Railgun: a fast strstr(3)-like function - <AUTHOR> http://www.sanmayce.com/Railgun/index.html

<comment><USER2> Ugh. Licensed under "Code Project Open License":

[http://www.codeproject.com/info/cpol10.aspx](http://www.codeproject.com/info/cpol10.aspx)

Good luck figuring out what this is legal to use with.

<comment><USER3> There are several insane clauses to this license, but the worst is probably §5f, which states that:

        You agree not to use the Work for illegal, immoral or improper purposes,
        or on pages containing illegal, immoral or improper material.

Good luck figuring out what that even means.

</comment></comment><comment><USER4> Seems difficult to verify any of the claims made, are there comparisons to other algorithms? Any analysis? Description of the algorithm?

Maybe they're there and I missed them because the website made my eyes bleed.

<comment><USER5> He has a ton of benchmarks on that page:

        Searching for Pattern('an',2bytes) into String(206908949bytes) line-by-line ...

        strstr_Microsoft_hits/strstr_Microsoft_clocks: 1212509/544
        strstr_Microsoft performance: 248KB/clock
        StrnglenTRAVERSED: 138478024 bytes

        strstr_GNU_C_Library_hits/strstr_GNU_C_Library_clocks: 1212509/359
        strstr_GNU_C_Library performance: 376KB/clock
        StrnglenTRAVERSED: 138478024 bytes

        Railgun_Doublet_hits/Railgun_Doublet_clocks: 1212509/321
        Railgun_Doublet performance: 421KB/clock
        StrnglenTRAVERSED: 138478024 bytes

        Railgun_Quadruplet_8Triplet_hits/Railgun_Quadruplet_8Triplet_clocks: 1212509/335
        Railgun_Quadruplet_8Triplet performance: 403KB/clock
        StrnglenTRAVERSED: 138478024 bytes

        Railgun_Mischa_8Triplet_hits/Railgun_Mischa_8Triplet_clocks: 1212509/348
        Railgun_Mischa_8Triplet performance: 388KB/clock
        StrnglenTRAVERSED: 138478024 bytes

        BNDM_32_hits/BNDM_32_clocks: 1212509/505
        BNDM_32 performance: 267KB/clock
        StrnglenTRAVERSED: 138478024 bytes

        ...

<comment><USER6> Such a 'ton' of codes and dumps in that form is the problem in itself. George, if you happen to read this once, I hope you'll get what I mean.

</comment></comment></comment><comment><USER7> @StefanKarpinski

The article is licensed under CPOL, not the code. Railgun is licenseless, one developer working for Mozilla advised me to put it under BSD or public domain - which is guess what: just another license, all my etudes/tools/functions are 100% FREE, not as pseudo-copylefters understand and try to sell their "Free" \- which is ridiculous, especially the free beer part, if I am to share my joy with my buddies I buy beers and give them for free UNCONDITIONALLY.

The bottom-line: Railgun is people's choice 'memmem', if you ever face the possibility to go to jail, just call me I will tell the judges some copyleft sagas of my own, that is to educate them how university professors are funded with people's money (not only) and any derivate of those algorithms/implementations should follow the same licenselessness - a nifty word - everything else is just one perverted game for money, as I like to say hypocrisy in action.

Regards to all, and no, my endless dumps are not to obstruct the usage, quite the contrary - to provide field feedback - to give thorough comparisons, had I had more than one computer I would have dumped several times more stats.

Best, Georgi

<comment><USER2> Thanks for the clarification. The algorithm is very clever and the performance quite impressive. It would be great if the legal status of the code were clearer so that there was more chance of it making its way into usage by people. Saying that the code is "free" in an article is not really sufficiently clear to alleviate legal concerns people might have. The word "license" is never mentioned anywhere in the page, while the code project version [1] appears to state that the article and its code are under the very unfortunate CPOL. If you want to make this code public domain – which is great, btw – then I recommend that you put it up on GitHub (or BitBucket, or something) with a LICENSE.md file that explicitly states that it is "public domain". Use that phrase verbatim – it will greatly alleviate the uncertainty and doubt about its legal status. Thanks for the cool algorithm.

p.s. I fully agree that code from publicly funded academic work should be open source – ideally under a very liberal license like BSD or MIT.

[1] [http://www.codeproject.com/Articles/250566/Fastest-strstr- li...](http://www.codeproject.com/Articles/250566/Fastest-strstr-like- function-in-C)

</comment></comment><comment><USER8> That webpage is just wow...

It looks pretty awesome, I think it could be ported to PHP fairly easily.

</comment><comment><USER9> This site is faster and has some code: [http://www.codeproject.com/Articles/250566/Fastest-strstr- li...](http://www.codeproject.com/Articles/250566/Fastest-strstr-like- function-in-C)

</comment><comment><USER10> Do projects like this ever get included into the mainstream? Would this be an appropriate candidate for inclusion into PHP's standard library?

<comment><USER11> I would have hoped (but have no idea) that PHP simply uses libc's strstr in their implementation of strstr. If this is the case, then this would need to be included in the relevant libc for the platform you're using PHP on.

I was going to have that be my entire comment here, but I figured this was easy enough to check - so I pulled php 5.5.7 source, and because of option parsing complexities strstr ends up being implemented in terms of php_memnstr, which is a macro for zend_memnstr, which in turn calls memchr and memcmp repeatedly in a loop. So, no, libc's strstr doesn't seem to be used.

I'm a little unsure whether or why this has to be so complex, but after a quick dip the water doesn't seem inviting enough for me to follow up.

<comment><USER12> With regard to your comment about complexity, the cunning thing here is that these algorithms find a substring in a string very quickly, often without even looking at every character in the string.

For example, Boyer-Moore ([http://en.wikipedia.org/wiki/Boyer- Moore_string_search_algor...](http://en.wikipedia.org/wiki/Boyer- Moore_string_search_algorithm)) starts by looking at the end of the substring. If it finds a match, it searches earlier. If it does not find a match, it can skip ahead by several characters (possibly even the length of the substring, depending on how the match failed). How much to skip ahead is a bit complicated, but can be calculated in advance.

Consider searching for a substring consisting of 1000 'a's. Boyer-Moore starts by looking at the 1000th (1-indexed) character. If it's an 'a', it then walks back and checks the 999th, 998th etc. However, if it's not an 'a', it can immediately skip on to examine the 2000th character, i.e. only looking at 1 in every 1000 characters. As you can imagine, this can be very fast!

