Google set to acquire Waze for $1.3B - <AUTHOR> http://www.globes.co.il/serveen/globes/docview.asp?did=1000850934&fid=1725

<comment><USER2> Great for me as a Google shareholder. Bad as an Angeleno fighting SoCal traffic.

No GPS/maps system seems to offer the option for FasTrak or carpool lane.

No GPS/maps system offers a way to tell a driver in a carpool lane if they have to change several lanes to the right to merge onto another freeway, or if there is a new carpool lane opening up to your left that takes you directly onto the next freeway you way to get on.

This is what happens when you have an oligopoly (Garmin, Google/Waze, Apple) and everyone's product, design and sales people are in the Valley or Tel Aviv and not more driver-centric cities with much more traffic and orders of magnitude more route options like Los Angeles.

<comment><USER3> I was in LA last week (vacation + rental car) and Google Maps definitely sent me to the express lanes on the I95 every time. They had the exact knowledge of the entrances and merges back.

As an aside, yesterday I was traveling upstate NY and to get off from I87 to some local road, Google Maps navigated me to a "Tandem Area", which was also marked that way by a sign and was indeed the right choice. Of course, I'd never turn myself from a highway to a Tandem Area ;)

So it seems like they have a lot of small detail knowledge.

<comment><USER4> I95 is 3000 miles from LA.

<comment><USER5> At least they said 'the I95,' which at least makes it sound like it's in California.

Dialects are interesting. In my native Pittsburgh, I always said 'Route 28' or maybe '79,' but now that I'm in LA, I always say 'take the 405 to the 10.'

<comment><USER6> While in Boston "the [number]" would mean a bus.

</comment></comment></comment></comment></comment><comment><USER7> Interesting development (if it's true - as we all learn, deals have a way if changing a LOT at the last minute).

I'd thought a FB acquisition would have been very important for FB -- it would have given them user-provided location info down to the foot for 50M people, which seems to me right up FB's alley (Where are you? Where are your friends? Where are you going? Where are they going?).

For Google, this will obviously cement their domination in the mapping space. As it is, they're so vastly far ahead than others (I think I heard from a friend who works there that they have 10,000+ people on the Maps team worldwide?)

Either way, Waze is awesome and despite the cynicism around what the big guys sometimes do, I can only imagine this making the app better and better.

<comment><USER8> 10000 people on Maps doesn't sound right. There are about 35k Googlers (excluding Motorola). 1/3rd on Maps? Implausible.

<comment><USER9> Google has 35k engineers, out of which maybe 2-3k work on Maps. The 10k number probably refers to total number of workers (mostly contractors) that contribute to Maps: Street View, testing, imagery, notation, etc.

<comment><USER8> Google has 38,739 employees. 90% of them are engineers? No way. When I was there, MTV campus was like 35% engineering.

From Google Q1 2013 earnings report: "Headcount – On a worldwide basis, we employed 53,891 full-time employees (38,739 in Google and 9,982 in Motorola Mobile and 5,170 in Motorola Home) as of March 31, 2013"

[http://investor.google.com/earnings/2013/Q1_google_earnings....](http://investor.google.com/earnings/2013/Q1_google_earnings.html)

</comment></comment></comment></comment><comment><USER10> NOOOOOOOOooooooooo!!!!

This is a competitor to google's maps, the only thing they'd do is shut it down (or at least not make anymore updates, ah-la sparrow) and not integrate the ideas into Gmaps.

From the founders standpoint this makes total sense, though, it's obvious this was the end game because they had no money-making business model.

<comment><USER11> Don't worry, Google isn't that type of company. You won't even feel it.

<comment><USER12> Uh, hah? Haha?

</comment></comment></comment><comment><USER13> Latest available source code is for v2.4 here [http://www.waze.com/wiki/index.php/Source_code](http://www.waze.com/wiki/index.php/Source_code) \- newer versions are not free software.

Map was never free data - I think they started with OSM, but later switched to a proprietary data source (and of course, they are crowdsourcing more data and updates from users)

<comment><USER14> I'm not sure they even started with OSM. I remember in the very early days I could select the 'bulldozer' icon and add new roads to the maps. People used to ask why the maps weren't as good as OSMs, but the maps got better very quickly because - I suppose - everybody's journeys were added to the maps.

</comment></comment><comment><USER15> Can someone with deep knowledge about Waze or the market explain why it would be worth $1.3B? It seems to have okay but far from insane traction. The technology seems less than trivial but at google scale shouldn't be that hard to develop in house. Once developed, it can simply be built into Google Maps and get overnight traction. As such, using Waze to me seems like a hack anyway.

<comment><USER16> It's not (just) about acquiring new technology or users. It's about blocking competitors (Apple, Facebook, Microsoft) from getting as good as them, or better, at maps and navigation.

</comment></comment><comment><USER17> Presumably this is defense against Apple (or Samsung) getting it.

<comment><USER18> Google was, IIRC, the second widely reported suitor after Facebook; I don't see that there's much reason to see it as defensive rather than an acquisition to enhance a major existing offering -- AFAICT, lots of people that preferred Google Maps prior to Waze shifted to Waze, at least for at-the-moment navigation, due to Waze's social features which resulted in better realtime traffic and routing.

</comment></comment><comment><USER19> As waze is not true competitor for google per se, I would be very dissapointed, if it would go the way other google-acquired software often goes - integration into google services and product's discontinuation.

I do not believe (anymore) that google could acquire Waze and leave it as a standalone product. Which would mean lots of compromises in terms of community interaction because google has different approach to this than Waze does.

Even more - waze approach to handling UGC in terms of map editing is somewhat not perfect, but with google involvement it could be discarded (not fixed), since it's not trivial to come up with better way.

Google, i believe, is more interested in traffic data than in community map editing, but latter one gives Waze lots of its appeal.

</comment><comment><USER20> For me the most interesting in this case is why nobody else wasn't interested enough, 1.3B is not that much of a money for other possible acquiree candidates to withdraw.

<comment><USER21> Facebook wanted to pull the Waze development center from Israel to the Valley. Waze's founder rejected this and demanded that the development will stay in Israel. This is why the deal with Facebook failed.

The deal with Google supposedly has a clause that for the next 3 years, Waze development will stay in Israel.

</comment></comment><comment><USER22> Now this is really an interesting news. First facebook was trying hard to acquire it ([http://mashable.com/2013/05/09/facebook- waze-1-billion/](http://mashable.com/2013/05/09/facebook-waze-1-billion/)) and now google is all set to acquire it. Hope whosoever acquires it makes better use of it.

</comment><comment><USER23> I'm surprised not many people are pointing out the antitrust concerns here...There are a few competitors in the space, but there may be a strong case that Google is essentially buying out that Waze's capabilities and niche are only rivaled by that of Google.

</comment><comment><USER24> I love the idea of crowdsourcing your speed to generate real-time traffic information. The other crowdsourcing features this brings don't seem very useful to me. Also, not sure this is worth $1.3B. Seems like another groupon or summly.

</comment><comment><USER25> I would be very curious to see what google does with waze an integrating it to maps. I think it would have been much more interesting to see what Facebook would have done with it

</comment><comment><USER26> What I trust even less than NSA and US intelligence is Israel's. We will have even less control on which entity or agency will have access to, what places or whom I'm visiting.

<comment><USER27> Salim, let me guess. You don't have a problem with all Israelis, only with the Israeli jews.

<comment><USER28> Stay classy.</comment></comment></comment>


NBA analytics and RDF graphs: Game, data, and metadata evolution, Occam's razor - <AUTHOR> https://www.zdnet.com/article/nba-analytics-and-rdf-graphs-game-data-and-metadata-evolution-and-occams-razor/ <comment><USER2> This article talks about my open source RDF basketball analytics project: [https://github.com/andrewstellman/pbprdf](https://github.com/andrewstellman/pbprdf)

The author links to the Hacker News thread where he learned about it: [https://news.ycombinator.com/item?id=16542183](https://news.ycombinator.com/item?id=16542183)

Happy to answer questions.</comment>


When to stop refactoring? - <AUTHOR>

We all love continuous refactoring (... ok, not all). But what happens when that becomes an obsession? I assume no code will never be 100% perfect. When should you stop refactoring? and ... continue ahead with more coding? <comment><USER2> Refactor AS you continue ahead when you notice specifically bad code/design issues. Also if you find performance issues when profiling. Don't let refactoring be your primary task, keep it on a secondary track but running along side your primary task.

</comment><comment><USER3> refactoring usually has diminishing returns, providing you're doing it well. it comes down to what will benefit you more? refactoring again for the 3rd time, which will take you even longer and/or result in less benefit than the previous 2 times, or something else like testing or development?</comment>


Can we trust floating-point numbers? (2006) [pdf] - <AUTHOR> http://www.jaist.ac.jp/~bjorner/ae-is-budapest/talks/Sept20pm2_Zimmermann.pdf <comment><USER2> I code-review altcoins[1] as a hobby and stuff like this is why I give a ding to coins using floating point operations in, say, reward code, especially when it's something relatively complicated like multiplication or division. I'm just waiting for different processors to differ in the last decimal place to cause a fork on the coin's network.

[1]: [https://github.com/Earlz/coinreviews](https://github.com/Earlz/coinreviews)

<comment><USER3> As far as I know, all the modern processors follow the IEEE 754 standard, which is a serious and reliable standard, so if anything like that happens, it shouldn't be a processor issue.

The implementations of the languages are something else, however. I suggest the fine article by Bruce Dawson:

[https://randomascii.wordpress.com/2013/07/16/floating- point-...](https://randomascii.wordpress.com/2013/07/16/floating-point- determinism/)

</comment></comment><comment><USER4> Clarification: The opening few slides (titled "who is NOT using floating point numbers") contain a list of prominent software that uses floating-point. The author is not an idiot. Presumably this was more clear with the verbal portion of the talk intact, but it would appear to be rhetorical device: "who uses floating point? It would be easier to list who doesn't; lots of prominent software uses floating-point…"

If you don't know who Paul Zimmermann is, you may safely assume that he knows more about floating-point than you do (actually that he knows more about computer arithmetic than you do). While there may well be errors or typos in the slides, it's far more likely that you are misinterpreting something without the context of the talk that went along with them.

