RTM: flow-based network monitoring - <AUTHOR> https://rtm.rdit.ch/ <comment><USER2> RUAG was hacked over a year ago an didn't notice until recently when the intelligence agency informed them. It's a huge scandal here.

[http://www.swissinfo.ch/eng/ruag-affair_sensitive- personal-i...](http://www.swissinfo.ch/eng/ruag-affair_sensitive-personal- information-likely-hacked/42140796)

[http://www.blick.ch/news/wirtschaft/beunruhigender-hack- wie-...](http://www.blick.ch/news/wirtschaft/beunruhigender-hack-wie-schlimm- war-der-russen-angriff-auf-ruag-id4996353.html)

<comment><AUTHOR> you're right. An other example why it's a good idea to invest into smart people supported by good products in order to defend against such attacks. From my personal point of view, the risk of a data-breach is beeing underestimated in almost all companies. Which leads toh harsh budget restrictions for security responsibles.

Note: in my opinion Blick.ch [1] is not the best ressource for information. Please consider [2], [3].

[1]: [http://www.blick.ch/](http://www.blick.ch/) [2]: [http://www.derbund.ch/wissen/technik/organisation/ruag/s.htm...](http://www.derbund.ch/wissen/technik/organisation/ruag/s.html) [3]: [http://www.nzz.ch/nzzas/cyber-attacke-gegen- ruestungskonzern...](http://www.nzz.ch/nzzas/cyber-attacke-gegen- ruestungskonzern-ruag-russische-hacker-enttarnen-geheime-schweizer- elitetruppe-ld.18562)

</comment></comment><comment><USER3> Wait. How do I actually download this and where's the documentation?

<comment><AUTHOR> Currently this is more of an ad-page for a propietary product. Devs are 'in discussion' with management in order to make the product available for a wide public audience. Actually the goal is a (at least) partial open source commitment.

\- stay tuned

</comment></comment><comment><USER4> Kentik ([http://www.kentik.com](http://www.kentik.com)) is doing something very similar, as a cloud-based service or on-prem cluster. Accepts standard flow formats (netflow, sflow, IPFIX) from routers and switches, and also "augmented" flow from nprobe running on hosts or sensors.

</comment><comment><USER3> How does this differ from Silk+Flowbat?

<comment> jawn- Judging from screenshots, RTM does a deeper level of packet inspection than netflow based system (silk/flowbat).

As Silk/Flowbat are based on netflow records, which doesn't inspect the traffic passing across the network. It just records surface level information about the traffic. Source/Dest ports and addresses, UDP vs TCP and length and size of the conversation.

Deeper packet inspection probably results in rtm being able to inspect less traffic. Though depending on how RTM is written and the network drivers being used and your network size, you still might be able to have this monitor your egress points.

<comment><AUTHOR> You're right. RTM, or rather, its internal flow assembling component RTS can be extended with plugins in order to extract and append more information for a flow. For example there are plugins for:

* regex matching * tcp state machine following * http * dns * bgp * smtp * icmp * pcap splitting by flows * ...

Using them will have an impact on performance, which is why there are no numbers regarding speed on this page. It's always a fit between: what one can see and what one wants to see. It's beeing sold as a privacy feature ;). Nevertheless a security expert has to configure the software so that it fits the environment.

In contrast to other projects, the general assumption is that RTM is not the 'one solution you implement and you're secure' but rather a platform on which you can build your security upon.

Sorry for the generic answer: I don't know Silk/Flowbat well enough in order to provide a in depth comparison.

</comment></comment></comment><comment><USER5> fastnetmon is another solution for this [https://github.com/pavel- odintsov/fastnetmon](https://github.com/pavel-odintsov/fastnetmon)

</comment><comment><USER6> #SWISSNESS</comment>


Apple forcing operators to buy phones - even if they can't sell them - <AUTHOR> http://www.theregister.co.uk/2013/11/29/revealed_the_secret_apple_deals_that_squeeze_rivals_and_tax_you/ <comment><USER2> _" The deals for the Galaxy S4 were almost as restrictive as Apple's," one source said. "But Samsung has a range of phones, and operators had choices."_

Well, operators _have_ choices. They can simply decide to not purchase Apple phones - at least not in the 20 billion dollars scale.

</comment><comment><USER3> This is also the reason why Apple started counting "shipped" iPhones this year, starting with that "record 9 million iPhones in first weekend", that everyone thought were _sold_ to customers, but in fact they were just shipped to carriers.

[http://www.fool.com/investing/general/2013/09/24/apples-9-mi...](http://www.fool.com/investing/general/2013/09/24/apples-9-million- iphones-may-not-be-so-impressive.aspx)

<comment><USER4> I don't think Apple has a large inventory just sitting around. They used to do "channel stuffing" in the worst way possible back before Jobs, it was almost criminally bad, but under Cook they've been running really lean.

Carriers might resent having to purchase so many, but I'm skeptical they're stuck with unsold inventory.</comment></comment>


Zynga selling words in the DrawSomething dictionary - <AUTHOR> http://adage.com/article/digital/zynga-s-ad-pitch-draw-draw-brand/234515/

<comment><AUTHOR> That didn't take long.</comment>


Some Rich Americans Are Getting Stimulus 'Checks' Averaging $1.7M - <AUTHOR> https://www.forbes.com/sites/shaharziv/2020/04/14/why-are-rich-americans-getting-17-million-stimulus-checks/#1025269e665b <comment><USER2> If I am understanding this correctly, there is no money flowing to rich Americans, but they will have additional opportunities to deduct losses on their 2020 taxes (basically paying less in taxes after a major stock market rout) that would normally need to be spread over future tax returns indefinitely.

However, this will only occur if they took losses, so it is really a discount of ~35% on negative income. This would also apply to someone who is not rich, i.e. a software dev sole proprietor who cashed out big losses in March in the stock market and then applied those losses against their normal income to end up reporting 64k in income instead of 100k (normally 36k in losses would have to be stretched over 12 years of tax returns).

I understand this doesn't fit the narrative, but please comment if it is incorrect instead of downvoting.

<comment><USER3> Something really needs to be done about downvote brigading on HN. At least people should be required to provide a reason for the downvote.

<comment><USER4> I've wondered if a five-a-day downvote limit would benefit HN.

<comment><USER5> Or just make it cost karma. Anyone that down-votes too much would wind up at the threshold for down-voting and be rate limited by their ability to make up- voted comments. It would also render ineffective the strategy of having a bunch of accounts with enough karma to downvote and using those accounts all at once to make comments you don't like dead (the presence of corporate or state controlled accounts employing this strategy has been suggested multiple times).

<comment><USER6> The way to game that is to just upvote random comments that you don't care about in stories that you don't care about, just to have made enough upvotes to enable you to downvote again.

<comment><USER5> I meant have comments that get upvoted, not upvote other comments.

<comment><USER6> Oh. That's harder, but not much. You just need two accounts. Make some innocuous comments on account 1, upvote them with account 2. Now you can downvote from account 1.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> This article is a summary of the original:

[https://www.washingtonpost.com/business/2020/04/14/coronavir...](https://www.washingtonpost.com/business/2020/04/14/coronavirus- law-congress-tax-change/)

<comment><USER8> [https://archive.is/cucsR](https://archive.is/cucsR)

</comment></comment><comment><USER9> >because of additional language that applies the policy retroactively "so losses in 2018 and 2019 can be 'carried back' against the past five years."

Damn, must be nice.

<comment><USER10> Surely this is what I'm paying taxes for.

Could go to healthcare for all, fixing my roads and access to education, creating a strong resilient nation for all of us.

But this is so much better.

<comment><USER11> This is what an oligarchy looks like.

<comment><USER10> Wouldn't it be nice to have "oligarch-democrat" as explicitly stated as "social-democrat"?

Everywhere a candidate's name is printed.

<comment><USER12> >Wouldn't it be nice to have "oligarch-democrat"

it is already called "Republican".

<comment><USER11> It's also called "Democrat." There is no non-plutocratic alternative in the US.

</comment></comment></comment></comment></comment></comment><comment><USER13> _It found that, "82 percent of the benefits of the policy go to about 43,000 taxpayers who earn more than $1 million annually."_

Why is that surprising? The people that pay the most tax have the most benefit from a tax break.

It's no different than saying a family making $30,000 per year don't benefit from tax breaks, but leaving out the fact they don't pay any tax anyways.

</comment><comment><USER14> Edit for definitional clarity: My use of the term socialism here is exactly equivalent here to the term "systems that enable wealth redistribution through legislation" no more, no less. Im not commenting on anything like the ownership of the means of production in society or anything like that.

It seems like the whole world is chomping at the bit to enact more socialism but do you think it's homeless people and cashiers that are defining the rules of the system and legislation? Of course not, it's lawyers and politicians. So are you really naive enough to believe that they write perfectly fair legislation that doesn't favor their interests at all?

Friedrich Hayek nailed this on the head almost 100 years ago. The problem with socialism isn't that its not an admirable goal, it's that even if you want it, by nature you aren't going to get the version of it that you wanted, you are going to get the version of it the a bunch of politically connected insiders design and while they may not be totally self serving, they are usually going to figure out how to be on the winning end of the game.

Crass said it well: "But no one ever changed the church by pulling down a steeple

And you'll never change the system by bombing number ten

Systems just aren't made of bricks they're mostly made of people"

The systems you get are the ones the people who design them make. Thinking otherwise is foolish. The people who should be the most scared of redistribution systems like this are the ones who want to look out for the interests of the little guys.

<comment><USER15> You're intentionally mislabeling "not using a crisis to hand out billions in tax breaks to rich people" as "socialism" to extend people's historic aversion to socialism to this situation.

Do that often enough and you'll find people quite willing to give this "socialism" thing a chance.

<comment><USER14> I'm certainly not advocating tax breaks for anyone here. In fact I'm advocating getting rid of the framework that is used to implement those tax breaks.

You're reading into my words to say things that simply aren't there.

</comment></comment></comment><comment><USER16> This is a pretty reasonable thing to suspend at a time when landlords are essentially forgiving huge amounts of rent. It's super reasonable that they be able to deduct those losses on their taxes in an unlimited fashion.

