Linux can now run on UEFI Windows 8 PCs - <AUTHOR> http://blogs.computerworld.com/linux-and-unix/21768/hurrah-linux-can-now-run-uefi-windows-8-pcs-itbwcw <comment><USER2> Well, I have to give props to Microsoft for helping out. I was pretty skeptical, but unless I'm being duped here it looks like they did a good thing.

Does anybody know the problem with the ARM technology? Or is it a licensing issue?

<comment><USER3> Microsoft is unwilling to provide the same for ARM. They want it to be much like iOS, under their full control.

<comment><USER4> ...and the FTC Consent Decree doesn't cover Windows RT, according to Microsoft's general counsel

</comment></comment></comment><comment><USER5> All I had to do was turn all the secure boot crap off in UEFI, delete all the Windows 8 partitions and then install regular Ubuntu.

<comment><USER6> the point isn't to get it to work without secure boot enabled, it's to have the benefits of secure boot as well as your own choice of OS. there's no reason to have to compromise on security now like you did.

<comment><USER7> Secure boot doesn't offer any practical security.

Most attacks are just social engineering, spyware and daemons for DDoS attacking. Basically all stuff that can be run from user space. There's no real advantage in writing rootkits in our current climate as it's significantly more complicated and not nearly as profitable.

The cynical side of me thinks secure booting was intentionally developed to lock users into their respective platforms and only later sold as a security mechanism to avoid a massive outcry (a la the "terrorism" excuses that Apple used to argue against jailbreaking).

<comment><USER8> Secure Boot, TPM, etc. are all good if the user wants them on. I'd like my laptop to be as tamper-resistant as possible. With a TPM, I know you can't just pop a USB key in or change my BIOS settings or otherwise intercept the boot process. (At least not easily; and I'm aware of TrueCrypt's (IMO misplaced) disdain for TPM.)

With Secure Boot, I have a higher level of confidence that even if I mess up while using my computer, software cannot have me unknowingly running something other than the OS.

It's not a magic cure-all, and there's potential use for evil. But being able to lock down a machine to the _configuration I want_ is a positive.

<comment><USER7> The problem is the temptation for evil is too attractive (as seen by Microsoft's policy on ARM).

After all, the Microsofts and Apples of this world don't become big without being at least a little cut-throat.

</comment></comment></comment></comment></comment><comment><USER9> I just installed Ubuntu 12.10 on a pre-loaded windows laptop and it works just fine with UEFI/Secure Boot enabled. I just could't boot from CD but a LiveUSB install worked just fine with UEFI/Secure Boot enabled.

<comment><USER10> Thats because Canonical paid the extortion fee for that privilege on your behalf.

</comment></comment><comment><USER11> hurrah Linux? New Distro?

<comment><USER12> It appears the "!" got stripped from the article; perhaps a moderator should simply remove the "Hurrah" :)

<comment><USER4> As the idiot who originally wrote that headline, I object to my creative wotchamacallits being corrupted in that way...

<comment><USER13> Ahh, when I read the headline I assume Hurrah Linux was the name of the Linux distribution.

<comment><USER14> Don't feel too bad, the title misled me for a few seconds too.

</comment></comment></comment></comment></comment><comment><USER15> Does Windows 8 not run on UEFI systems without Secure Boot enabled?

Or is this fix just due to pre-installed OEM Windows 8 configurations with Secure Boot enabled?

<comment><USER4> Sadly, some OEMs do not permit it to be disabled.

<comment><USER16> Which OEMs? Reference? Or are you regurgitating hearsay FUD from Reddit comments and SJVN?

<comment><USER17> I believe the Windows 8 certification _requires_ that the user be able to disable secure boot on x86.

<comment><USER18> Yes, but some OEMs may ship machines without Windows 8 certification, and Microsoft cannot do anything about them shipping with no way to turn Secure Boot off, an ironic consequence of the DoJ lawsuit against them.

Thus, the OEMs need to be named and shamed. However I am not holding my breath for richij (who also appears to be the article author) to name the OEMs.

<comment><USER19> And even with the OEMs who do get Win8 certification - do we trust Microsoft to enforce their own rule? If they omit the switch, or it doesn't work, will Microsoft withhold certification?

Maybe they will. But I'm glad Linux has strategies that don't rely on that.</comment></comment></comment></comment></comment></comment>


How to design a web page like this - <AUTHOR> https://stripe.com/about <comment><USER2> what determines bubble size? executive rank?

<comment><AUTHOR> Yes, I am interested to know not just the UI but the algorithms and data structure used behind the scene.</comment></comment>


NSA could put undetectable "trapdoors" in crypto keys - <AUTHOR> http://arstechnica.com/security/2016/10/how-the-nsa-could-put-undetectable-trapdoors-in-millions-of-crypto-keys/ <comment><USER2> Original research paper: [https://eprint.iacr.org/2016/961.pdf](https://eprint.iacr.org/2016/961.pdf)

It annoys the heck out of me when news sites bury the link to the source 2/3rd of the way through the article _(nearly_ as much as when they don't link to it at all!).

<comment><USER3> Interestingly the idea of these trapdoor primes goes back to 1992 (by Gordon, see section 4 "Heidi hides her polynomials" of the paper above.)

</comment></comment><comment><USER4> The way this headline reads, it sounds like NSA could, at any moment, flip a switch and __poof__ there's a backdoor in your crypto. I'd prefer to see some deeper explanation that gets us from "NSA" to "backdoor in your crypto."

Personally, I understand that NSA has made recommendations to NIST for decades. Those recommendations typically make it into standards. Those standards get implemented in software. I also understand there's lots of ~paranoia~ concern about anything NSA recommends and that oftentimes, software authors don't take their advice. (Sure, we don't know if the NSA recommendations are honestly excellent, or designed to facilitate backdooring; but not knowing whether the recommendations are trustworthy is part of the problem...)

