A strange green organism has spread, clogging up the world's rivers - <AUTHOR> http://www.bbc.com/earth/story/20140922-green-snot-takes-over-worlds-rivers?OCID=fbindia

<comment><USER2> This finding reported in the article is interesting: "Related to this discovery is an extreme irony. Governments and organisations around the world have, for a very long time, tried to stop algal blooms from strangling rivers by reducing phosphorous pollution, believing the algal feed off this nutrient boost. But in doing so, they might have encouraged the green snot that is Didymo. 'It goes against everything we've been thinking for 50 years,' says Spaulding."

The main takeaway from this interesting article is that we still need to do a lot more foundational science about microorganisms and their ecological relationships with various changes in the natural environment.

<comment><USER3> Or more fundamentally: attempts at eco-engineering are destined to fail. This is the most ironclad reason I can come up with for why conservation is the only route.

<comment><USER4> The problem is, things get damaged. Sometimes very severely. It's not possible to keep everyone from acting irresponsibly, and as humans in a modern society, we have a lot of impact on nature. All it takes is one ship with a handful of zebra mussels to infest the entire Great Lakes ecosystem. All it takes is one person accidentally releasing Asian grass carp for it to infest the entire country. All it takes is one farmer using a bit too much fertilizer to form massive algae blooms in a nearby lake.

Conservation is an important preventative step. But that's like telling a bleeding person that they shouldn't have stepped on that nail. The damage is done, and the patient needs antibiotics and stitches now. It's important to prevent damage from being done, but it's just as important to fix it after the fact.

<comment><USER3> With both Asian carp and zebra mussels, (and lionfish and starlings etc etc etc) we are essentially powerless to stop their advance. To extend your metaphor, we literally have nothing in the way of antibiotics and stitches to salve this wound. We need to be trying orders of magnitude more than we actually are to prevent such calamities from happening in the first place. People have this misplaced faith the we as a race can engineer our way of out any problem, and it's just not true. Ban the nail, I say.

</comment></comment></comment></comment><comment><USER5> Diatoms are primary producers and the fastest growers. If they are thriving it's a signal the water quality has dropped and they are doing their job, consuming the excess nutrients, so trying to kill it makes no sense.

While they feed on nitrogen and phosphorus their limiting nutrient is silicates, so maybe it's tied to siltation (erosion making it's way into water bodies). I don't see this mentioned on the article.

<comment><USER6> Part of the main thesis of the article is that _unlike_ what we've seen from diatoms in the past:

\- the growth is not a traditional growth in the reproduction sense; \- the growth appears to be linked to _low_ phosphorous levels, not high ones.

As a result, I don't think your first comment makes any sense.

<comment><USER5> It's about nutrient imbalance, not simply excess of nutrients across the board.

You can have, e.g., a high silicates and low phosphorus situation driving this particular diatom, simply because phosphorus is not the limiter (as I have already stated is the case for diatoms). If you had a different nutrient balance, there would be competition with other organisms, so no growth in the first place.

Whether it's reproductive or vegetative growth is irrelevant, because the mechanism of competition is the same: it covers surfaces and outcompetes other colonies.

</comment></comment></comment><comment><USER7> "[...] its biggest impact seems to be aesthetic. 'The main effect of Didymo is how it changed the appearance of rivers and streams,' she says. 'It's not toxic. It really doesn't do anything really awful.'

This is true, but it can cause problems for people swimming downstream: "people swimming in waters downstream from areas containing high concentrations of Didymo have complained of eye irritations, which may be caused by the silica of the frustules."

[http://www2.gnb.ca/content/gnb/en/departments/natural_resour...](http://www2.gnb.ca/content/gnb/en/departments/natural_resources/fish/content/Didymo.html)

<comment><USER8> Is it true? I have been told (by an ecologist) that it can use up nutrients and overwhelm a stream, killing a lot of the original inhabitants. Apparently its "invasive behavior" is an interesting response to a lack of nutrients – it undergoes explosive growth in an effort to search for nutrients. I can see where that might be an undesirable run-away process.

<comment><USER4> I would be interested in knowing more about how it undergoes explosive growth when its food supply gets low. Sounds like the opposite of most species, and that's an interesting evolution to take.

<comment><USER8> Here's a review of sorts: [http://bioscience.oxfordjournals.org/content/64/6/531.full](http://bioscience.oxfordjournals.org/content/64/6/531.full)

And one study: [http://www.ias.sdsmt.edu/staff/sundareshwar/Reprints/Sundare...](http://www.ias.sdsmt.edu/staff/sundareshwar/Reprints/Sundareshwar%20et%20al%202011%20GRL%20with%20Auxiliary%20material.pdf)

Abstract from the second paper:

 _In recent decades, the diatom Didymosphenia geminata has emerged as nuisance species in river systems around the world. This periphytic alga forms large "blooms" in temperate streams, presenting a counterintuitive result: the blooms occur primarily in oligotrophic streams and rivers, where phosphorus (P) availability typically limits primary production. The goal of this study is to examine how high algal biomass is formed under low P conditions. We reveal a biogeochemical process by which D. geminata mats concentrate P from flowing waters. First, the mucopolysaccaride stalks of D. geminata adsorb both iron (Fe) and P. Second, enzymatic and bacterial processes interact with Fe to increase the biological availability of P. We propose that a positive feedback between total stalk biomass and high growth rate is created, which results in abundant P for cell division. The affinity of stalks for Fe in association with iron-phosphorus biogeochemistry suggest a resolution to the paradox of algal blooms in oliogotrophic streams and rivers._

<comment><USER4> Thanks! Exactly what I was looking for.

</comment></comment></comment></comment></comment><comment><USER9> This crap has been a PITA a for flyfishers for a while. Rock snot is an apt name for it because it is treacherous when you're wading. Personally, I prefer felt boots because they have better traction, but they're also an easy vector for didymo and it's just not responsible to use them anymore since I'm in multiple rivers. I ended up switching to rubber boots. Not nearly as nice to walk in, but far less likely to have didymo hitchhiking along when practicing proper river hygiene.

</comment><comment><USER10> Didymo is edible btw, and Rob Rhinehart has talked about future Soylent ingredients being made by bio-engineered algae.

<comment><USER11> Where did you see / read that? That suggests an expansion in the turtle population. I haven't seen anything like that mentioned yet but would love to find it. I'm still on the lookout for a species that evolves into something which can only survive in an EPA superfund site so that cleaning up the site will cause the extinction of the new species. Just thinking about the Environmental Impact Statements on that possibility makes me chuckle.

</comment></comment><comment><USER12> Interesting article, but the images I'm getting are all extremely low quality. Tried both Chrome & FF.

EDIT: Well, downvotes or not, I'd still like to know what is going on. Here is a screenshot of part of my browser window while viewing the article.

[https://imgur.com/IcEyM3R](https://imgur.com/IcEyM3R)

I assume others are getting higher quality images (?).

<comment><USER13> It was fine for me, although the images were much delayed on loading, so there is some javascript acting there. Are you using noscript?

<comment><USER12> > Are you using noscript?

No. The only thing I explicitly block is flash. (Also, I don't recall having a problem like this before.)

<comment><USER13> What url do you have for the bad images?

A good image url is: [http://ichef.bbci.co.uk/wwfeatures/1280_720/images/live/p0/2...](http://ichef.bbci.co.uk/wwfeatures/1280_720/images/live/p0/27/l1/p027l1df.jpg)

<comment><USER12> I get this: [https://ichef.bbc.co.uk/wwfeatures/304_171/images/live/p0/27...](https://ichef.bbc.co.uk/wwfeatures/304_171/images/live/p0/27/l1/p027l1df.jpg)

Probably this isn't worth a whole lot of work; I guess it thinks I'm on a phone (I'm not).

<comment><USER13> What's your user agent? Maybe you set it funny and forgot.

[http://www.useragentstring.com/](http://www.useragentstring.com/)

</comment></comment></comment></comment></comment></comment><comment><USER14> The Andromeda Strain

</comment><comment><USER15> And then it will disappear, and the only person who will truly know what happened will be Fox Mulder.</comment>


Open letter to BC Law School's dean to leave and get a refund - <AUTHOR> http://eagleionline.com/2010/10/15/open-letter-to-interim-dean-brown/

<comment><USER2> I have sympathy for this guy but look nobody promised you a job when you took on those loans. It is basic risk reward. You took on a lot of loans to get a law degree because lawyers get paid well. You took on risk and it did not work out. Happens. Often too entrepreneurs.

