Credit cards used on cvsphoto.com may have been compromised - <AUTHOR> http://www.cvsphoto.com/ <comment><USER2> For those not looking to click through to the site:

====

We have been made aware that customer credit card information collected by the independent vendor who manages and hosts CVSPhoto.com may have been compromised. As a precaution, as our investigation is underway, we are temporarily shutting down access to online and related mobile photo services. We apologize for the inconvenience and are working diligently to resume service as soon as possible. Your images are saved and you will have access to them once service to CVSPhoto.com is restored. Our in-store photo centers are not affected and remain in service. Film and disposable camera orders are being processed and your CVS/pharmacy will contact you when they are received.

Customers who provided credit card information for transactions on CVSPhoto.com are advised to check their credit card statements for any fraudulent or suspicious activity and to call their bank or financial institution to report anything of concern.

Customer registrations related to online photo processing and CVSPhoto.com are completely separate from CVS.com, optical.cvs.com, cvs.com/MinuteClinic on line bill pay and our pharmacies. Financial transactions on CVS.com, optical.cvs.com, cvs.com/MinuteClinic and in-store are not affected.

Nothing is more central to us than protecting the privacy and security of our customer information, including financial information. We are working closely with the vendor and our financial partners and will share updates as we know more.

For more information, call 1-800-SHOP-CVS.

====

<comment><USER3> Thank you, this is a very valuable and useful comment.

<comment><USER2> My sarcasm detector is admittedly permanently broken thanks to years on IRC and forums, but just in case:

It's useful because the steps a reader would need to take before being secure clicking through to a site identified in the submission title as "hacked" (I notice the title has been clarified since then) are non-trivial. I figured since I'd done them once, I might as well save additional folks the steps if they were just looking for the page contents.

<comment><USER4> I don't think grand parent was being sarcastic. In case they were, I'd like to add that I am sincerely thankful for the copy paste.

<comment><USER5> Looking at his comment history, it's very likely he was being sarcastic

</comment></comment></comment></comment></comment><comment><USER6> Like others have said about this happening to Costco too, this is all because CVS, Costco, Sam's Club, Walmart Canada, and Rite Aid use PNI Media as a backend for their photo services and PNI seems to have been hacked:

[http://krebsonsecurity.com/2015/07/cvs-probes-card-breach- at...](http://krebsonsecurity.com/2015/07/cvs-probes-card-breach-at-online- photo-unit/)

<comment><USER7> This article should replace the current article link (to cvsphoto.com)

</comment></comment><comment><USER8> My plugin made it even worse: [http://i.imgur.com/uSnzzHC.png](http://i.imgur.com/uSnzzHC.png)

<comment><USER9> Hey, I'm actually the creator of the plugin. I'm amazed to see a picture of it on HN. Thanks for using it and let me know if you have any questions. If anyone else wants to use it, it's called Plain Text Offenders Alert and available in the chrome web store.

<comment><USER10> Great plugin. Link here: [https://chrome.google.com/webstore/detail/plain- text-offende...](https://chrome.google.com/webstore/detail/plain-text- offenders-aler/ggndaknbenjhnkddgjnjjcmomgaidhmd?hl=en-US)

<comment><USER11> Interesting. how does this work? based on statistics/reports I guess ?

<comment><USER12> From the chrome webstore page:

>Disclaimer 1: Plain Text Offenders Alert is not associated with plaintextoffenders.com, it uses their publicly available database.

</comment></comment></comment></comment></comment><comment><USER13> My credit card was ripped off 4 times in the last year. Recently, I had a credit card for less than a week.

Since then, I started to use Virtual numbers. It's a feature that generates a virtual credit card number that I am opting to use per vendor. Hopefully, this will expose the vendors that are leaking this sensitive information.

<comment><USER14> Good idea. Which bank or credit card are you getting this service through?

<comment><USER15> The only two live US banks with this on the consumer side are Citi and BoA. The unfortunate thing is that the functionality is all accessed via old flash applications.

<comment><USER16> Citi has a Windows program also.

<comment><USER15> You are correct. Forgot about that one since it's just their flash app wrapped to work on Windows with a bit of extra copy & paste functionality.

<comment><USER16> Would it be vulnerable to flash exploits, then?

</comment></comment></comment></comment></comment></comment><comment><USER17> Same thing happened to Costco a few weeks ago. Maybe the same company behind both. From [http://www.costcophotocenter.com/](http://www.costcophotocenter.com/)

===

As a result of recent reports suggesting that there may have been a security compromise of the third party vendor that hosts Costcophotocenter.com, we are temporarily suspending access to the site. We take the security of our members' data seriously, which is why we are taking this precautionary step. This decision does not affect any other Costco website or our in-store operations, including in-store photo centers.

This situation is affecting multiple online photo sites. We are diligently working to determine when we can re-enable the site, but in all likelihood that will not occur until the middle of August. We will update this statement when we have more information.

<comment><USER18> Hate when they say "We take security of our members' data seriously".

How do I know the hack was due to their incompetence? PR people need to come up with a better approach.

<comment><USER19> Hate on "We take security of your data" is a new hype, but grandparent and OP actually contained blame shift:

> security compromise of the third party vendor > collected by the independent > vendor <...> may have been compromised

This is the case of "sorry for my friends, I'm doing the best I can", which is _entirely_ different situation than "I accidentally slept with your best friend, but I value our relationship" kind of PR.

<comment><USER20> If they "took security seriously" they would work with vendors who take security seriously. Wonder if they'll drop these guys as vendors now that they are proven to not take security seriously...

</comment></comment></comment></comment><comment><USER21> Credit card security is a joke. I shouldn't have to worry every time I give my credit card information to a website that they may leak it due to whatever reason. The information that I give out should be considered public information. They should require to always authenticate myself with the physical card (which is a smart card by the way). What's the point of the card otherwise?

It's not like I want to cover up for cvsphoto.com. I just find it ridiculous that if I give my credit card info to N website than the risk that my credit card info get stolen and abused is O(N) instead of O(1).

<comment><USER22> You shouldn't be worried now. You don't pay for any fraudulent charges.

<comment><USER23> It's still a major hassle when our cards get compromised and subsequently canceled by the bank.

I've had it happen when I'm traveling, and my primary card suddenly stops working. I always carry backups for this reason, but it's still disruptive and potentially embarrassing.

Also if I have a card on file for recurring payments or repeat orders, I have to go find all of those places and update it every time the card gets replaced. When it happens once, it's not so bad. When it happens two or three times a year, it's a headache. I finally took to having a single card that is used for ONLY recurring payments, with the hopes that it wouldn't get compromised and when the others do I wouldn't have to go through this whole exercise again. So far so good.

The bottom line is yeah, it doesn't cost me money, but it does cost me stress and time. I have better things to do with my time and energy than cleaning up after yet another compromise that happened through no fault of my own.

<comment><USER24> > I finally took to having a single card that is used for ONLY recurring > payments...

This is a sound plan. Kudos!

For non-recurring payments, I've taken this a step further: I use a debit card for online purchases backed by an account with just a few dollars in it. When I wish to make a purchase, I move the funds for that purchase into that account.

I would rather have a fraudulent purchase be declined than to deal with the hassle -however small- of disputing a charge.

<comment><USER25> Are you sure it works that way? By default, the bank is more than happy to let the transaction go through, then charge you $20 for loaning you the money, plus much more interest than you'd pay with a credit card.

<comment><USER24> I'm 100% certain. I checked it intentionally once, and accidentally another time. As I understand it the trick was to decline the "Overdraft Protection" shit that every bank was pushing many, many years ago.

</comment></comment></comment></comment></comment></comment><comment><USER26> I saw this page two weeks ago, so it's not a new event. Don't know how long this page was up before that.

<comment><USER27> Since July 16th. Hilarious that their site is still down...

</comment></comment><comment><USER28> Weird. Carphone Warehouse (UK) has some news too: "Personal details of up to 2.4 million Carphone Warehouse customers may have been accessed in a cyber- attack, the mobile phone retailer says."

</comment><comment><USER29> I'm ok, because since the last time I used it there, I probably had to change my CC# 4-5 times because of other hacks or other issues detected by BoA.

</comment><comment><USER30> This is why I use a 2nd account for online use (and paypal / virtual card for the extra sketchy looking sites).

<comment><USER31> If only there was some secure & magical internet money thingie which works on a push not pull basis /sarcasm

<comment><USER30> Not sure I'm following? Bitcoin reference?

<comment><USER29> Seems like it, but a Bitcoin insurance would be nice.

</comment></comment></comment></comment><comment><USER7> Was access to stored photos also compromised? The linked message from CVS doesn't say one way or the other.

<comment><USER32> From the page: "We apologize for the inconvenience and are working diligently to resume service as soon as possible. Your images are saved and you will have access to them once service to CVSPhoto.com is restored."

That being said, my understanding as somebody with 15 years of working history in the online photo space is that PNI is the host and all of their major customers shut off so I can't imagine that PNI is very healthy right now. If I am mistaken and the individual sites (Rite Aid, Costco, Sam's Club, Tesco, CVS and Walmart Canada) actually store and manage the photos then the data is likely to be fine.

That also being said, never trust your photo storage to an online service even if you are paying for it. Photos generally don't take up that much space. You should have at least two copies on devices that you own if you don't want to lose them.

<comment><USER33> Having two hard drives with my photos on them doesn't protect me against a house fire.

<comment><USER34> If your house burns down and your lost digital photos are your primary concern, you're probably doing ok.

I think he meant _in addition to online storage_.

</comment></comment></comment></comment><comment><USER35> Another day another hack. At least they were smart and isolated photos from their other properties. Or lucky.

