Git is an editor, and rebase is the backspace key - <AUTHOR> http://blog.izs.me/post/37650663670/git-rebase <comment><USER2> I really recommend that this be a companion piece to Linus Torvald's own advice, here:

      People can (and probably should) rebase their _private_ trees (their own
      work). That's a _cleanup_. But never other peoples code.
      That's a "destroy history"

[http://www.mail-archive.com/dri- firstname.lastname@example.com/...](http://www.mail-archive.com/dri- email@example.com/msg39091.html)

He then gives specific advice.

<comment><USER3> Evolve for Mercurial (starting to show up in core mercurial) is trying to cleanly solve this.

It provides (safe) mutable history for local changes (the VCS tracks what is safe and what isn't), and a way to still be able to collaborate on changes without "surprising" the people who pull from you.

E.g.: [http://draketo.de/light/english/mercurial/hg- evolve-2013-01-...](http://draketo.de/light/english/mercurial/hg- evolve-2013-01-12)

<comment><USER4> Is there a difference between what he's talking about and phases that have been in Mercurial for a little while?

<comment><USER3> The vision was to have phase as the foundation for evolve.

We had some discussions as far back as mid-2010, at the time the feature was called LiquidHg. The first step was phase (differentiate between changeset states), and now it's evolve (make it flow).

</comment></comment></comment></comment><comment><USER5> Isaac has some controversial views at times (semicolon discussion anyone? ;) but here I fully agree with him.

When working on a very long and complicated feature on an unknown terrain, I commit "wip"s very frequently and rebase from time to time. I also frequently fork branches (from "foo-wip-1" to "foo-wip-2") before rebasing just in case I ever wanted to look at my messy history. When everything's done and thoroughly tested I delete a batch of branches.

This might sound like an overkill but it costs you literally nothing and might be useful sometimes.

</comment><comment><USER6> The most valuable feature from rebase to me is, that the one who commits to a feature branch, also "merges" the branch to the current master. So right after you finish your work on a branch, you can rebase even before having it reviewed by another person. When it's good to go, the actual merge is fast- forward.

<comment><USER7> That's exactly it. In one sense, it's just a better, less annoying form of merging. You get to sequence your commits on top of the current upstream (literally _re-basing_ ) without a merge commit that makes little sense in context. Then the ff-merge to master is also clean. I don't understand why anyone would be against this.

<comment><USER8> It's not that anyone is against it _when it's possible to do it cleanly_. But there are cases when that isn't true. Sometimes the branch is not ephemeral, so rewriting it becomes messy and risky.

I frequently find myself fixing or extending some open source project that my own systems depend on. Usually upstream will eventually take the patch, sometimes they might not. But I can't wait around to find out -- my own "master" branch gets deployed and lives a life of its own.

When upstream does get around the merging the changes, and I pull from upstream, the merge is 100% safe and clean because git sees my own commits coming back again. But if instead the changes were rebased, the chain of history is broken and git needs to go into conflict resolution mode. If I've changed other things since, I get a mess.

All of this gets even worse if you have things like continuous integration servers and git-based deploys. Those systems will happily deal with merges and break when you go and rebase a branch they've already seen.

</comment></comment></comment><comment><USER9> I'd like to take this post out of context and comment on the HN-submitted title alone. For me, it perfectly describes what i love about git _and_ what i hate about git.

Git is indeed an editor, but it's like edlin.

It's not Vim or Textmate or Excel. I want a Git that _works_ like an editor, not requiring me to keep in my head (or in some shell bells and whistles) 'where i am', and what I can or should do now. Not a UI frontend with buttons for single-shot editing commands, but a real editor, that makes use of 2-dimensional space, to somehow really edit everything that matters to me about versions and sharing and changes and all that.

It's a really powerful metaphor. Microsoft did something very right when they released Windows Explorer with Win95, which treats your harddrive like it's a document that you're editing (i bet it's a ripoff, but that's not the point here). Copy, paste, undo, it's all there.

Can't we design something similar for distributed version control? How well would document-editing metaphors map to git? My underbelly feeling says that it might be a surprisingly good match, given the right visualization and editing primitives.

<comment><USER10> Well, in lieu of a really thoughtful response, let me ask this:

If Git is an editor, the obvious question is... what is it editing?

I'm guessing that the answer is "history", but that's fuzzy to me and I'd have to think some more for a better answer.

<comment><USER11> The analogy with an editor seems weak to me, since pushed history shouldn't change. But you are editing something like a tree of patches (changesets).

</comment></comment></comment><comment><USER12> The correct permalink to this post: <http://blog.izs.me/post/37650663670/git- rebase>

</comment><comment><USER13> I really don't understand the advocacy of git bisect. Using git bisect boils down to figuring out at which point in the history a change happened that broke a test or introduced a bug. Having tried git-bisect five or six times, I've found it's way slower for me than the tried and true method of:

1\. Something's broken. What part of the code is broken? (perhaps 5 minutes tops?)

2\. git blame <file> (10 seconds)

3\. which lines in the trouble area were changed recently (10 seconds)

4\. git show <commit> to reveal what got changed in that commit and caused the problem

In 99% of these cases the git blame is just to see what the other programmer (or often myself) was trying to do at the time they broke the code -- in these cases it's obvious what's broken, just not why it was changed.

When it's nontrivial to figure out where the code is broken and I have no clue at which point in the history the code broke, it's still easier just to diff the broken code to a known good branch or commit and look for significant differences.

I guess where git bisect slows way down for me is that you have to devise code that will indicate definitively that the bug exists. It's really never faster for me than just eyeballing the troublesome code at that revision.

<comment><USER14> If you work on a small code base, or if you know the code base perfectly, you might get away with your "tried and true method" most of the time.

But if you are working on a code base with hundreds of commits per month, I wish you a lot of luck. Your 10s of seconds might easily become days.

On a big codebase you might even want to automate bisecting as much as possible. See <http://lwn.net/Articles/317154/> where Ingo Molnar says:

>>> for example git-bisect was godsent. I remember that years ago bisection of a bug was a very [laborious] task so that it was only used as a final, last- ditch approach for really nasty bugs. Today we can [autonomously] bisect build bugs via a simple shell command around "git-bisect run", without any human interaction!

<comment><USER15> > If you work on a small code base, or if you know the code base perfectly

Add to that "where bugs are guaranteed to appear in the same code path that causes them", and it becomes immediately apparent the value of bisect.

</comment></comment></comment><comment><USER16> I wish I could have both. Rebase to stick to single clean commit messages, but still preserve the history/order of modifications within that, even without the messages.

I might work on a project for a week, write some code, do an intermediate commit, realize it's not needed, delete it. Then when I finally merge into master (rebase), that code I wrote is forever gone. Which I think is fine, but two months later I realize I could actually use it. But there's no way to get at it, is there? Or am I missing something?

<comment><USER17> _Or am I missing something?_

That you can create arbitrary branches and keep them forever remotely or locally. If you think you'll need it branch off that point: git checkout -b branch_i_may_need then checkout the previous branch. a git log branch_i_may_need will always show the commit you needed at the top and git cherry-pick `git rev-parse branch_i_may_need` will cherry pick it into whatever branch you're on. That way you keep the commit and can still keep the remote repo clean.

