Ask HN: OSX Package Management - <AUTHOR> http://blog.ethanjfast.com/2009/10/osx-package-management/

<comment><USER2> Personally, it seems that we -- as for people appropriately inclined -- have reached the point where you just want _some_ platform to run Debian/Ubuntu: if it's OSX, cool; if it's native Ubuntu, okay then, too, as long as it works well enough with the hardware.

I dumped OSX a couple of years ago and a major part was the package management trouble.

I need all the basic open-source software as well-laid as in Ubuntu/Debian. I want them to be compatible, familiar, hopefully in the nice GNU flavor I'm used to, and preferably as the de facto standard for the system I'm using so that I won't run into conflicts with the system software itself. For me in 2006/2007, DarwinPorts/MacPorts/Fink/whatever didn't cut it. They weren't as up to date nor as extensive as Ubuntu/Debian repositories, and I was always feeling something was lacking in their overall integrity. In Ubuntu, it's the native software stack and everything just clicks together.

I think it would be really great if you could use a Mac with native OSX to run your Debian and GNU stuff as well as Ubuntu does.

I doubt Mr. Jobs would agree, though.

<comment><USER3> KDE makes their stuff available for OS X. One day I tried Amarok, partly because a Linuxing friend used it and recommended it, mainly because the Mike Oldfield song of the same name is my favorite song of all time. It installed a bunch of crap on my computer, added a folder directly to my root user, took a minute to launch, displayed a huge logo while it was launching, presented me with the ugliest interface I've ever faced on this operating system, took hours to find my music, then crashed when I tried to play a song.

Apple is of the opinion that its programs have to be unique and special. After my experience with KDE-on-Mac, I'm going to agree and say that if Linux things ran instantly on the Mac, the quality of experience for anybody who made an effort to run them would drop sharply.

I'm fine with the App system on the Mac. It's ultrasimple. Package management is a teeny bit simpler, but it's not enough for me to bother over.

<comment><USER4> _I'm fine with the App system on the Mac. It's ultrasimple. Package management is a teeny bit simpler, but it's not enough for me to bother over._

I'm not sure it's actually simpler; as a software author, my experience has been:

If I want to release something for the Mac, I post a dmg containing a dragable application; and even the most non-technical user can download and install it immediately. Sparkle provides automatic updates via my website; users gets the latest versions whenever they want them, I don't have to do anything complicated.

If I want to release something for the UNIXes, I provide a set of autoconf scripts and a make-based build system (or one of the recent alternatives, or a Python egg, or a Ruby gem), hope that the package management systems pick it up during their next release cycle, wind up in an argument with Debian over OpenSSL+GPL licensing compatibility, and see my software get shipped with half the featured turned off and a ridiculous number of local hacks applied, including all-too-regularly replacement of a working library dependency with something that doesn't work (but Debian likes it more).

The average end-user doesn't see my updates for months or years, the software is missing features and locally modified, and I have to wonder: Why couldn't I just give them something that they could drag to their applications folder?

<comment><USER5> You could always provide your own package repository and/or build your own packages. It's not terribly difficult, and certainly isn't any more difficult that maintaining your own auto-update mechanism anyways. And if you have your own package repo, users will get updates from your repository whenever they update their system...

<comment><USER6> You still have the problem of having your package's dependencies be broken/mutilated/ancient -- the only solid way to get around it is to statically link with your own unfucked builds, but that isn't always possible.

</comment></comment></comment></comment></comment><comment><USER7> there have been recent developments over an alternative, and <http://github.com/mxcl/homebrew> seems to be a very nice one.

it's still growing, but seems to be a viable alternative to macports

<comment><USER8> I'm a fan of homebrew, but it is very, very far from being a package management system. At this point it's basically an installer.

<comment><USER4> Yes -- if you were around when fink and macports (formerly darwinports) were nascent projects, homebrew will seem very, very similar.

This is a problem that is very easy to solve 5% of. It's the other 95% that's a monster.

If we walk down homebrew's feature list:

 _\- Zero configuration installation. Copy the contents of this directory to /usr/local. Homebrew is now ready for use._

This is how DarwinPorts started out, too. The problem was that eventually the implementation needed to run some pieces of native code, and a build process was born.

 _\- Or… install anywhere! You can actually stick this directory anywhere. Like ~/.local or /opt or /lol if you like. You can even move this directory somewhere else later. Homebrew never changes any files outside of its prefix._

Fink and MacPorts do the same thing. However, moving UNIX software from the prefix it was built with will rarely work.

 _\- The GoboLinux approach Packages are installed into their own prefix (eg. /usr/local/Cellar/wget) and then symlinked into the Homebrew prefix (eg. /usr/local). This way packages can be managed with existing command line tools. You can uninstall with rm -rf, list with find, query with du. It also means you can easily install multiple versions of software or libraries and switch on demand._

This is what MacPorts does, too. Look at /opt/local/var/macports/software -- every package in their own versioned subdirectory, hardlinked to /opt/local and managed automatically by MacPorts. You can have multiple versions installed at once (but only one activated).

 _You don't have to sudo It's up to you. We recommend not--see the relevant later section._

MacPorts used to not require sudo, but the fact is that users wanted things like launchd startup scripts installed and daemon users created. You can still run MacPorts as non-root, but some things (like creating a new user for postgresql) will break.

In later versions, MacPorts supports acquiring/dropping privileges as necessary to run non-root when possible.

 _\- Easy package creation. Packages are just Ruby scripts. Generate a template with ..._

In MacPorts, ports are just Tcl scripts with a very clean DSL.

 _\- DIY package installation MacPorts doesn't support the beta version? Need an older version? Need custom compile flags? The Homebrew tool-chain is carefully segregated so you can build stuff by hand but still end up with package management._

MacPorts supports your own local port files. Copy over the port file (port cat <portname>) to a new local directory, tweak it a bit, and run 'port install' from the directory. Done.

 _\- No duplication. MacPorts is an autarky -- you get a duplicate copy of zlib, OpenSSL, Python, etc. Homebrew isn't, and as a result everything you install has less dependencies and builds significantly faster._

MacPorts and Fink used to try to leverage the operating system dependencies, but the fact was that Apple would break those dependencies in minor releases and in ways that were incompatible with the user-installed software.

More importantly, the dependencies would grow stale and often be missing requested functionality, leaving users in the lurch and requiring the introduction of "duplicate" dependencies to the port system.

 _\- Fork with Git The formula are all on git, so just fork to add new packages, or add extra remotes to get packages from more exotic maintainers._

MacPorts supports portfiles places in arbitrary file://, <http://>, rsync://, svn://, etc locations. If you want to run your own portfiles, you can do so through a myriad of equivalent mechanisms (including git).

I'll stop here. The fact is that this problem space is an unexpectedly deep rabbit hole, and it's very easy to peer down it and think you've solved it, when in fact you have no idea how deep the rabbit hole actually goes.

MacPorts, Fink, apt-get and friends don't do things in a certain way because they're stupid, which seems to be so blithely implied in the homebrew documentation. They do these things because decades of experience have demonstrated the depth of the rabbit hole and the requirements necessary to provide a generally useful solution.

There's enormous room for improvement, but it's not going to happen with a project like homebrew following the exact same footsteps of the projects that came before -- and making the exact same mistakes.

<comment><USER9> Fortunately the other 95% has been solved several times over: dpkg, RPM, pacman, etc. Why bother writing another package manager for OSX? I'm puzzled.

Of course, the real problem is that building and maintaining a large package tree takes a ton of effort, and it's not very interesting work. I think that this is the real reason why package management is lacking on OS X--no one has any financial incentive to make it better. With Canonical and Red Hat, they literally have no product without a healthy package tree. So they pay a lot of people to package software. There is no corresponding situation in OS X. The vast majority of their users don't give a hoot, so Apple is not interested.

I think there is a modest but extremely unglamorous business opportunity here. Get a healthy FOSS package tree going for all arches on OS X and charge people $1 a month for access. (AFAICT this is allowed by the GPL: [http://www.gnu.org/licenses/gpl- faq.html#DoesTheGPLAllowDown...](http://www.gnu.org/licenses/gpl- faq.html#DoesTheGPLAllowDownloadFee))

<comment><USER4> _Fortunately the other 95% has been solved several times over: dpkg, RPM, pacman, etc. Why bother writing another package manager for OSX? I'm puzzled._

MacPorts can actually generate dpkg, rpm, and even Installer.app packages, but there hasn't been the resources or interest in maintaining a tree of binary packages. There has also been work into creating a dpkg-alternative via xar.

Fink produces dpkg packages as well, but has resource constraints in producing up-to-date trees of binaries.

 _I think there is a modest but extremely unglamorous business opportunity here ..._

Definitely allowed, but could you prevent users from simply copying your packages to an open repository (ala CentOS vs RedHat)?

<comment><USER9> No, but then again RH made $77 million last year :-)

</comment></comment></comment></comment></comment></comment><comment><USER10> reason that package management feels so integrated on Linux is that Everything Is A Package, including the system components. This works because, usually, every required for a Linux system is open-source and free-as-in-beer.

On OSX, on the other hand, _many_ things that people want to install are closed-source, for-pay apps. Having different installation and management for those than for open-source packages is what makes fink/macports et all feel like ghettos.

A "real" package management system for OSX would be more like a package _store_ : it would allow you to install both free and paid apps, and handle upgrading/installing dependencies/uninstalling them equally well. It would also need to be able to detect and "absorb" responsibility for any apps you installed from DMGs.

Of course, once such a system was created, Apple would very likely buy it and integrate it with Software Update.

<comment><USER9> s/Software Update/iTunes

<comment><USER10> I suggested software update because "Apple Software Update" (the Windows program) is required to be installed on Windows Boot Camp partitions, while iTunes is not. Apple likes all-encompassing, "we'll take care of everything" experiences; they wouldn't just go through all the trouble of making it work on the Mac side and then leave off Windows support (thus making the Apple Software Store the first thing you'd install on any Windows computer, in order to pull down all your favorite applications—convenient for them, isn't it?) It would be much harder to convince people to install iTunes in order to install, say, Photoshop, than it would be to convince them to install a single-purpose general-software utility.

