Dynamic software updating in C - <AUTHOR> http://kitsune-dsu.com/

<comment><USER2> This was work done as part of my phd thesis. You can take the code and samples that are here [https://github.com/kitsune-dsu](https://github.com/kitsune-dsu) and play with them. However, I wouldn't consider what has been released ready for production use. The papers were the main product of this research and are your best resource if you're interested: [http://www.cs.umd.edu/~hayden/papers/kitsune- draft.pdf](http://www.cs.umd.edu/~hayden/papers/kitsune-draft.pdf)

I moved on (graduated!) from the project in 2012 and the code that has been released is pretty much where I left it at that time. An undergrad collaborator was doing neat work on updating Tor, so that code continued to evolve a bit after I left.

I think there may still be folks at UMD working in some ways with Kitsune, but I'm not up on the details.

<comment><AUTHOR> I was thinking using this to update our graphics software, but then I realized I need to backup GPU states (textures, for example) and recover them before and after the update.

lots of the servers are now using gpus for deep learning, may be adding gpu support to the framework is a good feature.

<comment><USER3> If such states are preserved while the process that used them is still running then there is nothing to do: They will still be available to the updated program.

<comment><AUTHOR> I was thinking about memory mapped resources, like memory mapped io. and resource references.

maybe you are right, there might be no problem. I need to read the paper to understand better.

<comment><USER3> Yes, memory mappings should be preserved, so I can't immediately think why it wouldn't work.

</comment></comment></comment></comment></comment><comment><USER4> Seems interesting! It would be nice to have a diff between the base version and patch-ready version of the various software (eg, redis). It's hard to quickly understand what the integration of this into an large, existing piece of software would be.

That being said, I haven't read the paper so it may be clear as day there.

<comment><USER2> The paper describes the main changes that you have to make to make your program updatable and is the best resource.

You can find all the modified programs (redis, etc) here: [https://github.com/kitsune-dsu](https://github.com/kitsune-dsu)

<comment><USER3> To add: The number of changes tends to be very small, as reported in the paper. We are talking 100-300 LOC even for applications that are 100 KLOC. And these changes are robust in the sense that once you retrofit to include them, you rarely need to make further changes of that sort -- new versions will just work.

</comment></comment></comment><comment><USER5> Ah, Kitsune. I studied the paper for that as well as Rubah, a DSU for Java, quite a bit while working on my bachelor's thesis - which was implementing DSU in pure Java. I was pretty suprised with how little code you needed to make it work (for the one program I was testing on at least ...).

Unfortunately due to some failed prototypes and general lack of time I barely managed to get the basics working, there are little to no tests and I'm pretty sure when I handed everything in I knew a couple of critical bugs that hadn't been fixed.

The code isn't public right now, but if there's interest I may be able to make it open source. Just have to talk to a few people first.

</comment><comment><USER6> Very cool, this is one of the reasons I love Erlang and Java. Hot-patching is so simple.

<comment><USER7> Honest question; How can you even do this (replace the running binary/java code without closing file descriptors, etc) in plain java/on the jvm? [ Without resorting to tricks where there is some trampoline code that actually does the connection handling that never gets updated. I realize that's kind-of what the authors of the linked paper are doing too, but it's certainly possible to do this "the old fashioned way" without such hacks in native code on linux]

<comment><USER7> To answer my own question here, but without being a java expert, so talking out of ignorance probably. This paper [1] argues there are only two methods to do this on the stock JVM. One is putting in some trampoline code, the other one is patching the JVM. So it looks like the stock JVM doesn't actually support restarting the program while keeping the old heap and FDs etc around.

[1] [http://www.cs.umd.edu/~mwh/papers/rubah.pdf](http://www.cs.umd.edu/~mwh/papers/rubah.pdf)

<comment><USER3> I was just about to point you to this paper (I'm a co-author), but you beat me to it. The JVM has a fix-and-continue updating feature that perhaps replacing method bodies as long as (a) the method is not running, and (b) it has the same type as before. This approach is limiting and also slow, which directed us to use bytecode transformation. The Rubah implementation is pretty robust at this point, at least for research software. Your reference to "trampoline code" should probably clarify: You just need ways to "restart" your threads, as you do in Kitsune. You don't have to insert trampolines for every updated method, as some prior approaches require.

<comment><USER7> Thanks for the clarification! I understand that you got rid of the "trampoline"/dispatch code for calling methods by rewriting the respective bytecode at runtime. But you still need to register file descriptors and such with some rubah runtime code, and that piece of rubah runtime code doesn't get replaced on process upgrade, right?

I guess this really doesn't matter from the user's point of view, just for the sake of curiosity, want to work out that/if there seems to be a fundamental difference (FWIW) between what rubah is doing which I understand as "hot patch the code within the running process and have some kind of 'trampoline'/dispatch code within that process to switch between new and old version, regardless if it is actual explicit code or just implicit in the rewritten bytecode, but never actually leave that original process" vs. what you'd do in native code on linux which is more like "tell the kernel to start a proper new process and then pass all open fd's and programm state to the new process" (which obviously requires that process to be written in a way that allows it to "continue where it left off") --- and the latter is not possible to do when running on the stock jvm if I understand correctly, because the jvm doesn't allow you to implement the part where you pass the filedescriptors, right?

<comment><USER3> There's no need to register file descriptors, since these stay open during the upgrade -- the process identity doesn't change.

As far as a fundamental difference with the approach you propose: We actually tried it with an earlier system called Ekiden. We found that updating by migration was slower and more cumbersome than updating in place, but I don't believe there were fundamental issues. If you look at the related work section of the Kitsune paper you'll see a nice comparison with all known approaches, as well as Ekiden.</comment></comment></comment></comment></comment></comment>


Ad blocking "controversy" just foolishness - <AUTHOR> http://creaturefeaturecode.blogspot.com/2015/09/ad-blocking-controversy-aka-foolishness.html <comment><USER2> My feeling is that the current model adds liquidity to the internet. Paywall sites are annoying now as it is, I get frustrated when I click an interesting title and can't read the article. I really don't see how not being able to access huge swaths of the internet without managing your subscriptions is better than just having ads on the screen. Ads mean you just don't need to worry about it.

I remember seeing tons of this image (tiered internet: [http://www.gacetadigital.com/wp- content/2010/12/TieredIntern...](http://www.gacetadigital.com/wp- content/2010/12/TieredInternet.jpg)) used to scare people about net neutrality and yet this seems to be what a lot of these proposals boil down to.

The other ideas are nice, but they just add to the cost of monetizing your content. The advantage of ad networks was not having to spend time negotiating advertising or finding a vendor for shirts.

I think there is a compromise version of an ad-blocker that just freezes all animation -- that seems to be the biggest complaint that can be reasonably addressed. Privacy can be addressed by targeting ads based on the content of the page and possibly proxying the ad content through that server so the ad network never gets the request directly from a client. Since most ads only pay for a click instead of a view anyway I think confirming an ad loaded is becoming less of an issue from the other side.

