How to encrypt Google Docs and Google Drive - <AUTHOR> http://www.syncdocs.com/how-to-set-up-google-drive-encryption/

<comment><USER2> How do we know that the government has not cracked AES?

The NSA employs the best mathematicians in the world, and half the PhD output in math from our best colleges end up working there.

</comment><comment><USER3> Be careful - using crypto at all makes you a suspect now.

See Ars Technica: Use of Tor and e-mail crypto could increases chances that NSA keeps your data [http://arstechnica.com/tech-policy/2013/06/use-of-tor- and-e-...](http://arstechnica.com/tech-policy/2013/06/use-of-tor-and-e-mail- crypto-could-increase-chances-that-nsa-keeps-your-data/)

<comment><USER4> All the more reason for everyone to use it for everyday, non-illegitimate purposes.</comment></comment>


Exactly How Powerful Are Tweets & Retweets?  - <AUTHOR> http://www.seomoz.org/blog/exactly-how-powerful-are-tweets-retweets

<comment><AUTHOR> I invite you to help out SEOmoz with this experiment about the potential strength of (re)tweets as a ranking factor in Google. Click on the post link and send the tweet, thanks</comment>


Google rolls out algorithm change in the US - <AUTHOR> http://googleblog.blogspot.com/2011/02/finding-more-high-quality-sites-in.html

<comment><USER3> > sites that copy others' content

It would be interesting to know how Google determines, in an automated perspective, which site is the original and which is the copy - <USER2> when copying could go both ways. For example, I could write an article, license it under the GFDL, and someone could copy it to Wikipedia. I might then copy the Wikipedia improvements back to my site. Technically, I had the content first - so would Wikipedia be penalised?

If there is a bias against smaller sites, this might make smaller sites be reluctant to license their content under licenses that let bigger sites copy them.

<comment><USER4> This is a huge problem with Wikia. Wikia has a relatively high pagerank. Sometimes, because of Wikia's often-abusive policies, communities will decide to move their wiki off Wikia and host it separately.

But Wikia will refuse to remove the original wiki even if all the contributors want to move it, in order to maximize advertising revenue. This means that it's nearly impossible to get the new wiki to rank highly on Google, even if all links across the internet are changed to point to the new wiki, because Wikia's pagerank is so high that Google deems the new one to be a "copy". _This is why Wikia moved all their wikis to subdomains: in order to piggyback on the pagerank of the main site._

As a result there are a ton of long-dead wikis on Wikia that still get more search traffic than the active equivalent. Obviously this hurts users, since they get long-outdated information as a result.

In short, once a wiki is placed on Wikia, it's basically impossible to ever move it anywhere else because of Google's anti-duplicate biasing.

See <http://en.wikipedia.org/wiki/Wikia#Controversy> for more info.

<comment><USER5> I assume you're saying that the Wikia admins will prevent the community from deleting or overwriting content with a pointer redirecting to the new place? This does seem extremely likely if there's significant search engine traffic and ad revenue.

<comment><USER4> Yes. Now imagine if you had a blog on Blogspot and you wanted to host it on your own site instead -- and Blogspot prevented you from deleting your posts because they brought Blogspot good ad revenue?

</comment></comment></comment></comment><comment><USER6> When Pagerank was created, it worked really well to find the most relevant sites. The old search engines such as AltaVista and Excite were drowning in spam since the SEO experts had figured them out.

Does anybody else feel that Google has been figured out now, and that they are now just applying patches to a system that is fundamentally broken (in the same way Excite and AV did)?

There might be an opportunity here for a new search engine - one that creates a new core method of ranking, as PageRank was, to filter out duplicate content, content farms, malware sites, etc.

"Relevance = links" today looks as tired as "relevance = keyword density" did 10 years ago, but I have no idea what the new "relevance = " is

<comment><USER7> The "fundamentally new" system for defining relevance is the social graph. It's why Facebook and Twitter are so hot.

<comment><USER8> That's partly true, but given the way that the social graph is used today, I don't think it can satisfy the entire need.

The social graph is essentially a personal thing, not professional. Assuming that we see a need to partition our professional and personal lives (and that should be true, in order to protect both sides), then the professional side isn't going to be reflected well in the personal graph.

So long as our networking tools don't recognize this split, they are going to be (relatively) starved for content that is strongly oriented towards the professional world. For example, I wouldn't expect my wife to be able to find deep information about Medicare reimbursement if we relied on mining social sites.

<comment><USER9> For a lot of professional needs, the most valuable information is hidden in the deep web. For example, many MIS/DSS/ERP/CRM/TLA systems don't provide a lot of public information about how their systems work, so if you are trying to evaluate the market place, it would probably take you 3-6 months of research.

For example, I work at a healthcare services start-up, and we have one person full-time researching our competitors and figuring out how to differentiate us in the marketplace, as well as figure out what keywords someone might search for to find this kind of product. We're mainly mathematicians and smart programmers who found a way to break into the market initially, not marketers, so our terminology doesn't match domain experts well.

Anecdotally, I think most users are VERY bad at ranking how valuable information is. For example, we'll get paid $100,000/year for something that takes 1 week and provides zero insight into their business, and then they will refuse to pay us at all for something that makes them $30,000,000 a year! This is so common that I am wondering if its more a symptom of human nature than our customers.

<comment><USER10> I am really curious what makes them $30,000,000 a year? Are they getting it for free, or are they loosing out on the income?

<comment><USER9> Fixing their billing procedures and optimizing their price list for services. This is pretty tricky stuff and easy to get wrong, because there are many factors that influence how hospitals get paid, such as stoploss rules, carve outs, worker's compensation groupers, various mother-baby rules, etc.

Often times hospitals receive $0 for something they should be getting $10 million per year for, just because nobody ever contests the NOPAY response. Finding that sort of error isn't easy.

</comment></comment></comment></comment></comment></comment><comment><USER11> Brilliant use of crowd-sourcing to gather a test set via the chrome plug-in. Makes absolute sense, otherwise you can overfit. Great turn-around time also.

<comment><USER12> From the article:

> It's worth noting that this update does not rely on the feedback we've > received from the Personal Blocklist Chrome extension

<comment><USER13> The _implementation_ of the algorithm didn't rely on it, but they did _test_ it using that data.

>However, we did compare the Blocklist data we gathered with the sites identified by our algorithm, and we were very pleased that the preferences our users expressed by using the extension are well represented. If you take the top several dozen or so most-blocked domains from the Chrome extension, then this algorithmic change addresses 84% of them, which is strong independent confirmation of the user benefits.

</comment></comment></comment><comment><USER14> I know this is not a popular opinion here, but I'm not sure if I like Google reacting to what tech bloggers echo chamber talks about. Are we sure that this what is good for regular users and for the creation of quality content on the Internet? This group is not representative at all.

There seems to be enough "normal" spam in the search results that Google should be focusing on first. Just yesterday I searched for "viking dishwasher clog" and the #6 result is a .info page that is nothing but obvious spam.

I previously mentioned the issue of Wikipedia poorly regurgitating content from original creators (sometimes with attributing, sometimes without) and outranking that original page, even if it contained approachable, illustrated and in-depth article, and Wikipedia's content was much weaker. This is not something that tech bloggers will notice - they are much more likely to read Wikipedia's programming, science, math, or tech articles, which are of much higher quality than those on other topics, so you won't hear them complaining when they see Wikipedia as #1 everywhere.

