How to track your coworkers – Simple passive network surveillance - <AUTHOR> http://willschenk.com/how-to-track-your-coworkers <comment><USER2> Good post, but is pinging the broadcast address really "passive network surveillance"? My definition of "passive" involves never sending new network traffic.

<comment><USER3> Yes, this is definitely an active scan. However, hooking in to DHCP syslogs would still be passive. It's nice that the author provided an active alternative in cases where you might not have access to the DHCP logs.

</comment></comment><comment><USER4> This is cool!

This have the problem that most phone devices does not reply to ping; that's why software like fing[1] need to send an ARP to each ip in the network space; every client in the network is required to answer those.

[1] [http://overlooksoft.com/fing](http://overlooksoft.com/fing)

<comment><AUTHOR> There is code in there to pull the arp table and use that, but it's commented out because I never found a good way to determining how long things stay in the ARP cache. Since we don't know how long they stay in there, you will lose all of the "xxx left the network" notices, so we made that trade off.

</comment></comment><comment><USER5> It really kills me that something this small requires Redis. I don't want to have to install Redis on an rpi just so that it can monitor the network with a small script. Why not just use a Ruby-native data structure and store results in memory?

<comment><AUTHOR> The reason that I used redis here is because I wanted it to work even if you scheduled the thing in cron, or have it work when you restarted the process and not give any false messages. Also, putting things in redis makes it easier to integrate it with something else, e.g. a UI, without really having to tool anything.

But yes, at this point it doesn't really need to use redis and if you don't already have a redis-server running it's a bit of unnecessary work to get the proof of concept working.

</comment></comment><comment><USER6> Just tried it out on our LAN. Had to modify options to ping to '-bc 4' (I'm on desktop Linux), still didn't work. The only host that responded was the gateway. We have Windows, Debian, Ubuntu and Arch Linux hosts on our network.

EDIT: Linux discards normal broadcast ICMP responses. Must switch off /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts. Even after doing so, no responses. I guess broadcast ping flood is a serious DoS concern that it's almost universally disabled.

<comment><USER7> Yes: you would need to change /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts on every Linux device on your network. Which has the nice effect that this "tracking" becomes opt-in :-).

Meanwhile, my employer uses a non-Microsoftly-inconvenient authentication to get onto their WiFi, so I've never bothered to attach the smart phone they assigned me to their WiFi, since I've got access to bigger screens for network activities when I'm there.

</comment></comment><comment><USER8> "those can't be changed like the computer names can."

What about "ifconfig ether eth0 hw ether xx:xx...."?

This is a cool script, most routers offer a remote syslog functionality which may be a good tool too.

<comment><USER9> Yeah that is a problem, have been using this in my office - you can your MAC using ifconfig and the new MAC gets registered.

</comment></comment><comment><USER10> I use this simple tool to discover what's on the network around me: [http://www.iwaxx.com/lanscan/](http://www.iwaxx.com/lanscan/)

(Usually just to figure out which IP some device is on.)

<comment><USER9> I also have a similar setup in my office, using Fing ([http://www.overlooksoft.com/fing](http://www.overlooksoft.com/fing)) to scan (on a Raspberry Pi).

</comment></comment><comment><USER11> Hmm, I get this error when trying to run this script:

.../.rbenv/versions/2.1.4/lib/ruby/2.1.0/resolv.rb:128:in `getname': no name for 192.168.1.10 (Resolv::ResolvError)

<comment><USER12> I posted a comment on the original article with a fix for this, or just follow the directions in this gist:

[https://gist.github.com/anonymous/969e460958ba3268a226](https://gist.github.com/anonymous/969e460958ba3268a226)

<comment><USER11> thanks.

</comment></comment></comment><comment><USER13> Do most phones actually respond to pings?

<comment><AUTHOR> Based upon the phones in our office, yes.</comment></comment>


Google Drops Out of Pentagon's $10B Cloud Competition - <AUTHOR> https://www.bloomberg.com/news/articles/2018-10-08/google-drops-out-of-pentagon-s-10-billion-cloud-competition <comment><USER2> This makes me suspect Amazon's HQ2 is almost certainly going to be Washington D.C. Furthermore, gives me impression the reason it took so long to commit to a date to announce HQ2 is because they were waiting on whether or not this type of contact might be elicited. Having a massive government contract is a prime reason for having a large physical presence near by.

