Introducing TrumpScript – Make Python Great Again - <AUTHOR> http://www.makepythongreatagain.org <comment><USER2> This is beautiful. The best. I tell you, the best. We win, we really, really won today. Just look at the polls, no language has won this much. We win. Nobody knows the art of the language better than TrumpScript. I tell you.

<comment><USER3> You didn't end with "America is great."

</comment></comment><comment><USER4> The Zen of TrumpScript:

Ugly is better than beautiful.

Explicit language is best.

Simplistic is better than simple.

Having complexes is better than being complicated.

Flat world is better than complex world.

Special cases aren't special enough to break the rules, bitches!

Dissidents should never pass silently, unless explicitly silenced.

In the face of ambiguity, fall back to prejudices.

There should be one-- and only one --way to do it: Mine.

Although that way may not be obvious at first unless you're Donald Trump.

<comment><AUTHOR> We're currently taking language suggestions via pull request on the repository, if you'd like to contribute

<comment><USER4> If you want to add it, feel free to just copy and paste :)

</comment></comment></comment><comment><USER5> >>> from __future__ import presidency

SyntaxError: not a chance

</comment><comment><USER6> "There are no import statements allowed. All code has to be home-grown and Amerian made."

Would be extremely funny if he have no chance at the nomination.

<comment><USER7> A lot of people still think he has no chance at the nomination. Their hypothesis is that the Republican field is still very wide, so Trump is capturing the largest piece of the pie, but once other candidates start dropping out, they won't fall to him, but rather concentrate on another candidate.

I tend to believe this has merit since you can position yourself a certain way and gain a lot of popularity with certain segments of the Republican party/conservatives, but distance yourself from the rest of the party. The fact that this group has largely identified itself as the Tea Party and has been around for several election cycles and Mitt Romney, the most moderate of the of 2012 candidates ran away with the nomination in 2012, speaks well to this hypothesis.

</comment></comment><comment><USER8> I was fed up with the quagmire of other languages, so TrumpScript was a godsend. I was angry! angry! angry! but Trumpscript is the solution! Trust me, it just is!

Some observations:

An innovative new statement construction can be used to make objects immutable on-the-fly. These statements - called _insults_ must be prefixed by a statement of the "I have tremendous respect for <object reference>, but " construction. Following the insult statement, the object will be immutable for a while.

TrumpScript is really bad at interacting with other languages. But why would you?

TrumpScript is more form than function. In fact, it is extremely diffucult to phrase anything concrete using TrumpScript. Unlike other languages, lofty concepts can be expressed even contrary to popular facts.

TrumpScript is neither imperative nor declarative - a language first! While it may look imperative, statements are not in any way affected by previous statements. Indeed previous statements can (and frequently do) contradict later statements. The innovative internal perception engine makes this possible!

</comment><comment><USER9> I saw this at HackRice yesterday! You guys were pretty funny.

</comment><comment><USER10> This reminds me of C+=, except that C+= was funnier.

</comment><comment><USER11> The language should poll all the time since it has great numbers (performance). Event based is for liberals.

</comment><comment><AUTHOR> Please share and help this be the best, the greatest, and with the most brains, programming language ever.

</comment><comment><USER12> Could someone please transcribe his speeches and put them up as 'outcommented' python or TrumpScript files on Github?

It would make great boilerplate. and maybe one could put in a variable and two, and try to look at the outcomes in what that man really is saying, numerically.

+probably has some value in traffic, if executed properly.

</comment><comment><USER13> I am Donald Trump and I approve this message.

</comment><comment><USER14> Do any of the commands cause it to bomb?

</comment><comment><USER15> Some people have way too much time on hand :)

</comment><comment><USER16> America is great.

</comment><comment><USER17> When did HN turn political?

</comment><comment><USER18> Flagged. Partisan politics.

</comment><comment><USER19> Dear Republicans from the USA, do you want Hillary Clinton as president? Cause that's how you get Hillary Clinton as president.

</comment><comment><USER20> Should I make a comment talking about how satire is the cheapest form of political expression? I know it will get voted down. Bah, who cares. TRUMP 2016!

</comment><comment><USER21> Not a Trump fan, but I think this is a cheap cash-in. If I want to laugh, I guess I can just go back and read the INTERCAL documentation again, because this isn't funny.

If you want to write a funny esoteric language, ask yourself whether the first example program is seriously funny. If it isn't, put it back in the bin.</comment>


C++'s best feature - <AUTHOR> https://akrzemi1.wordpress.com/2013/07/18/cs-best-feature/

<comment><USER2> Reading this, I couldn't help imagining a blog post in which someone touted "assembly language's best feature", namely that the programmer had to keep track of registers and their contents.</comment>


Is Life Expectancy Finally Topping Out? - <AUTHOR> https://spectrum.ieee.org/biomedical/ethics/is-life-expectancy-finally-topping-out <comment><USER3> My understanding is that the doubling in life expectancy over the last 150-200 years was primarily due to the drastic reduction in infant mortality and elimination of most infectious diseases. If you only look at life expectancy from the point of reaching adulthood, the change hasn't been nearly as dramatic.

<comment><USER4> Yes. When most people say "life expectancy" they mean "life expectancy at birth." Even in the depths of the middle ages when life expectancy at birth was around 30 years, most people who lived to adulthood lived into their 60s and 70s.

<comment><USER5> I think the OP is specifically trying to say that most lay people do not actually mean "life expectancy at birth" when they use the term "life expectancy", but instead mean "how long I, a person who has reached adulthood, can expect to live". I agree with OP, FWIW.

</comment></comment></comment><comment><USER6> I remember seeing the horrible decline in life expectancy when the Soviet Union collapsed.

At the same time, the Soviet client state of Cuba saw a dramatic reduction in economic activity and caloric restriction. Cuban dietary belt tightening led to a massive reduction in cardio vascular disease with a correlated massive reduction in obesity.

I'm not a doctor, nor a data scientist or economist.

But I suspect we will see bifurcated life expectancy moving forward.

In the distant past when there was great wealth divide, one common denominator was similar life expectancy.

Moving forward, that same wealth divide can now be leveraged by those who can afford it to exploit the entire spectrum of longevity incremental opportunities:

Nutrition Clean water Clean air Mitigating physical wear & tear Sleep Stress Well being Microbiome Supplements Pharmacology Stem cell therapy Gene therapy CRISPR

I predict a continued flattening of average life expectancy as developing world life expectancy slowly improves and some developed countries possibly see some attrition from systemic obesity, economic disruption, and continued wealth divide.

But I see the top few % of most wealthy begin to see enhanced quality of life in their later years, as well as incrementally more years.

Longevity tech is the ultimate market.

How much will people pay for a Tesla Model Y(assuming it makes it to market)?

Something.

How much will people pay for an extra 5-10 years?

Everything.

Apologies, social "scientist" talking fiction!

<comment><USER7> > How much will people pay for an extra 5-10 years?

> Everything.

Yeah as long as it doesn't require any effort.

Exercise every day, stop alcohol, stop smoking, start eating well. You might not live longer but you'll live in good health longer, which is all that matter in the end. I'd take living until 60 in full physical and mental shape over slowly rotting in a retirement home until 90.

If we truly cared about health we wouldn't accept ICE cars inside our cities, fast food, sodas, fat acceptance movements, &c. We're not killed by diseases anymore, we're killed by sloth and gluttony.

<comment><USER6> I do agree with you about the majority unwilling/unable to invest sufficient effort into their physical wellbeing.

But I strongly believe there is a small minority of people who are making consistent choices that positively impact longevity.

Anecdotally, I'm seeing it with my cohort of friends and family here in NZ as well as when visiting the US.

At the age of 50, I'm already seeing clear indicators of the bifurcation between those who are taking active steps to enhance their longevity compared to those who are not.