Another bias I starting seeing lately is the high ranking of new Q&A sites (another focus of tech bloggers), when excellent topical forums with very good content, often exactly with the answers I needed, are ranking poorly. I'm speculating here, but I think Google's focus on links might hurt its ability to bring up deeply hidden content from forums. These forums won't get many links from tech bloggers and others looking for the next big thing, but they have very valuable content for many long-tail searches.

</comment><comment><USER15> Is the change live yet?

I remember an example provided here was "nstoolbar bottom bar". Let's take a look: <http://www.google.com/search?q=nstoolbar+bottom+bar>

Granted, it was probably linked from HN somwhere which will have made matters worse.

<comment><USER16> Yes, the change is live (rolling out slowly through the day). A ton of large sites have already been affected. It's a pretty big change.

</comment></comment><comment><USER17> Not to nitpick, but...

        If you take the top several dozen or so most-blocked domains from the Chrome
        extension, then this algorithmic change addresses 84% of them, which is
        strong independent confirmation of the user benefits.

Well, what if they are mistakenly penalizing Common Jack's blog because it gets re-posted across the interwebs? I bet no one is manually blocking Common Jack's blog, so that factor is lost.

Example: let's say Google just randomly penalizes 84% of ALL domains. Chances are that they intersect with, you guessed it, 84% of the Chrome extension's data. Independent confirmation!

<comment><USER18> The problem for Google is that any non-algorithmic approach (using a feedback mechanism) will just be abused by the SEO industry - they'll just crank up mechanical turk to start reporting anyone ranking above their clients.

<comment><USER17> I'm not advocating that, I'm just saying that the "independent confirmation" tells us little about the innocent sites that get negatively affected. They are, by definition, excluded.

</comment></comment></comment><comment><USER19> I really hope it will change for the better, but I don't trust Google anymore:

Small example: When you search "VLC" on google on find scams websites shipping VLC with a toolbar/crapware/malware, buying or not adwords...

Google plainly refuses to remove those websites, because they gives Google some money. So they make money from scammers, know it clearly and do not want to do anything...

And as we are a very small team of volunteers, it is impossible to attack those websites...

NB: this happens with other software too.

<comment><USER20> Strangely enough, your primary example always directed me to videolan in the past, and continues to do so.

I very much prefer DDG these days, but those statements are just not true. And I do not believe that Google would purposefully provide _much_ _worse_ results for US customers, relative to EU ones.

<comment><USER19> The english ones are the only fine, because the websites are in english...

Try .fr, .it, .es and you'll see...

And on .us, just deactivate your adblock.

</comment></comment></comment><comment><USER21> Google works hard (or maybe less) to keep their front page UI ultra clean. I do think users could benefit a lot from a small drop down arrow under the search field that stretches open another field to input the words searchers do not want included in their results. Most of us in the Hacker News community know this can more easily accomplished by including a "-" (minus sign) before such terms; we know how to use "-" and "site:..." to narrow query results. However, I'd say 50% of Google users don't know these tricks and waste time navigating to the advanced search link.

<comment><USER22> There is an advanced search link next to the Google search bar that provides the functionality you described for non-power users.

<comment><USER21> I mentioned that in the last line. I just feel it's not efficient for those who want to leave out certain terms... being that "-" is the most common query alteration (or maybe second after "+".

</comment></comment></comment><comment><USER23> For me, it's too little too late. I know a lot of people who have already moved to different search engines. Google lost a ton of money in the process. They didn't help themselves any when it was revealed JC Penny had successfully gamed Google for almost an entire year - and Google had no idea until the NY Times broke the story.

<comment><USER24> You may well know a lot, but I bet 100% of them are serious tech interest people which accounts for a tiny tiny % of the internet. You could argue that tech people drive the trends that spread out to the masses but in this case I think it's just bashing the big guy cos he's an easy target.

The idea that most people really care about the purity of their search results, let alone would understand what all this means even if the BBC or NYT ran a proper article is just unrealistic.

</comment></comment><comment><USER25> Is there any reason to change the algorithm, initially, only in the US?

</comment><comment><USER26> How will this impact sites like Rotten Tomatoes?

They have little original content, but are still a useful source.

</comment><comment><USER27> It looks like I have got higher up the ranks for some of my keywords, so the change must be good ;)

</comment><comment><USER28> It'll be as interesting to see how this affects Bing rankings.

<comment><USER29> It should affect them automatically. We know Bing uses Googles search -> page results coming from the Bing toolbar. If a site's ranking is reduced by Google, the same should happen (maybe to a much smaller extent) in Bing since that feature is now smaller.

<comment><USER30> It doesn't have to and I believe you are mistaken/oversimplifying.

As far as I understood the whole Bing ordeal was that users with the Bing toolbar reported not the links and ranking shown, but what the users chose as the "correct" hit for that search.

In that regard this doesn't really have to alter Bing's results in any way at all.</comment></comment></comment>


Machinery – A command-line tool to operate on a cluster of Docker Machine VMs - <AUTHOR> https://github.com/efrecon/machinery

<comment><USER2> "machinery is written in Tcl" ???!

</comment><comment><AUTHOR> The descriptive title line I submitted was changed. How'd that happen?

<comment><USER3> HN allows moderators to change the titles in an ad-hoc fashion.</comment></comment>


I've been impacted by Twitter's layoffs. This is how I found out this morning - <AUTHOR> https://twitter.com/bartt/status/653946266938818561/photo/1 <comment><USER2> One would expect minimum decency by such a big company before letting the world know about the layoffs. Such a sad state of affairs at TWTR. No wonder it has always been downhill even though they command the micro-blogging market segment.

<comment><USER3> How would you do that? How can you prevent anyone from knowing you layoff 300 person until you contacted all 300 persons?

They tried to contact him and failed. Should they wait until they reach him before contacting all other employees? What if he was number 100 on the call list? Do they tell the 99 others to please not say anything for a few days and ask for a media embargo because they couldn't contact Joe?

What if he was on vacation? Should they wait until 100% of employees are not sick/away/in vacation and postpone the announcement a few weeks? (Weeks? I'm being generous here).

</comment></comment><comment><USER4> In a time like this is when they should show how much they care by being a bit personal about the lay off. That was insensitive.

</comment><comment><USER5> He had a Work From Home deal. He admitted later that they tried to call him and it was sent to voicemail.

</comment><comment><USER6> Post your resume on the next HN who's hiring thread. First of the month

<comment><USER7> Or visit the existing thread[0], many of those ads will still be relevant.

I posted two (Pivotal Labs[1] & Pivotal Cloud Foundry[2]), both of which are relevant, both of which would be good fits for many Twitter folk who are getting RIF'd or who just want to roll off.