The Railgun implementation seems to be a combination of improved Boyer-Moore (Boyer-Moore-Horspool-Sunday) with Rabin-Karp (which uses hashing). My understanding is that these algorithms complement each other, so if you have an input string that is particularly inefficient with one algorithm, it automatically picks the other one.

Since many programs have string-searching in their innermost loops, spending some time optimizing this function can be worthwhile.

<comment><USER13> I think your parent was referring to why php's implementation is so complex.

<comment><USER11> Indeed. PHP is often criticized for having inconsistently named or patterned libraries, and the response is usually "PHP is a relatively light wrapper to a bunch of C libraries" \-- In fact I saw 3 versions of strstr in PHP core - strstr, mb_strstr, and grapheme_strstr. I guess I would have expected one of them to be a somewhat thin wrapper around libc's strstr.

As another commentator pointed out, libc's strstr assumes NUL-terminated strings. Maybe php's doesn't? Which seems a bit odd to me in light of the explanation of PHP's genesis as having roots in C, but stranger things...

I'm not surprised at all that libc's strstr would be complex.

</comment></comment></comment></comment></comment><comment><USER14> The site seems to be getting hammered, and once it loaded I struggled to read it due to the low-contrast font/bg-color selection.

Here is a gist of the code: [https://gist.github.com/jaytaylor/8102304](https://gist.github.com/jaytaylor/8102304)

<comment><USER6> The site has 5 MB of png files which show... well nothing relevant to the topic. And the content of the page is mostly unfiltered output of some strangely presented program pieces.

I would be glad to read that Sanmayce reads this or some similar input and then starts to think about making his output really more accessible. But I guess he likes it as it is. Bon Appétit.

<comment><USER15> "I would be glad that [webpage author] ... starts to think about making his output really more accessible."

This is how I feel when I hit a webpage that offers zero content without having to execute JavaScript in a browser first.

For whatever it's worth, this page loads in less than 1 second and looks fine in my text-only browser.

I guess in this case the web developer has chosen to recklessly punish users who never disable images or JavaScript, in the same way some web developers recklessly punish users who never enable such "essential features".

If the user's objective is to read and perhaps download some source code (as in this "article"), there is arguably no reason that images or JavaScript should be necessary.

"recklessly" here means the web developer does not intend to make users suffer but he knows some users will suffer if he makes a certain design choice and, knowing this, he makes that choice anyway

</comment></comment></comment><comment><USER16> Thought this was part of [https://www.cloudflare.com/railgun](https://www.cloudflare.com/railgun) at first...

</comment><comment><USER17> There are trade-offs it may be 'better' but it requires (I think) O(nm) space while something like two-way strstr requires O(1).</comment>


A general memristor-based partial differential equation solver - <AUTHOR> http://www2.ece.rochester.edu/~xiguo/gomac15.pdf <comment><USER2> Not the original paper but this explains in detail how this works. [http://www2.ece.rochester.edu/~xiguo/gomac15.pdf](http://www2.ece.rochester.edu/~xiguo/gomac15.pdf)

I would guess they are solving PDEs using systems of linear equations. The approximate solutions to these linear equations are found via the analog linear solvers.

<comment><USER3> Thanks, we changed the URL to that from [http://www.nature.com/articles/s41928-018-0100-6](http://www.nature.com/articles/s41928-018-0100-6) since the latter is behind a paywall without workarounds. (This is explained at [https://news.ycombinator.com/newsfaq.html](https://news.ycombinator.com/newsfaq.html) and [https://news.ycombinator.com/item?id=10178989](https://news.ycombinator.com/item?id=10178989)).

<comment><USER4> With respect (I didn't downvote you), there is a workaround: sci-hub (I checked that it is available there).

For others who want a comparison; the two papers are very different: the Nature paper uses entirely analog techniques to achieve high precision results while the newly-linked article is a mixed-precision approach. That is, the newly-linked article only uses analog to obtain a low-precision estimate which is fed back to a digital computing algorithm to produce the final high- precision result. The hope is that the overall time to solution is still faster because you do not need (hopefully eventually slower) digital computation to achieve the low-accuracy result. I am not an expert in this particular hardware field (I do applied math so I am used to solving the problems they do here in digital computers), but here is what the authors of the Nature article say:

> Recent theoretical and experimental studies have used memristor (including > phase-change memory) arrays to generate an initial, low-precision guess > (seed), and rely on an integrated high-precision digital solver to produce > the required high-precision solutions from the seed solution. Such types of > accelerators are certainly beneficial, as they reduce the number of > iterations required by the digital solver. Determining whether memristor- > based hardware can be used to directly perform high-precision computing > tasks, however, will enable a better understanding of how broadly memristive > hardware can be applied. Such knowledge will help pave the way to build more > general memristor-based computing platforms, instead of special-purpose > accelerators.

<comment><USER2> I have done graduate computational physics (Multigrid and such) So im familiar with the "digital" side of this but certainly not familiar with almost any analog computations. (beyond those trivial op-amp integrators)

</comment></comment></comment></comment><comment><USER5> The title is incorrect. It's not a general partial differential equation solver. The paper doesn't even claim it to be. The issue is that not all, not even most, PDEs can be discretized to a linear system of equations. Normally these need to be discretized to either a nonlinear rootfinding problem G(x)=0 find x, or a stiff ODE (normally solved by an implicit method, but not necessarily).

However, both of those problems do include a subproblem which is solving linear systems (when the ODE is solved implicitly), and so PDE solvers which take these routes will generally be able to be accelerated by an improved linear equation solver. Thus it's not an be all and end all algorithm, but when combined with the tools that exist for PDEs in something like PETSc or Julia then this can be used to give a more efficient algorithm for most PDEs (though there are still other PDEs where linear solving is entirely avoided, for example with exponential integrators or Runge-Kutta Chebyshev methods, which can be more efficient depending on the problem).

<comment><USER4> The link was changed from the original Nature article which has the original title. The new link is unrelated.