<comment><USER17> Only if they don't request to be paid back later for said rent. Otherwise, that's just giving rich people free money.

<comment><USER18> People who can't pay rent now are unlikely to be able to ever pay it back later. It's probably better for everyone to just write it off.

<comment><USER11> That would probably be better, but isn't happening. I think these landlords should have planned ahead and had six months of emergency funds saved up, just like McDonald's employees are supposed to.

</comment></comment></comment></comment><comment><USER19> Unfortunately, this isn't even slightly surprising. Tax breaks is essentially the de facto way the country rewards the rich as it's not 'giving handouts' (but it is).

</comment><comment><USER20> I'm assuming that's by design.

</comment><comment><USER21> Landlords who took big losses from tenants who didn't or couldn't pay their rent and suffered a loss will be able to deduct more of their loss from their personal income tax.

<comment><USER22> The reason why you get better yields from being a landlord or investing in shares than from keeping it in the bank is because you also accept risk. These people accepted the risk, and their reward during normal times is a better yield. By bailing them out (and specifically only the ones who also get income tax)

<comment><USER23> It seems they also got a reward during the tough times

<comment><USER24> It's one thing to make a profit or a loss, it's another thing when a government forces you to take a loss to subsidize someone else. If there was a risk that you'd be forced by the government to take huge losses then that risk should be priced into the rent — which means future rents will have to be much higher to accommodate the increased risk. Imagine if a grocery store were required to give free food to everyone at the command of the government. Who covers that expense? The shopkeeper? Any shops that managed to survive would have to jack up future prices to recover their loss. The risk of the government taking away your inventory and giving it away uncompensated is unprecedented. You can't evict and you can't collect rent because of a government decree — that's effectively a seizure of property which is illegal without due process. Even eminent domain requires fair compensation to the property owner. If you accept this as acceptable, then what's to stop the government from taking all of your income and giving it away? Why is your income supposed to be safe from seizure but someone else's isn't?

<comment><USER21> > which means future rents will have to be much higher to accommodate the > increased risk

Right! And that, too, is illegal under rent control in many places (NY and California).

</comment></comment></comment></comment></comment><comment><USER25> As soon as I heard that the Fed was going to do a cash injection. I knew that covid-19 was just a pretext. See [https://news.ycombinator.com/item?id=22560017](https://news.ycombinator.com/item?id=22560017)

And now we're seeing article after article just proving me right.

</comment><comment><USER26> They are not getting anything from the US government – they pay less taxes. This article tries to make a case a if it was the same thing. It is not.

<comment><USER27> If anyone pays a million less in taxes then someone gave them a million dollars back. so yes, you are giving them something. One can argue in some irrational way that taxes are theft so you never 'give' someone something if you reduce their taxes. At the end of that game, you have more money than you had before, gift or other political arguments aside.

Someone who was going to pay a million in taxes and now has 1 mil less is not going to put their money into the economy the same what that 1000 people with moderate income, like say restaurant workers getting $1,700 would. Those people poorer will spend all that money. I'm fortunate to be a well compensated software engineer, and I pay a huge amount of taxes. I'm not out there begging for more money (via tax reductions) and then claiming it was already my money, not a gift. That's a dishonest argument.

<comment><USER28> > is not going to put their money into the economy the same what that 1000 > people with moderate income, like say restaurant workers getting $1,700 > would. Those people poorer will spend all that money.

Wealthier people spend or invest all of their money. Only drug dealers hoard cash, and that's only because they have difficulty laundering it.

<comment><USER29> It doesn't seem hard to argue that purchasing stocks or expensive real estate is not as beneficial for the economy as thousands of people spending the same amount in their local economies.

<comment><USER28> > It doesn't seem hard to argue

I agree, but it doesn't make any sense. Investing is literally putting money to work. Storing it in a mattress is not putting it to work.

For example, what happens to the money when people buy real estate? The seller of that real estate gets the money. They don't hoard it, they also spend/invest it.

What happens to the money you put in your bank account? The bank loans it out to people who spend/invest it. (Banks don't make money hoarding cash, they make money loaning it out.)

Think about it another way. Wealthy people in general are not stupid with money, if they were they wouldn't be wealthy very long. They put it to work. That means spending it or investing it to people who spend it.

<comment><USER30> Unfortunately, when wealthy people get money they do not spend it on goods and services that employ people and drive the economY. Rather, the invest it in the financial vehicle with the highest ROI. Giving money to the rich does not trickle down to people. It goes into a holding pattern of financial engineering. That maybe why there has not been any inflation with all the quantitative easing that has been going on these past 2 decades. Instead of having more money chasing the same amount of goods and services (which would happen if all that QE hit the real economy) there is more money chasing more financial products. That is why the value of financial products(stocks,etc) has been skyrocketing for a decade.

<comment><USER31> > Giving money to the rich does not trickle down to people.

All of my well-paying tech jobs have been funded by VC money from rich people and/or IPO money from rich people. Same goes (indirectly and partially) for all the people who have been selling me goods and services over those same years.

<comment><USER32> Yeah, paying a few programmers high salaries doesn't quite count as trickling down. Let's say it's extremely-limited trickle down.

> Same goes ... for all the people who have been selling me goods and services > over those same years.

No, it doesn't. Unless you only buy services from VC-financed startups?

<comment><USER31> > No, it doesn't. Unless you only buy services from VC-financed startups?

I buy things using my salary which trickled down from the VCs and shareholders.</comment></comment></comment></comment></comment></comment></comment></comment></comment>


Gawker Media revenues up 45% in first half - <AUTHOR> http://nickdenton.org/5323836/ <comment><USER2> Scare your writers with layoffs and cut out their bonuses, get a 45% boost to your bottom line. How lovely.

<comment><USER3> I can see how what you describe could decrease expenses, and increase profit, but how could it increase revenue?</comment></comment>


Louis C.K's $5 Stand-Up Special Tops $1 Million - <AUTHOR> http://thenextweb.com/media/2011/12/22/louis-c-ks-5-stand-up-special-nets-him-1-million-donates-a-quarter-to-charity/ <comment><USER2>
      I never viewed money as being "my money" I always saw it
      as "The money" It's a resource. if it pools up around me
      then it needs to be flushed back out into the system.

Awesome thought.

</comment><comment><USER3> I liked that he posted a screenshot of the paypal account, it makes it a lot more personal.

<comment><USER4> If I had a Paypal account with that kind of balance, I'd have a knot of fear in my stomach, thinking Ebay would come up with some phoney excuse to appropriate it.

</comment></comment><comment><USER5> How do taxes work on this? Does he have a corp that takes the income and has employees and is making a charity donation, and then he is taking a salary that will then be taxed?

<comment><USER6> I assume the production costs will be written off. I assume the bonuses will be written off as income for his crew. I assume the charity will be a write off. At the end of the day, he's probably going to get taxed off the remainder, which after all the write-offs, probably won't be much left.

Although again, I assume...

</comment></comment><comment><USER7> The success of Facebook, Twitter, Dropbox, Square, and others has set a great example for the hacker community and prospecting college graduates to abandon the old corporate job mentality and pursue an independence through a startup. Louis C.K's success will hopefully do the same for the artist community.

</comment><comment><USER8> I'd really like to see the response curve here so i can do a time series regression with using reddit/hn/interviews as dummies and see how it fits :)</comment>


Some Thoughts on Open Core - <AUTHOR> https://www.linuxjournal.com/content/some-thoughts-open-core <comment><USER2> I agree that open core is not ideal if you do it to the extreme as described in the article, but it can be done with moderation to get much more money, which could be invested in the open source part and have it thrive as well, like for example done by Sidekick.

From my experience the alternative support and donations business models don't really work. I'm the initial author and maintainer of Autospotting, a piece of software that saved the users in the millions dollars aggregated over my entire user base, and as much as I tried so far I couldn't get much money out of it.

I'm currently getting about $100 monthly on Patreon for support plans and a few donations here and there but that's nothing compared to the effort I put in it and the value it creates.

<comment><USER3> Foss desktop software is so hard to monetize. At least with servers you can charge for cloud features (though then the user has given up some control in that scenario).

Industry associations seem to help, like the Linux foundation, where company stakeholders come together to fund the development and get a say in its direction - eg, if the different cloud providers banded together to fork mongo and/or redis in this way (to the unfortunate and severe detriment of the founders)

Possibly purism is pioneering a hardware driven angle too?

<comment><USER4> I think that this is in large part due to hurdles of paying for software easily.

For example

[https://play.google.com/store/apps/details?id=com.iiordanov....](https://play.google.com/store/apps/details?id=com.iiordanov.freebVNC&hl=en_US)

and

[https://play.google.com/store/apps/details?id=com.iiordanov....](https://play.google.com/store/apps/details?id=com.iiordanov.bVNC&hl=en_US)

are the same GPL licensed software either gratis or for $5. Just buying it via the store is straightforward instead of figuring out where the homepage is, finding a donate button, entering credit card details... .

Having more non-gratis but free software would be a good thing

[https://www.gnu.org/philosophy/selling.en.html](https://www.gnu.org/philosophy/selling.en.html)

<comment><USER2> That's actually a great idea, thanks for sharing it!

I'll try to make it paid from the mobile phone.

</comment></comment></comment></comment><comment><USER5> I don't understand what the offer suggests companies do instead?

Service based models (with training, support or integration) also can have perverse incentives on the open source software. To make those services valuable, you need the product to be worse than it otherwise could be.

Additionally, the characterization that open core companies stop improving the open source software and only improve the proprietary software might be true at some firms but is the extreme.

</comment><comment><USER6> I have a theory that open source which mostly targets business use could be funded by providing binary releases in the form of an apt/etc repo.

Small/Medium businesses increasingly seem to prefer to just pay for the solution (rather than say paying a staff member to compile, test, and distribute something open source).

<comment><USER2> That's pretty much what I also tried to do with AutoSpotting but very few people bothered to pay for it.

I suspect the problem is that the people who're using the software are techies who would rather enjoy spending some time compiling it and setting it up themselves, maybe learning some things in the process, instead of paying for it.

This kind of software would have to be sold to CEO/CTO folks who then ask the developers to set it up afterwards.

