FDA is considering drugs to help kids quit vaping - <AUTHOR> https://lite.cnn.io/en/article/h_66afc59fee1feb0f28b5944c6a8b2384 <comment><USER2> Companies like JUUL have patented formulations for nicotine salts that quickly spike blood nicotine levels similar to levels of analog cigarettes, then the sudden drop off promotes stronger cravings and more frequent usage. Cavings resulting from this quick spike and drop off significantly increases habit forming behavior by boosting both the intensity of withdrawl symtoms and frequency of usage compared to freebase nicotine formulas that have been common in traditional "ejuice" of the past decade. Combine this with their cornering the teenage vaping market you can see why Altria (malboro parent co) just gave them 13B for 35%. These nic salt formulas can ease the transition from traditional cigarettes, but also increase the first time user to addict conversion rate and lessen the likelyhood of users tapering off usage by gradual reduction of comparibly stabilized nicotine levels of freebase formulations.

I've been rolling around an idea for a device to help ween off nicotine for years now. I need to consult with an EE, but don't have any in my network. If anyone's willing to chat for 30 mins, or interested in colaberating I'd love to hear from you, emails in my profile. If you're aware of any service out there to buy small block of consultation time, that would help at well.

<comment><USER3> JUUL was the only thing that got me off a pack-a-day 13 year habit. I think very highly of the product and it is a shame teenagers made it so 'cool'. (Much like cigarettes at one time...)

<comment><USER4> Conversely, I switch to Dipping Tobacco as my quitting smoking mechanism, I dont think I can quit nicotine and stick to it, but quitting dip does seem legitimately easier than smoking, as there is much less ritual associated with it.

<comment><USER5> Mouth cancer though. Horrible stuff.

<comment><USER6> My dad's dad smoked a lot when my dad was young, but managed to quit by chewing cigars. He died of mouth cancer.

My dad swore off of drugs and alcohol, and always said he wanted to work until the day he dies. He's instead spent the last 10 years dying of Alzheimer's.

For what it's worth, I'm inclined to follow my dad's approach. Perhaps with a different interpretation of retiring when I die. But there are some games you just can't win.

</comment></comment></comment></comment></comment><comment><USER7> Anti-tobacco extremists believe the ends justify the means. They'll happily give people dangerous psychoactive drugs or get them hooked on nicotine replacement therapy if it means advancing their agenda.

I quit smoking a couple years back and I was baffled by the lack of quality information I could find online. It's 90% propaganda, thanks to the anti- smoking warriors. Most of it pushes these quit-smoking drugs or just different forms of nicotine intake (which is the very drug you're supposed to be trying to quit in the first place).

You'd think we would have collectively learned something from the abysmal failure of things like the DARE program and abstinence-only education. Facts work better than scare tactics and propaganda.

<comment><USER8> >Most of it pushes these quit-smoking drugs or just different forms of nicotine intake (which is the very drug you're supposed to be trying to quit in the first place).

Wait, what? I thought nicotine itself was pretty harmless, and that most of the harm from smoking comes from all the other junk you suck into your lungs? Wikipedia seems to agree:

>The health effects of long-term nicotine use are unknown. The general medical position is that nicotine itself poses few health risks, except among certain vulnerable groups, such as youth. Nicotine use as a tool for quitting smoking has a good safety history.

[https://en.wikipedia.org/wiki/Nicotine](https://en.wikipedia.org/wiki/Nicotine)

<comment><USER7> Nicotine is viciously addictive. I don't see how anyone could consider one of the most addictive substances, and its associated withdrawal symptoms, to be "harmless".

And yes, nicotine replacement therapy has a decent track record compared to other methods, which should not be surprising since you don't have to actual break the addiction. You just maintain the same addiction with a different delivery system.

Interestingly, vaping itself is just another nicotine delivery system, but one that the anti-smoking zealots decided to demonize, unlike the various inhalers, patches and gums they push.

<comment><USER8> >Nicotine is viciously addictive. I don't see how anyone could consider one of the most addictive substances, and its associated withdrawal symptoms, to be "harmless".

Addictive stuff is bad _if taking it has other negative effects_. Food, water, and air are likewise addictive, but that doesn't mean you should do without. You'd need to cite something other than being addictive to establish a reason to avoid them entirely.

>And yes, nicotine replacement therapy has a decent track record compared to other methods, which should not be surprising since you don't have to actual break the addiction. You just maintain the same addiction with a different delivery system.

I think the idea is to follow them up with a tapering off of the nicotine levels, which is much easier at that point.

<comment><USER9> > Food, water, and air are likewise addictive

This is a perverse usage. The physiological need for food, water, or air is innate; it arises from your body itself, not the action of the external substance on your body. Additionally they do not induce the classical development of tolerance.

Many people would hold that addiction itself is bad. Even if there are no other negative effects, there is the effect of dependence on the addictive substance and commensurate loss of independence (the addiction always occupies some mental space since you must always think about how you are going to satisfy it).

<comment><USER8> Okay, if I may rephrase the point in a less cheeky manner:

It's not very informative that a substance is addictive in the sense that "you must use this every day or experience extreme negative side effects". You have to also look the cost of taking it and what it does to you when you use it.

I have to constantly eat to stay alive? Manageable. I have to consume water and breathe air? Manageable. I have to inject 50 cents of insulin? Manageable. I have to absorb 50 cents of nicotine? Manageable.

If I have to consume expensive amounts of crack, which also makes me homicidal? Okay, then that's a problem.

I was objecting to the OP's criticism of the lingering nicotine addiction and usage as some kind of be-all end-all deal-breaker. No, it depends on the relative harm. If you go from "expensively sucking down toxic junk to get your nicotine fix every day" to "taking a cheap nicotine-only does everyday", that's not defeating the purpose of anything, and it's very much missing the point to dismiss it as "still being addicted to nicotine".

<comment><USER10> There's a difference between a physiological need, like consuming water and air, and a chemical dependence.

> I have to constantly eat to stay alive? Manageable. I have to consume water > and breathe air? Manageable.

No matter where you go, the entirety of society is structured around the fact that all people need to eat, drink and breathe.

> I have to inject 50 cents of insulin? Manageable. I have to absorb 50 cents > of nicotine? Manageable.

This is where the disconnect is. The cost of insulin dependence is not merely the cost of insulin itself. An insulin dependent person must always be aware of their blood sugar levels and diet. They must always be prepared for a situation in which they're away from their insulin supply. They must be prepared for an emergency or incapacitation due to complications with their condition and its treatment. There's a significant cognitive load that isn't accounted for by the fabric of society like the need for food is.

Likewise, there's a psychological, social and occupational cost to nicotine addiction that isn't reflected in nicotine's price alone.

This is why people are saying that chemical dependence is inherently bad: it's an inconvenience at best, a costly burden to most and a killer at worst.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> I cannot fathom how people still use phrasing like "drugs and alcohol" and "drugs instead of vaping" etc.

How can there be such a disconnect, those are first class drugs! Is it cognitive dissonance, i.e. actively refusing to acknowledge it? It's pretty much universal too, not just one or two countries.

<comment><USER12> This just reminded me of the time, not too long ago, I was on a date and she said to me, "I'm not into drugs." The problem was, she was on her second cocktail.

<comment><USER13> Personally...I like to be really pedantic and point that out to people who say that while drinking a coffee...and consuming the most widely used stimulant in the world.

<comment><USER11> Being pedantic can easily be addictive / a drug; win a little logic game, score some imaginary points! Especially on an internet forum.

<comment><USER14> Bad analogy... The drug you're thinking of might be dopamine released by your brain, but not a third-party drug like alcohol or caffeine, like everyone else is talking about.

</comment></comment></comment></comment></comment><comment><USER15> Bright idea: instead of letting kids vape (harm profile: uncertain, could be low), let's hook them to drugs like Varenicline (Champix) which are known to cause thing like cardiovascular diseases and suicide ideation.

(Actually, it's a bright idea for all the parties involved, because "think of the kids" brings positive karma points, and parents and insurance plan will cough up the money)

<comment><USER16> What a surprise: Varenicline is still under patent and available from only one provider in the USA [https://www.drugs.com/availability/generic- chantix.html](https://www.drugs.com/availability/generic-chantix.html)

I wonder who's paying the dinner bills after today's hearing.

<comment><USER15> I suppose we are both bad cynical people because I thought the same when reading the article

</comment></comment></comment><comment><USER17> > "I believe FDA posed the wrong questions for today's meeting," said Lauren > Lempert, a law and policy specialist for the Center for Tobacco Control > Research and Education at the University of California, San Francisco.

> Instead of debating the role of nicotine replacement and drug therapies, the > agency "should be focusing on policies that will prevent youth initiation > with e-cigarettes and addiction to nicotine,"

I've been noticing this form of argument... in case it's not clear why I find it strange: yes, for a hypothetical child it's ideal that he not get addicted in the first place. But you still have these children who are addicted, that's a real problem, so while it's useful to also consider prevention, a regulatory agency is mandated to address an actual problem.

<comment><USER18> Why would you plan to continuously use band-aids when you could prevent getting cuts in the first place?

It seems more important to address the source of the issue to prevent it from continuing to occur rather than only treating the symptoms. (Fixing the current is still important, but seems secondary to me)

</comment></comment><comment><USER19> It seems to me that it would be in the best (financial) interests of big tobacco and pharma that vaping be outlawed entirely.

Failing that they would probably both find it in the their best interests to force companies who want to produce vape related products through a regulatory process so expensive that only massive companies such as Marlboro or Pfizer can afford to comply - can't have the little guy taking a slice of their poison pie.

I think that if kids are going to try nicotine (and let's face it - they are) better it be through a vape than a cigarette.

Anecdotally as a person who has sometimes smoked as many as 100+ cigarettes a day - I am finding vaping to be helpful in quitting the horrible cigarettes and if it were not offered as an alternative, would probably go back to smoking because none of the other cessation methods have been effective for me.

I know both smoking and vaping are far from ideal but the lesser of two evils is still better any way you slice it.

When you have something that is taking significant profits from big companies, one of the first ports of call for them is to whip up some hysteria along the lines of "think of the children" if applicable.