<comment><USER3> People who take on risk for reward are still entitled to be upset at people who have lied to them about the nature of the risk and reward. There's a difference between taking on risk in an informed manner and getting conned into taking the risk.

On occasion I think HN goes overboard on the reward side of entrepreneurship too, and that's not right when that happens either. Tell the truth, let people make up their minds. (And to be clear, I mean it just happens _sometimes_. On the whole there's too many people doing it for real for raw cheerleading to go unchallenged for long.)

People have been getting led on about the value of their degree for a while now. The economic situation is bringing things to a head but it's not new.

Also, I doubt this is a serious call for a refund, in the sense that he has even the remote expectation of one. This is a warning to others dressed up with a rhetorical flourish.

</comment></comment><comment><USER4> Maybe he should get a refund. Because if part of a law school education is being able to construct a convincing argument based on the evidence you present, then I think he has been shortchanged.

<comment><USER5> Of course maybe that realization was his ingenious motivation for writing the letter. Which means he did learn to make a convincing arguement, in which case he does not deserve his money back, and it was a dumb arguement to begin with. Which means...

</comment></comment><comment><USER6> I can't see how he expected this would be accepted. I do sympathize with his situation but until someone invents a memory erasing machine to remove his accrued knowledge, a 'time refund' for all people who invested in his being there, and a method to magically transfer everything to the other person who would have paid to sit in that seat for the last few years, you just can't turn back time.

He would still walk away with knowledge, degree or not, and the school is out the time and effort to have imparted that knowledge. It's like asking for a refund if you don't achieve the degree. "I failed, I didn't get the degree, so can I be refunded?"

</comment><comment><USER7> When I thought about law school two years ago. I spoke to many lawyers and law students. They all told me the same thing.

1) Do not get into law right now. It is experiencing an outsourcing much like tech did in the early 2000s.

2) ONLY, and seriously ONLY, go if you truly love to study law. You will NOT find a job, and most likely you will have to do crap work for awhile.

What made me decide to hold off law school was the fact that I would accumulate too much debt and not be able to pay it off in a timely matter.

A LOT of law students that I spoke to had his grandiose dream and vision of a top job making hundreds of thousands.

One friend told me up front, he chose not to listen, he thought that everyone was just being pessimistic telling him not to get into law, he like most young students, didnt realize how bad it was, no matter how many warnings they got.

</comment><comment><USER8> I'm not sure about the loans you get to go to law school, or the loans he got, but I was under the impression that student loans are something that you can't get out of if you declare bankruptcy, just like alimony or something like that. Asking for a refund is the only way out. Though I disagree with the idea that a refund is fair. Schools aren't exactly flush with cash to be handing back to students who leave or fail out...nor should they be. It's just another reason to finish a degree to make yourself THAT much more marketable.

I fail to see how sticking it out and finishing something like a JD is somehow worse in the long run (financially) than leaving with somewhere around 100k (I assume) that you will have to pay back to creditors with interest.

<comment><USER9> The whole reason for the open letter is for a refund so he can immediately pay off those debts

</comment></comment><comment><USER10> This was pretty heavily reported (editorialized, in the Business sections non the less) in this past Sunday NYTimes, enough that I blogged it. . .

NYTimes links

Is Law School a Losing Game?: <http://www.nytimes.com/2011/01/09/business/09law.html?_r=1>

I Want My Money Back (On Everything): <http://www.nytimes.com/2011/01/09/business/09law.html>

My thoughts: [http://jaynesyourway.blogspot.com/2011/01/hear-one-about- law...](http://jaynesyourway.blogspot.com/2011/01/hear-one-about-lawyer.html)

</comment><comment><USER11> The proposed "trade" is so mind-numbingly unbalanced that I am fully convinced this is just a joke and commentary on the job market for law students.

</comment><comment><USER12> Salaries for Law School graduates are bimodal. Most people will over-estimate the rewards:

[http://lawprofessors.typepad.com/legal_profession/2009/06/th...](http://lawprofessors.typepad.com/legal_profession/2009/06/the- end-of-an-era-the-bi-modal-distribution-for-the-class-of-2008.html)

</comment><comment><USER13> Aren't you paying for your professor's time? It's like saying, "thanks for making that website for me, but I don't think I'm going to make any money, so I want my money back". Uh, too bad.

Just default on the loans and move to a deserted island if you don't want to pay them.

</comment><comment><USER14> just wait for that bubble to pop if this transitions from merely disgruntled graduates to defaulting higher education graduates en masse. If you think it's an unfair risk that you might not get a job _just_ because you have a J.D. wait till it gets bad enough for the loan lenders recalculate their risks. They'll tighten the belt on student loans across the board making them far less accessible.

</comment><comment><USER15> The guy could still go pass the bar and practice law. So maybe he shouldn't get a full refund... that education is worth something.

</comment><comment><USER16> BC != BU.

<comment><USER17> No kidding. I went to BU and taught at BC, and I'll be goddammed if I know who to root for in hockey.

<comment><USER18> The 2010 national champions, of course!

</comment></comment></comment><comment><USER19> I like how he says "at the end of this semester", why not immediately?</comment>


SimpleCV – Computer Vision platform using Python - <AUTHOR> http://simplecv.org/ <comment><USER2> It's difficult to effectively use cv libraries (such as opencv) because in order to approach new problems, understanding of the underlying theory and methodology is often necessary. Example code can only go so far to teach the user how to evaluate and adapt to new constraints. simplecv.org is down for me right now, but I hope that it addresses this concern!

The principles of computer vision are not too difficult to grok, requiring only knowledge of geometry and basic linear algebra. Two popular (dated, but still relevant) introductory texts are referenced to below [1] [2]. However, papers describing techniques that work in practice are often dense reads involving concepts from signal processing, control theory, and probability (e.g., [3]).

I personally enjoy learning about simple techniques that are also very effective in practice (e.g. Viola-Jones detection [4], SIFT points [5], RANSAC [6]), and I hope that simplecv.org might go over these in detail too.

[1]: [http://www.robots.ox.ac.uk:5000/~vgg/hzbook/](http://www.robots.ox.ac.uk:5000/~vgg/hzbook/)

[2]: [http://dl.acm.org/citation.cfm?id=551277](http://dl.acm.org/citation.cfm?id=551277)

[3]: [http://robots.stanford.edu/papers/montemerlo.fastslam- tr.pdf](http://robots.stanford.edu/papers/montemerlo.fastslam-tr.pdf)

[4]: [http://en.wikipedia.org/wiki/Viola%E2%80%93Jones_object_dete...](http://en.wikipedia.org/wiki/Viola%E2%80%93Jones_object_detection_framework)

[5]: [http://en.wikipedia.org/wiki/Scale- invariant_feature_transfo...](http://en.wikipedia.org/wiki/Scale- invariant_feature_transform)

[6]: [http://en.wikipedia.org/wiki/RANSAC](http://en.wikipedia.org/wiki/RANSAC)

<comment><USER3> I've worked on image recognition and find OpenCV too simple. I don't like algorithms that work on the entire image without taking into account what is being recognized. For example, if you have a combination of thick and thin edges, you only want to erode the thick ones and you only want to erode the thick edges until they are thin and smooth. If you posterize an image, you don't want to cross regions separated by long smooth edges. You don't want to blur away noise in the image because when the noise is localized, you can use it to identify what the object is (similar to the way shazam uses high frequencies to identify songs).

OpenCV, simpleCV etc are very useful libraries for toying around with images. You can get interesting results without a lot of effort. But the more serious you get about image recognition, the more you find that you can't use them globally across the image. Finding the yellow car in the parking spot is a good example of the usefulness of the library and also its simplistic capabilities. It recognized a yellow patch in the image and it doesn't recognize a car in a general way. When you're ready to write code to recognize a car, you'll probably find you can't use openCV libraries.

What has worked amazingly well for me, is to create a model of the image areas and then apply transformations based on the model. If you have a sharp foreground and a blurry background, don't run the recognition algorithms that rely on sharp edges on the blurry background.

</comment></comment><comment><USER4> Unfortunately computer vision libraries and toolsets are the worst offenders of making each algorithm a 'hammer' when traditional problems are not a 'nail'. A good example is "Detecting a Car" ([http://tutorial.simplecv.org/en/latest/examples/parking.html](http://tutorial.simplecv.org/en/latest/examples/parking.html)), where the mean color is used to determine if a car is in the image. A nice little exercise, but it oversimplifies the process. Each allows the user to step in a few puddles and then advertises that you'll be able to swim in the ocean.