<comment><USER6> Right, I think it helps if it provides primarily a business function rather than provides something developers might interact with directly.</comment></comment></comment>


The rise of the new Crypto War - <AUTHOR> http://www.dailydot.com/politics/encryption-crypto-war-james-comey-fbi-privacy <comment><USER2> Oh too bad. Law enforcement has had it absurdly easy for the past ~15yr, all they had to do was cry "terrorist" and they could read whatever they wanted (I'm glossing over a lot of details here) If the FBI can read everyone's email (and other communications) then the people who really have stuff to hide will find other ways of hiding it and they'll waste their time (and our $$) screwing innocent people or catching dumb people they would've caught in other ways.

As encryption becomes more common they've gotta choose who's communications they look at rather than entering "keywork=bomb" checking the "wiretap all in results" box. Bugging a room or vehicle isn't new but you need a semi- legitimate reason to justify that sort of stuff (reasonable investigations have an ample supply of legitimate reasons). They've got ways to look a a suspect's communications if they want to, especially on US soil.

The more I read about this debate the more I think that the FBI (law enforcement in general) is just whining because, rather than just tapping everyone of interest and sifting through the results, they have to find a different way of doing things and that requires work and work is hard. I don't feel sorry for them

This is the same problem the music industry is possibly starting to to get over. The way they do things is outdated and they're complaining that progress is causing more work for them. Legislating the past back into existence doesn't work well. Just ask the Taliban.

Short sighted bunch of fools...

</comment><comment><USER3> > "There is a misconception that building a lawful intercept solution into a > system requires a so-called 'backdoor,' one that foreign adversaries and > hackers may try to exploit," Comey said. "But that isn't true. We aren't > seeking a backdoor approach. We want to use the front door, with clarity and > transparency, and with clear guidance provided by law."

So, he is calling backdoors frontdoors, and then arguing that he's not seeking backdoors.

<comment><USER4> Isn't their a fair distinction between an undocumented weakness ("back door") to which LEOs have access, and a provider providing a key ("front door") upon a lawful order, maintaining the strength of the encryption scheme?

It seems some believe that Comey is playing with semantics in order to obfuscate, or doesn't understand the argument he's making -- I don't.

<comment><USER5> Neither backdoor nor frontdoor are well defined (backdoor does not always imply secrecy). I never heard the word "front door" until this recent push, and generally key escrow has been referred to as a backdoor despite being public knowledge.

My personal definitional taste would be:

* Backdoor - an additional way to decrypt a communication without the consent of the communicating parties.

* Secret Backdoor - a backdoor which the communicating parties are not aware of (DUAL_EC).

* Public Backdoor - a backdoor which is built into the public description the of the encryption system so that the communication parties are aware of it (lotus email backdoor).

* Frontdoor - a type of public backdoor which requires a warrant to access and whose key is controlled by a neutral (disinterested) third party. I'm not sure this is exactly what the FBI wants.

Thus, frontdoors are a very specific form of backdoors.

<comment><USER6> I would have thought "front door" would mean to get the intended recipient of the message to decrypt it for you.

<comment><USER7> Exactly. The front door is what the end user uses in the regular operation of the system. If there is another "door" imposed under penalty of law then it isn't the front door.

<comment><USER8> Every user downloads and runs arbitrary code constantly, as updates. In the far future updates might come with a formal proof of their security, machine- verified on download, but for quite a few years still we will be stuck with just cryptography.

A front door would be using Microsoft's signing keys. As long as you don't leak the keys, you aren't diluting security in general. A back door would be just leaving vulnerabilities around. It's a meaningful distinction.

<comment><USER7> There is a meaningful distinction between lawful imprisonment and false imprisonment; that doesn't make it accurate to call lawful imprisonment freedom.

Moreover, the ability of software vendors to push malicious updates _is a security vulnerability_. Just because we haven't eradicated it yet doesn't mean we should codify our inability to address it in the future, e.g. by allowing users to choose what party they trust to verify and sign updates.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> This is a profoundly US-centric perspective. Consider Microsoft's efforts to isolate data in Irish servers from US jurisdiction. US providers have already lost substantial global business since Snowden's releases. If mandated lawful access could short circuit jurisdictional disputes, US providers would arguably lose far more global business.

<comment><USER10> "Consider Microsoft's efforts to isolate data in Irish servers from US jurisdiction."

Maybe I'm a cynic, but isolating any servers in Ireland from US jurisdiction just seems like a another way of saying tax avoidance

<comment><USER11> no, not necessarily.

consider guidance from new zealand's Health Information Governance Expert Advisory Group (HIGEAG) [0]:

> Unless an exemption is granted by the National Health IT Board, all personal > health information held in an identifiable form and associated clinical or > administrative data must be fully domiciled in New Zealand.

[0] [http://healthitboard.health.govt.nz/standards/use-cloud- or-h...](http://healthitboard.health.govt.nz/standards/use-cloud-or-hosted- services-managing-health-information)

<comment><USER9> Yes. And imagine that it's "domiciled in New Zealand" by a US firm with mandated lawful access by the FBI ;)

<comment><USER11> i get that this is a tongue-in-cheek comment, and appreciate your sense of humor, but it also saddens/frightens me to think this could become the prevailing sentiment in the years to come.

i grew up believing the internet was a great equalizer, capable of providing opportunity to people from across the globe, irrespective of nationality, race, creed, etc.

but now i fear the actions of certain nation states could produce -- for lack of a better term -- a fervent "digital xenophobia" that causes people to delineate and enforce boundaries on the net mirroring real world geopolitical borders maintained by a powerful minority.

that's not the kind of future i'd like to see.

for example, might people one day need a digital passport to send and receive data internationally? and might those data be subject to customs inspection before/after receipt?

today these may seem like parts of a cyberpunk b-movie plot, but it's not inconceivable that legislators would push for similar measures in the future if, for example, "national security interests" hung in the balance and they had the power to push such measures through.

<comment><USER12> > certain nation states could produce [...] "digital xenophobia"

Like banning people from "evil" countries from accessing websites: [https://news.ycombinator.com/item?id=7142381](https://news.ycombinator.com/item?id=7142381) ?

</comment></comment></comment></comment></comment></comment><comment><USER13> Short of banning math, how exactly can you prevent people from using strong encryption?

Even assuming the government can convince a lot of big corporations to put backdoors in their products, tech literate people will just use niche open source encryption for their own communications. Terrorists, or people that want to do evil, will switch to using secure channels - so the only people you will be able to monitor via sig-int will be average people that are not particularly tech literate. That doesn't seem like such a huge gain to me.

<comment><USER10> > Short of banning math, how exactly can you prevent people from using strong > encryption?

You don't. You just make in imprisonable offence not to turn over keys: like here in the UK

<comment><USER14> Well, the problem is: You can't enforce this rule and call yourself a Rechtsstaat at the same time.

</comment></comment></comment><comment><USER15> I think the argument of backdoors making services less secure is the wrong approach.

The government just needs to convince lawmakers they've come up with a scheme where only they can access the backdoor, not criminals. The opponents scream, "that's impossible," but LEOs only need to persuade lawmakers it's _unlikely_ the backdoor will be compromised and they've won the argument with "good enough." If there's a terrorist attack and they claim weak encryption could've prevented it, "good enough" will suffice.

The more important argument is the government has repeatedly demonstrated they can't be trusted with the special access and they're pretty much guaranteed to abuse it. They'll even exploit those backdoors to spy on the very politicians from whom they're trying to get the new authority.

The threat of the government using new powers to violate the 4th amendment rights of innocent citizens is orders of magnitude higher than the threat of sophisticated criminals exploiting LEO backdoors.

<comment><USER16> The OPM leak is a good example of why we shouldn't just take their word for it that they can keep things secure -- they leaked everyone's personal details and security clearance interview details, why would we expect them to do a better job with people's communications?

</comment></comment><comment><USER17> Painting cryptography as a 'weapon,' as the header image of this article does and as was done in the past with the ban on it's exportation, is a completely wrong analogy.

Cryptography simply translates to the digital world mankind's right to be secure in our personal effects, and freedom from unreasonable search and seizure.

Unencrypted digital communication removes the temporal aspect of surveillance. If you have a conversation with somebody in the physical world and you are secure that that conversation is not being spied on, you can be sure that at no point in the future will that conversation be spied on. Encrypted digital communication simply translates that right to the digital world.

If an authority has pretty good knowledge that someone is in possession of encrypted digital files that only they have the password to access, this is simply the digital version of an authority having pretty good knowledge that someone has a buried treasure that only they have access to. This person cannot be coerced against their will to travel to the location of the buried treasure an dig it up just because an authority is pretty sure it is out there somewhere.

Others in this thread have pointed out that this is just law enforcement being lazy. And that is a very good point there are plenty ways to do law enforcement even if your target is communicating in codes and crucially it causes resources to focus on the important targets.

This is really crux of the matter, encrypted communication is not going to prevent law enforcement from doing their jobs. Crucially, what it does prevent, is the nation/world wide digital-technology enabled surveillance dragnets.

This is what must be kept in mind when considering this issue, we must make sure that we are creating future societies that are under no threat of nationwide spying from tyrannical governments.

In fact, any non-sense about 'going dark,' or terrorism and criminals is a smokescreen and should be struck from any reasonable, level-headed discussion of this matter. Terrorism and crime are rare enough and law enforcement is good enough that we are under no risk in seeing an upswing in crime and terrorism due to continued proliferation of strong(that is, actual) encryption. The continued development and use of cryptography is entirely about preventing the kind of massive scale, unlawful spying that has been shown to be taking place.

</comment><comment><USER18> I'm a little perturbed by the length of this article. Those who are aware of issues in crypto already know a lot of the background here. The challenge is to engage the public on the issue and break it down in a sensible way.

With the response to Paul Ford's "What Is Code?" article in Bloomberg, longer thought pieces on technology are now in vogue but the author could have made their argument in a more concise way.

I try to comment on substance generally and not appeal to complaints like mine but I only bring it up because this new fight around crypto is an issue with as much public bearing as the net neutrality debate but with infinitely more complexities (which makes it more challenging to engage regular people on)

</comment><comment><USER19> Starts by talking about a discrepancy between technology and law, and I agree, but not in the way Comey is saying.