My personal opinion is that we will see single digit percentage of people who consistently take drive steps to enhance their health and well-being to enhance longevity,

<comment><USER8> Also important will be quality of life in the later years.

If you're unhealthy, lonely and constantly in pain then why bother?

I've read that having a good network of friends & family into old age can keep you feeling better, having hobbies and keeping active are also very beneficial.

It's something I'm actively thinking about now I'm approaching 50 myself. Swimming and yoga beckon :)

</comment></comment></comment></comment><comment><USER9> My grandmother was born in 1912 and live to 97.

She:

\- was born in a time with no antibiotics

\- lived on a farm with all of it's inherent risks

\- lived through World War 1 (granted in the United States)

\- survived the "Spanish Flu" (although as someone under 10 whereas hardest hit were adults)

\- lived through the Depression

\- started having children post World War 2 (now with antibiotics available).

I've often thought, just making it to age 10 showed that she had a strong immune system. When she started having children, she benefited from having access to antibiotics at a time when there was no drug resistance.

Looking at my parents generation (the baby boomers) and suddenly you have a generation of children where infant mortality etc goes way down (again thanks to antibiotics). In other words, children that wouldn't have survived in 1912 are now living into adulthood. We applied selection pressure to have children (and then in turn adults) with weaker immune systems. (Not saying this is a bad thing).

Because of the above, I wonder how much of the life expectancy increase has to do with a kind of winning the demographic lottery of: "When I was little, my immune system kept me alive. When I was an adult, medicine took care of what my immune system couldn't."

<comment><USER10> I haven't come across any information that would indicate that we can generalize a person's immune system to be better than another's, outside of specified immune system disorders that have been defined. The immune system and the body in general are such a complex mechanism that it's impossible to claim one or a few persons surviving in one or a few instances and environments indicates they will have greater odds of future survival.

<comment><USER11> >I haven't come across any information that would indicate that we can generalize a person's immune system to be better than another's,

There's definitely people who seem to get sick all the time and people who don't. Ask any schoolteacher and they'll tell you that for every cough/cold/whatever that goes around there's a couple kids that always get it and some that never do. Of course there's other variables like hand washing and whatnot but there's probably still some differences between people. Whether these are genetic or environmental (e.g. nutrition) I don't know.

</comment></comment></comment><comment><USER12> Never mind the decline in improvement, I think we're going to see a sudden sharp drop very soon. It may be hidden by the long-lived generation before, but the baby boomers have eaten, drunk, and medicated themselves into oblivion compared to their parents.

And who knows what's to come for the next generation, with an increasing wealth divide and heck knows what else.

<comment><USER13> My parents, baby boomers themselves, are starting to see the effects of this. Funeral after funeral of friends and family dying in their early to late 60's - almost always due to heart disease, liver failure or some sort of cancer.

Every time I join them it's the same "he seemed so healthy/ it was so unexpected/ she was gone so quickly".

In my head I can't help but think "he ate nothing but meat/ she drank a bottle of wine a night/ they haven't broken a sweat in years".

<comment><USER14> > dying in their early to late 60's - almost always due to heart disease, > liver failure or some sort of cancer

In a "Death and Dying" psych class I took in university, the professor remarked how we went from dying from infectious diseases to dying from lifestyle issues.

I'm not sure how true or false this is, but when one isn't going to die from the flu you might live long enough to die from consuming too much bacon and alcohol.

I'm interested in learning more about this idea.

</comment></comment></comment><comment><USER15> > If we are still far from the limit to the human life-span, then the largest > survival gains should be recorded among the oldest people.

Trends in outliers cannot be used to extrapolate trends in mean, unless for _very_ small populations (such that outliers are unreliable).

The article just seems to be an opinion piece to explain away falling improvements in average life-expectancy rather than tackle rising inequality.

[https://news.harvard.edu/gazette/story/2016/04/for-life- expe...](https://news.harvard.edu/gazette/story/2016/04/for-life-expectancy- money-matters/)

Being poor in the United States is so hazardous to your health, a new study shows, that the average life expectancy of the lowest-income classes in America is now equal to that in Sudan or Pakistan.

</comment><comment><USER16> 30% gap between known maximum and highest average is interesting in and of itself. We have barely attacked aging as opposed to diseases of age.

<comment><USER17> "Aging" is not singular thing.

After development, the age of a human body is just an accumulation of many many different kinds of failures over time.

<comment><USER18> And we will be able pretty soon to replace failed organs - anything but the brain itself should be replaceable in 30 years at the latest, I bet. With the progress that is being made right now, I'd say prototypes should exist in a decade, and another 20 years to let the economies of scale work.

What has _not_ caught up with reality yet is society: how are people living 100+ years supposed to be financed? Do we expect people to work in their 80s fulltime? Will we be mandating organ replacements for those above a certain age?

How are we supposed to _feed_ all those people? It's barely working out right now with current mortality rates and only not collapsing because the rate at which resources like fish are exploited is way beyond the sustainability threshold?

<comment><USER19> I feel food production shouldn't really be an issue, of course depending on the food type. But the tiny country of The Netherlands is a huge food exporter [0]. Certainly other countries could learn a thing or two [1] on food production from The Netherlands.

\---

[0]: [https://www.nationalgeographic.com/magazine/2017/09/holland-...](https://www.nationalgeographic.com/magazine/2017/09/holland- agriculture-sustainable-farming/)

[1]: [https://www.wur.nl/en/Education-Programmes/master/MSc- progra...](https://www.wur.nl/en/Education-Programmes/master/MSc- programmes/MSc-Food-Technology.htm)

<comment><USER18> The Dutch mainly produce plant stuff - which is indeed easy to scale up. The problem is that veggies are not the part that causes problems... it's meat, both land animals (cattle, pigs, poultry) and water animals. The rising meat demand especially in the exploding middle class in formerly poor countries such as China and India has to be produced somewhere, and animals have the problem that they create massive amounts of feces which:

\- for land animals are carted across half of Europe as both Germany and the Netherlands produce more feces than can be brought out to fields

\- for fish, contaminate the farms and the freshwater in which the farms are set. In addition the fish food that does not get eaten by the fish causes algae and other pest blooms in the waters, plus the attraction that fish farms pose to predators.

</comment></comment></comment></comment></comment><comment><USER20> I don't doubt that we're approaching the max life expectancy that you can get from natural means... By that, I mean curing diseases and maintaining the right balance of nutrition.

But I think we'll start to see improvements that aren't about just staying healthy, but instead are about actually reversing "the aging process" and the things we barely understand about what makes us change as we get older.

<comment><USER21> We seem to have got a lot worse at nutrition over the last thirty years.

<comment><USER22> I don't know where you were in the 80s but 30 years ago nutrition was as bad or worse than now from my perspective (except in countries that were previously too poor to eat badly) - white bread, lots of sugar, etc - <USER2> stuff people nowadays avoid a lot more than my parents' generation did at the time.

<comment><USER23> Well in the US at least there was much less obesity, which I think says something about nutrition, no? I don't think people were particularly more physically active 30 years ago...

<comment><USER24> I think it's both. People were notably more physically active in decades past.

"Lower levels of physical activity, both in organized sports and at play, account for a lot of the rest, they say. U.S. health authorities say children should be getting 60 minutes of active play a day, but only one-third are getting that.

Children are much less likely to walk, bike or skate to school than they were in the 1970s, at least in the U.S., Canada, Australia and the United Kingdom. Neighborhoods are increasingly suburban, especially in Asia, and people are driving more.

And from the 1970s till now, the number of global households with TVs, VCRs, computers, Internet access and video games has soared."

