About the LIGO Gravitational-Wave Rumor - <AUTHOR> http://www.skyandtelescope.com/astronomy-news/about-this-weeks-gravitational-wave-rumor/?utm_source=newsletter&utm_campaign=sky-mya-nl-160115&utm_content=813396_SKY_HP_eNL_160115&utm_medium=email <comment><USER2> The bit I found most interesting:

"The current excitement could easily be a false alarm. Even if LIGO has a promising signal, it may be a false test signal planted as a drill. It's been done before, in 2010 near the end of LIGO's last pre-upgrade run. Three members of the LIGO team are empowered to move the mirrored blocks by just the right traces in just the right way. Only they know the truth, and the test protocol is that they not reveal a planted signal until the collaboration has finished analyzing it and is ready to publish a paper and hold a press conference. "Blind tests" like this are the gold standard in all branches of science."

Getting to the point of publishing a paper and holding a press conference seems like a lot of potentially wasted effort on a fire-drill type exercise. Presumably there are reasons why they wouldn't just let everyone know that it was a drill when they'd all decided on a conclusion? I realise that I'm assuming that the point of drawing that conclusion is much earlier than completing the paper as well, which may not be true.

<comment><USER3> Its probably poor phrasing in the article. The key is its event based (more or less) and they don't reveal until after all analysis is done.

So analysis complete we have X events at a SNR of 3 dB, Y events at a SNR of 2 dB, etc. Then and only then do the blind test dudes reveal "ah well all X events at a SNR of 3 dB were fake, and one of the Y events was fake, and you missed detecting one of the Y level events but the other 42 results were real."

We did this a lot in quantitative chemical analysis lab, it kind of spoils the point of the lab session if the TAs tell you the percentage iron in the sample before you start to test it, or while you're evaluating the test run results.

</comment></comment><comment><USER4> From the comments: "... how much noise exists in the measurement environment? I find it difficult to believe something even as mundane as a minuscule earthquake or similar ground noise wouldn't cause orders of magnitude more of a signal and therefore swamp out any meaning information"

This is also the first thing that came to my mind. How do the filter noise? Or are we missing something that is not described in the article?

And secondly, why not putting ( teoretically) this lasers into space? Aside the solar radiation/wind, not much would interfere if put around the Lagrange points.

<comment><USER5> As I understand it, this is one of the main reasons that there are _two_ detectors thousands of miles apart, in Washington and Louisiana. There will be a whole lot of false alarms at each one separately, but it's extremely unlikely that precisely matching earthquakes will occur at both locations at once. (They have other very sophisticated ways of isolating the system from outside noise, too, of course. But I don't think the experiment would be viable without the two location filter.)

As for space, the LISA project has been trying to get funding for years. (The preliminary "LISA Pathfinder" mission launched on Dec. 3, so there's finally some real progress on this: [http://sci.esa.int/lisa- pathfinder/](http://sci.esa.int/lisa-pathfinder/))

</comment></comment><comment><USER6> my intuition says this is impossible to detect as if space time is bent then all the equipment and our reality is bent along with it and thus we will be none the wiser.... ie we might be inside a bent reality but we and all our sensing equipment will still sense everything as straight.

<comment><USER7> It's not bent the same in all directions. You can detect the difference in different directions, which is what LIGO does.

Your point, by the way, was hashed out in the early 1900s as part of the development of modern relativity. Physicists were well aware of the problem back then, and that's part of why it's so interesting and important that the speed of light turns out to be a constant.</comment></comment>


How to monetize a small website about research in cancer, ALS - <AUTHOR> Hi HNers,
I have a small website which receives 2500 unique visitors per month and I wonder how I could monetize it?
The web site is about health, with a focus on cancer and ALS, I add a new article every week when I find something interesting. Often I take a news in English, translate it in French, provide context. I do not publish PR text that can be found in multiple sites on Internet. Even if few articles are in English, half users come from the US and the other half from France. I tried Google Adsense but got no revenue at all during three months so I drop advertising.
Thanks for any comment! <comment><USER2> Hey JP,

This is something the company I work for is (coil.com) specifically trying to help solve through an open web monetization standard.

Currently you have two options for monetization through the web monetization standard. 1\. Passive Mode: Add a payment pointer to your website and encourage readers to get a coil.com subscription. This means when they view your site you will get streamed micropayments. 2\. 100 + 20 Mode: Where you provide some locked bonus content on your site that is only accessible to them if they are streaming you payments. You can read more about this concept here [https://coil.com/p/coil/The-100-20-Rule-for-Premium- Content/...](https://coil.com/p/coil/The-100-20-Rule-for-Premium- Content/3l1ALJ3M6)

If you have any questions you can send me a mail to matt at [companydomain.com]

<comment><AUTHOR> Hi Mat, Thanks for the hint, I will think about it.

</comment></comment><comment><USER3> I would imagine many folks who are visiting cancer/ALS content are impacted by the diseases either directly or indirectly. Affiliate marketing (directed to non-profits) seems like a place to start.

<comment><AUTHOR> Thanks for the comment!</comment></comment>


ADsafe – Making JavaScript Safe for Advertising - <AUTHOR> http://www.adsafe.org/ <comment><USER2> How about browsers rejecting all off-site Javascript loads that don't have subresource integrity hashes, unless they're in iframes? This would force ad networks into using iframes. You could still load static assets such as JQuery and fonts from central sites. Anything you needed to load would have to be static. That makes it part of your page, just stored elsewhere. Assets would need versioned URLs. Think of it as version locking for external code.

The requirement for subresource integrity would have to be recursive; if something has an integrity hash, anything it loads must also have an integrity hash. This prevents escaping via indirection.

This would break a lot of sites, of course. (HN would be fine; I just looked at page source.) But it probably wouldn't be much worse than running with Ghostery set to reject all known third party crap. It would definitely break a lot of hostile code.

Not sure if you could enforce this from a browser add-on; those usually don't get control early enough.

<comment><USER3> Forcing ads into iframes would would make responsive websites enough harder that most people wouldn't bother. You'd end up moving all the ads to those obnoxious full screen and intersitionals

<comment><USER2> The parent page sets the iframe size; the iframe has to make itself fit. See [1] for a way to do this. If it's too small, the ad should refuse to load and the site doesn't get paid.

Amusingly, Google has a canned answer for "iframe size": 200 pixels.

[1] [http://stackoverflow.com/questions/819416/adjust-width- heigh...](http://stackoverflow.com/questions/819416/adjust-width-height-of- iframe-to-fit-with-content-in-it)

</comment></comment></comment><comment><USER4> How does this differ from [https://developers.google.com/caja/](https://developers.google.com/caja/) ?

<comment><AUTHOR> That was going to be my next submission. ;)

<comment><USER5> This was Crockford's attempt at making JS secure in browsers before his seif project. In theory, this would work well but requires developers to use the adsafe plugin of jslint to ensure their web apps are safe.

Caja is Mark Miller's (supported by Google) attempt at making JS secure in browsers. This was implemented in the static analyzers used by Google in their Google Apps Script environment.

</comment></comment></comment><comment><USER6> I applaud the honest and fair diplomacy effort by giving life to AdSafe. You don't want to kill the advertisements, you want to coexist with them peacefully. You deserve a lot of respect for this alone -- I know for a fact that I wouldn't be that better man and I'd opt for much more drastic approach.

I am afraid the ad networks never wanted to play fair in the first place however.

JS browser engines themselves have to start providing strongly jailed sandboxes or the problem won't ever be solved (which is the goal, I'd argue; almost nobody has an economical incentive to fix the current state of affairs).

Sadly, having in mind how much Google loves its tracking, I don't think they'll ever help wich such an effort in Chrome. Mobile Chrome for example never got support for content blockers, unlike other mobile browsers like Apple's Safari, Samsung's Internet (Android) and several, less popular, others.

</comment><comment><AUTHOR> A technique from CompSci for reducing risk of malicious JavaScript. Worth posting given many here claim they block ads due to malware risk. The technique needs further review for its security and usability.

<comment><USER7> > from CompSci

Maybe I'm missing something, but I don't see much that I would consider CS. This is an attempt at an engineering-style workaround.

> malware

They explicitly include support for spyware with the mouse{over,out} (etc) events.

> "ADsafe makes it possible to quickly and reliably determine that script is > safe"

That's incredibly hard. It's easy to hide arbitrary code even if all you have is a lambda expression[1] ("function () {}" in JavaScript). There are so many sharp corners and inconsistent gotchas in JavaScript - multiplied by the variations between browsers - that identifying a "safe" subset of the language is extremely difficult (or maybe undecidable).

Douglas Crockford has been warned[2] almost a decade ago about the insecurity of mixing foreign JavaScript. The language simply wasn't designed with a security model sufficient for running untrusted code.

[1] [https://codon.com/programming-with- nothing](https://codon.com/programming-with-nothing)

[2] [https://www.youtube.com/watch?v=qfBL2sc2zUU](https://www.youtube.com/watch?v=qfBL2sc2zUU)

<comment><AUTHOR> "Maybe I'm missing something, but I don't see much that I would consider CS"

It came from CompSci people researching sandboxing of JavaScript. The papers on the left show that. They later turned it into a more engineered solution and convenient web site. Uncommon with CompSci projects. I give them extra credit for that whether the method pans out or not.

"They explicitly include support for spyware with the mouse{over,out} (etc) events."

Is that limited to the site it executes in or would it have visibility to all sites? And anything you see that would lead to code injection outside hardware-level attacks?

<comment><USER7> > It came from CompSci people researching sandboxing of JavaScript.

Ahh! That makes more sense.