<comment><USER5> This statement is an oversimplification. Computer Vision libraries are essentially Swiss army knives. If the person without reasonable understanding of Computer Vision research thinks that he can solve the problem, that is the person's problem. Again I wouldn't blame the naive software engineer who thinks he can solve these problems, because our (extremely complex) visual process makes it all seem very simple. Even Marvin Minsky thought he could get his undergrad Gerry Sussman to "spend the summer linking a camera to a computer and getting the computer to describe what it saw". After almost 60 years we aren't very to close that. Sure, we can solve certain problems in most scenarios (like face detection) or many relatively more complex problem in limited variance situations (like machine vision problems). This is the equivalent of a person who have learned C++ recently, using iteration/recursion/design patterns for everything he sees.

<comment><USER4> I honestly can't tell if you agree or disagree. My sentiment on the subject was that CV libraries are good swiss army knives, but to continue the analogy - you wouldn't tell someone that all you need to survive in the wilderness is said swiss army knife.

</comment></comment></comment><comment><USER6> Check out this beard length detector I wrote in 22 lines of Python with SimpleCV

[http://labs.radiantmachines.com/beard/](http://labs.radiantmachines.com/beard/)

<comment><USER7> I'm looking to measure dimensions of objects using computer vision libraries. I think it is impossible to do this without a reference scale in the same image.

What is the unit of measure for line.length()?

<comment><USER6> For my use it is just arbitrary. SimpleCV does have the ability to calibrate cameras, which should give you what you want.

<comment><USER8> You can calibrate the camera, estimating the intrinsic params such as focal length. But for size you would need two images and to know the location each were taken relative to each other (extrinsic params). This is not impossible, just more difficult than a simple calibration and photo snap.

On top of that, you will have to be able to identify the object you are trying to measure (unless it is a manually driven process).

</comment></comment></comment></comment><comment><USER9> I'll put in a plug for the accompanying book: [http://simplecv.org/book](http://simplecv.org/book)

Very clear, well written, for a complete CV novice.

<comment><USER10> O'Reilly is currently having a 50% off sale on this ebook:

[http://shop.oreilly.com/product/0636920024057.do?code=WK5STA...](http://shop.oreilly.com/product/0636920024057.do?code=WK5STARS)

</comment></comment><comment><USER11> I have been working on CV with an emphasis on mobile phones/robotics. The big issue is the lack of consistent documentation. It is either scattered all over the web, or outdated. Been writing a document to address this, but it is still not done.

If you want to play with CV, just get a Raspberry pi, the camera module, and have fun. The Rpi makes it easy to move it around without much trouble. You can even add CV to many different appliances with the Rpi.

</comment><comment><USER12> I love OpenCV. Even with the slightly outdated and incomplete wrapper in Ruby, you can still have a lot of fun with it.

This was posted on HN some time ago and remains one of my favorite creative uses of OpenCV: "So I Suck At 24: Automating Card Games Using OpenCV and Python"

[http://arnab.org/blog/so-i-suck-24-automating-card-games- usi...](http://arnab.org/blog/so-i-suck-24-automating-card-games-using-opencv- and-python)

<comment><USER13> I agree. I recently used OpenCV to process some photos of some documents, and it was very awesome. I particularly liked the python 'cv2' bindings. Not bad. It was my first time really using NumPy, in a deep way, and it actually performed decently.

But, that said, after reading all the OpenCV posts on Stack Overflow and also going through a ton of OpenCV tutorials, I found that the library couldn't meet my needs, in a lot of ways. (Apparently, processing text documents from camera images is a lot harder than I thought!) So, now I'm off reading research papers on image processing, like I don't have anything better to do.

</comment></comment><comment><USER14> For everyone interested in computer vision / image processing in Python, [http://scikit-image.org/](http://scikit-image.org/) in combination with [http://scikit-learn.org/](http://scikit-learn.org/) are also worth a look.

</comment><comment><USER15> Nice marketing but not much behind?

This library seems to be great for fast exploration of new concepts. So I installed it and tested. I went through a small tutorial and tried to load an image from internet and display, unfortunately it didn't work. Connection failed, and image window showed up but no content... This is rather disappointing, and I was really expecting from this library that it will work out of box.

Anybody else with the same experience?

</comment><comment><USER16> Those who are giving brickbats to SimpleCV might be right but this seems an extremely useful thing to me.

In the robotics courses we often build robots that pick up balls etc. So far we used either openCV or Matlab for image processing but generallly turned out to be pathetic solutions given the steep learning curve with openCV.

I will surely give a try to SimpleCV.

</comment><comment> bulte-rs I'm not well versed in the usage of OpenCV; but I just can't get the fact that most CV applications will require a more thorough understanding of the subject (both mathematically and software-technically) in order to create something more than a 'nice toy' (I'm waiting to be corrected here)

</comment><comment><USER17> I have to say that this book: [http://shop.oreilly.com/product/9780596516130.do](http://shop.oreilly.com/product/9780596516130.do)

did a pretty good job of explaining everything for opencv proper.

<comment><USER18> This was the text in my Computer Vision course. I agree it did a good job and OpenCV was a lot of fun to work with. I would definitely pick it up again if I had interest in this field.

</comment></comment><comment><USER19> The site seems to have been thoroughly slashdotted ... er, fireballed ... er, hackernewsificated ... honestly, hasn't someone come up with a word yet for when HN does this?

<comment><USER20> Well, slashdotted is generic. It's got the "have you googled it on Bing" issue but, good enough.

</comment></comment><comment><USER18> Looks like this is to OpenCV as jQuery was to JavaScript.

</comment><comment><USER21> I like this!

</comment><comment><USER5> that site is HNed.</comment>


The Fully Remote Attack Surface of the iPhone - <AUTHOR> https://googleprojectzero.blogspot.com/2019/08/the-fully-remote-attack-surface-of.html <comment><USER2> One thing I like about this post is how it enumerates all of the dead ends that involved a lot of investment but produced no fruit. This is what is difficult about exploiting hard targets. What the general public doesn't see is the massive amounts of "wasted" time involved in bug hunting. Instead, they see the headline about how some wunderkind exploited X in a matter of seconds or minutes, conveniently omitting the part where that person spent the last year staring at code, writing tools, fuzzers, test harnesses, and finding nothing at all - not knowing if they would ever find anything, or if there is even a bug to be found.

<comment><USER3> There is something to be said though, and that is that there is always _something_ to be found _somewhere_. Lacking toolchains that can fully eliminate bugs, there will always be bugs. And even if there were legitimately no bugs, that doesn't mean there won't be bugs introduced in future releases, or bugs even outside the software itself.

The low hanging fruit has definitely been thoroughly picked these days, at least in software like iOS. But yet with pretty much near certainty, exploits find a way.

Perhaps even more fascinating, is that closing off one class of exploits always seems be followed by new kinds of exploits, like clockwork. You'd think eventually this would stop happening, but so far it hasn't. CPU side channel attacks may not be completely new, but they've emerged as one of the new big targets as of late.

I really know little about security personally and obviously the amount of work that goes into serious security research should never be underestimated but I'm impressed at the inevitability of security bugs. Very few large programs escape a regular cycle of bugs. Maybe OpenBSD is the best example of Pretty Secure software.

<comment><USER4> > The low hanging fruit has definitely been thoroughly picked these days

The problem is that vendors aren't in the business of perfecting existing software. They're in the business of pushing out big, bold, feature-rich changes and additions.

There's always new low hanging fruit.

<comment><USER5> The vulnerabilities found in the article support your argument: SMS and MMS, which barely ever change or get new features, were much more secure than iMessage, which constantly gets new features and architectural changes.

<comment><USER4> There was a Microsoft Research paper several years ago which looked at the relationship of exploits to age of code in BSD kernels. The number of exploits in older code diminished over time, but that was often offset by the higher prevalence of exploits in newer code. That much is intuitive, but it's good that there's some well researched empirical evidence showing that that's the case.

We can hypothesize that better languages and better mitigations (e.g. ASLR) can improve the situation across the board, and I don't doubt that that's the case, but I haven't yet seen the evidence. (Maybe I missed it?) It's probably too early as it's difficult to make apples-to-apples comparisons across those aspects.

