I Know What You Download - <AUTHOR> https://iknowwhatyoudownload.com/en/peer/ <comment><USER2> This can be used for amusement, but is in no way reliable to know what you (or anyone else) downloads. It could possibly act as a starting point to track what someone is downloading/seeding when used with other mechanisms.

 _> How we collect data_

 _> Our system collects torrent files in two ways: parsing torrent sites and listening DHT network. We have more than 1.500.000 torrents which where classified and which are using now for collecting peer sharing facts (up to 200.000.000 daily). We don't guarantee we can show ALL peer sharing facts:

> Single IP address could be assigned to multiple users. It depends on user's > ISP. For example mobile operators often used this schema._

Self-explanatory, but this could also be the case for home broadband where CGNAT is used. This means your public torrent downloads (or even if you don't have any downloads) will be seen along with many others' downloads as a single list.

 _> IP address could be dynamic. In such case it changes every time user connects to the Internet or periodically._

Again, self-explanatory. Unless one obtains and uses a static addresses (not the default for most home connections), what you see here could be somewhat similar to the previous point.

 _> User could download torrent which we don't have_

Aka private trackers and torrents, which is what many people who know how to torrent and do it regularly would drift towards. The torrent files from private trackers set a "private" flag that makes the torrent client disable features like DHT (distributed hash table) and PEX (peer exchange) for those torrents. So unless you have a working account on the tracker and join a swarm, you cannot find out about other peers from public sources.

</comment><comment><USER3> Can someone explain this:

[https://iknowwhatyoudownload.com/en/peer/?ip=18.104.22.168](https://iknowwhatyoudownload.com/en/peer/?ip=220.127.116.11)

?

<comment><USER4> Probably the first stages of the blue goo infiltrating our cyberphysical infrastructures. Prepare to be disassembled for scanning!

</comment></comment><comment><USER5> Not a single one of the links listed is correct for me. (And I am not NAT'd.)

<comment><USER6> unless you pay extra for a static ip, there's bound to be false-positives on a site like this.

<comment><USER5> I've had the same IP for months now.

<comment><USER7> Multiple homes/routers/connections can be assigned the same IP.

<comment><USER8> They said they aren't behind CGNAT

<comment><USER5> Clicking through on a particular torrent, till I get the IP list for that torrent, my IP doesn't actually show on that list.

So I suspect a bug in the display, perhaps if you download nothing, it shows incorrect info?

</comment></comment></comment></comment></comment></comment><comment><USER9> I do wonder how their categorizations work. There are lot of things classified as Movies that are clearly TV shows. This doesn't bode well for what they call "Child Porn". If they sell the lists of these IPs, it's rather scary to think it's as reliable as their Movie or TV filters.

</comment><comment><USER10> MacOS Mojave/Safari, Toronto, Canada. Dunno why, but I got nothing.

I just didn't see anything in the list. _shrug_ I guess it didn't work for me.

<comment><USER11> You're not downloading popular torrents on public trackers?

<comment><USER12> Is that surprising? I would assume the vast majority of people don't download torrents if I had to guess.

<comment><USER11> Not at all, I was proposing why the list would be empty.

</comment></comment></comment></comment><comment><USER13> Well that was pretty interesting. Nothing listed for my external IP as I expected. But I hopped onto one of my VPN providers endpoints and got a huge list - mostly TV shows, movies, and porn. Not exactly unexpected but still neat to see.

<comment><USER14> I believe now that you're on the list they'll track what you download?

<comment><USER15> I think they have just been joining the most active torrents on popular trackers. You can't watch for what somebody torrents just with their IP address, you have to be watching the torrent itself.

</comment></comment></comment><comment><USER4> Unreliable. My ISP in Hamburg, Germany recently got some Iranian and Ukrainian IPv4 space allocated. And it locates me in Aachen, about 500km/310 miles to the southwest.

</comment><comment><USER16> Well, not sure what I expected, but my (dynamic) IP was used about a week ago to download a porn torrent and it's the only item listed.

</comment><comment><USER17> This is why you should never torrent without using a VPN and/or seedbox. I'm partial towards put.io myself.

</comment><comment><USER18> Anyone else finding a crapton of porn? Because I'm finding crapton of porn.

</comment><comment><USER19> Does this work for anyone?

<comment><USER20> It shows some of my torrent downloads tangled with tons of other torrent downloads that are not mine. Looks like it's showing all downloads for a particular IP and my ISP uses shared IP for multiple customers.

<comment><USER21> Wait what, ISPs NAT their customers now?

That's just not cool

<comment><USER22> Well we have run out of IPv4 and ISPs aren't in a hurry to adopt IPv6. Also, isn't this common in apartment complexes?

<comment><USER21> ...now that I think about it I think I was NATted before; I just wasn't smart enough to know what it was at the time. Now you have made me think.

Fun fact: the college I graduated had a /16 with a student population of ~4k. Every single device got it's own public IP address.

</comment></comment></comment></comment></comment><comment><USER23> All I see is a generic page plastered wall to wall with ads.

</comment><comment><USER24> Nothing for me on my static ip

</comment><comment><USER25> Redirects from https to http.

</comment><comment><USER26> Why is this flagged?

<comment><USER27> Because users flagged it.

A better question might be, "why did you flag this post?", although those who did won't likely see your comment.

Edit: Your account is from 2012, are you still learning how this site works?

<comment><USER26> I do know how the HN works. But I can't see who flagged it. So it's really a genuine question - I don't see anything about the site that is against the guidelines. And I'm trying to understand why whoever flagged it did so.

<comment><USER28> For posts, flag seems to be a proxy for the missing downvote button, to many users. Sad, but that's the way it goes.</comment></comment></comment></comment>


Magento eCommerce PHP Remote Code Execution - <AUTHOR> https://ma.ttias.be/magento-ecommerce-php-remote-code-execution <comment><USER2> Unless it got significantly better/redesigned in the last couple of years, Magento is a piece of junk.

Arguably it's been years since I worked with it, but installation was weird, developing is slow a cumbersome, documentation was lacking, search was pretty much broken and it was slow. I can't image running it on a shared host, performance must be terrible.

On the positive side Magento does have an impressive amount of features.

<comment><USER3> Magento code in general is of very dubious quality. I once ran a quick static analysis on it and found some ridiculous results: [https://twitter.com/jlas_/status/391615992473722880](https://twitter.com/jlas_/status/391615992473722880)

<comment><USER4> While it could be better written, that's just their installer, it doesn't run in production by its very nature so might be a low priority for coding standards.

If you wanted to call them out, at least call them out for something which actually runs during normal operation.

<comment><USER5> Whoever wrote Magento thinks 777 permissions are ever the right thing to do.

Every book I've ever seen on Magento seems to think the same. That 777 permissions are _just not a big deal_.

<comment><USER6> From [http://devdocs.magento.com/guides/m1x/install/installer- priv...](http://devdocs.magento.com/guides/m1x/install/installer- privileges_before.html) :

"All directories have 700 permissions (drwx</comment></comment></comment></comment></comment><comment>). 700 permissions give full control (that is, read/write/execute) to the owner and no permissions to anyone else.

"All files have 600 permissions (-rw</comment><comment>-)."

<comment><USER5> From the Magento Enterprise tarball, which we pay enormous sums of money for: [https://news.ycombinator.com/item?id=9417235](https://news.ycombinator.com/item?id=9417235)

</comment></comment><comment> jay-saint Admin and developer of two Magento based sites here.

Magento has just started posting notifications of these vulnerabilities in their notification center. They sent two messages. One on April 16 and another on April 19. See images of message here [http://imgur.com/a/edVGy](http://imgur.com/a/edVGy) they did inform us that a press release with the vulnerability was coming.

That said I am annoyed that the patch was from February 2015 and October 2014. If you do not go to this page [https://www.magentocommerce.com/products/downloads/magento/](https://www.magentocommerce.com/products/downloads/magento/) on a regular basis there is no way that I know of to get same day notification of new patches.

<comment> jay-saint One extra note for those who may run their Magento install on a shared host. You will likely not be able to use the patch as is. It is distributed as .sh file that requires SSH and permissions that are not available on most shared hosts. This is a serious shortfall of this patching method. You should create a trouble ticket with support and they should be able to run the patch scripts for you.

<comment><USER7> I agree for the most part here. But it's not totally insurmountable. Patch against your local development and/or staging copy then upload the changed files to your shared host.

</comment></comment></comment><comment><USER8> Dutch's largest Magento hosting company Byte released a online testing tool: shoplift.byte.nl

Btw, see the comments section in Mattias' blog post, you will see that Magento themselves admitted that they have "no automated tests" whatsoever. And 2+ months out, they haven't bother to updated the latest code release with the new patch in.

Do you still trust Magento stores on the Internet? I don't.

<comment><USER9> "Dutch's"? I assume you mean the Netherlands since Dutch is the language, not a country or anything. This would be the same as saying "English's largest Magento ...". Alternatively you could say "The largest Dutch Magento ..."

<comment><USER8> Thanks.

</comment></comment></comment><comment><USER5> > It boggles my mind why Magento would willingly distribute unsafe code this > way, assuming users would just find out to download the patches separately.

Because Magento are OBSERVABLY INSANE.

This is from the Magento Enterprise tarball. I can't say how much we're paying, but I can say it's public knowledge that it's _at least_ $13,000 a year:

      $ grep -r chmod app | grep 777
     app/code/local/Gorilla/Heartbeat/Helper/Data.php:  chmod($logDir, 0777);
     app/code/local/Gorilla/Heartbeat/Helper/Data.php:  chmod($logFile, 0777);
     app/code/core/Mage/Install/Model/Installer/Console.php:   @chmod('var/cache', 0777);
     app/code/core/Mage/Install/Model/Installer/Console.php:   @chmod('var/session', 0777);
     app/code/core/Mage/Install/Model/Installer/Config.php:   chmod($this->_localConfigFile, 0777);
     app/code/core/Mage/Compiler/Model/Process.php:   @chmod($dir, 0777);
     app/code/core/Mage/Catalog/Model/Product/Attribute/Backend/Media.php:  $ioAdapter->chmod($this->_getConfig()->getTmpMediaPath($fileName), 0777);
     app/Mage.php:   chmod($logDir, 0777);
     app/Mage.php:   chmod($logFile, 0777);

<comment><USER6> The first two are a third party module. If 0777 is objectionable then I'm surprised you are using the module or haven't at least patched it - not trying to snark, just wondering if there's some additional context.

