Show HN: Gitnonymous – Contribute anonymously to Git repositories over Tor - <AUTHOR> https://github.com/chr15m/gitnonymous <comment> ryan-c A few things:

This seems to really be a pseudonym management tool, which is useful, but technically not anonymous.

A few information leaks still present:

* Timezone (narrows down location)

* Commit times (narrows down sleeping/working hours)

* SSH client version (shows Linux distro version and patch level)

<comment><USER2> Time data could/should be randomized (can still be ordered, but distribute regularly over the day). Couple this with pushing commits at random times in a defined timezone and you probably can get rid of most time leaks?

<comment> ryan-c You want to make at least a 24 hour window of plausible commit time, which is constrained by the previous pull time (assuming it is from someone else and not obfuscated), and the push time.

I would push at midnight UTC that is at least 24 hours after the most recent pull and set commit time = push time.</comment></comment></comment>


Relive the Horrors of the Early Internet with the Geocities Archive Project - <AUTHOR> https://www.geocitiesarchive.org <comment><AUTHOR> In honour of the days of crazy colour schemes, flashing images, tiled backgrounds and guest books, we have released the Geocities Archive Project at [https://www.geocitiesarchive.org](https://www.geocitiesarchive.org)

Geocities was a free web hosting service that was launched in November of 1994. On a corporate whim, in 2009, Yahoo! shut down Geocities, which meant years of digital data was lost to the world. This equated to around 38 million user-created webpages, rich with family photos, fledgling business profiles, and pics that were sure to embarrass their creators many years on.

So what happened? Geocities was acquired by Yahoo in January 1999 for $3.57 billion in Yahoo stock. Unfortunately, the new terms and conditions introduced by Yahoo! proved less than popular with the vast majority of users: Yahoo! stated that it now owned all content within Geocities. After trying to provide a more premium service by offering vanity urls, rumours began to surface during 2001 that Geocities would be closing. Yahoo! would go on to effectively destroy fifteen years of early internet history overnight as many users did not have the ability to make a copy of their website before it was taken offline.

On April 23, 2009, Geocities stopped allowing any new member registrations and announced that the United States version of Geocities would be shutting down on 26th of October 2009.

Good news! So, with some tricky coding, and driven by the belief that this early internet history should not be lost on future generations, we have searched, indexed and made available for search over 40 million user created files.

We hope you're ready for an entertaining and nostalgic walk down memory lane.

The team @ Geocities Archive</comment>


Ask HN: What's the best place to buy survey responses from a specific niche? - <AUTHOR>

I'm looking to run a pricing survey to a specific niche (musicians) - SurveyMonkey audience isn't specific enough, and I've been struggling to find a service that can deliver me responses to a relatively long (about 20-question) survey. I'm willing to spend money, but Qualtrics is a little out of my price range. What else is out there, and what do you use? <comment><USER2> I've had success with: [http://www.google.com/insights/consumersurveys/home](http://www.google.com/insights/consumersurveys/home)

<comment><AUTHOR> Hmm... their limitations on how much text/options you can enter is making it somewhat difficult.

</comment></comment><comment><USER3> www.aytm.com is what you want, based in Berkeley. Tell them Anand sent you!</comment>


16 weeks to get my iPhone app approved. Guess I was doing it wrong. Here's my advice. - <AUTHOR> http://softwaredev.meetup.com/92/messages/4917448/

<comment><USER2> It took us four weeks and four rejections to get Borange approved.

The back and forth via email with the App Store people moved at a snail's pace. The most helpful thing was for us to call Apple developer relations people and discuss our issues, despite that developer relations people have no involvement with the approval process.

I heard recently that there a 10 people at Apple working to approve 700 apps a day, including new apps and updates.

</comment><comment><USER3> Does the time depend on the category you are posting to?

I got a productivity webapp approved in one week last July.

I will be posting another finance app to the app store but I don't expect huge delays because its not in the hugely popular game section.

Am I wrong?

<comment><USER4> webapp is usually easier than real apple app which may have the potential to crash the whole iphone OS.

<comment><AUTHOR> I've never heard that web apps require approval. Probably a typo? Also, it would be nearly impossible to "crash the whole iphone OS." An app runs in a sandbox, the worst thing it could crash is itself.

<comment><USER3> No typo, timburks.

Before the app store debut around July 2007, web apps was the only way to develop for the iphone.

With Webapps, Apple simply place your application on their <http://www.apple.com/webapps> page and gives you a chance to promote yourself.

Apple does not seem to promote those web apps as much as they should.

</comment></comment></comment></comment><comment><USER5> I was wondering if there was a difference for company or individual developers?

We registered as a company and just getting the legal department to allow us to submit took 4 weeks. After that the review of the application "Stay Tonight" took only about 2 weeks, but it did not show in a AppStore search for 2 more weeks. In fact we had to report an incident for it to show up in a search. Then the date of availability was left to the approval date and not the discoverability date, so we never showed in the new app section. So it took about 8 weeks, not too bad.

</comment><comment><USER6> I was hoping for advice about specific issues. For example, don't have a picture of an iPhone in your logo (or anything else Apple trademarked). Any other specific issues people have run into?

</comment><comment><USER7> My (twitter related) app was approved in 5 days. The following update in 2 days. I had expected worse, so I was pleasantly surprised.</comment>


The House has passed the economic bailout bill 263 to 171 - <AUTHOR> http://money.cnn.com/2008/10/03/news/economy/house_friday_bailout/index.htm?postversion=2008100309

<comment><USER2> Maxine Waters:

 _When we buy up this toxic paper, we're in charge. We can do the kind of loan modifications we've been urging [the industry coalition]..._

Here's a clip of Maxine:

<http://www.youtube.com/watch?v=KN6s1KVFBNg>

...she is making a threat to nationalize the oil industry, but flubs the word. The reporters basically laugh at her, and compare her to Hugo Chavez. Guess what? The imbecile wasn't that far off...

We have no real conception of how screwed we are, but we know one thing: The credit market is now fully subject to political constraints. To what degree is hard to say. But congress has already been forcing banks to give loans to unqualified people (a big part of the original problem) and so the same practice will likely continue. Except, banks know full well that every bad loan can be sold to the taxpayer at full price.

An unbelievable coup.

<comment><USER3> You seem to imply two false points. Chavez was elected democratically, twice. And Venezuela's oil was not nationalized.

I don't like the paternalistic and interventionist style he has but he isn't Fidel Castro. In many ways, he is quite a capitalist.

<comment><USER2> "You"

Rather, the reporters did. And Waters was also elected democratically. And that's not the point; the point is the media's reaction to nationalization then and now.

<comment><USER3> "[...] and compare her to Hugo Chavez. Guess what? The imbecile wasn't that far off..."

To me that line makes him own the journalists's remarks about Chavez.

</comment></comment></comment></comment><comment><USER4> My $0.02

The Good:

A non trivial part of the market freeze was due to the uncertainty about the bailout. Will it pass and if so at exactly what price will the Feds buy the toxic junk. Rather then sell, people were waiting. Perhaps now things can start moving again.

So this may be better then doing nothing.

The Bad:

The may be worse then doing nothing. We may spend a whole lot of money and not make a profit on it. Steal (by inflation) from all the people who save, to give to the bankers, and the bankers could still fail.

Many experts argue a better alternative would have been to pick a few winners re-capitalize them and then let everyone else fail. The core issue here is solvency not liquidity, the bailout addresses liquidity, which many consider just a symptom, not the disease.

More may have to be done, like re-capitalization, yet more may not be done because while this time there are no pitch forks in DC, there may well be next time. And thus, this could be worse the doing nothing.

'Ain't economics fun.

<comment><USER5> Right on the money.

</comment></comment><comment><USER6> If I may paraphrase a Redditor...

        "So is this good or bad for the economy?

        Bubble: bigger
        Collapse: inevitable
        Distance to fall: farther
        Dollar: worthless"

<comment><USER7> This plan is a disaster that will be remembered as one of the worst error in History ever. The US shot its last bullet, and it aimed at its feets. Buckle up, folks, cause the future is even more incertain now for the world.

<comment><USER8> I dunno, It will be hard to top Smoot-Hawley.

<comment><USER9> Ripped directly from Wikipedia: The Smoot-Hawley Tariff Act (sometimes known as the Hawley-Smoot Tariff Act)[1] was an act signed into law on June 17, 1930, that raised U.S. tariffs on over 20,000 imported goods to record levels. In the United States 1,028 economists signed a petition against this legislation, and after it was passed, many countries retaliated with their own increased tariffs on U.S. goods, and American exports and imports plunged by more than half. In the opinion of most economists, the Smoot-Hawley act was partially responsible for the severity of the Great Depression.[2][3]

<comment><USER10> Oh dear, I can't resist.