<comment><USER5> They may put backdoor into future cryto systems, and they may have already put a backdoor into existing crypto systems. Just as possibly they may know a cryto system is weak and not tell anyone, or suggest an improvement to a proposed cyrpto system.

So, really unless you understand the advice you can't judge their suggestions.

</comment></comment><comment><USER6> "And, to this day, the DNSSEC specification for securing the Internet's domain name system limits keys to a maximum of 1,024 bits."

That is a factually incorrect statement. Currently the ZSK protecting the root zone is using a 2,048 bit RSA key. There are also many TLDs that are protected by 2,048 keys. There is absolutely nothing in DNSSEC that limits key length to 1,024 bits.

<comment><USER7> Also DNSSEC doesn't have to use RSA: [https://blog.cloudflare.com/a-deep-dive- into-dns-packet-size...](https://blog.cloudflare.com/a-deep-dive-into-dns- packet-sizes-why-smaller-packet-sizes-keep-the-internet-safe/)

<comment><USER8> No, it's true, you get the choice between RSA and terrifying NIST ECDSA on the terrifying NIST P- curves.

<comment> loup-vaillant There's still the 25519 curve, whose constants are highly constrained around reasonable criteria. DJB most probably haven't put any backdoor in _those_.

Plus, as far as big number arithmetic goes, it's relatively easy to implement.

<comment><USER8> 25519 is great. But you can't use it in DNSSEC.

<comment> loup-vaillant Oh, yeah, _standards_.

I believe someone here said you said one shouldn't rely on DNSSEC anyway?

<comment><USER8> We're on a subthread about DNSSEC, not about curves.

<comment> loup-vaillant Oops, sorry.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> This underscores the need for flexible security that doesn't rely on magic numbers. If an algorithm needs a number that can't be one of the obvious ones (0, 1, 2, 3, 2^x - 1, largest prime < 2^x) it should be generated.

<comment><USER10> I would assume that DH typically uses pre-baked primes instead of calculating them for a reason. One possible reason is that pre-baked primes can be designed to avoid certain pitfalls (e.g. primes close to powers of 2, which the article implies can be solved using the much faster algorithm) or otherwise to be resistant against certain cryptographic attacks. I don't know enough about DH to know if that's really the case here or if it's merely done to avoid having to compute fresh large primes, but I'm going to guess there's a good reason for it.

<comment><USER9> > One possible reason is that pre-baked primes can be designed to avoid > certain pitfalls (e.g. primes close to powers of 2, which the article > implies can be solved using the much faster algorithm) or otherwise to be > resistant against certain cryptographic attacks.

Why can't those primes be calculated on the fly? Checking a number for being within a certain distance of a power of two is well within the programming capability of a freshman CS student.

> I don't know enough about DH to know if that's really the case here or if > it's merely done to avoid having to compute fresh large primes, but I'm > going to guess there's a good reason for it.

Given the incentives involved, I see strong reason to believe this is not the case.

<comment><USER10> > _Why can 't those primes be calculated on the fly? Checking a number for > being within a certain distance of a power of two is well within the > programming capability of a freshman CS student._

You're assuming that that's the only criteria for a bad prime, but as this article points out, it's not.

> _Given the incentives involved, I see strong reason to believe this is not > the case._

Incentives where? The incentives by nearly everybody involved in making crypto is to be secure. The NSA wants to be able to break crypto, but the NSA didn't write the software that uses these primes (e.g. Apache).

</comment></comment></comment></comment><comment><USER11> So many discussion about what crypto to use when all of this relies on a broken CA system that everyone in power can abuse... This should be priority #1.

</comment><comment><USER8> The bottom line on this isn't that NSA can hide backdoors in crypto (we already knew that). It's that ensuring clean parameters for DH is comparably difficult to ensuring clean parameters for elliptic curve: you need "nothing up my sleeves" prime numbers for DH the same way you need "nothing up my sleeves" coefficients for curves.

What this really is, is one less reason to use conventional Diffie Hellman over Elliptic Curve Diffie Hellman.

<comment><USER12> It is one step worse than that: The evil prime numbers can be undetectable. That's what's new in the paper the article is based on.

<comment><USER8> That has long been the concern about elliptic curve parameters as well. (Presumably, we agree: ECDH > DH).

</comment></comment></comment><comment><USER13> Ahem, no. The NSA should spend their time protecting systems and strengthening encryption instead of this nonsense. Yes, yes, coding breaking is their mandate. I have a new mission.

<comment><USER12> That's correct in that we get what we pay for. Right now we are paying tens of billions for pervasive surveillance and tens of millions to enhance security.

</comment></comment><comment><USER14> This is why there have long been questions about NIST ECC constants:

[https://www.schneier.com/blog/archives/2013/09/the_nsa_is_br...](https://www.schneier.com/blog/archives/2013/09/the_nsa_is_brea.html#c1675929)

( [https://en.wikipedia.org/wiki/Bruce_Schneier](https://en.wikipedia.org/wiki/Bruce_Schneier) )

<comment><USER15> Remember how differential cryptanalysis was discovered by the academic community and subsequently the DES S-boxes pre-dating that discovery were found to specifically make DES resistant to that attack?

</comment></comment><comment><USER16> It would have been nice if the article spent a paragraph or two on what constituted a trapdoor prime. The only thing I saw was that trapdoors were close to a power of two.

All tease, no delivery.

</comment><comment><USER17> If you are extremely paranoid about security, you generate your own primes and do a lot of (super-computer style) computation to verify their strength. I have not read this whole paper yet but it seems like there is growing concern about widely used primes published by authorities without proving how they came up with the number.