<comment><USER3> Wouldn't Virginia be a better location for an HQ in that case?

<comment><USER4> Yes. It will probably be in the DC area, not literally in DC.

<comment><USER5> Would that research triangle place around Raleigh be close enough?

<comment><USER6> not sure why this is down voted.

having lived in Northern Virginia aka NOVA which is where a lot of businesses have offices and would be the potential area of HQ2, Research Triangle park is a tech hub for North Carolina that also afford lower wages compares to NOVA or other urbanized areas and I would consider 'in the area' of DC. Maryland is also an overlooked option which also has many datacenters.

NOVA is much more likely due to it meeting travel requirements much easier.

NOVA also already has many giant datacenters and already houses complexes for companies like VISA in addition to being one of the major backbones in the USA of the internet.

I would prefer the HQ be closer to NY, Boston or Toronto but that is a long shot I think unless the political climate forces them to make an unpredictable decision.

<comment><USER7> > I would prefer the HQ be closer to NY, Boston or Toronto

While anywhere east of the Mississippi is going to be a rude awakening compared to Washington, Oregon, California, Colorad, Utah, Wyoming &c., New York, Massachusetts, Canada or Maryland would be _far_ worse than Virginia, due to sclerotic governance. Virginia's bad compared to the western half of the country, but those places are even worse.

The eastern seaboard has over 400 years of accumulated regulations, rent- seeking and 'we've always done it that way!'; Virginia is _relatively_ better than the alternatives. If there's not a better argument for automatically- sunsetting laws than the East Coast, I don't know what it is.

<comment><USER6> >Virginia is relatively better than the alternatives.

Having lived in Northern VA for 7 years I do not think NOVA is any different than > New York, Massachusetts, Canada or Maryland

in fact - out of that group....Maryland is far better than Northern VA in regards to governance... which is the only place in VA I could possible imagine.... especially with the location of international airports being a requirement. In Maryland...the BWI airport in my opinion has poor transportation options in my opinion unless Amazon is okay with employees driving instead of using trains/buses.

In any case... what we say does not impact what HQ2 will choose... I hope... unless the decision makers are reading this, in which case -- its time to get real and build your own island in international waters and stop this bs with choosing somewhere in NA :-)

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Let's be real. Google would not hesitate to sell G-suite/Google Docs to the Pentagon and any US military ally in the world.

How many orders or strategy doctrines are delivered via e-mail/spreadsheets?

<comment> village-idiot From what I hear from the soldiers I know: far too many.

<comment><USER9> But hey, at least enemies of the state can deliver targetted ads to the the Secretary of Defence, right in their email!

<comment><USER10> You can always avoid that with a private server though.

</comment></comment></comment></comment><comment><USER11> "Oops, we forgot to get certified for this moneymaker contract. What do we do, Harry?"

"Why, Sally, you know what to do - claim this is a decision entirely based on ethics!"

<comment><USER12> "We messed up security in Google+ and it's all over the news. Now we'll never get that Pentagon contract. It will make us look even worse."

"Hey, we'll just back out ourselves and claim it's because of ethics"

</comment></comment><comment><USER13> Not buying their moral arguments at all, given that they are about to enter the Chinese market again, after backing out of it, supposedly because of moral concerns.

A while back an article surfaced here [0] about how the JEDI competition is basically tailored to AWS, and how Amazon had lobbyists stipulate the exact conditions.

[0]: [https://www.vanityfair.com/news/2018/08/has-bezos-become- mor...](https://www.vanityfair.com/news/2018/08/has-bezos-become-more- powerful-in-dc-than-trump)

<comment><USER14> > Not buying their moral arguments at all, given that they are about to enter > the Chinese market again

Their "moral" concerns are driven by the noisy section of their workforce that reflexively opposes the US military. These people aren't outspoken about the behavior of the Chinese government, in fact they probably don't think about it much.

