Slackware 13.0 is released  - <AUTHOR> http://slackware.com/releasenotes/13.0.php <comment><USER2> Slackware is still my favorite distro (even though I also use Ubuntu a lot nowadays).

It's the best choice IMO for learning Linux, for power users and for developers.

I still prefer to compile most of the software I need by myself, to get the latest releases and to compile with the options I want. And there's nothing I can't get running on Slackware. This is mostly because Slackware uses unpatched/non customized versions of each software, compiled with default settings.

I also love that fact that it doesn't even have its own visual branding. KDE is just KDE (with the default theme and its own wallpapers) and everything else comes as if you would have got the source and compiled yourself.

\\\//, live long and prosper, Slackware.

<comment><USER3> slackware, the main distro for the church of the subgenius. amazing. _wipes tears of joy_

</comment></comment><comment><USER4> Biggest news:

 _Probably the first thing to mention about the release of Slackware 13.0 is that it marks our first release with an official 64-bit port!_

Nice.

Also, they switched from KDE3 to KDE4. And version number == 13; lucky number.

</comment><comment><USER5> Because i run -current, i didn't even notice.

But hell yeah, it's a damn good news! I'm running the 64 bit version and it is rock-solid (as always is the case with slack.)

</comment><comment><USER6> I must admit, I have never understood the package management in Slackware, and that has kept me from trying it. Apparently it has some kind of package management tools, which don't do dependency resolving (by default).

But does it have the capability to update installed packages automatically or with a few commands (compare to aptitude update; aptitude upgrade)? And does it have a search function for packages (like apt-cache search foo)?

I can understand that not having dependency resolution simplifies tools a lot, but is there advantages for end-users from that? And is there some kind of external database or something that will help tracking dependencies, or is it based on guesswork and trial & error?

<comment><USER7> Every time Slackware is metioned in a news site, fans of it will always write comments saying how they love it, and many other users like to point out how Slackware's package management is "nonexistant" or outdated, in the sense that it doesn't resolve dependencies automatically and we're in 2009. There are even some Slackware fans who counter-attack saying that manually resolving dependencies is better and that you should not trust a program to do the job.

Now, as a long time Slackware user, I'm going to give you my opinion: it's all a matter of taste. Different people like different types of systems, and Slackware is a perfectly valid distribution for many people.

The reason it doesn't resolve dependencies automatically has to do with its "KISS" principle. Normally, to resolve dependencies effectively you need to add more stuff to the package management tools. For example, it makes much more sense to automatically resolve dependencies when the package management tools know the concept of remote repository, know the list of available packages, and what each package provides, and they can talk to the servers over the network to download packages automatically. Like apt-get does.

In Slackware, the package management tools you get are really really simple internally, and are in fact shell scripts (installpkg, removepkg, upgradepkg, etc). All they understand is package files, which are tarballs, and they don't really perform complex tasks. The package management tools in Slackware follow the KISS principle, and the line was drawn at that point. If you want to resolve dependencies automatically, then you probably need remote repositories, talking over the network, keeping a package database, etc. Slackware drew the line before all of that to keep the system simple. As easy as that.

As a Slackware user, I will never say that having to resolve dependencies by hand is a good thing. However, it's a very minor flaw that needs to be present if you want the package management to be simple, like the rest of the system. Slackware, internally, is very simple and stable. It's one of the few distributions you can very easily learn almost by heart. There are so few pieces and they fit together so easily...

For people like me, Slackware is the best choice because we want that type of system and we enjoy being working at the computer and knowing perfectly the system you're working on. Solving dependencies automatically is not a priority for me and having to do it manually is a non-issue. I don't install new software everyday. I just keep my system with the applications I need and use it. Contrary to one of the comments above, I don't use Slackware to hack and learn. I use it to get the job done. That's what computers are for, and Slackware is still a very valid system for that.

How do I track dependencies? If a program doesn't run because it lacks a library, running it from the command line will tell you which library is lacking. The ldd command can tell you that too. From that point, it's very easy to know what you are missing that the program needs. Library names usually match the package name. For other cases you can use the package browser and ask for the library (packages.slackware.it), you can ask in the IRC channel at freenode for a quick answer, you can ask at LinuxQuestions and you can also manually look in the MANIFEST.bz2 file present in every mirror, as it mentions the files each package provides.

If the problem lies in a piece of software you are trying to compile, usually the program documentation contains the appropriate information including a list of requirements. Some of those requirements may have an official package and some others may have to be installed by hand too.

But, really, it's not that hard and for most people this problem doesn't turn up all the time, at all. If you like the system, you won't find offensive to lose a bit of time tracking a few dependencies in a software package you're installing. Specially if you're going to use the software for months. That initial effort is not that important, at least in my humble opinion. Like I said at the beginning, it's a matter of taste and what fits you better.

<comment><USER8> According to your philosophy, isnt ArchLinux the perfect middle ground ?

rolling releases, BSD style init, a really good package repo (AUR) and manager (pacman) - no "-src" packages ...

if you want to insist on Slackware like package management - use PKGBUILD .

<comment><USER7> I've heard many positive things about Archlinux and a friend of mine who used to run Slackware now runs Archlinux and he's very happy, as far as I know. I don't use Archlinux for two reasons: I already know Slackware, and I have also heard, first hand from him, that Archlinux tends to break a bit more than slackware-current, that is, it's a bit more unstable.

But, yes, Archlinux is definitely another distribution that could fit me too, as it's quite simple and doesn't get in the middle. I'll probably try it one day if I become tired of Slackware.

</comment></comment></comment></comment><comment><USER9> Slackware 3.0 was my introduction to Linux in Jr. High. I definitely learned a lot. Although most "friendlier" distros weren't around then, even if they were I hope I would have still started with slack.

I use Ubuntu now in part because my wife and little kids use the computer too, but I am frequently tempted to give slack a try again.

</comment><comment><USER10> Anyone got any updates on the various gnomes? Anyone of them close to the finishing line?

</comment><comment><USER11> I don't really get the fascination around Slackware. As a distro it is probably the least featured among all of the distros out there. It doesn't even have automated patch management for Christ's sake.

Only real use I see for it is using it, once, to fiddle around and learn how Linux actually works. After that you just wants something which works and move on to Debian, Fedora or whatever.

Also obligatory demotivator link: [http://invalid.ed.ntnu.no/~jostein/qupload/files/slackware.j...](http://invalid.ed.ntnu.no/~jostein/qupload/files/slackware.jpg)

<comment><USER10> I am the opposite. I really can't get anything other than slackware (not that I can't work with them - I can, but life just is not as simple as slackware anywhere else). Why would anyone want or need anything more complicated then a compressed tar file for package management is beyond me.

Slackware is simple, beautiful and elegant but no more than it has to be. It just works and it leaves all the power in the world at my hands. I can make it do my bidding fast as lightning and it never gets in my way. Once you begin to get the basic principles of slack, it very closely follows the principle of least surprise.

<comment><USER12> I agree. I think that those who feel that Linux should be a "main stream" OS (for whatever definition of main stream you choose) are missing the point that it was, and always has been, primarily a hacker's OS.

That's not to say that distros like Ubuntu don't have their place, but there's so much automation going on in these "modern" package management systems that you really aren't going to learn anything. Sure, you'll end up with a very nice, very functional computer, but that (IMHO) isn't the point of Linux. I'd go so far as to say that I feel like Ubuntu is no longer "Linux", just like Mac OS X is no longer "BSD". Based on? Yes. Is? No, _Slackware_ is Linux.

<comment><USER11> Sure Linux may be a "hackers OS", but I'd still argue the opposite.

For people who work with Linux for a living, like system administration, you want your Linux distro to absolutely minimize the amount of work needed. When your server-park scales, manually having to fiddle around 200 Slackware installations simply isn't an option.

<comment><USER12> Right, which is why you'd be using RHEL or some such. When we get into the open source world of BSDs and Linuxes, it's hard to really say what qualifies as the "OS". My point was that the original "Linux" that Linus wrote to learn more about his machine had a purpose, I think, much more in line with Slackware than SuSE/RHEL/Debian/Ubuntu/etc.</comment></comment></comment></comment></comment>


React VR - <AUTHOR> https://facebook.github.io/react-vr/index.html <comment><USER2> [meta] previous discussion [https://news.ycombinator.com/item?id=13868327](https://news.ycombinator.com/item?id=13868327)

</comment><comment><USER3> Why is there so much fragmentation already?

React VR backed by facebook (who controls oculus):

          <View>
            <Pano source={asset('chess-world.jpg')}/>
            <Text
              style={{
                fontSize: 0.8,
                layoutOrigin: [0.5, 0.5],
                transform: [{translate: [0, 0, -3]}],
              }}>
              hello
            </Text>
          </View>

A-frame backed by firefox (who controls webvr implementations):

        <a-scene>
          <a-box color="#6173F4" opacity="0.8" depth="2"></a-box>
          <a-sphere radius="2" src="texture.png" position="1 1 0"></a-sphere>
          <a-sky color="#ECECEC"></a-sky>
        </a-scene>

x3dom (supposedly successor to VRML)

        <x3d width='500px' height='400px'>
            <scene>
                <shape>
                    <appearance>
                        <material diffuseColor='1 0 0'></material>
                    </appearance>
                    <box></box>
                </shape>
            </scene>
        </x3d>

<comment><USER4> React VR is just a library on top of WebVR, not a new standard. WebVR is coming, although it isn't "here" yet: [https://webvr.info/developers/](https://webvr.info/developers/)

It would be like saying that Angular, Vue, and React are causing fragmentation.

</comment></comment><comment><USER5> Hmmm... no support for skinned character models (and looks like a lot of design and implementation work required on many fronts before this could support them). As cool as this is that makes it feel like a toy rather than a real product (even 3D that doesn't require humanoid characters tends to require deforming meshes to meet the visual quality bar customers expect).

I wish instead of trying to make their own renderer they had used their considerable react and coding skills and time to create a React UI for Unity3d and/or Unreal, which are what most serious app developers are using to create VR experiences (and which have pretty terrible/minimal/antiquated UI coding frameworks compared to what React offers)

<comment><USER5> Looking deeper into the docs, their scene graph/hierarchy design practically screams "I was designed by someone with zero experience designing 3D scene graphs" (I'm approaching this conversation as someone who has done that sort of thing for Disney, for Microsoft's 343 Halo studio, for startups and major effects houses, and as part of the original design process for the Collada open source format used by google earth and others.

