Can't think of a good class name? Try this: - <AUTHOR> http://www.classnamer.com/ <comment><USER2> CLASS=$(curl <http://www.classnamer.com/> | grep \"classname\" | sed 's/. _classname" >\\(._\\)<.*/\1/') && echo "public class $CLASS {}" > "$CLASS.java" && javac "$CLASS.java"

</comment><comment><USER3> Disappointed, thought it might suggest class names based on the attributes that you already know you want to associate with it.

</comment><comment><USER4> Is it a Markov chain generator using word fragments from analysis of a large Java corpus?

<comment><USER5> You'd be surprised how many 'consultants' are nothing more than human Markov chain generators, spewing out words with an air of plausibility, but with no understanding.

</comment></comment><comment><USER6> As a VS Macro (Warning: VB)

Imports System Imports EnvDTE Imports EnvDTE80 Imports EnvDTE90 Imports EnvDTE90a Imports EnvDTE100 Imports System.Diagnostics

Public Module Module1

        Sub ClassNameGen()
            Dim res As String
            Dim req As System.Net.WebRequest = System.Net.HttpWebRequest.Create("http://www.classnamer.com/")
            Dim rsp = req.GetResponse()
            Using sr As New System.IO.StreamReader(rsp.GetResponseStream())
                res = sr.ReadToEnd()
            End Using

            Dim doc As Document = DTE.ActiveDocument
            Dim textDoc As TextDocument = CType(doc.Object("TextDocument"), TextDocument)
            textDoc.StartPoint.CreateEditPoint()

            Dim strstr As String = "
"
            Dim endstr As String = "
"
            Dim strt As Integer = res.IndexOf(strstr)
            textDoc.Selection.Insert(res.Substring(strt + strstr.Length, res.Length - (res.IndexOf(endstr, strt) + endstr.Length)))
        End Sub

End Module

</comment><comment><USER7> Can it invalidate my caches as well?

If so you're onto a winner.

</comment><comment><USER8> This is so awesome. Going to use this to populate the required "comments" for my CS labs.

</comment><comment><USER9> _GenericFlugzeugDialog_

I like this one :-)

</comment><comment><USER10> ThreadedThreadTester!? My brain just got Kickpunchered.

</comment><comment><USER11> This also works well as a baby namer.

</comment><comment><USER12> I was about to make a snarky comment like "ShootMeNow", until I realized that OP may actually have a real winner on his hands...

Think about it.

It a Big 5 consulting firm acquired this and used it in their enterprise web app practice, would anyone ever be able to tell the difference?</comment>


Query Plan Caching in CockroachDB - <AUTHOR> https://www.cockroachlabs.com/blog/query-plan-caching-in-cockroachdb/ <comment><USER2> How are you using CockroachDB, and where does it shine or not?

</comment><comment><USER3> Too bad all this work is proprietary.</comment>


Ask HN: Company Doing 6 Month Crunch - <AUTHOR> Last week during the company update our CEO told everyone that we need to work early, stay late, and tell our families to support us while we work overtime to make the company look strong enough to raise another round of funding or we'll be forced to sell the company.
I work at a well known startup company in the valley that needs to raise a series c round in the next year.
I've been working here for several years and have a good amount of equity as an early engineer, so I don't want to leave necessarily, but at the same time I'm 100% put off by being forced into working crazy hours for half a year with no real end in sight.
Does it sound like I should start looking for a new job at this point based on your past experiences? My gut is telling me yes, but I don't want to trust it =/ <comment><USER3> Let's see, a few questions:

1\. How much equity has already vested, in USD: 1. 10K-ish, 2. 100K-ish, 3. 1M K-ish+.

2\. How many years away would an exit be where your equity would be worth something? 1. 1-2y, 2. 3-5y, 3. 5-10y

3\. How good a view do you have on the company's current state and in how much trouble it is? 1. Little, they don't tell us much, 2. Quite a bit, they keep us well informed including runway, 3. Lots, I'm involved in the top executive meetings where we discuss this.

<comment><AUTHOR> 1\. We have options. I have vested quite a few. It would cost a lot of money to exercise them (~50k). 2\. If I had to guess: 3-5 years. 3\. They are semi- transparent. They give us runway info, and a general sense for things, but not specifics.

</comment></comment><comment><USER4> Always listen to your gut.

Understand your own boundaries, and when you confidently believe they are rational, communicate them and practice them.

A half a year doesn't seem like long, and I wouldn't expect "a good amount of equity," (that actually pays off) without working crazy hours.

</comment><comment><USER5> It boils down a simple question: what is your health worth to you? Make no mistake, extended crunch will take a toll on your body and mind and put considerable strain any relationships you may have.

What good will your equity do you if you're ill or burnt out?

</comment><comment><USER6> 6 months is not a crunch. It's a death march. Are you sure you want to be there? I would get off the sinking ship before it ruins your health - <USER2> or mental.

</comment><comment><USER7> > to make the company look strong enough

This make the company look like it has weak leadership and is clawing for scraps. A strong company would switch to 4 hr days and still survive...

</comment><comment><USER8> Nobody can produce for six months at twelve hours a day. That's why we have an eight hour day. They have no idea what they're doing.

</comment><comment><USER9> "a good amount of equity", apparently worthless without working like a slave. I'd leave.

</comment><comment><USER10> Are they going to pay you overtime?

<comment><AUTHOR> No. Everyone is on salary.</comment></comment>


How to Remember - <AUTHOR> https://www.inc.com/jeff-haden/how-to-remember-anything-you-really-want-to-remember-backed-by-science.html <comment><USER2> If you need to remember printed material (for an exam etc.), I highly recommend this product [0].

It's basically a blue highlighter and a red transparent plastic sheet. You first highlight the stuff you want to test yourself on, and when you are ready you can cover the material with the red sheet. Now the highlighted words just became redacted like in a released CIA doc.

There is a review on Youtube that let you see how it actually looks [1].

[0]: [https://www.amazon.co.jp/dp/B01C02NOMQ/ref=cm_sw_em_r_mt_dp_...](https://www.amazon.co.jp/dp/B01C02NOMQ/ref=cm_sw_em_r_mt_dp_U_ohdbDbTZCREJG)

[1]: [https://youtu.be/et14d3cafcQ?t=58](https://youtu.be/et14d3cafcQ?t=58)

<comment><USER3> Highlighting notes, and re-reading notes are the two study techniques that students think are most effective, but studies show are less effective.

Spaced repetition, repeated testing yourself on the material, questioning yourself to prompt you to work your memory recall, are shown to be the most effective.

Sources discussed and referenced in [https://www.youtube.com/watch?v=ukLnPbIffxE](https://www.youtube.com/watch?v=ukLnPbIffxE)

<comment><USER4> While highlighting and re-reading notes might not be as effective as SRS quizzing, I still think there's a lot of value in writing the notes themselves. It sort of acts as the "summarize and share" part of this article (you're sharing with your later self).

I got frustrated with writing notes in one app, then making SRS cards out of them in another app, so I made one that combines the two[0]. I'm still trying to nail down the best workflow, but something like:

1) Read/watch material.

2) Summarize material in note(s)

3) Create cards from note(s) and study with SRS.

Works pretty well I think.

[0]: [https://mochi.cards](https://mochi.cards)

<comment><USER5> For people wondering SRS means spaced repetition software

</comment></comment></comment></comment><comment><USER6> I've got a trick for remembering things that, to me at least, feels like magic. It was particularly useful in Biology courses where I would have to remember a large set of terminology like family names of fishes.

Just imagine a route you regularly take. Ideally a walk where you have time to consider your surroundings, but any route where you can remember landmarks will do. Now assign each thing you need to remember to a specific landmark. That's it. I've found that if I go through this process and then review it just once in my mind I can remember everything with 100% accuracy.

I used this trick recently to remember a gate code by assigning numbers to nearby architecture. I'd have a terrible time trying to remember it any other way.

<comment><USER7> When I'm driving my car and listening to an audiobook or podcast, I find that if I rewind it a couple minutes, my brain will flash back to where I was driving when I heard it the first time.

really weird.

additionally, and somewhat unrelated... The best racers _know_ the course. They can sit back, close their eyes, drive the course in their mind, and open their eyes. If they are missing parts of the course in their memory, they have more to learn. If they time this exercise the closer they are to a lap time, the better they know the course (and the better chance they have of driving it well)

<comment><USER8> The audiobook thing! Yes! I hike or mountain bike with books, too, and when I bike those routes now, sometimes I get almost total word recall of a moment in a book I heard years ago. It's a great sensation.

</comment></comment></comment><comment><USER9> Something that I started doing recently is to create a "30 second summary" of each important concept, consisting of text and diagrams. I then record a 30 second video where I narrate, using good intonation, the 30 second summary. I also create a hyperlink from the summary to my notes of each prerequisite concept.

This serves three purposes:

1) The act of teaching is one of the best ways to solidify a concept in your mind. It forces you to have a good understanding of it, and forces your mind to produce a good internal organization around concept.