There don't seem to be any specific vulnerabilities related to these permissions, though I'd like to see them go away. It's my understanding that 777 will not exist in Magento 2.

<comment><USER5> >The first two are a third party module.

As I said: Magento Enterprise tar ball, supplied at considerable expense straight from Magento. Magento bears full responsibility for the contents.

You really seriously just don't have any excuse for this sort of thing.

> There don't seem to be any specific vulnerabilities related to these > permissions, though I'd like to see them go away.

Only someone working for Magento could claim 777 is ever not a hideously terrible idea to have in the webroot of a PHP application. This is frankly insane behaviour. It's like running applications as root in the general case and saying "well, we haven't found a vulnerability _yet_." YOU REALISE PEOPLE PUT REAL MONEY THROUGH THIS THING.

> It's my understanding that 777 will not exist in Magento 2.

I look forward to it.

<comment><USER6> > _As I said: Magento Enterprise tar ball, supplied at considerable expense > straight from Magento._

Is this a download from the partner portal? I've asked support to check, but you can probably point out the source much more quickly than I can track it down.

> Only someone working for Magento could claim 777 is ever not a hideously > terrible idea to have in the webroot of a PHP application

I did _not_ make this claim. I stated that I wish it were not there. It's not necessary, as the kinds of environments in which 777 are necessary are a problem unto themselves. These instances are borne of legacy concerns which pre-date my arrival to Magento by 6 or 7 years. Pity they were not patched before now

Have you ever filed a bug report for this issue? I can imagine you might say, "I shouldn't _have_ to," (and I agree), but it's remarkable what even a single ticket can do.

In general, it's unfortunate that Magento 1.x development and bug tracking are so... _internal._ In contrast to the visibility and interaction present at [https://github.com/magento/magento2/issues](https://github.com/magento/magento2/issues) it's clear that _everyone_ is better off. Of course, we have to consider how to have the same kind of open dialogue for Enterprise Edition, and we're working out how to do that. Would you care to participate in a private GitHub repo, or can you suggest some other medium? Really, neither you nor I should have to spend time writing about the 777 issue - an open dialogue would likely have led this to be fixed years ago, so we could spend time bemoaning & fixing other issues!

</comment></comment></comment></comment><comment><USER10> Regardless the way Magento releases the patches, the most annoying thing is hiding them behind the login form, making it impossible to apply from the console. You can install Magento via SSH, but you cannot apply security patches the same way - I am not able to understand this. I know, there's a business behind this, but open source in Magento meaning is somehow strange.

</comment><comment><USER11> There's been 10 patches (2 with remote code execution exploits) and no version bump. Are they trying to make it seem like their product is more secure or stable by not incrementing the version?

</comment><comment><USER12> Where can one find analysis of this vulnerability? There are no details in checkpost blogpost revealing vulnerability. I assume its serious and real if magento releases patches but would be cool to be able to judge myself.

<comment><USER13> It will be released in the next day or 2 so people will have time patching up their systems.

</comment></comment><comment><USER14> Vuln tester @ [https://shoplift.byte.nl](https://shoplift.byte.nl)

I just did a global scan: still 100K shops are still unpatched today. According to builtwith.com, that's about 45% of the install base.

</comment><comment><USER15> This is hardly unique to Magento. Lots of applications do this. It's not ideal, but it's not SO bad _if_ the application nags you to patch on start up. I don't use Magento, so I'm not sure if it does.

<comment><USER16> It does, and looks like this, a screen filling alert view when you login into the backend. [http://i.imgur.com/yeBKQIM.png](http://i.imgur.com/yeBKQIM.png)

<comment><USER17> It's the wordpress problem; Magento has made e-commerce accessible to anyone with a shared webspace and the minimum of knowledge (speaking as someone who's company integrates with small businesses who use Magento). So it's very easy for things to get out of date.

(or even worse; one-click installers on some shared web host... so they can't update it even if they wish!)

</comment></comment></comment><comment><USER18> Would anyone be interested if I were to host a maintained fork of the Magento community edition on github with up-to-date security patches so you can just `git pull` and be done with it?

<comment><USER19> The only problem with that is you have to fork off that for your own Magento site and it basically doesn't help anyone that doesn't already know what they're doing and patch right away already. :\

<comment><USER18> True, and it's unlikely that they would update their website to encourage this approach since their incentive is to get people to pay them instead.

</comment></comment></comment><comment><USER20> Magento is pretty old school. Things like patching will be much easier in Magento 2, which uses Composer for managing dependencies.

<comment><USER21> Yes. And that non-existent upgrade path sure is pretty sweet, and sure isn't going to make people look elsewhere...!

</comment></comment><comment><USER22> I smell the lawyers coming.

</comment><comment><USER23> "Unsafe PHP"

Isn't that a bit redundant?

<comment><USER18> As someone who routinely finds security bugs in popular PHP frameworks... no, it really isn't.

<comment><USER24> What's your opinion on "popular frameworks".

<comment><USER18> They vary; generally, their maintainers mean well but that doesn't necessarily translate to secure code.

Cake lacks security expertise in their core team, unfortunately.

CodeIgniter is a bit conservative. (We must support PHP 5.2!) But then again, so is WordPress. They do listen to researchers.

Laravel is okay, but their lead dev is a bit of an egotistical and hypocritical ass. Recently, found and privately reported a PHP Object Injection vuln to Laravel; he said he didn't consider it a security issue, then when I disclosed publicly flipped his shit on me.

Symfony is great. Fabien has a cool head and responds well to security researchers.

Yii 2 is promising. I'll have to take another look before I call it bulletproof though.

My only experience with Zend has been interacting with their core devs on other media (Twitter, IRC); I haven't found any bugs in its core.

<comment><USER25> Looks like after your "evil" public disclosure, they now added security contact: [https://github.com/laravel/framework/commit/69e5c3c1daca8454...](https://github.com/laravel/framework/commit/69e5c3c1daca84549a15ce3a96021ec914bf002a)

<comment><USER18> Yes, but I originally emailed that address so I don't think it was a reaction to me (or even a passive aggressive gesture). Taylor had a week's heads up and chose to dismiss my report.

</comment></comment></comment></comment></comment></comment><comment><USER26> I don't see the big fuss here if people are warned, either as the main package is downloaded or in the post-install configurations screens or in the admin screens, or ...

It comes down to how much time they can afford to spend on release testing for the OSS edition. They have tested the main release extensively, and have tested the patches too, but haven't had/made time to roll together a new full release and explicitly test that so continue to go with "install X, apply patches Y, Z, ..." as the process for new instances because that has been tested.

Full release regression testing can be a long-winded (and therefore potentially time expensive) process. Maybe people who have a problem with the current install process could club together and donate enough to make that worth while doing before the next planned full release...

(of course that is moot if people _aren 't_ warned adequately)

<comment><USER26> A downvote with no explanation just tells me I've got on your nerves and you aren't mature enough to discus it openly.

If you think I'm genuinely wrong please educate me rather than hitting "downvote" and running away...</comment></comment>


Cervus: A WebAssembly subsystem for Linux - <AUTHOR> https://github.com/cervus-v/cervus <comment><USER2> The next step of evolution predicted by Gary Bernhardt. [https://www.destroyallsoftware.com/talks/the-birth-and- death...](https://www.destroyallsoftware.com/talks/the-birth-and-death-of- javascript)

<comment><USER3> The end is neigh and it is the death of javascript.

<comment><USER4> Don't horse around. The word is `nigh`

</comment></comment></comment><comment><USER5> From the readme:

> I'm busy with my College Entrance Examination until ~June 10, 2018

This dude is in high school?! When I was your age I thought I was smart for writing a youtube scraper in PHP...

Awesome work, really creative solution. Good luck to you.

<comment><USER6> I believe the other person working on a wasm kernel in Rust is also in high school. They take two different approaches, I can't wait to see how all of this turns out!

<comment><USER7> A real High School drama, not that fake stuff on the telly ;).

</comment></comment></comment><comment><USER8> Highly related: [https://github.com/nebulet/nebulet](https://github.com/nebulet/nebulet)

"(Going to be) A microkernel that implements a WebAssembly "usermode" that runs in Ring 0."

It's inspired by the Microsoft experiment Singularity OS.

<comment><USER9> I've been wondering for a while as to why nobody was trying to run an entire VM at ring 0, the benefits would be significant. I was just not aware that's what Singularity/Midori were doing.

I'm glad more people are picking up on it.

<comment><USER10> Doesn't Ling/ErlangOnXen run in Ring0?

<comment><USER11> Ling has the concept of hypercalls, as if you were running plain Linux on xen. So, it's less an actual unikernel and more like a skin that molds itself to xen, and looks like a unikernel.

So yes. But no.

</comment></comment></comment></comment><comment><USER12> Having web assembly be a native subsystem... That's brilliant. Why has this not been attempted for Java or anything else for that matter? I guess you could count Microsoft's .NET implementation.

In any case, you could extend this beyond just user mode. Currently the domain of safe ring0 execution is eBPF as far as I know, but this would be way more approachable and other operating systems could implement it.

I've got no idea what the future is for this project but I really hope it doesn't stay in the realm of "fascinating but not practical."

<comment><USER10> > Having web assembly be a native subsystem... That's brilliant. Why has this > not been attempted for Java or anything else for that matter?

There have been CPUs which could execute Java bytecode directly…

And not just actual Java processors, ARM has/had an extension for that: [https://en.wikipedia.org/wiki/Jazelle](https://en.wikipedia.org/wiki/Jazelle)

<comment><USER12> I was aware of the Java CPUs, but somehow that seems less interesting. Maybe because at that point, it's not so different from any other CPU architecture.

</comment></comment></comment><comment><USER13> WA in the kernel could lead to drivers being established as WA code with special interfaces. With safe interfaces to stuff like PCIe devices, the linux kernel could transform into a more hybrid kernel, similar to NT. Many funs to be had!