You're correct that the innovation is really about sparse linear algebra (though not just solvers) done in hardware. However the advantages are exploited not just by way of solving linear systems for implicit time- stepping. They implemented a Jacobi iteration in hardware for solving a system arising from discretization of the Poisson equation, but they also used an efficient forward-map of the coefficient matrix to do explicit time-stepping for a wave solver. So they solve both a time-independent and time-dependent problem, but neither with implicit time-stepping (though there appears to be no technical limitation here, it's just what they focused on).

</comment></comment><comment><USER6> Why isn't this PDF marked? Aren't they usually marked?

It even has a .pdf extension.

Accessibility fail.

</comment><comment><USER6> PDF

This crashed my browser.

</comment><comment><USER7> Should this be flagged due to the paywall?</comment>


YouTube Now Offering Video Statistics - <AUTHOR> http://www.techcrunch.com/2008/03/26/youtube-now-offering-video-statistics/

<comment><USER2> Benefiting from the technologies of their acquiror at last?</comment>


Show HN: Like Tim Ferriss's Podcast? Skip ads and go to the best parts - <AUTHOR> http://timferrissstorytime.tumblr.com/ <comment><USER2> This is most likely illegal. Tim owns the copyright to his podcasts.

You can't republish copyrighted works on your website. You cant republish someone else's books, photographs, music or podcasts.

<comment><USER3> It looks like they're not rehosting the files, just linking to them on their original host (Libsyn). Does that count as republishing?

</comment></comment><comment><USER4> I think episode 150 is mispelled as "Episode 501"</comment>


Building Real Applications from My iPad - <AUTHOR> https://brownfield.dev/post/2020-07-11-ipad-code-server-workflow/ <comment><USER2> I find these types of non-standard workflows fascinating. Ultimately it's all still too limited for my tastes, but there are interesting tricks I've picked up from a few similar coding on iPad articles.</comment>


Roll your own video conference tool part 1 - <AUTHOR> https://bengarney.com/2016/06/25/video-conference-part-1-these-things-suck/ <comment><USER2> Dupe, [https://news.ycombinator.com/item?id=12049385](https://news.ycombinator.com/item?id=12049385)

<comment><AUTHOR> Yeah, except mine was submitted eight hours earlier :-(</comment></comment>


The Death of the Von Neumann Architecture - <AUTHOR> http://www.codersnotes.com/notes/the-death-of-the-von-neumann-architecture <comment><USER2> The "Von Neumann" and "Harvard" architectures mean something very specific in CS. The author is applying them to a higher level where they don't belong, which I find a little silly.

The reasons for Apple, Microsoft, and other vendors for restricting execution of native code are various, but mostly related to security and maintaining control of the ecosystem.

It is fine to complain about that desire for control. But it is not necessary to view this as a computer architecture issue at another level.

<comment><AUTHOR> I think you have very much misread it.

I'm not complaining about desire for control at all. I'm complaining about the inability for a program to treat it's code and data as the same medium.

That is very much the key tenet of a Von Neumann architecture.

<comment><USER3> Although this is freedom-limiting, I strongly doubt that this thinking on iWatches will "infect" desktops in the future. The iWatch is designed to be an appliance, much like that microwave, rather than a computing platform for on- board idea creation.

Also, digital watches of all sorts have pretty much always been Harvard architecture for the past N years. From a use case perspective, the iWatch should be treated as a glorified digital watch, not a minified iPhone. Seen from this angle, I disagree that the iWatch is a "step backward". But I do agree with you that in general, Apple is annoying for deliberately limiting freedom.

<comment><USER4> Not to complain about terminology, but _appliances_ used to be precisely the sort of stuff you could repair. I've fixed my microwave, I did not carry it to a genius bar. This is the reason why I fear this pernicious business model will spread: it promises lock-in for everybody, from John Deere to coffee machines makers.

As far as the iwatch being just a watch, the same thing could have said of the iphone. It was a phone, only cooler. Almost a decade later, ios devices are the platforms where many users do a significant fraction of their computing. And while ios devices may not require on bitcode submission, they limit the users freedom in a way that is fundamental. Image a world were every x86 computer sold post 1995 (outside of the server space) could only run Windows.

Besides, even if you own a "creation machine", you'll often be catering to the market of restricted devices (case and point: gecko on ios).

EDIT: I'll grant you may be right in the specific sector of non-computing electronics (watches, calculators, etc).

</comment></comment></comment></comment><comment><USER5> I think the author is confused. Protecting a code segment to be 'read only' does not change a machine from "Von Neumann" to "Modified Harvard" architecture. That distinction is reserved for computers that separate the 'store' (aka volatile memory) into two disjoint regions. And pure Harvard architecture machines (like the early PIC series from Microchip) suffer from an in ability to vary the partition between data and code, which is the real problem[1].

Now there is a pretty sound reason for making your code segment read only, and the author touches on it, which is that if you are running third party code, because it limits the attack surface for security exploits somewhat.

But then he goes off the rails with this claim, _" What really struck me was that there was no flexibility here; no way to for a program to make changes to itself or build new subprograms, even if Microsoft approved it."_

The next topic on the required reading list should be "Turing complete" :-) It is entirely possible to write a piece of code which is both a core interpreter, and the byte codes on which that interpreter is operating. And including in the byte codes a means to read, modify, and re-execute any previous byte codes. The sum of actions of course will be constrained by what can be expressed in a byte code but given that, you are free to do what ever you want.

And of course any interpreter which was interspersing its data and executable byte codes in the same chunk of memory, well that would be a Von Neumann architecture :-)

[1] Harvard machines ultimately fell out of favor because you could end up with left over code store and not enough data store for an application.

<comment><AUTHOR> > That distinction is reserved for computers that separate the 'store' (aka > volatile memory) into two disjoint regions

On a machine where programs are supplied as bytecode, there are indeed two disjoint regions.

The bytecode sits in it's own region. You can't touch it from the data region.

<comment><USER6> I believe you are misunderstanding the use of bytecode in the Apple Watch: What is _deployed_ to the device is still native code, the bytecode is merely what's _submitted_ to the app store.

<comment><AUTHOR> But if the program has no knowledge, visibility or control of the native code, it effectively does not exist.

</comment></comment></comment></comment><comment><USER7> Von Neumann Architecture has been dead and buried for 20 years. We only imagine our x86 is Von Neumann because there is coherence between the instruction and data caches.

Every modern machine is a Modified Harvard Architecture.