</comment></comment></comment></comment></comment><comment><USER6> > some email providers also filter incoming messages and remove malformed MIME > components that are needed to reach a vulnerability.

I wrote @ronomon/mime [1] for this purpose, to protect downstream user email clients from MIME bombs [2], invalid charsets which can crash Apple Mail, multiple From headers which can exploit Gmail [3], attachment directory traversals, malicious continuation indices, truncated MIME messages, stack overflows etc.

[1] [https://github.com/ronomon/mime](https://github.com/ronomon/mime)

[2] [https://snyk.io/blog/how-to-crash-an-email-server-with-a- sin...](https://snyk.io/blog/how-to-crash-an-email-server-with-a-single- email/)

[3] [https://blog.cotten.io/ghost-emails-hacking-gmails-ux-to- hid...](https://blog.cotten.io/ghost-emails-hacking-gmails-ux-to-hide-the- sender-46ef66a61eff)

</comment><comment><USER7> > VVM works by fetching voicemail messages from an IMAP server maintained by > the device's carrier. The server URL and credentials for this server are > provided to the device by the carrier over SMS.

Visual voicemail is just IMAP and SMS? Wow, for some reason I assumed there would be some distinct protocol for that. It's pretty interesting that it's implemented using the existing software the phone already runs on.

<comment><USER8> And frustrating to learn that an open protocol with free implementations is locked behind a carrier that often requires significant fees for this feature.

<comment><USER9> How much does visual voicemail cost? I've never really noticed any significant fees on my bill related to it.

<comment><USER10> $2.99 for me. Not a huge cost, but certainly frustrating considering the non- existent burden to the provider.

<comment><USER11> Who charges for VVM?

<comment><USER12> Bell.ca charges for it.

<comment><USER13> Man.. Canadian telecoms really suck

<comment><USER14> Nickel and dime'ing is easier than innovating.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> How do they actually run the iOS OS code involved in this debugging? Jailbroken iPhones? iOS virtualization ala Corellium ([https://corellium.com](https://corellium.com))?

<comment><USER16> Probably so called "Dev-fused iPhones".

<comment><USER17> The code presented in the article seems like it would run on any jailbroken device.

</comment></comment></comment><comment><USER17> > We looked at this extension in great detail, looking for a way to spawn a > WebKit instance on the receiving device, but did not find any. The WebKit > processing always appears to be done by the sender.

This is done for privacy reasons, AFAIK: it prevents "read receipt" links like you might find in emails. It does however allow for the sender to attach a misleading thumbnail, though.

</comment><comment><USER18> What's really cool is that they released all the code they used to create the attacks.

[https://github.com/googleprojectzero/iOS-messaging- tools](https://github.com/googleprojectzero/iOS-messaging-tools)

Just went to the talk. TL;DR: iMessage uses old serialization libraries, they are terrible.

<comment><USER19> The final few paragraphs touch upon how expansive the attack surface can be due to this serialization code. So, yes the libraries are terrible.

Asking the HN audience: Is there a set of design principles that the iMessage team can follow to make these more resilient to such attacks while retaining their usability? As a non-Apple employee whose globally dispersed family relies on iMessage to stay in touch, I have a vested interest in the security of my family's iPhones. I know it's rare for Apple employees to comment, but it would be great if someone from Apple can comment on whether these libraries are being re-architected in some way. This will cut through any FUD that arises from this disclosure / discussion.

</comment></comment><comment><USER20> If this aims to enumerate all the vectors, it seems to be missing the lower level radio & networking attack surface - eg the WLAN one that was a high- profile Project Zero finding some time ago. And common networking things like DHCP client, mDNS, VPN protocols, etc. Probably there are WLAN driver style vulnerabilities in the cellular side too.

<comment><USER21> I was thinking phone-over-WiFi would be interesting to explore as well.

</comment></comment><comment><USER22> How many people were working on this project for how long? Also, is APNs something they took a look at? No mention of it in the article, which is surprising. Maybe they figured that it would be impossible to inject something into a push notification.

<comment><USER23> The blog post describes who did the work, right? Looks like one person for half of it, joined by another person for the second half.

</comment></comment><comment><USER24> I'm curious, does Apple pay the normal bug bounty to Google for finding these exploits?

<comment><USER25> I asked this question the last time this came up and the answer I got was "Project Zero does not accept bounties. They generally ask for the money to be donated."

<comment><USER24> That makes much more sense, it's not like Google _needs_ the money, so going to charity is much better. Now the follow up question is, does Apple do that?

</comment></comment></comment><comment><USER26> Fine work here.

</comment><comment><USER27> Is this the first successful remote exploit of the iPhone?

If I am not wrong, Android has been exploited multitude of times.

<comment><USER28> > Is this the first successful remote exploit of the iPhone?

No? [https://www.cvedetails.com/vulnerability- list/vendor_id-49/p...](https://www.cvedetails.com/vulnerability- list/vendor_id-49/product_id-15556/Apple-Iphone-Os.html)

</comment></comment><comment><USER29> So what's the motivation of Google? Are they are charity now?

I phrase it a bit unnuanced, but it does leave me a bit puzzled. I suppose companies can be nice and not nice at the same time, but I'd rather look at the level of incentives first before looking at the level of being nice.

<comment><USER30> Google has said in the past "we make our money from usage of the internet, and so anything that increases internet usage helps us".

That was their stated motivation behind things like Chrome - increase the speed and utility of webapps so that more things could be online. It works in this case because they are improving security and therefore user trust in online services in general..

The cynic in me is sure that that's not the only reason, but it's part of the picture.

<comment><USER31> Project Zero is a Chrome project, so I assume the intent is to find vulnerabilities elsewhere in the system that could end up tied to Chrome.</comment></comment></comment>


Ask HN: I'm a demotivated SE because I did not get a promotion. What to do? - <AUTHOR> * I'm a Software Engineer with around 5 years of experience hired as a junior developer 1.5 years back but perform on the level of a Senior Engineer.<p>* I write better code, can architect, can take a project from start to finish and in general work much better and more productively than my team-mates who have 10+ years of experience. I frequently re-factor things they have written and have 'saved' a project from risks and 'down the line rot due to technical debts' multiple times due to these refactor-ings and other decisions.<p>* No one from our team will be promoted this year due to reasons and I was looking forward to a promotion.<p>* I feel that waiting another 1.5years for a promotion is grossly un-fair to me & because my manager and company in general does not seem to value my contributions, the next obvious step is to change jobs.<p>* The twist is that I'm working on a student OPT visa that is valid only until August this year. If my H1B application is not selected once again this year (by May end), the company would help move me to other development centers around the world. (It's a big-ish company whose name you have heard & whose product you have probably even used)<p>* I need your views in understanding and evaluating my options.<p>* I'm also looking for views about how, if I start interviews, will other big companies (think Amazon, Uber, Google) view me w.r.t to my work eligibility and if I should just stay put and demotivated in my current company until at-least May end when I hear back about my H1B. <comment><USER2> "I'm a Software Engineer with around 5 years of experience hired as a junior developer 1.5 years back but perform on the level of a Senior Engineer."

I've met many junior level engineers that think they are senior, but just don't have the experience yet.

Being senior is as much about the wisdom and experience as it is the programming aptitude (which is only one part of it).

I don't think you can be considered 'senior' with only 5 years of experience total.

With that said, if you are unhappy with your current wage, start looking for another job. This is exactly how I got raises every few years when I worked as a developer.

<comment><AUTHOR> Thank you for replying.

I knew the post would entice one of these comments.

This is why I specifically included the 2nd point : "I write better code, can architect, can take a project from start to finish and in general work much better and more productively than my team-mates who have 10+ years of experience. I frequently re-factor things they have written and have 'saved' a project from risks and 'down the line rot due to technical debts' multiple times due to these refactor-ings and other decisions."

\- In the end, software is not just about writing code. \- Unlike some other engineering fields which have set rules and calculations (think civil engineering) that reduce the risk, each software project can have a lot of variance.... due to which it can end up being very complicated.

\- Coming back to the point, I know people who have 2 years of experience & who are at a 'Senior' engineer level. \- It's just a title and the semantics is subjective.

The point I was trying to make is that I'm working and producing much more value than the 'Senior' engineers with 10+ years. And not just coding wise.

Further, as I mentioned in the original post, switching jobs is the clear next step... what I'm unsure of is the hiring policy w.r.t work visas.

</comment></comment><comment><USER3> I you go to another country you'll be working for someone else even if you stay at your company.