> site it executes in

They seem to be allowing capture of UI events on any element that is selectable through their (limited) query interface. This is probably to allow interactive designs or ad-network "auction" tracking, but it's still spyware.

</comment></comment></comment></comment><comment><USER8> I doubt that big ad networks will touch this. Bot detection relies on intrusive/borderline malware code.

It was not unheard of ad companies probing, say, 0-day buffer overflows in browsers just to uncover botters.

<comment><USER9> The point (I hope) is to get the big ad networks to change practices or drive them out of business when e.g browsers have blockers on by default killing all ads from networks that serve ads that aren't using safe subsets.

</comment></comment><comment><USER10> why not just put the ads in a srcdoc+sandbox iframe. that way it can be loaded inline but runs on a null origin, preventing access to the page itself.

<comment><USER11> What about the risks if you serve something that breaks out of the sandbox?

<comment><USER10> then the origin security model of the browser is broken and you have much bigger problems than just some ads.

<comment><USER12> Well, yeah, but ads are the most likely attack vector.

<comment><USER10> I would argue that relying on SOP isolation is more reliable than attempting to patch over the ads running in the same page context in the first place.

The threat model changes quite a bit if we assume the attacker has a SOP exploit.

</comment></comment></comment></comment></comment><comment><USER13> How is this different from [https://github.com/douglascrockford/ADsafe](https://github.com/douglascrockford/ADsafe)? And isn't this all from 2011 or so? I recall this concept popping up then as well. I haven't seen much uptake from the ad industry which is focused on more tracking and access, not less.

</comment><comment><USER14> how much of this can already be mitigated by using `iframe[sandbox]`?

<comment><USER15> Just about all of it, especially with its default behavior of blocking script execution. Ads have no business running JavaScript, especially in the context of the site running the ads.

</comment></comment><comment><USER16> Call me ignorant but why exactly does a plain, honest ad need JavaScript? Why isn't a plain picture that links to the advertiser's site (maybe through a counter redirect so you can see how many people followed the link) enough?

<comment><USER17> It doesn't.

The problem is stated backwards though. Ads don't _need_ JavaScript. But ad vendors will use whatever tools they _can_ use, so if you let them use JavaScript, it will get used - and not just for malicious, track-the-shit-out- of-users purposes, but also as an enabler of general coding laziness (much like a lot of things are moved to JS today, because hey, free frameworks!).

</comment></comment><comment><USER18> The minimum set of `+!()[]` chars are proven to be TC [0]

So good luck trying to define a non-TC js-subset that allows to use these chars.

[0] [http://jsfuck.com/](http://jsfuck.com/)

<comment><USER19> The mitigation for this is:

 _[ ] subscript operator except when the subscript is a numeric literal or string literal or an expression that must produce a number value. So expressions like a[i] are disallowed because we cannot statically determine that i is not one of the dangerous property names. But a[+i] is allowed, because +i will always produce a number._

</comment></comment><comment><USER20> I wonder if it would be possible to make a browser extension that rather than block all ads, would simply run all third-party scripts through something like this to disallow malicious behavior.

<comment><USER21> Forget it. That would include solving the halting problem by proxy.

You can't know if a script or program is going to be malicious without effectively executing it. It's almost impossible.

Just look at Anti-Virus, they've been trying forever and the best we have is research papers on immune-system-based AVs or AI-solutions.

<comment><USER9> Wait, I thought this was intentionally made a small enough subset that it should be not only possible but fast and simple to decide whether a chunk of code conforms or not?

Is JavaScript so hard to parse and analyze that this is impossible?

<comment><USER21> It's a generic problem in computing. Reducing the language set only changes the difficulty and does not eliminate it simply by the Nature of Turing machines.

<comment><USER22> Running a Turing-complete language in a jail is entirely possible. If you don't give it access to, say, webcam APIs the you can be sure it won't turn the webcam on unless there's a bug in the jail.

Of course, proving the jail is secure is awfully difficult but you can at least analyze it at your leisure, and you only have to do it once. I don't know if this is possible as a practical matter but the halting problem doesn't exclude the possibility.

<comment><USER21> I'm not aware of any perfect jail. Even then studies have shown that a simple memory error can lead to breakout.

<comment><USER9> We already hope that the Turing Complete normal js doesn't access our files - so hopefully what this aims to do is simpler

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> Do any ad networks permit running their scripts in ADsafe?

<comment><USER2> Google, in their terms, prohibits sites from running their ad code in iframes. Probably because that makes ad-blocking so easy.

<comment><USER24> I think it's more likely that the no iframes rule is there to prevent click- fraud.

See for example [https://en.wikipedia.org/wiki/Browser_hijacking](https://en.wikipedia.org/wiki/Browser_hijacking) for more on a kind of malware that injects ads into browsers.</comment></comment></comment>


"Have you considered putting this on kickstarter?" - It's harder than you think. - <AUTHOR> http://lists.phcomp.co.uk/pipermail/arm-netbook/2012-September/005643.html

<comment><USER2> There are other crowd funding platforms.</comment>


Dispute over Adblocker: IP and P7S1 sue Adblock Plus / Eyeo (Google Translate) - <AUTHOR> https://translate.google.com/translate?sl=de&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fwww.horizont.net%2Faktuell%2Fmedien%2Fpages%2Fprotected%2FStreit-um-Adblocker-IP-und-P7S1-verklagen-Adblock-PlusEyeo_121209.html&edit-text= <comment><USER2> Nice. Ad companies (i.e. companies that offer nothing to users, only messing with their data) dictating what a user can/cannot install on his system.</comment>


Spending a ton of $$ on push notification services that charge per subscriber? - <AUTHOR> https://www.pushmaze.com/ <comment><AUTHOR> It will save a lot of your marketing budget.</comment>


Show HN: Obsessively follow a news story - <AUTHOR> http://beset.me/

<comment><USER2> You know, this reminds me of some old Web 1.0 services that would kind of do the same. You'd register an address, and if the site changes any content, you'd get an email. I used to have dozens of pages registered, mostly news type sites and always kept up-to-date with things.

At some point they went away, I think RSS killed them, but RSS never seemed to work quite as well for me for some reason, too granular I think.

I'm really glad to see something like back again.

</comment><comment><USER3> So the idea is that you add a link, it watches for changes to the article's content and alerts you if a change. Sounds good, but it seems rare for sites to update existing articles, when another could be posted.

Ever thought about watching the parent site for updates with similar content?

<comment><USER4> Yeah, I'd second this. If it's really targeted at following news stories, watching a given page change is not as useful as some sort of tag-based or curated per-topic subscription.

One thing I'd find this useful for would be when you're waiting for something to be released - point this at an author's website (or a subpage related to a book you're looking forward to) to be automatically notified when the page changes. Similarly, I think that Overdrive (e-book and audiobook lending through public libraries) has a page where it lists the libraries carrying a given book. If you're hoping that your library starts carrying a given book, you could imagine following a page like that.

Another feature suggestion - maybe put in an option for a reminder to check back even if the page hasn't changed either on some interval or after some period of time. I could see using that as a tool to try to keep kickstarters and the like honest ("You said there'd be an update after 14 days, it's been 18 days, no update...").

<comment><USER5> An alternate take on this would be for websites/services that have a splash page but no signup form/RSS feed or a non-news/blog site such as a bakery, local restaurant, etc.

From the name/HN prompt, I thought it'd be something that gave you updates as a story was developed. For example, you hear about a criminal being captured, but you don't always hear about the trial/sentencing. A few months later you're asking "What ever happened to that guy who..."

</comment></comment></comment><comment><USER6> This is cool, thanks for sharing.

I hoped when I saw the title that this would be a service to let me find out what happened in a story some time later. I often find 'developing' stories of great potential import seem to disappear from the world's media later on, and I never get to see how things actually turned out.

<comment><AUTHOR> The really obsessed never stop watching their news providers to see if new stories are breaking. I think Beset works well for watching specific articles to see if they change, even if that's six months after they're published.

</comment></comment><comment><USER7> This is great! I'm going to put a few pages there that I obsessively follow anyway. RSS isn't available (or good) often and I don't want to create social media profiles to get updates.

</comment><comment><AUTHOR> A really big thank you for everyone who's commented, it's great to have helpful feedback when you throw an idea out there.

</comment><comment><USER8> Thin white text on bright red background at the bottom is just unreadable and user-hostile.

<comment><AUTHOR> I did wonder about that when I was building it, but I liked the BREAKING NEWS lower thirds metaphor and only want the user there for a couple of minutes.

</comment></comment><comment><USER9> I think the design is really great</comment>


CityBikes: bike sharing networks around the world - <AUTHOR> https://citybik.es/ <comment><USER2> This has been around for a while:

[https://f-droid.org/repository/browse/?fdcategory=Navigation...](https://f-droid.org/repository/browse/?fdcategory=Navigation&fdid=be.brunoparmentier.openbikesharing.app&fdpage=3)

I guess this is the API it uses. It's pretty impressive. Seemingly hundreds of bike sharing systems are on this thing. It uses OSM for the background, and gives you a reading on how many bikes are at a given station.

</comment><comment><USER3> They should remove Seattle's entry here. The Pronto network was cancelled in March due to disuse.

[https://www.citylab.com/transportation/2017/01/seattle- bike-...](https://www.citylab.com/transportation/2017/01/seattle-bike-share- pronto-goes-under/513575/)

<comment><USER4> Seattle has a mandatory helmet law. Are there any successful bike shares in places with helmet laws?

<comment><USER5> Yes, when those laws are in place, but almost never actually enforced. Nextbike[0] is _extremely_ popular in my city, even though my country has a helmet law in place. They also offer a bike for 30 minutes per day completely free (you can also rent two bikes for free at the same time), so that alone makes it a pretty easy way to travel through half a city without paying a dime. Not a day goes by without me seeing one[1].

