Participle: A parser library for Go - <AUTHOR> https://github.com/alecthomas/participle <comment><USER2> Parsers are one of those fields I wish I had the time to really study deeply. I'm especially impressed with LALRPOP.

Cribbed from a previous comment of mine:

From time to time I find myself revisiting this thread: "Writing parsers like it is 2017"[0].

In particular I love a Rust parser generator called LALRPOP and it's emphasis on diagnosing ambiguous grammars [1].

> What I've tried to do now in LALRPOP is to do that clever thinking for you, > and instead present the error message in terms of your grammar. Perhaps even > more importantly, I've also tried to identify common beginner problems and > suggest solutions.

They work out a fairly deep example with error guidance in ambiguous grammars in that post.

[0]: [https://news.ycombinator.com/item?id=15016061](https://news.ycombinator.com/item?id=15016061)

[1]: [http://smallcultfollowing.com/babysteps/blog/2016/03/02/nice...](http://smallcultfollowing.com/babysteps/blog/2016/03/02/nice- errors-in-lalrpop/)

</comment><comment><USER3> A good intro by Rib Pike for those who'd like to learn more about parsers/lexers [https://youtube.com/watch?v=HxaD_trXwRE](https://youtube.com/watch?v=HxaD_trXwRE)

<comment><USER4> s/Rib/Rob :)

</comment></comment><comment><USER5> Cool idea. The way it handles alternatives looks awkward since each alternative is a field in a struct. You have to check each field to find the one that's not nil.

(See Term in the example.)

Normally this would be done with an interface, like in go/ast

<comment><USER5> Although, on second thought, this means writing a chain of if-else statements instead of a type switch in a visitor. Maybe it's not that big a difference?

</comment></comment><comment><USER6> I've used this before - really nice library and an easy way of getting started without having to write so much custom code. Only down side is that of course it's still faster to hand-write a parser :)

</comment><comment><USER7> Clever idea of using struct tags for grammar rules.

<comment><USER8> Wouldn't that then require reflection, which is "slow" (comparatively speaking - if this isn't in a hot path then perhaps who cares?)

<comment><USER9> It's not in the hot path, it's used to generate the parser.

<comment><USER8> Ahhh, then that's a cool approach to take parser generation.

</comment></comment></comment></comment><comment><USER10> This looks really cool. I spent a few weeks last year trying to build my first programming language, but I kept getting bogged down by parsing and eventually gave up.

<comment><USER8> Parsing isn't actually that hard once you wrap your hard around the problem. There are lots of good guides for writing parsers online which really helped me out when I was feeling the same bourdon as you are.

So what I'm trying to say is stick with it and I'm sure you'll crack it. :)

<comment><USER10> How do you write a parser in a language like Go? I stumbled upon parser combinatory and tried to shoehorn them into Go, but the lack of generics mostly prohibited this. I also tried imperatively writing the parser, but this was tedious and error prone. I also explored parser generators, but these seemed to have huge learning curves and still produced awful code. Beyond that, it's hard to tell what kind of parser I need because of all of the academic jargon. :/

I would love to be pointed in the right direction!

<comment><USER11> Parser combinators don't need generics, as they are merely higher-order recursive descent parsers. I.e. recursive parsers where functions are created via other functions to generalize and compose them. Go is expressive enough to do that.

For example, let's say we start with a function that parses a character '['.

      buf, pos := []byte("[123]"), 0

      LBRACK := func()bool {
         if buf[pos] != '[' {
            return false
         }
         pos ++  // consume character
         return true
      }

It would suck to write such function for every single character we have to parse. We can generate it instead:

      CHAR := func(c byte)func()bool {
         return func()bool {
            if buf[pos] != c {
               return false
            }
            pos ++
            return true
         }
      }

      LBRACK := CHAR('[')

Now let's do the same for parsing a sequence. We combine outputs of other functions and return one that parses them one by one.

      SEQ := func (args... func()bool) func()bool {
         return func()bool {
            for i := 0; i < len(args); i++ {
               f := args[i]
               if f() == false {
                  return false
               }
            }
            return true
         }
      }

      parser := SEQ(
         CHAR('['),
         SEQ(
            CHAR('1'),
            CHAR('2'),
            CHAR('3'),
         ),
         CHAR(']'),
      )

This is the idea.

This is not a real world example though. You'll need to have more primitives, a wrapper that handles various things, like restoring buffer index on failure, captures, that save starting index, move buf/pos into context structure, virtual stack to store captures/errors, etc.

      func SEQ (args... func(ctx *Ctx)bool) func(ctx *Ctx)bool {
         return wrap (func(ctx *Ctx)bool {
            ...
         })
      }

But it's important to get there on your own. And it's pretty much as fast and as flexible as completely hand-written recursive descent parsers and as powerful as parser generators.

<comment><USER10> Is that a parser? That looks like a matcher. I actually built something that looks almost exactly like this, but it doesn't get you an AST, right? What am I missing?

<comment><USER11> To get to AST you have to create AST nodes. Make a function that captures the output and put it into places where you want to create AST nodes. Sort of like this:

      SEQ(
         ...
         CAPTURE(
            // parser to capture
            SEQ(...),
            // extra arguments:
            // a name, a function to call,
            // that creates an AST node, etc.
         ),
      )</comment></comment></comment></comment></comment></comment>


The Surprising Subtleties of Zeroing a Register (2013) - <AUTHOR> https://randomascii.wordpress.com/2012/12/29/the-surprising-subtleties-of-zeroing-a-register/ <comment><USER2> Author here - I just want to drop in to reiterate how awesome register renaming is. It's a bit weird to try and understand, but it is crucial to how these out-of-order processors run, and it is the trick which lets the register zeroing run so efficiently.

An x86-64 CPU has sixteen integer registers, but 100-200 _physical_ integer registers. Every time an instruction writes to, say, RAX the renamer chooses an available physical register and does the write to it, recording the fact that RAX is now physical-register #137. This allows the breaking of dependency chains, thus allowing execution parallelism.

In the case of the zeroing instructions the register renamer says "RAX now maps to physical-register #0" where that is a register reserved for the purpose of being zero. No execution is needed. It's beautiful.

For more details read up on out-of-order execution and register renaming.

<comment><USER3> This is a good place to start: [https://en.wikipedia.org/wiki/Tomasulo_algorithm](https://en.wikipedia.org/wiki/Tomasulo_algorithm).

Butler Lampson mentions register renaming as one of a dozen paradigmatic neat techniques in this 2015 presentation:

[http://bwlampson.site/Slides/Hints%20and%20principles%20(HLF...](http://bwlampson.site/Slides/Hints%20and%20principles%20\(HLF%202015\)%20abstract.htm) Edit: corrected link

It's easy for software people not to ever encounter it!

<comment><USER2> > It's easy for software people not to ever encounter it!

Yep, because it does its magic without any intervention required.

One concrete example that I like is this:

mov rax,[rsi+0] mov [rdi+0],rax mov rax,[rsi+8] mov [rdi+8],rax

This moves sixteen bytes of memory, all of it going through rax. Without register renaming the third instruction can't run until the second instruction completes, because they're both using rax. With register renaming the third instruction uses a different physical register for rax, and the out-of-order engine can do the loads in parallel and the stores in parallel.

Before anybody freaks out - register renaming doesn't change the semantics of your program. It just makes your program run faster. It just means that you can write code like the above - there's no need to rearrange the instructions and use multiple temporary registers, because the CPU will do it for you, and will dirty fewer architectural registers.

<comment><USER4> I wonder how often (golang, let's say)

        x, y = y, x

Just becomes register renaming? What about

        array[i], array[j] = array[j], array[i]

    ?