Let's start with the <scene> tag, whose docs start out by saying the scene tag represents the camera location. You're not even at V1 and your docs already start out by saying "we picked a name for this but everyone else in the world thinks of it as having a different name." Worse, "scene" is an incredibly important keyword to be able to use in your 3D scene schema, and you've now tied it up representing something that isn't a scene in a way that prevents you from using the keyword to represent obvious future schema concepts (like multiple scenes you want to be able to switch between quickly).

On a more subtle or mathematical front, the handling of transform stacks is designed in a way that provides a small amount of needless advanced functionality for sophisticated/experienced 3d developers (who are not the target of this tech) while offering huge opportunities for needless confusion and errors in the hands of the novice 3D developers who are the target market for the tech. I'm looking specifically at the way in which individual transformation matrices are represented by an order-dependent javascript array of translate, rotate, and scale component "matrices" (putting matrices in quotes because they don't look like individual 4x4 matrices in the code but they act, combine, and commute (or don't commute) like 4x4 matrices). It's hard enough to help a novice programmer/3D developer to wrap their head around local and world space coordinate systems and the impact of non-uniform scaling on child objects. Expecting that novice tech customer to also need to learn about commutative rules for 4x4 matrix multiplication before they can understand why their slightly tweaked sample app is or isn't working is a terrible, needless complexity wrench to throw into the system.

I could go on for pages and pages here, but this isn't the format for that (and the tiny text box on iOS isn't helping), so I'll just say that I absolutely LOVE React and very much wanted to like this, but this looks like it was developed by people who don't even understand what's hard about designing a good 3D schema, much less how to address those challenges.

<comment><USER6> On this topic... this is something I've wondered a bit about before (logical representations of 3d scenes -- interested as someone who comes from the robotics world, and curious how the people who did video games, VR, graphics tools, etc. thought about this stuff).

Obviously not the same use case, but I've tried looking before for good information on how scene graphs are structured and used, and haven't found much out there that was useful for a beginner who was interested in learning the details. If you have any resources or stuff you would be willing to share, or a well designed library that does it right (any language), I'd love to know about it!

Thanks!

<comment><USER5> There are surprisingly few good representations for either 3d assets or 3d scenes.

Lots of people are pretty excited about the Universal Scene Description format that Pixar published and open sourced. It's great if you're a big film animation studio looking to manage huge scenes for offline rendering but it's explicitly not optimized for any of the kinds of speed/memory trade offs required for realtime rendering applications.

There are a couple efforts underway at the Khronos group that have lots of key folks from the Collada effort involved and there's a chance they'll come up with something good but this sort of schema design is such a subtle and forward-looking task that I personally am not optimistic about an open source effort being the first to get it right (you're trying to design a data format people will want to use two decades from now without getting trapped in a vicious cycle of analysis paralysis that can prevent you from being able to ship something usable today quickly, it's much like a language design problem where eventually you want to open source it but even then you need a Guido or an Anders or similar to guide the effort onto a good long term arc)

</comment></comment></comment></comment><comment><USER7> This is pretty neat.

The more I try to do Web VR stuff though, I get frustrated because there isn't yet a good way to design it "responsively" so that it will look right on normal flat screens, but become an environment in VR.

I also wonder about what the right UX for linking pages in VR is. I don't want to have to fist-bump some floating blue text. Maybe there should be a "link shape" or halo that draws the eye to certain features.

<comment><USER8> Clearly, links should be represented as human-sized exposed pipes that users jump into like in Mario games.

<comment><USER9> Note the date and time, this comment may provide proof of prior art in some future patent litigation.

</comment></comment></comment><comment><USER10> React is what we did in 2016. This is 2017, we use ReactVR.

<comment><USER11> They're not interchangeable. They're not even particularly related.

And almost nobody is using ReactVR, for the simple reason that almost no browsers support it yet.</comment></comment>


Little Lisp interpreter - <AUTHOR> https://maryrosecook.com/blog/post/little-lisp-interpreter <comment><USER2> Neat! I did my own javascript lisp after Norvig's too: [https://twitter.com/llimllib/status/857410209102299136](https://twitter.com/llimllib/status/857410209102299136)

Then, instead of adding variables, I wrapped most of the functions on a canvas in the env and used it to generate my talk's slides: [https://github.com/llimllib/adhocteam.club/blob/master/slide...](https://github.com/llimllib/adhocteam.club/blob/master/slides.py#L15)

Then I let my coworkers graffiti the slides with the same lisp as I gave my talk, as it was an open web server where you submitted them. A tiny demo is left running at [https://www.adhocteam.club/](https://www.adhocteam.club/) , but I should write it all up.

<comment><USER3> checkout letzcode.com, it uses scheme...meant to be a social way to introduce students to programming.

</comment></comment><comment><USER4> I don't want to take away from this, but any time a home built lisp interpreter comes up with a "let me show you how it works", I always have to reference back to the MAL (make a lisp) project:

[https://github.com/kanaka/mal](https://github.com/kanaka/mal)

I find it's better to write it yourself than just have it explained to you. It really doesn't take that long to do, and it's broken into nice chunks of discrete work.

</comment><comment><USER5> I love these articles (plus the "make a lisp" project as well). They give me a lot of hope in the future: Next time a customer insists that its software should be delivered in Java, i will first write my own informal, bug-ridden implementation of Lisp on top of it, and write the rest of the software in such Lisp.

Greenspun 10th rule rules!!

</comment><comment><USER6> I'm unclear about function invocation here... FTA:

        A function invocation. This comprises a list where the first element
        is the function and the rest of the elements are the arguments. first
        takes one argument, (1 2), and returns 1.

My problem is, the same way in every lisp I've seen, (1 2) qualifies as a function invocation. I'm not sure how the interpreter would know not to invoke 1 on 2, in these examples:

        (1 2)

or

        (first (1 2))

<comment><USER7> In most (all?) lisps that's actually exactly what would happen. It would try to call the function '1' (and throw an error since 1 is not a valid function). If you want to have a list you'd typically have something like (list 1 2) or you could quote it '(1 2).

In this case it seems to actually check if the first element of the list is a function and only treat it as a function call in that case.

<comment><USER8> but you're not passing it the argument '(1 2). Lisps are usually (always?) strict evaluation, so the form `(list 1 2)` or `(quote (1 2))` would return the form (1 2). First applied to this form would return 1. The specification is correct that first applied to (1 2) would return 1. The fact that this means most invocations would look like `(first '(1 2))` is irrelevant since the argument to first here is not '(1 2) but is actually (1 2).

<comment><USER9> You are actually in violent agreement with the parent.

The grandparent poster was confused why the syntax (foo (1 2)) can be used to apply FOO to (1 2). As the parent points out, for typical Lisps this would actually give an error; instead, (foo '(1 2)) would be the appropriate syntax to apply FOO to the form (1 2). Indeed, when strictly evaluating (foo '(1 2)), first the arguments are evaluated. Since functions self-evaluate, FOO evaluates to itself, while '(1 2) evaluates to (1 2). Then, FOO is applied to (1 2). This is in complete agreement with what you said and what the specification says.

However, the Lisp interpreter at hand actually self-evaluates lists whose head is not a function. Thus (1 2) self-evaluates and (foo (1 2)) has the same effect as (foo '(1 2)).

<comment><USER10> > Since functions self-evaluate, FOO evaluates to itself

No, in Lisp FOO is a name of a function, not a function itself.

Thus FOO evaluates to a function (otherwise it would be an error) in a Lisp-1 like Scheme. In a Lisp-2 like Common Lisp, one would say that the function value of FOO is retrieved.

> Indeed, when strictly evaluating (foo '(1 2)), first the arguments are > evaluated

Actually not. In Lisp the first item needs to be looked at first. If it is determined to name a function, then we can evaluate the arguments, of which there is only one in this case.

<comment><USER9> You are right about both points!

PS: The second you quoted out of order. If you reread, you will see that I was referring to FOO as the first "argument" (a typo for "element"..).

</comment></comment></comment></comment></comment></comment><comment><USER11> I also have made one based on Norvig's: [https://gist.github.com/jmikkola/b7c6c644dff1c07891c698f0a52...](https://gist.github.com/jmikkola/b7c6c644dff1c07891c698f0a527a890)

</comment><comment><USER12> Careful: any time someone says they built a lisp quickly, somehow it _always_ manages to leave out the whole (a . b) cons notation.

It's amazing just how difficult that little problem makes everything.

<comment><USER13> They also leave out _unwind-protect_ and any means to recover from an error.

</comment></comment><comment><USER14> It seems almost a right of passage for a programmer to build/attempt a lisp/pseudo-lisp implementation. Quite honestly, when I made my (very poor) attempt, it was one of the most fun, and most frustrating projects I had done at the time, and I would highly recommend every developer have shot at building some kind of lisp.

One thing I did notice in this implementation, is the lack of quoting and cons notation. Although, cons is a weird one in the lisp world given it is the only infix operator in the language.

</comment><comment><USER15> (test "this ) will not ( work")

<comment><USER15> But in the linked repository the tokenizer has been adjusted: [https://github.com/maryrosecook/littlelisp/blob/master/littl...](https://github.com/maryrosecook/littlelisp/blob/master/littlelisp.js#L112-L128)

</comment></comment><comment><USER16> This is an interpreter, not a compiler. The page title itself, "Little Lisp interpreter" is more accurate.

<comment><USER17> Thanks, we've updated the title from "A lisp compiler in JavaScript".</comment></comment>


Standard Interface Between a Text Editor and an IDE? - <AUTHOR> http://dmitryfrank.com/blog/2015/1009_why_we_still_don_t_have_any_standard_interface_between_a_text_editor_and_an_ide <comment><USER2> A very popular idea, and one that emacs has done quite a bit with. Vim is coming along (the original vi was not the scriptable machine like emacs so emacs had a head start)

This was also the basis for some 'glue' languages, the one I'm most familar with was REXX (and later NetREXX) which created a "port" in an application that could be driven by another application. So the text editor could connect to the compiler or debugger's Rexx port and drive it remotely using the editor screen's resources for i/o. A good place to look at that was the Amiga back in the mid 90's.</comment>


Twitter lets you use 2FA without a phone number - <AUTHOR> https://twitter.com/TwitterSupport/status/1197630682631221248 <comment><USER2> No doubt because Jack Dorsey was SIM jacked[1]. SMS 2FA is incredibly insecure.