As far as my experience goes, the country did try heavily enforcing the helmet law when they first introduced it (about a decade ago), now it seems to me like the police simply doesn't care if you're wearing a helmet or not.

Of course, if you commit any other traffic violation on a bike, you can be pretty damn sure that they're gonna bundle it with "not wearing a helmet" fine.

[0] [https://nextbike.com/](https://nextbike.com/)

[1] I live within a walking distance from the place I work in, so there's no need for me to use one every day.

</comment></comment></comment><comment><USER6> I built an app over it that attempts to predict the future state of any network. It later recommends addings/substractions in order to keep offer and demand balanced among stations.

It could work in about 440 cities but none of the big companies that lead this wanted this. What would you do with it?

<comment><USER7> That depends why they don't want it. Did any explain this? Maybe you're not articulating the value prop?

That'll be a good way to decide whether to keep trying to sell to them, what to change etc.

If you've exhausted that you may look at other applications for the technology.

<comment><USER6> I found two reasons here: \- They make money by using bikes as advertising space, so they do not really care about the overall quality of the system as long as they have a permanent exploitation contract.

\- They use historic data to approach future situations. In spite they do not have alert systems, they seem to think this is enough. Although, when sun suddenly appears, the shore tends to get crowded and "locked" for hours; they doing nothing about it.

What my system was going to provide was smart routes for the vans, to add or subtract bikes on strategic places.

</comment></comment></comment><comment><USER8> Isn't bike sharing huge in China?

Edit: [https://www.theguardian.com/cities/2017/mar/22/bike-wars- doc...](https://www.theguardian.com/cities/2017/mar/22/bike-wars-dockless- china-millions-bicycles-hangzhou)

> _the world's 15 biggest public bike shares are ranked. Thirteen of them are > in China._

<comment><USER9> My local city has just got a slightly different type of bike sharing scheme where there are no stations/docks for the bikes, but you're allowed to leave them anywhere sensible [1]. From other articles including the guardian one linked above, it seems that this a model that's been used in China and certainly seems to have proven very rapidly scalable.

I guess in these cases it's quite difficult, since it's likely not feasible to update the locations of individual bikes for these guys. I've checked their map and Bristol, UK doesn't appear to show YoBike at the moment, however it's only been in action for a few weeks.

[1]: [https://yobike.co.uk/](https://yobike.co.uk/)

<comment><USER10> There's a similar system in Prague and Brno, Rekola.

</comment></comment></comment><comment><USER11> This bike share visualization is also very good, has many different cities and lets you replay them over time [http://bikes.oobrien.com/global.php#zoom=3&lon=-60.0000&lat=...](http://bikes.oobrien.com/global.php#zoom=3&lon=-60.0000&lat=25.0000)

</comment><comment><USER12> Great project, it seems that some companies —like Citymapper— use the API[0]. Would be nice if they also contributed with code or supported the author.

[0]: [https://citybik.es/projects](https://citybik.es/projects)

</comment><comment><USER13> Just spent 3 weeks in 6 cities in China. Ofo and Mobike seems to be the biggest bike share companies. There is also a company that makes electric bikes (with hub motor) available for bike share.

How they work: 1\. Pay a deposit (99 RMB for Ofo, 299 RMB for Mobike) and register 2\. Scan the QR code to unlock the bike -Mobike will unlock automatically- Ofo will send a pin to your phone that you can use to unlock the bike. 3\. When you are done, just lock up your bike (rear wheel) and leave it anywhere.

In Shanghai it was common to see incensed security Guards dragging bikes off premises. Bikes definitely do clutter up precious walking space.

</comment><comment><USER10> I think I have to mention this: [http://opensourcebikeshare.com/](http://opensourcebikeshare.com/)

<comment><USER14> It's really tempting to buy a few $99 bikes from Walmart and setup a bike share.

<comment><USER15> Those bikes would become inoperable within days, and could present significant legal liability.

Citibikes and such are quite heavy because they must withstand a lot of abuse. The quality of 'department store' bikes are very low; they're often not even assembled correctly.

<comment><USER14> Anecdote: I've logged hundreds of hours on mine.

An LLC, waiver and self inspection might avoid the liability. This is just too complicated though.

</comment></comment></comment></comment><comment><USER16> How is the data gathered? In Stockholm all three items were in the middle of the water without any real information. The names sounded faux and were ungooglable.

<comment><USER17> Data is scraped from various sources (APIs, websites). Code is public: [https://github.com/eskerda/pybikes](https://github.com/eskerda/pybikes).

<comment><USER18> Thank you

</comment></comment></comment><comment><USER19> Stockholm's bikes all seem to be underwater? But I rode one yesterday so I don't think they're actually underwater..

<comment><USER20> Seems Stockholm's system in Citybikes were the remnants of a test project by JCDecaux, which was providing the data. The actual project on Stockholm is run (or at least used to be) by ClearChannel.

Actually, many years ago we supported Stockholm's system but stopped doing so after receiving a C&D by, apparently, a sole guy that had permission to use the data in exchange for providing the apps. Most possibly the situation has changed (this was more than 5 years ago) but it left an aftertaste that has stopped me from adding it. A PR to the project for adding Stockholm would be welcome, though.

// Disclaimer: citybikes

</comment></comment><comment><USER21> Great list! Donkey Republic ("global" but from Copenhagen) is missing though: [https://www.donkey.bike](https://www.donkey.bike)

And the one in Stockholm, whose domain is very close to yours! [http://www.citybikes.se](http://www.citybikes.se)

</comment><comment><USER22> It should be called "around the rest of the world" since it omits the biggest and hyper competitive bikeshares in some Chinese cities.

<comment><USER23> Since the info is scraped from the respective official websites, the Chinese networks will only be added once someone puts in the work to reverse-engineer their apps.

</comment></comment><comment><USER24> It doesn't seem very consistent. Lots of points in Latin America but when you zoom in, they are all gone.

<comment><USER25> I think you're just seeing a poor design choice: the purple dots they use to indicate cities with bike shares are very visible at the whole-world zoom level, but virtually impossible to see when you've zoomed in because they're the same size and in the same location as the map's default city marker.

</comment></comment><comment><USER26> Portland just has one because Nike bought all the bikes. That is why they are all in Nike orange.

</comment><comment><USER27> This is great. I wish more things were universal like this :)

</comment><comment><USER28> Why are there 2 in London?

<comment><USER20> In case you mean the dot just next to London, that's a town named Slough, with their own bike share system. By clicking on the dots you can actually zoom in on the systems. Here are some links with these zoomed in:

\- [https://citybik.es/map/santander-cycles](https://citybik.es/map/santander- cycles)

\- [https://citybik.es/map/cycle-hire-slough](https://citybik.es/map/cycle- hire-slough)

<comment><USER28> No, I actually zoomed right into street level in central London and could see two bikes.

I just assumed it was a different system to Santander cycles, so thought it should be zero.

To reproduce go to

[https://citybik.es/](https://citybik.es/)

Don't type in anything, just zoom/pan until you get to central London.

</comment></comment></comment><comment><USER29> I read: "bike shedding networks around the world", and I thought "Don't they just call those internet forums?".

<comment><USER30> Ha ha

</comment></comment><comment><USER31> If you guys know what the competition is for bikeshares in China, you will know this is probably not real...

<comment><USER32> Can you elaborate?

<comment><USER31> [https://www.ft.com/content/5efe95f6-0aeb-11e7-97d1-5e720a267...](https://www.ft.com/content/5efe95f6-0aeb-11e7-97d1-5e720a26771b?mhq5j=e1)

<comment><USER32> Paywalled link</comment></comment></comment></comment>


How a DLP Projector Stereolithography 3D Printer Works, by Engineerguy - <AUTHOR> https://www.youtube.com/watch?v=97ARLiTHjX0 <comment><AUTHOR> The engineer guy never disappoints. Here he explains the technology, mechanical and chemical, in the Ember Precision Desktop 3D printer, which prints upside-down unlike the consumer 3D printers you see normally.</comment>


SimpleWebRTC.js - <AUTHOR> http://blog.andyet.com/2013/feb/22/introducing-simplewebrtcjs-and-conversatio/ <comment><USER2> I'm confused as to why they didn't release a signaling server as well. Most servers I've seen for this are just simple WebSocket relays. Are they expecting to charge you to help implement the server? Or did they just think it was too complicated for developers to set up?

<comment><USER3> Here you go: <https://github.com/andyet/signalmaster>

<comment><USER2> Cool :-)

</comment></comment></comment><comment><USER4> looks great. Also want to point out <https://github.com/peers/peerjs>, which is focused on the data-channel part of WebRTC

</comment><comment><USER5> This looks awesome.

Does anyone have recommendations for a Node module that'll do WebRTC? I've looked at a few, but would love to get opinions from actual humans who've used them.

<comment><USER6> Do you mean as a WebRTC client, rather than a signaling server?

I think for that we'd need an SCTP (and ICE, and most of libjingle) library in node, and I don't think node knows how to speak SCTP yet. Sure would be nice if it did -- would love to hear if anyone knows someone working on this.

</comment></comment><comment><USER7> Cool stuff!

I used another lib [1] to create something very similar [2] last weekend. I needed an excuse to play around with node.js/express/socket.io and couldn't resist after I saw the WebRTC Chrome/Firefox demo.

[1] <https://github.com/wearefractal/holla/> [2] <http://videochatrtc.jit.su/room/HN>

</comment><comment><USER8> I tried to run the example but it's not finding simplewebrtc.com/latest.js Anybody got the example to run? Will it work with the latest chrome or only the nightly?

