Ask HN: Favorite pointer tricks in C? - <AUTHOR> Hey HN,
I'm teaching a class to a bunch of high school and middle school students tomorrow who've all had moderate experience with programming.  I'm covering pointer basics in C as a light intro or refresher, then focusing on cool (but relatively simple / not too crazy) tricks/tips/etc (e.g. stack walking, function pointer arrays).  Care to share any of your favorite small pointer tricks with me for the class?
Thanks :)
-Cam <comment><USER2> What I think takes the cake is this:

      array[index] == index[array]

Not that you would actually use this, but it gave me a lot of insight into how addressing and stuff works inside the compiler. Also from this example, there's the implicit suggestion that an array can be treated as a pointer. So that leads into pointer arithmetic which can be very useful.

<comment><USER3> You didn't really spell out why this trick works:

        array[index] == *(array + index) == *(index + array) == index[array]

<comment> alan-crowe array + index == index + array needs justification

One expects the generic + in a+i to get expanded to raw addition .+. and raw multiplication .x. with s the size of elements of the array

        a .+. s .x. i

One expects index + array to throw a type error because index is just a number and doesn't have an element size.

So I'm guessing that the real reason that the trick works is that generic + has _three_ methods with signatures

        int + int
        array + int
        int + array

</comment></comment></comment><comment><USER4> The canonical evil pointer trick is using prev_xor_next to construct a doubly linked list.

<comment><USER5> Could you put an example?

<comment><USER6> <http://en.wikipedia.org/wiki/XOR_linked_list>

<comment><USER5> thx!

</comment></comment></comment></comment><comment><USER7> Regarding function pointer arrays, I'm doing something in labrea (<http://github.com/dustin/labrea>) where I need to make what is effectively an FFI call from C to C where I know the number of arguments, and their types, but I have them in the form of an array of unions.

For example, if I need to call read, it's basically an invocation of a function with a 4 byte, 8 byte, and then 4 byte argument (on a 64-bit system). I have a union argument type that represents 32-bit and 64-bit parameter types at the same time. I make a call like this:

        rv = abstractInvoke(&fun, args);

which, depending on arity of fun, invokes something like this (auto- generated):

        rv = abstractInvoke(fun, args[0], args[1], args[2]);

That three-arg function looks roughly like this (calling my argument type ``a_t'' to abbreviate):

        a_t abstractInvoke(struct ftype *fun, a_t a0, a_t a1, a_t a2) {
            static a_t (*allfuns[])(const void*, a_t a0, a_t a1, a_t a2) = {
                invoke_3_4_444, // 0
                invoke_3_8_444, // 1
                invoke_3_4_448, // 2
                invoke_3_8_448, // 3
                invoke_3_4_484, // 4
                invoke_3_8_484, // 5
                // [...]
                invoke_3_8_888, // 15
            };
            return allfuns[fun->offset](fun->orig, a0, a1, a2);
        }

I generate all of the functions by arity and types and then compute an array offset of them ahead of time (so read has an offset of 5 since it returns an 8 byte value and its arguments take a 4 byte, 8 byte, and then 4 byte value).

Without this trick, I'd have to use very non-portable assembler to do the same invocation (OK, I'd use libffi or dyncall's already prepackaged very non- portable assembler, which I may end up with anyway) to make this function call.

<comment><USER8> This isn't terribly portable FWIW. Not all calling conventions massage data into either a 32-bit or 64-bit argument. In particular, passing structs by value has some interesting rules even in the common calling conventions.

It will certainly work for 90% of the common function types out there and is a pretty common trick.

</comment></comment><comment><USER9> Copy-free contiguous subsets of arrays are fairly simple but often convenient. If you want elements 5 through 33 of big_array, you just get a pointer to element 5, and keep track separately of the length. A common case is where you split an array into two non-overlapping subparts, in which case, if you no longer need the original, you can treat each subpart as if it were a separate array. Saves the work of allocating two new arrays for the split parts, which is necessary in many other languages. Useful for efficiently implementing things like decision-tree learners.

<comment><USER10> Also useful for storing parse results:

        ""

gets modified during parsing to become:

        ""

Your parse tree result result can then just contain pointers to "a\0", "href\0", and "blah\0" rather than doing any copying.

<comment><USER11> This is how strtok returns tokens too.

Incidentally I only found this after trying:

        char tmp[] = "cat,mat,sat";
        char *t;

        t = strtok(tmp,",");
        while(t != NULL){
          printf("%s\n",t);
          t = strtok(NULL,",");
        }

And getting a segfault, as 'tmp' is not writeable memory.

</comment></comment></comment><comment><USER12> I like the trick of using the last few bits of aligned pointers to store something useful. It's tricky and has to be done correctly. A class wrapper around the pointer would be better.

For e.g., a constraint in an AVL tree requires that the difference in sizes of left and right subtrees be -1, 0 or 1 (just 3 values, which requires 2 bits). A 4-byte aligned pointer would be enough. =)

<comment><USER13> This trick has been around for a very long time. I remember Tempus Editor on Atari ST (remember those?) using 8 bits of address registers for additional storage (as only 24 bits out of 32 were used for addressing).

</comment></comment><comment><USER14> You can demonstrate pointer arithmetic by showing how you would work with the strstr function. It's the clearest and most understandable reason for someone to see why you'd even discuss this topic I think. I talk to some people without C experience and they hear that idea and get scared. I usually explain how strstr works and that seems to always make sense to them.

Good luck!

<comment><USER15> char buf[1024]; /* should be enough */

I actually write this a lot in my code. Not code that I intend to share with others, of course. But I do find it amusing about the value I put in brackets. I find it amusing that I have an OCD-like predisposition to make it a power of two. And I find it amusing how the number between the brackets has increased over the last ten years, from a frugal 64 to an opulent 1024. This, to me, is progress.

<comment><USER2> In fact, a lot of code does this to avoid mallocs. Just be sure to check the length before you put anything into the buffer.

Also, making it a power of 2 is a good idea if you are concerned about alignment.

<comment><USER15> _Just be sure to check the length before you put anything into the buffer._

No need to check. The comment reassures both me and future maintainers that I have countenanced this potential pitfall! Assign away....

<comment><USER16> Smashing the Stack for Fun and Profit...

</comment></comment></comment></comment></comment><comment><USER7> It's kind of an anti-pattern, but I've found this to actually enhance clarity in a few places:

        int moved = (is_reading ? read : write)(fd, buf, len);

</comment><comment><USER17> Compare pointers rather than compare strings: convert all words in a dictionary to a trie structure. Then, each leaf of the tree (a word) is a pointer. A phrase or sentance can be a list of pointers. Pointer compares are mondo-faster when comparing two pointers than walking down two strings.

</comment><comment><USER18> One that comes to mind:

        struct name {
          int namelen;
          char namestr[1];
        };
        struct name *makename(char *newname)
        {
          struct name *ret =
          malloc(sizeof(struct name)-1 + strlen(newname)+1);
              /* -1 for initial [1]; +1 for \0 */
          if(ret != NULL) {
            ret->namelen = strlen(newname);
            strcpy(ret->namestr, newname);
          }
          return ret;
        }

(From <http://c-faq.com/struct/structhack.html> ) Simple way of storing a string's name and length in one allocated structure.

Others: virtual function tables, function pointers inside of structs that take a "this" argument effectively giving you OOP, opaque pointers to give compile- and run-time private encapsulation...

<comment><USER19> The correct way to write this is to not use /1/ in the size of namestr, it's to use a simple []. This tells subsequent programmers that you are using variable length structures. In older compilers, the metaphor was to use '0', but C99 (maybe even earlier) got everyone using [].

Here's a nice discussion in StackOverflow, including a bunch of C++ guys saying to just use Vectors, which ignores the entire point of getting a structure with only one memory allocation:

[http://stackoverflow.com/questions/688471/variable-sized- str...](http://stackoverflow.com/questions/688471/variable-sized-struct-c)

<comment><USER18> From GCC: ISO C90 does not support flexible array members. and: ISO C forbids zero-size array 'namestr'

Therefore I contest that your way is the "correct" way, especially since most C code is not C99 code. Also I'd probably never use this in C++. If you want to let subsequent programmers know you're using the variable length structure, add the comment: /* unwarranted chumminess with the compiler */

</comment></comment></comment><comment><USER20> * Using pointer offsets to get to the stack frame pointer, and then walking the frame pointer backwards to get the call stack.

* Using && to take the address of a jump label.

* Casting a u_int32_t over a 4-byte string (like an SMTP verb) to get a value you can switch() on.

<comment><USER3> > Casting a u_int32_t over a 4-byte string (like an SMTP verb) to get a value > you can switch() on.

This is awesome beyond words. If I stumbled across this in the wild I would flip flop between awe and disgust until my head exploded.

Let me guess, "SMTP verb" is not a hypothetical example?

<comment><USER21> There are at least three common mistakes involving tricks like this:

1\. Alignment. Many CPUs will trap (or worse) if accessing a 32-bit quantity at a non-aligned address.

2\. Endianness. Needless to say, the 32-bit value read for a given string depends on the machine endianness.

3\. Aliasing. Casting between different pointer types can result in a violation of the C aliasing rules and, with a little bad luck, incorrect results.

<comment><USER2> Good to see you on hn.

