Ask HN: Those in Europe making €100K+ annually, what is your job like? - <AUTHOR> For those who make €100K+ annually in Europe, where are you based? Where do you work? What is your position? And what is your job like? <comment><USER2> €100K is not really setting the bar all that high. It's a shame to see so many replies here that consider it to be impossible.

Personally, since living in Europe, I've done it two ways. I worked remotely for an American company for several years, at my butt-in-seat Bay Area rate. And I've bootstrapped my own SaaS product business (letting it grow in the background while working for that US company).

Another option would be to find a software company here and actually negotiate a market rate for one's self.

It's really expensive to live here, compared to the 'states. I don't see how anybody does it on the $35k/year salaries we see reported for software guys.

<comment><USER3> "Welp, €100K is not setting the bar that high folks. I can prove that by demonstrating two different examples where I didn't pull a salary of €100K from a European company."

<comment><USER2> This is an attitude that I see a lot when developers talk about salary, and it is baffling. It's as though you are so determined to win your point that you would prefer to spend an entire lifetime making a less than market rate out of spite, rather than accept that the market pays as well as it does.

It only takes one example to prove that something is possible. What you do once you know something is possible is up to you.

<comment><USER4> I like your blog posts and you're certainly an inspiring example, but really it's odd that you can't see that, given the large number of people _not_ in your position (as evidenced by the replies here and elsewhere in similar threads on HN), logic dictates that "one example" only proves that you are either lucky, talented, clever, or whatever (I'm not trying to analyse the reasons for your success or detract from it). But it's got nothing to do with a determination to win a point: it's just statistics, and they show that your personal experience, while interesting, has zero bearing on or significance for the experience of most people.

</comment></comment></comment></comment><comment><USER5> It doesn't make any sense to compare salaries solely by numbers and without comparing the buying power related to the salary in the given country. Escpascially (!) not in the EU, since it's so diverse. This is most basic economic understanding. It just does not work out, no matter what you take in account to "justify" the the higher or the lower salary.

I live in Austria (big corp) and make 1x € a year.

My brother lives in Swizerland (big corp too) and he makes 3x € a year. It's a usualy saying here, that you make around 3 times the money in Switzerland compared to Austria, independently of what you work.

BUT:

In proportion to buying power and minus cost of living he has just about 1,5x € more money to blow (or to safe). Not 3x

AND,

he also says quality of life is 10x better in Austria: Do you live to work or work to live?

Spoiler: He's moving back to Austria in 1-2 years.

</comment><comment><USER6> I was on this a few years back. Contracting in oil and gas but far fewer well paid gigs in that sector these days I believe. Job was demanding - pressure to keep services running, massively complex environment, everything constantly changing, tricky problems ranging across technical, organisational, political. I didn't last long but even so still managed to pay off a decent chunk of the mortgage! Permie for the moment but always keeping my eye open for that next juicy contract, and building up my skills in the meantime in preparation.

I discovered after being there a few months that I was on one of the lower contractor rates!

</comment><comment><USER7> Where I live (a nordic country) the median for architect level positions is about 4000-5000e/month (we don't talk about yearly salaries here). After taxes you get about 3000-3500e per month.

All tax information is public here and the magazines publish yearly lists of people earning over 100000eur (salary+possible capital gains). The lists usually never contain anybody doing "low level" work (ie. not CEO level etc.). And actually very few people earn that in salary alone.

</comment><comment><USER8> Senior/Lead UX designer at a big corp in London: making ~£115k/yr (~€130 at mythical exchange rates), salaried, before tax.

Actually took a pay cut, used to be a contractor with a day rate ranging from £600-750 which had me averaging approx £150k/yr and paying much less tax. Considering going back to that soon, although a bit worried about Brexit uncertainty, but right now I'm seeing plenty of contractor roles offering that much, a few up to £1k/day.

</comment><comment><USER9> In London:

      - Management or technology consultants with maybe 6-7 years+ experience (particularly the more well known firms)
      - Many roles in accounting and law firms, approx. similar experience as above
      - B2B sales (if they're any good) particularly in finance or enterprise tech
      - Almost anyone working in a hedge fund
      - Front Office IB roles (quant, trading, business management, sales, et al.) after perhaps 3-5 years
      - Other IB/banking roles at mid management and above levels (varies by bank)
      - Most any decent technical or business contractor
      - Technical architects and dev team leads for large projects
      - Some recruiters / "headhunters"

Source: I have been a consultant and contractor, and worked with/hired for the majority of these roles at £>100k

Some of these roles are hard, in cut-throat industries and involve long hours. Plenty are not; get yourself in a middle/back office mid management role in an IB and if you're reasonably intelligent you can take home 100k (and the rest) whilst working from home 1-2 days a week and rarely staying in the office after 5:30. I'm not saying you'll find it satisfying, but it isn't difficult.

<comment><USER10> Any IBs or hedge funds you'd recommend?

</comment></comment><comment><USER11> The salary scale for jobs paid according to tariff in the electronic (IG Metall) or chemical industry in Germany ends at around 100k€. This can be reached if you stay at the same company for a reasonably long time and don't fuck up. This is far from entry level salary though and most people only reach this in their 30ier or 40ies.

Senior technical expert and management positions are usually paid above tariff, starting at around 100k€.

There are plenty of positions in the big tech companies and software that are paid above 100k€. It's just very unlikely to get there if you are straight from school. Also, you won't have much luck finding >100k€ positions in the eastern part of Germany.

</comment><comment><USER12> I have worked in Vienna 2014/2015 (meteorological company) and Melbourne (big 4 bank) present. Vienna annual salary was 34k Euro. Melbourne annual salary is 67k Euro. Europe pay sucks.

<comment><USER13> Well I don't know for those two countries, but I'm happy with my 'only' 50k with "free" healthcare, schools, etc... Not going younger so I reaaaally care about free healthcare

<comment><USER14> Free health care in Melbourne too!

</comment></comment></comment><comment><USER15> Define 100k+...

Is it what you get on your account in one year ? Is it what you keeps after paying your taxes and your insurances ? Or is it the global value your employer is paying for you ?

I assume you ask for the first one, yet the more representative one is probably the latter.

<comment><AUTHOR> That's correct, I was asking about the former. I didn't understand the difference between the former and the latter though.

<comment><USER15> Well, it's pretty simple, I can talk for France : you have a ~2x factor between the former and the latter, because there is a ton of taxes and costs in-between.

And should you compare with the US, you should also take into account health insurance, which is handled roughly 80% by the state, so it's part of your taxes, and 20% by insurance ( and is mandatory, part of what your employer pays for your salary ).

So depending on the case you may compare oranges with bananas and apples, because depending on your country what you have into your account as an employee over one year is way different from the value you obtain from it. And I don't even speak of cost of life itself ( the value you output from your salary in France is way different in Paris, where you generally get 15% more in salary compared to the rest of the France, but renting a flat is twice as costly as pretty much anywhere else in the country, so in the end you get less value out of those 15% more... ).

In the latter case, I'm part of this 100k+ club, with a margin, as a JS contractor. In the former case, well, I'm not :)

You may be interested in [http://www.expatistan.com/cost-of- living/](http://www.expatistan.com/cost-of-living/) and [https://nomadlist.com](https://nomadlist.com) to compare things in a better manner over Europe

<comment><AUTHOR> Well, that's good. Can you share more about your skill-set and experience? I think a lot of JS Devs in Europe can benefit from it.

</comment></comment></comment></comment><comment><USER16> There is no one in Europe making €100K+ annually.

Just kidding... at least I don't know anyone personally. But maybe the Head of R&D of the company I work for could be close to that mark, at least he's driving a Porsche.

Yeah.. not useful I know, sorry.

<comment><USER17> > There is no one in Europe making €100K+ annually.

Are we talking Eurozone or Europe? I know programmers in Zurich making >= 130K Francs a year (which comes in at over €100K).

<comment><USER18> Or >= 300k CHF, but it's 1am in Zurich. Or similarly large amounts in GBP if you don't limit yourself to the continent.

I know at least one American unicorn will pay far more than €100k in cash to new graduates in London.

<comment><USER19> Even though I'm not a new graduate, I work in London so interested to know which unicorn this is.

I've not seen new graduates hit these sorts of numbers when I've been looking at the market. I'm sure there must be some, however I'd have assumed it was very rare. Still it's always useful to know what sort of competition might be out there when hiring, so genuinely interested in the details!

</comment></comment></comment></comment><comment><USER20> €100k is around £88k and I know of plenty of people in roles in the UK that pay this much, both in and out of the tech industry. The examples that spring to mind are not even in London but the Midlands and the North. Every hospital, University, Engineering Company and bank has many of these positions.

* Mid-level management in banking

* Leadership and CEO roles in colleges

* Financial Controllers and Directors

* Pharmaceutical Sales Managers

* Surgical Consultants

* Cyber Security Consultants

* Senior Pen Testers

I would be interested to see comparable salaries for these types of roles across the rest of Europe.

</comment><comment><USER21> Good contract developers (freelancers) in London earn around £450/£500 a day which is clear of 100k euro by quite a margin. Job depends on the client. Job could last 3 months, could last 3 years.

Unusual for a salaried permanent developer to earn that amount in London unless they were head of or near the top of a good dev team in a good firm.

This is all excluding finance jobs. Finance jobs its pretty easy to get to that salary in London.

<comment><USER6> Don't contracts get a bit iffy beyond 2 years? i.e. HMRC sniffing around querying your expenses and IR35? Or perhaps that's just contractor forum paranoia.

<comment><USER8> They do, yes. Many public sector companies (inc HMRC) are now forcing contractors to be paid by PAYE even.

Generally though, you're safe as long as you work at the same company for less than 24 months. Then you need to find a new contract or relocate (working at a different physical office or taking on multiple clients can get around IR35 (if you fall within IR35 you're considered to be a disguised employee, not an independent contractor, and must pay higher income tax).

<comment><USER6> It's funny really, we are supposed to have a Conservative government but you wouldn't know it what with crackdown on buy to let and contracting. Not that I'm looking to start an argument.

</comment></comment></comment></comment><comment><USER22> I know more than a few quants at banks in the City of London making well north of 100k. Finance is where the payscales jump well above the average.

</comment><comment><USER23> You asked when Europe was mostly at sleep. At least most of the ones doing that much.

In Berlin this is a quite high salary. However, I do know a few people who are doing 100+

It's mostly CEO, COO, CTOs at startups after their B rounds. It's also good B2B Sales people. But I also know developers who make this much.