</comment><comment><USER36> Hm, why aren't credit cards stored after a per merchant one way hash?</comment>


Two Big Steps Toward the Quantum Computer - <AUTHOR> http://www.popularmechanics.com/technology/engineering/extreme-machines/two-big-steps-toward-the-quantum-computer-16682595

<comment><USER2> This is all I can think of when I hear about this stuff: [http://upload.wikimedia.org/wikipedia/commons/4/4e/Eniac.jpg](http://upload.wikimedia.org/wikipedia/commons/4/4e/Eniac.jpg)

</comment><comment><USER3> > But here's the tricky part. The scientists can put the rubidium atom in > superposition, so that it is simultaneously in that energetic state and not > in the energetic state. It's on and off. Because of this, the photon both > does and does not enter the mirror, mingle, and gain its polarization > change. And the photon, by virtue of having both changed and not changed, > carries that superposition information and can bring it to a different atom- > based qubit.

I know almost nothing about Quantum Mechanics, but this sounds amazingly ingenious.

So what did they do, some sort of _parallel universe transistor_ where the rubidium atom acts as the gate? If you assemble a processor out of this, will it compute all possible computations _at the same time_? And, last but not least... how do you make it converge to the computation you actually want?

Quantum computers make my head spin.

<comment><USER4> Yeah, one interpretation of what a quantum computer does is that it performs all computations in parallel. However... you run into problems when you try to read the output of this computer. In order to read the output you must measure a quantum state, and when this happens you only get to see one answer at random, not all of them. And that's not really useful. But if you can design an algorithm so that all of the parallel computations add together to form one answer (i.e., get all the wrong answer's probabilities to cancel out), you can get an exponential speed up. The key takeway is that quantum computers are not faster for general problems - quantum computers are only faster for problems where a special algorithm exists (like Shor's algorithm for factoring).

</comment></comment><comment><USER5> I was under the Belief that we currently have no way of adding the qbits together. We can set a qbit and read it but we can't currently get the particles in the quantum state to interact.

The article however paints another picture.

<comment><USER6> Some groups have even been running Shor's algorithm on multi-qubit computers. [https://en.wikipedia.org/wiki/Quantum_computer#Developments](https://en.wikipedia.org/wiki/Quantum_computer#Developments) It requires the qubits to be entangled to do the computation, and in the later ones (not IBM's 2001 work) the researchers did observe entanglement.

<comment><USER7> Technically, you can run Shor's algorithm on non quantum computers, with an exponential speed up (but fully within capabilities of modern computing vs. small quantities of qubits)

</comment></comment></comment><comment><USER8> Here is a Google tech talk with Eric Ladizinsky that got posted a few days ago. [https://www.youtube.com/watch?v=eIEy1KHk0rk](https://www.youtube.com/watch?v=eIEy1KHk0rk)

Very interesting listen if you have the time

</comment><comment><USER9> IANAQP, but doesn't this article describe measuring the state of a quant? Shouldn't measuring put a quant into a defined state, i.e. destroying its superposition?

<comment><USER10> Measuring certainly would, but I don't think that's what it's describing. Instead, I think it is describing connecting the qbits together and allowing them all to share the same super-position through the entangled photon.

</comment></comment><comment><USER11> Am I missing something? Isn't a quantum computer just a non deterministic computation mechanism?

It feels wrong to suppose that answers come out in an "instant", or a mere one step.

</comment><comment><USER12> Continuum of Singularity, so to speak.

</comment><comment><USER13> When two network quantum chips can communicate instantly (not at speed of light--instantly) over infinite distances, using entangled atoms, then we can ditch the tecos.

I'm so looking forward to that.

<comment><USER14> Chances are FTL communication is not possible.

[http://curious.astro.cornell.edu/question.php?number=612](http://curious.astro.cornell.edu/question.php?number=612)

[http://en.wikipedia.org/wiki/Superluminal_communication](http://en.wikipedia.org/wiki/Superluminal_communication)

The book, "Why E=mc^2" is an exceptional read. If I recall correctly, it explains why light-speed is a universal limit:

[http://www.amazon.co.uk/Why-Does-mc2-Brian- Cox/dp/0306819112](http://www.amazon.co.uk/Why-Does-mc2-Brian- Cox/dp/0306819112)

<comment><USER15> Stating whether FTL communication is possible at all may require hedging. Stating that it can't occur over quantum superposition does not, as I understand it. The math is clear; there's no information traveling. It does not matter how sophisticated our quantum computers get, there will not be any FTL communication coming out of them.

If we could do that at all, we'd almost certainly be able to to it today, anyhow. We have multi-q-bit QM computers, they just aren't of a practical size for computation. But if FTL communication was possible, it would have been done with them already.</comment></comment></comment>


Do you have to file an FBAR for a bitcoin account? - <AUTHOR> http://www.irsmedic.com/2013/03/28/bitcoin-and-fbar/

<comment><USER2> It is unlikely the IRS would need a new law to require Americans to report significant Bitcoin positions on their returns.

If you have a stack of cash in a drawer, you are supposed to tell the IRS about it. It does not matter if it's in dollars, yen, Swiss francs, or pounds sterling. The fact that a lot of people don't doesn't make it legal, just unlikely to be enforced unless you give the IRS a reason to hate you. If, on the other hand, you have a garage with millions of dollars of un-reported cash in it you become an IRS priority. This is no different, _under present law_ , from someone holding millions of dollars in bitcoins across several wallets.

The IRS could also treat bitcoins as an asset, which would classify bitcoin transactions as barter and make holdings subject to capital gains (and losses) in dollar terms. All said, it would not need new legislation to deal with this.

<comment><USER3> > If you have a stack of cash in a drawer, you are supposed to tell the IRS > about it.

Under what regulation?

<comment><USER4> > Under what regulation?

Unfortunately when it comes to the IRS, current laws and regulations are irrelevant. They prosecute retroactively and change the rules as they see fit to scare the public into compliance.

The fact that people are so quick to ask about IRS compliance with bitcoins is evidence of this. People feel an obligation to an entity they owe nothing to, because they are scared to death if they don't report a couple bitcoins, that FBI, secret service, or even ATF is going to break down their door and storm in with assault rifles.

<comment><USER5> Stop spreading FUD. That's not how the IRS operates. It _very frequently_ loses court cases, including Tax Court cases, in which the taxpayer challenges IRS actions.

More to the point--the IRS does not have police powers, it can only levy civil sanctions after full due process. That means no ATF involvement, ever. The IRS can, in limited circumstances, refer cases to the DOJ for further investigation as a criminal matter.

<comment><USER6> In other words, there are frequently cases in which IRS tries to take what does not belong to them? If so, it only proves the point that people are scared by IRS and it is IRS that spreads soul-killing FUD.

</comment></comment></comment></comment></comment><comment><USER7> The headline is entirely speculation. The article itself is heavy on the ideology and light on facts.

Edit: The edited headline is STILL inaccurate. It's not a "law proposal". It's one tax lawyer's speculation.

<comment><AUTHOR> While I agree with you, I'm having a hard time explaining the article in a single short sentence. I actually found this link inside a long thread on a closed LinkedIn group discussing potential law, so it's not just one lawyer talking about it.

</comment></comment><comment><USER8> And how is this not any different from our reporting requirements now? Any bank account we (US citizens) have over $10k must be reported.

<comment><USER9> Because it's just something you have, which _might_ be worth $10k _if_ you sold it.

If you own a car worth over $10k, do you need to report that?

<comment><USER10> Until explicitly stated otherwise bitcoins are considered, by definition, a cash-equivalent for US citizens. I take it you don't file taxes in the US (or at least don't have very many assets)?

</comment></comment></comment><comment><USER11> I fail to see how any regulation regarding BitCoin would work in practice. I think it would be hard to prove you have a BitCoin wallet as it's a quite anonymous system. Besides, I could have my wallet.dat file on a remote server and manage transactions through that.

I get the feeling the IRS right now think BitCoin is a joke and if/when it becomes a big deal, they'll panic and try to pass shifty laws. None of which will make any real sense.

If anything, they'll try to pass laws regarding moving money to/from USD <-> BTC.

</comment><comment><USER12> Excellent article, but it needs a title change.[0]

[0]: At the time of writing the title is "US citizens to report BitCoin accounts over $10.000 to the IRS"

</comment><comment><USER13> I think a comma might be more appropriate here. North Americans usually use the $1,000 over the $1.000 format.

<comment><AUTHOR> Thanks, fixed it.

</comment></comment><comment><USER14> Interesting idea for a startup if they go through with this: a service that provides plausible deniability for bitcoin wallets.

</comment><comment><USER15> This begs the question, what is an "account" in Bitcoin? Can I not just make multiple Bitcoin addresses with $10,000 each?

<comment><USER10> The exchanges will all eventually have reporting requirements for US citizens making transfers above a certain threshold in a certain period of time.

Once the IRS actually gets to work and addresses this they'll probably end up altering terminology so that a bit coin "account" is comparable to all bit coins within an individuals direct ownership and control.

In the end investment proceeds from bitcoin will be taxed and traced. I wouldn't try to outsmart or game the US government in terms of account balances, I could see a "smart" early adopter going to jail because of their efforts to avoid taxes.

<comment><USER16> And if the money's never on an exchange, but just in the network? And how do they prove I own any bitcoin?

<comment><USER17> I wondered about this too, if it gets to the point where you can buy significant goods and services with bitcoin then it's basically a tax evaders dream.

<comment><USER18> Only to the point where the IRS audits you for spending significantly more money than you earn. Drug dealers and organized criminals get caught for this very problem concerning undeclared cash.

