comment><USER19> Almost every one has a _n_ version you should use, and their man pages will tell you that.

strcpy -> strncpy (or strlcpy on BSD)

strcat -> strncat (or strlcat on BSD)

sprintf -> snprintf (but still watch out for printf format attacks)

gets -> something else entirely. The man page says "programs should _NEVER_ use gets()".

<comment><USER20> Keeping in mind that strncpy has it's own problems, like not null terminating the buffer if it would overflow.

<comment><USER21> The point of the n is that you specify the maximum length that it's allowed to copy. It's slightly harder to mess that up than with regular strcpy.

<comment><USER22> The n in strncpy describes to what size the destination buffer (not string) should be padded with '\0'.

This is useful for copying a string into a fixed size buffer that is sent over the network, to give an example. It's not what the programmer generally means when using strncpy.

Many programmers are surprised when they learn that strncpy() really writes 1M-strlen("abc") zeros in the 1M char array every time it's called...

<comment><USER10> _" The n in strncpy describes to what size the destination buffer (not string) should be padded with '\0'."_

This is false.

From the man page: "The strncpy() function is similar, except that at most n bytes of src are copied. Warning: If there is no null byte among the first n bytes of src, the string placed in dest will not be null-terminated."

And the following code prints foo:ar on my system.

        char buffer[10];
        strcpy(buffer, "foobar");
        strcpy(buffer, "foo");
        printf("%s:%s\n", buffer, buffer+4);

Edited to add: huh, scratch that. Obvious error in above test :-P. Testing it with str _n_ cat like I had meant to, it seems it is in _fact_ padded, not just (possibly) terminated. Interesting, and very worth knowing if you are trying to move a probably small string to a large buffer under time pressure.

<comment><USER22> What is false? I'm not talking about the source string not being terminated when it's too long. That's obvious and there are plenty posts about it in this thread.

Not sure what you want to say with the example code. Maybe swap it for strncpy and strlcpy and see whether that matches your expectations?

<comment><USER10> Yeah, my bad, had meant to use strncpy. My contention had been that it only zeroes the first following character (if that). On closer reading of the man page, it is in fact clear.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER23> If you don't write C very often (I don't) and you want to see these things in action: [https://microcorruption.com](https://microcorruption.com)

I had no clue printf was problematic.

<comment><USER24> printf (and others in that family of functions) are only exploitable if you do something like `printf(user_controlled_str)` (possibly with extra arguments).

Basically, don't let the user control the very first argument (which would allow them to add format specifiers like %d or %x) and you're safe.

<comment><USER23> Well, yea. This is exactly what you do in a few levels of microcorruption.

You can always say "dont do X and you'll be fine." But that's kind of like saying "don't point a gun at someone" and the gun will be completely harmless. That's the trick, isn' it? That seems to be the point of the "True bugs wait" site at least. It only takes one mistake.

<comment><USER24> I agree, especially with things like strcpy and strcat, but printf is kind of a special case because it's a very, very simple rule to follow. Plus most of the time it's illogical to use it without a format specifier (or with user supplied ones).

</comment></comment></comment></comment><comment><USER25> Even though I don't think abstinence-only sex education is a good idea, it's strange that the true statement "only abstinence is 100% effective" is mocked.

Or are liberals going to start teaching an honest version of their view: "A combination of condom use and abortion when condoms fail, is 100% effective"?

<comment><USER26> I've only sees "only abstinence is 100% effective" mocked from a policy perspective. It is true that abstinence is 100% effective on a personal level, but teaching it is remarkably ineffective at a population level. There is room to mock it on a personal level, by pointing out that we are willing to engage in far more dangerous activities without 100% guarantees on safety. 'Seatbelts fail, only not driving is 100% effective'.

<comment><USER25> >I've only sees "only abstinence is 100% effective" mocked from a policy perspective. It is true that abstinence is 100% effective on a personal level, but teaching it is remarkably ineffective at a population level.

The phrase "only abstinence is 100% effective" is a slogan for teens, not a claim that only abstinence only sex education is 100% effective (which is clearly false).

>There is room to mock it on a personal level, by pointing out that we are willing to engage in far more dangerous activities without 100% guarantees on safety. 'Seatbelts fail, only not driving is 100% effective'.

It depends on how much a person wants to avoid having an abortion or unplanned pregnancy, and how much value they get out of sex.

<comment><USER27> > The phrase "only abstinence is 100% effective" is a slogan for teens, not a > claim that only abstinence only sex education is 100% effective

You don't have to claim that a stupid course of action is perfect to deserve mockery. Following the stupid course of action will suffice.

> It depends on how much a person...

No, the success of abstincence-only education as public policy does not depend on a single person's wants, desires, and incentives. It depends on the wants, desires, and incentives of an existing imperfect population.