</comment><comment><USER5> Much of the problem with floating point is that we intuitively expect it to follow the math rules we're familiar with, but they seem to, but often don't.

Most programmers realize they are 'approximate' but they don't notice consequences, such as checking for exactly equal to zero, when you need to check for "close enough" depending on your context.

More subtly, but perhaps more damaging, they break properties like associative and commutative. Different orders change values, you can add tiny values repeatedly to a large value, and it won't change, breaking testing of the value...

The presentation goes over many of these, but the fundamental problem, to me, is that we're falsely presenting an interface suggesting "this acts like a number" when it doesn't in many key ways. We should perhaps call them approximate pseudo numbers or something. Don't allow operators, require functions like SortOfMaybeAdd, AcculumateList...

Perhaps such measures will communicate better. A fascinating world we program in...

<comment><USER6> > More subtly, but perhaps more damaging, they break properties like > associative and commutative.

No: commutativity of multiplication and addition still holds, but associativity indeed does not. That associativity does not hold is a much more unpleasant than if associativity would hold but commutativity wouldn't (the mathematics of common associative, but non-commutative structures is understood quite well, say (non-abelian) groups and monoids).

<comment><USER7> Actually commutativity doesn't hold either, because of dealing with NaNs (at least on x86, on a quick search I can't find a reference for whether this behavior is part of IEEE 754 or just implementation defined). Operations with two NaNs will give the first operand. You can see this with a quick test program:

      #include <stdio.h>
      int main() {
          unsigned long long bits = 0x7FFC000000000000;
          double x = *(double *)&bits;
          bits += 1;
          double y = *(double *)&bits;
          double z = x + y, w = y + x;
          printf("%llx %llx\n", *(unsigned long long *)&z, *(unsigned long long *)&w);
      }

Of course, this probably doesn't matter for most applications.

<comment><USER4> IEEE-754 says that the result "should" be one of the two input NaNs. A platform could choose to e.g. take the NaN with the smaller payload to make * and + commutative, or it could simply define away NaN payloads entirely.

</comment></comment></comment></comment><comment><USER8> Is there any separate write-up of this? Trying to read the slides to a presentation is just frustrating.

(And if you can actually read the slides by themselves the presentation is probably not very good).

</comment><comment><USER9> Interesting, though Excel most certainly does use floating point numbers for storage and calculations (both at the time of its writing and now), and has some infamous calculation errors as a result. Maybe I misunderstood the slide.

EDIT: I don't normally care much about a "downvote", but when it must be backed by ignorance I have to comment. Excel has always, and to this day, uses doubles. There is not a whit of decimal math to be found in the product. I kind of know this given that my industry is finance, and the calculation quirks of Excel (which is simply a quirk of floating point math) are something that the industry is aware of and works around.

Now it by default rounds the number for presentation, but surely no one on HN would be so confused that they fail to understand the difference.

<comment><USER10> Don't worry about downvoters, they know not what they do. Also, it's easy to accidentally press the wrong arrow and it cannot be undone.

On topic: do you happen to know why Excel doesn't use decimal math? I'd imagine for most spreadsheets the performance difference shouldn't be noticeable.

<comment><USER4> Speculation: The performance impact would have been significant in the mid-1980s. They can't change the arithmetic now because users would complain if their spreadsheets started producing different results (how many billions of dollars of contracts were negotiated based on the results of an Excel spreadsheet?)

</comment></comment></comment><comment><USER11> BLAS doesn't use floating-point numbers? So what does it use? My impression was that BLAS _was_ a library of fast linear algebra. Decimals are not fast, as far as I'm aware.

<comment><USER12> It does use floating point. I think the slide was misleading.

[http://www.netlib.org/blas/blast- forum/cblas.h](http://www.netlib.org/blas/blast-forum/cblas.h)

<comment><USER3> BLAS uses it, and Excel of course also uses floating point.

On the first look, it appears a dubious presentation anyway. The examples don't have much sense too: you can't actually calculate properly sin( 10e22 ) in binary floating point format because both exponent and mantissa are binary: the exponent is 2^76 and in 4-bytes floats you have 23 bits, in 8-byte doubles 53 bits, so you can't even represent the starting number with the enough bits to calculate meaningful sin. You'd need a two parameter function to be even able to pass what you actually want to pass. So calling sin( 10e22 ) in the languages with 4 or 8-bytes binary FP of course can't be expected to produce any meaningful result.

But maybe all this was spoken, not written, and it's just misleading to read it without knowing the comments.

"Who is NOT using: Excel, BLAS" could maybe then mean that author wanted to say "Excel, BLAS, they use them too"? (If we want to believe that he had any idea what he wrote about). Definitely not good to give this presentation to somebody who doesn't already know more. Confusion guaranteed.

<comment><USER4> Paul Zimmermann certainly knows that BLAS and Excel use floating-point. I assume that the spoken content of the presentation made the meaning of those slides much clearer; it's too bad that the slides are being discussed in a vacuum.

Also 1e22 (note: _not_ 10e22) is exactly representable in double (though not in float). Specifically, it is exactly equal to:

        1.000011110000110011110000011001001101110101011001001 * 2^73

which requires only a 52 bit significand.

<comment><USER3> You are absolutely right, 1e22 fits in the double, exactly with the bit pattern you showed. And it doesn't fit in the float. Thanks. One more proof that PDF alone is too little of the presentation and that it's easy for the reader to remain confused. I consider your reply "a missing slide" between p 15 and p 16.

So the author is: [http://en.wikipedia.org/wiki/Paul_Zimmermann](http://en.wikipedia.org/wiki/Paul_Zimmermann)

</comment></comment></comment></comment></comment><comment><USER13> Why we need floating point at all now? IEEE-754 64-bit decimal appears to cover everything that's needed.

<comment><USER6> They have the same kind of rounding problems - except in base 10 instead of 2.

<comment><USER14> > They have the same kind of rounding problems - except in base 10 instead of > 2

Sure, but if you aren't dealing with transcendental functions but just typical input from people and arithmetic, you don't usually introduce as many errors by rounding to a base-10 representation, so decimal floating point solves a lot of the problems (at the cost of performance if you have a system that implements it over hardware that doesn't.)

You still have the big + small problem, though.

<comment><USER3> It is proven that the binary FP accumulates errors slower than any other bigger base when the longer scientific calculations are involved.

But when you want to represent something like money, there's by definition an error as soon as you want to store 0.01 as the binary FP, and the same error doesn't happen in decimal FP.

<comment><USER6> On the other hand: If your smallest unit of money is cents (or perhaps tenth of cents), you better use large integers to store the amount of money instead of base 10 floating point numbers.</comment></comment></comment></comment></comment>


Google Instant cannot be turned off.. - <AUTHOR>

I've disabled it in preferences probably at least 4 times now, last time being just yesterday. Today I go to search for something, and sure enough it's back again. Check preferences - it's back on. Is anyone else as incredibly annoyed by this as I am? <comment><USER2> So stupidly annoying. I am still appalled that google instant was good nuff to stick around.

I find it still breaking my back button, distracting my thought process among other things. And like you said, I don't know why it keeps getting enabled even though I could swear I'd disabled it.

</comment><comment><USER3> Well if you aren't using google search for images or anything you could use this instead: <https://encrypted.google.com/>

</comment><comment><USER4> Google Instant is so annoying. I sometimes rephrase my search when looking at the words in the current search results. Now the current search results disappear when I am retyping.

I am not sure if that makes sense but Google Instant breaks the way I search.

</comment><comment><USER5> Workaround is to start an experiment. <http://www.google.com/experimental/>

</comment><comment><USER6> Is this a security concern or a usability annoyance?

<comment><AUTHOR> Google instant is where google shows you search results as you type, going beyond auto completing your query. Some people like myself find that annoying, and it's doubly annoying that google actually resets your preferences back to what IT thinks is better for YOU.</comment></comment>


5 tips for hacking Golang logs - <AUTHOR> https://logmatic.io/blog/our-guide-to-a-golang-logs-world/ <comment><AUTHOR> 2 interesting remarks:

* How to improve event correlation when you're using a microservice stack * Why not code logs?</comment>


Little Alchemy - <AUTHOR> https://littlealchemy.com/ <comment><USER2> This is really cute.</comment>


Y Combinator's safes spread – L.A. accelerator is now issuing them - <AUTHOR> http://venturebeat.com/2014/01/07/y-combinators-safe-notes-spread-l-a-accelerator-now-issuing-them-too-exclusive/

<comment><USER2> This is pretty neat, the whole concept of 'open legal' is fascinating to me. For years it seems Lawyer's were like machinists of old, carrying around their own special sauce of document [1]. Now quality, vetted, legal documents are pretty straight forward to come by. This is pretty cool in my opinion.

[1] This was the root of a long running joke in Intolerable Cruelty referring to the 'Massey Prenup' \-- [http://www.imdb.com/title/tt0138524/](http://www.imdb.com/title/tt0138524/)

</comment><comment><USER3> I have a question about the SAFE.

SAFE holders don't seem to have the right to veto dividends. Shouldn't they have that right? What stops a company from issuing SAFEs, making a big dividend, and letting the company's shell fold?

</comment><comment><USER4> Chiming in to say that SAFE has been "ported" to France thanks to the awesome folks at TheFamily, it's called AIR: [http://www.meetair.co/](http://www.meetair.co/)

</comment><comment><USER5> Is there anywhere that discusses/describes SAFE and its benefits/trade-offs in detail?

<comment><USER6> My startup, Casetext (YC S13), has the full text of the SAFE annotated by lawyers, investors, and founders: [https://casetext.com/contract/simple- agreement-for-future-eq...](https://casetext.com/contract/simple-agreement- for-future-equity)

<comment><USER5> This is great, thanks!

</comment></comment></comment><comment><USER7> Is "SAFE note" a valid way of referring to a SAFE security? If it's not a debt instrument, it seems weird to call it a "note." It almost sounds more like an equity option (i.e. investors are buying the right to buy a certain amount of equity at a set price in the future).

<comment><USER8> PG himself refers to them as "Safe Financing Documents": [http://ycombinator.com/safe/](http://ycombinator.com/safe/)

</comment></comment><comment><USER9> I know of at least one Atlanta-based accelerator that is using them too. They seem to be fairly sound and better than other financial docs.