The rhetoric surrounding this appeals to something deep within human nature and it becomes trivial to demonise people who have a contrary point of view - in this case people who happen to be proponents of harm reduction and freedom of choice.

</comment><comment><USER20> [https://www.hhs.gov/ash/oah/adolescent- development/substance...](https://www.hhs.gov/ash/oah/adolescent- development/substance-use/drugs/tobacco/trends/index.html)

I posted a very well researched response, to a similar article (unfortunately somewhere else, I can't remember where).

As a big opening gambit - "Smoking rates of children have gone off a cliff since ~ 2000". Not only have they dropped, they've accelerated. If any of this acceleration is associated to the corresponding increase in vaping over this time, then the vaping industry is possibly the leader in saving lives. (I'm open to other suggestions).

<comment><USER21> > If any of this acceleration is associated to the corresponding increase in > vaping over this time, then the vaping industry is possibly the leader in > saving lives.

That doesn't appear to be the case.

See the chart in [https://www.motherjones.com/kevin-drum/2018/12/the-juul- fad-...](https://www.motherjones.com/kevin-drum/2018/12/the-juul-fad-is-far- bigger-than-i-ever-would-have-guessed/)

<comment><USER20> That's trends in percentages - not absolute numbers Makes perfect sense that. If there are more smokers than vapers (which there will be historically as vaping is new and smoking is old) - then a few switching to vaping will cause the smoking like do drop a little, and the vaping line to go up like a rocket. i.e. If there were 100 smokers and 10 vapers. Then one of them switches. Smoking has gone down 1% and vaping up 10%.

Plus doesn't seem to include relative harm. I'd have thought it would take a large number of non-smokers taking up vaping, to match the harm-reduction of one smoker switching to vaping.

<comment><USER21> What? No.

It's the percentage of high schoolers who've tried each. 1% of high schoolers switching from smoking to vaping will cause the percentage of high schoolers smoking to go down by one and the percentage of high schoolers vaping to go up by one.

<comment><USER20> My apologies. I was just recycling a previous argument against a different report (without reading this one properly).

</comment></comment></comment></comment></comment><comment><USER22> Where there's a way, pharmaceutical companies will make money.

</comment><comment><USER23> I can't read this article without shuddering. It sounds completely hysterical about kids using what is considered a _smoking cessation tool_ , that is not proven to cause any harm, and that delivers varying, but usually pretty low, if not zero, amounts of nicotine.

The solution? Prescribing other drugs to these kids (as if there are any that actually work against smoking, except the very one they're trying to gegt them off).

<comment><USER24> > I can't read this article without shuddering.

It's a wonderful example of fake news, using clever (but technically true, if someone ever called them on it) language to persuade people to be scared.

</comment></comment><comment><USER25> >Experts worry that the devices could put kids' developing brains at risk, get them hooked on nicotine early in life and be a gateway to smoking and other drugs. But, the long-term effects aren't clear.

The vast majority of smoking's harmful effects are due to the combustion products not the nicotine. It is really unclear if vaping will really have a long term effect on kids. In addition, given that vaping doesn't really hurt other people via second hand smoke or altered behavior(see alcohol) this whole panic about vaping seems overblown. How much do you want to bet that the "medical experts" who are harping about the dangers of vaping without a lot of data are "consultants" for pharmaceutical companies looking to get their "anti-addiction" drug approved.

<comment><USER26> Vaping certainly does damage air quality by releasing ultafine aerosol particulate matter (also known as pm10 or pm2.5) [0]. It's worth noting that these are associated with respiratory distress and can contribute to stroke and heart attacks as well as asthma. In fact, we now have compelling epidemiological evidence that vaping almost doubles risk of cardiac events [1].

Think about it like this: would I want to run a marathon on a bad air day in China? Probably not.

[0]. [https://www.nature.com/articles/s41370-017-0005-x?fbclid=IwA...](https://www.nature.com/articles/s41370-017-0005-x?fbclid=IwAR1X7IPVGTwF30C5nEeO3bMsjMI11-Ak01fv0JuA- FmTc4EAH8YM3fEIb2M) [1]. [https://www.ucsf.edu/news/2018/08/411476/risk-heart- attacks-...](https://www.ucsf.edu/news/2018/08/411476/risk-heart-attacks- double-daily-e-cigarette-users)

Edit: Study 1 focused on PM10 (particulate matter smaller than 10 microns) air quality levels, and not PM2.5. PM 10 tends to be associated with more acute respiratory distress, while PM2.5 is a more chronic threat [2]. Nevertheless, there is sufficient evidence that monitoring environmental PM10 levels remains an important public health metric.

<comment><USER24> > In fact, we now have compelling epidemiological evidence that vaping almost > doubles risk of cardiac events

 _If you continue to smoke tobacco_.

"Scientific" studies like this that assert causation when all they have is correlation, based on surveys that we know little about (and likely wouldn't be able to learn the full details of even if one was energetic enough to hunt down the original paper), certainly don't do anything to convince me. If anything, it just increases my suspicion around the "science" we're fed.

<comment><USER26> Well they have correlation that remains correlated after you adjust the model for other risk factors. So is that direct evidence? No.

But when you add in the other lines of evidence, you start building a case. It's sorta like a murder trial (not withstanding a separate discussion of our criminal justice system...) where the case is built over lines of evidence.

And as one of my graduate professors once said, "there is no double blind randomized trial for the efficacy of parachutes" ;) [0].

[0]. [https://www.bmj.com/content/327/7429/1459](https://www.bmj.com/content/327/7429/1459)

<comment><USER24> > But when you add in the other lines of evidence, you start building a case. > It's sorta like a murder trial (not withstanding a separate discussion of > our criminal justice system...) where the case is built over lines of > evidence.

When you're dealing with a murder trial, whether harm has occurred is clear. In this case, not only is there a lack of evidence for causation, there's not even any evidence for harm.

<comment><USER26> People have died of cardiac events and lung cancer. Some people have used e-cigarettes. Some have not. Is there evidence that connects the use of e-cigarettes to these deaths? That's for science to decide.

<comment><USER24> Similarly: People have died of cardiac events and lung cancer. Some people have chewed gum while walking. Some have not. Is there evidence that connects chewing gum while walking? That's for science to decide. As it is, we have none. But until then, I'd rather not have it outlawed or be forced to pay for research without some reasonable reasoning that there may be some significant risk involved.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Does nicotine have an medicinal value? It seems to me, it's used as an additive with one ends in mind: addiction.

While I'm not in favor of the Nanny State, the fact that tobacco products (read: known carcinogens) are sold freely boggles my mind. Imagine if a terrorist (e.g., UBL) had said, "I'm going to developer a product that addicts it's users. This product will cause health issue, and perhaps even cause cancer. I'm going to bring this product to the masses wolrdwide."

If such an proclamation where made, the public and the governments would FLIP OUT. The war on terror would ratchet up ten-fold. It's a mad world

<comment><USER27> Yes. It's an appetite suppressant, helps you focus similar to ADHD drugs, and relaxes you. Snus (steamed tobacco) doesn't have carcinogens, cause cancer, or reduce lifespan. Pipe Tobacco users live on average 3 years longer than non Pipe Tobacco users. Nicotine is not an issue with respect to cancer. It's everything else in cigarette smoke. Nicotine's not even that addictive by itself. What's more addictive are the social behaviors surrounding it. Overcooked steaks are carcinogens and psychologically addictive, should we ban those too?

<comment><USER28> Quite a few studies implicate nicotine as a carcinogenic agent. Further, nicotine is absolutely terrible for cardiovascular health.

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4363846/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4363846/)

<comment><USER29> Thank you! This is an important point that I almost never see mentioned.

</comment></comment></comment></comment><comment><USER30> Can't we make some sort of waxy nanostructure material in the form of a cigarette that burns with zero particulates? Won't help the issue directly but will help smokers.

Here's an idea - since all vapes except home made devices are electronic, put a Bluetooth chip that requires a phone app that securely identifies the age of the vaper. Make it mandatory for all vaping devices and boom - massive cut in underage vaping.

</comment><comment><USER31> How about if we make it so they do not start?

</comment><comment><USER32> like, say, 0% nicotine vaping?

<comment><USER33> This is exactly how I quit vaping a few years ago. Crazy, right? Offer 0% nic Juul pods for parents to buy their kids and they'll stop giving a shit after a while.

</comment></comment><comment><USER34> This was originally going to be a reply to ben509's comment but turned into a rambling mess only even tangentially related to the original article. Rather than throwing it away, I am posting it as a top-level one.

I don't think it's just the substance that is perceived as unclean. Even for a libertarian, there is a slimy texture to any industry based around an inherently addictive product. Especially when it comes to marketing to kids -- potential lifelong loyal customers if you can hook them while they're more easily influenced.

Suppose there was a substance that was completely neutral in terms of its effects on your body. It has no caloric content, is not caught on drug tests, it tastes like water, and doesn't even make you feel different when you take it. The _only_ effect that it has is that, several hours after your last dose, you find yourself craving another.

How would you feel about this substance being marketed? It's not hurting anyone, other than that they spend a portion of their money on the habit. But the companies selling it aren't doing their own customers any good, either, and in fact, each new customer they get to try the substance is just being roped into a life of either willing themselves through the cravings or spending a little money to make them go away.

Now, obviously nicotine is not this substance. For one, I do think nicotine users actually enjoy the products and also get some alertness benefits from them. But there is that skeevy layer to it too.

I'm not coming at this from a place of puritanism. I'm not a nicotine user but I do consume alcohol. I think we all know alcohol is worse than nicotine in terms of health effects, and the alcohol industry has done an extremely effective job of positioning their product as something cool grown-up adult people use, joke about, and have "sophisticated" tastes in. Just run through your favorite TV shows from the past 20 years or so and try to find any that don't show main characters either a. enjoying alcohol as part of all their social events, or b. abusing alcohol and it's played off as funny, or c. abusing alcohol as part of a "tortured genius" trope.

In a lot of industries the top 10-20% of customers account for the majority of sales. It just gets weird when you have an industry that has to pretend it cares about "responsibility" when its bottom line is as dependent on its most addicted users as they are on the product.