</comment></comment></comment></comment><comment><USER18> I remembered another one, the teleporting turtle algorithm. <http://www.penzba.co.uk/Writings/TheTeleportingTurtle.html> It's a neat way to determine if there are loops in a linked list (among many other uses).

 _We start with the turtle and rabbit pointing to the head, and then on each clock tick we advance the rabbit by one step. After a while, assuming we've neither found the end of the list nor caught the turtle, we teleport the turtle to the rabbit's position, double the length of time we're willing to wait, then go again._

</comment><comment><USER22> implementing linked lists the way the linux kernel does, that is: each node contains one pointer for each list it can be part of, that pointer's position is determined using some offset_of( field, name) macro.

<comment><USER2> I've recently started using offsetof in my own code, it's a pretty neat operator. Useful for nested structs, where you have a child but need to reference the parent.

</comment></comment><comment><USER23> Now I won't spell out actual "pointer tricks" but try to give some context in which these tricks might naturally be used:

I think that data structures like trees are a nice thing to continue once the fundamental properties of pointers have been discussed. (pointer to left, right and data...).

Then sketch out the operations necessary to insert elements, and then explain how pivoting the tree makes it stay performant. This gives you a lot of opportunity to use pointers-to-pointers and so on.

It's a thing that can be nicely visualized on a whiteboard, and it has relevance for students to understand things like databases or filesystems.

If you care to elaborate, you could continue explaining the pitfalls of multithreading, or locking all or parts of the tree during updates, making updates visible in a atomic way... but that gets's out of your "not too simple/crazy" limit pretty fast.

You could also make up a nice producer/consumer example where parts of data that has to be processed is passed around by pointers, stored in linked lists, sliced up/combined. Processing images (rotating tiles), or drawing fractals in parts of memory pointed to by some variable comes to mind.

</comment><comment><USER24> Would you care to share the learning objectives you are fulfilling with pointer tricks in C? Or if it's just some extracurricular entertainment?

<comment><AUTHOR> I'm teaching the class as a part of ESP's Splash @ MIT, a two-day educational outreach program. Thousands of middle and high school students swarm our campus just for this weekend, and MIT students/community/other teach whatever they want. I'm teaching this as a one-hour class, with two sections (that is, two times), for a bit of entertainment and to make this world a minimally more bug-free place... or something along those lines.

</comment></comment><comment><USER16> Instead of using a while loop to iterate through a linked list, consider using a for loop.

      Node * iter;
      for (iter=root; iter != NULL; iter=iter->next) {
           /* iter->object; */
      }

A concise implementation of strlen

      size_t strlen(char * str) {
         char * cur;
         for(cur=str; *cur; ++cur);
         return (cur-str);
      }

Reverse a string in-place.

      void reverse(char * str) {
        char *i,*j, tmp;
        for (i=str, j=(str+strlen(str)-1); i < j; ++i,++j) {
          tmp = *i;
          *i = *j;
          *j = tmp;
        }

<comment><USER25> Shouldn't that be --j in your reverse function?

Anyhow, when asked to write those on a blackboard, I typically do this:

      size_t strlen(char* start) {
         char* end=start;
         while(*end) ++end;
         return (end-start);
      }

and

      void reverse(char* i) {
        char* j=(i+strlen(i)-1);
        for (; i < j; ++i,--j) {
          *i ^= *j;
          *j ^= *i;
          *i ^= *j;
        }

<comment><USER16> Yup, --j.

Also, the XOR version probably isn't worth the complexity.

<comment><USER25> True in practice, but on a blackboard during an interview, it obviates the need to recode for the follow-up "now reverse the string in place" request.

</comment></comment></comment></comment><comment><USER26> A trick to save memory:

If you have a struct/class with a lot of members that are usually set to zero or some other initial value, you can store them in a "lookaside" structure that is hung off a global hash table with the pointer of the original object as the hashtable key. You can then use a bitfield to keep track of which members actually have interesting data.

So -- accessing the member would look something like this:

      int MyClass::get_foo() {
        if (foo_set_)
          return global_lookaside[this].foo;
        return 0;
      }

</comment><comment><USER27> My favorite pointer trick is a simple one. I learned it when I had to implement it (in 64-bit) in a C compiler.

Simply, you can subtract pointers. Let's say you're walking a string from the front and from the back at the same time, and want to find the length of the substring. Well, you don't have to use indeces, just do this:

       int len = back_ptr - front_ptr;

You'd be surprised how often this crops up when you're using lots of pointer tricks.

</comment><comment><USER28> I am not zure whether it fits what you call 'relatively simple', but Knuth's "Dancing links" (<http://en.wikipedia.org/wiki/Dancing_Links>) would make my list.

</comment><comment><USER29> pointers to structs for things like network protocols...

struct packet_header { uint from_addr; uint to_addr; ushort flags; ... }

packet *p;

read(socket, somebuf, sizeof(packet));

p = &somebuf;

printf("from = %u to = %u flags = %u\n",p->from_addr, p->to_addr, p->flags);

<comment><USER30> Won't this leave all multi-byte values in network endianness?

<comment><USER20> Yes, but so do the OS socket data structures, which is why htons() and htonl() are in the first chapter of any book on network programming.

The bigger problem with this scheme is alignment, although we appear to have outgrown architectures that will blow up when you get this wrong.

<comment><USER29> You do have to be careful, it can be annoying on ARM chips certainly. If you're using GCC, __attribute__ ((packed)) fixes alignment issues.

This method is so much less error prone than pulling stuff out a byte at a time. Plus you can use unions for network addresses, etc.

It's a simplified example to show what you can do.

<comment><USER20> It's a good trick, but I disagree that it's the right way to do it. My preferred idiom looks something like:

      s->field1 = ld32(&cp, ep);
      s->field2 = ld16(&cp, ep);
      s->field3 = ld16(&cp, ep);
      s->field4 = ld8(&cp, ep);
      s->field5 = ld8(&cp, ep);
      s->field6 = ld32(&cp, ep);

You can _just about_ automate this with a macro (you need to macro out the structure fields and use them both for the structure declaration and the field expansion), but the extra function call there gives you an opportunity to be defensive about e.g. buffer sizes, never blows up alignment, and isn't appreciably slower.

</comment></comment></comment></comment></comment><comment><USER31> You may want to show them how you can _generate_ code by emitting assembly hex-codes into a block of memory and then _call_ the block of code after casting it into a function pointer.

<comment><USER21> Modern hardware and operating systems require special care when doing this. Firstly, the D-cache must be cleaned and the I-cache invalidated for the relevant memory addresses. This is because the CPU does not in general maintain coherency between these caches for performance reasons (writing instructions is rare). Secondly, memory protection must be set to allow execution of the generated code. Some systems even forbid pages being writeable and executable at the same time in order to make code injection attacks that little bit harder.

<comment><USER32> By modern hardware I assume you do not mean x86? Self-modifying code (without flushing the I-cache) is still allowed even on the latest processors. Modern OSes indeed do not mark all pages read/execute by default, but that takes a 1-line mprotect() or VirtualProtect() to change. Also, on RISC architectures, D-caches are generally not cleared as part of that process. After all, you are writing instructions, not data.

<comment><USER21> To the store instruction everything is data, even if it happens to be instructions. Stores initially go the L1 D-cache, and unless the I and D caches are coherent, explicit cleaning (D) and invalidating (I) is required. Maybe they are coherent on x86, but I know with certainty that they are not on for example ARM.

<comment><USER31> x86 is cache-coherent; we can directly modify code at runtime and expect things to work.

</comment></comment></comment></comment></comment><comment><USER33> Copy a string in one line:

       while (*dst++ = *src++);

</comment><comment><USER34> I wish an HNer had taught _me_ C in high school.

</comment><comment><USER35> String literals are implicitly pointers and pointers are mostly equivalent to arrays.

char digitAsChar = "0123456789"[digitAsInt%10];

</comment><comment><USER36>
      void strcpy(char *s, char *d) {
        while(*d++ = *s++);
      }

<comment><USER37> your arguments are backwards and you didn't return dst.

<comment><USER38> Bit off-topic, are you ted unangst from openbsd?

<comment><USER37> that'd be me.

</comment></comment></comment></comment><comment><USER39> foo[5] is the same thing as * (foo + 5) (since "foo" is the address of the first element), which is equivalent to * (5 + foo) which is equivalent to 5[foo]! EDIT: hn ate up my * s.</comment>


Practical Networked Applications in Rust, Part 1: Non-Networked Key-Value Store - <AUTHOR> https://arveknudsen.com/posts/practical-networked-applications-in-rust/module-1/ <comment><USER2> Interesting! I'd love to take a structured distributed systems MOOC or course in a modern language well suited for the domain like Rust, Go, Scala or Elixir/Erlang. Does anyone know if something like this already exists?

<comment><USER3> MIT's 6.824 Distributed Systems course is taught in Go.

[https://pdos.csail.mit.edu/6.824/index.html](https://pdos.csail.mit.edu/6.824/index.html)

[https://www.youtube.com/playlist?list=PLpl804R-ZwjKCOwWpTZ21...](https://www.youtube.com/playlist?list=PLpl804R-ZwjKCOwWpTZ21eeaBS3uBrMfV)

<comment><USER4> The company, PingCAP, that made the course in the linked article also ported MIT 6.824 to Rust as part of their talent plan. You can check it out here [https://github.com/pingcap/talent- plan/tree/master/dss](https://github.com/pingcap/talent-plan/tree/master/dss)

</comment></comment></comment><comment><USER5> I also worked through the courses in this series, up through Part 4.