\- [https://www.npr.org/sections/health- shots/2013/11/20/2463167...](https://www.npr.org/sections/health- shots/2013/11/20/246316731/kids-are-less-fit-today-than-you-were-back-then)</comment></comment></comment></comment></comment>


How to turn a liberal hipster into a capitalist tyrant in one evening - <AUTHOR> http://www.theguardian.com/commentisfree/2015/may/24/turn-a-liberal-hipster-into-global-capitalist-world-factory?CMP=share_btn_fb

<comment><USER2> I assume these same liberal hipsters would also be happy to bankrupt their friends in Monopoly. Because just like this study, it's a game.

The author is making the false assumption that the players would make the same decisions as CEOs in real life. Deciding to cut workers wages instead of laying some off or shutting down the business does not making someone a capitalist tyrant. That's like saying putting down a sick dog makes someone an animal abuser.

</comment><comment><USER3> The option given was between lowering wages, or firing a third of the workers.

If those are truly your only options, I would hardly call you a capitalist tyrant for lowering wages. However, I imagine that in most cases, these are not the only options.

For me personally, this article seemed to play on the fact that external viewers to the game (e.g. readers like me) will naturally feel that there are other, more humane options. Forgetting about the rigid constraints of the game - since they did not play it themselves.

(I'm not sure if the above makes sense, I've never been to good at explaining myself)</comment>


Show HN: Real time code sharing and video chat (WebRTC) - <AUTHOR> http://codeshare.io

<comment><USER2> That's nice, but I suppose this is not free?

I'd like to use that with my colleagues, but not if it means our code crosses the internet.

<comment><AUTHOR> There's no way to search CodeShares so only people who know the URL can access it. And only the latest instance is saved (using Firebase) so you can always delete the code once you're done with it.

<comment><USER2> I'd like to believe you, but these days I think it's fair to say that one should try to leak the least possible amount of information to the outside, even seemingly harmless information or data could easily find its way to storage somewhere, and in maybe 10, 15 years have become less harmless than it once seemed to be.

But don't get me wrong, it IS great and working fine, especially the simplicity and ease of use are awesome!

</comment></comment></comment><comment><USER3> I would really like to see some login feature that allows you to keep the code private (in case someone guesses or discovers the url). Otherwise, its a pretty neat site and I would definitely use it

<comment><USER4> Cool, yah lack of login was purely for simplicity and pushing out this MVP before adding additional features without user input. Thanks for feedback!

</comment></comment><comment><USER5> Really cool product. What's the vision behind since this does not really cut it just yet for actual team work?

<comment><USER4> Dead simple code sharing and collaboration. I often find myself running over to coworkers desks to help them eyeball a certain file or snippet. One really great use case I can think of is conducting remote coding interviews.

<comment><USER5> Yep that's a good use case!

</comment></comment></comment><comment><USER6> It would be nice if you could add multiple files. Otherwise, lookin' good!

</comment><comment><USER7> It would be nice to have 4-space indentation for Python.</comment>


One year using Kubernetes in production (2016) - <AUTHOR> https://techbeacon.com/devops/one-year-using-kubernetes-production-lessons-learned <comment><USER2> The article seems to be from year 2016. Maybe it can be added to the headline.

<comment><USER3> Added. Thanks!

</comment></comment><comment><USER4> Don't know why but the post doesn't mention Ingress resources when it comes to exposing and load balancing your services. It is a much better and official way then that mentioned in the article.

</comment><comment><USER5> Sales and marketing. Poorly written.</comment>


If you're not writing tests first you're missing out - <AUTHOR> http://www.mokacoding.com/blog/if-youre-not-writing-tests-first-youre-missing-out <comment><USER2> I already tried writing unit tests first (TDD); it was a waste of time in my case.

TDD doesn't help you at all in terms of designing the right architecture. It encourages you to write lots of small classes and it discourages you from changing them later as your understanding of requirements becomes deeper - This leads to suboptimal architecture.

I much prefer integration tests to test my code during development. They don't have to be slow if you design them properly.

</comment><comment><USER3> Well it's not easy writing tests first when working on a legacy system.

In my instance, we've created integration tests. And business tests to make sure our business rules work as it should be.</comment>


Ask HN: Pondering Why the Social Security Website Shuts Down Nightly - <AUTHOR> The Social Security Website (https://www.ssa.gov) shuts down every night. Maybe for maintenance, but a part of me wonders if the primary driver is so that developers don't get paged in the middle of the night for outages/security breaches. What are your thoughts?<p>https://i.imgur.com/fgkdCTi.jpg <comment><USER2> I wasn't aware of that, but no I don't think it has anything to do with developers getting paged.

I have worked on these older systems that exist in government offices and I have done work to integrate new systems to them over the years. So much of the VA, SSA, IRS and a ton of other federal, state and local government systems are focused around batch processing that they literally need that maintenance window to update systems, synchronize datasets and do data imports/exports etc. I saw just about 5ish years ago a system that still required 4 hours nightly just to manage the backup and recovery, then another 2 to ingest data from other agencies so that the agents had data to work off the next day. And it wasn't rare that you had to wait 2-3 days for your transaction to process through the system to get included in the update. Newer developers take for granted all the technology and systems we have today and I think sometimes feel it has always been that way, it hasn't. When I started doing work in the early 90's offline backup windows were still normal, batch updates required databases to be offline routinely etc. Yes, Oracle existed and was used some places but most government agencies were still on mini computers or mainframes which didn't generally support that type of software. Even the ISAM databases of the time required compaction and cleanup nearly nightly which generally needed some downtime (offline).

Hell, a couple of years ago there was an article talking about the IRS still running a critical system that is 60 years old and written in a some assembly type language that isn't well understood anymore. So not surprised the SSA does this. lol

<comment><AUTHOR> Thanks for your insight. It's incredibly interesting! I suppose with so much inter-departmental exchanges of information running on legacy HW/SW, I can see why it might need several hours of downtime.

<comment><USER2> You're welcome. I definitely get your question, no one would intentionally make a transactional system like that today. With all the advances we have made it just isn't necessary anymore.

Although there are a few places where I can think that this pattern kinda still exists today for good reason. For example, compliance reporting systems where data is sliced off on a batch basis on some interval and pushed into a different DB for read-only reporting etc. We did that for public accounting compliance reports so the data was locked and non-updatable that produced the reports. But there are other patterns which can be used too.</comment></comment></comment>


Show HN: Create smart invoices - <AUTHOR> http://parolu.de/free-online-invoice/ <comment><USER2> Somewhere in the last 24 hours there was a thread on HN about invoicing, might wanna check that out, I beleive they were requesting an open source invoice solution.

One small thing I'd like to see change with this and that is the ability to edit it as "flat rate." Most of my invoices are just 1 number, nothing hourly so that would be cool.

Nevertheless, a nifty system that is well laid out.

Edit: found that thread for you: [https://news.ycombinator.com/item?id=10652696](https://news.ycombinator.com/item?id=10652696)

</comment><comment><AUTHOR> Yes, those "flat rate" invoices would be useful. We will consider this for one of our next updates.</comment>


Paypal to government: Be more like us - <AUTHOR> http://m.washingtonpost.com/blogs/wonkblog/wp/2013/10/30/paypal-to-government-be-more-like-us/

<comment><USER2> Be more like paypal? Paypal is difficult to use, an omnipotent power who shuts off access at their discretion, and frustrates it's users. It sounds as if the government is already exactly like Paypal.</comment>


Trimensional: 3D Scanner for iPhone - <AUTHOR> http://www.trimensional.com/

<comment><USER4> This is a shape from shading approach, which will only work if you're in the dark, with the phone as the only illumination source. If white dots are shown in different places on the screen, and assuming the phone and subject don't move during the process, surface normals can be computed from the resulting images, and once you have the normals then the shape can be approximated. Normals can be found by calculating the angle of maximum reflectance for each pixel for a series of images under different illuminations.