<comment><USER15> The problem is that since the qualities of these special semi-primes that allow SNFS to work on them is not very well understood there is not an easy way to test if an attacker could use SNFS rather than GNFS. Additionally, running SNFS (or GNFS) on a semi-prime is not guaranteed to result in a factorization. Unlucky polynomial choice, for example, is one of the reasons such an attempt may fail. So, you could expend massive resources attempting to perform an SNFS factorization and not have a clear answer.

If you go into the Linux kernel (or other software) and look at the randomness testing and primality testing code, you can see that it is not extremely complex. Basic checks include things like making sure that a stream of data from /dev/random is not just a repetition of the pattern 1010101010101010... Prime candidates are typically checked with trail division routines. After making it through the basic checks, software will typically do something more advanced and computationally expensive. Usually, a Miller-Rabin test is run on the candidate number. That is usually all there is to it. Extensive verification of cryptographic primitives ("random" large primes, etc) is typically not feasible.

</comment></comment><comment><USER18> This is why you _must_ use Honey Encryption [https://en.wikipedia.org/wiki/Honey_Encryption](https://en.wikipedia.org/wiki/Honey_Encryption)</comment>


What the best Language to learn for stater? - <AUTHOR>

<comment><AUTHOR> Internet Startup co-founder asking. I have no coding experience (except for sql queries) what is a language I can start to learn so I can better understand my business/

<comment><USER2> Python

(edit: late, but I should add why in case you visit again. I find Python to be quite a good cross between the C/C++ based dialects and, say, the newer, and ref a pg article, languages "closer to lisp." Also the syntax reads pretty close to English, and is beautifully formatted. The documentation is plenty too. I'm pretty much all PHP, but I'd recommend Python :) )

<comment><USER3> I'll second the call to Python. There's a fairly large community around it, it has a lot of libraries to use in your code, the source is very easy to read both because of it's enforced formating rules and the clarity of the language itself, and on top of all that it's even useful.

My point against Ruby is that it has a lot of magic. Python explicitly tries to remove magic and make everything clear. Magic is nice once you grok it, but for learning I'd want things to be straight forward.

</comment></comment></comment><comment><AUTHOR> Thanks for your answers.</comment>


FreeRice: Hack a site to feed the world - <AUTHOR> http://giantrobotlasers.com/post/161352785/bmdesign-freerice-is-a-website-where-users-play <comment><USER2> "Donated rice comes from the advertisements from sponsors, therefore abuse of scripts will likely lead to catastrophe, as advertisers prefer that actual people view their advertisments. Knowing the existence of the bots, FreeRice updated their FAQ explaining the potential damage of botting"

<http://en.wikipedia.org/wiki/FreeRice>

<comment><USER3> Yeah, people thought that solving world problems were that easy? Really?

"It's easy, I'll just write a perl script solving world hunger!"

<comment><USER4> In the next version of Emacs we'll just do M-x solve-hunger and be done with it!

</comment></comment></comment><comment><USER5> You guys did look at the faq before voting this up, right?

<http://www.freerice.com/faq.html>

"Couldn't I just write a computer program to play all day and give a lot of rice that way?

There are two problems with this. First, it overloads our servers so that real people can't play and learn. Second, without real people playing and the resulting company sponsorship, no money would be generated and we could not give any rice at all."

<comment><USER6> You're forgetting that there are other reasons for looking at this besides supporting this idea or thinking it could work....

For instance, I upvoted it because it is still thought provoking. People trying to game a website to donate rice? They're obviously well intentioned. How does one deal with such users? What could their efforts be redirected towards?

</comment></comment><comment><USER7> Bots might work in the short run, but in the long run it just reduces the amount that advertisers are willing to pay. Dumb idea.

FreeRice is awesome though. If I'm killing time with a game online, it might as well be one that improves my French vocabulary or geography. Not to mention that it supports a good cause, even if my individual "donation" is small.

<comment><USER8> It's my only hope of _ever_ learning the countries in Africa.

</comment></comment><comment><USER9> Why does it take a game to feed people? Can't they just give it to them?

</comment><comment><USER10> Ridiculous how the 'rich world' is playing with lives, food and life...</comment>


Over 40 Years, Has Software Gotten Better or Worse? - <AUTHOR> http://joshondesign.com/2015/07/13/betterorworse <comment><USER2> Perhaps I misunderstand the point of the essay, but I find it difficult to juxtapose:

"A developer from 1975 could look at modern Javascript and feel pretty comfortable. Garbage collection, runtime typing, closures, and object inheritance all existed in some form 40 years ago."

with

"I argue that almost all of the improvements have come from four areas: test driven development, version control, continuous builds, and library ecosystems.

I don't think that many developers in 1975 would have been comfortable with garbage collection, etc.. Certainly there are some developers would would have had no problem with them, but think of the many COBOL and Fortran developers would would have had no idea of what those terms meant.

On the flip side, there are also people in 1975 who would have been familiar with version control "in some form". SCCS dates from 1972 and the 1975 paper shows it was used for several projects at AT&T.

There was also an IBM user's group, SHARE, which started in 1955. Quoting Wikipedia, "A major resource of SHARE from the beginning was the SHARE library". DECUS was a similar user group for DEC, founded in 1961. The same developer from 1975 who knew about GC, closures, etc. would certainly have known about library ecosystems. So would many of the COBOL and Fortran coders.

(Kent Beck famously says that he "rediscovered" TDD, [http://www.quora.com/Why-does-Kent-Beck-refer-to-the- redisco...](http://www.quora.com/Why-does-Kent-Beck-refer-to-the-rediscovery- of-test-driven-development) , but that is not an aspect of 1970s programming practices that I know about.)

