Cloudant's BigCouch is Now Open Source - <AUTHOR> http://blog.cloudant.com/cloudant-core-is-open-source

<comment><USER2> Great. The problem with proprietary infrastructure is locking yourself in to a vendor and that isn't always a safe bet. For me, that is the problem with Google AppEngine and Amazon SimpleDB. As a happy CouchDB user this makes Cloudant a contender for future projects (or even existing ones). I don't want to roll my own infrastructure, but still want the option to move away from a vendor if I ever have to.

<comment><USER3> Yes, removing lock-in makes it easier to reach buy in.

Plus, if I'm understanding right, one should be able to have the production system hosted by them, and test code, or generate data on a local system, and then use the replication feature of couchdb to push the new code NGO production when ready.... Relatively painlessly.

<comment><USER4> Correct, just replicate between standalone Couch and Cloudant seamlessly. Replication is a powerful feature of CouchDB, and we also use it internally to synchronize partitions if they diverge. It is pivotal in how we achieve our multi-datacenter capabilities, too.

</comment></comment></comment><comment><USER5> Minor gripe: Make individual apps their own repositories so other people can include them in other projects.

If you want to update mochiweb, itap, etc on couchdb and bigcouch, do you manually patch the changes into every repository? Is erlang-oauth in couchdb the same as oauth in bigcouch?

Look at riak for the Right Way™ to package Erlang apps: The main riak repository has _no_ erlang code (<http://hg.basho.com/riak/src/tip/rebar.config>). It has one dependency of riak_kv which in turn includes everything else needed (<http://hg.basho.com/riak_kv/src/tip/rebar.config>).

Learn to love the gift of rebar -- recursive dependency resolving.

<comment><USER6> For a first release I'd say this is a good thing to skip in favour of shipping :)

</comment></comment><comment><USER7> Is anyone of note using this in production? (Not hating, just curious)

<comment><USER8> Cloudant has a number of big customers who have been in production for about a year on it. Here is a page where they list a few: <https://cloudant.com/#!/company/customers>

</comment></comment><comment><USER9> This one took out one advantage Riak has compared with CouchDB.

</comment><comment><USER10> Sounds great. It this like mongodb's sharding?

<comment><USER4> as Chris said, it's more like the other systems. See <http://blog.cloudant.com/dynamo-and-couchdb-clusters> for more information on our clustering.

</comment></comment><comment><USER11> This is very cool stuff.

</comment><comment><USER3> (my iPad autocorrect is broken as I was testing international software, so forgive the typos i miss.)

Love the stuff cloudant is doing and would love to base my future projects on them, but I can't quite do so yet due to their business model. I really prefer to outsource hosting and focus on code and never have to deal with machine configuration or administration.

My issues with the business model boil down to them tying database requests and storage usage together in their packages at a ratio that probably makes sense for a lot of businesses but won't for my current project.

The current project involves a large amount of disk space that will mostly be idle...as it scales, database requests will go up, hopefully dramatically, but the disc storage will not go up very much at sly percentage wise. A doubling of traffic might result in a 1% increase in data stored.

I'd be buying one of their most expensive plans, way out of our budget right now, just to get the disk space.... Which is forcing me to look at administrating my own machines and oaring .15 a GB/month for storage. Effectively vastly cheaper than cloudant even with triple redundancy.

The other thing I need is the ability to run periodic processes, such a cron jobs, and I'm not sure of a way to do this with couchdb. This has me looking at falling back on appengine.

That's just the feedback of one potential customer, and i am continuing to look at cloudant and other hosted services to see if I can figure out a way to combine them to do what i want. For instance, i could run arbitrary python at a left over dream host account in order to handle the periodic jobs.

<comment><USER4> lzw send us an email... we can almost certainly map out something that fits your needs. email@example.com

<comment><USER3> Good to know, and I will, once I have my needs characterized sufficiently to be able to tell you what it is I need.</comment></comment></comment>


TOAST UI Editor – Markdown WYSIWYG Editor - <AUTHOR> https://github.com/nhnent/tui.editor <comment><USER2> Why do this with markdown? Github supports other [1] markup languages, many of which were designed to be edited programmatically. The format produced by such tools are not designed to be read by humans [2]. Perhaps other tools support commonmark/GFM, but not the computer editable variants listed [here][1]? But that leads to the second question: why have such tools converged so heavily on markdown?

Don't get me wrong, I love markdown, but only because it allows the author to define the formatting of their source in the way they want. Standardizing markdown is completely against to the point. If you want a standardized markup language, why not start from something well defined, that is designed to allow extension, and in fact already includes more features than markdown?

[1]: [https://github.com/github/markup#markups](https://github.com/github/markup#markups)

[2]: Markdown is harder to make ugly than html, but the OP doesn't wrap long lines, and doesn't format tables properly. They also do inline links. I've seen readme.mds in the past that numbered every entry in a list with a 1., because they know that markdown treats it all the same when rendered.</comment>


Early Stage Investors, Prepare to Write a F$$king Check - <AUTHOR> http://www.victusspiritus.com/2010/08/24/early-stage-investors-prepare-to-write-a-fking-check/ <comment><USER2> Sounds like his idea is craigslist except better?</comment>


When F00F bug hit 20 years ago, Intel reacted the same way - <AUTHOR> https://www.itwire.com/security/81328-when-f00f-bug-hit-20-years-ago,-intel-reacted-the-same-way.html <comment><USER2> This isn't surprising. Intel has established a pattern of BS'ing when confronted with their mistakes / wrongdoings. Do they think their consumers aren't smart enough to see through it? I was already leaning towards AMD's processors for my next system, and Intel's handling of this recent episode does not help their chances.

I'd say Linus feels the same: [https://lkml.org/lkml/2018/1/3/797](https://lkml.org/lkml/2018/1/3/797)

<comment><USER3> Intel (like any other who wants to run a monopoly) has been trying to evade any responsibilities in wrong-doings either within (FOOF, the 2 new vulns) or without ("inappropriate" practices against competition a couple of decades ago).

This time they got caught with THEIR poop on OUR lunch-box.

They will deny wrong-doing, they will downplay it. I wonder if these vulns are exploitable, who had prior knowledge (e.g. NSA had 20 years of abuse for MS SME), and if they patch them, what new backdoor they now got (because conspiracy nuts apart, no one burns a card unless they got a better one and they just lost control of the previous one).

<comment><USER4> Intel didn't burn this card. They got burned. By at least three different groups and an individual all at once.

What to learn from it? One thing's for sure, Intel could cut the BS when faced with bad PR. It comes across as tone-deaf, defensive, and uninspiring.

</comment></comment></comment><comment><USER5> Considering the volume of what Intel ships and the complexity of their product, it's astounding that we are reaching back 20 years when looking for a comparable situation.

<comment><USER6> The bug has existed since speculative execution was introduced, 17 years ago. A 3-year gap between world-breaking bugs isn't that exceptional (I hope!).

<comment><USER5> Even so, that's pretty good. Large software companies have disaster scale bugs many times every year.

<comment><USER7> Can you provide examples of the companies and bugs you're referring to?

<comment><USER8> Buggy is the resting state of software.

Just tracking bugs is a billion dollar industry (Atlassian, etc.)

Personally? Tonight my Firefox was rendering all images as black until I rebooted. When I press the 'stop' button after watching something on the HBO app, it doesn't stop.

[https://www.reddit.com/r/softwaregore/](https://www.reddit.com/r/softwaregore/)

These aren't hypothetical vulnerabilities that a skilled attacker could discover after years of searching (as is the case with these CPU bugs) - they're right there on the surface.

<comment><USER7> I guess we understand "disaster scale" differently.

</comment></comment></comment></comment></comment></comment><comment><USER9> F00F is probably worse in practice than the recent timing attacks. For the average user, I think even the perf hit from the workaround for the timing attack is probably not worth it.</comment>


Polio makes comeback in Venezuela after decades - <AUTHOR> https://medicalxpress.com/news/2018-06-polio-comeback-venezuela-decades.html <comment><USER2> How are people holding up over there in general?

</comment><comment><USER3> _> >Encourage the messy, incompetent toddler who really wants to do the dishes now, and over time, he'll turn into the competent 7-year-old who still wants to help._

Not to mention that they need to learn, eventually they'll need it.

<comment><USER4> I think you meant to comment here: How Children in a Maya Village Do Chores [https://news.ycombinator.com/item?id=17280710](https://news.ycombinator.com/item?id=17280710)

<comment><USER3> Yp, sorry. [https://news.ycombinator.com/item?id=17280710](https://news.ycombinator.com/item?id=17280710)

</comment></comment></comment><comment><USER5> Can't be arsed to follow this up, lacking links in the article. Does anyone know if there is a clue as to how the virus got into the country? It only circulates in very few places, I thought, and none in the Americas.

<comment><USER6> The previously last known places for polio were Afganistan, Pakistan, and Syria. These are places where Iran has a military presence. There is military cooperation between Venezuela and Iran.

<comment><USER7> AFAIK, there is no military presence of Iran in Pakistan and Afganistan. Could you share some neutral sources to back-up your claim?

</comment></comment></comment><comment><USER8> Isn't Bill Gates basically betting on this scenario not happening?

<comment><USER9> I don't think even Bill Gates was counting on something as devastating as what is happening in Venezuela at the moment. His charity needs minimally functional countries to be able to access all children.

<comment><USER8> the human development index of Venezuela is in the top half of countries world wide.

Secondly, Bill Gates was vaccinating only in countries where polio is endemic. His whole thing is once it's gone, it shouldn't come back.

<comment><USER10> > the human development index of Venezuela is in the top half of countries > world wide.

The latest UN HDI data is from 2016 - things have gone /drastically/ downhill for Venezuela since then, especially in the last 6 months.</comment></comment></comment></comment>


Interviewing programmers: coding test results. - <AUTHOR> http://www.solipsys.co.uk/Writings/TestsForProgrammers_Part_1.html <comment><AUTHOR> Please can I make a request:

If you want to try this you're welcome, but I ask:

* Please no HTML emails - it's easier to extract from plain text

* Please remember the anti-spam measure - more than one person has been caught in the spam trap.

* Please put BEGIN before and END after you code so I can auto-extract it.

I've had 20 submissions in the last few hours, so these will help a lot.

Thanks.

</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>==

EDIT: And another 10 in the last 12 minutes. Thank you to those doing as I ask - it's making things easier. I'm going off to do some work now - I'm a little concerned about what I'll come back to ... although it is interesting. As I said earlier, I'll collect submissions until there's a 48 hour gap, then I'll start processing them.