2) It usually takes a while to write + diagram a good summary, and takes a number of tries to get a smooth recording of you speaking the summary (Example: [https://www.youtube.com/watch?v=rHc- bog1hhE](https://www.youtube.com/watch?v=rHc-bog1hhE)). All of this "repetition" / time spent with the concept makes it easier to remember.

3) Sooner or later we realize that remembering everything is impossible. Given enough time, concepts will decay in your mind. In the long term, one of the most important things for you to optimize is the speed at which you can re- create your mental model of a concept. Having these 30 second summaries, complete with links to prerequisite concepts, allows you to re-build your mental model of a subject area extremely quickly in the future in a just-in- time fashion. Just like a smartphone is an "extension" of your brain, a note system like I've described here is like an extension of your memory.

</comment><comment><USER10> > "What that [making yourself a quiz] forces you to do," Adam says, "is > practice retrieving the information, which makes it stickier and easier to > find yourself."

The same is true for flashcards where it is the process of creating them that helps remember the information. I have noticed when I don't create the flashcards I use, the information is not remembered as well.

</comment><comment><USER11> Now how about something to forget what I want?

<comment><USER12> 2 options

Create happy memories to crowd out the sad ones.

Invent the MIB device

<comment><USER13> I like the first option. What I do is don't worry about forgetting. I let myself be as angry, frustrated, sad, whatevs. The biggest help is decoupling feeling from action. Just because I am angry, that doesn't mean it'd be a good idea to aim my anger at someone else. Then I just move on. Getting the emotional stuff out of the early frees me up to remember something without getting all emotional about it. Eventually I just have too many other experiences to process before I get to the thing I'd prefer to forget.

</comment></comment></comment><comment><USER14> Good article on different techniques that don't require any special software/setup. Personally, quizzing doesn't really work for me, but discussing or (even better) trying to teach it to someone else is extremely effective. The third suggestion, association, has mixed results for me - I use it for names and dates, but trying anything more complicated isn't very effective. Anyone else have better results with these methods?

<comment><USER15> > discussing or (even better) trying to teach it to someone else is extremely > effective.

Whenever I have to learn a new OS, system, tool, programming language, etc: if I have trouble with it, I just write up a training manual as if I were also tasked with teaching others. What I end up with is a customized courseware for just me that I can refer back to at any time. Time consuming, but very effective for me.

<comment><USER3> I wonder if the main benefit of blogs and tutorials is for the writer, not the reader.

This makes me wonder about the damage FAQs do to a community; where once there was a continual flow of new people needing newbie explanations - and a continual flow of not-quite-newbies benefiting from writing those explanations over and over, but different people each time, and implicitly being welcoming through that interaction - there is instead an implicitly unwelcoming response with a link to a FAQ. A FAQ which is dauntingly large due to its attempt to be comprehensive, but never deleted and refreshed, so getting ever more outdated and cruftier.

</comment></comment></comment><comment><USER16> I highly recommend using flashcards apps, especially this one that I have found. As mentioned in the article about quizzes, this app has just that.

[https://play.google.com/store/apps/details?id=flashcards.wor...](https://play.google.com/store/apps/details?id=flashcards.words.words)

<comment><USER17> For those studying Japanese, this one is amazing: [https://nihongo- app.com/](https://nihongo-app.com/)

It has sets for all Japanese school grades, split into daily chunks so that you can keep going forward with the app for years.

The only thing missing is kanji stroke orders, but the dev has hinted that those would be coming soon.

</comment></comment><comment><USER18> The linked article reads: "Because students believe that learning and testing are separate things, they often study inefficiently"

Efficient learning is not only about performing during a test, but understanding the subject matter.

</comment><comment><USER19> Adam Grant is a charlatan. Never read his book. It is worthless self help.

</comment><comment><USER20> Must remember to read this!

</comment><comment><USER21> Finally, a memory article that doesn't mention spaced repetition!

<comment><USER22> It doesn't specifically mention spaced repetition, but spaced repetition is a way of quizzing yourself.

Spaced repetition is useful when the number of items to remember is very large; it's a way of optimizing the quizzing.

<comment><USER21> Spaced repitition is orthogonal to quizzing yourself.

<comment><USER22> I'm not aware of a passive spaced repetition, which just presents items in increasing intervals without interrogating the subject's recall.

For all intents and purposes, the normal SR that everyone uses in the form of software and that everyone refers to when they use the term SR is not orthogonal to quizzing; it's quiz-driven.

I don't think that a passive strategy could be anywhere near effective as the actual SR algorithms in use, which incorporate feedback from quizzing in order to adjust the interval for each item, so that difficult items remain on short intervals while easy items recede farther into the future.

<comment><USER21> But I'm sure you could imagine quizzing without spaced repetition</comment></comment></comment></comment></comment>


The best feedback you'll ever get about your business. Free. - <AUTHOR> http://cycle7.com/draft/2010/06/07/the-best-feedback-youll-ever-get-about-your-business-free/ When you're behind a business, or simply inside it, it's easy to lose sight of some aspects of that business. You start to see things differently, and can't necessarily view them the same way as your customers, especially your first time customers. Lucky for you, the best feedback you can get it free, easily accessible, and available immediately. <comment><USER2> It takes some courage to open yourself up to anonymous feedback from customers -- some of which may be unfair criticism from someone just having a bad day -- but the rewards far outweigh the risks. It shows that you're committed to providing a great experience and that you value and respect your customers' opinions. You could even go a step further and post some comment cards -- with your response -- on a message board of sorts. I saw this at my company's cafe once and it helped me feel like they were really listening and acting on suggestions.

</comment><comment><USER3> I agree wholeheartedly that customer feedback, whether solicited via a formal card or web form, talking to your customers (at a bar/restaurant), or simply observing their behaviors (a la web analytics or with eyeballs) is one of the most valuable tools a business owner can use to improve their product or service. Successful business owners know this (or will learn it from reading posts like yours), and that is part of what makes them successful.

</comment><comment><USER4> A lot of this is really just opinion, but the basic idea that you should listen to your customers is still good advice.</comment>


Functional Programming Principles in Scala is starting today on Coursera - <AUTHOR> https://www.coursera.org/course/progfun?5

<comment><USER2> I highly recommend this course for anyone interested in learning about functional programming and/or the Scala language.</comment>


"Australians First": Australia abolishing 457 temporary skilled worker visa - <AUTHOR> http://www.abc.net.au/news/2017-04-18/government-abolishing-457-visas/8450310 <comment><USER2> This is extremely bad news for Australian science.

I'm a postdoctoral researcher who's on a 457 visa out of my PhD. The new 457 replacement requires 3 years of work experience, so we cannot hire people from overseas who've just finished their PhDs. Without a permanent residency outcome we cannot keep these people after their initial contract (which is my own plan). They doubled the price but that's OK (for us!) since the university's reallocation funds pay for that.

This is short-sighted pandering to the far-right who've been clamoring for this, and science loses.

<comment><USER3> I would distinguish between PhD and IT work when it comes to 457 visas. In practice 457, within the IT field at least, has rarely served its intended purpose and often been misused. Likewise it has deterred many locals from considering IT as an area of study.

On the other hand PhD applicants are much closer to the intended purposes of the 457. For example research cannot be developed in the same manner and quantity as IT.

<comment><USER4> > Likewise it has deterred many locals from considering IT as an area of > study.

That's a bold statement. Have you got some good source? I'm having a problem imagining a statistically relevant number of people saying "I'm interested in pursuing one of the skills marked by the government as experiencing national shortage, (for years!) but I won't because immigrants will take those positions instead"

<comment><AUTHOR> 457 visa workers have driven down salary expectations for entry-level development jobs, thus students have began to shy away from computer science as a field of study (since there are plenty of other fields that pay more)

</comment></comment></comment></comment><comment><USER5> Shortcomings with 457 visas have been identified by Dr Joanna Howe, a senior lecturer in law at the University of Adelaide (see here and here) as well as in the recent Senate report entitled A National Disgrace: The Exploitation of Temporary Work Visa Holders[1].

The four major problems with the system that need fundamental reform, namely: * There are way too many occupations on the skills shortages list. * Those working under the skill level 1 (so-called "Managers and Professionals") and skill level 2 (so-called "Associate Professionals") are not subject to any labour market testing to determine whether an Australian can do the job first. Hence, nearly 80% of total 457 visa holders are not currently subject to labour market testing. * Where labour market testing is required it can be overcome by putting an ad on Facebook or other social media and that is enough to show that you've tested the labour market – basically a farce. * The 457 visa system is not sufficiently responsive either to higher levels of unemployment, or to labour market changes in specific skilled occupations.

[1] [http://www.aph.gov.au/Parliamentary_Business/Committees/Sena...](http://www.aph.gov.au/Parliamentary_Business/Committees/Senate/Education_and_Employment/temporary_work_visa/Report)

</comment><comment><USER6> Looking at this list, the professions that Turnbull wants to remove is incredibly broad. As a Canadian in the US, I'm not 100% clear, but it seems like the 457 visa is a lot like the H1-B.

With that comparison, it's really surprising to see professions like:

      * Chemical engineer
      * Petroleum engineer
      * Electronics engineer
      * Web developer

on the list at the bottom.