I thought it was a great way to get introduced to Rust, especially when concurrency comes into play. Having only ever written this sort of code in C/C++/Java, the way Rust required me to rethink my design to properly incorporate its concurrency model was really interesting to me.

For some reason sharing "references" in a formal way felt a lot different than what I was used to, and I'm not sure why. I'd say I prefer it, perhaps because it made my design feel more deliberate.

</comment><comment><USER6> Question for Rust programmers, do you still use Rust for quick hacking and exploration/prototyping or reach for another tool?

Rust is getting more attractive everyday, I wonder if there is something about the language that highly influences lib authors to write quality stuff or if the community has a high ratio of experienced devs.

<comment><USER7> > Question for Rust programmers, do you still use Rust for quick hacking and > exploration/prototyping or reach for another tool?

I have replaced all my tooling with Rust, fwiw. Rewrote several things at work with Rust _(which started this train for me lol)_ , and now all my projects are in Rust as well.

I often say that Rusts complexity is oversold _(by myself, too, at times)_ , and it can be just as productive as Go, if used like Go. That is to say, Go is often touted as being hyper productive because it takes decisions away from you, such as Generics. You can apply the same tools to Rust, and suddenly you lack a ton of features but also reduce the possible roadblocks you might be wanting to avoid.

Personally I don't even avoid any Rust features these days, I use all of them _(that I understand, at least lol.. which I think is all)_. I _more_ productive than in my Go days _(~5 years in Go, fwiw)_.

<comment><USER8> Do you use an IDE for Rust?

<comment><USER9> I personally use VSCode with the Rust Language Server.

A lot of people seem to really enjoy the IntelliJ Rust plugin.

<comment><USER10> I use VS Code too, slightly curious about IntelliJ for Rust though since I fundamentally like that environment.

<comment><USER11> Their proprietary code analysis [0] is mostly better than the Rust Language Server for now, even if I still use VS Code personally.

[0] [https://intellij-rust.github.io/](https://intellij-rust.github.io/)

</comment></comment></comment></comment></comment></comment><comment><USER12> I'm currently reading through everything. It's pretty cool, been seeing more and more stuff like this lately.

It could serve as a great second or third project for someone learning rust and the rust-ecosystem.

</comment><comment><USER13> Another nice(more lightweight) hands-on Rust tutorial that I came across with: [https://docs.rs/csv/1.1.1/csv/tutorial/index.html](https://docs.rs/csv/1.1.1/csv/tutorial/index.html)

</comment><comment><USER14> How hard is it to build a c compiler with garbage collection and compile all the the pre-existing code with safe garbage collection ?

<comment><USER15> You don't even need a compiler for this. [https://en.m.wikipedia.org/wiki/Boehm_garbage_collector](https://en.m.wikipedia.org/wiki/Boehm_garbage_collector)

<comment><USER14> I know about that one but can I compile mysql, httpd and all its dependencies with it enabled? I don't care if it is 100x slow.

<comment><USER16> sure. free() just becomes a noop. But probably they'll leak a bunch because conservative gc is kinda bad, doubly so in code that isn't made for it.

(it's really a little more complicated than that in codebases, like mysql, that probably manage their own allocation and actually care about page level stuff)

</comment></comment></comment></comment><comment><USER17> another rust hype article. with all that, readers of likes of hn, certainly would have a skewed view of industry.

<comment><USER18> Your comment isn't useful. Anything that ever becomes something was at one point nothing. Rust gets attention because it's doing new things. Important new things.

<comment><USER19> Yeah.

www.paulgraham.com/pypar.html In Python Paradox, the author argues that it's a signal of quality that someone would take the time/effort to learn Python. (Python is new and wouldn't land them a job).

Now in 2019, Python is popular. But I think it's fair to say instead that Rust wouldn't be a good choice if you wanted to get a job using a language which is popular in the industry.

<comment><USER20> From my experience people learning Rust are not people who are learning a language to get a job. They are usually experienced developers with jobs who know at least couple of languages, and learn Rust to expand their toolbox.

<comment><USER21> I'm learning Rust because:

1\. I want to add a low(er) level language to the ones I already know and use.

2\. Though I did some C/C++ in high school, getting really into depth with C++ at the moment seems really daunting.

3\. I don't need it for a job at this point so I can afford to learn a less popular language that can potentially have a future and which exposes you to new ways of thinking about code.</comment></comment></comment></comment></comment>


Jonathan Ive on the design of the iPhone 4 - <AUTHOR> http://www.core77.com/blog/object_culture/core77_speaks_with_jonathan_ive_on_the_design_of_the_iphone_4_material_matters_16817.asp

<comment><USER2> I really liked the original iPhone for how solid and a little heavy it felt, as though it's actually worth the $600 you paid for it. I'm glad to see that back with the iPhone 4; the 3G model just felt like a cheap toy.

Reminds me of that scene from Jurassic Park where the kids find the night vision goggles in the back of the truck:

      Gennaro: Hey, where'd you find that?
      Tim: In a box under my seat.
      Gennaro: Are they heavy?
      Tim: Yeah.
      Gennaro: Then they're expensive, put 'em back.

<comment><USER3> Sometimes Apple's material choices are questionable. Their iPod touches have this really slick, polished metal back. It looks really great – for a few weeks. Then it's quickly getting scratches.

I don't know whether they picked that material for sentimental reasons (all iPods back to the first one – except the smaller ones – had that back) and whether you are just supposed to accept that back that's slowly getting more and more scratches. (I won't use cases. Never. I have to be able to put your gadget in my empty jeans pocket. If I can't there's something wrong with your product.)

Apple knows and used better materials. My trusty six year old brushed aluminum iPod mini pretty much looks like new and has been treated far worse than my iPod touch.

<comment><USER4> > Their iPod touches have this really slick, polished metal back. It looks > really great – for a few weeks. Then it's quickly getting scratches.

Likewise for the chrome bezel. Within an hour of ditching my iPhone's case, I nicked the damn thing with a very slight bump. It was a huge relief to see Apple lose the chrome for the iPhone 4. But after one of Engadget's phones got a nice big scratch on the back, I can no longer assume they're using gorilla glass on both sides.

I'm forced to believe they make questionable material choices merely to increase the "shiny", which is one of my main gripes with Apple. It's undoubtedly why they use glossy displays by default on MacBooks, iMacs, and iPads, even though matte is far more usable.

<comment><USER5> To be fair, the introduction of glossy displays was done after most other laptop manufacturers had switched. I'm sure they did it because it looks better at the store, i.e. you have to know that a matte display is more usable in daylight to prefer that over the glossy display.

<comment><USER6> They do consider how it will look past the store—not in the least because Apple products are sold online as well as through the retail stores.

The likely explanation, to me, is that professional graphics people (Apple's high-end core market) will set up the environment of the device to be perfect for it (i.e. "studio lighting"—basically the same as the Apple stores) rather than expecting the device to conform to the environment. Glossy _is_ better under perfect conditions.

<comment><USER4> I don't buy that explanation, as glossy displays are ubiquitous on Apple products aside from the Cinema Displays and matte options for MacBook Pros. They surely aren't assuming that iPads and regular Macbooks are being used in perfect lighting conditions, which is an unreasonable assumption to make for any portable device.

I would actually argue that glossy displays are not ideal in any lit environment, for the simple reason that blacks just turn the display into a mirror. This is also a problem if you've turned down the brightness in order to save power.

Matte really needs to be the default for any display, with glossy as an option.

<comment><USER7> One sunny day I went outside and tested glossy and matte lcd side-by-side. I had the same results as described here: <http://netwalker.nl/2007/07/28/glossy-vs-matte/>

Glossy was better. (lcd panels were from different manufacturers, so my results may not apply to every case)

edit: unlike in the linked blog-post, backlight intensity of both lcd-s I tested was roughly the same.

<comment><USER4> That blog post is comparing a glossy LED to a matte non-LED display. Big difference, and one I know about first hand because I own MacBook Pros with both types of display, only my LED is matte.

Personally, it's incredibly rare for me to be using a laptop outside on a sunny day, so even if glossy were better in sunlight, I'd never base my decision on that fact. But I can tell you that I did get to compare a matte and glossy MBP of the exact same model in an Apple store, side by side, and saw no significant difference in brigntness.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> _When you see the breaks, the three little black reveals that interrupt the band, in photographs, you could be forgiven for assuming you're seeing three separate strips of metal with gaps in between; but in fact it's all one piece._

from the internal photos at ifixits iphone 4 teardown[1] this doesn't appear to actually be true... or am i crazy? ( i am fully prepare to be called crazy/blind :) )

[1] <http://www.ifixit.com/Teardown/iPhone-4-Teardown/3130/1>

<comment><USER9> I'm pretty sure this is a difference of semantics. He means that it's all one piece and then they machine into the separate antennas that fit together with incredibly tight tolerances.

</comment></comment><comment><USER10> This article reminds me vividly why, at my Alma mater, EVERY engineer (even EEs and CEs) were REQUIRED to take a class in their freshmen or sophomore year called "Manufacturing Process & Materials Design".