<comment><USER10> is that flashpoint?

</comment></comment><comment><USER11> What discounts are SAFEs going to be issued at? Assuming no caps yet?</comment>


Love My Company but Feel Like My Salary Is Low - <AUTHOR> Like the title says, I love my company and everyone that works there.
It's a company with about 20 of us who are mostly developers. I generally really like it - I feel like I could be more challenging work (but I think that's a bit of the grass is always greener).
My friends in tech are giving me crap because they know I only make around 50k and I'm entering a mid level of experience as a Front-End Dev. My skill set looks like this: high levels of knowledge with OO Javascript, Angular.js/Backbone/Ember.js, Ruby on Rails, Postgres/Mysql, Grunt, Less/SCSS. I've been here for 4 years now. I'd rather have better quality of life than get paid a lot but I can't help thinking that 50k is feeling a little low for the Portland, OR area. Any stories of a good balance between salary and quality of life? Or in a similar situation? <comment><USER2> Want the sad truth? You have to leave.

I was in this exact position once. Fun team, fun tech, lots of freedom to experiment and prototype new stuff just in case it became useful. Supportive management and sane working conditions. $37k/year.

Leaving that place was one of the toughest decisions of my young life. I had managed to secure the biggest percentage raise they were willing to give, at the end of a long negotiation explaining the state on the ground as it was in 1998 (when much like today developers were very much in demand and could essentially name their price), but that only got me up to the mid $40s.

So I took the leap. Responded to one of the mails in my inbox and took a job for another shop in town for twice the money. Folks at the old place were stunned and saddened. I wasn't sure it was the right thing to do.

But it was. Absolutely.

15 years later, I was on an even more fun team, with cool tech, respect, and all that stuff from above, but for 10X the takehome pay of that "Dream Job" from the 90s. To put it mildly, that's not where I would have been career-wise had I stayed put.

You have a whole life ahead. Even the best thing to ever happen to you will be something you look back at as a local maxima. It's not worth leaving millions (and I do mean actual real millions) of dollars on the table just to stay someplace fun.

Float your resume today. Future you will thank you for it.

</comment><comment><USER3> I usually encourage friends to never stop looking for opportunities to expand. Comfort and "stability" is worth something, but it's important to not stagnate (if you want a career). I would do a side project, consult, do something new at work, or find a new job. :) Do anything but let the status quo guide.

If you work for a reasonable company (and I feel most are), your quality of life is something you make happen or let happen. It is very easy to let the company guilt you into working 12 hours. Set appropriate boundaries and be in control.

</comment><comment><USER4> My best advice is to never stop learning and improving your skills. The larger your skill-set, the larger your leverage. If I were you, I would use the opportunity to start a side project to supplement your existing skills. As good as high-paying jobs are, they are often equally as demanding and can sap your will power if you don't have outlet to express your creativity.

As a suggestion based on your skills, perhaps in might be beneficial to learn some machine based programming languages (like java or better yet C). You seem to have a strong background in Web development, maybe a side project working with an Arduino would help to supplement your skills and give you a more rounded Computer Science background.

</comment><comment><USER5> Here's the thing: I seriously doubt you actually love your company or your job. Instead, you're comfortable.

You're not challenged and you're flagrantly underpaid in a great tech city. I would guess someone decent with your profile should make 2x what you're making. Think about that. Would you recommend such a job to a friend?

You need to move on. There are lots of companies as good or better as your current one, trust me. Take it one step at a time - start with updating your resume. Hopefully this will get you excited about the next steps.

When you give your notice it will be an amazing feeling. All your self-esteem will come rushing back. Good luck.

</comment><comment><USER6> I have one piece of advice for you. Start looking for higher paying opportunities and when you get a nice offer that you are happy with hand in your notice and move on.

Don't hold out for a big raise at your current workplace, it never works like that.

</comment><comment><USER7> It seems pretty low for Portland. Try applying to jobs you're interested in. Get an idea of what you're worth. If you end up really liking a place you interview, take the job. If you decide to stay at your current place, at least you know what you're worth and can negotiate your next raise better.

</comment><comment><USER8> It sounds to me like you're comfortable and don't think risking the steady pay and fun environment for something you're not sure will work out.

This is the worst thing you can do for yourself!

Your potential is always more than where you currently are in life. You should always be looking for the next opportunity to advance your career and increase your worth. This is why a lot of people stay at a job for 2 year and then move on - they learn a lot, contribute a lot, then go sell themselves for a lot more money and repeat.

You could jump ship right now for double the pay. Your friends at the company won't blame you for it, and it's healthy for founders of a company to see that happen.

Good luck!

</comment><comment><USER9> 1) List out your accomplishments at the company from the last 4 years.

2) Try to find out which accomplishments grew revenue or cut costs for the business. Try to find out how much. If necessary, take one of the sales managers out to lunch and tell them you're trying to get a broader sense of the work you do from their perspective.

With that information in mind you can get a rough sense for the company's BATNA; When you go to them in a negotiation you now know that for you to leave would mean they lose a resource that generates $450,000/yr in value for the company.

It also means you have some great lines for your resume. "...which earns $4K monthly recurring revenue" is a tantalizing way to end a scentence if it is true.

Google [bingo card creator blog] for more on this topic.

</comment><comment><USER10> Is everybody in your company paid low or just you?

If it is the latter and you are confident that you are making a solid contribution then you could ask for a raise. I'm no expert in this area, but I've seen posts on how to go about that.

<comment><AUTHOR> To be honest, I'm not sure. Is it common to share salaries with your peers in this industry because I'm not sure what anyone else gets paid.

<comment><USER11> Use glassdoor.com to research salaries for similar job titles in your city.

</comment></comment></comment><comment><USER12> It's low and If you have been there for four years and are not progressing how you would like or are early in your career it's time to move on.

<comment><USER4> Agreed, in fact I'd go as far as to say after 2 years you should have a pretty good feel for the environment and have an idea if there is room for growth. Some companies propagate a culture of mediocrity where everyone is just there to collect a paycheck and go home. If you can recognize that sentiment early on, its best to distance yourself to avoid getting sucked in and resigning yourself to the "do enough to get by" mentality.

</comment></comment><comment><USER13> I'm in Portland, and I'm not even in the same type of work as you (I do Systems Engineering work), and _I_ know you're _woefully_ underpaid given the kind of experience you have.

Like others have said already, get out of there.

</comment><comment><USER14> IS 50K before or after tax? What is after-tax salary? I have a friend who lives in South east asia country and his after-tax income (base+bonus) is 65K.

</comment><comment><USER15> That's about what you would make in Ukraine given the info you listed. So for US this seems really low.

<comment><USER16> Are you serious ? in Ukraine ? I make about 60k$ in Paris, and have a lot of friend making about 50k$.If Ukraine is like that, I'll be there in two months ! :)

<comment><USER15> I am totally serious a good Ruby dev with 4 years experience and really good english 4K/month is very doable. A good Senior Java dev would be 5K-5.5K (I had actually people turning down 5.5K/month for really nice remote positions). Can't say how tax/work permits work for foreigners but for citizens they operate under Private Entrepreneur thingy and basically pay flat 3% tax.

<comment><USER16> Do you have a number for C++ ? Thanks for the info anyway :)

<comment><USER15> For C++ only know that for DSP jobs it is in 4K/month range can't say what it in general.</comment></comment></comment></comment></comment>


Defending against Rowhammer in the Linux kernel - <AUTHOR> https://lwn.net/SubscriberLink/704920/7be829926c94cd9f/ <comment><USER2> A nice relevent discussion from a post Alan Cox started upon G+ recently [https://plus.google.com/u/0/+AlanCoxLinux/posts/AFqqpTPpKZ5](https://plus.google.com/u/0/+AlanCoxLinux/posts/AFqqpTPpKZ5)

Lunus covers the TL;DR in this quote "there is nothing remotely sane you can do in software to actually fix this." and gets down to ECC memory being the golden solution.

<comment><USER3> ECC isn't really the golden solution. It will likely just turn rowhammer into a DoS instead of something which is exploitable (and even with ECC it can still be exploitable just harder). While this is an improvement I wouldn't call it a golden solution.

<comment><USER4> A DoS from a program already running on the same hardware is nowhere near the same level of vulnerability as a privilege escalation.

Security is all about increasing those difficulty thresholds, not absolutes.

<comment><USER3> I agree, the only thing I was really taking issue with is calling it a "golden solution". When in fact it is just a (useful) mitigation.

TRR might better fit the description of a "golden solution" although it is still technically a mitigation. I would very much like to see more ECC in consumer/desktop systems.

<comment><USER2> I agree as I also found the lack of transition of ECC into consumer level pricing and hardware a lamentable state.

Now with these public issues becoming more open, one can only hope that some consumer product moves to ECC and ends up driving ECC memory prices down in much the same way as mobile phones have driven many sensors and associated hardware down in price, thru volume.

</comment></comment></comment></comment></comment><comment><USER5> This approach was also covered at Black Hat:

[https://www.youtube.com/watch?v=dfIoKgw65I0](https://www.youtube.com/watch?v=dfIoKgw65I0)

[https://www.blackhat.com/docs/us-15/materials/us-15-Herath-T...](https://www.blackhat.com/docs/us-15/materials/us-15-Herath- These-Are-Not-Your-Grand-Daddys-CPU-Performance-Counters-CPU-Hardware- Performance-Counters-For-Security.pdf)

</comment><comment><USER6> If you know how memory addresses map to row/column, it should be possible to force refresh the entire array with a few tens of thousands of reads, rather than delaying for 64ms. (At least on conventional DRAM, reading a row implicitly refreshes it; I presume it's the same on DDR SDRAM.)