If someone announced they were taking these professions off the H1-B list in the US, I'm pretty sure there'd be a huge uproar. This is not even to mention that lots of these sound pretty important for Australia's resource economy. Can someone educate me on the situation from a more Australian point of view?

<comment><USER7> A lot of "programmers/web developers" on this visa are scammers looking for a quick way to gain permanent residency (apparently it's a lot easier for a random person to claim they're a programmer than other professions that require actual skill). There's a whole industry of businesses providing "employment" to these people for a fee. I think the idea is to replace this visa with one that has more stringent skill/language requirements to weed out these scammers.

<comment><USER8> It's easy to suggest this type of fraud and assume it's true based on merit. Do you have any proof of the above statements or is this speculation?

<comment><AUTHOR> I personally discovered a hair salon that was advertising for a "full time web developer" to manage their website (lol) with the plan to then use that (unfilled, obviously, given the extremely weak salary they were offering) position to bring in a "web developer" hairdresser on a 457. The system is seriously abused.

EDIT: I guess the truth hurts?

<comment><USER4> I'd like to hear how it actually went for them. Here's why I think the story, or a successful (fraudulent) outcome is unlikely:

The visas cost quite a lot - in application costs, time to collect documents, cost of tests, etc. And I mean likely a full month or more of a hairdresser salary kind of cost. On top of that you'd need to provide a documentation of both a degree and relevant work experience for the last 10 years just to check if you qualify. Then you get the history and references checked, so that needs to pass as well.

For the company organising such fraud, it would likely be a lot less hassle to take a local person and teach them 1-to-1, full time for a month. And considering you may end up sponsoring someone without skills to come and work for you essentially illegally - what's the point?

Also for the person seeking that position: if you're found out, you'll likely never get a proper visa. That a big risk to take.

</comment></comment></comment></comment></comment><comment><USER9> 457 visas were very inflexible for the visa holder .... you needed to be sponsored by the employer and not many employers were interested in doing that.

</comment><comment> thomas-b A lot of it is summarized here: [http://www.border.gov.au/WorkinginAustralia/Documents/abolit...](http://www.border.gov.au/WorkinginAustralia/Documents/abolition- replacement-457.pdf) Basically, current holder are fine, 457 Visa will also keep being issued until March 2018 with some extra restrictions starting 1st of July.

</comment><comment><USER10> The company I work for has hired 2 students via 457s that completed their engineering work experience with us during their degree. Finding high quality employees this way worked great for us, it's a shame that it won't work anymore, as I understand it.

</comment><comment><AUTHOR> Hey TCS, don't let the door hit you on the way out ;)</comment>


Women Soldiers to test female-specific body armor - <AUTHOR> http://www.army.mil/article/83986/Women_Soldiers_to_test_female_specific_body_armor/

<comment><USER2> I never really thought of it, but there are only 11 sizes of body armor that have to fit the entire military? I hope they make the new ones available to men with shorter torsos and/or narrower shoulders. I guess taller and wider guys will still have to fend for themselves...</comment>


The second-worst poet in English - <AUTHOR> https://www.newcriterion.com/issues/2018/6/the-second-worst-poet-in-english-9867 <comment><USER2> It's a well known fact Paula Nancy Millstone Jennings, from Essex, UK, writes the worst poetry in the galaxy, closely followed by that of the Azgoths of Kria and the Vogons, in that order.

This would make Cumberland Clark at most the third worst poet in English language.

<comment><USER3> The Azgoths and Vogons weren't writing in English and could only be understood with help of the Babelfish. Thus, Cumberland Clark remains the second worst poet in English.

<comment><USER2> The article kind of mentions who would be the worst English language poet according to them. I forgot the name.

</comment></comment></comment><comment><USER4> Since we're on HN: did McGonagall's magnum opus ever become an in-joke or proto-meme between engineers? It concludes with a deadpan reflection on engineering's relationship with physics and safety:

"Oh! Ill-fated bridge of the silv'ry Tay,

I now must conclude my lay

By telling the world fearlessly without the least dismay,

That your central girders would not have given way,

At least many sensible men do say,

Had they been supported on each side with buttresses

At least many sensible men confesses,

For the stronger we our houses do build,

The less chance we have of being killed"

<comment><USER5> A beautiful side effect of learning various ways of analysing poetry is that every time you learn something new, this poem gets more hilariously awful.

</comment></comment><comment><USER6> Seems to be down for me :<

<comment><USER7> It's available on archive.org: [http://web.archive.org/web/20180605153046/https://www.newcri...](http://web.archive.org/web/20180605153046/https://www.newcriterion.com/issues/2018/6/the- second-worst-poet-in-english-9867)</comment></comment>


Design Better Data Tables - <AUTHOR> https://medium.com/mission-log/design-better-data-tables-430a30a00d8c#.exxlu3eah <comment><USER2> Thank you, author. This is quite comprehensive guide. Data tables are here to stay as long as we have data. The readable it must be.

<comment><USER3> Glad you found it useful :)</comment></comment>


Ask HN: What language/framework do you recommend for UI-heavy desktop apps? - <AUTHOR> To clarify what I am looking for:
A language/framework to build a cross-platform (linux,windows,mac) desktop application which will feature many charts and graphs.
This is currently a hobby project so it could also be something more exotic. So far I had the following ideas:
- Qt: I am not too hyped because I would like to avoid C++ and Python. Also the licensing of Qt always confused me. If this project was to be sold at one point would I have to pay for licensing?
- Javascript/Electron/d3.js: This is my current approach. Big plus here is d3 is offering me all the charts/graphs I can imagine for my app. Drawback is that Electron has a bad rep for being wasteful etc.
- Gtk: I recently saw that gtk even offers Javascript bindings.. maybe that would be an alternative? Seemed to be poorly documented at a first glance. It's also not clear what gtk would bring to the table in terms of graphs and charts.
- Racket Scheme: This was a fun idea because playing around with Racket again would be lovely. I saw that some kind of UI is part of the standard library but I am doubtful if this is a serious option, especially considering the charts/graphs.
What else could be worth checking out? Would love to get some unexpected recommendations! <comment><USER2> Don't dismiss Racket too soon, I would say. The developer of ActivityLog2 has been doing a lot to integrate charts and graphs into Racket GUI applications, and the program itself ([https://github.com/alex- hhh/ActivityLog2](https://github.com/alex-hhh/ActivityLog2)) is a good showcase of that work. His blog is also worth a read ([https://alex- hhh.github.io/index.html](https://alex-hhh.github.io/index.html)). Take a look!

<comment><AUTHOR> Thanks for mentioning this.. very interesting. I even had this project starred on Github but did not remember it.. :)

I will give racket another look. Do you by any chance know some more real world Racket applications?

<comment><USER3> Check this example:

[https://dev.to/goober99/learn-racket-by-example-gui- programm...](https://dev.to/goober99/learn-racket-by-example-gui- programming-3epm)

<comment><AUTHOR> Good thing I just checked the thread again. Thanks for the link!

</comment></comment></comment></comment><comment><USER4> Honestly the only one I have used successfully and the one I see most professional companies choose is Qt. Yes you possible have to pay for a license when you get to that point, but they work with small companies/startups and the license fees are not crazy and it saves you tons of time while making your app performant, portable and clean.

Gtk to me is just not worth the effort, it is a mess and documentation is horrid. We tried Gtk on one project I worked on a while back and it was abandoned because of the struggles we had to go through just to make it work as expected. While Qt isn't a panacea by any means, it is lightyears better than Gtk. I know I am pissing off someone that knows Gtk well and can't see why it is hard to use, but coming from the perspective of I need to get an app running and not struggle through a framework, Gtk just doesn't cut it.

And especially if you are talking about graphing, performance etc, Qt will be the best of them. While you are on the open source Qt you get community support and lots of help/examples. And if you do reach the point you are paying for a license then at least with Qt you will get quick support and problem resolution not based on a communities best efforts which may not align with your companies issues.

If I didn't mind some pain in framework maturity, I'd probably try Flutter. Flutter desktop is in early previews IIRC, but it (at least for mobile) is documented much better and is easier to use than Gtk IMO. Flutter does work pretty well for mobile, but that's the only thing I've used it for, so no clue on what the desktop preview even looks like.

<comment><AUTHOR> Thanks for your input. It coincides with my impression about Qt and Gtk. Years ago I made an application (for myself) with Qt and C++ and it was kind of a pleasant experience. I was only reluctant because I would like to not use C++ in my free time.. I will however consider this again and maybe see what bindings exist for Qt.

I don't think Flutter is an option for me. I would then rather go the JS/Electron route. It just makes no sense to learn Dart to me.. the only use for it seems Flutter.

<comment><USER4> Yea, I only mentioned flutter because it is there and is growing, but if I wanted to ship a desktop app quickly to get moving, it'd be Qt for me. I personally love C/C++, but understand not everyone does, but for installed desktop apps, C/C++ still just makes the most sense to me.

I know Wireshark moved off Gtk to Qt for a variety of reasons, but some of their key points from what I remember was Gtk was falling further behind on issues, current trends and platform support whereas Qt has really kept up and keeps evolving with the market.

Good luck with whatever you choose.