Bueller? Anyone, anyone?

<comment><USER11> ?

<comment><USER10> The Tariff Act is in the film Ferris Bueller's Day Off, with the teacher's "This act... anyone, anyone? - Raised...", except there's a line where he's taking class attendance register and goes "Bueller - Bueller". So I mixed both references. It's definitely an in-joke for viewers of the film. :-|

<comment><USER11> Oh yeah!

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> What's the main difference between this bill and the one that was rejected last week? Is it just the pork offerings including a tax credit for racetrack owners and makers of wooden toy arrows?

<comment><USER13> The arrow thing is popular with pork pokers, but what it is doing is correcting an accidentally applied tax.

In 2004 there was a small $0.39 excise tax levied on weapons. Unfortunately, $0.30 target arrows are considered weapons under the law so they got a 130% tax accidentally levied on them.

Any politician or journalist that grouses about arrow makers getting special handouts is either uninformed or attempting to deceive you. I recommend you ignore them as a source of future information.

<comment><USER14> i wish there were wikipedia style discuss pages for legislation. especially for things like this.

<comment><USER15> [http://publicmarkup.org/bill/emergency-economic- stabilizatio...](http://publicmarkup.org/bill/emergency-economic- stabilization-act-2008/)

thank you, Sunlight Foundation.

<comment><USER16> Good link, but the commentary there is just as bad as on this site.

</comment></comment></comment></comment></comment><comment><USER17> I thought this bill was the worst idea ever, until I heard Warren Buffett speak up for it two days ago. Buffett has both integrity and economic skills, and he probably understands this proposal better than any of us.

For instance, [http://ph.news.yahoo.com/rtrs/20080924/tbs-buffett- bailout-7...](http://ph.news.yahoo.com/rtrs/20080924/tbs-buffett- bailout-7318940.html)

The US government has a pretty poor track record for "emergency proposals" and other decisions these last 8 years, so I understand the skepticism. I'd vote against it myself. But there's more to the story than what you hear in most inflamed internet postings. Buffett himself says that we eventually need to roll some heads, but that it shouldn't be our first priority.

      They shouldn't buy them at what they're carrying, what the carrying value is, necessarily.
      They should buy them at the kind of prices that are available in the market.
      People who are buying these instruments in the market are expecting to make
      15 to 20 percent on those instruments.  If the government makes anything over its
      cost of borrowing, this deal will come out with a profit.  And I would bet it will come out with
      a profit, actually...

<comment><USER5> Fuck Warren Buffet. Who died and elected him grand master of the universe anyways?

Note that I'm not asking whether he knows how to make money - clearly he does: witness putting $5.000.000.000 into Goldman Sachs and then lobbying like hell for the bailout of ....... ..... (guess who?)

<comment><USER5> Is it the swearing that gets the downmods, or the contrarian view? Either way: Any of the downmodders have further thoughts now that the Dow is taking a beating despite the bailout?

</comment></comment></comment><comment><USER18> This is a real low point for HN (comment wise), the subject matter is interesting but I would have expected some interesting comments.

<comment><USER16> Well, like you wouldn't want to read Paul Krugman's or Tyler Cowen's opinions on programming languages, most people here don't have much that's truly insightful to say about economics and finance, with the exception, perhaps, of economics as related to software. I guess there are a few people who work or have worked as quants and know more than a thing or two about finance, but how much insight does that give you into the system as a whole, which is what broke?

This remains the best thing I've ready so far, in terms of something brief and at the same time thoughtful:

[http://www.marginalrevolution.com/marginalrevolution/2008/10...](http://www.marginalrevolution.com/marginalrevolution/2008/10/my- views-on-the.html)

<comment><USER18> Thats my thoughts exactly. I feel like I know less everyone else, as everyone seems to have an opinion or something to say, yet as I don't understand the system as a whole, I would rather just shut the hell up and contribute in some positive way (thats all we can really do at the end of the day).

So well said !

</comment></comment></comment><comment><AUTHOR> Here is the roll call: <http://clerk.house.gov/evs/2008/roll681.xml>

</comment><comment><USER19> Pitckfork: $10

Torch: $15

Freedom: Priceless

P.S. This is a joke...

<comment><USER20> Torches are one copper piece which is much less than a pitchfork.

<comment><USER21> 'use skill create torch' when in the outer-world, dumbass. Save your money in ING.

<comment><USER20> Don't flame me, I have a torch, with umm a big flame. Hah! _waves torch menacingly_

</comment></comment></comment></comment><comment><USER22> And I thought the democrats were the good guys... Now I really don't know whom to vote for. Wall St will get rich, but the political system has gone bankrupt.

<comment><USER23> This is totally off topic so I'll probably get modded down. Please don't be too harsh...

Thinking the Democrats were the good guys is your first mistake. The sooner we all realize neither side is good, the better. They are both equally bad in only slightly different ways. The Democrats are mostly impotent. They do nothing. They talk a great game and have some good ideas, but they almost invariably fail to execute. The Republicans know how to get things done. The only problem is it's often in the interests of a very small, elite minority.

Thinking one side is the 'good guys' is a big part of the problem we have right now. Fifty one percent of the population thinks the Republicans are the 'good guys' and continue to vote party lines, despite 8 years of bad policies and low approval ratings, instead of voting based on qualifications and track records.

</comment></comment><comment> patrickg-zill We will know in about what, 4 weeks, whether this actually did what Paulson claimed it would do. If not, then all we did was line Goldman Sach's and others pockets...

</comment><comment><USER24> One of the meanest things a friend has ever said to me is "people get the government they deserve."

Part of me still hates him for that.

<comment><USER25> a _democratic_ people get the government they deserve.

those living under a monarchy or dictatorship get to say "Well I didn't vote for you~"

<comment><USER26> The nation's control over its form of government goes beyond voting. All people have the government they deserve.

</comment></comment></comment><comment><USER27> I signed the wrong social contract.

(but it's not like anywhere else is preferable)

<comment><USER28> Did you keep your receipt?

Maybe you could take it back and get another one.

</comment></comment><comment><USER29> They misspelled Howard Coble's name. They said "Howard Cobble".

</comment><comment><USER30> we avoid fire and brimstone! but will pay for it forever! i want to see this "investment" as a dividend in my tax return.

</comment><comment><USER31> I think we're going to be the largest and richest third world country in the world because of this. Lets hope I'm wrong.

</comment><comment><USER32> Feckless bastards

<comment><USER33> We all are feckless actually, as they (the gov) represent us.

<comment><USER34> or _mis_ represent us?

</comment></comment></comment><comment><USER35> Damn.</comment>


The Bad Hair, Incorrect Feathering, and Missing Skin Flaps of Dinosaur Art - <AUTHOR> https://www.atlasobscura.com/articles/dinosaurs-art-paleoartists-mistakes <comment><USER2> Probably relevant: [1].

> The amazing dinosaur found (accidentally) by miners in Canada: known as a > nodosaur, this 110 million-year-old, armored plant-eater is the best > preserved fossil of its kind ever found.

[1] [https://www.nationalgeographic.com/magazine/2017/06/dinosaur...](https://www.nationalgeographic.com/magazine/2017/06/dinosaur- nodosaur-fossil-discovery/)

<comment><USER3> Wow, I'd missed that one. It seems to match the ideas we had about them, but what a gorgeous fossil.

</comment></comment><comment><USER4> One of my favorite Mangakas hilariously went full overfeather on a T-Rex.

[https://pbs.twimg.com/media/DGbedNNXkAIA0s0.jpg](https://pbs.twimg.com/media/DGbedNNXkAIA0s0.jpg)

<comment><USER5> For the curious, the notation 中身 on the lower image will mean something like "inner body".

</comment></comment><comment><USER6> The pictures of animals as interpreted by some future archaeology are very interesting. As a child I went through a phase - I suspect many of us did - where I gobbled up every bit of information on dinosaurs I could get. I never thought about how difficult it is to reconstruct what an animal looked like from its bones.

It is a little sad, because there are so many open questions and some of those simply cannot be answered without a time machine. But at the same time, I am happy that our understanding of dinosaurs is still evolving.

<comment><USER7> [https://xkcd.com/1747/](https://xkcd.com/1747/)

</comment></comment><comment><USER8> In principle I agree, but our image of what dinosaurs look like are probably closer to the truth than what we would have gotten had they just jumped to adding soft tissue.