<comment><USER2> > * Please remember the anti-spam measure - more than one person has been > caught in the spam trap.

What antispam measure? Neither this page nor [http://www.solipsys.co.uk/Writings/TestsForProgrammers_Part_...](http://www.solipsys.co.uk/Writings/TestsForProgrammers_Part_1.html) says anything about spam (except this note).

<comment><USER3> Nor does <http://www.solipsys.co.uk/new/ColinWright.html?Personal> \- though I'm not sure that Colin Wright even wrote that, given I've yet to find a link to the article from the root, and the article doesn't have the author's name ...

</comment></comment></comment><comment><USER4> Thanks for this write-up RiderOfGiraffes.

I'm one of the HNers that sent in code for the test. The feedback provided by RiderOfGiraffes was useful and the follow up questions were food for thought.

At the time I'd just failed a coding test for a systems programmer role and felt pretty low, which is why I decided to take this on.

In the interview I failed, I fared well in most of the questions, apart from one set involving heavy binary maths — I pretty much forgot basic binary computation from when I did my undergrad course. Following this, it prompted me to buy "Hacker's Delight" by Henry S. Warren. It's a great read if you're into high-performance algorithms <http://amzn.com/0201914654>

I can't wait to read the next part!

</comment><comment><USER5> You're testing whether active participants on HN that volunteer to do a problem are worth talking to?

I've done tests like this in the past couple of years for everyone _responding to a job ad_ for all sorts of positions. The job ads usually include the problem(s), so I'm getting the same self-selection you are. Combining our results for a _freakonomics_ style conclusion:

 _HN readers are an order of magnitude more skilled than job ad readers._

<comment><AUTHOR> I'm not really testing them - I'm providing them with information about the tests I do, why I do them, what I do with them, and the discussions that arise from them. If you don't try it for yourself then you haven't given yourself the chance to think of the issues that I then raise in subsequent discussions.

These test aren't for everyone, they are examples of what I specifically do.

We already know that self-selected from HN already means to 0.1%.

</comment></comment><comment><AUTHOR> OK - I've had a flood of emails trying the challenge, so I'm going to delay the next post about this to let more people have a go. It's not automated so I'm dealing with it by hand, but feel free to have a go. I'll do the next posting when I've received no submissions for 48 hours.

And when I get time.

</comment><comment><USER6> What a great thing to do, RoG, really, that's a very useful thing.

Maybe a bit less trivial challenge next time ?

(though I can see how in an interview setting this would be all you might be able to do).

<comment><AUTHOR> It's not trivial till you've done it.

If it really _is_ trivial then it shouldn't take you long.

If it _isn't_ trivial then you'll learn something.

Care to try it before I publish Part II ??

<grin>

<comment><USER7> It _seems_ very trivial :/

I don't really do much C, but here's x86:

      // esi -> asciiz string
      // cl = character to remove
      // NB cl=0 won't work well ;)

      mov edi, esi
      cld
      loop1:
          lodsb      // Load the byte from [esi] into al
          cmp al, cl
           je loop1  // Skip this byte
          stosb
          or al, al
           jnz loop1

Did I miss the "gotcha"s?

edit: condensed code a bit

<comment><USER8> Please don't post the solution, people would like to think for themselves.

<comment><USER7> The worrying thing is that you're suggesting there may be people on hackernews who can't bang this out in a few seconds :/

Does it even really require much thinking? I'm not trying to be arrogant here, but it seems like a good definition of "trivial".

<comment><USER6> > The worrying thing is that you're suggesting there may be people on > hackernews who can't bang this out in a few seconds :/

My sentiment exactly.

And by the way, you do have a bug in that code.

<comment><USER7> Really? give me a clue...?

<comment><USER6> You are making some scary assumptions about the validity of that pointer...

<comment><USER7> I didn't include all the boring error checking code, I included just the 'meat' ;) If you call it with valid inputs, it produces valid outputs.

IMHO That's not a 'bug'. That's a lack of boring gruntwork error checking.

<comment><USER6> Yes, that's more or less the problem with lots of code.

I'm not saying your code is invalid or that it won't work, but 'defensive' programming says:

\- assume your input is total garbage

\- handle all correct situations correctly

\- handle all garbage gracefully or throw an error depending on what the circumstances dictate

I'm also missing the stackframe handling, but as you said, this is the 'meat', that meat needs a bit of scaffolding to work.

<comment><USER9> Defensive programming is not always the correct assumption though.

<comment><USER6> _any_ assumption is wrong, but when given the choice between two assumption (safe vs unsafe) safe is best.

I did note in my 'answer' that the problem wasn't specified fully.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> If you're interviewing and are interested in filtering out the idiots with little work on your part, <http://www.ziprecruiter.com/> may be useful. (Disclaimer. I know the people who created it. But it still is a useful piece of work reduction.)

</comment><comment><USER2> I'm really amazed at the variation I'm seeing in the solutions that just my friends are providing. One said his first try would be quadratic, and his second would require allocation; another used a strange mix of indexing and pointer arithmetic. Even those who commit to either indexing or pointer arithmetic have significant variation in their solutions.

I actually think there's a distinct _best_ solution to this problem, so it's remarkable to me that there's so much variation between people that I consider to be good programmers.

</comment><comment><USER11> That seems pretty poor. I'm a pretty crappy programmer and haven't written any C in 18 years, but despite tripping over my feet for fifteen minutes, I have a working 4 line function. I despair for what passes as a professional programmer in shops that _don't_ bother to check their people out properly..

 _Added: In the interests of "put up or shut up":<http://gist.github.com/415975> \- no idea if it's OK by today's standards but hey, it works_

<comment><USER12> The program also seems to work if, in the loop header, you replace "i <= strlen(z_terminated)" with "z_terminated[j] != 0".

I don't understand why I have to put j in the index there, rather than j-1: after the string-ending null is copied, j is incremented, right?

<comment><USER13> I don't think 'j' nor 'j-1' would make sense here. 'i' would make sense, if you also terminate the condensed string.

Maybe it would be clearer if the names of the index variables better described their purpose?

<http://gist.github.com/416298> (no peaking if you're submitting!)

I think these names make it clearer that neither "z_terminated[condensed]" nor "z_terminated[condensed - 1]" are reliable ways to find the end of the original string.

</comment></comment></comment><comment><USER14> #include <stdio.h> #include <string.h>

void condense_by_removing (char *z_terminated, char char_to_remove) { int i, index;

    		for (i = 0, index = 0; i <= strlen(z_terminated); ++i) {
    			if(z_terminated[i] != char_to_remove) {
    				z_terminated[index++] =	z_terminated[i];
    			}
    		}
    	}

    	int main ()
    	{
    		char dt[] = "Now is the winter of our discount tents";
    		condense_by_removing (dt, 'u');
    		printf ("%s\n", dt);
    	}

<comment><USER6> Points for the <= copying of the termination character :)

You do make two passes over the string (one for strlen and one for the copy loop), also you assume the compiler will optimize the caching of the return value of the strlen function, if it doesn't your performance will be horrible.

No points for posting the solution...

</comment></comment><comment><USER15> Seems simple enough (formatted a little funny due to comment quirks):

void condense_by_removing(char *z_terminated, char char_to_remove) {

        int i;
        int write_index = 0;

        for (i = 0; i < strlen(z_terminated); i++) {
            if (z_terminated[i] == char_to_remove) {
                continue;
            }

            z_terminated[write_index] = z_terminated[i];
            write_index++;
        }

        z_terminated[write_index] = '\0';
    }

<comment><USER11> You don't need all that logic in there.

      for (i = 0; i <= strlen(z_terminated); i++)
        if (z_terminated[i] != char_to_remove)
          z_terminated[write_index++] = z_terminated[i];

That even removes the need to add the \0 later on.

<comment><USER16> For extra performance, use strchr to find the first char_to_remove.

      /* Find the first character to remove */
      /* This doubles the performance when there are no
         remove characters, I assume because it uses a
         builtin and because I don't do unneeded writes. */
      src = strchr(z_terminated, char_to_remove);
      if (src == NULL)
        return;

      /* src is the position in the old string, with
           the possible characters to remove.
         dest is the end position of the new string,
           where non-removed characters are added */
      dest = src++;

      for (;;) {
        /* Skip additional remove characters */
        while (*src == char_to_remove)
          src++;

        /* Copy (including copying the terminal NUL) */
        if (! (*dest++ = *src++)) {
          /* copied a NUL - end of string */
          break;
        }
      }

</comment></comment></comment><comment><USER17> I haven't touched C in the better part of a decade but the algorithm seemed straightforward to me. I'll fake it with some pseudo-C:

<http://pastebin.com/UpLNgxKC>

Note: I read the entire thread several hours before making this attempt so my results don't represent a good lab environment. Please let me know if I made any major errors.

<comment><AUTHOR> Please email it using the instructions - I've got too many submissions to go chasing them by hand.

Thanks.

<comment><USER17> Done! Thanks for taking the time to read this. My hope in posting the pastebin link was that other commenters might chime in if they saw glaring errors.

</comment></comment></comment><comment><USER18> I'm not afraid, or proud, to admit I couldn't get past the n^2 solution until I talked it out with a friend. Guess it's time to go back and read my K&R...

</comment><comment><USER19> uh, so not a single person has mentioned memory allocation issues yet?

the pointer to the 0 terminated string could have been to a statically allocated array or memory allocated from the heap using malloc. If you just shorten the string without reallocating the memory, the extra bytes that got condensed are still marked as allocated and are wasted.

<comment><USER6> That's pretty obvious, but since that was the requirement that's what you do.

For all you know the length of the original string is kept around somewhere for future reference when the buffer is re-used, it's not uncommon for buffers used like this to be limited to some fixed size larger than the maximum expected string length + 1 for the terminating nul char, and to have a string copied in to a buffer for processing.

You're in deep trouble when you try to insert stuff into strings like that though...

The bytes that got condensed and are wasted would be wasted even worse in the way you describe, if you re-allocate the memory then you'll have to free the original one, leaving the larger portion sitting unused, instead of just a few bytes...

Sure, that could be re-used by some other call to the allocator by a different part of the program, but the most important issue here is that that was not what was specified.

Whoever spec'd it needs it like that, so that's what gets built.

</comment></comment><comment><USER20> Interesting that so many solutions posted thus far use strlen().