[1] [https://www.nytimes.com/2019/09/05/technology/sim-swap- jack-...](https://www.nytimes.com/2019/09/05/technology/sim-swap-jack-dorsey- hack.html)

<comment><USER3> I still dont understand this, if SIM Swapping were the problem then it isn't SMS 2FA that is insecure, it is the telco themselves, and specially US Telco.

In many other part of the world, Switching Sim ( SIM Swapping ) requires to show proof of identification, as well as written form and signature.

And any CS accessing customer information are instantly logged, there is no way paying $1000 dollar to change or SIM Swap without going through the proper procedure, ( Should there be one ) and they will be fired for any misconduct.

SMS might not be the best solution to security, but for average Joe, that is near 4 billion of Smartphone users they are better than nothing.

May be had Apple created their own MVNO this problem could be solved.

<comment><USER4> As far as I know, the service telcos provide is the ability to make calls, receive calls, send text messages, receive them, etc.

Telcos don't get paid to securely provide SIMs. They make hardly any claims regarding the security of your calls, text messages, etc.

So it is rather odd to hold telcos reponsible for the failure of some security mechanism they where never part of.

<comment><USER5> The rationalisation here is mindblowing.

By the same logic, no company should ever be held responsible for harm to users of their products caused by product defects: after all, they never made any claims regarding their products being safe to use.

<comment><USER6> I mean I think the ship has pretty much sailed on this one but I think they've got a case when companies just started using "can receive a text at a given number" as a security verification which suddenly made it the telco's problem to make sure such a thing was secure when before it was a more informal system.

</comment></comment></comment></comment></comment><comment><USER7> Unfortunately there are two big problems:

\-- You can't provision more than one security key. I want to provision a backup key.

\-- You must have TOTP or text-message 2FA enabled in order to use a security key. But the very reason I want to use a security key is because I don't want to trust my phone!

<comment><USER8> >I don't want to trust my phone!

That's an interesting threat model that I don't hear very often. Can you expand on what threats you're trying to protect against? If you ever sign in to Twitter on your phone, you're trusting your phone with your Twitter account at least to some degree.

The main thing security keys protect against that TOTP doesn't is phishing.

<comment><USER9> You don't necessarily login to Twitter on the phone (I don't for instance). Even if you did, your login credentials are considered more sensitive data than the session cookie you get after you're signed in. As with the Twitter app, the window of time in which your login creds are in memory is short. With a TOTP app holding your private key around, you basically have half the credential available at all times (unless of course the TOTP app makes use of the mobile platform's hardware chip to encrypt the private key when app is not in use).

<comment><USER8> Yes, but assuming your phone is compromised, it can intercept the password and security key as you sign in, and take over your Twitter account. In fact if you use your security key to sign in to anything on your phone, the phone malware can use it to access any account linked to the security key (assuming the malware has your password). So even if you don't sign in to Twitter on your phone you're still vulnerable.

And even if you are already signed in to everything and think you won't ever need to sign in on your phone again, the malware can force a logout of something, and you won't be able to know if it was just some software update or expiration that signed you out. So you'll sign in again, and the malware will intercept your security key.

<comment><USER7> I have never used my Yubikey with my phone for any application, I don't even know if it works, and I see no reason why I would start. I almost never use Twitter on my phone and if I switched Twitter to my Yubikey, I would never use it on my phone.

</comment></comment></comment></comment></comment><comment><USER10> Twitter,google and the rest refuse to let you register without a phone number and they are agressive about not letting burner services.

So I spend money buying burner sims. I can. But normal people can't. They use phone numbers more than IP addresses to uniquely identify people. Never use apps if you can use a website!

And screw these companies that are sneakily hostile against their own user base.

<comment><USER11> I use a lot of burner phones cuz I'm paranoid, and when you sign up for fb/google/whatever they treat a burner phone you just turned on completely different from your regular, existing phone number. Example: if you activate a burner phone and sign up for tinder with the number, it pauses after you enter the code and then asks for your email address. You have to sepetately login and verify your email. On the other hand, if you sign up for tinder with your normal number you're verified; it doesn't request an email address. They get some kind of information packet about your account that I would guess includes activation date, your approximate age, whether your service is prepaid etc. I should say, I use the term "burner" for a cheap Android phone you insert a bring your own SIM into. Don't worry, it's not that anonymous because they also track/correlate your device IMEI with the services you use. I had an interesting experience the other day. The burner phone service expired, and tinder knew within 24 hours the number was no longer active...... Creepy.

2010-2019 has been the smart phone decade and now it's coming to an end. I'm celebrating by letting my cell service expire. My smart phones leak way too much data. I'll be using my too-smart phones like an ipad, making and receiving calls and texts only when I'm connected to WiFi at home.

<comment><USER10> I have the same experience with tinder. They build shadow profiles on you, and they're not even discreet about it if you look at their traffic. I get whole phones with sim cheap.

<comment><USER11> It's the implementation of a "social credit" system. I don't know all the details but they evaluate your "social media creditworthiness" through your phone number.

I don't agree to any TOS with tinder and I really doubt they "delete all my information" when I delete the account like it says.

In fact my guess is they just leave your profile active if it's popular to encourage other people to "match" with you.

<comment><USER12> > In fact my guess is they just leave your profile active if it's popular to > encourage other people to "match" with you.

I wouldn't go to the extent of saying they don't do it, but I think it's very unlikely due to the nature of their service. It's different of, say, Facebook, that can do it without anyone knowing. If I got into a relationship and close my Tinder account but they kept it alive, a single friend can find it and tell my partner. If this happens too often word will spread that something shady is going on.

</comment></comment></comment></comment></comment><comment><USER13> Why can't we have more than one u2f key??? The most important guarantee that u2f gives you is a significant reduction in phishing risk. I can still be phished with a totp code by a social engineering attack and something like Modlishka...

<comment><USER14> Yeah, recently demo'ed Modlishka to my org, really scary stuff...

Re U2F keys: I think I would prefer a security model where I provision a U2F key based on some master secret stored in a "secure" but accessible way, i.e paper. Then I could create a new key with the same secret when I loose or break the first one.

Having two U2F fobs seems almost like having two different locks on all your doors, setup so that only one is needed to open the door.

<comment><USER15> It's possible to do what you describe with existing open-source/open-hardware U2F security keys, as they let you define the master secret from which the per-site private elliptic keys are generated. I haven't personally tried it, though.

But for security you should still have at least two U2F security keys using different master secrets (if you lose one security key, you can deactivate it without deactivating the other).

</comment></comment></comment><comment><USER16> I simply refuse to do 2FA with phone number. I change phone providers and phone number more often than email provider. I generally don't trust my phone provider to act responsibly and fully expect to get ripped off by them and their customer support to do all the wrong things.

I implemented 2FA server and frontend support at some point and it's stupidly easy to do. It's arguably a lot easier to do than building SMS based 2FA because you don't need the integration with SMS. All you do is show a QR code, store the shared secret, and then run a simple algorithm to verify the current code and timestamp line up with what the user typed when they login. The algorithm for generating codes compatible with Google Authenticator, Authy, etc. is available in OSS form for several languages. Same for QR code generation. The rest is bog standard UX work and a bit of DB plumbing.

</comment><comment><USER17> As if they won't arbitrarily lock your account and force you to enter a phone number because of "suspicious behavior" anyway...

You could already disable SMS 2FA after enabling TOTP, but removing your phone number completely used to disable 2FA.

<comment> VvR-Ox Same here. I didn't want to give them my number and they blocked my account because of 'suspicious behaviour'.

Now I wrote to their support after reading this and I am very interested in their response.

I think if they go on trying to force me I will just delete the account. This is the only thing that helps those companies to understand their users needs when they have problems listening or seeing them on their own, I'm afraid.

<comment> VvR-Ox UPDATE: The support was very fast and kind and they unlocked my account without the need to provide a phone number.

</comment></comment></comment><comment><USER18> Facebook doesn't even let you sign up without a phone number anymore. How did we get here?

<comment><USER19> Well, I think the argument (whether you buy it or not) would be that platforms like Twitter and Facebook are trying to curtail abuse and bots, and "owning a phone number" is a decent way to tell if someone's human. To my knowledge, neither has ever texted or used the phone numbers for anything other than verification.

<comment><USER20> Ahem: [https://www.engadget.com/2018/09/28/facebook-two-factor- phon...](https://www.engadget.com/2018/09/28/facebook-two-factor-phone- numbers-ads/)

<comment><USER21> Both can be true. I tried to open an anonymous Facebook account. Could never succeed. My twilio number was refused. I couldn't give my normal phone because it's already associated with my other Facebook account. They do want to limit the number of accounts per person even if that meant more accounts to advertise.

</comment></comment></comment></comment><comment><USER22> This is great.

I ported my primary phone number into Twilio years ago. Most apps/websites have no problem with a `voip` number type. But some systems, including Twitter, have refused to accept it.

<comment><USER23> Why did you port your number to Twilio? Isn't it a pain for things like group messaging?

<comment><USER24> Not OP but I think I've participated in a group SMS maybe twice in 10 years and initiated none. I don't feel like I'd be missing out by not having group messaging support.

<comment><USER25> The problem is, you have no idea if you're missing out because you aren't getting them.

I use Google Voice and my family uses group text to coordinate things like dinner. I only knew about dinner because my wife gets the group texts.

GVoice eventually fixed the group text problem, but I don't get all the messages and I get them out of order. I also get other group texts with important info that I wasn't getting before.

I have no idea how many other group texts I'm missing out on that I might actually want to be a part of or was missing out on. Everyone assumes that group text works with all recipients all the time, and since it has no way of telling the sender it failed to deliver, no one ever follows up.

<comment><USER21> Depends on geography. In Canada it's WhatsApp and Messenger groups. Never had a group text. Not saying it's the same across the country but don't assume that other are missing on group text, I could get group text and I don't.