<comment><USER3> It isn't just animation, it's audio.. it's layers of iframes and tracking scripts that slow down the rest of the page/browser/computer ... I don't begrudge tasteful, and limited use of advertising windows on a page... the issue is that many sites go too far beyond that.

When left to their own devices advertisers and the sites that cater to them, most recently the clickbait article sites, will use ever more intrusive methods of advertising. Much of which aren't easily avoidable... you see someone post something on facebook that looks interesting, you click it, you've already been abused, before you realize it's the same site that has abused you in the past.

These abuses include fly over ads, popup/out actions that are all but unavoidable, clickjacking, close filtering and more. It's not that the full- screen ads aren't enough, but there's pervasive and invasive ads that are disguised and integrated to look like content at first glance.

If it weren't for the bad actors in advertising we wouldn't have popup blocking built into the browsers. And as time goes it doesn't look to me like advertisers have learned their lesson. If Firefox wasn't such a performance nightmare with adblock on android, I'd use it more.. if I could get uBlock with chrome on android that would be better still.

As it stands, using my phone more has only served to increase my desire for ad/privacy software everywhere.

</comment></comment><comment><USER4> The larger issue is this, the AdBlockers block 'independent ads, served via third party services via web' Ad blockers won't block Google Ads via Android or iOS ads in their new "news" apps. Nor it will block Facebook ads, YouTube Ads or some in-app marketing.

So, what I think is missing in the discussion that, perhaps by flaw or mistake, but the original sin of the web (ads) is now the currency for many websites, apps, etc... and it maintains the small, medium and large publishers and companies.

Ad blocking as-now targets the independent web more than anything. It will force Advertisers to give to Google/Facebook/Apple more and basically just suck the revenues of an industry into the hands of a handful of platform. Content has already been centralized by force, now they want the ads as well.

People who say, 'if your content requires ads then its not worth it, or you are in the wrong side of history, blah, blah, blah' fail to recognize how ad monetization happens on web/apps - yes it gets annoying, but it works. Independent sites (arts, news, etc...) like a favorite of mine ArsTechnica, depend on Ad revenue.

Apple releasing Ad Blockers the same day their News app becomes permanent and with Ads that cannot be blocked its not a coincidence. And that is quite a strategic move aimed to move more ad revenue into fewer companies. I don't know if that's the right side of history then. I hope not.

However, it's all in the defaults - 90% of online users (and I cant imagine app users are any higher) never touch the defaults. Sure, a number of 20MM may have downloaded adblockers online, but it is still small. But once the option is there, one day, the iPhone7 might default to 'ad block yes' and obliterate a mobile ad industry. No one likes to defend marketers, but moving us to a system controlled by a few platforms is a bad idea. Say, a presidential election could be influenced by a company deciding it won't allow ads of candidate Y or Z etc... or Donation campaigns won't be able to afford a market price of higher ad prices.

This is a bad idea folks.

<comment><USER5> > Say, a presidential election could be influenced by a company deciding it > won't allow ads of candidate Y or Z etc... or Donation campaigns won't be > able to afford a market price of higher ad prices.

That is a perfect example of why adblocking should be on by default for everything. It'd solve that problem instantly.

<comment><USER3> The trouble with this... is that the functionality behind ad service (iframes, remote content, etc) is very functionally useful... as is/was being able to open a window. It's simply abused.

If iframes were limited to 1 layer deep in the browsers that would change a lot, as ad networks wouldn't be able to cross-bounce for 10+ layers if iframes each with their tracking and behavior scripts (poorly written) running in the browser, and throwing up errors all over my console output.

For that matter, It's not unreasonable to serve ads from the origin domain... it is very easy to do, and can cover some interesting models with advertising... integration can come in other ways, as could server-side integration methods. There are better ways to serve ads... the "liquidity" mentioned in another post is generally of poor and dubious quality.

</comment></comment></comment><comment><AUTHOR> long time lurker, first time poster here. curious to hear opinions on this piece I just wrote. thanks!

<comment><USER6> I despise the "wrong side of internet" argument. It feels pretty childish and I quit reading after your TL;DR.

<comment><AUTHOR> you mean "wrong side of history"?</comment></comment></comment>


Ask HN: I'm a developer with a product, and need a non-tech partner - <AUTHOR>

Like almost everyone else on HN, I receive my fair share of the usual "I-have-a-billion-dollar-idea, and-need-a-developer-to-implement-it" emails. However, what happens in the opposite case?
I am a developer with a "slight entrepreneurial bent". Over the past several months, I have been working on a little product (nothing close to a "billion-dollar idea" though) that is now ready to launch. However, while I have the tech skills to get it built and launched, I feel the product really needs the input of someone with a sales/market/"community-building" mind-set -- particularly since most the data required to make this work will be crowd-sourced.
Any ideas, comments, suggestions? (apart from reaching out to family and friends -- they're not exactly the entrepreneurial kind!). Thank you! <comment><USER2> I'd be glad to connect to chat more about what your product is and to see if I'd be able to help you out. My email is in my profile.

</comment><comment><USER3> it will be nice idea to share the startup you are talking about to get more people interested to respond.</comment>


Party City says it is closing 45 stores amid a global helium shortage - <AUTHOR> https://www.usatoday.com/story/money/2019/05/09/party-city-store-closings-2019-45-locations-shutter/1157512001/ <comment><USER2> Hopefully this will make helium supplies last longer for medical and industrial applications

</comment><comment><USER3> Just use hydrogen. It's not that dangerous.</comment>


Nobody Really Likes Google Glass  - <AUTHOR> http://www.businessinsider.com/nobody-really-likes-google-glass-2013-5?op=1

<comment><USER2> Irony:

      The Verdict Is In: Nobody Likes Google Glass
      Jay Yarow	| May 3, 2013, 12:43 PM
      http://www.businessinsider.com/nobody-really-likes-google-glass-2013-5

      I've Changed My Mind: After Using Google Glass A Second Time, I'm Blown Away
      Kevin Smith	| May 2, 2013, 4:57 PM
      http://www.businessinsider.com/google-glass-experience-2013-5

\---

[1] [http://www.businessinsider.com/nobody-really-likes-google- gl...](http://www.businessinsider.com/nobody-really-likes-google-glass-2013-5)

[2] [http://www.businessinsider.com/google-glass- experience-2013-...](http://www.businessinsider.com/google-glass- experience-2013-5)

<comment><USER3> Content Farm:

<http://en.wikipedia.org/wiki/Content_farm>

</comment></comment><comment><USER4> >I haven't worn Glass.

OK, so this is probably a useless article, but let's skim ahead and see where the author did a rigorous analysis of customer feedback, compensating for known biases... and, OK, it's just a list of cherry-picked complaints.

</comment><comment><USER5> troll article. nobody likes google glass, nobody really? I wonder who's buying google glass for thousands of dollars on ebay. It's a prototype device, that's not even available for purchase yet, and it's already being shot down? Lets wait till it is more polished and more people start using it before making such a big statement.

</comment><comment> hippee-lee I like the idea or an unobtrusive piece of technology that does a lot of what Glass will do.