</comment></comment></comment><comment><USER5> The idea of creating cross platform desktop applications is why I created _Linux on the Web_. First of all, it is merely a website, so there is no concept of downloading anything, and needing to give system-level permissions. But it is a website that looks, acts, and most importantly feels like any other desktop environment in the world.

I have been working on this, nearly full-time, in one form or another, since 2011, ie, near the beginning of the Chrome/v8/nodejs-led webapp "blastoff" point. You can give the desktop environment a try at [https://lotw.xyz/desk.os](https://lotw.xyz/desk.os) (pay attention to the bottom-left corner of the screen).

My main audience at the present time is people just like yourself, so hopefully we can keep in touch (I'm Dennis). There are ways to communicate built into the interface.

</comment><comment><USER6> Use Electron. If your app takes off then you can reevaluate and re-write as necessary.

<comment><USER7> Correct. Seems to work fine for Slack and Notion among others.

</comment></comment><comment><USER8> I'm surprised that nobody talks about wxWidgets!

[https://www.wxwidgets.org/](https://www.wxwidgets.org/)

It's what I use for my app "Coollector Movie Database" and I'm very happy with it.

Ok, it's C++, but you get a super fast app, and there's no licensing issue contrary to Qt (it's completely free even for commercial apps). I recommend!

</comment><comment><USER9> I'm still using Meld since I switched to Windows from Linux. It's not a quite a native UI but close enough. I was surprised to find it is written in Python. It uses GTK for UI. It's worth looking into. I know I am.

<comment><AUTHOR> Do you mean Meld the merge and diff tool? I do not know any other Meld and could not Google anything related to UI programming..

Maybe you misread my question? I was asking for UI frameworks to develop applications with.. such as GTK, Qt etc.

<comment><USER9> Yes, I meant Meld the merge and diff tool. It uses the GTK sdk to produce a pretty nice UI (although their UX is a little clunky) [https://meldmerge.org/](https://meldmerge.org/)</comment></comment></comment>


Data alignment: Why is it so important? - <AUTHOR> http://www.ibm.com/developerworks/library/pa-dalign/

<comment><USER2> "Writing Cross-Platform Software: Getting Started" is largely about alignment:

[http://www.warplife.com/tips/code/portable/getting- started/](http://www.warplife.com/tips/code/portable/getting-started/)

For years it was the top hit for "cross-platform software development". After a while it wasn't anymore. Eventually I looked into why; I found dozens of articles on the same topic, all with the term "getting started" in their titles.

Some people would be angry. I was very pleased. I don't really want credit for my work; what I want is for problems to go away.

</comment><comment><USER2> It's not that data really _has_ to be aligned.

It's that computers are easier and cheaper to design and manufacture if they require data alignment.

Consider that it would be straightforward for today's 64-bit CPUs to permit 64-bit values to have one-byte alignment. There's all kinds of ways to implement that in hardware and software, but to do so requires extra circuitry, that would require larger silicon dies, there would be a greater failure rate at the fab and so on.</comment>


Intel Says Clover Trail Atom CPU Won't Work With Linux - <AUTHOR> http://linux.slashdot.org/story/12/09/14/1236219/intel-says-clover-trail-atom-cpu-wont-work-with-linux

<comment><USER2> Intel never said that the processor won't run Linux, but that they aren't going to support it.

Huge difference.

The reason they aren't going to support it is because Windows uses different system calls relating to shutting down cores on the processor in order to save battery life, and they designed the chip specifically for Windows.

If you used Linux with the processor, you'd get horrible battery life, and Intel understandably does not want the blame for that.

<comment><USER3> Sorry but this sounds like marketing speak. I highly doubt that Intel designs anything _specifically_ for Windows at the CPU level.

There is no direct mapping between _Windows System Calls_ and functionality of a specific chip. There is a ton of code between that system call and what actually happens on the chip or in its firmware.

The top layer sure is Windows specific because it runs as part of Windows. However, the bottom layer is just bits to fiddle with or instructions to send to the CPU and any OS can implement that. Including Linux.

Again, marketing blah.

<comment><USER2> If you click through to the source article, they even describe what I'm referring to:

>"Intel went to great lengths to highlight the new P-states and C-states in which it can completely shut down the clock of a core. The firm said the operating system needs to provide "hints" to the processor in order to make use of power states and it seems likely that such hints are presently not provided by the Linux kernel in order to properly make use of Clover Trail."

Also: [http://msdn.microsoft.com/en- us/library/windows/desktop/ff19...](http://msdn.microsoft.com/en- us/library/windows/desktop/ff190969\(v=vs.85\).aspx)

<comment><USER4> >"presently not provided by the Linux kernel"

How long until the commits start rolling in for this?

<comment><USER5> I'd imagine that they'll start as soon as the right developers gain access to the right specs. Real hardware wouldn't hurt either.

</comment></comment></comment></comment></comment><comment><USER6> Noone writes why, but i'm quite sure why:

Atom contains the superawful PowerVR chip that is a nightmare in Linux and Intel never got around to release open source drivers (because it's only licensed form PowerVR).

<comment><USER5> Since I don't have an Atom with a PowerVR GPU, I cannot say how well (or not) it works. I'm not unhappy with whatever is in the N270, however.

<http://www.unix-heaven.org/intel-powervr-gma3600-for-linux>

</comment></comment><comment><USER7> Original article was already posted 9 hours ago: [http://www.theinquirer.net/inquirer/news/2205462/idf- intel-s...](http://www.theinquirer.net/inquirer/news/2205462/idf-intel-says- clover-trail-will-not-work-with-linux)

</comment><comment><USER8> i'm not really surprised. I remember intel guys talking about hybrid tablets in the near future, with a iX CPU's running on the docks and atoms in the tablet part.

don't forget that we're talking about atom CPU's here. for all I care atoms are shit anyway, the AMD fusion alternatives are much better.

on the one hand, why would the linux kernel support some stuff that isn't there yet and only relevant to new windows 8 tablets.

on the other hand I don't see the intel linux driver teams disappearing anytime soon.

</comment><comment><USER9> Then I guess I won't be running Intel chips...that was simple.</comment>


Facebook Censoring Ads Depicting 'Ideal Physical Body Image' - <AUTHOR> https://twitter.com/SBakerMD/status/1079801767007641602 <comment><AUTHOR> See [https://developers.facebook.com/docs/marketing- api/adgroup/f...](https://developers.facebook.com/docs/marketing- api/adgroup/feedback/v3.2) for IDEALIZED_BODY description. I was skeptical of this tweet at first, but it appears legitimate.</comment>


Show HN: Media Browser Framework in Swift for iOS with Custom Transitions - <AUTHOR> https://github.com/altayer-digital/ATGMediaBrowser <comment><AUTHOR> Would appreciate any feedback from the hacker-news community.

<comment><USER2> I will suggest you read the guidelines for _Show HN_. Without clicking into it, I'm guessing this likely qualifies. _Show HN_ is specifically intended to get community feedback.

<comment><AUTHOR> @DoreeenMichele, Thanks for the direction. I'm kind of new to hackernews, will check Show HN.</comment></comment></comment>


Compression ignition engines are a big breakthrough–we got to try one - <AUTHOR> https://arstechnica.com/cars/2018/01/mazdas-skyactiv-x-shows-the-internal-combustion-engine-has-a-future/ <comment><USER2> This sounds similar to what Honda was doing in the 70s (with no electronics or injection!) in the CVCC engine ([https://en.m.wikipedia.org/wiki/CVCC](https://en.m.wikipedia.org/wiki/CVCC))</comment>


The alarming state of secure coding neglect - <AUTHOR> https://www.oreilly.com/ideas/the-alarming-state-of-secure-coding-neglect <comment><USER2> The survey polled 430 "mostly everyday programmers". Unfortunately, everyday programmers mostly know very little about security.

Developers tend to think of security as about avoiding coding mistakes, and that's reflected in their idea that security is about pen testing, code review, tools, etc. Any security professional will tell you that these are valuable but only a small part of the big picture. Take a look at Microsoft's SDLC for a wider view of what it takes to weave security into every aspect of software development[1]

Probably the single most valuable thing most development organizations could do to improve security of applications is to do threat modeling[2][3]. It's especially valuable in the early stages of application design, but it can be applied at any time. Threat modeling can increase awareness of how an application's security assumptions interact with its overall architecture. Thinking through your application's threat model systematically is the first step to prioritizing mitigations.

Unfortunately, this is voodoo to most developers even though it really should be an intrinsic part of designing application architecture. I've heard people say there's a mental block because the kind of thinking required for security is almost the opposite of that required to design and construct systems. I don't believe that though. I think it's mostly a matter of training and historical accident that security is even a separate discipline. It shouldn't be.

[1] [https://www.microsoft.com/en-us/sdl/](https://www.microsoft.com/en- us/sdl/)

[2] [https://msdn.microsoft.com/en- us/library/ff648644.aspx](https://msdn.microsoft.com/en- us/library/ff648644.aspx)

[3] [https://www.owasp.org/index.php/Application_Threat_Modeling](https://www.owasp.org/index.php/Application_Threat_Modeling)

<comment><USER3> _Unfortunately, everyday programmers mostly know very little about security._

If you really want security, it's something that every programmer should be thinking about, at least in the back of their mind, on every line of code they write.