See this Google video for a similar technique. <http://www.youtube.com/watch?v=rxNg-tXPPWc>

<comment><USER5> What are good resources for looking into converting photos into 3d object models? I'm really impressed by Shapeways but would like to take current real- world objects as a base rather than building them in a 3D tool etc.

I've seen the laser scanners but they're relatively expensive. Is there anything like a mount that takes two iphones, and software that can take those two photos to create atleast a projection?

<comment><USER6> There are a lot of approaches. Yes there is software that takes two photos and let you reconstruct 3d. If you have a man-made object you probably don't want a generic point-cloud building approach (like say <http://www.photosculpt.net/> ) - but rather something like Photomodeler that lets you select vertices and build up surfaces.

There is also software that builds models from silhouette methods, that usually require you printing out targets which you place the model, so of like a manual turntable approach. I can't remember the name of software that does this at the moment, but its out there.

Or you could work from video (just from a single camera) that you move around. That can be effective, not sure of the best software for doing this - it's called structure from motion, a quick google shows some source at this project site: <http://phototour.cs.washington.edu/>

There some code out there for a do it yourself laser scanner - this isn't what I was thinking of but it seems kind of cool: <http://www.youtube.com/watch?v=xK5eYhpBtQc>

I've also seen some do it yourself structured light software (ie bring your own projector and camera), that seems to work ok.

It kind of depends on what size and type of objects you want to scan - <USER2> like the surface properties could be important - also how long you can keep it still.

<comment><USER5> Thanks for the information, it was very helpful.

</comment></comment></comment></comment><comment><USER7> Very cool and very uncool.

Cool: that it works in a decent way, and uses a neat trick.

Uncool: You can't export the image into a 3D file, making it 99% less useful that it would be otherwise.

Suggestion: export it as VRML, it's trivial format that you can generate starting from your points. Use this format (from my own code, so use it as you wish):

        fprintf(fp,
        "#VRML V2.0 utf8\n"
        "Shape {\n"
        "    appearance Appearance {\n"
        "        material Material {\n"
        "            diffuseColor .5 .5 .5\n"
        "        }\n"
        "    }\n"
        "    geometry ElevationGrid {\n"
        "        xDimension  %d\n"
        "        zDimension  %d\n"
        "        xSpacing 0.01\n"
        "        zSpacing 0.01\n"
        "        solid FALSE\n"
        "        creaseAngle 6.28\n"
        "        height [\n", hgt->width, hgt->height
        );

        for (y = 0; y < hgt->height ; y++) {
            for (x = 0; x < hgt->width; x++) {
                height = getheight(x,y);
                h *= YOUR_3D_MULT_FACTOR;
                fprintf(fp, "%f", h);
                if (y != hgt->height-1 && x != hgt->width-1) fprintf(fp,",");
                if (x == hgt->width) fprintf(fp,"\n");
            }
        }

            fprintf(fp,
        "        ]\n"
        "    }\n"
        "}\n"

3d studio and other programs will happily import this stuff.

<comment><USER8> Wow, there's been a VRML sighting! As an old dude, VRML reminds me of the worst of 90s web hype. Trying to leave that aside, I also don't think it has a lot going for it to keep it around as a format.

I prefer the even simpler Wavefront OBJ format as a scratch format. It's about as printf-compatible as it gets and is supported in many more places than VRML.

<http://en.wikipedia.org/wiki/Wavefront_.obj_file>

<comment><USER7> Good point, but unfortunately in wavefront .obj there is no "elevation mesh" alike object, so it's a bit more complex than this, but still not too hard.

Btw while VRML as a plugin and the idea of a 3D web sounds now 90s, the data format itself is too bad.

</comment></comment></comment><comment><USER9> Cool app. But I have a pet peeve with information pages that only provide video as a description. Whilst I understand that especially for an app like this, the best 'information' is to demonstrate how it works via a video, it doesn't help people a. just want to get a quick one line explanation of what your app does and/or b. can't watch the video at the time (slow connection, work restriction etc).

If I hadn't been at home, I would have just left the page and moved onto to something else - missed sale.

<comment><AUTHOR> Thanks for the feedback. I was expecting to have this weekend to pull everything together but Apple approved the app in 2 days (which is great, but 5x faster than for my previous submissions).

<comment><USER10> The first question that comes to mind for me is: Is it possible to export the generated mesh that is shown in the stills?

<comment><AUTHOR> Good question. Version 1.0 only saves/emails images, but trading 3D scans and exporting the raw mesh is certainly on the feature list for future versions.

<comment><USER11> Might I suggest using the Bump API to share scans?

</comment></comment></comment></comment></comment><comment><USER11> I tried it this morning in the pitch black. It worked pretty well. The effect was mostly comical with some distortion. The most interesting aspect is how people are taking all these things that at first pass would be considered "impossible," applying some ingenuity and hard work to them, and pushing the limits of this technology.

</comment><comment><USER12> Looks like it just uses the reflected intensity to estimate the depth, then pastes the original colormap on top of that? Incredibly clever and simple hack.

<comment><USER13> Can the iphone modulate the intensity of its light via software?

<comment><USER12> It looks like it is just sending a total blank white screen while it takes a picture. Sure you can change the intensity-- use a gray pixel instead of a white one.

<comment><USER14> Actually, it briefly displays a sequence of four illumination conditions - <USER3> white semicircle at the top, right, bottom, and left edges of the screen.

</comment></comment></comment></comment><comment><USER15> The fact that this only works in the dark made me wonder, how much of what the Kinect does could be possible on an iPhone, and what would be needed to get there? 2 Cameras? What else?

<comment><USER16> If your subject doesn't move, two cameras can be approximated by taking two pictures a set distance apart.[1]

Also note that the method used by this app is very short ranged, and uses the LCD's backlight while it's imaging, so there's zero feedback, making any kind of interactive application impossible.

1: There are third party accessories to make this easy and repeatable, built with varying levels of quality. Here's a fairly cheap one, circa 2003: <http://www.dansdata.com/photo3d.htm>

<comment><USER14> Or what about using built-in motion sensors to record the relative camera location and orientation of a series of frames captured with an e.g. iPhone camera? I don't know exactly how the accelerometers and gyros work, or what sort of data they provide (linear distance vs just orientation changes?), but imagine holding down a "scan" button as you simply swing the phone around a subject to capture a series of images. I would think it would be possible to reconstruct 3d surfaces (at least under suitable illumination conditions, I guess) given known camera location/orientation for each frame. Pushbroom stereo, in remote sensing parlance...

<comment><USER17> Tracking movement in 3D using dead reckoning is apparently very inaccurate, with the iPhone sensors I wouldn't expect it to be accurate for more than a few seconds at best. I visited a startup working on the problem a few years ago, and they had problems even with dedicated hardware.

</comment></comment></comment></comment><comment><USER18> HTTP Error 503. Video can be found here:

<http://www.youtube.com/watch?v=IEZtiDrxh-E>

</comment><comment><USER19> Can't wait until someone pipes this into a reprap.

</comment><comment><USER20> Is this related to the webcam 3D scanner video that was in the news about s year ago? I'd be interesting to check out.

</comment><comment><USER21> What can one use this for?</comment>


What the mass resignations at Deadspin tell us about work in America - <AUTHOR> https://www.vox.com/identities/2019/11/1/20941677/deadspin-resignations-writers-workers-quit <comment><USER2> One thing is for sure, it will now be a lot easier for management to hire people with the goal of producing the targeted content instead of personnel writing screeds of political bias unrelated to the publishers desires.

<comment><USER3> Isn't that kind of the draw of Deadspin? It's not bland...</comment></comment>


Reducing Java Memory Usage and GC with UseCompressedOops VM Option  - <AUTHOR> http://blog.leneghan.com/2012/03/reducing-java-memory-usage-and-garbage.html

<comment><USER2> This article fails to say what this flag actually does. My understanding is that it makes 64 bit java use 32 bit pointers. Using the fact that all java memory is 8 byte aligned, a 32 bit pointer gets you a 32gb memory space.