Claiming that "our policy would work if only people were moral and rational in X, Y, and Z ways" is irrelevant if people are known to not be moral and rational in X, Y, and Z ways, which is indeed the case with respect to sex-ed. At the end of the day it either works to reduce teen pregnancy or it doesn't, and in this sense abstinence-only education doesn't work.

</comment></comment></comment></comment><comment><USER28> What are those ads referring to originally? Is this a campaign in the US? Is it publicly funded?

<comment><USER29> Sexual abstinence. And yes IIRC they are publicly funded in some states. Worse, they either don't give accurate information about contraception or give no information at all.

Needless to say, these policies have proven to be counterproductive when it comes to actual teen pregnancy and STI rates.

<comment><USER30> Not that the negative correlation between abstinence only programs and pregnancy + STI rates deters the people who push them. When you start to view public health policy through the lens of individual morality (if not piety in some cases), the actual effects of a given policy effectively become irrelevant next to the intent of the policymakers.

To the unfortunate consequence of many teenagers.

<comment><USER29> Of course, because if they don't heed your awesome moral advice and get into trouble then you can blame them for it!

I wish it wasn't so easy to be a misanthrope.

<comment><USER30> Ugh. That part makes me sickest of all.

</comment></comment></comment></comment></comment><comment><USER31> I would like C to have a native String type, and the primitives could be function pointers, replaceable in those cases when custom handling is needed (e.g. inside kernel). Object Pascal is sort like that.

<comment><USER32> D has this. A lot of people assume that D is just C++ with some GC and some improvements, but it's really more like _C_ with GC and some improvements -- including a native String type.

There's also a string module in the standard library that includes a lot of convenience methods, including ones for interoperating with C and for working with Unicode[1].

For someone like me with a background in dynamic languages like Python and Lua, as well as some background in C, D was a great fit. Unlike when I started learning C++, D felt like a very natural extension of C to include GC and lots of modern language features.

Lamentably, not many people are interested in D, and so aren't yet a lot of third-party libraries, and many of those that are abandoned. But the core language and standard library are great, and there's a nicely growing and incredibly fast web framework (vibe.d). And Facebook has started supporting the language. So hopefully it will start seeing some growth.

1\. [http://dlang.org/phobos/std_string.html](http://dlang.org/phobos/std_string.html)

</comment></comment><comment><USER33> 100% effective? Just wait until your friends invite you to a Hackathon, and all promises will be broken that night..

</comment><comment><USER34> Nice - although I wish they would fix the bugs in those libraries, too.

<comment><USER19> Many of the man pages for the function say "don't use them." OpenBSD let you link against "strcpy" but screams at you if you do.

Also, what's pickle? PS: don't type "man pickle" into the google, you won't like it.

<comment><USER35> Pickle is Python's native object serialization. Unpickling user inputs is executing arbitrary code.

<comment><USER36> Not accurate, Python has multiple serialization libraries and there is nothing special about pickle. Python's internal serialization is 'marshal' and shouldn't be used by apps for other reasons

<comment><USER37> anonymoushn said "object serialization". "marshal" doesn't serialize objects.

        >>> import marshal, cPickle
        >>> x = object()
        >>> marshal.dumps(x)
        Traceback (most recent call last):
          File "<stdin>", line 1, in <module>
        ValueError: unmarshallable object
        >>> cPickle.dumps(x)
        'ccopy_reg\n_reconstructor\np1\n(c__builtin__\nobject\np2\ng2\nNtRp3\n.'

That's a bit tongue-in-cheek, but it shows that the marshal serialization only handles a handful (I count 9) of built-in object types.

What's "special" about pickle is it's the default recommended serialization method. Quoting [http://docs.python.org/2/library/marshal.html](http://docs.python.org/2/library/marshal.html):

> "If you're serializing and de-serializing Python objects, use the pickle > module instead – the performance is comparable, version independence is > guaranteed, and pickle supports a substantially wider range of objects than > marshal."

</comment></comment></comment></comment></comment><comment><USER38> Friends don't let friends program in C

<comment><USER10> I would punch my friends if they tried to stop me.

</comment></comment><comment><USER39> True bugs wait in haunted attics.

</comment><comment><USER40> Not a C guy. Why are these functions unsafe?

<comment><USER41> Here, runtime, make some results and put them into this (character array) buffer I'm providing for you. Oh, the buffer wasn't big enough? Well, I'm sure the stuff after the buffer's end that you wrote over wasn't all that important, anyway. Probably just a few neighboring local variables that my function was storing nearby on the stack, or maybe the return address on the stack, or maybe the heap management data (block size field, free list pointer, ...) around the block of memory I allocated from the heap.

I wonder what the next pass of my loop will do now, or what will happen when this function returns???</comment></comment>