My C is beyond rusty, but this is what I came up with; do/while is so underappreciated these days. (HN needs a "spoiler" formatting tag, methinks. :)

      void condense_by_removing(char *z_terminated, char char_to_remove) {
          char *pos = z_terminated;
          do {
              if (*z_terminated != char_to_remove)
                  *pos++ = *z_terminated;
          } while (*z_terminated++ != 0);
      }

</comment><comment><USER21> With standard C style my solution is 12 LOC.

</comment><comment><USER22> I am curious to what the Python solution was, since the C requirement was to do it "in place".

<comment><USER23> I suppose you could first convert the string to a list of characters and use integers as a replacement for pointers. You could then modify the list in place.

<comment><USER24> I submitted the python solution. I changed the problem to accept a list. I was guessing this preserved the integrity of the problem, although I don't really know C so I couldn't be certain. I explained as much when I emailed my solution.</comment></comment></comment>


Public key pinning coming in Chrome 13 - <AUTHOR> http://www.imperialviolet.org/2011/05/04/pinning.html

<comment><USER2> Summary: the CA system is so broken that Google decided to hardcode a small list of CAs for google.com etc. "High value sites" can request the same treatment.

</comment><comment><USER3> I was excited for this until I read that user-installed root CAs are allowed to override the pinning. I suppose it's still a good development though.

<comment><USER4> Truly. Malware will just install user defined root CAs and you will be exploited that way.

<comment><USER2> Or it could just fiddle with the browser directly. Why is trusting explicitly user-supplied CAs such a bad thing?

<comment><USER5> He has the thread model backwards. If your advisary already can modify files on your computer, you have other things to worry about than SSL being compromised through the network.

The malware could just as well intercept your data _before_ it is encrypted, for example, by installing a rogue SSL library. No need for sniffing and fake certs.

</comment></comment></comment></comment><comment><USER6> I don't understand. I am sure I am missing something obvious but maybe you can help me understand.

The purpose of STS is to avoid the user accidentally going to the http address of a page instead of the https page. This is achieved by a special HTTP header that is sent from the server to the browser. The browser remembers that the server wishes to be contacted only over https, and from that moment on all network traffic from the browser to that domain will only be possible over https. No way for the user to accidentally type <http://gmail.com/>.

How is this different from a 302 location redirect header from the <http://> url to the <https://> url?

<comment><AUTHOR> An attacker that is able to MITM your traffic or poison your DNS can steal your session before you ever get to the trusted https url.

<http://www.thoughtcrime.org/software/sslstrip/>

<comment><USER6> But that is a problem with STS too. That is why google is HSTS preloading a lot of google domains in their browser (they hardcode the domains). Couldn't they just hardcode the redirect so that if the user types <http://gmail.com/> chrome replaces it with <https://gmail.com>?

<comment><AUTHOR> STS solves the problem unless the attacker has a fraudulent certificate for the domain you are reaching that is signed by a CA you trust. Presumably this is far fewer attackers than those who could manipulate your DNS or are on your local network to ARP in as a middleman. Basically, two different problems - the trust only X CA for xxx.com wouldn't ever get to come into play if someone using sslstrip simply keeps you from ever going to tls.

</comment></comment></comment></comment><comment><USER7> Why don't we make Perspectives standard and just be done with it?</comment>


Ford Dealership: You Can't Charge the Mustang Mach E at Home - <AUTHOR> https://evbite.com/ford-dealership-you-cant-charge-the-mustang-mach-e-at-home/ <comment><USER2> So the headline is kinda click-baity in that someone at a dealership WRONGLY told the author "you can't change the Mustang Mach E at home" because apparently no one at any of the many Ford dealers called had a clue what they were talking about. Still an interesting read, but you can apparently charge your Mach E at home if you get one.

"Absolutely nothing but misinformation was sold to me. You can't charge a Mustang Mach E at home, they can use Tesla Superchargers, it doesn't have enough range, a plug-in hybrid is better, ect ect. Nothing of importance because it's all, simply put, wrong."

<comment><USER3> Some car companies actually don't want you to buy certain models, believe it or not! The Chevy Bolt was hard to get a hold of because Chevy just had it in their line up for regulatory reasons - they had no interest in actually selling and servicing these cars, it was more expensive than what they'd get for the sticker price, so it was purely to meet emissions regulations on paper. Certain luxury brands _will not_ sell you the "base" model of a car because they don't actually produce them, they're just there to be on paper for marketing.

So in reading about this trouble with the Mach E, I can't help but think that it's just there to get you in to the dealership to buy the thing Ford actually wants to sell you; a Mustang GT or an F150.

</comment></comment><comment><USER4> Using a car salesman as your source of info is honestly pretty dubious for any car, especially one that the dealership isn't even going to see in person for at least a year. Ford does require dealerships to have a designated EV lead who takes some relevant training if the dealership wants to be "EV certified" by Ford. I wonder how many of these dealerships had that certification?

<comment><USER5> > Using a car salesman as your source of info is honestly pretty dubious for > any car

You could pretty much replace both instances of "car" with anything and this would be equally true.

Conversation I had years ago:

$boss: Please do $job using the new $overpricedpieceofcrap.

me: Sorry, $overpricedpieceofcrap can't do $job.

$boss: But $guy1 and $guy2 said it would do $job.

me: $boss, those guys are _salesmen_.

And suddenly $boss was enlightened.

<comment><USER6> How long did it last?

</comment></comment></comment><comment><USER7> I think this is more of the dealerships wanting to hold onto their business model, vs the Ford Company seeing which way the puck is going.

Most dealerships make most of their money from their service department. Considering most electric vehicles require much less service, this presents a very large problem.

The entire dealership model is going to get turned on it's head over the next decade.

<comment><USER8> A lot of things are. There will be a lot of job loss in these "middle men" industries.

</comment></comment><comment><USER9> This is not just Ford and there are more studies like this, both in US and in Europe.

See:

* [https://www.greentechmedia.com/articles/read/us-auto-dealers...](https://www.greentechmedia.com/articles/read/us-auto-dealerships-are-bad-at-selling-electric-vehicles-study-finds)

* [https://www.coxautoinc.com/news/overcoming-electric-vehicle-...](https://www.coxautoinc.com/news/overcoming-electric-vehicle-misconceptions-is-crucial-to-converting-consideration-to-sales/)

* [https://qz.com/1309799/car-dealers-are-erecting-barriers-for...](https://qz.com/1309799/car-dealers-are-erecting-barriers-for-electric-car-buyers/)

* [https://www.anthropocenemagazine.org/2018/05/glib-car-dealer...](https://www.anthropocenemagazine.org/2018/05/glib-car-dealers-are-a-major-obstacle-to-ev-adoption/)

* [https://www.digitaltrends.com/cool-tech/dealerships-dismiss-...](https://www.digitaltrends.com/cool-tech/dealerships-dismiss-electric-vehicles/)

So many people are quick to enumerate all the challenges Tesla faces but here's a big one for all the (currently) top 10 car makers: making their frenemy dealership networks into EV sales forces as opposed to anti-sale force.

Currently the car makers might sell a volume of sub-50k per year even with hostile dealership force, just based on the interest generated by media in general and some advertising.

But it's going to be much harder to sell 500k cars a year if your salesforce is misinformed or even lying about EV and pushing ICE cars instead.

And fixing it is not as simple as telling dealerships to change because they are not owned by car companies. Those are independent businesses with their own agenda, negotiated contracts etc. Car makers might end up having to apply a lot of carrot, which will contribute to even more losses on EV cars.

</comment><comment><USER10> Ugh, one of my pet peeves.

I love cars and cannot believe the ignorance of some salespeople. I've spoken with salespeople that knew next to nothing about the brand of car sold at their dealership.

It wouldn't take much effort to _study_ the cars a bit. Doing so would make a great difference in the buying experience. Yet it's sadly lacking, sometimes.</comment>


How Facebook is ruining sharing - <AUTHOR> http://news.cnet.com/8301-31322_3-57324406-256/how-facebook-is-ruining-sharing/ <comment><USER2> I've run into the Washington Post link a few times on something shared by a friend that I thought I wanted to read. Once I hit the social reader page, I've bailed ... every time.

<comment><USER3> You know you can hit the cancel button and it'll take you to the actual article, instead, right?

<comment><USER4> FYI, even if you click cancel it will still advertise you to your friends ("Rob uses this app" in the bottom left corner of the signup popup). Which seems pretty questionable.

I verified with two other friends--I saw both of them in the "so and so uses the app" section and neither of them had ever added the app (only "cancelled").

<comment><USER5> I hope that's just a bug.

</comment></comment></comment></comment><comment><USER6> It should really be called tracking instead of frictionless sharing. It's not the user acting, it's the sites observing/tracking the user (with consent).

<comment><USER7> Haha you're right. Maybe we should request they change the name. Imagine Zuckerberg at F8 giving a keynote on the this great new feature... "It's called Frictionless Tracking! It makes it really easy for us to collect all kinda of personal information on you which we'll keep in a file and later use to try to sell you things. The best part? We tell all your friends about everything you do! Everything from the LOLCat you just commented on to the article about genital warts you were reading on WebMD about an hour ago. How awesome is that?!"

I'm not making fun of you, I just thought it'd be funny to imagine what it would be like if companies like Facebook were just brutally honest like that.

<comment><USER8> _We tell all your friends about everything you do!_

Which, given how much they will then know about you, will introduce social pressures. "You like X, Y, and Z, why haven't you bought widget A or seen movie B yet? I thought we were friendsters!"

</comment></comment></comment><comment><USER9> This is the third time Facebook does the same mistake. Remember beacon? Remember when apps could publish anything, and when they started over publishing fb instated throttling? Just like the previous attempts they will revert this one within a few months, I m willing to bet on it. Facebook is great for growth but it lacks sophistication in the way they do sharing. Every time they hire a new platform lead, they go over the same mistakes all over again, reinventing the wheel every time.

</comment><comment><USER10> Theoretically, frictionless sharing makes a lot of sense _if_ the user gives the app explicit permission.

There is an app my friend Joel showd me called If This Then That <http://ifttt.com/> that allows apps to trigger frictionless sharing when certain actions are taken. For instance, I might want to only share songs I rate or those I 'star/favorite without the extra "are you sure" dialog.

The app maker/content owner should make it easy for me to set it up. They can create defaults but must allow me to opt out.

Because of this guardian stalking sharing app, I have deliberately never clicked any on the shared links that flooded my FB wall (past tense because I am on a FB break)

It is unfortunate that facebook actions put 'social graph' and page views before their customers. I do not blame them though, when you have 500 million people logging in almost everyday, you tend to believe you can get away with almost anything.