This is my bearded dragon's x-ray

[https://scontent- lga3-1.xx.fbcdn.net/v/t31.0-8/20819094_1010...](https://scontent- lga3-1.xx.fbcdn.net/v/t31.0-8/20819094_10102340751138068_1441931428537691081_o.jpg?oh=a1caaa2762fc890acb1ad7543f7285a0&oe=5AE6D3AA)

see all those facial features? That's how it's face looks, almost exactly. The don't even have to use crocs to derive the "reptile skulls look like their faces rule".

<comment><USER9> Many dinosaurs were related to modern birds, the rest were not reptiles either.

<comment><USER10> I suppose what you're both saying speaks to the real issue - we lump all dinosaurs into one single 'should look a bit like this' image.

It's a silly thing to do of course, humans don't much look like dolphins or rats for instance but we're all mammals.

On the face of it that above statement seems a silly thing to say too, but it speaks to the way we tend to just apply 'dinosaur' to an incredibly diverse range of species that lived in multiple different environment right across the planet and across hundreds of millions of years.

I think there's probably room to start to acknowledging that 'dinosaur' no longer really can mean 'terrible lizard' and accept that it must speak to the diversity of the species within the category.

<comment><USER9> Yeah, I was recently reading about this. It's amazing how diverse they were. They basically dominated every niche across every ecosystem for 100s of millions of years.

</comment></comment></comment></comment><comment><USER11> It's funny, that I have just stumbled upon this yesterday: [http://bogleech.tumblr.com/post/99186085698/as-cm-kosemen- ex...](http://bogleech.tumblr.com/post/99186085698/as-cm-kosemen-explains- throughout-all)

<comment><USER12> I guess we would know because animals don't tend to have much more bone than they need. You should be able to estimate the mass of an animal based on the size and structure of it's leg bones (and whether you think it lives it's whole life in water). Then you assume it has enough muscle to move that mass, which gives you an estimate of the density (and locations) of some of the remainder. Split the rest between organs, fat and more muscle in proportions that seem reasonable based on existing animals.

Then discover you're still surprisingly wrong, probably. But it should rule out the pudgy T-Rex at least.

</comment></comment><comment><USER13> This article was disappointingly lacking examples of good contemporary dinosaur art... had plenty of examples of errors

</comment><comment><USER14> I like watching history shows where they find an old human skull and then have an artist/scientist add flesh - but I've always thought it would be great to get a 3d model of MY skull and then ask the same - would it actually look anything like me?

<comment><USER15> Probably yes, considering that this technique has been used countless times to identify remains.

<comment><USER16> How do they know it is correct?

<comment><USER4> Human facial reconstruction has the advantage of millions of examples of the soft tissue to study before making the model. Dinosaur artists have zero real life examples to work from so they have to make lots of guesses. For a long time they were thought to be most closely related to reptiles so the artists used modern lizards as a reference.

Now that we know many dinosaurs are most closely related to birds it is causing a revolution in dinosaur art.

</comment></comment></comment></comment><comment><USER17> The reconstructions of most dinosaurs are just terrible. I've found that artists do a much better job than scientists of creating realistic looking animals. The good ones are no more or less speculative than the scientist reconstructions, they just have more thought put into the coloring and how the animal may have looked as it moved about and lived its life. Here are some examples of dinosaurs as they may have actually looked by an artist named John Conway. Quite different than how they're often portrayed:

* Velociraptor: [http://johnconway.co/images/medium/velociraptor-mongoliensis...](http://johnconway.co/images/medium/velociraptor-mongoliensis_ii.jpeg)

* Shuvuuia deserti: [http://johnconway.co/images/medium/shuvuuia-deserti.jpeg](http://johnconway.co/images/medium/shuvuuia-deserti.jpeg)

* Pterosaurs: [https://www.wnyc.org/i/raw/1/dinoart5.png](https://www.wnyc.org/i/raw/1/dinoart5.png)

<comment><USER18> John Conway is actually one of the authors of the book discussed in the article.

</comment></comment><comment><USER19> These do make you wonder: Elephant's skeleton and outline: [https://2.bp.blogspot.com/-yTfzpcnAjU0/TugXUt4MMqI/AAAAAAAAA...](https://2.bp.blogspot.com/-yTfzpcnAjU0/TugXUt4MMqI/AAAAAAAAAmQ/xfVaYiEGG7E/s1600/elephant_skeleton.jpg) T. Rex's skeleton and outline: [https://newsdesk.si.edu/sites/default/files/photos/Skeleton....](https://newsdesk.si.edu/sites/default/files/photos/Skeleton.jpg)

</comment><comment><USER20> Kosemen's "All Tomorrows" is also a fascinating art book, looking at a possible future of humanity: [https://en.wikipedia.org/wiki/All_Tomorrows](https://en.wikipedia.org/wiki/All_Tomorrows)

<comment><USER21> As a matter of HN etiquette, whenever I recommend a book I always give an Amazon referral link. It's a technique I picked up from an HN alum and gets me in the mindset to always be selling.

Is that something that would have been discouraged on HN itself?

<comment><USER22> Feel free to suggest books you wrote, but I would look down on someone using referral links to profit off their recommendations.

</comment></comment></comment><comment><USER23> That swan is a thing of nightmares.

<comment><USER24> If you've ever dealt with ornery swans, it mostly matches their personality...

</comment></comment><comment><USER25> Do you think deep learning models could create this more accurately? The training set would be known skeletal structures to fleshed out representations.

<comment><USER26> You probably could, but I'm assuming there's just so many things that are pretty arbitrary. Take for example a dog. We breed dogs to display a huge number of differences, and only some of these are skeletal. From bones alone there's no way to tell how jowly the muzzle of the dog is, or what colour and length its hair, how musculature it is. Dogs are bred by humans, but many species have extravagant, non-skeletal features use in mating displays that are bred purely by arbitrary sexual selection and have nothing to do with diet, climate, or any other factor you could determine from fossil remains.

<comment><USER27> Those are generally edge-cases, though. That evolve in situations where there is little competition, and room for a little evolutionary inefficiency.

Although it's perfectly possible that dinosaurs were effectively massive birds of paradise with ridiculous mating accoutrements...

</comment></comment></comment><comment><USER28> Just a quick note: the article is from Sept 21st of last year. Can we get a "(2017)" added onto the end of the title?

<comment><USER29> Why? Do you think it's outdated?

<comment><USER28> I'm friends with one of the authors of the book and was all excited to see what I thought was a new interview about his work. :(

edit: and for more general reasons, because HN has a policy of identifying things from previous years as such in their titles, whether they're still relevant or not.</comment></comment></comment>


Animals can tell right from wrong - <AUTHOR> http://www.telegraph.co.uk/earth/wildlife/5373379/Animals-can-tell-right-from-wrong.html

<comment><USER2> I think this is a really important study. Humans are so arrogant to believe that other species of animals, (humans _are_ animals, don't forget) do not have emotions or thoughts or communicate with each other in a manner more complex than what we hear as a bark or a chirp.

How do we know they aren't communicating concepts as complicated as "Be careful there is a human approaching and it looks dangerous." with one syllable?

If you look at trends in human communication, across all languages, then you'll find syllable reduction increases as the word frequency increases. There are only 9 words in the 100 most common english words that have more than one syllable, and none with more than 2. <http://en.wikipedia.org/wiki/Most_common_words_in_English>

If you look up these words in the dictionary, they are the most difficult to describe. Compare the definition of "the" to the definition of "superfluous" <http://www.merriam-webster.com/dictionary/the> <http://www.merriam- webster.com/dictionary/superfluous>

This pattern is not just found in English. Some, perhaps most, Asian languages even include tones in single syllable words to indicate different meanings.

It could be argued then, that perhaps the consciousness of animals is actually more advanced than human consciousness. Who knows? Just because we don't understand them doesn't mean they aren't complex, perhaps the very reason we do not understand them is _because_ they are more complex forms of communication than human communication.

Why too then can't this same principle be applied to their concepts of right and wrong? Their morality?

I don't know any animal, other than humans, that will kill another animal just for the sheer pleasure of it. That seems quite morally corrupt. Animals kill other animals for what appear to be rationalizable reasons, food, competition, self-preservation.

Even when fighting for mates, the loser of a battle is allowed to escape with its life. Sometimes accidents happen and the animals die of injuries, but death is not the intent. Humans _intend_ to kill when they battle.

<comment><USER3> I have a chihuahua that (when left unsupervised) would kill chickens and kittens for fun.

When all its doing is breaking a neck and moving to the next one, it's hard to say that it was just hungry.

<comment><USER2> Ah... that is interesting! I wonder why that is.

My first reaction is to think that perhaps the behavior you describe and that behavior in humans is the result of surplus supply of prey. In the wild, prey are difficult to find and so they are eaten when killed. When there are more prey than can be eaten, the drive to play and gain hunting experience, becomes killing for sport and a display of suitability for mating.