Side note: This is huge in Berlin and as some mentioned before you already covered health care etc.

<comment><AUTHOR> Can you please elaborate more on the type of work these developers you are referring to are doing?

</comment></comment><comment><USER24> Assuming software development: it's not easy to make 6 figures outside of finance / fintech, in London or Switzerland, unless you contract / consult. You could get there working for an SV firm, more likely if based in London / Switzerland and competing for the same pool of talent.

<comment><AUTHOR> What is the entry level salary for a software developer in Fintech?

</comment></comment><comment><USER25> For those reaching conclusions from the lack of replies: most Europeans are asleep at the time of posting.

<comment><USER26> we're busy paying for welfare state

<comment><USER27> What a reasoned and discussion provoking comment

</comment></comment></comment><comment><USER28> 100K/year after or before income taxes ? I'm almost there, but BEFORE taxes. Data-mining & applied math researcher, working remotely from France for a US/Chinese biotech company. Job is nice, paperwork is ok, it's mostly automated.

<comment><AUTHOR> I have seen this pattern a lot, a Europe-based engineer working remotely for US-based company. How much would you be making for say a competitor of the same size in Europe? Let's assume identical work.

</comment></comment><comment><USER29> In London €100K is roughly the ballpark I'd expect a salaried senior engineer or data scientist to earn or more generally any VP level role at a mid-tier startup.

If you're contracting a mid-level engineer can normally command ~500/day.

</comment><comment><USER26> Do contractors count?

£400-£500 gross per day is not that big of "achievement" here in London.

</comment><comment><USER30> I agree with throwaway_ldn.

I work in the front office of an investment bank (strat) and earn 120k after 5 years base (pre bonus).

Admittedly it's the higher end of the scale vs. years experience but it's not uncommon.

</comment><comment><USER31> MD at my last company earned 99,995 (although gbp), so I doubt many people who read HN in a salaried career are earning more than 100k EUR.

Generally, Europeans don't have such high salaries.

<comment><USER32> Bit of an odd number, how come he didn't just go for 100,000?

<comment><USER31> Likely because he could claim that he "also has a 5 figure salary"

</comment></comment></comment><comment><USER33> Belgium, self-employed. Full-stack engineer. Doing consulting work for various companies & other personal projects. Job's pretty good, paperwork is hell.

<comment><USER34> Belgium also, "bijberoep" though. What dev languages are you using?

<comment><USER33> Python & JS :)

<comment><USER34> OpenERP/odoo? :P

<comment><USER33> Used to !

<comment><USER34> What now? Next Erp?

</comment></comment></comment></comment></comment></comment><comment><USER35> I guess it's not much of a thing in Europe, because here instances of places where real estate prices are as insane as in SV are pretty rare.

<comment><USER36> You have the causality wrong. House prices are high because wages are high, not the other way around.

</comment></comment><comment><USER37> Any freelance technical expert That is not bullshitting.

Paris/Mostly Paris/Various positions doing mostly linux stuff/Usually relaxed.

</comment><comment><USER38> I don't, but I probably could by doing x1,5 or x2 freelance work I do right now.

But I don't think it's worth my free time.

</comment><comment><USER39> Switzerland, php developer, chill job. I know google pays even more.

</comment><comment><USER40> My brother is a cardiologist, making +300K euros/y in France.

</comment><comment><USER41> _crickets chirp_</comment>


Mint adds support for tracking bitcoin wallets - <AUTHOR> http://venturebeat.com/2014/01/29/mint-integrates-with-coinbase-so-you-can-track-bitcoin-with-the-rest-of-your-finances/

<comment><USER2> The fact that media buzz and now apparently financial management aids treat bitcoin like a niche investment is definitely in the realm of Not good things for the emerging currency. Treat it like a foreign bank account if you want and show a dollar equivalent to measure net worth... but don't treat it like an investment all that can do is help bring its ultimate value back down near zero.</comment>


For anyone doing web work in something besides PHP/Python/Ruby, what do you use? - <AUTHOR>

EDIT: ...OR node.js. Forgot to add that to the title.<p>Also, if you're using it in combination with a framework of some sort, please post that as well. I'm just looking for another language to learn that could still be pragmatic for me, as a web developer. <comment><USER2> Programming Websites with Scheme could be very instructive: [http://docs.racket- lang.org/continue/index.html#(part._.Gett...](http://docs.racket- lang.org/continue/index.html#\(part._.Getting_.Started\))

For learning more about OO <http://seaside.st/> Smalltalk Web Framework

For job opportunities Java Web programming should be killer, especially if you want to work on big projects.</comment>


Scientists Taking Steps to Defend Work on Climate - <AUTHOR> http://www.nytimes.com/2010/03/03/science/earth/03climate.html?hp

<comment><USER2> Imagine an engineer who normally comes to work in jeans and a t-shirt. One day the boss says "I want you to present your product tomorrow. Here's the address." So the engineer cobbles together a demo, dresses up in his kakhis and a polo shirt, and shows up to present... at a nationally-televised, black- tie event. That's analagous to the situation in which climate scientists now find themselves.

For the most part, climate scientists are doing normal science, and thinking in terms of presenting their work to other scientists. But their work has become the centerpiece for huge global initiatives with large economic, environmental, and political impacts. This means their results, methods, and even personalities are being subject to an unusual degree of criticism (some valid, some not.)

Given the situation, it's absolutely vital for climate scientists to be as forthcoming as possible -- engaging critics, admitting mistakes, and opening up data (as in the article's subtitle.) It's absolutely vital for climate scientists to do a better job of explaining than they've done thus far, and to be very clear about what's known to what level of certainty based on what evidence.

(IMO, it's also absolutely vital for scientists, rather than politically polarized figures like Al Gore, to do the explaining.)

<comment><USER3> Excellently put! Especially the last sentence.

</comment></comment><comment><USER4> ""We have to do a better job of explaining that there is always more to learn, always uncertainties to be addressed," said John P. Holdren, an environmental scientist and the White House science adviser. "But we also need to remind people that the occasions where a large consensus is overturned by a scientific heretic are very, very rare.""

That is a... _curious_ word choice for the White House science adviser.

<comment><USER5> Could you explain what you mean? I don't understand your subtext.

<comment><USER3> I think he means the use of the word heretic.

Heretic: _anyone who does not conform to an established attitude, doctrine, or principle._

The word plays on lots of negative connotations (when actually there is no reason that it is bad to be a Heretic). Initially it seems a weird choice of word: basically "hey, if your not with us your against us. Oh and were going to burn you out". On the other hand I think it's one used in science history books quite a lot (still in a negative context though) so perhaps it is because the guy is a scientist and that's how non-conformists are considered.

Or then again maybe it is just a political choice of words attempting to undermine anyone that does pick at the data.

(as an aside the guy is wrong - some of the biggest scientific advances come from "heretics" making big and controversial discoveries)

</comment></comment></comment><comment><USER6> Is there a non-editorial reason that a new title had to be submitted for this article? The original title:

 _"Scientists Taking Steps to Defend Work on Climate"_

is more succinct, and carries a different connotation than the one invented by retro:

 _"Climate scientists beginning to admit mistakes and open up their data."_

</comment><comment><AUTHOR> In case anyone questions why the HN title is different from the NYT title, I adapted it from the subhead which reads as follows: _"Grudgingly, many climate scientists are beginning to engage critics, admit mistakes and open up their data."_

</comment><comment><USER7> Definitely a good thing if they start opening up more and start engaging with skeptics in debates instead of just appealing to authority.

But the true reason no one will believe their claims till it's too late is that they have no good solutions other than pushing us to the dark ages in terms of energy consumption.

IMO climate scientists should also start thinking about solutions to the climate problem (even if its not exactly their field). We could definitely use more people thinking about solutions rather than just describing the problem or its extent.

<comment><USER8> > But the true reason no one will believe their claims till it's too late is > that they have no good solutions other than pushing us to the dark ages in > terms of energy consumption.

That may be true of some environmentalists, but certainly not all. For instance, a much greater number now support building new nuclear plants, as a lesser evil when compared to oil and coal.

<comment><USER7> My opinion is that nuclear is a non-starter due to the weight of regulations surrounding it and its capital intensive nature. We need to see radical game- changers which cannot happen in such an environment.

The recent news on the Bloom boxes has me quite hopeful however.

<comment><USER9> The Bloom boxes are nothing more than more efficient natural gas powered generators. If anyone truly believed that anthropogenic CO2 will cause catastrophic climate change in the 21st century they would not be looking toward Bloom boxes as a meaningful solution to that problem.

<comment><USER10> Though, perhaps they may be looking toward Bloom boxes as an effective way to reduce carbon emissions. Cutting emissions per kW in half is nothing to shake a stick at.</comment></comment></comment></comment></comment>


React Hot Loader: Tweak React Components in Real Time - <AUTHOR> http://gaearon.github.io/react-hot-loader/ <comment><USER2> This stuff is the real deal. I've been using it for ~6 months now and can't imagine now building websites without it. For Coffeescript fans, I use this to start off all new apps — [https://github.com/KyleAMathews/coffee-react- quickstart](https://github.com/KyleAMathews/coffee-react-quickstart)

<comment><USER3> Thank you

</comment></comment><comment><AUTHOR> If you're wondering about the magic behind this, see an older more technical post: [http://gaearon.github.io/react-hot- loader/2014/07/23/integra...](http://gaearon.github.io/react-hot- loader/2014/07/23/integrating-jsx-live-reload-into-your-react-workflow/)

</comment><comment><USER4> David Nolen had this going for the ClojureScript community about 3 months ago [https://www.youtube.com/watch?v=gI3fJKmvgq4](https://www.youtube.com/watch?v=gI3fJKmvgq4)

<comment><USER5> Don't forget Figwheel, it has been around since April 2014

[https://www.youtube.com/watch?v=KZjFVdU8VLI](https://www.youtube.com/watch?v=KZjFVdU8VLI) [https://github.com/bhauman/lein-figwheel](https://github.com/bhauman/lein- figwheel)

<comment><USER4> I'm just talking about when the video was made/uploaded.

</comment></comment></comment><comment><USER6> Interesting - I've just started playing around with jspm and system.js as showcased in the "Javascript in 2015" video that did the rounds ([http://glenmaddern.com/articles/javascript- in-2015](http://glenmaddern.com/articles/javascript-in-2015)) and I'm wondering if there is a way to achieve something similar with that tooling? Can webpack be used alongside jspm and system.js or do I need to change the way files are required?