</comment></comment></comment><comment><USER11> Until I upgraded to Snow Leopard, I was using fink with the unstable binary packages: [http://finkers.wordpress.com/2009/06/01/fink-and-binary- dist...](http://finkers.wordpress.com/2009/06/01/fink-and-binary- distributions/)

I could use apt and dpkg, it did't build the world whenever I wanted a package ( _cough_ Macports), and since it just used binaries, installs were super- fast.

Last I checked, fink wasn't all that usable with Snow Leopard, but it's by far the easiest package management method for Leopard.

<comment><USER6> Fink is also a ghetto where the maintainers feel free to modify the upstream packages to their personal preferences.

</comment></comment><comment><USER12> The fact that you can (and frequently do) copy a the .app component out of our .DMG bundle into your /Applications/ directory means that any attempt at package management will be half hearted anyways.

</comment><comment><USER13> Yes, yes, yes.

I'm glad the author mentioned pacman. It's definitely been my best package management experience. I still use macports, but it does feel pretty tacked on. That being said I'm definitely excited about homebrew [<http://github.com/mxcl/homebrew>]. Some initial weekend hacking with it left me happy that it exists and excited about where it is going. Cheers mxcl!

</comment><comment><USER14> I don't know, I've been pretty happy just building stuff the old school way. Never been a fan of package managers and especially not macports. I just don't trust 'em.</comment>


Trump Considers Forming Panel to Review Complaints of Online Bias - <AUTHOR> https://www.wsj.com/articles/trump-considers-forming-panel-to-review-complaints-of-online-bias-11590238800 <comment><USER2> Honestly. I'm for this (hello downvotes). There are a lot of platforms that have been censoring right wingers for years. And while they may indeed be "private companies", they nevertheless function as public spaces with significant public trust, and monopoly power on public discourse in their respective mediums.

<comment><USER3> Should a platform be coerced into allowing harassment and hate speech just because that happens to be someone's political stance?

<comment><USER2> Apple's and oranges. Harassment is a specific legally definable thing that we have legal processes in place to handle. I don't see why platforms can't model their harassment policies off of that, and enforce them impartially, or just have the courts handle it.

Hate speech is not something you can nail down, because it's not a real thing. The working definition of hate speech, as it's actually used is "Anything I don't like". I could very well say that you are being hateful against right wingers (I'm not saying that, but I COULD), and it would be about as sound an argument as any other for hate speech.

So yes, if a platform has a monopoly, then they should be coerced into allowing "hate speech".

EDIT: I should probably make it clear that my preferred solution is to force (yes, force) Twitter and Facebook to make themselves compatible with API's like activitypub or similar. I understand that's a pandora's box, but we seem to be in Pandora's emporium in this situation, and must open some box or other.

<comment><USER4> If you believe in freedom of speech, you should believe in a company's right to censor. Otherwise you are violating their freedom of speech to not speak.

There is no justification to force someone to make available what someone else uploaded on their servers.

From a practical level, the internet is a new medium, and were constantly transitioning from one state to another, and are far from settling down yet. Therefore, any rule you make will be out of date a few years down the road.

And I say this as someone who doesn't believe "hatespeech" should be censored or punished in any way.

</comment></comment></comment></comment><comment><USER3> Based on Trump's various statements to the press and past tweets, I have very little faith that this will be a fair and balanced look at online bias. If this happens, it is almost guaranteed to be a farce that plays up biases against his party and ignores biases against his political enemies.</comment>


Most Americans are not prepared for disaster. Now survival kits are on Instagram - <AUTHOR> https://www.vox.com/the-goods/2020/3/2/21151040/disaster-prep-survival-prepper-kit-judy-kim-kardashian-hurricane-fire <comment><AUTHOR> Though "prepping" has gotten a bad reputation because of the folks going to extremes building underground bunkers, some level of preparedness is prudent.

Many government recommend at least three days' worth of supplies for self- sufficiency:

* [https://www.ready.gov/](https://www.ready.gov/)

* [https://www.getprepared.gc.ca/index-en.aspx](https://www.getprepared.gc.ca/index-en.aspx)</comment>


Why I didn't fix your bug - <AUTHOR> http://magnusmanske.de/wordpress/?p=518 <comment><USER2> FYI Magnus Manske wrote the first version of MediaWiki, the PHP software which is underlying Wikipedia. It is constantly evolving and nowadays still a state- of-the-art code with a mature code base, a great documentation, API, extendability. Ontop of MediaWiki, people built WikiData or the semantic MediaWiki extension which can be used in a way to write complex web applications right ontop of a wiki with a minimum of code (wrote a video portal once based on SMW).

Having that said, the wikipedia ecosystem lives from a number of seperate tools which query the wikipedia database. One of the early well-known tools was the editcounter which allowed people to count their edits on wikipedia, for instance.

I think it is fair enough to let these tools be tools. Either they work for you or they don't. Many of them are open sourced and you can go on, fork and host them on your own.

Instead, this tells nothing about the quality of MediaWiki, IMHO. There are a number of maintainers keeping up quality and progress in MediaWiki itself.

<comment><USER3> Their API and documentation is pretty great. It allowed me to whip up a script to access WikiPedia in my shell in no time.

([https://github.com/jorvi/shiki](https://github.com/jorvi/shiki), in case anyone wants it)

</comment></comment><comment><USER4> His time calculation is more than friendly to the community! Dedicate 6 hours to non work coding is insane.

Take care of you!

</comment><comment><USER5> > -2h private (eat, exercise, shower, read, girlfriend, etc.)

How to manage to do all of this in 2h? Just for Gym it's always around 40-50m, not counting the time to get there and back. Eat unless you always order out it takes also 40-50 (prep and eat).

<comment><USER6> Many people can (prep and) eat in much less time than 40-50 minutes.

<comment><USER7> I'm a slow eater. It would take me 40 minutes just to finish the meal, without counting prep and cook.

I frequently wish I didn't have to eat at all - it would more than double my productivity and free time.

<comment><USER8> That wish was the itch that Soylent was built to scratch. I've gone back and forth on it, but in the end I found that mixing the powder up wasn't _that_ much easier than just making a sandwich. The bottled version is a really quick way to get some sustenance but it generates a lot of waste...

</comment></comment></comment></comment><comment><USER9> Very good article. I always reiterate that I and everyone else involved in my open source communities are volunteers. Everyone has their own agenda and unless they explicitly ask me for direction, they work on what they want. Maybe you can convince them to take on your bug, but if it doesn't affect them then it's probably not going to get looked at expediently, if at all. Send a patch!

</comment><comment><USER10> What a strange way to categorize whose bug it is.

<comment><USER11> Are you referring to "Why I didn't fix _your_ bug"? Because that struck me too. I agree with the thrust of the article, but it's a shame the title implies a slightly misguided attitude. I say "implies", because it's probably a 'mistype', but it's certainly one worth addressing for future readers, IMO.

<comment><USER12> I think it's just poorly phrased. He's referring to the proverbial "you" and the bug "you" reported, not the bug "you" introduced.

</comment></comment></comment><comment><USER13> The tortured protagonist is a core online archetype.

<comment><USER14> Read the article. He talks about things to do in his private time.

I don't know about you, but working after a full day of work is not really pleasing in the long run.

You hear this often because it's a common problem in Open Source.

<comment><USER13> I did read it. It fit the archetype.

A high agency individual looks for and finds solutions. Sidekiq is a great example. So is WordPress. Even Github was. Watch Tom Preston-Werner's Mixergy interview and you'll see that he specifically put thought into making sure it would generate revenue in a sustainable fashion if it were to become popular.

<comment><USER15> Is your argument that it's the author's fault that the bugs aren't being fixed because he volunteers on open source software when he instead should have found a way to get paid to work on it?

<comment><USER13> All three examples I shared _were_ open source.

To answer your question a bit more directly, yes. He doesn't like the consequences of running a reasonably large, unmonetized project. It isn't precisely a _fault_ , but it is a situation he's not happy with and one that flows from his own decisions.

He's not a passive victim of the internet. He's an intelligent actor with the power to take different actions and get different results. He's also free to continue down the current path, but he doesn't appear to enjoy it.

<comment><USER15> Thanks for your response!

> All three examples I shared were open source.

Indeed; I was making a distinction between volunteer and paid.

> To answer your question a bit more directly, yes. He doesn't like the > consequences of running a reasonably large, unmonetized project. It isn't > precisely a fault, but it is a situation he's not happy with and one that > flows from his own decisions.

I didn't read it as him being at all unhappy with the consequences. He is merely communicating the consequences of it to other people on the internet who _are_ unhappy with it.

> He's not a passive victim of the internet. He's an intelligent actor with > the power to take different actions and get different results. He's also > free to continue down the current path, but he doesn't appear to enjoy it.

And this is where we read the article differently. To me, he seems perfectly happy with the state of affairs, with a 9-5 job that pays the bills and several hours on a volunteer project that he gets some other satisfaction out of.

I guess I tend to give other people the benefit of the doubt when it comes to agency. I interpret "I don't have time for X" to mean "I have other things I am doing that are more important to me than X" which assumes the person is assuming responsibility for their choices.</comment></comment></comment></comment></comment></comment>


Shoppers Love Rewards Credit Cards, Retailers Hate Them - <AUTHOR> https://www.wsj.com/articles/shoppers-love-rewards-credit-cards-retailers-hate-them-1537867801 <comment><USER3> Here in the UK I've noticed that Amex is not accepted by a lot of smaller businesses. When I ask why I'm told it's because their fees are 4-5% - <USER2> than both Mastercard and Visa.

The thing is reward credit cards really feel like the banks are fleecing merchants and giving a small portion as a kick back to the consumer. If card issuers want to provide an incentive to their customers then they shouldn't fund it by charging the merchants more.

All that will likely happen is merchants will increase their prices and those without reward cards will end up paying more and getting less. It's probably why on so many sites (especially airlines!) I have to pay '2% credit card processing surcharge'.