I guess my point is, at some point we call people adults and let them weigh the benefits vs. the risks. Even if they suck at doing that, it's on them. But I'm totally OK with the FDA's aggressive stance on e.g. Juul marketing to teenagers, because that seems to me to be all about getting somebody to start the habit when they're least likely to make wise decisions.

<comment><USER35> > But I'm totally OK with the FDA's aggressive stance on e.g. Juul marketing > to teenagers, because that seems to me to be all about getting somebody to > start the habit when they're least likely to make wise decisions.

is there any evidence that juul is marketing to teenagers? genuinely asking, as I receive their promotional emails and they never strike me as targeting underage users.

<comment><USER21> Trying to get their "anti-vaping" curriculum in schools (aping what the tobacco industry did):

[https://www.nytimes.com/2018/08/27/science/juul-vaping- teen-...](https://www.nytimes.com/2018/08/27/science/juul-vaping-teen- marketing.html)

> Five days later, Carrie Yantzer, the principal at Nederland Middle-Senior > High School, received an email that immediately struck her as suspicious. > The writer introduced himself as Bruce Harter, a former educator working > with Juul to develop an anti-vaping curriculum for schools.

> "I read about the challenges you're having with Juul," Mr. Harter wrote. He > offered a free, three-hour curriculum provided by Juul to discourage teens > from using e-cigarettes by teaching them about their brains and giving them > mindfulness exercises.

The "cool flavors" thing was a (now banned) tobacco industry trick, too:

[https://www.smithsonianmag.com/history/electronic- cigarettes...](https://www.smithsonianmag.com/history/electronic-cigarettes- millennial-appeal-ushers-next-generation-nicotine-addicts-180968747/)

> Other efforts from Big Tobacco to target children were eventually stymied by > the government as well. In the late '90s, the Federal Trade Commission > banned the indelible Joe Camel, and the Food and Drug Administration banned > kid-friendly flavors like strawberry, grape, and chocolate from traditional, > or combustible, cigarettes in 2009.

<comment><USER35> > Trying to get their "anti-vaping" curriculum in schools

I can agree, that seems suspicious.

> The "cool flavors" thing was a (now banned) tobacco industry trick, too

this is more along the lines of what I expected, and I strongly object to this argument for two reasons. the first is just that, as an adult, I don't accept that I should be prohibited from buying something that tastes good to me just because a child might also enjoy the flavor. the second is that having vape flavors that actually taste good makes it a much more effective harm reduction tool; after a giving it a chance, many smokers actually end up _preferring_ the experience of vaping. if you ban all the good flavors, a good chunk of these people are just going to switch back to smoking.

also, I notice there are a lot of people that support the flavored cigarette ban of the 90s and are now railing against vape flavors. I never hear these people complain about sweet, fruity liquors. if strawberry vape juice is targeting children, who is strawberry vodka for? do we also need to think about banning sweet wines?

</comment></comment></comment></comment><comment><USER36> Ah yes, lets drug our kids even more to fix the fact that we drug our kids so much. We have to think about those poor pharma execs who need more mansions and private jets. When your paycheck depends on it, I guess drugs are the answer for everything.

Do people still believed that government and its agencies exist for the benefit of the public rather than to benefit capital and corporate interests?

The US government has never been a country of the people, by the people, for the people. It's been a government of the rich, by the rich, for the rich.</comment>


Ask HN: What is hire.withGoogle.com? - <AUTHOR> I can't tell if it's a job board product offered by Google, or their in-house job board.<p>Example post:
https://hire.withgoogle.com/public/jobs/medisas/view/P_AAAAAACAAADCtXddDrnY6h for https://www.medisas.com/ (possible Alphabet subsidiary?) <comment><USER2> Seems that works based on your location, take a look a the code inside the page. Probably when you log in, they search on your background to see if you are eligible to anyone hiring

</comment><comment><USER3> The former. I was actually just sent a link to use it to apply to a non-Google job.

<comment><USER4> Yeah, and the top level domain redirects to google.com the DNS registrar is the same one the Google uses, and WHOIS says the owner is Google.

I guess it's just a quiet launch of a Google service, probably beta-ing it with the YC crowd.</comment></comment>


Mathematica algorithms rendered as music - <AUTHOR> http://tones.wolfram.com/

<comment><USER2> It's amusing. Back when Wolfram's "A New Kind of Science" (NKS) came out, I was one of the masochistic types that actually read the whole thing. It's a fairly decent introductory text to cellular automata, but it's not new, and wasn't back then either. Well, the amusing bit is that he explicitly states in there how while the visual system has meaningful potential for interpreting complex patterns such as those generated by cellular automata, the auditory system is too linear and limited to perceive such things. And not too long later, he publishes a cellular automata -based music generator on his website (this thing has been around for a while).</comment>


The Pentagon Has Prepared a Cyberattack Against Russia - <AUTHOR> https://www.thedailybeast.com/the-pentagon-has-prepared-a-cyber-attack-against-russia <comment><USER2> If this news is coming out now then it has already happened.

<comment><USER3> This news is not news. The pentagon? Preparing?</comment></comment>


Ask HN: How do you manage your *nix binary package updates? (first post. eek) - <AUTHOR>

We run clusters of machines and whenever there's an update via USN / DSA or whatever I end up manually patching each cluster with cluster-ssh.
This is less than ideal, but seems to work.
What do you do?
Note; I'm talking about binary packages distributed by your OS : apt upgrades / rpms.. not  config files (Hi, puppet/chef), or deprec for capistrano style stuff. <comment><USER2> I used to manage around 300 servers myself. The only way it was possible was to have a completely stripped OS. All apps we used I installed under:

/apps/<appname>/<app version> example: /apps/perl/5.8.12 then I would symlink /apps/perl/5.8.12 to /apps/perl/current

The profiles on the machine would add /apps/*/current/bin to the path. This allowed upgrades and roll backs just by changing the symlink to the one I wanted to be current. This also allowed me to push out versions of software ahead of time, and they just change the link when we were ready to use it.

Each machine would rsync /apps from a master distro nightly and of course I could force it with a for i in `cat hosts.list`...

<comment><USER3> This sounds a lot like what gobolinux is doing [1] with its filesystem/package manager. Did you ever incur in more trouble than it was worth with that approach?

Making the filesystem the actual package database rather than a snapshot of what should be installed is quite tempting.

[1]<http://gobolinux.org/index.php?page=at_a_glance>

</comment></comment><comment><USER4> Create a custom repository of your packages and point all the machines in your cluster to it? If it is CentOS or RHEL just add a new repo to /etc/yum.repos.d. If you are upgrading system repos then just set the priority of your repo to be higher. Of course this implies that you have successfully rpm-fied your packages. We did that to all our packages and configuration.

<comment><USER5> If you run the Red Hat family (Fedora, CentOS, SL, whatever else) you could also run Spacewalk. Machines periodically check in and get config files and packages that it needs. If you configure it to do so you can also push.

At my last job we ran Spacewalk on our Koji box. Koji will let you build packages that you can then put in your repo to yum install.

<comment><USER6> +1. Yum and apt and the like are awesome for individual machines, but pull based. Spacewalk and RHN are centralized push, which you need for any decent amount of machines.

</comment></comment></comment><comment><USER7> I was at devopsdays in Mountain View CA a week ago and one of the panel discussions was on package management. I was a bit surprised to see it as a topic, as there are numerous known ways to solve the problem.

It turns out, that's exactly the problem. The topic was hotly debated and yes, there are endless possible ways to distribute packages across a large environment.

I think choosing a pattern involves deciding for yourself how secure/auditable you need your environment to be and how tightly you want to couple your deployment process to your current architecture (ie. some package managers only work on some systems, etc.). That will narrow your choices down to a handful, and then you get to dig into the implementation details and decide from there.

</comment><comment><USER8> Isn't this what people run their own apt mirrors for?

<comment><USER9> Yep. At my work we have a apt repository, and push packages to in, then issue an apt-get update on all the machines.

<comment><USER10> Hopefully an upgrade too, as an update alone wouldn't do anything.

<comment><USER10> So, do you guys not know what you're talking about is there some legitimate reason for downvoting this? Please, by all means, `update` to your heart's content with aptitude. It won't do a damn thing, but OKAY.

<comment><USER9> Yes, I meant upgrade. I mistyped. I assume the reason for the down-voting is that it was a petty point and it was clear what I meant.

<comment><USER10> For what it's worth, I meant it as a tongue-in-cheek sort of thing. I wasn't really criticizing. Sometimes I come on HN and am more conversational or joking than I ought to be. Anyway, I figured you meant as much, sorry!

</comment></comment></comment></comment></comment></comment><comment><USER11> Perhaps Murder would work? See: [http://engineering.twitter.com/2010/07/murder-fast- datacente...](http://engineering.twitter.com/2010/07/murder-fast-datacenter- code-deploys.html)

</comment><comment><USER12> We manage our own dists. We package our own software as .debs, so everything gets managed the same way. All security updates, release deployments, rollbacks, etc., are managed with apt-get. I don't exactly understand pinning, but it's also important to how we manage packages.

Depending on the release and the kind of server we're deploying to, we may do them all in one night or in batches of a few hundred over a week. All our boxes install security updates regularly (because we promptly add security updates to our dists.)

</comment><comment><USER13> I run a squid caching proxy and direct all my (Fedora or RHEL) systems to use it along with a non-mirror list repository that is fairly close to me. I'm not totally sure what your question is though.

If you want to tightly control the packages that get updated then there isn't much to be done other than manually managing your own repo. Although if it is this big of a concern you should probably be running a distribution that is less volatile than Ubuntu. Say RHEL, CentOS, or Debian.

</comment><comment><USER14> You can do two things.

1\. Mirror a yum repository plus updates. For each day create a hardlinked directory of updates named reponame.YYYYMMDD. On the hosts you wish to update sed -i to the new day in your yum repo config file and run yum -y upgrade. When you know it works, do it on the other hosts too.

2\. Use a configuration management tool like Puppet.

For your sized infrastructure you probably want the first.