<comment><AUTHOR> Hi, I don't think it's possible with System.js. Nevertheless I decoupled internal implementation from Webpack so it can be used in future hot-reload- capable build systems:

[https://github.com/gaearon/react-hot-api](https://github.com/gaearon/react- hot-api)

If you find a way to make it work with System, let me know!

</comment></comment><comment><USER7> This is amazing stuff, thanks Dan! Hopefully it is the beginning of the end of refresh-driven-development.

If you are a web developer (front-end/back-end), and you haven't switched to React yet, take this for a spin, and read "Facebook just taught us all how to build websites" ([https://medium.com/@ericflo/facebook-just-taught-us-all- how-...](https://medium.com/@ericflo/facebook-just-taught-us-all-how-to-build- websites-51f1e7e996f2)), and watch 'React - Rethinking Best Practices' by Pete Hunt ([https://www.youtube.com/watch?v=DgVS- zXgMTk](https://www.youtube.com/watch?v=DgVS-zXgMTk)).

The distinction between the back-end and front-end is a product of the complexity introduced by the web with its 'worse is better' mix of badly integrated tools. It made building user interfaces a dark art with all its quirks:

\- a layouting system that had an active vendetta against humans

\- Javascript with all its deficiencies

\- Connascence introduced by Server <-> Client communication (Server Model <-> API View <-> JS Model <-> JS View)

\- declarative views that were ill-suited for web-apps (logic-less templates, what a lie!)

\- cross-browser incompatibilities

\- difficulty in implementing client-side routing

\- immature developer tooling

But worst of them all was DOM mutation and spaghetti code, which was in reality a fundamental deficiency of the development model itself, and not because web developers the world over were being deliberately irresponsible.

React is changing all that with the help of ES6. It simplifies web development both in concept and in practice. In a few years, building UIs would be just another part of writing software, and competent Full-Stack developers would cease to remain unicorns.

Here are a few things that React approaches differently that makes all the difference:

\- templates are a bad idea. views are constructed imperatively, not declared. (plug: [http://www.jasimabasheer.com/posts/on- react.html](http://www.jasimabasheer.com/posts/on-react.html))

\- the basic unit of a front-end system is a 'component'. A component knows how it is rendered (HTML), how it is styled (CSS), how it behaves (JS), and has explicit knowledge of the data it handles (states and props).

\- everything should be programmable: even HTML and CSS. ([https://speakerdeck.com/vjeux/react-css-in- js](https://speakerdeck.com/vjeux/react-css-in-js))

The React team seems to be looking at what makes web development actually hard and are thinking outside ill-advised conventional wisdom (like separation of concerns. whose concerns anyway?). For example, Relay ([https://gist.github.com/wincent/598fa75e22bdfa44cf47?](https://gist.github.com/wincent/598fa75e22bdfa44cf47?)), removes the need for writing custom API end-points for each of our components. A component already knows the data it needs, but today we leak that info across the component hierarchy and to the server, creating a lot of accidental complexity.

Another example is Webpack ([http://webpack.github.io/](http://webpack.github.io/)), which changes asset management on the web by making it completely programmable. All your static assets should have the same bundling conveniences that your JS has. Webpack also makes react-hot-loader possible with Hot Module Replacement.

React seems to have finally figured out the right direction to take the web to. Exciting times.

<comment><USER8> I like a lot of what I see with react except the lack of 2 way data binding. Mainly, I tend to have input data tables for forecasting, cost estimation, and so forth with a lot of data inter-dependencies and calculations. It seems going back to the method of handling data updates through onchange events in a manual fashion would be a colossal step backwards from say, knockoutjs.

<comment><AUTHOR> Nope. Lack of two-way binding is a blessing. It makes everything predictable.

>It seems going back to the method of handling data updates through onchange events in a manual fashion would be a colossal step backwards from say, knockoutjs.

It's not exactly "manual fashion" because React updates everything according to `state` for you. If you have many interdependent fields, make them update `state` correctly, and React will keep them in sync with it.

In fact I find it easier to make complex input logic with one-way bindings because the data always flows one way. It's a tad more code to write, but you see exactly where your updates are happening and what's causing them.

Two-way binding tends to get _very_ complicated as soon as you need more complex logic. One-way binding doesn't have this problem.

<comment><USER8> I'm not sold two-way binding tools get inherently complicated, I just haven't seen this increase in complexity in our current app which is quite large. But I am attracted to react for the reasons you mention, the virtual DOM aspect is very nice so I'll give this a shot.

Although even though ReactLink works it a.) feels like quite the hack (i.e. not very composable) and b.) is a more code to maintain still when it comes down to it.

</comment></comment></comment></comment><comment><USER9> There's been a great talk about the workflow that this enabled at React Conf that is now on YouTube: [https://www.youtube.com/watch?v=yaymfLj5tjA](https://www.youtube.com/watch?v=yaymfLj5tjA)

</comment><comment><USER10> Allow me to be the detractor to all the fanfare - what does this actually do? The demo site hints at what is going with it's tutorial but I don't see in plain english. It seems, if I follow the tutorial, that as I modify the includes in the editor the javascript assets are reloaded in real time to reflect the state of loaded javascript.

So, I guess I'm looking for a technical summary of what this does exactly because I don't understand the benefit.

<comment><USER11> The main benefit for a developer, as far as I can tell, is that the state of the app is maintained between reloads. So you can interact with it — e.g., type into an input, make selections in dropdowns — then change the code behind it and everything you did will still be there.

The site does say:

> React Hot Loader will keep it mounted, preserving the state.

but I agree that it could be more explicit about how it's useful.

<comment><USER12> Yes, not losing state is a big deal. This is possible because the UI is stateless while React is a view on that state. We built a similar system (for TouchDevelop) in a PLDI paper a few years back:

[http://research.microsoft.com/pubs/189242/pldi097-burckhardt...](http://research.microsoft.com/pubs/189242/pldi097-burckhardt.pdf)

From the paper, adding a navigability aspect between UI and executing code is something that is fairly straightfoward to do and very useful.

My current live programming work is over stateful code (meaning the code that is being live edited involves side effects). It is difficult to support that in existing programming models, however.

</comment></comment></comment><comment><USER13> That animated logo is so amazing! A+. Really well done. And just beautiful website in general.

<comment><AUTHOR> Props go to Josh Hillier ([https://twitter.com/_joshhillier/](https://twitter.com/_joshhillier/)) and his Pen ([http://codepen.io/joshy/details/cojbD](http://codepen.io/joshy/details/cojbD)). I later converted it to use React Tween State ([https://github.com/chenglou/react-tween- state](https://github.com/chenglou/react-tween-state)) for animation.

Gadzhi (you may know him as the designer behind Sublime Spacegray theme, [http://kkga.me/](http://kkga.me/)) helped polish the logo and added the outer animation. It's currently in CSS but I plan to to move it into the component as well.

Logo source code: [https://github.com/gaearon/react-hot-loader/blob/gh- pages/_i...](https://github.com/gaearon/react-hot-loader/blob/gh- pages/_includes/logo.html)

</comment></comment><comment><USER14> This is beautiful and important work. I appreciate the efforts of developers improving the collective productivity of other developers.

</comment><comment><USER15> That looks pretty cool. I will have to try it out. I have been meaning to check out webpack for awhile anyway.

</comment><comment><USER16> I've been using this for almost three months now and it's fantastic, hard to work without it.

<comment><AUTHOR> Thanks!

</comment></comment><comment><USER17> Is this different than how Meteor does reactive components?

<comment><AUTHOR> Hard to say without knowing how Meteor does them!</comment></comment>


Ask HN: Can you list the mobile phones that you have used in the past? - <AUTHOR> Can you remember all of them? Can you list them in chronological order?
My List:

  2007 - Sony Ericsson (forgot the model name)
  2008 - Motorola W230
  2010 - Nokia C5
  2010 - LG Optimus One P500 (Android 2.1)
  2012 - Sony Xperia S (Android 4.0)
  2014 - Huawei Honor U-19 (Android 4.4)
  2015 - Motorola G3 (Android 5.0)
  2017 - Motorola G5 Plus (Android 7.1)
 What is your list? <comment><USER2> HTC Dream

T-Mobile SideKick 4g

Samsung flip phone

Motorola G

Pixel 1

Pixel 2</comment>


This sleek console plays old Sega cartridges on your new TV - <AUTHOR> https://www.theverge.com/circuitbreaker/2018/10/16/17967790/analogue-mega-sg-sega-genesis-mega-drive-price-release-date <comment><USER2> $189 is extraordinarily pricey for a throwback console. I picked up a Genesis last week for $35, and purchased an EverDrive cartridge for $85, so I can play 8Gb worth of ROMs on real hardware.

For the price, why not get a composite to HDMI adapter and an authentic console?

<comment><USER3> This! Oldschool feelings is better but there is always the option of a raspberry too!

<comment><USER4> The emulation would be subpar as appose to using a FPGA which would run games flawlessly when done right and Kevtris does it right. You also get to use real hardware accessories and up-scaling that doesn't have to use the analog output of the original console.

P.S. Not all Mega Drives are made equally. Some have an inferior sound chip.</comment></comment></comment>


John Scalzi Story: "A Model Dog" - <AUTHOR> https://www.theverge.com/2019/1/21/18139239/john-scalzi-robot-dog-story-video-sci-fi-better-worlds <comment><USER2> John Scalzi? Count me in!

Note this part of the Better Worlds project: [https://www.theverge.com/better- worlds](https://www.theverge.com/better-worlds)</comment>


On vim vs emacs - b-man http://www.sanityinc.com/articles/vim-vs-emacs <comment><AUTHOR> I hear about the viper-mode and vimpulse stuff a lot, and while they go a long way towards helping emacs be more useful for text editing, I find the discontinuities disturbing.

For example, I am no longer in vi-mode if I end up in a help window of some sort. I cannot just Ctrl-W+Ctrl-W my way back to the original window; that suddenly deletes words. But I like working with multiple windows in vim sometimes. This gets frustrating for a vim user.

Also, macros are still not fixed, still using the emacs assumption of what people want for an enhanced vi. We want the easy qq and @q.

Definitely, if you are going to try it out, grab vimpulse. viper-mode is a joke to the developers coming from the vim world. vimpulse makes visual mode highlighting sensible.

<comment><USER2> viper is not for vim users, it's for Emacs users. As a long time Emacs user who doesn't really enjoy holding down the control key while editing text, viper is wonderful -- it gives Emacs a command mode, without making Emacs work like vi. If I wanted vi, I would just use vi.