However, I spent the first 28 years of my live wearing contacts and glasses. Then I got LASIK. Paying 1500 dollars to wear glasses again is not that appalling to me. Cost is not really the issue for me.

</comment><comment><USER6> From what I understand, many of those complaints are valid.

However, I could excerpt only criticism from reviews of Business Insider, title them "Nobody Really Likes Business Insider", and it would also be unfair flamebait.

</comment><comment><USER7> I really like Google Glass.

</comment><comment><USER8> I have long held that the Web is text based with photos & videos for content.

After meditating on the Google Glass concept for awhile I realized this could be the next evolution of the Web.

</comment><comment><USER9> Isn't this what a limited beta is for?

</comment><comment><USER10> Related article

[http://bits.blogs.nytimes.com/2013/05/03/the-shine-starts- we...](http://bits.blogs.nytimes.com/2013/05/03/the-shine-starts-wears-off- google-glass/)</comment>


Ask HN: Rate my startup - Backpedalify - <AUTHOR> http://backpedalify.com Sorry, we're only in private beta. <comment><USER2> While good for a "lol", doesn't anyone else hate April Fools day on the internet? It's nearly impossible to find a serious post. I can't take anything seriously on the internet for the next day or two.

Guess my productivity is going to go up.

</comment><comment><USER3> I'm very confused... who are the users of your site? Actual politicians? When I click on "Backpedal", nothing happens... Are you expecting Bush/Clinton/Gore/Kerry to actually come to your site and use it?

<comment><USER4> Its apparently a silly april fools PR stunt to get exposure for a company (see excerpt from the website blow). Is HN going to be swamped with april fools nonsense?

"Backpedalify is, of course, an April Fool's Joke. But backing up your online data is no laughing matter. Secure you online data stored in Twitter, Facebook, Gmail and more with --redacted--. Learn more about how it works."

<comment><USER3> D'oh! This is what I get for coding 12 hours in a row.

</comment></comment></comment><comment><USER5> It is an April Fools joke site linking to their Backupify service, cute...

</comment><comment><USER6> If it's a joke - I don't actually get it. I get what backpedaling is and it's funny when politicians do it - but your description on the homepage is confusing (at least to me).

</comment><comment> PG-13 For this to be funny, your actual product has to be well-known.

<comment><USER7> For you to have a nickname on this forum, you should choose one that doesn'confuse others.</comment></comment>


Show HN: Export your data from Twitter/Facebook/Gowalla/Google+ as JSON - <AUTHOR> http://export.synack.me/

<comment><USER2> Or, use: <http://lockerproject.org/> and export everything locally without it passing through someone else's web server (as well as keep your local copy of the data completely current for as long as you decide to keep your locker running.)

Full disclosure: I work on this!

</comment><comment><USER3> Nice use of the twitter bootstrap, I just started using it as well to kick off new mini projects. Just gave twitter a whirl, looking forward to seeing the export.

Also saw you are using gauges, how do you like the reporting?

<comment><AUTHOR> gaug.es is really nice for tracking social engagement and responding to traffic trends in realtime... It doesn't retain a ton of data for long-term analytics, so if you care about that sort of thing, it should probably be used in conjunction with another service.

</comment></comment><comment><USER4> It's against Twitters TOS to provide a service that can present a users tweets as a downloadable dump. This new restriction was brought in earlier this year.

</comment><comment><USER5> Why is the google+ one needed since Google takeout exists already? Also, should I trust you with my data? Why should I?

<comment><AUTHOR> The Google+ one was added by user request. Yes, you could use Google Takeout to get the data as well.

I am not storing any of the data or even your OAuth tokens after the dump has been completed. As an implementation detail, your email address may remain in a log file for up to five days.

<comment><USER6> This is an awesome project, if not because it makes the concept of exporting your data from these sites very transparent, and approachable for the average person.

If you're comfortable with releasing your code, it would be awesome to have some sort of "offline" mode where users could opt in to downloading your scripts and running them locally. That way you'd be affording ease of use and allaying anyone's security concerns. Of course releasing code opens up a whole other can of worms (maintainability, license), but until then I wouldn't feel comfortable running my exports through your sites, as much as I support the idea. Others might feel differently though, in which case the site has a ton of utility.

<comment><AUTHOR> The exporting scripts are pretty trivial just using the APIs each of these services expose. The hardest part is setting up the OAuth bits, which require a web server to host a callback endpoint. This makes it non-trivial for the average person to run the scripts and becomes a nightmare for support.

That said, I might open source it at some point just so that people can audit it and verify that I'm not doing anything malicious.

</comment></comment></comment></comment><comment><USER7> i like it. I had a similar idea a while back where users can get a dump of their fb/linkedin/twitter details.

As an aside, i figured why not have the ability to download your social graph as well (as much as possible with public profile data)

I think the next step is an api. That way other developers can use your service as an import to their apps.

That is - of course - if that interests you.

Good stuff.

<comment><USER8> I've tried to construct a social graph from my own data using the Twitter API as a side project, but it seems that the rate limiting of 350 API calls/hr really kills what I can do. Anyone have experience or insight into an approach to this?

<comment><USER9> That's 8400 calls per day. What are you trying to do with your own data that requires more calls than that?</comment></comment></comment>


Overview of the VP9 video codec - <AUTHOR> https://blogs.gnome.org/rbultje/2016/12/13/overview-of-the-vp9-video-codec/ <comment><USER2> This is a great write-up! I too thought video codec was very difficult to understand.

There are many things that look difficult are really not that difficult. they just lack good explanation.

I heard that vp9 compression is a bit slow compared to h264, which makes it not so ideal for real-time streaming use cases. is this true?

<comment><AUTHOR> It depends on speed at which you're using the encoder. At faster speeds, you'll lose some compression performance. Libvpx is still ahead compared to x264 at higher speeds, but not by as much as at their top quality (slowest speed) settings. I discussed that earlier in [https://blogs.gnome.org/rbultje/2015/09/28/vp9-encodingdecod...](https://blogs.gnome.org/rbultje/2015/09/28/vp9-encodingdecoding- performance-vs-hevch-264/) (scroll down to "encoding speed").</comment></comment>


Ask HN: How satisfied are you with the Macbook Pro TB? - <AUTHOR> <comment><USER2> I would pay TB prices for a 15" with traditional Fn keys.</comment>


VLC media player 3.0.6 and earlier: Read buffer overflow and double free - <AUTHOR> https://www.videolan.org/security/sa1901.html <comment><USER2> How can a read overflow or a double free cause remote code execution?

<comment><USER3> Because the allocation memory address patterns are pretty predictable, heap overflows can be used to modify state in an object known to be very probably adjacent. Even read overflows enable the attacker to read the required state to make some other exploit reliable.

Double free implies the attacker can control victim object's memory through another object (which the attacker can somehow influence) occupying the same addresses in memory.

So the attacker can now carefully craft state that causes the desired (=bad) behavior in the original buggy object. Or to use it to learn something about the buggy object's state, like code locations in memory (= reading C++ virtual method pointers / function pointers directly _or_ indirectly) possibly leading to defeating ASLR and other protection mechanisms. This leads into various exploit scenarios.