<comment><USER18> You can also avoid doing the two git checkouts by just doing "git branch branch_i_may_need" and you'll stay in your current one. I do that all the time, though i had no clue about git rev-parse. That's a great time saver.

</comment></comment></comment><comment><USER19> > what does clean and tidy buy besides a sense of satisfaction?

What does _anything_ buy except for a sense of satisfaction?

</comment><comment><USER20> This is great, this is just the way I try to use git as well, even down to the --no-ff merges! :)</comment>


Why are IT systems in big enterprises usually built using Java? - <AUTHOR> http://www.quora.com/Why-are-IT-systems-in-big-enterprises-usually-built-using-Java-instead-of-Python-or-JavaScript?share=1

<comment><USER2> Because Java is a language developed by adults.

Over the long term the Java team has been making hard decisions and doing the right thing. Some guys wrote a paper about how the Java memory model was bogus and not right for multithreaded programming and they fixed it. C++ got around to this ten years later. Thanks to the global interpreter lock and lots of old GNU libraries that will never be treadsafe you can't do anything with threads in Python, Ruby, Javascript or other common interpreted languages.

The JVM team sees many tough challenges ahead and they are doing the hard work to make real solutions.

The strength of the JVM is so great that it is the ideal target for languages like Scala and Clojure and Groovy so if you can't stand Java syntax you have great alternatives -- and you still have access to all the amazing open source libraries that exist in Java, including the ability to plug into and interoperate with anything on the planet.

<comment><USER3> > Scala and Clojure and Groovy so if you can't stand Java syntax you have > great alternatives

The backers of Groovy promote it as having Java syntax so perhaps Scala and Clojure if you can't stand Java syntax.</comment></comment>


When will Bitcoin hit 100k? - <AUTHOR> https://medium.com/@sebastianhrw/when-will-bitcoin-hit-100-000-48338f5fefb7 <comment><USER2> Based on the amount of money I had yesterday before my salary and the amount of money I have after the paycheck I conclude that by 2021 I will be the richest man alive!

Bull on me.</comment>


Review my startup : Yoink http://yoink.com - <AUTHOR>

Hey,
Looking for some feedback about our startup http://yoink.com.
Yoink is the easiest way to get free things from people near you and give things away you don't need. Everything must be totally free, and once an item is Yoinked messages are exchanged to arrange local pickup.
Cheers! <comment><USER2> Awesome name!

Do you see yourselves competing with the craigslist "for free" section?

If so, how do you plan to compete? I'm not sure the map makes up for the sheer number of items on cl.

If not, what differentiates you from them enough to say you're not competing?

Couple of points: \- take taken items out. I found an item near me only to find out that it had been taken 8 months ago. Nobody cares about items they can't Yoink.

\- The text in the footer bar is rendering weird in chrome. It's got some strange white outline to it.

\- Move the search out of the map. I wouldn't have seen it if it wasn't pointed out here. I would also duplicate the search box on the get page.

\- How to get started belongs somewhere on the front page (maybe in a closable panel) not on the give or get pages. That page should focus on what's in the blue boxes.

\- on the get screen "You know you got to have faith." should be "You know you've got to have faith."

\- I like the stats page.

One last thing, how do you make money? I see no way to pay for anything and no advertising. Am I missing something?

Good luck to you!

</comment><comment><AUTHOR> suliamansaleh : There is a search box towards the bottom of the map

</comment><comment><USER3> very good idea, but i cnt search for things, :))

</comment><comment><USER4> <http://yoink.com></comment>


The death of the private citizen? - <AUTHOR> https://spectator.us/new-york-times-private-slate-star-codex-blog/ <comment><USER2> I think that ideological groups "naturally" seek to quell all differing groups. Like dueling beehives.

In decades past they could exist peacefully, insulated by a natural inability to communicate. An inability to rub against each other.

But now we are in the age of communication. We have the internet. The sensitivity and power of the hive has grown vastly. It touches much that it never touched before. Various ideological groups are now crowding each other. Grinding cheek and jowl. A thousand new "threats" become apparent. A thousand new demands for quelling.

So now we see more of that inter-ideological friction happening.

This is not a conscious act. It's more like gravity. Gallivanting glaciers. Or weather.

Charles Fort examined this phenomenon a bit. Check out his "Book of the Damned" for more on that.

<comment><USER3> If you're correct, then democracy will devolve into mob rule, which means anarchy. That's not a pretty thought.

<comment><USER4> Mob rule is not anarchy.

Arguably, it's one of the risks of democracy that motivates anarchists. (Now, there's a case to be made that anarchy also risks devolving into mob rule by a different path than non-anarchic democracy does, but they still aren't the same thing.)

<comment><USER5> Mob rule is not anarchism (the ideology).

It is however anarchy (the term), which is much older, and used to convey precisely lack of order and mob rule.

<comment><USER4> > It is however anarchy

No, it's ochlocracy; there's a reason the same people who named anarchy made a separate word for it.

<comment><USER5> Ochlocracy is mob rule.

Anarchy is lack of rule - not the same as anarchism (the ideology and ideal for self-government), as several oppressors can and are still at play in a state of anarchy, or everybody might be fighting each other and there can be constant power shifts...

Ancient Greeks used the term with this meaning, not to describe some anarchist utopia.

So ochlocracy is like the people turning into a mob carrying pitchforks. They are the law...

Anarchy - in the ancient Greek sense - is like there's no state and no all- encompassing rule of law to turn to. It's the "law of the jungle".

</comment></comment></comment></comment></comment></comment><comment><USER6> So, the SSC outing/doxxing story is now hitting the Spectator, National Review, Washington Examiner and Free Beacon websites, at least. It will probably spread to other parts of the mainstream media soon enough. How the NYT will react to this whole ruckus is anyone's guess, but sticking to their previous policy of publishing the article without removing sensitive info would be pretty hard at this point. Quite amazing, regardless.

<comment><USER7> This is par for the course for mainstream media outlets. In 2017, CNN threatened to dox an anonymous Twitter user making political memes.

I don't know why people continue to speak to these outlets while their records, actions and ethics are appalling.

The slide into clickbait and yellow journalism over the last few years has been devastating to the industry. There isn't a major outlet left that hasn't been behind some whopping journalistic errors (usually repeatedly). Not even self-described neutral outlets like AP are immune.

At this juncture, I'd sooner trust an independent journalist with 50k followers and a handheld camera on YouTube than a major news outlet.

<comment><USER8> Sadly NPR, and I don't mean the local programming, are also prone to lapses in journalism—even though I give props to Greene and Shapiro. They're usually pretty even keeled, unlike Bob Mondello who seems a bit narcissistic.

<comment><USER7> Less than 3 days ago NPR deleted a tweet (with no retraction) that heavily implied a person who was violently attacked in his vehicle and then sped away to avoid the violence was a "right-wing extremist" involved in a "vehicle- ramming incident" [1] -- with zero reference to the violent attack initiated on the vehicle.