<comment><USER4> Maybe it's actually should be the other way around ? Isn't it possible to build frameworks(using relatively popular/easy languages) for the most popular application classes(CRUD web apps, IOT MCU) that in many cases will isolate the developer from needing to think about security ?

And if it's possible, And we already have a few such tools(like say scala lift, ARM mbed ) but somehow haven't yet became popular, why is that ?

<comment><USER5> Many of them already are, but they aren't "sexy". I personally do a lot of .Net, and MVC 5 has relatively good defaults if you just install and go. ASP.NET Core is even better in some regards (CSRF tokens are completely transparent now). I think a lot of the problem is that people want to use a lot of new tech which hasn't had time to develop security as a convenience feature, or they just flat out don't want to use a framework.

</comment></comment></comment></comment><comment><USER6> "security proponents will probably have to demonstrate improvements to the bottom line: less maintenance, improved customer satisfaction, or other measurable incentives to bring everyone on board"

In most fields there is little incentive to change things when the company itself isn't too affected in case of hack. Stocks go down for a week, then back up. General population doesn't seem to care enough to stop using the services, and does not understand enough about privacy/value of their data/need for encryption. So why would a company care ?

If being "ethical" and more devoted to privacy becomes a trend, perhaps there will be a stronger drive to follow security experts' advice. Did Whatsapp get a surge in users after enabling end-to-end encryption?

[https://hbr.org/2015/03/why-data-breaches-dont-hurt-stock- pr...](https://hbr.org/2015/03/why-data-breaches-dont-hurt-stock-prices)

<comment><USER7> >In most fields there is little incentive to change things when the company itself isn't too affected in case of hack

This is correct. As long as the risk isn't too high then companies will just take the risk and accept a hack as the "cost of doing business". Much like Goldman Sachs expects they will get fined by Governments, but they don't care because the money they make far outweighs the fines imposed.

<comment><USER8> New legislation, fines against businesses form a feedback cycle. They keep going up against repeat offenders until the behavior changes. Inverse exponential-backoff under collision with the regulatory body.

<comment><USER9> Haha awesome, determine fines with a PID-controller

</comment></comment></comment></comment><comment><USER10> If you personal info gets stolen from a company (or government) you entrusted it with, it ends up being your problem, despite any negligence on their part.

Personally, I believe that if it's negligence, there should be compensation - they lost something that belongs to you and is of value. But few people seem to really care. The info of 1 billion yahoo accounts was hacked, but who cares? Until that changes, the problem will continue to exist.

<comment><USER11> And this is why we see companies scooping up people's data and saving it with no regard to the individuals. We need to move to companies seeing that data as a liability, not an asset.

<comment><USER12> > We need to move to companies seeing that data as a liability, not an asset

this could lead to serious limitations on legitimate future progress including on anything built using statistical methods that require large training data sets.

<comment><USER13> That's certainly a concern given the way things are currently, but I'm hopeful concepts like Google's federated learning [1] will become increasingly popular, and a change to data-as-a-liability would help drive development and adoption of such approaches.

[1] [https://research.googleblog.com/2017/04/federated- learning-c...](https://research.googleblog.com/2017/04/federated-learning- collaborative.html)

<comment><USER14> I really, really like this approach to data, and there's so many advantages beyond the ones outlined there: if you could turn that collection approach into a universal/OS-level API you could have some kind of setup where user data by default stays on the device, then to use it, the app/app server has to request it explicitly (allowing the user easy and powerful, but granular control over who gets what data) and then user data is further protected by the other measures talked about in their paper.

Some level of public education is also required I think, to make people aware of the value/threat of just giving everything up every time someone asks for it.

</comment></comment></comment></comment></comment><comment><USER15> I think we need to do everything we can to make it so that the tools that regular programmers use aren't dangerous and/or insecure by default; otherwise, we're just playing security vulnerability whack-a-mole. Better to solve problems at the source than try to educate people how not to use a tool incorrectly. This is really hard because there are so many widely used tools and abstractions that were designed to be as powerful as possible rather than to be easy to formally verify for correctness. I feel like the whole software industry is built on a wobbly foundation, but it's hard to part with tools we know because they're useful and they work, even if they do break rather often.

A good start would be to stop using C and C++ for new projects, and generally try to eradicate undefined behavior at all levels of software. There's a lot of really great software written in C and C++, and it would be a huge undertaking to replace, say, the Linux kernel with something written in Rust or Swift or some language that hasn't been invented yet. I think the eventual benefits may greatly outweigh the costs, but it's a lot easier to sit in a local optimum where everything is comfortable and familiar than to set out on a quest to, say, formally verify that no use-after-free errors or race conditions are possible in any of the software running on a general-purpose computer with ordinary applications.

<comment><USER16> Yep, this is the only thing that can possibly work. The path of least resistance has to be secure, and in order to do something insecure, you need to know enough about what you're doing to jump through hoops to get there. Right now, we are in the opposite situation. People have to jump through hoops to do the secure thing.

You also have to meet them where they are, not get them to change their ways to suit yours. Otherwise, you're adding resistance, and you'll fail.

<comment><USER15> Well said.

</comment></comment></comment><comment><USER17> Among the examples cited was the Sony entertainment breach, whose causes included a negligent security officer keeping passwords in a plain text file on his desktop. It's not clear what better coding practices could have done to improve that (or anything else at Sony entertainment, where the breached systems were mostly running commodity software).

Ref: [http://www.telegraph.co.uk/technology/sony/11274727/Sony- sav...](http://www.telegraph.co.uk/technology/sony/11274727/Sony-saved- thousands-of-passwords-in-a-folder-named-Password.html)

</comment><comment><USER18> I know at least part of this problem is driven by the IT security field itself. Try, for example, to find a pragmatic PCI auditor that can focus on real issues. They exist, I'm sure, but the defacto process is to create a huge report filled with minutea...versus something rolled up and actionable.

It's not good, but I can see why, after a few of these experiences, proactive security gets dropped off the priority list.

<comment><USER19> Unfortunately Security and compliance (like PCI) cover similar ground but are very different in implementation.

PCI auditors work to a fixed standard and can be negatively affected if its found that they deviated from it, so there's a strong incentive for them to be picky. When combined with the fact that it's hard to have a standard that reflects the reality of good security practice, you end up with well the current PCI process.

The problem you're describing isn't really (I'd say) one that came from the IT Security industry though, it was the card issuing companies who set the PCI DSS standard and them that mandated the compliance process. Auditors are just carrying out those requirements.

<comment><USER18> It was just one example. I've seen similar issues from IT security in other situations. Like recommending every tier of an application in AWS having it's own VPC, with firewall appliances between them, manual approval chains to open up ports in a dynamically scaled app, etc.

Basically, finding pragmatic security people that can balance "perfect" with "real life" is hard.

<comment><USER19> Indeed, part of that will be the culture of the company.

I've seen quite a few companies where any breach of security is held to be the "security team's fault", so they have an incentive not to accept risks (limited upside if they accept a risk, alongside a large potential downside if a breach/incident happens as a result)

Getting past that really requires a culture where security is the responsibility of all people in the organization and there's no finger pointing in the event of a breach/incident.

<comment><USER20> Huh but that is the job of security auditor to assess risk level give report with level of threat and then product owner job is to take responsibility for implementing fixes based on that report. I do not understand way of working where you have security team that dumps report with bs on developers heads and say fix all now or we die.

</comment></comment></comment></comment></comment><comment><USER19> Interesting, although not particularly surprising, results there.

I'm afraid that the InfoSec community has been unsucessfully persuing the idea of "RoI" for security activities for a long time (I remember debating the idea 10+ years ago..)

Also the idea that increasing breaches would drive good practices seems not to have taken root that much, probably due to breach fatigue and the fact that most companies who are breached don't take any serious financial hit.

Realistically the most likely way to improve this situation is for it to feature more heavily in contracts and perhaps regulations.

Having a contractual requirement to carry out specific activities relating to code quality/security can drive them as there's a clear monetary cost of not doing so.

<comment><USER21> If there isn't any financial hit, then there isn't any value in added security.

<comment><USER19> I said no _serious_ financial hit, not no hit. Serious in terms of "the stock price went down significantly", there's still costs of breach clean up etc.

Also there's a big negative externality in that a lot of the costs are borne by users of the app/system and not necessarily the developers, but due to a lack of liability for software development and security breaches that isn't taken into account by many companies

</comment></comment></comment><comment><USER22> I promise this will never get better until fines get handed out left and right for breaches of ANY personal information. Right now, no one really gets penalized for breaches unless it involves regulated data (financial, healthcare, etc...).

Why? Money, obviously.

1\. employing security engineers who know what they are doing is EXPENSIVE.

2\. third party pentests are expensive.

3\. if there isn't an open source tool available, all of the software in the security area is SUPER expensive.

No company, especially small or medium size, is going to spend that kind of cash without a real motivator.

Even if you do EVERYTHING you should be doing, you will still have vulnerabilities. Its a loosing game.