If Visa and Mastercard don't want retailers to get selective then there needs to be a single charge rate - and I think it would be a good idea that this information is shared with purchasers at time of a payment.

<comment><USER4> Interestingly a barber in the City (of London) I occasionally go to started accepting Amex recently. I had asked them the first time I used them (back in 2008) why they didn't accept Amex and it was for the high rates.

When I asked why they'd started accepting Amex, they said that the rates on some rewards cards they were accepting were so high that Amex was better value for them.

I also assume it was helped that the demand for Amex is higher in the City than the UK average.

<comment> J-dawg I've noticed a lot of smaller places have started accepting Amex because they use iZettle machines or similar.

It's funny that many medium-sized business will reject Amex, while a little burger stand at a farmer's market will (sometimes) accept it.

Perhaps iZettle have decided to take the hit on the Amex fees and charge a flat fee to their customers.

<comment><USER5> Hi, I saw one of your old comments and was hoping we could chat about it as I'm going through something similar. Email is in profile if you're willing.

[https://news.ycombinator.com/item?id=12099420](https://news.ycombinator.com/item?id=12099420)

</comment></comment></comment></comment><comment><USER6> There should be credit card charges added to every bill. This way we would have competition to make things cheaper instead if pointless reward systems - the sole purpose of those being to stifle competition.

If the stores want to give discount for paying with card they could do for example 0.5% or 1% and add the rest of the charge to the bill so there is still incentive for CC companies to compete.

As it is customers paying with cards get a hidden discount in comparison to those who pay with cash. Shops are forced to cover that discount as well. There is no incentive to provider cheaper payments either as the customers won't benefit. We really need a law that prohibits those hidden charges.

<comment><USER7> The EU has recently gone in the opposite direction by centrally banning such surcharges: [https://www.moneysavingexpert.com/news/2018/01/cards-fees- to...](https://www.moneysavingexpert.com/news/2018/01/cards-fees-to-be-banned- from-saturday/) ; [https://www.bbc.co.uk/news/business-40655333](https://www.bbc.co.uk/news/business-40655333)

This really does feel like a hidden subsidy to cards, presumably with the aim of moving towards full cashless operation. Norway is almost there already.

<comment><USER8> The EU also capped interchange fees though, in most cases at least.

I'd rather pay whatever payment fee (cash, debit, credit) the merchant sees fit. I have no problem paying a little more for my own convenience, but I'd rather not subsidize Amex and corporate cards.

</comment></comment></comment><comment><USER9> I'd love to pay cash, but it just doesn't make sense given the rewards and the benefits of the reward credit cards. Citi Double cash gives me 2% back and does price matching. That is a huge savings over the course of a year.

</comment><comment><USER10> Here in New Zealand, retailers will often charge a few percent extra for credit card purchases, and a lot of smaller shops won't accept them at all. EFTPOS (basically like a debit card in the states) seems to be much more commonly used, often with contactless terminals.

It seems to work well - I do have a rewards credit card, but certainly couldn't get by with just that card.

<comment><USER11> In New Zealand, EFTPOS costs the retailer a fraction of what credit card transactions do. When you swipe/insert your debit card, it goes through the EFTPOS system. But when you use the same card contactlessly, payment is processed by the credit card company and the retailer is charged a credit card fee or similar. That's the reason many retailers don't accept contactless payment.

The banks and card companies would surely love for EFTPOS to die, but the retailers love it. There's a reason every card issued today supports contactless payment, and you can't opt out.

</comment></comment><comment><USER12> The rewards motives are 2 fold: 1) to have the customer user their card (obviously) 2) to centralize spending in one card, so that the card holders have your information and spending habits

Some cards give better rewards for some type of shops. Amazon has their own CC as well.

Outside of the US/Canada most people get CCs from their bank and not from 3rd part vendors though.

</comment><comment><USER13> I'm not familiar with Reward Credit Cards, which seems to not have taken off in France.

Cashback here is opt-in, bank- and retailer-specific. Meaning that my regular MasterCard from Bank B used to purchase stuff at retailer R gets me x% cashback. So in a way, retailers' woes won't (shouldn't) happen here...

<comment><USER14> Well, most cards in France are not credit cards any way, they're debit cards.

Sometimes you can have credit cards with deferred payment (everything at the end of the month instead of immediately) but actual revolving credit cards, like in US are pretty rare.

</comment></comment><comment><USER15> If you charge credit card customers extra, credit card companies block you from network.

This should be illegal but it's not.

<comment><USER16> It is illegal in some countries like Australia.

</comment></comment><comment><USER17> I feel like the right to reject would lead to awful problems. How do I know if the particular card I get would work at a particular shop etc. There is certainly a problem, but rejecting cards outside of the normal Visa/Mastercard/Amex system is not the way forward and would be very confusing.

</comment><comment><USER18> [http://archive.is/gEOen](http://archive.is/gEOen)

</comment><comment><USER19> This always reminds me of the alternative : cash [0].

[0] [https://news.ycombinator.com/item?id=13782561](https://news.ycombinator.com/item?id=13782561)

</comment><comment><USER20> Taxpayers already pay quite a bit to keep the cash system running. I think it would make sense for the state to provide baseline infrastructure for electronic payments.

</comment><comment><USER21> Just a question. I saw this thread more than a day ago.

"32 points by prostoalex 1 day ago | past | web | 32 comments"

[https://news.ycombinator.com/from?site=wsj.com](https://news.ycombinator.com/from?site=wsj.com)

How come it's on the front page with "32 points by prostoalex 7 hours ago"

How did "1 day ago" change to "7 hours ago"?

</comment><comment><USER22> Isn't it curious that in an age where people want more privacy and control over their data that shoppers would love these kinds of cards?

<comment><USER23> How is it any worse than other credit cards?

</comment></comment><comment><USER24> Paywalled, but yeah; it'd be nice if everyplace used something like GNU Taler instead of credit cards.

[https://taler.net/en/index.html](https://taler.net/en/index.html)

While we're at it, please get rid of tracking and 'membership' cards too - just give me good prices on all the things every day.

<comment><USER25> They need to invest in a better website and make it friendlier for customers and merchants if they want to make that a thing.

GNU have never been good at design

<comment><USER24> You'd have to have buy-in from some lending institution, and presumably they'd be the ones to make the user facing documentation/education to fit their clients.

However if it's only one bank we're right back to where we are with PayPal, where there's only one provider facing consumers / sellers; instead of competition to drive the markets towards actual efficiency and liberty.

</comment></comment></comment><comment><USER26> No paywall: [https://finance.yahoo.com/news/shoppers-love-rewards- credit-...](https://finance.yahoo.com/news/shoppers-love-rewards-credit- cards-140600098.html)

</comment><comment> onion-soup Solution to this problem already exists, it's called cryptocurrency. Yet people still trash it</comment>


Inductive Power on the Cheap – Philips Imageo Teatlight Teardown - <AUTHOR> http://wp.josh.com/2015/09/06/inductive-power-on-the-cheap-philips-imageo-teatlight-teardown/ <comment><USER2> > How can Philips sell a set of 6 inductively rechargeable LED lamps with > charger and glass holders for less than $80 retail?

Who in the world thinks $80 is cheap for a few tiny little lights?

<comment><USER3> The BOM for the charging base is probably more than the 6 lights combined.

<comment><USER2> It probably is. But I wouldn't expect them to have more than $20 in the base, and that seems like a high estimate.

</comment></comment></comment><comment><USER4> Are the inductive parts that cheap? You can buy a pair of similar LED candles without the charging (but with changeable batteries) for about £1 in the UK. So that's roughly a difference of $75 for a set of six with the recharging equipment...

As a comparison, inductively charged electric toothbrushes start at around $25, and the charging equipment must be a relatively small part of their BOM.

<comment><USER5> $5.99 without the recharge.

[http://www.ledtealights.net/LED-Tea-Light-With-Flickering- Sh...](http://www.ledtealights.net/LED-Tea-Light-With-Flickering-Short-Flame- Set-Of-6_p_11.html)

25 batteries for $10

[http://www.aliexpress.com/item/dollarneer-20pcs- CR2032-DL203...](http://www.aliexpress.com/item/dollarneer-20pcs- CR2032-DL2032-CR-2032-Lithium-Cell-Coin-Button-Battery-3V-Worldwide-free- shipping/1895614662.html?ws_ab_test=201407_3,201444_6,201409_2)

4x rechargeable batteries + charger for $20

[http://www.aliexpress.com/item/AC110-250V-Wall-Charger- Plug-...](http://www.aliexpress.com/item/AC110-250V-Wall-Charger-Plug-Adapter- with-4x-3-6V-LIR-2032-CR2032-Lithium-Coin- Battery/32223192734.html?ws_ab_test=201407_3,201444_6,201409_2)

</comment></comment><comment><USER6> It's a "tealight", not a "teatlight".

<comment><USER7> I was expecting to read about some sort of dairy equipment, which would have been an interesting change of pace for HN

<comment><USER8> Please post.

</comment></comment></comment><comment><USER9> "The only disappointment I have in this otherwise lovely board is that it uses 56 ohm resistors to limit current though the LEDs…"

I know the author is geeking out, but his only disappointment _should_ be wasting energy with less efficient wireless charging in a world where power is still created by burning hydrocarbons.</comment>


Move Over, Silicon, There's a New Circuit in Town - <AUTHOR> http://viterbi.usc.edu/news/news/2014/june-17-2014.htm

<comment><USER2> Sound great could be a breaktrough for curved sensors too.

> [http://spectrum.ieee.org/tech- > talk/semiconductors/devices/so...](http://spectrum.ieee.org/tech- > talk/semiconductors/devices/sony-creates-curved-cmos-sensors-that-mimic-the- > eye)

</comment><comment><AUTHOR> I hate the title. I used the original title since I couldn't think of anything better. Suggestions?

<comment><USER3> HN policy is to always use the original title, no matter how dreadfully sensationalist or inaccurate it is.

<comment><AUTHOR> Actually, we're supposed to fix the really bad (misleading or linkbait) original titles but without injecting our own opinions (i.e. editorializing).