The discrepancy is that where once communications we considered private (loved ones, close friends) was generally face to face and phone lines were just used for business or more innocuous conversation, now all of it takes place along these lines the FBI and NSA want to have access too, along with personal information and other stuff that used to be only physical.

The discrepancy is that they want the law to grant them powers as if the internet is just a different type of phone line from the 60s.

<comment><USER20> One of the panelists from last Wednesday's senate hearing Peter Swire (Huang Professor of Law and Ethics, GT) puts forward the case that we're in actually in a Golden Age of Surveillance. I largely agree, but unfortunately most of the coverage I've seen starts by uncritically accepting the "going dark" narrative.

</comment></comment><comment><USER21> >"IP networks are different from packet-switched networks."

Minor gaffe, probably meant to say circuit-switched

</comment><comment><USER22> The funny thing is that extending CALEA to information services and requiring baked in facilities for government digital wiretapping would do nothing to stop a smart terrorist or criminal organization. Cryptography is a field of mathematics. It's not some physical thing like a mineral which can only be mined in the United States. The knowledge of how to build a proper cryptographic channel is freely available to anyone who can understand it.

</comment><comment><USER23> Sounds like a solution which increases bureaucracy and spending yet has the plausible objective of fighting crime. I can see why this issue never goes away.

<comment><USER24> It would also require crypto systems to be licensed and regulated, effectively limiting their deployment to huge vendors. Look into what FIPS compliance entails. These kinds of things always have a regulatory capture / monopolistic land grab component.

</comment></comment><comment><USER25> The thing that gets me in all these discussions is people acting like we can't build a protection mechanism that stops A from getting in but not B. Yet, these same people in another context say we can using words such as VPN, port- knocking, TLS, SSH, and so on. We do it all the time with some solutions being quite strong. If anything, a robustly-designed R.A.T. or escrow is nowhere near as threatening than the average app or network protocol on endpoint: practically backdoor generators in practice and their 0-days are the main way High Strength Attackers hit targets.

So, first we should stop with the double standard. There exist mechanisms that work well enough in practice which allow selective access to systems (aka front-door). There's also decent work in limiting such access, auditing it, escrowing, and so on. NSA also already does the escrow for its Type 1 encryption products with all key material managed and protected by their EKMS system [1]. If it got visibly breached, we'd probably have seen evidence of it. So, I'll skip straight to the other issues that popped up in peer review when I published a few attempts at a secure solution to the L.I. problem.

Will it have security problems in general? Yes. Damage can be limited in a number of ways, esp if scheme is decentralized. Yet, it adds risk on top of what we already given even rigorously-built solutions have had issues.

Will there be authentication forgeries for LEO requests? Yes. This might be a one-off, quickly detected thing. It might be unlimited depending on how the breach goes. Sender and receiver must be protected across the board. LEO's track record isn't good. High risk here.

Does the government have a history of abusing its access and deceiving about its usage? Yes. A _great reason_ not to do L.I.

Will the government agree to a L.I. scheme with a strong foundation for security that ensures _read-only_ access for a limited period and can't subvert system? Clive Robinson suggests that even a theoretically, bulletproof L.I. system won't be acceptable if it limits them and it will be forced to be more "flexible" by their sway over courts/lawmakers. Seems true given current situation.

Can they prevent attacks via malicious sys-admins or infiltrators? Snowden says no and with quite the credibility. ;) High risk here.

And the big one: will the KEYMAT-holder survive the inevitable attacks of all intelligence services, hackers, and organized crime combined? And all the things they will do to the organization _or its employees_? Gravely, high risk here.

Dirk Praet brought up the last question in a discussion where I had tried to cover every single angle in design, personnel, and ops. In the end, Dirk and Clive are right: the government will force the system to have too much privilege, centralization, and/or accessibility; data will be mass compromised in a free-for-all by the opponents. Whatever concrete requirements come out of such legislation will present vastly higher risk than with key escrow or remote administration tools in general.

So, there's extremely high risk in warrant process, key storage even with HSM's, and organizations administering this even at SAP security level. More risk than any DOD, NSA, or FBI have faced before given the concentration of enemy effort that will occur. Their track record on smaller things shows they can't handle something that big. Even if they were honest as Boy Scouts, the risk assessment argues against the L.I. option 100% and regardless of what level of INFOSEC our mechanisms ensure.

Also, if they were Boy Scouts, they couldn't think like the attackers enough to stop them. Proposal is untrustworthy whether they are or not. That's No^2. ;)

[1] [https://en.wikipedia.org/wiki/Electronic_Key_Management_Syst...](https://en.wikipedia.org/wiki/Electronic_Key_Management_System)</comment>


Show HN: LCON 1.0 – For reals this time (Ludicrously Compact Object Notation) - ar-nelson https://github.com/ar-nelson/lcon/releases/tag/v1.0.0 When I posted LCON before (https://github.com/ar-nelson/lcon), it was a horribly broken prerelease version. This version actually works (it has unit tests and everything!), and it has a slightly modified syntax that takes into account some of the criticisms from the last HN thread. In particular:<p>* Lists are now bulleted with - instead of .<p>* Comments are now delimited with # instead of ;<p>* Block strings are now delimited with """ instead of ``<p>* Stringify functions are now available, including one that stringifies to JSON with key order preserved. <comment> ar-nelson When I posted LCON before ([https://github.com/ar- nelson/lcon](https://github.com/ar-nelson/lcon)), it was a horribly broken prerelease version. This version actually works (it has unit tests and everything!), and it has a slightly modified syntax that takes into account some of the criticisms from the last HN thread. In particular:

* Lists are now bulleted with - instead of .

* Comments are now delimited with # instead of ;

* Block strings are now delimited with """ instead of ``

* Stringify functions are now available, including one that stringifies to JSON with key order preserved.

<comment><AUTHOR> First of all, congrats on releasing.

Now let me be sceptical for the following reasons:

1\. I don't believe the world needs another human-rwable object notation format. We have json for read-only object notation and both YAML and TOML ([https://github.com/toml-lang/toml](https://github.com/toml-lang/toml)) for human-writable stuff, config files etc. These formats are strongest when they are widespread and people don't need six different parsers to deal with six different services.

2\. "ludicrous compactness" seems at odd with the concept of things being human readable. If you need to save on space, you're probably better off with a binary (protobuf-like) format.

3\. What you're doing here seems to be a slightly less verbose take on YAML. I don't see the point here.

<comment> ar-nelson TOML is pretty interesting; I hadn't seen it before.

I'll give some of the same responses I gave on the other thread, hopefully before several other people say the same things:

* I understand that it seems like a solution looking for a problem; it's actually a byproduct of another project I'm working on, a language that's essentially JSON Lisp. I tried both YAML and CSON, and neither of them worked as syntax for the language due to various quirks and limitations. So this originally had a very narrow use case; I'm releasing it in the hopes that it's maybe useful to someone somewhere anyway, and so that I can refine it and work out bugs before writing tons of code in it.

* The compactness is primarily to save keystrokes, not file size. It even says it in the README: it's first and foremost a quickly-writable language.</comment></comment></comment>


The Literate Geek: Seriously, Amazon, WTF? - <AUTHOR> http://literategeek.blogspot.it/2012/09/seriously-amazon-wtf.html <comment><USER2> It's probably not Amazon; what the blogger hasn't realized is that the books he's looking at probably have different publishers (with different pricing policies) in different countries. Not to mention different rates of VAT, from 0% (the USA doesn't have VAT) to 20% in the UK and even higher levels elsewhere.

<comment><AUTHOR> I know that it's the publisher, or at least I am aware that Amazon puts the blame on publishers, but I am baffled that Amazon, which is THE BIGGEST online bookseller, has to bend to such insane demands.

<comment><USER2> If Amazon stop bending to those "insane" demands, you're going to see a wave of publishers going bust and then a _steep_ decline in the availability of new high-quality product[1]. AMZN are not the authors' friends, let alone the publishers'. And if they ever establish a monopoly on the supply chain, they'll stop being the customers' friend as well.

[1] Authors don't get to support themselves by touring. And those of us who try to supply good quality product can't do nearly as a good a job if our cash flow is being throttled, or if we're forced to take on the elements of workflow that our publishers currently handle for us.</comment></comment></comment>


Show HN: Space startup database and interviews - <AUTHOR> https://www.spacebandits.io <comment><USER2> The interviews are quite interesting.

<comment><AUTHOR> Thanks! Which did you like in particular?</comment></comment>


That's John – We Don't Know What He Does Here… - <AUTHOR> http://www.flatplanetmedia.com/thats-john-we-dont-know-what-he-does-here.html

<comment><AUTHOR> They'd probably kick you out of school for pulling a stunt like that these days...</comment>


Marc Andreessen Says Now's the Time to Build Companies Like It's 1999 - <AUTHOR> http://allthingsd.com/20120716/marc-andreessen-says-nows-the-time-to-build-companies-like-its-1999/ <comment><USER4> Well, I (for one) am happy to be alive right now. I am happy to be in the generation after people like Marc Andreessen and Elon Musk, who were 1 generation after Bill Gates & Steve Jobs.

Here is the guy that invented modern day browsers, and modern day SaaS services/companies, and is revolutionizing VC investing. It's like he can't do anything 'normally'.

I love it.

We need more people like that, in the world, willing to shake things up.

Either way, I will be one of those heeding his advice about trying to build awesome internet companies - because he is dead on the money.

Imagine, at the height of the automobile revolution if someone came to you and showed you an 'easy' way to build solid, quality cars in your garage and mass manufacture them for free/cheap and distribute them and sell them on the cheap. Effectively taking advantage of economies of scale without having to pay for the scale.

I can't think of any other industry/revolution/time in history when people could do (from a company building perspective) what we can today with the addressable market size we have access to, with such low distribution costs.

The same thing applies to creating content and media.

How can I not take his advice?

<comment><USER5> > How can I not take his advice?

For example, you might have a good idea in some interesting field that doesn't happen to particularly involve the Internet.

At the moment it just seems like everyone arriving in California with a tent and a picaxe because they heard they'll get rich. Overly romantic maybe but I prefer the other way round with the chicken and egg.

<comment><USER4> Well....while I would agree that many are flocking to California, but the beauty about the internet is that you don't have to be there to make a good living.