</comment><comment><USER9> webrtc.io <https://github.com/webRTC/webRTC.io>

</comment><comment><USER10> I'm curious when Android's Chrome will support this stuff.

</comment><comment><USER11> It should work in Firefox Aurora as well, IIRC.

<comment><USER12> you need to enable the peerconnection flag in about:config for the nightlies

</comment></comment><comment><USER13> whats an example of a signaling server that could be used with something like this?

<comment><USER14> I implemented one for work. Basically, you have a websocket for each client, and any message received from client X is transmitted to clients Y and Z. There's not much to it at all; the magic happens client-side.</comment></comment>


Exploiting the Wi-Fi Stack on Apple Devices - <AUTHOR> https://googleprojectzero.blogspot.com/2017/10/over-air-vol-2-pt-3-exploiting-wi-fi.html <comment><USER2> I'd love to know how many hours were needed to develop this exploit from start to finish, and how many dead ends the researcher ran into along the way.

Just writing the blog post and generating all the images for it must've taken many days.

<comment><USER3> I have followed iOS JB for years and keep up with exploit dev and mitigation/defense.

The usage of source code and avoiding deep assembly documenting helped a lot. You are still looking at several man days of deep work on understanding the driver and stack.

KASLR was the only real mitigation to bypass. That could have been a difficult part worth it's own discussion. Bypassing ASLR typically requires an info leak.

I think 3-4 weeks of one person's effort is a good guess. +/\- 1wk depending.

<comment><USER4> If others don't know, the K is for kernel. I had guessed that it was, but decided to look it up. I figure this may save others some time.

It looks pretty neat, conceptually. It loads the kernel into a random location in memory on boot. I haven't looked into how random it is, but it's a good idea.

</comment></comment></comment><comment><USER5> This post is a thing of beauty. The details of how this works are amazing.

<comment><USER6> Yes, I particularly liked the detail of using the KTRR registers to defeat KASLR.

</comment></comment><comment><USER7> Amazing. Did they need to jailbreak or physically open the phone to find all this stuff? They talk about reversing binary images and using their "Legilimency" toolkit; I wonder if a vanilla phone was enough to research all this and propagate through Wi-Fi.

<comment><USER8> I'm guessing there must be other jailbreaks involved to be able to observe and experiment on the ios kernel side of things while developing the wifi chip exploit; going in all blind from the wifi side only sounds impossible. The question now is, are they sitting on 0day jailbreaks for current iOS versions or did they have to do all the tests on legacy iOS versions?

<comment><USER9> It looks like that setup work for their research environment was all covered in part 1 (all the parts are really interesting and worth a read if anyone hasn't already incidentally). Specifically, the reason they mention at the end of part 3 that

> _The exploit has been tested against the iPhone 7 running iOS 10.2 (14C92)._

was because iOS 10.2 has a known kernel exploit developed by Ian Beer [1], and they used that as part of the basis of subsequent research. Presumably they either found some iPhones still running 10.2 (which stopped being signed a long while back) or like many well funded researches just keep a set of different iPhones loaded with major iOS versions so they're ready to go for research if an exploit is found after signing stops (dedicated jailbreakers sometimes to the same thing if they can). And of course security patches themselves are handy for reverse engineering old exploits from whatever bugs Apple fixes.

In part one read under "Kernel Memory Analysis Framework".

\----

1: [https://googleprojectzero.blogspot.co.uk/2017/04/exception-o...](https://googleprojectzero.blogspot.co.uk/2017/04/exception- oriented-exploitation-on-ios.html)

</comment></comment></comment><comment><USER10> Why did Apple make it harder to turn off the WiFi radio in iOS11?

<comment><USER11> Because people would turn off WiFi from Control Center and then forget about it, resulting in expensive cellular overages. (This cost me about $30, for example.)

I think the pertinent question is: why didn't they make the change more clear?

<comment><USER12> On Android 7.0, the cellular icon in the status bar makes it very clear when you are not on WiFi. The icon serves as a reminder for me since I usually switch off WiFi in the morning and re-enable it at home. I don't recall ever forgetting cellular on.

Regardless, I think Apple could have come up with a more user-friendly solution. This just looks like a lazy hack to be honest.

<comment><USER13> It would have taken you 10 seconds to Google and find out that iOS also has an icon in the status bar that shows you whether you're on Wi-Fi or cellular.

<comment><USER12> Why thank you! I would truly be lost without your wisdom.

Unfortunately, that still doesn't explain Apple's decision to make it harder to switch off WiFi. Do iPhone users simply not notice the status bar?

<comment><USER14> I'm not defending nor evangelising Apples current solution.

I'm lead to believe it's not iPhone users specifically, but people in general.

I've worked in IT, but qualified as a tradesmen nearly a decade before, and _I_ occasionally forget to turn wifi back on when I get home. I currently work for a large steel fabrication company. One of the project managers here _doesn 't even use email_.

It's _way too easy_ for the average person to forget to turn wifi on and blow all your mobile data / get slogged with overage.

In a similar fashion, it's not hard to see and feel when a / the tyres on your car need a bit of air, but we mandate tyre pressure monitoring systems.

We are, for good or bad, reluctant to regulate software system. So, I guess, as always, if we think of a better design we should probably make a demo or promote it, maybe iOS / Android will pick it up along the way.

<comment><USER15> In 5 years we're gonna wonder how we got to the point where you can't easily turn off wifi, slowly dumbing down devices for all of us for the sake of your project manager and the like.

<comment><USER16> @mikeash it takes a minimum of 4 or 5 taps and button presses.

<comment><USER11> On my 6+, the sequence is: press home button, tap Settings, Wi-Fi, Off. That's 3-4 depending on whether you count the home button.

On a 6s or newer, with 3D touch, you can cut it down to 2-3: unlock, force touch on Settings and toggle WiFi from the menu that appears. (That might be 1-2, I forget whether you can force touch and drag to what you want to activate, or whether it has to be a separate tap.)

<comment><USER16> I didn't know about using force touch on the settings app. However when I tap on the wifi menu entry that appears, I still need yet another tap to disable wifi.

Anyway, here's my count: 1\. use touch-id to unlock the phone 2\. press home to get to first screen with the settings app (if you aren't already) 3\. tap Wifi 4\. turn it off

You then need to navigate back to where you were previously.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> This is an incredible combination of both reverse engineering skill and communication ability. So good!

</comment><comment><USER18> These guys are amazing. Excellent level of details.

</comment><comment><USER19> Skimming through this makes me feel even more comfortable using my iPhone ... look how smart you need to be to exploit it!

</comment><comment><USER20> Wonder if something like this was used to get into the San Bernardino shooter's phone by the FBI

<comment><USER21> The shooter had an iPhone 5C[1], which according to the article uses USB, so the DMA PCIe exploit detailed here wouldn't work for it.

Not saying it wasn't something similar, but it could have been pretty different.

1\. [https://en.wikipedia.org/wiki/FBI–Apple_encryption_dispute](https://en.wikipedia.org/wiki/FBI–Apple_encryption_dispute)

<comment><USER22> It has a Lightning port, so maybe a different at-the-time undisclosed DMA exploit?

</comment></comment></comment><comment><USER23> When will Apple dump Broadcom?

<comment><USER24> But Why? Not until Apple make their own WiFi Chip ( Which they are doing with W1 in Airpod and W2 in Apple Watch )

But until then Broadcom still has the best WiFi Chip. Qualcomm Atheros is a big no no.

<comment><USER25> > Qualcomm Atheros is a big no no

Sarcasm? If not, care to elaborate?

</comment></comment></comment><comment><USER26> What is the story with Project Zero? What is the strategy here?

If you think about it, pointing out flaws in competitors' products is actually unusual for businesses, especially large ones. It raises questions of motives, of trust (are they drumming up business in a negative way? Can I trust what company X says about their chief rival? Are they exaggerating or spinning it?), and it looks unsavory: You don't win in the court of public opinion by insulting the competition, right or wrong; you just look like a jerk. Also, there's a liability risk, which adds legal costs to otherwise free blog posts - 'can't you guys just find Linux bugs?'.

On the other hand, it might improve security for everyone if Apple and Google started competing to publicize each other's flaws. :) (But I'd bet the noise of accusations and counter-accusations of errors in analysis, misleading statements, etc. would soon drown out the technical info, and then the lawsuits would begin ...).

<comment><USER27> I submit for your consideration that:

1\. The Google Project Zero guys are idealists and motivated by increasing security.

2\. Google security is taken far more seriously than most other companies

3\. If Apple and Google competed in publicizing exploits, Google would win [is winning].

<comment><USER28> If everyone competed in publicizing exploits and like project zero coordinates disclosure with vendors, then _consumers_ win!</comment></comment></comment>


Ask HN: Moving into System Engineering - <AUTHOR>
 Hi all,
I want to ask for advice regarding getting a career in system programming. I have about 7 years of professional working experience. Last 4 years has been in the area of full-stack development (Typescript, MySQL, AWS, etc). Prior to that, I spent 3 years working on Android OS, but more on the frameworks layer (Java, C++, C), while also having some level of exposures on low-level Android code (i.e. HAL) and Linux kernel programming.
I've been really interested to have a career in a low-level system programming, especially in Linux kernel. But there are some obstacles: (1) Other than hacking as a hobby on the side, I don't have a concrete portfolio in system programming that I can show off to get an interview. (2) I'm currently based in South East Asia (Singapore), and it doesn't seem like there's that many system programming positions here?
I'm very tempted to take a few months off, to focus on building a portfolio around system programming. My questions are: (1) what would be a good project to work on or OSS to contribute to land a system programming job? (2) what career prospect is there for Linux kernel development? (3) what are the recommended system programming language with good career prospects? (4) how hard it is to get a remote system programming job? (5) is it a good idea to get an internship position to get my feet wet vs. just building a side project?
I'd really appreciate it if somebody in the industry can enlighten me :) <comment> non-entity Can't answer all your questions, I'm a hobbyist here, not a professional, but I can offer a bit of insight on a few of them

1) The Linux kernel would be a good one to start. There are a lot of good resources out there for getting started with that. Work on similar _nix kernels could be helpful too. I 've done a little work on the FreeBSD kernel which has decent document, and NetBSD, which has poorer documentation, but a bit better code quality and a helpful community.

