Element – A Desktop UI Toolkit for Web - <AUTHOR> https://element.eleme.io/ <comment><USER2> I think "desktop" in this case just means "not optimized for mobile". It's a [[desktop] [[UI toolkit] for Web]], not a [[[desktop UI] toolkit] for Web].

I guess "A UI Toolkit for Desktop Web" (as opposed to "Mobile Web") would be clearer but sound more awkward.

<comment> ezequiel-garzon As a foreigner I have always struggled with association order in English (which undoubtedly happens in other languages, but not quite like this in my native Spanish). I liked your use of brackets here and, if you or others here don't mind let me present a question I've had for the longest time. Does CGI, as in "common gateway interface", parse as "[common gateway] interface" or "common [gateway interface]"? Thanks, and apologies for the digression!

<comment><USER3> Skimming Wikipedia and RFC 3875, it seems like there was never a notion of a "common gateway" that needed an interface. The name suggests to me that there were many ways forms of "gateway interfaces" between web servers and executables, and the standard was to pick a common one.

In general, it seems English doesn't try to make a distinction. Is a small, red bird a small bird that's red or a red bird that's small? Same difference, and in fact the standard ordering of adjectives (1) would preclude such a distinction from being possible.

(1) [https://en.m.wikipedia.org/wiki/Adjective#order](https://en.m.wikipedia.org/wiki/Adjective#order)

</comment></comment></comment><comment><USER4> This is a Vue-based component library, designed for webapps in desktop-size rather than mobile-sized browsers. It's still only JS/CSS view components, nothing to do with actual desktop apps.

There are dozens of libraries like this, especially many that follow the Ant Design guidelines created by the major Chinese company Ant Financial for their own apps. Vue has a large Chinese community and is more often used in projects there, which also means the documentation might be a little wonky when translated to English.

Some other design systems and component frameworks, with varying support for mobile and corporate backing:

[https://ant.design/](https://ant.design/)

[https://quasar-framework.org/](https://quasar-framework.org/)

[https://at-ui.github.io/at-ui/](https://at-ui.github.io/at-ui/)

[https://developer.microsoft.com/en- us/fabric](https://developer.microsoft.com/en-us/fabric)

[https://vmware.github.io/clarity/](https://vmware.github.io/clarity/)

[http://appnexus.github.io/lucid/](http://appnexus.github.io/lucid/)

[https://ng-lightning.github.io/ng-lightning/](https://ng- lightning.github.io/ng-lightning/)

[https://blueprintjs.com/](https://blueprintjs.com/)

[http://www.jetbrains.org/ring-ui/](http://www.jetbrains.org/ring-ui/)

[https://www.lightningdesignsystem.com/](https://www.lightningdesignsystem.com/)

[https://elastic.github.io/eui/](https://elastic.github.io/eui/)

[https://atlaskit.atlassian.com/](https://atlaskit.atlassian.com/)

<comment><USER5> You forgot Bootstrap-Vue, Bootstrap without JQuery.

A Nuxt core member is a core contributor to the project.

[https://bootstrap-vue.js.org/](https://bootstrap-vue.js.org/)

</comment></comment><comment><USER6> I can't speak as a user of said framework, but as a developer learning Vue I like it!

I like it because it's not over-engineered with like 10 classes to do a simple dialog. You can go to any .vue file and look how they do it. It's not very difficult to copy some bits of the code and css, to do your own components. They use a bit of mixins and whatnot but for the most part you can reuse some of that code without having to bother with the node packages and whatnot. Plus they have a bunch of useful little bits of js in there for dom manipulation etc.

I also learned how to manually instantiate components and passing props to them, from this codebase. It wasn't made obvious in the Vue docs.. and it's actually SUPER useful when refactoring old codebases (like YUI2).. where I do'nt have the luxury of wrapping everything in a view, I can make a Vue dialog, or a Vue bar chart.. and "mount" it to the page. Then I can use the webpack build, single file components & all the good stuff from a modern Vue build in a legacy web app.

<comment><USER7> That is how I'm using Vue as well, new parts of the system are done Vue SFC style but old legacy parts are refactored to in page components mounted against the dom, eventually the amount of legacy jquery soup will approach a point where I can just transfer those components over a full 'Vue' style approach.

VueJS makes that all very clean and simple compared to everything else I looked at which wants you do to do it "our way or the highway".

<comment><USER6> Exactly, it's awesome because if you eventually refactor the container page or section to a Vue comp, you can include the other child components straight without any further work. They already work as full blown components.

Plus:

\- since we're mounting components and using SFC, we can use the "runtime only" build (though I keep the full one when I want to make something quick, because the savings in the minified Vye library were very small)

\- it can be a small performance improvement in cases where we want to mount something in response to user input, whereas the template in the html page will be compiled on page load (afaik).

</comment></comment></comment><comment><USER8> I know it says "Desktop" but it seems pointless to me to design something with web technology that doesn't work on mobile.

I suppose if they're committed to being desktop only they could at least remove the meta zoom tag so I could see a scaled down version on my phone and zoom and pan around, ala the original safari mobile experience.

<comment><USER9> That depends on your requirements and constraints.

"Designed with web technology" doesn't necessarily mean "designed for the public web".

In many enterprise settings desktop-only is perfectly fine because applications developed for these environments often won't ever be accessed from a mobile device anyway. Even if they are it's usually only a small part of the application that needs to be available for mobile devices.

In these cases, devoting an inordinate amount of time to making all of your design work flawlessly on mobile devices can mean a huge waste of resources.

By the way, from a cursory check - while not particularly mobile-friendly - this UI toolkit is responsive (probably also because that makes perfect sense on the desktop as well) and seems to work alright on mobile devices, too.

</comment></comment><comment><USER10> I used this recently for a serious project recently, currently deployed in production, and it was delightful. One of the best designed software UI libraries (API and UI) I've had the chance to use.

It integrated perfectly with Vue.js.

We plan to use it throughout the rest of our application as we replace Rails views/jQuery with Vue.js components.

<comment><USER11> We tried using this for one of the client facing application(not an internal tool) and found it bloated and had to make lot of customization to fulfill our needs so we wrote a custom framework which is more than 10x smaller. Not that we didn't import all the components but just the components we needed but still felt it was bloated.

</comment></comment><comment><USER12> This feels like reinventing the wheel. There are a bunch of really great "desktop" web frameworks out there, e.g. [https://ant.design](https://ant.design) \- which is great.

Apparently the Select component doesn't support any keyboard commands - something quite many users do use on a regular basis. So apparently it's a downgrade over the default browser behaviour.

<comment><USER13> > There are a bunch of really great "desktop" web frameworks out there

I don't think that ever makes sense when it comes to design. No one ever says there are so many shirts out there let's not design another one...

<comment><USER14> > No one ever says there are so many shirts out there let's not design another > one...

Perhaps not, but many should.

</comment></comment></comment><comment><USER15> So we've come full circle now yeah? Rebuilding desktop component sets in the web, to port our web apps to the desktop...

<comment><USER16> Wait for wasm-compiled desktop apps in web.

</comment></comment><comment><USER17> It looks very similar to Ant, which is a battle-tested enterprise-class UI kit – [https://ant.design/](https://ant.design/)

</comment><comment><USER18> I'm curious why these libraries aren't embracing web components more. Requiring Vue 2.0 drastically fragments the potential audience.

</comment><comment><USER19> Who remembers Cappuccino and Objective-J?

I'm sad it didn't get much traction. At the time, it seemed Apple was trying similar things with SproutCore

[http://www.cappuccino-project.org](http://www.cappuccino-project.org)

[http://www.cappuccino- project.org/learn/objective-j.html](http://www.cappuccino- project.org/learn/objective-j.html)

[https://en.wikipedia.org/wiki/SproutCore](https://en.wikipedia.org/wiki/SproutCore)

<comment><USER20> I memba'

</comment></comment><comment><USER21> You mean AT-UI*: [https://at-ui.github.io/at-ui/#/en](https://at- ui.github.io/at-ui/#/en)

It looks VERY similar

<comment><USER22> Interesting... Does the AT UI have an actual repo? I couldn't find one like Element has: [https://github.com/ElemeFE/element](https://github.com/ElemeFE/element)

Makes me wonder who ripped off^h^h^h forked whom.

edit: found [https://github.com/AT-UI/at-ui](https://github.com/AT-UI/at-ui)

Element repo history starts in September-ish 2016, AT-UI in Apr 2017. The content is very close, but I'd guess Element is the original. Not sure.

</comment></comment><comment><USER23> I wonder how it compares with Ext JS, a semi-forgotten framework which was, among other aspects, _very_ desktop-centric (in a very powerful way IMO)..

</comment><comment><USER24> What is advantage over Bootstrap, other than working cleanly with Vue?

</comment><comment><USER25> What do they mean by "desktop ui toolkit for the web"?

<comment><USER26> I thought it was an alternative to QT, GTK, Cocoa, Electron, etc, but no…

It's just another CSS framework ala Twitter Bootstrap, very misleading.

</comment></comment><comment><USER27> I'll also chime in. I started using this about a month ago and it's been rock solid and really easy to work with. Especially with Vue CLI 3.

Really like the clean interface. Ended up using this instead of Vuetify. Vuetify is really well put together and maintained, I just found that I really dislike Material design.

<comment><USER28> I like Vuetify because it has a very active Discord community and it's pretty easy to get help. The lead developer himself responds to questions fairly regularly, and comments on feature requests too.

Does Element have something similar?

<comment><USER27> There's a gitter channel for Element. But the community is not as good as Vuetify. If you are ok with the Material design look, Vuetify is far superior in terms of # of components, community participation, and developer feedback.

</comment></comment></comment><comment><USER29> Can't even see the inputs... [https://element.eleme.io/#/en- US/component/form](https://element.eleme.io/#/en-US/component/form)

</comment><comment><USER30> As much of a fan I am for Vue, I never liked this library due to its lack of mobile friendliness. Sure, it says it's for Desktop, but the only use I can think of for eschewing mobile styles is Electron apps.