I imagine it could also be useful to run user programs without having to switch rings all the time...

<comment><USER14> > I imagine it could also be useful to run user programs without having to > switch rings all the time

That is pretty much exactly what this project is aiming at:

"Cervus implements a WebAssembly "usermode" on top of the Linux kernel (which tries to follows the CommonWA specification), enabling wasm applications to run directly in ring 0, while still ensuring safety and security."

<comment><USER15> Reminds me of how Forth was supposed to be the language for drivers and such, write once, run everywhere drivers.

</comment></comment></comment><comment><USER16> Another guy evaluating similar stuff: [https://idea.popcount.org/2017-03-28-sandboxing- landscape/](https://idea.popcount.org/2017-03-28-sandboxing-landscape/)

</comment><comment><USER17> Do not run untrusted code at ring 0, regardless of software sandboxing technology. It's just too risky!

Otherwise neat.

<comment><USER18> Why do you claim this?

1\. Hardware sandboxing (i.e., ring not-0) isn't much better, as seen by Meltdown.

2\. Most production-ready UNIXish kernels have had support for running untrusted code (namely BPF bytecode) in the kernel for decades.

3\. Do you _really_ trust all the code currently running in ring 0 on your computer? In particular, do you trust the executable loader. which handles complex untrusted input? What's the line between "code" and "not code"?

4\. On most desktop machines, there's a single user, and malware being unable to get to ring 0 isn't particularly stymied; it can still exfiltrate your files, stream your webcam, log into your bank, etc. Why is ring 0 more of a concern than untrusted code elsewhere? (In fact, on most Linux desktops, malware can wait until the user runs sudo, inject itself in, and then run insmod and get to ring 0 directly....)

5\. These same machines make a practice of running untrusted, JITted JavaScript and WebAssemy all the time inside the same sandbox you think is too dangerous, and the sandbox works. Not perfectly, of course, but also certainly much _better_ than, say, the Linux kernel protects itself from local privilege escalations. Why is the same software sandbox too dangerous for use in kernelspace?

<comment><USER17> > 1\. Hardware sandboxing (i.e., ring not-0) isn't much better, as seen by > Meltdown.

Meltdown was a single Intel bug, it did not occur on other CPU architectures or on AMD chips. It was a result of asynchronous permission checking and it is a side-channel disclosure (a non-write bug). It is objectively not as bad as the tens of thousands of buffer overruns and memory write vulnerabilities in software.

> 2\. Most production-ready UNIXish kernels have had support for running > untrusted code (namely BPF bytecode) in the kernel for decades.

Actually it is a security vulnerability as well. In fact, the Project Zero proof of concept for Variant 1 of Spectre was an attack on the BPF _interpreter_ , not even a _JIT_ , it's even worse with a JIT.

> 3\. Do you really trust all the code currently running in ring 0 on your > computer? In particular, do you trust the executable loader. which handles > complex untrusted input? What's the line between "code" and "not code"?

There are levels of trust, of course. I trust the Linux kernel a heck of a lot more than, e.g. V8. And I work on V8. On the WebAssembly implementation. I didn't want to mention it, but yeah, no, I would not put my own code into the kernel.

> 4\. On most desktop machines, there's a single user

Again, levels of trust. I would not, e.g. run most userspace software in the kernel, just because it's so broken it will probably bring down the system. All the other things you mention are made easier, not harder by running in the kernel.

> 5\. These same machines make a practice of running untrusted, JITted > JavaScript and WebAssemy all the time inside the same sandbox you think is > too dangerous, and the sandbox works.

I don't want to scare you, but please don't labor under the assumption that web browsers are 100% secure. We have tons of bugs. I mentioned above that the WebAssembly implementation in Chrome is a lot of my work. We've had security vulnerabilities.

> Not perfectly, of course, but also certainly much better than, say, the > Linux kernel protects itself from local privilege escalations. Why is the > same software sandbox too dangerous for use in kernelspace?

Objectively, no, it isn't better than the Linux kernel. And yes, it is too dangerous. This is based on the hundreds of security bugs that I've been involved with while working on Chrome, and the hundreds more that I wasn't involved with, and the probably hundreds more that are hiding in there. Yes, we take security seriously, and we are very sober about this.

<comment><USER18> Thank you for working on V8 and the WebAssembly implementation. :)

I still think that this is a case of knowing how the sausage is made. I've operated public-facing Linux systems for many years (but I am not either a kernel nor V8 developer, so you know what you're talking about more than I do) and the Linux kernel is ... not good. You take security seriously, and find hundreds of bugs, and it scares you, which is great. The Linux kernel does _not_ (remember the whole "security bugs are just normal bugs" thing, plus the resistance to architectural improvements that kill bug classes, which as far as I can tell you folks seem to be very excited about).

I would hope that you think that V8 + the associated Chrome sandbox (which, to be fair, I think does not have an equivalent in this project) is secure _enough_ to be exposed to random JavaScript / WebAssembly from malicious parties on the internet running and updating 24/7, and keep things reasonably safe, because a billion people do exactly that. I'm not saying it's perfect or unbreakable - I'm just saying I definitely don't trust Linux to be secure against random userspace from malicious parties on the internet running and updating 24/7.

</comment></comment></comment></comment><comment><USER19> This is a cool idea I've seen increasingly talked about, but in practice? I hope it never happens. Single Address space computing is a bad idea.

[https://www.cs.princeton.edu/~appel/papers/memerr.pdf](https://www.cs.princeton.edu/~appel/papers/memerr.pdf)

</comment><comment><USER20> So NaCL and PNaCL are not good enough to be comparable with WASM?

<comment><USER21> NaCL relied on a lot of segment register tricks that are only available to ring 3 AFAIK.

</comment></comment><comment><USER22> Can someone explain what this is actually useful for, if you're not a kernel developer? Would people in userland care about anything like this?

<comment><USER23> Gary Bernhardt explains it better in this talk: [https://www.destroyallsoftware.com/talks/the-birth-and- death...](https://www.destroyallsoftware.com/talks/the-birth-and-death-of- javascript)

But to summarize, jumps between kernal-space and user-space are expensive. Instead of doing that, we can run a well-vetted interpretor in kernal-space, and run "userspace" programs in kernal-space, in the interpretor.

This actually isn't slower (or so it is claimed), because a JITed interpretor can be native speed on hot-code paths, and the inefficiencies for most workloads are more than made up for by not having expensive syscalls.

So what you end up with is something that is about as fast as normal compiled code for cpu-intensive workloads (maybe faster sometimes), much faster for workloads involving a lot of syscalls, and interpreted languages like python/javascript end up much faster as well, presuming they can take advantage of the efficient JIT implementation.

Personally, what most exites me about this technology path, is that it should reduce the cost of interprocess communication to near zero. Combined with a shared object model, and a capabilities system, it could be pretty awesome.</comment></comment>


...and what's the deal with San Francisco? - <AUTHOR> http://venodesigns.net/2010/10/06/and-whats-the-deal-with-san-francisco-along-with-my-travels/

<comment><USER2> I won't speak to his other points, however if all the author met was a bunch of "me too" douchebags, then the author clearly hung out with the wrong people. To meet the real san francisco tech scene come to a scrodeo: <http://scrodeo.com/>.</comment>


Ask HN: How to handle this recruiting situation? - <AUTHOR>

Hi HN, I'm a 2nd-year CS undergrad restlessly applying for internships for this summer.
About 2 months ago, I applied to  and was subsequently matched with teams who were interested in me. I did my due diligence in interviewing and moving though the rounds, and at the very end I was told that my interview went well and that they "were trying to get approval to add an additional internship position" to hire me.
I was thrilled, but over the next 2 weeks, every time I asked my recruiter for an update, I was always told that he was still awaiting approval. Most recently, I was told that the odds of being approved "weren't likely." I don't understand why I was interviewed at all for a team that wasn't guaranteed to have an opening. What can I do now?
Should I ask for the contact information of the higher-ups to try to plead my case?
Thanks so much, HN. <comment><USER2> Unfortunately I would say just move on. Don't hold out on other opportunities just to see if you get this one internship. You are still young and there will be hundreds of opportunities that will come and go exactly like this one. Even when applying for full-time jobs this a common scenario where you will go through the hoops of interviewing and then be left in the wind while someone makes a decision that does not involve you. It is not personal, it is just one of those things. Don't look at as bad, but instead look at it as you got the chance to interview which in itself is valuable as you move on your career. There were probably other applicants who did not even make it as far as you did so that is a huge plus for you. Keep moving and don't give up just because of this one experience.

</comment><comment><USER3> just as an aside, quite often certain types of companies will just interview people to find out what the competition is up to.</comment>


Tales of Learning Computer Science as a High School Girl - <AUTHOR> http://betabeat.com/2012/06/real-tales-of-learning-computer-science-as-a-high-school-girl-stuyvesant

<comment><USER2> Some discussion on this yesterday : <http://news.ycombinator.com/item?id=4148524>

</comment><comment><USER3> How much did BetaBeat spend to make their website switch to a page flipping tablet mode? And do they realize that that mode makes whatever pages of this project inaccessible?

<comment><USER4> I spent several minutes on it on my iPad and can't figure out how to get past the first page.</comment></comment>


Evidence behind EPA's obligation to regulate greenhouse gases stronger than ever - <AUTHOR> https://news.berkeley.edu/2018/12/13/evidence-supporting-epa-obligation-to-regulate-greenhouse-gases-stronger-than-ever/ <comment><USER2> >The Clean Air Act requires the EPA to regulate air pollutants when the agency's administrator finds that they "cause, or contribute to, air pollution which may reasonably be anticipated to endanger public health or welfare."

The question is not whether it is a good idea for greenhouse gases to be regulated. The question is if the Clean Air Act mandates it. IANAL, but from what is quoted, I would have a hard time classifying CO2 (which already makes up 0.04% of air) which you exhale every time you breath as an air pollutant. There is no evidence that breathing air with CO2 (at the levels that current industrialization produces) produces harmful effects directly. In fact, if you hold your breath and exhale, the air you exhale likely has a higher local CO2 percentage than the increased levels caused by industrialization. The effects are mediated by its greenhouse effect and global warming. This is analogous to the CFC and the ozone depletion. The CFC's were pretty innocuous at ground level, but their release cause ozone depletion. This was regulated not through the Clean Air Act, but by the Senate ratified Montreal Treaty ([https://www.nytimes.com/1988/03/15/science/treaty-on- ozone-i...](https://www.nytimes.com/1988/03/15/science/treaty-on-ozone-is- backed-in-senate.html)).