[http://ycombinator.com/newsguidelines.html](http://ycombinator.com/newsguidelines.html)

> _" Otherwise please use the original title, unless it is misleading or > linkbait."_

</comment></comment></comment><comment><USER4> Why is it important to have both n-type and p-type transistors in the same circuit, why not just use p type carbon nanotube transistors?

<comment><USER5> It has to do with small amounts of leakage current on the device level. If you just use 1 type of transistor (p or n -type) then when you change from on/off or off/on you will lose more current than if you use both types in your circuit. Sum this across billions of transistors and the equation starts to make sense.

<comment><USER6> Can you explain what the importance of this leakage is? Electricity costs 'power-wise' it makes sense but are there other reasons to want to avoid transistor leakage?

Disclaimer: Not a hardware guy but am utterly fascinated, ooh's and ahh's may spontaneously result.

<comment><USER5> I'll speak to this a bit...

Transistor logical state, typically logical 1 or logical 0, is represented physically by positive and negative charges, respectively. Therefore, we can change the device logical output of 1 or 0 by changing the charge output as positive or negative.

However, to change the charge of a piece of metal from positive to negative (or neutral to negative... it doesn't matter because we're worried about relative change), you need to physically move electrons (charge) on or off the metal. This movement of charge is real 'work' if you're unable to fully recover the charge when the device changes state. This results in spent energy.

Leakage current is important to consider mainly for power and heat transfer. As we require devices to increase computing performance and decrease power consumption, it is important to use techniques that economically reduce power. As power consumption of a chip increases, the spent energy of a toggling transistor becomes heat that needs to be removed in order to ensure proper functionality (in the worst case, the chip burns itself up). Therefore, proper thermal simulation and validation must be made at the system level (depending on what type of designer you are).</comment></comment></comment></comment>


MRelief (YC W16 Nonprofit) makes public assistance more accessible - <AUTHOR> http://techcrunch.com/2016/03/17/launching-at-ycs-demo-day-mrelief-has-a-new-tool-to-make-public-assistance-more-accessible/ <comment><USER2> Hello HN Community! My name is Rose Afriyie and I am one of the founders of mRelief. We are a team of software developers that emerged from #chihacknight, Chicago's weekly event for civic technology. V1 of mRelief was built in partnership with Chicago's Innovation Delivery team to address backlogs in programs like rental assistance where 10,000 applications are filed but only 400 people qualify. We use a simple Web and SMS platform to help people find out if they qualify and are excited to use our platform to take people through the entire process of receiving needed benefits.</comment>


Your code is worth much, just like ideaguy/gal's idea, unless - <AUTHOR> ... some one is willing to pay you for using it. I think this should be a corollary of ideas are worth nothing. <comment><AUTHOR> I'm sure I'm going to get down voted for this because you don't want to hear it, and it plays with your world view.

I written a ton of code for side projects and never made money from the projects, ie my code isn't worth much.

<comment><USER2> A guy started selling a widget I did to learn angularjs, he just inserted the widget in an iframe and charged for it. He was in touch with people willing to pay, and that is valuable.

<comment><AUTHOR> not saying there aren't exceptions.

</comment></comment></comment><comment><USER3> To generalize, any singular component of a business is relatively worthless, unless there exists a functional business to plug it into.</comment>


Show HN: Census – Sync your warehouse data to any app - <AUTHOR> https://www.getcensus.com <comment><AUTHOR> We're launching a service that helps growth/ops teams get data about customers into go-to-market tools (a HN-worthy description would be "Fivetran in reverse"). Census connects directly to your data warehouse and syncs into apps like Salesforce, Marketo, Google Sheets, and FB Audiences.

You can customize how data is mapped and how frequently it's synced. You can also use SQL to build custom views on your data. Our goal is to help you build an effective customer data hub out of your data warehouse.

Would love to hear feedback from the HN community.

<comment><USER2> How does this differ from Segment's Persona [1] product feature?

[1] [https://segment.com/product/personas/](https://segment.com/product/personas/)

<comment><AUTHOR> That's a great question. I don't know all the features in their offering but here's some of the ways I believe we're different off the top of my head: we run on any data warehouse, you can use SQL to build data models, and we can sync any kind of data, not just users. Would love to hear if you've had experience with Personas and what you like/dislike.</comment></comment></comment>


Ask HN: Can a PEO rightfully expose your income to other employers? - <AUTHOR> In 2019 I worked for two companies that made use of the same professional employer organization (PEO). This PEO generated a single W-2 for 2019, combining my income from the two companies. Both companies can view this combined income W-2. Simple W-2 less payroll math would reveal to each company what the other paid.<p>This doesn't sit well with me for myriad reasons, and I can't imagine this is entirely legal. While the PEO reps are empathetic in correspondence on this issue, no resolution/progress on the matter has been made whatsoever over the last few weeks. Any advice/counsel is appreciated. <comment><USER2> Many companies provide employee pay data to equifax, and equifax sells it to many people:

[https://www.fastcompany.com/40508924/equifax-could-be- sellin...](https://www.fastcompany.com/40508924/equifax-could-be-selling-your- salary-history-heres-how-to-protect-it)

<comment><USER3> Note: the Work Number is effectively a collusion of employers against labor, an employer's "union" of sorts . Much lie the one where "competing" employers agreed not to recruit from each other to avoid bidding eats. Remember that next time your employer tells you you don't need a union.

</comment></comment><comment><USER4> No, this is not right. The PEO is paying you "on behalf of" a specific employer (even if your check is coming out of the PEO's account). So you should get 2 W2s with separate amounts from each employer.

TriNet (a large PEO) stores employees as SSN so if you have ever worked for a company that used TriNet as their PEO, you are in their system. As an employee, you should see a dropdown at the top and you can only see _ONE_ employer at a time and you have to use the dropdown to switch around.

The only reason you _can_ get ONE W-2 is if you work at a temp agency. The employer technically pays the temp agency and the temp agency pays you. So even if you got billed out to 10 different "employers", you are still an employee of the temp agency and you get ONE W-2 but technically, this is NOT a PEO situation

<comment><USER5> My understanding is exactly the opposite.

If you do work for a client of a PEO it is as an employee of the PEO. Therefore you would only get one W2 from the work you did.

<comment><USER6> that's what he said, if you are an employee of a contractor who contracts you out to different companies, you are an emplyee of only one company.

</comment></comment></comment><comment><USER7> Check with an attorney (a consult is usually no cost) if "26 U.S. Code § 7213.Unauthorized disclosure of information" [1] or "26 U.S. Code § 6103.Confidentiality and disclosure of returns and return information" [2] applies to this situation. If applicable, your attorney may consider contacting the PEO's legal department to inform them of their violation of federal statute.

[1] [https://www.law.cornell.edu/uscode/text/26/7213](https://www.law.cornell.edu/uscode/text/26/7213)

[2] [https://www.law.cornell.edu/uscode/text/26/6103](https://www.law.cornell.edu/uscode/text/26/6103)

<comment><AUTHOR> Thank you. Which kind of attorney would handle this: data privacy, tax, consumer protection, something else?

<comment><USER8> If I was in your position, I would start with a labor attorney. First off, there are plenty of them. Second, they specialize in the employee/employer relationship. Privacy is one very common aspect of this relationship.

If they are not able to help, they should at least point you in the right direction.

</comment></comment></comment><comment><USER9> Your PEO is making the W-2 available to the companies you did work for? That's weird. I can't think of a reason why that would be necessary at all... the W-2 is between you, company who is paying you (your PEO), and the IRS.

I would clarify their policy around this, and perhaps ask the IRS what the rules around W-2 disclosures are.

<comment><AUTHOR> Correct, both companies can see the same combined income W-2 within the PEO's site.

<comment><USER10> Who is the PEO? Some PEOs have very stringet legal teams that would make a big fuss about this. Depending who your PEO is, you might just reach out directly to their legal department.

Source: I worked for a large PEO.

<comment><USER9> And if you can't get this fixed, you might consider changing to a different one.

</comment></comment></comment></comment><comment><USER11> Your pay comes from the PEO, on "behalf" of the employer, right? Technically you "work for" the PEO, so this sounds fine to combine them. I bet they can't even do anything about it.

<comment><USER12> In that case, it's concerning that the PEO is sharing the W-2 with the companies the OP did work for. If the OP doesn't have an employment relationship with these companies, it seems like a huge privacy breach for the PEO to be sharing W-2s with these companies at all.

<comment><AUTHOR> I was hired and employed by both companies. They both make use of the same PEO. I'm not sure it's legally correct to say I only have an "employment relationship" with the PEO.

<comment><USER11> So does your check / payroll deposit come from the PEO? W2's are about who paid you.

</comment></comment></comment></comment><comment><USER13> On the bright side, if both companies are large, it's unlikely your manager at either will ever notice.

</comment><comment><USER10> Who is the PEO?

<comment><USER14> Post says in the first sentence

<comment><USER15> The post answers "what is a PEO", but not "what is your PEO". The second is what's meant by "who is the PEO?"</comment></comment></comment>


Amazon removes encryption from the software for Kindles, phones, and tablets - <AUTHOR> http://www.dailydot.com/politics/amazon-encryption-kindle-fire-operating-system/ <comment><USER3> I can see how this happened. They removed their own custom encryption system in preparation for the native encryption offered by lollipop. For some strange reason they couldn't actually finish making that native encryption feature shippable (some last minute show-stopper bug maybe?). But the old encryption code was not ported to lollipop either, so essentially they ended up with having two unusable encryption systems on their hands and deadlines looming. The end result can be seen here.

Of course this is purely speculation, but I see this sort of thing far more likely explanation than some nebulous collusion with NSA (Hanlon's razor etc)

<comment><USER4> To be fair, Hanlon's razor would also point to "encryption is hard and creates a negative user experience (and more work for us), so don't implement it."

<comment><USER5> Also "we don't want to spend the money to do this."