<comment><AUTHOR> Already using puppet, and -yum, it's debian/ubuntu ;) (thanks though)

</comment></comment><comment><USER15> Corporate repository to which official packages migrate upon certification. This usually takes about 24 hours.

</comment><comment><USER16> I've heard good things about MCollective for distributed package updates:

<http://www.puppetlabs.com/mcollective></comment>


Text generation without GPT 3 - <AUTHOR> https://blog.ml6.eu/neural-text-generation-from-1-million-belgian-real-estate-deeds-9230c940432c?source=friends_link&sk=62f009f9f9fad83edc75f9adb8b04069 <comment><AUTHOR> Neural text generation from 1 million Belgian real estate deeds - How ML6 trained a large-scale keyword-to-text model for composing real estate deeds in Dutch.</comment>


Ask HN: Why do you dislike about Medium.com? - <AUTHOR> My dislike for Medium has grown with time for personal reasons. What's your reason for disliking Medium? <comment><USER2> Unvetted, user-submitted articles and presenting them as if they are valid news is my biggest gripe.</comment>


How a former addict uses Reddit to save drug users' lives - <AUTHOR> https://medium.com/backchannel/the-heroin-heroine-of-reddit-a2fffcc2a25b

<comment><USER2> > A person can't get clean if they're dead.

That line stood out the most to me and is something I think people regularly forget or choose to ignore. It really is a shame that due to the stigma most people don't bother sharing their story of recovery or more often don't even try to get better.

For all of Reddit's warts things like this and subs like /r/leaves (weed), /r/stopdrinking (alcohol), and I'm sure many more that I've never heard of are awesome resources where someone can ask for help without judgement or shame. Really it's just part of the internet as a whole allowing people to ask questions or read up on topics that normally would be taboo for them in their communities and is why I love the internet so much.

</comment><comment><USER3> I was an active member on /r/opiates for ~2 years and it is a great place that talks extensively about harm reduction the pifalls of being an addict and operating safety in a high-friction low reputation seedy underworld of drug culture.

If you have never done heroin, it is dangerous as hell. Not just the drug, but the people you have to deal with to get it. Obviously, there were people on the subreddit tellng first time vicodin users to "bang that shit"[0] but there were people giving safe advice and counseling as well.

It is a strange place where people post a bundle of heroin and some cocaine and title the post "my breakfast (:", but also when a long time member says that they quit, there are dozens of congratulatory posts. This community is the biggest thing I miss about reddit. I still try to go to tripsit IRC to chat with people even after being clean.

[0]a slang term for IV injection of a substance.

</comment><comment> 1-more I'm reasonably active on /r/stopdrinking and it's one of the most positive corners of my life. I've taken a few cats that I've met on there to their first meeting. I find /r/opiates very interesting: recovery mixed with active usage mixed with harm reduction. A very interesting scene that can definitely appeal to the active user way more than a sub with "stop" right in the title.

<comment><USER4> I'm pretty sure there is an /r/opiaterecovery or similar forum. Overall I think opiates is a good subreddit, because obviously with an addiction that strong there are going to be many people who refuse/aren't ready to quit.

I've hung out there for a few weeks, and I will say when someone posts "about to try Heroin the first time, any tips?" many of them will try to dissuade them from ever starting. And the people who post who are going through withdrawals and posting the lurid details of what life is really like as a heroin addict also serve as an indirect influence on others.

</comment></comment><comment><USER5> It seems insane to me that naloxone isn't over the counter everywhere. It's a drug with (as far as my limited reading goes) literally no potential for abuse. To be fair, it has no purpose unless you are taking opiates, but it seems the worst kind of paternalism to say that you can't have something because it makes it less dangerous to do drugs.

<comment><USER6> I suspect that the thought behind not making it available is the same line of reasoning that leads to various prohibitions on contraceptives: "if they use it, then the 'bad' behavior will increase."

<comment><USER7> You forgot to fully finish the line of reasoning: "if they use it, then the 'bad' behavior will increase, so let them die."

</comment></comment></comment><comment><USER8> I'm not sure that assisting people to treat drug overdoses themselves without medical supervision is unambiguously saving lives; many of those people would have been saved if they had sought medical treatment instead of self-aid, and I don't see any data about how many died attempting self-aid that could have been saved if they had sought medical attention.

<comment><USER9> Lots of users don't seek medical treatment because they're afraid they'll be arrested.

I know this sounds unbelievable, but it's true... I found and called in the heroin overdose of two of my friends, and not only were the paramedics very leisurely in their response (walking slowly up the stairs to get to the bedroom where my friends were unconscious), but the cops threatened to charge me with selling the heroin to my friends. I believe they were bluffing in an attempt to get me to snitch on the person who really did sell it to them, but it's apparently not unprecedented for overdose victims to be charged with possession and the people who called it in to be charged with distribution.

Thinking about that night still makes me angry. It's one of maybe three really terrible experiences I've had with police in the US. My friends both lived, though one had his heart stop completely for 1.5 minutes and had to be revived via a Naloxone shot to the chest.

<comment><USER10> What you interpreted as "leisurely" was likely "caution". Overdoses can be very dynamic and dangerous scenes, and EMS will approach carefully. Did the extra 5 seconds have any impact on your friend's outcome?

I don't know what actually happened, but your description is not correct. "A Naloxone shot to the chest" is not something that is done.

<comment><USER9> I didn't witness the Naloxone shot so I don't doubt that you're right about that, but I know he got one because the cops told us and we found the empty syringe afterward.

I really don't feel like it was caution. The cops were already at the scene. I talked to the paramedics as they entered the house. The whole thing was conducted with a total lack of urgency -- I got the impression from the cops and the paramedics that they were just pissed off to be there, tired of dealing with stupid junkie kids.

<comment><USER10> So, how do you know his heart stopped?

He got Naloxone because he overdosed on an opiate... That is not the least bit surprising...

<comment><USER9> Because the police told us! And I'm also pretty sure my friend was told the same when he was at the hospital.

I should have left the part about the paramedics out because it's not really central to what I feel is important about that story -- that our laws exist in a way that makes drug users afraid to seek medical attention. I don't mean to malign the paramedics, and perhaps my perception of their behaviour was off since it was a really traumatic night for me.

You're free to believe me or not. With regard to the Naloxone thing, I told it that way because that's just how I thought Naloxone had to be administered... I guess I've seen too many stupid movies (Pulp Fiction in this case, perhaps). If you knew the full context of what happened it might make more sense. My friends had never done heroin before and I've never around people who do it either, so I don't know anybody who carries around Naloxone.

</comment></comment></comment></comment></comment></comment><comment><USER11> link to the reddit thread regarding the article: [https://www.reddit.com/r/opiates/comments/3e2ord/the_article...](https://www.reddit.com/r/opiates/comments/3e2ord/the_article_about_us_came_out/)

</comment><comment><USER12> Saving drug user's lives? I don't believe it. The press has clearly told me multiple times that reddit is just for despicable people to be be sexist and racist.

<comment><USER13> I don't think anyone is saying that Reddit is _just_ for despicable people, but you can't deny that they're all over it.

Look at the front page right now.

<comment><USER14> > Look at the front page right now.

Not a single racist or otherwise scummy content on mine, I stick with the defaults - and I doubt /r/CoonTown etc. end up on your frontpage by accident

<comment><USER13> I should have clarified - the logged-out homepage. The one Reddit exposes to the internet at large.

There is currently a post with several thousand points: a picture of two women on the back of a garbage truck with the caption "Actual feminism." I'm not sure what that has to do with feminism, but I guess Reddit thinks women need to work seemingly "dirty" jobs before they're allowed to complain about work conditions.

But you're right, if you customize your subreddits you can avoid a lot of the scum.

<comment><USER14> > There is currently a post with several thousand points: a picture of two > women on the back of a garbage truck with the caption "Actual feminism."

I don't see any problem with the picture itself or its description. Isn't feminism after all also that women can work in previously male-dominated jobs? Challenge accomplished for these two, I dare say.

As for "dirty" jobs, well I highly respect garbage men/women, even more so when they strike in Italy again and pictures of trash-filled streets make headlines.

<comment><USER13> Women can and have been able to work those jobs for many decades.

There's a certain undertone with the word "actual" \- as if other depictions of feminism are not valid. It's just strange that it's there at all.

But whatever, words are hard.

</comment></comment></comment></comment></comment></comment><comment><USER15> What's the hacker angle on this story? It seems like a common human-interest story about someone donating their time to help others.

Is it supposed to be intellectually fascinating because it happens on an internet forum? Is that all it takes to get upvotes on HN?

<comment><USER16> It's a person who, through technology, has done something risky and enterprising to change peoples' lives. And it has interesting policy and societal facets as well. Why doesn't it "belong here", again?

<comment><USER15> _Is it supposed to be intellectually fascinating because it happens on an internet forum? Is that all it takes to get upvotes on HN?_

</comment></comment></comment><comment><USER17> I just put a script on my openwrt router to get all A dns records for reddit and iptables block them.

reddit has become the lowest common denominator of procrastination and my human side cant reasonably control itself.

I dont care anymore about all these fabricated stories and the hivemind filterbubble.

<comment><USER3> This wouldn't actually block this article or stop reddit from appearing in google searches, no? You just basically edited your host file to resolve these to 0.0.0.0 making the links dead when you follow them. If you have a way to make these links not appear in google, I would be interested to apply this to other sites, but how does this help? Legitimately interested, please expand.

<comment><USER17> It is almost eqivalent to the hostfile trick. But since switching DNS is too easy and some of my devices default to 184.108.40.206 it is not a sufficient solution.

<comment><USER17> Nope, still shows up, but cant open any reddit website.</comment></comment></comment></comment>


Machine Learning - <AUTHOR> https://www.linkedin.com/pulse/humans-ai-joining-forces-create-better-world-rahul-vishwakarma/ <comment><AUTHOR> The real power of AI isn't in replacing humans. Rather, it lies in complementing and augmenting human capabilities, not replacing them.</comment>


High Performance at Massive Scale: Lessons Learned at Facebook - <AUTHOR> http://idleprocess.wordpress.com/2009/11/24/presentation-summary-high-performance-at-massive-scale-lessons-learned-at-facebook/

<comment><USER2> Interesting quote from the article:

"Jeff also relayed an interesting philosophy from Mark Zuckerberg: 'Work fast and don't be afraid to break things.' Overall, the idea to avoid working cautiously the entire year, delivering rock-solid code, but not much of it. A corollary: if you take the entire site down, it's not the end of your career."