The issue right now is that there is not the political will in the United States to address greenhouse gases, therefore people are trying to accomplish this through a very broad reading of the Clean Air Act. This will not be helpful in the long term as it just further associates fighting climate change with government overreach, and further politicizes what should not be a partisan issue.

<comment><USER3> > There is no evidence that breathing air with CO2 (at the levels that current > industrialization produces) produces harmful effects directly.

"directly" is not in the cited requirement, so indirect causation is not excluded from the requirement.

<comment><USER4> And actually c02 concentration has a measurable effect on intelligence.</comment></comment></comment>


A simple light weight jquery plugin library to make working with Bootstrap css. - <AUTHOR> http://bootstrap.ourjs.com/

<comment><AUTHOR> have fun</comment>


How the car industry made crossing the road an offence  - <AUTHOR> http://www.bbc.co.uk/news/magazine-26073797

<comment><USER2> Hah, didn't know that, but what a fantastic example of victim blaming.</comment>


Mmmule - anything from anywhere to anywhere - <AUTHOR> http://mmmule.com/wants/new

<comment><AUTHOR> Mmmule on TechCrunch - [http://techcrunch.com/2012/04/20/deliver-the-love- with-mmmul...](http://techcrunch.com/2012/04/20/deliver-the-love-with-mmmule- let-strangers-carry-things-to-other-places-for-you/)

This article will leave you scratching your head!</comment>


Windows 10 Without the Cruft: Windows 10 LTSB (Long Term Servicing Branch) - <AUTHOR> https://www.howtogeek.com/273824/windows-10-without-the-cruft-windows-10-ltsb-explained/ <comment><USER2> I'm on ltsb for my business laptop and it stinks. Id rather have random issues with a few upgrades than be stuck without new features and get almost no bug fixes. New features I get for my home machine are missing on my job laptop. New dpi handling improvements coming Nope, not in ltsb.

It appears to get security fixes only - few bug fixes. For example, the LTSB start menu is completely broken - there is no search on it and it takes 3-4 seconds to show. Presumably related to the lack of Cortana, but who knows. In any case, it's been a widely reported bug in ltsb for a long time and it's a pretty fundamental feature in windows.

I could see the point in being on the LTSB branch of _windows 7_ because that OS is done. But windows 10 isn't nearly finished yet and very rough around the edges. Being on LTSB of such an old Win10 release is like being on the release day version of a AAA game while everyone else runs the fixed version that came out 3 months later.

<comment><USER3> LTSB is meant for kiosks, embedded systems, and other business applications where a non-changing OS is important.

If you put this on a laptop for daily use, you're going to have a bad time.

<comment><USER4> But that's precisely the problem. This article even calls it "Windows 10 without the cruft", and there's this misinformed view everywhere that you can "strip down" and accordingly "make faster" Windows by using the LTSB. And before you know it, everyone wants to.

There are forum threads with people buying home desktops and being upset that they didn't get LTSB because "Cortana uses RAM I want for gaming".

LTSB is a victim of poor marketing. It should be called "kiosk edition" or something to make some of these things really clear to people.

<comment><USER5> Ok, I want a machine to do _nothing_ but run office. I have given up on the portion of my Steam library that doesn't run on Linux, but running Steam would be a bonus.

I have no interest in the app store, or any of Microsoft's cloud services, and sending my data to Microsoft (or leaving open a remote diagnostics backdoor) is a complete deal breaker for me. Since my Win 8 box downloaded backports of the Win 10 spyware without my authorization, I have physically unplugged it.

Is there some reason LTSB will not meet my requirements? I can afford $7/month.

It seems like the best choice at the moment, but I'd rather not waste time if it can't run office (or has hardware issues, etc).

<comment><USER6> Just run Windows in a VM and cut off internet access. Use the windows offline updater periodically (not nearly as important since you don't have internet; still useful if you are going to import foreign files into the vm). [http://www.wsusoffline.net/](http://www.wsusoffline.net/). You'll need a different windows scapegoat machine to use wsusoffline though. I don't think there is a linux version. Also, office 2010 on wine/crossover is perfectly usable for light work. Office 2013 is also somewhat supported these days.

</comment></comment></comment></comment></comment><comment><USER7> Two changes made a big difference for me in using Windows 10:

1\. Turning off Cortana using these instructions: [https://www.howtogeek.com/265027/how-to-disable-cortana- in-w...](https://www.howtogeek.com/265027/how-to-disable-cortana-in- windows-10/)

2\. Turning off most of the visual effects under "Adjust the appearance and performance of Windows." (I left "Smooth edges of screen fonts" and "Enable Peek" checked)

The combination of these two change feels like a whole new computer.

<comment><USER8> I don't want to turn off Cortana, I want Cortana not to exist. How can I accomplish that in Windows 10?

<comment><USER9> Remove "C:\Windows\SystemApps\\* cortana* " with something like[0] to get around "File is in use".

A fair warning though, [insert standard MIT style disclaimer].

[0] [https://gist.github.com/Tharre/d900a5f6ce16701b441c4405abc36...](https://gist.github.com/Tharre/d900a5f6ce16701b441c4405abc3634a#file- post-install_win10-ps1-L27)

</comment></comment></comment><comment><USER10> The only version of Windows 10 which prosumers want, they can't have.

<comment><USER11> There are plenty of prosumers who don't want to serve as a functional IT department in addition to everything else they have to do, who want features like Bash on Windows, and who are generally fine with Pro.

</comment></comment><comment><USER12> There is a whole Eco-system of tech-bloggers and tool-smiths, whos whole working-life consists of ripping out the "improvements" Microsoft has shoveled towards the users - riding binary rodeo with every update.

My assumption is that this Eco-system will rather soon bring the clumsy Microsoft attempt to become google one stack-layer closer to the user to a horrific end.

<comment><USER13> This has been going on since I got into the "Windows scene" 15 years ago with Windows XP, slipstreaming and custom install INI's. It's no longer the area I work in, but something tells me your prediction is probably as wrong as it was when people were saying this exact same thing 15 years ago.

</comment></comment><comment><USER14> Now that's useful. I have a Windows 7 machine for the few things that don't run on Linux. Windows 10 LTSB would be great for that.

I wonder if I can get Windows 10 LTSB preloaded by Central Computer, the retailer. They installed Windows 7 with no bloatware for me. (I asked for that, and the invoice actually reads "no bloatware")

</comment><comment><USER15> > And Windows 10 Enterprise is only available to an organization with a volume > licensing agreement, or through a new $7 per month subscription program

Given that it's basically free to register as a commercial entity (in Germany it costs 40-50€, and iirc a British LLC can be formed for less), can one do so, and then apply for said subscription program?

edit: are offerings like [https://www.lizengo.de/microsoft/windows-10-enterprise](https://www.lizengo.de/microsoft/windows-10-enterprise) actually legit, and can these be used to activate a LTSB installation?

<comment><USER16> Not sure if it's worth the hassle of setting up a company IRL just to use a piece of software.

<comment><USER17> in the UK it takes 10 minutes online to open a company and if you don't do anything with it the only thing you need to do is add it on your annual tax return, with all fields as zero since you are not actually trading. It's almost zero effort.

<comment><USER18> > add it on your annual tax return

That's not doing nothing. That requires filling in a Self Assessment which most people aren't doing

</comment></comment></comment></comment><comment><USER19> >Windows 10 LTSB omits a lot of the new stuff in Windows 10. It doesn't come with the Windows Store, Cortana, or Microsoft Edge browser. It also omits other Microsoft apps like Calendar, Camera, Clock, Mail, Money, Music, News, OneNote, Sports, and Weather.

>In fact, the default Start menu on Windows 10 LTSB doesn't even include a single tile. You won't find any of those new Windows 10 apps installed, aside from the Settings app.

That sounds fantastic. I use absolutely none of those "features" and would love to be able to remove them from my copy of windows 10.

<comment><USER20> Is it really better to have IE11 and only IE11?

And the _ability_ to use the store is not a bad thing.

<comment><USER21> I have a local account and while store is there, I can't use it without signing in with ms account. I'm not going to, so it's basically just wasting space. I would rather it wasn't there completely.

<comment><USER22> You could run this script: Make Windows 10 Great Again. [https://gist.github.com/IntergalacticApps/675339c2b805b4c9c6...](https://gist.github.com/IntergalacticApps/675339c2b805b4c9c6e9a442e0121b1d)

<comment><USER23> Does that break Skype and parts of Azure portal and online Office suite?

Most of such scripts break things. And I see the usual suspects, like DNS blocking client-s.gateway.messenger.live.com etc, so I think this one isn't an exception.

<comment><USER22> You can edit the script to remove what you don't want disabled/blocked.

</comment></comment></comment></comment></comment></comment><comment><USER24> I have deployed LTSB in a few schools I look after, it's far easier because of the minimal feature set especially in smaller environments where full enterprise management tools like System Centre and WSUS are not installed.

Go old school and customise the default profile in the build for best results!

The best part is that if you have education volume License You get both EDU and Ent LTSB editions!

</comment><comment><USER25> I was about to switch to this about a month ago but realized WSL __does not __work with LTSB. So no BASH for Windows. It will probably be more than a year too...

<comment><USER26> The Bash that comes with Git (which uses msys AFAIK) works pretty well.

<comment><USER27> It uses MSYS2 actually, which is a completely different project.

<comment><USER28> To expand on that: MSYS was a fork of Cygwin 1.3, and MSYS2 is a fork of Cygwin 1.7. (Babun is a distro of Cygwin, and Git-bash is a distro of MSYS2.)

</comment></comment></comment></comment><comment><USER29> I'm a full time Fedora user. I run LTSB in the VM that I run Office 365 in and it's perfect. No fuss, no bells, gets out of my way and just works.