2) A good bit of companies hire people to do direct work on the kernel. Redhat is the first that comes to mind. I imagine most if not all of the Big _N* companies have teams working on doing kernel work. Many hardware and silicon companies also have kernel work available. Not sure about companies in your specific market, unfortunately.

3) C mostly. I imagine having solid C++ knowledge, but I don't think there's much, if any, C++ directly in the Linux kernel. Knowing other languages never hurts, I see a lot of relevant job postings mentions Python / Perl, I assume mostly for automation. For more specialized roles I imagine there are some other languages that could be useful.

I can't give much information on the other questions, as I'm just a hobbyist. If I said anything that's flat out wrong, please feel free to correct me.

<comment><USER2> AFAIK there is NO C++ in the Linux kernel. It's all C code.

<comment> non-entity I kinda figured, just wasn't sure. I know the Window's kernel supports a handful of features from C++

</comment></comment></comment><comment><USER2> May I assume that you read [https://lkml.org/](https://lkml.org/) ? If you research the contributors, then you will be able to identify where they work and thus identify any possible job openings.

Google's Fuschia project might also be of interest.

In general, kernel level programming requires years of experience. Most of the work entails device drivers and sub-systems, e.g. filesystems, networking -- all of which rely on knowing standards and their implementations.

Being located in SE Asia, I would think that equipment manufacturers could be interested in your skills in writing device drivers for their products. Another area might be embedded systems, which in addition to Linux might use one of the BSD variants.

In order to be effective at the low-levels, you need a good grasp of CPU architectures and their many idiosyncrasies. In addition to x86-64, ARM and RISC-V knowledge should be very applicable.

<comment><AUTHOR> Researching LKML contributors is a really good idea. Thanks!

Yeah Linux kernel positions seem to require extensive experience. Do you have any suggestion on what would be a good way to bootstrap such experience? Would making contribution to Linux kernel OSS be the best way?</comment></comment>


Negative Ion Products Are Radioactive - <AUTHOR> https://www.youtube.com/watch?v=C7TwBUxxIC0 <comment><USER2> This things should really be banned...</comment>


What does it feel like to be shot/wounded by a bullet? - <AUTHOR> http://www.quora.com/What-does-it-feel-like-to-be-shot-wounded-by-a-bullet

<comment><USER2> ...only one way to find out.</comment>


Starting Small: A new type of business - <AUTHOR> http://yodelgamer.com <comment><USER2> The page you've linked to seems to have no information about what this is, what it does, or why it's interesting at all. Perhaps you could link to something more informative, rather than making us hunt around for something, perhaps only to find that we don't care after all.

It would be useful to have some sort of "elevator pitch" page.</comment>


Llgo on Go 1.1 - <AUTHOR> http://blog.awilkins.id.au/2013/05/llgo-on-go-11.html

<comment><USER2>
        llgo is a compiler for Go, written in Go, and using the LLVM compiler infrastructure.

        llgo is a fledgling, and is being developed primarily as an educational exercise. It is not presently useful for real work. Progress will be reported at http://blog.awilkins.id.au.

<https://github.com/axw/llgo>

<comment><USER3> Thank you.

Always briefly describe the thing you're writing about.

<comment><USER4> Author here.

Fair enough. I wrote that post for a much smaller audience (namely, people already following the llgo project), and certainly didn't expect it to be posted to HN. You're right of course, I should always consider people unfamiliar with the project stumbling across my posts.

</comment></comment></comment><comment><USER5> Personally, my hope is that we'll be able to target the browser through this effort via emscripten (asm.js) and PNaCl.

<comment><USER6> I can't wait for my favorite web browser to be implemented in my favorite web browser to run on my favorite operating system...

<comment><USER5> Yeah.. well, native developers want to target the latest platforms, too. :(

</comment></comment></comment><comment><USER7> I'd like to help test and even help code this thing. Axw, do you maintain any "does not work" or todo list?

<comment><USER4> There's a wiki page on the GitHub repo: [https://github.com/axw/llgo/wiki/Unimplemented-and- incomplet...](https://github.com/axw/llgo/wiki/Unimplemented-and-incomplete- features)

If you'd like to work on a feature, please let us know on the llgo-dev group: <https://groups.google.com/forum/?fromgroups#!forum/llgo-dev>

Please be aware that this is still fairly rough around the edges, and I'm new to this game (compilers/language implementation, beyond toys).

Thanks!

</comment></comment><comment><USER8> Would this make embedding a go runtime in a C program possible, maybe even on iOS?

<comment><USER4> I haven't even thought about that to be honest, but there's not currently anything that would preclude embedding code generated by llgo in a C program. This might change in the future, with the introduction of goroutine scheduler and segmented stacks.

I don't know the first thing about iOS development, so can't comment there.</comment></comment>


Ask HN: Security audit or certification for enterprise sales? - <AUTHOR> We've recently been going through the sales process with a mid-sized enterprise. We're in the final stages, but they're got a bit scared about dealing with a startup and are requesting a security audit or accreditation. We primarily deal with SMBs, so this is the first time we've been asked for this.<p>Has anyone had any experience with this kind of request as a startup and how have you dealt with it? Should I just send them the results of our 3rd party PCI compliance scans? Is there a cheap certification we can do? <comment><USER2> > Should I just send them the results of our 3rd party PCI compliance scans?

You could ask, "We are routinely audited for PCI-DSS compliance. Would you prefer to see the results of our latest compliance audit?" This may be acceptable, and the only way to know is to ask.

If that's not satisfactory, try to negotiate with them to cover or split the cost of a comprehensive third party audit that meets their requirements.

If they require FIPS 140-2 compliance, see your doctor for blood pressure medication first.

> Is there a cheap certification we can do?

Security isn't cheap, unless you compare security to the cost of a data breach, in which case it's a hell of a bargain.

If they're Enterprise, they're probably more willing to cut a check for $X0,000 than accept the risk of losing millions in disaster recovery.

Whatever you do, don't go for the cheap options, if for no other reason than, if anyone on the client's side is security-savvy, they'll figure it out quickly and that might turn them off completely.

Whatever you do, don't pay for the audit out of pocket.

(Disclaimer: I do source code audits for Paragon Initiative Enterprises. We tend to focus on web-based and desktop software.)</comment>


Apple's free coding classes are a sales engagement - <AUTHOR> http://sdtimes.com/sd-times-blog-apples-free-coding-classes-sales-engagement/ <comment><USER2> "The problem is that computer science education is obscenely expensive" \-- No, its not. In fact if you're really smart it's free

<comment><USER3> "The problem is that being really smart is obscenely expensive" \- or depends on luck in the genetic and family environment lotteries.

</comment></comment><comment><USER4> > Yes, the classes are free, but they require the use of a US$600 tablet. Your > kids can learn about Swift inside the doors of an Apple store, but what > happens when they get home?

This blog post is a great and much needed critique. Apple's classes seem like little more than an attempt to create and build brand loyalty and to increase sales.

</comment><comment><USER5> Okay, at this age, I don't think we should worry about kids being tied to one platform.

In 10 years we don't know what language or platform is going to dominate, let alone by the time kids grow up.

The point is to learn any language to get some basic concepts down and then branch out.

Many people on this forum probably cut their teeth on Commodore 64 Basic but we're not laughing at them for platform lock in.

</comment><comment><USER6> The real irony here is a rant against commercialism that is published on a page with no less than 11 display ads and a "related content" unit....

<comment><USER7> >There is absolutely no altruism in Apple's free kids programming classes. They are a sales engagement.

That's about as ranty as it gets but that's probably what he means.

<comment><USER4> When does concisely articulating an obvious conclusion become a rant? What makes it a rant? Is it the fact that you disagree? Or the fact that he uses the word "absolutely" ?

From the information available to me, it appears to me that there is absolutely no altruism in Apple's programming classes.

<comment><USER7> I didn't actually state it was a rant, only that the quoted statement was about as close to a rant as I could find. Personally I didn't find it to be a rant either.

<comment><USER4> Oh, I apologize. When you said "That's about as X as it gets" I thought you were using the common US idiom conveying an extreme degree of X. (I usually make this mistake in the opposite direction, misunderstanding an idiom by taking it literally, rather than mistaking literal writing for an idiom)</comment></comment></comment></comment></comment>


I love to be a window repairer - <AUTHOR> http://www.alfredodinapoli.com/posts/2012-10-24-i-love-to-be-a-windows-repairer.html Just some night thoughts. <comment><USER2> > Sometimes work with existing code sucks

In my experience, working with legacy code has always sucked, and always for the same reasons.

1) No documentation around! No up-to-date specifications (what's this code supposed to do?), no up-to-date test results (does it do what it's supposed to do?).

2) Always the same request: add some features, but do not change _anything_ in its current behaviour, not even the smallest detail (a.k.a.: we've got to love its bugs, and anyway we can't tell any more the bugs from the right thing).