</comment><comment><USER31> > span > number of column the grid spans > number > — > 24

It's not 2010 - we have grid for grids. Unless someone is paying you vast quantities of money for IE support why use something else?</comment>


Show HN: A really little API exposing Scotland's blood stocks, by blood type - <AUTHOR> https://github.com/unwitting/scotblood-stock-api <comment><USER2> Looks like a good project! Could see it being the backend for some nice visualisations.

<comment><AUTHOR> That's my intention :) it's worth checking out [https://www.scotblood.co.uk/](https://www.scotblood.co.uk/) \- they have a nice "blood-bag" visualisation on there, it's where I get my data!</comment></comment>


Literacy in the United States - <AUTHOR> https://en.wikipedia.org/wiki/Literacy_in_the_United_States <comment><AUTHOR>
      then the resultant literacy
      rate for the United States
      would be at most 65-85%
      depending on where in the
      basic, minimal competence
      quantile one sets the
      cutoff.

Wait what now? 85% at best?!?!

Seems it's true, with other studies and commentaries. But how can it be true?

<comment><USER2> It's not even that high if you set the bar where most Hacker News readers would say that a person is capable. Just 15% are supposedly college-level, and from experience in college I can say that "college-level" isn't always what you'd hope it to be.

What portion of the population can open to a random page of something like "Campbell Biology", read the text, and actually understand at least the non- technical aspects of the text? (that is, ignoring the biology-specific terms that were explained in prior pages of the book) This is a single-digit percentage.

Heck, what portion of the population can understand my comment or yours? It's well below 65%. Illiteracy is one of those things that can be a real shocking eye-opener for a person who has read well for as long as they can remember. Things you take for granted -- like reading uncommon (not memorized) road signs -- are just not possible for a large portion of the population.</comment></comment>


Ask YC: Questions on ASP.NET and Windows hosting (getting started) - <AUTHOR>

To preface this, I know pretty much nothing about ASP.NET or Windows hosting. I know the two are not popular here, but I figure someone knows something about them. I'm very familiar with Linux servers and PHP/MySQL, but I have some free time this summer and wanted to look into ASP.NET a little more closely.
Before I look into it, I'd like to know just how different the hosting aspect of it is compared to the traditional Linux/PHP setup. I'm not interested in the language/design differences right now. Note that this won't be for a startup, but rather someone who might make a couple of small CRUD-type sites; nothing crazy.
For example, PHP shared hosting is a dime-a-dozen, and there are some very good providers out there. I see that there are some shared ASP.NET hosts with good reviews as well, notably discountasp.net; would this be fine for small websites, or do all ASP.NET websites really require a VPS/dedicated server (much like Rails)?
Likewise with a Windows VPS: I see these being offered pretty cheap (~$30-40/month) that comes with Windows Server 2003. I'm guessing I would be running IIS. Would Windows Server 2003 be difficult to set up and manage from someone who is used to setting up Linux servers? On the same note, how memory-intensive are simple ASP.NET websites? On a 256MB VPS running Linux and PHP, one can fit a ton of small-traffic sites on it with no problems.
Finally, would I need to pay anything in terms of licenses? It seems Visual Web Developer and SQL Server 2005 (Express Edition) can be downloaded for free to play around with, and it doesn't seem like you need a server license when you purchase a VPS. <comment><USER2> _do all ASP.NET websites really require a VPS/dedicated server_

No. A shared hosting plan will go a long way. From my experience the biggest performance issues with hosts have been with shared SQL servers with hundreds or thousands of dbs on them. I have not used SQL Express in a shared environment, so I can't comment on the performance of that scenario.

 _I'm guessing I would be running IIS_

Correct

 _Would Windows Server 2003 be difficult to set up and manage from someone who is used to setting up Linux servers_

No. The concepts are the same. You may find IIS limiting (no built in mod_rewrite for example) but you should be able to find your way around any limitations. The problem with running your own Windows server is that you have to become a Windows security expert. You can't know enough about how to secure a Windows box (and yes, it can be done). If you don't want to manage the server and security, there are plenty of managed hosting services.

 _On the same note, how memory-intensive are simple ASP.NET websites?_

As memory intensive as simple PHP sites. The sites will use as much memory as you program them to. ASP.NET itself is not memory intensive. You can run a ton of small-traffic sites on a single box, although I'd recommend more RAM but that's for Windows and not ASP.NET specifically.

 _would I need to pay anything in terms of licenses_

Nope. The Windows license is included in the hosting fee. SQL Server on a shared server will likely be included, SQL Express is free. If you get a VPS and want to run your own full-blown SQL Server instance, you will need to pay for it and it's expensive. Some hosting companies offer SQL licenses payable per month. Visual Web Dev and SQL Express are free to download and use, including for commercial sites.

</comment><comment><USER3> Try Ultimahosts.net. It's true, there are less choices available for cheap ASP.NET hosting but Ultimahosts have got to be among the best.

You might have to ask to get it but they have shared plans that offer 400 MB storage, unlimited SQL databases, Dotnetpanel controls, unlimited domains + subdomains etc. and plenty of bandwidth to mess around for $15/month.

In fact, they don't seem to even track bandwidth.

My most memory-intensive sites are not on shared hosting but I have many smaller sites hosted on a single shared account. Good luck.

</comment><comment><USER4> Since you mention discountasp.net I wanted to say that, for most people, discountasp.net is the most expensive shared hosting you can find. I've been very disappointed w/ the quality of service from every shared host I've used in the past two years - and by "service" I mean both the speed and the technical support. I'm exclusively an ASP.NET person so I don't have experiences w/ php hosts to compare against.</comment>


Explore GitHub (trending/featured repos and podcasts) - <AUTHOR> http://github.com/explore

<comment><USER2> The "Languages" tab is great for finding interesting projects in less-common languages, e.g. <http://github.com/languages/Haskell>

</comment><comment><USER3> Looks pretty sweet. Good job guys!

</comment><comment><USER4> I dread github sites because the site is so slow; exploring it, while a very appealing idea, is unfortunately just too tedious.

In lieu of a _isitslowjustforme.com_ , is it slow for anyone else? I'm in Australia.

<comment><USER5> uh, have you used it lately? The problems were due to Engineyard and ever since github switched its hosting the site has been lightening fast.

<comment><USER4> I mentioned it because I used it just now, because of this story, and I found it too slow to really be usable. It's, you know, a comment on the submission. Other sites are fast (e.g. HN).

If they use a lot of javascript, that might be slowing it down on my eeePC; but it doesn't seem to be javascript heavy. I wonder what it is. Incidentally, git itself is lightening fast on the eeePC.

 _EDIT_ on checking, they do have a fair bit of javascript. Most of their users, on fast machines, wouldn't be affected. A "githublite" version would be nice (like slashdot and reddit have), and might even increase sales marginally. I just tired adblocking their js, and it approx. doubled the loading speed (from 10 sec to 5 sec). Still too slow.

<comment><USER6> That still seems really slow to me. I just tested my Eee, and it was loading in about 2s (in both Firefox and Chrome).

Granted, I am in the US right now, and that might be helping, but my connection is not particularly good at the moment either.

<comment><USER5> same here, i'm actually using an eeepc to read HN at the moment too and github is plenty fast.</comment></comment></comment></comment></comment>


AT&T Archives: The Unix Operating System - <AUTHOR> http://www.youtube.com/watch?v=tc4ROCJYbm0 <comment><USER2> RIP Dennis Ritchie. We all owe a great debt to you.

Heck, here I sit typing this in Firefox, written in C++, a derivative of C, on OS X, a derivative of the UNIX system. I have a Terminal open with which I am compiling PHP, written in C. His works are still relevant to today's world beyond the grave.

</comment><comment><USER3> The phrase "standing on the shoulders of giants" comes to mind when watching the video.

I wonder if Ken Thompson, Brian Kernighan and Dennis Ritchie even imagined at the time that their creation will still be carried in the pockets of over a billion people 30 years later.

<comment><USER4> > _The phrase "standing on the shoulders of giants" comes to mind when > watching the video._

Isaac Newton used the same phrase, but it was suspected he was referring to the short stature of his contemporary Robert Hooke.

Ritchie seemed down to earth, unassuming and hard working. That is why I am fond of him.

</comment></comment><comment><USER5> I don't know why it just happened now, but it finally dawned on me after seeing the video's kernel/shell/utilities graphic: the shell is a wrapper around the kernel.

<comment><USER2> Well... the shell is a layer above the syscall functions which are a layer above the kernel :)

</comment></comment><comment><USER4> The other film:

"The UNIX System: Making Computers Easier to Use"

[https://www.youtube.com/watch?v=XvDZLjaCJuw](https://www.youtube.com/watch?v=XvDZLjaCJuw)

</comment><comment><USER6> I found the old Episodes of Computer Chronicles on Unix interesting to watch: [https://archive.org/details/UNIX1985](https://archive.org/details/UNIX1985) and [https://archive.org/details/unix_2](https://archive.org/details/unix_2)

Totally unrelated: Gary Kildall comes across as if he's been a really nice guy. Poor guy. :(

</comment><comment><USER7> Lots of female developers in this video. What happened?

<comment><USER8> I was going to mention that. I could recognize Dennis Ritchie, Brian Kernighan, and Ken Thompson, but I have never heard of Lorinda Cherry [1]. Apparently, I should have, because she essentially inspired gnu plot utils, which must have had some influence on future plot utilities(?)

[1] [http://en.wikipedia.org/wiki/Lorinda_Cherry](http://en.wikipedia.org/wiki/Lorinda_Cherry)

edit: made a correction, oops

<comment><USER9> I don't know that gnuplot _wasn 't_ inspired by her work (it might have been). The wiki article you linked mentions GNU plotutils, which is different than gnuplot (gnuplot is not affiliated with GNU).