That's the logic behind Viper, anyway. I believe a few people are working on a vim emulation layer for Emacs; giving Vim users the ability to have a proper scriptable environment, without having to give up anything they know from Vim. Ask on #emacs.

</comment></comment><comment><USER3> Heh, I've ended up doing the same thing. The issue is that Vim's key scheme has a much better economy of motion (faster with less movement) while Emacs is much more extensible and flexible. So this is the compromise instead of creating yet another text editor.

</comment><comment><USER4> I hear a lot about this vim vs emacs war. But I have never seen a battle, so to speak.

Where can I see videos of people actually _using_ this text editors? A side by side comparison of interesting/useful features?

I really would like to choose, but the most I managed to find was a guy playing snake on his emacs.

I'm currently using the very basics features of vim, but just because I felt like it and it came with a tutor file.

<comment><USER5> All the really matters is that you use what you like. If you like gedit or notepad++ that's just fine. FYI, emacs also comes with an extensive tutorial.

Personally, I used emacs and clones (mg and JASSPA MicroEmacs) for a long time- though I never really went very deep into the features. Then, I started a job where I'd be doing some sysadmin work on AIX boxes- nothing but vi and ed installed- so I figured I should sharpen my rusty vi/vim skills. I've found myself using more of the features available in VIM, as well as writing plugins myself. After you get past the initial weirdness (for folks coming from emacs and other modeless editors) I've found it easier. Less of a learning/feature curve, far fewer keystrokes, and almost no "Meta-Shift-Control-Z Ctrl-X abc" acrobatics. UI feels more modular in that I'm stringing together simple commands rather than using a command that does something specific.

Not advocating so much as trying to explain where I came from when I started using vim...

<comment><USER4> Thanks for the info.

The problem with the "use what you like" approach is that the emacs/vim learning curve are too steep. By the time I am actually _using_ one of them I'll have spent so much that the fear of change starts to strike and I'm stuck with that editor.

</comment></comment></comment><comment><USER6> Vim is cool because it's built in to every OS (except maybe Windows) and highly usable even without any configuration and requires very little resources.

For me knowing vim has proven a very productive skill. I often work on random new OS installations like virtual machines and cloud instances, and sometimes in very limited environments like embedded Linux devices. It works there just as well as in my regular Mac/Linux environments.

<comment><USER2> vi is the one built into every OS. Sometimes it happens to be vim, but not always... and other vi variants are quite different from vim.

<comment><USER7> Really? I thought nvi and elvis had fallen by the wayside, and now everyone shipped vim (in compatibility mode).

<comment><AUTHOR> I noticed recent distributions (last couple years) deploy a crippled form of vim, halfway between vi and vim. You still have to "sudo apt-get install vim" to get something that is nice.

<comment><USER7> You have to turn off compatibility mode

</comment></comment></comment></comment></comment><comment><USER8> I used to do the same thing, but I missed out on a lot of good emacs shortcuts. Today I use the dvorak version of Xah Lee's layout. You get vim- like navigation by holding Meta.

<http://xahlee.org/emacs/ergonomic_emacs_keybinding.html>

</comment><comment><USER9> Somewhat specious, since Emacs can be run inside Vim too.

This is a screenshot of Vim in Emacs in Vim: <http://i.imgur.com/fxlm4.jpg>

</comment><comment><USER10> I've tried using Emacs with Caps Lock as Control key, and it didn't worked well. So I changed Ctrl to (1)right-click-menu key (or whatever it's called) and to (2)right Alt; and turned Caps Lock into Alt. Now I can easily move around Emacs without hurting my pinky to much :). Long live Emacs!

</comment><comment><USER11> I like using vim in emacs, but it makes it too easy for me to fall back to my emacs muscle memory.

</comment><comment><USER12> BTW, vim is the perfect editor for tablets and similar devices with a shrunken keyboard.

</comment><comment><USER13> i like vim, that's it

</comment><comment><USER14> Seriously? Seriously? It's 2010, and we're still having this religious debate? Pick an editor that works for you. Learn it. Use it. Done. NB I'm a heretic, I use both vi and emacs.

<comment><USER15> If it's a religious debate, why is it surprising that people are still having it in 2010? Aren't _religious_ debates known for never getting resolved? Also, aside from the article's title, I don't see the religious debate in the article or the comments. I see people saying how they use vim and/or emacs, and providing tips.

I'd like to know how you're using both vi and emacs. I like both, and used both for a while. Please do tell.

<comment><USER16> I use emacs and vi at the same time, too. I usually have a two-pane emacs open that takes the whole screen and an 80x22 terminal in the back. When I need to navigate to some config file/log file etc. I use ls/pwd/pushd etc. and use vi from that terminal on whatever short edits I need. I use emacs for the code that I'm writing, the one that's under VCS and everything.</comment></comment></comment>


Show HN: Get Emails Notifications When Your Online Business's Reputation Changes - <AUTHOR> https://www.biz-eye.com

<comment><USER2> "Emails Notifications" should be: "Email Notifications"

<comment><AUTHOR> I changed that headline so many times, I've missed this. thanks for the heads up.

</comment></comment><comment><AUTHOR> Would you, fellow HNers, use a service like this? I searched the web, and could not find anything similar...

Thanks for all your answer/suggestions.</comment>


Andrew Cuomo and the Curious Case of the $81M Elevator - <AUTHOR> https://slate.com/business/2019/09/mta-elevators-are-the-perfect-example-of-new-yorks-cost-problems.html <comment><USER2> The process should be 100% transparent here. I'm curious why the budgeting, invoicing, cannot be looked at transparently to discover _what_ is going on here?

Can the contractors hired not be held accountable to their proposed budgets? 2-5x multiple seems about right as a fudge factor - but 10x?</comment>


Ask HN: This CNN video says US Intl traced DNC hack to Russian keyboard - <AUTHOR> https://www.youtube.com/watch?v=R_-GuADLoA8<p>at 0.49, it says US intelligence traced the hack back to a specific Russian keyboard. It makes no sense how can any one do that? You guys have any idea? <comment><USER2> The CIA uses special hardware to track keystrokes and installed it in many foreign computers. Essentially we hacked them and now cry foul that they hacked the DNC and discovered the fact that Clinton stole the primary. Pretty hypocritical.

</comment><comment><USER2> Yes by hacking into their computers fist which is pretty hypocritical</comment>


SEOMoz gives free 24 access to their competitive link tool - <AUTHOR> http://www.seomoz.org/labs/link-intersect

<comment><USER2> Can anyone explain this tool? I didn't realize looked at _who_ was linking to you outside of their page rank.</comment>


ByteDance plans TikTok IPO to win U.S. deal as deadline looms - <AUTHOR> https://www.reuters.com/article/us-usa-tiktok-china/bytedance-plans-tiktok-ipo-to-win-u-s-deal-as-deadline-looms-sources-idUSKBN2682NL <comment><USER2> Why hasn't twitter relaunched vine? The market is very different now from when they shut it down. I'm surprised that investors haven't demanded it yet.

<comment><USER3> Dom Hofmann, one of the cofounders of Vine launched Byte which is basically a new Vine: [https://en.wikipedia.org/wiki/Byte_(app)](https://en.wikipedia.org/wiki/Byte_\(app\)). I don't know if it's catching on though. I guess if TikTok does get banned we'll see a mass migration somewhere.

<comment><USER4> I don't keep up with the new social media - but I am wondering why TikTok succeeded where Vine failed?

<comment><USER5> I also think 30 seconds is just long enough to tell a meaningful story rather than Vine's 6 seconds which was only useful for short-form comedy.

<comment><USER6> And note it's 60 seconds, so even more so

</comment></comment></comment></comment></comment><comment><USER7> Its interesting how DonnyT ran his 2016 campaign on trade with China, and now by virtue of opening his mouth, more people than ever are aware of certain questionable actions taken by semi-nationalized Chinese companies. I'm not sure thats a bad thing, all things considered.

<comment><USER8> i think someone in his administration understand China better than all the previous. American have this belief that if you bring China into WTO. the open trade with China and free flow of commerce should transform China into a democracy. after 40 yrs, we see none of that. 8 yrs of Obama/Biden soft on anything China to the point of appeasement. (Chinese expansion on South China sea) Chinese CCP have only grow stronger and Xi have consolidated all powers into himself. Xi is more powerful than Mao.

what we are seeing from Trump admin is 1. seperate Chinese people from CCP. i think that hit hard to the point that Xi have to come out and said CCP is UN- separable from Chinese people. 2. trying out how to use National security to hit Chinese companies like what we are seeing right now and with Huawei.

it will be interesting to watch geopolitics in coming years if Trump win re- election. if Biden win, then it just back to Obama's era policies.

<comment><USER9> You make a very weak argument that Obama's administration was soft on China. Your only point is strategy in the South China Sea and unless you're privy to US Navy posturing and what our coordination with Japanese naval forces was at that time, you can't definitively say that it is any different now.

</comment></comment></comment><comment><USER10> Too many parties in this whole drama are too incentivized to spread FUD, or at least not debunk it, for anyone with only public information to really understand what's going on.

</comment><comment><USER11> Does anyone think this plan actually works for the US Government?

<comment><USER12> Depends on what you mean, there are a lot of ways to look at this.

If somehow they do get the apps banned from app stores... I suspect that would constitute a fairly large chunk of the US cut off from tiktok.

On the other hand if you look at it from the POTUS's POV where just saying your doing stuff means you can claim victory... he might feel he already won.

<comment><USER13> There is only one way to look at this, and that's what it is. It's the president and his administration searching for any route to re-election and thus abusing any power he has towards that goal. It could also be collusion in which Trump is trying to personally profit or have supporters profit.

The security angle is theater. Many American corporations gather and abuse much more data than any allegations against TikTok and WeChat. And if people are really worried about foreign monitoring, then there are millions of cameras and microphones embedded in baby monitors, pet feeders, home security cameras, and other smart devices, all foreign made and networked. Some claims of influence could be made in TikTok, but there's literally nothing stopping that from happening on platforms owned by U.S. companies, where it's been proven to have happened and is still currently happening. So that argument doesn't apply. If it does apply, it applies to a much broader app landscape than just TikTok and WeChat.

So in the end, everyone debating this thing as if it is an actual intelligent thing to be discussed is just adding legitimacy to Trump grasping for re- election and another one of his chaotic moves. There are actual problems but those are only plastered onto this whole deal by externals. The president literally tried to treat this thing as if it was an episode of The Apprentice, demanding payment from the sale. It's ludicrous.