<comment><USER2> If the "x, y = y, x" is implemented using the x86 "swap" instruction then the CPU could implement the swap using register renaming, I think - with no execution unit activity required. I don't know if it does.

But everything that golang (or C or C++ or whatever) does has to be expressed in assembly language, and assembly language doesn't directly control register renaming - it's a hidden implementation detail.

<comment><USER4> Thanks. That clarifies things.

</comment></comment></comment></comment></comment></comment><comment><USER5> This is highly appreciated: the kind of advanced, specific knowledge that your average hacker might not know, but should improve their/our thought processes, efficiency, reliability security and general understanding of programming. This is one of the primary reasons HN is so valuable, and I do wish there were some good repository of the best of these kinds of article to browse, apart from searching HN, which like anything can be noisy.

</comment><comment><USER6> As to the 4 instruction limit, see: [https://www.realworldtech.com/sandy- bridge/5](https://www.realworldtech.com/sandy-bridge/5).

The register rename stage, which does the zeroing, can handle four instructions per cycle. It's not immediately obvious from the picture, but after instructions are fetched from the uop cache, they are sent to a 28-entry decoder queue, which can act as a small loop buffer. From there, four uops per cycle are sent to the allocate/rename stage (which is part of the ROB block in the first picture).

<comment><USER7> It's said in the article, under the "Update: January 7, 2013" heading.

</comment></comment><comment><USER8> > CPU designers could create a design where an xor instruction was faster than > a sub instruction. However that would mean that sub would take at least two > clock cycles, since instruction lengths are integer cycle counts. Unless > this modification let them at least double the clock speed it would be a net > loss. It's better to make xor take just as long as sub. You can't make an > xor instruction take, say, 0.6 cycles. But feel free to try.

Earlier, the article says that the process can perform four instructions per cycle. Just to confirm, this isn't normally referred to as taking "0.25 cycles per instruction", right?

<comment><USER6> The Intel manuals sometimes use that as a shorthand, but no, it's usually not. The difference is between throughout and latency. You can process four independent instructions per cycle in parallel (if none depend on the results of the others), but the results of a given instruction will take at least one cycle to be available for the next instruction that uses it as an input. (It takes 9 months to make a baby even though you can make more than one at a time.)

<comment><USER9> > You can process four independent instructions per cycle in parallel

is this down to pipelining, or is that separate?

<comment><USER2> Pipelining is necessary is well, but super-scalar is the key ingredient here - parallelism.

Pipelining means that instruction fetch, decode, execution, and retirement are done in separate stages, each one taking at least one cycle.

Super-scalar/parallelism means that there are multiple units for all of these stages so the CPU can fetch many instructions in parallel, decode many instructions in parallel, etc.

The cool/critical thing here is that many Intel CPUs can execute three XOR instructions in parallel but can retire _four_. Because the CPU recognizes XOR of an instruction with itself as a special case it skips the execution stage and can then process four per cycle.

Or, more likely in real code, the execution units are available for other instructions to use.

<comment><USER10> Strictly speaking pipelining isn't actually _necessary_ , it's just hard to imagine why you'd bother with superscalar execution without first exhausting the relatively-lower-hanging-fruit of pipelining.

</comment></comment></comment></comment></comment><comment><USER11> I recently had an interview at one of the big chip designers, and towards the end they gave a few basic computer architecture and assembly brainteaser questions. One of them was whether I was aware of a smaller instruction for zeroing a register, and I did manage to guess xor after a little thought. It's a trivial idea, but very satisfying to realize for the first time.

</comment><comment><USER12> (2013)

The article was written in 2012, but was last updated in 2013, so dealer's choice?

<comment><USER13> Written December 29th and updated 9 days later. :)</comment></comment>


Create a more compelling experience for your users through game mechanics - <AUTHOR> http://blog.steveklabnik.com/create-a-more-compelling-experience-for-your

<comment><USER2> Some great points here, I've always noticed that sites with "game mechanics" have a tendency to make me addicted, even if the content is mediocre.

<comment><AUTHOR> There's the competitive edge, too. Lots of people (myself included) are very competitive and want to "win." More twitter followers, more foursquare badges, etc. If you and a friend both join the same site that promotes these types of game mechanics, you (potentially) just got two loyal users who will fight to beat each other, also inviting their friends to compete as well.</comment></comment>


Ask HN: Would you pay for a tool to fix UX antipatterns on the web? - <AUTHOR> Hi HN,
I'm constantly frustrated by the amount of annoying things websites do. Useless cookie and privacy notices, ads disguised as content, use-our-app walls, clickbait designed for "engagement", AMP and so on.
I'd like to build something to help users browse the web more efficiently. The closest thing I know of is uBlock Origin with handmade filters e.g. https://github.com/yourduskquibbles/webannoyances, but this doesn't really solve the problem as I'd like (or maybe it can't due to API restrictions).
Is this something you'd use and/or pay for? <comment><USER2> I'd pay good money ($100/month?) for proper reimplementations of official social media and messaging clients without the user-hostile features.

I actually want some services in app form but currently can't have that because the official apps are malicious.</comment>


Pentagon Expands Inquiry Into Intelligence on ISIS Surge - <AUTHOR> http://www.nytimes.com/2015/11/22/us/politics/military-reviews-us-response-to-isis-rise.html?_r=0 <comment><USER2> People tend to think of there being a unified "US government", but the reality is that there's a large number of mostly separate organizations connected only loosely by a theme. Sometimes they lie to each other. Sometimes they lie to the politicians in Washington, who are nominally in charge but who seem to have less real power with every passing year.

<comment><USER3> God I wish more people knew this and understood that it's a feature, not a bug of our system.

In this case, that message is not quite exact because MAJCOM commanders have the POTUS as their boss. But between state governors, POTUS, Congrees and the Judiciary, there is an intentional and functional disconnect.

<comment><USER4> To the citizens of nations that are being bullied by those organisations it's NOT a feature.

<comment><USER5> Right, but the concerns of those citizens quite frankly aren't a primary concern of the United States.

<comment><USER6> Governments that maintain such shortsighted positions will eventually find themselves superseded on the world stage.

<comment><USER7> I'm curious, do you have any examples to point to?

<comment><USER6> It's based on intuition and is only a response to the direct parent comment. If the US of .3 billion people ignores the needs of 6.7 billion people, eventually those people will find a way to escape the needs of the US.

I'll note that the HN article title used to be significantly different, so some of the conversation makes less sense without the "accused of lying to the president" in the title.

</comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> Summary: US Central Command is accused of lying to the President and Congress about airstrikes and the ground fight against ISIS, obscuring the fact that America's strategy to combat ISIS simply was not effective, as "senior officials" at Centcom were determined to "overstate the progress of American airstrikes against ISIS."

In September, The Guardian reported that the tendency for Centcom to provide upbeat assessments of the fight against ISIS may have been influenced by James Clapper (Director of national intelligence), who was "said to talk nearly every day with Grove – 'which is highly, highly unusual', according to a former intelligence official." ([http://www.theguardian.com/us- news/2015/sep/10/james-clapper...](http://www.theguardian.com/us- news/2015/sep/10/james-clapper-pentagon-military-official))

</comment><comment><USER8> I don't understand why anyone would be surprised by this. This is par for the course in intelligence. The intelligence agencies exist to provide whatever fiction those in power wish to hear. In the 80s, the CIA determined that the USSR was a paper tiger destined for collapse. But Reagan wanted an enemy. So the higher-ups at the CIA took the report by the head of their USSR division and threw it away, crafting their own fictional representation of the USSR as a powerhouse. This is why every major world event comes as a huge surprise to the CIA and other intelligence agencies. It doesn't surprise any of the analysts working there, they actually know what is going on most of the time. But because the truth is not politically convenient, the agency as a whole cannot be made to seem like a danger to the political machinations of those who influence their funding. Some of the gymnastics this involves are sometimes funny. Reading the CIAs reports on Iran's 'nuclear weapons program', for instance, are an adventure in absurdism. Pile after pile of pages of extensive descriptions of total knowledge of Iran's operations culminating in not a single shred of evidence of any weapons program gets topped off with "but then again, absence of evidence is not evidence of absence. There could be a super-duper-extra-top-secret weapons program buried 50 miles underground" which gives the politicos and media the ability to report it as "CIA says Iran may have secret weapons program in new report!"