Hopefully I explained this well enough... it's pretty straightforward really. Especially if you step through in a debugger.

Double frees (and use after frees!) can be _very_ dangerous.

<comment><USER4> Why is the memory VLC uses marked executable? Wouldn't read/write suffice?

<comment><USER3> Not sure what you mean.

There was no mention about executing anything in the heap (or stack for that matter). I have no reason to believe VLC maps (a part of) its heap RWX (=read + write + execute). This kind of exploits don't even require memory to be executable.

C++ virtual methods cause the compiler to add vPtr (that is writable, because it's contained in the object) and vTable. Modifying vPtr can be used for making certain class execute code somewhere else (or mostly crashing :-)).

However, neither vPtr and vTable themselves are executable. vTable doesn't even need to be writeable.

If you can somehow do indirect vTable reads, you'll learn ASLR [0] base for the module. With that information you might be able to circumvent ASLR, and eventually be able to pull off code execution through a ROP [1] chain.

A C-style function pointer would be easier to use for a similar effect.

[0]: [https://en.wikipedia.org/wiki/Address_space_layout_randomiza...](https://en.wikipedia.org/wiki/Address_space_layout_randomization)

[1]: [https://en.wikipedia.org/wiki/Return- oriented_programming](https://en.wikipedia.org/wiki/Return- oriented_programming)

<comment><USER4> > This kind of exploits don't even require memory to be executable.

If this exploit is a memory leak, and the memory isn't executable, how do the malicious contents that get put into the leaked memory get executed?

<comment><USER3> Possibly through a ROP chain. Abusing VLC's code itself. You don't need memory that's writeable and executable for that. Check the Wikipedia link in my comment about ROP exploits.

<comment><USER5> Just elaborating on this. One way of looking at it is that we turn the attacked program into an interpreter thus bypassing the requirement for executability.

It turns out that a lot of programs can be tricked into interpreting a family of languages called rop chains.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Personal preference to avoid these sorts of exploits is by using a virtual machine with a browser VM from Microsoft, although by default those browser VMs are run in admin mode.

<comment><USER3> Be aware that there have been plenty of virtual machine escape vulnerabilities. If enough people did same, the attackers would start to exploit that vector. Or a target interesting enough.

VLC might run quite a bit worse as well, because hardware video decoding is most likely unavailable in a VM.

<comment><USER7> Exploits around hardware implementation of bitstream deciding is more of a constrained problem than arbitrary and legacy file formats that vlc needs to decode.

Would like it if OS's ran binaries in micro-vms by default. At least with a very much de-privileged container.</comment></comment></comment>


Ask HN: Are there any IDEs or editors that support editable views of code/text? - <AUTHOR> What I am imagining is this: The underlying file format does not change. You can specify some sort of bidirectional transformation, via regexes or maps or something. The editor presents you with an editable view of the text, with this transformation applied. When you make edits, the reverse transformation is applied to the underlying file.
Think of it as a vastly expanded version of git's 'change line feed' options. Your team likes tabs but you like spaces? Edit in spaces view - they never get into the file. Your team likes veryLongDescriptiveCamelCaseNames, but you like to kp it trs? Edit in terse view - the file is always camelCased.
I'm not really looking for a solution to one or both of these problems in particular, though. I'm really looking for an editor that even has a notion of "editable -views- of text" to begin with. Does this exist? <comment><USER2> You could implement the 2 transformations using any language you like, and then hook into your editor of choice's on-load/on-save API, to pipe the text through the external programs.

<comment><AUTHOR> Aha! I had not thought to look for such a hook. Are they common? This is very close to what I'm looking for, thank you. Then, to toggle, I guess I would automate closing and reopening the file.

Edit: Oops. Now I'm thinking this would _probably_ break all code analysis features. It would be nice if there was a notion of a 'view' that is very superficial and doesn't impact the code analysis.

<comment><USER2> All programmer editors should at least have some mechanism to notify you when loads/saves occur. But you might need to use whatever the editor's embedded scripting language is to do the actual child process launching and to do something non-standard with their output.

In Sublime Text for example, the above would be writing a Python class that handles some of these events:

[https://www.sublimetext.com/docs/3/api_reference.html#sublim...](https://www.sublimetext.com/docs/3/api_reference.html#sublime_plugin.EventListener)

...probably by making use of the subprocess module from Python's standard library:

[https://docs.python.org/3.3/library/subprocess.html](https://docs.python.org/3.3/library/subprocess.html)

</comment></comment></comment><comment><USER3> For a lite version of this, take a look at Vim's conceal patch: [http://vim.wikia.com/wiki/Patch_to_conceal_parts_of_lines](http://vim.wikia.com/wiki/Patch_to_conceal_parts_of_lines)</comment>


Get $50 for Publishing an Android App - <AUTHOR> http://aws.amazon.com/Android-development-with-AWS/

<comment><USER2> This offer shipped in November 2011...

</comment><comment><USER3> AWS credit, not cash.</comment>


Shakespeare's Vocabulary Considered Unexceptional - <AUTHOR> http://zwischenzugs.wordpress.com/2011/03/06/shakespeare_unexceptional_vocabulary/

<comment><USER2> There's more power in putting together a handful of common words in a powerful image or metaphor than a particularly apt selection of a single word, for several reasons.

Overuse of obscure words will reduce the size of your potential audience; Shakespeare wrote plays that were seen by a broad slice of the population and have humour and puns to match. It wouldn't have made sense for him to dig too far in this direction. Original words, meanwhile, are frequently formed by joining together two other words. Joyce was especially fond of this.

A vocabulary wielded almost like a weapon has far more value as a social signifier. Uncommon words are especially potent if they're capable of sending an adversarial interlocutor to the dictionary, because in the heat of the moment your opponent is left with only two choices: concede a point, or look stupid or uneducated asking what you meant.

Particularly precise words are also subject to some of the same problems that Orwell enumerates in Politics and the English Language [1]: lazy prefabricated sentence fragments that waffle around the proper thrust of the desired meaning. His essay is a strong affirmation of the value of plain English, suggesting effort be applied to original metaphor, simile and imagery instead.

[1] <http://www.mtholyoke.edu/acad/intrel/orwell46.htm>

<comment><AUTHOR> I believe Shakespeare was considered wordy and difficult by his "broad" audience. But he knew how to hit the crowd's buttons and was considered populist by the literary elite of his day. And the myth of his large vocabulary continues.

Looking through the list of unique words used by Joyce, surprisingly few of them looked invented to me.

<comment><USER2> Joyce loved making up words by joining them together. It almost seemed like he was making a kind of bid for immortality by throwing as much stuff at the wall and seeing what would stick. It's one of the most obvious characteristics of his writing; that you doubt this makes me wonder if you've read his work.

I did a download of Ulysses from Gutenberg, did an egrep -oi '[a-z]+' | sort -fu > u, then aspell dump master > d, then sort -f d d u | uniq -ui; that gives over 7000 seemingly unique words of the of the 29000 used in that book, but many of them are misspellings, transcription errors, proper nouns, Greek references, etc.