</comment><comment><USER30> This seems to install a pretty 'good' win10 version: [https://www.microsoft.com/en-us/software- download/windows10s...](https://www.microsoft.com/en-us/software- download/windows10startfresh)

I had a Lenovo S500 dektop that I just reinstalled. Non-SSd. I was getting a '100% disk usage' issue right of the bat. I installed 'windows10startfresh' and now it's pretty sweet - pc is not slow, and such. The 'windows10startfresh' installs windows without all the lenovo crud apparently.

<comment><USER30> I should have emphasized the machine is like a dream right now - without the Lenovo cruft that is usually installed. Runs like a charm - where as the base Lenovo install was slow - i mean really slow. and this is an i7 16gb machine.

</comment></comment><comment><USER31> I'm both amused and angry that Windows 10 adopted the same model as the big commercial Linux distributions: a fast-cycle OS that upgrades every 6 months (but might have bugs), and a slow-moving version that they support for a long time but won't suddenly change behavior or stop working with your hardware.

It is a proven model in the Linux world. The unpleasant thing is that Microsoft shunted millions of users on to the equivalent of Fedora or non-LTS Ubuntu without bothering to explain this.

<comment><USER32> I'm sorry, what didn't they bother to explain? Why are you angry that they adopted a release model that works well?

<comment> yjftsjthsd-h They pushed everyone from major versions to rolling release.

</comment></comment></comment><comment><USER33> Microsoft should make this available for everyone. It sounds perfect.

<comment><USER34> It's the precise opposite of the Extend and Embrace strategy which has worked for them forever. I'm surprised they have it as a named product instead of a set of bizarre Registry tweaks.

</comment></comment><comment><USER35> I noticed that when I had Windows 8.1 installed on my PC earlier this year, the version string mentioned LTSB. Does 8.1 use the kernel of 10's LTSB?

<comment><USER36> winblue_ltsb means that it's the long term support branch, with no new features and securuty updates only.

</comment></comment><comment><USER37> I would be okay with a pay-as-you-go Windows 10 Enteprise subscription for this LTSB. My use of Windows is very sporadic. If I could log in and pay $7 for the next 30 days official access then let it expire till I need it again, I would be giving MSFT more money than I do now but would consider a fair exchange for ongoing security updates.

<comment><USER38> Have you tried their free virtual machines for browser testing?

[https://developer.microsoft.com/en-us/microsoft- edge/tools/v...](https://developer.microsoft.com/en-us/microsoft- edge/tools/vms/)

</comment></comment><comment><USER39> I also want the Classic Theme back, Classic like in NT4 classic, with the old school minimize, maximize and close buttons.

<comment><USER40> Classic theme, classic explorer, classic task manager, classic everything.

Just admit it, you want to use NT4.

<comment> yjftsjthsd-h ...yes, that sounds nice. With security patches and drivers for modern hardware.

</comment></comment></comment><comment><USER41> LTSB = Embedded

<comment><USER42> More like Server 2016.

In embedded version you have more fine-grained pick of components to install, and you do this before even storing your image to installation media.</comment></comment>


Ask HN: How to prepare for Programming Interview? - <AUTHOR> A few of my friends and myself are preparing for job interviews. So we have been crawling the internet for the best way to prepare for Programming interviews.<p>So we wanted to know what fellow HNers were doing? <comment><USER2> Read "Hacking a Google Interview" from MIT (<http://courses.csail.mit.edu/iap/interview/>). Solid gold.

Besides that, a lot of startups ask about distributed computing. So make sure you understands the AWS tool ecosystem, as well as have an understanding of new (NoSQL) data stores.

<comment><AUTHOR> Thanks, there is some great stuff on there. I am already familiar with AWS and a little Cassandra

</comment></comment><comment><USER3> 1) have the details (and top level descriptions) of the work you have already done and put on your resume, on your fingertips. 2) Remind yourself of the obstacles you have faced in your projects and how you solved them - see that your explanations as to how you solved them will highlight the positives in you such as resourcefulness, creative problem solving, readiness to take help, determination, etc 3) If the requirements are for skills that you do not have, but think you can pick them up fast, figure out how your current skills and past exposure will enable you to quickly pick up tne new skills 4) Know the requiremetns very well so that you don't get any surprises 5) know your resume very well

If I were the interviewer, I would also ask (preferably through a questionnaire) a ton of questions to check problem solving capabilities and attitudes about different stuff.

Good luck and cheers.

<comment><USER4> Great advice! I would add knowing common data structures such as trees, linked-lists and queues/stacks and how to traverse/sort/build them

</comment></comment><comment><USER5> Make sure you know fizz-buzz and OOP

<comment><USER4> Dont underestimate non computer related questions like:

What sets you apart from others?

</comment></comment><comment><USER6> I assume you're still in school or just left?

If you've had an internship involving programming or a side project, put it on your resume and _be prepared to talk about it_

If you don't, then pick the most (and perhaps least) interesting class and _be prepared to talk about it_ One of the biggest problems I have with interviewees is dragging out of them what they did on their last project. I don't care what the project achieved, I don't care how cool the people were, I don't care how amazing the UI that Jim built looked. _I care what YOU did_

You'd think this would be easy, it sure ain't. I love interviewees who are cocky and confident: they are easy to talk to and I don't spend an hour gently teasing information out of them. Know what excites you and talk about it! HR can deal with "where you want to be in 5 years" and all that crap. We the techies just want to know if you can code, if we can get along with you, and if you'll be productive in our environment. Make it easy for us to tell that and you're ahead of the pack!

Oh, and please be capable of writing a for..next loop! Seriously!

</comment><comment><USER7> Make sure your resume follows this (not joking):

<http://stevehanov.ca/blog/index.php?id=56>

Also practice coding on a whiteboard. Some problems, like running out of vertical space, are things you don't run into on a computer.

<comment><AUTHOR> very interesting, i think my resume would get a decent score according to that scale =) i cant say my resume is LaTeXed =/

</comment></comment><comment><USER8> I've interviewed hundreds if not thousands of programmers over the past 15 years. I am coming from the perspective of a UK based internet infrastructure/software startups of 1-100 people, much applies to other situations but there are some cultural differences over size of companies, geography etc.

CV/Resume Stage (getting an interview)

* In your CV/Resume be clear about what you've achieved. What I look for is somebody who has achieved 'stuff'. Either in jobs, their education or their career. Try and display an ability to problem solve and make a difference. It doesn't have to be massive achievements, but if you word it properly it can sound impressive, but don't exaggerate. For each job position talk about what you accomplished, were responsible for. For your education, give a paragraph about your projects. Talk about stuff you've done in your spare time, taught yourself. As well as demonstrating what you've achieved it also helps steer an interview to stuff you will be strong about.

* If you struggle to talk about interesting things on your CV/Resume, then that is perhaps an issue. Write some code in your spare time, get involved with an open-source project etc.

* People form impressions within a few seconds of looking at your resume. Format and layout matters, but also make it easy for them to scan through it. For HR people this does often mean some relevant tech buzzwords, but put yourself in the position of someone recruiting for the job you're looking for. What would give them confidence?

* Don't hide details. I personally like to see dates of jobs/education and grades. If you had a career brake or dropped out of college, don't hide it, think about how you can present in a positive manner.

* Find interesting companies and apply direct to them. This saves recruitment fees for the company, but it also shows you are interested in them. Write a short covering letter that is tailored to them, and (without being smarmy) make it clear why you are a good fit for them. Sell yourself.

Interview Stage

* Take your resume, and look at what obvious questions might come up. Work out what you can address in your resume, and what you would answer when asked. Be prepared to admit short-falls rather than bluff your way through them, but be prepared to spin them to your favour.

* Be prepared to deal with the standard generic interview questions "where do you see yourselves in 5 years?", "what makes you enjoy your job?", "what do you like doing in your spare time?". In most cases when asked this sort of question, the interviewer is just looking to get your talking to find out more about you.

* Ask intelligent questions. This (if managed properly) helps the flow of the interview and allows the interviewer to feel in control. If you're tested on some technical thing and you don't know the answer, feel free to ask them 'if you don't mind could you just explain that to me?' rather than just shrinking into your seat feeling stupid when you don't know the question. An interviewer goes into the interview with 4-5 set questions in their mind, and if they spend 10 minutes explaining to an intelligent curious person the answer to one, they leave feeling good. If you just say "sorry - i don't know" and look sheepish, they move onto the next question, and mark you poorly on it.

* Get comfortable being put under pressure, explaining things on a whiteboard and coding whilst you talk. One can imagine some brilliant programmers who might get agressive if challenged, or who are not used to explaining their thinking as they go along.

* Most technical interviews involve some technical questions. Some will be detailed specifics (in this language how do you that?) for these there is little prep you can do bar knowing it. For others, there may be more generic questions. A class Microsoft question used to be something like "Why are manhole covers round?". Imagine an interviewer asking you that kind of question. If you just say "I don't know" and show no curiosity it won't reflect well. If you go into silence and think for 10 minutes it won't make a good interview. Learn to enjoy the question rather than feel threatened by it. Learn to think allowed and articulate your thought processes. Ask gentle questions like 'am i thinking along the right lines here?'. These questions are more designed to test your problem solving and analytical skills. The third type of question is open questions like "is garbage collection a good thing?" or "is agile the right approach to development". In this case the interviewer wants to have a balanced, rational, pragmatic opinion on the subject. Don't be shy with stating a view, but preface it with 'it obviously depends upon the specific application/product/requirement'.

* Understand the business of the company you are interviewing for. For example, if you're interviewing at Google for a product management role, expect to be asked questions like 'which search terms do you think think have the highest CPM rates?'. They don't want a perfect answer, they just want someone who can have an intelligent guess.

* Treat everybody you meet at the company with respect and confidence. You never know who are the decision makers, and don't underestimate the importance of the receptionist, junior-HR person in having some influence.

* Make an effort. Turn up on time. Dress appropriately. Understand the company.

* Don't take rejection personally. People tend to recruit in their own image. There are some companies where they you won't be a good fit, and you won't come across right, or fit in. To some extent it's a numbers game.