<comment><USER15> I should probably keep my mouth shut, but as a Google employee I can assure you I am concerned about both and I am not alone. My views are my own, etc

<comment><USER16> Thanks for what you do.

<comment><USER17> What did he do?

</comment></comment></comment></comment></comment><comment><USER18> I'm going to laugh, then sigh, when Oracle wins it.

<comment><USER19> Or IBM :(

<comment><USER20> What was wrong with evil 'ol Plantir? Thiel had been waiting for his reward since he wagged his tail for Trump.

</comment></comment></comment><comment><USER21> The article strongly suggests that everyone is far behind AWS and that they therefore think that any such large contract is unwinnable.

Tough.

<comment><USER22> not only technically-wise. From what i see and hear Google has significant impedance mismatch between internal "googliness" and the "enterprise" style required to do business in the enterprise/gov/mil space. Just imagine a Google's $1M+/year AI PhD doing a support call with a bodyshop consultant maintaining a laundry services accounts payable application for some small Army base.

</comment></comment><comment><USER23> TBH, I don't think Google stand a solid chance winning it either. Their offering is not the best, and there isn't good wills from the current administration either.

Even though issues regarding big techs nowadays are all high politicized, but Google stands in the centre of the current political radicalization in US. Their means are extremely restricted.

<comment><USER24> > TBH, I don't think Google stand a solid chance winning it either. Their > offering is not the best, and there isn't good wills from the current > administration either.

IIRC, the current administration has _less_ goodwill towards Amazon because its CEO owns the Washington Post. I don't think that was a factor.

<comment><USER25> It's both Amazon (because Bezos owns the Post) and Google (because of Eric Schmidt's close ties with the DNC).

</comment></comment></comment><comment><USER26> What's wall street doing about Google's hostage situation - held hostage by their own outraged employees.

Two publicly documented big opportunities missed so far - the Pentagon missile deal and to an extent this. Maybe the China search engine opportunity is also at risk. Time for Wall Street to sell Google, and let their opinion be known!

<comment><USER19> I own many voting shares in Google and I support them whenever they decide to choose whichever side they think benefits humanity more. They have good heads on their shoulders and I trust their decision making. Google oftentimes is just trying to make the world a better place and fill missing needs. Say what negativity you want but the world would sorely miss them if they weren't around.

If you want a stock that soaks up DOD contracts, pick up Raytheon. I have a friend that works there and he can't tell anyone what he does there.

</comment></comment><comment><USER27> The first good thing I've read about Google in a while. A change in direction, perhaps?

<comment><USER28> Why is this good? (I'm not American)

<comment><USER27> Because they are taking ethics into account (or claim to be).

<comment><USER29> Lets me really honest, they pulled out because they couldn't compete with Amazons offering. Google is driven by profits and growth just like any other company.

<comment><USER30> You're being downvoted, but you're almost certainly correct.

"If someone's going to do it, it might as well be us" is about the extent of corporate ethics.

</comment></comment></comment></comment></comment><comment><USER31> I don't understand what is so moral about not selling stuff to the army, as if google are not enjoying the protection this army provides them. I would say it is even less moral, you let other people do the dirty work for you. They should give a discount to the army as a thank you for the sacrifice the people in the army are sacrificing for a fraction of the salary someone in google is earning. I mean, I know googlers still have PTSD from the Damore thingy and that they are still recovering from the trauma in a safe space designed for that, but still, fighting in a remote country for half an year is at least as hard?</comment>


Yahoo Sports Gets iOS 7 Redesign, Gif Creation Tool - <AUTHOR> http://techcrunch.com/2014/01/03/yahoo-sports-gets-ios-7-redesign-awesome-gif-creation-tool-for-sharing-big-4-sports-moments/

<comment><USER2> Great example of observing something that the community is doing (these kind of gifs are all over Twitter and sports blogs) and building a tool to make it easy. I love seeing these kind of "organic" features.

</comment><comment><USER3> I hate it because I don't like fun,* but it's still genius. Also, it's only a matter of time before crowdsharing of video taken by spectators at games allows for a full 3d reconstruction of the entire game action. You have tens of thousands of people at an NFL game, the field is a fixed quantity, and you only need maybe 10 people filming the same action at any given time to accurately model everything that goes on.