My feeling is that the author's understanding is heavily biased by personal experiences. That's clear from phrases like "I think I first used CVS in the late 90s and never worked on an un-versioned project again.", which is 20 years after SCCS was shipped as part of AT&T Unix. Already by 1990 you see projects like Python begin under version control, as [https://hg.python.org/cpython/rev/3cd033e6b530](https://hg.python.org/cpython/rev/3cd033e6b530) , and Perl 1.0 at [http://history.perl.org/src/perl-1.0.tar.gz](http://history.perl.org/src/perl-1.0.tar.gz) was developed using RCS, based on

        perly.c:char rcsid[] = "$Header: perly.c,v 1.0 87/12/18 15:53:31 root Exp $";

and contains an imported package that used SCCS:

        malloc.c:static char sccsid[] = "@(#)malloc.c	4.3 (Berkeley) 9/16/83";

Gibson wrote "The future is already here — it's just not very evenly distributed"; it took about 20-30 years for the usefulness of version control systems to make it's way to the majority of programmers. I suspect the issue is that it's much easier to understand isolated technical details about programming languages from 30 years previous that it is to understand the more nebulous topic of what was considered best practices.

I also find this statement hard to understand: "I feel like Java really kicked off the trend of wide scale reusability with it's built in standard library". C has a standard library. Python has a standard library and is older than Java. (The expression was, "Python comes with batteries included".) What makes Java's standard library more special than, say, the standard library from Borland's Object Pascal/Delphi with all of its support for rapid application development? Or of the vast library ecosystem built around VB and COM?

Lastly, there's "The magic part is simply that open source licenses like Apache and MIT lower the friction to trying out a new library." Historically there were no copyrights to source code prior to 1980. Someone from 1975 would not have had to worry about these licenses because they weren't relevant.

<comment><USER3> > I don't think that many developers in 1975 would have been comfortable with > garbage collection, etc.. Certainly there are some developers would would > have had no problem with them, but think of the many COBOL and Fortran > developers would would have had no idea of what those terms meant.

I think it's a mistake to assume they wouldn't know what those terms meant, just as much as it's a mistake to assume modern C developers don't know what they mean, whether they have experience in languages that support them or not. Possibly more so. Part of a CS degree is exposure to concepts, usually embodies in languages that feature them. The fact that the job market was more constrained and there were only jobs available for developing in a small set of languages could account for why they weren't used much.

> I also find this statement hard to understand: "I feel like Java really > kicked off the trend of wide scale reusability with it's built in standard > library" ...

Python isn't suitable, or at least is arguable a poor choice, for some tasks. C had libraries, but the standard library is very small compared to what Java and Python include.

> Historically there were no copyrights to source code prior to 1980.

There also wasn't a good way to distribute, much less collaborate, on projects like we do today. I think both the licensing and the new methods of distribution and collaboration.

<comment><USER2> Neither you nor I nor the original author have hard numbers about who knew what, so all of this is conjectural. But I was addressing a different point, which was my difficulty in reconciling the author's position that "a developer from 1975 could ... feel pretty comfortable" with modern programming languages because the underlying techniques existed already "in some form", while also implying there would be no developers from 1975 who would feel comfortable with version control control and library ecosystems "in some form."

It's surely true that not all programmers now know about closures, just like it's unlikely that all programmers in the 1970s knew about them, so this isn't a universal claim. Nor did I think it was a universal. Rather, I think the author's point is that those with interest and experience in programming languages would have known the topics. That is undeniably true.

My response was to point out that those with interest in software engineering techniques would have known about version control systems and library ecosystems "in some form", because I can point to people who were SCCS, and people who were involved in library ecosystems.

"Python isn't suitable, or at least is arguable a poor choice, for some tasks."

That inarguable. Java isn't suitable for some tasks either. Nor is the statement that the C standard library is smaller than Java. But why is it that Java's standard library "really kicked off the trend of wide scale reusability"? What was the size magic threshold? Why did previous languages with a large set of standard libraries (I suggested Object Pascal, eg, from Turbo Pascal 5.5) _not_ kick off that trend?

"There also wasn't a good way to distribute"

Again, I don't think you are discussing the same point I am. The author wrote "The magic part is simply that open source licenses like Apache and MIT lower the friction to trying out a new library."

My point was that in the 1970s that magic part wasn't relevant. Instead, and I agree with you, the "magic part" for a 1970s developer is _instant network access_ , and not open source licenses.

I think licensing is much less magical... and even in the 1970s there was already ARPAnet, email, and UUCP, so again it's more a diffusion process than something "magical" or unknown in 1975.

</comment></comment></comment><comment> dao-shen We might ask, has humanity gotten better or worse? Given this impossible query, i will try to answer anyway. A caveat being i can only comment on direct observation of about 37 of those years.

The overall answer is software systems are solving multiple orders of magnitude more problems than 40 years ago. So much better from that perspective.

I suspect the questions behind the title question however are qualitative. Are we solving these problems in better ways? Is our code more maintainable? Easier to reason about? Faster to develop? Maybe. Probabably. Yes. Certainly not by the same orders of magnitude.

Frameworks and languages continue to pile on Rube Goldberg-esque construct upon construct. Long-lived systems must ultimately be scrapped or the businesses relying upon such antiquated systems replaced. The very few notable exceptions applying engineering effort to eliminate cruft are often overlooked in favor of whichever latest marketing spiel shouts the loudest.

Ah, so we are talking about humanity after all aren't we? :)

<comment><AUTHOR> We are indeed talking about humanity. Apparently the human condition also includes taking the easy way out at the cost of long term pain.