</comment><comment><USER9> A friend of mine runs CareerCup - <http://careercup.com/>

Highly recommended as a place to find/practice tech interview questions.

</comment><comment> brown9-2 Check out the interviews section on the glassdoor.com profile of the company you are interviewing with.

<comment><USER10> yes i just did that, lots of good feedback

</comment></comment><comment><USER5> I think that should be "Ask HN" not HW

<comment><AUTHOR> thanks fixed it

</comment></comment><comment><USER4> try this: <http://niniane.org/interview_howto.html>

<comment><USER4> and this: [http://www.ehow.com/how_4526446_prepare-software- developer-i...](http://www.ehow.com/how_4526446_prepare-software-developer- interview.html)

<comment><USER11> That was about as content-free as you'd expect from an eHow article.

</comment></comment></comment><comment><USER12> Make sure you know how to write a brainfuck compiler

<comment><AUTHOR> haha well i did take compiler design, but i think id rather do an implementation of lolcode

<comment><USER12> What's lolcode?

I'm serious about brainfuck. You can explain it in a minute and can expect a smart person to work with it from the start (even a non-techie (although the compiler question is for techies)).

Don't test knowledge, test smarts.

</comment></comment></comment><comment><USER11> What kind of company?

<comment><AUTHOR> Web Development and content provider

<comment><USER11> Small to medium size companies? If so, I'd say they're probably more interested in experience & knowledge from related projects and technologies than more theoretical concepts (the really big actors tend to hire for an idealized position, and then find you something to work on after they've hired you).

I also assume that you know all the basic interviewing stuff (be yourself, don't try to bullshit them, don't panic, etc).</comment></comment></comment>


Cross-VM RSA Key Recovery in a Public Cloud - <AUTHOR> http://eprint.iacr.org/2015/898 <comment><USER2> and for history, the 2009 version of this paper

[http://pages.cs.wisc.edu/~rist/papers/cloudsec.html](http://pages.cs.wisc.edu/~rist/papers/cloudsec.html)

</comment><comment><USER3> Basically is RSA so vulnerable to sidechannels that we can only use it safetly inside HSMs?

I bet this would be much harder to do for ECC.

<comment><USER4> RSA and ECC have similarly-shaped common implementation strategies; just the underlying field arithmetic is different. You have a secret input (an exponent in RSA, or scalar in ECC) and work through it bit by bit, doing different operations if a bit is set vs not set (RSA: square and perhaps multiply, ECC: double and perhaps add). If the sequence of operations is visible to attacker (via power, time, cache, branch predictor, etc.) then your secret key does, too.

So, ECC implementations are not generally in a better state than RSA.

This is why curve25519 and its ilk are so much better; they can be efficiently implemented using the Montgomery ladder which is really very easy _and cheap_ to make free of side-channels.

<comment><USER5> No, some implementations of the Montgomery ladder are not invulnerable to side-channel attacks[1].

Unfortunately these attacks all focus on implementation issues rather than the underlying algorithms (hence the name).

[1] [https://eprint.iacr.org/2014/140.pdf](https://eprint.iacr.org/2014/140.pdf)

</comment></comment></comment><comment><USER6> So... what does this mean for PCI/DSS in the cloud ?

<comment><USER7> Intel will bribe PCI to make Cache Allocation Technology yet another checkbox?</comment></comment>


U.S. Steps Up Probe of Tech Hiring - <AUTHOR> http://online.wsj.com/article/SB10001424052702304703104575174293867620832.html?mod=WSJ_hpp_LEFTWhatsNewsCollection <comment><USER2> > Skilled computer scientists with some management responsibilities, for > instance, often make base salaries of $180,000 to $210,000.

Huh. I guess I need to go find some management responsibilities somewhere, dealing with people issues instead of computer issues for part of the day can't be _that_ bad...

> Behind the scenes, technology companies are making the case that agreements > among companies are not anticompetitive and don't affect employees' salaries > or the availability of jobs. They say such agreements are commonplace, used > by companies to maintain good relationships with business partners.

> The technology industry makes the case that it would be harder to enter into > collaborative ventures with other companies if they fear losing valuable > employees.

That seems rather contradictory; if there's no effect on the employee's opportunities, what are the companies afraid of?

> Policing the labor markets hasn't been a central focus of antitrust > enforcers in recent years. But the Justice Department did act against what > it saw as efforts to manipulate the labor market. It brought a civil case > against a group of hospitals in Utah in 1994, alleging that they had > illegally conspired to hold down nurses' wages by exchanging information > about their pay.

Maybe this could be an argument for not keeping salaries a secret; get rid of the information asymmetry.

</comment><comment><USER3> This is the first I hear about a DoJ investigation, but this article largely comes off as FUD. It dances around a few weak claims, none with real evidence to back them up.

First, there's a shortage of computer scientists [1], which has led to an increase in salaries and fierce competition among companies to hire good employees. It's no accident that Google has had better perks than any U.S. company in history in order to attract top talent. They're already spending a lot per employee, and that they would fix employees salaries is ludicrous, considering they would lose out on great talent.

I don't even know what to make of, "skilled computer scientists with some management responsibilities, for instance, often make base salaries of $180,000 to $210,000" -- in Silicon Valley, at least, this is the top tier salary range reserved for only a privileged few. It would also seem strange that the DoJ would be helping these salaries stay at this high level. The government doesn't have a great track record of publicly trying to make the rich richer.

Somebody please enlighten us with the real facts.

[1] <http://www.cis.udel.edu/jobs/market/>

<comment><USER4> /First, there's a shortage of computer scientists/

That doesn't sound like the experience of anyone who works in the field. Remember that CS is one of the few professions where workers really do have to compete with Chinese, Russian, and Indian salaries.

/often make base salaries of $180,000 to $210,000/

Sounds like a statistic invented by the same people who are suggesting a shortage of computer programmers to hire.

</comment></comment><comment><USER5> Here's something I've been thinking about. Imagine Google or FB acquires of a small startup. The startup's product is either unwanted or incorporated into their parent company within a year. That means that for the next couple years of the payout period, a founder could be making $1M/year. Are they _that_ much more valuable than the rest of the company's devs (who make a lot less)? (That's definitely possible.) Or, are the rest of the devs paid a lot less than what the value they provide? If the latter, why don't Google and FB raise salaries more? Could acquisitions be a kind of backdoor to avoid having to raise everyone's salaries?

<comment><USER6> I'm not convinced the difference is that pronounced.</comment></comment>


23andMe Granted FDA Authorization for Genetic Test on Cancer Risk - <AUTHOR> https://mediacenter.23andme.com/press-releases/23andme-granted-first-fda-authorization-direct-consumer-genetic-test-cancer-risk/ <comment><USER2> I spent years working for a company which performed genetic testing for a variety of conditions, germline and somatic (IE, cancer).

Internally, the results we accumulated were only used for providing diagnoses, estimating population frequencies, and writing papers.

Other companies, however, like Guardant Health and Foundation One, initially provided inexpensive or free tests in order to build enormous patient data stores and were then bought by large pharmaceutical companies primarily for this data.

In the end, the patients were the product, and the cheap/discounted tests were overhead cost in taking advantage of these people. I do not know where these companies are now, but my distaste for the industry was a large part of why I've chosen a different field of research.

<comment><USER3> Bingo! You just described 23andme, Anchestry and some others.

Fun fact: you can't make any reasonable profit off of sequencing human DNA at $49 per pop. Its just won't happen. Maybe with technology in iPhone250 in year 3560, but sorry not today.

Back in a day when I was a Noogler, I had interesing conversation on data scraping and purity of infornation in DNA sequencing database. Basically I was explain it will eventually be sold to insurance companies so that they could estimate your premiums better based on probability of your future diseases. As you can imagine that's a gold mine for any large or mid health insurance provider out there. I was also explained how data verofication makes sure of consistency; for example, if male order a kit (via credit card [prepaids dont work bc they cant know your identity]) but result came as female, such result would not be marked as purity and never sold. There are many other checks and balances, but you get the point.

Bottom line: if you want to get the kit and test your DNA out of fun, at least make sure your identity is not obvious.

<comment><USER4> The Genetic Information Nondiscrimination Act (GINA) prohibits the use of genetic information to determine health insurance eligibility or premium

<comment><USER5> Which is not really an ironclad guarantee it won't happen (I'm thinking in terms of the law being modified or repealed, not in terms of companies ignoring it).

But the solution to the insurance problem is pretty obviously at the societal level. Once the testing is cheap enough, if they are allowed to, companies will just refuse carriage to people that won't submit the DNA (well, assuming that DNA profiling provides meaningful pricing information).

<comment><USER6> I don't think repeal of GINA is remotely likely, just look at the political discussion about pre-existing conditions on both sides of the aisle, there is no appetite for having companies accurately price insurance.

I think the fact that health insurance premiums are the #1 thing brought up in privacy discussions is basically evidence of the fact that we all know that insurance is a bad model for healthcare, but we can't bear to socialize it yet.

</comment></comment></comment></comment></comment><comment><USER7> I've never done one of these genetic tests. Partly because it's scary to me to learn what diseases I'm likely to get as I get older, but also I just don't want that information in some else's database. We're very fearful of what Google and Facebook already knows about us now imagine they buy 23andMe and then join all their data about you with your DNA (which you've already willingly given up and allowed them to "profile".

Google/Facebook user behavioral data + their users' _DNA_ is about as scary invasive as it gets.

<comment><USER8> On the other side of this, if massive databases of DNA and medical histories were accumulated, it's possible a great amount of human suffering and harm could be solved by aggressively mining this data to find out the connection between DNA and various diseases.

I mean, besides being denied health insurance because of what someone might find in your DNA, why are you so afraid of something even having your DNA, because it might result in GATACA-like society? If so, we need strong legal protections against discrimination by DNA, but we can't throw out the baby with the bathwater.

There's too much good that can be done to human wealth and welfare by eradicating disease and paranoia about theoretical danger should be challenged into laws to protect against discrimination.

What do you think Facebook + DNA is going to do to harm you? Try to sell you a pharmaceutical or medical treatment? A cure for balding or erectile disfunction?

<comment><USER7> People already post their 23andMe "results" on their dating profiles to say "I'm clean and healthy with good genetics!"