* what I really mean is that most animated gifs sorta suck in my view; obviously I'm in a minority on this.

<comment><USER4> Though, the NFL already has 3D reconstruction technology called FreeD. Cowboys Stadium installed 12 4k cameras around each endzone. Using those points of view, they can construct a point-cloud and render a replay with arbitrary camera movement in 30 seconds.

There is a video here, demonstrating the technology with baseball: [http://www.theguardian.com/technology/video/2013/aug/13/free...](http://www.theguardian.com/technology/video/2013/aug/13/freed- matrix-3d-replay-technology-video)

<comment><USER5> 30 seconds today suggests to me that in a few years it will be available for instant replay, instead of the canned bits they show in current broadcasts 5-10 minutes after the play.

Once that works, how far can we be from compositing these images in real time? That will be amazing.

</comment></comment></comment><comment><USER6> I'm a big fan of the Facebook git creator www.in-a-gif.com</comment>


Viral Marketing doesn't need nifty skills - <AUTHOR> http://govindtiwari.blogspot.com/ This guy was trending on twitter above everyone else.Unfortunately most of the images from his blog have been removed since then but the one with blinking eyes is a killer. Hackers let's build websites like these more often. There are marketing lessons to be had from this.
Here is link to some other links:
http://www.rajeshrana.com/govind-tiwari/
http://ibnlive.in.com/news/how-govind-tiwari-got-his-15-minutes-of-fame/168956-11.html <comment><AUTHOR> This guy is so much in love with himself :)

</comment><comment><AUTHOR> wow enjoy the site it is back now as bandwidth limits wane.</comment>


Hyperlocal news site, Not monetized - <AUTHOR> http://crfpnews.com

<comment><AUTHOR> I'd like to make money with it.

I started it because the newspaper in my town is aggressively corrupt.</comment>


Tell HN: A gigantic JavaScript security opportunity – who is going to do it? - <AUTHOR> There needs to be some sort of new "antivirus" type application that does the job of ensuring a javascript application is built from packages that are secure/not compromised.
I do not want my code to have this sort of thing: https://www.google.com.au/search?q=malicious+npm+package
Doing all this is too brittle and not repeatable enough: https://www.twilio.com/blog/2017/08/find-projects-infected-by-malicious-npm-packages.html
Presumably there is alot of work to be done for this package to know all current security issues and analyze packages to find them, but that's where the opportunity is.
As a developer, I don't want to be using malicious components, I would rather buy some antivirus type package and scan my application or source code or something.
I will pay money to buy this service/application. <comment><USER2> [https://nodesource.com/products/nsolid](https://nodesource.com/products/nsolid)

[https://nodesource.com/products/certified- modules](https://nodesource.com/products/certified-modules)

</comment><comment><USER3> [https://www.npmjs.com/package/nsp](https://www.npmjs.com/package/nsp)

<comment><AUTHOR> I want to give money to a company for this because companies need to pay people to work hard on it and make sure it is always being done properly.

It's a big job that will required a ton of research and analysis and staying up to date. I have not looked at this package but I bet it is not "the answer" \- I'll give you $ if it is.

The answer is not to just run another npm package.

<comment><USER3> there is a company behind the package; i'm sure they'd take your money.</comment></comment></comment>


Show HN: Where does our money go? - <AUTHOR> https://docs.google.com/spreadsheets/d/1iJY7P10QKkH0LYuSGaHHADz_6no9zghAbz6lCCadHn0/edit?usp=sharing <comment><AUTHOR> I've been using this sheet once or twice a year for over a decade now, as it does one simple job really well - it takes expenses and income with differing frequencies, and converts them all to the same monthly rate so they're more easily comparable.

I've also used it for planning what I needed to buy a house, and the impact this would have on my monthly surplus/deficit.