<comment><USER17> That's true, if you have a ferrari and declare minimum wage income you'll have problems though there are many less conspicuous ways to spend/save/invest the money.

You would certainly get a significant rise in tax evasion. I'm not actually convinced that's a bad thing overall (though I'm not inherently anti tax). If it brings tax schemes previously only available to the wealthy into the hands of commoners.

</comment></comment></comment></comment></comment></comment><comment><USER19> As Bitcoin has no country or jurisdiction of origin, I fail to see how Bitcoin can be classified as foreign.

I also fail to see how the IRS has any regulatory power over a currency not defined by US tax law.

<comment><USER20> One easy way to disabuse yourself of this notion is to take a job working remote for a Canadian company.

<comment><USER19> The difference being they can't see you getting paid in bitcoins. They can see you getting paid through banks.

They have no regulatory power regarding Bitcoin because they have no way to enforce it.

</comment></comment></comment><comment><USER21> Suppose you have the Bitcoin on a local wallet, and your computer crashed, losing all the private keys (perhaps presenting the requisite Apple Store receipts when you took it down to the store to get repaired). A bit like losing your cash in a fire; computers do crash quite a bit. Not a lawyer, but I think something like that might be difficult to disprove in court. On the other hand, subsequent spending from those addresses would then be monitored. So perhaps best to report that computer lost/stolen.

<comment><USER22> How would anybody know a particular address belongs to you?

Unless there's a direct connection with transactions, or you generate a vanity address with your name in it, there's probably not much way that you could.</comment></comment>


Genetics determine academic success: UK Grammar schools have virtually no effect - <AUTHOR> https://www.telegraph.co.uk/education/2018/03/23/grammar-schools-have-virtually-no-effect-genetics-determine/ <comment><USER2> The paper is "Differences in exam performance between pupils attending selective and non-selective schools mirror the genetic differences between them" and is available at [https://www.nature.com/articles/s41539-018-0019-8](https://www.nature.com/articles/s41539-018-0019-8) .</comment>


Bug Labs Founder and CEO Peter Semmelhack on Bottoms-Up Innovation - <AUTHOR> http://www.clickable.com/blogs/clickableblog/archive/2009/12/06/bug-labs-founder-and-ceo-peter-semmelhack-on-bottoms-up-innovatin-video.aspx

<comment><USER2> Sorry, but calling it "Bottoms-Up" innovation made me think that there was drinking involved.

I think the term he is looking for is "bottom-up".</comment>


Re: CVE-2014-6271 – remote code execution through bash - <AUTHOR> http://seclists.org/oss-sec/2014/q3/734 <comment><USER2> And I'd like to thank Gentoo developers for the usual very fast response they had towards this security advisory.

The moment I saw the news here, I ran to update my stuff -- the patch was already there, marked stable in the official gentoo repositories.

My impression is that they're following very closely the progression of this event and the relevant GLSA entries are being updated without any noticeable delays.

Thanks for running the show guys, you're true professionals!

Here's the relevant Gentoo Linux Security Advisory (GLSA) link: [http://www.gentoo.org/security/en/glsa/glsa-201409-10.xml](http://www.gentoo.org/security/en/glsa/glsa-201409-10.xml)

<comment><USER3> Same with Ubuntu, which I run on my servers. It was patched by the time I had SSH'd in.

</comment></comment><comment><USER4> This issue is an awesome demonstration of how bad closed ecosystems are. The open systems that are running on Linux (RedHat, ubuntu, etc) are patched and updated.

However, OSX which is also affected is still waiting. If I owned an Apple server I'd be screaming right now.

Embedded devices with closed eco systems are also stuffed (we've got to moved to open router firmware like OpenWRT). Basically, you can carry on as normal if you use open source the way it was intended.

<comment><USER5> Devil's advocate: most OS X systems aren't running exposed services that could be exploited, and if you were running an OS X server you can always re-compile bash manually for something of this severity (and Homebrew/MacPorts make this even easier).

That said, I do think it's ridiculous though how slow Apple is. It's absolutely crazy. I can only hope that Heartbleed and now this are causing some major internal reviews over there...

<comment><USER6> Even though I've got MacPorts bash installed, it lives in /opt/local/bin, while the default one in /bin/{ba,}sh is the ancient apple 3.2 one.

[https://apple.stackexchange.com/questions/146849/#146851](https://apple.stackexchange.com/questions/146849/#146851) has a simple enough step-by-step guide to patching & recompiling the system version with the appropriate patches, if you've got XCode installed and are comfortable with that sort of thing.

Agreed on the Apple security response time though. I reckon they have all their best guys fighting the IOS jailbreakers :P

<comment><USER7> You should jump to using Homebrew. It's superior in most ways. I'd used MacPorts and Fink before Homebrew came about and I never much liked either. Homebrew is as simple as it can be and is really good at detecting conflicts which MacPorts and Fink were terrible at.

<comment><USER6> I've fought with both of them in the past, and ultimately went back to MacPorts when I last reinstalled.

Homebrew was (at the time, maybe a year or so ago) missing a lot of things I wanted to use, and some packages broke for no obvious reason.

I'm sure some of it was the result of my rather frankensteinien setup by that point, but I have no real desire to reinstall things again until I have to.

MacPorts may be occasionally annoying, but at least it's usually in a way have come to understand. :)

</comment></comment></comment></comment></comment><comment><USER8> This appears to be the same as [http://seclists.org/oss- sec/2014/q3/att-690/eol-pushback.pat...](http://seclists.org/oss- sec/2014/q3/att-690/eol-pushback.patch) at least for 4.3. But for 3.2 [http://seclists.org/oss-sec/2014/q3/att-690/eol- pushback.pat...](http://seclists.org/oss-sec/2014/q3/att-690/eol- pushback.patch) did not work, I had to download bash32-053.bin from Chet's email.

Procedure for Ubuntu 8.04 and other installations where binaries are not available (default 8.04 LTS server did not have m4 and bison dependencies), assuming that 1st patch has already been applied per [https://news.ycombinator.com/item?id=8364385](https://news.ycombinator.com/item?id=8364385) :

      #Executing as root
      #assume your sources are in /src:
      cd /src/
      echo "getting m4..."
      wget http://ftp.gnu.org/gnu/m4/m4-latest.tar.gz
      tar zxvf m4-latest.tar.gz
      cd m4-1.4.17/
      ./configure && make && sudo make install
      cd /src/
      echo "getting bison..."
      wget http://ftp.gnu.org/gnu/bison/bison-3.0.tar.gz
      tar zxvf bison-3.0.tar.gz
      cd bison-3.0
      ./configure && make && sudo make install
      echo "getting patch..."
      cd /src/
      #replace line below with wget http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-026 tomorrow
      wget http://seclists.org/oss-sec/2014/q3/att-690/eol-pushback.patch
      cd bash-4.3
      patch -p0 < ../eol-pushback.patch
      ./configure --bindir=/bin && make && sudo make install

</comment><comment><USER9> Not having worked with bash (et al) in ages I wonder whether allowing a function definition (even without trailing commands) is not still hole? What if you defined a function 'ls() { evil... }'... could a CGI script making a call to 'ls' actually end up with the function instead of the real 'ls'?

<comment><USER10> I think the cases where it's still a hole are probably obscure and/or unlikely in the wild, but I definitely think the response to this should have been to disable the feature altogether. It's a terrible idea and I'm really curious if anything actually uses it _and should be using it_.

<comment><USER11> It's used to export functions from one instance of bash to a child. Do you think that that's a terrible idea, or do you have a better idea of how to implement it?

(The fix changes it so that exporting is done through specially named variables. Instead of exporting `x='() { :; };`, it now exports `BASH_FUNCTION_x()='() { :; };'`.)

<comment><USER10> Do any other shells do it? Afaik it's not part of the POSIX sh spec. So any script that does it is going to be extremely dependent on bash in particular.

It would take actual use cases to convince me it's not a terrible idea. No matter what it's a mechanism to throw arbitrary code into a script that has no say in it. This is not the sort of thing you should do because it seems cool, it should be the sort of thing you do because of a really compelling use case that necessitates it. The fact that afaik no other shell has implemented this behaviour since bash did (a couple of decades ago if I understand correctly?) would rather suggest there is a lack of need for this.

</comment></comment></comment></comment><comment><USER12> Debian patched this 8 hours ago, Redhat issued a patch about 3 hours ago, I believe Centos is still vulnerable, Ubuntu 14.10 isn't patched yet, Ubuntu 14.04 was patched about 3 hours ago.

<comment><USER13> I'm using debian jessie (testing) i386, and I had to download bash myself (from sid) because my up-to-date system was affected but the first patch was available for sid (unstable) and wheezy (stable) and not in jessie.

So I don't know if every architecture, and version is updated with the same speed.

<comment><USER12> Jessie isn't released / stable and doesn't receive security patches until it is. It's called testing for a reason.

<comment><USER14> debian testing do receive security patches, but it is not a priority so they may not get there in a timely manner.

<comment><USER13> Yeah. I'm aware that stable and old stable need to be patched first, I was just surprised by how much time it took considering the kind of risk (and being beaten by sid, the kid whom always breaks his toys).

</comment></comment></comment></comment></comment><comment><USER15> There seems to have been some confusion about the effect of this _feature_ on PHP in previous threads on HN. If you are running mod_php you are unaffected even if you use exec / system etc as the Apache PHP SAPI doesn't pass the environment variables to the sub process.

However if you pass any user data (_POST, _GET, etc) into a system/exec etc call that sets an environment variable then you would be vulnerable.