[http://en.wikipedia.org/wiki/Modified_Harvard_architecture#M...](http://en.wikipedia.org/wiki/Modified_Harvard_architecture#Modified_Harvard_architecture)

<comment><USER8> > Every modern machine is a Modified Harvard Architecture.

Well, this is just not true if you consider all modern computing systems rather than just desktop computing.

Every modern microcontroller is either Harvard, or pure Von Neumann. And there are billions upon billions of these shipped every year: ARM microcontrollers ship at a rate of 35Hz! Generally the lower power parts tend to be Von Neumann.

<comment><USER9> The AVR family of microcontrollers are Harvard machines. [http://www.atmel.com/technologies/cpu_core/avr.aspx](http://www.atmel.com/technologies/cpu_core/avr.aspx)

<comment><USER10> As are many of the PIC series of microcontrollers.

</comment></comment></comment></comment><comment><USER11> If you like this article, you'll also like:

"The Coming Civil War over General Purpose Computing": [http://boingboing.net/2012/08/23/civilwar.html](http://boingboing.net/2012/08/23/civilwar.html)

"The Right to Read": [https://www.gnu.org/philosophy/right-to- read.en.html](https://www.gnu.org/philosophy/right-to-read.en.html)

</comment><comment> vezzy-fnord Not to detract from the author, however:

 _Or perhaps you're running on an OS that doesn't have any support for hot- patching a running executable with new code. And you think "I know how to write a programming language runtime that can do that." Perhaps you'd seen how Erlang can do it, and wanted to try it yourself._

Dynamic code upgrade is really rare in general. The most that's usually done in mainstream practice is to pass socket fds to a newly exec()ed child instance, or some other form of superserver/pre-opening, a la inetd, UCSPI or whatnot.

 _What if you were on a system that didn't support DLLs or shared libraries, and you thought it'd be kinda useful to invent something like that?_

Depends on what your purpose for shared libraries are. If you just want a plugin system, then the traditional way w/o shared libs is to use some form of RPC so as to coordinate forked OS processes.

Finally, the majority of our programming languages are firmly in a von Neumann model, so it isn't quite dead yet. Not sure if read-only code segments are enough to deliver its eulogy, either.

</comment><comment><USER12> _> Apple's own Safari compile scripts to assembly because they've helpfully added a secret backdoor just for Safari, but not for any other programs .. On one benchmark, LuaJIT's ARM JIT is 48X faster than its own interpreter. Android can run the JIT version, but iOS can only run the interpreter version._

How many years will it take for an antitrust regulator to level this playing field?

<comment><USER13> Someone just needs to make a better computer that people can switch to from Apple. No need to bring violence into the equation.

We know the formula now, which Microsoft ignores since their market is companies. The formula for selling computers to people seems to be "be in control of both hardware and software to provide the best native experience". It's not a secret, anyone that wants to can start a company and compete with Apple. All regulators can do is make Apple's job harder for themselves which will result in bad products and cost taxpayers money, a lose-lose situation.

<comment><USER12> The formula also includes factory financing which slows competitor access to manufacturing capacity. Some products benefit from network effects (manufacturing, developer adoption) and become difficult to displace by any competitor, however well funded. Careful intervention can help to restore balance.

Unlike the oil companies of yesteryear, or even a browser that is supposedly "baked into" an operating system, the remedy here is not logistically complex: the backdoor is already known to exist -- it can be extended to some competitive products.

<comment><USER13> > The formula also includes factory financing which slows competitor access to > manufacturing capacity.

I'm talking about the formula that seduced the customer. "Factory financing" did not seduce the customer - one company in charge of the whole computer (as opposed to one company making the hardware and another making the software) is what seduced the consumer. The fact that company makes computers for end users, not company employees, is what seduced the consumer.

> Careful intervention can help to restore balance.

Like non-violent spanking, careful intervention is an oxymoron. Unless you can show an example where no one was harmed by government anti-trust laws being applied.

</comment></comment></comment></comment><comment><USER14> It seems disingenuous to write an article extolling the benefits of JIT and self-modifying code without mentioning the security concerns of allowing anyone to change executable code.

<comment><USER11> You don't need to be able to change code to execute arbitrary code --- see return-oriented programming. Besides, NX gives you almost all the same benefits.

Restrictions on code execution strike me more as business controls (and yes, assaults on freedom) than real security measures.

<comment><USER15> Look at my other response in this thread, ROP isn't trivial these days due to ASLR implementations. Almost always one needs information leak bugs.

The presence of a JIT makes things trivially abusable for the attacker and is a big security risk.

</comment></comment></comment><comment><USER16> The technical points mixed with the politics is a little boring. I'm really over people trying to make a moral issue out of iOS. You totally have the freedom to ignore platforms that don't work the way you want.

I also agree you have the freedom to complain about things over and over endlessly but _yawn_

<comment><USER17> iOS has 42% marketshare. You can't ignore it. When a company is moving in the direction of removing freedoms from 42% of the market, that's a political problem that should be addressed and not ignored.

<comment><USER18> Sure he can. And besides, Apple won't change course because us devs worrying and they never have in the past. Neither did Microsoft, at least not out of free will.

The only power we have is buying power. Ranting and politically complaining as the article does won't change anything.

<comment><USER19> > Ranting and politically complaining as the article does won't change > anything.

Yes it does, it educates readers, it can convince others not to buy iOS devices.

Other articles have certainly convinced me of that, for which I am very thankful to the authors.

These articles are not for Apple, they are for the people. People like us in Internet forums, who then discuss them, learn something (or not), and then make a decision (or not).

</comment></comment></comment></comment><comment><USER20> There's also a counter-point: Harvard architectures are more secure. If the application has the ability to execute data as native code, attackers will find a way to exploit that.

<comment><USER21> Until someone uses ROP-widgets turning stack return addresses into executing what the attacker wants. Doesn't matter if there are no pages that are both writable and executable. Besides, any secure JIT will only keep a page either writable _or_ executable, but not both in the same time.

[http://en.wikipedia.org/wiki/Return- oriented_programming](http://en.wikipedia.org/wiki/Return- oriented_programming)

<comment><USER11> latiera, you seem to be banned for some reason. Both of your comments are dead. I'll quote your post in full.

> It's not that simple. ROP relies on known or predictable addresses and > pretty much all modern OSes have some form of address space layout > randomization (which keeps getting better and more sophisticated).