This is exactly what Adam Curtis means by Hypernormalization.

<comment><USER14> How exactly does this move help him win reelection? I'm genuinely curious, I just don't see how this action would move anyone into a Trump vote who was previously not already planning to vote Trump.

<comment><USER13> No one said it is an intelligent move. Just because it is a move doesn't necessarily make it a good one. Trump is, hopefully, grasping for straws. He has tried to use the virus and now trade to tie into hate brooding in the country and use anti-Chinese sentiment to his advantage. Trump has specifically attacked Biden as being soft on China. It's all a ploy, just like his shenanigans on the U.S. treasury being sent a cut of the sale of TikTok. The fact that there are legitimate issues external but related to Trump's actions and proclamations does not legitimize them.

I think it's dangerous because people are underestimating just how hateful a lot of the U.S. is against foreigners and how whatever Trump is anti at the moment spreads like wildfire. Americans in general do not understand China or even how similar our government can be, and so it is easy to rally people against it.

</comment></comment></comment></comment></comment><comment><USER15> I'm so confused about what's going on now. First it was Microsoft, then it was a technology deal with Oracle, now it's Walmart? and Oracle taking a majority stake, spinning out the global operations? Oh and Trump thinks MS are still involved despite them saying their offer was rejected? Oh and the IPO is planned for long after the election so wouldn't? happen if Trump loses. Oh and meanwhile the likelihood of China letting themselves get bullied out of one of their biggest tech successes. How much of Google, Apple, and Facebook will have to spin off to Chinese corporations in return?

<comment><USER16> It's more complex and nuanced than this what you've stated of course, why it's so confusing. Arguably, aside from security risk of the CCP having access to the data, banning apps is an leverage against the CCP having economic access to Americans to help influence the CCP to stopping their human rights abuses.

If the CCP had allowed the United Nations to visit the prisons/concentration camps to interview prisoners (etc) then this could have all quickly gone away, assuming the CCP was being honest about what was happening at these concentration camps and the UN could confirm that on the ground.

<comment><USER17> > CCP having access to the data

Wow, CCP will be able to slide into 17 year olds' DMs. Massive security threat.

So much of the TikTok hysteria has been built on "CCP will have X". Is there any verifiable proof at all that CCP is actively and illegally accessing user data through TikTok?

<comment><USER18> The chinese being able to use data to influence 100 million American lives by determining what content is shown to people within a chinese app is a national security threat.

<comment><USER19> I'd argue it's already happening, too.

In March and April, all I saw were Trump's worst moments- his blunders, his viciousness, his arrogance. My distaste for Trump heightened; I became more reactive and further triggered by his incompetence. Then, back in early June, _every_ last thing I saw on TikTok was insane forms of rioting and the worst police brutality there was. TikTok effectively increases national attention to things like this.

The algorithm, of course, is reacting to my behavior- behavior which surely suggests that this is the type of content I " _want_ " to see. If I go searching for basketball videos, I can teach the algorithm to populate my feed with them quite easily. But I never used the search bar.

The danger of the echo-chamber, rabbit hole aspect of the algorithm _combined_ with TikTok potentially hand-selecting the types of content to push by default to American people to stir political dissension is very much there.

<comment><USER20> Yeah, I'm struggling to see the connection here... _All_ social media was absolutely inundated at those same times with those same events. Twitter was the worst by far. I had to uninstall the app after a while because it was just so full of negativity it was really starting to affect my mental health.

</comment></comment></comment></comment></comment></comment><comment><USER21> $50 billion market value, 25,000 employees? This is for a short video sharing app, right? I'm confused both by the apparent market value of the company and the number of employees proposed for the US operations. Seems orders of magnitude off for what the app does, even at the scale that it does.

<comment> abc-xyz The value TikTok brings to the CCP cannot be understated.

> ByteDance has had a party committee since 2017 and is headed by CCP > secretary and company editor-in-chief Zhang Fuping (張輔評), reported Human > Rights Watch. Members of the committee hold regular gatherings at which they > study speeches by Chinese Chairman Xi Jinping (習近平) and "pledge to follow > the party in technological innovation."

> In addition, ByteDance on April 25, 2019, signed a strategic cooperation > agreement with the Ministry of Public Security's Press and Publicity Bureau > (公安部新聞宣傳局) in Beijing. The agreement was billed as "aiming to give full play > to the professional technology and platform advantages of Toutiao and Tiktok > in big data analysis," strengthen the creation and production of "public > security new media works," boost "network influence and online discourse > power," and enhance "public security propaganda, guidance, influence, and > credibility," among other aspects.

[https://www.taiwannews.com.tw/en/news/3982027](https://www.taiwannews.com.tw/en/news/3982027)

<comment><USER22> CCP has increased oversight of more private companies this week as well

[https://www.asiatimesfinancial.com/ccp-announces-plan-to- tak...](https://www.asiatimesfinancial.com/ccp-announces-plan-to-take-control- of-chinas-private-sector)

</comment></comment></comment><comment><USER23> How does the IPO help?

<comment><USER24> Potentially distributes the pain to US shareholders.

</comment></comment><comment><USER25> I'm about as anti this administration as they come, but I'm not altogether opposed to some semblance of reciprocity in what China allows of US internet companies, and vice versa. I haven't followed this specific case closely enough to have an informed opinion of how it's being handled.

</comment><comment><USER26> I guess I am in the "crazy conspiracy-theorist" minority here but I see it as an actual security situation.

And I believe the reason they are talking about Microsoft and Oracle is because the intelligence agencies are suggesting that it would actually be a good outcome if they were able to effectively access that userbase. Whereas it is not tolerable otherwise.

Monitoring and controlling millions of people's information streams is a national security issue. And whether people want to believe it or not, all countries have propaganda programs.

What you see in your feed becomes your reality.

And just in case the above isn't enough to get buried, I will throw out an even crazier theory. TikTok is such mindless garbage it's reducing attention spans of kids even more. It may actually be making American children even stupider.

So, to sum up, I think WWIII started with Covid and TikTok is just part two.

Just kidding. Sort of. I hope.

<comment><USER27> You think it's dangerous to have access to social networks not under US control?

Many governments would, of course, agree, but this is traditionally the domain of governments seen as "authoritarian", such as, e.g., China. (Is it reasonable China does not let its citizens access Facebook?)</comment></comment>


Show HN: My saturday project. For when your co-founders can't 'Draw Something'.  - <AUTHOR> http://www.omghalp.com/

<comment><USER2> Funny, I wrote a script for my girlfriend a week ago too. I just grabbed my word list from /usr/share/dict/words though.

<https://gist.github.com/2069501>

<comment><USER2> Update: use the official word list from DrawSomething...

</comment></comment><comment><USER3> Real awesome tool, great job Steve.

On a side note though, anyone who seriously uses this tool to play 'Draw Something' is missing out on the concept of the game, which is to use your creativity to draw up something that users can then guess.

If you're using a tool to help you guess a word the correct word, then you're doing the "drawer" a disservice by basically saying to them that their drawing is good enough, when it really isn't... seeing as you couldn't guess what it was.

It's like funding a start up that you know is destined to fail and you keep telling them to keep on keeping on with the doomed idea; or in this case, their crappy drawings that you can't guess!

<comment><USER4> While I agree with you in spirit, I just want to point out that it's not always the drawer's fault that you don't recognize a pop culture reference ("katniss") or something a bit obscure ("golem").

Also, you might have too much riding on the game if you can use startup funding as an analogy!

</comment></comment><comment><USER5> It would be nice if you made the text "Draw Something" in the subtitle link to the app. I didn't know what Draw Something was, but clicked the link anyway, assuming I could figure it out by analogy to hangman and Pictionary by looking at your site's interface. I couldn't; I had to look it up.

Possible link destinations:

<http://omgpop.com/drawsomething>

[http://itunes.apple.com/us/app/draw-something- free/id4886282...](http://itunes.apple.com/us/app/draw-something- free/id488628250?mt=8)

<comment><AUTHOR> Thanks for the suggestion! Just deployed a new version that links to their page.

</comment></comment><comment><AUTHOR> This is just a quick project I threw together this Saturday. It simply finds all possible words that meet the criteria you specify and ranks them according to their English frequency.

<comment><USER6> I'm surprised that domain name was available :)

</comment></comment><comment><USER7> I tried the word 'parallelogram'. The web page keeps changing 13 letters to 12 letters in the number of letters box then saying it can't find a word.

I've never heard of 'draw something' as a game before so perhaps I'm using a word that isn't allowed or something.

Stuff like this is handy in teaching especially if it works on a mobile phone (blackberry for teenagers, iPhone for colleagues :-)

<comment><AUTHOR> Hey, thanks for the feedback. You can only specify 12 letters, so it doesn't make sense to search for a 13 letter word.

Re: teaching, I'll clean up the code a bit and put it up on github. There isn't anything too novel in there though.

</comment></comment><comment><USER8> Steve, "Scoutzie" is not a word! _ugh_ :) It's good to see you guys are still having fun!

<comment><AUTHOR> Haha, thanks Kirill :) Everyday you gotta have fun!

</comment></comment><comment><USER9> Is this is an acceptable convention in US: <http://omgpop.com/drawsomething> says that the app is available at .99 cents (Get it now: .99 cents)?

<comment><USER10> No, that's definitely wrong. It's a common error, though, and in a lot of cases people don't even notice (especially when it's clear that it doesn't sell for part of a cent).

</comment></comment><comment><USER11> I've actually been using this for awhile: <http://www.justin.my/draw- something-words/>

</comment><comment><USER12> Cool - where are you sourcing the candidate words?

<comment><AUTHOR> I used the frequency lists from Wikitionary for searching an ranking. They've got the 40,000 most frequent words.

<comment><USER13> The client downloads the current word list from this URL: <http://static.iminlikewithyou.com/drawsomething/wordlist.csv>

I've been meaning to see if I can run a proxy and substitute my own words.