<comment><USER11> No. No, it doesn't make sense. I _don't care_ what my friends read - I only care what they think was good out of that. You can't just open up everybody's browser logs and call that viral.

<comment><USER10> If you re read what I said I was referring to the frictionlessness (is there a word like that) when you want to do the sharing.

I do not want to see any pop ups when I want to share. Maybe we should differentiate between frictionless sharing and automated frictionless sharing.

<comment><USER12> Think I get your point. For example, I used to have an app on facebook that shared the songs I loved on Last.fm. Those where very few, maybe 5* a year, so it made sense to auto-share them on facebook.

Edit: *Looked it up and it's more like 30 each year, ops.

<comment><USER11> Ah! Now I think I see, then - if I have a curated collection somewhere else and want it to share onto Facebook, sure - that makes sense. But you have to curate _somewhere_ ; just because some guy I went to high school read an article or listened to a song doesn't mean I want to hear about it.

<comment><USER13> I believe OoTheNigerian's point is that he likes it when the sharing functionality is rolled up into another thing that you do. Say, every time you rate a song 5 stars, or mark one as your favorite. He'd rather not get a popup asking if he also wants to share it on facebook (but have a config option which says "share my liked songs")

</comment></comment></comment></comment></comment></comment><comment><USER14> After reading this great piece (<http://blog.pinboard.in/2011/11/the_social_graph_is_neither/>) one picture comes to my mind regularly: that fb is like meeting and hanging out with your friends in a room with one way mirrors.

<comment><USER15> That goes for 90+% of all social interactions. What makes you think people want their beliefs and opinions challqenged?

<comment><USER16> I think you're misinterpreting the meaning of one-way mirror. He means that you're hanging out with your friends while being observed surreptitiously by people on the other side of the one-way mirror (a one-way mirror is reflective on one side, and see-thru on the other, often associated with police interrogation rooms)

</comment></comment></comment><comment><USER17> I learned not to click on shared articles because of this. Why the hell would I install an app to read a single article?

<comment><USER9> Because Facebook wants to lure 'serious' publishers in its platform. It has worked great for zynga and other games, but once again it will fail for 'serious stuff'. Why doesn't Facebook realize that their future lies in entertainment rathe than news?

<comment><USER18> I think the two overlap more than you think. There has always been a group of people in society whose entertainment is talking about the news, almost as a form of gossip.

With that being said, while the idea makes sense, the Facebook implementation has fallen flat.

</comment></comment></comment><comment><USER19> So, I guess I am the only one here who actually likes the new apps? Its interesting to see what people are doing, and I have found interesting articles that I wouldn't have otherwise seen.

The talk about recommendation is missing the point, making this information available to your friends in this way is not recommendation. And people don't see it in that way; I certainly don't. Explicit sharing is still treated differently by facebook, and given more emphasis. Its clear that they realise things that aren't explicitly recommended are less valuable; thats why they now show you this aggregated view of articles read.

It seems a bit weird at first. I'll admit, I initially opted out of sharing, but I'm meaning to change it back now. The 'openness' philosophy of Facebook is often a bit daunting, and they make mistakes because of it, which is worrying, but it does have its upsides as well.

</comment><comment><USER20> The whole article seems to hinge on the following line: "For every five people who authorize an app, I'd guess five will turn away..."

The author doesn't seem to have any data to back this statement up so I'd put this in the bucket with the rest of the "OMG FACEBOOK" hyperbole that I've been seeing of late.

To add in my personal experiences, I haven't added any of these apps and I'm trying not to. Since this is just a guessing game, I'd wager that the tech community and people who understand the implications of these services would be more hesitant to authorize these apps but Facebook users at large probably don't care and just click through to the article.

</comment><comment><USER21> Every time I read an article like this I wonder if there is enough demand in the real world for a new social network ...

</comment><comment><USER22> This poses an interesting question for those of us building apps - would you get more signups to your app eventually if you _didn't_ make people sign up just to view the content? Its theoretically possible that requiring people to authorize your app just to view content will annoy enough people that you'll end up getting lower signups. And of course, the reason for requiring or not requiring authorization is in most cases to get signups.

<comment><USER23> These authorisations might be acting as a filter. Being an app developer and someone who's read a lot about FB, I'm very wary of authorising anything, whereas someone who's less informed won't give it a second thought.

Basically, these filters are only funnelling people to the website who are more likely to click on ads and fall for scams.

</comment></comment><comment><USER24> I know this puts me in the minority of the HN crowd.. but I really don't care. I click the allow button and get on with my life.

<comment><USER25> So, you only read the most non-controversial articles and you don't have private information that you'd rather not share with your community, about the links you've visited? Do you put your browser history in a public area? Please don't make the assumption that everyone is living an open life or doesn't want their 'friends' (work colleagues, extended family) to know every aspect of their online personality.

<comment><USER24> >So, you only read the most non-controversial articles

I don't frankly give two craps if someone knows what public news articles I read. Why would you?

>...about the links you've visited? Do you put your browser history in a public area?

Except that's not what's happening here. So.. your point was what?

</comment></comment></comment><comment><USER26> Here are some statistics by FT how seamless sharing is affecting newspaper top stories: [http://blogs.ft.com/fttechhub/2011/11/unexpected-impact- face...](http://blogs.ft.com/fttechhub/2011/11/unexpected-impact-facebook- newspaper-sites/)

</comment><comment><USER27> I think Molly could fairly blame the apps and not Facebook. This flow (prompting for permission before a user accesses your app) is completely optional. You can still use the new graph APIs and not do this.

In my opinion, this flow makes a lot of sense when the page the user lands on is going to be completely uninteresting without their info. For example, if the page is going to show you a visualization of your friends' birthdays. However, I think it's overkill if you're just using it to grab permission to auto-share what they do.

The apps can choose... I think these apps are choosing incorrectly.

</comment><comment><USER28> IMHO, the WaPo's Social Reader is interesting because it effectively reinvented a product the Post already had — Trove — in a way that was more effective.

What I think will happen is that Facebook will double back in a couple of months and refine what becomes frictionless and what gets friction. If they find ways to make "frictionless" a little less invasive, it becomes a more- useful tool. Saw a mention of ifttt in the thread … Facebook needs to do a bit of that.

</comment><comment><USER5> Something I'm starting to notice is I'm spending less time actually browsing Facebook. I still check my notifications several times a day to see if anything pertains to me, but I don't scroll through my newsfeed or peoples' pages as much. I log in, check messages, respond, and dip out.

If they start to spam the notifications too, it's over. (Nick read a story on Washington Post that we think you would like!)

<comment><USER29> I'm done. Just deleted all my content that is not fed via twitter anyway. I hadn't logged in for weeks and this was the last straw.

</comment></comment><comment><USER30> You can turn off all that bullshit. I had no idea what the OP was talking about because I have always had it turned off. I'm not sure the exact setting (they seem to always change the wording), but I logged in and in privacy settings for Apps, Games and Websites I have "You have turned off all platform apps, games and websites.". I have no instant personalization and I don't see anyone else's. I've also hidden pretty much every app from appearing in my feed, so all the game/poll notices aren't there either.

I also use Facebook Disconnect, which works to get out all the widget clutter.

[https://chrome.google.com/webstore/detail/ejpepffjfmamnambag...](https://chrome.google.com/webstore/detail/ejpepffjfmamnambagiibghpglaidiec)

It's crazy that you have to go to such lengths to not be harassed, but at least those lengths are there. That Facebook keeps making the same mistakes is a good sign that as a whole they just don't get it. It should prove interesting how it all shakes down.

</comment><comment><USER31> What is worse is that even if you don't have the app and if you share something from say The Guardian, Facebook will take readers to install that app. I tried adding the link in a comment, again the same.

</comment><comment><USER32> I've been blocking these apps as they appear in my news feed. I have no interest in finding out what stories my friends were tricked into sharing.

</comment><comment><USER33> Don't think anyone has mentioned here that the Yahoo news app is a lot worse as it also wants access to your email address.

</comment><comment><USER34> Actually I've never seen one of these. Maybe my friends are less annoying than this woman's?

</comment><comment> brown9-2 Am I missing something, or can't you simply not give these apps permission?

</comment><comment><USER7> So is this a growing pain or a sign that Facebook will soon fall? This reminds me of back when search engines were just full of keyword stuffing related spam or when MySpace turned into a hangout for creeps and everyone's profile looked like a GeoCities site from 1997.

Frictionless sharing is good in theory but the execution is annoying and the posts it generates are not relevant to you more often than not. The way I see it they can go in one of two directions: they can tell the collective user base to suck a fat one and "get used to it, you'll learn to like it" or they can modify frictionless sharing in a way that decreases annoyances like app installs and only shows you stuff that's relevant to what you want to see. That way they can move forward with this cool idea and just perfect it instead of back pedaling and looking somewhat bad.

Facebook already has the capability to do so much more than what it seems on the face of it. I wish I remembered the link but they have this piece of JavaScript that can show you who you've been Facebook stalking. To me that's impressive, maybe I'm kind of an a,after for thinking that way. The point is that they have the tools and the skill to. Perfect the frictionless system just like Google was able to rid itself of spam for the most part and become known as the one search engine that provided truly relevant results. Let's hope they go that way. I don't really like Facebook but I wish them success anyway.

<comment><USER25> The Guardian link situation is scaring some of my non-tech friends who have no idea what is happening, and why their read links are showing up for the rest of the us to read. That and the fact that more spam is showing up (a male friend was embarrassed last week when it showed a pornographic link on his page, though perhaps his wife was more embarrassed and none of them knew how to make it go away so I flagged it for them). I feel I've become something of a watcher on my friend's pages lately and providing advice on how to protect them - I've even gone so far as to create a fake account so I can monitor for them what is public and what isn't (they take comfort in my screenshots that their posts are actually private). It really is getting to the point where facebook has to address this properly or many of us are going to bail.

</comment></comment><comment><USER35> Everyone is entitled to their opinion, including the CNET author. As for myself, the only friction I see in sharing is Facebook itself. Beyond collecting a useful list of email addresses of people I know, they are not providing a service that I need, they are just a man in the middle, intercepting everything they can.

Given the ability to forgo having to let users opt-in (what they see as "friction"), what would Facebook do? I think it's obvious. In that regard they are no different than any spammer.

In my opinion, Facebook apps offer much more to Facebook (as they acquire an often elusive opt-in) than they do to the user. The user associates the use of the app with their friend rather than Facebook and the app developer. In this way Facebook gains the user's trust.