[0] [https://news.ycombinator.com/item?id=10311580](https://news.ycombinator.com/item?id=10311580)

[1] [https://news.ycombinator.com/item?id=10311637](https://news.ycombinator.com/item?id=10311637)

[2] [https://news.ycombinator.com/item?id=10311634](https://news.ycombinator.com/item?id=10311634)

</comment></comment><comment><USER8> wow, thats pretty cold.</comment>


A powerful new way to edit DNA - <AUTHOR> http://www.nytimes.com/2014/03/04/health/a-powerful-new-way-to-edit-dna.html <comment><USER2> This is somewhat old news in the field, but it's nice to see some mainstream coverage of science. I'm glad that they mentioned to off target effects. I think that editing with Crisprs is supposed to be somewhat noisy, so any uses outside of the lab (eg clinical) will probably be limited. But, I haven't worked with them, so who knows where this will be in 5 years.

<comment><USER3> > Crisprs is supposed to be somewhat noisy

Since you seem knowledgeable: Do you know how they compare to other kinds of methods for cutting/splicing new genes into DNA, such as Zinc fingers or homing endonucleases? Specificity (non-noisy) seems like it would be _the_ most important feature of something like this. Although I guess we don't really know, I could imagine "noise" turning into other horrible diseases, loss of viability, etc.

Edit: And now I notice that they discuss this further down in the article. Nevermind.

</comment></comment><comment><USER4> It is interesting how profession changes perception of the language. I work as a software engineer and "modify DNA" sounds as a more natural description of the process to me. I am speaking in context of taking existing DNA and using a technique to identify specific locations in order to change them. In other words there is no "redo" if you get something wrong. In news world editing is much more natural and encompassing term.

<comment><USER5> I think "edit" is appropriate, since you aren't just randomly modifying the DNA, but modifying the DNA at a specific location in order to introduce a specific modification. Furthermore, in biology we usually use "modify" to mean more exotic changes, such as adding specific chemical groups to the DNA (e.g. methylation) that change how cells interpret the sequence.

<comment><USER6> Software engineers often use the word "update" for operations of that kind on databases, as part of the so called "crud" operations (Create Read Update Delete), which represent the fundamental operations one could apply. I agree with you that "edit" sounds good (and "cred" perhaps better than "crud"), though it sounds a bit more like an ongoing action rather than an atomic operation to me (personal bias I suppose).

</comment></comment></comment><comment><USER7> Reminds me of: "The original virus rips, or "unglues" \- as the name suggests - DNA strands. The strand attempts to repair itself, but its proteins are scrambled in the attempt." — [http://ansible.wikia.com/wiki/Descolada](http://ansible.wikia.com/wiki/Descolada)

</comment><comment><USER8> "The development of the new tool is an example of the unanticipated benefits of basic research."

</comment><comment><USER9> Worth noting that the initial discovery - identifying the common sequence motif - is a purely computational problem.

</comment><comment><USER10> > edit DNA

Isn't there an emacs mode for this yet? I guess Stallman is really slacking these days...

</comment><comment><USER11> tl;dr: like restriction enzymes, but easily retargetable because they recognise sites using RNA.

</comment><comment><USER12> Is that site legit?

</comment><comment><USER13> THIS.</comment>


Libtask: A Coroutine Library for C and Unix - <AUTHOR> https://swtch.com/libtask/ <comment><AUTHOR> This is hardly new, but it came up in conversation recently off-site and I realized that I've hardly ever seen it used in practice. Figured I'd post it and put it fresh in people's minds again.</comment>


Our Math Deficit Doesn't Add Up - <AUTHOR> http://www.motherjones.com/kevin-drum/2013/04/our-math-deficit-doesnt-add

<comment><USER2> Bingo. This has been a general trend across all measures; as productivity and technology have made things more efficient and profitable, corporations and their government patsies have had no interest other than lining executive and investor pockets. No lowering of prices, no increasing wages, no improvement of quality of living, no improvement of benefits, no public-good spending, etc. It has all been pure exploitative, carpetbagger type of pilfering of rigged sham markets; pump, dump, and support the fraudulent the price.

Anyone who thinks the American market is a free trade market is abjectly delusional; it's a market of dominant cartels who make mediocre efforts at appearing to provide choice and act competitive just like our inept and antiquated political parties and structure. Collusion has all but removed real choice in all of our markets.

</comment><comment><USER3> There are other possible reasons for the perceived math deficit. Factories like General Plastics may be seeing lower scores from job applicants because:

1) Racism 20 years ago may have prevented minorities from applying for jobs at these factories. Now, policies, attitudes, and the workplace environment may encourage more african americans or hispanics to apply for these jobs. The full NEAP reports make it clear that there is still a significant math performance gap between the overall population and whites. A broader pool of applicants, reflecting less racism today, will result in lower math performance. (This performance gap although significant is narrowing.)

2) Sexism 20 years ago could have precluded many women from applying for factory jobs. Now with more women applying, the performance gap in math between women and men may affect the average results seen on General Plastics tests. (Unfortunately, this performance gap hasn't narrowed over time.)

3) Improved opportunities for students from lower income families to go to college (because of student loan programs) may be causing the lower test scores at General Plastics. There is a significant performance gap in math and reading associated with family income, so it is more likely that students from lower income families apply for factory jobs rather than go to college today. Twenty years ago even the better performing students from low income families might not have been able to go to college because of the expense. Now, the better students from this pool will go to college (supported by student loans, etc.) changing the population that will be applying for factory jobs.

I'm not sure if any of these possibilities is true, but they are alternative hypotheses not considered by the article. Notice that each of these possibilites don't imply that things are getting worse, but that things are getting better (over a multi-decade time period--less racism, sexism, more opportunities).

</comment><comment><USER4> "Scaled Score" vs. "Raw Score"

Learn. The. Fucking. Difference.

This article shows a graph of the _scaled_ scores on the NAEP Math test. The _scaled_ scores remained flat. He then uses that fact to show that students are about as good at math now as they were 35 years ago.

There's just no fucking connection.

It's true that the scaled scores have remained the same, but all that shows is that the group of people taking the test now is about as diversely-skilled in mathematics as they were in 1978. For all we know, the raw scores could have plummeted 50%.

The only thing we can conclude from this graph is that the test _itself_ is just about as good at ranking students as it was 30 years ago, and, maybe, that student math-skill-diversity has remained constant. The "bell curve" is the same shape as it was yesterday. But that doesn't mean it hasn't been bitch-slapped to the left. To the left.

The only thing we can conclude from this article is that the author doesn't know shit about statistics. We can't conclude anything about General Plastics, or any other military commander.

SOURCE: Psychometrics is my bitch.

TL;DR - Kids might suck more at math than before, or not; the relevant data isn't in this article.

</comment><comment><USER5> The argument against explanation 3 (roughly, "NCLB created incentives for schools to teach kids to be good at math tests and not good at real-world problem solving") is that no one teaches to the NAEP, and that the NAEP has stayed mostly constant in its material coverage since '78.

This would be sound if the NAEP tested real-world problem solving. However, judging by their sample question booklets ( <http://nces.ed.gov/nationsreportcard/about/booklets.asp> ), the NAEP consists of the sorts of questions one would assign for homework in a high school algebra or geometry class: e.g., "train" problems, proofs of properties of triangles, and so on -- not exactly things I would call "real-world problem solving."

My own personal experience as an undergraduate math instructor hints very strongly to me that #3 is the most significant issue.</comment>


Show HN: Gitdude - code tips as a comments on your GitHub commits - <AUTHOR> https://gitdude.com <comment><AUTHOR> Creator here. It is basically running ESLint with your custom configuration and posting the result as a Github comment whenever you commit code to the repository. The source code is also available on Github[1].