<comment><USER8> Right you are, made an edit.

</comment></comment></comment></comment><comment><USER4> Looking at the wikipedia article on Ritchie, I found this photo of attendees of the 1984 Usenix Conference [0].

At the bottom of the page it points out some faces. There is a tall guy to Dennis' right, named as Erik Fair (not familiar with him, I'll admit) but he looks a lot like Larry Wall.

The only other face I recognised was Peter Langston, it demonstrates how little is known by the general public (including myself) about the contributions of all these people to CS.

[0] [http://en.wikipedia.org/wiki/File:Usenix84_1.jpg](http://en.wikipedia.org/wiki/File:Usenix84_1.jpg)

</comment><comment><USER4> At exactly 7 minutes into the video, you glimpse Brian Kernighan's pair of walking boots, sporting some fabulous purple bootstraps.

</comment><comment><USER10> I find this far more compelling for anthropological reasons than technical ones.

<comment><USER11> I couldn't possibly disagree more.

The composition of programs through pipes remains a brilliant idea, and an extremely effective way to get a job done. I've lost track of the number of times I've heard a new programming tool described as "It's like Unix pipes for..."

C is still a remarkably popular programming language, and it has proven surprisingly hard to invent a new language that's better than C in every respect.

Many people could benefit from the ability to connect multiple programs in the shell to get a job done, even if they're not programmers.

It's hard for me to think of any computer scientists whose work remains as relevant today as the people in this video.

<comment><USER12> > The composition of programs through pipes remains a brilliant idea, and an > extremely effective way to get a job done

Except pipes were already present in another operating systems at the time, [http://cm.bell-labs.com/who/dmr/hist.html](http://cm.bell- labs.com/who/dmr/hist.html)

> C is still a remarkably popular programming language, and it has proven > surprisingly hard to invent a new language that's better than C in every > respect.

In 70's already had a few system programming languages better than C in every respect, safety, modularization, thread support, low level programming, you name it.

C's widespread into the industry is a consequence of UNIX adoption by the industry.

</comment></comment></comment><comment><USER13> Also nice to see Alfred Aho(One of the creators of Awk).</comment>


Unemployment rises to 4.4% during March - <AUTHOR> https://www.bls.gov/news.release/empsit.nr0.htm <comment><AUTHOR> Note this is based on data during March largely before the mass lockdowns began. The median consensus expectation was 3.6%, highlighting employers laying off well before lockdowns were initiated.</comment>


The Official Forecast of the U.S. Government Never Saw This Winter Coming - <AUTHOR> http://www.businessweek.com/articles/2014-02-18/the-official-forecast-of-the-u-dot-s-dot-government-never-saw-this-winter-coming <comment><USER2> FWIW, my next-door neighbors, who were dairy farmers for many years, felt quite certain that it would be a very harsh winter this year. Their prediction was based on a few natural indicators: the fact that old apple trees along our road were bearing fruit for the first time in a while; and the coloring of a certain type of furry caterpillar (sadly, like a typical city transplant, I don't recall the details at the moment). There was also something about where birds were placing their nests.

My lovely neighbors are full of observations and predictions like this, sometimes preceded by references to the Farmer's Almanac... what one could call "country wisdom" with perhaps a smile on one's face... but it really seems like they are usually right about such matters. They were so convinced of the harsh 2013-2014 winter that they decided to leave for two months of it, which they haven't done in like 50 years or something--which turned out to be a great call. Of course it could be coincidence or random chance, and I probably don't hear about or remember the times when the predictions are wrong. But I do love that there are other constructs for measuring and predicting weather other than what we typically hear about from the weatherperson on the news.

<comment><USER3> Your lovely neighbours cannot be correct except by chance; if there was any validity to their predictions, it would imply not just that they knew the future of the weather, but that the future of the weather was knowable, which it certainly is not. Your tendency to see their predictions as accurate is likely a conflation of your confirmation bias and your choice-supportive bias.

Humans naturally search for meaning in chaos. That is all that their observations of caterpillars and trees and birds amounts to. They are trying to attach significance to a chaotic universe in order to reassure themselves that their place in the world makes sense. It does not. This is mathematically verifiable.

If the birds and the caterpillars and the apple trees could know the future of chaotic systems, it would imply that we live in a deterministic universe where birds and caterpillars and apple trees could not exist. QED.

<comment><USER4> _" If the birds and the caterpillars and the apple trees could know the future of chaotic systems, it would imply that we live in a deterministic universe where birds and caterpillars and apple trees could not exist. QED."_

Wut?

<comment><USER3> Complex dynamics 101: life is a complex dynamical system. If the math of chaos is wrong, the processes underlying life would not operate as they do. Life would not exist as we observe it.

Also, your iPad would not work. As I said, QED. This is not controversial.

<comment><USER5> > Also, your iPad would not work.

What?

</comment></comment></comment></comment></comment><comment><USER5> Reading the comments is a really depressing exercise.

Do people really know the difference between weather and climate?

<comment><USER6> I'm increasingly less impressed by the claim that we can't predict weather across weeks, but we can somehow predict climate across decades. (I've never been overwhelmed by it, but it seems even less sensible over time.) And part of the reason why is that we can't seem to predict climate across years, and I'm _really_ unconvinced we can't predict climate across years but we can predict it across decades.

Wrong predictions are wrong predictions; it is irrational to keep excusing wrong predictions over and over again and insisting they'll just get more right in the unknowable future.

If the models can't look into the future even a few months and see a high probability of the vortex detaching (and I'm _fine_ with a probabilistic prediction, in fact I'm deeply suspicious of anything else), what use are they for predicting anything else? One wonders if the models are even capable of expressing that prediction (in the machine learning sense of the word "bias").

<comment><USER7> That predicting behavior at larger scales is easier than predicting it at small scales is a principle you'll encounter repeatedly in the physical science and engineering disciplines. In the physical sciences, models are often top-down, as opposed to in computing where they are almost always bottom-up. In fluid dynamics, for example, the behavior air in a turbulent flow is chaotic at the small scale. Yet, we can still design airplane wings because we have pretty good approximate models for how such flows behave at larger scales. Or to use a physics example: it's easy to predict where a baseball will land, but very complicated to predict where an electron will be in a molecule.

<comment><USER8> The analogy I like to think of is a ping-pong ball in the ocean. At any given second, its location will be hard to predict, as at the second-granularity, its location will be dominated by local phenomenon. But, over the course of months and years, we can often accurately predict where it will generally end up in the world due to ocean currents.

</comment></comment></comment></comment><comment><USER9> So are polar vortex dips now going to become a regular thing?

Because I could see rock salt becoming a valuable commodity (ironically returning us to roman times?)

What is all that salt and brine doing to wildlife and water tables?

</comment><comment><USER10> I liked Nate Silver's chapter on climate modeling predictions in his book The Signal and the Noise. He wasn't impressed. Maybe somebody needs to start a fantasy weather league.

<comment><USER11> The hilarious ending of course would be the fantasy weather league correctly predicting the weather.

</comment></comment><comment><USER12> That scroll is obnoxious. You shouldn't suddenly jar the text position out from under the reader's eyes.

</comment><comment><USER3> That is because the weather is a chaotic system. It is governed by the mathematics of complex dynamics.

Predictions diminish in accuracy with increasing time because the number of inputs rapidly approaches infinity, and each one of them can turn out to be determinative of the overall behaviour of the system.

It should be no surprise to any scientifically literate person that a weather forecast issued in October has no validity by January. Any resemblance to reality is purely accounted for by chance.

This is not amenable to the Mr. Fix-It mentality that inevitably shows up in these discussions. There is good reason to believe that weather prediction will _never_ improve, no matter what the scientific and technological developments, because the future of a chaotic system is mathematically intractable and genuinely unknowable.

The same argument applies to climate science. I'm sorry to bring you the very bad news that we live in a chaotic universe, not a deterministic one. Get over it. Wear a helmet.

Edit: The mysterious part is that the scientists at the so-called Climate Prediction Center would issue a 3-month forecast. What part of complex dynamics did they not understand? Sometimes an expert is just a guy with slides.

<comment><USER13> Prediction centers might not be able to tell the exact date and place of a storm that far out, but they can at least tell if a season is going to be bad well ahead of time.

Edit: It says this right in the article: _climate forecasters focus on things that change more slowly, such as temperatures of the land and oceans... they try to say whether a given three-month period will be wetter, drier, hotter, or colder than average._

<comment><USER3> I'm sorry, what part of complex dynamics did _you_ not understand?

It doesn't matter how slowly things change. It doesn't matter how big the inputs are. Complex dynamics teaches us that scale does not matter; very small inputs can and do end up being more important than very large inputs.

I'll say it again: _scale does not matter_.

No, they cannot tell if a season is going bad well ahead of time. It is a fallacy to think that they can. They can tell that a season is going bad exactly at the moment the season starts to go bad.

Why is it that every time I raise the issue of the unknowable future of chaotic systems that people down-vote me? Is it so hard for you to accept? Check the math and the science: it is sound. I am sorry you do not like it, but the mathematics of chaos is not some fringe idea. It underlies everything. I'm astonished that so few people have noticed this.

<comment><USER13> Chaos theory does not mean that literally anything can happen. Weather changes are still bounded by energy inputs and outputs. It can't rain if the humidity in the air is too low. The jetstream isn't just going to reverse course anytime soon, although it is shifting slowly. It's physically impossible to have snow if the weather is too warm - complex dynamics can't change that. I'm not saying a forecast will never be wrong, but not every case is an edge case. With good data and a useful model, you can be right most of the time.</comment></comment></comment></comment>


Angst about DNS Privacy and DoH / Doc - <AUTHOR> https://www.potaroo.net/ispcol/2019-04/angst.html <comment><USER2> Most linux users could probably install bind if they were worried about dns privacy. There are lots of tutorials on it.</comment>


Are functional languages the future of programming? - <AUTHOR> http://lesswrong.com/r/discussion/lw/55y/are_functional_languages_the_future_of_programming/

<comment><USER2> Functional programming basically just means that you handle program state explicitly- All the other parts of FP follow from this fact.