Here are a small handful selected at random; they are very probably not the best examples, as there are far too many to examine to discern that:

        crookeding
        flusterfied
        holyeyed
        languideyed
        unportalling
        dullbrained
        darkshawled
        dedale
        overarsing
        heartbalm
        seacold
        beardframed
        doaty
        birdsnies

Many of those 7000+ words that aren't in aspell's dictionary on my machine because they're archaic, legalese, obscure dialect, foreign allusions etc., but you can hardly read a paragraph without some word made up.

<comment><AUTHOR> Shakespeare's full of mis- and variant spellings too. He's also held up as an example of someone that made up words. My point about Joyce was that, if you want to hold up someone as a writer who has a large vocabulary by the standards that have traditionally been applied (as he has been), then he simply doesn't.

</comment></comment></comment></comment><comment><USER3> This kind of analysis should (also?) include checking what words were in common usage prior to the writer vs. what words originated with said writer...

<comment><AUTHOR> I'm not sure how you'd determine that; I guess you'd need a definitive and complete transcription of correctly-dated works. The OED is not a few man- hours work, and even they hesitate to be definitive :)

</comment></comment><comment><USER4> The true power of Shakespeare's vocabulary isn't in the variety of the words he used but how he used them. I'd imagine that having a complex rhyming scheme and creating original content in iambic pentameter isn't easy and the fact he pulled it off so eloquently is a testament to his mastery of the English language.

</comment><comment><USER5> Shakespeare really is the king. His vocabulary was unexceptional, his stories were copied from others and, still, yet his masterpieces are immortal.

That teaches us that we don't need either exceptional tools or ideas to succeed.

<comment><AUTHOR> Dr. Faustus ain't too shabby for a young man. I wish Shakespeare had had a go at that story.</comment></comment>


Phillips machine: Like water for money - <AUTHOR> http://judson.blogs.nytimes.com/2009/06/02/guest-column-like-water-for-money

<comment><USER2> Previously posted:

<http://news.ycombinator.com/item?id=639252>

Not much discussion there either.

</comment><comment><USER3> I read about this in Terry Pratchett's "Making Money", but I never realised that it really existed.

</comment><comment><USER4> Feels like maxflow.

</comment><comment><AUTHOR> An article on the same topic:

[http://www.americanscientist.org/issues/pub/everything-is- un...](http://www.americanscientist.org/issues/pub/everything-is-under- control)</comment>


HN Now Indicates Dupes - <AUTHOR> https://news.ycombinator.com/item?id=11816664 <comment><USER2> Just sometimes. We're still working on a more general thing.</comment>


"I came from India to get my Masters, and worked at a major tech company in SF" - <AUTHOR> https://twitter.com/humansofny/status/1148304368958992384 <comment><USER2> In US, if you are not native american - you are an immigrant. But few people don't know history. Trick is you need to get GC before your long term visa expires.

</comment><comment><USER3> His entire organization came in on work visas _in 2011_ , when the recession was still on and there were many GC and citizen tech workers out of work.</comment>


Ask HN: How to expose fraudulent software startup - <AUTHOR> With AI hype almost everyone (specially professors and academia) are coming up with AI startup. Some of them are genuine but some of them are fraudulent. Can these fraudster be indicted as done with "Theranos" founders? <comment><USER2> The answer is honestly that it depends. If the investors asked the right questions, but the answers were fudged/ deliberately incomplete, then perhaps you have something to pursue. But, if you are not asking the right questions, or you do not further evaluate answers to ascertain their correctness and completeness, then you slacked at some point, and then the answer is that perhaps you are liable for your losses.

<comment><USER3> That sounds reasonable and could be paraphrased to "caveat emptor". IANAL but I believe that's a reasonable thing for a court to decide should it come to that.</comment></comment>


Ask HN: How best to report phishing emails to a domain holder? - <AUTHOR> I have received a phishing email from an email address using the Northeastern Illinois University. I cannot find and address to which to send an email regarding this and get no response on Twitter.<p>What is the best way to report this? <comment><USER2> I would send emails to email@example.com and firstname.lastname@example.com. In addition, you could perform a whois lookup on the domain to get the Technical Contact: [https://who.is/whois/neiu.edu](https://who.is/whois/neiu.edu) and send an email to email@example.com

If you wanted to take it another step forward, here are the folks you could probably contact: [https://ssb.neiu.edu/mercury_neiuprod/GZKDIRL.P_DISPLAY_DEPT...](https://ssb.neiu.edu/mercury_neiuprod/GZKDIRL.P_DISPLAY_DEPT_DETAILS?alpha_in=Technology+Services)

Hope this helps.

<comment><AUTHOR> Thank you very much for the information.

</comment></comment><comment><USER3> If nothing else, send a report to firstname.lastname@example.com. If NEIU is a member, the folks at the watch desk will have te ability to immediately get in touch with someone in security there.

I'm no longer at an .edu (and so no longer a member of REN-ISAC) but this was a great, quick way to get ahold of someone at another institution quickly.

(n.b.: This goes for pretty much any .edu.)

</comment><comment><USER4> It's also entirely possible that the email isn't being sent by them or anyone affiliated with them. FROM headers on email are miserably easy to spoof.

I've had thousands of spam emails sent with senders listed as nonexistent addresses from one of my domains. They were sent from third-party servers (my servers were not compromised and I had no open relays), and I only found out because of all the bouncebacks from naive receiving servers.

The only thing the domain holder can do at that point is to set up DomainKeys and similar measures - which still won't prevent spammers from using the domain, it'll just cause more of the mail to bounce back as spam.

<comment><AUTHOR> Thank you very much for that information. I was wondering what one can do if the email address is actually spoofed and not coming from the domain it seems to.

<comment><USER5> You need to watch the email headers and look for the originating IP. Then you'll see if the presumed FROM address is what it says.

If it's an spoofed email, send an abuse report to the owner of that originating IP [+], including full headers and full body text.

[+] If the originating IP is from a country you know it won't give a shit, look for the next jump.

</comment></comment></comment><comment><USER6> First check the domain registration record. Many domain registrations include an abuse or technical contact, or at least an administrative contact.

If not, try abuse, postmaster, webmaster, et al like suggested by others already.

</comment><comment><USER7> Additionally, I send phishing emails to email@example.com which alerts the Anti-Phishing working group... Not sure what happens once they get my forwarded emails...

</comment><comment><USER8> I normally send to admin@, abuse@, phishing@, and hope that at least one don't get kicked back.

</comment><comment><USER9> >What is the best way to report this?

Flag as spam and move on with your life.

<comment><AUTHOR> While I appreciate your view of simply brushing it off I would really hope that someone would pay me the common courtesy of letting me know when people are spoofing or spamming from a domain I own.</comment></comment>


World's first hummingbird-like unmanned aircraft system takes flight - <AUTHOR> http://www.gizmag.com/aerovironment-nano-hummingbird/17918/

<comment><USER2> Real hummingbirds are the most energy intensive birds. They have a very low margin for error, a few hours without feeding at best.