<comment><USER3> Thanks for the feedback, I have now added a bit more information to the background section as well as a link to a full writeup of how it is done.

</comment></comment><comment> Tuna-Fish An interesting tidbit to those who do not know: x86 allows for all memory accesses to use an addressing mode of base+{1,2,4,8}*index. This allows this particular optimization to be used with no performance cost for many normal accesses.

</comment><comment><USER4> We love this setting. It gives us a really nice performance boost on big heaps. Obviously, it can only be enabled on heap sizes below 32GB. We have found that with this setting enabled on a 32GB heap, we need to go up to 48GB+ in order to achieve the same performance.

<comment><USER5> 48GB??? How long are your old gen GC pauses?

</comment></comment><comment><USER6> It is not clear whether it reduces the heap size, or the overall footprint of the java process.

By the way, if anyone knows of a method to reduce the RSS size of the java process, I'd be more than grateful to hear about it.

<comment><USER5> Heap size should be roughly equivalent to the overall footprint unless you're allocating a lot of native memory or mmapped files from the java process. If you are, well, that's your answer.</comment></comment>


Ask HN: What services do you use to send email for small scale apps? - <AUTHOR> Services like Sendgrid and Mailgun offer free tiers up to a certain number of emails sent per month (about 10k). But beyond the free allotment, the cost of sending emails begins to add up, especially when running an app that doesn't generate revenue.
How does the use of these, or similar, email services compare to using Gmail or Fastmail's SMTP servers to send all your app's emails, assuming they're mostly transactional?
What other options do you recommend for sending transactional emails at small scale (0 - 50k / month)? <comment><USER2> Amazon's email service is extremely cheap [1]. I don't think you can go cheaper than them?

[https://aws.amazon.com/ses/](https://aws.amazon.com/ses/)

<comment><AUTHOR> Do you know how SES stacks up against services that focus solely on email?

It looks like a great deal if you already use EC2 because of the free 62k outgoing emails/month. But there doesn't seem to be a free tier otherwise.

</comment></comment><comment><USER3> I like MailGun (10k/mo free) - if cost is a significant issue for larger volume why not do the work to send directly from your server?

<comment><AUTHOR> Everything I've read about hosting one's own mail servers indicates, other than the educational rewards, it's not a practical idea.

But along those lines, I was considering sending emails using Gmail or Fastmail's servers. I'm unfamiliar with the potential pitfalls, if any, when going this route. I'm hoping someone can comment on that or share their experience.

<comment><USER3> When deciding on architecture, I always start with asking what are my key priorities with this project?

      to minimize cost = run my own mail server

      to maximize learning = write my own mail server

      to maximize flexibility or do something truly unusual = one of the above

      to minimize time = pay for a service

      to maximize maintenance cost = cobble solution from pieces intended for other uses.

I have used Gmail for little tiny projects like a contact form that got used a dozen times per year, but that was before MG was an option. As for using Gmail or FastMail today, it will probably work for now, but will it continue doing so in the future? Maybe, but my own personal experience indicates that _all_ free services are not something one can count on persisting over the long haul. TANSTAAFL = you get what you pay for. At some point their funding will run out, or new management will decide to optimize their business expenses. If I were to plan on using a service like this (IANAL) the first thing I check is the Terms of Service. The second thing I check is the service providers intended use case. (When I read the terms of use for both Gmail and Fastmail I get the distinct impression they are intended for use by a human, not for volume transactional send). While these providers may not currently prevent their service being used for transactional mail send - there is a long history of service providers throttling, ejecting, or (if paid) increasing the billing for their highest volume users. When that inevitably (considering history) happens, a new solution will have to be found (probably with minimal notice and urgent deadlines). I don't know about you but I have enough on my plate maintaining the evolving decay of my projects (as libraries fall out of favor and security updates stop) without having to worry about monitoring changes in QOS for email deliver-ability for a cobbled together solution.

Among bulk send providers, Amazon SES is probably cheapest (I read their chart as $100 for 1 Million emails).

Finally, I got something very different out of my reading on running your own mail servers. HN search ([https://hn.algolia.com/?query=mail%20server&prefix&dateRange...](https://hn.algolia.com/?query=mail%20server&prefix&dateRange=all))</comment></comment></comment>


As We May Think (1945) - <AUTHOR> http://www.theatlantic.com/magazine/archive/1945/07/as-we-may-think/303881/?single_page=true <comment><USER2> The most interesting thing about this article, to me, is that part 7 is often skimmed and not understood. Bush describes the user building his own 'trail' of linked item (books, articles, etc.) and being able to store that trail. He was not envisaging the web as we have it (consisting of links chosen by authors), but of the ability to form your own web of connections.

It's in section 8 that he describes the something similar to the web. I've always felt that better tools could be built for part 7.

How many times have I lost the thread of thought while surfing the web and been forced to re-search to find my way back?

<comment><USER3> Yes.

I also regret that we don't have Ted Nelson's original idea for hypertext, in which incoming links were also visible by default.

Of course in reality the spammers would have a field day with that -- every popular page would have about a jillion incoming links for dubious pharmaceuticals and dodgy gambling operations, but still, one can dream.

<comment><USER4> Can't you hack that together with a [link:] query on Google? You can even use Google's ordering algorithm as a spam filter.

<comment><USER5> link: has been incomplete for years and years; when I heard of link: I thought it'd be so awesome, and then I encountered the brutal reality...

You can approximate something similar though on sites you control: set Google Analytics to record referring URLs and after a few time-units, dump the set per-page to construct a manual trackback.

<comment><USER6> Don't do this if you care anything about SEO. It will make your site appear to Google as part of a reciprocal link scheme, and it will get nuked from the index.

<comment><USER7> Marking the links as rel="nofollow" should prevent that from happening, shouldn't it?

</comment></comment></comment></comment></comment></comment><comment><USER8> The Office of Scientific Research and Development was essentially the civilian side of the Manhattan Project. Interestingly this article was published in the same month as Trinity, at which Vannevar Bush was present. The Manhattan Project itself was still a tightly held secret at this point.

A contemporary picture of Bush: [http://images.google.com/hosted/life/l?imgurl=3dcd2f9a3fce36...](http://images.google.com/hosted/life/l?imgurl=3dcd2f9a3fce368f)

</comment><comment><USER9> Vannevar Bush is an absolutely incredible guy. If you want to understand the origins of the modern academic research complex and Bush's role in building it definitely check out 'The Making of the Atomic Bomb' by Richard Rhodes.

</comment><comment><USER10> It is the classic essay written about the future in 1945. We got fundamentals (of computing age) for topics like hyperlinks, information retrieval etc. in this article.

I guess I've read somewhere that people like Doug Englebart (father of computer mouse) were inspired by this essay and made that vision into reality.

<comment><USER11> If Bush's essay is the start of a trail, then Englebart's "Mother Of All Demos" is the next waypoint:

<http://www.youtube.com/watch?v=JfIgzSoTMOs>

This is great, critical history to absorb about our industry.

(As an aside, I feel that the introduction of the original iPhone is in some ways a spiritual successor to Englebart's demo.)

</comment></comment><comment><USER12> Vannevar Bush's idea for the PC (and web) as an aid to memory is coming true big time. For better or worse, it's often those who already well educated who benefit the most.

</comment><comment><USER13> Doug Engelbart Institute posted a link to videos and transcripts of the Oct 1995 Brown / MIT Vannevar Bush symposium celebrating the 50th anniversary of AWMT:

"As We May Think: A Celebration of Vannevar Bush's 1945 Vision, An Examination of What Has Been Accomplished, and What Remains to Be Done"

Excellent talks and panels with Doug Engelbart, Ted Nelson, Andy van Dam, Alan Kay, Tim Berners-Lee, Paul Kahn, Lee Sproul, Raj Reddy, Michael Lesk, Bob Kahn, and others.