<comment><USER7> A very similar approach, that attempts to refresh rows adjacent to the ones that are being repeatedly accessed is described here(disclosure: I am one of the authors of the paper): Paper: [https://iss.oy.ne.ro/ANVIL.pdf](https://iss.oy.ne.ro/ANVIL.pdf) Kernel Module Code: [https://github.com/zaweke/rowhammer/tree/master/anvil](https://github.com/zaweke/rowhammer/tree/master/anvil)

It is tested on on an Intel SandyBridge CPU. For a full deployment, we would need to know which bits of the physical address are used to select the DRAM banks and rows for each specific CPU. There has been some effort to reverse engineer these mappings by various people. Two excellent sources regarding these mappings: [http://lackingrhoticity.blogspot.com/2015/05/how-physical- ad...](http://lackingrhoticity.blogspot.com/2015/05/how-physical-addresses- map-to-rows-and-banks.html) [https://www.usenix.org/system/files/conference/usenixsecurit...](https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_pessl.pdf)

<comment><USER8> This, this is the real golden solution. Thank you for your work and links, so full of information, golden, golden!

</comment></comment></comment><comment><USER9> Wouldn't an effective countermeasure to this also be knowing what types of neighboring cell reads are vulnerable and forcing reads on those instead? Bonus points if the reads pull in to the cache data that is actually useful to sequential access.

<comment><USER10> With modern processors, that becomes a much more difficult proposition. For various reasons, processors now scramble addresses before writing to dram. This makes it more difficult to figure out which cells are neighboring, and much more difficult to implement that type of countermeasure.

<comment><USER9> Are you talking about userspace memory mapping (via pagetables) to physical address space, getting confused about what Address Space Layout Randomization does, or thinking of the very latest CPUs (announced) which offer to encrypt the content of memory pages (Secure Memory Encryption and Secure Encrypted Virtualization)?

In any event, the kernel can know what's behind the curtain and that is the context in which the suggestion and news item exist.

<comment><USER10> This is called Data Scrambling on Intel processors. There's not a lot of info I can find from the horse's mouth, but the datasheet [1] has a blurb:

        The memory controller incorporates a DDR3 Data Scrambling
        feature to minimize the impact of excessive di/dt on
        the platform DDR3 VRs due to successive 1s and 0s on
        the data bus. Past experience has demonstrated that
        traffic on the data bus is not random and can have
        energy concentrated at specific spectral harmonics
        creating high di/dt that is generally limited by data
        patterns that excite resonance between the package
        inductance and on-die capacitances. As a result, the
        memory controller uses a data scrambling feature to
        create pseudo-random patterns on the DDR3 data bus to
        reduce the impact of any excessive di/dt.

So basically, all the kernel knows is that the data is in there "somewhere", and can be accessed traditionally.

[1] [http://www.intel.com/content/dam/www/public/us/en/documents/...](http://www.intel.com/content/dam/www/public/us/en/documents/datasheets/2nd- gen-core-desktop-vol-1-datasheet.pdf)

<comment><USER11> That seems to be exclusively about the data bus, not the address bus. So it affects what bit patterns get stored, but has no effect on where they get stored.

</comment></comment></comment></comment></comment><comment><USER12> I have an alternative suggestion for how to mitigate this.

I designed a number of DRAM memory boards "back in the day", but haven't kept up with recent developments. But this idea could be used as a starting point by someone more in tune with current hardware to write a kernel module to help mitigate Rowhammer.

One key thing to know is that, internally, a DRAM chip isn't accessed by a single row (of let's say 32 bits) at a time. What happens is that a read causes a large number of bits (literally thousands) to be accessed and refreshed at once. Then the selected 32 bits are returned to the CPU. But, as a side effect, all those 1024 bits (or perhaps a lot more in current DRAM chips) are refreshed.

So what's needed is a background process that does the following for all of physical memory:

       perform an uncacheable read of 32 bits direct from DRAM
       increment read address by perhaps 32 words
       pause for some small amount of time (perhaps 1 usec)
       repeat forever

This task of repeatedly sweeping through physical memory will, as a side effect, cause all memory cells to be refreshed.

Obviously there is some magic needed, which can only be done in the kernel. First, _all_ of physical memory must be able to be accessed by this process. Second, some tuning must be done to keep the task from consuming too much memory bandwidth. Third, it might make more sense to do something like reading quickly a burst from 4 different physical memory locations then pausing for 4x as long.

Unfortunately, running this type of program would be devastating in terms of power consumption. DRAM chips consume much more power while being accessed than while they are in standby. So it probably would have an large deleterious effect on a laptop. But it would probably be OK on a desktop or server.

That just the basic idea. There is a lot of tuning that could be done. For example, instead of reading thru all of physical memory, perhaps just read only the _kernel_ memory. That's a lot less memory, a lot lower power consumption. The idea is that corrupted kernel memory is potentially a lot more harmful than corrupted memory used by some random user process.

<comment><USER13> DRAM refresh occurs regularly and automatically, think of it as signal regeneration. But this does not correct bit flips, even on ECC memory.

For ECC memory systems your idea is called _ECC scrub_. The idea is to trigger SBE correction before more bit flips occur, turning it into an unrecoverable or undetectable error. Usually it appears in BIOS as Patrol Scrub (continuously and slowly walk through all memory, slow enough not to contend with active programs) and Demand Scrub. See also [https://github.com/andikleen/mcelog](https://github.com/andikleen/mcelog)

I've never seen a reason for Demand Scrub until now... If the kernel talked to the memory controller to map which pages were which banks it could cause a scrub specific high risk pages (e.g. the kernel as you say) or after X uncached accesses... Or it might be possible to segregate less trusted code to specific bank groups.

[https://lackingrhoticity.blogspot.com/2015/05/how- physical-a...](https://lackingrhoticity.blogspot.com/2015/05/how-physical- addresses-map-to-rows-and-banks.html)

Another approach might be to use memory integrity. Intel SGX has memory encryption and uses a tree of hashes to validate. It has holes against an on- machine attacker, but would defend against bit flips. [https://eprint.iacr.org/2016/204.pdf](https://eprint.iacr.org/2016/204.pdf)

</comment></comment><comment><USER14> I realise the article already touched on this, however issueing non temporal stores (MOVNT family) will bypass caches thus mitigating this particular proposed protection.

</comment><comment><USER15> I don't see how it will help. First, if the vendors can ship a new Linux kernel, they can as well ship updated firmware to increase memory refresh frequency. Secondly, on mobile devices CPU and GPU share the same memory, and it could be only a matter of time before we see GPU-powered rowhammer attack.

<comment><USER13> Why do you think the firmware would be capable of programming DRAM refresh rate to a heretofore unheard of frequency? This capability does not exist in the memory controller.

It might be hard to get the GPU to hammer memory hard enough because of the caches ([http://wccftech.com/intel-skylake-gen9-graphics- architecture...](http://wccftech.com/intel-skylake-gen9-graphics-architecture- explained-gt2-24-eus-gt3-48-eus-gt4e-72-eus/)). Maybe with glBufferData in DRAW mode it would force uncached access, depends if the graphics core cache snoops the address bus (coherent) or not, in which case it could be tricked. However the AMD Fusion docs certainly seem to indicate it is possible, and significantly higher read bandwidth than from the CPU ([http://developer.amd.com/wordpress/media/2013/06/1004_final....](http://developer.amd.com/wordpress/media/2013/06/1004_final.pdf)). Indeed, it makes me wonder why (given the repetitive read pattern required for updating VBOs) whether the system instability people have seen before is not due to the GPU doing unintentional rowhammer.

<comment><USER15> I thought refresh rate is programmable. But if not, at least firmware could lower the DRAM frequency.

Intel GPUs have write-back caches because they share L3 cache with CPU cores. AFAIK, other GPUs typically have write-through caches, which doesn't help against rowhammer.

</comment></comment></comment><comment><USER7> A kernel module implementation along the same line: [https://news.ycombinator.com/item?id=12822490](https://news.ycombinator.com/item?id=12822490)

</comment><comment><USER16> Just curious, is it possible to rowhammer cache?

<comment><USER17> Cache is usually SRAM, while rowhammer is a problem specific to DRAM.

</comment></comment><comment><USER18> Flagged for linking subscriber only material.

<comment><USER19> [https://lwn.net/op/FAQ.lwn](https://lwn.net/op/FAQ.lwn):

 _Where is it appropriate to post a subscriber link?_

 _Almost anywhere. Private mail, messages to project mailing lists, and blog entries are all appropriate. As long as people do not use subscriber links as a way to defeat our attempts to gain subscribers, we are happy to see them shared._

<comment><USER18> Ok then, unflagged. Thanks for the clarification.</comment></comment></comment>


Mininova ordered to purge all links to copyrighted files - <AUTHOR> http://arstechnica.com/tech-policy/news/2009/08/mininova-ordered-to-purge-all-links-to-copyrighted-files.ars

<comment><USER2> How do they tell copyrighted content from noncopyrighted content? Granted for the more popular content it's fairly easy, but once you start getting into things that may or may not be copyrighted, and the authors may or may not have given their permission for it to be on torrents, it starts getting difficult.

While I can't argue the decision, I feel this will just end up helping the large copyright holders, and ignoring the small ones.</comment>


Google can't search anymore - <AUTHOR> https://binarypassion.net/google-can-t-search-anymore-d8588d9c7d87#.k5uxoakub <comment><USER2> I am conflicted about archived Usenet. I agree that there's a lot of "former glory" there. But I'm also _glad_ that my own personal rantings aren't as easily found.

Google search in general, not just the former Deja News, has gotten much worse. And that's the real tragedy. It is now one step away from being fucking useless. They've slowly taken away all the advanced features.

Nowadays, when I search for something like this:

       "search phrase one"  "search phrase two"

I will get a plethora of hits that omit one or the other of those words or phrases, starting with the very first page of results.

It used to be that you could do something like

       +"yes I want to" +really +include +this

to be sure your words all mattered. But they stole the plus for Google Plus, and other advanced search features have also been neutered.

But the good news is that they're developing blimps and thermostats and other crap like that!

</comment><comment><USER3> An old button said "Reading Usenet is like drinking from a firehose. Posting to Usenet is like shouting from a mountaintop. Archiving Usenet is like saving used toilet tissue."

While there is truth to each claim, I'd also like to see better historic search-ability... Anyone know if it's possible to get the input set that Google got on the historic text group side?

<comment><USER4> A quick Google search shows that most commercial usenet providers do not have more then 3000 days worth of text retention. (ie, you can get a little more then 8 years worth of history).