Oh, and that head of the CIAs USSR division whose report showing the truth of the USSRs weakness was Aldritch Aimes. It was at that point that he realized the intelligence game was a sham and just being used to lend an air of mystique and 'secret knowledge' to whatever position those in power want to make seem legitimate and decided if everyone else was just playing a game, he might as well play to, and cut a deal with the Russians to act as a double agent.

<comment><AUTHOR> The article says intelligence/Centcom lied to the President and to Congress, how exactly is this is par for the course?

<comment><USER9> I think the leadup to the Iraq war taught us everything we need to know about the CIA. They're appointed by the executive. They report to the executive. Yet every other branch of government relies on their assessments.

The CIA is merely a tool by which the President leads Congress around by the nose. It's their _job_ to lie. What's harder to understand is why Congress continually falls for whatever they're selling.

</comment></comment></comment><comment><USER10> It wouldn't suprise me to learn the Obama administration downplayed ISIS purposefully. Nothing builds a coalition like a common enemy, and apart from some disagreements over targeting, the key players (Iran, Russia, Europe, Turkey) are coordinating efforts to destroy ISIS. Economic necesssity requires the US defense establishment to downsize, and after decades of costly wars in the middle east, there really is no option but to let others lead this fight.

I suspect the administration is now rebuilding and retooling for high intensity conflict, and that Syria/ISIS is a distraction the US doesn't need but a conflict that requires regional actors to form a coalition. To which: [http://www.bloomberg.com/news/articles/2015-11-22/russia- cal...](http://www.bloomberg.com/news/articles/2015-11-22/russia-calls-for-un- brokered-moves-in-fighting-terror-ifx-says)

</comment><comment><USER11> Since operations in Iraq are just a government fraud / boondoggle by the Pentagon and it's incestuous corporate leeches, this bad attempt at coverup isn't surprising

</comment><comment><USER12> Is this not treasonous?

<comment><USER13> What person, owing allegiance to the US, is levying war against them or giving their enemies aid or comfort?

<comment><USER12> Since we call whistleblowers traitors, maybe we should call yes men traitors too.</comment></comment></comment>


Structure: Beyond the picnic-table crisis - <AUTHOR> http://www.newyorker.com/reporting/2013/01/14/130114fa_fact_mcphee?currentPage=all

<comment><AUTHOR> In the middle of this piece, after the spiral diagram, there is some interesting stuff on old text-editing software (XEDIT, Kedit).

</comment><comment><USER2> John McPhee is a national treasure.</comment>


See Wolfram Alpha in Action: Our Screenshots - <AUTHOR> http://www.readwriteweb.com/archives/see_wolfram_alpha_in_action_-_video_and_screenshots.php

<comment><USER2> I checked Google results for the queries in the screenshot.

"internet users in Europe"

Top link is:

<http://www.internetworldstats.com/stats4.htm>

One more click, but I think at least as much information in that page as the Wolfram results.

"weather oakland"

Google has cute little icons for rainy/cloudy/sunny, current temperature and conditions, and hi/lo for next 4 days. Probably more of the data a "normal" person wants, in a more concise format.

"oakland"

First link is Google maps, more close in view. If you don't already know that Oakland is on west coast of U.S., the Wolfram map could be more helpful. The other information that Wolfram has likely saves some clicks to the Wikipedia or official city of Oakland site.

"uncle's uncle's brother's son"

This is the classic kind of query that Computer Scientists obsess over answering correctly, that is utterly useless to any normal human being. If they think the kind of inference necessary to answer this query is also needed for actually useful queries, they should have demonstrated the actually useful query instead.

"water 550C 3 atm"

OK, if you want an engine to answer your Physics questions, looks like you want Wolfram Alpha. Google did not have anything useful here.

"integrate x^3 sin^2 x dx"

Again, nothing interesting from Google. I wonder if it would be hard for them to tack this on, if they wanted to. But then, they would likely get scolded by all of the Calculus teachers that they are making it too easy for students to cheat on their homework. :)

"bob"

I like how Google finds various common "bob"s, and divides the page to make it clear which is which. Bob Dylan, Bob Strollers, B.O.B. as acronym for Bank of Baroda. This is the kind of thing that is difficult to replicate without watching the kinds of things the world actually clicks on when they search for "bob."

So, if your question is physics or math (maybe other sciences?) use Wolfram Alpha. Anything else, stick with Google.

EDIT: I see Techcrunch has a similar take away:

"The engine looks awesome for science students and researchers."

[http://www.techcrunch.com/2009/04/30/the-wolfram-alpha- demo-...](http://www.techcrunch.com/2009/04/30/the-wolfram-alpha-demo-returns- this-time-with-actual-footage/)

<comment><USER3> You overlook the main difference: Alpha's answers are structured. So, it may be possible to build something on top of it, once API is out.

<comment><USER4> I could see a lot of value in have a consistent interface and features (sortable columns, zoomable graphs, filters etc.) and reliable data sources.

Wikipedia articles are often condensed information that is on google, but the condensing it's self is useful.

</comment></comment></comment><comment><USER5> Looks like it has great potential. I hope there will be an API and am really looking forward to trying it out. The dynamic parsing aspects of it are what appeal to me. Some searches I plan to try when it's live;

(some company) revenue - and I hope to get graphs for past years, and a pie chart for the current year, given that all that info is in a [public] company's 10k filing.

Napoleon relationships - hopefully I should get a tree showing positive affiliations with Josephine & others, negative ones with Wellington & others, and ambiguous ones with with Talleyrand etc.

I can think of a lot of others, but I'm keeping my mouth shut in case they have commercial mashup potential :-) I hope there will be an API or licensing terms which offer a low barrier to commercial entry.

</comment><comment><USER6> I haven't watched the demo video yet... but looking at the screenshots, I'm pretty sure I could see using this as a third knowledgebase alongside Google and Wikipedia for those "I wonder how many..." or "What's the per-capita indcident rate of..." type questions that come up.

Looking forward to playing with it whenever it comes out.

</comment><comment><USER7> Google killer? hmm maybe Ask Jeeves killer would be more accurate. Only problem being that Ask Jeeves died already.. Watching them build the racks out was fun though.

<comment><USER8> Not a Google killer, but a Google augmenter. Like Wikipedia.

This is a completely separate service, and from what I can see, it's going to absolutely rock in its domain.

</comment></comment><comment><USER9> This article made me go back to Wikipedia again and figure out how the whole "removed" nomenclature system of kinship works.

</comment><comment><USER10> _"uncle's uncle's brother's son"_

I'm always confused by familial relations. The diagram seems biased to maternal grandparents (assuming square/circle is boy/girl) - an uncle could also be on the father's side. Also, your "uncle's brother's son" could be you.

I'm pretty sure they discussed these alternatives (and probably deliberately chose this very example as an excuse to do so.)

<comment><USER11> What I want is what these relationships are in Hindi so I stop calling relatives by the wrong title.

</comment></comment><comment><USER12> so I wonder if practical queries like "How do I implement pagination in a django template?" will yield a graph also? Doesn't seem to be any examples of them doing a search on something anyone will want to look at except for idle curiosity. In that regards I think yahoo is closer to being the "google killer"

</comment><comment><USER13> I'm not a big fan of the name used for the product, but the tech is great.