I was inspired to write this post after reading about people trying to design better programming languages. I realized that PL design hasn't fixed our problems in the past, and it probably won't fix it in the future. We muddle through by improving our tools and processes.

</comment></comment><comment><USER4> I'd like to see more emphasis in improving tooling and less in creating new languages too.

I feel like the battery of concepts from different languages is "good enough" for concisely and elegantly expressing software solutions (if you mix and match them), but annoys me that programming language authors seem to leave the implementation of debuggers, language analysis tools, and editors support to the final stages of the project.

E.g. in a lot of languages, getting and working AST of it is no easy matter and many times relies on user supplied libraries. Same for repls/debuggers.</comment>


Research for Practice: Expert-curated guides to the best of CS research - <AUTHOR> http://queue.acm.org/detail.cfm?id=2949831 <comment><USER2> I love this idea! I'm just a working programmer, but right now I'm trying to read through the highlights on research into temporal databases. People have been writing papers for 25-30 years, but it seems like not a lot has made its way into everyday practice or commercial products. Something was almost added to the SQL standard around 1997-2000, but was eventually rejected. SQL:2011 added something but it is pretty incomplete. I have been thinking I should put together a bibliography and a talk: temporal databases for web developers. A list curated by an expert would have saved me a lot of time!

I'm also (less professionally) interested in the overlap between the results from Turing and Godel. I would love a guide and/or annotations for Turing's "On Computable Numbers", because it is not easy going. Also a list of papers for quantum computing....

<comment><USER3> Such a thing exists. It's called "The Annotated Turing" by Charles Petzold (of "Programming Windows" fame). It's very good, although the machinery of setting up the Turing machine can be tedious.

<comment><USER2> Wow, purchased, thank you!

 _Code_ starts out tedious too but is worth it by the end. I guess for any technical subject you have to make sure you cover sufficient preliminaries to get all your readers up to speed.

</comment></comment></comment><comment><USER4> Adrian Colyer does something similar with his blog which I highly recommend:

[https://blog.acolyer.org/](https://blog.acolyer.org/)

Every weekday he posts a digestible summary of an influential paper, typically with a link to the paper itself.

<comment><USER5> +1 for this; Colyer's blog has been incredibly eye-opening.

Just reading the summaries is pretty interesting, but having a curated set of papers to dig into as time permits is fantastic as well.

</comment></comment><comment><USER6> This is a good idea, but how were those experts and "best papers" chosen? It's a well known fact that for each research domain, there are a few 'competing' labs. How can we be sure the experts aren't biased and decide to promote their papers to increase their visibility?

What would be cool is some sort of Hackernews style ranking per research domain, with voting ring detection, the only voters would be "recognized experts" (from academia or industry) with enough karma in their respective domain.

<comment><USER7> We already have that, it's called citations...

<comment><USER8> Citations give a ranking of how often work is mentioned, but not how valuable the work is. For example " Ileal-lymphoid-nodular hyperplasia, non-specific colitis, and pervasive developmental disorder in children" , otherwise known as "Vaccines Cause Autism" has (according to google scholar) over 2000 citations, but is known to be wrong and based on bad science.</comment></comment></comment>


Bootstrapping a startup - <AUTHOR>

These days I hear a lot about starting your own company after you graduate. It doesn't use to be same 2-3 yrs back.
I too like the idea of having my own business but I don't believe in approaching VCs for money and giving away share of your company. But I would definitely like to give share for being a Mentor.
Just want to know experience of HN readers who have bootstrapped their company. <comment><USER2> I am just at the beginning of a bootstrapped company, and I just graduated too.

First: Get ready to eat a lot of ramen noodles, unless you have rich parents or something.

Second: Try to start making cash as quickly as possible. You'll need it!

Third: Praying. Lots and lots of praying...

</comment><comment><USER3> There are a lot of bootstrappers on the Lean Startup Circle discussion group (<http://groups.google.com/group/lean-startup-circle/topics>).

</comment><comment><USER4> I have not done so but check out 37signals.com. They are bootstrapped and talk about it in their blog and books. Great work.

<comment><AUTHOR> Thanks :)

I read about Threadless. Though not a technology company, I was impressed but their story.</comment></comment>


Confirmed Coronavirus Cases Are Growing Faster in the US Than Any Other Country - <AUTHOR> https://www.forbes.com/sites/trevornace/2020/03/20/coronavirus-is-growing-faster-in-the-united-states-than-any-other-country-in-the-world/#4eb806657e72 <comment><USER2> Not really surprising at all. There are most likely a higher percentage of asymptomatic individuals in the US than is expected. From the article: "In the past week, the number of tests conducted in the United States has increased, however, the data for the past couple days has not been compiled yet. This could skew the numbers to look like coronavirus is growing faster, yet we are simply testing more."

and since we didn't self quarantine and cancel public events sooner we will see a wider distribution than would have occurred with social distancing.

"Health officials in New York, California and other hard-hit parts of the country are restricting coronavirus testing to health care workers and people who are hospitalized, saying the battle to contain the virus is lost[...]" [1]

[1]: [https://www.washingtonpost.com/health/2020/03/21/coronavirus...](https://www.washingtonpost.com/health/2020/03/21/coronavirus- testing-strategyshift/)

</comment><comment><USER3> The article implies that the percentage increase in cases is highest in the US but that's not actually the case (the list of percentage rates at the bottom includes several other countries with higher rates). The US seems to have added the largest absolute number of cases but that's not a particularly meaningful measure given how widely countries vary in population.