Questions and critiques welcome. It is fairly beta.

[1][https://github.com/lassegit/gitdude.com](https://github.com/lassegit/gitdude.com)</comment>


All aboard San Francisco's hipster bus for leather seats, Wi-Fi and iced coffee - <AUTHOR> http://www.theguardian.com/cities/2015/apr/09/san-francisco-hipster-bus-leap-leather-seats-wi-fi-coffee <comment><USER2> The pictures from the promo shoot look like a traffic security nightmare. It looks like many people would be injured by a high velocity vehicle impacting into the bus.</comment>


Thoughts on Aptitude - <AUTHOR> http://bbowden.tumblr.com/post/2952288932/thoughts-on-aptitude

<comment><AUTHOR> Author here. Not the best writing on the web, but I'm hoping to spark some discussion. What are some good ways to leverage your own particular aptitude while coming to terms with your shortcomings? How do you determine whether to tackle a problem or accept that it's not worth the time or effort?

<comment><USER2> I'd recommend you read some of the tutorials here (even if it looks old- school), as it gives visual examples of each algorithm's output: <http://homepages.inf.ed.ac.uk/rbf/HIPR2/wksheets.htm>

You could also try to read the documentation/source code of some open source image analysis software, and prototype your application around them: <http://opencv.org/> <http://hugin.sourceforge.net/>

Once your prototype works as expected, you can learn more about the algorithms you used, and implement it yourself in your language of choice.

BTW when reading the title of the article I expected something about Debian's package manager, aptitude :)

Edit: to answer to the more general question in the post: if a problem is interesting enough I would invest some time in learning how to solve it.

If it turns out that the domain (image analysis in your case) is not as interesting as I thought, or would require a significant amount of time to learn properly then I'd probably avoid that domain for a while. But I wouldn't give up on it just because I didn't learn about it in school.</comment></comment>


Burning out on Capistrano (Jamis Buck) - <AUTHOR> http://groups.google.com/group/capistrano/msg/f5213577eaeadc47

<comment><USER3> I recently had an e-mail from a Windows developer in the Ruby community who pointed out how opaque many Ruby projects are regarding Windows. He works on porting a number of libraries - so he's definitely putting in some hard work - but has had issues with project owners not updating CHANGELOGs properly, deliberately breaking Windows support, etc.

At Euruko (European Ruby conference) earlier this year, I raised the topic of Windows and.. most of the audience couldn't care less. They were mostly of the opinion that if Windows people wanted to use Ruby, they had to do the legwork. (FWIW, I'm an OS X user who doesn't care too much for Windows either, but I recognize there's a massive userbase there)

Windows is in the third-world of operating systems when it comes to Ruby - <USER2> Jamis' standpoint is less than surprising.

<comment><USER4> I switched from Vista to OS X this year. I made the stupid mistake of trying to develop Rails on a Windows machine. And it was not worth the trouble at all. If you're going to devote your life and livelihood to building software on Rails, do NOT do it on Windows.

I switched to OS X and I'm happier with my computer than I ever have been in my life.

And Rails works awesome.

<comment><USER5> I write my Ruby on Windows Vista and deploy on Ubuntu. And I've run into the usual set of headaches with doing this. Sometimes this results in me having to make fairly simple changes to, e.g., older versions of Capistrano to get them to work on my machine -- not too terrible because, after all, it is OSS Ruby code.

(I'm still running Cap 1.4.2 because it only took one line to make compatible. If I upgraded I would have to fix everything again.)

What flavor are the bugs? Usually, it ends up being a weak link in filesystem paths, SVN integration, or SSH integration. What causes these issues? Much respect for the folks who code them, I understand you do not owe anybody anything, but any honest assessment points to platform chauvanism.

"I do not use Windows, nobody I know uses Windows, true Ruby hackers are too cool to use Windows, begone ye Microsoft-infested slimeball"

The community (which I generally like and, let me note, _actively contribute to_ ) positively _drips_ with this sentiment. DHH mentioned that 37signals wouldn't hire a Windows programmer (though he later backed down, somewhat), and the reasons were essentially tribal more than anything else.

And a big -1 to everyone who says that the Windows API is getting in the way of compatibility. Really folks? The Windows API being opaque made you hard code the path separator? The Windows API being opaque made parsing the results of a call to ls the more obvious choice than using the built-into-the- standard-library cross-platform way to get the contents of a directory? (To name just two implementation choices I've seen in Ruby libraries.)

<comment><USER6> 1\. The relative quality of many new Ruby libraries is extremely low. There are a lot of affected idiot hipsters who want to be the next DHH and think releasing every module they write will help with that.

2\. Just run a headless VM to run your development in, since you don't have to deploy on Windows.

<comment><USER7> Yes it couldn't be easier to just run ubuntu. Once you do, you'll never go back to dealing with windows paths (Better for Java dev too).

<http://wubi.sourceforge.net/>

</comment></comment></comment></comment></comment><comment><USER8> Although lots of comments are about the Ruby language, I think this post can be applied to just about any open source project out there. It's always easier to complain to the maintainer than to try to fix the problem yourself and distribute the fix as a patch to others. Open source doesn't work well if there's only one person who fixes all the problems. I think it could also be a newbie developer mentality. Newbie developers are more likely to use libraries that are completely plug-and-play; if something doesn't work right, they'll complain rather than try to fix it themselves.

<comment><USER9> It's also a problem with Windows itself. It really is a nasty environment for coding non-MS-based software on.

If I want to support Windows I have to setup a (virtual) machine _with a license code_ just to have any basic functionality. As someone who doesn't work with Windows anywhere, this is a huge hurdle. Then there's the hoops I'd have to jump through just to get a decent shell and a compiler ready.

Oh, but the fun doesn't end there. Which _version_ of Windows are we talking about? More than one? Ah, well, each of these will require its own machine (virtual or otherwise). With matching keys, of course.

Supporting Windows is a pain and when it's not required for what I want to do, I'm simply not going to do it. Period. I have better things to do with my time.

Letting people who want this code running on Windows do it themselves and having them submit patches upstream is a perfectly valid choice.

<comment><USER10> What if I'm an anything else coder and I want to support Mac? Forget license, I need to buy a new machine. Linux is the only really painless platform to support if you're not using it.

<comment><USER11> But if you support any sort of *nix, then you quite possibly work on OS X already. If not, there's still probably minimal work to do.

It's not like going from Unix to Windows, where you have an entirely different access control mechanism, system API, filesystem structure and path separator, etc.; it's just going from one Unix to another. So the author only has to accept a couple patches from his Mac-using colleagues, and then he's basically set for OS X. On the other hand, debugging a Unix app on Windows can become a full-time job, and may be more work than you can reasonably expect a few random patch contributors to accomplish.

</comment></comment></comment></comment><comment><USER12> People who receive free software really have no right to complain about it, if it isn't working as they want it to. They didn't pay dime for it. Either donate money to the project or scratch your own itch. It's not the job the the original developer to spend all of his/her time fixing other people's problems.