Having explicit state is a good idea and _may_ become the default way to write programs at some point in the future- You would only deviate from this if you have a specific reason (such as a performance optimization.)</comment>


What Neil & Buzz Left on the Moon (Other Than Footprints) - <AUTHOR> http://science.nasa.gov/science-news/science-at-nasa/2004/21jul_llr/

<comment><AUTHOR> A very interesting example of relatively lesser-known scientific innovations. It is a surprisingly rare knowledge. In fact, it is one of the evidences scientists use to refute the claim of the moon-landing deniers.

It is also worth mentioning that this project has now been axed (in 2009 to be precise) as the mirrors have gotten dusty and no longer provide the same worth of scientific data they used to [1]. The above post was written in 2004, long before such problems surfaced.

[1]: www.guardian.co.uk/technology/2009/jun/21/mcdonald-observatory-space- laser-funding

</comment><comment><USER2> This was mentioned in the article: "But Einstein, constantly tested, isn't out of the woods yet. Some physicists (Alley is one of them) believe his general theory of relativity is flawed. If there is a flaw, lunar laser ranging might yet find it."

Does anybody know what specific flaw(s) they're talking about?

<comment><AUTHOR> A scientific theory is a set of principles that explain and predict phenomena. All theories are only provisional, in that they are upholded every time an observation supports the predictions they make. In principle, a good observation that is inconsistent with a theory's prediction can falsify it.

In this case, Einstein's theory predicts the lunar orbit to be slightly different than Newton's gravitation model. If someone could find a discrepancy in new observation he would have found a flaw in Einstein's theory of general relativity.

As of this writing, no flaws have been found in the theory of general relativity. Though such claims pop up every now and then.

</comment></comment><comment><USER3> What do they mean when they say the gravitational constant has changed less than 1 part in 100 billion? Surely that's within experimental error? I think they mean to say "there is no evidence that it has changed at all".</comment>


Chromium OS ported to iPad - <AUTHOR> http://www.engadget.com/2010/09/29/chromium-os-infiltrates-ipad-makes-itself-comfortable/

<comment><USER2> If this actually works without any roadblock like catches, I wonder if Apple will start modifying the iPad to make chromeOS (or any other OS for that matter) can't run on it. I don't know if there's anything you can do from a Hardware perspective to stop someone from installing a different OS, but the cat and mouse game will be fun to watch nevertheless.

<comment><USER3> I doubt it. Apple seems to understand the futility of the cat & mouse game. Even with the Hackintosh community that is not buying an Apple computer and probably pirating OSX they haven't added any additional road blocks since the first public x86 OSX Tiger build from 2005. Even with jailbreaking they haven't taken a very aggressive stance besides fixing exploits.

</comment></comment><comment><USER4> Thats almost a reason to get an iPad. I wonder what else could be ported over

<comment><USER5> Tablets and netbooks that run Chrome OS will be released in one or two months, so you might want to wait a bit.

</comment></comment><comment><USER6> Besides hacking coolness, is there any point in swapping iOS for Chromium? You get almost same WebKit browser, but without iOS apps?

<comment><USER7> * Multi-user

* Flash (I browsed the Bowmore whiskey site on my iPad last night... I still hit this occasionally - <http://www.bowmore.co.uk/> )

* The chance of getting some native Google apps from the Chrome appstore

* Perhaps a chance to break the dependence on iTunes for updates (just give me OTA already and don't require a link to a computer)

* Chrome Sync so your tabs, passwords, bookmarks go with you

Hell, I'd want it for most of the above. Though I'm growing dependent on the Twitter app for iPad (thankfully the site is catching up fast) and also Flip Board (which doesn't yet have a HTML5 version or Chrome version.

<comment><USER8> Multi-user?

<comment><USER9> Meaning you could share the iPad with other members of the house, and each member could have their own login with their own preferences, their own bookmarks, plugins, history, saved passwords, etc.

<comment><USER10> i guess Apple will somehow port that feature out into the iPad sometime into the future... Pretty sure Jobs did not see the iPad becoming a family shared pc substitute household device...

<comment><USER11> ...or Jobs is hoping every family member gets their own iPad.

</comment></comment></comment></comment></comment></comment><comment><USER12> Looking forward to seeing more details on this... I'm guessing an ARM build of Chromium OS' userspace components[1], ported to run on iOS' Darwin kernel?

If that's the case, I'm guessing there could be a Chromium OS "App" for "normal" jailbroken iPads (running in a chroot jail or similar.)

As I see it, the alternative way would be a working port of Linux to Apple's A4 SoC, but AFAIK that doesn't exist. :(

[1] <http://code.google.com/p/chromium-os/wiki/ArmWIP></comment>


"Side Hustle" as a Sign of the Apocalypse - <AUTHOR> https://medium.com/sandpapersuit/side-hustle-as-a-sign-of-the-apocalypse-e7027a889fc2#.585tus3xm <comment><USER2> > "These tech companies position themselves as heroes. They talk about > "changing the world" constantly. Yet all they do is churn out technology for > rich, white dudes in their 20s/30s who live in big cities and want apps to > fill in the blanks for what mommy used to do. [...] And they even call it > "mom-tech." We're letting our lives be dictated by brogrammers who want to > breastfeed forever."

This goes directly in my quote trove ! :-)</comment>


Bloom – Super fast and highly configurable cache for REST APIs - <AUTHOR> https://github.com/valeriansaliou/bloom <comment><USER2> I read pretty far into the readme before I realized this doesn't somehow use bloom filters.

</comment><comment><USER3> How does it compare to Varnish ?

<comment><USER4> Vastly simpler, I understand what Bloom is doing after 10min of reading. I had hard time even understanding all of Varnish's scope in same time.

Written in RUST. Uses Redis. Uses custom headers instead of Cache-Control Seems more flexible cache invalidation, but maybe varnish can do this after understanding all of VCL/Varnish.

Seems written for an API developer not wanting to write own/reinvent cache layer for their REST API. vs written for a sysadmin who is building a system that is larger/more generic, less tied to one specific app, and who would reach for Varnish being old, reliable and having every feature ever thought of.

<comment> nathan-io > an API developer not wanting to write own/reinvent cache layer for their > REST API

For Laravel projects at least, a package like spatie/laravel-responsecache makes it super easy to handle caching for GET API routes. I'm sure there are similar packers for other frameworks often used in API development.

I really like Bloom, I'd just rather handle it at the application layer, where I can get the finest level of customization (assuming there's a suitable package to abstract the most tedious work away).

Seems you could keep the associated code to a minimum, and easily maintainable, by using model events to trigger cache updates.

Personally, I'd rather have a little more code than a new dependency (and the resources the Bloom takes from each API worker it's installed on). But in situations where it's non-trivial or inadvisable to do it at the application layer, it seems Bloom could be quite useful.

</comment></comment></comment><comment><USER5> Curious, if you already are running NGINX in front, why not just use proxy_cache?

</comment><comment><USER6> Reminds me of [https://varnish-cache.org/](https://varnish-cache.org/)

</comment><comment><USER7> What's the difference between this and varnish or nginx acting like a reverse proxy?

<comment> nathan-io Found this at [https://crates.io/crates/bloom- server](https://crates.io/crates/bloom-server):

> A simpler caching approach could have been to enable caching at the Load > Balancer level for HTTP read methods (GET, HEAD, OPTIONS). Although simple > as a solution, it would not work with a REST API. REST API serve dynamic > content by nature, that rely heavily on Authorization headers. Also, any > cache needs to be purged at some point, if the content in cache becomes > stale due to data updates in some database.

> NGINX Lua scripts could do that job just fine, you say! Well, I firmly > believe Load Balancers should be simple, and be based on configuration only, > without scripting. As Load Balancers are the entry point to all your HTTP / > WebSocket services, you'd want to avoid frequent deployments and custom code > there, and handoff that caching complexity to a dedicated middleware > component.</comment></comment>


Speculation Regarding the Pricing of and Strategy Behind This Year's New iPhones - <AUTHOR> https://daringfireball.net/2017/07/speculation_on_new_iphone_pricing <comment><USER2> I think Gruber's analysis here is spot-on, and does a great job of marrying basic supply/demand economics to the absolutely bonkers scale of iPhone manufacturing... This September's announcement is going to be one to watch!</comment>


SystemML: Machine learning made easier (open source) - <AUTHOR> https://developer.ibm.com/open/systemml/ <comment><USER2> I'm slightly concerned about the Hadoop/Spark + machine learning ecosystem right now.

There seem to be a lot of technologies and projects being built up on the core foundation of in memory distributed computation. MLlib in Spark, H2O, Apache Mahout/Samsara, probably many others.

My impression is Samsara and SystemML's DML are being designed to supply the primitives you need to build a machine learning model with less awareness of the underlying system model. So this is ostensibly to save the developer of a new algorithm the headache of thinking how their algorithm needs to relate to the distributed computation model like one should consider for developing with H2O or Spark. However, It seems like many common off the shelf algos are already available and implemented indicating that perhaps working with Spark or H2O backends directly is not that hard to produce performant ML codes.

As a computational scientist learning a DSL to accelerate development of an algorithm of mine into production via Spark seems like a potential distraction from just getting better with Spark.

<comment><USER3> The current Big data ecosystem is a difficult place to be for companies that bet the house on hadoop (cloudera, Hortonworks, MapR) for sure.

There are new technologies coming at a breakneck pace. Check out apache Flink if you need streams and the microbatches in Spark don't do it for you. The ML lib there is not that far ahead yet though.

</comment></comment><comment><USER4> This project just entered the Apache Incubator 2 days ago. [http://wiki.apache.org/incubator/SystemML](http://wiki.apache.org/incubator/SystemML)

</comment><comment><USER5> If anyone is interested in working on this (or other exciting Spark related things) @ IBM please reach out to me ( my HN username with the letter k removed at us.ibm.com )

<comment><USER6> Has there been any work toward integration with IPython/Jupyter?