<http://www.blurtit.com/q890088.html>

"A 4-gram hummingbird has a basic metabolic rate of 1,400 calories per gram. In repose, a hummingbird's metabolism rate is 25 times that of a domestic fowl. If a person had such a high metabolic rate, he would have to eat twice his body weight daily, his temperature would be 750 degrees F, and he would consume 155,000 calories per day."

It's probably marginally better than helicopters.

</comment><comment><USER3> That is the first ornithopter that I've seen that seems to demonstrate flying capabilities similar to those of birds - something which might be very -other than- only for the curiosity of a plane that flies by flapping its wings. Color me excited.

</comment><comment><USER4> Anyone know its battery life? I'd think at least 20 minutes of flight time would be needed to take this from expensive cat-toy to a surveillance tool.

<comment><USER5> At least 11 minutes (DARPA requirement mentioned in the article).

</comment></comment><comment><USER6> I think it's neat how, at times in the second video, the wings are phased with the camera, so it looks like they are completely stationary.

</comment><comment><USER7> It won't take long before this gets weaponized. Then safety as well as privacy will suffer mightily.

<comment><USER8> It's difficult to name a technology of which this is not true.</comment></comment>


The Startup Playbook - <AUTHOR> http://startup-playbook.com/ <comment><AUTHOR> The Startup Playbook is #1 on Product Hunt today - [https://www.producthunt.com/posts/the-startup- playbook-2](https://www.producthunt.com/posts/the-startup-playbook-2)

Also, the Kindle edition is on sale for $0.99 for the first week - [https://www.amazon.com/Startup-Playbook-Founder-Founder- Vete...](https://www.amazon.com/Startup-Playbook-Founder-Founder-Veterans- ebook/dp/B078QCRYWJ)</comment>


AWS Just Started Folding - <AUTHOR> https://forums.anandtech.com/threads/aws-just-started-folding.2578802/ <comment><USER2> Let's be clear here: this is about protein folding.

I almost panicked for a moment thinking they were folding in some sort of business sense, before realizing it would take far more than what's currently going on for AWS to fold.

<comment><USER3> Azure has been having a really tough time during all of this so my head went there too

</comment></comment><comment><USER4> Oh, spot instances to save lives!

There is also [https://covid19-hpc-consortium.org/](https://covid19-hpc- consortium.org/)

      COVID-19 High Performance Computing Consortium

      Members: a lot of universities, federal agencies, NASA, US DoE, IBM, Amazon Web Services, AMD, Google Cloud, Hewlett Packard Enterprise, Microsoft, NVIDIA,

compute muscle -> Over 402 petaflops, 105,334 nodes, 3,539,044 CPU cores, 41,286 GPUs, and counting.

To join - go to [https://www.xsede.org/covid19-hpc- consortium](https://www.xsede.org/covid19-hpc-consortium)

Just curious - are Apple/FB doing anything about it?

EDIT: Apple is helping in a different way ([https://www.theverge.com/2020/4/5/21209270/apple-face- shield...](https://www.theverge.com/2020/4/5/21209270/apple-face-shields- masks-covid-19-coronavirus))

</comment><comment><USER5> The teams are quite fascinating. A diverse bunch of national teams, and community teams from tech websites to the skeptics community to Bronys to Free Republic, the Republican mega-forum?

[https://folding.extremeoverclocking.com/team_list.php](https://folding.extremeoverclocking.com/team_list.php)

HN should start one.

</comment><comment><USER6> So I'm curious, we have a tendency on HN to assume every problem has a technical solution; from autism to inmate rehabilitation, from food insecurity to poverty, solutions are just one good SaaS idea away.

Is covid@home really going to solve this by donating cpu cycles before traditional medical research creates a vaccine? Is turning coal into code (ala Bitcoin) that productive in this case? Because I've run the app but feel like I'm in some kind of techbro bubble to believe I'm making even an iota of difference

<comment><USER7> (I'm paraphrasing people here and I may have mangled what they're saying, sorry)

This thread has some useful commments, one from someone who's actually done F@H research, another from someone who mentions the length of time it takes to get a medication trial through the system (without covid-19 easements) and how few trials actually make it.

There's a bit of discussion around the cost in electricity, and whether it's better to just send that money somewhere.

[https://news.ycombinator.com/item?id=22491910](https://news.ycombinator.com/item?id=22491910)

This post links to a blog that talks about F@H that you may be interested in.

[https://news.ycombinator.com/item?id=22662026](https://news.ycombinator.com/item?id=22662026)

This post is from someone who is a researcher who says that F@H is a form of science, and so it should continue, but that it's probably not as directly applicably useful as F@H says.

[https://news.ycombinator.com/item?id=22576088](https://news.ycombinator.com/item?id=22576088)

</comment></comment><comment><USER8> So... can we add "@ Home" to this title? Cuz I was like "WHOA how is AWS possibly going out of business?"

</comment><comment> swagasaurus-rex What am I seeing? The chart is blurred out.

<comment><USER9> Click though to [https://folding.extremeoverclocking.com/team_summary.php?s=&...](https://folding.extremeoverclocking.com/team_summary.php?s=&t=238068)

I'm still not sure what this is. Who is ec2spot??

My guess is that maybe Amazon installed the Folding client on some part of ec2 capacity in an idle pool waiting to be launched?

I'm not sure. That would use quite a lot of power... and setting up networking and getting approval to do this would be a ton of work.

<comment><USER10> EC2 "Spot Instances" are unused instances that you can bid on if cost belows x price. I would assume they are using those unused ones.

</comment></comment></comment><comment><USER11> Why has this article been flagged?

<comment><USER12> I'm going to guess because it's pointing to a forum post which is just a link to the article, and the title is misleading.

<comment><USER13> And maybe because 'folding' could mean 'starting to crumble' or anything else related to business continuity management.

I suggest changing the title to Folding@home, the more common name for this type of project.

</comment></comment></comment><comment> louis-paul Slightly better context: [https://forums.aws.amazon.com/message.jspa?messageID=938560](https://forums.aws.amazon.com/message.jspa?messageID=938560)

</comment><comment><USER14> Is amazon the corporation putting in the cpu time or an individual paying for aws to do this?

</comment><comment><USER15> So, anyone want to hazard a guess at what their bill would be?

</comment><comment><USER16> No information in the link.

</comment><comment><USER17> Can anyone explain to me what I'm looking at?

<comment><USER18> The link in the Anandtech forum points to the ExtremeOverclocking leaderboards for Folding@Home, which is a Stanford project to do distributed protein folding. They're currently placing COVID-19 related projects at max priority.

My understanding is that Amazon is devoting a chunk of spare AWS capacity to folding for the project. In the last week or so, they've done about 300k work units (essentially they've run that many simulations all the way through).

</comment></comment><comment><USER19> As usual ... Wikipedia [1] has a better explanation than the actual site [2], sigh.

"Folding@home (FAH or F@h) is a distributed computing project for performing molecular dynamics simulations of protein dynamics. Its initial focus was on protein folding but has shifted to more biomedical problems, such as Alzheimer's disease, cancer, COVID-19, and Ebola."