<comment><USER2> Second reaction... If there is a range of moral "quality" so to speak of decisions made by humans, and animals also exhibit morality in decision making, then why might there not also be a range of moral quality in animal decisions. Perhaps your murderous chihuahua was on the morally depraved end of that spectrum...

<comment><USER3> She's definitely some form of demon.

</comment></comment></comment></comment></comment><comment><USER4> "Tell right from wrong" is a conjectural extrapolation. What this really tells me is that animals observe social protocol. Now, perhaps morality is no more than social protocol. But all of these "moral" behaviors have important practical consequences.

</comment><comment><USER5> How is this controversial? Anyone who literally thought that animals had nothing analogous to morality or who didn't understand the evolutionary underpinnings of morality was not being serious.

Nevertheless, the difference in intelligence (and thus scope of morality) between humans and most animals is so vast in degree that it becomes a difference in kind. Also, I still like eating tasty animals.

<comment><USER6> > Also, I still like eating tasty animals.

I think this is the 'logic' that has underpinned the previous dominant views of animals as mindless automatons.

I like eating animals -> eating animals is morally OK -> animals don't have consciousness

Merely trying to point out that animals do have concsiousness often causes cognitive dissonance and is quickly dismissed.

</comment></comment><comment><USER7> When in doubt, blame the journalist, not the scientist, but this is some pretty deficient evidence.

> On three occasion the male monkey picked up tokens she dropped and inserted > them into the slot and allowed her to have the food.

> As there was no benefit for the male monkey, Prof Bekoff argues that this is > a clear example of an animal's actions being driven by some internal moral > compass.

Primates participate in a good deal of social behavior based on reciprocal exchange, e.g., social grooming. The lack of immediate obvious benefit for the male monkey ignores the benefits of e.g., greater friendship, and ignores the dangers of "stealing" food from an older, possibly more dominant monkey. This example is interesting, but no more "moral" than any other one-sided benevolent exchange that you can find in monkey societies.

> Recent research from Switzerland also showed that rats will help a rat, to > which it is not related, to obtain food if they themselves have benefited > from the charity of others. _This reciprocity was thought to be restricted > to primates._

Next paragraph...

> Those who are successful in foraging for blood will share their meal with > bats who are not successful. They are more likely to share with bats who had > previously shared with them. Prof Bekoff believes _this reciprocity_ is a > result of a sense of affiliation that binds groups of animals together.

(My emphasis.) The bat data has been known for over 15 years, and the lack of internal consistency is likely the journalist, but the science is still... stretching pretty far. It is not uncommon for vampire bats to find "bat buddies" with whom they predominantly share their excess food. This activity is easily traced through reciprocal altruism to selfishness.

> Some studies have shown that animals experience hormonal changes that lead > them to "crave" social interaction.

Yes, like estrus, or ovulation in humans. This fact is unimportant and does not relate to morality.

> They also have three times as many spindle cells compared to humans and are > thought to be older in evolutionary terms.

We know so little of the workings of the brain or of spindle /neurons/ that stating an absolute difference (without reference to the fourfold or greater size difference (sorry, no reference to whale neuron count on hand))) as if it means something is silly. They exist in whales, which is important, but in humans they have been implicated in emotion, spatial awareness, and touch. Would whales having a sense of touch be a radical notion?

> This finding has suggested that complex emotional judgements such as empathy > may have evolved considerably earlier in history than previously thought and > could be widespread in the animal kingdom.

So because whales are older than humans in evolutionary terms, this suggests an earlier evolution of empathy? I think the fundamental mistake is thinking that the whales did not evolve spindle neurons independently, but the whole line of thinking is somewhat muddled.

</comment><comment><USER8> Isn't that just a matter of how one defines "morality"? I think morals are just rules that are being followed without understanding the reasons why. Even in human societies it is the same - we think we are all human and moral, but really the moral rules only serve to make us establish a specific organization of society (the moral rules are induced by society). In that way, why not consider the behavior of wolves or whatever "moral"? They are evidently following some rules.

Societies are subject to evolution - fair behavior among it's members might give one society an advantage over another society, so the fairness rule sticks and becomes inbuilt.

Not sure what is supposed to be new about this research then.</comment>


LCA: How to destroy your community - <AUTHOR> http://lwn.net/SubscriberLink/370157/33038a9113a805df/

<comment><USER2> Some of these guidelines are pretty nasty and serious, some of them are very, very subtle. For example, when reading this rule:

"5. Employ large amounts of legalese. Working with the project should involve complex contributor agreements, web site content licensing, non-disclosure agreements, trademark licenses, and so on. [...]"

I can't help but be reminded of the process involved in contributing to Clojure:

<http://clojure.org/contributing>

Obviously this comparison is not fair to the Clojure project, but if you squint a little bit, some contributors might be scared off by even the smallest roadblock.

<comment><USER3> The Apache Software Foundation has something similar. It's mostly for ass- covering should future "SCO"s arise.

<comment><USER4> Not really. It's more for ease in relicensing. When contributers don't assign copyright, the license can never change, since their contributions bind the original project to the original license.

Emacs is a good example of this working. Because Emacs is copyrighted by GNU and not its contributers, it was a simple matter of changing a few strings to change the license from GPL2 to GPL3.

For projects without copyright assignments, this is not possible; the Linux kernel will be GPL2 forever, even if someone wants to change. Some copyright holders are long dead, and contacting their estate to change some terms in the license agreement is impractical. (This is a shame, too; a GPL3 version of Linux would be great for hardware hackers everywhere.)

<comment><USER3> What you are describing is the motivation behind the FSF assignment requirement, what I was talking about was the Apache Software Foundation:

<http://www.apache.org/licenses/> (see 'Contributor License Agreements')

</comment></comment></comment></comment><comment><USER5> While reading this, it struck me as though Magento (the open-source e-commerce shopping cart) could be guilty of using some of those tactics.</comment>


PSA: There is something going on with OpenDNS - <AUTHOR> So I have been using OpenDNS as my DNS and just about 5 minutes ago, I could not open a single website on my firefox with the error: https://i.imgur.com/SU881Yg.png
---
Having figured this had something to do with firefox, I switched to Brave but got the same message. Then I opened certificate details - saw Open DNS's name in the issued to column - reverted back to default DNS in my router settings and voila! Everything came back to normal.
Any explanations or similar experiences? <comment><USER2> Can you provide some logs? i.g. dig output of sites you try to visit, using OpenDNS and your ISP's DNS. Do you get the expected results here: [1] (Note, some of the resolvers may time out)

[1] - [https://www.whatsmydns.net/](https://www.whatsmydns.net/)</comment>


Hackers raid eBay in historic breach, access 145 million records - <AUTHOR> http://www.reuters.com/article/2014/05/22/us-ebay-password-idUSBREA4K0B420140522 <comment><USER2> Here is what I get when I try and change my password:

      Page not available
      Ebay is asking its users to reset their passwords due
      to the unauthorized access to our corporate information
      network. This may result in a delay of service due to
      the high traffic volume. We ask for your patience and
      that you return to eBay soon.

I wouldn't think that "password changes" were really that heavy a function.

Edit - Finally got through. They are not letting you change your password directly, you either need to respond to an SMS or Email. Probably a (very) good idea if they are worried that someone has done a bulk theft of passwords.

<comment><USER3> Actually having difficulty even locating where to change my eBay password!

Also I did not receive ANY emails from eBay regarding this. Not sure if it meant my account was not affected, or it is just taking a while...

( EDIT: Finally found it, [http://ocsnext.ebay.com/ocs/sr?st=1&query=How%20do%20I%20cha...](http://ocsnext.ebay.com/ocs/sr?st=1&query=How%20do%20I%20change%20my%20eBay%20password)? )

</comment></comment><comment><USER4> Is it safe to change my password now? All I read in the article is how much they are investigating this. How do I know the hackers don't still have access and are now actively monitoring password changes potentially getting more info? I am concerned that there is nothing about this on the eBay front page and that I have not received an email from eBay about this

<comment><USER5> I wonder if this means the dutch auction site 'Marktplaats' also had its data copied. PayPal is apparently in the clear (not that I would ever use them again), but I do have a Marktplaats account and that's an ebay subsidiary. (they got bought out after ebay realized they were not going to be able to out-compete them).

</comment></comment><comment><USER6> Ok, passwords were encrypted, were they salted? Per-account salts? How was the salt stored? How about the keys? What was the scheme?

Actually, it seems like all sites with sensitive user data should disclose full technical details of their password scheme. How could we make that a reality?