<comment><USER7> Getting IPython/Jupyter connected to Spark isn't hard.

I did it following a combination of these two guide:

[http://ramhiser.com/2015/02/01/configuring-ipython- notebook-...](http://ramhiser.com/2015/02/01/configuring-ipython-notebook- support-for-pyspark/)

[http://thepowerofdata.io/configuring-jupyteripython- notebook...](http://thepowerofdata.io/configuring-jupyteripython-notebook-to- work-with-pyspark-1-4-0/)

Edit, if this is interesting then... [https://news.ycombinator.com/item?id=10496385](https://news.ycombinator.com/item?id=10496385)

</comment></comment></comment><comment><USER8> The readme in the github repo has more information: [https://github.com/SparkTC/systemml](https://github.com/SparkTC/systemml)

</comment><comment><USER9> > written in Java

gotta go, see ya!</comment>


Notion ink adam price, specs beat ipad, but not release date - <AUTHOR> http://technabob.com/blog/2010/02/15/notion-ink-adam-price-specs-release-date/

<comment><USER2> I hate to be a pessimist, but "call me when it ships." I've read so many articles about "iPad killers" (before and after the iPad launch) that I've become entirely desensitized to their promises. I feel a great deal of reservation about rewarding companies with my time, attention, and admiration until they ship an actual device.

</comment><comment><USER3> I'm interested in this device mostly for the Pixel Qi screen. Luckily some other tablets are coming out that will be using that as well (supposedly), but the Notion had the most interesting feature-set of the bunch. The amount of hype followed by absolute silence is getting to be annoying, though.</comment>


Phalcon PHP - A high-performance PHP framework implemented as a C extension - <AUTHOR> http://phalconphp.com

<comment><AUTHOR> Here's a cached copy of a website that benchmarks all the popular PHP frameworks. Phalcon PHP blows the competition away. (The website must be down or something.)

[http://webcache.googleusercontent.com/search?q=cache:e0uj7yP...](http://webcache.googleusercontent.com/search?q=cache:e0uj7yPpEZcJ:systemsarchitect.net/performance- benchmark-of-popular-php- frameworks/+php+framework+seped&cd=1&hl=en&ct=clnk&gl=us&client=safari)

<comment><USER2> More about YAF from a kohana framework forum thread:

\- - -

The author Laurence is a member of PHP development team.

The manual is in

[http://yaf.laruence.com/manual/index.html](http://yaf.laruence.com/manual/index.html),

the workflow of the framework is in

[http://yaf.laruence.com/manual/yaf.sequence.html](http://yaf.laruence.com/manual/yaf.sequence.html)

the benchmark is in

[http://yaf.laruence.com/manual/yaf.bench.html#N20171](http://yaf.laruence.com/manual/yaf.bench.html#N20171) (yes, it's very fast).

The problem is the manual is written in Chinese, because Laurence is a Chinese programmer who worked in Yahoo and Baidu(the second biggest Search engine around the world).

\- - -

And this from Laruence, YAF vs Phalcon:

[http://www.laruence.com/2012/09/16/2791.html](http://www.laruence.com/2012/09/16/2791.html)

</comment></comment><comment><USER3> I am spamming this in every other framework thread today, so I might as well add it here. Here's our single-query test filtered to show PHP only.

[http://www.techempower.com/benchmarks/#section=data-r6&hw=i7...](http://www.techempower.com/benchmarks/#section=data-r6&hw=i7&test=db&l=sg)

Phalcon does quite well with a 50.5% overhead rating.

<comment><USER2> Saw YAF there too, also written as a PHP extension:

[http://www.yafdev.com/](http://www.yafdev.com/)

At 40% overhead ratio, between phalcon at 50% and phalcon at 20%.

</comment></comment><comment><USER4> The downside of these C frameworks is that you'll have to use gdb to debug code. Not sure if it's a wise move. If performance matters (and you're stuck with a php codebase) HipHop is more practical imho.

</comment><comment><USER5> Wow this looks really cool.</comment>


Ask HN: Found a way to fraud my bank thru a loophole, how to disclose properly? - <AUTHOR> Hey guys,
First, excuse the messy title - I was limited to 80 characters.
I recently found a way to create money out of thin air through a loophole in my bank's current banking portal.
I tried reporting it a few times, but every time I am stonewalled by a low-level employee, telling me they will call me back later in the day, which never ends up happening. The furthest I've come is to call their abuse department, found on their ARIN records, who seemed to take it seriously, but I ended up going full circle - back to the low level-guys.
I discovered it inadvertently and, technically, defrauded them of ~0.32 US$ using legitimate transactions that the bank's software should have handled differently. Pennies, but still.
I also confirmed the issue with other accounts and other transactions - my account is not a glitch in the system.
What is the best course of action? How would you get in touch with security officials at a big bank?
I mostly don't want to get caught or charged with (attempted?) fraud over $0.32.
I have also spent quite a few hours trying to disclose it, unsuccessfully. What would be the best way to get some of this time spent trying to do things right compensated?
Thanks! <comment><USER2> Stop.

You're risking your freedom to save a corporation.

If you press ahead you will be dealing with people who lack knowledge and are scared of what you did affecting their career. They will rake you over coals. And you will have gained what? The minute pleasure of helping them save a few bucks?

You have a desire to help people. That's great and noble and commendable. But that's not what you would be doing here.

My advice: drop it. It's not worth it. If there was no risk to life or liberty from what you found, then yes chase the disclosure. But there isn't. Drop it and forget it ever happened. Your life is worth it.

<comment><USER3> I can't agree more with Brador, you're really risking your freedom and if they don't have a bug bounty, you might end up in court / being sued.

Here is a google translate from a French article that you might find interesting : [https://translate.google.com/translate?sl=fr&tl=en&js=y&prev...](https://translate.google.com/translate?sl=fr&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fkorben.info%2Ferreurs- dun-professionnel-pentest.html&edit-text=)

<comment><AUTHOR> Thanks for the link

</comment></comment></comment><comment><USER4> I use LinkedIn when I have to penetrate a bureaucracy such as this.

Nothing gets action faster when a VP or higher get a personal email / phone call regarding something like this.

Step 1: Troll linkedin to find these people in positions of real power.

Step 2: If they are easy to reach via email or on the platform, try that. Failing that, call their HQ and work the phones until you get to them.

Step 3: Win.

<comment><USER5> I think you mean "trawl," not "troll." :-)

<comment><USER4> ...or do I ;-) ?

</comment></comment></comment><comment><USER6> Document your attempts to alert the bank. You should have proof that you contacted them about it. Don't use the loophole obviously. Definitely switch banks.

<comment><AUTHOR> Yep, good idea.

I'm documenting everything I can think of. Tried the loophole three times - once inadvertently, a second time to try a different approach and a third time on a different account. Told the low-level techs all about that, they didn't seem too concerned about le ~0.32$ I created, but still being careful.

I'm documenting everyone I talk to as well - there is never any case file # though. Are there any other things you think I should document?

As for switching banks - definitely will. This is realllllly bad.

<comment><USER6> If it's possible for regular transactions to look like fraud due to this loophole, you should make sure all your legit transactions have a paper trail (receipts or whatever).

<comment><AUTHOR> Good idea, thanks!

</comment></comment></comment></comment><comment><USER7> Just drop it. It only hurts the bank and you did your best to warn them. At this point the only reason to peruse it is to get recognition/reward or attention for being clever.

</comment><comment><USER8> I am a developer who works with one of the largest US banks and I would love to speak with you about what you have found and pass it along to the head of security in my office.. Unfortunately like others have pointed out you will more than likely encounter low level employees who dismiss you OR, and this is the dangerous part.. you may bruise the ego of someone in a position who can and should listen to you.. possibly resulting in adverse actions being taken against you. Do you have an email address I could contact you at? I could conference you in to my department and see the exploit you found(MOST banks share the same backend software for their online services so this is alarming)

</comment><comment><USER9> Call the bank's regional HQs. Ask to speak with the manager of security. Report the instance. Ask for his/her name and number. Tell the individual you plan to go public with the information in 48 hours if there's no resolution.

The individual will feel a career risk and act accordingly.

<comment><AUTHOR> Bold. Love it!

</comment></comment><comment><USER10> Try to find developers that work at the bank via LinkedIn or something. Ask if they have a bug bounty program, and disclose things appropriately. You won't ever get to the right person calling in on the customer support or abuse numbers. You need to go around.

EDIT: Also, how long does that money stick around in your account? I wonder if there is some kind reconciliation processes that go through and square everything up. The web software is probably just a replica of the actual ACH data, so maybe those processes would correct things and it's not as big of a deal as it seems to be?

</comment><comment><USER11> STOP, you're already done this on multiple accounts that is asking for trouble.

I wouldn't risk interacting with them further if they aren't interested in listening.

Document that you tried to contact them and report it so they can fix it.

But you're in the gray area where they could attack you feeling you were attacking their their system.

Forget it and move on.

Otherwise you're going to be tempted to: [https://www.youtube.com/watch?v=GyB6ffmXsZo](https://www.youtube.com/watch?v=GyB6ffmXsZo) (Office Space Virus Scene) And we all know how that ends.

</comment><comment><USER12> Document the vulnerability. Document your attempts to contact the bank.

Contact your local[1] newspaper. Particularly one that is big on investigative journalism, and technology.

A good hint is if they covered the recent SWIFT bank heists.

[1]Local is relative. If it is a big national bank, go national.

The idea is for them to do an article, not necessarily exposing the vulnerability, but how processes (or lack thereof) in the big banks allow security holes to go unfixed.

</comment><comment><USER13> I have to ask the folks here. Given the OP used an ID that seems easily traceable and he/she admits to defrauding the bank publicly (I know, just .32 USD, but still people are going to prison these days for so many silly things). Should OP retain legal counsel and have the lawyer make contact with a VP?