</comment><comment><USER16> Available on Debian now.

[https://www.debian.org/security/2014/dsa-3035](https://www.debian.org/security/2014/dsa-3035)

</comment><comment><USER17> If you have some RHEL4 machines that you still haven't retired:

wget [https://oss.oracle.com/el4/SRPMS- updates/bash-3.0-27.0.2.el4...](https://oss.oracle.com/el4/SRPMS- updates/bash-3.0-27.0.2.el4.src.rpm)

rpm -ivh bash-3.0-27.0.2.el4.src.rpm

rpmbuild -ba /usr/src/redhat/SPECS/bash.spec

rpm -Uvh /usr/src/redhat/RPMS/x86_64/bash-3.0-27.0.2.x86_64.rpm

</comment><comment><USER18> I don't understand. I see that the fix causes bash to ignore function definitions in the environment variable. But why should bash interpret the variable's content in the first place, and not treat it as a string? I suppose that someone can use eval if he really wants to execute it.

</comment><comment><USER19> Amazon has released packages for their Linux AMIs that deal with both CVEs: [https://alas.aws.amazon.com/ALAS-2014-419.html](https://alas.aws.amazon.com/ALAS-2014-419.html)

</comment><comment><USER20> 2nd CentOS update is out too [https://news.ycombinator.com/item?id=8371164](https://news.ycombinator.com/item?id=8371164)

</comment><comment><USER21> My server actually got hacked through this. I patched the first vulnerability quickly (arch linux, just did pacman -Sy bash). The second vulnerability was published overnight, tried to ssh to my box to patch it in the morning: "enter password:" \- uh oh, I use public key auth

My server runs a couple of wordpress sites and a rails app - not sure where the vulnerability was exploited but be warned, looks like bots are already crawling for it

<comment><USER22> Huh. I thought the second issue did not have an exploit? That when set, all would happen was that running "X Y" via a shell could instead run "Y > X " ?

<comment><USER23> If the attacker can control a list of arguments and an env var value, you're back to arbitrary command execution, albeit redirected somewhere. That sounds suspiciously insecure even without bash vulnerabilities, though. Would be interesting if GP knows what they used.

<comment><USER21> I have no idea, I wasn't able to access any logs or anything.

It's possible they had already installed a backdoor using the first vulnerability before I patched it, or perhaps something else entirely (though that's a little too coincidental)

</comment></comment></comment></comment><comment><USER24> Ubuntu: [http://people.canonical.com/~ubuntu- security/cve/2014/CVE-20...](http://people.canonical.com/~ubuntu- security/cve/2014/CVE-2014-7169.html)

RHEL: [https://rhn.redhat.com/errata/RHSA-2014-1306.html](https://rhn.redhat.com/errata/RHSA-2014-1306.html)

CentOS update is available also - just not on some mirrors yet.

<comment><USER25> I just patched my CentOS 6 server a few hours ago. Double check yum.

<comment><USER26> I patched mine about 10 hours ago. Is this one newer?

<comment><USER24> Make sure you have bash-4.1.2-15.el6_5.2 instead of bash-4.1.2-15.el6_5.1 which was the initial patch.

</comment></comment></comment></comment><comment><USER27> I don't see the new update on Ubuntu 12.04. What version of bash contains the complete fix? I'm still at 4.2.25(1)-release

<comment><USER28> [http://www.ubuntu.com/usn/usn-2363-1/](http://www.ubuntu.com/usn/usn-2363-1/) \- Ubuntu 12.04, bash 4.2-2ubuntu2.3.

</comment></comment><comment><USER29> Is any fix going to be rolled out to older no longer supported versions of Linux? I know they're out of support but I think this is a special case and deserves the attention.

<comment><USER30> Highly unlikely. Anyone still running an out-of-support instance who isn't manually applying updates is already vulnerable to other unpatched issues anyway, and those held back on old versions who _are_ manually applying security updates (by compiling their own from upstream source and such) will already be on the ball with this one.

</comment></comment><comment><USER25> Very thankful this made it out today.

<comment><USER31> Agreed, kudos to everyone for the speedy response!</comment></comment>


Physicists build world's first antilaser - <AUTHOR> http://arstechnica.com/science/news/2011/02/physicists-build-worlds-first-antilaser.ars <comment><USER2> Why can't the beams cancel each other out in the air?

<comment> alok-g That's what I am trying to figure too. Two coherent beams with the same frequency, and after adjustment for phase and amplitude, could be made to cancel simply with destructive interference. Maybe this achieves something more, or maybe this does not require amplitude or phase adjustment. I do not know (and possibly do not know enough Physics to follow).

</comment></comment><comment> alok-g Want to absorb some light? Why not make it fall on some black object! Want to absorb some specific frequency band? Add a dichroic filter to the setup.

<comment><USER3> Want to control whether a beam of light is transmitted or absorbed by the presence of another beam?

Sounds like a transistor doesn't it? Did switching electrical signals with transistors ever lead to anything?

<comment> alok-g As far as I understood reading the article a few times, this does not sound to have transistor action (for light) to me.

</comment></comment></comment><comment><USER4> Shields up Mr. Sulu!</comment>


A framework to build interactive console apps with ease - <AUTHOR> https://github.com/adhocore/php-cli <comment><USER2> May want to mention php in headline</comment>


Fear and Loathing with APL - <AUTHOR> http://theburningmonk.com/2015/06/fear-and-loathing-with-apl/?ref=hn

<comment><USER2> "SQL, Lisp, and Haskell are the only programming languages that I've seen where one spends more time thinking than typing."

\- Philip Greenspun

From [http://www.paulgraham.com/quotes.html](http://www.paulgraham.com/quotes.html)

I adore languages with a high thinking-to-googling ratio. I've been typing the code in this example. Even though I use my mouse to type APL characters, it feels _fast_. Really, really enjoyable.

Thanks to the author; this is readable and fun.

<comment><USER3> One of Iverson's changes when he created J as a successor to APL is that all the operators are ASCII characters.

[http://jsoftware.com/](http://jsoftware.com/)

Open source and even available on Android so it can be run on a phone.

</comment></comment><comment><USER4> A few years back, I ran into two professional APL developers. Apparently there are still 3 major commercial APL vendors (not counting IBM, which probably still sells APL2). Each targeting their own niche, and each being expensive if you're used to free compilers (starting on the order of $1k per seat).

</comment><comment><USER5> A language that shares the same philosophy but is a little more approachable is J (jsoftware). Unlike APL, it only uses normal ascci punctuation marks. J is also open source, which is a big advantage over APL.

<comment><USER6> There's GNUapl which is coming along nicely.

<comment><USER7> Yup, GnuAPL is getting better every time I use it for anything. Dyalog for personal use is also very good and decently affordable (and they just released a Mac version, I got to test the beta as an interested user and it works very nicely)

</comment></comment></comment><comment><USER8> APL is an awesome language with _one_ glaring flaw. It's impossible to read and you need a special input method to type. I enjoy reading about it but I can't imagine I'd ever enjoy having to work with it.

<comment><USER9> That's two glaring flaws. You may want to try J, which only has one glaring flaw.

<comment> vezzy-fnord YMMV, but I find the readability of J and K to be far worse precisely because of the ASCII charset instead of the glyphs. The APL glyphs give me a concrete context switching mechanism that I'm operating within its "alphabet" and the semantics thereof. Whereas because I associate ASCII characters with plenty of other meanings already, I find J and K to look like complete line noise in comparison.

<comment><USER10> It seems like translating J or K to a glyph format for reading would be a relatively simple matter.

<comment><USER9> Would have to be a one to many relationship. Part of the problem with K is that the meaning of an operator depends on the type of the operands. "?" can be "generate a random number" or "search for an element in a list" for instance. And yes, that is insane.

<comment><USER10> Well, a parsing display system still sounds like a reasonably simple piece of software.

Still, while I met J author Roger Hui years ago in college, I've never run a line of J so I probably would be the one to create such a system.

</comment></comment></comment></comment></comment></comment><comment><USER11> I really hope "Fear and Loathing in/with $TOOL" doesn't become the new "How I learned to stop worrying and love $TOOL"

<comment><USER12> Fear and Loathing Considered Harmful?

<comment><USER13> I don't know why "x considered harmful" articles irk me so much, but they do

<comment><USER14> "Considered Harmful" Essays Considered Harmful

[http://meyerweb.com/eric/comment/chech.html](http://meyerweb.com/eric/comment/chech.html)</comment></comment></comment></comment>


A Few Notes On The Culture - by Iain M Banks - <AUTHOR> http://nuwen.net/culture.html

<comment><USER2> I have been re-reading some of my favorite Iain M. Banks novels. It breaks my heart that there will not be any more Culture novels.</comment>


Danny Sullivan's Twitter list about Watertown - <AUTHOR> https://twitter.com/dannysullivan/watertown <comment><USER2> The Reddit/Twitter/Social Media aspect of this entire series of events is truly unprecedented. It's truly amazing to see how the Internet has enabled a constant, real-time stream of information from thousands of sources to be analyzed, commented on, shared, sent in to the FBI and other law enforcement agencies for leads, and etc. Truly something special and never before seen.

<comment><USER3> I wonder how many people who absolutely detest the gap-filling vacuity of 24-hour news channels are glued to tweets and tabs following live comments, Twitter lists, police scanners and the like right now?

I know I'm in that category.

<comment><USER2> Agreed 100%. I watched CNN for 15 minutes and they literally kept looping the same 15-second clip of police running down a street with guns drawn.

On the other hand, you had a thriving community of Reddit/HN/Twitter users, live scanner and BPD radio feeds, you can stream CBS Boston (local station 10x better than CNN) and a variety of other real-time (accurate) information.