> With good ASLR, ROP is not possible without relying on information leak bugs > which are finite. So the cost for the attacker increases and it gets harder > and more time intensive for reliable exploits to be written.

> Allowing JIT for everything is a TREMENDOUS security violation, since it's > trivially abusable and page permissions are irrelevant. There are just too > many ways for clever attackers to abuse it.

Of course ASLR makes ROP harder. It makes all exploits harder. I still don't agree with your last paragraph. As someone else mentioned, good JIT implementations never leave code both writable and executable. It's simply not the case that "page permissions are irrelevant". Page permissions are central because they defeat the specific attacks you have in mind. A JIT is no more vulnerable to them than the dynamic loader is.

I still don't buy that banning PROT_EXEC buys you any protection from attackers exploiting applications.

On the other hand, banning PROT_EXEC provides plenty of protection against uppity application developers trying to "abuse" the platform you "own" by attempting to program in unapproved ways.

<comment><USER21> Exactly.

To add, nothing prevents from allocating pages from random addresses to get protection similar to ASLR.

It can actually be harder to attack dynamically generated code, because instruction offsets and instructions used will vary from application invocation to another. You could even do intentional variations to ensure no relative instruction offsets are deterministic. So dynamically generated code can have not only have random address (ASLR) but also random relative offsets. Obviously statically compiled code must have those offsets static, known by the attacker.

ASLR just means you don't necessarily know where. But once the attacker knows where or has some clever trick so it doesn't matter, it's game over. Unfortunately the creativity of attackers getting around ASLR seems to be endless.

</comment></comment></comment></comment><comment><USER22> > Languages like Java, JavaScript, or the .NET framework could never have > prospered on platforms that didn't allow them to create new native code as > they ran.

We can take this a step further and say that if IBM locked down its PC back in the 80s, we wouldn't have Linux!

</comment><comment><USER23> >Apple and Microsoft are showing every indication that within the near future this direction may well apply to desktops too. The restrictive 'store' APIs pushed by these platform holders seem to relish in preventing the execution of unapproved code.

Not really. Windows 10 apparently allows universal Windows apps to call VirtualAlloc() and VirtualProtect().

[http://blogs.msdn.com/b/chuckw/archive/2012/09/17/dual- use-c...](http://blogs.msdn.com/b/chuckw/archive/2012/09/17/dual-use-coding- techniques-for-games-part-2.aspx)

<comment><USER21> > Windows 10 apparently allows universal Windows apps to call VirtualAlloc() > and VirtualProtect().

Yes, but they're useless for this purpose. VirtualAlloc is mapped to VirtualAllocFromApp. Which means you can't allocate executable pages.

You can't make a page executable. Nor can you make executable pages writable.

So you can't run dynamically generated code at all in a Windows 10 universal app.

<comment><AUTHOR> It's hard to tell if that's the case or not - the documentation seems to contradict itself on that point.

</comment></comment></comment><comment><USER11> Come to Android, where mprotect still works.

</comment><comment><USER24> > "A step backwards to the Harvard architecture benefits no-one."

Actually it benefits Apple, which is why they did it. Or is the author arguing it doesn't benefit Apple? However, I didn't see anything substantiating that in the article.

</comment><comment><USER25> Sounds like "Java Phones." It was being done way before Apple got involved.

</comment><comment><USER26> I don't think using proprietary platforms such as Xbox 360 or iOS as examples constitutes a trend in the field of Computer Science. It's more likely that Apple will reject your iOS app for some reason than it is that you won't be able to "innovate." If you want to innovate on iOS and create something truly spectacular, you should be seeking employment or simply be satisfied hacking the provided device yourself.

I would consider this article's content far more substantial if there was an example of this architecture being used in, say, Linux 4.

<comment><USER27> Do you really believe in this what you wrote here??? Are people completely lost their dignity?

It used to be that the owner of the operating system did not have any say about what other developers can write to that platform.

<comment><USER12> _> It used to be that the owner of the operating system did not have any say about what other developers can write to that platform_

It used to be that "online lobbyist" was not a job description, [http://www.washingtonpost.com/blogs/monkey- cage/wp/2014/06/0...](http://www.washingtonpost.com/blogs/monkey- cage/wp/2014/06/02/if-you-can-fake-spontaneity-you-have-it-made-five-key- questions-about-the-grassroots-industry/)</comment></comment></comment>


Mark Zuckerburg comments on Peter Thiel controversy regarding Trump donation - <AUTHOR> https://s13.postimg.org/ohe1sci6f/mmexport1476831885441.jpg <comment><USER2> Some surprising wisdom in this private note: If everyone looks different but thinks the same, that's not real diversity.

</comment><comment><USER3> When people say "half the country supports X candidate" I like to point out polls only count registered voters who are likely to vote, which is closer to half the eligible voting population (which of course doesn't include any of the non-adults).

It's more like each candidate has support from less than a quarter of the population and most people don't support either.

Somehow I find that reassuring.

<comment><USER4> Don't be daft. The non-voters are the ones who don't care. They don't care about xenophobia doing its thing. They don't care that Hillary may be corrupt. They don't care about the fact that Trump wants to carry out extrajudicial killings of people who might be related to terrorists. They don't care he wants more extreme forms of torture than waterboarding. Get real the people who aren't voting probably would make the country worse.

<comment><USER5> Or they have given up on voting for a shit sandwich vs a dirty douche. Either way you vote you lose.

This covers a vast group of people in the united states.

As George Carlin (loosely) said: If you voted for the people in power, you have no right to complain when they do things you dont like. You voted them in. I on the other hand... Did not vote for them and have every right to complain about the mess you made and I had nothing to do with.

<comment><USER6> Love Carlin, but you can't make keeping your hands clean the main priority in life.

I raise you one Emerson: "The other terror that scares us from self-trust is our consistency; a reverence for our past act or word, because the eyes of others have no other data for computing our orbit than our past acts, and we are loath to disappoint them.

But why should you keep your head over your shoulder? Why drag about this corpse of your memory, lest you contradict somewhat you have stated in this or that public place? Suppose you should contradict yourself; what then?