<comment><USER7> You need to know how they store passwords because ... what?

<comment><USER8> So we can understand the risk of compromise.

<comment><USER7> Could you elaborate on that?

<comment><USER9> I think the reason people like to know this detail is so they can gauge how urgently they need to act and change their password(s).

If the attackers got plaintext data (worst-case) and users re-used logins on other sites, it's a 'holy shit drop everything and change passwords now' moment.

If Ebay followed best practices then affected users know they can wait a day or two and update passwords at a convenient time. Hashing, salting, encrypting all buy you time to react.

Your other comment is correct though, once a password database is compromised all those affected must assume it will be cracked and so they must change passwords. The only variable is how quickly they should act.

<comment><USER10> If used properly, can't the good hashing techniques be "safe", at least if the salt is not leaked?

<comment><USER11> You're thinking of pepper, not salt.

Salt is a random value that is added to a password before it is hashed, so that two identical passwords do not hash to the same value. The value is different for each hashed password, and is stored alongside the hash.

Pepper is a configured value that is the same for all hashed passwords, and is added to the password (and salt) before it is hashed. It is kept secret, and effectively turns the hash function into a secret hash function. Its merit can be argued because if an attacker is able to compromise your hashed password database, they could possibly have compromised your configuration and discovered the pepper too. However, it does add an extra hurdle for an attacker.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> "3 months ago"... And "eBay suggest users chanche their password"... Wait, what? I suggest a policy where important breaches in security are disclosed within a short timeframe.

<comment><USER13> They didn't know about the breach until about two weeks ago [1], though that doesn't normally excuse that they waited two weeks to go public with the knowledge.

One reason to hold back this information is if going public would make their investigation harder OR if going public would increase the security risk (e.g. if the security hole used wasn't yet fixed and going public meant disclosing something about how the hackers got access). But according to what had been made public so far this doesn't seem to be the case.

[1] [http://www.ebayinc.com/in_the_news/story/ebay-inc-ask- ebay-u...](http://www.ebayinc.com/in_the_news/story/ebay-inc-ask-ebay-users- change-passwords)

<comment><USER12> Agree. Those should be the only reason not to disclose breaches (to the public).

</comment></comment></comment><comment><USER14> New information in this article:

1) The user database wasn't just accessed, but 145 million user records were stolen.

2) eBay hired FireEye's Mandiant subsidiary to do the forensic work.

</comment><comment><USER15> How many billion $ companies will it take before we finally rid ourselves of plain-text password authentication (regardless of whether or not it's performed over TLS, or they're using a 'good' hash function for verification)?

The lack of a usable secure password authentication standards for the web is the most pressing issue in web security these days. If there's one thing in the next HTML standard that should be depreciated, it's <input type="password">

<comment><USER7> There is no usable secure password authentication standard that will protect from password compromise after password database leak. In fact, if you're talking about SRP, it's worse in this regard compared to, say, using bcrypt.

<comment><USER15> SRP as published in RFC2945 (circa 2000), which uses SHA-1, is worse. The protocol _and general idea_ is a lot better, and can be adapted to use any hash function you like. Replacing RSA with EC is also trivial. Half a day and a room full of cryptographers and browser guys and you could RFC these changes. Given more time, I have no doubt that they could come up with something entirely new and web-centric.

We have a standards body responsible for stewarding the web, and a handful of some very smart and well resourced browser vendors who can solve these problems. Ultimately these guys have to take this burden eventually, and these people _write_ web standards... not having a standard yet just isn't an excuse.

Why aren't they doing so? Is it because they're more interested in pushing their own platforms and authentication solutions (hint: all 3rd party authentication is horrific). It's not like Google, to pick one, is shy when it comes to developing their own protocols. And it's not just protocols... why don't browsers come with cracklib style hints regarding password strength yet? Why no builtin password generation to go with the existing password storage? So many things not being done because it's easier to blame the next company when their database is compromised than cooperating to solve hard technological and UI failings.

<comment><USER7> Again, SRP is useless against password database leaks. Even if it's used with scrypt instead of SHA-1, and ECC instead of RSA, it's no better than scrypt.

There is no standard not because nobody invented it, but because it's impossible in principle (unless we replace passwords with something else).

<comment><USER15> SRP _does_ offer reassurance when databases are compromised. If my browser supported SRP-EC-Scrypt, and users were guided on password strength by their browsers UI, then there would be negligible public concern regarding 'encrypted passwords' being leaked, or worry about whether eBay or HN is using MD5 or leaking HTTP POST requests somewhere.

Not to mention SRP verifiers are public keys. Password derived pubkeys like those in SRP can be used to securely encrypt other sensitive user data while still allowing users to decrypt and maintain those records interactively.

A good solution isn't "impossible in principle", we just need a full-stack solution extending from browser UI all the way to your favourite CRUD webapps database. Most of that complexity falls to the browser vendors, web application frameworks and languages would jump all over it once there was a client-side consensus.

We need to change our trust models. I trust eBay as an organisation to offer me a service. I don't trust the web stack or their servers.

<comment><USER7> It's true that if your browser and websites supported SRP-EC-Scrypt, you would know that they stored things "securely". However, this won't solve the problem of people using weak passwords and people using the same password for different websites. If you use strong passwords and don't reuse them, you already know your risks.

As for your second point, I don't understand it. Do you mean, with the help of SRP, you can store some sensitive data on server, which won't be available to this server, but will be available to user? What's the use of it? This sounds strangely similar to this idea: [https://www.w3.org/Bugs/Public/show_bug.cgi?id=25721](https://www.w3.org/Bugs/Public/show_bug.cgi?id=25721)

 _> We need to change our trust models. I trust eBay as an organisation to offer me a service. I don't trust the web stack or their servers._

Then passwords don't matter, because you assume that attackers already can do everything with your eBay account.

<comment><USER15> > If you use strong passwords and don't reuse them, you already know your > risks.

Nobody does this. Geeks who use password management are are an extreme minority, and solutions like LastPass are crock that solve the same problem by papering over infrastructural failings and mean users are never completely free to move.

Anecdotally I believe people typically use a 'good password' for banking etc, and a handful of lazy passwords. Cryptographically speaking, they're all weak of course, but imho people are better off with knowing one or two really good passwords (I used a 12 character mixed case password containing symbols entirely from QWERTY induced muscle memory) and letting their browser deal with derivation for different endpoints.

> Do you mean, with the help of SRP, you can store some sensitive data on > server, which won't be available to this server, but will be available to > user?

Not SRP specifically. Forget SRP. What I mean is generally that any user public key (whether it was originally derived from a user secret like a password or not) can be used by an organisation for online encryption and authentication and offline decryption, where data can be decrypted by either the organisation using their private key, or by the user using their password.

<comment><USER7> I agree with you that browsers help can improve security, in general. (Mozilla tried this with BrowserID/Persona, but failed.)

As for your second point, I still don't understand it :-) It's hard to make something usable without trusting servers in the current browser environment, even if browser vendors cooperate.

<comment><USER15> > It's hard to make something usable without trusting servers in the current > browser environment, even if browser vendors cooperate.

That's why the solution needs to be built in to web standards like HTTP 2.x and HTML, rather than shimmed in to a javascript library. The original HTTP authentication scheme actually did one thing right, and that was bypassing HTML and Javascript (where any hope of security and privacy is long dead and buried) and going straight to the browser UI.

<comment><USER7> Could you give one usage example of such scheme if it was properly implemented?

<comment><USER15> Not specifically, no. Armchair solutionary ;).

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> With such a large user database, why isn't tar pitting db requests the norm?... or at the very least, instituting something as simple as a flag on dummy record requests?

<comment><USER17> A flag on dummy record requests? You mean have records that don't correspond to real accounts, and audit access to them? How would you censor them from legitimate full traversals of the user database? How would you tar-pit attackers without throttling such legitimate processes?

<comment><USER7> There's an interesting project called "Honeywords" (one of the authors is Ron Rivest) [http://people.csail.mit.edu/rivest/honeywords/](http://people.csail.mit.edu/rivest/honeywords/)

Link to paper: [http://people.csail.mit.edu/rivest/honeywords/paper.pdf](http://people.csail.mit.edu/rivest/honeywords/paper.pdf)

(see also recent paper "Some Remarks on Honeyword Based Password-Cracking Detection" [https://eprint.iacr.org/2014/323.pdf](https://eprint.iacr.org/2014/323.pdf))

</comment></comment></comment><comment><USER18> > Cyberattackers compromised a small number of employee log-in credentials, > allowing unauthorized access to eBay's corporate network, the company said. > Working with law enforcement and leading security experts, the company is > aggressively investigating the matter and applying the best forensics tools > and practices to protect customers.