</comment><comment><USER14> The semi-closed demo was far more impressive, but I am not sure to what extent it was secretly scripted.

</comment><comment><USER15> Ask HN:

Q1. How much woukd you value Alpha today?

Q2. Should Google buy them right away before they get too big?

A1: $2B

A2: Yes

</comment><comment><USER16> Aww, look at their datacenter, it's so cute!

Seriously, I can see why they're so cagey about when it'll go live, if they let The Internets onto six racks of machines doing un-cacheable, potentially expensive computations they'll pull a Cuil.</comment>


Show HN: peek – A new social platform that allows you to create and share events - <AUTHOR> http://getpeeking.com <comment><USER2> I created 2 events on FB yesterday and what really annoyed me was that i couldnt select FB Live as the location so people knew where to go at the time of the event. The location options are always limited. Do you have something that will cover that

<comment><AUTHOR> Yeah, you can create events at any location. All the events you make are 100% public. Whenever you make an event, people can view it on the map.</comment></comment>


Why So Many of the World's Best Companies Are Run by Indians (2015) - happy-go-lucky https://foreignpolicy.com/2015/08/18/why-are-so-many-of-the-worlds-best-companies-run-by-indians-google-sundar-pichai/ <comment><AUTHOR> These are companies that already have solid foundations and have had strategic roadmaps built out for years. Both companies are still guided behind the scenes by founders or predecessors. That being said, there are tons of companies that are founded by immigrant Indians in America. The reason can't do the same in India is because 1. Extreme corruption 2. Uneven playing field 3. Complete breakdown of rule of law / IP.</comment>


Show HN: Roomchat – No signup instant custom chat rooms - <AUTHOR> http://roomchat.co

<comment> mike-cardwell XSS by writing the message:

      <i<script></script>mg src="#" onerror="alert(1)">

Just stripping out tags doesn't work. Stripping out the script tags there simply ends up creating another new tag. You need to understand and implement proper escaping.

</comment><comment><USER2> Cool! Looks like HTML injection isn't blocked whatsoever. With chat messages being loaded as people enter, it could lead to someone exploiting everyone that enters your site.

<comment><AUTHOR> Ha, good catch! It's just a toy at this point, but we'll fix that asap.

</comment></comment><comment><AUTHOR> We created this in Meteor.js, pretty fun. Great for short term chat rooms that don't need a sign up. Would love feedback!

</comment><comment><USER3> Please fix it : <IMG SRC=# onmouseover="alert('xxs')">

</comment><comment><USER3> People ... It still has XSS issues ..</comment>


The entire win32 API in JavaScript - <AUTHOR> https://gist.github.com/3361208 <comment><USER2> What appears to be missing is the automatic mapping of the A (ansi) and W (wide) suffixed function names to conventional unsuffixed function names. In C, this is done using macros. If UNICODE is not defined, the macro MessageBoxEx would expand to MessageBoxExA. With UNICODE, the macro expands to MessageBoxExW. Similarly, TEXT is used to wrap strings to ensure they're unprefixed or prefixed with an L respectively. You could do this by hand, it's just a bit more tedious to write.

<comment><USER3> One would wish these distinctions could be forgotten with calling the Win32api from JS. However, that is a pipe dream and could have an impact on performance.

<comment><USER2> You can forget the distinctions without impacting performance if your JavaScript engine uses UTF-16, because that's the native encoding of Windows NT 5.0+. You'll still get overhead when working with binary data, Typed Array or not.

</comment></comment></comment><comment><USER4> This is fascinating, but I just can't discern a practical purpose.

The novelty of the "I just converted this huge piece of software written in c or machine code into JS" type of post usually extends only to the title. The link itself generally serves only to evoke a profound "WTF" (and in this case took upwards of 40 seconds to load.)

Although I appreciate the undertaking of compiling prodigious libraries, drivers, etc. into JS, I don't see practical value in the product of said undertaking.

The fact that this practice has proliferated throughout HN recently is odd. This kind of thing is certainly remarkable, but it doesn't do anything.

<comment><USER5> You're 100% right but you're missing something here. Something like this takes skill and builds skill and when you've finished you just want to show it off. And it really is impressive! Sure, it has no practical application itself but I'm sure that some piece of this or some technique used in porting it to JS will have some practical value somewhere. Sometimes the practical is born from the impractical.

I guess what I'm saying is why does it need to do anything or be practical? Cool stuff is just cool sometimes.

<comment><USER6> Windows script host (cscript) allows you to execute js files in addition to vbscript (vbs). This is particularly useful in extending the functionality of batch files. This can be useful in a lot of circumstances build process, installation etc.

<comment><USER7> This is for Node.js, not host scripts. It uses node-ffi.

</comment></comment></comment></comment><comment><USER8> I want to put a reminder that Windows itself provides a lot of background command scripting via WHost

[http://www.microsoft.com/resources/documentation/windows/xp/...](http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en- us/wsh_overview.mspx?mfr=true)

Things like accessing namespace folders, creating shortcuts, etc are easier through this WHost interface than the raw API.

</comment><comment><USER9> Can someone please explain what's the purpose of this JS code?

<comment><USER10> The author of this gist is also one of the developers of <http://appjs.org/>. It looks like they may be related.

</comment></comment><comment><USER11> Nice! Do you have a quick example you could share?

<comment><AUTHOR> This is the beginnings of a wrapper around various windowing Apis to create a Window class <https://github.com/Benvie/node-Windows/blob/master/Window.js>

This is the beginnings of a windows registry library <https://github.com/Benvie/node-winreg>

This is an example of creating a windowless event loop in order to create a low level keyboard/mouse hook <https://github.com/Benvie/node- Windows/blob/master/input.js>

<comment><USER12> This is a fine example of what hacking is about.

Thank you for publishing this.

</comment></comment></comment><comment><USER13> Was this generated with Clang? I hope it was not written by hand...

</comment><comment><USER14> Sshhhh...don't let this individual know that Windows 8 API, Windows Runtime (RT), is available in JavaScript.

That said, WinRT doesn't expose Win32 API. Well done. That takes dedication, skill, and lack of sanity.

> Edit WinRT API link: [http://msdn.microsoft.com/en- > us/library/windows/apps/br21137...](http://msdn.microsoft.com/en- > us/library/windows/apps/br211377.aspx)

</comment><comment><USER15> I'm more interested in how this was automatically generated rather than in the end product itself.

<comment><USER13> Possibly with <https://github.com/tjfontaine/node-libclang>. I'm actually working on a node module that will automatically parse header files using libclang and make native dynamic libraries available with no configuration required on the end of the developer. It will eventually be part of <https://github.com/olalonde/better-require> if you're interested.

<comment><USER16> How about pure JS PEG generated parser instead of clang? <https://github.com/xdenser/node-ffiCparser> though that is not finished yet

<comment><USER13> An didn't know about this, looks great. Would you be interested in helping me write an add-on for better-require? Anyways, I'll try it out and see how it works out.

</comment></comment></comment></comment><comment><USER17> What is the overhead of using FFI in this case vs going with a native c/c++ module ?

</comment><comment><USER18> s/in/wrapped in/

</comment><comment><USER19> Not sure what the point of this is.. can someone enlighten me?

<comment><USER20> This brings plenty of low-level (or higher level) method call and related structure definitions for Windows.

You can for instance get processes informations, start a wave sound, and many more.

Scroll down to the middle to see API calls.

One use-case is using CoffeeScript or JavaScript to write tools that would benefit from these calls (could be system tools, or not).