This is by no means and example of great spreadsheet programming, but it's useful, it works, and it's easy. Feel free to copy, modify, and share further.</comment>


An exercise in riddle-solving - <AUTHOR> http://asserttrue.blogspot.com/2009/05/exercise-in-riddle-solving.html

<comment><USER2> Although the author says he solved it, he didn't; he made a guess and got lucky. Perhaps there's a subtle joke going on? (Or maybe it's not so subtle and I'm just being dim. Then again, I solved the puzzle in a couple of minutes and he apparently didn't.)

I don't think it's a terribly interesting puzzle.

<comment><USER3> His point is that he got the value of "?", but not the "correct" method to arrive at that solution. Neither of blog posts seem to ask explicitly for the method.

I think choosing to take a statistical gamble on a silly meaningless puzzle (rather than attempt to solve it conventionally like everyone else) is actually not necessarily a bad idea. I talked about that a while back here : [http://lhorie.blogspot.com/2009/03/games-bias-and- statistics...](http://lhorie.blogspot.com/2009/03/games-bias-and- statistics.html) (albeit I was reacting to a more statistical-natured puzzle at that time)

I do agree this puzzle isn't very interesting in that it doesn't evoke as much gut feeling as, say, the Monty Hall paradox.

</comment></comment><comment><USER4> it jumps out right away that:

1+1+1+1+1 = 5

2+2+2+2+2 = 10 and 1+0 = 1

3+3+3+3+3 = 15 and 1+5 = 6

(whenever it's sums of digits you think mod 9)

since there are 5 numbers, the sum of the coefficients mod 9 = 5 (ie, 5, 14, 23...)

that's as far as I went before giving up

anyone got the rest without brute force?

\</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>----

Oh and what's with the author's justification of random guessing?

<comment><USER5> From

        1 1 1 1 1 = 5
        1 1 1 1 2 = 1
        1 1 1 1 3 = 6
        1 1 1 1 4 = 2
        ...

you can see that an increase of 1 in the last digit will increase the answer by 5 or decrease it by 4, so it is an increase of 5 mod 9.

Similarly, from

        1 1 1 1 1 = 5
        2 1 1 1 1 = 8
        3 1 1 1 1 = 2
        4 1 1 1 1 = 5
        ...

you can see that an increase of 1 in the first digit will increase the answer by 3 or decrease it by 6, so it is an increase of 3 mod 9.

So the first digit is multiplied by 3 and the last digit is multiplied by 5. That rings a bell, since the last line is 3 1 4 1 5, which starts with a 3 and ends with a 5, so you must suspect that the second digit should be multiplied by 1, the third by 4, and the fourth by 1. Go over a few numbers, or all of the numbers, to check this out, and it works, so you can apply it to the last line and get the answer.

<comment><USER4> _since the last line is 31415_

That would be brute force,,,

<comment><USER5> There's a reason why the puzzle-writer used those 5 digits in the final question, so that you can spot the pattern and find a shortcut. Spotting the pattern is not brute force. To check your formula you have to do some calculations, but that is something you cannot avoid. By going over the numbers, what I mean is confirming that:

        1x3 + 2x1 + 3x4 + 4x1 + 5x5 = 1
        5x3 + 4x1 + 3x4 + 2x1 + 1x5 = 2
        ...

You can do that manually or mentally, so it is not what I call brute force.

And if you do not spot the 3 1 4 1 5 pattern, or just do not want to use the shortcut provided, there is another way to do it. First let's find the second digit. We only need our known digits and the two lines

        2 2 2 2 2 = 1
        1 1 2 2 2 = 6

Since we know that the multiplier of the first digit is 3, we can calculate the value of 1 2 2 2 2 = 2 2 2 2 2 - 1 0 0 0 0 = 1 - 3 = 7. Then it follows that the multiplier of the second digit is 1 2 2 2 2 - 1 1 2 2 2 = 7 - 6 = 1. The third digit can be found by changing the line 1 2 3 4 5 = 1 to 3 3 3 4 4 = 3. You can do this since you have the multipliers for the first, second and fifth digits. We already have the line 3 3 4 4 4 = 7, so the third digit is 7 - 3 = 4. For the fourth multiplier, change the line 1 1 1 1 1 = 5 to 2 2 2 1 2 = 0. Compare to 2 2 2 2 2 = 1 and you see that the fourth multiplier is 1. So now you have all the five multipliers, 3, 1, 4, 1 and 5.