</comment></comment></comment></comment></comment><comment><USER26> But if you reply to a tweet too soon to be misidentified as Bot & get blocked; then you have no choice but to link your mobile number to get unblocked.

<comment><USER27> You don't even have to tweet before you get blocked. I created an account, after a few minutes of looking around, I was blockeed. (Still blocked, because not worth it.)

<comment><USER26> Were you on VPN/Tor, not that I'm implying it's a legible case to block; but I've read VPN/Tor usage on Twitter will lead you to mobile linking inevitably due to said issue.

<comment><USER28> I had the same experience. Not on VPN/Tor/anything. Before I even posted a single tweet I got blocked by a generic "our algorithms think you violated community guidelines" or something.

</comment></comment></comment></comment><comment><USER29> Who came up with the idea of using SMS for 2FA in the first place instead of e-mail? It sounds insane.

</comment><comment><USER30> I don't understand. I already have authenticator app ticked, and this doesn't appear to be the new default - I have it in the authenticator app already too. If I untick SMS, it says this will disable 2FA. What gives?

EDIT

Looks like a bug. Deleting the phone number gives no such warning, and 2FA continues to work.

</comment><comment><USER31> This is wonderful news. I hope that others follow their example. (In particular, Apple...)

</comment><comment><USER32> Good move!

A 2FA system that requires me to give a phone number is a 2FA system that I won't use. I'm not about to give my phone number out to most companies, and I'm too lazy to go get a burner phone just to set up 2FA.

</comment><comment><USER33> Strange. Since any new account I add to the site gets locked after about ten minutes and demands a phone number to verify.

I get the account unlocked after a few days if I pester support about it. (which is not easy either)

</comment><comment> AA-BA-94-2A-56 I still can't log into Twitter because they refuse to send the verification to my phone number. It's been three weeks of multiple emails to their support.

All this and I only need the damn thing for my data analysis course.

</comment><comment><USER34> I hope paypal and transferwise follow this example. International travelers have been suffering for years due to this horrible ux.

SMS based 2FA is a farce, I look forward to it going extinct.

<comment><USER35> PayPal[1] and TransferWise[2] already support TOTP, am I missing something?

[1] [https://www.paypal.com/us/smarthelp/article/faq4057](https://www.paypal.com/us/smarthelp/article/faq4057)

[2] [https://transferwise.com/help/12/managing-your- profile/29321...](https://transferwise.com/help/12/managing-your- profile/2932125)

<comment><USER34> Both require that you have sms based 2fa first. I have had this conversation with both of their support departments and its a non starter.

</comment></comment></comment><comment><USER36> We need to stop calling this 2FA. If you can reset your password via text or email, it's not. I rather have no way of reseting the password. And if it is lost, it is lost.

<comment><USER37> Exactly. SMS as a 2FA option is _worse_ than no 2FA. It actually creates a _new_ attack vector.

</comment></comment><comment><USER38> I had 2 twitter old accounts over the years, I stopped using twitter and I end up having both disabled. I messaged their support but got no answer.

</comment><comment><USER39> Good, but pathetic that it took so long. The only other 2FA I still do via SMS occasionally is a bank.

</comment><comment><USER40> I'm glad this happened; I've been waiting for more than 5 years for this.

</comment><comment><USER41> I can't believe it's taken them this long for proper 2FA.

<comment><USER42> Not proper as it only allows a single key.

<comment><USER39> You could argue that it's up to you to have a proper key backup strategy (ie not Google Authenticator). You don't have several user names and passwords for one account, either.

<comment><USER43> The specification for WebAuthn (Security Keys) explicitly tells implementers they SHOULD support multiple tokens because otherwise the recovery scenario is terrible.

You can't realistically "back up" cheap Security Keys, their whole design is predicated on your being unable to extract the secret inside them which makes them work.

<comment><USER39> Thanks, I stand corrected.

</comment></comment></comment></comment></comment><comment><USER44> But I still had to add and verify my email before I could add 2FA.

</comment><comment><USER45> Let me guess (they didn't define it on linked page) - 2FA with a physical token only works in Googlenet Chrome?

</comment><comment><USER46> And people in the 60s thought we would be commuting in flying cars by now.

</comment><comment><USER47> What took Twitter so long?</comment>


Easy way to make backup of Linux server in a minute - <AUTHOR> http://bitcalm.com?link=18&utm_source=Hacker&utm_medium=Link&utm_campaign=Link%20%2B%20Hacker%20%2B%2016.01

<comment><USER2> I see they transfer the data over SSL/TLS to Amazon's S3, but it appears the data is not encrypted prior-or-after the transfer -- meaning Amazon and/or BitCalm.com has access to your data.

It should do client-side encryption of the data, then send it over SSL/TLS to Amazon S3.</comment>


Show HN: Newsletter covering big topics – daily - <AUTHOR> https://outsideplatoscave.substack.com/p/outside-platos-cave-2 <comment><AUTHOR> New episode out !! Please subscribe we are growing a lot and it is 100% free.</comment>


Apple's Next Launch | A Smart TV - <AUTHOR> http://blog.makeitwork.com/apples-next-launch-a-smart-tv/ <comment><USER2> Wish the article was substantive, but it's mostly conjecture without a real conclusion. I guess we'll find out in the next year or so.</comment>


How I Get Enough Sleep to Maintain a Healthy, Productive Life - <AUTHOR> http://www.huffingtonpost.com/joel-sandberg-md/how-i-get-enough-sleep-to_b_8265562.html?1444332097 <comment><USER2> It is a interesting article about sleep. It is very hard to balance among your work life, your social life and sleep. Many people think that sleep is the waste of time because they think that the amount of time spending of sleeping can be used to do something more useful. We can see that the author of the article can always make time for the sleep.</comment>


Growing a Language, by Guy Steele - <AUTHOR> http://video.google.com/videoplay?docid=-8860158196198824415#

<comment><AUTHOR> Also, the paper:

<http://www.brics.dk/~hosc/local/HOSC-12-3-pp221-236.pdf>

</comment><comment><USER2> The way he demonstrated what he was talking about with the way he talked about it reminded me a bit of the dialogues in Godel, Escher, Bach. Cleverly done.</comment>


Click – Python library for command-line interfaces - <AUTHOR> http://click.pocoo.org/ <comment><USER2> I did not expect this to be on hackernews this early. I want to point out that I have not made a release yet and it's not yet feature complete. Mainly I want to ask for feedback on the general design.

<comment><USER3> Armin, my feedback is in the form of my own version of this library.[1] I have been working on this on and off for some time and like you have not made a release. That said, I have been using it quite a bit both in my research and at work and I think it helps.

The main idea behind it is make it easy to write a "getopt" style program with arbitrary command nesting. I have found that although argparse and sisters are nice libraries they don't allow me to do many of things I like to do in my interfaces. For instance sometimes like options such as

        foo -x a -x y -x q ...

where I would process that into like so:

        extras = list()
        for opt, arg in opts:
            if opt in ('-h', '--help',):
                util.usage()
            ...
            elif opt in ('-x', '--extra'):
                extras.append(validate_or_die(arg))

I also believe that you should have "fast fail" validators. So I have several in `optutils` which are like:

        util.assert_dir_exists(path)

which if a directory doesn't exist on the path it creates it. If there is already a file there and it isn't a directory it dies with an error. When it dies, I try and have unique exit codes for various errors (for testability) and provide usage information immediately. This style is nice because it provides immediate feedback to the user with no fuss. I think a lot of "option parser frameworks" miss the point in having lots of things for parsing ints and things. Most of the time I deal with files, directories, and "string" parameters which these libraries don't help with.

In general, the standard libraries make it way to hard to write really nice command line tools. I like some things about your library, but I think that you need to increase the flexibitly for how options are processsed to you can do whatever you want with them. I also think that option parsing and configuration should be integrated. I am working to support that but I am not there yet. (see optutils/conf.py for my current ideas)

[1] [https://github.com/timtadh/optutils](https://github.com/timtadh/optutils)

<comment><USER4> > I have found that although argparse and sisters are nice libraries they > don't allow me to do many of things I like to do in my interfaces. For > instance sometimes like options such as

?

This is trivial to do with argparse (or optparse for that matter):

        import argparse

        def a_prefixed(string):
            if not string.startswith('a'):
                raise argparse.ArgumentTypeError("%r does not start with 'a'" % string)
            return string

        parser = argparse.ArgumentParser()
        parser.add_argument('-x', '--extra', action='append', type=a_prefixed)

        print parser.parse_args()

resulting in:

        > python test.py -x afoo -x abar
        Namespace(extra=['afoo', 'abar'])
        > python test.py -x afoo -x baz
        usage: test.py [-h] [-x EXTRA]
        test.py: error: argument -x/--extra: 'baz' does not start with 'a'

> I also believe that you should have "fast fail" validators.

Isn't that what the callback parameter is for, especially with is_eager=True? Or ParamType if you need either something more reusable or something more extensive.

> Most of the time I deal with files, directories, and "string" parameters > which these libraries don't help with.

[http://click.pocoo.org/api/#click.File](http://click.pocoo.org/api/#click.File), argparse has something similar.

<comment><USER3> @masklinn good point. I haven't used argparse (mostly out of compatibility requirements with 2.6). So I may have mis-characterized the state of the art. It does do many things well. One note, is that the `prefix parsing` functionality could cause weird behavior when doing partial parsing (which I do a lot of).

> Isn't that what the callback parameter is for, especially with > is_eager=True? Or ParamType if you need either something more reusable or > something more extensive.

yes. I think almost everything should work like this. I think the getopt style makes this a bit easier to understand.

> > [http://click.pocoo.org/api/#click.File](http://click.pocoo.org/api/#click.File), > argparse has something similar.

Not at all the same. I never said my programs were going to open the files themselves. I often have to write automation scripts around other things. In these cases I need to make sure files and directories are sane but I don't open them. I just canonicalize them and pass them on.

The big thing is the lack of integration with configuration files which is something I am still working on myself.

</comment></comment></comment></comment><comment><USER5> Gorgeous. This guy has a full time job, a wife, and wrote Flask and Werkzeug, ItsDangerous, Sphinx, Markupsafe, Jinja2 (and Jinja) and that's just some of the well known stuff. Handsome and young too. Bastard. He probably saves the world in a dinner jacket in his spare time.