</comment></comment></comment><comment><USER6> Don't buy an Amazon device while planning on rooting it and installing CyanogenMod or the equivalent, either. Starting with Fire OS 5.1.1 in December 2015, Amazon locked down the bootloader making such hacks considerably trickier. Here's a relevant thread at XDA forums: [http://forum.xda- developers.com/amazon-fire/development/amaz...](http://forum.xda- developers.com/amazon-fire/development/amazon-fire-5th-gen-supertool- root-t3272695)

With moves like this, I'd guess it likely that Amazon continue to move in a direction unfriendly to users wanting full control over the devices they own.

<comment><USER7> I think devices to Amazon are merely marketing budget, enabling further sales of media. I think they're selling them at a loss per device but a net gain with sales included.

If you put CM on your Fire, they would view that as if you defaced a billboard they paid for.

</comment></comment><comment><USER8> While data isn't encrypted-by-default on AWS, this plants a flag in the ground on where Amazon stands in a way that does not sit well with me.

Given Amazon's stance here, I am disinclined to running infrastructure on their cloud. The USA is becoming less and less friendly as a place to operate a business.

<comment><USER9> THIS is the thing that makes you worry about where Amazon stands in relation to government interests? Amazon has a rich history of rolling over to government interests whenever their profits may be at risk.

A great example is the Wikileaks case. Wikileaks was running on EC2, but Joe Lieberman called Jeff Bezos and said "Hey, you want more of those sweet, sweet government contracts? Take Wikileaks offline." And Amazon immediately complied. [http://www.theguardian.com/media/2010/dec/01/wikileaks- websi...](http://www.theguardian.com/media/2010/dec/01/wikileaks-website- cables-servers-amazon)

<comment><USER10> Well in fairness not hosting Wikileaks wasn't violating any user's rights or privacy.

<comment><USER11> You don't think that Amazon's pulling Wikileaks' hosting at the urging of a sitting Senator might have any First Amendment implications?

I mean, obviously, no _law_ was passed, so it doesn't violate the letter of the law, but the _spirit_?

<comment><USER10> Perhaps, but blame the government, not Amazon. I'm not sure there's even any evidence they really threatened to do anything. And as I said, they didn't leak users private information. In fact it didn't even succeed at shutting down Wikileaks, so it didn't really hurt anyone.

</comment></comment></comment></comment></comment><comment><USER12> I would buy the argument that this is a performance change, had they not already shipped with it on before. Encryption on android is not usually a large bottleneck (measurable but not great) on such devices. I call BS on any claims of this being perf-motivated.

<comment><USER13> Have you used one of their new products launched last quarter? They are horribly slow.

<comment><USER12> Not due to encryption

<comment><USER13> Your comment said "is not usually a large bottleneck (but it is measurable)" which implies that there is a performance impact. If they are trying to eek out as much performance as they can from an already terribly slow device then it stands that it could be for performance reasons.

</comment></comment></comment></comment><comment><USER13> Amazon's most recent line of Kindle Fire tablets are horribly slow products. They sacrificed their hardware in order to make a super cheap tablet (which in my opinion is a mistake because it leads to poor user experience). I'm sure this is an attempt to get a little extra performance from these products.

<comment><USER14> I actually have one of the $50 Fire tablets. Super slow for a tablet, yes, but fast enough to read Kindle books, watch Amazon Prime shows, or listen to music from Amazon. It's slow hardware, but it's just fast enough for its intended purpose.

<comment><USER8> I haven't poked at the underlying system at all, but I have noticed that giving these cheap tablets a fast SD card considerably improves the performance. It might be memory contention and the tablet using the card for swap, or simply putting applications onto the card is faster than the internal storage. I'm not sure, but it Works For Me.

</comment></comment></comment><comment><USER15> > the operating system that powers its Kindle e-reader, Fire Phone, Fire > Tablet, and Fire TV devices.

Fire OS doesn't run on Kindle e-readers.

</comment><comment><USER16> >Amazon is among several tech companies filing or joining amicus briefs in the Apple case.

I bet the wording in Amazon's amicus brief will be much weaker than that of Google and Facebook's.

<comment><USER17> I'm in. $1.

</comment></comment><comment><USER18> People unfamiliar with full-device encryption on Android devices need to be aware of the following: until Marshmallow, it was _SLOW_. It was so bad that while Google recommended turning on encryption by default on Lollipop, they had to _back off_ of the recommendation because full-disk encryption made the devices run like crap. [0] The reason suspected for this is that up to and including Lollipop, Android handsets did not support hardware-backed encryption/decryption, which meant it all had to be done in software.[1] This had the end result of putting huge overhead onto the device once FDE was turned on, and over time it would get slower and slower. Anecdotally, I tried encrypting my HTC One M7 a few years ago for security, and I eventually I had to factory wipe the damn thing because the overhead got _so_ bad that I would periodically turn on the screen and it would take so long for the phone to respond that the auto-idle would turn the screen back off before I I was even presented with a lockscreen!

The M7's specs were nothing to scoff at in 2013. Given the incredibly limited specs of Amazon's tablets, however, I would not be surprised if encrypting them could slow them down further to the point of being unusable.

[0] [http://arstechnica.com/gadgets/2015/03/google-quietly- backs-...](http://arstechnica.com/gadgets/2015/03/google-quietly-backs-away- from-encrypting-new-lollipop-devices-by-default/) [1] [http://www.androidpolice.com/2014/11/20/anandtech-posts- side...](http://www.androidpolice.com/2014/11/20/anandtech-posts-side-by-side- nand-performance-for-nexus-6-encrypted-vs-unencrypted-its-not-pretty/)

<comment><USER19> I discovered this a few days ago ([https://news.ycombinator.com/item?id=11152640](https://news.ycombinator.com/item?id=11152640)) on my Kindle Fire HD 6. I ran it quite happily with encryption under Fire OS 4, and upgrading actually required that I wipe the device. Amazingly, Fire OS 5 (without encryption) appears to run about the same, or maybe even a bit more slowly. The HD 6 actually has decent specs, so I'm speculating that this is mainly to improve performance on the newer $50 tablets that don't have the computational power of the older models.

<comment><USER20> > Amazingly, Fire OS 5 (without encryption) appears to run about the same, or > maybe even a bit more slowly.

And this is the real reason they killed encryption. Instead of optimizing FOS 5, they made it less secure.

</comment></comment></comment><comment><USER21> A lot of these devices are low-end so I can see that removing it is two-fold benefit:

1.) Making friends with the NSA. 2.) Improving performance on their devices.

<comment><USER16> Number 2, while conceivable, is probably not the reason given Qualcomm (and other chip makers) include hardware encryption support. Furthermore, this article indicates that encryption is "no longer supported," not that it is just turned off by default (which would be reasonable if performance was the issue).

<comment><USER22> Yeah, I can't believe someone held some of the Fire tablets in their hands and said out loud with a straight face, "Someone will not think this is trash."

Slow interface at a device or OS level is insta-garbage to me as a user.

<comment><USER13> Can't agree with you enough! I thought they would have learned their lesson with the Fire phone. As a owner of a company that makes games for tablets, the performance on the new line of devices was noticeably worse than the previous generation.

</comment></comment></comment></comment><comment><USER23> Amazon has just made it easier to pick what devices to purchase: None of theirs.

<comment><USER14> It makes it harder to know what other devices and software to buy, though. If you (like some comments in here imply they do) assume that the entirety of Amazon is compromised, you'll have to stop using Netflix, since they're hosted at Amazon. You'll have to stop using Reddit, since they're at Amazon. You'll have to stop using almost all the popular apps, since they're most likely on Amazon. And if Amazon is compromised by an external attacker, you have to assume AWS is compromised as well.

It's more difficult to drop Amazon than you might think.

<comment><USER3> OP was talking about devices, not services.

<comment><USER14> Obviously. But where is the difference? If the NSA is reading your texts through the physical phone hardware or reading them off the wire, it's the same thing. In fact it's scarier if there is an encryption backdoor on their software, since it could be read remotely much easier.

If Amazon hardware is compromised, there's no reason to assume their AWS platform isn't compromised. And that puts a backdoor in a lot of web applications.

</comment></comment></comment></comment><comment><USER24> Considering Amazon's reputation and practices, I wouldn't be surprised if their system was broken or compromised, probably on purpose. Still, they're also forcing Kindle Keyboard users to upgrade their devices for them to keep functioning while giving them only weeks in which to do, something which this wouldn't explain. I own almost a dozen Amazon devices and I can honestly say, every single one was a waste of money. It's not that I didn't read books and use the tablets, but the way Amazon treats its customers is only slightly better than guards treat inmates in jail (and in some cases, worse). And now, it looks like they're pretty much going to stop working altogether. If Amazon wants to keep its customers, it should probably stop threatening them and closing their accounts over made up policies as well as stop bricking their devices (which is now imminent). But they simply just don't care.

</comment><comment><USER25> I must admit, I am unsure how to properly encrypt phones anyway. Currently I am using a 4 digit PIN on my phone. Surely if an attacker had access to my phone, that would be trivial to crack. It seems unrealistic to use a lengthy PIN (10 digits or more?) to unlock my phone, because I have to do it so often.

What is a good solution? Perhaps sensitive applications have to encrypt their own data, so that I can access most of the phone functionality with the short PIN, but need a longer password to access certain data. No dice with the address book, though :-(

(I don't trust finger prints, because they seem tricky to keep secret - <USER2> latest phone also says that fingerprints may be less secure than a good PIN).

<comment><USER20> If you are using Android, look into trusted places, etc.

<comment><USER25> Interesting idea, although I am not sure which places I would trust enough. Even my home can be broken into. I'm actually working on getting all my data encrypted, even at home, because of the nightmare scenario of a thief getting all my data.

<comment><USER20> There's trusted devices as well. Maybe you could pick up a cheap bluetooth thing and only turn it on when you don't want to be bothered with passcodes.

Another alternative might be to look into Tasker. You might be able to write a script that will turn off the lock when you're at home and it's during this time range, for example.

</comment></comment></comment></comment><comment> awinter-py but don't worry about storing your customers' data on EBS, that's still totally cool.

</comment><comment><USER26> It's an interesting approach if encryption is available as a 3rd party option. It means that they deflect liability; especially if the 3rd party is an easily installed app provided by a shell company.