Also, that doesn't mean that everybody needs to build the largest companies they can. But, it does mean that everybody that wants to - can.

If you have the ability to, you probably should at least try.

What's the worst that can happen? Even if you go for broke and end up being broke, given that you were the type to go for broke, it's highly likely that you will be very employable.

<comment><USER6> > the beauty about the internet is that you don't have to be there to make a > good living.

I do hope you're not mistaking the incredible location-agnostic quality of the internet with the incredible location-dependent quality of human relationships.

Don't take real people for granted. IMHO you hugely multiply your chances if you surround yourself with people in the same physical space and can talk, work, play, and drink together. In my experience, the great ideas come when you are _away_ from your computers.

There are a lot of places this can happen—SF, Boston, New York, and more. But I highly encourage you to make physical connections as well as digital ones.

<comment><USER4> I agree...but I don't have to be living in SF, Boston, New York to create those connections either.

</comment></comment></comment></comment></comment><comment><USER7> Title is quite misleading. It seems to imply we should build companies like they used to in 1999 (webvan style). What he is actually saying is that is now time to build companies that people tried in 1999 but were too early. It's now time to revisit all of those ideas. This is actually quite obvious to most people by now.

</comment><comment><USER8> _Andreessen said the firm has made an investment in a third hardware company that he declined to name. "We've recently made a stealthy investment that we can't talk about, but hopefully next year everyone will get to take one home to the kids."_

I so hope he means OUYA!

Generally speaking though, wasn't the Web 2.0 era the one where people dusted themselves down, said 1999 was "too early" and did things right? Andreessen's optimism is infectious, but it doesn't feel like this article says much that's new.

<comment><USER9> OUYA has no chance of success. It's a wishy washy and poorly thought out venture that's somehow hoodwinked a lot of people.

<comment><USER10> Except people really want what they're building. The fact that its bringing out such passionate hatred from folks is a good sign for them I think.

<comment><USER11> I don't think it's hatred at all, for me it's despair. A product like that well supported by game publishers, with an innovative controller and accessory market around it would be fantastic.

It's just that it's not going to happen.

</comment></comment></comment></comment><comment><USER12> It's kind of like a used car salesman saying now is the time to own a car!

<comment><USER13> I read a local free real estate advertising magazine.

Every week, the editorial has a message that fits the latest data.

Every week, the conclusion is that NOW is the time to buy real estate.

If the market is strong, get in before it is too late. If the market is weak, good time to be a buyer. If the market is very weak, take advantage of those distressed sellers.

It really is amusing. It's more blatant than most self-interested publishing, but so much of what we read follows the same script in more subtle ways.

<comment><USER14> Yeah, I sometimes listen to a real estate show on Saturday on the radio, and the guy says basically the same things. It is always the right time to buy.

</comment></comment></comment><comment><USER15> So can we go through list of companies that tried and failed in 1999 & see if its feasible now?

<comment><USER16> Sure, here's the list: [http://www.amazon.com/Fd-Companies-Spectacular-Dot- Com-Flame...](http://www.amazon.com/Fd-Companies-Spectacular-Dot-Com- Flameouts/dp/0743228626/ref=sr_1_1?ie=UTF8&qid=1342497633&sr=8-1&keywords=fucked+companies)

Used copies start at a penny.

</comment></comment><comment><USER17> I thought in 1999 most companies just slapped ".com" to the end of their company name and raised $50m from VC's without accomplishing anything or solving a specific problem.

<comment><USER18> The current suffix is 'cloud'.

The industry movers and shakers (marketeers) will be sure to tell us what the next word is shortly.

</comment></comment><comment><USER19> If it's 1999 again, you know what's around the corner, right? _pop_

<comment><USER20> A weasel? I'm confused.

<comment><USER21> Bubble.

</comment></comment></comment><comment><USER22> In 1999 most were doing the headless chicken over y2k

It's 2012 now, lets not go there.

Though I do like the old time issue cover with the whole V Chip thing, oh wait we have that covered as well this time around as well. Guess he may be right, but it's only because computers has become more idiot friendly and mobiles going for a compressed birth life period going from early png like games to full media ones in a shorter time than desktops did and converging and bluring the lines.

Only way to build a company is to gamble and do it quickly or slowly and do it organicly. Both have there plus points and negatives. Only people who realy gain from a massive influx of new companies are those that finance them. But nothing in the article stands out that could make a bullet point out of IMHO.

</comment><comment><USER23> In one sense he is right though. There is a lot of crappy software still out there. There are still places that run off of an Access db. Ripping and replacing these is finally starting to make sense from cost and value proposition. Mobile access, greatly reduced cost of building apps is finally tilting the needle towards "lemme build this" for devs and "lemme buy this" for users.

</comment><comment><USER24> I've always felt kind of sorry (is that the word?) for Marc Andreessen - <USER2> never quite could get a good exit out of anything he has ever done. This despite the fact that his browser (and company) set off the feeding frenzy that we know as the dot com boom (and bust).

Netscape/Loudscloud/Opsware ended their lives as pity acquisitions, and Ning never did get off the ground.

Hopefully this venture fund works out and doesn't blow up in 2016 or so.

But he is right on the money with this though:

> _From there he pivoted to an argument that the consumer electronics industry > is coming back to the U.S. Yes, it's true, he says, that products like > iPhones and tablets get assembled in China, but they often include > components made in the U.S. and run software that more often than not was > designed in the U.S. "You have to ask where the profits go, and they really > go to the U.S. The assembly part is really an arbitrage of labor and > transport costs."_

The only reason we make stuff in China is because of the cheap labor (yes really). Robotics and more scalable production designs (you know things that don't require people to touch the production line) will destroy this advantage. Transporting goods thousands of kilometres from production to consumption is just insanely wasteful.

<comment><USER25> I'm sure he isn't going hungry!

<comment><USER24> Haha indeed - but that's not what I really mean :D.

Netscape was the trigger for a great deal of what you see around you on the Internet today. Obviously, that doesn't mean that if they didn't exist - <USER3> one would've done it.

But my point is this: for the first guy to IPO into what started the craze - he didn't get out with too much.

Indeed, if you were to just look at Broadcast.com, which sold for ~$5 billion at the height of the dot com boom, Mark Cuban pulled ~$2 billion for something I think was quietly killed shortly thereafter (i.e. no real impact).

</comment></comment></comment><comment><USER26> I get the message but he shouldn't use "1999", lots of companies founded that year were doomed from the start, and even some good ones couldn't get enough funding after the industry collapsed.

About the last paragraph he certainly means the Ouya, either that or Gabe showed him an actual SteamBox.</comment>


Advice to newbie on learning Lisp/Clojure - <AUTHOR> http://www.learningclojure.com/2011/02/advice-to-newbie.html

<comment><USER2> The author seems to think that Clojure has some conceptional complexity to it that is easier to overcome by doing a intermediate step with Racket. But in which way is Racket or any other Lisp an intermediate step?

I had no Lisp experience whatsoever before I started with Clojure, and the only real difficulties I experienced were (in descending order):

a) translating my imperative-style thinking into functional style - this would happen to me in Racket as well.

b) macros - but you don't need to grasp macros as a beginner, that's a topic by itself anymay.

(and NO, the bracket syntax was no problem at all)

YMMV if you have an other background. It is true: The more programming languages you already know, the easier it will be to learn a new one (iff it doesn't conceptionally diverge too much). But if you don't have that background, why not learn the desired language right away?

<comment><USER3> My experience is very limited. I've not yet worked through all of Chapter 3 of SICP, and I've not had the opportunity to hack any real code in any lisp dialect since I implemented LispKit one weeked in 1989. However ...

I think there is merit in the simplicity, clarity and purity of Scheme in helping put someone "in the right place" for grokking the real value and real power of Clojure. On the very few occasions I've written in Clojure I've known I've not been really "getting it" and that there's more, but I've felt (pause) overwhelmed is one word ... by the completeness of Clojure. It's a proper language for proper work.

I think I've gained a lot from going back to Scheme's purity and elegance.

It's a bit like "lies to children." We know that Newtonian mechanics is wrong, but we still teach that first because it's easier to grasp, easier to do the sums, and more directly in line with our own experience. But if taught properly (and that's another story altogether) it lays the foundation for being able to do the sums and do the work "properly" in Relativity.

I think Scheme can help to create the functional mindset in an elegant way, before having to worry about real world nastiness.

YMWV, because everyone is different and comes with different skills, deficiencies and baggage.

<comment><USER2> I definitely disagree that Clojure introduces "real world nastiness" which would prevent a beginner from learning it "the clean way". Clojures data structures are very elegant and easy to grasp (e.g. you don't have to think about pointers or define equal operators, it's all there already). And you can define functions just as clean an "pure" as in Scheme.

I do agree that Clojure is very comprehensive, and can be overwhelming for a beginner. But you could buy a book, which will use only a subset of Clojure at the beginning. And when you get to the point where you can use the basic data structures and _map, filter, reduce_ them, this will get you _very far_.

<comment><USER4> To me, the "real world nastiness" is the Java cruft surrounding it. You don't have to deal with it except to get a nice programming environment running. At this point the options are much more complicated and uglier than DrScheme.

<comment><USER2> That's not what the author seems to mean though: _Clojure's exceedingly cool, but to understand it you need to speak lisp_

But I agree, an uncomplicated und "Java-free" IDE would be a great gain for a low-threshold start with Clojure. Clojurebox is a beginning, but it in turn burdens a starter with Emacs.

</comment></comment></comment></comment></comment><comment><USER5> I don't agree with the suggestion as I fear that beginning with SICP could just demotivates a beginner and that early positive feedbacks (related to the goal to achieve) are important.

While Scheme is conceptually simpler than Clojure, Clojure remains relatively simple in its conception. Here is what makes it a little more complex:

\- one needs to know a bit of Java to really use it fully. The integration with Java is so nice that it's not rare to see direct calls to Java APIs without using wrappers, for instance when there is no Clojure library to do the job.

\- one needs to understand the different ways of dealing with concurrency and learn to choose the appropriate one for a given problem.

\- one needs to understand how protocols work, when they are needed and when multimethods are prefered. This also implies understanding the differences between deftype, defstruct and defrecord.

That said, it remains relatively simple because you only have to deal with functions, macros and namespaces and all is rather uniform.