Douglas Adams was the dinner speaker (great talk, unfortunately no video or audio record).

[http://www.dougengelbart.org/events/vannevar-bush- symposium....](http://www.dougengelbart.org/events/vannevar-bush- symposium.html)

"The event was in fact an exhibition of Bush's legacy, a self-referential, interweaving (intertwingling, Ted Nelson would say) of all the themes - social, technological, and psychological - from Bush's paper. In the course of two days it became very clear how deep and ambitious - socially and culturally - Bush's most central ideas were. At every turn we were reminded that Bush was writing about how fundamentally new intellectual practices could change the entire landscape of human social life. Bush's vision was not just about hypertext, or data management, or information retrieval, let alone about microfilm or calculating machines; rather, it was about extending the power of human beings by giving them radically new ways of working together.

The goal of fundamentally changing how we work in order to address pressing human problems continued to be central throughout the development of Bush's legacy in the '60s and '70s, most obviously in the work of Engelbart, Nelson, and Kay. Its continued evidence throughout the symposium - even (perhaps most notably)in the presentation of Tim Berners-Lee, the youngest speaker - and the warm response of the audience made it clear that this optimistic social agenda still resonates. It seems that we are not too jaded, skeptical, or post-modern to believe, 50 years later, that technology can bring us 'a new relationship between thinking man and the sum of our knowledge', one that will promote 'the application of science to the needs and desires of man' ('As We May Think')."

from <http://www.cs.brown.edu/memex/Bush_Symposium_Interact.html>

</comment><comment><USER14> Old School! Nice to see Bush sprouting up on Hacker News!

@Turing_Machine - stay tuned. 2-way public hyperlinks might just be on their way : )

</comment><comment><USER15> Is there any evidence that this article actually informed or inspired the pioneering work on hypertext systems (Xanadu, HES, Intermedia, etc)? Or was it brought in later to add historical credibility to the idea? IN would be intersting to see a citation history.

Its a great article, though, and Vannevar Bush was an impressive guy.

<comment><USER13> AWMT was certainly a hot topic and required course reading from 1968 on... I was a student of Andy van Dam's in that era and early user of the Hypertext Editing System developed at Brown with Ted Nelson.

Certainly for Intermedia and Nelson's "Literary Machines" era; Nelson published a full copy of AWMT in his 1980 book.

Doug Engelbart frequently tells the story of reading "As We May Think" as an enlisted radar technician in a thatched hut Red Cross Library in 1945 (see Belinda Barnet link below)

Ted Nelson said in an Aug 2000 telephone interview:

"I think I read it when it came out in 1945. Since I was eight my memory is necessarily incomplete. Everyone else who would have been in the family is now deceased. But we did subscribe to the Atlantic Monthly and I think there's a very good chance I read it at that time." ~ Ted Nelson

<http://illuminationgallery.net/wr/hypertext/nelson.html>

Belinda Barnet's PhD thesis on the intellectual history of hypertext will be published as a book early next year, including extensive interviews with Doug Engelbart, Ted Nelson, and Andy van Dam.

She writes frequently on the subject, often published in Digital Humanities Quarterly: <http://www.digitalhumanities.org/dhq/>

For a good 2008 paper by Belinda and Darren Toffs, on Bush, Engelbart and Nelson see:

Too Dimensional: Literary and Technical Images of Potentiality in the History of Hypertext

[http://www.digitalhumanities.org/companion/view?docId=blackw...](http://www.digitalhumanities.org/companion/view?docId=blackwell/9781405148641/9781405148641.xml&doc.view=content&chunk.id=ss1-5-9&toc.depth=1&brand=9781405148641_brand&anchor.id=0)

A Companion to Digital Literary Studies, ed. Susan Schreibman and Ray Siemens. Oxford: Blackwell, 2008.

<comment><USER15> Thanks, very interesting. And some useful links.

I wrote my masters dissertation on hypermedia back in 1991, and I remember that references to AWMT kept appearing in papers I was reading. When I read it I could see how it related to hypermedia as it existed in the early nineties, but 1945 seemed rather distant and the paper seemed to stand on its own, rather than being the start of something. I haven't thought about it since, but it now seems obvious that this was because of my lack of knowledge at the time. I wasn't aware then of Englebart's work, for example.

I re-read Literary Machines only last year, but had completely forgotten that Nelson included AWMT in it. I may pull it off the bookshelf again tonight.

<comment><USER13> I think the trail led from Doug Engelbart and folk who were directly or indirectly influenced by his 1968 Demo as well as Ted Nelson and Computer Lib / Literary Machines.

Doug donated his personal copy of "As We May Think" with marginal notes to the Computer History Museum (you can download a copy). He wrote about Bush's influence in "Augmenting Human Intelligence" (1962) and talked about it in a Stanford University Oral History interview.

See [http://www.dougengelbart.org/events/vannevar-bush- symposium....](http://www.dougengelbart.org/events/vannevar-bush- symposium.html#3)

</comment></comment></comment></comment><comment><USER16> This pops up in front of me every couple years and I always get something new out of it each time.

</comment><comment><USER17> I can't tell you how many times I had to read this in college. It was the first text we read in at least 5 of my courses my junior year.

Both classic and ahead of his time.

</comment><comment><USER13> "Endless Frontier: Vannevar Bush, Engineer of the American Century" (1999 MIT Press)is an excellent biography of Bush by G. Pascal Zachary.

</comment><comment><USER18> Vennaver Bush invented the blogosphere :-)

> The historian, with a vast chronological account of a people, parallels it > with a skip trail which stops only on the salient items, and can follow at > any time contemporary trails which lead him all over civilization at a > particular epoch. There is a new profession of trail blazers, those who find > delight in the task of establishing useful trails through the enormous mass > of the common record.</comment>


Learn how to bring animation to your web projects - <AUTHOR> https://github.com/cssanimation/css-animation-101 <comment><USER2> Cool that you open-source a book - it looks like it contains a solid amount of information. Well done!

What I'm missing (couldn't find it on the first glance) is a topic about the performance implications of animations. Most devs don't consider which css properties trigger a layout->paint->composite re-render, which has massive influence on browser performance.

There are soooo many shitty animations/transitions in the web, just because people don't know that animations can slow down a whole site.

Imho people should read something like the web dev one pager on animation performance (1), which explains (more or less) how to build high-performance animations.

There is also this free udacity course (2) which explains everything a web developer needs to know. It's not hard nor magic, and you just have to hear it once to remember it for whenever it becomes necessary.

1: [https://developers.google.com/web/fundamentals/design-and- ux...](https://developers.google.com/web/fundamentals/design-and- ux/animations/animations-and-performance) 2: [https://eu.udacity.com/course/browser-rendering- optimization...](https://eu.udacity.com/course/browser-rendering-optimization --ud860)

<comment><USER3> It's especially bad with the CSS frameworks that people slap on their sites.

Various Material UI implementations are notorious here because they have fancy animations everywhere.

<comment><USER2> ^ this!

I've seen so many jquery libraries used on sites to get a quick fancy animation, but then it used something like: setTimeout(() => { element.height += 2; }, 50)

Which literally brings a 60+fps page to <5fps on a high-end machine.

</comment></comment></comment><comment><USER4> Just don't be tempted to add all the animations you can think of after reading something like this (similar to what often happens to other developers after reading about design patterns.) If anything, you should probably err on the side of not using animation.

(Unless it's a game or such, in which case definitely be more liberal with animating things.)

<comment><USER5> Also, if your app or website has settings, please include a setting for them: no animations | reduce animations | enable all animations.