<comment><USER23> In my dreams, some combination of closed hardware and/or software (perhaps the latest Intel AMT vulnerability?) leads to the personal information of all congressmen to be leaked--financial, medical, residential, etc. They respond with a "Secure Computing Act" that requires that the all US agencies, as well as any companies they do business with, to use 100% open-source hardware and software.

<comment><USER24> The more likely outcome would be to nonsensically ban open-source implementations and instead give a monopoly to a small list of "governmentally approved security companies." These companies in turn would be required to produce massive volumes of paper report to "manage the risk and prove that their software is secure."

</comment></comment></comment><comment><USER25> In healthcare, you have HIPAA and if you mess up patient records you can lose your license, be subject to legal actions. e.g: leaking 1 patient record.

If a pharmaceutical company releases a drug that causes negative side effects, lawyers are happy to sue the company on your behalf for free.

But software engineering is a discipline where no license is required, and now thanks to informal educational institutions like coding camps, not even a degree is required. You can ruin the lives of millions of people but always hop around and get another job.

Companies maximize their margin saving money on security (and other non- functional requirements), and expose customer sensitive information to significant risks with no accountability. A statement like "Sorry! we got hacked, your SSN and credit card information is now being sold by the bulk in an .onion site!" would do. We as consumers should punish those incidents more aggressively and demand a reasonable cause.

The product-driven minimum-viable-product lean-agile full-stack get-it-done culture of spaghetti code bases without security needs to die now. It's highly profitable and the preferred business model for many, yes. Is it ethical? hell no. Stop doing it. In those cultures, security is treated as "tin-foil hat paranoia" and laughed upon, and put into some "nice to have"/"maybe some day" list, with the lowest priority.

A security bug can make it into any software. But if you assembled a team of coding camp guys or fresh graduates to work on a banking platform or making an IoT pacemaker you deserve to be sued for neglicence.

Unfortunately because software is a relatively new activity compared to others, there is no established legal framework around it and that needs fixing.

</comment><comment><USER26> Security is one of those arts, especially when it comes to the programming side of things, that one tiny chink in your armour is enough. There are people and tools out there which scan continually for the bugs and holes, either wearing a white hat and submitting them to bug bounty programs or similar, or wearing a darker shade of hat and doing much worse.

Of course, there are things out there which can help a business to minimise these risks and to try and catch these potential coding horrors before they're put in-front of the general public:

\- Static Code Analysis (sometimes referred to as source code analysis) is sometimes a quick win here, but of course not the silver bullet. Sometimes a bug cannot be easily identified by just looking at code for common mistakes, it takes a skilled eye or even dynamic analysis for it to be spotted. However, static analysis can be added into your production pipeline and workflow, checking on each push for any newly added vulnerabilities!

\- Automated vulnerability scanning/testing is also something else which can be done in-house usually, with the right tools. There is no reason why you shouldn't be running various security scanning tools against your application during testing/pre-production, such as web application scanners or even fuzzers.

\- Go external, and get a 3rd party to penetration test your application if it requires that level of scrutiny. There are plenty of smart folks out there who do it day after day who can do this for you.

You can also deploy thing post deployment of course (depending on what you are coding!), so for web applications, a WAF (web application firewall) is sometimes useful to stop the vast majority of automated attacks. The alerts from this will also give you a very good idea of what is out there and at what scale you are being targeted. I'm currently working on a side project [1] which is to try and identify breaches once they have happened, as unfortunately they are almost inevitable. It isn't always your code which lets you down! It may be a dependency or library, or even a simple phishing email. Put simply, my project produces a canary to add to your user base, that we'll monitor continually for a number of tell-tail signs that someone else may have a copy of your data.

At that point, it's time to invoke your incident response process! Or... get someone in to run that process for you.

[1] [https://breachcanary.com](https://breachcanary.com) \- If you get this far, I would absolutely love any feedback.

<comment><USER24> >There is no reason why you shouldn't be running various security scanning tools against your application during testing/pre-production, such as web application scanners

Likely one reason is cost. When each individual tool costs 10k+ with the vendors trying to throw in consulting, it adds up.

</comment></comment><comment><USER27> And we're surprised? Didn't we learn anything from the 90's? No amount of diligence sitting at a desk, carefully evaluating the implications of the placement/thoroughness of your user input sanitation, adjusting the settings in server configuration files, preventing your employees from using removable media and accessing outside sites... No threat model, seriously none.. ever.. will ever.. Stop a young Angelina Jolie on rollerblades from gaining access to your evil corporations's super computer and thwarting your carefully laid, super-villain plan.

<comment><USER28> There's so much sarcasm in your post that I'm not sure I understand your point. Can you clarify?

<comment><USER27> Let me rephrase that; Skipping reindexing punch cards: If your adversary can write some ASM to get the EIP to point to a malicious instruction, they can instruct your system to do something you don't necessarily want it to do. Then our homies at bell labs built C, as a layer of abstraction to ASM. With C, your adversary has several ways to accomplish getting the EIP to his malicious instruction. Then, over the years, many brilliant, incredible minds, (no sarcasm about that. None.) have built abstractions to simplify C, and then built abstractions on top of those abstractions, and then abstractions to simplify those abstractions. (I'm totally not even going to touch networking protocols) There is decades, of building systems with flaws, on top of systems with security flaws, (which admittedly wasn't as much of a concern to anyone, as providing the functionality to accomplish objectives, business and otherwise) ... literally, like over half a century of this. So then these middle-management suits, operating with "LEAN 6-Sigma" misconceptions about the nature of the world, expect a kid, with a degree in anthropology (not knocking the study) to run through a 12-week intensive program, and be able to write code for a production system, with perhaps 2 people on their dev team of 8-16, and 3 folks in devops/IT who understand security to be able to proof all of that code, and make sure that your Gibson is bulletproof? It's unrealistic. If she wants to hack your Gibson, she's going to hack your Gibson. We're all going to attempt to stop that, and after we've failed, we will spend days filling out reports, talking to feds, and mitigating the damage. But we're continuously building onto a flawed mechanism, with another flawed mechanism. I mean, do you know any civil engineers who would say, "Oh hey this foundation is cracked, let's build something that tries to patch those cracks, and when that's broken, we'll build another level on top of that, and let's just obfuscate what's really going on underneath everything so that nobody who uses the building realizes it's unstable, and just hope it doesn't get too windy, or that there is an earthquake." ? Ipso Facto: When you launch some ransomware, that threatens the software reading a gyroscope to tip over an oil tanker if you aren't paid $1,000,000, and try to blame it on some kids who's only crime was curiosity, they will find a way to subvert the carefully measured security mechanisms you have put in place, to not only clear their names, and prove beyond the shadow of doubt that it was in fact YOU, who hatched this terrible plot, but also save the environment.

Sorry, I should have said that to begin with.

<comment><USER29> > I mean, do you know any civil engineers who would say, "Oh hey this > foundation is cracked, let's build something that tries to patch those > cracks, and when that's broken, we'll build another level on top of that, > and let's just obfuscate what's really going on underneath everything so > that nobody who uses the building realizes it's unstable, and just hope it > doesn't get too windy, or that there is an earthquake."

No, but civil engineers say stuff like "What's the likelihood that a 9.5 earthquake will his this area? What about a 5?" and model their designs on that. That's the point behind threat modelling - if a nation state actor decides they want to 'hack your Gibson' that's one thing, but if you're a bank than it may be that your most likely threat is employees or contractors stealing customer data. So you put your effort into protecting against those threats as well.

</comment></comment></comment></comment><comment><USER30> Programmers probably don't go out of their way to do secure coding not only because it's not mandated to them, but because they know that unverified code is junk. If security is a feature, it has to be verified. It's not the kind of verification where you can show that a feature works on correct data, and rejects incorrect data in some anticipated ways. It requires exhaustive code review, and a lot of cunning in the test strategy.

<comment><USER31> Programming languages from Adga to Monte are coming now with the ability to encode meaningful real-world proofs, and the compilers are checking those proofs.

We could be writing a _lot_ of verified code, if we wanted.

<comment><USER32> You radically overestimate the skills of the average programmer.

<comment><USER33> You are correct when you say that writing verifiable/verified code is a separate skill that not many programmers possess.

But crucially, it's a skills gap -- not an intelligence gap -- that stands in their way. For most properties, writing verified code doesn't require _that much_ more intelligence than writing normal code. Different skills, but in most cases not much more intelligence.

But I don't think a skills gap is the most pressing barrier. There is an _intrinsic_ difference in difficulty between stating conjectures and proving theorems. There's no silver bullet here, including either education or raw intelligence. The latter is, intrinsically, more difficult and more time consuming.

<comment><USER32> I'm reasonably sure that for all things where a proof would be helpful, that is properties that the programmer has a nontrivial chance of getting the implementation wrong and not catching the mistake with a test, a correctness proof is _a lot_ harder than writing a correct implementation. I've dabbled a bit with Coq and Isabelle and certainly found this to be the case.

Stronger type systems help a lot with common security problems. Memory safety and a system to express taint of inputs eliminate a huge class of potential problems. They are still very, very far from correctness proofs that could catch actual logic bugs.