<comment><USER13> This is a terrible attitude and one that I'm fairly certain is not shared by the best open source developers.

If you publish some code and go around claiming it does this and that, you are absolutely responsible for making good on those claims. Your reputation is at stake. How much you are getting paid is irrelevant. Besides, there are plenty of indirect ways to profit from making free software.

Also, there are implicit claims in every piece of software that doesn't say otherwise, namely that it is secure, won't trash your data, follows best practices, is not full of bugs, etc.

If you want to publish "as is" software, that's fine, but it should be made explicity clear to what degree you stand behind the quality of your code.

Users have no business complaining because you won't add some feature they came up with or your pre-release version isn't solid. But it is quite reasonable to complain if an open source project does not live up to its own pretenses.

<comment><USER14> I think you point it out well. Users have no business complaining because you won't add some feature they came up with. What if that feature is something the user believes is very important to the software, but you think it's a complete waste of your time to even bother to add or maintain it?

That's what this whole Capistrano situation seems like to me (sadly, I didn't even think cap worked on windows). People are irate because a project is dropping support for a platform it never seemed to work well on to begin with. Have the developers ever _promised_ windows support? I always thought their main claim was that it's a tool to automate deploying (mostly rails) apps, and I think it works well in that regard. I didn't think those promises extended to platform support as well.

<comment><USER13> Given the informal nature of software development, there are going to be a lot of grey areas when it comes to implicit standards and best practices. But it's the principle that matters. Some people believe that open source can do no wrong. I think that belittles open source.

As for this case.. well, Capistrano is a Ruby lib and Ruby libs tend to work on any platform Ruby does, unless otherwise specified. Plus, it used to be supported, which means people invested their time, thinking it would continue to be. It's a weak complaint but it deserves at least a little recognition.

But the attitude bothers me more than the action. Read that message again and then look at this sunshine enema: <http://www.capify.org/>

Can you put that site online and then claim you're not beholden to anyone? Questionable.

<comment><USER14> Maybe this is a difference in expectations, but I don't expect a platform to be supported forever, nor do I expect support for a platform when not specified, by _anyone_. When I looked at the "sunshine enema", I saw a tool for a specific purpose and not much else, certainly not anything about what platform the tool supported which could wait until I read the install/download pages. What I read in the message was someone who was stuck doing something he didn't like, and he was asking for people to do precisely what he did with Capistrano: step up and scratch their own itches, something further helped by Capistrano being an open source project with a current release that still works fine with Windows. I didn't see someone who should have been beholden to anyone otherwise. I also don't see that as an OSS project doing wrong, I think it's reasonable given the situation and this certainly does not have to end here in this way.

For what it's worth, what would bother me is if this wasn't explicitly announced and the dev just didn't feel like working on the project anymore, or if it was a core feature of the tool that was going to be ignored in the future. Now that's something to complain about, and then go do something about if it mattered that much to me.

I've personally been in a similar hellhole of a situation (who hasn't?) doing some dev work for a nonprofit where less than 5% of the users both by number and usage completely wasted my time trying to convince me I should bring back support of older browsers and platforms for absolutely no legitimate reason other than a lack of willingness to upgrade on their part, even though the nonprofit had existing volume and discounted licenses that would effectively make the software free for them. Make a lazy <5% happy by doing LOTS of extra work possibly eschewing working on features for the other >95%, and still deliver what may be a subpar experience (think windows 98 when everyone else is running Vista) while billing them for it at the same time? No thank you.

</comment></comment></comment></comment></comment><comment><USER15> I have an honest question: Why does anyone want Ruby to run on Windows? The cost of switching to Ubuntu and running Ruby there is probably way, way cheaper than rewriting all the libraries to work on Windows.

I don't understand why this is even an issue.

<comment><USER16> I want to write actual executable client software for home users, rather than servers. Specifically, I want to write a game. I want to do it in Ruby. However, all the "home users" that will play it, use Windows.

<comment><USER17> Can't you develop it on *nix and run it on the JRE via JRuby?

</comment></comment></comment><comment><USER18> I don't think RoR is _that_ bad on Windows. I've used InstantRails on Windows quite successfully for over a year now with only occasional problems with plugins (like Paperclip, though it's fine now).

It seems the incompatibilities come from things like capistrano which are quite close to the metal. And that seems reasonable to me. However, expecting new users of your language/framework to delve into the internals just to make their basic app work isn't going to happen. Maybe it should, but it isn't.

</comment><comment><USER19> Isn't it kind of obnoxious how Google requires a login to read public group archives? (Or am I mising a way to read these without logging in?)

</comment><comment><USER20> I don't understand why people on windows just install Wubi. It dual-boots into Ubuntu (a MUCH better OS anyways) and the whole database is stored as a file so you don't have to fiddle around with hard drive partitioning. Or you can just pop VMWare on your computer and have linux running in no time flat.

If you're using Windows to develop for RoR, you're just lazy and you don't deserve to be supported.</comment>


Rails Commit: Whitelist all attribute assignment by default - <AUTHOR> https://github.com/rails/rails/commit/06a3a8a458e70c1b6531ac53c57a302b162fd736

<comment><USER2> I don't think hacking sites to do security activism is a good idea, at all. However, many people over a period of years said that this change needed to be made, in all of the friendly, ethical, polite OSS-approved ways. Tickets, blog posts, emails to security, etc etc. I got to the issue a few years late, saw the WillNotFix tickets, and wrote up - I kid you not - an on-dead-tree _journal article_ which said:

 _[W]rite access to sensitive data should be limited to the maximum extent practical. A suitable first step would be to disable mass assignment, which should always be turned off in a public-facing Rails app. The Rails team presumably keeps mass assignment on by default because it saves many lines of code and makes the 15-minute blog demo nicer, but it is a security hole in virtually all applications._

<http://queue.acm.org/detail.cfm?id=1964843>

This doesn't justify the Bad Guys abusing third-party sites with this, but the Good Guys did everything right and did not achieve a fix as a result of doing so.

<comment><USER3> AKA "The end justifies the means". It wasn't ideal, but it achieved and end result that others have been asking for for years to no avail. That justifies the means in my book, and then some. I hope Egor will be given sufficient indemnity for his actions, as, even if misguided, they were clearly well intentioned.

<comment><USER2> I strongly disagree both in general and as regards web vulnerabilities. For one, Github is in no way responsible for the decisions of the Rails project, and this stunt will cost Github five to six figures. (Anyone who thinks this is in any way exaggerated has not been on an Incident Response team or read what has to happen in industry. Heck, there are individual _customers_ of Github who may have to push the Big Red Button right now.)

For another, there exist many, many applications against which one could demonstrate a bug in Rails or Ubuntu or SSL or just the finding "Lol, P=NP." Pragmatically, would you like that to be your application? I would very, very much not like someone to do one of these to my sites. It would cause an instant nightmare for me. The _happy_ outcome is I lose thousands of dollars and don't sleep for most of a week. The unhappy outcomes are not upper-bounded by death of my business.

n.b. Busting into Basecamp to make a point about Rails would also be morally irresponsible.

<comment><USER4> How would you be losing sleep now? Assuming you were Github, as of now you would have (1) identified the problem, (2) fixed the issue, (3) handled the public relations with a press release that includes a future disclosure policy. You probably blew some cash on overtime pay this weekend, but how do you count 5-6 figures?