* Altopia has 499 days of text retention ([https://www.altopia.com/retention/retention.html](https://www.altopia.com/retention/retention.html))

* NewsDaemon has 720 days of text retention ([http://www.newsdemon.com/newsgroup-retention.php](http://www.newsdemon.com/newsgroup-retention.php))

* Giganews has ~ 960 days of text retention ([http://www.giganews.com/news/article/retention_grows.html](http://www.giganews.com/news/article/retention_grows.html))

So, unless someone out there has terabytes worth of text storage from way back when (which is one reason why Google bought Deja News in the first place), I don't think it will be possible to get all that history.</comment></comment>


Meta: [dead] users? - <AUTHOR>

I occasionally see [dead] comments from users.  Looking through their history, it looks like all their comments past a certain date are [dead], and that they're not aware of this fact - but I also don't see anything particularly offensive in their history.  Is it possible they somehow mistakenly get auto-flagged and no one notices?  It doesn't seem possible to upvote or reply to [dead] comments, so how can they climb out of this hole which they're (presumably) not even aware they're in? <comment><USER2> I wonder if it's possible to have a social news site where certain members can be given the "Blue Pill?" That is, their comments and submissions do not appear on the regular site, but instead appear on an alternative version of the site generated for them. There could even be a Markov chain reply generator that replies to their comments, and a Bayesian filter that fake- upvotes them. (Trained by upvoting on the normal site.)

Better yet, have a "red pill" instead. Have an elitist site-within-a-site that only select members could see. Have it only available to members with a certain Karma, and then require that they get an invitation from another member already there.

Actually, it would be best to have all 3 levels!

EDIT: Another wrinkle. Have the "Red Pill" be divided up into groups, each requiring a separate invite. Membership to multiple groups would be allowed.

EDIT: Actually, something like this idea would be _even better_ on IRC! Also, receiving the "Blue Pill" would look on the surface just like getting a "Red Pill" invite. Do Androids Dream of Electric Sheep?

<comment><USER3> You haven't been invited, yet? Oops.

<comment><USER2> We've both been Blue Pilled. Actually, just you. I'm really a Markov chain.

</comment></comment></comment><comment><USER4> my guess is you're not seeing the whole story. could be that the alias in question is one that was made to evade an earlier ban, for example.

<comment><AUTHOR> That's my guess as well (although there's always the possibility of human/software error).

It just seems... eerie, and a bit sad. I understand how effective a "transparent" ban can be for spammers, it just seems strange to see people comment for weeks in this mode. Never replied to, never voted up or down, seen by few. Like digital ghosts who may or may not even know they're ghosts.

</comment></comment><comment><USER5> I think this is because you have showdead set to "yes". Go to your profile and turn it off.

<comment><USER6> I think the question is how does this happen, and why don't these ghosts know they are dead? It is very 6th Sense.

"I see dead people. They only see what they want to see. They don't know they're dead."

<comment><USER7> Presumably mods kill them, and if they knew they were dead they might respawn.

If people are getting killed for no good reason, that sounds like moderator abuse. But I'm skeptical; I have showdead on myself and haven't seen anything that seemed like it was wrongly killed.

</comment></comment></comment><comment><USER8> Can you link to examples?

<comment><USER6> If you have showdead on, there is a dead-man posting in response to your comment, mixmax.

</comment></comment><comment><USER9> It's possible to upvote [dead] comments, but not reply.

<comment><USER10> Actually I've been trying to upvote 'tempor', but it isn't sticking. I think it's no good since he's dead. I just _see_ the 2.

<comment><USER9> You're right, it doesn't stick.</comment></comment></comment>


Git for the masses - <AUTHOR> http://kivo.com/blog/git-for-the-masses/

<comment><USER2> Office already has features to track and merge different copies of documents together. Assuming you haven't disabled it, it also has (hidden) builtin versioning, allowing a git-like three-way merge with all the accuracy improvements that entails.

The larger problem is, of course, discovering that these features exist and training people to use them.

<comment><USER3> One problem with the office track changes feature is that ALL PREVIOUS VERSIONS OF THE DOCUMENT ARE INSIDE THE DOCUMENT.

This is wrong, the document should be inside the VCS.

Some examples that my mother brought up regarding Law firms and the track changes feature are that if somebody writes 'adding this paragraph because of idiot customer X' or repurposes a document for customer Y into a document for customer X then some bright beaver at customer X turns on the track changes feature...

I'm sure there is a way to scrub the changes from the document before sending it but not separating the content from the history will always create problems.

<comment><USER2> Tracked changes show up in bright red, blue, and green colors. Difficult to miss, as long as you don't hide them. There are also ways to ensure that a "final" revision of a document is saved.

The hidden versioning I talked about are attributes on elements in the XML version of documents that are not normally displayed. They contain a random number that distinguish text edited in different "blocks" from each other -- making it possible to determine how to combine different versions of text, without containing full version history (and thus leaking information like in your example). It's not as good as a recursive three-way merge that git has, but it's reasonably effective when combining documents.

You are right that it doesn't separate the content from the history -- but keeping full history and keeping things private are at odds with each other anyway. Consider the outrage when people rediscovered the Fast Save feature -- it was very useful, but it also leaked potentially sensitive information in a way people didn't expect.

[http://support.microsoft.com/kb/197978](http://support.microsoft.com/kb/197978)

[http://news.cnet.com/8301-10784_3-9780073-7.html](http://news.cnet.com/8301-10784_3-9780073-7.html)

</comment></comment></comment><comment><USER4> Kivo looks a lot like DocVerse. Which was eventually bought by Google and became Google Cloud Connect[1].

Google Cloud Connect was supposedly replaced with Google Drive[2]. No idea if it offers the same functionality. There may be 100,000s of people missing Google Cloud Connect which just isn't enough of a market for Google to pursue.

Personally, I don't think the problem is lack of tools or a better way than email. It's just lack of training or willingness to do something different.

[1][http://googledocs.blogspot.com/2011/02/google-cloud- connect-...](http://googledocs.blogspot.com/2011/02/google-cloud-connect-for- microsoft.html) [2][http://support.google.com/a/bin/answer.py?hl=en&answer=30170...](http://support.google.com/a/bin/answer.py?hl=en&answer=3017040)

<comment><AUTHOR> You're right, ease of adoption is the no. 1 barrier to products like ours and docverse. We know that to make this work, it needs to be at most two or three steps to be fully set up and working with someone else, and then very little effort from then on. No one has made it this simple yet. Also, we're doing slide by slide version control, rather than snapshots of the whole document.

People emailed themselves files before dropbox, but since dropbox I've never done that. That's the kind of ux needed to make any product solving this problem succeed.

</comment></comment><comment><USER5> I see this problem all the time in our marketing department. I think Microsoft Office is the problem, and the solution is to move toward systems which support collaborative document editing like wikis.

One of my pet peeves is emailed Word documents that the author has no intention that the reader will print. I prefer to read most documents in a web browser. I consider Word documents (and PDFs) to be skeuomorphs from a time when the printed page was the only means to share information: [http://baus.net/documents-are-skeuomorphic/](http://baus.net/documents-are- skeuomorphic/)

Word is convenient for the author, but not the reader. I suspect over time its use will diminish as better collaborative systems become the norm.

</comment><comment><USER6> Re: enterprise vc, I am still horrified whenever I think about the "diff tool" one of our top consultants from Big Blue used when coding in Java: copy code from IDE into Word, copy the Word file across systems, reverse the process...

As for what you guys are doing, it's fantastic and it was high time someone decided to tackle the problem. Another huge market opportunity is an editor tailored for writers (academia, fiction, etc), with vc embedded and an open format behind the scenes (HTML maybe).

<comment><USER7> hey ludoo - cheers for the reply; my name is Leo and I'm CTO @ kivo. Re for a version for writers, would this entail MS Word? We are planning to ship our Word version in the near future and it would be great to get your feedback on what you would like this to look like (email@example.com). All Office files post-2007 actually do have the open format of OpenXML behind them, so we can totally see this being a reality.

</comment></comment><comment><USER8> This is the sort of problem that if you don't solve it _very_ carefully, you will get a "working" monstrosity that you will wish was never created in the first place.

See: Sharepoint. I honestly prefer emailing around files, but good luck going back to that once you've got sharepoint.

<comment><AUTHOR> completely agree, we'd love your help. I'm on firstname.lastname@example.com

</comment></comment><comment><USER9> I'm married to a designer who spends a lot of time in Adobe products, and her team's collaboration workflows are very similarly busted.

I've often felt like they could make great use of a version control system, and wondered why this hadn't been done before.

Good luck, this looks really promising!

<comment><USER10> It's been done for design, architecture, and engineering. There are (were, at least) specialized, integrated revision control products out there by Adobe and AutoDesk. I don't think I've encountered them in the wild, but I haven't looked too hard.

I don't think it's lack of product. I pretty convinced that there just isn't any significant level of adoption. Revision control is just an intrinsically difficult thing for people to grasp. I'm sure more than a few folks here have walked into software shops that were either abusing or simply not using any revision control.

Look at the state of the art for a product made by programmer for programmers: [https://www.kernel.org/pub/software/scm/git/docs/howto/rever...](https://www.kernel.org/pub/software/scm/git/docs/howto/revert- a-faulty-merge.txt). I was trying to explain this process last week. It's just not easy.

</comment></comment><comment><USER11> Installing a plugin and pressing "Sync" may indeed be improvement over manually merging Word docs, although they do gloss over the hairy yet important bit of managing permissions: who exactly gets access to each doc?

But having gotten used to Google Docs, it's considerably more convenient -- hell, nearly magical -- to be able to _just work_ and have your changes sync in real-time. For example, meeting minutes pretty much write themselves when everybody has the ability to edit the doc simultaneously and summarize what they've just said.

<comment><AUTHOR> If someone has the document then they can get the changes. We know this isn't the perfect way to do, but it's the simplest way to start off with. Would appreciate any thoughts on how we can make this better. I'm on zefi@

</comment></comment><comment><USER12> Awesome. The part about the crazy, convoluted workflow Powerpoint users go through to share changes rings so true, at least from a management consultancy perspective (I used to be one). When I was one, we weren't allowed to use Google Docs, etc, so having this directly in Powerpoint would have been the killer feature.

</comment><comment><USER13> My inner-management-consultant-child just shed a little tear thinking about how many times I've had to redo work lost to coworkers editing the wrong emailed version.