<comment><USER3> And apparently, don't worry about violating your user's data privacy!

I felt compelled to write this since I just received the Facebook Beacon class action lawsuit email a couple of minutes ago.

Why the downvotes?

</comment></comment><comment><USER4> More on Haystack: <http://www.facebook.com/note.php?note_id=76191543919>

<comment><USER5> The article mentions that Haystack has been open sourced but that doesn't seem to be the case yet.

<comment><USER6> A few days ago I sent a message to the FB developer that wrote the blog post about Haystack.

He told me that they are working on getting it open sourced and that it will be ready 'soon'.

</comment></comment></comment><comment><USER7> wow. they have no (ie random) partitioning - it's just brute force. i hope their "Graph-based caching and storage systems" is coming along... :o)

[edit: although, given the exponential growth they give and the factor of 4 headroom they have left, they're going to top out in about 1.5 years anyway]

<comment><AUTHOR> Yep, so basically one request can touch hundreds of servers. It's basically the opposite approach of Twitter. They aggregate the graphs on write.

<comment><USER8> Who is "They" in this case? Both a read and a write could be a "request", so I am having some trouble with the ambiguity of your last sentence. Thanks!

<comment><AUTHOR> Twitter is they.

</comment></comment></comment></comment><comment><USER9> An impressive statistic:

"In aggregate, Memcache at Facebook processes in 120M requests/sec."</comment>


Ask HN: Online Bootcamp..Suggestions please - <AUTHOR>

Hello,
I would really appreciate if hacker news community can share their thoughts over whether its a good idea to go for a online bootcamp & which of them are good?
There are just too many out there and its just becoming difficult to figure out which one to join.
About me: Employed as an Integration Analyst, currently consulting for a Fortune 500 client in Bay Area. I never recd. formal education in Computer Science and hence looking for something which helps me develop a good foundation as well.
P.S. I have tried learning myself, but didn't really succeed much because of my unstructured approach. I believe that bootcamp mentorship will be able to provide me the needed 'push' and 'direction'. <comment><USER2> Generally, boot camps don't teach CS. Probably because CS requires mathematics and abstract concepts like Turing Machines in addition to concrete vocational programming knowledge skills and ability.

</comment><comment><USER3> For web development I'd recommend Bloc.io. Full disclosure: I know the founders.

[https://www.bloc.io/](https://www.bloc.io/)

</comment><comment><USER4> I help out on freecodecamp.com they have a really good approach to learning this stuff</comment>


Kite telemetry code in Sublime package SideBarEnhancements - <AUTHOR> https://forum.sublimetext.com/t/rfc-default-package-control-channel-and-package-telemetry/30157 <comment><USER3> So this is something I'm not sure I've ever said before, but if you work for Kite, you need to quit.

Like, I get working for even exploitative companies (though I won't)--economic insecurity is definitely a thing and we all gotta eat. But you can find a job that doesn't involve literally spying on the down-low. I promise you, you can.

Abandon these jerks before they bring _you_ down with them. They've demonstrated a willingness to screw people and even if you don't really care about them screwing other people, they'll screw you too.

EDIT: Also, because it's on-topic and the post on HN seems to have gone ignored, somebody is typo-squatting `cross-env` on NPM and dumping environment variables to a Chinese server run by "HackTask", it probably deserves a signal boost: [https://twitter.com/o_cee/status/892306836199800836](https://twitter.com/o_cee/status/892306836199800836) [https://news.ycombinator.com/item?id=14901566](https://news.ycombinator.com/item?id=14901566)

<comment><USER4> This seems incredibly overblown. According to the diff, all they were collecting is time spent editing certain file extensions, along with a list of installed packages:

[https://github.com/SideBarEnhancements- org/SideBarEnhancemen...](https://github.com/SideBarEnhancements- org/SideBarEnhancements/commit/4d1d20cf7f4917cbe7dad0b3a9e8a8573162be6b#diff-01b294ac86b2009fd6c11bf4267bb0e7L65)

They're trying to figure out what languages people are actually editing on a day-to-day basis, and people here are calling for them to leave the company? Like, really?

People have been whipped up into a frenzy for data that a webapp wouldn't blink twice at collecting. But when it's installed locally it's somehow different than if we load a webapp in a browser?

I agree with you in principle, but it seems like people here didn't actually look at what was being collected. They just saw "data collection" and went absolutely nuts.

Yeah, collecting installed package names isn't really great, but it's pretty harmless, right? It's a stupid decision, but people seem to be looking for reasons to get upset.

They're not collecting filenames, and they take the sha1 hash of whatever could be personally identifiable. Why is any of this bad, or a violation of trust? They even say right in the readme that they're doing it and how to opt out: [https://github.com/SideBarEnhancements- org/SideBarEnhancemen...](https://github.com/SideBarEnhancements- org/SideBarEnhancements/commit/4d1d20cf7f4917cbe7dad0b3a9e8a8573162be6b#diff-0730bb7c2e8f9ea2438b52e419dd86c9L29)

If they made it opt-in, no one would opt-in. I understand it's a slippery slope, but is this reaction appropriate?

<comment><USER3> 1) Principle is what matters. This behavior is utterly and completely indefensible; screwing with people's private code for your whatever-nobody- cares startup is absolutely unacceptable at any level. I don't care how big your Series A round was or who your investors are, you just don't do it and you don't hide it and you don't lie about "forgetting" about it (and it should be considered a lie until proven otherwise because after the last couple weeks Adam Smith could fit in some Baghdad Bob photoshops).

2) Collecting non-bundled package names is another way to phrase "exfiltrating competitors' upcoming products." That by itself is sufficient evidence for me to want some heads.

<comment><USER4> Collecting file extensions bucketed by time plus a list of installed package names is spying on you?

I doubt they even thought of the competitor angle. I wouldn't have. Startups don't win by worrying what every new company is doing.

It wasn't a smart decision, but you're acting like they are uploading your entire source code tree. (I think someone even claimed that they were doing this at one point but was later shown to be mistaken.)

<comment><USER3> Man--I like you and I think you are a pretty awesome poster, so I'd like to go through an experiment with you. Upload the filenames of everything you've put through your editor in the last nine months. Pastebin it for me right now (and I say pastebin because _I_ sure have no idea how secure Kite's stuff is so we're gonna be assuming that it's not, yeah?). The request is totally insane, right? Even beyond the pure principle of it, if you did that for half a dozen developers we'll find something you really don't want me to know about, be it business or personal. (Ever use, say, org-mode or vimwiki?)

I'm willing to be strident because _heads on pikes_ are how you ensure this is not repeated in an amplified way. Kite might be dopey, stupid, careless, and mean instead of actively malicious. Doesn't matter. The next one will be if clear lines are not drawn.

<comment><USER4> Your posts are pretty good too! I completely agree that collecting filenames would be a blatant breach of trust. If they were doing that, I'd be the first one labeling the company as evil. But my hangup is that they didn't actually do that, and what they _did_ do seems benign.

The thing is, market forces are pretty good at settling these issues. It's an open-source plugin, so everyone can see what they're doing. If they start being naughty, people can uninstall and switch to something else. But why are we punishing them before they did anything serious, along with locking down the ability of anyone else to ever collect any kind of usage data about their plugins? Even something harmless like "time spent trying to figure out the options screen"?

I hope it doesn't seem like I'm trying to defend spyware here. Collecting metrics about your product is the first step toward improving it. The motive seems like a positive one, not a negative greedy one.

<comment><USER3> They did do something serious, is what I'm saying. Consider people who use a text editor--the same text editor they write code with!--for, say, a list of notes. I have a list of meeting notes in Markdown, for example, in a git repo. Sure, I doubt Kite is paying attention to that I met with X on Y. But I really, really don't care that they're not paying attention (because I don't know who's gonna get ahold of it next--are they keeping it, are they packaging it for resale, is their server pwned, how do I know and how do they verify). Fundamentally, I care that they stole it. The act demonstrates either ill will or negligence so grave as to substitute for ill will.

"Telemetry" and "personally identifiable and sensitive data" are very different things both morally and legally and _boy howdy_ do I have a different reaction to one or the other.

Market forces are only good at settling issues when the market participants have perfect information. Nine months of spying that somebody just happened to notice to reveal it? (Ditto the Atom thing?) The damage has already been done. "With many eyes, bugs are shallow" has a certain truth to it (although I have Heartbleed calling on line two), but nobody's auditing everything, nobody can audit everything, and the damage that can be done because nobody has that information has the potential to be both personal and very high.

<comment><USER4> Wait, sorry, I think I missed something.

 _They did do something serious, is what I 'm saying. Consider people who use a text editor--the same text editor they write code with!--for, say, a list of notes. I have a list of meeting notes in Markdown, for example, in a git repo. Sure, I doubt Kite is paying attention to that I met with X on Y. But I really, really don't care that they're not paying attention (because I don't know who's gonna get ahold of it next--are they keeping it, are they packaging it for resale, is their server pwned, how do I know and how do they verify). Fundamentally, I care that they stole it. The act demonstrates either ill will or negligence so grave as to substitute for ill will.

"Telemetry" and "personally identifiable and sensitive data" are very different things both morally and legally and boy howdy do I have a different reaction to one or the other._

If I'm reading this correctly, you're saying Kite has access to your meeting notes? How? According to the diff, they were only uploading the file extension.

If they're uploading PII (let alone the contents of code files), that's completely different, and I'd turn on them in a heartbeat. Did they do that?

<comment><USER3> What happens when the file name is "2017-02-12 - meeting with John Doe.md"?

(This is the same reason, scaled down, that people are angry and concerned about stuff like phone metadata collection.)