</comment><comment><USER27> > The company did not respond to a request for comment about its Fire OS > encryption change.

It's clear these comments are going to be a wave of negative speculation but I find it hard to believe that Amazon has done this to make their devices easier to hack by the three letter agencies.

I would love to hear some kind of comment from anyone at Amazon who knows why they did this.

</comment><comment><USER28> Amazon has big CIA contracts unlike Apple.

</comment><comment><USER29> Does this have anything to do with it? [https://aws.amazon.com/govcloud- us/](https://aws.amazon.com/govcloud-us/)

<comment><USER30> No. GovCloud is just a way for Amazon to sell cloud services to the US government. The US government would not be able to put services in the "public" clouds due to the massive amount of regulations involved, so Amazon offers them a private space that is separated from the rest. If the customer (in this case the US gov) is big enough, the overhead of complying with all the regulations/requirements imposed by the customer is worth it.</comment></comment>


Counting Bugs in Windows Calculator - <AUTHOR> https://habr.com/ru/company/pvs-studio/blog/443400/ <comment><USER3> > The analyzer has detected two identically implemented functions. As their > names, Convert and ConvertBack, suggest, they were meant to do different > things, but the developers should know better.

This is not a bug. Look how the `BooleanNegationConverter` is used:

        <RadioButton x:Name="fullKeypad"
         ...
         IsChecked="{x:Bind Model.IsBitFlipChecked, Converter={StaticResource BooleanNegationConverter}, Mode=TwoWay}"/>

        <RadioButton x:Name="bitFlip"
         ...
         IsChecked="{x:Bind Model.IsBitFlipChecked, Mode=TwoWay}"/>

Two radio buttons bound to the same boolean value, one with the negation converter. If `fullKeypad` is checked, `IsBitFlipChecked` should be set to false. If `IsBitFlipChecked` is set to true, `fullKeypad.IsChecked` should be set to false. The converter needs to do the same operation in both directions.

<comment><USER4> Agree it's not a bug as I assume it's an implementation of the IValueConverter interface: [https://docs.microsoft.com/en- us/dotnet/api/system.windows.d...](https://docs.microsoft.com/en- us/dotnet/api/system.windows.data.ivalueconverter?view=netframework-4.7.2)

However since the method bodies are identical, IMO one should have the full implementation and then the other should just call the first. Still not a _bug_ , just a code smell.

</comment></comment><comment><USER5> Is this PVS-Studio blogspam? They're always so proud of being able to detect the same things gcc/clang -Wall -Wextra detects.

<comment><USER6> PVS-Studio vs Compilers:

Clang: [https://www.viva64.com/en/b/0108/](https://www.viva64.com/en/b/0108/) , [https://www.viva64.com/en/b/0155/](https://www.viva64.com/en/b/0155/) , [https://www.viva64.com/en/b/0446/](https://www.viva64.com/en/b/0446/)

GCC: [https://www.viva64.com/en/b/0425/](https://www.viva64.com/en/b/0425/)

<comment><USER7> Do you have Clang tests which are more recent than 8 years ago? Or, especially, any which were validated and accepted upstream?

<comment><USER6> The last check was in 2016: [https://www.viva64.com/en/b/0446/](https://www.viva64.com/en/b/0446/) . Yes, it was few years ago because we were not interested in writing the same articles again and again. There are a lot of other interesting projects in the world: [https://www.viva64.com/en/inspections/](https://www.viva64.com/en/inspections/) . I also want to note that you assume that Clang was worse than PVS-Studio long time ago but now it can catch up. To that, I will say that all these years we've been working on analyzer development :). By the way, here is where you can read about the way it works: "Technologies used in the PVS-Studio code analyzer for finding bugs and potential vulnerabilities" \- [https://www.viva64.com/en/b/0592/](https://www.viva64.com/en/b/0592/)

<comment><USER7> More simply, I'm just curious about what, as a developer in 2019, would be the selling point for using it if you were on a project which was relatively clean using Clang's warnings and static analysis toolchain, flawfinder, etc.

</comment></comment></comment></comment></comment><comment><USER8> In 'Suspicious comparison of real numbers':

isActive = ((ratio > threshold) || (ActiveIfEqual && (ratio == threshold)));

is called out as bad code by the blogger; this feels very much like a false positive, given that we're checking an inequality already; just effectively changing it from > to >=

A good example of not just blindly following the linter...

<comment><USER9> Still, the comparison ratio == threshold has very little chance to turn out true.

When you want to check whether A >= B (where A and B are numbers represented as floats), you would probably want to use the check A >= B - epsilon.

<comment><USER10> I disagree strongly. It looks obvious to me that they can be equal and that this is a special case. The comparison is done only after checking for A<B, and only if a boolean called "ActiveIfEqual" is true. I mean, I don't know how much more obvious they could have made it.

</comment></comment></comment><comment><USER11> It's interesting to see the transition from the old _Proprietary Microsoft_ , to the new _Open-Source Microsoft_. Opening up code like this, which is unpolished and has bugs, is a sign of good will and transparency which I appreciate.

Although considering this application _Calculator_ could be one of the most- used programs on Windows, and they left that many errors in. It's scary to think how many errors could be in other parts of the system...

<comment><USER12> BTW, I think that python/ipython cli is a much better calculator. I stopped using other calculators long time ago. Although I understand that it's probably too complicated for ordinary user.

<comment><USER13> There is no task executed in Excel that I can't do better and/or faster in ipython.

<comment><USER14> \- Pivot Tables

\- Reach goal.

\- Simple curve fitting

\- Drawing charts in general (even with matplotlib categorical bat charts are a world of pain and then they tell you to learn Altair or something.

\- Tables with conditional formatting

\- ...

</comment></comment></comment></comment><comment><USER15> I think all the code errors like this is why some people are scared to open source their code. While it's a great learning experience some people just get overwhelmed with the possibility of wrongness so they don't.

<comment><USER16> I'd go as far as saying that this kind of posts worsen the situation. In general, if you find bugs in open source code, it's better to quietly file bugs to the author instead of writing a full post listing errors people made. It's like your high school teacher calling you out in front of class for mistakes you made in a test. Not cool.

<comment><USER17> This post was an advertisement for static code analysis, not a shaming. It even mentions that these bugs will probably soon be fixed, which is good for Microsoft.

<comment><USER10> This post shows some false-positives and present them as bugs. It is mildly disingenuous for the casual observer.

</comment></comment></comment></comment><comment><USER18> _> Suspicious function sequence_

As far as I remember, and it has been a while (and is virtually undocumented), with ETW the convention is to _not_ call the EndX method when an error occurs as EndX is basically synonymous with `return`. This might have been carried over.

Either way, I'm sure there are false positives, as always with static analysis.

</comment><comment><USER19> This seems like a stolen article. The URL should be changed to the original blog post: [https://www.viva64.com/en/b/0615/](https://www.viva64.com/en/b/0615/)

<comment><USER20> They usually repost their articles on Habr themselves in their corporate blog, linking to the source. It's a very popular Russian IT resource, so they do it to promote their articles, nothing is stolen, it's just reposted.

</comment></comment><comment><USER21> Thanks for the pointer, that was actually interesting. No one looks at most old code bases unless they are changing something in particular, that's how old bugs hang around forever. Commercial software companies of the world, open source your old crappy utilities and the world may improve them. Of course you don't do that because you are embarassed at their poor quality. Based on my own personal experience :-). You should have seen the source code of sybase sql server.

<comment><USER22> This isn't an old code base though. It's the new UWP calculator that was introduced in Windows 10 (or was it 8?).

<comment><USER7> This is the current codebase but it goes back at least 20 years in places. If you look at the core engine you'll see plenty of comments dating back to 1995:

[https://github.com/Microsoft/calculator/search?q=1995&unscop...](https://github.com/Microsoft/calculator/search?q=1995&unscoped_q=1995)

</comment></comment></comment><comment><USER23> Calculator is interesting in that there is a physical button on (many) keyboards to open it. Ironically enough, I encountered a bug with the Windows 10 calculator that caused it to crash upon opening: the window would draw, then a second later vanish.

Turned out that it was due to something profile related: re-registering the Windows App Store fixed the issue. Yes, that's right, a dependency on the app store can prevent you from running Calculator.

</comment><comment><AUTHOR> There's another article on calculators' code check. This time is Qalculate - <USER2> multi-purpose cross-platform desktop calculator. [https://habr.com/en/company/pvs- studio/blog/443656/](https://habr.com/en/company/pvs-studio/blog/443656/)

</comment><comment><USER24> It's interesting that most of these would have been avoided by using a safer language than C++.

<comment><USER25> Calculator has been around since ninteen-eighty-something-or-other[0] and this seems to be a revamp of the base code, with a XAML (read: WPF) wrapper[1].

Aside from the obvious answer of them using C++ based upon "using something you know and that works", why _shouldn 't_ they have used C++? (Genuinely wanting to know/understand.)

It would seem like a monolithic task to rearchitecture the entire app versus just dropping the code-behind into a new UI wrapper, yeah? I'm not excusing it, to be sure, just explaining the potential ROI perspective they might've had when they stuck with C++.

[0] - [https://en.wikipedia.org/wiki/Windows_Calculator#History](https://en.wikipedia.org/wiki/Windows_Calculator#History)

[1] - [https://en.wikipedia.org/wiki/Windows_Calculator#Windows_10](https://en.wikipedia.org/wiki/Windows_Calculator#Windows_10)

<comment><USER26> The code base has changed quite a bit since 198x:

\- [https://blogs.msdn.microsoft.com/oldnewthing/20040525-00/?p=...](https://blogs.msdn.microsoft.com/oldnewthing/20040525-00/?p=39193)

\- [https://blogs.msdn.microsoft.com/oldnewthing/20160628-00/?p=...](https://blogs.msdn.microsoft.com/oldnewthing/20160628-00/?p=93765)

\- [https://blogs.msdn.microsoft.com/oldnewthing/20180704-00/?p=...](https://blogs.msdn.microsoft.com/oldnewthing/20180704-00/?p=99165)

This might also explain the choice of C++. Rather than rewriting their calculation engine in another language (it works, so a rewrite is rarely a good idea), UWP (not WPF; XAML is merely an XML dialect for object graphs and works pretty much anywhere if you want it to) allows you to write the UI in C++ (C++/CX to be precise) as well, and the UI code is for the most part not that complicated that C++ is a major impediment. That, and of course, most developers for Windows applications at Microsoft are familiar and well-versed in C++. Rewriting it in JavaScript or C# may take longer.