The GATTACA society is rapidly becoming reality, just not institutionalized yet.

<comment><USER9> Great. Maybe we will have less cystic fibrosis in the world. Not sure many people would argue they would be keen for their children to inherit that. There is a big difference between knowing you naturally are a carrier of a disease, and acting on that info, and then manipulating radically and arbitrarily the genetics of humanity. Regulation internationally is fairly clear, sifting out incredibly debilitating disease is going to be ok. Making your children more aryan looking, not so much. Now if only they posted a recent STI panel result too.

<comment><USER10> You'd be fine with someone not finding a partner because they have a chance that their child would carry a disease? Something like "I cannot find a husband because my child will have a 5% chance of cystic fibrosis, so nobody will go for me".

<comment><USER11> That isn't remotely how that works. There is no circumstance whatsoever where your child has a 5 percent chance of having CF.

CF is a homozygous recessive disorder. Both parents have to contribute a defective gene in order for the child to have CF. If one parent is a carrier and the other is not, there is zero chance of the child having CF, barring random mutations which have been known to happen. If both parents are carriers, there is a 50 percent chance the child will be a carrier, a 25 percent chance the child will have no defective genes and a 25 percent chance the child will have CF.

If you actually have CF, you have two defective genes and you can only produce children who are either carriers or who have CF, depending on the genes contributed by the other parent. If the other parent is not a carrier, the children cannot have CF.

As someone who both has CF and has raised a child with it, I absolutely do not want more children with CF. It's a horrible burden for the parents and only a deeply sick sadist would wish such a thing upon their child.

I have never lacked for male interest. I don't know why the hell that is because I'm quite open about my medical situation. I am now menopausal, so it is a moot point. But I absolutely spent some years agonizing over how to screen out CF carriers from the dating pool. Having another child with CF is one of my worst nightmares. I would rather be taken out and shot.

<comment><USER10> Sure, that's for CF, but my question still stands for all the other heritable diseases.

<comment><USER11> Uh, no. All other heritable diseases are either homozygous recessive or they are passed via a single dominant gene. In neither case is there a 5 percent chance of passing it on. All recessive disorders follow the exact same math outlined above.

This is genetics 101.

<comment><USER12> I think I've read it's for bipolar:10% if only father, 50% if both parents.

<comment><USER11> And I am guessing that's not a case where they have identified specific genes. Please correct me if I am wrong. But I am not aware of bipolar genes being a thing.

There is a difference between hand wavy "runs in the family, but we don't really know how it works" and a bona fide genetic disorder whose alleles have been mapped to some degree or another.

Edit: To be perfectly clear, if it is not genetic and merely tends to run in families, it may be due to a variety of nongenetic factors, such as diet and lifestyle. Smoking also tends to run in families. Smoking is not a genetic disorder, though it significantly impacts health.

If it is not genetic, it's heritability is not going to show up on your 23 and me profile. Fretting that it will basically means you don't know what you are talking about.

<comment><USER12> You are right, no genes. They are doing a study for depression + bipolar: [https://www.23andme.com/depression- bipolar/](https://www.23andme.com/depression-bipolar/)

<comment><USER11> There is a disease that was thought to be genetic, but was ultimately traced to ritual cannibalism spreading an infection. Relatives would eat the dead and what body part you got depended upon how closely related you were. This caused the disease to very much mimic a genetic disorder in its pattern of dispersal throughout the family.

"Runs in families" needs to be very clearly distinguished from genetic disorders per se. The former suggests correlation with an as yet unidentified cause or causes, as there may be various contributing factors. The latter is a case of identified cause.

Easy enough to confuse if your own life does not depend upon it, but absolutely not the same thing.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> Here's my view on this:

This doesn't test the full gene sequence, only a few SNPs. Say someone does the test, and it comes back positive. They then call all their relatives. Those relatives have the choice of getting the same test done with 23andMe, or seeing their doctor. Usually proper BRCA gene tests are only reimbursed under certain circumstances, so mostly the relative will have to pay at least $500 to get tested properly. Most of them will just go to 23andMe. The growth in testing because of this effect is going to be significant. All the hard work of doing this kind of testing eg counselling, detailed family pedigrees, contacting family members, discussion of pros/cons of testing etc is being put back onto the individual and their healthcare providers. Good for 23andMe I guess, especially since their value seems tied to how much data they have. Whether this is net beneficial to society I'm not so sure.

<comment><USER14> If you are thinking of macro-societal impact... I think you have to ignore the specifics of this particular test and think of the impact of these _sorts_ of test on medicine, culturally.

For example, there's a sort of Principe in medicine that you shouldn't order tests unless you will action treatments based on results. For example, if you detect a risk of breast cancer that can only be avoided by mamosectamy, only do the test if you're willing to to the procedure. Otherwise, all you have is a more stressed out patient. Data gathering is totally different in medicine for such reasons.

The big, relevant exception is cancer, where a statistical, risk estimating approach is commonplace.

In any case, genetic testing (and other ambient data gathering) may give us good reasons to change this approach. It's a transition and taking a step from toy to medicine (this is what 23andme is doing) is en route to such a change. What could emerge downstream is personalized cancer screening protocols. Maybe you should start getting colonoscopies at age 20 and I should start at 60.

<comment><USER13> (Disclaimer: I'm an oncologist)

There is definitely a science of designing and performing useful diagnostic tests. I have seen many cases of illogical or misinformed testing that has harmed patients physically, psychologically and financially. I ultimately believe that more information is better, however, so far the transition to more direct consumer testing is failing miserably (eg Theranos, or all the companies claiming SNPs can help design dverything ftom skin care to exercise regimens). Then there are just crackpots who coerce vulnerable patients into expensive and totally unproven, never-to-be validated tests that cost thousands of dollars.

</comment></comment></comment><comment><USER15> I haven't read through the T&Cs at 23andMe, but can this data be cross referred to (bought by) by insurance companies to quote me an insurance price depending on the outcome of 23andMe analysis ?

Or even by mortgage providers for that matter ? Or potential employers ?

</comment><comment><USER16> They probably will partner up with insurance company's and will provide discounts if you take this test as part of your physical. And increase it if you don't or start at a higher price for all products that the client doesn't take the test. Yeah it's gonna come to that

<comment><USER17> > They probably will partner up with insurance company's and will provide > discounts if you take this test as part of your physical. And increase it if > you don't or start at a higher price for all products that the client > doesn't take the test. Yeah it's gonna come to that

Even if they could do that [0], once you (and presumably _they_ ) get the results they can't discriminate based on them due to the Genetic Information Nondiscrimination Act of 2008, so there is very little incentive for them to pressure you to take the test.

[0] They can't, AFAICT, also because of the GNA, though employer-sponsored insurance might be able to back door something similar through a voluntary employer-based wellness program nominally separate from insurance.

</comment></comment><comment><USER18> If the current FCC approved something, I wouldn't assume that it was approved on its merits. Is the FDA better? An honest question; I don't know much about its current performance or composition, but it's under the same political control as the FCC.

<comment><USER19> I don't know much about the FCC other than reading about net neutrality, but my answer would be probably yes.

For all its faults, FDA is pretty good all things considered, especially considering the lack of resources they have to do their job. The reviewers are often helpful and the conversations are very scientifically focused and objective. There are many controls within FDA to prevent corruption or outsiders to influence policy.

That said, ive been involved with some decisions where FDA has clearly made questionable decisions that have set back innovation for no good reason. There are also many lobbyists pleading their case to FDA, but congress has very limited power to influence in most cases other than by writing laws (which i think is as it should be)

Many companies that complain about fDA simply havent done their homework or are pushing shoddy science

<comment><USER20> While I respect the FDAs intentions and notable positive actions, I would like to present several articles from reputable sources describing the FDA as a "revolving door" for various industries - an obvious inlet for corruption, dubious research, delayed actions, etc. As I understand it, this is a well known issue.

I believe it is important to be vigilant and critical when it comes to three letter acronyms.

[https://www.npr.org/sections/health- shots/2016/09/28/4956945...](https://www.npr.org/sections/health- shots/2016/09/28/495694559/a-look-at-how-the-revolving-door-spins-from-fda-to- industry)

[https://www.washingtonpost.com/investigations/senators- call-...](https://www.washingtonpost.com/investigations/senators-call-for- crack-down-on-pharmaceutical-industry-revolving- door/2017/11/02/d0c3e6a2-bf34-11e7-959c-fe2b598d8c00_story.html)

[https://www.vox.com/2016/9/28/13059538/fda-drug- regulation-r...](https://www.vox.com/2016/9/28/13059538/fda-drug-regulation- revolving-door)

[http://www.modernhealthcare.com/article/20160927/NEWS/160929...](http://www.modernhealthcare.com/article/20160927/NEWS/160929902)

<comment><USER19> That is fair and skepticism is warranted. A lot of those links point to one study by vinay prasad, who has a reputation as something of an alarmist. Just want to make sure people don't take that study to definitively claim a trend where none may exisr

<comment><USER20> While you may be right about Vinay Prasad being an alarmist (I have no idea), the second article is actually based on a bill written by 7 senators with (seemingly) no relation to Vinay's work.

</comment></comment></comment></comment></comment><comment><USER21> 23andMe reported this gene in 2013. Then the FDA forbade the reporting. Now they're allowed to report it.

What changed?

<comment><USER22> A new administration, including a new FDA Commissioner (Scott Gottlieb) is one

</comment></comment><comment><USER23> Unfortunately, it seems that you're out of luck if you're outside of the US, but you do get the raw data regardless.

Is there a tool which can help analyze this raw data? If not, I think it would be beneficial to create one, but I imagine this might be hard. Does anyone know how difficult it is to programatically test the genome, as 23andMe provides it, for various genetic disease risks? Is research on this easily available? Would a person need a significant know-how in the field, or can this be done by someone after a reasonable amount of reading on the subject?

<comment><USER24> geneticgenie.org analyzes your 23andme data. You can upload raw data or just link your 23andme with oauth. It might be more narrow in scope than what you had in mind since it is primarily used to generate a methylation and detox profile. I used it primarily to determine if I had a MTFHR mutation but it was helpful since it showed other potential issues with my methylation system.