<comment><USER6> To be fair he only got married this month, so the jury is still out on where his productivity goes from here ;)

<comment><USER2> Given that I wrote parts of this on my honeymoon I think it helped. Fingers crossed :)

<comment><USER7> You never cease to amaze :D

<comment><USER8> That's actually not a good sign for future marital bliss.

<comment><USER9> o rly? ;)

</comment></comment></comment></comment></comment></comment><comment><USER10> It looks really well done.

I still prefer docopt ([https://github.com/docopt/docopt](https://github.com/docopt/docopt)) . It is so much simpler to use. Click seems to be a bit overengineered.

<comment><USER11> As someone who has never used either, the documentation and simple example of Click won hands down.

I could use it for simple cases within 15 seconds of reading. Docopt not so much.

<comment><USER12> You're right - looking on the [http://docopt.org/](http://docopt.org/) page it's not immediately obvious how it works.

The general idea is that you don't specify any code, you just give the help message as text. Docopt parses that to figure out all the options etc and convert those into the parameters coming in to your system.

It's a really clever idea. You specify the human interface, docopt converts that into the code version (so long as you adhere to a few common conventions). I haven't seen a cleaner system anywhere.

From their example:

        """Naval Fate.

        Usage:
          naval_fate.py ship new <name>...
          naval_fate.py ship <name> move <x> <y> [--speed=<kn>]
          naval_fate.py ship shoot <x> <y>
          naval_fate.py mine (set|remove) <x> <y> [--moored | --drifting]
          naval_fate.py (-h | --help)
          naval_fate.py --version

        Options:
          -h --help     Show this screen.
          --version     Show version.
          --speed=<kn>  Speed in knots [default: 10].
          --moored      Moored (anchored) mine.
          --drifting    Drifting mine.

        """
        from docopt import docopt

        if __name__ == '__main__':
            arguments = docopt(__doc__, version='Naval Fate 2.0')
            print(arguments)

<comment><USER13> That's brilliant. I wonder if there's a way to use docstrings like that to create REST services in Flask.

</comment></comment></comment></comment><comment><USER14> Does anybody know docopt? I really like it because you simply write the help/usage as text and docopt automatically generates the parser for it.

Take a look at the example in the README: [https://github.com/docopt/docopt](https://github.com/docopt/docopt)

<comment><USER15> I'm using docopt....It's really nice with it's automagicness. But for some stuff it's just not enough, too unflexible. I'm really excited about click.

</comment></comment><comment><USER16> It seems to me that there are a few projects similar this. Here is another, [https://pypi.python.org/pypi/Cogs/](https://pypi.python.org/pypi/Cogs/) (conceptualized as a "Makefile" replacement).

I'm wondering if there could be a breakout at the next PyCon to see if we could discuss approaches and come up with a unified way to do convert Python libraries into command line scripts?

<comment><USER17> Yeah, plenty:

\- Cliff [http://cliff.readthedocs.org/en/latest/](http://cliff.readthedocs.org/en/latest/)

\- docopt [http://docopt.org](http://docopt.org)

\- argparse

\- optparse

etc etc etc...

<comment><USER18> And the author acknowledges that:

"There are many alternatives to click and you can have a look at them if you enjoy them better. The obvious ones are optparse and argparse from the standard library.

click is actually implemented as a wrapper around optparse and does not implement any parsing itself. The reason it's not based on argparse is that argparse's design does not allow proper nesting of commands by design and has some deficiencies when it comes to POSIX compliant argument handling."

What I love about Pocoo is they always have stellar documentation and give clear rationale - from the beginning.

<comment><USER19> Does that mean optparse will be maintained along with click? optparse has been deprecated in favor of argparse since 2.7/3.2.

<comment><USER2> Given that argparse has known problems and that not all optparse code can be ported to argparse I doubt optparse will ever go away. It's also a very small module and if optparse will ever disappear only a subset of optparse is needed to make click work.

</comment></comment></comment></comment></comment><comment><USER20> Kudos again to the pocoo team for creating such a simple and useful library. It sure beats optparse :)

On a side note, however, does anyone know why the team prefers to wrap functions in decorators? Flask also uses them, but what's the design decision behind them?

<comment><USER5> Decorators are so simple and minimalistic and elegant and easy to understand. They can surface an arbitrary amount of extra functionality with a single statement. For example, ensure a function is only accessible to authenticated users by simply saying something like @requires_authenticated_user. Another example would be to create a logging decorator to wrap a function or a class to create a log of every time the function is accessed @log_function_access. Or to wrap a function to ensure that every access to the properties of that function are pushed through some sort of validation or transformation @validate_set or @transform_get. Decorators allow encapsulation of functions within other functional concepts with almost no code, that's the design decision for using them.

<comment><USER21> Yep, it's best us case is basically acting as pythons anonymous function (since lambdas suck for everything but the most trivial things).

Where in js flask might read app.route('/', function(){//do something}); python uses a decorator right above a regular function definition. The alternative is to manually add it after it's defined (in flask that's add_url_rule), but that kind of hides the intent of the function and is more cumbersome as you need to manually pass in the fn name.

</comment></comment></comment><comment><USER22> On a related note. Which python library would you recommend for text-based interfaces? I have never used ncurses, so I don't know how complex it is. What I would like to achieve is having a user launch my script from the command line, use the text based interface to select a source and destination folder, set a few parameters and show a progress bar.

<comment><USER23> I'd say [http://urwid.org/](http://urwid.org/) should be the best choice for something like that. The main alternative would be to hack it together by yourself using [https://docs.python.org/3.4/library/curses.html](https://docs.python.org/3.4/library/curses.html)

<comment><USER24> Urwid is definitely the nicest of the curses widget frameworks I've used for python.

</comment></comment></comment><comment><USER25> >You can get the library directly from PyPI:

>pip install click

Well... no you cannot. See the page: [https://pypi.python.org/pypi/click](https://pypi.python.org/pypi/click)

The package hasn't been uploaded yet. However one can install it straight from the git repo:

> pip install git+ssh://firstname.lastname@example.com:mitsuhiko/click.git

<comment><USER26> > pip install git+ssh://firstname.lastname@example.com:mitsuhiko/click.git

Can someone comment regarding using pip like that? Is it fine to put this on req.txt? Any best practices somewhere?

<comment><USER17> That syntax is usually meant for packages that you want to edit after installation (with -e).

If you plan to release your stuff, the dependencies in your req.txt should be as pinned as possible. The classic example is Requests: when it changed the API fairly significantly, umpteen installers broke... just because people did not bother with specifying a version for that lib.

</comment></comment></comment><comment><USER27> A bit off-topic, but I like how pocoo.org uses different fonts for different projects:

Flask: Georgia for text, Garamond for titles

Werkzeug: Lucida Grande for text, Ubuntu for titles

And now click: Ubuntu Mono for text, Open Sans for titles

<comment><USER28> I had the same thought, and will almost certainly be cribbing this page's body-text font stack...

 _font-family: 'Ubuntu Mono','Consolas','Menlo','Deja Vu Sans Mono','Bitstream Vera Sans Mono';_

...(fulfilled by Menlo on my Mac) for a future project.

</comment></comment><comment><USER29> Why is it that (nearly) every description I read about some random new Python command wrapper fails to get the "python" and ".py" out of the command examples, even in Linux?

I don't blame this particular offering, since I don't think release was actually planned just yet and any number of other projects have made the same subtle mistake.

Command Name Extensions are Harmful. Don't expose such an implementation detail in every example, lest everyone actually follow them. Use the "#!/usr/bin/env python" or whatever at the top of your scripts. And yes, you can keep the .py if what you have is a library, not just a command (but it's nice to then make a wrapper the doesn't expose the implementation language). And obviously in other OSes where the command extension can be omitted and still work this isn't such a big deal.

But in Unix/Linux, commands should be reimplementable in a different language without making some .(extension) a like, retained to keep from breaking other things that depend on it. Just say no :-)

<comment><USER30> Did you see the last part on setuptools?

It actually shows you how to set it up so you don't even use a #!, but rely on setuptools to make an executable for you, that'll work in a vitualenv or on windows. And the script name doesn't have .py at the end in his example, though he doesn't call that out specifically.

</comment></comment><comment><USER31> I should write up a comparison between:

\- Cement ([http://builtoncement.com](http://builtoncement.com))

\- Cliff ([http://cliff.readthedocs.org/en/latest/](http://cliff.readthedocs.org/en/latest/))

\- Plumbum ([http://plumbum.readthedocs.org](http://plumbum.readthedocs.org))

\- Argh ([https://pypi.python.org/pypi/argh/0.24.1](https://pypi.python.org/pypi/argh/0.24.1))

\- Aaargh ([https://github.com/wbolster/aaargh](https://github.com/wbolster/aaargh))

\- Baker ([https://pypi.python.org/pypi/Baker/](https://pypi.python.org/pypi/Baker/))

So many more to choose from. Now we get to evaluate Click. Seems like the reason Armin wrote Click was to load options dynamically, but that's what Cliff does via stevedore ([https://github.com/dreamhost/stevedore](https://github.com/dreamhost/stevedore)).

My favorite feature about Cliff though is: [http://cliff.readthedocs.org/en/latest/complete.html](http://cliff.readthedocs.org/en/latest/complete.html) which comes out of the box, but then again, there's Argcomplete ([https://github.com/kislyuk/argcomplete](https://github.com/kislyuk/argcomplete)).

EDIT: Updating from previous posters

\- Naked ([http://naked-py.com](http://naked-py.com))

\- Docopt ([http://docopt.org](http://docopt.org))

\- Clint ([https://github.com/kennethreitz/clint](https://github.com/kennethreitz/clint))

\- Argvard ([https://github.com/DasIch/argvard](https://github.com/DasIch/argvard))

\- Commandr ([https://github.com/tellapart/commandr](https://github.com/tellapart/commandr))

\- Argtools ([https://pypi.python.org/pypi/argtools/0.1.2](https://pypi.python.org/pypi/argtools/0.1.2))

\- Plac ([https://pypi.python.org/pypi/plac](https://pypi.python.org/pypi/plac))

<comment><USER32> Clime ([https://github.com/moskytw/clime](https://github.com/moskytw/clime))

</comment></comment><comment><USER33> This looks pretty similar to aargvard [1] (which is, as stated in the README, inspired by flask).