Settings are often maligned in interface design, but they're very important for people who actually use your app often. Instead of forgoing them altogether, ship with good defaults and let the user reset them if things go wrong.

<comment><USER6> There's also an upcoming media query `prefers-reduced-motion`: [https://developer.mozilla.org/en- US/docs/Web/CSS/Media_Queri...](https://developer.mozilla.org/en- US/docs/Web/CSS/Media_Queries/Using_Media_Queries_for_Accessibility#Reduced_Motion)

</comment></comment></comment><comment><USER7> Thanks for sharing this! I was looking for a resource on CSS animations for a couple web apps I'm working on.

</comment><comment><USER8> Something important which I think is missing from the accessibility section is a reference to the prefers-reduced-motion CSS media feature [0]. When it was initially released the WebKit team wrote a post [1] explaining its purpose, how to use it, and many practical examples. I'd suggest including a link to their post.

It's currently supported by Firefox and Safari [2]. The Chromium team recently began working on it as well [3]. Edge's Platform Status [4] has it marked as a low-priority issue; given the included explanation they'll probably wait for Chromium to finish implementing it and copy them. Please consider taking a minute to vote on the issue if you consider it important.

WCAG 2.1 Level AAA requires that animations from interactions have a way to be disabled [5]. I wish more developers would implement this, although in my case it's just because I generally don't care much for animations.

There's no mention of springs, which is essential for creating animations that feel natural. I remember having my mind blown when I first learned about these animation techniques. Just knowing they exists lets you expand your toolkit, even if you don't regularly work on UI development. "Creating Animations and Interactions with Physical Models" [6] has a superb explanation.

The book references it in passing, but I want to highlight Disney's Twelve Basic Principles of Animation. I was first exposed to them in the wonderful animation: "The illusion of life" [7], and it remains my preferred resource for quickly introducing others to the concepts. They also put up each individual rule as gifs on tumblr [8] if you prefer to skip the video. This is one of those foundational building blocks that you start to notice everywhere after learning about it.

[0] [https://developer.mozilla.org/en- US/docs/Web/CSS/@media/pref...](https://developer.mozilla.org/en- US/docs/Web/CSS/@media/prefers-reduced-motion)

[1] [https://webkit.org/blog/7551/responsive-design-for- motion/](https://webkit.org/blog/7551/responsive-design-for-motion/)

[2] [https://caniuse.com/#search=prefers-reduced- motion](https://caniuse.com/#search=prefers-reduced-motion)

[3] [https://bugs.chromium.org/p/chromium/issues/detail?id=722548](https://bugs.chromium.org/p/chromium/issues/detail?id=722548)

[4] [https://developer.microsoft.com/en-us/microsoft- edge/platfor...](https://developer.microsoft.com/en-us/microsoft- edge/platform/status/mediaqueriesprefersreducedmotion/)

[5] [https://www.w3.org/TR/WCAG21/#animation-from- interactions](https://www.w3.org/TR/WCAG21/#animation-from-interactions)

[6] [https://iamralpht.github.io/physics/](https://iamralpht.github.io/physics/)

[7] [https://vimeo.com/93206523](https://vimeo.com/93206523)

[8] [http://the12principles.tumblr.com/](http://the12principles.tumblr.com/)

<comment><AUTHOR> Thank you for the links and feedback. I will revisit the accessibility section with this new information.

</comment></comment><comment><USER9> other than css tricks, as far as animation is concerned, webp is replacing gif:

[https://caniuse.com/#feat=webp](https://caniuse.com/#feat=webp)

</comment><comment><USER10> Looks cool.</comment>


NSA OSS Technologies - <AUTHOR> https://nationalsecurityagency.github.io <comment><USER2> This caught my eye:

> [https://github.com/apache/incubator- > pirk](https://github.com/apache/incubator-pirk)

> Employing homomorphic encryption techniques, PIR enables datasets to remain > resident in their native locations while giving the ability to query the > datasets with sensitive terms.

I can imagine a few scenarios there. One perhaps is when db admin should not find out what someone, possibly working on a classified project is querying.

Or say one compartment / project collected the data and now they want to share it with another project. Those read into the second project don't want to reveal to the first one what they are querying because it would reveal classified information.

Another scenario is a database which has results of possibly illegally intercepted communications. If the NSA can argue that the Constitutionally defined "search" doesn't occur until someone actually performs a search (as in runs an SQL query over the data). Then having PIR capability means being able to break the law but only let as few people as possible do it.

Also [https://github.com/redhawksdr](https://github.com/redhawksdr) is pretty damn impressive. It looks like a complete parallel implementation of GNU Radio. Completed with an IDE and such. Wonder how it compares?

<comment><USER3> This is pretty common in the commercial world too, and something I've done more than once myself. The obvious use case is storing medical records.

In the UK personal medical records are often stored by systems integrators in datacentres with nebulous locations, and need to be accessed by third parties for things like underwriting life insurance policies.

To protect the data (compliance with the EU data protection act) it's encrypted in transit AND at rest. Access to data by third parties is managed through AMRAs (access medical record authorisation), which are completed by the third party, authorised by the data owner (private individual) and given to the data owner's general/dental practitioner or pharmacist, who is able to access and decrypt and appropriately share the sensitive data.

<comment><USER4> Are AMRAs kinda like "stored procedures" then?

<comment><USER3> AMRAs are like physical documents with an instruction to the information guardian, with a signature from the information owner, authorising access.

A lot of it is electronic these days, and is automated to the point that an individual authorises access by clicking a link in an email that calls an endpoint that in turn releases a token and URL to the requestor to view the appropriate records.

<comment><USER5> So like OAuth?

<comment><USER3> Partly. OAuth is authentication (who I am), which is part of it, but the real point is authorisation (what I can do).

</comment></comment></comment></comment></comment></comment><comment><USER6> Violating the sanctity of the captive portal license agreement! [https://github.com/iadgov/goSecure/blob/master/scripts/wifi_...](https://github.com/iadgov/goSecure/blob/master/scripts/wifi_captive_portal.py)

:)

<comment><USER7> The captive portal license agreement?

<comment><USER8> That code just bypasses a captive portal. It's basically automatically clicking "I agree".

</comment></comment></comment><comment><USER9> That's nice to see the NSA is contributing to the OSS community. I just randomly picked one of the NSA GitHub repositories, analysed it with VersionEye ([https://www.versioneye.com](https://www.versioneye.com)) and found already 25 security vulnerabilities. Who is the best person to contact in this case? Here is the security report: [https://www.versioneye.com/user/projects/59479cd06725bd00123...](https://www.versioneye.com/user/projects/59479cd06725bd001230f152?child=summary#tab- security).

<comment><USER10> They say it clearly themselves:

> The government benefits from the open source community's enhancements to the > technology.

They're hoping that by putting this code out there, unwitting dupes will then collaborate with them to contribute to the surveillance state.

</comment></comment><comment><USER11> Can someone explain how some of projects can be MIT-licensed (or anything- else-licensed) as they claim? Aren't they necessarily in the public domain given that they're works of the U.S. Government?

<comment><USER12> Certain government agencies and subsidiaries are exempt from having their work considered "government work" and can thus claim copyright if they want. I'm guessing the NSA is such and agency. Also if the work was actually done by a contractor then there are other exemptions.

<comment><USER11> Thanks, but I'm not sure that's it. For example, when I look at at [1], I see an apparent contradiction with [2]. It almost seems like they don't know what they're doing, but surely that's because I'm misunderstanding what's going on?