A foolish consistency is the hobgoblin of little minds, adored by little statesmen and philosophers and divines. With consistency a great soul has simply nothing to do. He may as well concern himself with his shadow on the wall. Speak what you think now in hard words, and to-morrow speak what to- morrow thinks in hard words again, though it contradict every thing you said to-day.--'Ah, so you shall be sure to be misunderstood.'\--Is it so bad, then, to be misunderstood? Pythagoras was misunderstood, and Socrates, and Jesus, and Luther, and Copernicus, and Galileo, and Newton, and every pure and wise spirit that ever took flesh. To be great is to be misunderstood."

</comment></comment></comment></comment><comment><USER7> Zuckerburg should elevate the conversation. Accusations are not proven leave the sexism out. Knowing Hillary's Campaign staffs comments about Catholics, gays, blacks, hispanics and etc. demeaning comments provides a springboard for free and fair political speech. Zuckerburg is proving himself to be low minded and poorly educated pertaining to our constitutional rights provided centuries past from high minded genius founding fathers.

</comment><comment><USER8> I get it that you can't fire someone over his support of a political candidate but what about his public views on rape and racism: [https://www.theguardian.com/technology/2016/oct/21/peter- thi...](https://www.theguardian.com/technology/2016/oct/21/peter-thiel- support-donald-trump-date-rape-book?CMP=share_btn_tw)

</comment><comment><USER9> It seems to be a typical postmodern viewpoint that every idea is equally valid. But even if you're not "racist, sexist, xenophobic, or accepting sexual assault", if you, as a reasonably minded individual, back Trump, you're condoning all of these things, which is really just as bad ... Not everybody's idea is valid!

<comment><USER10> that's just your opinion and I feel bad that I'm voting for the same candidate as someone like you who doesn't tolerate other people's political choices.

<comment><USER11> I feel equally as bad that this person has been fed a narrative and hasn't gone out to debunk the propaganda and find out what is really going on behind the curtain. We can have a disagreement, sure, but when the argument is just shouting "sexist, racist, homophobe, xenophobe", etc. it's clear there's no real political discourse to be had, which is sad because there's a boatload of disgusting politics and corruption being exposed right now.

</comment></comment></comment><comment><USER12> The last paragraph introduces a question interesting to me.

Is opening up communication channels responsible for social conflict?

Is Mark right or wrong in his last paragraph.

I've always assumed he was wrong but the premise should be examined explicitly.

Naturally I don't claim that the radio or newspapers _invented_ the social conflict. I am saying they could be responsible for the actual incidence of conflict itself.

If you picture each person as a collection of memes, then;

> The most merciful thing in the world, I think, is the inability of the human > mind to correlate all its contents. - H.P Lovecraft

The potential for conflict in the individual is not resolved with conflict for the most part. We do know the more intellectual among us tend to be more neurotic, perhaps another hint at the essential lovecraftian truth.

That means barefaced conflict is only possible when an individual meets another and communicates. It is then latent contradictions become evident.

Far from the notion that communication acts as a meditator and leads to peace, the truth might be the opposite.

tldr; if we don't talk to each other, everything will be fine!

</comment><comment><USER13> Zuckerberg should look at his own aegist, chauvinist company and get rid of discrimination in his own company before critiquing others who he feels are not imbracing diversity.

<comment><USER14> Source?

</comment></comment><comment><USER15> What is it with you US-people and 2 candidates?!?!

I mean this is ridiculous.

He's all like "oh don't hate on Thiel just because he supports Trump. Half of the US does it so it's a valid opinion"

Why not support other republicans who aren't chauvinists?

They talk like "Oh we just have Trump and Hilary and Hilary is corrupt, so what should we do? Vote Trump of cause!"

I mean if you're a chauvinist and like what Trumps says, just vote for him, it's your right to do so. But talking about diversity and then supporting people against it is bullshit.

"Hey yes, you can work at FB, we think you got mad skills, but we will invest the money you make in people who make your life worse!"

<comment><USER16> > What is it with you US-people and 2 candidates?!?!

It's the natural consequence of a plurality voting system.

Conservatives remember H. Ross Perot spoiling the election for George H.W. Bush, and throwing the election to Bill Clinton. Progressives remember Ralph Nader making the contest between Al Gore and George W. Bush close enough that G.W. was given the election by a Supreme Court stocked with his dad's buddies.

Voting for third parties is a terrible political strategy in the United States. The spoiler effect is real. I'd go so far as to say that our plurality system all but guarantees bad candidates--it's not the fittest that survive the primary election process, it's the most memorable, the one who we feel will best appeal to our neighbors.

Going further, I'd suggest that having a strong majority political belief is a major liability in U.S. elections.

When Bill Clinton was elected, the nation was largely happy with the center- right GOP of the time. As a result, the further right bloc had the confidence and diversity of small differences of opinion to split and lose the whole thing. (Never minding the fact that Bill Clinton was far to the right of traditional Democrats).

The same was true with Nader and Gore in 2000. Bill Clinton's policies had been so popular that people largely wanted another Clinton, but perhaps a little more progressive. Disagreement ensued as to how much more progressive, and thus we had Nader and Gore losing to the much more hawkish right-wing George W. Bush.

So, in the U.S., you're best off being part of a popular political leaning, but pray your political leanings don't grow so popular as to result in a split.

My personal feeling is that this country desperately needs to move past plurality voting. The easiest path to this is for states to apportion their electors based on ranked choice voting. It doesn't solve all our problems, but it does remove the spoiler effect. With luck, that would allow us to have less shrill, more substantive candidates--even if the major parties continue to dominate.

<comment><USER17> _My personal feeling is that this country desperately needs to move past plurality voting. The easiest path to this is for states to apportion their electors based on ranked choice voting. It doesn 't solve all our problems, but it does remove the spoiler effect. With luck, that would allow us to have less shrill, more substantive candidates--even if the major parties continue to dominate._

I think you've made some insightful points here, particularly when you said "In the U.S., you're best off being part of a popular political leaning, but pray your political leanings don't grow so popular as to result in a split." This does explain a lot.

However, I'd like to see some evidence that ranked-choice voting actually leads to better outcomes. I believe Australia has this system, doesn't it? They've elected some of the worst sorts of people I've ever seen in public office outside of an outright dictatorship, pushing the worst sorts of policies.

My concern is that RCV-like voting strategies may encourage a tyranny of the majority to emerge. While I'm no supporter of either Jill Stein or Bernie Sanders, I do like the idea that Hillary Clinton has to worry about what they have to say, for fear of being Nadered in one or more critical swing states. Likewise, I can see the Libertarians, both big-L and small-l, having a moderating influence on the knee-jerk theocrats who would like to take over the GOP. It seems that ranked-choice voting might have the effect of removing those beneficial "spoiler effects."