<comment><AUTHOR> True, but will other companies (Google, Amazon, Uber, Linkedin, Salesforce etc) consider me positively for a role given my soon expiring OPT and uncertain H1B ?

<comment><USER4> The first two companies in your list won't care. They will hire you and move you to another country if you want to.

<comment><AUTHOR> How are you making this statement ?

Is this from first hand experience or from the general understanding of how they work ?

<comment><USER5> From first hand experience, big companies are hiring constantly from overseas to the US. If you can pass the interview, they will figure out how to legally get you on payroll. If you are flexible in which countries you will work, so much the better.

However, when you apply to big companies, don't go in saying "I want to be a senior engineer". That means different things at different companies. Quora has some great answers on how the ladders work at the big players; you will see that "Senior" can mean 10+ years of experience at some places. Feel free to send me an email if you want more info about one of the places you mentioned.

<comment><AUTHOR> Understood. Thank you.</comment></comment></comment></comment></comment></comment>


An Interview Question Too Many Developers Get Wrong - <AUTHOR> http://openmymind.net/An-Interview-Question-Too-Many-Developers-Get-Wrong/ <comment><USER3> * How many numbers are you looking for?

* How many times will you look for each number?

* How big is the original data?

* How sorted is the original data?

* What kind of access patterns do you have for lookups? (i.e. are the lookups themselves sorted)

* Are there perhaps special space constraints to consider that may have priority over time constraints?

* Where/how is the data stored/how is it backed? (perhaps you're reading from tape media or other non-random-access-optimized storage)

* Is the data a set or bag? (duplicate values allowed, do you care which one is returned, etc)

<comment><USER4> Probably a quicker way to get a developer to generate this same list of considerations is to say "explain the tradeoffs in adding an index to a column in a database table." We tend to search large tables much more frequently than large in-memory lists these days, so that's where any discussions you'll find on the topic are focused.

<comment><USER5> Dumb/honest question from someone who isn't as experienced with database mechanics as he'd like to be:

What exactly _are_ the tradeoffs of adding an index?

<comment><USER6> Storage size of the index itself, insert/update performance. Also there may be very little gain from adding an index to a column with only few distinct values or a very skewed distribution (partitions may be a better approach in those cases).

</comment></comment></comment></comment><comment><USER7> Since they're evidently looking for pedantry, I present the following:

> _What factors influence which approach, between a linear scan and a > sort+binary search, you should pick for an unsorted array?_

"A" search implies once. Linear will always be better, since sorting implies visiting every element at least once, followed by a lookup, where linear is at most once. You can of course come up with data structures and contents where this will not be true, but if you're asking for all solutions to everything, the only possible answer would be "it depends".

</comment><comment><USER8> In my personal experience, if this question were posed to me by a project team, I would ask questions about usage and purpose (granted it would be more business-like such as given an array of 10 million transcript credits, does employee X exist for the Code of Conduct training). If knowing whether a particular number (or item) existed in a large array, maybe we then create a boolean and check during inserts/updates/deletes. Who knows, lets ask more questions and understand each other. Not every developer works on cutting edge Google Search algorithms in lonely cubicle all day by his lonesome.

As a developer, understanding why and coming to an efficient solution (in terms of development hours and customer satisfaction) is about problem decomposition and problem solving skills, not being an algorithm expert.

</comment><comment><USER9> tl;dr

The easiest way to paint yourself into a corner on a technical interview question - especially a trick one - is to answer it without asking clarifying questions about boundary conditions, usage patterns, data set sizes, target hardware, etc.

<comment><USER10> and if you didn't know this going into an interview, you probably had no business going in the first place.

It's not a trick question, it's as much a part of quality software development to ask the right questions as it is to start hacking on the keyboard. The right answer to any interview question starts with "it depends, ..."

</comment></comment><comment><USER11> "No, I'm sorry, that answer is incorrect. The correct answer is, you don't need to sort the array at all because you are a polar bear on an ice floe."

</comment><comment><USER12> Oh man, that interview question gives one hacker the freaks. After reading it, my biological reaction was like: wow, I've got stuff to learn before becoming proficient in Computer Science as a college dropout.

<comment><USER13> If it helps, this type of problem has come up precisely zero times ever. Use a built in function, loop through the array, and if in the future it's running slow, _then_ optimise

<comment><USER14> Hi. I wrote the post. I'm releasing a free ebook next Tuesday where hopefully I can change your mind. (I also wrote The Little Redis Book and The Little MongoDB Book, so hopefully you'll give me a chance!)

<comment><USER12> How nice of you to share! Thank you Mr. latch (:

</comment></comment></comment></comment><comment><USER15> Depending on your tolerance for false positives, space and time requirements, size of the array and data type, either a bitmap or a bloom filter or other hash-based structure may be a much better option than sorting. I would expect a candidate to offer that suggestion.

</comment><comment><USER16> How many needles you're looking for, and at what frequency (if ever again) you're going to need to run the search.

Building any alternative data structure from an unsorted array will require O(n) time. If you only need to find something once, then a O(n) linear scan time is optimal.

</comment><comment><USER17> Sorting and binary searching is more code. Do you need the benefit enough to add the code?

Do you need to implement sorting/binary searching or find libraries, or do you have libraries handy?

I guess the "correct" answer is "lots of things could affect the choice, tell me more about the context".

</comment><comment><USER18> Cache efficiency for linear reads CAN greatly outpace a large array where both the sorting method and the binary search itself might cause a high number of cache misses.

</comment><comment><USER19> Personally, I'd use whatever built in function exists without giving it a second thought. Until it shows up as a hot spot in the profiler I don't care about performance.

<comment><USER20> I often see this kind of attitude expressed on internet forums as if it is the right answer in every situation.

All of the options expressed here will usually be built in to the language, there is no extra implementation cost at all. Pick a vector, sorted vector, set, map or hash-map.

Knowing and picking what is usually correct will not take more than a few seconds of extra thought.

Your attitude leads to "generally slow" programs that are the hardest to make faster.

<comment><USER21> _Your attitude leads to "generally slow" programs that are the hardest to make faster._

Really? Even if they have proper encapsulation, separation of concerns, etc. (even unintentionally)? "Refactor the function or method later if necessary" is not the worst way to write software, and in fact I would say it's the dominant technique _even when_ initial attempts are optimized.

</comment></comment></comment><comment><USER22> This is a fun question to discuss, but I don't see its value in an interview. If you were on the fence about a candidate, it's hard to see an immediate "how many times do I need to search" response pushing them over, and a candidate that can implement sort+bsearch in an interview setting has cleared the "search an array for a number" bar.

Be very wary of questions that may just be a mechanism for demonstrating how smart your team is to candidates.

</comment><comment><USER21> Some people just love to find ways of asking about big-O without asking about it.

<comment><USER23> You'd be surprised how many people interview as programmers without knowing what big-O is. Some of them aren't even bad and could answer the same question on the substance, but don't know the terminology for some reason.

<comment><USER21> Big-O is a interviewer's proxy for a CS degree. Most software engineering (particularly web dev) is not specialized (or complicated) enough to require a degree under US labor laws, so asking about Big-O is a way around the prohibition against requiring one. It's also a signal that the technical leadership of the company may not be able to communicate in substantive terms.

It raises two questions: in what way does the terminology serve the company's business goals, and when was the last time the company had to refer to Big-O in order to solve a problem?

</comment></comment></comment><comment><USER24> I think a different way to ask this question will help you learn more about the candidate. After the trivial answer has been given - ask whether the solution would change if you knew the query will be done several times for the same array, or could it be done more efficiently.

</comment><comment><USER25> I'm surprised no one has brought up testing, or am I just too obsessed with testing?

I'd argue you should have good test coverage and a well thought out API such that you can easily swap out the searching algorithm as needed to meet your needs without worries of breaking the component or things that depend on it. What if the function is handed a pointer to the array, and the caller doesn't want the data sorted?

Beyond that, I'd strongly argue the answer is: whatever can get me the answer with the most readable and simplest code. If this part of the program later proves to be a bottleneck, then consider different algorithms. Which again, good test coverage plays a roll in.

<comment><USER26> Yes you are. You didn't answer the question asked, you avoided the question and talked about what you found important, rather than what the interviewer found important.

<comment><USER25> See my reply to raylu. I suppose I'm biased because I feel questions like this are completely ineffective. Whatever the interviewer finds to be important is not necessarily going to get them quality candidates.