<comment><USER27> It will be interesting to see how soon they will convert it to C++/WinRT because C++/CX will be retired at some point.

 _The first step toward full C++ /WinRT support within Visual Studio and the eventual retirement of C++/CX happened today with the availability of build 17025 of the Windows SDK Insider Preview._

[https://moderncpp.com/2017/11/01/cppwinrt-in-the-windows- sdk...](https://moderncpp.com/2017/11/01/cppwinrt-in-the-windows-sdk/)</comment></comment></comment></comment>


Russia launches sub that will carry doomsday nuke drone torpedo - <AUTHOR> https://arstechnica.com/information-technology/2019/04/russia-launches-sub-that-will-carry-doomsday-nuke-drone-torpedo/ <comment><USER2> If you designed a craft to tap undersea cables, what would it look like?</comment>


3.6 Million Tax Payers Exposed in South Carolina Cyberattack - <AUTHOR> http://www.securityweek.com/south-carolina-hit-massive-cyberattack

<comment><USER2> I live in SC and in the last few months complained to the SC DOR numerous times that their online "ePay" system was horribly outdated and a huge security hole. I accidentally stumbled on a possible SQL injection exploit while I was making a tax payment last month and reported it to them... No response.

This is just a prime example of the incompetence of state government IT departments. They likely paid millions of dollars in 1995 for this system to be developed (written in classic ASP and throws very detailed errors to users all the time) and just never thought to update it since? This system probably processes hundreds of millions of dollars in tax payments every year. You would think this would be the one system the state government would want to keep up to date and secure.

Also they had my credit card on file so it was one of the ones compromised that was "encrypted" (honestly I suspect since the system was designed in the 90's that original recipe DES was used).

</comment><comment><USER3> wait until this one shows up on fiver</comment>


For New Yorkers - a post-Sandy subway/bus planner using open data. - <AUTHOR> http://sandytransit.alastair.is/opentripplanner-webapp

<comment><USER2> this is pretty neat! one quick thing -- 40th and 8th ave -> grand central: suggests S grand central -> 53rd and park: suggests 6 40th and 8th -> 53rd and park: some crazy sequence of bus routes.

[http://sandytransit.alastair.is/opentripplanner- webapp/index...](http://sandytransit.alastair.is/opentripplanner- webapp/index.html#/submit&fromPlace=40.756468,-73.991129&toPlace=40.759767,-73.972322&mode=TRANSIT,WALK&min=QUICK&maxWalkDistance=420&walkSpeed=1.341&time=11:33pm&date=Thu) Nov 01 2012 21:26:37 GMT-0400 (Eastern Daylight Time)&arriveBy=false&itinID=1&wheelchair=false&preferredRoutes=&unpreferredRoutes=</comment>


Mum's a Neanderthal, Dad's a Denisovan: discovery of an ancient-human hybrid - <AUTHOR> https://www.nature.com/articles/d41586-018-06004-0 <comment><USER2> This happened a mere 5,000 generations ago... (before the separate admixture with European and Melanasian Homo Sapiens).

Were the Denisovans as different from Neanderthals as Sapiens were from either branch? †

Reading the branch/tree diagram it looks like only Europeans mixed it up with the Neanderthals, after splitting from Asians, and only Asians with the Denisovans, also after the split. Meanwhile Africans never encountered or mixed with either of those ancient hominid branches. Our ancestor branches and genome are so varied and rich!

† "Denisovans and Neanderthals split from Homo sapiens around 744,000 years ago and diverged from each other 300 generations after that."

<comment><USER3> That is not quite right - Asians actually have more Neanderthal genes than Europeans. The current best hypothesis is that there have been multiple Neanderthal/SSA hybridization events and that some occurred post the split between Europeans and East Asians (the first occurred in the near East and later events occurred in East Asia).

</comment></comment><comment><USER4> Wonderful, now someone lucky can update the Wikipedia [1] entry for Denisova Hominin :-)

[1] [https://en.m.wikipedia.org/wiki/Denisova_hominin](https://en.m.wikipedia.org/wiki/Denisova_hominin)

</comment><comment><USER5> How would they know they are different species? They don't have their DNA. The Denisovans are just a different form and we don't find them outside one cave. And now they claim that different species can interbreed? Who determines all this?

<comment><USER6> Whether Denisivans and Neanderthals are different species is mostly just a matter of semantics. We have had a pretty good look at the DNA of each and it's clear that the two were evolving in isolation for hundreds of thousands of years resulting in genetically distinct populations. The difference between Denisovans and Neanderthals is about half the difference between humans and either.

It's not at all unusual for two different species to be able to interbreed. Lions and tigers for instance or horses and donkeys. Mules, the offspring of horses and donkeys are sterile, though, so the two populations can't mix. Ligoers, the offspring of a male lion and female tigers, aren't entirely sterile but have very low fertility. With humans and neanderthals there are portions of the Neanderthal genome related to reproduction that were very heavily selected against in a way which seems to indicate that male hybrids at least had moderate fertility problems until those genes were removed. So it's not black and white at all. We have zero evidence for any reduction in fertility between Neanderthals and Denisovans since we have very few examples of hybrid offspring and this sort of analysis needs lots of data - so who knows.

<comment><USER5> That's my point. We don't know the amount of gene transfer between the two groups at different times. Calling something two different species usually implies some sort of allopatric speciation leading to almost zero gene sharing. Can you name a single proven example of something like this happening in the last few thousand years?

<comment><USER3> Happens all the time in biology - let me introduce you to the Coywolf [0].

0\. [https://en.wikipedia.org/wiki/Coywolf](https://en.wikipedia.org/wiki/Coywolf)

</comment></comment></comment></comment><comment><USER7> Those beer goggles must have been next level.

<comment><USER8> [https://tvtropes.org/pmwiki/pmwiki.php/Main/GreenSkinnedSpac...](https://tvtropes.org/pmwiki/pmwiki.php/Main/GreenSkinnedSpaceBabe)

</comment></comment><comment><USER9> It's a historical storyboard for a "Quest for Fire 2", sequel to one of the greatest romance films ever!

<comment><USER10> It will never work. He's a man of the world, and her family are a bunch of cave dwellers.

</comment></comment><comment><USER11> Interesting how main stream science obsesses over Neanderthals but ignore Boskopoids. I suppose it does not fit in with the narrative being projected on humanity. Also worth mentioning Adam's calendar which was discovered in 2003 in South Africa and predates Stonehenge by 10s of thousands of years.

<comment> saiya-jin > Adam's calendar which was discovered in 2003 in South Africa and predates > Stonehenge by 10s of thousands of years.

Wikipedia wildly disagrees with you [1], it's few hundred years old

[1] [https://en.wikipedia.org/wiki/Blaauboschkraal_stone_ruins](https://en.wikipedia.org/wiki/Blaauboschkraal_stone_ruins)

<comment><USER11> In academia we do not even consider the opinion of people who cite wikipedia as a basis for their argument.

<comment><USER12> Too lazy to click through to get the cite?

<comment><USER11> No I have just found so many discrepancies on wiki through the years that I do not consider it a valid cite and many academics agree. Are you perhaps to lazy for more in depth research than picking the first hit on Google and forming your opinion based on that one source of information?

<comment><USER13> You are the one making extraordinary claims and complaining how "mainstream science" ignores them.

The burden of showing credible evidence clearly falls to you, and you have yet to show anything at all. I think you should already consider yourself lucky that some people have even deigned engage with you despite your tone and your general conspiracy theorist attitude.

<comment><USER11> I do not consider myself lucky to be engaged by people who do "quick Google" searches or cite Wikipedia as sources to base their arguments on.

<comment> saiya-jin Hmm, if you are so high and above most of us, why not contribute to the mankind and actually improve that wiki page with some cold hard facts in academic fashion? If you actually know them of course

<comment><USER14> All: please resist the temptation to engage in this intellectually dreadful floundering.</comment></comment></comment></comment></comment></comment></comment></comment></comment>


Want To Know How You Rank As An Entrepreneur? Take The Founder Institute Test - <AUTHOR> http://techcrunch.com/2010/07/21/want-to-know-how-you-rank-as-an-entrepreneur-take-the-founder-institute-test/ <comment><USER2> Before you fill this out, note that there is a $50 application fee.

This is clever: sell a test to folks who are unsure of their entrepreneurialness.

<comment><AUTHOR> Ugh, I didn't see that and it's too late for me to delete this submission. Perhaps people wouldn't mind flagging it?</comment></comment>


The K8 Javascript Shell - <AUTHOR> https://github.com/attractivechaos/k8 <comment><USER2> It would seem that K8 is making the same mistake Sun did with their approach to cross-platform java libraries. Their first attempts defined a common API and then they wrote native code to fill in the platform.

This is a bad approach. Better is to a) define a common API, b) generate a compatibility layer that is as close to the native API as possible, and c) fill in the gap using platform code (in this case, JavaScript).

Node got b) right, by simply wrapping the posix API in as thin a layer as possible. If you don't like how file operations are _exposed_ or _organized_ in Node, the right thing to do is to write a library for Node, in JavaScript, not write another shell!

<comment><USER3> I wholeheartedly agree, especially with the "unable to read a line" comment the author has.

Perhaps he has never seen the "Lazy" nodejs library which lets you simply do new Lazy(fs.createReadStream("data.txt").lines.forEach(handleLine));

The claim that "other programming languages have ways to read lines" is sort of true in that many do, but they don't do it significantly more efficiently than implementing it as above.