</comment><comment><USER4> This is actually good news because we are finally doing more testing after weeks of delay. If we can continue to ramp testing faster than the virus is spreading, we may actually come out of this okay in a month provided everyone minimizes their physical contacts.</comment>


For the Big Problems, Bring Fuzzies and Techies Together - <AUTHOR> http://blogs.cfr.org/cyber/2017/03/27/hacking-defense-and-diplomacy-in-silicon-valley/ <comment><USER2> Interesting. Are there plans to make any of this available online, e.g., Coursera?

<comment><USER3> It'd be super valuable to see case studies of mixed teams avoiding a common problem in which Techies have the upper hand because they are the mediators of whatever system is actually getting built.

Techies have something of an ultimate veto ("it wouldn't make sense to build it that way") that can really impact everything from brainstorming to product design.</comment></comment>


Hacker Panel updated (bookmarklet to pull up HN discussion on any web page) - <AUTHOR>

Hacker Panel was previously broken due to using an outdated HN API, but now it's fixed and works excellently. It lets you pull up a panel containing the full Hacker News thread for any web page with the click of a button.<p>Check it out and get the latest version here: http://chetan51.github.com/panels/hacker/ <comment><AUTHOR> Clickable: <http://chetan51.github.com/panels/hacker/></comment>


NewLisp - <AUTHOR> http://www.newlisp.org/ <comment><USER2> Better spend your time learning Clojure, Racket, Scheme or Common Lisp. NewLisp repeats the design mistakes of ancient Lisps that were fixed in the newer Lisps, like dynamic scoping and interpreting only instead of compiling which makes it much slower than other Lisps. NewLisp should be called OldLisp. It also adds some mistakes of its own, like deep copying everything when you pass it around. And making `cons` act like `list` when the second argument is not a list.

<comment><USER3> While it is true that NewLisp isn't going to win any awards from either the Avant /or/ the Vieille Garde, I would argue that just because its philosophy is different from what you believe is most performant doesn't make it a bad language. Ruby's defenders should back me up on that...

As I understand it, scoping is handled by "contexts", which can be inconvenient if you expect every function to be a single standalone snowflake, but just fine if you`re tossing off quick scripts which don`t require hermetic degrees of encapsulation. You can also force scope by using 'let' or declaring private variables as arguments, among other things. Certainly Emacs Lisp seems to do OK with similar constraints.

As mentioned elsewhere in this post, the deep copy thing may not be as bad as you make it out to be -- certainly it's never particularly troubled me.

As for cons... It seems to me that cons is a rather obsolete construct, referring to a long obsolesced hardware feature. I can't get too unhappy about someone trying to make it more immediately useful in a modern context.

We've talked about what you don't like about it -- here's what I think NewLisp has gotten very much right:

      * It's simple to use.
      * It's small and self contained.
      * It has a REPL and you can do introspection.
      * It has conveniently and reasonably named built-in functions.
      * It deals well with a UNIX-derived file system.
      * It's easy to pick up and start using, but you can still do fancy stuff.
      * The documentation contains worked out examples for every built in function.
      * The main developer is very responsive and helpful.
      * Trivially cross-platform with downloads, not compiles.

I have found NewLisp to be very convenient for many of the problems I have applied it to. I have used it for everything from dynamic web pages to image processing to ad-hoc render farms. So, I certainly feel that it may be invaluable for someone who is interested in Lisp, but has been intimidated or discouraged by the "official" compilers and needs to get some real world work done.

<comment><USER4> Let me respond to your points individually:

>It's simple to use.

There are many Lisps that are simple and easy to use. Scheme, for one, is extraordinary simple and easy to use. Indeed, many colleges use it for their introduction to programming classes.

>It's small and self contained.

This could apply to any Lisp, but again is especially true of Scheme. Scheme is a very small language; the entire language can be built from 7 special forms. How much smaller can a language get? Even all the special forms required to build a "practical" Lisp like Clojure can be counted on two hands. Lisp, in general is a very elegant and self contained language. NewLisp's elegance and cohesion does not break new ground.

>It has a REPL and you can do introspection.

Every Lisp extant today has these two features. Indeed, introspection is inherent to all Lisps; when code is data and data is code, introspection becomes trivial.

>It has conveniently and reasonably named built-in functions.

>It deals well with a UNIX-derived file system.

Most Lisps have fairly nice pre-built functions for accessing files. Moreover, I don't want my programming language to become especially tied to a single platform, by making file-system assumptions that may not hold true on other systems.

>It's easy to pick up and start using, but you can still do fancy stuff.

Well, it is Lisp. The inherent abstraction of the language will mean that Lisp won't ever be as "beginner-friendly" as, say, Python or Ruby. That said, Scheme (especially Racket) does an incredibly good job of allowing total novices to build programs in a very short time. As far "fancy stuff" goes, I wrote a minimax chess engine with an interactive graphical front-end for a school project. I don't know if that's fancy enough, but it certainly seemed pretty cool at the time.

>The documentation contains worked out examples for every built in function.

Again. see Racket.

>The main developer is very responsive and helpful.

Well, here I must concede a point. I have no idea how responsive the developers of Racket are, for I never had cause to contact them.

>Trivially cross-platform with downloads, not compiles.

First, this is true of every JIT compiled and interpreted language. Second, its not as trivial as you're making it out to be. The user has to have the interpreter installed, unless the interpreter, libraries and script are all packaged together as a frozen binary of some sort.

<comment><USER5> > >The main developer is very responsive and helpful.

> Well, here I must concede a point. I have no idea how responsive the > developers of Racket are, for I never had cause to contact them.

They are very responsive and helpful and the mailing list is active.

</comment></comment></comment></comment><comment><USER6> _It is especially well-suited for applications in AI..._

<Groan>. I wish people would stop putting "lisp" and "AI" in the same sentence. How many decades did lisp languish because people thought there was no reason to learn it if they weren't doing AI?