<comment><USER26> But that's for them to decide. You as the candidate have one directive, and an interrupt.

If you want the job, do whatever it is you think you will impress the employer, unless whatever that would take convinces you you don't want the job.

</comment></comment></comment></comment><comment><USER27> Bad question. What is better when searching in an unsorted array - <USER2> search or sorting and binary search? Assuming better implies faster only the size of the array and the (expected) number of searches matters.

If you want me to figure out if searching an array is the best option in the first place, then ask me that question. It is an important skill to ask questions - especially when you have to figure out what customers really need versus what they have requested - but expecting that a simple interview question with extremely narrow scope like this makes me question if an array is the correct choice is ridiculous.

It's a bit like when your math test asks you to calculate some annual interests for you savings account and you start to question if bringing money to a bank is the best option in the first place.

</comment><comment><USER28> One factor I don't think I've seen mentioned yet is how much lead time you have between the construction of the array and the need to search it.

For example, suppose the array is built when the program starts, but you know the need to search it will not arise until significantly later, and you also know that the program will have significant idle time in between. You could then use that idle time sort the array.

</comment><comment><USER29> _What factors influence which approach, between a linear scan and a sort+binary search, you should pick for an unsorted array?_

It seems like there are some serious grammar issues with this question. If the interviewer cannot clearly ask a question, that may explain why many interviewees "get it wrong."

</comment><comment><USER30> At a minimum, you have to consider how long the arrays are and whether the items in the array are sortable.

<comment><USER31> Do you frequently find yourself dealing with arrays of unsortable numbers? ;-)

<comment><USER30> Epic comment fail. I read original post but forgot that they specified numbers by the time I posted my comment. As uncertainty set in, I reread the original post and had a Homer Simpson moment. I upvoted you to teach myself a lesson.

<comment><USER32> There are unsortable or only partially sortable numbers, depending on your number system; it's not a problem if you can restrict yourself to real numbers, though.

But they never said that numbers were the only thing in the array.

<comment><USER31> True enough! Is it complex numbers you're considering? Now I feel like I'm playing one of those puzzles where there is puddle of water and a dead man and you're supposed to figure out what happened.

edit: Puzzles like this: <http://kith.org/logos/things/sitpuz/situations.html>

<comment><USER33> Decomposition and evaporation, I'm assuming?

</comment></comment></comment></comment></comment></comment><comment><USER34> so link baity. "I MUST NEVER GET THIS QUESTION WRONG"

</comment><comment><USER35> job sounds boring.

<comment><USER36> I don't know how serious you are being, but the purpose of the interview question may not have anything to do with the job whatsoever, or it may.

Either way, questions of this nature are intended to filter out people who are not interested in getting to the root of a problem, and solving that problem practically.

The interviewee should be looking to determine constraints, limitations, expectations, requirements, use cases, problem scale.

The interview for any job should be looking for someone looking for those things.

In what way would any job that requires critical thinking be considered boring?

<comment><USER37> I get what you're saying, but there's a line interviewing crosses when it becomes less about trying to figure out if the person is right for the job and more about trying to outsmart them by painting them into some sort of technical corner.

<comment><USER21> Dominance games.</comment></comment></comment></comment>


Credit Suisse has deployed 20 robots within bank - <AUTHOR> http://www.reuters.com/article/us-milken-conference-creditsuisse-idUSKBN17X2JC <comment><AUTHOR> "Chin said although technology has allowed Credit Suisse to cut back and middle office staff, headcount has remained flat because the bank has hired a large number of programmers."

Interesting.</comment>


The Quiet Menace of Kelly Reichardt's Feminist Westerns - <AUTHOR> http://www.nytimes.com/2016/10/16/magazine/the-quiet-menace-of-kelly-reichardts-feminist-westerns.html <comment><USER2> I'm sure her movies are great, but in what universe is this relevant to HN?

<comment><AUTHOR> Hackers are people, i.e. diverse, multi-dimensional beings with a range of interests. To presume otherwise is to short-change the community.

I don't see HN as a technical repository for news, but rather, where Hackers get their news. Furthermore, I enjoy it because often the level of criticism and debate floats above traditional media outlets on a broad range of topics. Not always.

"Reichardt's films are animated by a sustained unease...The menace is durational and transforms the audience into participants in a kind of endurance art. It's the low-grade but unrelenting sense of hazard that is a woman's experience of merely moving through the world, an anxiety so quiet and constant it can be confused for nothing more than atmosphere."

I found this to be interesting, poignant, well articulated and insightful.

I'd argue that it's relevant as we all have something to gain by enriching our understanding of the human experience. Even more so when it extends beyond our comfort zone.

<comment><USER2> >Even more so when it extends beyond our comfort zone.

I hope you're not under the impression that rhetoric like "the low-grade but unrelenting sense of hazard that is a woman's experience of merely moving through the world" is anything controversial or even a millimeter outside the Overton window. Lines like that are dogma in every major political, cultural, educational, and business institution in the Western world. A bologna sandwich would be more controversial and beyond-our-comfort-zoney than claims about how bad women have it in the Western world.</comment></comment></comment>


Chrome about:flags now has instant and side tabs - <AUTHOR>

Type about:flags into Chrome address bar. <comment><USER2> Instant has been moved into Options in the Beta version. I know I was pretty confused when I couldn't find it.

</comment><comment><AUTHOR> Beware of the message a the top of the page. Apparently some pretty bad things can happen. I've tried instant and side tabs with no apparent negative ramifications on Windows Vista.</comment>


Ask HN: Is there a more free version of the interwebs being worked on? - <AUTHOR> Recently with all the news about cracking down on unpopular speech, I think there will be more interest in another version of the internet (if there isn't already great interest) where there is free speech for all and perhaps less corporatism in platforms (although of course there almost necessarily must (and probably should) be business on all forms of interwebs).<p>Is there already something like this people are working on that you can be a part of? I don't want to join anything illegal, and my content is pretty tame, but I want to join what I suspect will probably be more of the future of interwebs, which will be one with more freedom of speech etc. <comment><USER2> How about

[https://www.torproject.org/docs/hidden- services.html.en](https://www.torproject.org/docs/hidden-services.html.en)

</comment><comment><USER3> Check out IPFS [https://github.com/ipfs/go-ipfs](https://github.com/ipfs/go- ipfs)

It's the distributed web and it's the future, there's tons of videos on youtube as well [https://www.youtube.com/watch?v=skMTdSEaCtA](https://www.youtube.com/watch?v=skMTdSEaCtA)

<comment><AUTHOR> Thanks. Am watching this.

</comment></comment><comment><USER4> Fully distributed wireless mesh network would be the evolutive step, but as Big Telecomm controls not only the grid but also the things manufacturers are urged to make, openly wireless-to-wireless cards may take a while to emerge.

<comment><AUTHOR> Is this like the app the arabs used during the arab spring, where nations cut off internet, so they used an app to share info using each other as a network? I think there's also a radio-wave version of this, isn't there?

<comment><USER4> Must be something of the sort. It's hard to have internet when the ISP decides to turn off the main nexus, so that is my assumption but I have not asked anyone from that conflict about the logistics so true intel on it would have to wait. Radio-wave version... like a plug-and-play hub? It would be really good to have this for a) remote areas, b) emergency times, c) social reform

<comment><AUTHOR> Ok, so I have watched 2 of his videos and understand what he's explaining, but what I don't understand is where the data is supposed to be stored. (I also can't think of any ways for data to be stored except in big banks (hosting) like it is now - Can you think of any?

I get that he's proposing all devices can access the web by accessing each other (each device a port), but where are the websites located then? Where are the videos stored?</comment></comment></comment></comment>


Ask HN: Idea Sunday - <AUTHOR>

I wonder what happened to Idea Sunday, there were some really good discussions there: https://news.ycombinator.com/item?id=7616910 https://news.ycombinator.com/item?id=7582077 https://news.ycombinator.com/item?id=7541601 Hopefully we can restart the tradition. <comment><USER2> HN Admistration stated that they don't allow posting these type of topics from regular accounts as they bring karma disbalance. And they don't see such a value in this topic to make submission created by the "whoishiring" account bot.

<comment><AUTHOR> OK, I didn't know that. It's a shame.</comment></comment>


Rust is not a good C replacement (2019) - <AUTHOR> https://drewdevault.com/2019/03/25/Rust-is-not-a-good-C-replacement.html <comment><USER2> > Go is the result of C programmers designing a new programming language, and > Rust is the result of C++ programmers designing a new programming language". > This isn't just a metaphor - Go was designed by plan9 alumni

That may be true, but Go has a garbage-collector, and Rust does not. Garbage- collection strikes me as being against the principles of both C and C++, but especially C.