<comment><USER4> They split off the extension and only collect the ".md" part: [https://github.com/SideBarEnhancements- org/SideBarEnhancemen...](https://github.com/SideBarEnhancements- org/SideBarEnhancements/commit/4d1d20cf7f4917cbe7dad0b3a9e8a8573162be6b#diff-01b294ac86b2009fd6c11bf4267bb0e7L70) If it's an unrecognized extension, they set it to blank.

That's why I was so confused why people are upset.

<comment><USER3> Yup - I understand that; I looked at the code. But, and I think I expressed this poorly, I have no assurances except through forensics (i.e., having to go grovel through a bunch of code for a few frigging sidebar functions that have no reason to be sending anything anywhere in the _first_ place!), that that's _all_ they did. The breach of trust has been created and it has created a relationship (an unwitting one) that _they_ could change at will.

<comment><USER4> Yeah, after thinking it over, I agree. It also wasn't clear to me that they were trying to hide the fact that they were submitting the statistics to Kite. I thought they were being up front about it. Your reaction (and everyone else's) makes complete sense in that context. It was strange that a list of file extensions caused such uproar, but it's doubly strange that they tried to be shady about collecting it.

I guess it's best to enforce a blanket ban on this behavior. I still can't get over how dumb it was for Kite to do this. All they had to do was be open and honest about it and nobody would've cared too much. Crossing over into the realm of paid spyware is way too far.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> /u/michael0x2a on Reddit put together a nice tl;dr[1] of the story arc for those that don't want to dig through the thread.

tl;dr for that is basically:

Kite has been collecting "anonymous" data from sublime users with the _SideBarEnhancements_ plugin installed. This has been happening for atleast a year and the data collected included _activeNonBundledPackageNames_ which is basically a list of packages installed via Package Control.

It seems they were intentionally unclear about who the data was sent to and did not think to remove it from the plugin after the Atom Minimap incedent because:

 _> the truth is we didn't remember_ [2]

[1] [https://www.reddit.com/r/programming/comments/6qwtfz/kite_in...](https://www.reddit.com/r/programming/comments/6qwtfz/kite_injected_telemetry_into_the_third_most/dl0psv0/)

[2] [https://forum.sublimetext.com/t/rfc-default-package- control-...](https://forum.sublimetext.com/t/rfc-default-package-control- channel-and-package-telemetry/30157/30)

<comment><USER6> For what it's worth, we didn't remember. There was no upside to keeping it there.

<comment><USER3> Just an upside to doing it at first, was it?

I hate that we're even talking about your company and that we have to because it's a bad actor that's hurting people. Talking about what you're doing, even condemning this _ratshit_ behavior most strongly, kind of empowers your company, and your company doesn't deserve press--even bad press. Kite deserves the equivalent of an unmarked grave.

</comment></comment></comment><comment><USER7> I'd implement an industry-wide blacklist, personally. This is strike number, two? three? of this company subverting well-known packages with telemetry. Any package that is proven to be connecting to their servers should be removed, the authors should be banned, and the company should be thrown onto a list of Known Bad Actors to prevent any kind of package, add-on, or extension from ever accepting them again.

You _cannot_ fight this kind of malevolence with a finger-wag and a proposed solution that you simply _inform_ the user next time before doing it. It will become buried inside the ToS and become ignored and commonplace. Stop it now and forever, while the spotlight is on it.

<comment><USER8> Seriously. Sublime, Atom, VSCode, and every other platform that supports plugins should all be in crisis mode over the crap Kite's been caught doing.

If we can't trust that an addon we installed yesterday is safe today, their platforms just turned into gigantic malware vectors that are totally wide open.

This kind of exploitation needs to be stopped immediately.

<comment><USER9> I work on VSCode. We are aware of the possibility of bad plugins or even good plugins that go bad. The real nightmare scenario would be what's happened with some Chrome plugins, where a widely used plugin is either co-opted or bought out and becomes malicious (even worse if it disguises its maliciousness).

All of these package ecosystems are similar to NPM in that they are built on trust and community policing. This is not enough. One possible way forward is to move towards an security model more like iOS's or Androids where apps need to explicitly get the user's permission before performing potentially dangerous operations like making network requests.

I'd be interested to hear how other platforms have tried tracking these sort of concerns

<comment><USER10> Explicitly asking the user before a plugin can make a network request would be great! I don't know what "sidebar enhancements" is/was, but it doesn't sound like that would need network access.

</comment></comment></comment></comment><comment><USER11> /sarcasm Really looking forward to reading the Kite blog post this time around: "Staying Open (Still): Kite Responds To the SideBarEnhancements Issue." /sarcasm

Sorry Kite - fool us once, shame on you. Fool us twice, shame on us. There's now a 0% chance of my ever using your products or services.

<comment><USER8> Kite is plainly a bad actor. Sublime and GitHub/Atom should be taking steps to permanently remove them and the things they're infecting from their respective ecosystems

We now know of 3 different popular addons they've hijacked in various ways to snoop on code and to build up their business.

If one company is doing this, it makes me very concerned what else is going on, and what else is coming.

</comment></comment><comment><USER12> they're also obscuring who this log data is being sent to by just posting JSON to an ec2 IP address (126.96.36.199). The server tries hard to not let you know it belongs to Kite. You know someone is ashamed of what they're doing when they take efforts to mask who's doing it.

But you can see kite's own installer uses the same ip address for its telemetry: [https://github.com/kiteco/kite- installer/blob/master/ext/tel...](https://github.com/kiteco/kite- installer/blob/master/ext/telemetry/telemetry.js#L9)

<comment><USER12> It might be worth searching every release in the package_control_repo for this IP address...

[https://github.com/wbond/package_control_channel/tree/master...](https://github.com/wbond/package_control_channel/tree/master/repository)

<comment><USER13> Seems not to be included in any other file on github: [https://github.com/search?utf8=%E2%9C%93&q=%2252.52.168.91%2...](https://github.com/search?utf8=%E2%9C%93&q=%2252.52.168.91%22&type=Code)

<comment><USER14> Shouldn't this search find the kite-installer repo? The IP does not exist anymore in SideBarEnhancements but is still in this repo: [https://github.com/kiteco/kite- installer/blob/master/ext/tel...](https://github.com/kiteco/kite- installer/blob/master/ext/telemetry/telemetry.js)

</comment></comment></comment></comment><comment><USER15> Deeply concerning that this has been in place for "the better part of a year", and that they "didn't remember" about their telemetry collection - <USER2> careless have they been with the actual data, if they don't even claim to be able to keep track of gathering it?

This is a complete destruction of their narrative from last week. They'll be sorry for being caught - again - and we'll have to be on continual lookout for this kind of thing in the future. I can't wait for the floodgates to open, once major tech companies figure out that there's not enough oversight to prevent this 100% of the time: I expect more than a few projects to be bought out similarly.

</comment><comment><USER16> This is why I use Little Snitch. If there are any rogue outgoing connections, I will know about it. I am extremely selective with the connections I allow my machine to make.

<comment><USER4> So for those of us who aren't selective with the connections we allow, is it feasible to start using Little Snitch? I'd be interested in trying, but it seems like there would be dozens if not hundreds of "strange" connections that you'd have to filter through which ultimately turn out to be innocent (e.g. OS X update checks).

<comment><USER3> The first day of using Little Snitch may drive you insane. It gets better rapidly after.

<comment><USER17> How does it work with browsers? You have to allow all outgoing traffic to port 80/443 regardless of host/ip? Or be asked every time you visit a different website if you want to allow it or not?

<comment><USER18> IIRC the default ruleset allows browsers to make any connections on 80/443\. You could delete that rule and do it on a case-by-case basis, but it'd be painful.

There are probably browser extensions better suited to restricting browser connections. Maybe run LS on top of one of those so the browser can catch most of them witout making a ton of popups.

<comment><USER17> Makes sense. Thanks!

</comment></comment></comment></comment></comment></comment><comment><USER19> On the topic of tracking, you might want to check your browser extensions as well.

I discovered tracking codes inside a browser extension back in 2013, and I doubt that it would be the last one:

[https://paradite.com/2013/12/07/solved-issue-with-vglnk- all-...](https://paradite.com/2013/12/07/solved-issue-with-vglnk-all-websites- having-a-script-related-to-vglink-attached-to-the-end/)

(Ironically by visiting my blog post you are contributing to tracking by Google Analytics)

<comment><USER20> uBlock begs to differ ;-)

<comment><USER21> Grimd for the DNS blocker!

<comment><USER19> I don't know if storing a plain text log of my browsing history is a good thing or not...

[https://github.com/looterz/grimd/blob/fc327b2f2993f762c8557c...](https://github.com/looterz/grimd/blob/fc327b2f2993f762c8557c577d394960b1c82a87/handler.go#L84)

</comment></comment></comment></comment><comment><USER22> Interesting growth model by buying out developers of popular packages and add telemetry or the kite product.

You just kill all credibility on the way and you will be outlawed by maintainers etc.

We may be many but at certain bottlenecks ethics is still high and with OSS we are able to just fork packages.

As companies start to exploit developers trust we have to rethink the security model inside our IDE`s and probably move to a smartphone like sandbox model.

<comment><USER11> > Interesting growth model by buying out developers of popular packages and > add telemetry or the kite product.

Sadly, I think it's what you might call "evil genius".

</comment></comment><comment><USER23> Again? Is there no escape from these guys?

<comment><USER24> I really don't like the idea of having to wonder if the next plug- in/editor/IDE/etc I use is compromised by Kite or any other shady phone-home companies.

<comment><USER21> use vim ;]

<comment><USER24> What's stopping Kite from grabbing one of your Vim plugins and adding telemetry to it?

</comment></comment></comment></comment><comment><USER25> I just started picking up Python and was installing popular useful looking addons from Atom. Surprisingly I got some Kite installer running from a syntax highlighting package.

They seem to be very keen on paying addon developers to distribute their crapware.

</comment><comment><USER26> It looks like we need to sandbox packages and put a permissions system in place for atom/vscode/sublime. There's no reason why SideBarEnhancements needs access to the internet.

</comment><comment><USER27> The best course of action in such cases is to vote with your feet.

<comment><USER28> The question is: to where?