EDIT: I personally use wordplay ([http://hsvmovies.com/static_subpages/personal_orig/wordplay/...](http://hsvmovies.com/static_subpages/personal_orig/wordplay/index.html)) with the -lx flags on this file when I'm stumped

<comment><USER12> Nice! Steve - can you use this word list instead? (<http://static.iminlikewithyou.com/drawsomething/wordlist.csv>)

<comment><AUTHOR> Yep, the site includes that word list now :)

</comment></comment></comment></comment></comment><comment><USER14> took the best methods from this comments here and put the in an ios app: CheatSomething! is free in the AppStore: [http://itunes.apple.com/WebObjects/MZStore.woa/wa/viewSoftwa...](http://itunes.apple.com/WebObjects/MZStore.woa/wa/viewSoftware?id=513666674&mt=8)

</comment><comment><USER15> you should consider allowing users to input all the letters into one single input box, might just a little bit less effort for the users =)

<comment><USER16> You can just keep typing while you're in the first text box :)

<comment><AUTHOR> I'm glad you noticed that! I added it as a convenience for myself when testing it... and wasn't sure if anyone else would discover it :)

<comment><USER16> Would be even nicer if the cursor also moved!

<comment><AUTHOR> Yeah, I played around with that. On the iPhone they disable allowing you to programmatically focus input fields in Safari (from what I could tell). So rather then spend time on a work around, since this was just a fun side project, I figured I'll ship it as is.

<comment><USER16> Fair enough! It's not up on github is it?

<comment><USER16> I'll keep an eye on it and see if I can send you a pull request :)

<comment><AUTHOR> Here it is: <https://github.com/stevekrenzel/omghalp>

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Why "co-founders"? Surely you mean co-players

<comment><AUTHOR> Heh, it was a jab at my co-founders.

</comment></comment><comment><USER18> nice.. so you put a limit on the number of letters, and shuffle the letters in all possible combinations searching your wictionary. Interesting.

<comment><AUTHOR> Thanks :) I also order the results based on frequency and I just pushed an update to the site that uses the official word list of "Draw Something".

</comment></comment><comment><USER19> 500 Server error.

That went well.

<comment><USER20> [http://www.omghalp.com/?length=6&char=b&char=a&c...](http://www.omghalp.com/?length=6&char=b&char=a&char=t&char=&char=&char=&char=&char=&char=&char=&char=&char=)

indeed

<comment><USER5> Yes, it turns out that the game gives you a selection of letters, like Scrabble, to fill in all the text fields shown. You get the 500 error if you leave the text fields blank. It would be nice if the site gave a JavaScript alert instead of submitting the form with invalid input.</comment></comment></comment>


Obama Order Sped Up Wave of Cyberattacks Against Iran - <AUTHOR> http://www.nytimes.com/2012/06/01/world/middleeast/obama-ordered-wave-of-cyberattacks-against-iran.html <comment><USER2> >The code itself is 50 times as big as the typical computer worm

All else aside, this is a clear pointer to government contractors.

<comment><USER3> How did they possibly know the code is 50 times that big. Is the code out in the open?

<comment><USER4> "Several layers of masking obscured the zero-day exploit inside, requiring work to reach it, and the malware was huge — 500k bytes, as opposed to the usual 10k to 15k." - [http://www.wired.com/threatlevel/2011/07/how-digital- detecti...](http://www.wired.com/threatlevel/2011/07/how-digital-detectives- deciphered-stuxnet/all/1)

This is a great read and very informative!

<comment><USER5> Yes it is, but your parent post was asking how they knew how large the _source code_ was. This quotation is reporting the size of the final binary.

<comment><USER6> Where did the article say 'source code'? Machine code is still 'code'.

You have to consider the audience the NY Times is targeting. Just _knowing_ what a compiler is puts one in relatively sparse company.

</comment></comment></comment></comment></comment><comment><USER7> _Mr. Obama, according to officials in the room, asked a series of questions, fearful that the code could do damage outside the plant. The answers came back in hedged terms. Mr. Biden fumed. "It's got to be the Israelis," he said. "They went too far."_

 _In fact, both the Israelis and the Americans had been aiming for a particular part of the centrifuge plant, a critical area whose loss, they had concluded, would set the Iranians back considerably. It is unclear who introduced the programming error._

I guess it's naive to think they might be using git and could resolve this with a simple `git blame`...

<comment><USER8> It's a little different when half the goal is to leave no trace of who wrote the software (and everything is obfuscated to hell).

<comment><USER9> But the obfuscation much be done immediately _before_ deployment. obfuscating while writing code does not make much sense.

<comment><USER8> I'd imagine two paranoid governments not being able to agree on a DVCS is not very far off. Everyone involved wants plausible deniability.

</comment></comment></comment></comment><comment><USER10> This is clearly an approved leak from the administration. The number of sources and specifics make it very easy to catch whoever leaked this information. If this wasn't approved, the leaker is going to be sitting next to bradly manning within a week, and there is no moral cause to leak this information, so it is safe to assume this was an approved leak.

The real question, is why did the administration leak the story, and why now? Is it politically motivated because Obama wants to seem tough on Iran in an election year? Is it to trick the Iranians into thinking the program is over? Maybe versions 2, 3, and 4 are already in place, and it will be demoralizing to Iran's program if they keep getting setback.

<comment><USER11> _The real question, is why did the administration leak the story, and why now?_

The latest round of multi-lateral talks on Iran's nuclear program just concluded a few days ago in Baghdad. I think they're trying to send the message to Iran that they will never be able to have a clandestine nuclear weapons program. The world is going to know about it. So if a nuclear power option is on the table for Iran this might give them a little extra motivation to accept all international regulations/inspections as a precondition. What are they actually going to be able to hide? Not much apparently.

The other goal here is to make Iran's position that they only want nuclear power, not nuclear weapons, even more difficult to accept. They are enduring sanctions and refusing to accept all of the regulations/inspections for what purpose exactly? They could have had nuclear power years ago if they were willing to accept these conditions. The longer they hide behind 'nuclear power only' the harder it is to believe. At some crucial point I have no doubt we'll be leaking detailed information about their weapons program. When that happens Iran will have to probably admit they _do_ want nuclear weapons and from there the war question pretty much resolves itself.

<comment><USER10> Great point. After reading the article, I completely forgot that Iran was still claiming that they didn't have a weapons program. This now proves that claim is complete nonsense and now that this is public, the US can show the UN security council and infinite amount of data that shows Iran has a weapons program.

</comment></comment></comment><comment><USER12> This shouldn't be a surprise to anyone. The set of { countries that are capable of creating something like Stuxnet and getting it into the plant } intersection with the set of { countries fearful of Iran } comes down to { US, Israel }.

You might add UK in there and UK might have assisted the US in the creation of Stuxnet if the US had asked.

<comment> excuse-me Although a Billion quid government IT project which was then abandoned 5years later without ever delivering anything would probably be noticed.

<comment><USER13> Or not. That's why they have national security and classified information. So they don't have to tell you were your tax is going.

</comment></comment></comment><comment><USER14> I'm very curious who gets hired to write the code for a project like this. What caliber are they, what kinds of backgrounds do they come from, and how are they recruited to these positions? Is this more likely to be done by a government agency or a defense contractor?

I have always assumed that the world's most talented hackers work in places like Silicon Valley and Wall Street, but Stuxnet was clearly the work of some brilliant minds, so I'm curious.

<comment><USER15> I think there are defense contractors that develop and weaponize exploits, rootkits, and so on for the government and while I'm sure some of that work was used in Stuxnet, I think anything specific to Stuxnet was handled by actual governmental agencies. The article names the NSA and an Israeli unit.

As for recruiting, you wouldn't ever get recruited directly to such a project - you'd already need a TS/SCI clearance and to have proven yourself within the NSA. As for recruiting into the general field of classified cybersecurity, it's not too much different from any other field; they post job ads, scour college campuses, probably advertise at defcon, etc. Generally if you're getting hired without a clearance it's not for a specific position - it takes upwards of half a year before you get cleared and can start, at which point they figure out which project to put you in.

As for the most talented hackers, keep in mind the subject area: Wall Street has very little demand for security researchers, and Silicon Valley's demand for them is minuscule compared to the government's.

<comment><USER16> For example this one seems fairly direct to me: [http://www.clearancejobs.com/jobs/1536410/cyber-software- eng...](http://www.clearancejobs.com/jobs/1536410/cyber-software-engineer-2)

<comment><USER17> Can someone explain to me how Google Earth is considered a 'security research' tool (as mentioned in 'Preferred Qualifications')?

I'm woefully clueless when it comes to this realm of software, so I'd love for some insight.

</comment></comment></comment></comment><comment><USER18> Holy shit. Stuxnet was just confirmed as being developed by the US and Israel.

<comment><USER19> This really makes you wonder at what point do you go from calling something "some digital nudging about between nations" to "war".

To me this seems to qualify as terrorism and sabotage on all accounts. I'm pretty sure I know how the US would react if _they_ had been on the receiving end of this sort of attack.

<comment><USER20> The difference is that the US doesn't threaten to wipe countries off the map. Iran is an evil theocracy and can't be trusted with nuclear weapons. Drawing moral equivalencies between the US and a totalitarian terrorist state is ridiculous. It's like comparing North Korea with Belgium.

<comment><USER21> >> _Iran is an evil theocracy and can't be trusted with nuclear weapons._

As per history, I believe the US is the only nation that cannot be trusted with nuclear weapons.

<comment><USER22> Yup. That _totally_ extrapolates infinitely. No reason to worry.

<comment><USER21> I find it does seriously put in question their self appointed authority to be the global nuclear police.

<comment><USER22> Using your own logic, they _have_ been 100% successful.

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> "It turns out there is always an idiot around who doesn't think much about the thumb drive in their hand."

Good quote. And there seems to always be a Windows PC around that auto-runs anything you stick into it.

<comment><USER24> The actual exploit stuxnet used to get onto Windows PCs didn't require the computer to have autorun turned on. The exploit runs on all newer versions of Windows (XP-7) and it triggers by _browsing_ the device's contents with Explorer. (Specifically, it exploits a method Explorer uses to show icons on .lnk (Windows' sym-links) files.)

[http://www.geek.com/articles/news/new-stuxnet-usb-exploit- th...](http://www.geek.com/articles/news/new-stuxnet-usb-exploit-threatens- windows-users-20100719/)

<comment><USER25> You're corroborating the grand-parent's point that Windows PCs autorun everything you stick into them. Granted, in this case it's not by design, but still...

<comment><USER24> That's kinda the point: blaming autorun will make people who are "smart" enough to switch off autorun feel secure.

But they aren't. There are vulnerabilities far more insidious than autorun.

</comment></comment></comment></comment><comment><USER26> Is this a purposeful leak to take credit for a national security win before the election? Seems like they kept it under wraps pretty well until now.