It's not much different than dangerous email attachments. Same old trick. Give it any name you want.

</comment><comment><USER36> I find it ironic to see all the social media buttons on a page criticising social media.

<comment><USER37> How is it ironic when that is what the article is in favour of over the passive sharing of Facebook's Open Graph? The critique isn't of social media, but the invasive nature of these new passive sharing posts.</comment></comment>


Syncing Up Your Credit Cards - <AUTHOR> http://www.avc.com/a_vc/2011/07/syncing-up-your-credit-cards.html <comment><USER2> This article seems like something from a content farm, yet it's from avc.com.</comment>


The last day of linotype at the NYT (1978) [video] - <AUTHOR> https://vimeo.com/127605643 <comment><USER2> I restored a small scale letterpress several years ago.

That gave way to learning about hot metal typesetting, manual typesetting, and other essentially abandoned technologies and skills.

I also got to volunteer at a local university library [0] that has a fully functional print shop to learn the necessary skills to manually typeset. Needing several parts, I got to visit a collector who had amassed a warehouse of type, typesetting materials, presses, and parts. Here are some photos [1] [2] [3]

Linotype, and this video, represent the pinnacle of mechanical automation for printing. It took over 500 years to go from Gutenberg to the recording of this video, but only a couple of years to go from the invention of the microchip to digital typesetting. What a great reminder of the transforming power of computers!

[0] - [http://www.uky.edu/Libraries/KLP/tour/](http://www.uky.edu/Libraries/KLP/tour/)

[1] - [https://www.instagram.com/p/KSZCKGiPrAy_zXgJslBGhi6rRHkpSu1d...](https://www.instagram.com/p/KSZCKGiPrAy_zXgJslBGhi6rRHkpSu1de4xcU0/)

[2] - [https://www.instagram.com/p/KSZnFWCPrUTwdRHmwz6hrf_hQzmuWnD5...](https://www.instagram.com/p/KSZnFWCPrUTwdRHmwz6hrf_hQzmuWnD5TnFYs0/)

[3] - [https://www.instagram.com/p/KSaKYciPrhndq1LVqk1S-iQBvX60FNPD...](https://www.instagram.com/p/KSaKYciPrhndq1LVqk1S-iQBvX60FNPDZKx1M0/)

<comment><USER3> Your Instagram links aren't working.

<comment><USER2> Sorry, here they are on Imgur - [https://imgur.com/a/Gh7PYp0](https://imgur.com/a/Gh7PYp0)

</comment></comment></comment><comment><USER3> What always amazes me about this video is how on-board the workforce was with the change -- it was an era of stronger unions, which ensured they'd all keep their jobs for life and be trained to use the new tools, so of course they embraced the new way of doing things.

[https://timesmachine.nytimes.com/timesmachine/1974/07/29/797...](https://timesmachine.nytimes.com/timesmachine/1974/07/29/79709965.html?pageNumber=1)

<comment><USER4> My father ran a small-town newspaper and tells me that the printers unions were very strong. When he finally did away with the linotype machines, the operators were guaranteed lifetime employment. When my father finally retired decades later, he still had some of the original linotype operators doing what he called make-work jobs. Many of these operators were never able to pick up the new required skills, but he had to find something for them to do because of the union contract. Not a good situation for anyone.

<comment><USER5> I mean it sounds like an alright situation in a country without any form of proper safety net.

It's definitely not ideal, but it's something.

<comment><USER6> The United States has a perfectly capable social safety net.[0]

It makes no sense to employ people unproductively. If you believe that your work should have meaning, this would be the ultimate insult.

[0] [https://en.wikipedia.org/wiki/Social_programs_in_the_United_...](https://en.wikipedia.org/wiki/Social_programs_in_the_United_States)

</comment></comment></comment></comment><comment><USER7> At 14:40: "All the knowledge I've acquired over these 26 years is all locked in a little box called the computer. And, I think, probably most jobs will end up the same way."

<comment><USER8> [https://www.youtube.com/watch?v=JOM5_V5jLAs](https://www.youtube.com/watch?v=JOM5_V5jLAs) (this talk also mentions linotype).

</comment></comment><comment><USER9> The Times's resident historian, David Dunlap, wrote about this wonderful film in 2014: [https://www.nytimes.com/times- insider/2014/11/13/1978-farewe...](https://www.nytimes.com/times- insider/2014/11/13/1978-farewell-etaoin-shrdlu/)

</comment><comment><USER10> As someone who spent the weekend figuring out `flexbox' to align copy around a webpage, after years of floating divs and pulling my hair out, I can appreciate this video. Creative destruction is an awe-inspiring, yet wistful force of nature.

<comment><USER11> I think it's great to see why web is the way it is. These people were the web devs of their days desiging lead based layouts. Imagine having to roll back a change mid print.

</comment></comment><comment><USER12> Guess because I've reached a certain age I remember things like rotary dial phones, vacuum tubes and linotype machines. Until quite recently here in Michigan we still had one weekly paper with handset type.

The last linotype operator retired from the New York Times after fifty years in 2016:

[https://www.nytimes.com/2016/06/02/insider/1966-2016-the- las...](https://www.nytimes.com/2016/06/02/insider/1966-2016-the-last-hot- type-printer-puts-down-his-tools.html)

<comment><USER13> There is an interesting period video that explained the mechanical inter- workings of a Linotype machine available.

[https://www.youtube.com/watch?v=gRHOPmGUtPA](https://www.youtube.com/watch?v=gRHOPmGUtPA)

<comment><USER14> A more detailed one is [1].

The amazing thing about Linotypes is how little they changed through their century long life. One would have expected a few generations of the hardware - machines becoming more compact and simpler. But no. There were various models, but the basic form didn't change.

[1] [https://archive.org/details/0066_Typesetting_Linotype_02_25_...](https://archive.org/details/0066_Typesetting_Linotype_02_25_45_00)

<comment><USER15> A great many systems and designs reach stability relatively early on. Particularly for mechanical systems.

Computers are something of an exceeption so far as _scale_ goes, what with Moore's law, though other principles are vastly more durable.

(x86 architecture, Unix, core memory, von Neumann / Turing machines, Boolean logic.)

In mechanical systems, it's often some particular breakthrough somewhere which makes for changes. In the case of printing, the period from about 1780 -1920 was profound: from wooden "wine press" designs of perhaps 60-120 impressions/hr to electrically-powered, steel-framed, web-fed, linotype-set, offset-press based systems running 1,000,000 impressions/hr.

</comment></comment></comment></comment><comment><USER16> My favourite is how they could set spaces that were springs that would adjust to the width of the column.

</comment><comment><USER17> I was fortunate enough to have a school field trip to the NY Times in the 70's. If you were a nerdy kid the word "shrdlu" showed up a few times, mostly in PBS documentaries about AI, as it was at the time. If you grew up in the tri-state area, everything important was on Channel 13. Except for Star Trek which had moved into syndication by that time.

[https://www.youtube.com/watch?v=QAJz4YKUwqw](https://www.youtube.com/watch?v=QAJz4YKUwqw)

<comment><USER18> SHRDLU was a natural language interface program by Terry Winograd at MIT.

[https://en.wikipedia.org/wiki/SHRDLU](https://en.wikipedia.org/wiki/SHRDLU)

</comment></comment><comment><USER19> On the one hand, it's fascinating to see how (overly) complicated the process of printing used to be. On the other hand, it looks much simpler now because we gloss over all the complexity in the silicon. Back then there were thousands of components, today there are billions and they all operate at millions or billions of actions per second. But it all happens inside tiny little packages about the size of a sugar cube.

</comment><comment><USER20> This is extremely cool, although it's a little unnerving to see people working with so much lead with bare hands, especially considering a lot of them had the job for decades. Was lead poisoning an occupational hazard among typesetters?

<comment><USER21> Solid lead is not really a problem if you wash your hands before eating after handling it because it doesn't absorb through the skin. Whether or not these people actually did that, I have no idea. But to this day there's still plenty of solid lead stuff that hasn't been banned: fishing weights, bullets, etc. The main causes of lead poisoning back in the day were all from inhalation: soldering results in inhaling lead fumes, machining/sanding lead resulted in inhaling lead dust, exhaust from cars using leaded gas (this was the big one that affected basically everyone), etc.

<comment><USER22> The amount of lead fumes you'll inhale from soldering is minimal -- the temperature at which the work is done is almost always below the temperature at which the lead will vaporize. See [https://diamondenv.wordpress.com/2011/01/06/lead-exposure- du...](https://diamondenv.wordpress.com/2011/01/06/lead-exposure-during- soldering/) \-- low-temperature melting of lead (below 500 degrees Celsius) "is not liable to result in significant exposure to lead".

<comment><USER23> There is no safe amount of lead.

</comment></comment></comment></comment><comment><USER24> Thank you, great video!

This 30 minute movie from 1960 explaining mechanical typesetting is absolutely fascinating if you're curious: [https://www.youtube.com/watch?v=EzilaRwoMus](https://www.youtube.com/watch?v=EzilaRwoMus)

</comment><comment><USER2> Anyone interested in Linotype would greatly enjoy Linotype: The Film [0], a full length documentary that interviews several of the people that made this film.

[0] - [https://vimeo.com/15032988](https://vimeo.com/15032988)

<comment><USER25> Link is to a trailer, not the actual film. The actual film is at [https://shop.linotypefilm.com/](https://shop.linotypefilm.com/) and is $20 for blu-ray or $8 on itunes or $8 on amazon video.

I loved the movie Helvetica, I'm sure I'll love Linotype!

</comment></comment><comment><USER26> Look at the computers that replaced them and then imagine how often those have been replaced since then. Of course they did get less expensive pretty quickly (and I'm sure that even though the guy who invented the linotype could sit down at that machine and use it, that doesn't mean those are the _same_ machines from when the NYT started using linotype, which was my initial silly assumption)

</comment><comment><USER27> I'm somewhat fascinated by the technical aspects of the videography here. Solid chunks of color "shimmer" as though random noise was added by a digital sensor. Then there are lines, presumably on the original film, that appear light green instead of white. I can't think of anything to account for either of these effects.

<comment><USER28> Film scratches are not all equal. Some scratches would go all the way through the emulsion resulting in solid white or black lines depending on if it was a print or a negative. However, if the scratch as not that deep, then the scratch would have a color tint depending on its depth.

Maybe this is what you are seeing? If you provide a time reference to a specific example, I can take a look to see if that matches what I'm describing. I used to work in film post in transferring and restoration. The restoration software is pretty magical. The scanning software/hardware has also come a long way, but the really nice equipment is still $150k-$250k(US) depending on the options.