</comment></comment><comment><USER21> Still no cure for cancer...</comment>


Ask HN: Does anyone actually use clear glass as a "whiteboard" IRL? - <AUTHOR> I know in pop culture you aren't a really cool coder/hacker/statistician/accountant? unless you do your brainstorming/calculating on a clear glass "whiteboard" but do people actually do this IRL?<p>http://www.fandango.com/movie-news/watch-ben-affleck-in-new-the-accountant-trailer-751147 (see pic in article) <comment><USER2> Yes, we have done two offices with paneled glass as whiteboards.

We have a fabrication studio run by the owner's brother, who made the wood paneling, and attached runners for holding dry erase markers, and erases.

[http://i.imgur.com/sJkFhXp.jpg](http://i.imgur.com/sJkFhXp.jpg)

</comment><comment><USER3> My office had a glass door. I used it as a whiteboard extension all the time. For those who don't know what a 'door' is, it is a thing to improve productivity. Think of it as an effective noise-cancelling device.

</comment><comment><USER4> yes, on the window of the office.</comment>


The pain that minimal version selection solves - <AUTHOR> https://about.sourcegraph.com/blog/the-pain-that-minimal-version-selection-solves/ <comment><USER2> It does solve that pain.

But it doesn't solve the "A dependency of a dependency has a massive security hole in it, and there's a patched version which has just been released" pain.

Which I'd argue is more important.

<comment><USER3> Here's a problem MSV guards against: a new checkin in a dependency introduces a massive security hole and it silently gets pulled into your project.

The "security issue" argument is bogus because while new code can fix bugs it can also introduce new bugs.

Every competent dev shop has code reviews.

A code review exists because you don't trust your coworkers to not introduce bugs.

But somehow you're ok with people you don't know to effectively check in code into your code base without as much as running a smoke test.

<comment><USER4> > […] silently gets pulled into your project.

The core issue that caused all of OPs problems was that Renovate Bot claimed to have only updated one dependency (@sourcegraph/codeintellify), but also updated another, unrelated one (sanitize-html). If you can't trust the tools around you not to lie to your face, all bets are off.

It doesn't matter whether our tools follow MSV or the opposite (LSV – Latest Version Selection?). We should always pin our dependencies to exact versions, and explicitly update them as needed. Renovate Bot (and its alternatives) attempt to automate that part. They send you notifications or even open pull requests, you can inspect the changelog of your dependencies and decide for yourself if the update is necessary (eg. because of security reasons) or if you prefer not to update out of fear of breaking something. Right now it seems Renovate Bot sucks at that, and should be improved accordingly.

<comment><USER5> Renovate Bot didn't do anything special. It ran exactly the same npm command that I would have run on the command line (update the single dependency), which would have produced the exact same result.

<comment><USER4> > Renovate Bot didn't do anything special.

Maybe it /should/ do something special though. Maybe it should stop using npm.

If it says "I updated package X" and it really updated X /and/ Y, then it didn't do what it promised. Maybe it should say "I updated package X and maybe also others I don't know…" that would be more accurate to how it currently works.

<comment><USER5> This pain isn't really about Renovate Bot. You can pretend that it doesn't exist or that your project isn't using it. I should still be able to update a single dependency without updating unrelated things.

</comment></comment></comment></comment></comment></comment><comment><USER6> > avoids solving Version-SAT, which is NP-Complete

This is just a terrible argument. Sure the problem is NP-Complete to find an optimal solution for the general case, but you don't need to do that. You need to find a good-enough solution for the cases that people actually use. Heuristics for that problem are plenty fast and even finding the optimal solution is fast enough for most of the problems people are actually trying to use.

<comment><USER7> Yeah, this argument is ridiculous. It's like arguing that people shouldn't have individual homes with garden because lawn mowing is NP-complete…

(Not that I'm saying individual homes are a good idea in general, but the NP- complete argument is pretty dumb).

</comment></comment><comment><USER8> This isn't really about minimal version selection. It's about how it is bad for your code to change behind your back ... which is a much more general and widely-applicable point.

<comment><USER9> right.

>Renovate Bot noticed that there was a new version of codeintellify so it helpfully created a pull request to update our main repository to codeintellify 3.6.0.

while this sounds really cool and I'll check it out later, automatically updating your code just because a dependency has a new version seems like a REALLY bad idea.

<comment><USER5> It doesn't happen automatically if you don't want it to (and it didn't happen automatically in this case).

The value here is that it notifies you if an update is available (by opening a pull request), automatically tests the new dependency (when CI runs on your pull request), and makes it easy for you to apply the update if you want (by merging the pull request).

</comment></comment></comment><comment><USER10> It looks like the major problem was that NPM updated an inrelated package, despite a lock file. I would classify this as rather unexpected behaviour. I don't see why that's relevant to dependency resolution in situations where there's no lock file.

<comment><USER11> The fix for this problem is not a whole new philosophy of version selection, it's being more sensible in implementing the current one.

Do any of Yarn, Bundler, or Cargo have this behaviour?

<comment><USER12> Yarn has the same issue (it used to do shallow updates, but this was changed due to community demand, and now theres the demand to change it back again)

</comment></comment></comment><comment><USER13> This is the opposite of the monorepo philosophy: everyone always uses the most recent version of the code to minimise hassle. I wonder if minimal version selection works nicely initially, but becomes more of a hassle over time because you're basically procrastinating on moving to newer versions of your dependencies. On the other hand, package managers should not _silently_ upgrade packages behind your back.

</comment><comment> ainar-g >I was upset because the design of NPM assumes things that just aren't true in general:

>People perfectly understand and apply semantic versioning (see also: compatible versioning).

Doesn't _any_ dependency management tool assume that _some_ form of versioning is followed strictly? Go modules have another assumption besides that one, the Semantic Import Versioning principle.

I understand OP's pain, but it seems to stem from bad design decisions made by NPM authors, and doesn't have a lot to do with Minimal Version Selection.

<comment><USER5> NPM specially assumes that "patch versions are safer to update than minor or major version". MVS doesn't make that assumption.

> it seems to stem from bad design decisions made by NPM authors

Yep.

> doesn't have a lot to do with Minimal Version Selection

The pain I experienced has nothing to do with MVS (because npm doesn't use MVS). The observation of the post is that my pain would not have happened with MVS. No more, no less.

<comment><USER12> > NPM specially assumes that "patch versions are safer to update than minor or > major version".

I don't see where that assumption is baked into npm - the creator of a package declares the dependency constraints, so they are the ones making the choice which versions can be trusted well to work. You could pin all dependencies but then users would need to download tons of duplicate dependencies because of slight version differences everywhere. So it's a tradeoff, but the user makes it, not npm.

<comment><USER5> Rephrased:

npm's design incentivizes projects to assume "patch versions are safer to update than minor versions are safer to update than major versions" to avoid dependency duplication.

Such incentives do not exist with MVS because all that is required is a total ordering and there is no duplication within a major version of a module.

</comment></comment></comment></comment><comment><USER14> How about if we had a feedback loop between the the continuous integration/delivery system and the dependency version lock file?

It would probably be very difficult to set up, but I imagine it could start by testing the minimal version, and if that works well, then do a binary search to find the latest versions of all dependencies that still work well. In the case of an exception stack trace, it could perhaps find the offensive dependency quickly, but even if not, a brute force binary search should still work.

<comment><USER15> I think that once such systems are set up and have reached parity with the most recent releases of dependencies, the business of keeping up is much easier, which makes it more likely to happen.

We've all been in the situation where we fell behind some dependency and, upon trying to upgrade, found that we were so far behind that everything was broken in this-will-take-weeks-to-fix ways. That kind of work tends to get shunted into the too hard pile, where it generally only gets harder. Eventually the codebase ossifies around a very particular dependency set that can't be upgraded without stopping feature development.

The fact that it may be carrying a stew of published vulnerabilities tends not to be enough to trigger a change: work to upgrade is concrete, immediate and costly. Exploited vulnerabilities are probabilistic, sometime in the future and not taken from the current budget.