Just as one example, most Americans self-identify as members of the Christian faith. (Not picking on religion per se, just saying that it's probably the one cultural attribute that Americans share more widely than any others.) The same is true in Australia. There, a wave of neo-Puritanism has swept over the country, resulting in legislative micromanagement of everything from Internet censorship to the bra sizes of porn actresses.

So, does ranked-choice voting inevitably lead to the emergence of a nanny state? If so, I think we're better off here in the US with the strong two- party system. If not, are there any other downsides that should be discussed before switching over to RCV?

<comment><USER18> No, we don't have internet censorship in Australia. The idea was mooted and then shot down after backlash. That government was also voted out.

We also have no such regulation regarding the breast sizes of porn actresses. The refusal of classification is done on a "We'll know it when we see it" basis, much in the same way that many US laws are interpreted.

Your comments about religion are inaccurate in that we do not allow our faith to dictate our politics in the same way as the US. A 2011 Census question put Christianity at about 60%, while in the US it's at 70%. We do not have parts of the country that have a reputation for being deeply religious (unlike the American South) and we do not reference a deity of any kind in any official pledge whatsoever. We don't even have a pledge of allegiance that we force on our children in schools.

Our country has real problems (i.e humanitarian treatment of refugees and the environment) but we aren't the kind of place you're talking about.

Our High Court isn't a political game, our banks didn't fall apart during 07-08, and our worst terrorist attack in the past 10 years wasn't even bad enough to be considered a "mass murder" under the FBI's definitions.

One key difference between Australia and the US is that our Parliament can be dismissed if they are at a gridlock. This prevents the kind of gross obstructionism that has prevented the US government from functioning properly in recent years.

The other key difference is that we have compulsory voting.

<comment><USER17> _We also have no such regulation regarding the breast sizes of porn actresses. The refusal of classification is done on a "We'll know it when we see it" basis, much in the same way that many US laws are interpreted._

Sounds like you're under some mistaken impressions about First Amendment law in the US, particularly doctrines such as strict scrutiny. But to be fair, I'm sure that's true for both of us.

In any case, you've made an impassioned defense of the lawmaking process in Australia, but failed to answer my question regarding whether RCV would actually lead to improved outcomes if implemented in the US.

<comment><USER18> I wasn't trying to claim that Australia is somehow equivalent to the US in terms of what's protected (because it isn't - the US is undoubtedly more protective of speech than Australia), but more making the point that in the porn case we don't make nanny-state laws saying that X breast size is too small. Rather, content classification is taken on a case-by-case basis using the "We'll know when we see it" threshold that allows for some flexibility and common sense without needing to make all kinds of meddling regulations.

If adopted right now with no other considerations, preferential voting offers one big win for the US over the current status quo, which is that you'd be able to quantify the _true_ level of support that the minor parties have.

If given the option of voting third-party without running the risk of vote stealing, I'm certain that _tons_ of Americans would take that option. Right now Alice might want to vote third party but won't do it because she knows that people like Bob won't, and Bob won't vote third party because he knows that Alice won't do it. Preferential voting breaks that cycle because it doesn't matter how other people vote and allows people to just care about their own vote.

Both the Australian and US Green parties were founded in the 1990s, and the Australian Greens have been able to take seats and hold the balance of power at times while the US Green party hasn't been able to take a single seat at the federal level or in most states. I fully attribute that to the ability of preferential voting to let minor parties grow over time without fear of vote stealing.

There are also a few other things that Australia does with voting that I think make a lot of sense, but many of these don't really need preferential voting to be of value to the US:

      - All elections (local, state, and federal) are held on Saturdays.
        I don't really think I need to explain why this is a Good Thing.

      - Voting is compulsory. For free speech advocates this is sometimes a
        tough pill to swallow. However, compulsory voting ensures that people
        of all economic backgrounds and living situations still turn up and vote
        - without making it mandatory and forcing everyone to do it many people
        simply won't be able to find the time to vote. You are still allowed to
        cast an informal (and thus uncounted) vote if you *really* don't want to
        express your political views.

      - You do not have to vote at a designated polling place - you are free to
        vote at any polling place on the day of the election without any
        justification whatsoever for being out of your electorate, and you are not
        required to register for an absentee vote ahead of time in this case. Again,
        this is a way of ensuring that as many people vote as is humanly possible. It's
        also somewhat required here due to it being really unfair to force people to
        vote but then potentially turn them away for being in the wrong place.
        (Electoral rolls are of course checked during counting to ensure that people
        haven't voted at multiple polling places)

      - Funding is allocated to the recipients of first preference votes (as long as
        there's more than a certain threshold). House votes are worth $2.60, Senate
        votes are worth twice as much and the value is indexed to inflation. This
        allows smaller parties to slowly build up a base over time without actually
        winning the election to begin with.

      - We do not use electronic voting. Our elections have comprehensive paper trails
        that can be audited to ensure accuracy.

As for things we do that don't make sense with our voting system, one downside of a diverse Senate is that we have a _ton_ of candidates. This results in something of an excessively large ballot paper! [http://resources3.news.com.au/images/2013/03/11/1226594/7771...](http://resources3.news.com.au/images/2013/03/11/1226594/777191-ballot- paper.jpg)

</comment></comment></comment></comment></comment></comment><comment><USER19> What he writes sounds reasonable. Although I'm equally disturbed by Facebook News Memes like Tomi Lahren: [http://deadspin.com/tomi-lahren-is-a-facebook- meme-come-to-l...](http://deadspin.com/tomi-lahren-is-a-facebook-meme-come-to- life-and-america-1786062538)

</comment><comment><USER20> Is there a link to this? That photo doesn't appear to match Zuck's profile.

<comment><USER21> That post is "Facebook only." Note the "f" in privacy.

<comment><USER22> Does such a setting actually exist? I cannot find any information about that. There hasn't been any other source for this post either.

<comment><USER23> One would assume that would be for facebook employees only.

<comment><USER24> Looks like it was posted here: [http://www.theverge.com/2016/10/10/13229082/facebook-work- of...](http://www.theverge.com/2016/10/10/13229082/facebook-work-office- enterprise-software)

</comment></comment></comment></comment></comment><comment><USER25> If Mark is unsure about what makes Peter throw his weight behind Trump, why not ask him?