<comment><USER7> And from the other side, how many decades was AI approached from an ineffective direction because it was assumed that Lisp was good at it?

<comment><USER8> Your thesis here is that Lisp itself was a limiting factor in AI research? What alternate language/direction would have resulted in substantially more progress?

<comment><USER9> I'm not Miky, but I interpreted his statement to be that doing AI is a whole heck of a lot more complicated than just using an introspective, code-as-data, data-as-code language.

LISP is a hammer in an AI researcher's toolbox. Human-level AI is a monumental skyscraper undertaking. For sure, any construction team would be hard-pressed to build the Empire State Building without the proper tools, but there's a lot more to it than that.

</comment></comment></comment></comment><comment><USER10> Can someone explain NewLisp's memory management model to me? The description here: <http://www.newlisp.org/MemoryManagement.html> makes it sound like NewLisp essentially uses something like an std::auto_ptr from C++ for all its references, but I'm not sure how its possible to write a Lisp where you only ever have one reference to things.

<comment><USER11> It looks like everything is passed by value, so instead of passing a reference to that int, string, list, array, etc, you are always passing a copy. Once you hit an evaluation contact above where the copy cane from, it can be deleted.

I would imagine for some particular set of data (many large arrays and such) that this could get really slow, but their claim is, at least in the general case, it is faster to copy everything.

<comment><USER12> They also provide mechanisms to pass by reference. Default pass-by-copy with specially enabled pass-by-reference is indeed the opposite from most other languages do. I wonder how this interacts with things like memory paging and CPU cache.

<comment><USER13> Default pass-by-copy with specially enabled pass-by-reference isn't _that_ uncommon; it's how C++ works, for example.

</comment></comment></comment></comment><comment><USER14> When I read any well written Lisp code I feel my awareness of the subject gets cleaner, sharper and lighter. I never experienced a similar thing with other languages. I am not belittling them, or criticising. It is just a deep personal feeling, that has been lasting since university times, back in the 90s.

I liked the code that I have seen at newlisp.org, newlisper.wordpress.com (for example) and I am eager to see what I can do with it.

After reading so many pages (including this one), on so many sites, I have decided that I will learn newlisp too.</comment>


Accidents at Amazon: workers left to suffer after warehouse injuries - <AUTHOR> https://www.theguardian.com/technology/2018/jul/30/accidents-at-amazon-workers-left-to-suffer-after-warehouse-injuries <comment><USER2> I guess I'M going to strike out amazon and order my stuff from ebay or local online shops then.

This isn't the first story I hear in this direction and since there is a Amazon Warehouse in the nearby city, I get a lot of bad news from that place too.

</comment><comment><USER3> Is it really worth saving a few cents on Amazon while such stories keep popping up?

I for one stopped using Amazon and its services (including the recent ones such as Audible and WholeFoods) entirely five years ago. I buy books from a local used bookstore or Barnes&Noble. For ebooks and audiobooks, I use Kobo. For everything else I shop locally.

</comment><comment><USER4> This is a seriously click-baity title. It makes you think Amazon ignored them lying there in a corner.

In actuality this is a dispute over payments and workers comp.</comment>


Tumblesocks, an Emacs tumblr client - <AUTHOR> https://github.com/gcr/tumblesocks

<comment><AUTHOR> Hey guys! Here's my weekend project, an emacs client for Tumblr.

You need Emacs 24. If you have Marmalade, it's just M-x package-install tumblesocks.

It's "fairly" feature-complete; you can view your dashboard posts (as well as posts from arbitrary blogs), compose posts, and edit/delete your posts.

Images are displayed inline -- tumblr does tend to be pretty image-heavy, so it sometimes slows down a bit.

<comment><USER2> This is cute. If I wasn't a vim person I'd consider using it.</comment></comment>


Dropbox surprise – deleted files magically reappear after several years - <AUTHOR> https://badcyber.com/dropbox-surprise-deleted-files-magically-reappear-after-several-years/ <comment><USER2> Lmao at the Dropbox damage control. I wish the cloud meme weren't pushed so hard, but it's becoming more and more of the norm.

<comment><USER3> But cloud.</comment></comment>


Kindle now available on woot.com for $149.99 - <AUTHOR> http://www.woot.com/

<comment><USER2> This Youtube video does a great job explaining today's woot acquisition. [http://www.youtube.com/watch?v=bnCHCcveteA&feature=playe...](http://www.youtube.com/watch?v=bnCHCcveteA&feature=player_embedded)

</comment><comment><USER3> Does anyone have one of these already? I'm wondering how well this kindle would work for reading programming books? PDF format in particular.

<comment><USER3> Oh and also I remember DRM issues with these, is that still an issue with the Kindle?

<comment><USER4> Kindle's DRM is about as much a hindrance as DVD-CSS; there's a package called mobiDeDRM, to which you can feed a book from your kindle and your kindle's serial number, and it strips the DRM. The file is still an annoying ebook format, but the DRM part falls right off.

</comment></comment></comment><comment><USER5> Brilliant play, I love this. Very good way to announce the Amazon purchase to Woot users, then they'll have it shipped directly from Amazon.com showing the shipping/speed/logistics boost that Woot is going to get from Amazon. And they're selling a device that lets people impulse buy ebooks at high margins to a crowd of loyal impulsive buyers. Love it.

I'm guessing the Kindle device is already a loss-leader (anyone know?) at $189, but the extra $40 off is well worth the price when they're paying millions for Woot. Tactfully bringing attention to the Amazon acquisition, getting some goodwill, and showing off he benefits of the Amazon acquisition... man, I want to meet Jeff Bezos someday, my admiration for the guy keeps growing every time I see him do anything.