It was basically a fancy academic term for "shop class".

We made gears, arc welded (still have a scar from that), cut screw threads, riveted sheet metal, worked milling machines & saws, turned fixtures on lathes, and glued/bagged/baked carbon fiber.

At a very visceral hands-on level were introduced to the materials, workflows, and structural fastening tech that makes up the shells and supporting frameworks of physical goods.

At the time, it was a royal pain in the ass (I'm not a natural kinesthetic learner) and I didn't "get it", but looking back it was an extremely valuable experience.

Aside from the welding scar on my left thumb, I think the biggest takeaway was gaining an appreciation for the EXTREME ROI gained in designing processes which have "loose" tolerances where it's acceptable and "tight" tollerances where it's required.

</comment><comment><USER11> Anyone else read Johnny Ive quotes in a British accent, almost as if it's instinct?

<comment><USER12> It is instinct. At least for me. If I know how someone actually sounds I "hear" their voice as I read a quote by them.

</comment></comment><comment><USER13> Ive is right. My new iPhone is like a work of art. Like a piece of art in a museum, because I can't touch it either. The unit I have has so many problems, simply holding it makes it lose both 3G and wifi signal. I'm exchanging mine or switching back to my 3GS

<comment><USER14> 3G AND WiFi? Somehow I doubt you even own an iPhone...

<comment><USER15> Could you explain why? I don't own one and never really read much about Iphones.

<comment><USER16> When you're on wifi you have no indication of the signal strength of any other data source (3G, Edge or GPRS).

It's possible the Wifi would go out and then the bars would drop, I suppose. Any signal issues I've seen have been non-wifi though.

<comment><USER17> You do. The signal strength bars are to the left of the carrier name, while the connection type (EDGE, 3G, WiFi) icon is the right.

The WiFi icon (which acts as a signal strength indicator for WiFi connections) unfortunately does hide the cellular data indicator, which shows whether you're connected to EDGE or 3G.

<comment><USER16> What I mean is you could have full voice signal with no data signal and not know it if you are connected to wifi too. Most areas have at least GPRS, but you can still find some towers that are voice only. Because of this you really don't have an indication of your cellular data. You can assume you have it, which is true most of the time, but you can't know for sure.

</comment></comment></comment></comment></comment></comment><comment><USER18> Zzz... device porn. Nothing new to see here, move along.</comment>


Show HN: Imgp – high-performance batch image resizer & rotator - <AUTHOR> https://github.com/jarun/imgp <comment><AUTHOR> imgp is a command line image resizer and rotator for JPEG and PNG images. It can resize (or thumbnail) and rotate thousands of images in a go, at lightning speed, while saving significantly on storage.

Powered by multiprocessing, SIMD parallelism (thanks to the Pillow-SIMD library), an intelligent adaptive algorithm, recursive operations, shell completion scripts, EXIF preservation (and more), imgp is a very flexible utility with well-documented easy to use options.

imgp intends to be a stronger replacement of the Nautilus Image Converter extension, not tied to any file manager and way faster. On desktop environments (like Xfce or LxQt) which do not integrate Nautilus, imgp will save your day. File manager nnn provides a script to batch resize images with imgp.</comment>


China congress: BBC team forced to sign confession - <AUTHOR> http://www.bbc.com/news/world-asia-china-39137293 <comment><USER2> The current state of human rights in China, and its utter, utter lack of admonition by world leaders due to their dependence on their economy is to me one of the greatest tragedies of today.

I truly don't know what could be done to help free speech prosper there as it should.

<comment><USER3> For decades now we've been hearing that China will change and become more democratic as its economy grows. It's one of those issues like the Israeli/Palestinian conflict that you'll read an update on every week in the NYC or The Economist for 20 years straight.

China got things to work though. It did it without a free press. It did it without an independent central bank. It did it without elections. It did it without Facebook, Google, YouTube and Twitter.

What did China get to work though? Nobody knows. That's because the western press ignores the inner working of the structure of their society. They only focus on what they do and how it is largely bad and can be remedied only by adopting our systems. There isn't any attempt at understanding or self- criticism.

I just find it annoying when there is ideological and cultural conflict that continues in an endless stalemate and every week it's groundhog day.

<comment><USER4> It's been an article of faith for a long time that prosperity requires democracy, and democracy brings prosperity.

It seemed reasonable during the Cold War, when the First World was democratic and prosperous, and the Second World was authoritarian and much less prosperous. But now we're seeing that maybe that was just a coincidence, or perhaps democracy helps but isn't required.

I do wonder if China's prosperity will be more fragile. If the Chinese Communist Party turns more ideological, or another Mao-like figure shows up, it could all come tumbling down.

On the other hand, democracy is starting to look a little more fragile these days as well.

<comment><USER5> Is there any large, populous, developed country which is non-democratic? I don't know any.

<comment><USER4> How large, populous, and developed do they have to be to qualify? It's hard to answer that without setting some boundaries first. China still has lots of really poor people and undeveloped areas, but a huge portion of the country is developed more or less to first world standards, so China would qualify if you can accept some inconsistency.

Otherwise, Saudi Arabia? 30+ million people, high per-capita GDP, fairly high Human Development Index, totally non-democratic.

Russia might be a marginal example, with a moderately high HDI and a government at least pretends to be democratic.

I think Germany is a pretty good example if we're allowed to look at the past rather than just the present.

<comment><USER5> China is a developing country. If "a huge portion of the country is developed to first world standards" then 50% of developing countries would suddenly be classified as developed. One of the criteria for being a developed country is uniformity of development.

Saudi Arabia basically sells gold that springs out of the ground. Let's see how they fare when the price of their "gold" goes down to 1/100th.

Russia is not a developed country, it's a developing country.

And about Germany, we're talking about past 1945. Otherwise any comparison is useless since a relatively poor country in 2017 is richer than quite a few developed countries pre 1945 - progress does that to things :)

</comment></comment></comment></comment></comment></comment><comment><USER6> On free rights: There was one time - one student was curious about other things like religious belief etc. The short conversion went like this: He:"Are you a Buddhist?" Me:"No, I'm Hindu .. but I like Buddhism more." He:"??" Me:"What , I don't understand your question" He:"Why you do that?" Me:"Do what?" He:"Like Buddhism? while being Hindu" Me:"Nothing wrong in it, I like teaching of Buddha" He:"Lucky, you choose what you want. Here we can't openly tell we follow religion." Me:"Why?" He:"Our govt, won't allow such things."

we know Chinese communist party has strong influence in people way of life,but hugely disappointed to hear people can't even decide which religion to follow,if one wants to? I agree, every country has its own issue, but free speech and free rights are important. For ex, If social media like Facebook/google etc banned in other countries, there will be huge uproar by people in the name of free speech. Even the one who never used social media, will be against govt decision.

Sincerely hope common people from world's most largest population will have these rights in future.

<comment><USER7> Your being a bit presumptuous there, in most Western countries they'd be able to block VK and other non-local sites without protests in the streets, and if they occured you'd see a significant portion of the country (esp. in the US) hoping for the police to come in and crush said protest.

Depending on the subject, the protest can be crushed, hence why most public spaces in the US have been bricked over for easy protest breakup.

<comment><USER8> > bricked over for easy protest breakup

What do you mean by this, exactly?

<comment><USER7> At UW Seattle, they bricked over Red Sqare (and hence made it red) so that they could use water cannons on the protesters and they'd have nothing to firmly attach/affix themselves to, whether that be trees, stakes in the ground, etc. This was also done to many urban spaces and college campus squares at the same time, as it is very effective.

Note: love the downvotes, keep 'em coming. I'm just referencing history here :P

</comment></comment></comment></comment><comment><USER9> I'm confused. So we are upset with China and it's lack of human rights. But we get upset with Trump for talking to Taiwan...

If we were advocating human rights we would also advocate against One China policy.

<comment><USER10> Except that Trump only talk to Taiwan as a way to bargain with China, which is a dumb diplomatic move (since, given how complex the situation is, the status quo is probably what's best for both Taiwan and China). Probably the last thing Trump care about is human rights.

<comment><USER9> My point is that if America wants to talk about human rights in china, then it also has to denounce its acceptance of One China policy.

<comment><USER11> Probably not wise to mention Trump then, who praised the Chinese regime for crushing the pro-democracy "riot" (his word) in Tienanmen Square.

<comment><USER12> Citation?

<comment><USER13> [https://www.theguardian.com/us-news/2016/mar/11/donald- trump...](https://www.theguardian.com/us-news/2016/mar/11/donald-trump- tiananmen-square-china-playboy-interview)

<comment><USER14> That source chain is really weird to me. It goes Guardian -> Independent -> filthy.media - a news company founded in 2016. I guess they have a license to the content? Otherwise, I don't get why Guardian wouldn't just link to the original Playboy interview.

Okay, on to the Guardian article, which does well to quote the original content.

>When the students poured into Tiananmen Square, the Chinese government almost blew it. Then they were vicious, they were horrible, but they put it down with strength. That shows you the power of strength. Our country is right now perceived as weak … as being spit on by the rest of the world—

Honestly, I don't know _what_ that means - it's bordering unintelligible. The way he used pronouns in that sentence completely obfuscates who he was calling vicious and who he was calling strong.