I don't know how hard it would be to programmatically do, but if geneticgenie is any proof, it can be done.

</comment></comment><comment><USER25> Did they ever come out and repute this article about faking results for "racists"? Yes, it's on cracked but many a true word was spoken in jest.

[http://www.cracked.com/personal-experiences-2522-inside- shad...](http://www.cracked.com/personal-experiences-2522-inside-shady-world- dna-testing-companies.html)

</comment><comment><USER19> I wonder how this stacks up vs other BRCA tests in terms of performance and coverage of common variants. And also whether it is cheaper to use their DTC test rather than going to a doctor and getting insurance to cover the test? I assume this is not a sequencing based test?

<comment><USER26> It's a SNP chip and only covers a few common mutations.

To anyone who wants to know for sure whether you're at increased risk of breast cancer, you'll want to get a test that sequences _all_ the known mutations, along with another half-dozen or so genes that can have essentially the same effect as a damaging mutation in BRCA. I'd also urge you to find a genetic counselor, who can help explain the diagnosis in detail, as well as the limitations of the each kind of test.

<comment><USER27> Additionally, many harmful mutations are essentially "private" within a family and do not inform any of the GWASs used to create these SNAP chips. Regional sequencing is still important for persons with a family history of illness.

</comment></comment></comment><comment><USER28> so if I already did a 23andMe hereditary analysis, do I need to pony up more if I want them to reveal more about myself?

<comment><USER29> What I did a while back is download the raw data and run it through [https://promethease.com/](https://promethease.com/). Will tell you a lot more about risks, drug interactions. What it does is it compares your data to that of all the journal papers and research around that gene. Interestingly I have a SNP that is correlated with lack of empathy and another one that is the "warrior" gene. The BRCA SNPs would be identified.

<comment><USER26> I'd urge you to be cautious when interpreting those data. The effect size of most of these SNPs is tiny, often explaining (at most) only very small amounts of the variability observed between groups. This is especially true for things like personality traits, which have a _huge_ environmental component.

So, if finding out the empathy thing is fun, then by all means, keep poking around in your data! Promethease is probably the best of the bunch, and I've run my data through it. Just be mindful of the evidence level and effect size!

<comment><USER29> Yes, this is a good note for anyone interested in doing this. Other things to keep in mind, the paper source, while may be peer reviewed, most likely was not reproduced (a problem in the industry in general), so would be prudent to filter on # of publications supporting the SNP correlation. Also, the report will tell you relative risk, not absolute (e.g. 1.5x increased risk of getting breast cancer). In other words, your absolute risk may be 0.00001, so it can easily be 8x and it won't really matter. The most actionable items I've found for me personally were drug interactions due to genetics. Thanks for bringing up the caveats.

<comment><USER30> l'll second that, drug drug interactions and genetics is an under learned topic in the UK, I know that because my GP borrowed my book, 'Clinical Manual of Drug Interaction Principles for Medical Practice' :)

</comment></comment></comment></comment></comment><comment><USER31> Hmm. How long before health insurers use this to, uh, "personalize" rates? Note that many have wellness programs that incent employees to present blood samples.</comment>


The myth of the American Dream - <AUTHOR> http://money.cnn.com/2013/12/09/news/economy/america-economic-mobility/

<comment><USER2> I have seen a 1 000 000 USD note once, backed 'by American dream'. Looked solid.</comment>


RickRolling in the Bitcoin Blockchain - <AUTHOR> https://blockchain.info/tx/e6d4cfbbc45b5e3cfcfa36613b04a8732c7b4606f5dbbd8af3ba06d8f3899fc2

<comment><USER2> wonder how much time was spent to generate these addresses...</comment>


The pleasantness of Om - <AUTHOR> http://danielsz.github.io/2014/02/28/The-pleasantness-of-Om/

<comment><USER2> I know the use of object-to-HTML-mappers is only going to grow from here on out, but I really don't see the appeal in most cases where pure HTML would have been a perfectly readable and lightweight choice. We're becoming so scared of angle brackets that we seek refuge behind object-like constructs that are nothing but yet another impoverished and leaky abstraction layer above an already abstract markup language.

Look at that nightmare of a rendering code and tell me you'll still want to touch that when the time comes to go back and modify it in a few months.

I had the displeasure of working with Jade on a recent project. Not only was it more difficult for humans to parse than the HTML it produced, it was also slow to execute and generally cumbersome to modify. The main purpose of its existence might just be so programmers can lie to themselves about separating code from templates, and making those templates look really sophisticated at the expense of productivity.

The battle cry " _nobody should write literal HTML anymore_ " is not a good enough reason to do this - in fact it's not even a reason at all to begin with.

The example code in the article, well, I'm sorry to say that it's unreadable, convoluted, and huge for what it actually does. Both versions are terrible in their own way, only the JavaScript one is also deliberately sabotaged in order to really stand out as an abomination.

That being said, if there are people looking at this going "my, that _does_ look mighty pleasant" \- all the more power to you. A huge part of programming is finding technologies that map well to your brain. It just doesn't work for me at all (I needed to vent that just now, thanks for bearing with me) and I kind of hope I'm not alone.

<comment><USER3> It actually looks much more pleasant than HTML. The syntax is almost identical, except that HTML is much more verbose and difficult to read. This is a very different beast from Jade - Lisps translate to HTML very easily and transparently.

<comment><USER4> I'm not the world's foremost Lisp advocate, but you're absolutely right. It's even better than HTML in the sense that you don't have the "sometimes close the tag, sometimes not close the tag" inconsistency issue.

</comment></comment></comment><comment><USER5> Om looks interesting for more complex stuff, but I agree with others that the jquery version shown for comparison is a bit baroque. Here's a simpler one for comparison [https://gist.github.com/twfarland/9285304](https://gist.github.com/twfarland/9285304) Short, magic-free, and sufficient for something this simple.

</comment><comment><USER6> > Is it a rhetorical question were I to ask which of the two versions, Om + > Clojurescript vs vanilla JavaScript, looks more pleasant?

Well, the JavaScript is harder to read because of the colour choices and the fact that at least in part it looks to have been compiled from CoffeeScript (or something else).

Conversely, the ClojureScript is probably quite hard to read if you don't know what "peek", "reify", or "did-mount" mean.

<comment><USER7> * did-mount is a mapping to React's componentDidMount[0] lifecycle method (and, in Om, part of the IDidMount protocol[1])

* reify is the creation of an anonymous type instance, implementing 1..n protocols (not entirely dissimilar to an anonymous class in java). This could also have been done with a deftype (no difference in efficiency, but Om's creator seems to prefer reify):

        (deftype Widget [data owner]
          om/IRender
          (render [this]
            ; render code here
            )
          om/IDidMount
          (did-mount [this node]
            ; mount code here
            )

* peek's a bit more complex because it requires knowledge of interesting features (?) of Clojure collections: all clojure collections are immutable, and often built with conj(oin). conj "adds an item to a collection", but _where_ it does so depends on the collection (and its efficiency profile): (conj '(1 2 3) 0) -> '(0 1 2 3) but (conj [1 2 3] 0) -> [1 2 3 0] (lists can be efficiently extended from the head, vectors from the tail). `peek` essentially returns the last conj'd item, so on lists it's equivalent to `first`, on vectors it's equivalent to `last` (but faster)

[0] [http://facebook.github.io/react/docs/component- specs.html#mo...](http://facebook.github.io/react/docs/component- specs.html#mounting-componentdidmount)

[1] [https://github.com/swannodette/om/wiki/Documentation#wiki- id...](https://github.com/swannodette/om/wiki/Documentation#wiki-ididmount)

</comment></comment><comment><USER8> Om and React are cool, but this comparison is disingenuous. The author should have compared the Om implementation to a native (JS) React implementation.

I recently converted a React project to Om and found it to be a very enjoyable exercise. However, contrary to most tweets/blog posts, my Om code ran slower than the JavaScript version, which ultimately caused me to abandon the conversion. Full disclosure, the port was a naive implementation of a single page React component which probably wasn't the best use-case for Om ( (om/transact! ...) was causing a full page re-render to the VDOM).

Om/cljs is very beautiful and concise compared to JS ... immutability rocks! If I could achieve performance comparable to JS I'd switch in a heartbeat.

<comment><USER9> Is your project open source? I'd love to see what you're doing. From my understanding of React/Om, Om shouldn't cause a full re-render if React wouldn't.

The immutability of Om/cljs means that the code for determining re-renders (shouldUpdate lifecycle method) is (always?) faster than React.

</comment></comment><comment><USER10> I'm a huge proponent of both ClojureScript and Facebook's React. However, this is a severely broken comparison.

<comment><USER11> Its give me sympathetic shame.

</comment></comment><comment><USER12> The "looks more pleasant?" test can be valid only between cljs/Om and the CoffeeScript from which the generated JS was compiled.

By presenting Coffee's not-quite-idiomatic JS output as the counterpoint, the otherwise well made argument for Om's pleasantness is weakened.

<comment><USER13> yeah, it's riddled with '_ref's and the like.

</comment></comment><comment><USER14> Your post content keeps moving up and down when the ticker changes size. Makes the post unreadable.

</comment><comment><USER15> That sample widget was not a good idea. Tried reading the article on mobile & tablet, but I cannot: Every iteration showcasing a different testimonial changes the height of the widget, causing the _complete_ article to jump up and down.

Might be only a problem on a device like mine (S3 or Nexus 7), but it completely breaks the whole page.

</comment><comment><USER16> That JavaScript code is ugly because either:

1) the author tried to make it ugly. 2) the JavaScript was generated by a compiler.

Or, I suspect, both.

</comment><comment><USER13> Widget delays the load of the rest of the page.</comment>


LinkedIn Google Result – Title and Description in German - <AUTHOR> https://www.google.com/search?q=linkedin <comment><USER2> Not for me (UK). Are you searching from a German IP address?

Edit: I do see it if I manually navigate to google.com (I was redirected to the UK site at first)

<comment><AUTHOR> I'm in LA, and I checked on my phone as well (AT&T LTE).

</comment></comment><comment><AUTHOR> Not sure how long it's been like that, but an interesting snafu for such a large company.</comment>