Any company that is paranoid enough to cut their Github contract following a benign intrusion that was resolved in under 24 hours is not a company that would have uploaded code in the first place. This is not the only security vulnerability on Github.

I think you are being excessively dramatic.

<comment><USER5> > (2) fixed the issue

They were notified of the issue 3 days ago. Today, he simply found another instance of the very same problem in a different place. The vulnerability is throughout their entire code-base.

They are not even close to resolving this.

</comment></comment></comment></comment></comment><comment><USER6> Thank you, @homakov

</comment><comment><USER7> They should've at least thanked the guy.

<comment><AUTHOR> I actually had "Thanks to Homakov" inside the title of this post but I guess I wasn't allowed to have that in the title and someone changed it.

<comment><USER8> Yeah there's a guideline on "editorialising in the title"

</comment></comment></comment><comment><USER9> It still auto-adds the attr_accessible list which is nearly as bad as allowing mass assignment in the first place. At most it should add an informative comment, and the error message about being unable to mass assign attributes should be made better, possibly with a URL to the existing mass assignment Rails guide.

</comment><comment><USER10> Good for Egor Homakov. I don't necessarily agree with his methods in this case, but in the end, the net result of his actions was positive for web security. And as so many others have pointed out, when the proper channels aren't working, sometimes a little spectacle is just what you need to instigate change.

In other news, I'm not sure why the rails core team was so against this in the first place. Making things safe by default is usually a good idea. This change doesn't seem to add too much additional ceremony, and people had been asking for this for some time.

<comment><USER11>
       I'm not sure why the rails core team was so against this in the first place.

Lack of humility.

<comment><USER12> That's a bit harsh, it is at least a grey area.

Mass-assignment by-default, with disabling fields you want to protect

vs

Mass-assignment off by default, with enabling fields you want to mass-assign.

It's hardly just outright arrogance.

<comment><USER13> In other words:

Security vulnerabilities by default, with the ability to patch the vulnerability on a project-by-project basis.

vs

Security by default, with the ability to allow potentially insecure assignment on fields you want to assign.

<comment><USER14> This seems like an intentional oversimplification. Having mass-assignment on by default and therefore requiring the developer to create a whitelist of attributes for each of their models has a complexity cost associated with it. Failing to mention this at all shows a lack of objectivity.

I happen to believe it's worth it for the increased security, however I'm not going to pretend that there isn't an associated cost.

<comment><USER11> It is 2012, we should no longer have to debate about the acceptability of unvalidated inputs in a web application. Even PHP ditched register globals long ago.

</comment></comment></comment></comment></comment></comment><comment><USER15> Unfortunately people never learn from the past. Security holes directly traceable back to the design of C are still trickling out after 30 years. The entire construction of the web has failed to learn from this lesson. The whole design is "fail open", and one mistake ends with site credentials being dumped on pastebin.</comment>


Toshiba has invented a quantum cryptography network that even the NSA can't hack - <AUTHOR> http://qz.com/121143/toshiba-has-invented-a-quantum-cryptography-network-that-even-the-nsa-cant-hack/ <comment><USER2> No practical difference compared to point to point network with symmetric ciphers.</comment>


Decentralizing Trillian - <AUTHOR> http://blog.trillian.im/?p=2746

<comment><USER2> A few notes:

1) We are obviously aware of XMPP, having been developing client-side interfaces to it for years.

2) We started this project in 2001 - around the same time Jabber was in its infancy - and as smacktoward notes, the main reason we're not using XMPP today is inertia. XMPP is great, but XML just isn't our personal preference.

We figure being more open with our protocol can't be a bad thing and so it's out there for folks to pick apart and send us feedback, which we'd love! Alot of our protocol was built with an eye towards XMPP federation as well; I actually had Trillian interoperating with Google Talk one afternoon but it seems like that ship may have sailed. :-\

</comment><comment><USER3> I must be missing something, because it sounds like they're creating one more IM protocol and claiming it will solve protocol fragmentation. If they want an open and federated protocol, why not back XMPP?

<comment><USER4> "IMPP is a binary protocol that works by establishing a TCP connection to an IMPP server, authenticating with that server, and then exchanging messages with that server in order to reach other clients. Over the years, best efforts have been made to keep the protocol flow reasonably compatible with XMPP with the long term idea of enabling federation between IMPP and XMPP servers. As such, the general flow for establishing an IMPP session somewhat mirrors that of XMPP: [...]"

Source: [https://www.trillian.im/impp/](https://www.trillian.im/impp/)

<comment><USER5> That explains what IMPP _is_ , but it doesn't answer the question of how/why it's different from XMPP.

And the "keep the protocol flow reasonably compatible with XMPP" part only makes it more curious. The more similar your protocol is to XMPP, the stranger it seems that you don't just use XMPP.

The answer may be just inertia; the spec says they started working on IMPP in 2001, back when XMPP was still very young. It could be that they've just built a ton of internal infrastructure on top of this thing and can't afford to move it all to pure XMPP. But that doesn't really explain why anyone else would want to use it in 2013.

<comment><USER2> Yeah, inertia. What we've tried to do with IMPP is to roll all of the features that IM users actually want into the core protocol versus just saying "it's open!" or "it can be extended!" and hoping someone else does the dirty work. We build the server side and we build the client side, which is important; it means we're not off dreaming up pie-in-the-sky features that would be absolutely horrible for a client developer to implemement.

We have some experience reverse engineering the rest of the IM protocols out there as well, and they all have their own issues which we kept in mind when building ours. At the end of the day, our actual motivations were simple: publishing the protocol is the right thing to do and so we did it. It's been on our TODO for 6+ years. :)

</comment></comment></comment></comment><comment><USER6> Who else is thinking "woah, Trillian still exists?!"

<comment><USER7> Not me. Trillian's iOS IM client is one of the few that's any good.

<comment><USER8> Indeed, especially if you use it in combination with their desktop applications (win or mac), because the "continuous client" functionality makes switching between devices fluid.

<comment><USER9> Definitely. I wish Apple would have bought them instead of rolling their own iMessages. Trillian consistently delivers messages to me wherever I am, and keeps everything property synchronized better than any other messaging tool I've used.

</comment></comment></comment></comment><comment><USER10> Obligatory: [http://xkcd.com/927/](http://xkcd.com/927/)

<comment><USER11> And "instant messaging" is even one of the examples it uses!

</comment></comment><comment><USER12> This is interesting because it seems like they are proposing ways to decentralize existing services. Would it not be possible to add some sort of third party authorization in the app that registers your centralized ids in a decentralized database.

i.e. (1) Open Trillian (or Adium) (2) Sign in to each of the centralized services: AIM, Hotmail, Yahoo, etc. For each authorization, save that user name in the decentralized database in some sort of cryptographically signed form. (Maybe some algo similar to Bitcoin's solution to the byzantine general's problem). (3) Now when someone on another trillian client wants to reach you, they can use any one of your centralized handles to search for you in the centralized database and connect with you directly. (4) Lastly, some sort of handshake occurs between you and your friends.

I see no reason why this can't be fully compatible with XMPP once authentication has been performed by writing to a block chain and lookup of friends has been performed by reading from the blockchain.