So, I can go with how I feel about Trump as a person and use the Guardian as my source for how I should interpret what he said: "he praised the Chinese regime". Or I can just go with what I really feel which is "I have no idea what that means."

<comment><USER15> It's tricky but translatable. He's saying that the government was vicious as horrible, but it worked for them because they where forceful. Then he maps it back to the US, saying that we need to be forceful to be successful (presumably we won't be horrible and vicious, though)

Strength is bad when evil people (THEY) use it but good when good people (US) use it.

He's using the King Arthurian logic of "Might makes Right in this world, but WE shall use Might in the service of Right" and holy cow my required liberal arts elective is directly applicable to modern government policy.

<comment><USER16> Trump does not have a core set of principles, so you cannot presume and read between the lines, you can only take what he says at face value.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Human rights have always been used as a cynical tool tool by a clique of countries to forward their own interests.

Saudis can be ignored for decades inspite of being the worst offenders on any parameter but Iran, Syria or Libya must be bombed. That itself stops any credible 'human rights concerns' by the US or Europe and infact shifts it the other way for warmongering, massive violations and basically destroying these countries. What can be worse for anyone genuinely concerned about human rights?

There have been zero consequences for US citizens involved in these violations from Iraq to Snowden so the idea that we can put the spotlight on anyone is laughable and smacks of dissonance. We can't be building the infrastructure to run total surveillance states, attack other countries at will and yet lecture others on human rights.

This is politics masquerading as concern and its the worst sort of exploitation that trivialize and make a mockery of 'human rights'. This type of sanctimonious posturing is completely disconnected from the way the world works and way past its sell by date. Integrity requires either stop the self serving geopolitical agendas or stop the posturing.

</comment><comment><USER18> Tell me again how mainstream media is outdated and we should listen directly to the official sources.

<comment><USER19> Mainstream media is an uncritical mouthpiece for official sources.

<comment><USER20> As seen by the coverage of the current Trump administration.

Not.

</comment></comment></comment><comment><USER21> Is there some (longer) article with more context in it? I would like to read more about it.

Anyway, this is why free speech is important.

<comment><USER22> Free speech is the government not officially taking action against you for your speech.

This was just run-of-the-mill intimidation by those in power, of a free media. Really how far away is this from putting journalists in cages and having your audience shout at them at campaign rallies?

<comment><USER23> Why is this being downvoted? How is it when X person chills the press is bad but when Y person I like does it, it's okay?

<comment><USER22> Because everyone is nitpicking the first statement and not reading the second.

</comment></comment></comment></comment><comment><USER24> You can see how behind China is in terms of the West. The concept of Human Rights is non existent in newly emerging markets. It took the US a few centuries. I'd imagine it would take China similar amount of time before it becomes "cool" like the US.

This is why I don't see China replacing US hegemony anytime soon in our lifetime. Civilizations upgrade themselves internally as they realize the overwhelming benefits of valuing human life.

<comment><USER25> I believe we're seeing the systematic destruction of human rights in the West. Many governments from former British colonies desire a centralized economy. They want to watch their citizenry. As we dismantle the West, it will look more like China.

China can point to our destruction while dealing with 3rd World African countries. They can show how their form of government is the same as ours. They can tell the Africans that it's okay to be a semi-brutal dictatorship. As a result the Chinese government can get along with new trade partners better than the US.

<comment><USER24> I don't see any evidence to support what you wrote. Division? Yes.

It's more likely that we are seeing an emboldened China that is completely oblivious to the nature of capitalism and it's incompatibility with a centralized economy in the long run.

I feel like we are going to deal with multiple Chinese states when the communist party inevitably loses it's grip on the populace.

It will be just like the old times, when China consisted of competing Kingdoms fighting for resources which really propelled it to reach hegemony in Asia.

<comment><USER25> Look at the US. We have a surveillance State. The US government keeps tabs on everyone. Do they care? Probably not, but you have a file. The British won't allow locking blades. They too have a surveillance farther along than the US'. Australia is the same. The Indians would if they could, but their corruption holds them back.

<comment><USER24> at least our organs are intact and not being harvested by the government.

</comment></comment></comment></comment></comment><comment><USER26> Why am I seeing stuff like this on Hacker News? Which part of it is relevant?

<comment><USER27> Relevant to what?

<comment><USER28> To Hacking ...

</comment></comment></comment><comment><USER29> Not that I think the subject is not important, but is this really topical for HN?

On the other hand, it has 100+ votes, so perhaps HN demographics is changing.

<comment><USER30> I think the HN crowd has always been interested in this sort of stuff? It certainly has since I started reading it (~7 years ago). One of the things that I like about HN is that we are not completely inward looking.

From the guidelines:

> On-Topic: Anything that good hackers would find interesting. That includes > more than hacking and startups. If you had to reduce it to a sentence, the > answer might be: anything that gratifies one's intellectual curiosity.

> Off-Topic: Most stories about politics, or crime, or sports, unless they're > evidence of some interesting new phenomenon. Videos of pratfalls or > disasters, or cute animal pictures. If they'd cover it on TV news, it's > probably off-topic.

You could certainly say that a BBC group being forced to sign a confession for attempting to conduct an interview 'gratifies one's intellectual curiosity' about the world, but it could certainly fall under 'Most stories about politics, or crime', too.

Either way, as you point out, once a post has over 100 points you probably have your answer!

<comment><USER29>
      > once a post has over 100 points you probably have your answer!

It seems that we both agree that it's an Off-Topic article at face value and yet it is On-Topic based on the votes. The votes in effect override the second criteria of relevance, not unlike the final clause in Azimov's law of robotics.

Hence I'm genuinely curious about any shifts in the audience demographics that are occurring.</comment></comment></comment>


Unless You Are Spock, Irrelevant Things Matter in Economic Behavior (2015) - <AUTHOR> https://www.nytimes.com/2015/05/10/upshot/unless-you-are-spock-irrelevant-things-matter-in-economic-behavior.html <comment><USER2> Economics makes no claims about what items, experiences or feelings should be demanded. It's impossible to say that the students can't value seeing a 95 on their test or that workers shouldn't value not touching their retirement accounts. It's actually a good thing when counterparties want to optimize different variables because it reduces the need to compromise, as the author brilliantly demonstrated in the anecdotes about test scoring and tax- advantaged accounts, and this kind of negotiation is modeled by economists.

The cost of obtaining and trusting information also explains a lot of "irrational" behavior, and it is modeled by economists.

Finally, I'll note there are markets where buyers and sellers rationally prefer money and consistently act on that preference — simple models are sometimes useful, just like simple approaches in other fields.

<comment><USER3> >Economics makes no claims about what items, experiences or feelings should be demanded.

You are simply incorrect about this. The author of this piece, Richard Thaler, just won the Nobel Prize in Economics (let me cut the pedants off: yes, I know it's the Nobel Memorial Prize in Economic Sciences) for his decades of work addressing the implicit and explicit assumptions of traditional economic theory, which largely presumed perfectly rational "Homo economicus" actors, as the article notes.

That idea of rationality, and rationality over all other concerns, still holds a lot of sway in economic discussions. You'll see it come up a lot here on HN, for that matter.

You might take a look at Thaler's work before presuming to lecture him on economics.

<comment><USER2> I know who the author is. Any time that you have an opinion about a controversy in a field, you are going to agree with and disagree with some famous people. We can respect that we know less than the lead voices in controversies and still participate in them.

I can certainly agree that there are economists who stick to simple models when they shouldn't, but there is simply too much written that addresses the problems in the op-ed to discount the field of economics as too simple or focused on too few variables.

</comment></comment></comment><comment><USER4> Econ students or not the prof should have failed the complainers for not understanding "the material" (in this case the clear scoring rubric).

I remember a physics exam of the sort "here are three questions; you have four hours answer one". I couldn't answer any so just struggled for a while on the first; I ended up with 25% for work shown and, to my astonishment, the only passing grade.

(BTW the big lesson from that, which has been useful all my professional life, is "show your work". It means I can come back to it later, or I can collaborate with / ask for help from another person, who can show me where I'm a bozo or forgetting something or need to learn something).

</comment><comment><USER5> Another example of why even the more open minded and critical of the humanities crowd has such a difficult time taking economists seriously.

<comment><USER6> Oh the humanities!

...the open-minded and critical among that crowd–and I do know that they are plentiful–know that this idea of economists dealing exclusively in abstract models, and denying "soft" factors like emotions or differences in preferences was never true. It's a straw man, as exemplified by the recipient of today's Nobel.

<comment><USER5> I never said they are plentiful.</comment></comment></comment>


Show HN: Planda – Group Scheduling Made Simple - <AUTHOR> https://planda.fun <comment><AUTHOR> Hi HN Readers,

I am the founder/developer of Planda, a web app designed to help people schedule group events more efficiently.

Using Planda is a super simple process:

1\. Create a Planda - enter the possible days/times for your event 2\. Share the Planda - send to your friends/colleagues, who can fill their availability without needing to register 3\. Confirm a Date - once everyone has replied, pick a final date/time and send calendar invites by email

Planda is totally free to use and offers integration with Outlook and Google Calendar, allowing people to fill their availability with a single click.