[1] [https://github.com/DasIch/argvard](https://github.com/DasIch/argvard)

</comment><comment><USER34> [https://readthedocs.org/projects/argh/](https://readthedocs.org/projects/argh/)

<comment><USER35> I also really like argh, though it seems the provided link documents an api the mandates decorators and in fact what I like about argh is that functions can remain clean. [http://argh.readthedocs.org/en/latest/](http://argh.readthedocs.org/en/latest/)

<comment><USER36> You're never forced to use decorators, they're just syntactic sugar.

Their example:

      @click.command()
      @click.option('--count', default=1, help='number of greetings')
      @click.option('--name', prompt='Your name',
                  help='the person to greet', required=True)
      def hello(count, name):
          for x in range(count):
              print('Hello %s!' % name)

Could be written as:

      def hello(count, name):
          for x in range(count):
              print('Hello %s!' % name

      hello = click.option('--name', prompt='Your name',
                 help='the person to greet', required=True)(hello)
      hello = click.option('--count', default=1, help='number of greetings')(hello)
      hello = click.command(hello)

<comment><USER37> The command decorator is nice, but the group decorator feels wrong, why create a function that does nothing just to decorate it? I'd rather use `cli = click.Group()`.

</comment></comment></comment></comment><comment><USER38> The biggest gripe I have with using Python for rich command-line tool is the startup time. One of the first reason I like to write a nice command-line tool when I start a project, say foo, is to be able to do `foo --help` to quickly see and remember what the project can do (I have a very bad memory and doing this makes it possible for me to jump back faster to a project, even well documented. I can forget what I was doing in just a few days and so I add a lot of small commands).

In short running `foo --help` should be instant and if it loads all its modules to list the different sub-commands and their respective description it is really too slow.

A possibility is to cache some information (e.g. generate a text file or a small Python script).

<comment><USER39> I'm completely clueless about this, but would it be possible to have a persistent python interpreter always running in the background somehow, and submit the commands to it?

<comment><USER40> You can keep ipython kernel running in background if you want. Quick unscientific test showed that it didn't reduce ipython console startup time significantly. But it should be possible to make a leaner console to connect to the kernel.

edit: my test was flawed, with more accurate test there is almost a full second time difference:

        $ echo -n | time ipython console --existing kernel-29793.json
        1.06user 0.06system 0:01.52elapsed 74%CPU (0avgtext+0avgdata 29968maxresident)k
        0inputs+64outputs (0major+19245minor)pagefaults 0swaps
        $ echo -n | time ipython console
        1.07user 0.08system 0:02.40elapsed 48%CPU (0avgtext+0avgdata 30264maxresident)k
        0inputs+72outputs (0major+20538minor)pagefaults 0swaps

of course two seconds is ridiculously slow either way

</comment></comment></comment><comment><USER41> Ahh.. I really like pocoo's products. But I've found manage.py ([https://github.com/Birdback/manage.py](https://github.com/Birdback/manage.py)) to be far leaner and simple. What do you guys think?

<comment><USER42> don't like that, clashes with Django

<comment><USER43> I think this is intentional.

Django's manage command is already extensible, so if you're using Django then perhaps it's best to use its tool chain.

</comment></comment></comment><comment><USER44> This doesn't look much different than argh, which has been around for ages: [http://argh.readthedocs.org/en/latest/tutorial.html](http://argh.readthedocs.org/en/latest/tutorial.html)

</comment><comment><USER45> Looks nice but the example looks almost exactly like [https://pypi.python.org/pypi/argtools/0.1.2](https://pypi.python.org/pypi/argtools/0.1.2)

</comment><comment><USER46> Reminds me of Commandr. Both use decorators. [https://github.com/tellapart/commandr](https://github.com/tellapart/commandr)

</comment><comment><USER47> Little unfortunate naming. Isn't Click a trademark of ASF? [http://click.apache.org/](http://click.apache.org/)

</comment><comment><USER48> Looks like a nice wrapper around argparse: [https://docs.python.org/3/library/argparse.html](https://docs.python.org/3/library/argparse.html)

<comment><USER49> It's a wrapper around optparse, as per [http://click.pocoo.org/why/](http://click.pocoo.org/why/).

I'm curious about that decision given that optparse is deprecated. It says it's because argparse doesn't allow nested commands, but I don't really see why that feature is so desirable as to warrant using a deprecated module. I probably need to have a play with it to find out.

Looks like a nice module.

<comment><USER2> Click can be extended lazily which helps execution time a lot when working with many, many plugins. It also can be extended at runtime as per configuraton.

argparse requires the parser to have full knowledge of everything which makes it slow if you add many commands. Biggest problem though is that it's parsing system is a bit broken when it comes to escaping. Options with arguments cannot have values starting with dashes which is problematic for delegating subcommands to other things.

For what I wrote Click for I could not find any alternatives that worked that way besides optparse itself but that is hard to use.

<comment><USER50> Can you provide an example of what you're saying? I've found that argparse.ArgumentParser.parse_known_args() and sub-parsers can do everything I can see click doing. Including lazy loading of plugins and the like.

<comment><USER2> Argparse has too magic of a design that you could fully nest it. I tried it many times but you always run into it's limitations.

Links to some open bugs on it:

      * http://bugs.python.org/issue13966
      * http://bugs.python.org/issue14191

</comment></comment></comment></comment></comment><comment><USER51> Trying to figure out how this compares to Naked ([http://naked- py.com](http://naked-py.com)) in terms of goals.

</comment><comment><USER52> Time to rewrite some of my dirty command-line programs

</comment><comment><USER53> [https://github.com/mitsuhiko/click](https://github.com/mitsuhiko/click)

</comment><comment><USER54> user@uweb1:/$ pip install click Downloading/unpacking click Could not find any downloads that satisfy the requirement click No distributions at all found for click

</comment><comment><USER55> do you know plac[0]?

[0] [https://pypi.python.org/pypi/plac](https://pypi.python.org/pypi/plac)

</comment><comment><USER56> There are like 20 libraries for this already and this looks very similar to those. But Armin Ronacher, therefore it will be popular

</comment><comment><USER57> the name is a bit oxymoronic

</comment><comment><USER58> is there anything like this for Go?

<comment><USER59> Can't say I've tried it but the above-mentioned docopt has a Go implementation: [https://github.com/docopt/docopt.go](https://github.com/docopt/docopt.go)</comment></comment>


Death to the Stock Photo - <AUTHOR> http://join.deathtothestockphoto.com/ <comment><USER2> Great service. If I could make one suggestion, it would be to show more of the photos without requiring the user to sign up. As it is, I expected to be able to scroll down a bit (as is the trend with deep landing pages) and was annoyed that there was nothing below the fold. And unfortunately, most of the photos on the landing page look like stock photos or too generic for some people's tastes.</comment>


Ask HN: Start-up idea in existing company, what compensation should I expect? - <AUTHOR>

Hacker News focuses mainly on start-up ideas that receive outside funding but I have a question about creating a company from within the company I work for.
Let me preface this by noting that I had this idea before I joined the company. The product/service would combine a web interface with manufacturing. My employers existing manufacturing infrastructure is a perfect fit; we would just need to build is the web interface (and obviously market it).
If I bring this idea to my company what kind of compensation should I expect? A raise? Equity in the new venture? If an idea is "1% inspiration, 99% perspiration", how about at least 1% ownership? <comment><USER2> How long is a piece of string?

This really depends on a lot of factors, not the least of which are: 1) the non-obviousness of the idea, 2) the degree to which you have the idea developed as something that can be implemented, and 3) the attitude of your current employer.

My guess: if all you're coming to them with is a vague idea, you're likely to get nothing more than a pat on the back, if they deign to implement it at all.

</comment><comment><USER3> Do you have any clauses about intellectual property, ideas, inventions in your employee contract? Be sure to analyze it carefully - speak to a lawyer if it isn't clear to you.

Even if there are clauses in your contract stating the company can keep your ideas without compensation, sometimes companies are decent and good about that sort of thing.</comment>


The Alpine Docker Mistake - <AUTHOR> http://technosophos.com/2016/02/25/the-alpine-mistake.html <comment><USER2> The article spends a lot of time on a metaphor and vague claims, but IMHO doesn't do anything to convince me that the arguments are good ones, never citing relevant concrete issues. (I mean, really, "tar" doesn't have all the flags that it does on your desktop, that's the most specific criticism you can come up with?)</comment>


Register domain names with Twitter - <AUTHOR> http://tweetname.com/ <comment><USER2> Why would I want to pay $15 to register a domain via Twitter?

</comment><comment><USER3> There are too many useless twitter apps but maybe twitter will start a trend of "textual interface applications". I am personally working on one and there's a lot of reluctance about that kind of interface but if a "mainstream" player can help... I'm happy to have one more useless twitter app.

</comment><comment><USER4> What a bad idea. Please, no one register with them. I say this only for security concerns, nothing against them. You're going to directly link your credit card info with your twitter account...

<comment><AUTHOR> Yeah, I agree it's a security concern.

It's Phil Kaplan's site (Adbrite, FuckedCompany)

<comment><USER5> :potd: :mittens:

(For those not in on the joke, feel free to look up the history of Fucked Company)

Apparently they dropped the price already (12 dollars). Considering Godaddy is 7 dollars with a coupon, who would take the risk?</comment></comment></comment>


I hate stacked area charts (2011) - <AUTHOR> http://www.leancrew.com/all-this/2011/11/i-hate-stacked-area-charts/ <comment><USER3> I agree with the problem but disagree with the solution. I'd much prefer removing the stack completely and using overlapping plots, like this:

[http://i.imgur.com/zO7CuQG.png](http://i.imgur.com/zO7CuQG.png)

In a chart like this no data is lost in presentation. You can easily answer questions like "when did Android overtake iOS in marketshare?" and "is Windows Phone marketshare growing or shrinking?"

<comment><USER4> I don't like percentage plots. If one thing goes up by 1 point, then the rest must necessarily go down by 1 point (distributed between them). I think that's a bit confusing. I'd much prefer absolute values.