<comment><AUTHOR> we'd love to help!

</comment></comment><comment><USER14> >Function: Work out what has changed

>Dev Method: git diff

>Normal Method: Open two documents at the same time, look through to work out what the differences are.

I don't think non-programmers are all manually comparing documents. In Microsoft Word, people can use any of the following methods:

\- "Track Changes" when they edit

\- use Word's compare documents feature

\- view Previous Versions on Word Wep App

\- Use Sharepoint (if they're in a large company).

I agree that version control is still an issue, but it's not like nothing exists yet. I think Microsoft or Google will probably be able to improve their version-control/collaboration tools though, so it might be hard for a third- party to beat them.

</comment><comment><USER15> This looks neat!

edit: Document syncing beyond just the dumb hard drive approach is a market that is wide open. We saw the beginnings of it yesterday at Dropbox DBX and with things like LayerVault. Huge opportunity.

Disclaimer: I started LayerVault.

<comment><AUTHOR> huge fans of what you guys are up to. what's the best way to get in touch?

</comment></comment><comment><USER16> The scale of this problem is hard to overestimate. I estimate that people collectively spend 100 billion hours in PowerPoint annually. We're tackling the same problem at LiveLoop ([http://getliveloop.com](http://getliveloop.com))... but we capture edits keystroke by keystroke so you don't have to click "sync" to see each others edits. Somewhat like Etherpad inside PowerPoint. The other big problem we've identified is participating in PowerPoint from tablets... So we have a mobile client that also lets you see presentations in keystroke-by-keystroke realtime.

</comment><comment><USER17> _" You should be able to sync changes without worrying about permissions or storage locations."_ seems to conflict a little with _" We know how important privacy is, ...so no one except you and your team can ever access your files, not even us."_

It seems to me that they've replaced the step of 'save it in the right location' (skydrive, sharepoint, dropbox) with 'open it with the right program'. I don't see that as a benefit at all. You even lose the normal workflow of just opening a file by double clicking it.

<comment><AUTHOR> Sorry, we're probably not clear. You can still open your documents just by double clicking on them. If you and I were working on a deck and I stored the flie on dropbox and you on your desktop - we could both double click on the pptx files and they would open. Let me know if I've misunderstood you.

<comment><USER17> So why the convoluted method of opening in the video then, and the emphasis that I should open it as a kivo file? If I just open it in powerpoint and save changes am I still getting the versioning and updates shared to my friend?

If we have it stored in two different places, how do the changes get to his file on his dropbox where I don't have access?

<comment><AUTHOR> So when he makes a change to the file, that edit is synced to a git repo that you have access to, your desktop document (via kivo) is polling that repo for changes and when it sees one pulls it down and displays it within powerpoint

</comment></comment></comment></comment><comment><USER18> After spending some time in the business world outside of development this is a problem I've been thinking a lot about as well.

Dropbox has slightly improved this problem but not by much.

<comment><AUTHOR> ping me on zefi@kivo

</comment></comment><comment><USER19> This appears to be a git-like backend for Microsoft Office documents; initially starting with Power Point.

There are web based solutions from wikis, to trackers, and things like Google Docs and eversion allow many people to collaborate on a document at the same time (eversion does it in real time).

<comment><AUTHOR> We're starting off where we know people really have the problem - with MS office files stacked away on old network drives. In the long run we want to integrate with any file type - Photoshop, CAD etc. Wherever there's currently v1, v2, v3, v5_tommy_edit2 we think there's room for improvement.

<comment><USER20> How do you plan to manage changes in binary files?

<comment><AUTHOR> Office docs can be exported to xml. Wherever possible we serialise to a git friendly format, if this isn't possible we'll version the binary itself. But we'd love any tips you have!

<comment><USER21> So if you diff xml docs, will users be expected to read the raw xml diff output? Or, is there enough documentation on the file formats available so that when you diff two Word docs, for example, that you can create a third doc using Word's "show revisions" feature?

<comment><USER7> hey derek, Leo here -- I'm CTO at kivo. So, although the PowerPoint COM API is super old and buggy, the OpenXML standard which has been around since Office 2007 is actually pretty advanced. This means that you can realistically diff two versions of a file and extract and analyze the changes. The C# wrapper for this is also good (the hard bit is actually serializing the slide from COM -> OpenXML in memory). We would never expect our users to read the XML!

</comment></comment></comment></comment></comment></comment><comment><USER22> How would you compare this to LiveLoop?([http://www.getliveloop.com/](http://www.getliveloop.com/)) It looks like a very similar approach, is it just sans the real-time aspect?

(I know the LiveLoop folks, so this caught my eye.)

<comment><AUTHOR> Big fans of the liveloop guys, great to see other people tackling the problem. For us we're trying to make UX our key differentiator, and keep things as simple as possible. Also, we're doing slide by slide version control, rather than the snapshots of the whole file, which a few other companies in the space go for. One other interesting thing to note, is that when we were doing usability testing, people seemed to prefer the idea of new drafts of a slide rather than pure realtime. It seemed to suit the way they currently worked rather than, realtime. This surprised us.

<comment><USER22> Interesting, that surprises me as well. Thanks for sharing!

</comment></comment></comment><comment><USER23> Any plans on spreading this to other Office formats?

<comment><AUTHOR> yep, we're working on word next. Sign up on the site and we'll keep you updated. Do you think that's the best Office format to tackle next?

</comment></comment><comment><USER24> I couldn't find anything either on your features page or in the screencast - how do you handle conflicts and conflict resolution?

<comment><AUTHOR> At the moment we don't do anything automatic. We display all the previous versions on a slide by slide basis within PowerPoint. We don't know yet what the right way to do this is, but we'd love your input - I'm email@example.com

</comment></comment><comment><USER25> The ideal solution to this problem (and many others) would be using text based, human readable file formats.

<comment><USER26> Like the XML-based formats that MS Office has used as its default for saving documents since 2007?

[http://en.wikipedia.org/wiki/Office_Open_XML](http://en.wikipedia.org/wiki/Office_Open_XML)

<comment><USER27> Isn't it zipped? Can Git really handle .docs? Would be great!

</comment></comment></comment><comment><USER28> scigit.com is solving this problem.

</comment><comment><USER29> Great, congrats Zefi and Leo! This is a huge problem for a lot of real world people (non-hackers). My mom was complaining about this a couple days ago, and I told her I knew a couple great guys working on it ;)</comment>


Sed&awk&grep&vim. shirt - <AUTHOR> http://teespring.com/sedawkgrepvim Design might look a <i>bit</i> familiar. If the shirt reaches its goal, all profit goes to charity. (Taking suggestions. Is there a charity that teaches underprivileged kids web programming?) <comment><USER2> I'd probably buy it if it had '|' instead of '&'.

<comment><USER3> Though that would be a pretty weird chain of commands to pipe. I don't think I've ever piped data into vim.

</comment></comment><comment><USER3> _all profit goes to charity_

What charity? Why should we trust you to send it on and not just keep it for yourself?

</comment><comment><USER4> I heard the emacs guys made their own version, it just reads "emacs.".

(PS: I don't hate vim :) )</comment>


SF Issues Cease-and-Desist to Mobile App Auctioning City Parking Spots - <AUTHOR> http://www.sfexaminer.com/PoliticsBlog/archives/2014/06/23/sf-city-attorney-issues-cease-and-desist-to-mobile-app-auctioning-city-parking-spots

<comment><AUTHOR> A few thoughts on this: (1) The City's attitude toward these mobile apps, which facilitate a market for public parking spaces, is that they are creating a "predatory private market for public parking spaces" by "hold[ing] hostage on-street public parking spots for their own private profit." But there's another way of looking at what is happening here. These apps aren't allowing drivers to "rent" public parking spaces--something which they do not own; rather, they are enabling drivers to sell their legal right to occupy the space. Perhaps this is just a semantic difference, but I find it irritating that they liken it to a predatory market for property they don't own.

(2)Regardless, it is clear that apps offering financial rewards for leaving a spot would violate the SF city code prohibition on contracts concerning the use of a parking space. I think these companies could easily avoid this legal snafu by adapting their model to provide other incentives for users to provide updated information about parking spots. Rather than offering to pay users each time they give a parking spot to another user, these apps should offer these users points--or "Parking Karma"\--for each trade. Users with high Parking Karma could receive special benefits--like being the first ones to receive updated information on parking spots that become available in their area. They could also be given the option to message with other drivers in the area to discuss when they plan to leave a desired spot (and each successful trade would result in more karma points to both drivers who participate). There are many ways this could be executed, and I hope these apps pivot and adapt rather than shutting down. They provide such an important service by aiming to reduce the frustration associated with public parking and achieve a more efficient distribution of public resources.</comment>


NASA tests largest 3-D printed Rocket Part - <AUTHOR> http://www.popsci.com/technology/article/2013-08/nasa-tests-largest-3-d-printed-rocket-part-ever

<comment><AUTHOR> This is an interesting follow on to previous NASA experiments in this area. This is a pretty significant part (the injector) to build using a 3D process. It is a rare case where 3D printing the part is both cheaper and faster than making it the traditional way (machining it). I would not say there are a lot of parts that fall into that category but there are some.</comment>


Native Steam under openSUSE, Gentoo, Fedora, Arch   - <AUTHOR> https://developer.valvesoftware.com/wiki/Steam_under_Linux

<comment><USER2> I installed this on my netbook running Arch last night, really excited because I had steam keys for all of the linux-capable games in the current Humble Bundle.

Sadly, the ones I tried all said they're not supported on my platform. bubble.Burst();

<comment><USER3> Is your netbook powerful enough to run games?

<comment><USER4> Netbooks may not be equipped with the latest and greatest 3D, but a lot of indie games are essentially 2D, just using the 3D for compositing. There's no reason those wouldn't work.

<comment><USER5> Unless they need a hardware accelerated OpenGL implementation to run, because they don't have a software renderer?

</comment></comment></comment></comment><comment><USER6> The linked Wiki article is about 4 years old. The section about (inofficial) _native_ clients, on distributions other than Ubuntu, was added.

</comment><comment><USER7> I really don't understand why (in terms of number of users) Debian-based wasn't the number 1 priority, let alone why _Gentoo_ was given preference to it.