Planda Pro offers a paid version with the ability to customise the branding and colours on the website, for businesses who want to use the product professionally to schedule events with clients. A free 30-day trial of Planda Pro is available at [https://planda.pro/](https://planda.pro/).

The backend uses Elixir & Phoenix, which are a wonderful language and web framework that I cannot be positive enough about. Happy to answer any questions about those if anyone has any.

The app does no tracking/data mining of any kind and it collects no data other than the obvious things that are required. See the privacy page for more information ([https://planda.fun/help](https://planda.fun/help)).

Any questions, please let me know.

Thanks</comment>


RIAA: Online Music Piracy Pales In Comparison to Offline Swapping - <AUTHOR> http://torrentfreak.com/riaa-online-music-piracy-pales-in-comparison-to-offline-swapping-120726/

<comment><USER2> The way we (obviously not all of us) think about culture is pretty fundamentally flawed IMHO. Copyright exists only to create incentive to produce more copyrighted works(aka culture) and not explicitly make anyone money. Culture can't, and shouldn't be contained. When you release a song, movie, drawing, game, some source code, you've given it to the world. You took everything the world gave you, got inspired, worked hard, and gave back. To think that you in some way own those vibrations, or light recordings, or bits is kind of childish. You've been granted a temporary monopoly on their production and that is all.

Should you make some money? Absolutely, but pretending like anyone actually owns any intellectual property is a mental deficiency induced by our childish need for control.

In the face of unprecedented sharing, all culture producing industries are thriving. More money comes out of movies, music, games, and other software than ever before. So anyone that really thinks that they can create culture and then _own_ it can cram it.

</comment><comment><USER3> While I take anything the RIAA says with a brick of salt, I am very curious how they know hard drive swapping is a bigger source of piracy than P2P. This boggles my mind. Is there some underground network of hard drives that I'm not aware of?

<comment><USER4> At universities worldwide, every dorm room features a terabyte external hard drive overflowing with booty.

The 16gb drives everyone has in their pocket also help.

<comment><USER5> But they're also the people that have no money, and wouldn't buy anyway.

Now that I am a professional, it's not that common for me to swap a hard drive.

<comment><USER6> Would they buy terabytes of music? No, but few people of any income level would. However it should be remembered that once upon a time, college students were a _major_ market for recorded music.

Twenty years ago when I went to college (ugh, that felt weird to type) every dorm room had stacks of CDs in it... maybe an average of a couple hundred dollars worth per head. That music-selling bonanza just doesn't exist today.

I don't really have a strong opinion one way or another about whether this is a good or bad thing.

</comment></comment></comment></comment><comment><USER7> They seemed to have misplaced the "burning/ripping from others" section.

<http://en.wikipedia.org/wiki/Private_copying_levy>

<comment><USER8> In the US (where the RIAA operates), the levy only applies to CD-Rs that are labeled as being for "Music." Standard CD-Rs and DVD+/-Rs, and so forth aren't covered.

</comment></comment><comment><USER9> Interesting to see that P2P has gone down 6% and downloads up 3%, whereas physical media has stayed the same. It's clear where the growth market is, now the RIAA just has to read their own numbers.

The one thing that puzzles me is that the numbers for burning have gone up. Who in the time of wireless networking, huge disk drives and USB sticks burns a DVD? I just can't see this segment growing 6% in a year.

<comment><USER10> > Who in the time of wireless networking, huge disk drives and USB sticks > burns a DVD?

Not everyone has a computer, so those that do burn a DVD for those friends/family who don't.

</comment></comment><comment><USER11> In collage someone passed around a pirated DVD of "Shawn of the Dead" in class. Everyone just put in their dvd-rom (feels so weird saying dvd-rom / disc drive) copied it, and then passed it along to the next person till most of the 80 guys in the room had it. Not to mention the sharing that went on over home wireless networks. Each student would share their music / video / software folders and make them public to anyone on their LAN. You could then browse their collection and copy over whatever you wanted. That's not something stoppable.

Sharing is an evolutionary trait among humans, we have an inner instinct to share the things we find useful with others. Despite the bullshit excuses and justifications and delusional utopian ideology that many file sharers babble about, it can and does cause damage. However, p2p file sharing is an extraordinary distribution platform. Maybe even the most efficient, effective, wide reaching distribution platform for anything digital. If we can design with it in mind and find a way to monetize around it / despite it, I think we can all live happily ever after. For instance, Star Wars made more money from the merchandise than it ever did with the films. Even if all the star wars films were made free to the public, it still would have still made massive amounts of profit. Not all movie franchises can follow that path but it is a creative alternative and proof-of-concept that you can make money from movies without charging for the movie itself.

In other worlds, use freely distributed digital content to advertise and solicit sales of real world products & services.

<comment><USER12> The reality is that the classical concept of copyright, where it is illegal to make a copy of a covered work without authorization from the rightsholder, cannot be enforced in a digital world. The further reality is that people are not motivated by the moral argument that consumer-facing copyright law is an intrinsic good that must be universally respected.

Together, this means that no one is going to heed that aspect of copyright law. We have to adapt. There are still plenty of ways to make money on intellectual property, but it's time to just _let go_ of this concept that piracy can or should be fought. It's an outmoded idea that has been shown irrelevant in a world of instantaneous, perfect replicas.

Big media is throwing a fit because it doesn't know what else to do and causing all kinds of collateral damage to both legal and technical systems in the process. We need to face facts and just tell them to calm down, grow up, and accept that their old business model doesn't work in the new frontier of widespread content digitization.

I think there is still a place for commercial copyright. I think that one can still make a bunch of money selling access to copyrighted material. It's still enforceable and reasonable to sue Studio A if they use content from Studio B in their latest blockbuster without a license. This is much, much different than downloading a movie instead of driving to the rental store.

Old media is constantly screwing themselves over by choosing to pour money into legislative influence and lawsuits instead of innovative content delivery platforms that could be bringing in $50+/mo/user. Right now, all that potential revenue is lost because the studios are so busy hoarding their material that often unauthorized channels are the only places that content is easily available.

The attempts that have been made suck; the TV people don't want to let go of ads as a revenue stream, prohibitive DRM and lockdown everywhere and on everything, forced to use Flash Player to watch video, forced to use special adapters to access content as desired, etc. It seems these people are just incapable of an objective analysis of the consequences and realities of digitization. Are there any ways we can help inform and create meaningful distinctions, or do we just have to wait until everyone with an irrational attachment to the old tricks of the trade retires?

<comment><USER13> I'm not sure exactly why, but we have a tendency to tie together three not necessarily connected issues.

One is the question of whether there are viable alternative business models complimented by free distribution of traditionally copyright protected content.

The second is whether we can sustain copyright in the digital age.

The third is the moral questions.

People are always mixing and matching from these. Objecting to a morality point with a business one or somesuch. I'll grant that often there are legitimate cross-overs, but a lot of the time its just absurd. If someone thinks copying art is like stealing from someones house, how can you retort with an alternative business model.

Would you suggest that if passers by keep stealing oranges from a tree the owner should accept it & try to sell them orange juice subscriptions?

If new technology made rape much harder to prevent and prosecute, would we suggest women readjust their sexual expectations?

I think copyright is doomed by reality. I think the industries built around copyright will be rattled, resized & otherwise changed but ultimately survive in some new form. I think that copyright infringement is not exactly the same as theft: it's an artificial system of rules that were engineered around a technological & political reality that no longer exist. I also think that the public does not see piracy as morally wrong. These all conveniently unanimous for me. But, they don't have to be. Sometimes conflicts exists.

I believe that heroine criminalisation is morally problematic, creates terrible drug crime. I also think that legalization it would probably lead to increased use and associate problem. It's a conflict.

<comment><USER14> It can be relevant to answer the moral question with a business argument because the moral question often has economic underpinnings. The idea that copying is equivalent to theft is based on the idea that pirates would otherwise have bought the work, making piracy an indirect financial loss. Creating a new business model that accommodates piracy with equal or better returns resolves the fundamental moral issue. (Whether that's possible is beyond me, though.)

There is, of course, the completely separate moral issue of the rights of artists to control their work. Business arguments are inappropriate there.

<comment><USER13> Sometimes, but very often it isn't.

If copying is equivalent to theft new business model that accommodates piracy with equal or better returns does not solve the moral problem. It solves the business problem.

If copying is equivalent to theft, the copyright owner has similar rights to property owners. Can a property owner have his stuff stolen if allowing it gives them some other financial advantage. What about the right to control how their work is sold? What about the right to stop selling? This isn't just theoretical. For example, Prince wants to exercise these rights.

<comment><USER12> OK, but I don't understand where you're going with this. Some people think digital piracy is bad, maybe even "equivalent to theft" of real world artifacts. Most people familiar with technology don't agree with them. As such, our society is not obliged to grant these unnatural monopolistic "rights". Do you want to argue that copyright _is_ equivalent to theft, or do you just want to point out that people who hold an alternate view of copyright are going to be upset when the laws inevitably catch up with society? Of course, there are some people who are going to be unhappy no matter what happens.

I recognize your point that even though the artists feel they are making equivalent or more money than previously, they can still feel wronged when something that is contrary to their concept of copyright occurs. But like I said, I'm not really sure where you intend to go from there.

</comment></comment></comment></comment></comment></comment><comment><USER15> I think they are missing the point here: each track _was_ paid for, but shared twice (on average). Perhaps music rentals and broadcast would paint a fuller picture?