This entire ordeal from Monday's incident to the community working together to pinpoint the suspects to today's manhunt at MIT will go down in history as a pivotal moment in the crowdsourced news movement.

<comment><USER3> What makes it so different? Is it the slow pace of 24-hour news? The repetition? That you have to endure talking heads who don't actually add value to the information presented?

<comment><USER4> I think the repetition and the talking heads don't _have_ to be a bad thing, it's just that the news outlets mix their presentation styles.

Business/Sports have already been broken out into their own channels by most outlets, due to different viewer demographics, which is also nice because they have very different presentation styles. News outlets also need to figure out what they're doing on their main channel, or break it up further.

* Are they delivering summaries of today's important events around the world like a nightly news program? If so most viewers will watch for one cycle, and you can deliver them a high quality, well produced report.

* Are they focusing on a 'live' breaking news event? If so maybe they should just be silent and listen to the police scanners, with occasional narration. Every 15 mins you could give an update "this is what we know so far" for people just tuning in.

* Are they doing the whole talking-head thing where experts/politicians are being interviewed and debates are happening? If so you could have 30-60 minutes per topic for today's news.

IMHO, all of these are best suited with different presentation styles... news presenter vs narrator vs debate moderator. Unfortunately they're trying to do all three, which just doesn't work.

</comment></comment></comment></comment></comment><comment><USER5> This one has same + more members (mostly on-scene): <https://twitter.com/meetmarshall10/boston-tweeps>

<comment><USER6> This link from that stream is interesting, [http://news.gather.com/viewArticle.action?articleId=28147498...](http://news.gather.com/viewArticle.action?articleId=281474981864024)

It is an article talking about a kid who went missing a month ago who is thought to be one of the suspects.

<comment><USER7> actually posited on reddit, [http://www.reddit.com/r/boston/comments/1cn9ga/is_missing_st...](http://www.reddit.com/r/boston/comments/1cn9ga/is_missing_student_sunil_tripathi_marathon_bomber/) a day ago - well before his name was released over the police scanners.

<comment><USER8> Your link points to Reddit, which points to a Twitter user, but when that Twitter user is asked how he knows, he says it was on Reddit.

I'm now completely convinced that story is total fucking bullshit.

<comment><USER9> There are current reports that the suspects are Chechyan, not the missing guy. Way too early to know who they are, even for the police.

[http://globalgrind.com/news/411-sunil-tripathi-missing- brown...](http://globalgrind.com/news/411-sunil-tripathi-missing-brown- university-alleged-suspect-boston-marathon-bombings-photos)

</comment></comment></comment></comment></comment><comment><USER10> Great use of lists. News sites curate social media as it happens with their stories. It would be great if individuals on Twitter could do this. Curate tweets around a hashtag.

<comment><USER2> Agreed 100%

Never really used Twitter lists before but this one shows the true capability of having an aggregate list of important information on what is turning out to be chaos in the Watertown area.

</comment></comment><comment><USER3> Is it possible/likely that the marathon bombers were spotted planting bombs on campus at MIT and killed the cop that tried to stop them? If so, his effort and sacrifice may have saved many more casualties.

<comment><USER11> Do you have any reason to think this?

<comment><USER3> Edit: Have now read that the officer (presumably the original, now deceased) was responding to a 7-11 robbery or shot in his car when searching for the robbers.

</comment></comment></comment><comment><USER12> pg, check out this one: <https://twitter.com/AKitz>

friend of mine who had a first hand account of the standoff

<comment><USER13> The Boston police ask that your friend not tweet street addresses.

</comment></comment><comment><USER14> Link doesn't work on iPad.</comment>


Ask HN: Does disrupt mean unnerve established player, so player must buy you? - <AUTHOR> <comment><USER2> There's a weird period during things that appear truly disruptive where the established player may try to buy you. This happens when it becomes clear there's a non-zero chance that the established player may quickly become extinct because of the new player's growth, however it is still not inevitable. Lately, the most prominent examples of this have come with Facebook's successful and failed acquisitions. For example:

Instagram in Apr. 2012: Facebook is about photos, but it wasn't crushing mobile like it is today. Instagram was, but it still wasn't clear whether Instagram's growth would top out or what monetization would look like. Facebook made a $1bn offer that many thought was crazy, but Instagram is now worth (by many estimates) 30-50x that.

ON THE OTHER HAND:

Snapchat ~Nov 2013: Snapchat pioneered an entirely new way to interact with photos on a phone - another existential crisis for Facebook. Facebook offers $3bn in cash. To an extent FAR greater than when Zuck made the offer to Instagram, people were aligned in saying Evan S should take the offer. Snapchat, after all, in many people's minds was about sexting and distasteful things - take the money. Growth would top out eventually, people would get over it. Evan, however, disagreed - Snapchat wasn't mostly used for sexting, it was used for sharing moments. And it was working, and in fact it had become inevitable to him. Zuck went through the same thing getting offers from Yahoo and Microsoft at Facebook, and he was right. Evan, FWIW, I think is also right - Snapchat is going to change the game.

</comment><comment><USER3> Assuming what you are doing is disrupting the industry, the end goal will almost entirely depend on the degree of conviction which the Founder / CEO has in their company and their motivations / aspirations. Of course, the funny thing about motivations and aspirations is that they could appear clear till the time there is an inflection point in the business and results surpass expectations. Knowing you are spearheading and are part of a 'cult-backed' growth can often set back your prior motivations of cashing out on a big payoff from an established player.

Why stop now and if I do, what do I do next? Can I ever replicate this high again?

So an acquisition by an established player or an IPO to further cement your position is ultimately a function of what underlying motivation is driving the leader. Just like everything else, motivation nowadays is often as fluid and agile as the product you are developing.

</comment><comment><USER4> No. Uber is "disrupting" the taxi industry, but has no intention of being bought out.

<comment><AUTHOR> Okay, so it certainly does not 'only' mean that. I am thinking a lot of the insurance industry, e.g, the wifi toothbrush ([http://beamtoothbrush.com/](http://beamtoothbrush.com/)). This is what started my train of thought.

When venture capitalists look at exit strategies, one strong possibility is to threaten to take market share, even unprofitably, from a cash-rich incumbent.

</comment></comment><comment><USER5> That or "blatantly break laws and hope you make money fast enough". Worked for Uber, didn't work so well for Sand Hill.

</comment><comment><USER6> Probably something more along the lines of "big change that will piss some people off", but it's really just a buzzword, you can have it mean whatever you want.

</comment><comment><USER7> Well, not originally.

Disruption isn't always a good thing. Established newspapers getting squeezed out by unreliable and biased sources like blogs isn't a good thing. Both sources of information have their place, but we don't want to live in a world where people can't tell the difference between the _New York Times_ and Breitbart.

At this point, most VC-funded startups are audition projects for product managers who'd rather manage up into investors than corporate executives. If they succeed (get bought on favorable terms) then they skip a couple rungs on the ladder and get to be executives at an earlier age than they'd otherwise get. If they fail, they either get acquired on worse terms (acqui-severance) or they have to suck up to their investors enough to get an EIR gig and repair their reputations.

Established players in tech aren't "unnerved" by startups. They don't fear startups, and they don't fear mediocrity. They know that most startups can't threaten them, and the things that _do_ threaten established players are "unknown unknowns" that no one even thought about. Companies aren't killed by competitors, but by an inability to adapt to new means of doing business (usually because upper management is afraid to compete _internally_ with the existing company and factions).

Besides, most acquisitions in the Valley are cases of favors being paid back. It's not that MegaCorp's CEO says "oh shit, we have to buy IUsedThisToilet before Google buys it"). It's that some VP in MegaCorp owes a venture capitalist a favor and is willing to spend $850 million of his company's money to clear the score. And most people who are involved in purchasing decisions get kickbacks, not of an overt monetary kind (because that would be illegal) but in terms of long-term career support and job placement. Often, the guy who decides to buy a dipshit startup for $2 billion will get, a year later, a VP- level position in a "unicorn" with 5% equity and zero responsibilities. Since the appearance is of an unrelated, merit-based job offer, all parties avoid getting in legal trouble for the kickback.

<comment><AUTHOR> Any examples for the latter?</comment></comment>


Dangers in Cloud Computing - <AUTHOR> http://jscoder.wordpress.com/2009/11/19/dangers-in-cloud-computing/ <comment><USER2> 30 years ago we finally got rid of mainframes, the priesthood, and the control.

The cycle begins again.

When he says 'nobody questions the wisdom' though, I needa point out that Larry Ellison does.</comment>


Ask HN: How to deal with seasonal affective disorder? - <AUTHOR> Every winter for probably the last 10 years or so I've run into a difficult pattern of mood, fatigue and concentration, depression I suppose, around this time of year.
I think this is not so uncommon, so I'd love to hear from anyone on HN who's found particularly effective ways of dealing with this and keeping life on track over the winter. My goal is not to be happy but simply to be stable enough that I can maintain regular productivity.
Here's what I've tried:
1. Light therapy - easy and somewhat effective, but not super effective
2. Vitamin D supplements - no real difference noticed
3. Vigorous aerobic exercise 3-4 times a week - moderately effective, not super effective
4. Meditation every morning - recent habit, seems to be helping but it's too early to say
5. Cutting down sugar - somewhat effective when I  stick to it, often undisciplined
6. Cutting down carbs - same as above
7. SSRIs - haven't used for 5 years, don't think they were really working when I did
8. Skipping breakfast - recent habit, seems to help, too early to tell
9. Psychodynamic therapy - for 2 years, never seemed to help in the moment, but maybe did over the time period
10. Microdosing psilocybin - reasonably helpful but can't do it every day
11. Modafinil - reasonably effective while on it, but it fucks with sleep; ceased use
Here's what I haven't tried that could be helpful:
1. CBT
2. Mediterranean diet
3. Moving to a warm country (not possible right now)
4. Sleeping for longer (> 9 hours)
5. Other antidepressants
6. Keto diet
7. Weightlifting / anaerobic exercise
8. Other supplements
9. Other types of therapy
10. Longer term meditation habit
11. Philosophy / self-reflection
Has anyone tried something from the second list that was particularly helpful? Anyone figured out a way to overcome this (or just depression/cognitive decline in general)? <comment><USER2> I'm not sure if life hacks and self-psych will make any major impacts on SAD. If you feel down it never hurts to get a mental health consult. I'm from Minnesota so here's more or less how I would deal with winter, ymmv. This list is kind of light-hearted so I hope I'm not offending. Winter is my favorite season so maybe this won't connect very well.