<comment><USER27> 2:37 is one. There are others that are green in dark areas and pink in light areas, however. That's what's so weird about it.

I will think more but scratching the emulsion only partially sounds like a really good explanation to me. Where the image is dark, though, there should be very little dye left in the emulsion, so I'm not 100% convinced. Still thinking about it though :)

</comment></comment></comment><comment><USER28> I wonder how many Quark users would dream of going back to the manual ways? Quark is still my number one of "least favorite to use programs". I could just never think the way Quark wanted me to thing. I took to PageMaker in a heartbeat, but just never got Quark.

<comment><USER29> Quark 4 was definitely full of quirks and there were plenty of things it just couldn't do. It featured decent keyboard shortcuts, though, which I once relied on daily for newspaper layout — and which proved quite difficult to teach to my successor as, ultimately, I knew them only by feel!

</comment></comment><comment><USER30> Sigh, almost makes you wish for the days when it really cost something to publish words, and not every moron with a wifi connection could tweet to the world one more banal opinion adding to the noise saturating everyone's attention spans.

<comment><USER31> This is a very interesting observation. The decrease in the difficulty of publishing vastly increased the noise. I think I understood that this was happening but hadn't consciously made the connection.

</comment></comment><comment><USER32> "Headlines are still set by hand."

I now understand where the word "typesetting" comes from.

<comment><USER33> Alot of font terms comes from that time, like leading and kerning: [https://en.wikipedia.org/wiki/Kerning](https://en.wikipedia.org/wiki/Kerning)

<comment><USER2> Interestingly, the term "font" itself came from the fact that typefaces were cast.

"Font" originally described a size, weight, and face. It no longer includes a concept of size, because digital typesetting allows sizes to be changed so easily. What we refer to as a "font" today was originally referred to as a "typeface," that is, the general style of the lettering.

<comment><USER34> This explains too how sometimes you see a list of _every combination of every "font"_ in a list and other times you see every font and can configure them.

Likely some confusion around this in the documentation and in programmers who implement these features.

</comment></comment></comment></comment><comment><USER35> Wow, I saw one of these at the Bristol Industrial Museum. A very impressive piece of kit.

</comment><comment><USER36> Are there any PDF's available of this last manual typeset edition of the NYT for viewing online?

<comment><USER37> Apparently[1] it was the July 1, 1978 edition: [https://timesmachine.nytimes.com/timesmachine/1978/07/01/iss...](https://timesmachine.nytimes.com/timesmachine/1978/07/01/issue.html) (NYT subscription reqd)

1\. [https://www.nytimes.com/times- insider/2014/11/13/1978-farewe...](https://www.nytimes.com/times- insider/2014/11/13/1978-farewell-etaoin-shrdlu/)

<comment><USER38> It's actually July 2nd 1978, which was produced the night of July 1st.

[https://timesmachine.nytimes.com/timesmachine/1978/07/02/iss...](https://timesmachine.nytimes.com/timesmachine/1978/07/02/issue.html)

<comment><USER39> After about the 11 minute mark the footage shows them working on the front page of the July 1 issue. Looks like they didn't shoot it all in one evening.

</comment></comment></comment></comment><comment><USER23> Curious to know how the photos got turned into casts. Does anyone know?

<comment><USER40> Photoengraving: [https://en.wikipedia.org/wiki/Photoengraving](https://en.wikipedia.org/wiki/Photoengraving)

</comment></comment><comment><USER41> This is a great docu, too bad there is no download button in vimeo.

<comment><USER42> [https://rg3.github.io/youtube-dl/](https://rg3.github.io/youtube-dl/)</comment></comment>


List of Y Combinator companies I have worked with (hacked) - <AUTHOR> https://introvertmac.wordpress.com/2015/10/28/list-of-y-combinator-companies-i-have-hacked/ <comment><USER2> Mildly off topic but I don't care: I'll never forget the time I was invited as an early developer for the Palm Pre. At the time Palm's website was horrendously bad security and usability wise.

While waiting for their website to accept my upload I was poking around and decided to see what I could get into. I found that the addresses were something like /user/<sequential id> so I wondered "could I look at another user's page by changing the ID? Na, no way that would work"...but it did work. In fact I was able to see and theoretically control app submissions for all 500 developers at the time. This set of pages even included tax IDs.

So I immediately went to Palm and told them about the issue and how to reproduce. After about two weeks they finally reported that the issue was fixed...except it wasn't. What they did was change the way the pages were accessed from a standard GET with the ID in the URL to using JavaScript to accomplish the same thing but kinda sorta hide the ID (so basically fetch content via JavaScript versus page loading via direct browsing). So naturally I was able to change the ID and still get in.

It would take them another month to finally fix this issue. I was never able to convince them to let developers know their tax IDs may have been exposed along with all of their other information. I did get a special mention in one of their release notes but they spelled my name wrong :(

<comment><AUTHOR> What you found is called IDOR [https://www.owasp.org/index.php/Top_10_2010-A4-Insecure_Dire...](https://www.owasp.org/index.php/Top_10_2010-A4-Insecure_Direct_Object_References)

<comment><USER3> I have yelled at people for this for years. I thrilled to know it has a name. This is why the URL pages on delicious were md5'd and not the raw url_id.

<comment><AUTHOR> Glad, I helped you in finding a name

<comment><USER3> [http://joshua.schachter.org/2007/01/autoincrement](http://joshua.schachter.org/2007/01/autoincrement)

</comment></comment></comment></comment></comment><comment><USER4> I signed up for the Firebase beta in February 2013 using a unique email address and got a phishing mail to that address in September 2013.

I reported this fact to email@example.com but never got a reply. I guess they preferred to sweep the theft of their customer database under the carpet.

<comment><USER5> We once used a third-party service (the name eludes me now) to handle our customer mailing list, and of course they got hacked, so everyone who used unique email address + extensions blamed us for selling their addresses to spammers. They only acknowledged the hack in a "we're investigating this"-type blog post, and 6 months laters they revamped their blog and the post mysteriously disappeared...

<comment><USER6> _> We once used a third-party service ... they got hacked ... [people] blamed us for ..._

From my point of view as a client, I don't care that the problem was with one of your suppliers: my relationship is with you no them, I trusted you with my information not them, and so forth. Unless you gave your users a choice about whether their information went to that third party then from your user's point of view it _is_ your fault - there was nothing they could do to prevent the problem (other than not use your service).

I know it is not realistic to expect you to fully vet the security of all third parties and take full responsibility for any failures of them as no amount of due diligence will protect against every eventuality, hence I use the "unique email address" approach and take other care when handing out personal details that are less easy to fake (phone numbers, details needed for payment processing, ...), but it is also not realistic to disavow yourself of responsibility when something like that does go wrong at a supplier. You chose to trust that service, not your users. You put your users information in a position of being out of your (and their) control.

</comment></comment></comment><comment><USER7> This is awesome, and exactly the right way to go about things (reporting things privately, telling people when there's a good outcome). It's good to see so many HN companies handling their side of the issues so well too.

EDIT: Just for curiosity's sake, how many HN companies have you _tried_ to hack? 24 successes (not counting HN as a company) out of every company that's been through the accelerator would indicate HN companies are unusually good at websec. Conversely, if you've only tried to hack 24 and you've had 24 successes, that would indicate _something else_.

<comment><USER8> Shame to see them being so thrifty about rewards though. At least the ones that could well afford better.

(Or maybe he explicitly asked only for t-shirts?)

<comment><AUTHOR> Yes, I wrote. I was a jerk. Now when I do have 60+ i don't even care.

<comment><AUTHOR> BTW "when you are good at something, never do it for free". So I don't ask for T-shirt, only work for paid work.

</comment></comment></comment></comment><comment><USER9> Dear %username%, thanks for reporting this critical security vulnerability, affecting our multi-million business.

Do you want a T-shirt?

<comment><AUTHOR> Haha, for what ?

<comment><AUTHOR> yes, that's the issue. They think their T-shirts worth the time and efforts we spend in finding the bugs

<comment><USER10> Well, they also put your name on their "thank you" page _and_ sent you a nice email! What else could you possibly want?

It might be a multi-million dollar business, but it's not like these hacks can actually cost them millions of dollars. Verizon has had employees giving out personal details to people on the phone for years, and they're still happy to do it even for the director of the CIA: [https://www.schneier.com/blog/archives/2015/10/the_doxing_tr...](https://www.schneier.com/blog/archives/2015/10/the_doxing_tren.html)

<comment><AUTHOR> True, but people do have bills to pay. So this can't be a full time thing.

<comment><USER10> I think Schneier is arguing that if companies were liable for their disregard of even minimal security standards, they might pay you more to help finding vulnerabilities.

</comment></comment></comment></comment></comment></comment><comment><USER11> I did my first conference talk[0] on this, and also have a similar list.

Security consulting is expensive and the value just isn't there at all for early stage companies. It's why I think Owasp top 10 should be required reading for founders.

As for my conference talk, the delivery was atrocious (warning if you choose to watch). I spent 5 minutes per startup and churned through hundreds. I didn't name names because there were too many bugs to report after a day or two of doing it.

[0] - [https://www.youtube.com/watch?v=wzrVYyouQTk](https://www.youtube.com/watch?v=wzrVYyouQTk)

<comment><USER12> I agree with you that early stage companies generally do not have much utility in security consulting due to its expense, but unfortunately "crowdsourced security" is not yet a viable replacement.

Once a company has enough funding that it has left the "early stage" point, there is almost no reason not to engage with security firms. This doesn't mean pay a firm $20,000 for a week or two of work, it means find the highest quality you can afford.

My own firm works with YC companies all the time and they are generally very happy with the work I do. I think it really comes down to what you offer. If you charge an unreasonable amount, have pushy salespeople, inflate the findings in your report or just view your job as handing off a report and demanding a bill, you're doing it wrong and not contributing value.

On the other hand, fairly priced security consulting with an eye towards developer education and working with the company to resolve their vulnerabilities contributes a lot of value. More security firms should try to help companies improve their security in the SDLC.

I do hope crowdsourcing security improves. I think it could be better, but it isn't yet. The results in my experience are mixed - for every bounty hunter who finds vulnerabilities you have another nine who just spam for pity findings on Hackerone and Bugcrowd. Most of the successful bounty hunters eventually just open up their own consulting shops or take very lucrative jobs with top companies like Google or Facebook.