</comment></comment></comment></comment></comment><comment><USER34> > One of the central security protocols protecting the web—OpenSSL

OpenSSL is not a protocol. It is an implementation of TLS. Other implementations were immune to Heartbleed.

</comment><comment><USER35> I implore you to try your very best to hire only professionals. (computerhackguru AT gmail DOT com or (513) 453-6539) will increase your chances of getting your job completed. I was lost with no hope when my credit score is below 500 and i was about to lose my job, my car, most of my properties including my house because i was yet to pay the mortgage, I sit my best friend down and tell him all my problems and he then introduce me to savior of all time Computerhackguru AT gmail DOT com or (513) 453-6539. I contacted him and he asked for my info and i gave him all he needed to proceed with the hack. Behold! I thought it was a joke after which have funded the exploits and i was told to wait to 48 hours. He helped me hacked into the FICO and all and get my credit score boost to 825 plus and now, I got a new perfect job and had to pay my mortgage and i'm living my life in peace without debts and bad credits. All thanks to the realest hacker alive! get to him through Computerhackguru AT gmail DOT com or (513) 453-6539. He's real, swift and affordable. I bet you get to find me and thank me later.

</comment><comment><USER36> Cultural changes among engineering teams would be helpful, but the bottom line as far as business apps are concerned is that, to prioritize security, the financial liability of letting hackers access customer data needs to meet the financial incentive of shipping working code. Until those curves intersect the status quo remains.

<comment><USER37> Government could impose fines for not meeting certain security standards, and then do random audits, or in a more free market way this sort of alignment ought to eventually be able to come about via:

1\. Class action lawsuits to sue companies who have data leaks.

2\. Companies take out insurance for being sued for data leaks.

3\. Insurance companies impose security requirements in order to provide coverage.

</comment></comment><comment><USER38>
    		The costs of dealing with breaches, no matter how demoralizing, never seem to justify
    		the extra time and money that good security requires. Additionally, although a security
    		flaw is sometimes traceable to a single line of code—as in Apple's famous "curly braces"
    		bug—breaches are often a simultaneous failure on several levels of the software stack
    		and its implementation. So each company may be able to shift blame onto other actors,
    		and even the user.

That above paragraph provides another perspective on why the software security vulnerabilities happens more frequently, which is different from the hardware ones. [1]

[1]: [https://news.ycombinator.com/item?id=14238391](https://news.ycombinator.com/item?id=14238391)

</comment><comment><USER39> Self plug =).

Check us out at [https://oneupsecurity.com](https://oneupsecurity.com) if you're interested in secure software development.

Always great to chat with businesses who are passionate about security.

</comment><comment><USER40> Replace "security" by "safety", and I suspect you have the same problems.

I wonder how that will work out with e.g. self-driving cars.

<comment> yoz-y I would be surprised if safety was not very high on the list of priorities. Getting hacked is always a nebulous proposal but I think it is quite easy to describe the consequences of somebody being hurt or killed by your product.

<comment><USER40> "We need to add this feature to the car immediately!"

"We can't do that because it would mean we would have to re-test the codebase, meaning we'd have to test-drive the car for hundreds of thousands of miles."

"Can't we take a shortcut? I believe the change is quite innocent. And the competitor already has this feature."

"Ok, sounds reasonable. Make the change."

<comment><USER41> You are assuming that car manufacturers operate like web companies.

Tip: They do not.

<comment><USER42> "Sir our car won't pass smog tests!"

"Oh no! Now we will need to do x and y and z and it will cost x dollars"

"Well we could adjust the software.."

"Sounds great!"

Yep, car industry...

<comment><USER43> Easily caught and heavily fined. (Not to mention loss of PR.)

</comment></comment></comment></comment></comment></comment><comment><USER44> What's the incentive for companies to care? They get hacked and leak everyone's data all over the place and we all just kinda shrug and say "that sucks". Sometimes bigger companies get in trouble for some millions, an insignificant amount to them.

Look at what happened last week with Netflix. It didn't involve user data, but they got hacked and their stuff leaked and then what? Everyone just shrugged. No big deal. I mean probably some people are getting yelled at internally, but otherwise the situation is clear: we pretend to care about this, but we don't care about it.

Imagine being a security advocate in an organization in this environment. You get to convince business people to spend money so that something doesn't happen, which even if it does happen, will result in embarrassing headlines for a day. Not exactly a convincing case!

</comment><comment><USER45> There are some obvious contributing factors:

0) The majority of programmers at this point in history are novices. Src: Joe Armstrong.

1) There is very little formalized training except in some enterprises. Many outsourcers invest very little in training and expect staff to learn on-the- job.

2) Large enterprises with immense codebases with many committers easily become Tragedies of the Commons without active code reviews and high standards.

3) There is very little standardization (convention over configuration): many languages, many non-orthogonal coding styles/language features.

4) Security seems like a non-value add activity... until there's a major problem. (Non-proactive development/CMM.)

5) Offensive and defensive sec require a different, acquired skill-set and engineering mindset from simply implementing features and fixing bugs.

</comment><comment><USER46> You can only have two things in software development either your software is "user friendly" or "secure". Example: PGP

<comment><USER47> PGP/GPG is the FFMPEG of encryption software. It could be done _way_ better.

<comment><USER48> ffmpeg has had a lot of hours of fuzzing and improvements thrown at it. I believe it's come out of the avconv fork looking better - after all, it survived.

<comment><USER47> It's powerful software, but goddamn that command-line interface makes ImageMagick look downright simplistic.

There are GUI tools for setting these options, but they're absolutely atrocious. You may as well be trying to program a guided missile.

<comment><USER43> FFmpeg is mostly a set of libraries rather than the test command-line application. There are really a huge number of applications using it internally.

</comment></comment></comment></comment></comment><comment><USER49> ITT: talking about poor incentives, doing basic threat modeling, etc.

The answer has always been professional licensing.

And no, just because there's always a new flavor of the month language or framework, doesn't mean the fundamentals change all that often.

* Sanitize inputs * Secure data at rest and in transit * Never store secrets in plaintext * Set up IAM properly for your organization * Use 2FA whenever possible * Principle of least access * Update frequently

Why, again, can't we conditionally license professionals on knowing the basics, and threaten disbarment for knowingly neglecting security?

<comment><USER16> > _The answer has always been professional licensing._

That's only the answer if you're asking people who have no real experience in security. Those who do are more likely to tell you that will only make the problem worse.

Professional licensing for writing or operating software will never work, and if it does, it will be extremely harmful.</comment></comment>


In Search of Dark Stars - <AUTHOR> http://www.simonsfoundation.org/quanta/20140722-in-search-of-dark-stars/ <comment><USER2> So back when I was running numerical simulations of pop III stellar evolution (which is rather a long time ago now), the interesting thing is that, in comparison to pop II and I, the extreme metal paucity means that you can have (a) stable and extremely long-lived very dim, very small stars, verging on being warmed up gas giants, and (b) very large and extremely short-lived stars, which will supernova or otherwise give way to instability on the order of a few million years after core ignition.

You can then work back to speculative mass functions (distribution of mass in the population) by asking (a) how many large, short-lived stars you need to generate the observed metallicity of pop II, and (b) how many extremely small dim objects you'd need to fill out the missing mass without having so many that someone would have seen them by now. The latter is an interesting line of thinking; what is the upper density bound on (for example) 0.1M objects to make both the solar system's continued existence and an inability to see these things plausible.

You can also look at the paucity of candidates for ~1M extremely low metallicity stars (there are just a couple out there known that could be pop III candidates) as another constraint on the pop III mass function. Any pop III ~1M stars would have a lifetime longer than that of the universe to date, or at least such was the case in my models.

Research on missing mass and pop III has moved on considerably from those days of course.

</comment><comment><USER3> > Her move to Stockholm, she said, is motivated in part by the cultural > acceptance of women in science there. "On the entire planet, as far as I can > tell, the best place for a woman to do science is Scandinavia," she said.

Am I wrong to think that Sweden is as wonderfully progressive as it seems?

<comment><USER4> >> Am I wrong to think that Sweden is as wonderfully progressive as it seems?

There are advantages/disadvantages with everything.

A consensus culture where the boss goes around and talks to people before setting goals is very different for Americans. Like all other cultures it works better for some areas, worse in others.

Think politically correct, group oriented. (Have you seen that anywhere else?)

Edit: Let me paraphrase it like this: "The worst of worlds, the best of worlds". Let me give an example. It isn't good for someone to have the "wrong" opinions on some sensitive point in a consensus culture; a low roof. [The Swedish term is "the opinion corridor", i.e. that only a small bandwidth of opinions are tolerated.]

Edit 2: I think that was the first time in my life I've seen the Stockholm people described as "friendly". :-)

<comment><USER5> I was surprised as well, regarding edit 2. Then again, my heart belongs to Gothenburg. :-)

</comment></comment></comment><comment><USER6> > We pointed out that because the Earth moves around the sun, any dark matter > signal you see should go up and down with the time of year, peaking in June, > with a minimum in December.

Why June and December? (Perihelion is around January 3, if that's relevant.)