[1] [https://pbs.twimg.com/media/EbEIlsUUcAACYht?format=jpg&name=...](https://pbs.twimg.com/media/EbEIlsUUcAACYht?format=jpg&name=large)

Additionally, the protesters who attacked the vehicle were arrested, including one who brandished a gun at the vehicle and another who assaulted the driver. [2]

[2] [https://www.wave3.com/2020/06/18/protesters-arrested- followi...](https://www.wave3.com/2020/06/18/protesters-arrested-following- altercation-with-driver-downtown-louisville/)

NPR's tweet came after the arrest and live video footage of the incident. They chose to run the story anyway.

</comment></comment></comment></comment><comment><USER9> There's a great guideline: Always be at least two of: kind, necessary, or true. Publishing Scott's legal name is truthful, but neither necessary nor kind.

</comment><comment><USER10> This isn't really new.

Based on the few encounters I've had with journalists, I cannot imagine a reason I would voluntarily interact with one unless I was reaching out for a reason.

5/7 interactions, the reporters were a lazy turds who strung together some drivel to meet deadline, missing key facts and mangling the story.

</comment><comment><USER11> Very interesting article. I'd hypothesize that this comes out of the fact that this is rooted in the idea that "the personal is political". This has led to the growing idea that not taking a stand on an issue is supporting the status quo and therefore just as political. Therefore, everyone must "pick a side". This is reflected in the attacks on people who don't condemn political movements, but refuse to support them.

While this isn't directly related to the situation with Scott Alexander, it sets the precedent that everyone is now "fair game".

<comment><USER12> >I'd hypothesize that this comes out of the fact that this is rooted in the idea that "the personal is political".

A lot of these concepts are derived from the French historian Michel Foucault (he was not a philosopher or a "critical theorist", he was the chair of history at a major French university) and bear out the interpretations that won out in American humanities departments and trickled down to street level as a generation of grad students hit the streets after 2008 as humanities depts shuttered left and right.

Occupy Wall Street wouldn't happen today because it was the last vestige of '68 style old school European Left politics. In 2008, good ol' class consciousness was the last thing critical theory and Humanities depts were discussing. 'Identity politics', itself the evolution of 80/90s Critical Race Theory, had already started to dominate academic circles in the late 90s/early 00s, to the point that the popular, heralded Slovenian Marxist Slavoj Zizek dedicated a whole book to the topic, arguing on behalf of good ol' universality as pivot point for politics against popular writers like Judith Butler (gender/sexuality) and Wendy Brown (race).

Coming to software as I did from continental European philosophy study it's been quite fascinating watch a species of Foucault interpretation become the mainstream Left ideology in America (and one that differs in my reading by quite a bit).

</comment></comment><comment><USER13> "The death of the private citizen who publishes publicly with their own personal information attached".

First name + middle name + occupation + city isn't "private".

<comment><USER14> The article states numerous examples of media outlets outing anonymous and pseudo anonymous identities.

</comment></comment><comment><USER15> Good article. I find the reaction of the "private citizen" symptomatic of a larger rejection of the idea that people can be multi-faceted, and that different facets can be valued while others not.

</comment><comment><USER16> Just like the Gawker case.. To decide to pursue a story that may not be all that newsworthy, or to unmask someone and say it's just presenting the facts, must have some emotion driving that. Because if there is no emotion driving those decisions, then it's a really rotten way to run a newspaper.

</comment><comment><USER17> I am in no way a fan of the Failing New York Times (if I may quote a prominent contemporary statesman), but am I missing something by thinking that this is overblown? They haven't printed his name, only asked if they may do so. I also don't see where they threatened him with exposure, but the article claims they have.

<comment><USER18> They didn't ask. He asked them not to, and they refused and said they were going to publish the article about him even without his cooperation.

</comment></comment><comment><USER19> So NYTIMES policy is to Dox their sources ? I don't see them dox the opinion column of the famous "anonymous" government official or other tyrants.

<comment><USER20> I was always under the impression that journalistic integrity was staked on providing anonymity to anonymous sources. In the past it was something the most respected journalist would have gone to prison over, but in today's world I guess it's whatever keeps those click rates high.

<comment><USER21> Well, yeah, for anonymous sources. A random blogger they're writing an article about usually isn't an anonymous source.

The ethics publishing name etc. are absolutely debatable, but the anonymous sources you are talking about are something completely different. Those are people who only agree to be sources for the story on the condition that their anonymity will be protected.

</comment></comment></comment><comment><USER22> I saw a comment on Twitter that what you're really seeing here is dueling philosophies, and I agree.

Ever heard the expression, Sunshine is the best disinfectant? I think you're seeing it's logical endpoint with the SSC story. And while it seems to have fallen out of fashion, for the most part, I agree.

It seems to me that no matter where you turn, when it comes to 'the truth and nothing but the truth' about someone or something, you face bad choices.

The problem with allowing some people to be pseudonymous sometimes is that immediately all kinds of bad actors will rush in and try to claim that in their defense. Polluters claiming anonymity because they don't want to be targeted by eco-terrorists, for example. Rather than parsing ever-smaller hair-thin rules about - legitimate - illegitimate - legitimate - and getting docked on every one on charges of political bias - there's an easier solution. Give no one pseudonymity. Problem solved.

The only exception - national security - doesn't require your agreement to accept; it just takes a willingness to not go to jail. It's an appeal to power, really. So you don't have to debate it on moral grounds, it's the law.

Incidentally, for all those stories where the NYT allowed pseudonyms, I agree there was an inconsistency, but my conclusion was: resolve it by publishing them all. Publish Bansky's name, publish Ferrante's name, publish the name of whoever wrote that tell-all book. Make that the norm, instead of half-applied psuedonyms.

Now if you arranged an interview with them about something other than their identity, and they agreed to talk to you on condition of you not revealing it - that's different. That news outlet can't break the story. But another one can. No exceptions. Sunshine is the best disinfectant.

I do believe this in principle, believed it long before this story broke, and could be brought around to disallowing most anyone's pseudonymity, before this news became news. It doesn't matter to me at all what the content or leaning of the blog is. Whether they're left or right or 'good' or 'bad' \- I believe in the secular version of 'you shall know the truth & the truth shall set you free.'

There is a cost, a real human one. But, rather like capitalism and democracy, it happens to be less than every other alternative. It's not great that people can't be pseudonymous - but it prevents worse problems.

<comment><USER23> >but it prevents worse problems.

Like you, I also comment on the internet under my real name, so pulling back the curtain on everything else is an exciting prospect.

But for that not to ever bite us, that requires that we never offend too many people, even for a brief second.

I naturally stay within bounds, so that is fine for me, but I suspect many opinions would need to remain hidden if a war were waged on anonymity.

Why can't ideas be allowed to exist on their own, detached from any known person?

<comment><USER24> > Why can't ideas be allowed to exist on their own, detached from any known > person?

Perhaps because their formation was coloured by someone else's experiences and prejudices. Why is it wrong to want those who propose these ideas to take credit and responsibility so that we can examine the idea and the nature of the person who conceived the idea. These ideas exist to persuade; they should be examined as the rhetorical sophistry that they truly are and not in some pretend world of spherical cows and platonic ideals.

If you temper the ideas you propose to the public it could be because you are afraid of offending someone, or it could be that you are simply someone who is capable of feeling empathy. Given the similar result does it matter which reason is the source of such self-regulation, and are we worse off for it?

<comment><USER25> You're making an oversimplification of generating offense. You can be afraid of offending someone, but the idea that generates the offense can still be correct.