<comment><USER6> They're probably getting ready to introduce a new version of the small Kindle (just did introduce a new big one), and want to clear out the old stock.

<comment><USER7> It's another great example of why buying Woot makes a lot of sense for Amazon; they thrive off of exactly that kind of inventory. And I'm sure Amazon doesn't mind being able to easily liquidate inventory while still making some money back...

Wasn't part of the reason they also purchased Zappos because of how good the inventory system was? I thought I read that somewhere...

</comment></comment></comment><comment><USER8> Woot now available on Amazon.com for $149M.

</comment><comment><USER9> It's really frustrating that they don't ship internationally.

</comment><comment><AUTHOR> Click on the "FULL STATS" link in the page to see the breakdown of customers.

</comment><comment><USER10> Sold out now. I guess people woke up.

</comment><comment><USER11> Hmm, I wonder why...?

<comment><USER12> Kindle 3 forthcoming?

      Amazon.com, the world's largest online retailer, isn't relying merely on price
      cuts to contend with Apple. In August, Amazon.com plans to introduce a thinner
      Kindle with a more responsive screen and a sharper picture, people familiar
      with the company's plans said last month.

[http://www.bloomberg.com/news/2010-06-21/amazon-cuts- kindle-...](http://www.bloomberg.com/news/2010-06-21/amazon-cuts-kindle-price- to-189-boosting-price-war-with-barnes-noble.html)

<comment><USER13> Seems odd they would release a Kindle DX less than two months before a major new version?

<comment><USER10> I think they're aimed at different markets, and the most important thing for the DX was to get the price further away from the iPad, which they did.</comment></comment></comment></comment>


Introduction to HTML5 Canvas - <AUTHOR> http://www.storminthecastle.com/2013/05/20/introduction-to-html5-canvas/

<comment><USER2> Sorry but calling this a tutorial is clearly giving it too much credit when there are real and comprehensive tutorials like [https://developer.mozilla.org/en- US/docs/Web/HTML/Canvas/Tut...](https://developer.mozilla.org/en- US/docs/Web/HTML/Canvas/Tutorial)

<comment><USER3> Um... who called it a tutorial?

I thought it wasn't a bad introduction to what the canvas is/does (rather than how you use it).

</comment></comment><comment><USER4> Our app WebCode (<http://www.webcodeapp.com>) is a vector drawing app that instantly generates HTML5 Canvas code. No need to write all of it by hand :-)

<comment><USER5> I was about recommend WebCode after reading the article.

I just bought it a week ago. It makes canvas a lot more human. I've used it to create a few minor UI elements even, but main issue I've had simply the lack of rotate (or my ability to find it).

Still, its best tool I've used for Canvas.

<comment><USER4> See: [http://www.webcodeapp.com/documentation/beziers#RotatingBezi...](http://www.webcodeapp.com/documentation/beziers#RotatingBezier)

Also, we'll make rotations much more useful in future updates.

</comment></comment></comment><comment><USER6> The shapely library - <https://github.com/lukehaas/Shapely> \- makes working with the canvas much simpler

<comment><USER7> I really like sketch.js

<http://soulwire.github.io/sketch.js/></comment></comment>


"Manufacturing Consent" in Action - <AUTHOR> https://www.currentaffairs.org/2019/12/manufacturing-consent-in-action <comment><USER2> NPR's political reporting is pathetically weak: it's all about the horserace, never about policy.

</comment><comment><USER3> This motivated me to donate to his campaign again.

</comment><comment><USER4> I'd imagine that there's some kind of grudge against Sanders in the media class, similar to the obsession with Russia. The MSM was entirely confident in Clinton's win, and were reeling for answers after she lost. He was Clinton's main challenger in 2016, and I know a lot of liberals saw his campaign as somehow detracting from hers, so much so that it contributed to her losing the election.

<comment><USER5> We already know what it is, the centralized ownership of news media. Billionaires do not want Sanders to bring their taxes in line with reality. Thus the corrupt political elites and the corporate owned media marginalize him every chance they get.</comment></comment>


UDepth: Real-time 3D Depth Sensing on the Pixel 4 - <AUTHOR> https://ai.googleblog.com/2020/04/udepth-real-time-3d-depth-sensing-on.html <comment><USER2> Looking forward to the day when the user can capture viable 3D models for 3D printing using their phone.

<comment><USER3> You already can! Check out the Capture 3D app for iPhones with face id.

<comment><USER4> Thank you for this! I have thought about how neat this would be since FaceID first came out, but I had always assumed the IR camera's API wasn't available to third parties. This is awesome.

Edit: Yikes. A bunch of these 3D scanner apps are very shady. Requiring an account and/or subscription. There is no way I'm sending 3D scans to some private server. I did find one that seems on the level: STL Maker. I'm sure there's others, but users should be careful.

</comment></comment></comment><comment><USER5> Well, just don't expect it to work in sunlight.

<comment><USER3> Why? The iPhone has had similar tech for years and it works fine in sunlight.

</comment></comment><comment><USER6> Fascinating ai usage. I could only have imagined these models running on phone chipsets.

Still not buying a pixel though.</comment>


APM Companies say: AI and machine learning is the future of APM - <AUTHOR> https://haydenjames.io/asked-apm-companies-about-the-future-of-apm/ <comment><USER2> Per [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html), "please use the original title, unless it is misleading or linkbait"</comment>


AppOnboard: Downloadless apps and next-gen chronological heat map analytics - <AUTHOR> http://apponboard.com <comment><USER2> Looking forward to all the feedback here!

</comment><comment><USER3> looks intruiging. seems like it would be good for softlaunching apps. pre-0.1?</comment>