Is there a single IDE with plugins that has a security model in place that would prevent plugins from being taken over by nefarious asshats?

I love vim and emacs... but what's to keep them from being affected by the same thing? Who has time to read all the source code of every plugin/dependency that they use?

It's all about trust and what Kite is doing is completely destroying the network of trust in each of the communities they choose to infect.

<comment><USER29> I think the person you're replying to meant not using Kite.

<comment><USER28> What keeps Kite from taking over another package?

<comment><USER27> A failing business model.

Moreover, a valid solution doesn't have to solve _every_ problem. Abandoning Kite is already a good start.

</comment></comment></comment></comment></comment><comment><USER30> What I find most amusing about this company is that they even attempted to get away with spying on people in an justly-paranoid/vigilant industry like ours.

Like, did they not think that we wouldn't catch them in the act?

Don't try to steal from thieves.

</comment><comment><USER31> Just uninstalled the package, are there any alternatives available? I can live without it but it'd be nice if I had something to replace it with

<comment><USER32> The current version on Github is clean (telemetry removed). You can always fork it yourself, or just download the repo files and add to Sublime Text 3\Installed Packages.

If you have the .sublime-package file still, you can unzip it to that directory and modify the extension

</comment></comment><comment><USER33> I modified the Stats.py file in the SideBarEnhancements.sublime-package on my computer to remove the line that references this IP address. I also made the file read-only so it won't get updated. Does anyone know if that will take care of the issue on my computer for now?

<comment><USER34> A new version of SideBarEnhancements is out with the stats removed. You should get automatically updated the next time you restart Sublime Text or manually upgrade the package.

</comment></comment><comment><USER35> At this point I'm really thinking that Atom, Sublime et al are lost causes. If plugins makers will add their own telemetry I'll just go back to vim and be done with it.

<comment><USER36> What is there to prevent a vim plugin author from adding the same kind of features?

</comment></comment><comment><USER37> Disappointing. Kite looked like a really nice product.</comment>


The Anti-Addiction Pill That's Big Business For Drug Dealers - <AUTHOR> http://www.npr.org/blogs/money/2013/10/23/240242221/episode-391-the-anti-addiction-pill-thats-big-business-for-drug-dealers <comment><USER2> I started taking suboxone 5 months ago and it (almost literally) saved my life. Before finding out about it, I thought I was going to be stuck in a hell-hole of heroin dependence forever. You wake up one day and realize that you are completely fucked, and that there's nothing in the world to help you. Suboxone changed that. I started taking it, with no/minimal side-effects, and immediately stopped doing heroin, stopped craving heroin, stopped everything. Finally, I can live in peace without there being a short-fused time bomb just waiting to blow up inside of me.

Thanks to suboxone, I can program and think and live again.

<comment><USER3> So does this mean that the opiate addiction is still present, but satisfied by suboxone? In other words, if you stopped taking suboxone, would the heroin craving come back?

<comment><USER4> Heroin cravings never leave, it's the physical withdrawal you want to avoid.

<comment><USER5> That's extremely misleading and generally over exaggerated by anti-drug advocates. The cravings get weaker as the weeks progress and by a full year or so, they're completely gone. What remains is the _nostalgia_. You think back on the time you were doing them and remember how good you felt (while conveniently forgetting all the bad times) and you crave it like you crave something from a memory.

For me, (8 years clean) it's like remembering Christmas morning when you were a child. Now that I think about it, it's almost exactly like that. I don't crave it like a cigarette (You don't have an "urge"), instead it's like recalling a happy memory and feeling nostalgic. Why it's misleading is because the same could be said about virtually anything you can feel nostalgic about.

</comment></comment></comment></comment><comment><USER6> As an interesting aside, the company that makes Suboxone attempted to prevent generic companies from entering the market.

Apparently there have been a number of poisoning caused by children taking Suboxone tablets. What Reckitt (the maker of Suboxone) did was create a new dose in the form of a film that dissolves in your mouth. Each film came in a seal packet that was difficult for children to open.

Once the patent for Suboxone was nearing expiration, Reckitt introduced the new film dose form and pulled the tablets off the market. Once the patent expired, Reckitt asked the FDA to deny approval of any new generic forms of the tablets in the interest of public safety (in essence giving them an additional patent life as the film was a new patent).

The FDA didn't believe the risk was enough to stop generic versions of Suboxone and two new generic forms were approved earlier this year [1].

[1] [http://www.drugfree.org/join-together/government/fda- approve...](http://www.drugfree.org/join-together/government/fda-approves-two- generic-versions-of-suboxone)

</comment><comment><USER7> Suboxone has helped me beat my 6 year long opiate (heroin) addiction. It has it's own issues. I'm lucky enough to live in Australia, where it was simple to get on the program, and it costs me $5 per day (less if I pay two weeks in advance).

I'm currently on 8mg, down from 28mg a year and a half ago. Ask me anything :)

Ps. I'm writing a book based on my experiences at the moment. You can find a draft chapter here: [http://jgirvin.com/the-things-we- do.html](http://jgirvin.com/the-things-we-do.html)

</comment><comment><USER8> 'Reindeerspotting' is a good watch if anybody's interested. Subutex/Suboxone has its merits, but it's not a silver bullet.

[http://en.wikipedia.org/wiki/Reindeerspotting:_Escape_from_S...](http://en.wikipedia.org/wiki/Reindeerspotting:_Escape_from_Santaland)

</comment><comment><USER9> Only take bupenorpine if you are really addicted to heroine. Doctors who prescribe for opiate addiction are allowed only 100 patients. They(Doctors) will drag you in for needless expensive visits. I say only if you are really addicted to opiates, because I see people switching to this drug because they "think" they are addicted.

The drug is not something you want to get addicted too.

If you do end up on this drug, try to find a doctor who's not trying to make money off your misery. Might be hard?

There's two forms of bupenorpine. One has a opiate blocker (nalaxone) in it-- It is expensive. Try to get your doctor to prescribe generic bupenorpine. Once you get bupenorpine in your brain, your craving for opiates will diminish. If it dosen't you need to do the whole 12 step dance.

The high of bupenorpine wears off after a few months, so it's no panacea. Remember, you will be addicted to another drug, but at least it's legal. Try to take the smallest dose possible. The slight euphoria wears off! People don't understand that? After a few months you will be addicted to another drug. Your Doctor will become your drug dealer. The fun wears off real quick. I have no reason to lie. And yes--I'm just one person. You're not reading the results of a well done double blind study.

There's a lot of misinformation about this drug--even among the MD's who needed to take a special class in order to prescribe it.

Again, don't start it unless you've bathed your brain in opiates for a long time. A while is not a few months. Even if your hooked to the gills on smack, the media makes detox so dramatic. I've seen people scared to death, thinking they will die from withdrawal. Dying s very rare, unless you have the health of Jerry Garcia.(huge addiction, obese, and diabetic, etc). If you are realitively healthy you can taper off. This goes for Alcoholics too. You don't necessarily need to spend your last 40 grand on high priced Promices. Taper, Taper, Taper. Ten percent a day. Doctors won't tell you this because of the small chance you die--liability.

Again, don't start this drug if you can. They don't know the long term effects. If you are one of the unfortunate ones, and use bupenorpine, make the best of the situation. I have heard of peope getting off it, but they taper their dose, and have a fair amount if decipline. If you are trying to get off bupenorpine, stay off the drug recovery websites; everyone exaggerates, and the stories will just scare you.

My honest, blood written advise is Never take opiates. Especially, if you even think you have a slightly addictive personality, or biology? Don't take that free Percocet offered by you friends. I honestly feel long term opiate use, or buprenorpine use damages the pleasure centers of your brain.

Good Luck--and please save any lectures. This is just my opinion.

<comment><USER10> Delirium Tremens is no laughing matter. Most alcoholics won't get it when they go through withdrawal, but those that do will very likely die without medical treatment. With modern medical treatment, the death rate is 'merely' _" 5 to 15%"_.

I don't think most people treat alcoholism as seriously as it deserves; myself included.

<comment><USER11> Agreed in that few people treat it with the seriousness it deserves. In fact it's almost a joke for many people - "haha, I'm such an alcoholic" etc. I'm sure if they'd ever seen the real effects of alcoholism they'd think twice about throwing terms like that around.

I drink a decent amount of beer and wine so I'm pretty far from tee-total, but misusing the term "alcoholism" bugs me a great deal.

<comment><USER12> In my case it started to become obviously serious when I woke up with the shakes and needed some to feel right and stop shaking. I didn't really take it that seriously before then.

</comment></comment></comment></comment><comment><USER13> Unfortunately Subutex/Suboxone come with it own set of problems:

Detox drug is Georgia's new habit - [http://www.nytimes.com/2006/06/12/world/europe/12iht- drug.19...](http://www.nytimes.com/2006/06/12/world/europe/12iht- drug.1954947.html?pagewanted=all&_r=0)

Suboxone: The New Drug Epidemic? - [http://americannewsreport.com/nationalpainreport/suboxone- ne...](http://americannewsreport.com/nationalpainreport/suboxone-new-drug- epidemic-8821747.html)

How a nation of junkies went cold turkey - [http://www.newrepublic.com/article/113051/](http://www.newrepublic.com/article/113051/)

</comment><comment><USER6> "The government spent tens of millions of dollars developing Suboxone."

Where is this coming from? It was developed by a private company.

<comment><USER14> listen to the podcast, your answers are there, but it sort of amounts to the government having to bribe the manufacturing company to develop it (because doing so would break a ton of laws) and it is unpatented, so the company that makes it issued some pretty harsh demands.

</comment></comment><comment><USER15> Please be fully aware of the risk of precipitated withdrawal when considering taking bupe. If you're an addict, you shouldn't take it until the withdrawals hit full swing.

</comment><comment> vezzy-fnord What about ibogaine? It's a naturally occurring substance and has been used to treat addictions for all sorts of hard recreational drugs. It's also the prime drug that's always mentioned when talking about breaking addictions.

Hell, it has entire religious movements dedicated to it. It's the Lisp of drugs.