</comment></comment></comment></comment><comment><USER26> Maybe it's not a bad thing.

Look up the etymology of idiot.

<comment><USER26> I think it got misunderstood

</comment></comment><comment><USER27> I still have no idea why people are making this whole thing about a political point or 'controversial opinions'. The facts are:

-The NYT wanted to write about SSC notably because SA warned about covid ahead of time, wrote a nice piece about the effectiveness of masks, etc.

-The NYT did not care enough about Scott's pseudonymity to keep it intact

-Scott, fearing that his relationship with his patients might be jeopardized if they got linked to his personal blog, deleted it.

Where do 'the mob' or 'controversial opinions' or 'ideological differences' factor in this _at all_? It is not 'the mob' that triggered this, in fact Scott upset a lot of people over the years with some of his articles and that hasn't deterred him from keeping them up blogging further. The NYT isn't reporting on the SSC commentariat's curious obsession with the IQ of black people either. So why do 90% of posts on here are making it about politics? If I were not charitable beyond reason I would start to believe HN's love of neutral, level-headed and impassionate discussion might be an act.

<comment><USER28> Scott didn't take down his blog just because of his relationship with his patients. It's one of his core arguments, yes, but it's tied with modern cancel culture, where speaking your mind if it deviates from accepted norms and ideas can result in significant personal and professional consequences, even if your intent isn't to oppress, spread hate speech, promote racism, etc. and even if the ideas you express are valuable in some way. It's dangerous nowadays to toe the line of what's "acceptable", where what's acceptable is decided by what people happen to feel on any particular day and how something can be spun into something it's not. Any number of character assassinations we've seen (such as the attempt on Stallmann) show that there are risks to being visible if some people suddenly decide they don't like you. Which connects with his other concern, that he may become too much of a liability for the place he works if some group or other finds something he's said controversial and tries to punish him or his employers for it.

<comment><USER27> At no point did he mention cancel culture or 'the norm'. In fact, his argument entirely revolved around his relationship with his patients and that has little bearing on what he believes about the IQ of black people, since, as he says, his patients run the full gamut of the political spectrum (so _any_ opinion would be controversial to some of them). It's more about the fact that psychiatrists are apparently supposed to act as blank slates to their patients and his blog contains a lot of deeply personal stuff. Even without the politics stuff it'd be a problem.

<comment><USER28> Are you sure you read his blog entry?

> The second reason is more prosaic: some people want to kill me or ruin my > life, and I would prefer not to make it too easy. I've received various > death threats. I had someone on an anti-psychiatry subreddit put out a > bounty for any information that could take me down (the mods deleted the > post quickly, which I am grateful for). I've had dissatisfied blog readers > call my work pretending to be dissatisfied patients in order to get me > fired. And I recently learned that someone on SSC got SWATted in a way that > they link to using their real name on the blog. I live with ten housemates > including a three-year-old and an infant, and I would prefer this not happen > to me or to them. Although I realize I accept some risk of this just by > writing a blog with imperfect anonymity, getting doxxed on national news > would take it to another level.

He doesn't name cancel culture, but it's obvious it's a part of what he's worried about.

<comment><USER27> There's no evidence all of this comes from cancel culture. As I said in a previous thread, the main doxxing comes from an alt-right dude who angrily posted Scott's personal info and clinic because he believed to be shadowbanned.

Seriously, look at Scott's post where he quotes disparaging opinions about him. You'd be surprised at how much of the vitriol comes from the alt-right, calling him limp-wristed, a beta cuck, as well as any number of Jewish slurs. And the alt-right _does_ have a far more prominent record in actually killing people than blue-haired people on twitter.

</comment></comment></comment></comment></comment><comment><USER29> All of the examples in the article are people who spoke up about various things online that are clearly in the public interest. If you want to maintain a blog about a subject, if you want to speak out publicly and gain some sort of online rep, then you risk your identity being released. That's freedom of speech. If you are the author of a meme that becomes nationally significant (ie the president adopts it) then CNN will be on your lawn.

If you want to be actually anonymous, I suggest not using facebook or any other online identity tied to your real name. Get a VPN. Learn to use tor. It isn't very hard, just inconvenient. Don't post on facebook.

<comment><USER30> _That 's freedom of speech._

To avoid making an incorrect assumption, and reading this in context with the rest of your post: are you saying it's "Freedom of speech" if someone has a blog or "Freedom of speech" is having your identity revealed as the _owner_ of said hypothetical blog?

Just trying to make sure if I've read and interpreted your comment the way you're wanting it to be consumed and understood by people reading it.

<comment><USER4> Both publishing on your own blog and publishing true, not-legally-protected facts about someone who owns a blog are exercises of free speech.

It's not either/or.

<comment><USER30> I assumed that was the meaning, but I'm also trying to defer to authorial intent-a bit risk averse to assume with how hot this topic has been lately and all.</comment></comment></comment></comment>


Ethereum White Paper – annotated version (2015) - <AUTHOR> http://fermatslibrary.com/s/ethereum-a-next-generation-smart-contract-and-decentralized-application-platform#email-newsletter <comment><USER2> The annotations I see look very thin.

Was this submission to HN intended to generate interest to crowdsource more annotations (à la RapGenius)?

<comment> aaron-lebo Seems to be a subtle way of drawing interest to the site (see the author of annotations) using a currently hyped tech. Of course, Buterin has earned the right to be annotated along with greats such as Einstein and Keynes.

Snark aside, this is a really cool site. They seem to be attempting to annotate a variety of papers (amateur and professional), so it's understandable. It is a bit jarring to see something by Kenneth Arrow or Feynman alongside Ethereum marketing material, though.

They've even got McCarthy (maybe a better expenditure of time):

[http://fermatslibrary.com/s/recursive-functions-of- symbolic-...](http://fermatslibrary.com/s/recursive-functions-of-symbolic- expressions-and-their-computation-by-machine)

<comment><USER3> > ...Buterin has earned the right...

Care to explain why?

<comment> aaron-lebo Is building a new currency that is the platform for billions of dollars of rampant unproductive speculation not enough?

<comment><USER4> That is usually the bar, I like the relativity of how people's opinions suddenly begin mattering because they were associated with something that is over a billion dollars now.

Don't know why people may try to create a separate standard for cryptocurrency.

<comment><USER5> Of course I'm just speculating (ha), but Ethereum is more than this. You can build your whole payment gateway from a smart contract. I participated in a crowd-funding event that (no, not an ICO) had me so impressed with the payment gateway tech, I had to send more money twice just to recap what I just learned about this new cryptocurrency.

[https://firefly.city/](https://firefly.city/)

The device itself is pretty impressive for $5 worth of parts, but I did not really hit "wow" until I saw how easy it was for this guy to take my money and establish a point of contact and a payment relationship that can support repeat business. (He's also the one who built this payment gateway, it lacks some for polish but it is also as a bonus, essentially proof of concept that shows how the device can work. tl;dr: it's a portable thin wallet that runs inside of the browser, you get a javascript file that you can save and keep as a backup of your keys. The arduino jobber is just doing the signatures.)