Seems like the kind of tactic used by spy cells to target people in certain places.

</comment><comment><USER19> Just tried to change my password and got:

"White spaces are not allowed in password."

Is there a valid reason to disallow spaces in passwords? I can't think of one.

</comment><comment><USER20> An idea I had a while back -

Build browser add-ons and a javascript site that performs N hashes of your master passphrase (high entropy) concatenated to the website domain (google, ebay, etc.). Set that hashed password to be your password on each website. Then when you use a computer you enter the master password and it generates all the domain-specific passwords. If that website is breached only the specific password is released. Even if someone knows you're using this scheme you can make it arbitrarily difficult for them to break it and get the master password by making N arbitrarily large.

This way you could use one master password to procedurally generate all of your passwords from any computer without relying on cloud/storage while still keeping them relatively independent. It's sort of weak to rainbow tables, but you could make N large enough and use a high enough entropy password that this would be a negligible threat I think.

Thoughts?

<comment><USER21> Changing the master password will be a problem because you will have to update every site your have an account on.

<comment><USER20> Yeah, that's kind of annoying. You could probably get autofill working reasonably decently, but it wouldn't be easy.

</comment></comment></comment><comment><USER22> Seems easier to just delete my account.

<comment><USER17> Yep. My ebay account can go to its final resting place, next to my linkedin account and my yahoo account.

</comment></comment><comment><USER5> Nice intrusion detection system they have there. And being able to exfiltrate a chunk of data that size without any alarms going off does not bode well. For all you know there is now a copy of the full db living somewhere else, not just the userdata but also every trade those users ever made. This would allow a whole bunch of other trouble to happen given that addresses and other information were also present in the data taken.

For instance, this could be used to set up a series of targeted raids along the lines of what some gangs have done in Europe in the last decade.

Knowing who has expendable money, buys fancy art, expensive jewelery, what it looks like and so on could help a lot during the planning of such an excursion.

</comment><comment><USER23> Just changed it.

I don't understand why eBay (and others) don't offer two-factor authentication. Of course this wouldn't have prevented the data theft but at least one can have a reasonable degree of certainty that your individual account will not be compromised with a simple password.

I also strongly suggest that you change the answer to the one-and-only secret question to something completely unrelated. For example, if the question is "What's the name of your high school?" the answer could be "violet and purple are similar". In other words, make it impossible to socially engineer the answer to such questions. I wonder if these answers were also stolen.

<comment><USER24> > I don't understand why eBay (and others) don't offer two-factor > authentication

eBay implements 2-factor auth via a PayPal s/Key hardware token.

[https://www.paypal.com/securitykey](https://www.paypal.com/securitykey)

<comment><USER23> Doesn't that just protect PayPal? How does it protect from someone social- engineering their way into your eBay (not paypal) account through, say, customer service?

</comment></comment></comment><comment><USER25> With eBay's response to date, there is very little information that allows users to better evaluate a service in which they have invested trust. Questions of trust and safety are natural for people to raise in a variety of everyday circumstances. For example, when people get on a plane or take medicine its natural for them to be concerned about the safety. In eBay's case, eBay is a market place and a financial services company so it's reasonable to ask for high standards and to question what their security practices are like.

One would also think that eBay would have a strong interest in developing trust between themselves and their customers, but there is little evidence of that recognition. Specifically, the going corporate standard for a major security breach among eBay's corporate peers is (a) full and (b) immediate disclosure.

By (a) full, note, that eBay has come our with a very murky statement about exactly what happened. There is nothing more substantial than "you should change your password but we don't think there is any danger". Well, was there general database access? Did attackers had access to production servers? All of them? Is there any impartial 3rd party audit that stands behind eBays security statements? Further, as part of a full disclose, it's good procedure to disclose how passwords were stored if they expect to establish trust. They have had 2 weeks at least to prepare their statements and they can't do better than the useless "passwords were encrypted"?. There are really only two possibilities here: (1) passwords were combined with a random salt and then hashed or (2) they were morons. And right now given their public statement it looks like (2).

By (b) immediate, note, its not unreasonable to expect that a certain percentage of eBay's users use the same username / password for both their eBay and their PayPal accounts. So for a couple of weeks now eBay has been aware of a potential financial danger to their customers and they have been sitting on the problem. Fail.

Security breaches happen to everyone. There is no faulting eBay there. The fault is with all aspects of their response. They have had a major security breach and they have not responded with a proportional disclosure. And that implies that security isn't their largest company problem.

</comment><comment><USER26> Can someone please help me understand why their stock price was not impacted by this? I observed Target when similar incident happened and nothing seemed to change.

Is the general market neglecting security exploitations or is the damage too small for those big companies? I personally think that it's a big hit for the companies. They will have to spend money to patch it up and also lose trusts from users.

<comment><USER27> Turns out most people probably don't give a shit and likely won't change their passwords now unless they're forced.

</comment></comment><comment><USER28> I class any address, date of birth, phone number information about me as "financial related data" as it is used by my bank to identify me. I wish eBay would stop trying to play down the seriousness of this breach.

Also, on the BBC news this morning (Thurs AM UK) a journalist seemed to hint that "passwords may or may not have been encrypted".

</comment><comment><USER29> From the comments:

"This really won't affect anything. Most people these days are use to being hacked, spied on and violated."

</comment><comment><USER30> dump: [http://pastebin.com/vmvjGw3N](http://pastebin.com/vmvjGw3N)

</comment><comment><USER31> Amazon is probably next.

<comment><USER5> It probably isn't for lack of trying that this has not happened.

</comment></comment><comment><USER32> Too bad security isn't a concern; only the almighty dollar, right?

Cheap excuses for security only add salt to the wound.

</comment><comment><USER33> Billion dollar startup opportunity: un-hackable, secure databases as a service.

<comment><USER34> You mean like when Oracle claimed that its servers were "unbreakable"?

It's a ridiculous claim for anyone to make.

</comment></comment><comment><USER35> "EBay spokeswoman Amanda Miller told Reuters late on Wednesday that those passwords were encrypted and that the company had no reason to believe the hackers had broken the code that scrambled them."

That seems to imply that eBay used a singular encryption key across its accounts. Surely not?

<comment><USER14> Journalists and PR people don't know the difference between encryption and hashing.

eBay is steering media reports toward the password story.

Much more important and potentially damaging to eBay's reputation and revenue is that 145 million user records were stolen.

This could be much more damaging than the Target or Adobe breaches.

<comment><USER36> Target had payment info. That trumps this easily.</comment></comment></comment>


Public stats for wasitup.com - <AUTHOR> http://wasitup.com/stats/ <comment><USER2> The first major growth in the middle of October last year was seen after I published wasitup for review at Hacker News: <http://news.ycombinator.com/item?id=886875>

The steep growth at the end of November last year can be attributed to a blog article I wrote where I referenced wasitup: <http://journal.uggedal.com/vps- performance-comparison>.

The last jump of regisrations on Jan 4th 2010 was due to a featuring on HTML 5 Gallery: <http://html5gallery.com/2010/01/was-it-up/></comment>


IsArray: Why is it so bloody hard to get right? - <AUTHOR> http://ajaxian.com/archives/isarray-why-is-it-so-bloody-hard-to-get-right

<comment><USER2> Because Arrays don't _really_ exist properly in javascript. They're just objects, with a magic 'length' property that is set to the largest positive integer index plus one, and a few convenience methods.

What sort of example do you need to know if an object is an Array? Never come across this problem yet...

<comment><USER3> I agree with you. I guess sometimes it's important to do a type check, but duck typing seems more appropriate for Javascript.</comment></comment>


What should a self-taught programmer with no degree learn/read? - <AUTHOR> http://stackoverflow.com/questions/414779/what-should-a-self-taught-programmer-with-no-degree-learn-read <comment><USER2> "One day Alice came to a fork in the road and saw a Cheshire cat in a tree. _Which road do I take?_ she asked. _Where do you want to go?_ was his response.

I don't know, Alice answered. Then, said the cat, it doesn't matter."

A good (non generic) answer to "What should I learn?" (asked by a self educated programmer here) depends on the answer to the question "What (kind of programmer) do you want to be?"

Step 1, answer the Cheshire cat! )

<comment><USER3> I just want to single out the ')' at the end of the post, a classic Cheshire Cat smile where you only see immediately his smile but not his face/eyes (i.e. compare with ":)").

If this is a coincidence and you done it by mistake (i.e. mistakenly have not put a ':') then this is one sweet coincidence. If not, then kudos to you :)

<comment><USER2> heh I did that deliberately(You can see there is no balancing '(' in the post), but I didn't expect anyone to catch it or even notice it. :-). I was just having some fun.