This approach basically rebuilds out the network effect of "skype" and other centralized services via a trojan horse approach.

</comment><comment><USER13> Could email be considered an "interoperable" instant messaging service? All it would take would be an email client's layout to be presented a bit more like a standard instant messaging layout and it might as well be considered a platform with the "back end glue" that they're talking about in the first paragraph.

On another note - and forgive me, I'm a bit clueless on this - is there any reason why email clients/providers couldn't have a standard way to do audio and video calls across services? Then they could do text messaging, file sharing, audio and video calls/messages. Any reason this couldn't happen?

<comment><USER14> The email protocol is built for reliable delivery instead of speed. It's not built for realtime communication. It was built so that mail goes through even if the destination's mail server goes down for a day or two. The fact that mail arrives mostly in real time today is purely accidental. There's no guarantee in the protocols to ensure that.

<comment><USER15> OTOH, I've learned to treat IMs as emails to a degree: often I'll send a message to someone who's online and expect that they'll likely see it. This might be a quirk of the clients we use, but it's very email-like.

The difference is less one of speed and more one of an ephemeral inbox. (In how it's treated by typical use cases; obviously, IM logging makes it less ephemeral.)

</comment></comment></comment><comment><USER16> i have used trillian years ago and now rediscovered it through this. Their current client looks cool and the cross-plattform stuff seems to work really well and syncs chat histories and everything. However today most of my IM stuff goes through Skype (still have a 7 digit ICQ Uin that i have been using from 1997-2010) and their mobile clients dont support it. Too bad, i still dont like Skypes offical mobile clients, they seem to be dog slow and eat alot of resources. Skype is also a massive PITA on multiple machines/devices which i do all the time and it really annoys me.</comment>


The Problem with Amazon and Open Source Isn't Amazon - <AUTHOR> https://anonymoushash.vmbrasseur.com/2019/06/07/the-problem-with-amazon-and-open-source-isnt-amazon/ <comment><USER2> Agree with the OSS / Amazon licensing sentiments. My problem with Amazon and OSS is they give back far, far less than their competitors. Google, Microsoft, RedHat, and Facebook top my list of corps doing good OSS work.</comment>


Censorship Doesn't Just Stifle Speech – It Can Spread Disease - <AUTHOR> http://www.wired.com/opinion/2013/08/ap_mers/

<comment><USER2> I never thought of censorship from that perspective.

It is refreshing, since 90% of the links I come by here about censorship are either about privacy, privacy expectation and influence on economy.

That way, nobody can say "I've done nothing wrong, so I'm not concerned".

</comment><comment><USER3> This is very like what happens in the book World War Z, which was probably inspired by government responses to SARS and other epidemics. A mysterious disease arises in China, and the government strongly censors reporting of outbreaks. This and other factors (people smuggling, illegal organ trade) contribute to its spread worldwide, and it is only when it cannot be contained that the world is aware and can start to understand and fight it.

<comment><USER4> As downvote-prone as that comment seems like it could be, I would like to add it it by saying that this can't be the right way to handle diseases. There has to be a sweet spot between telling everyone immediately, insighting a panic, and holding back all of the information.

I'm not too incredibly concerned with managing the information from the general public; but, the WHO and other people should always be immediately informed. In fact, if they were rapidly informed and we can get a cure out quickly, then the loss of life from these new diseases wouldn't be as bad, I would like to hope.

The problem is in hiding the information.

<comment><USER5> > _There has to be a sweet spot between telling everyone immediately, > insighting a panic, and holding back all of the information._

What if there's panic? It's not with a, say, earthquake prediction, where people would evacuate cities etc.

Rather, they'd stay at home more, avoid crowded places, avoid people looking sick, and wear those white mouth/nose masks more when out -- in all, that should help reduce the spreading of the dicease.

<comment><USER4> I was imagining my mental panic response for THIS instance:

\- companies refusing to fly people back from Saudi Arabia to the United States

\- us putting all people of the interested groups, for example, all Muslims and family members of anyone Arabic looking, into special hospitals to make sure they don't spread the disease, even if we don't have it.

\- violent outrage if our family members end up sick, and there is a mosque down the road.

This particular article seemed to make it pretty clear that the yearly pilgrimage often results in illness from all the populations coming together with their own unique resistances. This particular pilgrimage, with these numbers, tends to be with a single population. That population could be seen as the source of the disease, and bad things happen.

That's the sort of 'panic' I'm thinking of and it's not good. Oh, and the reason I'm saying this level of panic is due to the currently estimated 56% death rate after extreme signs are shown.

</comment></comment></comment></comment><comment><USER6> What isn't really apparent to me from this article is WHY Saudi Arabia, or China for that matter, would even want to censor this.

<comment><USER7> Because if it leaks out that they have a new, lethal, incurable and contagious disease, they'll be treated like they have the plague. (See where the metaphor comes from?)

I moved to Singapore in 2003, when the SARS epidemic was raging. (IIRC, the last death in Singapore was the day I arrived.) People back home thought I was crazy, the usually crowded city-state's streets were rattlingly empty, restaurants had desperately promotions ($1/plate sushi etc) and the five-star hotel I'd been booked into at an already low rate bumped me to an apartment suite.

Of course, I was far more at risk of dying in a traffic accident, but "plague!" is one of those risk factors like "terrorism!" that makes people's hindbrains gibber in fear and discount all rational risk analysis.

<comment><USER8> The risk for SARS was massively overblown, but, unlike terrorism, entire populations really have been decimated by plagues.

</comment></comment></comment><comment><USER9> Some would argue the desire to censor is a disease of the mind. Or perhaps, a symptom of a mind plagued by fear of the unknown and shaken by the threat of new information.

<comment><USER10> I would argue that the desire to censor is the result of its effectiveness in maintaining existing power structures.

</comment></comment><comment><USER11> If you construct the machinery of censorship, it will be misused for bad things that never even crossed your mind.</comment>


Historian uses lasers to unlock mysteries of Gothic cathedrals - <AUTHOR> https://news.nationalgeographic.com/2015/06/150622-andrew-tallon-notre-dame-cathedral-laser-scan-art-history-medieval-gothic/ <comment><USER2> I find it fascinating the feats that they managed back in when there were no computers, no powered heavy equipment, and mostly just ambition and sweat. We too often forget that they had an incredible understanding of construction techniques and math we hide in our design programs was worked out on paper, not discounting a bit of gut feel when actually putting the structure up. This of course was not limited to the Middle Ages but stretches back through Roman times, Egypt, and the far East of China and more.

note : the site wants flash for some activities so it may limit what you can view

<comment><USER3> There is a survivorship bias in ancient structures. Those that wern't up to snuff, collapsed. Most did.

<comment><USER4> I don't think it's right to apply survivorship bias in this case.

I mean, it's trivially true that anything unmaintained will collapse over a long enough time-frame, but I don't think >50% of buildings built to last collapsed before their time. If anything the damn things were overbuilt and hard to get rid of, even while being plundered for building materials.

<comment><USER5> Actually medieval designers did not use conservative design. Many cathedrals were _not_ overbuilt. There was a push to make the walls and pillars thin, the ceilings tall, to create a sense of ethereal beauty. As a result, many buildings collapsed during construction, because they were pushing things too far.