But we are not necessarily ready yet, we may need to add a constant, c. So pick a line, the easiest seems to be 1 1 1 1 1 = 5. Now, since we know the five multipliers, we can say that

        1x3 + 1x1 + 1x4 + 1x1 + 1x5 + c = 5
        5 + c = 5
        c = 0

The constant is 0. So just multiplying each digit by its respective multiplier gives the correct answer. You still need to verify your formula by calculating the right hand side of a few lines.

</comment></comment></comment></comment><comment><USER6> my guess was pi :(</comment>


Ask HN: How about security start ups? - <AUTHOR>

Hi!. I'm from Buenos Aires, Argentina. Unfortunately, we have too much insecurity in our country and seems it'll be even worst.
So I was thinking if some kind of web start up could help our situation. A web won't solve the insecurity and that's for sure, but maybe could help a little.
Do you have something like this in your country?.
Any idea?.
Sorry about my poor English, I promise I'll improve it. <comment><USER2> OWASP is the first thing that comes to mind. <http://www.owasp.org> I'm not sure if I'd consider it a start up though.</comment>


Show HN: Very low footprint JSON parser in portable ANSI C  - <AUTHOR> https://github.com/udp/json-parser

<comment><USER2> There definitely is a lack of good JSON parsers for C. We wrote our own in QEMU. The relevant code is:

[http://git.qemu.org/?p=qemu.git;a=blob;f=json- lexer.c;h=3cd3...](http://git.qemu.org/?p=qemu.git;a=blob;f=json- lexer.c;h=3cd3285825d1f8433da982eba6059169bd6776c3;hb=HEAD)

[http://git.qemu.org/?p=qemu.git;a=blob;f=json- parser.c;h=849...](http://git.qemu.org/?p=qemu.git;a=blob;f=json- parser.c;h=849e2156da4e7a3fad8f890370236cb6da9be716;hb=HEAD)

Among other things, this supports streaming, is fairly fast, and has gotten a fair bit of scrutiny against malicious input.

The lexer is a hand written state machine which seems like something you should never do but turned out to be pretty reasonable.

<comment><USER3> What's wrong with YAJL?

<comment><USER4> Nothing, YAJL got a lot of things very right. We use it in our C daemons for a bunch of things. Not having to unpack the whole JSON into memory is pretty handy.

</comment></comment></comment><comment><USER5> Another alternative, <https://github.com/esnme/ultrajson>

"Ultra fast JSON decoder and encoder written in C with Python bindings"

From the people that built the Battlefield 3 web portal.

Medium complex object:

ujson encode : 18757.01101 calls/sec

yajl encode : 6315.14030 calls/sec

simplejson encode : 5542.03928 calls/sec

cjson encode : 4651.59072 calls/sec

\</comment><comment>---

ujson decode : 10759.69649 calls/sec

simplejson decode : 8148.35221 calls/sec

cjson decode : 7931.04387 calls/sec

yajl decode : 5887.38201 calls/sec

</comment><comment><USER6> This Show HN makes me think there needs to be a site for more formalized code reviews of open software. Ideally with some great game mechanics to make sure engagement is high and thing are getting reviewed well.

<comment><USER7> As a younger programmer with great ambitions, some sort of code review site would be awesome!

<comment><USER8> <http://codereview.stackexchange.com/>

</comment></comment></comment><comment><USER9> What happens when the input length is longer than 2^31? You used an "int" for the length (also, why ever use a signed value for length?) --- even on LP64, that counter wraps at ~32 bits.

(Same question applies to how you handle the max_memory computation).

<comment><AUTHOR> Added some protection against that, thanks.

</comment></comment><comment><USER10> You aren't checking the return value of json_alloc() in new_value()

<comment><AUTHOR> Well spotted! Fixed, thanks.

</comment></comment><comment><USER11> Is JSON guaranteed to be ASCII?

To clarify: Any "lookup table" that maps hex values to assumed character values is a portability red flag. When using them, it's polite to add comments to explicitly call out the code page dependency and argue (from a spec or RFC, say) why that assumption is okay.