Here is what I would suggest to begin with Clojure:

\- if you have some Lisp background just pick a book like Programming Clojure (short, nice to read and direct to the point) or Practical Clojure (also short and up to date regarding protocols)

\- if you have some Java or OO background but don't find confident enough with a Lisp syntax read the first chapters of Practical Common Lisp and then one of the other books mentioned above. <http://www.gigamonkeys.com/book/> This book explains really clearly the why of the Lisp syntax and also macros (better than Programming Clojure on this point but this is mostly due, I guess, to the fact that Programming Clojure is more concise).

<comment><USER6> Just to complete the thought, what advice would you give to someone familiar with both Java and Lisp or to someone familiar with neither?

<comment><USER5> There should be no major problem if someone knows both Java and a Lisp. Either reading Programming Clojure or Pratical Clojure should be enough to start with, or maybe this tutorial <http://java.ociweb.com/mark/clojure/article.html> (I didn't read it but it supposed to be good)

For somebody who don't know neither Java neither a Lisp, I would suggest to understand the following concepts in Java and the JVM before doing the suggestions in the second point (though PCL could be read before learning Java to see why Lisps are so awewome):

\- collections (java.util.List, hashmap, set etc.) since each Clojure collection implements a Java interface. This is useful for interoperability.

\- interfaces, inheritance and access specifiers (because then you can understand why you can not override a Java protected method from a Clojure proxy)

\- some of the most common API like regular expressions, syntax for printf etc.

\- the basis of how the classpath works

</comment></comment></comment><comment><USER7> This is the approach I took when learning Clojure. I started diving into the language and then stopped everything to learn Scheme. It was painful because I really wanted to be doing Clojure. When I finally got back to Clojure I think that it helped out a ton. Cons, car and cdr oh my!

I believe that doing what I did is not necessary to get started with Clojure. It seems like the choice between top-down and bottom-up design. If you choose Clojure first, you will learn concepts that will help if you should ever approach scheme.

This thread from the Clojure Google group may be of some interest: Thinking in Clojure

[https://groups.google.com/d/topic/clojure/9JufDYgE8DQ/overvi...](https://groups.google.com/d/topic/clojure/9JufDYgE8DQ/overview)

</comment><comment><USER8> Can I not defer paying homage to the LISP cult until I achieve a fair amount of productivity in Clojure ?

I am learning Clojure as I work through "Clojure in Action".(Thanks to Manning's promotions-- I also have the "Joy of Clojure" ebook but I haven't opened that one yet). My complaint is that there are not enough exercises in Clojure for beginners. I recall the K&R C book -- it had exercises at the end of every chapter which were very useful. Those exercises are the reason why I can still dive in C with no fear whatsoever .

I understand Clojure's relationship to LISP ; but that doesn't have to mean that Clojure can't have its own set of programming exercises and blogs for the beginners.

But posts like OP are not helpful for beginners. And they are not helpful to Clojure ecosystem as they scare away causal learners.

</comment><comment><USER9> I'm not sure going down the Scheme->List->Clojure path is the right way to go. First, I don't really know Clojure. But I do think Scheme to Lisp was more painful for me than I think it should have been. I also learned Scheme from SICP, but going to Lisp it seems like I tripped over every little thing.

Things like funcall had me banging my head -- as I didn't even realize that it was something that should be different.

If your goal is to learn Lisp, I'd just go straight to Lisp.

Again, I don't know Clojure, so I don't know if learning Lisp first is really necessary, but if it is, then skip Scheme.

Also, don't do all the exercises in SICP unless you feel like doing so. Some require domain knowledge that you frankly just don't need if your desire to learn these languages is web dev.

Someone needs to do a SICP: The Web Dev Edition

<comment><USER10> "Also, don't do all the exercises in SICP unless you feel like doing so. Some require domain knowledge that you frankly just don't need if your desire to learn these languages is web dev."

I disagree quite a bit... I think the exercises in SICP are really valuable and provide a lot of depth that just reading the text doesn't.

"Someone needs to do a SICP: The Web Dev Edition"

Why? If someone is really interested only in web development in a Lisp, they probably shouldn't go looking in SICP.

On the other hand, I believe that SICP has material that will make any programmer a better programmer, even if there are some examples that require "domain knowledge" (mostly math at the level of calculus). It's about the structure (building abstractions with procedures and data) and interpretation (how Lisp programs are actually executed by a machine) of computer programs, not "Web development with Lisp 101"

This is all from someone who recently finished reading SICP and lovingly doing as many exercises as possible, and is definitely of the same persuasion as the author of the OP, when he writes:

"That's where all the smuggest lisp weenies come from, or go eventually."

So take it with a grain of salt, I guess.

</comment></comment><comment><USER11> sorry why does lisp have anything to do with clojure?

<comment><USER3> I can't work out if that was a genuine question, or a troll. But HN doesn't have many trolls, so I thought I'd answer you straight. I also thought at the same time I'd explain the downvote you got from someone. Ive upvoted you to cancel that out for now. We'll see what other people do.

Try this search on Google: <http://www.google.co.uk/search?q=clojure>

The very first hit is: <http://clojure.org/>

From that site, the home site of Clojure, we get:

        Clojure is a dynamic programming language that targets
        the Java Virtual Machine (and the CLR ).

        ...

        Clojure is a dialect of Lisp, ...

See that? In one search and one click - there's the answer to your question. And the reason you got downvoted was because your question/comment added nothing of value, and it showed that you didn't do any homework.

So I hope that's been useful and constructive.

<comment><USER12> Your post could be shortened to: <http://lmgtfy.com/?q=clojure>

<comment><USER13> I upvoted you to cancel out the downvote you got. Spot on.

<comment><USER12> Thanks.

Look, it's the nature of text-only that doesn't capture very much of a person's "state". In order to do that with any sort of fidelity, a considerably longer post is required. Of course something short like that _could_ be interpreted as snarky, _or_ it could be interpreted in the spirit in which is was offered, a playful one. I understand, _everything_ here on HN is _dead serious_ and so trying to make a joke will go over like a lead balloon.

I guess what _I_ find disturbing is that if people were to take that comment from a different point of view, giving me the benefit of the doubt (like the original poster was granted), I think people would not be so quick to rush to be offended.

I also don't know if all HN folks know about letmegooglethatforyou.com and I think it's kinda fun and playful.

Lastly, pg is _not_ God, and invoking his name as if he has the "last word" is, I think, not helpful. I appreciate his opinion, but that's all it is. And he ain't perfect, as he will instantly admit. (As _I_ will instantly admit!)

Now, I will go back to being my serious self, because, you know, everything on HN is serious! Laughing is _not_ allowed. Apparently...

<comment><USER3> I don't agree that everything here on HN is _dead serious._ However, the bits that are funny also add value. the bits that are funny for funny's sake are quickly down-voted, and generally don't fit with the current sense of the community.

You could've phrased your submission as:

      Don't know if people here are aware of it, but if you
      were you could've replaced that entire post with <link>

Then it would've been informative as well, and, in my experience, less likely to be downvoted.

        Now, I will go back to being my serious self ...
        Laughing is not allowed. Apparently...

HN is a multi-cultural place, and the potential for misunderstandings abounds. I've been in countries where what I thought of as a completely innocent remark has been regarded as a serious insult. I don't know how familiar you are with other cultures, but levity is frequently heavily culturally based, and getting it wrong can make you look like a complete jerk. People here usually appreciate the respectful nature of the site.

There is humor here, it's just of a different kind.</comment></comment></comment></comment></comment></comment>


Using Golang on processing images and machine learning - <AUTHOR> Hi All, I'm building a server for mobile application. Server must using OpenCv for processing images and machine learning for searching or some task. So i'm consider use python or golang for server. Can you suggest something for my choose.Thank you so much <comment><USER2> The short answer: It depends.

The long answer: It depends on what your biggest constraint is. If your biggest constraint is server cost, then I would suggest C++. C++ has come a long way in terms of web services, and if you are doing both image processing and machine learning, then C++ will give you unparalleled performance and access to libraries. However, if your primary constraint is developer hours, then python is the way to go. You won't have the same explicit control, but for OpenCV and Machine Learning, Python has excellent support and you will end up having much more concise, readable code.

<comment><AUTHOR> Yes, i got it. Thanks

</comment></comment><comment><USER3> I use Go to process images for my food project. I specifically use a library with bindings to libvips

It runs on both osx and linux for me

[https://github.com/h2non/bimg](https://github.com/h2non/bimg)

There is also bindings for OpenCV here is one

[https://github.com/lazywei/go-opencv](https://github.com/lazywei/go-opencv)

<comment><AUTHOR> Because maybe i'll write some complex function. With C++ and OpenCV,it's very faster and better. I extend use cgo for call c++ fuction. But i don't know speed of it.

</comment></comment><comment><USER4> It seems in your case all the heavy lifting will be done by libraries like OpenCv and other ML libraries which are already very efficient. So the only purpose of your server side language is to expose those capabilities to your mobile application through HTTP/REST. If this is so then go ahead with python.</comment>


Cassandra 1.2 Startup time improvements. - <AUTHOR> http://www.datastax.com/dev/blog/1-2-startup-time-improvements

<comment><USER2> This is nice, but the main reason I gave up on Cassandra was the difficulty of operating it. It's a far cry from, say, MySQL in terms of devops-friendliness. Curious how much work is being done in that respect.

<comment><USER3> There's a certain amount of complexity that comes with the territory when you move from a single-machine design to a cluster, but Cassandra does as much as possible to simplify things, starting with a fully-distributed "every node is the same" design. (As opposed to having master + router + config + slave nodes, for instance, each of which needs a different kind of troubleshooting.)

Additionally, DataStax makes the "DataStax Community" distribution of Cassandra available for free, including for production use, which includes the OpsCenter management and monitoring tool: <http://www.datastax.com/products/community></comment></comment>


Show HN: Buy My House - chris-at http://kaufmeinhaus.at/ <comment> chris-at I'm selling my house and discovered that the options in Austria are either boring (just pictures) or expensive.