The tokens do not need to appreciate in value, that helps speculators of course, but if you don't yet recognize that Ethereum is a substantial advancement over Bitcoin, I can't really help you with that. You'll have to figure it out! While I'd love to get rich off of trading the coins, if they can simply just remain stable in valuation it is ultimately going to change how we do money around the world, I don't doubt this anymore.

<comment><USER4> Did you take my comment to be a criticism or trivialization of Ethereum in some way? Why are you telling me any of this, I am very familiar with solidity development

<comment><USER5> I misread this sentence completely:

> Don't know why people may try to create a separate standard for > cryptocurrency.

Interpreting Ethereum to be "the separate standard for cryptocurrency" rather than the standard being about what is noteworthy. Eg. "Why aren't people just satisfied with Bitcoin, it is already the standard" Sorry! My mistake.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> The Ethereum white paper was published in 2013.

The events surrounding TheDAO, which the annotations mention, occurred in 2016.

I'm not sure where the 2015 in the HN title is coming from.

</comment><comment><USER7> [https://genius.com/Ethereum-ethereum-whitepaper- annotated](https://genius.com/Ethereum-ethereum-whitepaper-annotated)

It's also on genius, not super annotated

<comment><USER8> is Genius still a thing? It was constantly on HN years ago and the founders looked like superstars but I haven't heard too much since then.

<comment><USER9> It's definitely still a thing, its just that 99% of people only really care about song lyrics from (12-24) years old.

A lot of the buzz moved on to stuff like Music.ly but Genius is still doing good business.

<comment><USER10> It's funny to see how data generates itself based on societal interest. Like, you're going to have shittons of training data if you were going to look at commentary on Jay-Z lyrics but not on, say, Principia Mathematica haha.</comment></comment></comment></comment>


Ron Paul investment ad predicts currency crisis, civil unrest - <AUTHOR> https://www.yahoo.com/politics/ron-paul-investment-ad-predicts-currency-crisis-118207796096.html

<comment><AUTHOR> I have much respect to this man, he is a financial genius. He predicted almost every financial crashes in the past 40 years. But I hope he is wrong about this.

</comment><comment><AUTHOR> I also feel bad Ron Paul got into creating an infomercial style video. It will worsen his image for those who don't know him.</comment>


U.S. Is World's Most Competitive Economy for First Time in a Decade - <AUTHOR> https://www.wsj.com/articles/u-s-is-worlds-most-competitive-economy-for-first-time-in-a-decade-1539727213 <comment><USER2> Meanwhile, household debt is at it's all-time high, $13.3 trillion... surpassing its previous peak in 2008. [https://www.newyorkfed.org/microeconomics/hhdc.html](https://www.newyorkfed.org/microeconomics/hhdc.html)

This article seems like fluff/propaganda.

<comment><USER3> when ppl think of household debt, they think big screen TVs and other discretionary items, but it's actually mostly mortgages and student loans [https://www.valuewalk.com/wp-content/uploads/2017/05/US- Hous...](https://www.valuewalk.com/wp-content/uploads/2017/05/US-Household- Debt-1.png)

<comment><USER4> Which is even scarier.

In case of default, discretionary items can be seize and sold to at least repay part of the debt (while decreasing quality of life).

2008 has shown what seizing houses leads to.

Now think that there is nothing to seize for student debt loans.

If you fail to get a good enough income using the degree you paid using debt, you are as hopeless as if you had used it all on hookers and cocaine. At least with discretionary items you have a big TV which holds some value.

<comment><USER5> Cars might hold some value, houses might hold more value over time, but TVs? Don't expect much.

What we need is to make college debt discharable through bankruptcy, same as any other debt. Then the only people who can borrow are those likely to be able to pay it of, which nicely solves the problem of unplayable college debt (while reducing the interest students of medical, science, law etc have to pay, since more money will be chasing fewer students), for profit colleges and useless degrees.

Does it mean some people won't be able to study their favourite subject? In general no[0], in college? Yes.

[0]: Remember the " you dropped 150 grand on a fuckin' education you could have got for a dollar fifty in late charges at the public library!"? Today it is probably 15 USD on Beeminder, and you won't have a degree, but that degree is worthless in the first place, so overall huge win.

<comment><USER6> Ha! Can we use that footnote in our marketing copy? :)

<comment><USER5> Sure

</comment></comment></comment></comment></comment></comment><comment><USER7> The content of this article is based on the 2018 The Global Competitiveness Report which you can find here: [http://www3.weforum.org/docs/GCR2018/05FullReport/TheGlobalC...](http://www3.weforum.org/docs/GCR2018/05FullReport/TheGlobalCompetitivenessReport2018.pdf)

<comment> munk-a So there's a handy table in that document that shows all the rankings and notes that the US position hasn't moved in the past year, how is this article even a thing?

<comment><USER8> You're not wrong that the chart shows that rank didn't change for some reason, but if you look at the 2017 report you'll see the US was number 2 last year.

</comment></comment></comment><comment><USER9> That economic growth came at a pretty severe cost though.

The budget deficit blew out by 17% in 2018 as a result of the tax cuts.

<comment><USER10> For a long time I couldn't wrap my head around why defecits matter to the US when we print our currency. To be honest I still don't fully understand the hand wringing over a balanced budget and reading more about modern monetary theory is leading me to believe that for a superpower which issues it's own currency the defecit is more of a political issue that a concrete one.

The defecit just keeps ballooning but the only thing stopping the US government from running are self imposed restrictions on debt (the "debt ceiling"). The US is not a company, and it's not a normal household, why does the budget matter?

<comment><USER11> The deficit mainly matters because we have to pay interest on the loans we take out. If the rates are good, it's actually a great investment. If the rates are bad, it hamstrings future growth, because now the budget is spent paying back old loans instead of building new things.

Well, why can't we just print money? We can, but it runs the risk of inflation. Inflation is historically low, so yes -- we could totally just print a bunch of money to pay back our debts with relatively little risk of inflation in the short term.

Essentially, debt doesn't matter, except that we have to pay interest. Interest doesn't matter because we print money, except that it might cause inflation. Taxes "destroy" money to dampen inflation. Thus, we can pay off our loans, but that might cause inflation, which might require us to raise taxes not to repay the loans, but to prevent inflation.

<comment><USER12> In other words, we don't have to pay interest, we choose to, because inflation would almost certainly rise substantially if we printed a ton of money, and we're cautious (some might say overcautious) about inflation.

Of course there are some head-scratching rationalizations going around about why gargantuan deficits are good _now_ , a decade into one of the longest economic expansions in living memory, but would have been bad to do when proposed in response to one of the deepest recessions in living memory.

</comment></comment></comment></comment><comment><USER13> And fewer and fewer people benefit from it.

So okay. Great. Now let's do it in a way that doesn't turn the entire nation into a series of hyper-reactionary tribes fighting over leftovers.

</comment><comment><USER14> [http://archive.is/b1dLN](http://archive.is/b1dLN)

</comment><comment><USER15> Seems relevant: [http://www.doingbusiness.org/en/rankings](http://www.doingbusiness.org/en/rankings)

</comment><comment><USER16> Is that 2008 based on data immediately before or after the largest economic catastrophe sine the Great Depression?