<comment><USER5> Isn't that exactly how it's supposed to work?

<comment><USER6> Yes, but human being seem to struggle with the concept, regularly assuming that a decreasing percentage necessarily implies a decreasing absolute number as well.

If they aim is to communicate a true representation of reality then you need to take that into account.

</comment></comment></comment></comment><comment><USER7> I was going to leave this as a comment on his blog but apparently comments are closed now.

Stacked bar charts are better, but only a little better.

Line charts overlaid on top of each other are most clear, to me.

Like this: [http://i.imgur.com/kyvpiax.png](http://i.imgur.com/kyvpiax.png)

<comment><USER8> To me they are far and away the worst, probably because I'm color deficient.

<comment><USER9> Can you recommend an Excel addon/color chooser or website so that persons with normal vision can test their charts and color choices for the four known kinds of color deficients?

It would of cource help you, if the chart lines have different line patterns (dottet lines).

<comment><USER10> [http://colorbrewer2.org](http://colorbrewer2.org) has some good palettes for data presentation which they describe as "colorblind safe". I assume this means for all kinds of deficiency.

</comment></comment></comment></comment><comment><USER11> While I agree to some of the points made in the post, I don't think the author provided a better alternative. Stacked bars are not any better for looking at how the percentage change on the green one.

[http://i.imgur.com/jfuJGu5.gif](http://i.imgur.com/jfuJGu5.gif)

Here is my solution:

* It retains the line aspect of it, which is essential as we are talking about a trend here.

* It easily allows you to see it both in stacked and overlapped lines. Each one of them is good at communicating clearly a certain point about the data.

* It also mitigates the problem in nostromo's comment, where a whole bunch of lines could overlap without a clear view on a single point of interest.

<comment><USER12> That doesn't translate to print (a problem with any dynamic content). Or even, say, to static screenshots.

<comment><USER11> Who's still printing these days? :) It's safe to say that iPads and smartphones have made it easy to consume content anywhere needed. Interactive documents are definitely where the puck is headed.

<comment><USER12> It happens more often than you'd think, and as I noted, even static screenshots or images won't reflect the dynamic nature of that graphic.

Those are both issues you could address with small multiples, a Tufte method.

</comment></comment></comment></comment><comment><USER13> The stacked bar chart is no better. Yes, it doesn't have the same distortion of making green look smaller towards the right, but it is very hard to see the slow growth.

Just use a normal line chart.

<comment><USER14> It's not perfect, but it's definitely better.

<comment><USER15> Yes, it's better, but using "better" stacked bar charts is not the advice I want people taking away from an otherwise valid complaint about stacked area charts. Volume is a [colorful] distraction.

</comment></comment></comment><comment><USER16> Here's a recent paper about how to compensate for this very illusion, by Heike Hoffman and Marie Vendettuoli: [http://users.soe.ucsc.edu/~pang/visweek/2013/infovis/papers/...](http://users.soe.ucsc.edu/~pang/visweek/2013/infovis/papers/hofmann.pdf)

</comment><comment><USER17> Rabble rabble rabble.

The solution described is incorrect. Area charts and column charts are used to display different types of information. Area charts (and line charts, similarly) are used to display continuous data - data that must pass through point B to get from point A to point C. Column charts are used for non- continuous data.

Some examples:

You should use an area chart (or just a line chart) when tracking your weight. If you weigh yourself on Tuesday and you weigh 150 lbs, and then weigh yourself on Thursday and you weigh 155 lbs, because of how weight works, you can assume that between Tuesday and Thursday your weight traveled through all the points required to get from 150 lbs to 155 lbs.

If you're tracking the amount of hours you sleep every night, you should use a column chart. Just because you get 6 hours of sleep on Tuesday and 8 hours of sleep on Thursday doesn't mean you got 7 hours of sleep on Wednesday. The data isn't continuous.

For market share, that data is continuous - you can't get from 10% market share to 15% market share without passing through all the percentages in- between. Therefore, a column chart is very much the wrong way to display that information.

<comment><USER18> Area charts differ from line charts though in that they emphasize the cumulative integral under the line. In your weight example, in general the total of your weights on each day multiplied by the number of days is not a meaningful statistic (except perhaps to the operator of the elevator in your building who is tracking cumulative strain on the support cables). An area chart makes sense if the product of the x-axis and y-axis units make sense.

Data continuity is a secondary concern; there's no reason not to have a stepped area chart, which is the union of a set of adjacent bars representing discrete measurements. And sleep hours per day do accumulate nicely over time, so an area-emphasizing plot does make sense (sleep hours per day * days = sleep hours). It lets you look at two parts of the chart and assess 'did I get more sleep in this period or that period'.

</comment></comment><comment><USER19> One of the things I dislike about stacked area charts (or stacked bar charts) is that are in many cases are used to show percentage breakdown over time.

The problem with representing percentage breakdown over time this way is that it visually eliminates the size of the sample, be it size of market, number of users, page visits, etc. It is visually implying that the same size has stayed the same over time.

Take these two charts representing the breakdown of smartphone shipments by manufacturer: [http://s831.us/1kmFK28](http://s831.us/1kmFK28) and [http://s831.us/1kmFrEz](http://s831.us/1kmFrEz)

The first displays the percentage of market by manufacturer over time. In this chart, Apple's performance looks mediocre.

Then look at the second graph that displays the number of units shipped by manufacturer. Here the amazing growth of the smartphone market is visually captured along with the breakdown of which manufacturers are driving or benefiting from the growth.

</comment><comment><USER20> There are things stacked charts can show you much more clearly than other things. For a particular process I'm working on, I have a timing breakdown rendered as an area chart (not normalized, ordered by total time) that showed something I'm not sure would have been visible any other way.

My ascii art skills are failing me, and this is going to be hard without visual aids, but I'll try...

Overall, there was a significant and stable jump from best case to worse case (not _worst_ case). What was interesting was that a chunk of time the size of that delta always fell in a single region but it was not always the same region but always roughly the same amount of time from the start. Since the process is small scale and kicked off at varying times, this means it was something asynchronous but triggered by our activity (or activity we were responding to).

</comment><comment><USER21> Site's down, archive.org link: [https://web.archive.org/web/20140409154002/http://www.leancr...](https://web.archive.org/web/20140409154002/http://www.leancrew.com/all- this/2011/11/i-hate-stacked-area-charts/)

</comment><comment><USER22> I've always felt like I had some deficiency when it came to viewing stacked area charts. I rarely liked them but couldn't put my finger on why (not that I really gave it much thought). This article's explanation of our eye's tendency to see thickness rather than the vertical distance is spot on. I find the stacked columns way easier to read, although if you had a lot of data points I agree with several of the other posters that a boring old line chart is going to be the easiest to read.

</comment><comment><USER23> Gauges and 3d area charts are other examples of misleading visualizations that take up a lot of space without deriving much meaning. Why do we keep seeing them? They're flashy and make my dashboards look like the one my competitor is using! That's just the world we live in.

After studying data visualization, it's surprising how most popular dashboard widgets/visualizations are relatively bad at encoding data versus simple things like sorted tables.

</comment><comment><USER24> we use them on internal dashboards and they can be extremely useful. One use case is keeping track of bad orders, we work on the dropship model so the top line is our total bad order percentage and each area is the bad orders from a certain supplier. When the goal is to lower the top line we focus all our efforts on the largest areas.

</comment><comment><USER25> Hahaha. The solution described works if you have t=6. Try having t>>25.

The perfect use case for stacked area charts (but not pinned to 100%) is when there are many categories, but one is very predominant, and you're interested in (a) the sum of all quantities and (b) the participation of the principal category.

Example: a country is mainly reliant on hydropower for domestic electricity; there are years where it doesn't need any other source (it's still cheapest....). So we want to track (1) the evolution of domestic consumption and (2) the share of hydropower (3) which years it hasn't been enough.

</comment><comment><USER26> I think this more illustrates a problem with trying to generalize solutions. The final stacked area chart with green at the bottom works perfectly for this data set. Even the author's proposed solution fails to emphasize the growth of the green section.

</comment><comment><USER27> To be fair, its 'mis-use' that is the problem here. Like any tool, the right one should be selected for the job. There are people out there that generalize this same logic to "charts" without qualification (they prefer tables).

</comment><comment><USER28> Not meta enough. When was the last time you designed the chart for a book or other static media?

I'd like to think that in this age there's no need to force a static, unexplorable view of the data to the user at all.

<comment><USER29> Print still exists, you know.

</comment></comment><comment><USER30> Talking about fancy visualisations, you should definitely have a look at horizon graphs

[http://square.github.io/cubism/](http://square.github.io/cubism/)

<comment><USER31> Nice, but I think it would take some time to get used to the "overplotting" thing. Sometimes it's better to just take up a bit more space for clarity's sake.

</comment></comment><comment><USER32> Making a stacked graph interactive can help like this one I prepared earlier:

[http://theopenindex.org/](http://theopenindex.org/)

</comment><comment><USER31> You don't have to stack it like that:

[http://bl.ocks.org/mbostock/582915](http://bl.ocks.org/mbostock/582915)

</comment><comment><USER33> I hate stacked charts, period. I would much prefer a line graph - and with absolute values rather than percentages.

</comment><comment><USER34> Stacked charts are no better when trying to compare categories other than the one closest to the x-axis against each other.

</comment><comment><USER35> Color me dumb, but that chart/graph made perfect sense to me as it was.

</comment><comment><USER36> Yeah, that's a fair point. These charts are misleading. Then again, if you generally trust charts for an easy interpretation of data, you're probably going to be misled anyway. Perhaps I express an unpopular opinion, but the only way to really get a handle on the data is to _read the data_. (I find it to be a rare occurrence that a chart exposes --- rather than oversimplifies --- relationships in the data. They're mostly okay for a cursory glance, but not for more. In this example, they're not even okay for a cursory glance.)

<comment><USER37> How would I determine if the pattern was linear or logarithmic, whether an observation was an outlier, or whether two series were related?

A tiny bit ad hominem, but I take it you are not a statistician. The first thing we do is to graphically illustrate the data, because human brains are so good at recognising patterns.