So I

\- rented a Theta camera and took pictures of every room + outdoors

\- made up a DSL to define a grid with connecting rooms

\- used that to generate scenes for Pannellum (which I tweaked a bit)

\- made some clickable svg maps (strangly this was not as easy as I thought)

\- and put a bit of bootstrap over it

You can view the result here: [http://kaufmeinhaus.at](http://kaufmeinhaus.at)

Pannellum is great btw, see [https://pannellum.org](https://pannellum.org)

Let me know if you are interested and I'll try to put the code on github.</comment>


FluxCards: Spaced Repetition flashcards (and its vast competition) - <AUTHOR> https://play.google.com/store/apps/details?id=de.leowandersleb.fluxcards

<comment><AUTHOR> [https://news.ycombinator.com/item?id=7127742](https://news.ycombinator.com/item?id=7127742) inspired me to bring this up as there the criticism was that he has no actual app yet. I do. thousands do, so here are just a few random thoughts:

I developed FluxCards for Android more than 2 years ago and also am at zero with my web version but will put money on it right now. If you are interested in SRS apps, ask me anything! (If you want to program one for money, read below.)

* Do you know how many flashcards learning apps there are out there? It's not hundreds but thousands. [http://www.flashcardapps.info/](http://www.flashcardapps.info/) lists just some of those available for iPhone. So if you want to program one, do your research. Reading the right blogs you will get almost daily some new such app.

* Witch SRS? Well there you get the number down considerably (100?) although new apps increasingly come with SRS.

* If only the customers knew how good SRS is! Many apps (Duolingo anybody?) are vastly more successful (or hyped) than any other ugly but good SRS app. Yet in my opinion everybody should at least have learned with SRS once in his life for 2 weeks. If I had known about SRS apps when I was at school, I would have been so much more successful, yet when I had to learn Spanish fast, I literally worked through 30 different apps on Android that were all without SRS. After learning with "the best" of these for 2 weeks I realized that being asked the easy words over and over again was utterly pointless and decided to program FluxCards in 48h. Version 1 was in the play store 46h later and now stands at 11k active and happy users.

* Over these 2 years I soaked up all there is about flashcards apps and it is a lot. Of course I came across Anki, Supermemo, Mnemosyne and many others but with that knowledge I'm about to build the next generation of a cross platform (web + android) flashcards app.

* Users want a nice interface more than anything else but to get growth, they must be able to easily share their cards which is a big issue in the current FluxCards. A web-based solution as the FluxCards web naturally will solve that easily.

* For relevance in classes it has to be cross platform.

* To be efficient, it has to work on mobile.

* Students are impatient with a new platform and need to get access to good content fast.

* Good content is scarce. Another field FluxCards currently lacks at but the new version will have a powerful crowd-sourcing feature that will hopefully .

If you are good at front end development, maybe you wanna be hired? By Monday I want to kick off the development.</comment>


Implementing a Custom AWS CloudWatch Dashboard - <AUTHOR> http://www.taos.com/2014/04/09/implementing-a-custom-aws-cloudwatch-dashboard/

<comment><USER2> Awesome!</comment>


Python 2, Python 3, Debian and Porting - <AUTHOR> https://lists.debian.org/debian-devel-announce/2015/04/msg00005.html <comment><USER2> Shameless plug of a modern Python 2/3 porting tool that I wrote: [https://github.com/kislyuk/eight](https://github.com/kislyuk/eight), which builds upon the excellent work in [https://pypi.python.org/pypi/future](https://pypi.python.org/pypi/future).

<comment><USER3> That looks like a really good solution - and an ideal approach as we get to keep writing in Python 3. Are there any large caveats?

<comment><USER2> There is still a delta between how unicode behaves on 2 and how str behaves on 3, for example. In general, you'll be fine as long as you have a test suite that runs in CI for both 2 and 3 - to catch incompatibilities early.

</comment></comment></comment><comment><USER4> When it comes to finding which packages need to be ported:

I've been disappointed by the "Python 3 Wall of Superpowers" and the fact that they've basically never updated their package list. (They update the Python 3 readiness, but you'd never find out if a popular package created in the last 4 years was incompatible, or if packages on the list have become unpopular.)

Today I found py3readiness.org, which is much more relevant and up-to-date. It has a better call to action, too.

[http://py3readiness.org/](http://py3readiness.org/)

<comment><AUTHOR> OP and maintainer of the above site here.

Thanks for noticing py3readiness.org

Yes, it's up-to-date and takes advantage of [https://github.com/brettcannon/caniusepython3](https://github.com/brettcannon/caniusepython3)

Also, you can help to keep it updated [https://github.com/chhantyal/py3readiness](https://github.com/chhantyal/py3readiness)

<comment><USER5> Both lists should replace python-ldap with ldap3. The former is abandon-ware and will never (probably) be upgraded. The latter already works great with python 3 (and is a better library all-around).

<comment><USER4> There are more packages like that, in fact:

* Python-MySQL is abandoned, but it's been superseded by python-mysql-connector.

* oauth2 is kind of superseded by oauthlib.

* pathtools can probably be replaced with Python 3's pathlib.

* ipaddr can be replaced with iptools, which has the additional advantage that you can contribute to it without approval from Google's lawyers.

<comment><AUTHOR> We know about that. Many of the packages are overriden if there are drop-in replacements like PIL -> Pillow.

In above list, these are not drop-in replacements and it will require lots of changes in your application code if you want to use them. One idea is to show alternative packages [https://github.com/chhantyal/py3readiness/issues/9](https://github.com/chhantyal/py3readiness/issues/9)

</comment></comment></comment></comment></comment><comment><USER6> Am I correct to assume this would be a _fantastic_ place to start contributing to open source projects by helping convert these Debian tools over to Python 3?

<comment><USER7> Yes, as noted in the message:

       If you're interested in this effort, please email me. This is a really good new
       contributor task, so if anyone's asked you how they could get involved with
       Debian, you should send them to us!

<comment><USER8> Yep! My email is firstname.lastname@example.com - sign up for the porting list @ [https://lists.alioth.debian.org/mailman/listinfo/py3porters-...](https://lists.alioth.debian.org/mailman/listinfo/py3porters- devel)

Yes, it's hilarious that version of Mailmain needs to be ported to Python 3.

<comment><USER9> Paul, I already emailed you but I'm responding here because I have a feeling your response will be useful to other people interested in helping: could you give some direction for people like me who know Python 2 and/or 3 and want to help, but don't know the first thing about the structure of Debian packages or how they are developed?

For example: I'm looking at ./main/f/flask-wtf/flask-wtf_0.10.2-1.json and I'm not even sure what I'm looking at. The contents of that file are:

        {"has_python3_module": false, "canidate": true, "trove_python3": true, "has_python2_module": true}

What's all that mean?

On my machine `apt-cache search flask-wtf` finds a package called `python- flaskext-wtf`. Digging deeper with `apt-cache showpkg` I find the homepage [http://packages.python.org/Flask-WTF/](http://packages.python.org/Flask- WTF/), which in turn gets me to the code [https://github.com/lepture/flask- wtf](https://github.com/lepture/flask-wtf). I haven't updated the code to Python 3, but let's assume for a second that I have: now what? How do I tie this all together? Do I just send you a patch for this code? Is this even the right code?

If you point me in the right direction I'll be happy to write up a tutorial to help other folks contribute.

And as a side note: I really like Hy.

<comment><USER10> To know what every key means, you can look at the script: [https://github.com/paultag/debian-meta- archive/blob/master/s...](https://github.com/paultag/debian-meta- archive/blob/master/scripts/python3/main.py)

 _has_python2_module_ : is a python2 package

 _has_python3_module_ : is a python3 package

 _trove_python3_ : Is is declared as python3 ready in Pypi ?

 _canidate_ : Python 3 module already there and Python 3 compatible on Pypi

I published it as a csv to better understand the situation: [https://github.com/mdamien/mdamien.github.io/blob/master/sta...](https://github.com/mdamien/mdamien.github.io/blob/master/status.csv)

<comment><USER11> Is "canidate" a misspelling of "candidate"?

</comment></comment></comment></comment></comment></comment><comment><USER12> > We can all soon look forward to the day where we no longer have to play > Unicode whack-a-mole

I don't expect Unicode trouble to disappear with Python3, quite the opposite, it's trivially to insert ticking Unicode time bombs into Python3 code, especially in things surrounding shell scripting. Something as trivial as this:

        print(os.listdir())

Will explode when it runs into filenames that aren't encodable by Unicode (i.e. perfectly legal filenames in Linux). Linux allows raw binary in a lot of places (filenames, arguments, environment variables) where Python expects Unicode.

<comment><USER13> Are you implying that by using Python 3 incorrectly you can run into unicode problems? I agree with that.

However, there are ways to do this safely. At the boundaries of your code you have to deal with the unicode/bytes question, in any language out there. The good thing about Python 3 is that once that boundary is crossed, unicode and bytes are nicely separated.

<comment><USER12> > Are you implying that by using Python 3 incorrectly you can run into unicode > problems?

The problem is that `print(some_string)` is now incorrect, even so it looks perfectly harmless. So far I haven't seen any "best practice" guide on how to fix that. `sys.stdout.write(os.fsdecode(some_string)` works, but is pretty ugly. Handling all filenames as bytes instead of strings works as well, but again, that gets ugly quick. Cleanest way seems to be:

        PYTHONIOENCODING=utf-8:surrogateescape python3 somescript.py

But should I depend on users setting `PYTHONIOENCODING`? Should I do that in my scripts? It feels all very rough and causes a lot of issues that you really shouldn't have to deal with in the first place.

> The good thing about Python 3 is that once that boundary is crossed, unicode > and bytes are nicely separated.

Not exactly "nicely separated", the unencodable bytes get squished as surrogates into the Unicode strings waiting to cause trouble later on.

<comment><USER14> JFTR. In Python 3.4 and later I think, stdout has a surrogateescape error handler by default. Not that it helps much, because this will fall apart if you write to other things. The story with this apparently is now so confusing that I am not sure what the correct way to do it on Python 3 is.

From my experience most people don't care anyways. In some of my libraries the Python 3 version just refuses to work unless the encoding is utf-8 to avoid accidental failures down the line which nobody can debug.

<comment><USER15> Unfortunately, that has not made it into Python 3.4.