</comment><comment><USER16> As soon as we have the technology to monitor's everyone's moves offline and see what they do or _think_ , you can bet RIAA will try to use it. Hopefully they don't exist anymore by then.

</comment><comment><USER17> So instead of giving a mix tape to that girl you fancy, it's now the custom to hand her a 16GB USB drive instead?

<comment><USER18> I tried lots of mixtapes :) It was hit or miss. :-\ I married the girl I gave a mix CD to though! ;-) That was almost 10 years ago. Kids these days have it so easy. They have software to match beats and do perfect mixes... back in the day it was a real talent to produce a smooth mixtape! Probably the next thing is to give her a streaming music subscription lol.. too easy

<comment><USER19> "I made you a spotify playlist" doesn't quite have the same ring to it.

</comment></comment></comment><comment><USER20> The sneakernet returns! I predict that this trend will only increase with time.

<comment><USER21> I'm pretty sure it's been the main conduit for viruses for a while now.

</comment></comment><comment><USER22> I'm sure they won't let that stop them from continuing to fund the erosion of civil rights worldwide. The assholes.</comment>


Ask HN: Where should amateur bughunters look for bugs? - <AUTHOR>

I'm your typical computer security hobbyist. I'm interested in searching for bugs I can call my own. But, I'm sure that some areas are more fruitful than others. I'm looking for advice from professionals on where a novice is likely to have the most success. Other, more general, tips on bughunting is appreciated as well. <comment><USER2> A good recourse for tools for everything from Security audits to analysis to fuzzing is : [https://packetstormsecurity.com/files/tags/tool/page2/](https://packetstormsecurity.com/files/tags/tool/page2/)

Other then that learning the proper lingo gives you the proper search terms when looking around. Looking the txt zines gives you some interesting search phrases aswell as sometimes bug hunting comes up. Also do some deepweb diving or darknet hunting (which ever term you like).

</comment><comment><USER3> one idea is to use a static analysis tool and look for memory exploits. for practice you could take say an old version of any popular app (say bittorent v0.1 ) and run it through the tool. the older versions would have example bugs and memory exploits so you can get familiar with the tool. maybe that would also give you some ideas of places to look for bugs (since first versions tend to be more buggy).

the most fruitful has been for a long time sql injection (imo). while thats largely been fixed by parametized queries, theres probably a ton of software that was never upgraded.</comment>


ReactOS network PXE-boot with 3rd party driver and RDP-connection to Windows 7 - <AUTHOR> https://www.youtube.com/watch?v=5ycbPb4KgY8

<comment><AUTHOR> Real hardware!</comment>


Gatekeeper's Dialog - <AUTHOR> http://dcurt.is/gatekeeper-s-dialog

<comment><USER2> This dialog makes me very, very glad I have moved the vast majority of my users off of downloadable software. That's going to cause a lot of "Why did your Googles download me a virus?!?" complaints.

<comment><USER3> What's coming for apps may in turn come for the Web. With the commotions around link sites, piracy, and pedophilia, a similar "must be signed/registered with us"-type restriction for accessing specific Web sites isn't a particularly tin foil hat idea now.

<comment><USER4> Yes, and that would be as simple as disabling HTTP in the commercial browsers (allowing only HTTPS.) The remaining handful of nerds who compiled their own browsers would require far fewer resources to track.

Note to self: don't buy a SSL certificate from GoDaddy.

<comment><USER5> Which commercial browsers? You mean the ones that Apple vetted and allowed on the App Store?

</comment></comment></comment></comment><comment><USER6> It might be aggressive to suggest you put it immediately into the trash, but "... has not been signed by a recognized distributor and may damage your computer" is totally accurate.

The suggested "The app Adium hasn't been checked by Apple. It can't be trusted. Use the App Store to find trusted apps." is less scary, but more inaccurate. Apple doesn't check signed apps - they only issue the certificates. The app store is also not the only place to find trusted apps, which a major point behind the Gatekeeper system.

<comment><USER7> It's accurate but overly technical and unnecessarily frightening. You shouldn't be using terms of art anywhere in your copy unless that's the language your audience speaks, too.

The average user will think they're about to get a virus or do irreversible damage to their computer, both of which are very, very far from the truth.

It's as bad as this type of error dialog:

      +</comment></comment><comment></comment><comment></comment><comment>---+
      |                     |
      |                     |
      |  An error occurred  |
      |                     |
      |             [ OK ]  |
      +</comment><comment></comment><comment></comment><comment>---+

What am I supposed to do with that? It provides no information and doesn't give me the opportunity to fix the (very mysterious) problem.

In some ways this is worse because while the dialog is technically accurate, the presentation will alarm anyone who doesn't understand exactly what's happening.

tl;dr: Imagine if your grandma saw this error message. How would she react?

<comment><USER8> > The average user will think they're about to get a virus or do irreversible > damage to their computer, both of which are very, very far from the truth.

Very far from the truth, _today_ , when this is a brand new beta that Devs are just getting their hands on.

But 6 months from now? A year? It's not going to be long before an unsigned binary probably is a trojan or similarly untrustworthy. It's not like Adium isn't going to be signed by the time Mountain Lion ships.

> tl;dr: Imagine if your grandma saw this error message. How would she react?

She'd freak out and throw it in the trash -- _which is exactly what I want her to do with unsigned binaries_.

There's really no analogy with the "An error occurred" dialog. We want to scare users away from blindly trusting binaries from the internet. "An error occurred" serves no similar purpose in training the user.

<comment><USER9> I doubt trojans will bother with unsigned binaries. I suspect they'll just do some sort of "social engineering" to get all the developer certificates they want.

<comment><USER4> Or maybe we'll see malware distributed in source form. That could be nasty if the development environment gets compromised. Probably more dangerous than a compromised website.

</comment></comment></comment></comment><comment><USER10> Reminds me of the same issue with CA warnings, which used to be very alarmist but often incorrect in terms of the actual danger, so users just got used to pushing "Ok I don't care."

Basically, if you have something alarming show up in from of every install created prior to OS X 10.8, it will be the "boy who cried wolf" scenario.

</comment><comment><USER11> I wrote an article about Windows' take on this, some time back: <http://usersinhell.com/unhappy-security-dialogs/>

There, they have a different set of problems. In both cases (signed and unsigned), you can proceed...but Microsoft doesn't really distinguish between the two types of warnings well, turning the whole thing into noise. I'm convinced nobody pays attention to it.

</comment><comment><USER12> Also, check out the available buttons on the dialog---"Cancel" and "Eject disk image". I'm guessing that "Cancel" is the one you need to click to say "Cancel the warning and mount it anyway", which in other contexts is known as "OK". Argh.

<comment><USER13> I think "Cancel" means close the dialog and not run the program.

<comment><USER14> Mounting a disk image is a step before trying to run the program. The dialog shown is what you would see when you first download the app in a .dmg file. Then you mount the disk image, and either run the app from the disk image by double-clicking on it, or copy the application to your computer.

</comment></comment></comment><comment><USER15> I think that as long as Apple stays impartial, verifies the identities of developers, and fights attempts by governments to abuse revocation, this is actually a development we should welcome and encourage.

Imagine if by default, all software most users install on their Macs will be traceable to a real entity - be it a person or company. This entity can be held responsible for the behavior of the software it distributes. If the distributed software is malicious, it's possible to immediately revoke the entity's certificate, stopping the software from running on future, and possibly even current machines. Legitimate entities that don't distribute malware are only mildly inconvenienced whenever they register or renew their Mac Developer Program membership.

In fact, a system like this only has value if it's difficult to opt-out. For an example of how useless signing is without a mandate, look at Windows: Unsigned apps run just fine, and most malware has no certificate to revoke - it keeps working long after it's discovered.

Even better, if all applications are required to be signed, it's now possible to verify the signature of everything on the system. You can prove that nothing has been tampered with, and in the event tampering has occurred, you potentially know what to replace to return to a known good state. I think this alone is awesome!

Now, could Apple use this to stifle competition? Maybe. Does it raise the bar to distribute an app on the Mac? Sure (but I'm not sure that's a bad thing). As long as disabling the signature mandate is an option, power users are free to do whatever they want, and most other users will be _much_ better off.

<comment><USER16> The problem is with the hypothesis that Apple would stay impartial and fight attempts by government to abuse revocation. This is highly unrealistic, and we've already seen Apple use the App Store policies to keep competitors' apps out (Google voice for a long time, 3rd party browsers, ...), calling them "redundant functionality".

<comment><USER15> I think that even if you add up all of Apple's indiscretions so far (and I agree with you they've made mistakes), you'd find the number to be small, and the number still outstanding even smaller. It's not going to be a perfectly smooth ride, but _as long as disabling signature verification is an option_ users will be able to work around Apple's obtuseness in situations like this until they're resolved.

<comment><USER17> As long as no one comments out _that_ _checkbox_ , we still have a general purpose computer...

</comment></comment></comment></comment><comment><USER18> It looks about right to me. It's warning the user of untrusted software from an anonymous source, and its message should be strongly worded.

If you don't want your users to see that message, make sure your stuff is signed.

<comment><USER2> Thought experiment for you: is the analogous message for untrusted webpages or emails from "anonymous" sources a good idea for usability?