Drew makes some solid points about the merits of C, even despite its considerable downsides, but I have to agree with others here that _rewriting_ in Rust is rarely what people are advocating. Writing new systems in Rust, is usually the point.

Mandatory link to the Spolsky article, _Things You Should Never Do_ , on why you probably shouldn't throw out working code. [0]

> Rust will eventually fail to the "jack of all trades, master of none" > problem that C++ has.

Ok, but C++ has been incredibly successful, and it outcompetes C in many domains, just about everything but kernel programming and embedded programming. C++ isn't completely out of the running even there. Versatility is a feature.

Also, Drew (the SourceHut guy, if anyone missed it) has a good sense for minimalist web design. There's no fat on that page. A refreshing change.

[0] [https://www.joelonsoftware.com/2000/04/06/things-you- should-...](https://www.joelonsoftware.com/2000/04/06/things-you-should-never- do-part-i/)

<comment><USER3> Offhand thought is there are two ways to skin the cat vs safety.

Go and Rust put hard limits on what will compile and especially rust run a whole bunch of checks to enforce book keeping.

In C if you are doing things right you run those checks as a separate process. And you only do it once you are done with a dev cycle, not every time you compile the program.

</comment></comment><comment><USER4> I honestly don't think anyone suggests dropping C in favor of Rust. Make no mistake, I love Rust and I think it's the best language that's been developed in this century.

Firstly, C is where it is because it's well established and has solid foundations and it has remained pretty much unchanged for decades. Rust on the other hand is changing rapidly and fast, which is something you wouldn't want for a language that powers your kernel

Secondly, the Rust community is painfully small.

Thirdly, Rust lives in the LLVM world and I don't see it coming into the GCC world anytime soon. Which is a huge problem, as far as replacing C goes(namely licencing might be problematic in some cases).

Lastly Rust, in terms of it's nature, is more closely related to C++ rather than C. If Rust was to replace something, it has a much better chance against C++ than C.

I truly want to see the day I open up linkedin, go to the jobs section, type in rust and see 6000 new job offers. But at this point in doubt this day will ever come.

<comment><USER5> I do believe there's a "drop C and pick Rust" crowd, or multiple even.

When it comes to building user mode applications like desktop programs with QT or GTK or what have you or command line programs such as curl and wget, I think these crowds have a valid point. Most of those applications are written in an object oriented language though.

There's also a very small group that's very militant about everything, including kernels and microcontroller programs, being rewritten into Rust. I don't pay too much attention to that crowd; C has its place and it's not the ultimate solution to programming languages.

Rust won't replace C in the kernel, but I do think we will see tooling for our network clients, file indexing and perhaps even version control slowly switching languages (if they still rely on C, that is). These will all be new tools though, because rewriting an old application into Rust and maintaining compatibility and performance is a big challenge.

<comment><USER6> Doing GUIs with Rust is difficult. Gtk-rs lucked out because Gtk has introspection that maps out its C object API. Qt is not so good. Something simple like Win32? Not so good.

Maybe I want to write a game. Gfx-rs is deprecated. Its replacement? It's in a half ready beta state, and most of its developers are now focusing on a compatibility wrapper for MacOS, so progress is stalled.

The ecosystem just isn't there. System libraries have an interface that is extremely suited for C. Interfaces have to be uniquely adapted for rust or be marked completely unsafe. Dynamic linking is convoluted, so Rust encourages statically linking everything. It's not easy, and the situation needs to improve or Rust will be relegated to just another text processing language. C library symbols need to be accessible as a first-class part of the language.

<comment><USER5> I agree the ecosystem isn't there yet, but given some time that will correct itself.

Perhaps Rust will not be able to interface with Win32 because of its reliance on pointers, but there's the possibility of leveraging alternative programming interfaces such as the abstractions in the .NET runtime.

I believe that if Python and Java can have cross-platform GUI libraries, so can Rust. I don't know what the result would look like but the tooling has already massively improved since I first looked into the language. I'm too annoyed at GTK for their obsession with client-side decorations messing up the native look on Windows and other platforms to use it for my own projects, but the Qt integration didn't look all that bad in my opinion. Rust-qt is clunky because the Qt API requires unsafe code, but with some work the unsafe parts can be abstracted away from the main program logic. It's suboptimal but it does allow you to do data and network traffic parsing and handling in a safe manner, which would already be a huge win for application security in my opinion.

<comment><USER7> (Rust can absolutely interface with Win32, and Microsoft themselves have implemented bindings to WinRT.)

<comment><USER5> Interesting. In my experience, a lot of Win32 messaging required converting pointers to structs and reading values from that. I don't see how that works with Rust? I suppose you can add a load of unsafe code but that would make the whole thing a lot more complex as you now need to deal with pointer ownership and (de)allocation.

<comment><USER7> Yes, because it is FFI you have to use unsafe to do so.

Almost 20 million all time downloads: [https://crates.io/crates/winapi](https://crates.io/crates/winapi)

And the other bindings I was talking about [https://github.com/microsoft/winrt-rs](https://github.com/microsoft/winrt-rs)

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> The reverse is also true: C isn't a good replacement for Rust. Between Rust and Go, I can't see myself plausibly starting a new project in C ever again. Contributing to existing C projects? Sure! But for me, today, C has little appeal other than being compatible with itself. In any situation where C compatibility isn't a requirement, I don't feel like it has anything to offer me.

<comment><USER9> Rust has been a fantastic C replacement for me.

I have all the control and performance I wanted from C. Despite Rust being a "bigger" language, it's simpler to use, because it takes care of things for me, instead of relying on me to handle every tedious detail.

It is more portable than C was for me. I don't need to support exotic DSP platforms, but I do need to support Windows. Now I don't have to spoon-feed MSVC, and I don't need to answer endless support tickets about the build system.

<comment><USER8> That's been my experience, too. It's the little things, like having a built-in HashMap data structure, that I find to be so time saving. Data ownership took a bit of getting use to, but the compiler gives wonderful human-readable suggestions for how to fix errors that pop up, and now I don't have to spend a lot of time reasoning through every decision I've made to make sure I'm not leaking or clobbering memory all over the place.

</comment></comment></comment><comment><USER10> > Cargo is mandatory. On a similar line of thought, Rust's compiler flags are > not stable. Attempts to integrate it with other build systems have been met > with hostility from the Rust & Cargo teams. The outside world exists, and us > systems programmers spend a lot of our time integrating things. Rust refuses > to play along.

Linux kernel maintainers doesn't want to use Cargo in the kernel ("Agreed, I wrote one ~half a year ago that compiled TUs through rustc mimicking what we do with cc to some degree (i.e. no cargo etc.), and it was quite pleasant." [1]), and there hasn't really been much opposition to that by the Rust team.

> However, nearly all programs needn't be parallel. A program which uses poll > effectively is going to be simpler, reasonably performant, and have orders > of magnitude fewer bugs. "Fearless concurrency" allows you to fearlessly > employ bad software design 9 times out of 10.

Sure, if you don't care about performance, which may very well be the case in many situations. However, the reality is that modern CPUs get their performance from multi-core workloads, requiring you to do things in parallel. Go does have some nice bits (e.g. no fragmentation between Tokio and smol, no need to separate code between async and non-async versions), but you don't explain what those are in depth.

> I especially refuse to "rewrite it in Rust"

Sure—that's mostly just a meme[2], which many people in the Rust world acknowledge is a bad thing[3].

[1]: [https://lore.kernel.org/lkml/CAKwvOdmuYc8rW_H4aQG4DsJzho=F+d...](https://lore.kernel.org/lkml/CAKwvOdmuYc8rW_H4aQG4DsJzho=F+djd68fp7mzmBp3-wY --firstname.lastname@example.com/T/#u) [2]: [https://www.reddit.com/r/rustjerk/comments/av5pog/higherres_...](https://www.reddit.com/r/rustjerk/comments/av5pog/higherres_rust_evangelism_strike_force_image/) [3]: [https://www.reddit.com/r/rust/comments/ifkrvg/i_printed_rewr...](https://www.reddit.com/r/rust/comments/ifkrvg/i_printed_rewrite_it_in_rust_swag_for_students/g2s1bh9)

<comment><USER11> > "rewrite it in Rust"...which many people in the Rust world acknowledge is a > bad thing

I've seen "rewrite it in Rust" mentioned plenty, even on HN; in fact, that meme colored much of my initial impression of Rust before I learned anything about it directly. I think the maintainers and the Rust world in general need to address that meme head on if they don't want it to be part of how Rust is known.