</comment><comment><USER3> I think it has been competitive for a lot longer than that. Despite all the bad news about partisanship, Trump, wealth inequality, there is a lot of innovation in the US and intellectual output from research universities and the private sector. It's why the rich Chinese keep coming here and keep buying up the real estate and applying to the most prestigious of universities. There's more good news than bad even though the former gets so much attention.

<comment><USER17> It moved up from #2 last year. A less sensational headline would be something like "A bunch of countries with approximately equal competitiveness scores had their scores change by approximately 1%".

</comment></comment><comment><USER18> Competitive or competent?

</comment><comment><USER19> Is it just me or has the HN front page been more overtly political in the last few days? This is #1, some fear-mongering about China from Bloomberg is #2 (as if we forgot their technical fear-mongering about China the other day), and both of the stories are mainstream news (explicitly discouraged in the Guidelines) and have no particular "hacker" angle, except insofar as many hackers participate in the world economy just as many normies do. Earlier there was an NYT opinion piece from a sad conservative college professor (flagged), and before that a page from GOPUSA.com calling an internal Google presentation "the end of free speech as we know it" (flagkilled).

How is this stuff getting upvoted?

<comment><USER20> There are now 5 million visitors a year. So it's not really shocking that more "mainstream" stuff does better these days than it might have done back in the day.

I tend to feel like I have no idea whatsoever what will do well here. I sometimes decline to post some article because I think it's not HN worthy, only to see it on the front page later.

I sometimes get accused of posting _political_ pieces when, to my mind, they are interesting for sociological reasons. I certainly don't post things to promote any kind of political agenda per se.

I also didn't notice the things you are specifically commenting on. I recall different details from the front page. So there's possibly a certain amount of "You just happened to see X for some reason." which isn't conclusive proof of objective fact.

<comment><USER21> Yeah, HackerNews seems to be getting closer to Reddit by the day.

<comment><USER20> I don't know what you mean by that. I participate on Reddit. I experience HN and Reddit as completely different animals. I see them as very extremely an _apples to oranges_ comparison.

<comment><USER21> Perhaps my comment was the prime example ]=

What I meant is:

Three years ago, HackerNews seemed (to me) to be a forum for intellectuals to discuss things business/tech-y. Opinions were mostly well thought out. When they weren't, they were challenged (thanks for calling me out [= ).

Now it just seems like the break-room banter. A lot of sensationalist articles seem to make the front page. A lot of purely comedic comments (which I do appreciate). A lot more unfounded anecdotes. A lot of promotional posts, etc.

Also -- and I'm admittedly putting on my tin hat here -- I've seen a lot of discussions that seem like they're just troll accounts trying to further polarize the community.

Maybe I'm part of the problem ]=

<comment><USER20> Hacker News is a single entity. Reddit is a conglomeration of sub forums, each with their own interests, rules and moderators.

Reddit is a very cosmopolitan environment. It's like a big city, where you can participate in different social groups and there can be overlap in members, but it isn't guaranteed. Your behavior on one sub forum can impact your reputation on another, but it isn't the same as a situation where you deal with the same moderators and same group of people all the time for everything.

I don't hang on "the front page" of Reddit. I have a few niche interests I dabble in a bit over there.

I occasionally consider writing a blog post to talk about some of the differences between forums of various formats that I've experienced. It's more than I care to try to catalog in a comment here.

But when you say "HN is like Reddit," that doesn't even parse for me. Because it's like "So, exactly what part of Reddit are you comparing it to?" It strikes me as a _six blind men and the elephant_ scenario.

</comment></comment></comment></comment></comment></comment><comment><USER22> HN: no politics allowed, except when they are.

<comment><USER23> If you really care, you could try to flag it couldn't you?

A lot of the users seem to be more business oriented though, and they will want to hack the economy... So good luck.</comment></comment>


Show HN: Mini ICOs of physical (art) pieces - <AUTHOR> Hi everyone, We just launched possibly a first ICO of a physical object ever.
The project page is here:
http://www.trivial.co/
And the first ICO page is here:
http://www.trivial.co/auction/
The first item sold is just a rat mascot with no artistic purpose, but possibly - a high historical one :)
The site requires MetaMask to track ICO's progress - we'll be fixing that soon.
Any feedback will be appreciated. Especially potential new sellers, ideas for things anyone would be willing to buy, and ideas for investment funds willing to play with such tokens :) <comment><USER2> I know posts about blockchain related technologies are all over HN these days and I think it's all super fascinating. But it took me reading your post, going to the links provided, skimming through your whitepaper (even the glossary in the paper) to try and figure out what an ICO is. I couldn't find it on there at all. After googling it, I finally figured out that it's Initial Coin Offering which allowed me to finally understand what this was all about but my interest was already fading pretty fast.

Not everyone speaks blockchain. Overall cool idea though.

<comment><AUTHOR> Oh wow, you're absolutely right. This week is all about bugfixes etc, but next week we will add a section for Blockchain newbies.

Thanks a lot for this feedback :)</comment></comment>


Your papers please: TSA bans ID-less flight  - <AUTHOR> http://news.cnet.com/8301-13739_3-9962760-46.html <comment><USER2> This article is from 2008...?

</comment><comment><USER3> From the article:

>TSA's new rules only protect us from a non-existent breed of terrorists who are unable to lie.

The rules, as described by the article, instead protect the "secure" area of the airport from those who wish to assert their right to fly without presenting ID.

</comment><comment><USER4> A little off topic, but I like to also have my passport in a hidden pocket in my travel jacket just in case my wallet with drivers license is stolen while travelling.

We just flew across the country to see family.

Had to put up with 2 TSA groping sessions.

Also, one more little rant: I hate it that TSA tries to pass itself off as a part of government or as a proper police agency. No, they are a for profit corporation. I add the suffix "corporation" whenever I use "TSA" in conversation to hammer in that point.

</comment><comment><AUTHOR> This was submitted while reading another more current article about the TSA testing out new ID system.

<https://news.ycombinator.com/item?id=3878142>

</comment><comment><USER5> this is 4 years old, and has been this way for quite a while</comment>


Teardown of a Failed Linux LTS Spectre Fix - <AUTHOR> https://grsecurity.net/teardown_of_a_failed_linux_lts_spectre_fix.php <comment><USER2> > The takeaways here are that there is a real benefit to having an > external/independent review and backporting process like the one we perform > for our customers

That's great for sales for these people, but I think the real takeaway here is:

> when the actual merge of the tree was performed, no mention was made of > [Linus's] correction to the [original] fix, and with no specific commit > mentioning the correction and fixing it alone, everyone else's processes > that depended on cherry-picking specific commits ended up grabbing the bad > warning-inducing change. As a further failure, instead of looking at Linus' > correct fix (observable by checking out the master tree at the time), the > approach employed in the LTS kernels seems to have been to naively silence > the warning

There are a LOT of process failures in this description of what happened. At the kernel development level, that should be very concerning.

It's good that an external auditor found it (hooray open source), but this was almost definitely an easily preventable mistake with a better process.

> everyone else's processes that depended on cherry-picking specific commits

This alone sounds horrifying.

I don't know anything about kernel development, so I don't want to sit here and judge and offer advice out of ignorance, but I really do feel like there's a better process that would work for them that doesn't involve people "cherry- picking specific commits."