<comment><USER4> But not most, I don't think.

<comment><USER3> Cathedrals were 100+ year endeavors and sufficient care was taken in design so that relatively few failed completely. Most buildings were not cathedrals and didn't benefit from such care.

</comment></comment></comment></comment></comment></comment><comment><USER6> The article was written while the researcher still was alive and the researcher speaks in present tense.

But now with the new interest, they republished it mostly unchanged (starting in present tense and all) but then inserted in the middle (completely shocking for me):

"Tallon, who died Nov. 18, 2018, at 49..."

and then the text continues:

""Every building moves," he says."

Sad. There is a Wikipedia article about the researcher:

[https://en.wikipedia.org/wiki/Andrew_Tallon](https://en.wikipedia.org/wiki/Andrew_Tallon)

</comment><comment><USER7> I really want to read that article, but there's an advertisement covering the "continue reading" button.

</comment><comment><USER8> There's a great documentary on the construction of cathedrals which heavily relies on this same research. It's floating around YouTube (not gonna link it because if I do it will probably get flagged and taken down as I suspect it violates copyright by being there). It goes into mid level detail on how they were constructed. It's well worth watching if you're interested in this kind of thing.

</comment><comment><USER9> did the fire start with a laser? ;)

</comment><comment><USER10> Too soon.

</comment><comment><USER11> So this is an article originally published in 2015, but now "Published April 16, 2019". Why do I feel, like how the death of artists pushes them to no. 1 on iTunes (so death is a good career move!), are news websites taking advantage of world events to get pageviews? Next level SEO-ptimizing!

I suppose it's a natural evolution, Twitter spambots do it, YouTube spammers do it. Now respectable news sites too.</comment>


Introducing the JetStream benchmark suite - <AUTHOR> https://www.webkit.org/blog/3418/introducing-the-jetstream-benchmark-suite/

<comment><USER2> The situation where browser vendors create browsers benchmarks isn't healthy. And SunSpider is a total joke at this point, full of toy programs and microbenchmarks that have been optimized to death, so I'm disappointed that JetStream is including most of it.

(For example, did you know that every major JS engine now has a daylight savings offset cache, something which is entirely useless for any real code, but substantially speeds up the date benchmarks in SunSpider? Bleh.)

The state of C/C++/Fortran benchmarking has been much better -- not perfect, but much better -- for years, thanks to the SPEC benchmarks, which are created by an independent company that invites submissions for real-world programs that are suitable for benchmarks.

I wish there was something similar for JavaScript and HTML, though the fact that you have to pay for copies of the SPEC benchmarks isn't good.

<comment><USER3> Did you read the article? It explained why we used fast-running tests from SunSpider combined with longer running tests from Octane and the LLVM test suite. You may have a fair point about the date tests being mildly silly. But many of the SunSpider tests (for instance 3d-raytrace, tagcloud, crypto-md5) are pretty realistic workloads, if fast-running. They are arguably more realistic than some subtests of Octane (like splay).

I agree with you that a neutral and fair benchmark would be good. Unfortunately, the non-browser-vendor-created browser benchmarks out there tend to be uniformly much worse. I think the only way to get something that is high quality and also neutral is to create a neural group that multiple browser vendors join.

<comment><USER2> > But many of the SunSpider tests (for instance 3d-raytrace, tagcloud, crypto- > md5) are pretty realistic workloads, if fast-running. They are arguably more > realistic than some subtests of Octane (like splay).

I stand by my opinion that SunSpider is a poor benchmark suite that should have been retired years ago.

Octane also has some bad benchmarks, and I agree that splay is one of them. I've written about this before at [https://blog.mozilla.org/nnethercote/2012/08/24/octane- minus...](https://blog.mozilla.org/nnethercote/2012/08/24/octane-minus-v8/).

And you admit that at least some of the SunSpider and Octane benchmarks are bad, and yet you included them anyway? Argh.

I must say I also dislike this trend of creating benchmark suites that have entirely new names yet consist mostly of tests from prior suites.

> I think the only way to get something that is high quality and also neutral > is to create a neural group that multiple browser vendors join.

I agree 100% with you there. Robohornet was an attempt at this, but was fatally flawed by the fact that the benchmarks themselves were terrible.

<comment><USER3> "Bad" is relative. Some tests are not as reflective of real-world workloads as some other tests. But they still test real aspects of VM performance. I don't think these tests force you to do things that are actively counterproductive, and if you did, the weight of other tests would punish you. The scoring is geometric mean, so it's impossible for a single test to dominate.

Did Robohornet get non-Google browser vendor involvement? It doesn't seem so currently, and I don't recall any particular push to get involvement. It seems like it was single-browser-vendor in practice (and also not very well designed).

I will hedge this by mentioning that there is a totally neutral benchmark that is actually good and more realistic than any of these. JSBench is created from the JS in real websites, was not created by any browser vendor, and has had advice and input from multiple vendors. <[http://jsbench.cs.purdue.edu>](http://jsbench.cs.purdue.edu>) It's not very good at modeling advanced / bleeding-edge webs though. Also, Safari spanks other browsers so hard on this benchmark that it's not a useful optimization tool.

<comment><USER2> > Did Robohornet get non-Google browser vendor involvement?

There was a stewardship committee that had lots of non-Google people on it: [https://github.com/robohornet/robohornet/wiki/Committee- Memb...](https://github.com/robohornet/robohornet/wiki/Committee-Membership). There was even a Mozilla person on it at one point, I can't remember who (someone I didn't know) but they asked to have their name removed once we discovered and explained how bad the benchmarks were -- it turns out that person had only had tangential involvement anyway.

But I just found the technical advisory committee, which consisted of three Google Chrome people: [https://github.com/robohornet/robohornet/wiki/Technical- Advi...](https://github.com/robohornet/robohornet/wiki/Technical-Advisors). So it was more Google-heavy than I realized.

</comment></comment></comment></comment></comment><comment><USER4> Is it just me, or do these tests seem more heavily weighted towards C compiled to JS than most other suites? Emscripten tests seem to make up 1/4 of the suite. That's a good exercise for FTLJIT, but emscripten code is rather atypical for the majority of web apps and isn't idiomatic JS.

</comment><comment><USER5> This is also interesting: [http://browserbench.org/JetStream/in- depth.html](http://browserbench.org/JetStream/in-depth.html)</comment>


Octus.app - <AUTHOR> https://octus.app/en/ <comment><AUTHOR> Desktop application for managing social accounts in one place, in one window. Each tab have their own session and cookies, so you can use several account in one app. (No need to use private mode in your browser). Connect as many account as you want.</comment>


On Bacon - <AUTHOR> http://www.tbray.org/ongoing/When/201x/2010/09/19/On-Bacon <comment><USER2> I know this comes from Tim Bray, but why should we be interested in cooking bacon? On the other hand I'm European, so I could have missed some unique cultural reference.

<comment><USER3> It's unfortunate that editorializing is so strongly discouraged here that people shy away from even briefly summarizing the topic of the link.

For those whose curiosity has been piqued by the title: the article is about exactly what adambyrtek's comment suggests - nothing more, nothing less. Cooking bacon. That's it.</comment></comment>