(For the perplexed) In "Alice In Wonderland" the Cheshire Cat fades away till nothing is left but its grin So I removed the ":-" from ":-)".

<comment><USER4> Note that the ":-" isn't strictly necessary: both Ambrose Bierce and Vladimir Nabokov, independently reflecting on their desires for the addition of a "typographic equivalent to a smile" before one ever existed in popular culture, proposed a simple "supine round bracket" or "\\___/".

</comment></comment></comment></comment><comment><USER5> I would suggest learning algorithms and data structures. I know that is suggested a lot, but I did not realize how little I knew until I studied these things. And I think that is part of what makes good programmers stand out as these things apply to _all_ languages.

I then looked at my primary programming language (C++) differently. I wasn't just always using vectors any longer. I knew when to use them and when to use a queue or stack or hash.

In short, studying algorithms and data structures and then applying what I studied in C++ made me a better programmer.

<comment><USER6> As someone with a CS background who has worked with several very talented self-taught programmers in the past I can echo this. Even if they knew a particular language or environment better than I did, I could usually write faster or more efficient code simply because of my deeper knowledge of data structures.

One in particular comes to mind, I was working a temp job during my 3rd year at college with a very talented friend who was self-taught. He had written a rather brilliant dynamic reporting system for a very large e-commerce site in Perl, allowing the management to interactively drill down into recent sales and inventory activity. It worked fine for a few years until the volume of data became very large. Try as he might he couldn't get the software to be performant any longer and had to resort to a 10-11 _hour_ batch crunch every night with the output dumped out to static HTML files for the mgmt to review. Finally one night, the process failed -- out of memory. Throwing more hardware at it only bought another few days.

A dive into his code (most of which was really quite well done) turned up the following: he was using Perl hashes _everywhere_ to operate on the data because they made the code easy to read and convenient to write and maintain. I rewrote many of the particularly inefficient parts to use arrays over a few weeks and suddenly, the entire batch took 10 minutes to run! A few more tweaks and we turned it off of batch mode and back into full interactive mode. Mgmt never had to wait more than a minute or two to return back a report of a huge amount of data.

The key of course was that he simply didn't understand how much overhead the associative arrays created because he didn't understand the data-structures involved. He had simply relied on the magic of the language to do that work for him. A few days spent with [http://blob.perl.org/tpc/1998/Perl_Language_and_Modules/Perl...](http://blob.perl.org/tpc/1998/Perl_Language_and_Modules/Perl%20Illustrated/) and he never made that mistake again.

</comment></comment><comment><USER7> First thing to do is realize that for many (most?) older programmers, this is the norm. Being self-taught in the days before Programming as a major or Comp- Sci for that matter isn't a new thing for the profession. That said, best thing to do is to continue the methods/procedures that got you to where you are. Learn more, read more. There are always other languages to learn and certainly more books to read. There are many lists of 'Best Computer Books for Language Foo' out there as well as 'Best Computer Books in General'--- find them and start at the top, bottom, middle, where ever you want. I tend to divide reading into what I think of as the classics and the practical; the classics are programming texts that apply to all languages, the practical are those that apply to a particular language. When it comes to reading in general, remember Sturgeon's Law--- '90% of everything is crap' this is particularly true for the 'practical' category, so spend time reading in the bookstore before plunking down cash...

</comment><comment><USER8> Read recent phd theses. They always have a few chapters at the front giving an overview of the state of the art of their subject area, to prove that the candidate knows it. As for subject area, just sample widely - it's impossible to know what will be useful in advance, and in any case it's all exercise for the brain.

<comment><USER9> This is excellent advice. If you have a hard time following a thesis, look for introductory stuff in the bibliography.

CiteSeer (<http://citeseerx.ist.psu.edu/>) is an _excellent_ place to find theses, research papers, etc., and it has local PDF / PS caches for many of them. Google Scholar (<http://scholar.google.com/>) also works, though many results will be behind academic paywalls (e.g. the ACM) - the "all X versions" link will often have alternative links, such as faculty pages, including PDFs / PSs.

<comment><USER10> Re paywalls: that's why I use also <http://academic.research.microsoft.com/>. For some papers it has a PDF link on the bottom of the page. As a personal preference, I like it more than Scholar (scholar is more full-text search driven, while academic is more filtered).

</comment></comment></comment><comment><USER11> I'm surprised Donald Knuth's Art of Computer Programming only got 1 upvote. I've never considered the series a good fit for beginning programmers but for someone with 7 years under their belt who is looking for depth of knowledge I really can't think of a better choice of reading material (Plus there's a nifty box set coming out next year:[http://www.amazon.com/Computer- Programming-Volumes-1-4A-Boxe...](http://www.amazon.com/Computer-Programming- Volumes-1-4A-Boxed/dp/0321751043/ref=sr_1_2?ie=UTF8&s=books&qid=1292565902&sr=8-2-spell))

<comment><USER12> Most people that recommend TAOCP haven't read it; and IMHO it's highly overrated.

I've read parts of volumes 1 and 3. This book is awesome if you have the time to digest it, but you get faster results from other books that are easier to read, like Cormen's Algorithms.

<comment><USER13> It depends on the results you want to get-- TAOCP and CLRS are completely different creatures.

If you are expecting TAOCP to be an Algorithms textbook, you're going to be severely disappointed.

Personally, I find TAOCP to be highly underrated. I find Knuth to be an utter joy (and just yesterday, greatly enjoyed watching the video of the 16th Annual Christmas Tree lecture.)

CLRS is a great Algorithm textbook, but it's not the place to go to find why there is a Pi in the formula for the approximation of Catalan numbers.

<comment><USER14> Thanks for mentioning the lecture "Why Pi". Here's a direct link to the video [http://stanford- online.stanford.edu/seminars/knuth/101206-kn...](http://stanford- online.stanford.edu/seminars/knuth/101206-knuth-500.asx)

</comment></comment></comment></comment><comment><USER15> I'm in the same boat (10 years of experience, a good 6 doing serious programming work) with no degree.

However, because I know I will always do web programming I have definitely not focused on issues like compiler design, low level memory management [1], etc because most of the languages I use are either interpreted or compiled to bytecode and thus those areas are irrelevant

I would therefore argue it very much depends on what kind of work you wish to do - sure read some more in depth stuff but if you are doing web programming spending some of that time on product development knowledge, server administration, etc might be more beneficial.

[1] clearly some memory management is important in languages like Java and Objective C but using the built-in alloc/dealloc functionality is not really "low level understanding"

<comment><USER16> > I know I will always do web programming

That seems like a pretty unwise assumption to me. In a decade or two the web may have changed beyond all recognition.

<comment><USER15> Just to follow up and explain... I'm at the end of my programming career _(10 years, I've worked on high profile stuff, I'm done)_ , having migrated away from programming into product development and strategy.

Programming may be completely different in a decade's time but I won't be programming. My era is now and that was always the plan to concentrate on web.

I fully respect the "career programmer" may need to choose differently but for many of us working as an engineer/programmer is simply a step in the journey. To go back to the OP, that's probably why I didn't feel inclined to study CS at university.

<comment><USER16> Oh. So, er, "I will always do web programming" actually meant "I'm not really going to be doing much of any sort of programming from now on". Fair enough, and that may well be a very wise career decision, but I don't think I can really be faulted for misunderstanding you.

<comment><USER15> No, it means I will always do web programing.

Lets say the next big thing in programming is GPU programming to compute massive volumes of data - I will still always do web programming.

Lets say I continue to move into strategy, product development etc - I will still always do web programming.

I just don't sit into one of the boxes perhaps you are trying to pigeon hole me into, maybe?

</comment></comment></comment></comment></comment><comment><USER17> +The Practice of Programming - K&P are prolific authors and deliver the salient points of a BSCS and the transition into practicing programmer. Best bang for your buck.

+Code Complete - A no nonsense approach to Software Engineering and other tasks related to development. The SE texts used in most college courses are far too advanced and abstract for undergrad students that have never worked on very large projects. This one delivers excellent advice for single programmers up through medium size groups.

+Some algorithm and data structure book - there are a lot of bad ones. Use Amazon ratings to try and find a good one. Work through the design of as many algorithms as possible, no matter how mundane or the fact that most practical languages have libraries that deliver this functionality. Know what algorithmic complexity is and memorize the complexities of often used data structures to help quickly choose while coding.

+An operating system design book (e.g. Operating System Concepts or Modern Operating Systems) - know how the OS packages RAM, storage, CPU scheduling, network, concurrency for userland programming.