<comment><USER3> Can you make a recommendation of a process which doesn't involve cherry-pick commits (or more often patch-sets)?

Note, your process needs to allow a fix to be developed against V5.1, and back-ported to V4.1.

I suspect one of the problems here is a lack of bug tracker, which would have associated the fix to the merge and the fix itself together.

<comment><USER4> > Can you make a recommendation of a process which doesn't involve cherry-pick > commits (or more often patch-sets)?

This is for LTS, Long Term Support. Why would the maintainers be cherry picking candidate patch sets at all? Shouldn't they wait for a release and back port from that? Regular release intervals are 8-10 weeks.

That would be my recommendation, backport only from releases. This is especially the case here because it was a security fix.

<comment><USER5> Patches have to be in Linus's tree before they land in -stable. That's been the policy for at least as long as I remember. Also, Greg does releases of -stable every week or two -- waiting 8 weeks for patches (that Linus has already merged) makes very little sense.

Yes, fixup patches are something that need to be handled separately but Greg has always handled those properly (and good kernel devs use the Fixes: tags and always Cc: stable on those fixup patches). Not to mention you'd need to handle fixup patches even if you did depend on releases (if a bug was introduced in a released version it's usually fixed by the next -rc1 -- so waiting means the newest kernel is broken needlessly for 8 weeks).

</comment></comment></comment></comment><comment><USER6> > Finally, it should be noted that the "many eyes" of the upstream community > failed to notice this flaw; without this blog post it would have likely > persisted for many years.

Such a spicy remark, this whole post is great. (Though "many eyes" typically refers to an oft-claimed quality of open source generally with no arbitrary distinctions of upstream / downstream. grsecurity makes up some of those valued eyes for Linux!)

This makes me wonder what other logic errors were introduced into the kernel because of an incorrect resolution to a warning...

</comment><comment><USER7> It's wonderful of grsecurity to produce a review like this - it'll be extremely helpful in addressing any issues in the development and patch management process. One can only think what improvements we might see in regards to Linux security, as a whole, if they'd work more proactively with the rest of the community. Of course, they're under no obligation to do so.

Unfortunately, I doubt that we'll ever have their participation - or even see or review any of grsecurity's modifications - all because of grsecurity's "Access Agreement". [0] Essentially, if I understand it correctly, even if grsecurity's customers wanted to, by sharing grsecurity's work with us or anyone else, those customers stand to have their access to the latest grsecurity created derivatives of the Linux kernel revoked. Of course, if that's true, facing a penalty for sharing code grsecurity received and modified per the GPL just doesn't sound right or just to me.

It seems obvious to me that one must carefully consider the wider picture when evaluating linux security posture evaluations, as presented by grsecurity, as there may be conflicts of interest in effect. I take what grsecurity says about the security of the Linux Kernel with a very large grain of salt, and you should as well.

Further, I'm not a legal expert and I use measured tones as grsecurity have taken legal action against open source community members in the past for expressing their opinions [1] on the matter of the access agreement [2]. While those matters were dismissed by the court [3], I am still hesistant to say anything, but find speaking on this matter a neccessary thing to do, for what I perceive to be the good of the community.

[0] [https://grsecurity.net/agree/agreement_faq.php](https://grsecurity.net/agree/agreement_faq.php)

[1] [https://perens.com/2017/06/28/warning-grsecurity- potential-c...](https://perens.com/2017/06/28/warning-grsecurity-potential- contributory-infringement-risk-for-customers/)

[2] [https://www.theregister.co.uk/2017/08/03/linux_kernel_grsecu...](https://www.theregister.co.uk/2017/08/03/linux_kernel_grsecurity_sues_bruce_perens_for_defamation/)

[3] [https://perens.com/wp- content/uploads/sites/4/2017/12/file0....](https://perens.com/wp- content/uploads/sites/4/2017/12/file0.43502131597246.pdf)

<comment><USER8> > Of course, if that's true, facing a penalty for sharing code grsecurity > received and modified per the GPL just doesn't sound right or just to me.

The GPL requires distributing the modified source to people you distributed a binary to. If grsecurity's clients don't distributed a binary, they don't have to distribute a source.

EDIT: though there's this clause, and I'm not quite sure what to make of it:

> Each time you redistribute the Program (or any work based on the Program), > the recipient automatically receives a license from the original licensor to > copy, distribute or modify the Program subject to these terms and > conditions. You may not impose any further restrictions on the recipients' > exercise of the rights granted herein.

<comment><USER9> GRSecurity has the same, odious, if legal posturing as RedHat - the GPL requires the _current_ version's source (which customers have access to), be made available to customers. Upon sharing of the current version's source in a useful format to the public, _licensing_ for future version is denied - ie, you cannot be a future customer of RedHat. Thus you don't have a right to the binaries and thus neither the source.

RedHat, gets away with distributing the source to their modified kernel as a giant patch file to the vanilla kernel because adheres to the letter of the GPL but not the "spirit", insofar as a law can have a spirit, and insofar as I can claim what the spirit even is. Business-wise though, RedHat is able to get away with it as a billion dollar company. Spender (of GRSecurity) is smarter than I, but has tried to build his product upon something that requires more smarts and more resources - that he is too fiercrely protective of - than he is willing to trade rights to, in order for his contributions to be available to the wider community, as he purports to desire. Facebook's kernel modifications, nor Google's "interesting" kernel modifications (as defined by those requisite for running Google.com and other properties) aren't made available, nor are they t required to, by the GPL. (Android's Linux kernel sources and select other kernel changes _are_ made available.)

The GPL allows building a business by providing support, and/or tuning of kernel parameters (eg VM swappiness, or disk scheduler deadlines) for running highly specialized workloads, eg Oracle DB. If providing a highly successful product, eg Google.com or Facebook internal knowledge will naturally follow. External benefits not necessarily so. The fat client of the pre and early Internet made the GPL (and LGPL) sufficient for the time, but things are different on the cloudy Internet, and arguably the broader community suffers for it.

<comment><USER10> Redhat distributes it's sources to everyone, thus making any violation of the no-restrictions-on-redistribution clause acedemic to the linux copyright holders who would be the claimants.

GRSecurity successfully prevents redistribution: it's violation is blatant and NOT academic.

A court can be shown the attempt and it's successful conclusion.

Quite different in substance from RedHat's possible violation.

</comment></comment></comment></comment><comment><USER11> C90 is partly to blame is here. It rejects sensible code due to limitations of hardware and compilers older than Linux itself.

I find it hard to believe that a decades old compiler with an actual compile- in-one-pass limitation would produce something useful from the current kernel source. It's affecting the the entire kernel development just so that someone somewhere with an abandonware compiler doesn't get a shock of updating it once every 30 years.

<comment><USER12> Linux only compiles with at least semi-recent compilers. The minimum version for GCC even has been bumped not too long ago. They certainly are able to handle C99 style declarations. Why Linus hate them, I don't know, probably he could be able to formulate some pseudo justifications when in reality it is just what he is used to.