For example, had I ever had the luck to take over a project from a colleague who had quit the company _less than six months earlier_ , I'd have loved it!</comment>


The Complete Web 2.0 directory (broadband preferred) - <AUTHOR> http://go2web20.net/ A comprehensive collection which seems to be updated often. <comment><USER2> I dislike the UI. It's sluggish and difficult to read. A list choice would be my preference. It does remind me of the million dollar home page.</comment>


After the Ellen DeGeneres iPhone dust-up, does Apple need to lighten up? - <AUTHOR> http://www.csmonitor.com/Innovation/Horizons/2010/0505/After-the-Ellen-DeGeneres-iPhone-dust-up-does-Apple-need-to-lighten-up

<comment><USER2> They probably do need to lighten up but I can see their point here. Ellen's poking fun at herself but Apple's afraid it will translate into "the iPhone is hard to use". Apple's now looking to target the Computer Illiterate folks and the fake commercial could be seen as a sign that it's hard to use. Which is why Colbert and Stewart (who mocked the company and not a specific product) didn't get calls.

It's reactionary but not illogical.

<comment><USER3> It's a classic Streisand blunder.

<comment><USER4> What was the Streisand blunder?

<comment><USER5> <http://en.wikipedia.org/wiki/Streisand_effect>

</comment></comment></comment></comment><comment><USER6> Do we know what Apple's relationship is with the show? Are they paying for positive product placement? According to one reference I found online the Ellen show employs a _product placement team_ that solicits in-show sponsorship. If that is indeed the case here I don't blame Apple for wanting clear cut good PR.

<comment><USER7> if they wanted good PR, they totally screwed it up.

</comment></comment><comment><USER8> Why would you even think for one second that this "dust-up" isn't fully orchestrated by Apple in the first place? Are consumers really _that_ dumb? That's two days in the running that Apple got (seemingly free) advertising on her show.

Less laughably transparent plugging of products, next time.

</comment><comment><USER9> Phone, or cult?

<comment><USER10> Reasoned argument, or naked hyperbole?

<comment><USER11> Ignorant, or informed?

I like this game, let's do it with candy:

Swedish berry, or fuzzy peach?

</comment></comment></comment><comment><USER12> Apple has such a stick up their ass. Every day I read a story about them, like this one, that makes me cringe. WTF is wrong with this company?

<comment><USER13> Do we even know for a fact that Apple contacted the show? She just said they weren't happy about it, which I took as a follow-up on the joke. They never mentioned Apple insisting on a formal apology, it just got reported so that it was implied.

<comment><USER4> If they contact them and say they're unhappy, it's generally considered an indication they'd be less likely to spend their ad buy with the show.</comment></comment></comment>


The ReiserFS Filesystem (2000) - <AUTHOR> http://p-nand-q.com/download/rfstool/reiserfs_docs.html <comment><USER2> I was a big fan of ReiserFS "back in the day".

While many are no doubt aware of the trial and conviction for his wife's murder, I find that almost nobody is aware that a successor (Reiser4) was also in development: [https://en.wikipedia.org/wiki/Reiser4](https://en.wikipedia.org/wiki/Reiser4)

<comment><USER3> I believe it is still in active development and they refuse to change the name for some odd reason. It's like if kdenlive was named "Weinstein" wouldn't you want to change it?

<comment><USER4> I mean, I get it. I truly do, but part of me hates this idea of names being "burned".

This name is a direct link to the person, and he should not be immortalised like that. But other cases (CockroachDB is one) I think people go overboard with getting offended at names.

Names typically have power when we only associate them with a single thing. If we have many things with similar names then one of them being terrible, no good, or awful does not directly come to mind when the word arises.

<comment><USER5> > But other cases (CockroachDB is one)

And GIMP. Some people just work so hard to get offended by an acronym that happens to also be an almost-unknown slang, that they created a fork called Glimpse.

That project declares that the name alone prevented adoption by thousands of companies and universities. If this is true, we should expect Glimpse adoption to skyrocket immediately.

<comment><USER6> > Some people just work so had to get offended by an acronym [...]

That's nothing compared to German law: You won't see a single license plate there that has the numbers 18, 28 or 88 on it. Although numbers like 318 or 288 would be fine ...

<comment><USER7> Swedish license plates (currently in the form of "ABC 12E" are screened for 3-letter combos like "CIA", "KGB", "KKK" and of course "KUK". Such plates are not issued.

<comment><USER8> Belgian license plates also have 3 letters, and there is a list of 99 forbidden combinations. Most of them are slurs, swears, political parties or things like SEX or BOM (bomb). No idea about some of them, like KKQ.

[https://nl.wikipedia.org/wiki/Belgisch_kenteken#%22Verboden%...](https://nl.wikipedia.org/wiki/Belgisch_kenteken#%22Verboden%22_lettercombinaties)

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> The real innovation of ReiserFS was to set up a development environment where they could develop, profile a new feature, repeat, multiple times a day. That's how they got such an amazingly performant FS: Short feedback cycles.

<comment><USER10> Is there any more information on how they accomplished this?

<comment><USER9> "Plugins"

[https://reiser4.wiki.kernel.org/index.php/V4#Software_Libre_...](https://reiser4.wiki.kernel.org/index.php/V4#Software_Libre_Takes_More_Than_A_License_ ---_It_Takes_A_Design)

[https://reiser4.wiki.kernel.org/index.php/V4#The_Software_En...](https://reiser4.wiki.kernel.org/index.php/V4#The_Software_Engineering_Lurking_Below_File_Plugins)

They have some text where it shows they thought deeply about the meaning of names and domains, and how to develop file systems, what is important, etc.

<comment><USER10> Thank you for the link - the whole page is a really interesting read.

</comment></comment></comment></comment><comment><USER11> I found it very useful for transparent partition compression a few years ago (on a bootable usb stick). ZFS takes more system memory. Nowadays I would consider F2FS compression. [https://www.phoronix.com/scan.php?page=news_item&px=F2FS- Com...](https://www.phoronix.com/scan.php?page=news_item&px=F2FS-Compression- For-Linux-5.6)

[https://sudonull.com/post/126002-As-I-wrote- LZ4-compression-...](https://sudonull.com/post/126002-As-I-wrote- LZ4-compression-plugin-for-Reiser4)

[https://reiser4.wiki.kernel.org/index.php/Reiser4_Howto](https://reiser4.wiki.kernel.org/index.php/Reiser4_Howto)

</comment><comment><USER12> As I read this page, 19 comments are about the name, 1 comment is about the file system itself.

<comment><USER13> If the name were changed:

> Previously known as ReiserFS.

> The guy who made it killed his wife.

</comment></comment><comment><USER14> Reiser is up for parole this year. The hearing is in March. I myself don't have a lot of public respectability, but if you are a CS PhD or occupy a notable position at a tech company you might be able to mail the parole board. Murdering your wife is detestable but I don't think he will ever find another woman to marry him and I don't think he would commit murder under any other circumstances. I don't think he is a continuing danger to society and the world would benefit if Reiser were allowed to continue his work.

<comment><USER15> there's a lot of "don't think" in your post, and tbh, you're talking about someone who premeditatively killed his wife, hid her body, researched how to get away with murder, plead not guilty, and finally accepted a plea for 2nd degree murder in exchange for giving police the location of his wife's body.

so, "if you're a CS PhD or occupy a notable position at a tech company", i would recommend some introspection on what's more important: justice or a filesystem.

personally, i'm on the side of justice. ¯\\_(ツ)_/¯

<comment><USER14> He's gonna be homeless, without family, with a 60 million judgement over his head. He's spent over a decade in prison. Justice has been served. If he gets out, he can start earning some money to pay his kids (who are the major living victims of his crime) that restitution AND he can do cutting edge computer science research that benefits the entire Linux community.

Sometimes justice needs to be more than just retributive.

</comment></comment></comment><comment><USER16> I managed a system that really benefitted from Rieser. Reiserfs's idea of a "small file" was 1-2 orders of magnitude smaller than most other filesystems, and this system stored map tiles of the entire globe, many, many of which were 37 byte long all blue tiles. Reiserfs stored it in a fraction of what ext or xfs would take.

Ideally some meta-tile format would have been used, like with mod_tile, or some deduplication or hard linking, but reiserfs just handled it like a champ.

</comment><comment><USER17> Hopefully development can continue again in March.

</comment><comment><USER18> Feature comparison of file systems -- no other file system has all the features of ReiserFS or Reiser4:

[https://en.wikipedia.org/w/index.php?title=Comparison_of_fil...](https://en.wikipedia.org/w/index.php?title=Comparison_of_file_systems&oldid=209063556#Features)

<comment><USER19> "Murders Your Wife"

<comment> yjftsjthsd-h ... How did that make it into Wikipedia? How has it not been removed!?

Edit: Oh, that's an old version. My mistake.</comment></comment></comment>


Show HN: fwber - "gamified" FWB finder (NSFW) - <AUTHOR> http://fwber.com

<comment><USER2> Would you agree to a date/casual encounter without seeing any pictures? I know I wouldn't. And I'm willing to bet most people feel the same way. There is a HUGE difference between your friend setting you up on a blind date and agreeing to one online. Not to mention that the adult nature of your site makes it even more of a risk. If this is a potential business venture, I'd definitely change your dating model. If you're hell bent on making a casual dating site, there are other ways of ensuring quality and privacy. Profile verification is one way, private/fee based entry is another.

<comment><AUTHOR> You have to have pictures uploaded to request a "blind date."

The "blind date" is virtual, in that once you've both approved it your profiles are then exchanged with face pictures. (This is intended to protect pictures from being publicly scraped and make people comfortable with uploading them.)