In practice stuff is kept up to date by rigid process discipline or by automation. Of the two, automation is more likely to be successful and _sustained_.</comment></comment>


Easy Fix For Software Patents Found In US Patent Act - <AUTHOR> http://yro.slashdot.org/story/12/09/14/1339255/easy-fix-for-software-patents-found-in-us-patent-act?utm_source=slashdot&utm_medium=facebook

<comment><USER2> Reducing the number of patented algorithms does not solve the fundamental problem, which is that algorithms are patentable. Letting people reserve pieces of mathematics for their private use is and will always be a disaster.</comment>


Google and Coursera launch a new machine learning specialization - <AUTHOR> https://techcrunch.com/2018/05/23/google-and-coursera-launch-a-new-machine-learning-specialization/ <comment><USER2> At this point it's just another day, another ML course...</comment>


You Have Two Cows - <AUTHOR> http://en.wikipedia.org/wiki/You_have_two_cows

<comment><AUTHOR> Here is a good example: [http://www.tickld.com/x/capitalism-explained-this-is- so-accu...](http://www.tickld.com/x/capitalism-explained-this-is-so-accurate- it-hurts)</comment>


3 Little Known but Useful Vim Tips - <AUTHOR> https://dev.to/jovica/3-little-known-but-useful-vim-tips-1pbg <comment><USER2> That's actually really useful but I'm just gonna say it:

#1. use emacs</comment>


The iPhone Economy - <AUTHOR> http://www.nytimes.com/interactive/2012/01/20/business/the-iphone-economy.html

<comment><AUTHOR> Credit to ivanzhao <http://news.ycombinator.com/item?id=3494442> \- I thought this was so good it deserved a link of its own.</comment>


Nintendo, One Year Later - <AUTHOR> http://ignorethecode.net/blog/2014/10/30/nintendo_one_year_later/ <comment><USER2> In a would where companies just release their old (very successful) games on mobile devices with awful touch screen controls hacked in I am so glad Nintendo do not do that. Sure it would make them some money to sell Mario on the iPhone but god damn is it a horrible experience IMHO.

Nintendo have good years and bad years. The Wii U wasn't the success they hoped it would be. But they took a chance with the Gamepad. That is what I like about Nintendo, they do things differently. Sometimes it works sometimes it doesn't.

Now give me a 1080p60 F-Zero game on the Wii U please :)

<comment><USER3> > they do things differently

Only the Nintendo of recent years. They were famous for NOT innovating much before. The SNES was just another 16 bits console (albeit quite powerful), the N64 did not even ride on the CD technology, and the Gamecube did not have much points of differentiation versus the Xbox 1 or PS2.

<comment><USER4> I'm not sure that's really fair.

\- Nintendo experimented with a CD add on (with Sony) for the SNES. It eventually became the Playstation. \- They released the Double Density Drive addon for N64 (probably a failure). \- Mario 64 was the first really 3D platformer, and was groundbreaking. \- The weird looking controller for the N64 had an analogue stick before anyone else. \- Rumble packs \- N64 came with four ports for four-way split screens

They're just off the top of my head.

<comment><USER5> It's not fair. Nintendo has a long history of innovation. They may not have foreseen every shift in gaming, but absolute prescience isn't a pre-requisite for innovation.

In the cases where Nintendo "lagged" others, it was mostly for good reasons; an example is the shift to optical media, which Nintendo resisted because they didn't want the user to have to wait for load times. Ultimately, cartridges were proven to be untenable long-term, but that doesn't mean Nintendo was "not innovative" in their principled choice to prioritize user experience over giving game devs extra space.

</comment></comment></comment></comment><comment><USER6> Nintendo (IMHO) is missing out on a huge potential revenue source by not releasing its old IP on a Windows/Mac/iOS/Android version of the virtual console. Sega seems to have been at least mildly successful re-releasing Genesis era games on these platforms. Do they really feel re-releasing something like say Super Mario Bros. 3 (NES) for iOS would detract from Wii U sales?

Nintendo has the best back catalog in the industry, and with today's microprocessors, emulation makes that catalog fully portable.

<comment><USER7> I'm fairly certain that Nintendo is simply scared to release their IP on a platform that they do not control. The last (and only) time they did was the Phillips CDI which they now entirely cease to acknowledge. That and the fact that their IP drives the sales of their hardware.

<comment><USER8> It's almost as if Nintendo and Apple have very similar cultures that cause them to always act as iconoclasts, choosing formats and channels different from their competition, and betting big on innovation. It's remarkable how both the original Wii and iPhone were both released within a year of each other. What I don't understand is why both companies like to use the same distinctive off-white color. Maybe it makes their products look like porcelain, something classical and timeless.

<comment><USER9> Yeah, I have always chuckled at the irony that the apple followers criticize Nintendo for not releasing its IP on other platforms. Because, of course, I can install OS X on my custom computer and Safari on my Android.

The strategy of Nintendo makes as much sense as Apple's, and anyway, I have always though that it is far more likely for Nintendo to launch an Android smartphone where you could play their games (And only there).

</comment></comment></comment></comment><comment><USER10> > I think it's fair for Apple writers to complain about the fact that a lot of > people who have no clue about how Apple's business works make crazy > pronouncements about what Apple should do. But I do think that they should > measure their own expertise by the same yardstick.

John Gruber is very guilty of this. He understands Apple very well, knows how they work, and how they think. But every time he discusses Nintendo, I see the same mistaken thinking about the company that, were a similar mistake made about Apple, would earn a "filed for future claim chowder". Like Apple, Nintendo does things differently than its competitors. But that doesn't mean that they do things similarly; nor do they face the same challenges.

</comment><comment> eden-san Consoles are very likely to thrive for the next generation. China finally lifted the ban on game consoles and I'm starting to see Xbox One / PS4 being sold in different retail stores.

Even though it's still a tough sell for most Chinese (remember, no one pays for games here, at least not upfront), they'll come around.

</comment><comment><USER11> Mario Kart 8 is an curious example to cite. The game was sold with a free download of another game - and choices included many top tier first-party titles. That's a very unusual tactic. It's a great game, but I'm sure this will have been a big driver for sales.

I wonder if the tallies for the other games (e.g. NSMB-U, Nintendoland, Z:WW) include those sold as a pack in, or free download?

[http://en.wikipedia.org/wiki/List_of_best- selling_Wii_U_vide...](http://en.wikipedia.org/wiki/List_of_best- selling_Wii_U_video_games)

<comment><USER12> You're right, I forgot about the fact that it was "bundled" with an additional game. Personally, I only found out about this after I bought it; I'm not sure how much the bundling helped Mario Kart's game sales. But it's a fair point.

I didn't want to pick Nintendo Land because the way it was sold is not entirely straightforward. For example, some copies were bundled with a controller.

I didn't want to use NSMB or 3D World as examples because Mario platformers are often outliers when it comes to sales. I guess The Wind Waker HD would have been a good example, because it sold really well despite being an HD remake of an older game.

</comment></comment><comment><USER13> Hahaha, I'm going to read the rest of the article but am I the only person having trouble taking the author seriously after the opening sentence where the other takes seriously the idea that Nintendo just make iOS games? Enough so to lead a post by addressing it?

<comment><USER14> You do realize that the second sentence was "I thought, and still think, that this would be bad for the quality of Nintendo's games, and bad for their bottom line", right? Or are you trolling?</comment></comment>


Bill Murray on taking chances and saying "No" - <AUTHOR> http://ninjasandrobots.com/bill-murray-on-saying-no-and-taking-chances

<comment><USER2> _Interviewer, Scott Raab: A lot of folks worry that if they aren't available or don't say yes, they'll stop getting asked.