Or does lawyer-ing up make OP look guilty from the start?

<comment><AUTHOR> Well, there are audio recordings of bank staff asking to demonstrate the flaw and there are also recordings of the same staff telling me that going public is within my rights, but they don't seem to understand the underlying issue.

Not sure about lawyering up, maybe it's something that I should do (should have done?)..

<comment><USER13> IANAL, but I thought I would mention it anyway. Do you have these recordings for safe keeping?

<comment><AUTHOR> Some places, yes. But you're right, definitely. Better safe than sorry!

<comment><USER13> One more idea. I once witnessed another company being shown a competing companies unreleased product while testing my own product in a testing facility. I send them an unmarked envelope with a letter of what I saw and the names of the people involved (as they were wearing name tags). This is stone- age now, but perhaps it might help.

</comment></comment></comment></comment></comment><comment><USER14> You've tried to disclose and they made it impossible. Time to post it on Twitter and cc @troyhunt.

<comment><AUTHOR> Hah! Yeah, that's definitely something I'll try if my latest inquiries don't go through! :) Thanks!

<comment><USER14> Good luck! I respect that you're making the effort to do the right thing, even though I don't think the bank deserves it.

</comment></comment></comment><comment><USER15> It's amazing that any large firm who business heavily relies on security doesn't have some kind of report a bug or bounty system easily findable. This should be as standard as a 404 page.

</comment><comment><USER16> > What would be the best way to get some of this time spent trying to do > things right compensated?

That depends how quickly you can get the money out of the bank, and get yourself out of the country!

</comment><comment><USER17> The bank isn't going to pay you money. You gain _nothing_ from reporting this, and risk getting fucked over for mere pennies. Just forget about it and move on with your life.

</comment><comment><USER18> You could contact a legitimate security firm that buys vulnerabilities to get the credit (and knows how to report responsibly).

You want one that immediately discloses and does not resell.

</comment><comment><USER19> > What would be the best way to get some of this time spent trying to do > things right compensated?

Creating more money out of thin air seems like the appropriate compensation. /s

</comment><comment><USER20> Is this a big bank? If so I would let it slide.

If you really understand how big banks stole from the US taxpayer in 2008, you might want to steal more.

</comment><comment><USER21> Don't call from your land line. Don't call from your cell phone. Find a public phone, away from cameras.

</comment><comment><USER22> apply for a job with the bank

<comment><AUTHOR> Well, I don't really want to work there. And I wouldn't be able to disclose the info simply by applying, I'm sure.

The real question is - how can I get the higher ups attention? Or would I be better off going public with it, given the private disclosure didn't work out?

<comment><USER23> When I worked at a big company, one thing that always got everyone's attention was when the CEO received written letters from his customers. It's a very slow way of going about airing grievances, but it might work the same way. The CEO was notified and every letter was responded to.

<comment><AUTHOR> Similar to the LinkedIn[1] idea - I like it! Nice, clever and convenient :) Thanks

[1] [https://news.ycombinator.com/item?id=11772336](https://news.ycombinator.com/item?id=11772336)

</comment></comment></comment></comment><comment><USER24> _defraud_ is the verb form. To defraud is to illegally obtain money from (someone) by deception.

 _fraud_ is the noun form. 1) wrongful or criminal deception intended to result in financial or personal gain or 2) a person or thing intended to deceive others, typically by unjustifiably claiming or being credited with accomplishments or qualities.

The English language is changing. Modern usage has promoted some nouns to verbs in informal use, but for many of us, the change is a bit like scratching your fingernails on a blackboard. In a situation like this, where credibility is important, careful attention to usage and spelling is critical.</comment>


The world's most expensive book? A 1992 volume on flies - <AUTHOR> http://www.tgdaily.com/unbalanced/55566-the-worlds-most-expensive-book-a-1992-volume-on-flies

<comment><USER2> Much discussed already in previous submission to HN:

<http://news.ycombinator.com/item?id=2475854></comment>


Ask HN: If an unique email-adress receives suddenly Spam - <AUTHOR> Hi,
I create an unique email-address for each web service and suddenly such an email-address started receiving Spam.
Does it always mean the provider either sold addresses or was compromised? I am asking to ensure that my systems, e.g. mail server, browser, PC didn't leak such data.
What do you think? <comment><USER2> Not necessarily. A spammer may have generated a list of plausible e-mail addresses. For example, if your unique e-mail address is email@example.com, it's pretty easy to guess by combining common first names, last names and numbers. But if it's firstname.lastname@example.com, it has probably been leaked or hacked.

<comment><AUTHOR> yeah, thanks. the unique email-address is a number-code-service- email@example.com and can't be guessed really.

I thought that my system may have leaked such email-addresses, e.g. my own mail-server (horde), or apps uploaded my address book or browser add-ons or LastPass-hack to login with that email into the service provider.</comment></comment>


GnuPG 2.2.0 released - <AUTHOR> https://lists.gnupg.org/pipermail/gnupg-announce/2017q3/000413.html <comment><AUTHOR> Announcement for the previous version:

[https://news.ycombinator.com/item?id=14971203](https://news.ycombinator.com/item?id=14971203)

Rationale for reverting to --no-auto-key-retrieve:

[https://lists.gnupg.org/pipermail/gnupg- devel/2017-August/03...](https://lists.gnupg.org/pipermail/gnupg- devel/2017-August/033021.html)</comment>


Lambdas: From C++11 to C++20, Part 2 - <AUTHOR> https://www.bfilipek.com/2019/03/lambdas-story-part2.html <comment><USER2> Related to the capture of this and exceeding its lifetime, I've been doing it thusly:

      class Foo : enabled_shared_from_this<Foo> {

        void start_callback() {
          auto thisp = shared_from_this();

          function_taking_callback([this, thisp](int err) {
            if (err) errFlag = true;
          });
        }

        bool errFlag{false};
      }

The idea is that thisp is captured in the lambda and extends the lifetime of this until the callback is destroyed. And because this is also captured you can refer to member variables implicitly.

<comment><USER3> I've used this in the past, but I've had trouble with "phantom callbacks". Where the logic of the program assumes the object is gone, and it ends up changing program state unexpectedly. The problem with shared pointers is ownership is not clear - just because you don't segfault doesn't mean there's no bug.

<comment><USER4> Exactly. I've had endless arguments about that exact point with shared_ptr. IMHO, shared_ptr should be used as a last resort, where ownership of something truly is shared. Use unique_ptr for everything else.

Just using it for convenience for things like callbacks will lead to weird, hard-to-debug bugs in more complex code.

</comment></comment></comment><comment><USER5> Wow, as somebody who has "seriously" worked with C++ professionally since ~5years and with more "user friendly" languages since decades, these new features don't blow me out of the socks. Conversely, I'm terrified by the super complex syntax of these examples. Sure, these are synthetical border cases, but it shows the abysses of C++ logic. I get headache already with error messages from contemporary C++ templating and don't even got my hands touched with error messages from future templated lambdas à la C++...

<comment><USER6> Some of them are complex, some are less complex than they used to be. For example look at the first article in this series that discusses the very common mistake of incorrect parameter types leading to unwanted copies, which is solved by generic lambdas where the compiler is permitted to deduce the type.

      std::map<std::string, int> numbers {
        { "one", 1 }, {"two", 2 }, { "three", 3 }
      };

      // each time entry is copied from pair<const string, int>!
      std::for_each(std::begin(numbers), std::end(numbers),
        [](const std::pair<std::string, int>& entry) {
            std::cout << entry.first << " = " << entry.second << '\n';
        }
      );

This has an error, which is harder to commit in c++14 and forward, with a more compact expression:

      std::for_each(std::begin(numbers), std::end(numbers),
        [](const auto& entry) {
            std::cout << entry.first << " = " << entry.second << '\n';
        }
      );

<comment><USER7> In all honesty in my experience both of these approaches are wrong. Rather, it's using the good ol' typedef, which you should already be using pretty liberally anyway:

      typedef std::map<std::string, int> Numbers;
      Numbers numbers {
        { "one", 1 }, {"two", 2 }, { "three", 3 }
      };

      // each time entry is copied from pair<const string, int>!
      std::for_each(std::begin(numbers), std::end(numbers),
        [](const Numbers::value_type& entry) {
            std::cout << entry.first << " = " << entry.second << '\n';
        }
      );

Or if you're feeling particularly pedantically correct, you can replace const Numbers::value_type& with Numbers::const_reference, but I don't go that far generally.

IMHO one of the mistakes of (many, even very experienced) C++ programmers is that they don't realize typedefs are such a powerful tool to be used liberally throughout a code base, and they instead overuse auto and decltype. Typedefs prevent you from repeating yourself, prevent accidents like these, make changing the underlying types a breeze, are self-documenting, and (when needed on occasion) let you use a different type for a variable than the expression used to initialize it, which isn't possible with auto.

</comment></comment></comment><comment><USER8> Part 1 says that it is not correct to call a lambda which value-captures a member of a temporary instance of a class. Is that really correct? Isn't the whole point of value-capturing that the value is copied and preserved regardless of the life of the source of the captured value?

<comment><USER9> This is only related to the use of the _this_ pointer.

If you have a member of a class called _s_ then any mention of _s_ inside a member function of the class is really a mention of _this- >s_.

After you understand that, you can just apply all the regular rules of lambdas to understand why it gets you in to trouble.

 _this- >s_ is a capture of _this_ , not _s_. _this_ is a pointer and therefore capturing it by value isn't going to extend the lifetime of the object it points to.

<comment><USER8> I see from the below link that the 'STAR this' pointer would be captured implicitly by reference in this case. This happens regardless of a default capture type if it does exist.