1: [https://en.wikipedia.org/wiki/Folding@home](https://en.wikipedia.org/wiki/Folding@home)

2: [https://foldingathome.org/](https://foldingathome.org/)</comment>


Zuckerberg blasted for censorship of Pulitzer prize-winning photo - <AUTHOR> http://www.theverge.com/2016/9/9/12859686/facebook-censorship-napalm-girl-aftenposten <comment><USER2> Norwegian Prime Minister has posted it on her official Facebook page in response to this too, and they removed that post as well.

EDIT: As well as the Norwegian Minister for Culture.

EDIT2: Here's an article about the PM posting it (in Norwegian; Google translate ought to do an ok job): [http://www.dagbladet.no/kultur/facebook- fjernet-ernas-bilde/...](http://www.dagbladet.no/kultur/facebook-fjernet- ernas-bilde/62449143)

<comment><USER3> Excellent, that should teach those idiot Norwegians a thing or two about where they stand on the totem pole of power.

Facebook > Every other country on the planet

Facebook is a country because it is acts as an independent sovereign state which is not answerable to anyone at this point. Apparently, it already makes up its own taxation laws[1].I expect them to release their own flag, maybe a national anthem?

[1] [http://www.forbes.com/sites/kellyphillipserb/2016/07/29/face...](http://www.forbes.com/sites/kellyphillipserb/2016/07/29/facebook- ignores-another-irs-summons-reveals-it-could-owe-billions-in- taxes/#71ea3ae30bfc)

<comment><USER2> As an "idiot Norwegian", I think you'll find Facebook better thread carefully here. They've now pissed off and censored multiple high level politicians, two of the largest national newspapers, and several high profile writers, pouring gasoline on a long simmering debate over whether they are a threat to democracy...

If they want e.g. to have Norwegian brands willing to be associated with and advertise on their platform, they'll need to step carefully, because they're getting dangerously close to it being a PR coup of higher value for companies to publicly announce they won't spend money on advertising on Facebook, than the return of actually advertising on Facebook.

Of course, they can live without the Norwegian market. What they can't live with would be if this debate also start taking off elsewhere. And this has already led to articles in a number of major international newspapers, and it will get a lot more attention before it subsides.

<comment><USER3> Obviously it was sarcasm. If you read my comment history, you would notice that I keep railing against FB every chance I get.

<comment><USER2> I didn't take any offence, but I'm pleased to hear I didn't catch the sarcasm.

<comment><USER3> I could have omitted that first sentence. What I meant was that I didn't expect a serious response to a comment of mine which was intended to be only sarcastic.

</comment></comment></comment></comment></comment></comment><comment><USER4> See also: "Dear Mark. I am writing this to inform you that I shall not comply"

[https://news.ycombinator.com/item?id=12457004](https://news.ycombinator.com/item?id=12457004) (13 hours ago, 175 comments)

</comment><comment><USER5> _" We try to find the right balance between enabling people to express themselves while maintaining a safe and respectful experience for our global community. Our solutions won't always be perfect, but we will continue to try to improve our policies and the ways in which we apply them."_

Does anyone else find these sorts of vague, bland, verbose, and somewhat doublespeak-ish "non-answers" a bit tedious to read, and tiresome? This "whatever" tone seems to have taken over a lot of PR these days, and I've met people who actually speak like that. It's a lot of verbiage and feels more like they're saying what amounts to "we'll say we're trying, but we don't really care all that much about the edge cases".

</comment><comment><USER6> Evil mega corp does evil shit. News at 11.

Seriously. Stop it with the "dear mark" letters. Stop telling yourself Facebook can improve and it just needs to know what the community wants.

<comment><USER7> Snarky commenter comments on the vanity of it all. It's so easy once you get started :)

<comment><USER6> Im not being snarky. Im completely serious.

Facebook is a fucking cancer on society and technology. I imagine when Zuckerberg watches 007 Tomorrow Never Dies, he probably sees Elliot Carver as the ultimately unsuccessful hero.

</comment></comment></comment><comment><USER8> I don't think that Zuckerberg/Facebook is to blame. The system that allows so much power in so few hands is to blame and should be improved.

The good thing about capitalist democracies used to be that the decision making was distributed between a large amount of actors. When you have an economy where most companies are monopolies/oligopolies you end with something closer to feudalism than to an actual democracy.

<comment><USER6> Yeah, this is very much a case of 'Fool me once, shame on you. Fool me twice, shame on me.'

Facebook has shown its hand many times before, if you're still giving them content to attract products (i.e. eyeballs) to their platform, you're as much a part of the problem as Facebook itself.

</comment></comment><comment><USER9> A couple days ago there was an entry about how European startups fail to scale because they don't take time to understand how their audience differ in the countries they expand. :)

<comment><USER2> That's a baffling sentiment to me, as to me one of the key advantages I've seen for European companies internationally is that most are forced to face cultural and legal differences from day one, while US companies often take a very long time to expand abroad exactly because they for a long time have the luxury of ignoring cultural differences, and very often end up with bizarre approaches when they're finally forced to acknowledge the rest of the world...

</comment></comment><comment><USER10> People complaining because it's a famous award winning photograph but still gets treated like every other photograph with nude kids in it?

I can just imagine them saying "It's just art bruh"

<comment><USER2> What do you mean "like every other photograph with nudge kids in it"? Because most countries do _not_ have laws against photographs with nudge kids in it. Most countries have laws against _child porn_. Yes, there are difficulties discerning the difference sometimes. This is not one of those cases.

In the case of Facebooks specific censorship, the issue is also not that she was a child in the photo, but nudity in general.

<comment><USER10> It's not against the law?????? OMG! Oh wait... did I say anything about it being against the law? Exactly. Facebook does not allow nudity. Get over it.

<comment><USER2> You did however make a point of it being a kid, which under Facebooks rules is irrelevant. And no, I won't get over it - Facebook is now so ingrained in culture and the exchange of ideas that their censorship is becoming a problem.

</comment></comment></comment></comment><comment><USER11> While I disagree with the censorship and removal of the entire post, I can't see why they couldn't reach a compromise where the photo is censored to either blur or obscure the nudity yet still retain the message. Keeping it obvious that Kim Phuc is nude, while actually censoring the specific nude areas that Facebook disallows, would retain the message and historical significance.

The approach Facebook should have taken was to remove/censor the photo itself but keep the post and all relevant discussion unmodified, until a photo/set of photos that abide by their terms was added to replace the offending images. The message isn't that Facebook is censoring war discussion and history, it's that some content of the images themselves are not permitted and that content should be what is censored.

<comment><USER12> Why should nudity be disallowed in the first place, though?

The photo is clearly not sexual or pornographic. As for censoring it partially: Are we really totally fine with seeing someone burned by napalm, just not with seeing their genitals?

The photo is arguably one of the most famous pieces of photojournalism, and helped shape our civilization. I remember seeing it for the first time in my elementary school history book, even: it can't be that inappropriate.