Bill: If you keep saying yes, they'll stop asking you, too. That's a much more likely event._

I don't know if the conclusion is for everybody to start saying 'no' more. Doesn't it depend on where you are? I know friends I stopped asking to hang with because all I have gotten is some form of repeated 'nos' in past. On the other hand, I have very few friends I stopped hanging with because they said too many 'yes' and I'm not sure if the reason was that they kept saying 'yes'.

Now, there are definitely times when you are saying too many yesses but in general, I think more people would do better by saying 'yes' than 'no' in their life.

To actually know whether you should be saying more of 'yes' or 'no' for yourself requires a much more nuanced evaluation than this generic post could offer.

<comment><USER3> In the interview he's talking specifically about saying "Yes" or "No" to an acting job.

If he says "Yes" to everything he'd be in a lot of terrible films. This could be a detriment to his career.

I think it's a completely different situation when you're talking about whether or not you hang out with a friend. In that case, I'd agree with you.

</comment></comment><comment><USER4> This guy should take an intro level improv comedy class. If BFM's quote was that inspiring to him, he's got a lot of learning yet to do.

As a comedian and an entrepreneur, I can say there are many overlaps between the two, and the willingness to take bold steps is just one of them. Another is to trust your team members. Another is to build on others' ideas, not tear them down. And many more.

<comment><USER5> _Everyone_ should take an improv class, in secondary school and again in college.

Like the bard said, everyone's an actor; most people are just really bad ones. Knowing how your own facial expressions, gestures, voice and words really work is a crucial survival skill in human society, and one which you are very unlikely to pick up without a little training.

<comment><USER6> > Knowing how your own facial expressions, gestures, voice and words really > work is a crucial survival skill in human society

You may want to rephrase this. I'm willing to accept it's useful, but it's clearly not a survival skill or there would be a lot of dead nerds out there.

<comment><USER5> I expect you're being downvoted for your derogatory and inaccurate use of "nerds"-- I know several theater nerds who are phenomenal actors.

<comment><USER6> Thanks. I meant nerds in the common meaning, derogatory or not. Let's try again and elaborate in more neutral terms:

I'm willing to accept it's useful, but it's clearly not a survival skill or there would be a lot of dead people with weak social skills but otherwise reasonably successful white collar lives out there.

Very very few cog-in-the-machine can't-talk-to-people tech people that otherwise lead reasonably comfortable middle class lives in our current society _die_ because they don't know their own facial expressions, gestures, voice, or words.

<comment><USER5> In that case, I'll readily admit I was using "survival" in the hyperbolic sense of "NYC survival skills" than the literal sense of "wilderness survival skills". I'll downgrade it to "crucially significant determiner of success" if that's easier to stomach :)

<comment><USER6> And I'll again point out that most cog-in-the-machine can't-talk-to-people tech people are successful by the standards of majority of North Americans, let alone the world :)

<comment><USER5> I never said it was the sole determiner. If you can't talk to people but you can do tech, you can do all right for yourself; if you can talk to people and you can do tech, you can write your own check.

People in tech need this _most_ \-- we're way too willing to write off the _primary_ importance that other people have in our lives.

<comment><USER6> This is getting silly, but: what percentage of cases of success would you say should exhibit a crucially significant determiner of success?

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> I'm sorry -- is this really a "great quote"...?

 _"The essence of design lies in the process of discovering a problem shared by many people and trying to solve it."_

Just seems kind of obvious to me.

<comment><USER8> Yeah, fairly obvious.

Design is about delivering to a brief. Not necessarily discovering a problem, or necessarily a problem many people have.

"(noun) a specification of an object, manifested by an agent, intended to accomplish goals, in a particular environment, using a set of primitive components, satisfying a set of requirements, subject to constraints;"

It's really hard to judge a design without knowing the circumstances behind it. That is the first clue that someone does not really know about design - they will judge some design where they know nothing about the goals, constraints, or requirements.

</comment></comment><comment><USER9> Probably should have taken his own advice when it came to Garfield.

<comment><USER10> He thought that was a Coen Brothers movie: [http://www.vulture.com/2010/07/bill_murray_only_did_garfield...](http://www.vulture.com/2010/07/bill_murray_only_did_garfield.html)

<comment><USER11> Err, that's him being funny. No one at his level just has chats on the phone and has contracts written up and walks into a studio to do lines.

He saw a paycheck and took it. Come on, a brooding Garfield movie by the Coen brothers?

<comment><USER12> Joel Cohen (Garfield) is different Joel Coen.

<http://www.imdb.com/name/nm0169505/>

<http://www.imdb.com/name/nm0001054/></comment></comment></comment></comment>


Developer! Are you looking for the freedom you will never have in your company? - <AUTHOR> https://medium.com/taikai/developer-are-you-looking-for-the-freedom-you-will-never-have-in-your-company-fed91d5fa706 <comment><USER2> Nice article. I totally agree with you. I think the corporate and the startup world are completely different and people now can have a choice.</comment>


Comet is dead, long live websockets - <AUTHOR> http://armstrongonsoftware.blogspot.com/2009/12/comet-is-dead-long-live-websockets.html

<comment><USER2> I find articles like this annoyingly premature. Sure, we're seeing the birth of a whole new way of communicating with the backend, which will only server to improve web apps in a positive manner.

At the same time though, support for WebSockets in major browsers is woefully little, with only Chrome currently supporting it in an active "release," and (I believe) support available in the Firefox trunk for a later version. This still doesn't account for Safari or Internet Explorer, the latter being the biggest impediment to adoption.

Additionally, I certainly don't think this is the beginning of the end for "AJAX" — not in the least. AJAX still has very strong grounds in pulling down data from the server that doesn't require some sort of long-running communication.

Yes, let's get excited, but a little bit of a sanity check should be done if you're ready to call AJAX "dead" (or "dying").

<comment><USER3> I agree with you, but why can't this be used as an excuse to kill internet explorer?

It seems that IE has been a consistent impediment to web based technologies for upwards of 10 years now. There have been so many other things that have been horribly crippled because 'internet explorer doesn't support it'.

People are becoming more and more savvy from the standpoint of computer use, and putting up a redirect to install a new web browser... like Chrome or Firefox... is something the majority of people should be able to handle/understand.

I'm tired of waiting 10 years to actually use the technology that we have /today/.

<comment><USER4> Indeed. I can't believe the IE team hasn't implemented a standard whose draft specification is dated today. Why are they so fucking slow?

<comment><USER3> Whether or not you are serious, indeed they should have something in the works for a standard whose draft specification is dated today.

I think the bigger issue is that Microsoft doesn't bother adhering to standards;

Or they make up their own standards when there are already perfectly good standards that provide the same functionality;

Or they implement part of a standard, but certain stuff is completely wrong, and when it is pointed out, they don't do anything about it.

And then they force you to conform their arbitrary non-standard stuff, because they can bully you with their 70% market share.

This isn't just about being slow, its about their course history of being slow AND maliciously protectionist AND incompetent.

And they should get ditched if they continue to behave in such a manner.

<comment><USER5> Historically, Microsoft has put forth their own standards well before anybody else, only to see the official "Standard" be written differently by a 3rd party.

DOM, CSS, Box Model, Events, SVG, and a bunch of other things they did before anybody else (in a straightforward and reverse-engineerable way) were ignored by later groups who put together slightly incompatible "standards", some of which had no reference implementation. NN6, for example, was out for a full year before it implemented the W3C Events model that the Netscape team had proposed (which of course didn't exactly match the reference implementation that IE5 had in place 2 years earlier).

It's only recently that the Standards folks have managed to spec out things that the IE group hadn't done yet.

</comment></comment></comment></comment></comment><comment><USER6> Nobody seems to mention this but you can have HTML5 WebSockets on legacy browsers today via Orbited, <http://orbited.org/>.