<comment><USER12> <http://www.ietf.org/rfc/rfc4627> specifies that the encoding must be Unicode: "JSON text SHALL be encoded in Unicode. The default encoding is UTF-8."

<comment><USER13> Neither the execution nor source character set (of C) is guaranteed to be ASCII though. This makes the general parsing as well as lines like "if (c >= 'A' && c <= 'F')" non-portable.

<comment><AUTHOR> Non-portable to different character sets, not platforms. One could argue that the argument to json_parse is a UTF-8 string.

</comment></comment></comment></comment><comment><USER4> ts=3? Is this some sort of subtle troll to irritate all factions of tab stop religions?

</comment><comment><USER14> Interesting. I may try my hand at learning some Erlang NIF creation using this. Then I can benchmark it against Bob Ippolito's mochijson2 module.

Could be a fun little exercise.

</comment><comment><USER15> I like using Jansson: <http://www.digip.org/jansson/>

<comment><USER16> +1 for Jansson here too. Lightweight and works really well.

</comment></comment><comment><USER17>
      const json_char *cur_line_begin, *i;
      ...
      top->u.dbl = strtod (i, (json_char **) &i);
      top->u.integer = strtol (i, (json_char **) &i, 10);

Ick

</comment><comment><USER18> Seems similar to the one up on CCAN [1], which is also BSD-MIT licensed.

EDIT: forgot to mention that it includes a bunch of great helper functions, too.

<comment><USER19> 1\. <http://ccodearchive.net/info/json.html>

</comment></comment><comment><USER20> I've used cJSON (<http://sourceforge.net/projects/cjson/>) in the past, which worked very well for what I needed (simple 1 file JSON parser for config files). Maybe I'll give this a shot the next time I need to do some simple JSON parsing.

You should get the project listed on <http://www.json.org/>

<comment><USER21> If that's the same cJSON I was using a few months ago, I found it a lot more memory-hungry than it needed to be. I was doing some network code with lwIP on an embedded system, so the all-static nature of js0n (with some helper functions) was a better fit for me.

</comment></comment><comment><USER22> Here's another minimalist alternative: <https://bitbucket.org/zserge/jsmn/wiki/Home>

I've used it and think it's pretty neat. One of these days I'll get around to releasing the helper functions we've written to make it easier to use too.

<comment><USER23> I use it as well, and I'm very happy with it! It's been running in production for quite a while now without any hiccups.

</comment></comment><comment><USER24> Any reason you roll your own numeric() instead of using isdigit()? It's in C89.

<comment><AUTHOR> Just to be sure it's inlined, really. Although I assume isdigit would be, being a compiler built-in.

<comment><USER25> Seems like a premature optimization. Don't assume, check the assembly if you care :)

</comment></comment></comment><comment><USER26> why are the flag values not enums (and why is 4 missing?)? is using a lookup table for decoding hex really faster than the (minimal) logic (what if it causes cache misses)? do you really think that a state machine with bit flags is the best way to express the logic here? is string_add meant to increment string_length on subsequent passes? what is "json_value * cur_value" supposed to do at the top of json_value_free (maybe i am missing some c trick here?)?

[not dissing you, just bored on a sunday afternoon...]

<comment><AUTHOR> _> why are the flag values not enums (and why is 4 missing?)?_

What would the advantage of using an enum be? (and I guess I used 4 and then removed it later.)

 _> is using a lookup table for decoding hex really faster than the (minimal) logic (what if it causes cache misses)?_

No idea, that's just the way I did it. Feel free to try something else and profile if you're really that concerned.

 _> do you really think that a state machine with bit flags is the best way to express the logic here? is string_add meant to increment string_length on subsequent passes?_

There's only two passes, and it increments the length on both (the first is to measure the string, the second is to know where to write in it).

 _> what is "[..] cur_value" supposed to do at the top of json_value_free (maybe i am missing some c trick here?)?_

You're not supposed to mix code and value declarations in ANSI C, so I put it at the top of the function. It's just used to temporarily store the value while reading the parent.