I'll mention this on the front page so as not to cause confusion, thanks!</comment></comment>


DeepMind unveils broad alliance with University of Oxford (paywall) - <AUTHOR> http://www.ft.com/cms/s/0/8f21d982-59fe-11e4-8771-00144feab7de.html

<comment><AUTHOR> Link to the article without paywall:

[http://www.euro2day.gr/ftcom_en/article-ft- en/1267094/deepmi...](http://www.euro2day.gr/ftcom_en/article-ft- en/1267094/deepmind-unveils-broad-alliance-with-university-of.html)

Other way to read the article directly on Financial Times is to search for it on Google and then access it via results.</comment>


ReactJS is a tax Facebook levies on startup web development - <AUTHOR> https://typed.pw/a/1322 <comment><USER2> I've been using React for just about everything front-end wise for the past year. I don't think it's particularly hindered me, really. Sure, it was a learning curve, as was Redux, but now I understand those concepts better, my process is, I clone a 'react starter pack' from git, which has all of the build set-up I need, webpack, sass, ES6 etc, etc. And that's really it, I find it quicker to develop in React and Redux because the component approach, along with the immutability of Redux, allows me to overcome bugs pretty quickly. I find I run into less bugs, too, due to the predictability of doing everything the 'react/redux' way. I also find writing unit tests so easy in React, using 'dumb' components. So the result is, I've got some of the most bug-free, well tested front-end codebases I've ever worked on.

I guess everyone's experiences are different, and I understand that it's a difficult series of libraries to learn and understand fully, and that can be time consuming. But long-term I think it's a time saver.

<comment><USER3> I'm quite surprised seeing quite many comments telling how they use React "for everything".

Isn't React just a small[1] library that essentially does only one single thing? (And does it well) Takes a component definition, a state object, and then renders (and maintains) the component as a DOM structure?

Unless I was looking into some other React that everyone's talking about, or I've had my eyes looking somewhere else and missed something giant - I'm sure it is. Then, how come everyone's doing everything with what's just an evolution of the templating libraries? I mean, even a simplest CRUD front-end webapp isn't only about the UI.

Not trolling, I really don't get it.

____

[1] Well, technically it's not really small, because it does not of stuff under the hood to implement those virtual DOM and make things efficient. But it's end-user (=web developer who isn't hacking on React internals) functionality isn't wide-scoped. It's a library after all, not Angular or another we-do-it-all framework.

<comment><USER2> I think the great think about React, and stop me if I've missed your point, is that they're actually just libraries, not framework's, you can just pull in the parts you need and work off of those.

Say you're just doing a single page application, with some basic logic. You can just use React on its own to create components, as you don't need an entire state life-cycle. We do this a lot to 'enhance' our statically generated sites.

Or completely on the other end of the spectrum, you can use Redux, isomorphic rendering with Nodejs for example, react-router, and you can create a complete, dynamic site, with state, storage, authentication, whatever you need.

Then you have everything in between.

So you really can use React "for everything" in my view, and that's partly why I love it so much.

I don't think React is just an "evolution of template libraries", I think React is a concept, I know React didn't invent this concept of 'components', far from it, but I think it brought about the most clear-cut, concise way of creating web components, largely thanks to React's use of JSX, I think. When you team that up with Webpack (which you totally should btw), you can house all of that components dependencies in the same directory, and call them within the component, a truly modular approach.

(I promise you I don't secretly work for Facebook, I just love React).

<comment><USER4> > Say you're just doing a single page application, with some basic logic

Not trying to argue here, but don't you think for a simple static SPA, using React and creating components is too much overhead ? Why not just create the good-ol' html pages with css and js ?

I always take into account something I call as a effort-to-gain ratio. i.e.- If I have to give a certain amount of effort, I need to see proportional gain. I just don't see a proportional gain with using React in static SPAs.

But I get your point too. At a certain point when you are too familiar with a certain style of development, its hard to let it go.

</comment></comment></comment></comment><comment><USER5> This is silly. Facebook isn't forcing anyone to use React. People use it because it works better than the status quo.

>The component philosophy of React does offer some organizational benefits, especially for working in a team, but it's nothing that couldn't be replicated by some simple coding conventions.

If it's so simple to organize code why do many vanilla js codebases quickly devolve into spaghetti? It may be simple for the author, but not the average dev. Hell, it may not even be simple for the author if the author was placed in charge of a team of average devs! Just because something is easy technically doesn't mean it is easy politically. You can be "right" about something but still struggle to get others to play along. React predefines the rules and it is validated by a major tech company so people are apt to play along.

<comment><USER6> > React predefines the rules and it is validated by a major tech company so > people are apt to play along.

That's his point. By being giant Facebook can "force" React to others.

</comment></comment><comment><USER7> Well, that's some serious tinfoilery. No one is forcing startups to use React, or to stay with it of they are stuck in development due to it. Facebook did not create and release one of the most popular JavaScript frameworks in order to intentionally hamstring other companies.

</comment><comment><USER8> Leaving out the second-guessing and the search for motives, I can only say that I have only had positive experiences with React, and that the team I was part of is still working on their React app without losing any velocity after two years; I have never seen that happen with other frameworks or without frameworks at all.

</comment><comment><USER9> Agree on the direction this post is going, but that's a really cynical way of looking at it. My perspective is that a combination of factors (and FB's engineering clout played no small part) in making React trendy enough where people started using it because it was cool, not because it actually solves their problem. And I'd imagine in a lot of cases those projects aren't complex enough to warrant React, and/or developers have dived in without really understanding how it works and what it does.

</comment><comment><USER10> React is absolutely overkill for many, many web applications.

The temptation to over-engineering has been seen again and again, yet the industry continues to fall for it.

I think a lot of it boils down to the cult of the new/a fear of being left behind and, perhaps more pernicious, fear of being perceived as 'not smart enough' to deal with the complexity of these tools.

</comment><comment><USER11> It's an interesting theory but I don't see much to back it up.

In my own experience, developing rich UIs has been - after the initial learning curve - a way simpler task than using vanilla JS.

</comment><comment><USER12> I completely agree with this. Here is the key point of the article, which I think goes hand in hand with Facebook's mission to create a new web that they are entirely in control of: "From Facebook's perspective, React has to serve two functions: \- priming and funnelling programmers into their enterprise and \- suppressing development efficiency elsewhere. It's positioned very well to achieve both."

This isn't conspiracy or tinfoil-hattery as other comments have mentioned. I think it's really the case and I doubt Facebook disagrees.

</comment><comment><USER13> I see a lot of handwaving on the side of "just" (fun activity: search for the word "just" on this page) using vanilla JavaScript. Can anyone point to a sane method of putting together a real-world large(ish) JavaScript application without using (or essentially rewriting) any of the established frameworks? I am talking about a single page app with multiple sections, each with multiple pages using nested reusable components. Bonus points for solutions for performance, server-side rendering, nested routing, state management, data flow.

</comment><comment><USER14> I do react professionally. EVERY DAY. And yes I agree with you to a large extent. I just don't think it's react specifically. Take for instance, building an address form. In the year 2016 this has never been more difficult. What used to be two hours of html/css/jquery, has been turned into a nightmare of our own design. React and other heavy hitters do serve a purpose, but I think it's fair to say that things are harder now than ever.

We live in a world where many js devs only know js, this wasn't true 10 or even 5 years ago.

</comment><comment><USER15> Could not agree more. I also think React serves its purpose really well, if and only if you will have a complex web app with a lot of updates, connections and a lot of abstraction in components is beneficial for you. So if you want to test everything and want to put everything in a component: Use React, it's proven to work in large scale, look at FB.

But React is not the perfect tool for all use cases. Often many parts of your web app don't need component abstraction. React feels like app development, not like web development. Especially if most of your problems are more web designer problems React makes things difficult for you. One point I absolutely don't like is all the "massive" amount of tooling you need to get React working in a good way. I want to do web development not to be a webpack hero.

Just to be clear: I like React and it serves its purpose. But if you want to be more flexible and don't need logic in every part of your project try something lighter like vue.js (2.0 is coming out soon), which feels like a good mixture of React and Angular best concepts, which is better and ideal for "glueing" stuff and your web templates together with some advanced logic. No need to make components everywhere. It's a lighter transition (from vanilla, jquery etc.) which gives you enough power to handle every medium complex web app. And you also have components there if you want ;)

<comment><USER16> Frankly - if you're doing web development and not app development (using your words), you shouldn't be using any client-side templating _at all_. Just render templates server-side, and if necessary use something like InstantClick.

See also: [https://eev.ee/blog/2016/03/06/maybe-we-could-tone-down- the-...](https://eev.ee/blog/2016/03/06/maybe-we-could-tone-down-the- javascript/)

</comment></comment><comment><USER17> > tricking the framework into doing what we want it to do

I read this from many framework users about many frameworks. Seems like the average developer just can't change is modus operandi to work with the framework they use.

> performance is abysmal

Yes, it's not that good, but most of the time it's enough. Many people write how you should go immutable and be pure and the performance (see pure render mixin etc.) will come. I simply switched some parts of the app, that need high-speed, out with D3 for example.

> it's nothing that couldn't be replicated by some simple coding conventions

True and there are many many component based frameworks to choose from. React simply has the better eco system.

> priming and funnelling programmers into their enterprise

Yes and that's probably the main selling point of React for Facebook (i.e. why they give it away for free). They already hired a bunch of devs that did some OSS work on React.

> suppressing development efficiency elsewhere

This, on the other hand, is a bit of a stretch. They don't force anyone to use it and if you did and saw the problems with it (like I did), you could simple use a different framework. There is no shortage on JS frameworks.

What I like about React, is that it has a big eco-system/community and a small API.