I do wish there was a middle ground. I don't think it's fair for security consultants to work for free (which very often happens with bug bounties, even if they are very good). However, I really don't like how inflated the pricing has become at the largest security firms, which appears to be a side effect of having account managers, project managers, salespeople, "solutions architects" and finally the consultants themselves on each engagement.

<comment><AUTHOR> Can't agree more on this. YC companies are best, but yes sometime startups don't want to pay some random guy for one/two bug.

</comment></comment></comment><comment><USER13> TIL what a homograph attack is. [1] Thanks.

1\. [https://en.wikipedia.org/wiki/IDN_homograph_attack](https://en.wikipedia.org/wiki/IDN_homograph_attack)

<comment><AUTHOR> you got it :)

</comment></comment><comment><USER14> I looked at your nod on the HN page: [https://news.ycombinator.com/security.html](https://news.ycombinator.com/security.html)

>The site name display for stories was vulnerable to an IDN homograph attack.

How is that sort of thing mitigated?

<comment><USER15> Either block them entirely or use Punycode[1] when displaying IDNs.

[1]: [https://en.wikipedia.org/wiki/Punycode](https://en.wikipedia.org/wiki/Punycode)

<comment><USER16> Yes, we now use Punycode.

</comment></comment></comment><comment><USER17> I found a bug in your page! The link to the Gitlab acknowledgements page isn't right (not sure what the correct link should be). Let me know what my bounty will be ;)

<comment><AUTHOR> haha, is that a security issue ? this is the link [https://about.gitlab.com/vulnerability- acknowledgements/](https://about.gitlab.com/vulnerability-acknowledgements/)

BTW you can have free invisible hug and a big thank you :)

<comment><USER18> Wow, you pay as well as half of these startups.

<comment><AUTHOR> haha, I don't have money because of these startups so..

</comment></comment></comment></comment><comment><USER19> Wow, I'm amazed how many companies I recognize and/or use were in YC.

<comment><AUTHOR> 800 companies got funded till date.

</comment></comment><comment><USER20> Are you Nepali/of Nepali origin? It's great to see a (possible) compatriot featured in 1st page of HN for hacking HN.

The reward does seem a bit thrifty as others have pointed out. Keep up the good work.

<comment><AUTHOR> No I'm Indian, I live a bit close to Nepal(Bihar) but am not Nepali.

<comment><USER20> Oh haha. Your surname is common one in Kathmandu and uncommon one outside the valley. I guess it's more widespread that I think lol

<comment><AUTHOR> Ya, Indians are everywhere. Nepal is our second home.

<comment><USER20> Well there are billion Indians, so it's no a surprise.

Just bring your own supplies if you are visiting and you should be alright. It's not like we can be of any help regarding that :-P

</comment></comment></comment></comment></comment><comment><USER21> Ambiguity clickbait is the best clickbait :-)

<comment><USER22> I believe you are referring to the original title: "List of Y Combinator companies I have worked with(hacked)" (I had the same feeling when I opened the page).

However, the author is a security researcher and has indeed hacked (as in, disclosed vulnerabilities) the companies in question, so I thing the title is not ambiguous.

<comment><AUTHOR> Yes, That's what I did. Thanks for understanding.

</comment></comment></comment><comment><USER23> It feels to me like you're getting a bad deal here. You responsibly disclose stuff and you get ... T-Shirts?

I hope they fit.

<comment><AUTHOR> Sometime they do, sometimes they don't :P so I make someone happy in my friends circle.

</comment></comment><comment><USER24> What kinds of vulnerabilities did you find?

<comment><AUTHOR> Security Bugs. OWASP TOP 10 mostly

<comment><USER25> Does YCombinator have someone to advise on basic security issues like this?

<comment><AUTHOR> I guess No, better ask @Sama. Hopefully you'll take my name :)</comment></comment></comment></comment>


Show HN: Coinwell - the easiest way to mine litecoins - <AUTHOR> https://coinwell.net

<comment><USER3> Logically, this must generate less income than it costs to run, otherwise the people running it would make more money mining Litecoins themselves rather than selling the service to mine them.

<comment><AUTHOR> We are also mining ourselves and now we want to grow more. In order to mine more and reduce our costs, we need users. It becomes cheaper to buy more hardware etc., hence we are providing this as a service.

</comment></comment><comment><USER4> Lets quickly do the math on this.

At the time of writing, Litecoin is at $23.50 and Bitstamp is showing Bitcoin at $821.

The cost of the lowest service is 0.75BTC pa, which works out to be $615.75 per year.

615.75/23.50 = 26.2021276596

At a rate of 0.5 MH/s, we're looking at 0.12406948 LTC a day[1] at the current network difficulty.

So, to mine 26.2021276596 LTC, it would take us 211.1891470779115 days. That came out a lot quicker than I thought it would, but still an exorbitant amount of time.

LTC is not my interest or strong point, so if there are any errors, please let me know so I can correct them.

[1] [https://www.litecoinpool.org/calc?hashrate=500&difficulty=38...](https://www.litecoinpool.org/calc?hashrate=500&difficulty=3891.34232183&power=&energycost=0.10&currency=USD)

<comment><USER5> Don't forget that the difficulty [1] will increase over time. By using the calculator [2] with only a 5% increase, zero electricity costs etc. we don't see any return at all.

[1] [http://bitcoinwisdom.com/litecoin/difficulty](http://bitcoinwisdom.com/litecoin/difficulty)

[2] [http://bitcoinwisdom.com/litecoin/calculator](http://bitcoinwisdom.com/litecoin/calculator)

<comment><USER4> Ouch. Thanks for the information.

In addition, that second link helps us work out what equivalent hardware at home we could use to accomplish a similar (non)return. Purchasing an AMD HD7970 graphics card, with a hash rate of 0.7MH/s, and mining with that could arguably be cheaper in the long run

<comment><USER6> The problem comes when you start factoring electricity and so on. In my calculation the difference is just too little. Plus you have the advantage of not investing time into it.

</comment></comment></comment></comment><comment><USER7> The interesting thing is that India has one of lowest costs for electricity.

<comment><AUTHOR> Exactly, thats why we are able to be so cheap

</comment></comment><comment><USER8> Maybe a referral program like CEX will help Coinwell out

</comment><comment><USER9> "We are a company registered in India." \-- No, thank you. Economic and political stability required.

<comment><USER6> India is not as economically and politically unstable as you think - [http://en.wikipedia.org/wiki/Economy_of_India](http://en.wikipedia.org/wiki/Economy_of_India)

Think about it, all the largest companies like IBM, Microsoft, Google, NetApp have huge campuses in India if it was unstable why would they be there?

<comment><USER10> A large company can absorb a lot more risk than an individual, or really any entity smaller than itself.

In fact, that attribute - the ability to absorb risk (and failure) is the reason why a corporation is a useful structure in the first place - <USER2> wants to take on a billion dollars in credit personally.

<comment><USER6> True, however large corporations take large risks also. When you invest in services like this its around 1000 USD. Imagine when companies are willing to take upward of 2 billion USD risk they won't do that unless they are sure.

</comment></comment></comment></comment><comment><USER11> 1.5mh/s is tiny.

<comment><AUTHOR> 1.5 MH/s is pretty fast in Litecoin mining, and we are working towards getting more capacity. From our initial estimate we found that you can earn upwards of $50 a week

</comment></comment><comment><USER8> are you running any promos? :P

<comment><AUTHOR> Thanks for the suggestions, we will consider adding a referral program. Also what do you mean by promos? like a discount on contracts?

<comment><USER8> promos for early users, to get the word out, etc. so yes, discounts.</comment></comment></comment>


The AI Games – Create a Bot for Tetris and Join the Competition - <AUTHOR> http://theaigames.com/competitions/ai-block-battle

<comment><USER2> Interesting.

I like these types of "program it and compete" things. It wasn't clear that the rules were fully fleshed out here. Some other of theses I've seen. prisoner's dilemma game: Algorithms compete. Some simple ones work very effectively. I can't find an online version.

IBM's robocode (building virtual robot tank control system, put in an arena...). I'm not sure this is still running either

Code Combat multiplayer arenas: [https://codecombat.com/play- old](https://codecombat.com/play-old)</comment>


In Pricey Cities, New Residents Make Much More Than Those Leaving - <AUTHOR> https://blogs.wsj.com/economics/2018/04/05/in-pricey-cities-new-residents-make-much-more-than-those-leaving <comment><USER2> See also:

'Socioeconomic sorting at the metropolitan level is making America more polarized' [1], linking to [2].

[1] [https://news.ycombinator.com/item?id=16776977](https://news.ycombinator.com/item?id=16776977) [2] [https://www.citylab.com/equity/2018/04/how-your-social- class...](https://www.citylab.com/equity/2018/04/how-your-social-class- affects-where-youll-move/557060/)</comment>


CPY – Code C/C++ with no redundancy - <AUTHOR> https://github.com/vrsperanza/CPY <comment><USER2> "CPY" seems to concentrate on syntax. I would not call an expressive syntax "redundant". From my perspective, redundancy in programming arises due to the lack of programming skills or a good preprocessor, especially probably in the C/C++ world where codes are more likely tailored for speed.

The problem with (essentially) replacing the C/C++ syntax with a more lightweight (pythonic) one was already mentioned here in the threads: There will be a lot of corner cases which the CPY compiler does not understand.

<comment><USER3> Redundancy in C++ chiefly arises from textual inclusion as the mechanism for communicating about the capabilities of other modules. It's not because of a bad preprocessor or programming skill.

<comment><USER2> Can you give an example of what you refer to?

In my impression, most of the redundancy in the C world comes from the header/code seperation, i.e. all the signatures are repeated. Another level of redundancy was added by C++ templates where one quickly needs to write lengthy expressions, but the newer C++ standards resolved much of that thanks to the "auto a = b" type keyword or the "use X = Y" definitions.

Note that "CPY" addresses none of these issues.

<comment><USER4> I must be one of the few that like the header/code separation. When dealing with plain text, I get a more concise view of what is going, as well as a view of what should be used by other modules.

<comment><USER5> The problem with the separation is mainly with making changes to code, not with reading the code as it currently exists.

This problem is avoided at no cost in Go, where an external tool can be used to get the same concise view of all of the function types that you like, without needing to manually create and update header files.

<comment><USER6> Writing code takes effectively no time, reading and reasoning is the primary concern (for me anyway).

</comment></comment></comment></comment></comment></comment><comment><USER7> It seems a lot of cpy features are covered by C++ and/or libraries.