To truly capture a member by value, you can (1) make a copy of that value in the enclosing function, thus making it an automatic variable which can be value-captured, (2) value-capture through an initialiser in the capture list or (3) you can indicate 'STAR this' (since C++17) as a capture, which then captures the 'this' as a value copy and thus transitively your member.

[https://en.cppreference.com/w/cpp/language/lambda#Lambda_cap...](https://en.cppreference.com/w/cpp/language/lambda#Lambda_capture)

</comment></comment></comment><comment><USER10> Is it possible yet to use C++ productively without the preprocessor at all (including in the standard libraries)?

If not, then the C++ committee should focus on that, imho.

<comment><USER11> What's the problem with the preprocessor?

<comment><USER10> Sorry, perhaps I should have elaborated on that. See for example the top answers here for a good discussion:

[https://stackoverflow.com/questions/14041453/why-are- preproc...](https://stackoverflow.com/questions/14041453/why-are-preprocessor- macros-evil-and-what-are-the-alternatives)

</comment></comment></comment><comment><USER12> The website seems to have been hugged to death. Does anyone have an alternative link or cache? (I tried to get one from google but it is 404-ing)

<comment><USER13> Its back up now but here's a cache [http://archive.is/lP77x](http://archive.is/lP77x)

</comment></comment><comment><USER14> Thank you!

This was helpful, concise, well written, yet did not throw a SUBSCRIBE TO OUR NEWSLETTER popup in my face, did not ask me to create an account, did not bombard me with ads and did not come across as the usual LOOK AT ME I'M AWESOME HIRE ME. If I could upvote this more, I would.

</comment><comment><USER15> Isn't it better to learn lisp first?</comment>


What's up with HN? - <AUTHOR> I'll provide more details in a full writeup later.
We suffered a DDOS. The volume of traffic was sufficient to keep us from handling it in Arc like we always have before. Simply accepting and dropping all requests not from our office required 45% CPU utilization.
Now nginx is helping with some of the work. Ironically the transition was planned for today anyway, except it was meant to happen at night with no downtime. So it goes.
I'm fixing things as I find they're broken.  Please let me know if I've missed anything.
Edit: Yes, I know about and will fix all the SSL resources. Like yours, my Chrome window was also a portal to the '90s for a bit.
Edit Again: Your SSL resources should now be happy. Let me know if I missed any. <comment><USER2> Hi, it seems all the major sites that have been hit recently have been using the "DDOS" term as a catch all, which really doesn't provide any insight for those of us who are trying to protect our own sites and understand wtf seems to be happening lately with all these high-profile attacks.

A site could, because of its own deficiencies in handling normal traffic, call any outage a "DDOS attack". Not saying this is the case with HN, but see what I mean.

Could you at least specify, is this a massive scrape, which would indicate an attempt to pirate or steal information, or a SYN flood type attack (not a ton of GETs) which would indicate an attempt to not steal information but disable the site.

I believe some more insight into what is happening with all these major site attacks will help us to protect our own sites better. Thx,

<comment><USER3> General practice in the industry is not to discuss the details of attacks publicly.

As much as it sucks, the rule of thumb is that you need every advantage you can get when it comes to being attacked. You gain little by talking about these kinds of things publicly and stand to lose much (by giving away how you're mitigating the problem, for example, possibly leading the attackers to adjust their attack). It's just generally safer not to.

If you are someone who runs a web site, once you hit a certain size where you have to worry about DDoS attacks you will certainly have the kind of industry connections where you can talk about the issue privately and get help and/or help someone. Below a certain size you just don't generally have to worry about it -- and if you do get attacked, the response will mostly be done by your provider as there's not usually a lot you can do if you're just a few servers.

<comment><USER4> This sounds a lot like Security through Obscurity to me. Why does it work with DDOS, but not source code?

<comment><USER5> Security through Obscurity is actually a valid tactic, in most arenas. It can't be relied upon _in isolation_ , which is what many people tried to do. If you already have a robust defense system, it adds an additional layer.

Additionally, there are different trade-offs for DDOS vs source code. Source code you leave behind obscurity, in order to get a well-tested and well-vetted implementation. In DDOS, you're using ops, not code. All your responses are custom-crafted anyways, so there is no well-tested implementation for you to gain. The benefits of transparency are much smaller, and the benefit is the same.

<comment><USER6> Just in case anyone else was confused: The _cost_ is the same.

</comment></comment></comment></comment></comment><comment><USER7> Bug report for kogir: all items with an id less than 5million are 404'ing.

E.g. this loads: <https://news.ycombinator.com/item?id=5000000>

But this 404s: <https://news.ycombinator.com/item?id=4999999>

<comment><USER8> Looks like anything above ID 8000000 returns a 404 too.

<comment><AUTHOR> Together, the two of you can probably guess the regex responsible :)

<comment><USER9> Does this mean that old content will be permanently inaccessible? One of my (rarely exercised) pastimes used to be typing a few random five- or six- digit IDs into the address bar, then following the chain up to the top-level article. I found some really interesting stuff that way.

</comment></comment></comment></comment><comment><USER10> I guess the rule is that you know you're making it as a startup when somebody sues you. You know you're making it as a website when they DDOS you.

Geesh.

<comment><USER11> A DDOS of HN is quite strange indeed. There should be some kind of ransom involved, but seeing as HN doesn't make money (I assume) from these forums, there is nothing to ransom.

<comment><USER12> For the people doing it, the gain can be about trying out their skills, not being bored, and getting the bragging rights of having DDoSed "Hacker" News.

<comment><USER13> So if they then brag about it and it get posted on HN, should it get upvoted? (not a rhetorical or cynical question, I'm really curious)

<comment><USER14> I'd upvote it if it was interested and they talked about how they did it (and it didn't involve LOIC).

Which is to say the blog post about it probably wouldn't be worth reading :)

</comment></comment></comment></comment></comment><comment><USER15> For what it's worth, <http://ycombinator.com/images/grayarrow.gif> is being referenced by pages on <https://news.ycombinator.com/>, leading to mixed (SSL vs. not-SSL) content fun in browsers.

Also, if SSL is now a permanent thing for HN, it would be a nice bonus to see "add_header Strict-Transport-Security max-age=31536000;" in the nginx configuration block for the https server...

<comment><USER16> I think arrow should be replaced with raw css, or converted to base64, since it's very small image, it won't be big as base64.

<comment><USER17> Or at the very least set a long future expires set on it....

I doubt the arrow is going to change much, and if it does, just use a new reference!

</comment></comment></comment><comment><USER18> It would be really nice if there was an official Twitter account with status updates for things like this. Might reduce the amount of refreshing.

<comment><USER19> Or we could step away from the keyboard for some fresh air :-)

<comment><USER20> not possible.

<comment><USER21> Fresh air? What's that?

<comment><USER22> I think it's a new Javascript framework. I hope it is REST-compliant.

<comment><USER21> Oh, yeah! Well, that makes two of us.

</comment></comment></comment></comment></comment></comment><comment><USER23> Thanks for spending your time on a site that's essentially one big favor to us all.

<comment><USER24> It's also (hn) an effective way to get quality beta testing of new startups.

</comment></comment><comment><USER25> For what it's worth, HN is loading extremely quickly now. Is that the nginx transition? Usually it takes a few seconds to load, say, my user profile. Not anymore. Nice work!

</comment><comment><USER26> Chrome is still throwing a small fit about insecure elements. Change the favicon url to a protocol-relative one.

</comment><comment><USER27> It's surprising that there still isn't a sure-fire defense against a DDOS attack.

<comment><USER8> That's a bit like asking for a truck-proof bicycle.

<comment><USER28> Not quite. There's one sure protection from DDOS actually: scale. For example, Facebook or Google are practically immune from DDOS, since you cannot really overwhelm an infrastructure of that size, even with 100,000s of bots. If you have 10,000s of servers, IP anycast to multiple datacenters, multiple 10Gbps uplinks, you are immune from most DDOSs- they are simply handled like normal traffic fluctuations.

<comment><USER8> To extend the metaphor; Google and Facebook have 1000000 bicycles, and you can't take them all down with a single truck.

<comment><USER29> Your second metaphor ain't correct. Google and FB's normal way of executing doesn't consist in sending regular trafic to a bicycle (server) until it crashes and then re-dispatching that legit trafic to non-crashed servers.

Sure a server does crash once in a while but it's not because they purposefuly did overload it.

The DDoS attempt trafic is dispatched left and right just like regular trafic and doesn't affect the normal behavior.

It's more like the single truck can hit any of the 1000000 flying bycicles.

: )

<comment><USER30> Are you saying that Google and Facebook respond to DDoS attacks by just having enough capacity to serve all the attacking requests, all the way to rendering the pages as though they were requests from legit users? And if so, do you have first-hand knowledge to back that up?

Consider the fact that each of those companies has many services, which can vary widely in usage and capacity.

</comment></comment></comment></comment></comment></comment><comment> kostya-kow >The volume of traffic was sufficient to keep us from handling it in Arc like we always have before.

>Now nginx is helping with some of the work. Ironically the transition was planned for today anyway, except it was meant to happen at night with no downtime. So it goes.

Does this mean that HN no longer uses Arc, but nginx? Or are you using nginx+Arc now?

<comment><USER31> Arc is a programming language. Nginx is a web server.

</comment></comment><comment><USER32> Why not use CloudFlare? It is probably the easiest way to deal with that kind of situation.

</comment><comment><USER33> So is the redirecting to HTTPS thing going to permanent then?

I guess I'll have to figure out how hack some Chrome extensions that haven't been updated for 3 years since the creators seem to have hard-coded the HTTP URLs.

</comment><comment><USER34> Well, it's lightning fast now. I don't believe I've ever seen it this fast.