There was a TED talk by Ralph langer in which he was asked if he thought the Mossad was behind Stuxnet, as that was the common belief. His response was that it must be the only cyber superpower -- the US.

<comment><USER27> This is an excerpt from a soon-to-be-published book, so some of the quotes might be much older.

</comment></comment><comment><USER28> I'm a little disappointed by the lack of named sources and/or documents. Most assertions are anonymous paraphrases or quotes. That seems thin, and makes the book seem rushed and exploitative.

</comment><comment><USER4> What amazes me, and please excuse my naïvety, is that the congressmen are constantly pushing for more control online- whether that be monitoring skype, access to our facebook, or what have you. Basically taking our freedom in the name of 'Cyber Security', however on the other hand, they're the ones who are creating these viruses, exploiting systems and posing cyber threats.

What has the world come to?

</comment><comment><USER29> It appears they "acquired" Realtek's code signing certificate. Can Realtek bring action against the U.S. for stealing the certificate?

Edit: For stealing the private key, I mean.

</comment><comment><USER30> HB Gary was passed the source in 2010: [http://crowdleaks.org/hbgary-wanted- to-suppress-stuxnet-rese...](http://crowdleaks.org/hbgary-wanted-to-suppress- stuxnet-research/) Anonymous scooped the NYTimes.

<comment><USER30> To defend myself against the downvoters who may not have made the same connections: Aaron Barr talks to Defence Intelligence Agency and DoD about StuxNet in 2010, they had a copy given to them in 2009 that they claim was a US produced binary. Keep in mind stuxnet was 'discovered' in 2010.

First reference to Stuxnet being U.S. government produced?

They had a binary they believed was US produced. It was Stuxnet. It was 2009.

</comment></comment><comment><USER31> How ironic that one of the first major forays into cyber warfare be codenamed "Olympic Games".

</comment><comment><USER32> So now countries will fight cyber war, then what? cyber defense systems. So humans will never learn lessons, will they? How far is Skynet?

<comment><USER33> It's okay. We'll just add this line of code in: <http://xkcd.com/534/>

</comment></comment><comment><USER34> Meanwhile, the US continues to attempt to extradite Garry McKinnon from the UK - without a trace of irony.

<comment><USER35> This is like saying that because the US mistakenly invaded Iraq, it no longer has the moral authority to prosecute drive-by shootings. The syllogism holds on a message board but is useless in reality.

</comment></comment><comment><USER36> Are there any clues , how many people worked on stuxnet and flame.coding style methodology, how this project was managed etc. ? (Im still not convinced that this is from goverment)

<comment><USER37> Semantec has done several detailed analyses of Stuxnet. They are in no doubt this was an extremely well resourced project that was state financed.

<comment><USER36> Yeah I read that, but nobody seems to mention what coding and project management practices were used in development of this software.

If this software is really done by military then it's development process was following some strict military standards and regulation. and should be similar to existing other software.

Regulations like : How is software partitioned to modules? What interfaces it is using? Are this novel or existing techniques? and things like that.

<comment><USER9> The code was (obviously) obfuscated and encrypted in every way possible so that it's origin or any details about it's inception cannot be read if someone catches the code. To expect a readme file saying "managed by git on mac" in stuxnet's root directory is laughable.

</comment></comment></comment></comment><comment><USER38> Obama will do anything to avoid a conflict right now. If gasoline prices go up any more, his opposition will be running ads replaying the video of him saying he believes that gasoline should be in the $5-$7 range so alternative energy will become more adopted. (everyone knows this so it makes him very weak internationally)

So this should surprise no one. He used technology to get elected, and he will use technology to try and stop Iran without a physical military conflict.</comment>


Mir's hiring - <AUTHOR> https://community.ubuntu.com/t/mirs-hiring/1856 <comment><USER2> Uh, what? I thought they dumped Mir for Wayland when they switched back to Gnome.

<comment><USER3> This indicates they're making it a drop-in replacement.

[https://community.ubuntu.com/t/mir- architecture/467/4](https://community.ubuntu.com/t/mir-architecture/467/4)

<comment><USER4> From that link: Once Mir's support for Wayland clients is on a par with the support for "native" Mir clients we will likely phase out support for the latter.

Does that mean they want to phase out Mir once they have a full Wayland display server? I thought the whole point for them was to continue to support those that are already using Mir? This still doesn't make any sense to me.

I thought one of the original distinctions was that Mir was going to work with the old closed-source nVidia driver, while Wayland insisted on doing it the "right" way and made nVidia catch up instead of pandering to them. Other than that, I've never heard anything to justify Mir's existence. Why not just start with an existing Wayland server that supports all the features and move on? They'll reach the end goal faster.

I'm not trying to be negative, but if the end goal is to be a Wayland display server then why is it so hard to let Mir die? Is it just pride? Separation Anxiety? ;-) j.k. but really what is it?

<comment><USER5> What existing wayland server? Gnome and KDE has it's own, there was not a generic server when Mir announced support for Wayland and from what I know some people are working on creating a library that can be used for creating compositors, Mir is a solution for DEs like Mate because it would be easy to work on using Mir as a server so gaining wayland support then doing a compositor from scratch or using a library.

<comment><USER4> >> What existing wayland server?

I don't know what was around when Mir was started, but plenty exist today:

[https://en.wikipedia.org/wiki/List_of_display_servers](https://en.wikipedia.org/wiki/List_of_display_servers)

It was always obvious to me that Wayland was the future replacement for X for a long time. Why they had to take the ideas in Wayland and do something a bit different in Mir has always been a mystery to me.

<comment><USER2> There is no separate display server in Wayland. The window manager fulfils the roles that a display server would, using the libraries provided by the Wayland project.

</comment></comment></comment></comment></comment></comment><comment><USER6> Dunno if this is a good value propositon since the layoffs for the people that were working on Unity.

</comment><comment><USER7> Working on a space station. Sounds cool.

<comment><USER8> One that was certainly cool at the time, but has since burned up and was superseded by a collaborative effort. :p

</comment></comment><comment><USER9> ehhh..... Really

</comment><comment><USER10> If you want reinventing the wheel 24/7 - this job is for you!</comment>


GrabCAD will be joining the Stratasys family  - <AUTHOR> http://blog.grabcad.com/blog/2014/09/16/big-news/?utm_content=buffer11dab&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer

<comment><USER2> I don't like this. Stratasys basically controls the 3D printing world. first makerbot and its community and now this. They have both the maker/ hobby 3D printing world and the professional 3D printing and modeling markets under their control. I don't see anything good coming from this.</comment>


Toronto Hacker News Night - <AUTHOR>

A couple of days ago a posting hit the front page of HN for a Toronto Hacker News Night. After a bunch of voting on both the venue and the night we have a winner: Sin and Redemption - 2010-04-29.
Since there was such a huge response from Toronto, Waterloo, and, even, OTTAWA hackers I created a Toronto HN twitter account to organize around. That way we won't need to spam the HN front page every time we want to have a get-together. Follow @TorontoHN to keep up to date on things. Of course, if pg has a problem with me using any part of his branding, company name, whatever, I'll take the twitter account down immediately, but I don't think he will mind.
Thanks for the awesome response gals and guys, I can't wait for the 29th. <comment><USER2> Previous discussion: <http://news.ycombinator.com/item?id=1248222>

What time are we meeting at? In order to RSVP, we could use <http://guestlistapp.com>.

<comment><AUTHOR> Done!

<http://guestlistapp.com/events/19938>

Is the link. As for time, I set 6:30 because I'll need to eat once I get there, but I'm sure many people will show up at 7 or later.

<comment><USER3> Hrm - GuestListApp just sent the confirmation, saying "error in parsing this message..." :-|

<comment><USER4> Are you using a blackberry? We have been tracking this bug for a while now, and it appears to be a bug in the Blackberry email application from what we can tell. Newer Blackberries don't seem to give this message. It happens when the email client tries to convert the HTML email to text, instead of just using the text version of the email. Viewing the email with a different email client with solve this problem.

</comment></comment></comment></comment><comment><USER5> Awesome! I should be there. Coming from Waterloo so if anyone is up for a carpool I may be able to help. I'll be living in Toronto as of June so hope to meet some people as well, I won't have any friends as of June haha :)

<comment><USER6> I imagine we might be able to get a Waterloo HN meetup together.

Any interest?

<comment><USER5> There's not a Hacker News meetup in Waterloo but there is Dev house run by the guys from Postrank.com - It's the last monday of every month and it's basically full of chit chat and presentations of the like you'd find on hacker news .. I'm sure some of the members visit here too. Check it out: <http://devhouse.postrank.com/>

</comment></comment></comment><comment><USER3> Looking forward. Don't forget there's a StartupDrinks the night before at Elephant and Castle - if you don't mind hearing the latest about, er, Rails...

</comment><comment><USER7> Darn. I'll be in California on a business trip. If there's another next month, I think I'll come out to it.

</comment><comment><USER8> Signed up. See you guys there.</comment>


Show HN: Robots Round Robin - <AUTHOR> https://www.robotsroundrobin.com/ <comment><AUTHOR> [Resubmitting again to Show HN ... previously I linked to a blog post about the game, but this time I linked to the game directly, according the Show HN rules]

Here's the companion blog post:

[https://www.linkedin.com/pulse/we-made-game-robots-round- rob...](https://www.linkedin.com/pulse/we-made-game-robots-round-robin-jim- pick)

The Signl.fm crew is here to answer any questions!

<comment><USER2> Was any of the data going to be released under an open license?

<comment><AUTHOR> We're planning to do a follow up blog post with some analysis of the data -- comparing the interesting results.

We'd be happy to share the data with anybody that is interested. All in all, there's the sounds clips + the game data + the results data -- I think it all needs to be considered together in order to draw any good conclusions.

If you are a researcher or are just interested in what comes out of the game, we'd love to compare notes with you! (And I'm sure we can stick some sort of license onto the data if that's useful.)

<comment><USER2> I assumed you we using the data to train a NN. And was thinking it would be a good dataset for that.

<comment><AUTHOR> Potentially down the road at some point.

We're using commercially available speed-to-text platforms (Watson, Google, Microsoft, etc.), so we're just evaluating how well they are doing with this test. I think all of those are using NN's internally -- but since we're doing a cross-platform test, it's probably not useful for training the individual platforms.