<comment><USER7> if i remember it is explained by the move against and along the dark matter "wind" in our galaxy. Personally i think there are a lot of "wind" to be accounted for - out galaxy moves, our Sun moves inside galaxy and the Earth moves around Sun. So Earth definitely hits some "wind". Is it dark matter "wind"?

<comment><USER6> Ah, that makes sense. So the "wind" would peak when the Earth is moving against the galactic background.

</comment></comment></comment><comment><USER8> This is the same Freese who has proposed detecting dark matter using gold and DNA. I have no idea if she is right or wrong, but reading about this kind of researching is exciting to me.

</comment><comment><USER9> I know this is off-topic, but anyone else had "Benson, Arizona" ringing through their head when they read the title?</comment>


Can Programming Be Liberated, Period? (2008) [pdf] - <AUTHOR> http://www.wisdom.weizmann.ac.il/~harel/papers/LiberatingProgramming.pdf <comment><USER2> The previous discussion from 2017 was on point: Most of programming is figuring out what you actually want and that problem is not going to be solved by computers any time soon. However, I think there is a sub-problem where computers _can_ help. One of the biggest issues when writing large and long lived systems is that the code becomes more complicated than the original problem. Anybody whose worked on legacy systems before will be familiar with that issue: figuring out how to do what you want to do in the confines of the existing code is sometimes more difficult than analysing the original problem.

I tend to make my living on legacy code. In fact, I enjoy it more than green field projects because it's trickier. Also, because nobody else wants to touch that code, I have more freedom :-) And (if I'm honest) it's an easy escape from the occasional colleague who always insists that "it must be like X" because they lack experience to see things in terms other than X. When you get to the point of, "Well, we can't reasonably _do_ X because of all our legacy problems. What's plan B?", there is a lot more room for compromise and the task becomes a lot more fun (IMHO).

But on greenfield projects, having a tool that helps you understand when you are making the code worse would be incredibly helpful. We've got some metrics (like cyclomatic complexity, class size, method size, etc, etc) but it's still pretty easy to write code with terrible consequences even when following linting rules.

This is where I can see the potential for AI and ML to help: a kind of permanent pair programming partner that can keep an eye on the big picture. For example, warning you when you have too many options in your API, or when your architecture is not isolated enough (or too isolated). It's a lot of fuzzy judgement calls, so it's hard to find specific rules to help you. I suspect there are some startups looking at this, but I admit that I haven't followed their progress at all.

</comment><comment><USER3> I think the programming language design is not the problem. Python and others are easy enough. The problem is more with representing the thousands(more sometimes) of decisions that go into building a codebase. It is impossible for someone to just go in and understand a codebase. If there is a way to shorten the time to learn why every decision was taken, programming could be easily gamified.

</comment><comment><USER4> From 2017: [https://news.ycombinator.com/item?id=16008462](https://news.ycombinator.com/item?id=16008462)

</comment><comment><USER5> It is perfectly possible to program without a keyboard. That said it is a bit domain limited - block diagrams usually or picking from a list of functions.

Not having the how and what however is a bit of a receipe for disaster by asking something for nothing - undefined behaviors are bad. Programming depends upon clarifying your ideas - design does period. Even if you could teach it a phone interface it would still have to deal with standards to actually be a phone.

The precise "how" can be left to programs with machine learning or other optimizations like compilers of course but one needs a search space/technique for it to generate.

And there are pitfalls to keep in mind like spurious correlations,data poisoning to make a toy turtle be perceived as an AK-47, and model glitch exploitation. It will still give you what you ask for in the training functions - not what you really want. You may want a more efficient form of locomotion so it finds a perpetual motion device trick that needless to say won't work in the real world.

That happens with humans as well with perverse incentives and unclear requirements.

</comment><comment><USER6> Side note; Harels Algorithmics is a wonderful book I recommend to anyone.

</comment><comment><USER7> This is a bit similar to what I had been thinking for the past several weeks. My approach was a little bit different, and involved excel-like mechanisms with a bit of AI sprinkled on top, but this might be even better, though harder to do.

</comment><comment><USER8> Title should mention the year, [2008].

<comment><USER4> Added. Thanks!</comment></comment>


On Switching from an iPad Pro and a Macbook to a Pixelbook - <AUTHOR> http://www.speirs.org/blog/2018/11/30/on-switching-from-an-ipad-pro-and-a-macbook-to-a-pixelbook <comment><USER2> How does Chrome (browser) perform for your needs on iOS?</comment>


Open-Source Code for Hand Gesture Recognition – Sign Language Translation - <AUTHOR> https://github.com/google/mediapipe/blob/master/mediapipe/docs/hand_tracking_mobile_gpu.md <comment><USER2> There is nothing here close to sign language translation. Hand gesture are a very small and quite easy part of sign language who involve all the upper part of the body and face and use a lot of context and placement in space.

<comment><USER3> Yep this is fingerspelling, a small part, used for names and things there aren't signs for.

Here's an instructor running at medium speed for clarity. Experts go faster, drop more letters bcs cn undrstd wthout thm, and combine motions, like dipthongs.

[https://www.youtube.com/watch?v=yizRk2CP9gs](https://www.youtube.com/watch?v=yizRk2CP9gs)

</comment></comment><comment><USER4> What amazes me it's that a relatively new language easy to use (no voice, no accent distortion) it's not a global standard and we need tools like this to translate the different language signs.

This situation feels very stupid IMO.

<comment><USER5> It is a common misconception (dare I say prejudice) that gestures are "universal" and therefore easy to learn/unify sign languages. Sign languages are a full-fledged natural language with nuances and complexities, just like spoken languages. Their grammar tends to be spatial as well as temporal, and a typical signer can express abstract concepts and its relationships using different placement/movement of signs. The reason why it's diverse is that most sign languages have been organically developed (just like spoken languages pre radio/TV era) in mostly isolated deaf communities.

<comment><USER6> Even just a simple head movement depends on the culture, as nodding for "yes" and shaking the head for "no" is not universal [0][1]. And this doesn't even account for something like the "indian head bobble". [2]

Another example is the use of index finger and thumb to create an O. [3]

So if these very simple examples depend on the culture, I expect signing to be much more localized.

[0]: [https://en.wikipedia.org/wiki/Nod_(gesture)](https://en.wikipedia.org/wiki/Nod_\(gesture\))

[1]: [https://en.wikipedia.org/wiki/Head_shake](https://en.wikipedia.org/wiki/Head_shake)

[2]: [https://en.wikipedia.org/wiki/Head_bobble](https://en.wikipedia.org/wiki/Head_bobble)

[3]: [https://en.wikipedia.org/wiki/OK_gesture#Negative_connotatio...](https://en.wikipedia.org/wiki/OK_gesture#Negative_connotations)

</comment></comment></comment><comment><USER7> Can someone change the title? It seems to be Google open sourcing the code, not GitHub.

<comment><USER8> There's also a fair distance between hand detection and "Sign Translation". To begin with, most sign has both hands overlapping.

</comment></comment><comment><USER9> Ha, I read the headline and thought it was "git by gesture".

This is because I'd recently watched "Perl out loud", a talk this year by Emily Shea (2shea): [https://www.youtube.com/watch?v=Mz3JeYfBTcY](https://www.youtube.com/watch?v=Mz3JeYfBTcY)</comment>


Ask PG: do you cap karma averages? - <AUTHOR>

Lately I've noticed that while my karma continues to rise, the average-karma-per-comment remains locked in place. Over several weeks, neither highly scored (> (total/average)/100) nor multiple single-point submissions cause it to waver. Is it only recalculated periodically, or is there some external constraint?<p>PS not that I mind if you do, since I'm not the HN target demographic; just curious. <comment><USER2> pg: "There's a background process that runs every 45 seconds and picks a random loaded user to update the average of. Empirically, not more than every couple days, at best."

<http://news.ycombinator.com/item?id=1875635>

Also, pg posted the code to calculate karma/comment average. It doesn't include the karma of your last 5 posts or your highest ranked comment: <http://news.ycombinator.com/item?id=1853688>

<comment><USER3> The entire source of HN (modulo some antispam stuff) as of last year is available at <http://ycombinator.com/arc/arc3.1.tar> .</comment></comment>


That YC "female founders" graph with full context - <AUTHOR> https://docs.google.com/spreadsheets/d/1tZVHgKnNS5ghjkQou4QOyQtQWX9sURgSMVYgyC76z-Q/edit?usp=sharing

<comment><AUTHOR> NB I only found two all-female YC startups; if there are more, let me know and I'll correct it.</comment>


Convert scans of handwritten notes to beautiful, compact PDFs - <AUTHOR> https://github.com/mzucker/noteshrink <comment><USER2> I've tried some Imagemagick incantations that have been passed around to try to get results like this, and have been disappointed. I look forward to trying this!</comment>


IBM and the Holocaust - <AUTHOR> https://en.wikipedia.org/wiki/IBM_and_the_Holocaust <comment><USER2> They may be close lipped on it in public but this was widely known to employees when I worked there in late 80's and early 90's. At that time, the company was defending its operations in South Africa despite IBM equipment and services being used to enforce apartheid. It took them many years to drop that business.</comment>