For deduced types you can do

        auto a = 10;
        auto b = a;

And not have to mess with known.

For multiple return types you can do structured binding and make_tuple.

       auto [a,b] = func();

Where func is

       auto func(){return std::make_tuple(1.5, 3);}

Using a loop, you can use boost::irange

        for(auto i: irange(0,10)){

For the output stuff, you can use fmt ([https://github.com/fmtlib/fmt/blob/master/README.rst](https://github.com/fmtlib/fmt/blob/master/README.rst)) which is on track for standardization.

        fmt::print("{} {} {} ", a,b,c);

Overall most of the problems that CPY implies have pretty good solutions in C++ without the pain of another pre-processor

<comment><USER2> This is very true. It would be elegant if "CPY" compiled to these newer C++ features (or boost).

<comment><USER8> That is exactly what it does

</comment></comment></comment><comment><USER9> This suggests that large parts of C/C++ can be 'simplified', which I think is a falacy, resulting in CPY to be a proper subset of C/C++. Already the introduction of a keyword like 'known' shows that the simplification is not as simple. I suspect that many new keywords needs to be added to support the full scope of C/C++ within CPY.

<comment><USER10> If you think of cpy as high level glue code for "pure" c++ functions, this might work.

I don't like decisions like implicit << and >> for cin, cout. Too much magic for me.

<comment><USER11> Honest question, why do you consider implicit << and >> for cin,cout to be too much magic?

<comment><USER12> It's a misappropriation of an operator. C had a "definition" for them, and this completely disregards that definition. It's one of the biggest things people cry about when custom operators are brought up in other languages, because C++ really dropped the ball here in using operators in a sane way.

<comment><USER13> And yet we had a few decades of magic 0 literals that transmute into pointers until we finally got a proper nullptr. There's some grade A impurity built directly into the core language and hard to avoid unlike the std lib.

</comment></comment></comment></comment></comment><comment><USER14> I use MyDef to achieve most of features `cpy` is trying to introduce:

        # t.def
        page: t, basic_frame
            module: c

            a=10
            b=a
            $dump a, b

        $ mydef_run t.def
        PAGE: t
          --> [./t.c]
        gcc -std=c99 -O2 -o./t ./t.c  && ./t
            :a=10, b=10

I didn't introduce `known` keyword. If I want straight C code passthrough I simply append semicolons.

MyDef is a general preprocessor, so I need the page and module declarations to tell what file and types I am generating. It always shows the command it actually runs, so there is no magic. And it does not pretend to replace C. It always produces `.c` file for debugging or merging with existing workflow.

As long as MyDef is strictly preprocessor, it is purely complementary. If you prefer straight C/C++ at places, just use straight C. If you have questions on what MyDef syntax does, just read the C output.

It does pose some restrictions on the C I write. I do not write long statements in multiple lines and rely on my editor to softwrap the lines. Long lines are difficult to read anyway with or without splitting and soft-wrapped lines are not much difficult to read anyway. I often can avoid long lines by refactoring. In rare cases that lines still end up too long, I leave it as is to remind me that it needs further work.

Sometimes I need import third-party raw c code during a progress of refactoring or code digesting. MyDef has template construct to quote them directly.

MyDef: [https://github.com/hzhou/MyDef](https://github.com/hzhou/MyDef) output_c: [https://github.com/hzhou/output_c](https://github.com/hzhou/output_c)

<comment><USER15> Last year I learned about MyDef. I like the basic concept, but it did not fit my use case unfortunately. I also am not well versed in Perl and at least at the time the documentation of the internals was too sparse for me, so I was not able to adapt it to fit my needs. But I do think people should look more into the idea of using preprocessors like MyDef and CPY.

I, like everyone else who has the need, wound up writing my own C++ preprocessor. I think there is a lot of merit to the idea of having a low level base language which is machine independent and using a high level syntactic sugar over it.

<comment><USER14> I lately do realize that to be comfortable with MyDef, one need be versed in three languages -- the language you are writing, MyDef, and Perl. People seem more welcome to the idea of having new language replacing the old rather than a solution of taking advantage of existing tools. I think this is the same barrier of Knuth's literate programming. Despite how I find how much MyDef make life easier, others will not see the same if not ready.

What I am hoping for is conversation. With conversation, I can have the motivation for documentation and others can understand and the barrier may dissolve.

</comment></comment></comment><comment><USER15> The redundancy that matters to me is writing code for yet another serialization or pretty printer. I couldn't care less about syntax.

I am a firm believer that the compiler should do as much work as possible, no matter the time it takes. I think the compiler ought to generate default pretty printers for structs and unions on its own, that may be overridden. Same for serialization formats and so on. The C++ compiler has more than enough information to make programmers lives more convenient at no added runtime expense, and I would be very willing to eat the compile time cost.

I wound up having to write my own preprocessor for C++ to automatically generate structure metadata for an embedded application. I wish there was more of a push for general preprocessors in this direction.

</comment><comment><USER16>
        // CPY loop to iterate from a down to b, c at a time
        for i a b -c

        // For comparison: pure C++11 and boost
        for(auto i : irange(a, b, -c))

After CPY removes redundancy to this extent, sure there's still enough information for a compiler to parse this, but there's not enough information for _me_ to parse this. Remember that you spend a lot more time reading code than pressing buttons on the keyboard, so the number of characters you need to type is pretty irrelevant to your productivity.

Maybe I'm getting too caught up on the name, which suggests a Python-like experience, which CPY definitely not. If anything it is less like Python than C++! Sure it has the indentation vs braces thing, but that is probably one of the least important reasons why Python is so readable. A more important reason is the excellent visual cues in the syntax, and forcing you to spell things out e.g. with named parameters; "explicit is better than implicit". CPY seems to strip out visual cues, as shown above, by its four print functions that are cryptically called !, !!, ? and ??, and by the fact that it's even harder to spot function declarations in CPY than in C++.

</comment><comment><USER17> The feature I like here is an old Common Lisp feature: accepting as many returned values as you'd like. C/C++ allows you to accept 0 returned values without special syntax, but in all other cases you have to be careful. Whereas in CL you can return as many values as you like and the caller can accept as few of them as it likes with no extra overhead.

In c++17 you can sort of do that but you still have to unpack the whole tuple (and the caller has to make one instead of simply doing 'return a, b, c;' to return three values. I understand why the C++ committee didn't make this change (it would break valid programs, though there are likely few to none of them).

<comment><USER18> Having to write :

return {1, "42", '2'};

seems like a fair trade-off to me. Btw, this is already implemented from c++11.

</comment></comment><comment><USER19> I think this could be more interesting if it was a superset of C++ that allowed for brevity in some cases. Something that could:

1\. Act as a preprocessing step for any existing C++ file

2\. Output perfectly servicable C++ in the case where you want to move away.

Additions like the "known" keyword make this look badly thought out.

In any case, the weakness of C++ in most cases is compilation speed, not typing speed. Even in the ideal case I can't see this adding more value than it detracts (preprocessing speed + buildsystem complication + extra dependency).

<comment><USER20> One nice feature is writing your class interface/implementation all as one and the system splitting it into .h .and .cpp. Especially if it can be set to do things like the "pimpl" pattern.

I'm probably a minority in the C++ world, partially because I don't have a powerful IDE, but I tend to write everything in .h and only split it out later on, which gets annoying.

<comment><USER21> If compiler times and ordering of declarations were easier to handle, I would probably change my code to live in headers only. Keeping headers and sources in sync is annoying. And the compiler also gets amazing optimization opportunities if it can see all of the implementation code.

<comment><USER22> As far as optimizations go, LTO (Link Time Optimization) solves a large part of that problem

</comment></comment></comment></comment><comment><USER23> One basically needs to implement perfect C/C++ parser in order to accomplish this with sufficient accuracy. Does CPY implement that? No.

<comment><USER24> libclang to the rescue! (which CPY doesn't use)

</comment></comment><comment><USER25> I would love to be able to write C++ without having to write header files, there is an insane amount of redundancy between header/sources in any C++ project. I don't even care about anything else, that would be the most important thing this tool should support flawlessly.

<comment><USER26> You could simply write header-only code (see keyword 'inline').

</comment></comment><comment><USER27> A superset of C++ would be unwise: same issues as those C++ inherited from C! I imagine something similar to CPY could be created for different domains like:

\- Pure functional style (Haskell subset that is usable from C++)

\- GC'd higher level gluing code (calls C++ but maybe not necessarily callable from it)

Am sure others are more qualified for suggestions, but I imagine other subsets like some for interfacing with representing relational data querying, different concurrency models (like Go, Erlang...)

Is this a sane suggestion?

</comment><comment><USER28> Very interesting! On a slightly related note, I'd personally love to see more "C++ variants" (for lack of a better term) out there. By that, I'm referring to ecosystems/languages that are essentially a simplified/abstracted/modernized version of C, but ones that also still allow you to "break out" back to classic C at will. Thank you for sharing.

<comment><USER29> Objective-C? D?

<comment><USER28> Correct me if I'm wrong, but Objective-C's ecosystem is very much Apple- centric. Things in that regard have only started changing fairly recently.

<comment><USER29> Apple-centric? The libraries in iOS and macOS, for sure. However, the language itself can be used anywhere where GCC is available.

</comment></comment></comment></comment><comment><USER30> So, just syntactic sugar for frequent use cases (stdin/stdout with iostreams, returning tuples)?

</comment><comment><USER31> So CoffeeScript meets C++?

</comment><comment><USER32> > _... without redundancy. Curly brackets are implied from identation_

I.e. nesting information is repeatedly encoded into every line. Nope, no _redundancy_ here, move along!

</comment><comment><USER33> Hey, cool project!

I'm not sure I agree that the input is more readable, but good nonetheless.

If I had the choice, I'd move the syntax closer to Haskell do-notation than Python, but that's just me.

</comment><comment><USER34> Similar idea: [https://bixense.com/coffeepp](https://bixense.com/coffeepp)

</comment><comment><USER35> Reminds me of Groovy vs Java ... although seems limited to syntactic sugar mostly rather than adding functionality.

</comment><comment><USER36> Implicit variable declaration, multi-value return, so semicolon / parenthesis... sounds a lot like Golang.

<comment><USER37> Sounds a lot like most languages designed during the last 20 years (or 50 years if you include academia), actually :)

</comment></comment><comment><USER38> Damn it.. this was my idea. I was going to call the language "raw" x(

</comment><comment><USER39> What about debugging? Looks like it's Linux-only.

</comment><comment><USER40> Good luck setting a breakpoint.</comment>