</comment></comment></comment></comment></comment><comment><USER16> As someone who uses a lot of Python scripting for sys-admin automation stuff, is there anyone here on HN who could ask apple to start distributing a python3 binary with the OS by default?

Otherwise we're going to end up with a similar situation as BASH and other utils in a few years time, where OSX comes with Python2.7.x, and everything else in the world is Python3...

(Although, by 2020, apple will probably have deprecated OSX in favour of iOS, and have javascript as the only blessed scripting language...)

<comment><USER17>
      $ ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
      $ brew install python3 pypy3

(to be less pithy, it's super easy to write code that will run on both 2.7 and 3.x -- avoid print-as-statement and use format strings instead of '%' for interpolation and that will get you 95% of the way there--probably 99-100% of the way for simple automation scripts)

<comment><USER18> As the maintainer of a Python project that is 2.7 and 3.3+ compatible on the same code base, there is _nothing_ super easy about it. It's horrific actually. Enough so that I'll never do it again. It goes far beyond just print functions. Libraries like `six` help, but the subtle differences in how Unicode handling has changed makes it a real challenge.

<comment><USER15> A nice read: [http://lucumr.pocoo.org/2013/5/21/porting-to- python-3-redux/](http://lucumr.pocoo.org/2013/5/21/porting-to-python-3-redux/)

<comment><USER18> I've read all the relevant material. That doesn't mean it isn't painful. The same author of that blog post wrote another blog post complaining about how Unicode is handled in Python 3.

</comment></comment></comment></comment></comment><comment><USER19> > Python 2 is scheduled to be EOL'd upstream officially and for good in 2020. > We're in 2015 now (wow, that went quickly), and keeping our release cadence > up (3 years a pop) puts Stretch up in 2018, and Buster in 2021.

Am I missing something? Did Debian decide to extend their release cycles?

Jessie is due to be released next week, which is 2 years since Wheezy (May 2013). In fact, the last several years have all been 2-year cycles, not 3. The only three-year cycle was Woody → Sarge (2002-2005), and AFAIK, that delay was one of the reasons that Ubuntu had room to enter the market. Since this put pressure on Debian to make their development more rapid, I'd be surprised if they decided to move in the opposite direction.

<comment><USER8> Yes, everyone's making fun of me for not saying 2 years rather then 3.

Also, our releases aren't timed, they're based on bug count, so the timing of the releases wasn't even the main point (and doesn't really matter) :)

I also typoed Python 3 as Python 2 in one of the lines, so, uh, just switch those two numbers. I'm pretty sure it works like that.

Either way, getting Buster off Python 2 means the transition will be more bug free, since we'll have a bit of slack time.

</comment></comment><comment><USER20> Nice, I'm glad to see that Python 3 adoption is finally picking up steam! Python 2 is nice, but it has really started to overstay its welcome, I think.

</comment><comment><USER21> We (Fedora) are step ahead.

Currently we are waiting for a last few packages to be ported (anaconda is already running on python3 and ready for Fedora 23 release). Ironically the hardest part isn't porting (we've sent a huge amount of patches to upstream projects) but getting upstreams to accept the python3 as supported interpreter ("what is this python3 thing?" yes, this is a real quote).

I am happy to see a new distros joinning a party, gl!

</comment><comment><USER22> If you want to switch back and forth between python2 and python3, one option is to install miniconda (like Anaconda, but with just the package manager) as your Python distribution and create a python2 environment (conda create --name=myproject-py2 python=2.7 && source activate myproject-py2) that you can then pip install the python2-only libraries into. Then, when your libraries support Python3, create a new Python3 environment and install them into that (conda env export > environment.yml && conda create --name=myproject-py3 python=3.4 && conda env update --name=myproject-py3 --file=environment.yml && source activate myproject-py3)

See [http://conda.io](http://conda.io)

Disclosure: conda is open-source, but I work for company that sponsors most of the development.

<comment><USER23> I believe virtualenv (with/without virtualenvwrapper) is most widely used. Not sure if there are any advantages/disadvantages compared to conda tho.

[https://virtualenv.pypa.io/en/latest/](https://virtualenv.pypa.io/en/latest/) [https://virtualenvwrapper.readthedocs.org/en/latest/](https://virtualenvwrapper.readthedocs.org/en/latest/)

<comment><USER24> One disadvantage of conda/anaconda is that you can't, or are discouraged from using virtualenv with conda/anaconda.

I use Anaconda on Win7, like it a lot, but I haven't figured out how to use, say, the python 2 that comes with anaconda alongside the python 2 that comes from python.org. I've looked around, haven't really understood what I should be looking at for that. But whatever it is, it isn't virtualenv if you use Anaconda.

<comment><USER25> _One disadvantage of conda /anaconda is that you can't, or are discouraged from using virtualenv with conda/anaconda._

True, but conda has its own virtual environments that work quite nicely. You can make a new one with conda create and switch between them with activate/deactivate. You even get the same sort of interaction with pip (for the packages you want that aren't in conda or binstar), and I've been able to use e.g. Emacs packages that expect to work with virtualenv and have (mostly) had success using conda's envs instead.

<comment><USER24> Yep, and your answer is the sort of answer I see all around, including on their forum. I haven't figured out the doc.

How would you use conda's environments to switch between Andconda's python 2 and python.org's python 2?

<comment><USER26> Why would you want to do that? If you're using anaconda or miniconda, you should be using Continuum Analytics' builds of python, not python.org python.

<comment><USER24> Because I want to use Anaconda and its infrastructure, but skeptical people in my circle would want to see that whatever was built will run on the version of python that they would download (which would not be Anaconda).

"Why would you want to ..." answers are generally pretty frustrating. It's a big universe with a very large possible set of individual circumstances.

Can this be done?

<comment><USER26> If you're building conda packages then the only possible consumer is other users of miniconda or anaconda.

I'm not sure "whatever was built" refers to in this case. Some kind of app? Of course you can use anaconda for normal library or application development, since there's functionally no difference between Continuum Analytics' python builds and the python.org python build.

<comment><USER24> I want to run the following, using either of Anaconda or python.org python 2, on the same machine depending on the whim of the day:

      C:> python -c "print 'hello'"
      hello

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER27> My biggest peeve writing Python 3 is pretty trivial...

I cannot get used to typing print()

Every time I go to debug a line, I get a syntax error, and have to go back and change it. And I type a lot of debug lines!

I need to find a vim extension to handle this, but so far it just makes me frustrated whenever I try to type Python 3.

<comment><USER28> Have you tried using the logging module? Might be overkill for really small scripts as it requires a few lines to set up, but even the tiniest tool ends up requiring print-debugging at some point. With logging it works the same in 2/3, you can leave all the debugging statements in, and if a library also uses it then you get additional debug output from that too. Add a "debug" command line flag to pass when something goes wrong down the road (to change the default log level), and you don't have to add/remove statements for debugging.

For a vim extension - I use snipMate [http://www.vim.org/scripts/script.php?script_id=2540](http://www.vim.org/scripts/script.php?script_id=2540) It's a bit on the dead side but works great as-is. ifmain followed by the expander key (shift-tab in my case) expands to the if __name__ ... idiom. You could add your own "p" snippet that expanded to print() in python code.

</comment></comment><comment><USER29> Interesting side node: Blender (an open source graphics suite) switched to Python 3 in like 2008 (so far as I can determine).

The reasoning probably was "Hey, the rest of the Python community would probably leave us in the dust, if we don't..."

</comment><comment><USER30> Oh man.

I've been meaning to check out Python 3 for a couple of years now, but so far I did not have a compelling reason. Maybe it's time to start anyway.

<comment><USER31> Yeah, reading through this thread, I haven't seen a single reason why I should care about Python 3.

<comment><USER32> Because Python 2 will be phased out in 5 years.

<comment><USER33> By who? The core developer team? Or by PyPy and Pyston? The people that matter (the users) aren't phasing out 2.x in 5 years. That much is clear.

</comment></comment></comment></comment><comment><USER34> Someone asked why not swap to Elixir or Rust, but why not actually swap to the sysadmins dream of Ruby?

<comment><USER32> I don't know a sysadmin on this planet that dreams of using Ruby as systems scripting language. That sounds like hell.

Again, its the trade off between a relatively simple port and adopting a new language with different standards, technical difficulties and culture.

</comment></comment><comment><USER35> Or just fork python 2 and keep on trucking there in happy land.

</comment><comment><USER36> > Booo, Python 2!

It would be better for everybody if we'd treat Python 2 and Python 3 like separate languages. Then we can reason about the sanity of spending development time to port existing and working code from one language to another.

<comment><USER37> The problem is they are really really similar and you can write code that runs on Python2 and Python 3 at the same time.

</comment></comment><comment><USER38> This seems like a good time and opportunity for Debian to try their hand at one of the recent languages that have popped up like Rust, Elixir, etc.

<comment><USER32> You're being downvoted because writing Debian's system infrastructure in a language whose spec isn't finalized or is not well known is a Bad Idea when other options exist.

Python 2 -> Python 3 is a trivial port compared to adopting a new language and the technical/cultural baggage that come with it.

</comment></comment><comment><USER39> I am getting really tired of this "if Python3 is to live then Python2 must die" stuff...

Perhaps Debian should avoid the war entirely and switch to another scripting language.

<comment><USER40> Python2 is a ticking time bomb - it's officialy EOL'ed in 2020, all new development is happening on 3.x

It's like the jump between Ruby 1.8 and 2.0 - there is no reason to be doing anything in 1.8 in 2015.

<comment><USER41> I predict that Python 2 will be forked by a drop-in replacement by 2020.

<comment><USER42> I'll bet you $50 that no non-maintenance fork of python2 will be shipped by default in any of the top 5 linux distributions before 2020.

<comment><USER33> Only because the core dev team is making it their priority to move distros over to 3. It won't make any difference, the strength of Python is in the library support, not the distro support. 2.x support by libraries will last a very long time, nothing worth its salt will be dropping it. By the time they do, Python3 and wherever it is by that point will be unrecognizable to the original release of Python 3.0.</comment></comment></comment></comment></comment>


UX Myths : Debunking user experience misconceptions - <AUTHOR> http://uxmyths.com

<comment><USER2> I really like that they're linking to others writing about the same point they're making.</comment>