</comment><comment><USER18> The thing that struck me about some of the recommended reading on the list was that I suspect some of the books in the highly voted answers are probably not recommended texts on a good CS course (as is the author of the posts wish). I mean it's been a while since I took an undergraduate course but there were very few books recommended that looked at the more practical side of computer programming - apart from maybe in the first year of your course, and I'm assuming the author was looking for more in depth reading. Senior years on many CS courses tend to focus on theory behind topics which is something that I think is probably a lot harder to get motivated to read than say Code Complete. I mean you really have to want/need to learn Edmonds' graph matching algorithm as things like that are not comfortable reading. It's the reason why I think doing a CS course has some benefits as it's not often you are forced to approach the subject in that manner. That said, the accepted answer has probably provided a decent list of books with a more academic slant.

</comment><comment><USER19> You might be interested in the lectures from MIT on Comp. Sci

[http://ocw.mit.edu/courses/electrical-engineering-and- comput...](http://ocw.mit.edu/courses/electrical-engineering-and-computer- science/)

</comment><comment><USER20> I recommended _The Elements of Computing Systems: Building a Modern Computer from First Principles_ <http://www1.idc.ac.il/tecs/> It's a great book/course which takes you through all the abstraction layers from chip architecture to OO-programming.

After that, I recommend SICP.

When you are self-taught you easily end up with big holes in your knowledge, because you typically focus on what you need to know in your current project. These two books are great because they cover a lot of ground (different abstraction levels, different paradigms) while still remaining practical.

</comment><comment><USER21> One thing I found useful as a self-taught programmer was getting outside of the dominant programming paradigms. Though I'd like to disassociate myself with the over-the-top PG fanboyism that sometimes goes on here, I must admit that his lisp books were a great help in breaking out of the imperative and OO worlds, and were a major influence on me at an early stage.

Even better, PG has now made On Lisp available for free: <http://www.paulgraham.com/onlisp.html>.

<comment><USER22> I'm not sure the SICP is for everyone, but that's exactly why I recommend it to self-taught programmers and the occasional "I'm a web jockey but I'd like to learn to be a real programmer" post. If you're excessively steeped in the practical side, it focuses like a laser beam on the bits of education you've missed out on, and in a shocking twist of fate, will teach you eminently practical skills as well. I'd rather hire web jockey + "I worked all the way through the SICP" than a guy with just a degree.

(I hate it when people say they learned nothing from schooling, computer science theory is _dripping_ with practical usefulness. Unless you're just so damned brilliant you came up with compiler theory and basic AI and type theory and all kinds of other stuff all on your own. Which I don't believe.)

</comment></comment><comment><USER23> I had been programming for years before I got to college. I'm "self-taught", but until I got to college, I hadn't learned any of the academic aspects of programming. Learning how to analyze code, in addition to how to write it, was one way in which formal education really helped. Read about complexity analysis, for example.

</comment><comment><USER24> [http://www.noop.nl/2009/03/top-50-new-software- development-b...](http://www.noop.nl/2009/03/top-50-new-software-development- books.html)

[http://www.reddit.com/r/compsci/comments/ce592/ask_rcompsci_...](http://www.reddit.com/r/compsci/comments/ce592/ask_rcompsci_what_are_some_good_book/)

[http://www.reddit.com/r/books/comments/ch0wt/a_reading_list_...](http://www.reddit.com/r/books/comments/ch0wt/a_reading_list_for_the_selftaught_computer/)

[http://www.reddit.com/r/compsci/comments/dynkd/ask_rcompsci_...](http://www.reddit.com/r/compsci/comments/dynkd/ask_rcompsci_must_read_cs_literature/)

<http://krainboltgreene.github.com/l/2/>

<http://news.ycombinator.com/item?id=2002602>

</comment><comment><USER25> Here's the slightly modified answer I just posted there (even though it's an old question):

Back when he was still doing podcasts Joel Spolsky answered the similar question, which was partly "Does a good programmer without a CS degree really have a chance to get a job at Fogcreek?[1]" (It's near the end of the page.)

He says that for a good self-taught programmer who began with a high-level language, say PHP or Java, who comes at programming from a practical perspective, there are a few important parts of the CS curriculum the person may have missed out on, and goes on to list some books that would help fill in those gaps.

Off the top of his head he named these books in about this order:

\- Structure and Interpretation of Computer Programs[2] (also free online[3])

\- C Programming Language[4]

\- The Unix Programming Environment[5]

\- Introduction to Algorithms[6]

He said that those books covered the aspects of the CS curriculum his company needs in a good programmer, e.g. being able to create algorithms for an uncommon data structure.

Those books all have the added advantage of having exercises, and all being a very pleasant read. SICP is an introduction to many of the big ideas in CS: data structures, streams, recursion, interpretation, compilation, register machines, etc., and their implementation in Scheme (a kind of Lisp). It's a great place to start. The next two focus on implementation details like pointers and memory allocation. They are compact, powerful books. The last, Introduction to Algorithms, seems misleadingly titled, as it is fairly comprehensive and used in both undergraduate and graduate courses. If you work your way through the entire book, chapeau!

[1]: <https://stackoverflow.fogbugz.com/default.asp?W29060>

[2]: [http://www.amazon.com/Structure-Interpretation-Computer- Prog...](http://www.amazon.com/Structure-Interpretation-Computer-Programs- Engineering/dp/0262011530)

[3]: <http://mitpress.mit.edu/sicp/>

[4]: [http://www.amazon.com/Programming-Language-2nd-Brian- Kernigh...](http://www.amazon.com/Programming-Language-2nd-Brian- Kernighan/dp/0131103628)

[5]: [http://www.amazon.com/Unix-Programming-Environment- Prentice-...](http://www.amazon.com/Unix-Programming-Environment-Prentice- Hall-Software/dp/013937681X/)

[6]: [http://www.amazon.com/Introduction-Algorithms-Third- Thomas-C...](http://www.amazon.com/Introduction-Algorithms-Third-Thomas- Cormen/dp/0262033844)

</comment><comment><USER26> Learn to write and speak well.

Strong communication skills are powerful.

<comment><USER27> For this, I recommend Dale Carnegie's poorly named How to Win Friends and Influence People, and attending your local Toastmasters group (you will improve your speaking substantially)

</comment></comment><comment><USER28> _How to Win Friends and Influence People_ , because you're going to have to sell yourself better than the people with degrees.

</comment><comment><USER29> the manual.</comment>


What happened to sublimetext? - <AUTHOR> http://www.sublimetext.com/ I am wondering if it still is under development or if it will just die quietly. The last tweet is from June - as well as their last release, which has been a beta ever since.<p>Does anybody have any insights on this? <comment><AUTHOR> That is more than embarrasing. I actually wrote quite a bit about how I am not sure if they are actively developing it and so on. Sorry to see that it got lost at some point. I was basically trying to figure out if there will be any improvements to sl in the near future, and if anyone is having any information about it.

</comment><comment><USER2> may be you are looking for sublime text 3 [http://www.sublimetext.com/3](http://www.sublimetext.com/3)

If that's not your issue, please state clearly what your issue is. Not many people here are clairvoyant.

</comment><comment><USER3> Am i the only one who don't get it? Is there something not usual in the homepage?</comment>


Idea Paint - <AUTHOR> http://www.ideapaint.com

<comment><USER2> Kinda makes me nervous: _Whoops. Sorry! I thought I was in my office..._.

If you redefine common things, your expectations diverge from the norm eventually. This is a problem only in proportion to the consequences of error, so it's one argument for strict standardization of safety measures.

</comment><comment><USER3> Blackboard paint is cheaper. You can even mix it with other colors to make non-black colors. See: [http://www.apartmenttherapy.com/ny/how-to/how-to-make- your-o...](http://www.apartmenttherapy.com/ny/how-to/how-to-make-your-own- chalkboard-paint-016134) [http://www.apartmenttherapy.com/la/another-color- twist-on-ch...](http://www.apartmenttherapy.com/la/another-color-twist-on- chalkboard-paint-088829)

</comment><comment><USER4> Someone on the Joel on Software discussion board noted that it would cost by hundreds of dollars ($600?) to paint a single wall.

<comment><USER5> I priced it out for a wall, and it's really expensive. For an 8ft x 18ft wall, at $3.99/square foot, it would cost $574.56.

<comment><USER6> Have you ever priced out a white board to fit that space? An actual whiteboard that size would be much pricier. This actually doesn't seem too unreasonable.

</comment></comment></comment><comment><USER7> Interesting, but the site doesn't handle tools like NoScript gracefully.

</comment><comment> onreact-com Good thing for kindergardens or elementary schools :-) Can't imagine it'll spread elsewhere though. Looks too messy.</comment>