The only thing I could find quickly was from 2005: [https://lkml.org/lkml/2005/12/13/223](https://lkml.org/lkml/2005/12/13/223)

Maybe it made sense in 2005, but 14 years later this _might_ not be that much important anymore. To be honest I'm radically against the opinion that "Putting variables in the middle of code only improves readability when you have messy code", but I kind of understand where it comes from, with an hardcore old-school C mindset. With experience with more modern programming languages and considering code like more abstract level object instead of low level immediate imperative instructions, not putting declarations before the variable are needed makes sense. This is more in line with how modern compiler work AND more importantly with what we need to do to _reason_ on code (not surprising because part of the reasoning is the same for a modern compiler and for us), and I _suspect_ that this actually leads to less programming errors, including the silly ones we saw here.

<comment><USER13> It is of a piece with forbidding link-compatible C++ components. Destructors prevent far more mistakes than they cause, and templates, used correctly, are much more specific and less error-prone than macros.

<comment><USER14> C++ is broken without exceptions. Exceptions aren't ever going to enter the kernel even if you tried to hide them behind a C ABI.

<comment><USER15> The folks behind the Pistachio microkernel said they used C++:

[https://github.com/l4ka/pistachio](https://github.com/l4ka/pistachio)

I don't know if it has exceptions or an unusual style since I don't know C++. It is written by CompSci researchers which usually means a different style. Just throwing it out there for anyone considering C++ in kernels since the L4 kernels were all really fast and lean.

<comment><USER14> And Google merrily uses C++ with exceptions disabled. That doesn't make it right when the shit hits the fan. "Works most of the time" is not acceptable in an OS.

<comment><USER15> Your statement equates not using exceptions with no error handling at all. Are exceptions the only way C++ can handle errors? Or can it do things like return codes used in C or advanced constructs via its metaprogramming?

<comment><USER16> You can use error codes or, better, a Result<T, E> template in C++, but throwing an exception is the only sane way to signal an error from a C++ constructor that I know of. The alternatives are awkward: you either stick an error code on the struct, which the caller can check after construction, or write an error code to the caller through an out parameter. In either case, the class implementation now must be concerned with handling objects in some partly-initialized, "error" state.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Man that attitude of the grsecurity folks is bad. Oh look how great our process and fix is and how fast we are. And look how bad them kernel folks are. Yuk.

<comment><USER13> But they are correct.

Correctness should forgive any amount of "tone", if indeed we care about correctness.

<comment><USER18> No, it should not. I am no stranger to be borderline rude sometimes, also in part due to cultural differences and language barrier, so I am pretty forgiving when it comes to other people doing the same.

But this... what they did is tooting their own horn, at the expense of others, and that annoys me. "look how great we are and how much the others suck".

</comment></comment></comment><comment><USER10> GRSecurity is violating the GPL, and thus violating the linux programmers copyrights, as Bruce Perens explained: [https://linux.slashdot.org/story/17/07/09/188246/bruce- peren...](https://linux.slashdot.org/story/17/07/09/188246/bruce-perens-warns- grsecurity-breaches-the-linux-kernels-gpl-license)

[http://perens.com/blog/2017/06/28/warning-grsecurity- potenti...](http://perens.com/blog/2017/06/28/warning-grsecurity-potential- contributory-infringement-risk-for-customers/)

Brad Spengler / PaxTeam / GRSecurity have no right to modify the linux code nor redistribute derivative works of it thusly.

Placing a "no redistribution or else" clause in a "separate writing" does not absolve one from the requirement NOT to stymie the linux programmer's stipulation in their license that such restrictions NOT be created by distributees or those who have created derivative works.

The linux programmers should sue Spengler, or simply revoke his license (another option: gratis licenses are freely revocable: they are not secured by an interest, and as-far-as-we-know Spengler has not payed the linux licensors for a license).

</comment><comment><USER19> There was another post on this here: [https://news.ycombinator.com/item?id=20871727](https://news.ycombinator.com/item?id=20871727) (10h ago, pointing to a short excerpt on lwn.net; 3 comments)

Though I like this one more, as it points to the source.

</comment><comment><USER20> I'm struggling to see how the backporters thought this was an acceptable transformation. I don't know any of this code, and even the warning seems a little opaque to me initially. But it seems very obvious that you can't just reorder the lines.

<comment><USER21> The most surprising thing to me is that one submitter gets dinged for a line break in review, yet another submitter can re-order logic, (seemingly) without being reviewed at all.

<comment><USER22> It's almost as if grsecurity is implying this was not an innocent mistake on Greg KH's part and I may not be the only person that noticed this today. [https://flak.tedunangst.com/post/warning-implicit- backdoor](https://flak.tedunangst.com/post/warning-implicit-backdoor)

</comment></comment></comment><comment><USER23> Does anybody know what triggered the original fix in the first place? Just grep-ing?

If the kernel folks did what this company did . I.e have the compiler detect vulnerable code . The issue would have been avoided as well right ?

<comment><USER24> The article describes grsecurity's 'respectre' compiler plugin [1].

[1] [https://grsecurity.net/respectre_announce.php](https://grsecurity.net/respectre_announce.php)

<comment><USER25> While they say that Respectre would have caught it, the actual discovery was apparently made this way:

"We independently backported the fix on July 9th 2019 and on noticing the warning, fixed it correctly. When the upstream kernels later backported their bad fix, it created a conflict in our git repo that led to us immediately spotting their flaw (and keeping our existing fixes)."

</comment></comment></comment><comment><USER26> Is it just me or there an elephant in the room no one is talking about?

To me, so much blame lies with C's arcane rules, in this case for forcing you to declare variables earlier than you need them. If the compiler hadn't complained pointlessly and just let the programmer declare variables where they're needed, people wouldn't have had to try to "fix" it to begin with.

Apparently people would prefer to blame the kernel developers than the immaculate language that is C though...

</comment><comment><USER27> So Linus fucked it up?!

<comment><USER28> No. According to the author, Linus Torvalds was the only person who've noticed the problem in the final merge and applied a fix manually before merging it to the mainline. However, the stable kernel trees picked up the old patch, and the broken version was merged to all stable trees silently. The author blames Greg K.H. for fxxking it up.

<comment><USER29> > Linus Torvalds was the only person who've noticed the problem in the final > merge and applied a fix manually before merging it to the mainline

The fix was done as part of the merge commit itself, it should have been a separate patch.

<comment><USER27> So one could argue that Linus kinda failed in fixing the problem he has identified correctly.

</comment></comment></comment></comment><comment><USER30> So the only question remains, based on history of Chinese government (well, not only them but in this case the developer was a Chinese) wanting to weaken the security of software - was this intentional, and then the Chinese developer is a mole from them, or was a honest mistake?

<comment><USER31> The fix as submitted by the Chinese author was secure, but it triggered a compiler warning because it was not standard conforming C.

A kernel maintainer applied an incorrect fix for this warning, which ended up defeating the purpose of the fix.

I don't think you can blame the author for the bad fix.

<comment><USER32> They're clearly playing 4D chess and submitted a patch with a warning in anticipation of the next guy breaking it while trying to fix it.

<comment><USER28> Or that the author of the article and his infosec company has connection to the Chinese government, so he asked the Chinese security service to do an inside job, and he would expose it later to increase the sales of grsecurity, which in turns support the secret service...

It is one of the only few logical conclusions one can draw if one insists on OP's opinion that the Chinese attackers are playing 4D chess. The chance is non-zero, but doesn't make much sense.</comment></comment></comment></comment>