<comment><USER7> Ok, I've never worked with Orbited. But I looked at the site, through the examples, and through the documentation, and I see nothing about being able to use WebSockets on, say, IE7 or Safari.

Orbited looks like an event-driven webserver, which is nice and all, but it doesn't magically give WebSocket functionality to legacy browsers.

<comment><USER8> Orbited functions as a proxy which lets you use a raw socket on your server end to communicate through the black-box Orbited in the middle to a JavaScript API that looks roughly like the WebSocket API. So as far as you as a developer are concerned, the code you have to write is about the same as if you were using WebSocket directly.

</comment></comment></comment><comment><USER9> I love websockets, and have been waiting for them for a long time, however I am severely disappointed that there is no way to elevate permissions from the same origin "security" model, this is a huge limitation on the way towards purely client side javascript applications.

html5 introduced crossdomain requests for xhr because it already proved to restrictive, and flash introduced crossdomain.xml.

I wish w3c stopped pretending that in order to stop people from doing nasty stuff, you have to stop everyone else from doing anything (also looking at you, clipboard)

<comment><USER10> WebSockets have been capable of cross-origin communication since day one. (see: [http://tools.ietf.org/html/draft-hixie- thewebsocketprotocol-...](http://tools.ietf.org/html/draft-hixie- thewebsocketprotocol-66#section-8.4)) _"The |WebSocket-Origin| header is used in the Web Socket handshake. It is sent from the server to the client to confirm the origin of the script that opened the connection. This enables user agents to verify that the server is willing to serve the script that opened the connection."_

<comment><USER9> yes but at nowhere in the specification does it say that either the client or server is allowed to modify the origin from the actual origin you are serving / being served from.

This may be part of the specification that I am missing, but it seems to suggest that its using exactly the same origin model as original xhr, which is my complaint

as [http://tools.ietf.org/html/draft-hixie- thewebsocketprotocol-...](http://tools.ietf.org/html/draft-hixie- thewebsocketprotocol-66#page-7) suggests

"The Web Socket protocol uses the origin model used by Web browsers to restrict which Web pages can contact a Web Socket server when the Web Socket protocol is used from a Web page."

and [http://tools.ietf.org/html/draft-hixie- thewebsocketprotocol-...](http://tools.ietf.org/html/draft-hixie- thewebsocketprotocol-66#page-4)

"The first three lines in each case are hard-coded" (referring to the origin)

<comment><AUTHOR> The spec allows the server complete discretion to accept or reject cross- origin requests. Only the origin in the request (sent by the client) is defined in terms of the originating web page; it's left entirely up to the server to decide whether or not to allow requests from any given origin. The spec talks about the server being "willing" to respond to requests from different origins, and explicitly mentions that it may support multiple origins ( _"This is why the server has to send these strings: to confirm which origins and URLs the server is willing to service"_ ).

This is basically the same as the Cross-Origin Resource Sharing spec, another W3C spec supported by some current browsers:

<http://www.w3.org/TR/access-control/>

> _"The first three lines in each case are hard-coded" (referring to the > origin)_

No, the three hard-coded lines of each handshake part come _before_ the origin headers:

            GET /demo HTTP/1.1
            Upgrade: WebSocket
            Connection: Upgrade
            [...]

            HTTP/1.1 101 Web Socket Protocol Handshake
            Upgrade: WebSocket
            Connection: Upgrade
            [...]

<comment><USER9> the problem isnt the server, http servers right now can serve webpages to any client, its wether the client will allow the connection, as they dont with xhr

from a guess at the fact they specifically say they use the existing same origin policy, they cant, but the confusion is cleared up with a simple test, I will check tomorrow

<comment><AUTHOR> This is a way for servers to opt in and tell the client to allow cross-domain requests, just like crossdomain.xml or CORS.

I haven't tried it myself with web sockets yet, but I've done some experiments with XHR+CORS (almost the same protocol, except for different names of the response headers) and it does work cross-origin on recent Gecko and WebKit browsers.

UPDATE: Ran a quick test using the current Google Chrome beta for Linux and standalone.py from Google's mod_websocket, and successfully opened a cross- origin WebSocket connection, just as described in the spec. mod_websocket will authorize requests from any origin by default; there's a sample handler included that shows how to reject cross-origin requests on the server.

<comment><USER9> ok cool, if I stand corrected that would be awesome, cheers

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> I'm currently working on a Google Chrome extension that communicates with a Web Service to do some data saving and loading. Since I'm targeting Chrome, Web Sockets seem compelling vs AJAX, however I have no idea on where to start implementing this server side.

I'm using (puts on flame suit) IIS7. Are there any good tools or articles on getting Web Sockets running in IIS7. I'm a somewhat competent .NET developer, but I'm not a low level guy so something slightly above "For Dummies" would probably work best.

</comment><comment><USER12> I agree that WebSockets is definitely the way forward and that stuff like Comet are merely hacks. However WebSockets is still premature: only Chrome supports it right now and even the server protocol isn't finalized yet. And the biggest hurdle is of course IE...

</comment><comment><USER13> "the current AJAX technology imposes an enormous overhead since virtually all the time in the server is spend parsing HTTP headers."

Except for the times when that HTTP header tells you don't need to download some huge amount of data...

<comment><AUTHOR> Then it spends _literally_ all the time parsing HTTP headers. :)

</comment></comment><comment><USER14> Maybe when Microsoft implements Web Sockets in their browser 10 years from now, this might be applicable.

FWIW, I believe the proper usage is "X is dead, long live X".

</comment><comment><USER15> Comet is not dead because websockets is:

1\. too obvious handshake fingerprints for a firewall to block

2\. No passive mode

3\. Not supported by every browser.

<comment><USER10> WebSockets: 1\. Can use TLS 2\. The client _always_ initiates the connection 3\. Can be use the same API with a shim or comet underneath

</comment></comment><comment><USER16> Lots of talk about IE here, but IE users aren't the ones using these new fangled realtime webapps. Ignore IE. They can stick with comet.

</comment><comment><USER17> What's the chance this will get into IE?

<comment><USER18> It will, but not anytime soon.

</comment></comment><comment><USER19> Good riddens. Comet was the painful reminder of how little browsers have developed over the last 10 years. It may be a little late, but who doesn't like sockets?</comment>


Bitcoin Currency and GPU Mining Performance Comparison - <AUTHOR> http://pcper.com/reviews/Graphics-Cards/Bitcoin-Currency-and-GPU-Mining-Performance-Comparison

<comment><USER2> TL;DR - Expensive cards run faster, ATI/AMD > Nvidia for mining, Radeon 5830 most efficient in their testing.

It's a pity this article didn't look at a few other cards which would have been very competitive, namely the Radeon 5850's and 5870's. I've found my 5850's do very well, especially considering the performance/watt ratio.

<comment><USER3> I think there was more to it than that. It also came to the conclusion that a $130 video card (Ati 5830) can earn $540 a year.

A system costing $1710 could earn $5300 per year.

Assuming a $14 bitcoin that represents a 210% return on investment.

<comment><USER2> This, of course, is making a big assumption: that the difficulty factor will stay the same. It has consistently increased, making earning those bitcoins significantly more difficult.

Break-even for me occured at about 75 days for my 5850's, but also used a much lower difficulty (less than 5% of the current difficulty) for the beginning of that.

(difficulty over the past 2 months: <http://bitcoin.sipa.be/speed- lin-10k.png>)

</comment></comment></comment><comment><USER4> Valuations are still quite speculative and difficulty can increase by an order of magnitude. Still, if you're not using the GPU but still using the computer, you may as well throw in a miner as a low priority process.

</comment><comment><USER5> No print button? Don't really feel like running Instapaper on all 7 pages.</comment>