Read lots of books and watch shows to stay away from the gray outside.

Stay in office environments during the day to benefit from florescent lighting.

Take up outdoors activities like skiing, broomball, or hockey (I think it develops a positive association with the winter weather). Otherwise curling is indoor so maybe that would help distract from the weather. Adding friends and beer to all of these events makes them more fun of course.

Feel free to eat heavier foods like cheese curds and pasta. They make you feel good and nobody can tell that you gained 10lbs because you have heavy winter clothes anyway.

Take comfort in talking to strangers and coworkers about how bad the weather is.

Look at the ground during the winter so you don't see the ugly, gray skies. The cold windchill usually forces this anyway.

</comment><comment><USER3> You mentioned SSRIs. I'm not usually one that's all that happy about pharmaceuticals, but I started Bupropion today for smoking cessation, and while I was doing research I remember it being mentioned as a potential SAD treatment. It's a norepinephrine-dopamine reuptake inhibitor (NRDI) instead of an SSRI. Might be worth looking into, given the list of things that haven't worked.

[https://www.aafp.org/afp/2017/0101/p10.html](https://www.aafp.org/afp/2017/0101/p10.html)

<comment><AUTHOR> Thanks, I'll look into that

</comment></comment><comment><USER4> Regarding your list of things you haven't tried, you should certainly try 2 or 6 and 7 before bothering with the other potential solutions (if you're able). Your diet and your exercise habits are going to be play the biggest role in your physical and mental well-being. I would not bother with supplements. The general efficacy of supplements is debated and you should be getting all of the nutrients you need from your diet anyway. If you're not able to try diet and exercise changes due to depression symptoms you should consider 9 (and 5 at the doctor's discretion).

Sleep is important but you should only be sleeping for as long as your body needs it. Going to bed earlier can help you find the point at which you're waking up naturally and from there you can decide how much time you need to sleep.

Philosophy and self-reflection are really two very different things. Studying philosophy in my experience hasn't improved my mood. Reading and learning in general might, and you might find that reading about philosophy is a passion you didn't know you had, but you aren't going to pick up a philosophy book and just internalize a worldview that will cure your depression. Self-reflection on the other hand will also not cure your depression, but it may help you identify the deeper triggers in your SAD that you could potentially address. What if your depression is not triggered by the temperature? Your problem would likely not be solved by moving to a warmer country.

</comment><comment><USER5> I think this is a problem for a lot of people in various climates. I'm from central Canada where we experience -50c Januaries and 6 months of snow. Step 1 was moving the fuck out of there, which helped. I've been back, but knowing It's optional is massive.

The problem I've faced for 4 years is the rain on the west coast, and the way I manage that is shifting to a different social mode, combining that with intense exercise, and having something that I find compelling intellectually to do. I'm normally a skateboarder, which is impeded by the rain, but I can still find larking garages or indoor places to do that. Partying with friends is great. Wet hiking is fun. If you're not enjoying your life normally, winter hits hard, so work on making your joy more robust. I'd recommend not bothering with any of the hacks on your list aside from lifestyle changes, because they'll probably prolong your ability to omprove your baseline joy quality.

</comment><comment><USER6> I'm affected to a lesser degree by SAD just noticing the changes but not really affected for another month or so.

Related to the fasting/microbiome advice is active oral hygiene. My main problem with SAD is lack of motivation/energy to care to do anything which can happen in any month but is especially bad during the winter. For non-SAD reasons I've taken my personal war on plaque seriously, brushing three or more times a day with an super-soft brush (Colgate SlimSoft 2-packs on sale) to save gums, mouthwash, etc. What I've found is that I sleep better and it's 5x (subjectively) easier to wake up at the set time and have energy/motivation to start my day. Since this behaviour is new this year I have yet to see how it does through the winter.

<comment><AUTHOR> Wow, I'd never heard of this. Going to look more into this thanks!

</comment></comment><comment><USER7> I moved from Seattle to Austin and I no longer had seasonal affective disorder in the fall and winter.

However, I did get a little depressed in August, because that's when you realize that summer began 4 months ago, and there's still 2.5 months of 100 degree days to go.

Depending on how far north you are and how cloudy, going outside in nature might be beneficial. For me I find that being in a city when it's dark is super depressing, but if I give my body some contextual clues -- the look and smell of autumn leaves, eating autumn food, etc. -- it can help. Then my brain puts the darkness into "circle of life" category a bit more instead of "the light is fading and with it comes death!"

That said, I think that would not work for me in Seattle. It's too dark and too overcast. But has worked for me a bit better in southern New England.

</comment><comment><USER8> Did you do 1-6 at the same time? Consider adding 'time spent outside.' What social things have you tried? People need to have close relationships with other people. Def look into weight training and avoiding processed foods. Avoid or highly limit alcohol and pot (if you partake in either). Assuming you live in a northern territory with hard winters, try a winter in the south (maybe SoCal, Arizona, or Texas).

<comment><AUTHOR> No, I haven't been consistent or disciplined enough with diet stuff or getting out and socialising even when I don't feel like it, so that's the first thing to change this Winter.

I live in the UK, so it would be more like moving to Southern Europe, which I can't really do at least in the next couple of months.

<comment><USER9> The weather has been particularly shite the last 3 weeks or so, hasn't it?

I would suggest booking a trip somewhere warm and sunny, even if it is for Jan or Feb. Having something to look forward to makes things better.

</comment></comment></comment><comment><USER10> I'm not sure what kind of light therapy you did. I would recommend trying a tanning salon. Try to find beds with high UVB (the "bad" kind). This is better fir getting vitamin D. And they are the cheap beds too. You do t need to stay in long enough to get much of a tan. I feel better after a single session. I do 1 or two short sessions a week.

However, I also crave regular light. So me assumption is that visible light serves a purpose also.

<comment><USER11> Just as a matter of safety, UV tanning is a great way to get melanomas. That's why they've been banned (commercially) in Australia.

<comment><USER10> I'm not sure it is worse than getting the same amount of UV from the Sun. But, when I go to a tanning salon, I do see some people who overdue it. I would agree that is bad.

</comment></comment></comment><comment><USER12> Elizer Yudkowksi(sp?)'s wife had SAD they were having problems treating. He talks about it here

[https://www.lesswrong.com/posts/yPLr2tnXbiFXkMWvk/an- equilib...](https://www.lesswrong.com/posts/yPLr2tnXbiFXkMWvk/an-equilibrium- of-no-free-energy)

He says basically they just kept on increasing the amount of light therapy and eventually it cured her SAD.

<comment><AUTHOR> Ah, I have indeed read this - thank you for reminding me. I tried unsuccessfully to do this two years ago. Worth a try in my new accommodation which might be more accommodating.

There is a separate post from his wife here btw - [http://agentyduck.blogspot.com/2014/09/my-experiences- with-s...](http://agentyduck.blogspot.com/2014/09/my-experiences-with-sad- interventions.html)

Potentially helpful to others reading this.

<comment><USER12> Thanks for the link, I hadn't read it from her perspective.

</comment></comment></comment><comment><USER6> What are people's experience with types of indoor lighting?

I know that you can't really get any vitamin D through glass but much prefer any kind of natural light over fluorescent. Other things I do is adjust the color of my monitor to emit less blue light (even during daytime ours) which seems to help. I even use ComfortView (less blue) on my phone 24x7.

</comment><comment><USER13> Get your Vitamin D levels checked? Higher dosage?

<comment><USER14> Agreed. When I did my research on this, I found the recommended amounts are far lower than what is required for someone living near the poles. And dangerous levels are also very very high, so there is no risk in doubling or tripling the amount of the recommended dosage and seeing if it helps.

</comment></comment><comment><USER15> No first-hand experience with SAD, but a few thoughts:

1\. Perhaps the change in season promotes some secondary issue, like more mold growth, and that's the real problem that needs to be addressed.

2\. One of the better tools for self experiments is a journal. Try to track diet, symptoms and anything else that might come into play.

3\. Fasting seems helpful with a variety of issues.

<comment><AUTHOR> Thanks. You're correct, I should learn from Gwern and run these kind of self experiments properly. Will at least do a better job of journalling this year. I did this with microdosing and it was quite helpful.

Have you tried fasting specifically for SAD or otherwise depression?

<comment><USER15> I do not appear to be prone to either SAD or depression.

But my general understanding is that a. Fasting impacts the microbiome and b. The microbiome is increasingly being shown to impact the microbiome.

</comment></comment></comment><comment><USER16> When this kicks in, I get an urge to eat a large amount of high caloric foods including desserts and to sleep for many many hours. If I comply with this, the situation is manageable. When summer and heat returns, I loses interest in food and will automatically drop the extra weight gained during winter.