With much larger traffic and fancier gameplay, I think this technique could be used to generate a higher volume of training data on a custom built speech-to- text system (eg. Kaldi)

</comment></comment></comment></comment></comment><comment><AUTHOR> Kelly, another dev here at Signl.fm, also wrote a blog post describing what we are doing with this over at Medium:

[https://medium.com/@TheMindWright/helping-robots-learn-to- sp...](https://medium.com/@TheMindWright/helping-robots-learn-to- speak-2a9e8401f072#.v84qv5egv)

</comment><comment><USER3> It's a simple game that combines our two loves: making voices more accessible via speech-to-text, and videogames :) (PS—I'm one of the devs)

</comment><comment><USER4> yeah.. You wish you could get to use my time for free, UH?

jk totally played the game lol

<comment><AUTHOR> Cool. Did you find anything about it interesting?</comment></comment>


Google Ceasing Development of Google Wave - <AUTHOR> http://techcrunch.com/2010/08/04/wave-goodbye-to-google-wave/

<comment><AUTHOR> This is depressing to me. The interface still left a lot to be desired, but I was using it very successfully at my startup to collaborate on documents and interact with coworkers.

It never experienced the explosive growth they were hoping for, but I figured it was a long term play. I guess new strategic priorities ("Kill Facebook") are getting in the way of ongoing development.

<comment><USER2> If they can get people via online casual gaming, which seems like their new strategy, they have _way_ more chance.

People were never going to suddenly start using wave en masse. It doesn't solve a problem that they couldn't solve other ways.

<comment><USER3> It solves the problem for remote teams of how to efficiently collaborate online. I don't know of any better solution for that problem, do you?

</comment></comment></comment><comment><USER4> You were the first to submit this, but the discussion seems to be at <http://news.ycombinator.com/item?id=1575892>

</comment><comment><USER5> The announcement is on the official Google blog: [http://googleblog.blogspot.com/2010/08/update-on-google- wave...](http://googleblog.blogspot.com/2010/08/update-on-google-wave.html)

</comment><comment><USER6> This is very sad. I thought it was a great product but suffered from lack of good marketing AND positioning (as in it wasn't good enough to do what Google wanted it to, and it was never marketed adequately to fill a niche). In particular: \- It isn't a good replacement for email because there is no integration with gmail or other established mail systems. \- It isn't good enough for creating documents (blogs, company documents) because there was no security (ability to make something read-only to certain people). \- It isn't good enough as a collaboration tool because after a few people edit a Wave, it looks so confusing - you lose all notion of it being a single consistent document because it looks too much like a complicated chat.

I also wonder if it was just too heavy in terms of Javascript and network processing.

Either way, this is a big shame - I was very much looking forward to Wave taking a greater part in my tech life.

</comment><comment><USER7> I wonder how long they've been planning it. The wave team was still promising API updates a few days ago (to fix some data api bugs with my wave client) <http://micro-wave.appspot.com>

It's especially odd as they just rewrote the wave API docs 3 days ago.

</comment><comment><USER8> Ok, in other words google are becoming less willing to develop cutting edge technologies and are going to spend more time on making money out of their traffic (e.g. purchase of ITA and listing hotel prices).

If you make money on the internet from a sector that goole are / might be in, be very afraid.</comment>


The world of bug bounty hunters - <AUTHOR> https://builtin.com/software-engineering-perspectives/bug-bounty-hunting <comment><USER2> You'd think companies would be willing to commit to fixing bugs if they're paying people to find them.</comment>


Some near-term arm64 hardening patches - <AUTHOR> https://lwn.net/SubscriberLink/804982/7955d88a2305bb84/ <comment><USER2> With BTI can the attacker not just write a BTI opcode to the start of the jump location? Usually you would jump to a buffer that you control the contents of (i.e. shellcode)

<comment><USER3> W^X prevents that straightforward attack, by not allowing writable buffers to be executed. The typical way to defeat W^X is ROP chains with gadgets consisting of pieces of code already present in the binary. BTI, in turn, is a defense against _that_.

It's very much a cat and mouse game.

<comment><USER4> So now we're going to see the next step be making gadgets out of code fragments that happen to begin with BTI.

The real end game here is memory safety.

<comment><USER5> There are ways to compile that elide ROP gadgets. It's easier on architectures like ARM than x86. OpenBSD has taken this approach:

       Number of ROP gadgets in 6.3-release arm64 kernel
         69935
       Number of ROP gadgets in 6.4-beta arm64 kernel
         46

[https://www.openbsd.org/papers/eurobsdcon2018-rop.pdf](https://www.openbsd.org/papers/eurobsdcon2018-rop.pdf)

Note: As described later in the presentation, those 46 remaining gadgets are in the boot code, which is erased after booting.

<comment><USER4> I'm not convinced that a conditional branch to the ret followed by breakpoints between it and the ret is enough to remove the usefulness of the gadget as much as they say.

<comment><USER6> Why?

<comment><USER4> It's exactly the kind of roadblock that people who do offensive security are great at finding loopholes around.

<comment><USER6> I mean, that's really been their job every time a new mitigation is developed…the introduction of NX led to the use of ROP, which has been joined by JOP techniques as efforts to remove return gadgets gain momentum.

<comment><USER4> This is more like fitting shellcode into something that can be strcpyed. Not really that much of a complication from an attack perspective.</comment></comment></comment></comment></comment></comment></comment></comment></comment>


An Illustrated History of American Money Design - <AUTHOR> http://gizmodo.com/an-illustrated-history-of-american-money-design-1743743361 <comment><USER2> I was impressed the author left a PGP key at the bottom of his post.</comment>


Kurt Vonnegut's rules for writing short stories - <AUTHOR> http://en.wikipedia.org/wiki/Kurt_Vonnegut#Writing <comment><USER2> "Give your readers as much information as possible as soon as possible. To hell with suspense. Readers should have such complete understanding of what is going on, where and why, that they could finish the story themselves, should cockroaches eat the last few pages."

After having read most of Vonnegut's books, I can say that this is a big hallmark of his work. Vonnegut has such a microscopic view of events and characters that doesn't exclude even the slightest and faintest of the details or idiosyncrasies. Its refreshing to have that view but sometimes too much - but more than that, it leads to a very special relationship between the author and reader - Its probably just me, but I think of Kurt as a member of my family or karass because of this.

<comment><USER3> I liked that in Cat's Cradle, which is the only book of his I read. It was interesting having the Ice-9 tracked throughout the story, even before we knew what it was or what it would do. At the same time, it was a little exhausting, and it made the narrative feel somehow shallow. While it was enjoyable reading, there was no point in the book where I actively felt a desire to know what would happen next. That's the problem with the lack of suspense, I guess.

<comment><USER2> If this the only one you have read, then try slaughterhouse 5 too.

<comment><USER4> I think Hocus Pocus is more similar to Cat's Cradle than Slaughterhouse 5 is. Both are great though.

</comment></comment></comment></comment><comment><USER5> Interesting to think how these rules would work applied to other formats, like pitching a startup, or giving a scientific talk. Their applicability indicates a possible truth: people want a narrative, everywhere, all the time.

<comment><USER6> yeah, and all the rules read to me as being aimed towards "have mercy with the reader", which applies to writing code as well :)

</comment></comment><comment><USER7> From, "Back to School," Rodney Dangerfield's rules for learning Kurt Vonnegut:

"Dad, why don't you join me on a little reality break, OK?"

"Just 'cause you're in love with Dr. Turner does not mean you're gonna pass her course."

"You got a major paper coming up on Kurt Vonnegut."

"You haven't even read any of the books."

"I tried."

"I don't understand a word of it."

"So, how you gonna write the paper, then?"

"Hi, I'm Kurt Vonnegut. I'm looking for Thornton Melon."

"Want to come in? Dad?"

<comment><USER8> from wikipedia: _Vonnegut played himself in a cameo in 1986's Back to School, in which he is hired by Rodney Dangerfield's Thornton Melon to write a paper on the topic of the novels of Kurt Vonnegut. Recognizing the work as not Melon's own, Professor Turner tells him, "Whoever did write this doesn't know the first thing about Kurt Vonnegut."_

</comment></comment><comment><USER9> The first four are good general advice. The fifth and sixth are good ideas some of the time, the seventh is a bit platitudinous but possibly good advice some of the time, and the eighth is more like "a guide to writing like Kurt Vonnegut".

</comment><comment><USER10> these are great

</comment><comment><USER11> I suspect the only one who ever could write like Kurt Vonnegut is in fact Rodney^B^B^B Kurt Vonnegut.

The whole deal is that it cant be reduced to a formula - unless you have a lisp script for it, in which case Id accept that as proof I am wrong.

<comment><USER11> Downmod?

You resent the understated attempt at humour, or perhaps the deliberate Strunk and White non-compliance?

I have read several of Vs books, each of them sublime, along with Stephen Kings 'On Writing'.. and I think my comments were on topic.

ok, I'll pay 17c via paypal to the first two persons who upvote this post, thus obliterating the downmod.

<comment><USER12> "Resist complaining about being downmodded. It never does any good, and it makes boring reading."

<http://ycombinator.com/newsguidelines.html>

that's the general rule, but i'm going to play along this time, because -1 does seem a bit harsh for what you wrote.

humor is risky. it's not that news.yc readers don't like it, it's just that our standards are very high. the ^H^H joke is a threadbare cliche at this point and should be avoided.

sometimes you get downmodded for no real reason by a karma troll. if that happens, you _really_ shouldn't complain about it, because within an hour or two somebody will vote you back up in sympathy.</comment></comment></comment>


Microsoft reveals source to Russian Secret Service - <AUTHOR> http://www.zdnet.co.uk/news/security/2010/07/08/microsoft-opens-source-code-to-russian-secret-service-40089481/ Could this be because of Russia's push for Linux and dismissal of black box software? <comment><AUTHOR> I think this is a very interesting move on Microsoft's part. It comes from Russia's dismissal of blackbox vendor software citing security and privacy fears. As well as Russia's push for it's own open Linux distro, ALT Linux. It seems that Microsoft wants to regain some traction within the Russian government.</comment>


How Much Money You Need To Recreate The Scrooge McDuck 'Gold Coin Swim' - <AUTHOR> http://thebillfold.com/2012/04/how-much-money-you-need-to-realistically-recreate-the-scrooge-mcduck-gold-coin-swim/

<comment><AUTHOR> C'mon, it's Friday. Whether the math is even close or not, isn't it amusing that someone even bothered to ask this question!

</comment><comment><USER2> Family guy already did the the calculations on this.

<http://www.youtube.com/watch?v=0fyE6N4JQt0>

</comment><comment> daniel-cussen Funny article. Shittiest Fermi calculation I ever saw, though.</comment>