<comment><USER8> I'm most likely misunderstanding you, but a debian package (though I think geared towards Ubuntu) was the first thing released, in fact a lot of those listed in this wiki page are built _from_ the debian package. <http://repo.steampowered.com/steam/>

</comment></comment><comment><USER9> Native? This is a guide to installing under wine.

Edit: oh duh. Completely skipped over that since I remember this page saying nothing of the sort.

<comment><USER10> The native part is in the first subsection:

[https://developer.valvesoftware.com/wiki/Steam_under_Linux#N...](https://developer.valvesoftware.com/wiki/Steam_under_Linux#Native_Steam_on_Linux_Beta_Client)

</comment></comment><comment><USER11> Source code please.

<comment><USER12> <script type="text/javascript"> document.write('<blink>Steam Powered</blink>'); </script></comment></comment>


How to successfully launch an MVP - <AUTHOR> https://blog.civikowl.com/how-to-successfully-launch-a-minimum-viable-product-188c743dab3f <comment><AUTHOR> Details on marketing tactics that worked and didn't with our recent launch of a Chrome extension. Hope this is helpful to others launching their MVPs.</comment>


Soft Weight-Sharing for Neural Network Compression - <AUTHOR> https://github.com/KarenUllrich/Tutorial-SoftWeightSharingForNNCompression/blob/master/tutorial.ipynb <comment><AUTHOR> Soft Weight-Sharing for Neural Network Compression - Karen Ullrich, Edward Meeds, Max Welling (13 Feb 2017) [https://arxiv.org/abs/1702.04008](https://arxiv.org/abs/1702.04008)</comment>


GitHub Cancer - <AUTHOR> https://medium.com/@sAbakumoff/github-cancer-180db780d99d#.vjnam6i93 <comment><USER2> But if you vendorise dependencies like this you don't have to worry about the npm repo going down.

<comment><USER3> I don't like your argument, I'm a bit of a purist. But the problem is that it very much makes sense. Github could go down for an hour or two, we recently had the whole problem with the leftPad package which was deleted, and npm don't always produce the same versions of dependencies (since their missing something similar to PHP's Composer's .lock file). I don't think it's a good solution, but it's absolutely a valid one.</comment></comment>


Ask HN: What are some assets that you've bought? - <AUTHOR> From where I come, people generally buy apartments which gets them a monthly income in the form of rent. I would like to know what other things can be used as assets. <comment><USER2> Anything that earns value over time is an asset.

I personally own:

* Index funds (a little bit of the entire stock market): both US and international

* Physical real estate: 2 houses (and hopefully purchasing more!)

I also invest in:

* Trying to maintain my health so I can live a happy life

* Spending time with my family and friends so I can have the type of social life I desire

* Education: I read a lot of books and spend money and time learning new things</comment>


Ask HN: How do I structure a reseller program for my webapp? - <AUTHOR>

I have been recently approached by someone, who wants to be a reseller for my webapp, blogVault.
One of the things he mentioned was that, he wanted to co-brand it, so that he can mark up and charge his clients. Now I had typically imagined it to be a situation where I had a relationship with the customer directly. What are the ways in which I can approach this situation? Is there a limit I should set on the markup this person can add?
One other concern I have here is that, there will be certain people, who will actually be paying more for the service, just because they did not directly visit my site. Can this be a problem? <comment><AUTHOR> Here is a link to my pricing page, to help answer the second question as mine is not a very expensive application.

<http://blogvault.net/home/pricing></comment>


Ask HN: Why do games usually reach higher FPS in full screen mode? - <AUTHOR> <comment><USER2> in fullscreen mode, you do flipping. in windowed mode, [https://gameprogrammingpatterns.com/double- buffer.html](https://gameprogrammingpatterns.com/double-buffer.html)

you do blitting. [https://en.wikipedia.org/wiki/Bit_blit](https://en.wikipedia.org/wiki/Bit_blit)

</comment><comment><USER3> This is probably more of a stack overflow question. Good luck hunting for answers!</comment>


Ask HN: What is the word for reinventing browser features in JavaScript - <AUTHOR> Client is building a single-page web application using some framework, and normal browser conveniences (like back/forward navigation, direct links to content, etc.) are not supported. Users complain about not being able to navigate back and forth through screens easily, or go directly to a certain screen they need to go to. Developers go about recreating these lost features using copious amounts of client-side code.<p>How would you describe, politely, what is going on here? Is there an industry standard terminology that is understandable by all? <comment><USER2> I'm not aware of a specific catchy word that precisely describes that but I can imagine it would be useful to have one.

You could describe it in sentences though. Like, breaking standard browser features is not a good thing. Also it's really really hard but still possible to create single page applications that don't break those features and support direct links and back/forward buttons and everything.

So in a way they are being lazy or biting more than they can chew.

<comment><AUTHOR> Found it: "false affordance." See my other comment below.

</comment></comment><comment><USER3> "NIH" Not Invented Here syndrome. If it was not invented here it is not used. Not paid to invent everything from scratch. Paid to implement features. Success is achieved by applying not best practices but proven practices. If it works use it regardless of the source as long as it was not stolen.

<comment><AUTHOR> It is not an automatic preference for in-house solutions, but just not being aware of how to take advantage of known UI patterns on the web. The problem is I have no slogan or buzzword to hang this concept on like "RESTful" or "big data".

</comment></comment><comment><USER4> History navigation, bookmarks, and reloading are all supported using any modern framework. I think this is a 2012 topic.

Some browser features are not used for a good reason. The Alert, Prompt, and Confirm popups for example block the whole browser -not just the current tab- because they're older than tabs.

<comment><AUTHOR> On this project the maintainers have chosen not to adopt any post-2012 JS frameworks, citing poor stability. I think they made a sound decision, so I'm not interested in going down that road with them.

You raised a good point about alert dialogs and it helped me refine my thoughts. Sometimes it's actually worth it to "reinvent" browser features. I don't know anyone who thinks that alert dialogs are good UX. So "reinventing the wheel" doesn't work here because it's too broad.

I found the concept I was looking for, and it's called "perceived affordances" vs. "false affordances." A perceived affordance is any sort of intuitive, visual clue that a user can perform an action. For example, text that is blue and underlined lets a user know it is a link that can be clicked. A false affordance is a perceived affordance that is not real. For example, a back button that does not do the intuitive function of taking you one screen back is a false affordance.

</comment></comment><comment><USER5> "Reinventing the wheel"

</comment><comment><USER6> v1: waste of client money. v2: government funded project</comment>


Facebook bans Israeli company it says aims to disrupt elections - <AUTHOR> https://www.cbc.ca/news/technology/facebook-elections-1.5138796 <comment><USER2> Facebook itself is disrupting the US elections by banning right-leaning activists. They are also banning misuse of their data if they suspect Trump might be using it it to win in 2020.

Who is going to moderate the moderators?</comment>


Can't Hack a Hacker: Reverse Engineering a Discovered ATM Skimmer - <AUTHOR> https://trustfoundry.net/reverse-engineering-a-discovered-atm-skimmer/ <comment><USER2> Just a minor point but it really weakened the article for me: The photo at the beginning purporting to show a skimmer sitting in front of an ATM in fact shows a standard ATM without a skimmer.

[https://www.flickr.com/photos/angusf/4450137156](https://www.flickr.com/photos/angusf/4450137156)

Then the 'keypad overlay' in the second image is just a photoshop of a keypad.

Fortunately, the rest of the article was interesting enough to outweigh these issues. The best advice contained in the article, for me, was that interfering with ATM skimmers and camera modules can result in direct intervention by the criminals who may be watching nearby. The best strategy is to leave it alone and alert the bank immediately.

<comment><USER3> I'd be cautious putting my card in that slot, but I've seen many legit machines that look a bit ropey.

</comment></comment><comment><USER4> Google cached copy: [https://webcache.googleusercontent.com/search?q=cache:72ebLH...](https://webcache.googleusercontent.com/search?q=cache:72ebLHTY2bMJ:https://trustfoundry.net/reverse- engineering-a-discovered-atm-skimmer/+&cd=1&hl=en&ct=clnk&gl=us)

</comment><comment><USER5> Some banks over here (Europe) now let you block mag-stripe credit card transactions. Actually sounds like a good way to prevent ATM fraud as long as you are not visiting the US.

<comment><USER6> The whole situation in the US is silly. Some background: when a major iOS version comes out, thanks to Apple not allowing downgrades (grrrrr...), my company buys a new set of test devices for each major iOS version. When iOS 9 came out, I went to Walmart with my manager's company credit card to get some iPods (cheapest iOS test devices).

The clerk asked me what I wanted and I said "5 iPods please". I would be suspicious if anyone asked for that many iDevices. When they realized they only had 3 iPods, I said I'd take those. When I went to check out, I asked them to break up the transactions into < $500 chunks so as to not cause additional oversight, they obliged.

This was the first time I had ever used a chip-enabled card. It was obvious to the cashier, I was fumbling around with the card and had to ask how to operate it. Finally, after I bought three iPods in two transactions with a card I had obviously never used before, with the merchandise in a bag in hand, they ask for the credit card and my ID to verify the name. Busted, I thought! But no, after explaining that I was buying the devices on behalf of my boss (with no proof of this) they let me go on my merry way. I was flabbergasted.

TLDR: If you have a stolen credit card and want to use it to buy expensive electronics to fence, go to the Electronics department at the West Lafayette Walmart. Chip and signature cards offer no improvement in security, even when faced with at least five big red flags that indicate fraud.

<comment><USER4> To be honest, all of the behavior you would have seen as fraudulent is pretty typical in retail.

Furthermore, it's always been obvious that the chip'd cards provide no improvement for online fraud.

It's a PR move to hide the fact that the banks and creditors rely so heavily on transaction disputing to fend off fraud.

<comment><USER7> You're right. Lots of people split orders, probably one out of 4 or 5 fumble for things, and quite a few buy for their company. The phone the person bought was an iPhone rather than some weird one. Had the comment said i _Pods_ I'd have expected a bit more skepticism from cashier.

Yet, a company sends someone to buy a set of mainstream phones split on two transactions? Totally believable for a cashier and not as crazy as people's grocery orders have gotten while I was in line. ;)

</comment></comment></comment></comment><comment><USER8> Wrapping in aluminum foil does not make a Faraday cage.