<comment><AUTHOR> I have this too. Are you saying you feel better when you _do_ eat the high caloric/sweet foods?

<comment><USER16> Yes, much better. I have tried not eating high caloric/sweet foods to be more healthy, but then the winter months just became pure hell. If I eat the food, I'm able to get things done and be functional.

<comment><USER6> The high carbs work for me too but sweet/sugary foods just makes me hungry so fast that I can't concentrate for long before I'm distracted by it.

</comment></comment></comment></comment><comment><USER17> I would advise you to go for a small vacation to place like india and brazil during that time. Sometimes relocating works best, If the seasonal disorder affectz life. This is my one cent.

</comment><comment><USER18> You should pick up one of the many books on this topic if you haven't.

From what I have read, the only thing specifically you can do is light therapy. Buy a light specific for this.

Moving obviously has the biggest impact.

</comment><comment><USER19> Weightlifting, microdosing shrooms.and light therapy.

Never tried them all at the same time, but these three things at different phases in life, were effective, for at least one season.

</comment><comment><USER20> It gets me too. I've found embracing the change with seasonal foods helpful. Buying produce from my local farmers market helps build some excitement and anticipation.

</comment><comment><USER21> Moved to California.

Used to live in Canada (eastern ontario) and this became intolerable.

Living in shitty weather conditions and trying to compensate with artifical means never really worked for me.

<comment><AUTHOR> Did it completely disappear once you moved?

</comment></comment><comment><USER22> exercise went from kind of works to OMG when i hit 30+ miles per week - suddenly running was easy, effortless and amazing natural high

obviously 9 miles per week is better than zero

</comment><comment><USER23> Move to Australia. In most cities SAD is so rare that people aren't even aware that it is a thing.

</comment><comment> d-sc Get some outside time. Pets (dogs, cows, etc) are good for this as they force you to attend to them.

</comment><comment><USER24> Spend every winter in Thailand or some other sunny place. Worked for me for 10 years..

</comment><comment><USER25> You know the real solution is #3.

But at the same time you know there is a price.

</comment><comment><USER26> How about SAM-e?

</comment><comment><USER27> Move?

<comment><USER28> I spend week-long visits at a remote cabin in the Central Cascades. During the winter I have to get outside and get some significant exercise every day. Outside. Exercise. Every day. Or I will go crazy. That's it. Think of the trappers who spent all winter in cabins in the mountains. Outside. Exercise. Every day.</comment></comment>


Will the Saudi Kingdom Collapse Under the Resource Curse? - <AUTHOR> http://www.theamericanconservative.com/articles/will-the-saudi-kingdom-collapse-under-the-resource-curse/ <comment><USER2> MatPat (The Game Theorist) actually cited countries like Saudi Arabia and Venezuela in one of his videos. He said that their complete dependence on one resource and totalitarian governmental structure would cause come collapse in a matter of time.

[https://www.youtube.com/watch?v=ByeyFfOHgQA](https://www.youtube.com/watch?v=ByeyFfOHgQA)</comment>


The Time Has Come to Finally Delete Facebook - <AUTHOR> https://www.pastemagazine.com/articles/2018/11/its-time-for-all-of-us-to-finally-delete-facebook.html <comment><USER2> Facebook prioritizes "connection", but doesn't question whether all of those connections are -good- ones. I know there are a million comments out there about how deleting Facebook led to someone having less anxiety, depression, etc., but I'm also in that camp for a reason that I don't think gets mentioned a lot.

I suffer from PTSD due to childhood abuse and neglect (and I'm talking heavy drug use, physical, verbal, and psychological abuse, gas-lightning). But when my parents, my abusers, added me on Facebook I felt obligated to add them due to pressure from family members and friends who don't get how the abuse affected me, and out of guilt because I had a child and didn't want to deprive them of some relationship with their grandchild. I do know that responsibility lies with me for not ignoring them or speaking up about it. However, leaving Facebook severed that connection again, and I felt slightly more free knowing I wouldn't have to interact with them or let them have a view into my life.

I started using Facebook because I wanted to cure my loneliness and make some friends in college, which did actually happen. At first. Now it's just a platform that reminds me of the past by forcing these "connections", suggesting people who I had long forgotten and never wanted to speak to again.

I say, "Good riddance".

<comment><USER3> Sorry to hear of what you've been through

> _Now it 's just a platform that reminds me of the past by forcing these > "connections"_

It doesn't force those things.

<comment><USER2> Maybe "force" is too strong a word. However, it strongly pushes them by generating lists of people you may know even if you haven't talked to them in over a decade. It also makes it easier for someone to just click "Friend this person" rather than having to find someone's number and pick up the phone.

Guilt is a strong motivator, as least for me, so granting someone that access makes it a lot more difficult to set appropriate boundaries.

<comment><USER3> It's up to you to accept a friend suggestion or request. And the UI makes it easy to delete any friend request. If there's pressure it comes from outside FB itself.

<comment><USER4> _> If there's pressure it comes from outside FB itself_

When I was a kid, long before Facebook, my mom would frequently receive an anonymous chain letter in the mail.

The letter would have some dramatic emotional appeal, or it would claim to be raising money for a poor family in the church, or it would promise pyramid riches, or it might have some mystical mumbo jumbo warning about breaking the chain.

But in the end, the stories about heartbreak or helping people or mysterious calamities were complete horseshit. Their only purpose was to convince my mom to copy the letter and send it to 12 other people, thus expanding the base of the pyramid for the benefit of whoever started the chain letter.

Facebook is the modern chain letter.

Just like chain letters, Facebook has lots of horseshit stories about connecting people, with implied mysterious social consequences for not participating.

But underneath all that, the real purpose of Facebook is to amplify social pressure to get people to expand the base of the pyramid for Facebook's benefit.

</comment></comment></comment></comment></comment><comment><USER5> Going cold turkey is never easy. If you're having trouble withdrawing, consider what I did over the past few years:

1\. Turn off notifications for the Facebook app on your phone; _next_

2\. Turn off notifications for the Facebook Messenger, Instagram, _et cetera_ apps on your phone; _then_

3\. Delete the Facebook app from your phone; _then_

4\. Delete the Facebook Messenger, Instagram, _et cetera_ apps from your phone; _and finally_

5\. Log out of Facebook on your desktop.

It took me 2 years to go through from step 1 to step 5. It has made me happier and more productive. I still have a Facebook account. But the friction of grabbing my laptop and logging in forces me to consider "is this what I want to do? Or am I thoughtlessly reaching for the crack pipe?"

(It's been months since I've cared to log into Facebook. Feels more like trudging through spam in an old e-mail inbox, now, than anything compelling.)

<comment><USER6> The biggest issue for me is Messenger. There's a few people I only communicate with on it, and I'd hate to lose that, even though it's not frequent communication. Otherwise, I've had mine deactivated (so I could keep messenger) for going on a month now, and don't miss it apart from some updates for groups I'm in.

<comment><USER5> > _The biggest issue for me is Messenger_

It was for me, too. That said, if you simply ignore Facebook Messages and periodically drop in with "didn't see this until just now; shoot me an e-mail or text next time," everything you want to see eventually makes it over.

</comment></comment></comment><comment><USER7> one of the most difficult things to relay about why facebook is a danger (probably more so in years gone then now) is they can not visualize the effects (both in the real world and mentally) . This was probably how drugs where viewed back in the 70s it was all seen as fun and games and mostly harmless.

If you say to someone dont speed, drink and drive as it may cause you to get into a car accident its clear to see the devastating impact speeding and drink driving can have, people can imagine it, they can see it and dont want to be involved in it, but when you tell friends and family facebook has the potential to brainwash, manipulate and control you its hard for people to understand how because it is related to understanding how data can predict and be used understand behavior, its a very new concept for many people just being understood in the last few years.

To the majority of users they control facebook, its not the other way around, they can delete images, comment on things, vote on things and and do what they need to on the platform from the saftey of their own home, to majority of people it gives them a voice when before no one cared about what they had to say, but as the ads that they are shown seep into their thoughts without them knowing, the articles and propaganda about the latest political events change their behavior and their emotions and mental well being are affected as they see their friends lives supposedly much better then theirs, they just get more and more sucked in.

As someone with a comp sci major from 15 years ago and understanding the power of data i have been having this conversation with people for years and even now with so much of these facebook powered problems occurring more and more in the media, many still dont see the effects, though at least now , the dangers are hitting the bigger more general audience. At least there is progress there and hopefully this will allow the public to make a more informed decision before they put up their whole lives and the lives of their kids on social media before their kids are even old enough to approve or accept that they want a social media account.

<comment><USER8> Good comments. Many people seem to believe that Facebook can behaviorally manipulate other people, but not them. They are wrong.

</comment></comment><comment><USER9> Facebook is not going away, not soon, at least. Not until a fit replacement shows up.

I look at people around me, they love how easy it is to create a new facebook "group" just to get people together working on something (event, workgroup, plain discussion around a topic). Nothing matches this so far.

Nobody wants mailing lists (I do!), or newsgroups, or going to 2 or 3 other website (more registrations needed) to be able to do the same facebook does so simple.

Unfortunately.

PS - extra tip: take advantage of the containers in the new firefox, and make sure you isolate your facebook usage in one, at least it wont track you around the web

<comment><USER10> just create group chat in your favorite messenger

</comment></comment><comment><USER11> The time to 'delete facebook' has been here for several years. A more accurate title would be 'person finally notices the writing on the wall'.