It is important to experiment with several variations of display, also including and excluding outliers and different series, to see if there are biases that mislead you.

Only then do we come up with a mathematical model to fit.

Actually reading the data line by line can be extremely misleading - <USER2> you can only compare a few numbers at a time, which fails to give you an insight into the overall variation.

<comment><USER36> I am in fact a statistician. I work in statistics, mathematics, and computer science. I am often severely frustrated by the oversimplifying and misleading natures of conventional charts.

I have seen good charts. Yes, they exist, and I actually see them quite often. It just so happens that the vast majority of charts and graphical illustrations I see are omitting details at best and dangerously misleading at worst.

<comment><USER25> This is very true.

Reading Tufte carefully, one realizes that (a) he's read more Derrida than he's willing to admit (there are entire unattributed quotations, probably by accident) and (b) great charting is an art form, perilously predicated on someone being both quantitatively educated and visually gifted.

There is no silver bullet but the table, and even then, Simpson's paradox is always ready to bite you.</comment></comment></comment></comment>


Covid-19 reduces economic activity, which reduces pollution, which saves lives - <AUTHOR> http://www.g-feed.com/2020/03/covid-19-reduces-economic-activity.html <comment><USER2> Frankly I find this a little bit nauseating. If a plague wipes out an integer percentage of humanity then Earth will be less polluted,... yay?

What those satellite pictures are showing may be marginally cleaner air. But it's also millions of people out of work and an economy stalled and not producing for its populous.

That roughly equates to people lives significant _worse_ , not better.

<comment><USER3> > What's the lesson here? It seems clearly incorrect and foolhardy to conclude > that pandemics are good for health. Again I emphasize that the effects > calculated above are just the health benefits of the air pollution changes, > and do not account for the many other short- or long-term negative > consequences of social and economic disruption on health or other outcomes; > these harms could exceed any health benefits from reduced air pollution. But > the calculation is perhaps a useful reminder of the often-hidden health > consequences of the status quo, i.e. the substantial costs that our current > way of doing things exacts on our health and livelihoods.

<comment><USER2> I'm not sure that's a valid way to do the calculation. A net benefit is not a cost. A net benefit is a benefit.

A proper analysis looks at costs and benefits together and calculates the net result.

There are inherent damages (externalities) to the way that we do things, but the correct analysis is to examine the substitute ways to do things and what their relative (increased) costs are in exchange for decreases damages.

So you can say we can reduce A amount of pollution, which is expected to save B lives, at an increased cost of C, which drives D amount of people into unemployment or poverty.

Looking at one thing without examining the overall effect on the whole system is pretty pointless, even inhumane to a point.

</comment></comment></comment><comment><USER4> Thinking through the long term implications of this disaster is interesting because it might be a catalyst for a lot of positive change, especially in the U.S. Hopefully we can flatten the curve and prevent huge mortalities before things spiral, but I can't see how the aftermath this doesn't lead to an immediate demand for universal healthcare in the U.S.

Beyond that, a lesson in listening to and respecting scientific warnings about climate change and other existential threats we'd rather not think about. Lessons about not blindly listening to economic advisers who want numbers to go up and, hopefully, lessons about how humans can revert to human kindness and decency when faced with real issues. I think of the stories from NYC about so many people helping each other on 9/11 - we need to become real communities again to work through this together.

<comment><USER5> I do hope the push to WFH helps normalize remote work - that's something I'm optimistic about.

I think it's a stretch to say a virus pandemic will be the catalyst for climate policy change but stranger things have happened.

<comment><USER6> The voting cohort that votes for politicians that don't support climate change mitigation policy have the highest mortality rate from the pandemic.

If this pandemic doesn't lead to universal healthcare and climate change policy because citizens have a change in heart, it might occur because enough of those opposed to these ideas die.

Not intended to be morbid or gratuitous, simply an observation.

<comment><AUTHOR> Ummm...I don't think so. The Marin Chrunchy-Moms, who are falling over from the measles, and will not get their kids vaccinated, are sure to have a high mortality rate. And they certainly do support climate change mitigation.

<comment><USER6> We'll find out soon enough.

[https://www.vice.com/en_us/article/epgkb7/if-your-aging- pare...](https://www.vice.com/en_us/article/epgkb7/if-your-aging-parents-are- ignoring-coronavirus-risks-youre-not-alone)

</comment></comment></comment></comment></comment><comment><USER7> Reducing economic activity kills people too.

You do realize that the economy isn't just a game of moving multi-colored pieces of paper around

<comment><USER3> The Federal Reserve's trillion-dollar injection into the Treasury market yesterday would seem to indicate the direct opposite

<comment><USER7> The economy is the method by which humans live a life other than that of animals.

Moving multi-colored pieces of paper is a small part of that process, but it is highly visible because it is near the top of the stack.

</comment></comment></comment><comment><USER8> also reduces physical activity and social contact, which are not good for life expectancy</comment>


Freelancers vs. Custom Software Development Companies: Whom to Choose? - <AUTHOR> https://medium.com/globalluxsoft/freelancers-vs-custom-software-development-companies-whom-to-choose-918510b11a7e <comment><USER2> Having inherited some crappy projects software development companies, I think he overestimates the quality.</comment>


Red Hat's CentOS "acquisition" good for both sides, but 'ware the Jabberwock - <AUTHOR> http://redmonk.com/dberkholz/2014/01/10/red-hats-centos-acquisition-good-for-both-sides-but-ware-the-jabberwock/

<comment><USER2> I see this as a good thing. Seems to me that we are basically getting back RedHat releases pre-RHEL. Fedora is great for the desktop, but I really like "Enterprise Linux" on the server side. I basically abandoned RedHat after the RHEL/Fedora split. Went to Gentoo (to unstable at the time) for a bit, Ubuntu, then CentOS during the late 4.x releases. I will pretty much stick with CentOS from here on out, why? Well enterprise customers who what support can get it, people who don't can easily use it, and those that don't want to pay now but know they will need to later will have an easy path forward. And its nice to have a major release that will remain stable and patched for a 7 year haul. Some folks seem to be concerned like this is a bad thing, RedHat has been a model citizen for open source. The amount of work they do in backporting fixes for people who need to remain on a version for whatever reason is huge. On top of the fact that they make most (all?) of their own software freely available as well. There is really no advantage for them to do anything to CentOS other than keep it doing what its doing, but faster.

</comment><comment><USER3> To those wondering, I think that Red Hat doesn't make that much money from SELLING RHEL. It's the support, certifications and those things that are making Red Hat's budget. So CentOS and RHEL aren't really competing products. But Red Hat can now offer support even to CentOS customers.

(I'm Red Hat employee.)

<comment><USER4> I love you.

just... throwing that out there.

</comment></comment><comment><USER5> I don't see why so many people think this deal is such a head scratcher. Red Hat is shifting away from pure support to a suite of cloud services. People are more likely to choose them if they are already using a Red Hat platform. This is especially useful if you're obliged to maintain a free version.

The moment you enter the blade business, you stop caring if someone is giving away your razors.

</comment><comment><USER6> I wonder what this is going to do to the Centos-Xen[1] project?

[1][http://blog.xen.org/index.php/2013/06/20/welcome-to-the- xen4...](http://blog.xen.org/index.php/2013/06/20/welcome-to-the- xen4centos6-project-first-release/)

<comment><USER7> RHEL specifically mentioned it in the FAQ:

[http://community.redhat.com/centos- faq/#_what_this_means_for...](http://community.redhat.com/centos- faq/#_what_this_means_for_centos)

"The CentOS Project will expand its mission to provide additional open source technology-specific variant editions of the core operating system. Such editions will be capable of serving as a foundation for multiple, complementary cloud/virtualization projects. A current example is the Xen4CentOS project, which provides the components required to use CentOS 6 as a Xen host. Future examples will likely include variants to provide the virtualization component needs for OpenStack and oVirt, and variants providing hardware support and component updates for web hosters."

So they're publicly committing to continue to support that.

<comment><USER6> ah. thanks. I missed that.

</comment></comment></comment><comment><USER8> On one hand, this might actually improve the state of CentOS. But on the other hand, it's a bit of a conflict of interest for Red Hat to be maintaining the free (as in freedom) version. The real question is, how compatible is the freemium (as in beer) business model with open-source interests?

<comment><USER9> No, it's a transition from Premium Enterprise Linux to Freemium Enterprise Linux, since the usage of CentOS pretty much made that already the case. They are so compatible that you can purchase support contracts for CentOS by doing an in-place upgrade to RHEL from CentOS for support.

This is more of a strategic move to make Oracle Linux and the other RHEL copies and CentOS-wannabes less compelling: many enterprises that are evaluating Oracle vs. Red Hat will stick to the single-vendor option, and many enterprises that are evaluating Ubuntu vs. CentOS can finally check both checkboxes for "corporate backed and officially endorsed" and "$0 to get started".

<comment><USER6> >This is more of a strategic move to make Oracle Linux and the other RHEL copies and CentOS-wannabes less compelling: many enterprises that are evaluating Oracle vs. Red Hat will stick to the single-vendor option, and many enterprises that are evaluating Ubuntu vs. CentOS can finally check both checkboxes for "corporate backed and officially endorsed" and "$0 to get started".

Yes. There are customers like me who are never going to give you $500 per server. sorry. it's just not happening.

But, eh, when I need money, you know what I do? I go work for larger companies, maintaining their servers. You know what I tell them to do? I tell them to go buy RHEL; It's a good product. They really do set things up so you don't have to do a major upgrade for ten years. And for the large companies? the $500 isn't a big deal, and the support really is worth something; they have someone to call if I'm not around.

CentOS was perfect for RedHat, because there is a real disadvantage to CentOS, even without the support problems; there's a delay. Nobody who can afford the $500 a machine is going to use CentOS, but it's there and good enough for those of us who can't.

Oracle changed this situation. Oracle will give you CentOS, for free, and is much faster at the re-compile. Now, I don't use it because I hate Oracle, but using Oracle has been the rational choice for some time now. (And I like RedHat. I mean, as much as you can like a company. Vs. Oracle? I am really rooting for RedHat here.)

My hope here is that RHEL will improve the compile-time of CentOS to where it's as good as Oracle.</comment></comment></comment>