Don't believe me? Wrap your smartphone in foil and then call it.

Mine rang. Freaked me out when I discovered this.

It didn't ring when I put it in the freezer though.

<comment><USER9> Faraday cages do not block all signals. From wikipedia:

> A common misconception is that a Faraday cage provides full blockage or > attenuation, this is not true. The reception or transmission of radio waves, > a form of electromagnetic radiation, to or from an antenna within a Faraday > cage is heavily attenuated or blocked by the cage. However, a Faraday cage > has varied attenuation depending on wave form, frequency or distance from > receiver. Near field High powered frequency transmissions like HF RFID are > more likely to penetrate. Solid steel cages provide better attenuation over > mesh cages.

<comment><USER8> You know those old school lead bags they used to use for carrying film through airport x-ray scanners?

[https://www.google.com/search?q=lead+bag+for+film&gbv=1&prmd...](https://www.google.com/search?q=lead+bag+for+film&gbv=1&prmd=ivns&source=lnms&tbm=isch)

I wonder if that would be far better to almost completely kill a signal.

</comment></comment></comment><comment><USER10> Next step: put a tracking device in the skimmer to find out where their headquarters are. :-)

</comment><comment><USER11> Instead of banks spending millions on fraud detection how about they invent a system of moving money around that doesn't require you to give your username and password to a 3rd party and hope they only remove the amount of money they say they will?

<comment><USER12> Like some kind of cryptographically authenticated public pseudonymous ledger maintained by a peer-to-peer network and constantly audited by millions of participants? Aren't you afraid that would destroy civilization?

<comment><USER7> Funny reply but simpler: today's banks with basic changes in authentication and limits on each party doing a charge in amount or timing. Would deal with parent's concern. Maybe add whitelisting, too, if people just wanted to use their main accounts for certain stores or bills. Just one extra transaction in a traditional database with some simple COBOL. Not much work.

Note: Brian Krebs recommended the same thing as a barrier to ACH fraud where the recipients were whitelisted with maybe in-person, strong-auth registration.

</comment></comment></comment><comment><USER13> Risky decision take home the skimmer

<comment><USER14> Also, if you're not police, you shouldn't be taking evidence of a crime for your own homebrew investigation. Call the cops and wait there until you see them dismantle the skimmer if you're so concerned about others.

<comment><USER7> "Also, if you're not police, you shouldn't be taking evidence of a crime for your own homebrew investigation."

This immediately jumped out at me. Most likely, you might get scolded or in trouble for screwing up chain of evidence or something. In a rare scenario, they might be watching the place with the skimmer there waiting for the perp to show up. Not sure of the risk there.

There was debate on how to handle it on Krebs. I think one person's suggestion of sending an anonymous tip about a skimmer to number on ATM was a good one. Keeps you out of FBI's microscope, local thugs watching don't get you, no convincing store clerks, and the skimmer gets taken care of somehow. Maybe best idea.

</comment></comment></comment><comment><USER15> It amazes me that cards with magstripe are still being issued. I have _never_ needed to use magnet instead of chip despite having traveled quite a bit. I used to ask my bank to disable magstripe on my cards, but now they changed this to the default option for all new cards.

<comment><USER16> I'm in Boston, and have yet to encounter a single reader that takes chips. They have started having the slot lately, but it's always taped over or there's a sign telling you not to use it. Or if you try to use it, the cashier gives you a weird look and has no idea what you're doing and tells you to swipe.

<comment> james-skemp Madison WI. Gas stations (at the pump) and grocery stores are the only places I go to that don't have or use the chips (taped over). I understand both have extra time to rollout.

I assumed it had rolled out across most of the US at this point since most of the smaller places had even implemented it.

<comment><USER17> I've been told that card processors will get charged more going forward if they don't implement the chips, or for non-chip transactions because of the added risk involved. That should help speed up the transition or at least activate it on those readers that have it.

<comment><USER18> > I've been told that card processors will get charged more going forward if > they don't implement the chips, or for non-chip transactions because of the > added risk involved.

This is true. It's also weird, since really they should be charging less for chip-and-pin, not more for magstripes. By moving to chip-and-pin they immediately release themselves from the hook for card theft, moving the liability to the card holder. The high transaction costs in card networks have historically been defended as largely stemming from fraud costs. Yet, we're expected to pay the same fees.

It's a good time to be in the card processing business.

</comment></comment></comment></comment></comment><comment><USER19> _The beeps correspond to actual keypresses, so you can't fool the skimmer by pretending to touch multiple keys._

The keys on ATMs I've used don't actually move much, so you could put several fingers on the keys at once and press only slightly harder with the one you intended. It might confuse any PIN pad overlays too, which by design have to activate with less pressure than the real switches so as not to arouse any more suspicion.

<comment><USER8> Or type a series of numbers, hit clear, enter real pin.

Though not to hard to realize last four are pin.

If the atm has a backspace instead of all clear, numbers, backspace one or two, numbers.

Still, not the usual routine.

</comment></comment><comment><USER20> > Cover your PIN with your hand This will not protect you from PIN overlays, > but it will hide your PIN from hidden cameras. Plus it's so easy to do, why > wouldn't you?

Here in Fiji, ATMs have a an opaque plastic guard over the keypad to keep the pin out of view of a camera.

Kinda like this one but bigger: [http://thumbs.dreamstime.com/x/atm- keypad-22036137.jpg](http://thumbs.dreamstime.com/x/atm-keypad-22036137.jpg)

<comment><USER21> If you read the article, so did this ATM. Except it wasn't a guard... it was a skimmer with a pinhole camera in it.

</comment></comment><comment><USER22> He's worried about being shot by gang members for stealing the skimmer, and then he posts this story with his picture?

<comment><USER23> "Kansas City Penetration Testing & Information Security"

they're probably back in the u.s. again. it's unlikely they'll send an assassin overseas.

</comment></comment><comment><USER24> Please warn in tweet when you link to paywalls

<comment><USER25> From the FAQ:

      In comments, it's ok to ask how to read an article and
      to help other users do so. But please don't post
      complaints about paywalls. Those are off topic.

</comment></comment><comment><USER26> mupeng

</comment><comment><USER27> "Error establishing a database connection". Why does this still happen to people in 2016?

<comment><USER28> I get it but ... front page Hacker News is kind of a big deal, hosting is sold very cheaply - sadly not everything scales.

<comment><USER29> Even things that do scale, don't often scale automatically. If I spring for Heroku to host my blog over GoDaddy, it's still going to go down the minute it hits the front page of Hacker News.</comment></comment></comment>


Printing Floating-Point Numbers (2014) - <AUTHOR> http://www.ryanjuckett.com/programming/printing-floating-point-numbers/ <comment><USER2> Great links, thanks. I sometimes noodle with a faster printf for Java, mostly for giggles. I also found these:

Dragon4 and Grisu3: Algoritms to Display Floating Point Numbers

[https://www.clarusft.com/dragon4-and-grisu3-algorithms-to- di...](https://www.clarusft.com/dragon4-and-grisu3-algorithms-to-display- floating-point-numbers/)

"Printing Floating-Point Numbers Quickly and Accurately with Integers" by Florian Loitsch

[http://www.cs.tufts.edu/~nr/cs257/archive/florian- loitsch/pr...](http://www.cs.tufts.edu/~nr/cs257/archive/florian- loitsch/printf.pdf)

And its implementation in C

[https://github.com/google/double- conversion](https://github.com/google/double-conversion)

Here's a Java implementation of Grisu2 algorithm.

[https://github.com/jnordwick/zerog-grisu](https://github.com/jnordwick/zerog- grisu)

</comment><comment><USER3> See also Russ Cox's take on this: [http://research.swtch.com/ftoa](http://research.swtch.com/ftoa)

</comment><comment><USER4> > Personally, I don't use anything with an MIT or BSD style license because > I'd rather avoid the legal baggage.

Gees, what a troll.

<comment><USER5> That was surprising. Those are some very, very permissive licenses and pretty widely used, too. Just today I wrote a plugin and stuck an MIT license on it. The only requirement is basically that you keep the license/copyright with all copies of the code. Is that really so much baggage?

<comment><USER6> The issue is that you need to ship the license with binaries as well. When you work on systems like game consoles, this gets even more annoying because you can't just add some sidecart text file. You instead need to write up some UI page to show the licenses or reference some website that you keep online forever for people to visit. It's not the end of the worls, but a license that just requires comments in the source code is a bunch simpler to track (no need to collate them all into some user facing GUI).

</comment></comment></comment><comment><USER7> It reminds me that it's annoying that there is no "engineering" mode for printf (to force the exponent to be a multiple of three). There is this project on github using %.*f: [https://github.com/dhoerl/EngineeringNotationFormatter](https://github.com/dhoerl/EngineeringNotationFormatter)

<comment><USER8> I have always wished that printf (or its equivalent in your language) was somehow extensible. In a language like Python you can kind of get around this by defining __str__ on an object an using %s to format it, but that doesn't help implement something like engineering mode.</comment></comment>


Reactor storage pools leaking, #3 dry, rods exposed and will soon catch fire - <AUTHOR> http://www.guardian.co.uk/world/2011/mar/17/japan-nuclear-crisis-deepens-radiation

<comment><AUTHOR> More info at NYT but with their limited view policy, I didn't want to link to them directly

<http://www.nytimes.com/2011/03/18/world/asia/18spent.html>

 _11,125 spent fuel rod assemblies are stored at the site which is four times as much radioactive material as in the reactor cores combined_

 _the water in the pools is either boiling away or leaking out of their containments, and efforts to add more water having gone awry. While spent fuel rods generate significantly less heat than newer ones do, there are strong indications that some fuel rods have begun to melt and release extremely high levels of radiation_

</comment><comment><USER2> I think the "why I'm not worried about the nuclear situation in Japan" guy needs to write a new assessment.</comment>


Microsoft Letter to the Attorney General - <AUTHOR> http://www.scribd.com/doc/154204598/Microsoft-Letter-to-the-Attorney-General

<comment><USER2> Ships, rats and sinking come to mind.

Another big name starts the process of PR mitigation eh?</comment>