I understand why they wouldn't want Facebook to degenerate into a porn (or borderline porn) filled website. I think they simply are relying too much on automated systems to remove content, and don't have a good appeal system in place.</comment></comment>


How did America's police become a military force on the streets? - <AUTHOR> http://www.abajournal.com/magazine/article/how_did_americas_police_become_a_military_force_on_the_streets/

<comment><USER2> I wondered about this a few years ago when my bus stop in Redmond, WA was moved temporarily and I had to walk by the police station to get to the bus. In the parking lot sat an armored personnel carrier. What in the hell does Redmond, a town of 50K at the time and about as low on crime as you're going to get, need with an APC? And what excuses does the PD find to use it? This in a town where one patrol cop, when interviewed during a ride-along by the local paper, stated that patrol is pretty boring in Redmond.

At first I thought that they got it cheap or free, but it still costs money. Personnel have to be trained and regularly drilled, and maintenance isn't free. When money is being spent, it's going to get used. And I can't help but think of Barney Fife when I think of quiet little Redmond's PD running around in an APC.

<comment><USER3> Hah! I too, have seen that V150 APC driving around Redmond and wondered why they have such a thing. I talked to an acquaintence, an engineer for the city of Redmond, and he told me that the tires are so fragile on hard surfaces that the little buttons they use in lane dividers can shred the tires, each of which is several thousand dollars and each of which have had to be replaced a few times.

<comment><USER2> A couple grand to put tires on the department's penisMobile, huh? _sigh_ I think it's time to run for Redmond city council again. The question is: has any candidate for any city council ever won a seat after saying he'll cut the police department's budget? :-) Which might explain how police departments arrived at their current state to begin with.

<comment><USER3> You should. The license plate cameras, the elaborately stealthy cars, the motorcycles that look as though they came from Tron, the smart car parking enforcement cars festooned with electronics... All of it seems a bit exquisite given what I perceive to be a low risk environment. But, then, I am just guessing and I do understand how much better and effective a job can be done with good equipment.

</comment></comment></comment></comment><comment><USER4> It is odd that a law school professor should take that view of the constitution; after all, it primarily regulated the duties and powers of the federal government and its relations to the states. I think that a lot of things are wrong with the way that the US does policing. But to pretend that the constitution gives a detailed description of the principles of right government is absurd, and done by one who teaches law implies either willful ignorance or sophistry.

</comment><comment><AUTHOR> Excerpt from a book by Radley Balko, The Rise of the Warrior Cop (link: [http://www.amazon.com/Rise-Warrior-Cop-Militarization- Americ...](http://www.amazon.com/Rise-Warrior-Cop-Militarization- Americas/dp/1610392116))

</comment><comment><USER5> Chapter 12:

[https://mises.org/rothbard/newlibertywhole.asp#contents](https://mises.org/rothbard/newlibertywhole.asp#contents)

</comment><comment><USER6> I've never understood that about America. You guys have weak doors. In Western Europe you have brick houses, heavy double glazing, and the outer doors are solid wood or stretched metal, or one of the very heavy plastics reinforced with metal bars. The walls, nearly all of them, are concrete or brick. Security doors are reinforced concrete. Lately there has been a big push (by the police) to replace traditional locks with security locks and put locks and shutters on the windows, security doors, ... complete with tax breaks and a personal advisor (police would come down and do a security survey of your house if you wanted them to. They'd index all the entrances and exits, point out where there would be no visibility, tell you to have at least one locked barrier inside the house, ... Then give you the report, and I don't think they even kept a copy. Not that it would help them that much to get in). Windows get double tax breaks : better security and better isolation.

The big problem they're trying to protect against is power-tool equipped robbery gangs coming in from outside of the country, but within the EU.

Frankly, given the response to self-defense these days (intrusion = 1 year probation, hurting an intruder goes from 6 months to 10 years, but guaranteed not to be fully probation), you're pretty much forced to do things this way, plus it's a lot safer.

If the police wanted to kick down my door (previous owner installed a security door) ... they'd have to bring a tank, or heavy power tools, and it would take them 20-30 minutes to get in. SWAT teams exist of course, and they regularly get into that situation. Person locks himself in with drugs, and they need the entire afternoon to get past the door of the house.

Then you go visit America, and you see American houses. I'm not exactly fit anymore, but I'm pretty sure I could kick down one of those doors. The windows do not resist a light tap (average West European windows will easily resist a football getting kicked into them, good ones will resist a hammer, and when they do shatter, they shatter like plastic does, which still doesn't give you access without 10 minutes of cleanup)

Always wondered why that is. Is it just cheaper ?

<comment><USER2> Cheaper, and in most cases it's good enough. I often read British motorcycle magazines, and I'm shocked at the anti-theft tips in the mags. Sure, you've got your usual tips on locking it when you're out. No biggie, I use a disc lock a lot of times myself, and wouldn't leave a bike on the streets of NYC without some serious locking equipment. But the difference really set in when one sportbike mag had a list of preferred baby monitors to use for the garage. That's for after the thief has broken into your garage ( _could_ happen in the U. S.), and is now working on extracting the bike from the anchor that holds the bike to the floor (I don't think they even sell these in the U. S.) _while you 're in the house_ (in which case a thief stands a non-zero chance of being shot in the U. S). It does make me wonder what the hell is going on over there in Britain.

I won't even try to explain what the difference is, but it has never even occurred to me to wonder if my windows can resist a hammer (I doubt they could, but have no idea). Granted, I live in a boring suburban town (see comment elsewhere: Redmond, WA). And when the Redmond SWAT team brings their APC and wants in, it won't take them long. And the bastards will probably shoot the two pit bulls before they realize they have the wrong house.</comment></comment>


Ask HN: Is the UX of a typical microwave oven optimized for 1 minute cook times? - <AUTHOR> It just seems that it can't possibly be a coincidence that heating for 1 minute works so well for such a wide variety of food items. A great deal of thought must have gone into the power settings? <comment><USER2> Not really -- I suspect it's a coincidence. Consider that different microwaves have different magnetrons with different power levels, kitchens have different available line voltages, a big microwave in a modest kitchen is likely to drag down the line voltage while running, and even the food put into the microwave is likely to vary in its mass and density (for a given portion size). That's a lot of uncontrolled variables.

It's likely that, if you cook the same thing every day, you may unconsciously adjust the portion size to match up with your microwave's traits.

> A great deal of thought must have gone into the power settings?

Believe me, users are expected to decide which settings work for them. Microwave power levels typically fall in the range between 600 and 1200 watts, so obviously a power setting of 10 on the small unit should equal 5 on the large one -- or, to put it a different way, one minute on the 600 watt unit should equal 30 seconds on the large unit.

</comment><comment><USER3> Other microwave tricks:

1) When using timed cook, it's often faster to repeat the same digit (e.g., 2:22) than to type different digits (2:30). And it yields pretty much the same result.

2) The "\+ 30 seconds" button usually will also _start_ the microwave if it's off and set the timer for 30 seconds. (It's not just for adding time to an existing timer.)

3) Turn off the beeping alarm. It's annoying. Most microwaves have an option for this.</comment>