</comment><comment><USER35> Is HN having SSL problems? Firefox is complaining that HN's SSL cert has not been verified. A screenshot can be seen here: [1]

It used to be fine up to today.[2]

[1] - <http://img1.imagilive.com/0313/hn-cert-130311.png>

[2] - Just FYI, for me, news.ycombinator.com resolves to: 126.96.36.199

<comment><USER36> I had this problem the other day with a site I administrate, in Firefox only. It turns out that Chrome and other browsers have robust and complete certificate chains built in which allow them to trust certificates that Firefox over zealously assumes are not verified if you don't explicitly define a certificate chain file to link your certificate issuer to a root certificate that Firefox does trust.

So long story short: Firefox demands a chain file for some certificate issues while other browsers just trust the certificate.

<comment><USER37> I bet what actually happened was that your chain was set up incorrectly, but was cached in Chrome so it appeared ok. If you've already hit another site that uses the same root certificate as your chain, then your site would appear fine. If you haven't (i.e. testing your site in a browser you don't use much), than you'd see an SSL warning. So it might not have been anything different about Firefox, just that Chrome trusted the chain because it had already verified the root for another site with the same chained SSL certificate issuer.

<comment><USER36> That actually could be. I use Chrome primarily and rarely use Firefox so Chrome probably trusted my Network Solutions SSL certificate because it had already encountered and cached a chain file linking Network Solutions back to a trusted root certificate, but Firefox had not cached that chain file yet.

<comment><USER15> At ${PREVIOUS_JOB}, I despised that certificate caching behavior. It did nothing but wallpaper over configuration errors that shouldn't be wallpapered over...

Me: "Your site at <https://blah.otherdept.myemployer.edu/> is causing visitors to see SSL errors because your web server isn't sending the certificate chain. It probably got messed up when an updated certificate was installed the other day."

Other sysadmin: "It works fine for me. Try clearing your browser's cache."

Me: "No, really, it's not that. Here's the openssl s_client output showing that your server is only sending its own certificate and not any intermediate certificates."

Other sysadmin: "I just tried from another computer in the office, and the site's working fine. You should call the university's helpdesk since the problem is obviously on your end."

Me: _profanity_

<comment><USER8> Funnily enough, I had the same conversation just last week.

</comment></comment></comment></comment></comment></comment><comment><USER38> SSL on HN no longer supports RC4 ciphers, see BEAST Attack and the full report on

[https://www.ssllabs.com/ssltest/analyze.html?d=news.ycombina...](https://www.ssllabs.com/ssltest/analyze.html?d=news.ycombinator.com)

</comment><comment><USER39> while you're in there, can you please increase the default font size on this site!?

<comment><USER40> Try ihackernews.com for mobile HN browsing.

</comment></comment><comment><USER41> It would be nice next time to direct to a static status page with info on what is going on, if possible, and keep that site up all the time, e.g.: status.news.ycombinator.com.

</comment><comment><USER42> Why do people bother with ddossing, it just always goes away anyway. I can't imagine that it would be anything other than kids since it achieves no aims in particular.

<comment><USER43> Not true - it can be used effectively to distract from a primary more targeted attack...

</comment></comment><comment><USER44> The //news.ycombinator.com comments links in the RSS feed aren't working from Pulse for Android. Can we put the https scheme in the RSS feed permanently?

</comment><comment><USER45> I have a suspicion that average karma isn't updating.

</comment><comment><USER46> Can you let us know if this was done by a "large state actor"? Any reason why you think this could have happened? Any specific target?

</comment><comment><USER47> I can't submit, it just says "Please try again" - been like it for a few hours now

</comment><comment><USER48> What about the RSS feed? All the links point to file://.

<comment><USER48> Aha, it's a problem with NetNewsWire not liking <https://> URLs. That's a problem.

</comment></comment><comment><USER49> Who did it?

<comment><USER50> Since attacks are distributed amongst several infected zombie machines with no motive or intent, it can be difficult to pin-point the true source of the attack.

<comment><USER51> We really need to standardise a protocol for this so at least victims know who is taking them down

/half-s

<comment><USER52> To the IETF!

<comment><USER53> Don't forget to tell them to turn on the Evil Bit:

<http://www.ietf.org/rfc/rfc3514.txt>

</comment></comment></comment></comment></comment><comment><USER54> Thanks

</comment><comment><USER55> Interesting info, happy the site survived.

</comment><comment><USER56> Thanks for the update. But how is that ironic? Do you mean coincidentally?

Sorry, I don't mean to be a pedantic jackass, but still I said it.

<comment><USER57> I'd say that depends on what type of irony you're considering: [http://en.wikipedia.org/wiki/Irony#Irony_of_fate_.28cosmic_i...](http://en.wikipedia.org/wiki/Irony#Irony_of_fate_.28cosmic_irony.29)

I imagine you're referring to situational irony, but there are a few more literary ways to use it. Ignoring that, it really isn't hard to see how it is ironic that they planned to do today anyways, but instead of everything going smoothly, there was a severe unseen outage that they weren't prepared for.

<comment><USER58> When the whole trend of "irony has only one meaning" start? Every dictionary I've looked at includes something like "incongruity between the actual result of a sequence of events and the normal or expected result" (I've got an old Webster's New World from the 40's that gives the example "it was an irony of fate that the fireboat burned and sank, which is exactly the kind of thing that a certain type of person claims is "coincidence, not irony").

Is it all down to that one episode of Futurama?</comment></comment></comment>


Could Russia Cut American Submarine Telecom Cables and Internet - <AUTHOR> http://www.npr.org/sections/alltechconsidered/2015/10/26/451992422/what-would-it-take-to-cut-u-s-data-cables-and-halt-internet-access <comment><USER2> Let me see, Russia have nuclear weapons, its army is in the top 5 of the conventional forces and "American military and intelligence officials" worry about internet cables "in times of tension or conflict" ?

What is this, scare mongering addressed at geeks ?

The western propaganda became so ridiculous, it's no wonder the Russian one wins every time.</comment>


Court Says Sending Too Many Emails To Someone Is Computer Hacking - <AUTHOR> http://www.techdirt.com/articles/20110809/03492415447/court-says-sending-too-many-emails-to-someone-is-computer-hacking.shtml

<comment><USER2> Here Techdirt hasn't bothered to read the opinion they pasted to the end of their own article, in which it is pointed out that the holding in this case comports with several prior cases, including one specifically involving degrading an email server.

The article also leaves out the detail that LIUNA instructed their members to send _thousands_ of email messages to the target server, to "fight back" against Pulte.

And finally, the article falsely claims that the Computer Fraud and Abuse Act criminalizes "hacking", which is not what it does; it criminalizes computer _abuse_ , specifically, the intentional inflicting of damages on someone else's computing systems.

LIUNA orchestrated a campaign to bombard Pulte with email messages --- not individual messages, but thousands of messages, to executives, per member --- and in doing so flooded Pulte's server off the net. LIUNA also hired an autodialer firm to do the same to Pulte's phone systems. LIUNA is culpable for the resulting chaos.

Want to not have the same thing happen to you? Don't use your computer to fuck with other people. You'll be fine.

</comment><comment><USER3> This is exactly like a DDoS attack. I don't take this to mean that email spam is hacking, though - I take it to mean that a DDoS is _not_. Snail mail campaigns can't get you prosecuted. Telephone complaint campaigns can't get you prosecuted. Even physical protests don't get you prosecuted. Email campaigns and SYN campaigns should fall under the same rules.

<comment><USER4> I agree a DDoS is not hacking, and I quickly looked and didn't see the terms hack or hacking in any of the articles(I could be wrong though as I only looked for a minute).

In any case I think this probably boils down to intent. If the intent was to take down the server, it's CFAA, if the intent is a non destructive protest then it's not.

<comment><USER5> More to the point, the company everyone was emailing had a limit on the number of emails in a given inbox. The IT department for the company could have temporarily raised that limit or done other things to prevent disruption in service.

So basically, if you send emails to a company that is incapable of managing their email servers, you will be found guilty of hacking.

</comment></comment></comment><comment><USER6> Nice, so now when I unsubscribe to an email list and still get messages for a few days, my mail server is being hacked? Excellent. I see a lot of jail time for email marketers in the near future.

</comment><comment><USER4> It's the equivalent of a DDOS to an email server. And yes it's abuse.

<comment><USER6> What happened in this case is something like the EFF's form for emailing your representatives when there's some important bill that's up for voting. The EFF makes their members aware of that fact and then the individual members send email to their Congress-critters. That's not a DoS, though, that's "a lot of people with the same thing to say".

In this case, it seems like a bunch of employees were all upset about the same issue, and they all emailed the same person about it. The court ruled this a computer crime.

<comment><USER4> Yes, See my response above to saulrh about intent. If they were encouraged to each send one message to petition, it should be legal. If they were encouraged to bombard with more than one message it's probably abuse.

</comment></comment></comment><comment><USER7> _[We] conclude that a transmission that weakens a sound computer system—or, similarly, one that diminishes a plaintiff's ability to use data or a system—causes damage._

This sounds pretty broad to me. How the hell am I supposed to know how many messages or what size attachments your crappy -- I mean "sound" -- mail system can handle?

</comment><comment><USER8> This is the kind of strategy activists use, for instance Greenpeace uses this extensively:

 _To keep up the pressure we urgently ask you to send an email to the Danish minister for foreign affairs, Per Stig Møller._ \--<http://oceans.greenpeace.org/en/take-action/denmark>

<comment><USER9> There's no malice in this unless Greenpeace tells their followers to spam and/or clog them which this Union explicitly did. "When the Union ignored his request, the company filed suit for, among other things, a violation of the CFAA for "knowingly caus[ing] the transmission of a program, information, code, or command, and as a result of such conduct, intentionally caus[ing] damage without authorization, to a protected computer." 18 U.S.C. § 1030(a)(5)(A). "

Your statement of Greenpeace is disingenuous and bordering on slant.

</comment></comment><comment><USER10> This would be the same as a DDOS attack in that you take down a persons phone line and email, instead of a website.</comment>


Show HN: Cindr - <AUTHOR> http://cindr.com <comment><USER2> I think you'd get some traction on this if you add some description of what your site is _about_ in the title.</comment>