Nodejs certainly is minimalistic if you look at the core modules, but the minimalism does not get in the way of accomplishing the goals the author describes; rather it simply leaves them up to userland to implement (which they have been many times).

</comment></comment><comment><USER4> > All the following objects manage some memory outside the V8 garbage > collector. It is important to call the close() or the destroy() methods to > deallocate the memory to avoid memory leaks.

This seems... unfortunate...

</comment><comment><USER5> Did anyone else here think this was something like bash or zsh, except that the commands were in Javascript?</comment>


Ask HN: How are Google Home sales going? - <AUTHOR> <comment><USER2> A good resource is gonna be [http://voicelabs.co/2016/12/27/amazon-echo-and- google-home-w...](http://voicelabs.co/2016/12/27/amazon-echo-and-google-home- were-smash-hits-this-holiday-season-voice-developers-see-major-holiday- growth/).

It is too early to tell for now.

<comment><AUTHOR> Interesting. Thanks.</comment></comment>


What Is the Most Profitable Hollywood Movie Ever? - <AUTHOR> https://www.hollywoodreporter.com/news/what-is-profitable-movie-ever-1269879 <comment> noman-land "So Star Wars is the most profitable movie in history. But Gone With the Wind holds the crown in terms of absolute profit from its theatrical run alone."

</comment><comment><USER2> TL;DR: it's Star Wars, by a wide margin, as everyone already knows.</comment>


Tesla Autopilot vs. Comma.ai: Geohot Challenges Elon Musk to Navigate Golden Gate - <AUTHOR> https://electrek.co/2016/04/06/tesla-autopilot-comma-ai-geohot-elon-musk/ <comment><USER2> I have a feeling this has zero chance of happening any time soon as Comma.ai has received a cease and desist letter from the NHTSA.</comment>


MegaPipe: A New Programming Interface for Scalable Network I/O - <AUTHOR> http://highscalability.com/blog/2013/6/19/paper-megapipe-a-new-programming-interface-for-scalable-netw.html <comment><USER3> This is definitely the correct solution to the problem with BSD sockets - nobody actually treats network connections as files. All of that file overhead and unix integration is entirely wasted. All of the advances that have been made in message passing systems/buses have passed over BSD sockets because everyone is of the opinion that BSD sockets are already perfect. Most of that view comes from the very simple fact that everything uses BSD sockets - <USER2> Windows.

Hopefully this research spurs on others to create new implementations, because I bet that there are many improvements possible in the basic socket idea.

<comment><USER4> The real problem is the entrenched legacy software that uses BSD sockets. I don't want to even imagine the cost of rewriting all of that to use a different networking paradigm. POSIX certainly isn't the best way to do things, especially with the move to the cloud, but much of today's high- performance software today does fine with sockets. There are absolutely some hacks that are used to get around some inadequacies, but BSD sockets work, by and large.

<comment><USER3> Agreed there - maybe a possible option would be to flag a specific port as being non-BSD sockets? So when the kernel reads the port, some short circuit logic could trigger and dump out to a different socket implementation? That would allow legacy to run fine, and then let apps trigger a special flag when binding a socket to allow for direct access. The routing part of tcp/ip happens before BSD sockets are hit, so this should do an end-run around the BSD socket overhead.

Then you could have your system running as normal, but allowing your http server special access to network i/o. Any kernel hackers around who can comment?

<comment><USER5> I'm not certain, but it seems from the article that they implemented MegaPipe to run alongside the BSD API. You do have to keep the BSD sockets API alongside the new implementation. Not only because there is a lot of existing code that depends on it, but also because abstracting a socket as a file is actually useful in many cases.

</comment></comment></comment></comment><comment><USER6> The way they do mp_read() is not right IMO.

If you have to pass a target buffer every time you call mp_read, that ends up using a lot of memory in a scenario where there are a lot of connections open but traffic is sparse. Since data might arrive at any open connection, you'll have to have at least one "pending" mp_read operation for every socket at all times. This quickly adds up in terms of memory usage: if you were to read into 64k-sized buffers (that's somewhat arbirary - but using smaller buffers tends to be very bad for througput) you'd need 625mb of memory for just these buffers alone to handle 10.000 connections. In a C10M scenario ([http://c10m.robertgraham.com/p/blog- page.html](http://c10m.robertgraham.com/p/blog-page.html)) the same would need a staggering 625GB of memory. The good old select model lets you allocate these read buffers "just in time" before you read data into it.

This was a major issue when implementing libuv (node.js) for windows. Windows overlapped I/O has exactly the same problem (and so has that new RIO thing).

A better model would be to have a "buffer pool" that is kept reasonably full by the user-mode application. The kernel could then take a buffer from the pool as soon as data actually comes in from the network.

<comment><USER7> You can probably keep buffers very small with megapipe, since syscalls are batched together, so they can't impact throughput very much in case of many concurrent connections. You still get a lot of memory taken out of kernel per syscall, but spread across many connections, if I understood megapipe correctly.

<comment><USER6> Well sure you could do that. But I don't believe that reading say 50 bytes at a time is very efficient even when you factor in automatic syscall batching.

But this is all speculation. I didn't any consideration for this problem in the paper at all so I don't have the impression it was on the researchers' radar.

</comment></comment></comment><comment><USER8> It sounds like they're trying to solve the same problems that I/O Completion Ports and Registered I/O are, in many of the same ways. It would be nice to see a head-to-head comparison for CPU overhead and scalability between the two models.

</comment><comment><USER9> How does MegaPipe compare to Van Jacobson's "netchannels" for Linux?

[https://lwn.net/Articles/192767/](https://lwn.net/Articles/192767/)

</comment><comment><USER10> This matters in so few applications, and they already have alternatives (mostly message queue systems). Bulk data transfer is rarely operationally time-sensitive. To justify bothering investing time to investigate this, maybe we could see some benchmarks versus popular MQ solutions _and_ traditional sockets for different messaging scenarios. Also factor in the various TCP optimizations, etc. (Actually, something like this should exist anyway... it would be a great resource.)

<comment><USER3> As far as I can tell, the main usage for this MegaPipe system would be creating a better API for webservers like apache and nginx to plug into to bypass some of the overhead inside BSD sockets. Most popular MQ solutions also use TCP/IP and hence BSD sockets, so they're not alternatives - they would actually replace their BSD socket API calls with MegaPipe API calls and receive performance benefits (in very large message/recipient situations).

I think either you have misunderstood the article, or I have.

<comment><USER11> For static file serving, Nginx can bypass BSD socket overhead with the sendfile (or sendfile-like) syscall, though it is disabled by default. On FreeBSD, the sendfile syscall accepts not only the fd to pipe, but can additionally be passed a header/footer such that you don't need to call write(2) at all, though this is not true on either Linux or Windows (AFAIK).

The whitepaper's macrobenchmarks make no mention of sendfile; I presume their tests with Nginx run without sendfile enabled (since it would defeat the point of the benchmark by nature of it skipping all of the write(2) calls). The paper does not appear to detail the configuration used in their benchmarks. I believe that the performance benefit of Nginx+MegaPipe, when compared to an Nginx server configured to use sendfile, is much, much less than +75% throughput.

That said, sendfile has very narrow uses (it's effectively only for sending static files) -- I wish the paper benchmarked Nginx against Nginx+MegaPipe as a reverse proxy rather than a static file server.

<comment><USER12> Linux has splice now which can support more generic uses (and tee). You can feed one network stream into another and add headers etc. They are not yet widely used but some decent performance figures I believe.

But on the other hand user space networking is also performing.

</comment></comment></comment></comment><comment><USER13> How does it compare with ZeroMQ? Looks to me they have some overlaps for the message batching part.

</comment><comment><USER14> I hate to say it but, with 'Mega' in the title, I figured this was another Kim Dotcom offering. Not that it's a bad thing but that's instantly where my mind went.

</comment><comment><USER15> how does this compare to windows overlapped io completion ports.</comment>


"Tenacious-C" IDE (for C coding) - <AUTHOR> http://www.reddit.com/r/programming/comments/e5a7n/tenaciousc_ide_for_c_coding_looks_very_intresting/ <comment><USER2> Here's a link to the actual IDE (<http://tenaciousc.com/>), which appears to be vaporware at the moment.

</comment><comment><USER3> Kind of challenging to see what this is when the "Try It!" link doesn't actually let you try it.

<comment><AUTHOR> No doubt. Try it! (but then wait for a month while we release it)</comment></comment>


The Mystery of the Missing Chromosome - <AUTHOR> http://blogs.discovermagazine.com/loom/2012/07/19/the-mystery-of-the-missing-chromosome-with-a-special-guest-appearance-from-facebook-creationists/

<comment><USER2> Nice article (mostly), and very nicely illustrated.

But when you get to "... ancient patchwork" you can stop reading. The rest is a pointless blow-by-blow of a discussion with a creationist organization on FB. No idea why Zimmer thought that was worth including.</comment>


How the iPad will destroy Microsoft.  Quietly. - <AUTHOR> http://rondam.blogspot.com/2010/01/since-i-have-nothing-better-to-do.html

<comment><USER2> This dude is crazy. Crazy wrong.

</comment><comment><USER3> I guess there's nothing much stopping Microsoft from developing a MS office for iPhone OS.

Not approving it will cause a lot of mayhem and maybe even antitrust issues for Apple so they will need to allow it.

Also don't forget google docs and upcoming office web apps.</comment>


How hard is it to intercept SMS (two-factor authentication)? - <AUTHOR> https://security.stackexchange.com/questions/11493/how-hard-is-it-to-intercept-sms-two-factor-authentication <comment><USER2> SMS is weak against state actors.

3G interception is not impossible but you have to ask yourself how many people in which economies and why you suffer the attack.

SMS in some economies with poor process can be subverted by requesting the mobile number be ported. This attack means they get your SMS message but also have to drain your funds or conduct the attack by intent before you can reverse the number port out or remove the 2FA via backup codes and redirect.

If you're being _targetted_ then I suspect the risks are worse. But as a random threat? This feels below the noise threshold.

Overall SMS 2FA is better than simply using a password but worse than TOTP (in my opinion)</comment>