"'Facebook' has not been verified by a certificate authority and may damage your computer. You should close this window."

"'Bob Smith' may not actually be the author of this message and the contents may be lies. You should delete this email."

The _happy_ outcome there is users learn to ignore both of them inside of a week.

<comment><USER19> The analogous message for untrusted webpages is "Go ahead, browse, because this is in the sandbox of the browser.".

And, when you type stuff into a textbox and POST it over HTTP, a text box often pops up the first time, saying "This is insecure, fyi".

For text-only emails, it's plenty fine. For emails with images, there's some privacy issues, and for emails with attachments, even more issues.

For the average user that won't check MD5s, saying "This can't be trusted, throw it out" is probably the right idea. There's a lot of history of people telling others their password for a candy bar, so anything that users really want they'll get, scarygram or no.

</comment></comment></comment><comment><USER20> This reminds me of when Firefox, Chrome and other browsers decided all self- signed certs are malicious, and forced all https websites (even intranet) to sign up with some CA or get users to install their certs in the browser.

As an enterprise web-app dev for a small company, it was an incredible pain- in-the-ass.

However, now, like then, the issue will dissipate once the developers get their (free) OSX signing key... just another item on the checklist before distributing your code.

</comment><comment><USER21> The suggestion to trash the app is a bit harsh. The rest doesn't seem bad, though. Maybe something like "The identity of this application cannot be verified by Apple. Only install applications from vendors you trust. Installing applications from unknown sources may damage your computer."

Also, that "Cancel" button is pretty ambiguous. I'd think "Eject Disk Image" and "Proceed Anyway" would be better options.

<comment><USER22> There is no "Proceed Anyway" option. That would make it just another Button- That-I-Have-To-Click-To-Get-What-I-Want dialog that are so pervasive on Windows. The options are "Don't mount the DMG" and "Don't mount the DMG and throw that mofo straight into the trash".

If Apple is consistent with their past behaviour and their uncanny understanding of user psychology, setting the "Allow all unsigned programs to execute" option in System Preferences won't add a "Proceed Anyway" button - it'll just suppress this dialog altogether.

<comment><USER21> Ah, I misunderstood the intent. I thought cancel would close the warning and allow the application to be installed anyway.

So there will be no way to bypass this in a per-app basis without changing the system preferences for all applications? You either completely disallow unsigned applications, or you always allow them?

I'm not sure that's the best approach, but I'm not sure it isn't, either. :)

<comment><USER8> You can right-click it and open it and the system will remember it as a per- app exception, from what I can tell.

That this isn't achievable directly from the standard dialog is probably a good idea to avoid training Joe Average User to become blind to the warnings.

<comment><USER21> Ah, nice.

> That this isn't achievable directly from the standard dialog is probably a > good idea to avoid training Joe Average User to become blind to the > warnings.

Yes, this is a very good point.

I feel like there's a (probably smaller, but still not insignificant) middle ground of people who generally know what they're doing, but would still like the extra layer of protection, for whom the per-app exceptions would be handy. Having it not the default, though, is probably a good thing.

<comment><USER8> > I feel like there's a (probably smaller, but still not insignificant) middle > ground of people who generally know what they're doing, but would still like > the extra layer of protection, for whom the per-app exceptions would be > handy. Having it not the default, though, is probably a good thing.

Well, that's effectively what the default is, where the "middle-ground" people will know to go into the contextual menu (or if you're feeling particularly keen, to disable the quarantine bit on the DMG from the command line, which is what triggers the signing check in the first place).

</comment></comment></comment></comment></comment></comment><comment><USER23> Where's the "Proceed Anyway" button? In this context, 'Cancel' is super ambiguous.

<comment><USER22> Not ambiguous. Cancel means don't mount the DMG, but don't move it to the trash either. There is no 'Proceed Anyway' option, unless you enable it in System Preferences.

<comment><USER24> Which is a problem. Suppose I want to run an app that _I_ trust, but Apple does not. I'm going to go find the option in System Preferences and turn it off so it stops bugging me, then probably never turn it back on.

<comment><USER25> There is an option to 'proceed anyway' by right clicking on the app.

<comment><USER24> Thanks, I didn't see that initially but it's mentioned in the Macworld article.

</comment></comment></comment></comment></comment><comment><USER26> Does anybody else find it ironic that this complaint comes from the guy who _invented_ "You should follow me on Twitter"?

<comment><USER27> I've been thinking about it for a minute and a half and I actually have no idea why that's ironic.

<comment><USER26> Just because he says

> Also, saying "You should move it to the Trash" is weirdly strong wording.

when he published a very influential write-up[1] of how he discovered that "you should follow me on Twitter" was the best text to use to actually _get_ people to click the link and follow him. It's not unlikely that people implementing this UI were actually influenced by Dustin's original findings when choosing this wording.

So he may be calling his own idea "weirdly strong", which is how I always felt about his "you should follow me on Twitter" phrase (and the resulting explosion of it around the web). It's a meme come full-circle, and the father doesn't recognize it!

[1] [http://www.dustincurtis.com/you_should_follow_me_on_twitter....](http://www.dustincurtis.com/you_should_follow_me_on_twitter.html) Dustin has clout in the web UI/UX/whatever designer blogo-webo-sphere.

</comment></comment></comment><comment><USER28> "You should move it to the Trash"? What kind of crap is that? Apple is going down the terrorism route to make sure developers pay them to join the walled garden?

I'm afraid this is a glimpse of the post-Jobs era. Modal dialogs with technical, scary non-sense and money trumping good UX.

</comment><comment><USER29> Maybe this is so when they water it down they arrive at something strongly worded that we would have originally disliked but can live with it because it is a lot better than the current implementation.

</comment><comment><USER30> What about adding an option, "proceed anyway, I understand the risks" ?

Currently in 10.7 there is something for downloaded apps the first time it pops up and has an option to continue. Why not continue with that? And yes this will just lead to people deactivating the thing completely and it will now offer 0 protection in the future.

<comment><USER31> Idiots will just click it anyway.

This doesn't appear if you have the preference to run everything turned on.

<comment><USER32> Idiots will Google for how to work around the warning and run the program anyway.

<comment><USER33> That takes a lot more effort. Besides, most apps will be signed by the time it's released.

</comment></comment></comment></comment><comment><USER34> Of all the Mac viruses, worms, malware, etc. that have been distributed, how many of them came in the form of a dmg that the user opened and installed? I would think most of the things that "may damage your computer" would come in the form of vulnerability exploits and other stuff that the user will never see or get a chance to block.

<comment><USER35> > how many of them came in the form of a dmg that the user opened and > installed?

Erm, in recent years, all of them? I can't think of any exploits in the wild that have been anything other than a trojan.

</comment></comment><comment><USER36> It's good to see that Apple is getting more open about being an enemy of software freedom.

</comment><comment><USER37> _The vast majority of apps people download will not damage their computer_. That's irrelevant. Downloading 100 good apps and one malware app still means I have malware. It's reasonable to warn people when they are doing something risky.

<comment><USER13> It's not a warning, it's a verdict. There's no button to "proceed anyway".

</comment></comment><comment><USER38> Apple's pieces are in place. This is the personal computing endgame.

</comment><comment><USER39> 'saying "You should move it to the Trash" is weirdly strong wording'

closelly followed by:

"You should follow me on Twitter here"

</comment><comment><USER40> Couldn't the dialog have an option to take you to the app store and show you similar apps?

</comment><comment><USER41> Seems very Apple-like to me: they provide a more controlled environment for users and developers – providing warm security fuzzies – and want to collect a toll for that service (via 'recognized distributor' registration).

The toll isn't very large, and while imperfect, it does add a level of accountability/reputation that isn't there otherwise.

I wonder, though: is every signature-verification reported back to the Cupertino mothership? That would offer some interesting capabilities: "there's a statistically significant larger number of [crashes|support- requests|upgrades|etc] from users of developer X's software".

</comment><comment><USER42> Forgive my naivety, but what problem is this solving? Maybe I'm not in the loop, but I'm not aware of a large amount of malware that forcibly downloads itself marked as an Adium.dmg file. It seems like this is a hoop to jump through. Come to Apple or else your users will be scared to install your application.

(also, none of the comments seem to touch on the fact that this is OPTIONAL in Mountain Lion. Of course, I hope it stays that way or it is modified to be... less fear mongering)</comment>


Ask HN: simple affiliate tracking software? - <AUTHOR>

Working on a site that is similar to groupon - what would you recommend as an affiliate tracking software if you were to work with a handful of publishers who are not your usual "affiliate people" but rather large publishers?<p>Mainly we're looking for a system that is simple to administer both from the merchant's side and especially the affiliate's side. It should also be easy to integrate and support delayed tracking (someone might signup for a service but only buy a couple days later - it should still be accounted for) <comment><USER2> We were also planning to introduce an affiliate program for CurdBee, which also had very similar flow to your context (with delayed tracking). Existing apps were no match for this need and we decided this is something worth to be addressed from the scratch.

Initially we'll try integrating it with CurdBee. Then, we hope to release this to public use. We'll publish more details on the release in our blog.

<comment><USER2> We've launched our partner program to be used with CurdBee. Take a look at it and let us know if you are interested about the app - <http://vesess.com/blog/2010/04/06/hello-partner/></comment></comment>