After using it one year, I saw its flaws (both in React and Redux) and wouldn't use it for the next project if I have the choice.

</comment><comment><USER18> Especially when all you're building is a basic CRUD form.

Not knowing the nature of author's project, I think the issue is not so much about "levied taxes" but back to the wisdom of choosing the right tools for the problem at hand.

</comment><comment><USER19> This article is disappointingly short.

While I agree that React stuff can be done with vanilla HTML and JS for me at least it has been a dramatic improvement in code quality and productivity. And this coming from someone who refused to use jQuery for Ajax when it first came out, I don't jump on bandwagons lightly.

I also haven't seen performance issues assuming you remember to turn off debug in production. But that is not to say there isn't any.

But everyone has their own experiences.

I will say, I don't know if you can call it a tax when no one is forcing your startup to use it.

</comment><comment><USER20> I think the real reason react is taking off is the ease of integration with es6. It's weakness is the lack of support for web components. The lack of support may cause react to lag behind dart and angular 2 in the future but right now it's a nice way to work with es6 and get some pretty good code organization. Angular 2 is going to be easier to test but people also use react with typescript for the same level of testability. But ultimately the popularity has to do with the way react integrated with babel and es6.

</comment><comment><USER21> One of the most important skills in web engineering is navigating an ecosystem of tools that grew more complex to use than the problems they originally aimed to solve. And ignoring those tools, identifying and adopting only the ones that are exceptions to the rule.

While I sympathize that React ended up this way effectively, I don't believe it was the premeditated intent. It happens often enough without malicious intent that Occam's razor suggests this is only another non-malicious case.

</comment><comment><USER22> We've already been through an era of manual DOM updates with jQuery and it was pretty horrible for anything non-trivial.

<comment><USER8> My first biggish js app was built around jQuery custom events. It started out elegant and simple, I was very happy. It then quickly became a nightmare, a very non-benign spaghetti monster.

</comment></comment><comment><USER23> I think there is a tendency to reach for frameworks as a default instead of evaluating if they are really needed.

</comment><comment><USER24> Components is the main benefit of React. It forces you to think modularly, which can be very difficult at first.

</comment><comment><USER25> Web dev fads change so fast today, only young whipper snappers can keep up because they have both the time to waste and the ignorance not to know its yet another reinvention of the wheel.

Case in point Enyo.

<comment><USER25> [http://enyojs.com/](http://enyojs.com/)

</comment></comment><comment><USER26> Yeah, no. At least not any more than the same holds true for Angular, Ember, etc. And thinking it's some ingenious evil plot is a bit silly.

</comment><comment><USER27> +1. i am paying this tax tinkering with reactjs getting it to do stuff which is very trivial with normal html/js world

<comment><USER26> Here's an example of using "trivial normal html/js" inside a React component:

[http://www.webpackbin.com/VkDiCyjd-](http://www.webpackbin.com/VkDiCyjd-)

What gives you the idea you have to do everything with React if React makes something too difficult? React has escape hatches built into it for a reason.

</comment></comment><comment><USER28> Certificate authority is invalid -- would never visit.

<comment><USER8> It isn't for me.

<comment><USER29> The server isn't sending the intermediate CA certificate, so you'll get errors unless your browser has cached the LetsEncrypt intermediate (for example from having browsed a different site that sent the LetsEncrypt intermediate). "This server's certificate chain is incomplete. Grade capped to B."

Anyways, they score an "F" on SSLLabs because "This server is vulnerable to the OpenSSL Padding Oracle vulnerability (CVE-2016-2107) and insecure. Grade set to F."

[https://www.ssllabs.com/ssltest/analyze.html?d=typed.pw&s=10...](https://www.ssllabs.com/ssltest/analyze.html?d=typed.pw&s=126.96.36.199&hideResults=on&latest)</comment></comment></comment>


Apple adds SSD TRIM support to Mac OS X 10.7 Lion beta - <AUTHOR> http://www.appleinsider.com/articles/11/02/25/apple_adds_ssd_trim_support_to_mac_os_x_10_7_lion_beta.html <comment><USER2> It's disappointing that this has been lacking, it's a very important feature for proper use of modern SSDs and it's been in Windows since late 2009 and Linux since early 2010.

<comment><USER3> Which so far as proven not to be so important, especially as Apple has historically been using SSDs very resilient to that issue (according to Anandtech's tests of the 2010 MBAs).

<comment><USER4> If you think an SSD can be "resilient to that issue" you don't understand the problem. From the Anandtech article you mention:

"Either the Toshiba controller is using over 12% of the total NAND capacity as spare area, or there's only 30GB of usable flash on the drive."

So they're lying about capacity to offset the need for TRIM. Who knows the long-term implications of that decision? I noticed the benchmark didn't saturate the drive to capacity before speed tests. Maybe they didn't mention it, sloppy either way.

Perhaps long term results aren't relevant; a frequent upgrade cycle is assumed. I suppose the average user is agnostic to the capabilities of their hardware, like you suggest.

<comment><USER5> There is no reason trim needs to be done in the OS. (Not that I know of any drive that does this, but it should be possible without any OS interaction.)

<comment><USER6> Without TRIM, there's no way for an SSD to know (without cheating) which blocks are considered free by the filesystem. Increasing the FTL free space allows an SSD to absorb more writes at full speed before needing to GC.

<comment><USER5> A SSD that understands NTFS and the other major file systems while "cheating" is not impossible. Also _The TRIM command does not work on RAID volumes_ so there is plenty of room for improvement.

</comment></comment></comment></comment></comment></comment><comment><USER7> It's unfortunately NOT supported for everyone.

[http://neosmart.net/blog/2011/os-x-10-7-lion-adds-trim- suppo...](http://neosmart.net/blog/2011/os-x-10-7-lion-adds-trim-support-but- not-for-all/)

That's on a top-of-the-line C300 256GB. It's detected as an SSD, but no TRIM support though the drive itself does have TRIM.

<comment><USER8> Hmm, typical Apple - we will support only what we ship. But it should be easy to enable for 3rd party drives - probably there is a plist somewhere that maintains a list of supported drives that can be hacked or worst case a kext needs to be hacked.

<comment><USER9> Yes typical Apple, they view their products as appliances. As Steve Jobs said in 2006 or 2007[1]: "We're getting to the point where everything is a computer in a different form factor. So... So what? Right, so what if it's built with a computer inside it. It doesn't matter. It's "what is it?" How do you use it? You know, how does the consumer approach it? And so who cares what's inside it anymore."

Of course we still see them as computers because we're geeks, but for most people they simply are appliances. If things break they're not going to open up the machine and take a look, just like their TV, washing machine, etc.

Whether or not you feel that computers _should_ be appliances, Apple has _always_ had this view of their products for better and for worse.

[1] <http://www.youtube.com/watch?v=Vc8QXzYQoBY>

<comment><USER8> The Mac Pro is an appliance? Apple sells Graphics Cards, RAID Cards and stuff as add-ons to the Mac Pro. Mac Pros also can use SSDs and not many are going to be bought from Apple or packaged inside when it is bought.

<comment><USER9> Good point. The Mac Pro is definitely a computer, but it is the exception. The iMac, MacBook + Pro + Air, and Mini are not like that.

</comment></comment></comment></comment></comment><comment><USER10> danudey left a helpful link to a comment I made recently about TRIM support in Lion. Apparently, 10.6 is doing some good SSD maintenance even without TRIM support, and SSDs do not experience the same performance drops as they would on a Windows machine without TRIM support, but it is not clear why this is the case.

[http://www.bit-tech.net/hardware/apple/2010/07/01/mac-ssd- pe...](http://www.bit-tech.net/hardware/apple/2010/07/01/mac-ssd-performance- trim-in-osx/7)

<comment><USER11> Does that apply to all SSDs? From what I gather TRIM is just a spec for formalized OS-level garbage collection hooks. Some disks (like Apple-installed Samsungs) do GC at the disk-level.

My Sandforce (Vertex 2) has disk-level GC (as well as TRIM), and sometimes will block for a long period on writes now on OSX... I haven't tried it on a different OS yet.

</comment></comment><comment><USER6> As I said in the other thread, displaying the fact that an SSD supports TRIM does not prove that HFS+ uses TRIM, but it's a good sign.

</comment><comment><USER12> To someone who bought a 2010 MBA in October and doesn't get an OS that supports TRIM until this summer, what's going to be the impact on the useful life of the SSD?

<comment><USER13> None, I'd say. I've been running an older X25-m generation on a Win2K box for 14 months now. No TRIM in firmware, no TRIM in W2K. Disk has been filled and cleaned out numerous times since I bought it and it still performs adequately. I'd be surprised if your SSD would suffer from the few months until you get TRIM in 10.7.

<comment><USER14> On the other side of things, I've owned 3 X25-M's. A first gen that died in 9 months, a second gen (RMA replacement) that just started acting weird and corrupting things last month (was about 15 months old and was in a RAID 0 array with another X25M but I undid the array and began using the better of the two X25M's). Needless to say I use Dropbox, Time Machine and Carbon Copy Cloner very often.

related: <http://paulstamatiou.com/ssd-raid-performance-9-months-later> <http://paulstamatiou.com/ssd-corrupt-failure-intel-x25m>

</comment></comment></comment><comment><USER15> interesting discussion of TRIM here: [http://www.realworldtech.com/forums/index.cfm?action=detail&...](http://www.realworldtech.com/forums/index.cfm?action=detail&id=116082&threadid=115697&roomid=2)

(read the thread segments which relate to TRIM)

</comment><comment><USER16> Bend over and get screwed by Apple. At every OS update.</comment>