</comment><comment><USER12> Well, I'm certainly ahead of the times, then. I deleted years ago. Was barely even on the platform. I don't get why it addicts so many people, it feels like the worst way to communicate with friends; I've got group chats across several apps and those are infinitely better even if limited. My only real regret is the "several apps" part.

So if Facebook doesn't care, why do people think Twitter cares? Or any social media?

I early on naively hoped Google+ would "save" social media... But honestly, even though I was a huge proponent in it's first year or so, it became clear the problem was really with the concept itself and not the platforms. I don't believe in global social networks anymore. I believe in a very loosely tied network of tiny to small communities for interests, groups of friends, etc. And I realise some social media platforms have tried to implement groups, but to me it never even really came close to offering what we already had with the web of online forums and IRC channels. To me, having a single global network where each person has their own group of friends is both too limiting and too wide open.

<comment><USER13> The benefit from Facebook that isn't really offered by anything other than Google+ is the "Christmas Card" news - you find out when your old friends and distant relatives have important things happening in their lives, like moving, getting married, having kids, etc. Also people like to live vicariously through their friends, which they can do through photos of their lives, especially kids and trips.

<comment><USER12> Yeah, I see how different kinds of people may genuinely benefit from Facebook. Maybe it is a personality thing, but I can't relate.

</comment></comment></comment><comment><USER14> I never had Facebook but still got my friends, family and places to go to.

As an outsider I find the fuzz around Facebook amazing.

So what Facebook does only care about money. Are they supposed not to?

If you don't like Facebook just leave and don't be so dramatic about it.

<comment><USER15> Facebook still tracks non users in photos. There are some benefits to getting especially you close friends and family to quit.

<comment><USER16> What are your thought on resolution advancements in satellite imaging?

</comment></comment></comment><comment><USER17> All the rewards and none of the responsibility. It's the Silicon Valley way.

<comment><USER18> Repackage business models that exist in developing nations as a result of extreme income disparity or poverty and call it the new gig/sharing economy. Make sure the app captures as much data from the user's phone as possible; it's worth something.

<comment><USER19> Could you elaborate on the business model repackaging? Did these models really come from developing nations?

Edit: typo

</comment></comment></comment><comment><USER20> This is really stuck up and unrealistic. People need connection and Facebook provides that. Provide an alternative or suck it up. Positive and negative causes both feed off of what Facebook has to offer. Being high and mighty isn't going to be enough to fix what is wrong here.

</comment><comment><USER21> Facebook will delete itself.

[https://trends.google.com/trends/explore?date=today%205-y&q=...](https://trends.google.com/trends/explore?date=today%205-y&q=%2Fm%2F02y1vz)

Facebook interest has been steadily trending down for years.

<comment><USER22> That's not the way the Facebook user base and revenue has moved. But of course, why would anyone already on Facebook search for it?

</comment></comment><comment><USER23> have done.</comment>


Ask HN: Recommend book on reverse engineering / static analysis - non-entity It's something I'm planning to do soon, and I'm curious if anyone knew any recommended reading material. I've seen a lot of books on Amazon, but many are specifically in the context of analyzing malware whereas I'm more interested in analyzing general binary code (my first project will be attempting to analyze an old dos driver) <comment><AUTHOR> Practical reverse engineering by Bruce Dang

</comment><comment><USER2> good luck on your journey im beginning this soon too.</comment>


What is your dream development PC? - <AUTHOR> http://successfulsoftware.net/2010/12/14/speccing-my-dream-development-pc/

<comment><USER2> At this point my dream development PC is anything that doesn't have the company mandated McAfee virus scanner and LANDesk spyware/inventory management software. Although it would be nice to have the fastest harddrives, quickest processors, and most capacious memory, there are other things that prevent it from being useful. It's a shame that my relatively new "workstation-class" computer at work with 8 cores and 12GB RAM feels more sluggish than my three year old dual core PC at home.

</comment><comment><USER3> I feel like an Apple (be it a Mac Pro or MBP) is sort of a given in terms of "spare no cost development machine" as it's the only option you have to ensure your "dream development machine" will support the platform you want to develop for during the rest of it's life.</comment>


The cost of dynamic vs. static dispatch in C++ (2013) - <AUTHOR> http://eli.thegreenplace.net/2013/12/05/the-cost-of-dynamic-virtual-calls-vs-static-crtp-dispatch-in-c

<comment><USER2> As the article demonstrates, in anything other than trivial microbenchmarks it's the inability to inline across a virtual call that will cost you. Inlining is the single most fundamental optimization for a modern C++ compiler. It enables the 0-cost abstractions for which C++ is rightly famous.

<comment><USER3> Why shouldn't it be possible to inline virtual calls? The CLR folks were complaining about this, too. But it seems rather straightforward to figure out the actual implementation that's commonly called and inline it, perhaps with a guard for uncommon cases. And I wouldn't be surprised if many apps end up with only a single actual implementation, so the entire virtual overhead can just be dropped.

<comment><USER4> Because c++'s type system doesn't make it possible to determine the actual implementation in most cases. Concepts would allow rust-style monomorphization, but they aren't part if the standard yet.

<comment><USER5> None of this matters if you create the "flexible joints" in the right places, where you get the benefit of dispatch, without making hundreds of millions of calls per second to it.

</comment></comment></comment></comment><comment><USER6> In 2015 clang & gcc have a more or less working devirtualization feature that eliminates the virtual overhead in a simple benchmark such as this. The compiler sees all classes and knows that a particular interface is implemented by only one class, so it simply elides the virtual table lookup. Add that features such as speculative devirtualization that can remove a surprisingly large number of virtual calls in an established code base such as Firefox: [http://gcc.gnu.org/ml/gcc- patches/2013-09/msg00007.html](http://gcc.gnu.org/ml/gcc- patches/2013-09/msg00007.html)

If C++ will exist in 10 years from now, I predict 'virtual' to be just yet another legacy keyword.

<comment><USER7> >If C++ will exist in 10 years from now, I predict 'virtual' to be just yet another legacy keyword.

I really doubt that. Not so much because of the virtual call overhead, but because there's plenty of cases where you really want control over how your class objects and structs look in memory. Adding a vtable entry to every struct is something you really don't want in many cases.

<comment><USER8> Also from semantic point of view expressing which methods you are expecting to be overwritten in quite handy.

</comment></comment></comment><comment><USER9> If you just want the number: dynamic is 6x slower.

<comment><USER10> Not a good summary.

1\. If the static method is trivial enough, the compiler can inline it removing the need for a function call. In that case, a virtual function call for a single increment op is 6 times slower.

2\. If you disable inlining for the static method, curiously it is 1.5 times slower than the virtual function call.

3\. Newer compilers have devirtualize that the OP could not test but should be able to give much better than the 6x degradation.

</comment></comment><comment><USER11> If you can use templates, the decision of which function to call can be done at compile time and you don't need virtual calls. Virtual calls are useful when the decision must be done at runtime.

<comment><USER12> Article just seems like "I misused some feature X and it was slower than something else."

<comment><USER13> no it's not. it's more like, the most common dispatch pattern used in C++ (and most other OO languages) as a factor of 7x performance penalty over the less widely embraced alternative. The popularity of the former methods is partly due to the ignorance of programmers to its performance implications. I have seen huge code bases that had to be retired because of their over reliance on OO, and dynamic dispatch.

<comment><USER5> > _I have seen huge code bases that had to be retired because of their over > reliance on OO, and dynamic dispatch._

What were they replaced with?

</comment></comment></comment></comment><comment><USER14> Why is the author referencing the Itanium C++ ABI? Isn't IA-64 an obsolete architecture that nobody uses? And then he gives examples with x86_64 and mentions his "i7-4771 CPU". Confusing.

<comment><USER15> The C++ ABI that everyone (well, OK, the open source compiler toolchain ecosystem) uses nowadays on popular architectures was created for the Itanium [1], and so it bears its name. Itanium ended up having an impact in a weird, roundabout way :)

[1]: [https://mentorembedded.github.io/cxx- abi/abi.html](https://mentorembedded.github.io/cxx-abi/abi.html)

<comment><USER14> Learn something every day, I guess!

I remember early linux used to have lots of trouble running binaries across upgrades, because the C++ ABI kept changing and changing. Is that related?

</comment></comment></comment><comment><USER16> How is this an apples to apples comparison? Instantiating CRTPInterface with Implementation is no different than just calling DynamicImplementation::tick() directly, so why not benchmark that?

<comment><USER17> The entire point of the benchmark is virtual calls vs templated static calls. Everything else is what should be controlled.

<comment><USER5> If everything else can be controlled, then virtual calls are being used unnecessarily. The fact that an indirect calling mechanism which has to first use indirection to retrieve the address to be called (and possibly do more work, like fixing up a pointer) is slower than a static call is completely unsurprising.

If virtual calls are used essentially, then it's a canoe-versus-bicycle comparison, because everything else cannot be controlled. The program based on static calls has to be written quite differently to solve the same problem, and the benchmark then measures the entire approach. Plus the benchmark doesn't account for benefits that it doesn't measure, like maintainability and extensibility of the code.

<comment><USER17> Regardless, it's still useful to actually _test_ the performance of virtual vs static calls- how much slower are they? in which situations can the compiler devirtualize them?

Or should we only ever benchmark the entire software stack at once, even though people do in fact sometimes use CRTP and virtual functions in the same situations?

<comment><USER16> My beef with this article is that it misleads you believe that need CRTP is the only way to eliminate vtable lookups on interface calls. It left me wondering how CRTP compared to invoking DynamicImplementation::tick() directly. The article is actually quite great otherwise.</comment></comment></comment></comment></comment>