<comment><USER7> It's certainly no miracle cure, nor is it even particularly effective for a lot of addicts. Two of my aquantinces attempted it. One stayed clean afterwards for about six months, the other was back on it in weeks (he passed away a year later due to an overdose).

Of course, n=2 does not a theory make, however their experiences certainly put me off it enough to not attempt it. I'm on Suboxone ORT instead.

</comment></comment><comment><USER16> I suspect the private prison industry, some in law enforcement and politicians do not want this drug readily available. It could be significantly disruptive to their wallets and positions of power.

<comment><USER17> This is actually a really good point, and I'm glad you backed it up with concrete evidence.

</comment></comment><comment><USER18> Ibogaine treatment is the best way to get over heroin addiction (apart from strong will power of course).

<comment><USER7> I was going to write something much stronger in response to this, but I've decided this will suffice:

You are wrong, and frankly generalisations like that will get people killed.</comment></comment>


FCC Releasing Data to Support Robocall-Blocking Technologies - <AUTHOR> https://www.fcc.gov/document/fcc-releasing-data-support-robocall-blocking-technologies <comment><USER2> 1) If companies begin blocking numbers on the FCC lists, it would open an opportunity to DoS any number by generating a high number of spoofed calls to generate complaints.

2) Telemarketers are now spoofing Caller ID to come from the same area code and prefix as the called number, with a random four digits at the end. I don't see the database helping prevent these sorts of calls.

<comment><USER3> As it is now, I just don't answer any calls from numbers that are not already in my contact list. Any unknown numbers go to voice mail.

<comment><USER4> I do that too, but I also check and if they don't leave a message I block them immediately[1]. It seems harsh at first, but I've cut down the number of telemarketer calls dramatically since I started doing it.

[1] If I'm (for some reason) expecting a cold call from someone I don't know yet, I'll tend to answer them. But that's not my norm.

</comment></comment></comment><comment><USER5> Ironically, most annoying / unprofessional robocall I received recently was from the government agency (by CDC -- actually their contractor) for some sort of health related survey/interview.

I speculate this system won't block those calls...

<comment><USER6> Do you know what the topic of the survey was?

<comment><USER5> No idea. I wasn't planning to participate after seeing their persistence, with more than a few voicemails (I generally don't answer to number I don't recognize unless I'm expecting calls.) -- so I called the number back, which basically told me to leave my number and message, so I recorded the message with number to not call again.

Then, they've called me, which I told them to not call me again. (Which they've acknowledged.) Then a few days after they called me again, and I told them the same thing and she got extremely personal, telling me she's just doing her job; justifying reason they can call me despite my earlier denial because she (the attendant) was not the person who made the call earlier.

Complained to CDC via phone (which took me to the voicemail) and via their website, but I haven't received any response. I just had to conclude people involved in those surveys are highly unprofessional and incompetent, let alone not trustworthy enough for giving answer to any health related questions.

</comment></comment></comment><comment><USER7> Someone should maintain a contact file that has all those numbers in it. When a telemarketer calls you phone will show "Telemarketing is calling"!</comment>


Show HN: TechLetterApp – markdown to email service turns links into rich embeds - <AUTHOR> https://techletter.app <comment><AUTHOR> Hi HackerNews

I built TechLetterApp in 17 hours this weekend because I love writing my newsletters but I hate making screenshots, ensuring images are small enough, pasting code into carbon.now.sh, ... it's a huge time sink and super hard to get just right.

Been wanting a service that does it for me and nobody was building one. So I did

The #24hrstartup challenge was just the kick in the butt I needed.

This is gonna save me tons of time and I plan to keep adding more embeds. They're super easy to add.

For the curious, TechLetterApp is built with

        - reactbulma for layout and basic styling
        - showdown for markdown parsing
        - Zeit for hosting
        - a single AWS Lambda function for screenshots
        - an AWS API Gateway to give the Lambda a REST API
        - it uses Chrome Headless to render & screenshot pages
        - Chrome Puppeteer to drive the virtual browser
        - GraphicsMagick to resize and optimize images
        - uploads all images to S3
        - click to copyToClipboard method from a hackernoon article
        - a hack to push code into carbon.now.sh from a random gist
        - Serverless framework to drive AWS deploys and packages
        - uses CheckoutPage to collect optional $2/export payments because I didn't want to faff around with Stripe myself
        - I used https://megatags.co/ to generate social sharing tags
        - and I tried and abandoned a bunch of other libraries on the way

Truly this project is a testament to how far The Web Platform has come that a single person with a little help from the audience can build something like this in just 17 hours.

</comment>


Manipulating C++ Containers Functionally - <AUTHOR> http://yapb-soc.blogspot.com/2012/12/quick-and-easy-manipulating-c.html

<comment><USER2> I do agree that C++'s STL is sometimes too verbose.

It's important to be generic, but it'd have been great if the most common conveniences were added as well to make it pleasant to use. E.g.: erase remove idiom, count but no contains, specifying begin() and end() even when you mean the whole container, ... Anything where you need to type the variable name of your container more than once to do one operation on it.

Not just the containers and stl algorithms have that annoyance, but also the string stream operators to convert numbers to strings, this is way too verbose imho.

At least the new initializer lists make some things way more compact and convenient now :)

<comment><USER3> Fortunately with C++11 we no longer have to do the stringstream dance thanks to built-in stoi/stol string member functions: <http://en.cppreference.com/w/cpp/string/basic_string/stol>

<comment><AUTHOR> Technically, those are free functions defined on strings, not members functions of the class string.

But also: std::to_string

[http://en.cppreference.com/w/cpp/string/basic_string/to_stri...](http://en.cppreference.com/w/cpp/string/basic_string/to_string)

</comment></comment></comment><comment><USER4> I think going this way is going to turn out painful. The sort of immutable container logic that people associate with FP is against the nature of C++ and you'll be constantly bumping into other people's code, and parts of the library, that don't like it.

C++ style prefers

      for_each(xs.begin(), xs.end(), f);

to

      xs = std::transform(xs,f);

Because the first does not copy the container and its elements, which in C++ is a meaningful operation which may not be allowed for xs's elements, or may be remarkably expensive.

I thought the annoying verbosity when using the whole container with <algorithm> was fixed in C++11 like it was for for loops, but I can't find documentation to that effect. Boost's range algorithms library is still useful here:

[http://www.boost.org/doc/libs/1_52_0/libs/range/doc/html/ind...](http://www.boost.org/doc/libs/1_52_0/libs/range/doc/html/index.html)

<comment><AUTHOR> > The sort of immutable container logic that people associate with FP is > against the nature of C++...

My argument is that C++, a multi-paradigm language, benefits from not being bound to purity and that being able to mix imperative and functional code is a good thing. We aren't stuck in pure-land so we can insert IO where it needs to be, not where it propagates, but neither do we need to be stuck in state-land. Functional programming is not against the "nature" of the language, it gives us the freedom to choose.

> Because the first does not copy the container and its elements...

This is a quality of implementation detail. It would have been detrimental to the point of the article to waste time showing optimizations such as "if F is a function X to X, use the in-place version". But I assure you, my optimization testing has shown there is little difference between the code generated by this and vanilla <algorithm>. In fact, it is at times better.

[https://github.com/splinterofchaos/Pure/blob/master/samples/...](https://github.com/splinterofchaos/Pure/blob/master/samples/efficiency- fold-map.cpp)

</comment></comment><comment><USER5> I was a little bit afraid to read this one. I've glanced at some of the functional patterns in the STL — function objects, ugh — and come away shaking my head.

But despite my problems with C++ and/or the STL, I really appreciated this piece. The author seems to know his stuff pretty well, as there are references to Haskell, monoids, laziness, as well as a brief discussion of performance.

It's probably too much to hope that this will win terribly many converts, but hey, what do I know?

<comment><USER6> What's wrong with function objects? They're essentially functions with partial application.

</comment></comment><comment><USER7> I've recently discovered the delights of <algorithm>... now if I could just figure out how to bind member functions in my build environment (Solaris) I'd be a very happy man.

<comment><AUTHOR> You want either mem_fn (C++11) or mem_fun.

<http://en.cppreference.com/w/cpp/utility/functional></comment></comment>


Details on the Google AdSense/Ad Buyer Exploit - <AUTHOR> https://www.seroundtable.com/details-google-adsense-ad-buyer-exploit-24298.html <comment><AUTHOR> Techmeme summary: _Google fixes AdWords exploit that allowed advertisers to create non-clickable ads, which led to many publishers getting low cost-per- click rates_</comment>


How Richard Feynman Thought  - <AUTHOR> http://www.freakonomics.com/2011/04/08/how-richard-feynman-thought/

<comment><USER2> "It's not quite true that Feynman could not accept an idea until he had torn it apart. Rather, the idea could not yet be part of his way of thinking and looking at the world. Before an idea could contribute to that worldview, Feynman wanted to turn over the idea, to see why it was true, from any angle that he could find...In other words, he wanted to connect a new idea to what he already understood and thereby extend his understanding."

Perspective is the key to genius. Feynman wanted to understand problem from all angles and understand why something was true, not just that it merely was true. Your perspective is your answer to "Why?" (see <http://jamesthornton.com/blog/how-to-get-to-genius>). His approach resulted in a tight mental framework that enabled him to connect new ideas and build upon insights from the outside in -- breadth before depth.

</comment><comment><USER3> I'm glad this article exists.

How can a person honestly argue that another person should have spent their time elsewhere or researched in a different manner? Feynman wrote a lot about how he was forced into researching in certain methods and researching certain things, and he realized he hated it and was ineffective as a result. It wasn't until he allowed his playful, curious, and lighthearted self to come out that he really started enjoying his work and getting somewhere. Supposedly his breakthroughs in QED all began from a simple curiosity into the wobbling nature of a plate that a student one day threw into the air.

People are stimulated in different ways.

</comment><comment><USER4> Reading new things about an old topic of interest is so refreshing --- until the moment where you come across one fact which you know --- and which author got wrong. Feynman was from Far Rockaway in Queens, not Long Island, as implied by Lawrence Krauss in the first page of his book.

<http://en.wikipedia.org/wiki/Richard_Feynman></comment>