Otherwise, as it stands currently, Rust is the language that's trying to replace C and rewrite everything that is C in Rust.

<comment> Ar-Curunir I mean, every rust forum has a "no language zealotry" rule in place, partially to head off the RIIR meme. I don't know what you want the Rust team to say, "Don't use Rust to improve your C projects"?

<comment><USER11> Maybe a clearly published outline of where their language fits in the ecosystem of languages that are out there. e.g., it improves on these aspects of C++, gets these traits from python, fixes these weaknesses of C, but doesn't improve on X, and Y is something that C still does better.

Or something like that. Then there's something out there and clearly visible that immediately shuts down the zealotry because the maintainers have said exactly where Rust stands, and what they think it's great at, and what it doesn't do. Which seems like the problem: that the zealots are giving the impression that Rust is better than C for everything.

<comment><USER12> I don't really see how that would stop the zealots. They are already getting pushback within the Rust community.

<comment><USER11> It sure wouldn't hurt.

</comment></comment></comment></comment></comment></comment><comment><USER13> The discussions about a lack of specification are, I think, the largest and most-relevant. Someone in an earlier discussion mentioned the Rust Reference [1], but it is not sufficient: in particular, many portions of the memory model, calling conventions, and borrow-checking enforcement are left unspecified. Rust's guarantees are built on these, and they are currently defined by the current rustc implementation. Until a complete and detailed standard is published, Rust will not have a stable AI, and cannot enjoy multiple implementations (which inhibits its portability). Even the bit about Cargo stems from this: without a specification, Cargo's implementation is the de facto explanation for to properly link external, compiled libraries against rust binaries. As Rust matures, I anticipate many of these things will stop being the case---and I really hope someone gets around to writing a different Rust compiler, using pattern-matched ASTS like you would in OCaml, instead of the current, visitor-based solution.

1\. [https://doc.rust-lang.org/1.0.0/reference.html](https://doc.rust- lang.org/1.0.0/reference.html)

<comment><USER7> > Until a complete and detailed standard is published, Rust will not have a > stable AI, and cannot enjoy multiple implementations (which inhibits its > portability).

This is not really true; we already have one alternative implementation that's good enough to compile the compiler, though it is not complete yet. Also, the gcc folks are interested in getting Rust in, and a formal specification is not a roadblock for them.

> Even the bit about Cargo stems from this: without a specification, Cargo's > implementation is the de facto explanation for to properly link external, > compiled libraries against rust binaries.

This is not true; this interface to the compiler is stable.

<comment><USER13> > we already have one alternative implementation that's good enough to compile > the compiler

That's really interesting! Can you link it?

<comment><USER7> [https://github.com/thepowersgang/mrustc](https://github.com/thepowersgang/mrustc)

</comment></comment></comment></comment><comment><USER7> Three months ago: [https://news.ycombinator.com/item?id=23343507](https://news.ycombinator.com/item?id=23343507)

A year ago: [https://news.ycombinator.com/item?id=19482669](https://news.ycombinator.com/item?id=19482669)

</comment><comment><USER14> This seems like attacking a straw man.

Rust _can_ be a good C _alternative_ , which is all I've ever seen Rust people promise it to be.

C is far too widely used/supported to be replaced. A small minority of libraries will be rewritten in Rust, but mostly we'll see new projects that have their own namespaces.

</comment><comment><USER15> Parallelism is too hard in C, easier in Go, but Rust makes it too easy and is therefore poorly designed? What kind of an argument is this?

<comment><USER16> Yes. I have criticisms of Rust, but not that one. We have to go parallel for things that need speed. CPUs are not getting faster, but we have far more cores.

Now this is more of a problem:

\- C: 0.73 new features per year

\- Go: 2 new features per year

\- C++: 11.3 new features per year

\- Rust: 15 new features per year

Rust is now stable enough that you can recompile old programs from a few years ago, but more and more features are being added and the ideomatic usage keeps changing.

The borrow checker was brilliant. The rest of the language, not so much.

A point that doesn't get discussed enough is threading models. Go has "green threads" \- no need for a distinction between threading and "async". Python and Rust started with threads, and are having "async" bashed into the language as an afterthought. "Green threads" have been around for years, but Go seems to be the first language where they really took off. This may reflect the use case. Go is optimized for big web servers talking to huge numbers of clients, which is what Google does all day.

<comment><USER17> The feature comparison is bullshit because the author uses different methodologies to count the features of Rust compared to the other three languages. For the other languages, it's count the bullet points in a list of new features; for Rust, it's count the bullet points in release notes. (And the methodology isn't clear as to whether it's limiting to language features, or including both library and language features)

> Python and Rust started with threads, and are having "async" bashed into the > language as an afterthought.

Rust started with green threads, but they were removed pre-1.0 for reasons that I'm sure steveklabnik can jump in and explain.

<comment><USER7> Yeah, I would strongly disagree with "bashed into the language as an afterthought"

Here is a very lengthy explanation of the reasons: [https://www.infoq.com/presentations/rust-2019/](https://www.infoq.com/presentations/rust-2019/)

</comment></comment></comment></comment><comment><USER18> Hum... Of course, Rust is very different from C. I don't think anyone disagrees.

But a "C replacement" doesn't mean "something similar to C", it means "something that solves the same problems as C". Rust doesn't excel on all the problems that C excels at, but it does for a lot of them. So it is a partial replacement, and isn't at all a total replacement.

<comment><USER19> At the moment I believe C excels at portability to uncommon CPU architectures. It also excels at ABI stability.

Are there other areas where you believe C excels vs. Rust?

</comment></comment><comment><USER20> If you take this argument seriously enough there's a level of specificity about the salient features of C (or any language) where you can say "nothing is a replacement for C, because it isn't C".

Is C's degree of portability important for a C replacement? Depends on the project we're talking about and the platforms it needs to support.

We can go down the line w/ these arguments (some of which like "concurrency is a bad thing" and "I don't care about safety" aren't even serious). I'm also surprised that in 2020 (or 2019 as this was written) we have engineers making a serious argument that specifications are inviolable laws. They do in fact help, but there are more considerations to make about a project's commitments to reasonable, expected behavior than just "there's a spec" (and in fact C has more guardrails supporting those commitments than a spec).

I agree that there's a rust contingent that is over-eager to rewrite and may be oblivious to the concerns of a project or broader technical implications involved in pulling rust into a project.

That being said, this reads more like a "get off my lawn", oblivious tirade about the "cult of the new" than a serious attempt to address these instances.

</comment><comment><USER21> How often does this get rehashed?

This is at least the third maybe forth time the article is in the top charts.

I don't feel even like posting my opinion anymore.

<comment><USER22> It's not a job, you don't have to feel bad about that ;-)

<comment><USER21> Sure ;) it's just a topic I'm normally likely to comment on as I both respect Drew a lot for the work he does but at the same time disagree a lot with what he thinks about programming languages.

</comment></comment></comment><comment><USER23> It might be that the only real C replacement in the author's sense is a language of annotations/validations and idioms for C. How else would you get everything that C has now -- the compiler support, the well-tire-kicked-spec, the ABI, the low feature-rate and concomitant unchanging character -- besides basically just being C with some minor (and unchanging) addenda?

The weird thing about Go relative to all this is the fact that interoperates so poorly with C.

</comment><comment><USER24> Don't think there's any good C replacements. There are great alternatives, with advantages and compromises.

</comment><comment><USER25> _Concurrency is generally a bad thing_ and specifically it is a good thing.

</comment><comment> Paul-ish Whatever replaces C, if it is replaced, won't be C.

</comment><comment><USER26> I wonder how the author views Zig as a C replacement.

</comment><comment><USER27> > Consider Go, ... addressing them with the simplest solution possible.

Go code doesn't result in the simplest solution possible.

</comment><comment><USER28> "Oh say, can you C?"

"In Rust We Trust."

<comment><USER11> Very clever, but off topic. :)

</comment></comment><comment><USER29> I don't think anyone is seriously claiming that rust is a replacement for C.

</comment><comment><USER30> This post is just decompressed twitter trolling.</comment>