<comment><USER27> I've converted the lookup table to a few lines of logic. I think it's more readable, and I would definitely bet on it being faster, though since I haven't profiled I don't know how much difference it would make.

[https://github.com/PeterScott/json- parser/commit/db9c326f747...](https://github.com/PeterScott/json- parser/commit/db9c326f74709b5a5f2904e11f44b9c165613433)

<comment><AUTHOR> Yeah, I'll go with that - cheers.

</comment></comment></comment></comment><comment><USER28> What are you doing with json.h:121 in _json_value::&operator[](const char* index) when your key doesn't exist?

Still, very nice. Comparable to jsonxx which i've been using up until now.

<comment><AUTHOR> Hmm, what should I do? (since it returns a reference). I could make it a pointer instead, but then you wouldn't be able to chain it.

Maybe some kind of const json_null value to return when the key isn't found.

edit: Done that.

<comment><USER29> longjmp to an earlier stage where you can "retract" the error or somehow wrap it in a chainable form (e.g. add a union to your result to signal whether it's a value or error, or whatever)

That's what exceptions are supposed to do. C doesn't have exceptions, so you use setjmp/longjmp.

</comment></comment></comment><comment><USER30> On a related note, if you want to get something done on a sunday afternoon, writing a simple recursive descent JSON parser from scratch is both doable and fun.

<comment><USER31> This should go without saying, but never use such a thing on user-supplied data.

</comment></comment><comment><USER32> The _inline_ keyword is optional and redundant for member functions defined within a class or struct declaration.

</comment><comment><USER17> Where c is `json_c', "return c > 127 ? 0xFF : hex_table [c];" always returns false due to the range of types.

<comment><USER27> Nice catch. It's fixed in the latest version.

</comment></comment><comment><USER17> Why are you doing "#define numeric(b) ((b) >= '0' && (b) <= '9')" instead of say isdigit(3) ?

</comment><comment><USER33> Where are the tests?

<comment><USER34> Oh, thanks. I was starting to feel weird because nobody was saying anything about the lack of tests.

HN may or may not work as a code review platform, but I don't think I would use myself a 3rd party software that doesn't provide tests.</comment></comment>


Getting metabolism right - <AUTHOR> http://newsoffice.mit.edu/2014/flawed-metabolic-networks-1007#.VDaR777d07c.twitter

<comment><USER2> As a scientist who works on computational models, this kind of thing is terrifying.

There's just so many ways that writing software can go awry that I have a hard time believing _any_ computational result too strongly.

<comment><USER3> Speaking of which, aren't the predictions related to global climate change based on computational models?

</comment></comment><comment><USER4> I think you could give this a subtitle of "Why you should read the Art of Computer Programming, Vol 2." Number representation in computers is a vast field that really deserves all of the attention it can get.

</comment><comment><USER5> Note that this is fairly common in rodent models for human diseases [1], but as the referenced article says: "Less than Perfect, Still Invaluable". I guess the same applies here.

[1] [http://www.hopkinsmedicine.org/institute_basic_biomedical_sc...](http://www.hopkinsmedicine.org/institute_basic_biomedical_sciences/news_events/articles_and_stories/model_organisms/201010_mouse_model.html)

</comment><comment><USER6> I gotta say, I love to be working in San Diego these days. The deluge of results coming from here or originating here and being re-examined elsewhere (as in this case) is just great.</comment>


Microsoft Goes All in for FPGAs to Build Out AI Cloud - <AUTHOR> https://www.top500.org/news/microsoft-goes-all-in-for-fpgas-to-build-out-cloud-based-ai/ <comment><USER2> Previous discussion [https://news.ycombinator.com/item?id=12578163](https://news.ycombinator.com/item?id=12578163)</comment>


Facebook data transfers to be examined by EU court, Irish judge rules - <AUTHOR> https://arstechnica.com/tech-policy/2018/04/facebook-data-transfers-to-be-examined-by-eu-court-irish-judge-rules/ <comment><AUTHOR> Looks like Facebook will have some extra problems with GDPR, transfering data between legal entities is just another checkbox that they will have to add to huge, scroll down list of "what we want to do with your data" checkboxes.</comment>