Not that he is answerable but if he has good reasons I'm sure he wouldn't mind talking about them.

</comment><comment><USER26> Sexual assault is not an idea. How about having the courage to stand up against a major player from your circle because it's the right thing to do.

</comment><comment><USER27> IF YOU CARED ABOUT DIVERSITY...YOU WOULDN'T "PUNISH" FB'ERS BY IMPEDING THEIR FIGHT TO LIKE OR DISLIKE A POST..OR CLAIM LANGUAGE IS OFFENSIVE AND YET PRINTING "MADONNA PROMISES BLOW JOBS!"..OR OBUMMER ROCKS A WOODY ON FB...ETC ETC....YOU'RE A HYPOCRITE!!!

</comment><comment><USER28> Trump is an embarrassment for United States of America but we can't impose our judgment those who want to support and vote for him. Nor do I agree with Mark Zuckerberg that half the country Support this man.

<comment><USER29> Is that a royal we?

</comment></comment><comment><USER30> I agree 100%. Haters gonna hate.</comment>


Ask HN: Is it worth paying $10,000 to attend the TED Conference? - <AUTHOR> The annual TED conference costs about $10,000 per ticket. I just moved to Vancouver and heard that the conference is here this week. So I passed by the convention center, saw KPCB's John Doerr. Have you ever been to TED? Was it worth the price? <comment><USER2> I've seen a few good presentation given on TED. David Grady's talk [1] on meetings is one such example.

This is just my opinion, but unless I can be assured a return on my investment, I am certain I can find better things to spend that kind of money on.

On a lighter note, any time someone mentions TED talks, I am reminded of thought leader This is that. [2]

[1] [https://www.ted.com/talks/david_grady_how_to_save_the_world_...](https://www.ted.com/talks/david_grady_how_to_save_the_world_or_at_least_yourself_from_bad_meetings)

[2] [https://www.youtube.com/watch?v=_ZBKX-6Gz6A](https://www.youtube.com/watch?v=_ZBKX-6Gz6A)

<comment><AUTHOR> Haha. that thought leader skit was wonderful. Thank you for sharing that.

</comment></comment><comment><USER3> The talks themselves are definitely not worth it. The real question is, will you benefit from meeting other people who have put $10K into a ticket?

</comment><comment><USER4> In my opinion, it's only worth it for people who don't ask themselves this question.

I think we should think in terms of time and fraction of a salary (relative) instead of absolute dollar figure.

Framed as follows: Someone who makes $X/year attending an event with a fee "f": what's the ratio f/X. What's the time/opportunity cost of attending the event. Is it still worth it to attend.

$10k can be one's savings or another's dust collecting Brioni.

</comment><comment><USER5> Geeeeeze, 10k? Here i thought ted was about making ideas accessible/spreading ideas. Not elite nonsense. Damn totally missed that.

</comment><comment><USER6> You might find this relevant: [http://www.theverge.com/2013/3/5/4061684/inside-ted-the- smar...](http://www.theverge.com/2013/3/5/4061684/inside-ted-the-smartest- bubble-in-the-world)

<comment><AUTHOR> Thank you for that link. This phrase:

>THERE IS A SUBTLE, UNSPOKEN STRATA THAT EXISTS WITHIN THE CLOSE-KNIT COMMUNITY The most striking was between that upper strata of speakers, former speakers, celebrities, and CEOs, and a surprisingly basic TED attendee who operated with a kind of business-like agenda. 'What can I leave here with besides ideas,' they seemed to be saying, hungrily scanning every room for their next hit. The gap between these A-list members and the schmooze- and party-hungry B-listers grew more obvious with each awkward encounter I witnessed

sums it up for me. I went to a bunch of the after-parties. All of them feel very exclusive. And while I did see some top-brass, there were lots of people... like me, but that had actually paid the $10k and wanted their money's worth.

</comment></comment><comment><USER7> Become a man with a microphone.

<comment><USER8> This is the best advice. The guy on the stage gains the most respect, and people assign a lot of status to that person.

Speakers get a free ticket.

For $10k you could get a lot of speaker coaching.

</comment></comment><comment><USER9> I thought all the TED taks would end up on youtube anyway? 10k? Sheesh....

<comment><AUTHOR> The talks have zero value for sure. The connections and people you meet are the draw... supposedly.

</comment></comment><comment><USER10> If you feel you need to ask, you already have the answer.

</comment><comment><USER11> No

</comment><comment><USER12> Nope.

</comment><comment><USER13> NO.</comment>


Australia's big banks say Apple Pay is anti-competitive - <AUTHOR> http://m.imore.com/australias-big-banks-say-apple-pay-anti-competitive <comment><USER2> Everyone in Australia pays with the wave of their visa card. You only bother with a pin for transactions over $100. I always have my card handy and it doesn't need to be charged. Every trader accepts visa paywave. I have no idea why anyone would want to use a phone for payments instead. It seems like an idea more suited to different country with a different banking system.

</comment><comment><USER3> It's not just Australian banks that _will_ have a problem, it's going to be a service-level problem with non-US banks.</comment>


Can the U.S. Military Halt Its Brain Drain? - <AUTHOR> http://www.theatlantic.com/politics/archive/2015/11/us-military-tries-halt-brain-drain/413965/?single_page=true <comment><USER2> > The stories of Jost and van Dam represent a dangerous trend for the U.S. > military. It cannot afford to continue bleeding promising talent like theirs > without putting its future in jeopardy.

An encouraging article on the DOD. I was reminded of the great Churchill quote "You can always count on Americans to do the right thing - after they've tried everything else." -</comment>


DMCA being misused for censorship - <AUTHOR> https://www.theguardian.com/technology/2016/may/23/copyright-law-internet-mumsnet <comment><USER2> tl;dr UK news reports of UK citizen posting review about a UK business on a UK website run by a UK business, censored by a US law.</comment>


Things All Software Engineers Should Know - <AUTHOR> http://blog.braksa.com/2012/08/10-things-all-software-engineers-should-know/

<comment><USER2> Why submit this? Just submit <http://www.computer.org/portal/web/swebok>, or at least add some commentary.

<comment><USER3> But then you couldn't put the words ten things in the title.</comment></comment>