[1] [https://github.com/NationalSecurityAgency/DCP/blob/21c8d3efe...](https://github.com/NationalSecurityAgency/DCP/blob/21c8d3efecd0ceb5fc38dfe8e2c3aa8011ed58cd/COPYING)

[2] [https://github.com/NationalSecurityAgency/DCP/blob/496402fa9...](https://github.com/NationalSecurityAgency/DCP/blob/496402fa92aa61acfbb871f6faa0988b16d1e2c1/LICENSE)

<comment><USER13> Well if they are forking or contributing to other software or any type of derivative work, they probably have to retain the original license by law

<comment><USER11> That's not the case at least in the example I just gave though, right?

</comment></comment></comment></comment></comment><comment><USER14> I've trialed Apache Nifi and it's very powerful. It's also a little unsettling as you use it thinking about how the NSA used it ...

<comment><USER15> NiFi looks pretty interesting, what's the learning curve like? Looks like a supercharged yahoo pipes.

</comment></comment><comment><USER16> [https://github.com/ozoneplatform/owf- framework](https://github.com/ozoneplatform/owf-framework) looks very interesting - NSA wrote their own BI tool?

<comment><USER17> OWF came up in a meeting recently -- may not be as awesome as NSA wants you to believe.

<comment><USER16> Can you share any other info?

<comment><USER18> reddit have a comment thread about this.

Once comment described it as a "shit show".

Apparently its terrible and they tried to get the company to rebuild it and they made it the same.

Another comment comment on how "buggy" it was.

Or that the only dev that willing to work with it are contractors that want money.

<comment><USER19> > Or that the only dev that willing to work with it are contractors that want > money.

Greedy b*stards! </sarcasm>

</comment></comment></comment></comment></comment><comment><USER20> I wonder if all the people who are really suspicious of it in here realize that this (releasing their projects as OSS) has been a thing for a while.

SELinux

Accumulo (a popular NoSQL distributed key-value store)

Apache NiFi (data processing system)

etc.

</comment><comment><USER21> It's nice to see a push for open security and solutions rather than secretive offensive counter-security. Thanks. :)

<comment><USER22> One does not exclude the other though

</comment></comment><comment><USER23> One of my favorites is the Speck cipher, which has been released before:

[https://en.wikipedia.org/wiki/Speck_(cipher)](https://en.wikipedia.org/wiki/Speck_\(cipher\))

I'd be very interested in more public cryptanalysis of this. It's a damn simple cipher to implement, and if it were at least as secure as say Salsa20/12 it'd be very nice for all kinds of applications.

</comment><comment><USER24> Does the fact that many of these havent been updated in months or years mean that these are really old projects that effectively hold no value to the NSA and arent close to any of their core operations?

<comment><USER25> For every one of these projects someone spent a considerable effort do the paperwork to get it pushed out, have it signed off as sanitized, non- embarassing, etc. It is a lot of work to get that done in bureaucratic and risk-averse organisations.

If there had been a community contributing back I expect that there would have been more activity, but if it seems like noone will, would you spend your time pushing out regular updates?

</comment></comment><comment><USER26> There's a lot of neat things there. (This one looks interesting: [https://iadgov.github.io/goSecure/](https://iadgov.github.io/goSecure/))

Also interesting is splitting the repos: that the NSA and IAD have different repos, and that one seems focused on defensive tech while the other is publishing analysis tools.

I know there's a lot of people who aren't fans of the NSA (or what they do), but I think most of us can see a need for a military-grade organization to research defensive technologies for helping secure our infrastructure. I don't think many of us would be unhappy with the NSA if that's all they did. (Or phrased another way: most of us are unhappy because of how they conduct intel work or compromise defensive capability for offensive ones, eg, that whole business with ECC.)

So I think it's important to respond positively to things like the IAD github page, even if we're not fans in general.

<comment><USER27> I think you're right. It's sad to see many people are looking at these tools and performing a sort of "Allegory of the Cave" by extrapolating, then, the evils that can be done with these tools.

Something, mostly common sense, tells me that we will not find some smoking gun to a crime here in these OSS repos...if anyone wanted that, they can refer to any number of leaks.

Ultimately, I'm happy to see this stuff shared, happy to see others use it and happy to see the OSS community build on it.

<comment><USER28> There's multiple reasons why you wouldn't want to use these newly released open-source projects. First one is, like you said, the danger of a backdoor. The second one is that due to the very long list of non-ethical and illegal practices of the organisation you don't want to contribute or depend on them.

<comment><USER29> Bleach has been used in bombs around the world, should I not use it because there's a chance it's been used for (perceived) evil?

<comment><USER30> Cluster bombs have such blatant propaganda spread against them by well-meaning but naive individuals. Don't be fooled - look at all their positive uses!

<comment><USER29> That's not a like for like comparison, one is a bomb designed for destruction, one is software designed to solve a problem. The software isn't designed to kill, maim, or destroy, if it can be used as part of the process that doesn't make the software itself evil. Should we throw out linux systems since linux powers many control systems in war machines?

</comment></comment></comment></comment></comment></comment><comment><USER31> I suspect there are a lot of very incredible computer programmers at the NSA and they're probably using just regular open source non security related tools every day. It's good to see that they're contributing back to the OS community what they can.

<comment><USER32> Let's not forget: these people may be skilled, but they are working against every principle of our community.

[https://www-androidauthority-com.cdn.ampproject.org/i/www.an...](https://www- androidauthority-com.cdn.ampproject.org/i/www.androidauthority.com/wp- content/uploads/2014/06/SSL-Added-and-Removed-Here.jpg)

<comment><USER25> And you pasted an amp link? Was that deep sarcasm?

The world is full of shades of grey, and black and white 'they are all evil!' is just pointless and dumb.

<comment><USER32> It wasn't intentionally ironic.

Where did I call anyone evil? I didn't even vilify people - I specifically focused on the work that these people are performing. It works to make the world a worse place.

How should I criticize them?

<comment><USER25> For breaking the law and working to undermine the Constitution? Is that not a big enough claim?

Maybe blame specific people (the DIR NSA Hayden, Bush, Obama). There was a strong culture at NSA of NOT spying on Americans until those clowns came along.

<comment><USER32> But spying on other people is okay, simply because where they had the audacity to be born?

Nations are fictions and depriving rights to a group that you permit to others based on nationality is entirely unjust.

I blame the specific people who built these systems to collect and process data for the military.

<comment><USER25> Would you rather that nations didn't spy on each other? I wouldn't. Effective spying helps prevent war, and lack of intel leads to wars.

If the British had had better intel they would never have invaded Afghanistan to repulse an imaginary Russian annexation. If intel had been listened to, instead of deliberately ignored/fabricated by Bush we wouldn't have invaded Iraq because of imaginary WMDs. If Kennedy hadn't actively understood the intel on Cuba, and just left it to the fears of the generals, the US would have invaded Cuba. The biggest fear of the Warsaw Pact is that the West would invade -- which was the West's fear also -- to the point that a lack of intelligence on Western force movements almost resulted in a counter-premptive invasion.

So maybe nations are fictions, but they are pretty powerful ones that most people are happy to roll with, and that makes the consequences real. These same people can agree on a set of collective norms that control who/what/where can be surveilled.

The propaganda that there are many ISIS terrorists embedded in Western nations is the key lever which will be used to transition from military/national intelligence to the surveillance state. This can't be won by railing against the NSA, but by countering (islamic and fascist) extremism, false reporting and propaganda.

And yet in the mean time we are being outflanked by traditional nation state adversaries using strategic propaganda campaigns. And they won't hesitate to spy on us. I want NSA(/GCHQ/DGSE/8200) working hard to prevent that, instead of navel gazing illegal programs about spying on environmentalists/unionists/politicans.

<comment><USER33> What about using the state infrastructure/technology to spy in the Brazilian state oil company and steal engineering secrets to hand to american competitors?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER34> Also don't forget SELinux [https://github.com/SELinuxProject/](https://github.com/SELinuxProject/) which is a project that comes from the NSA as well

<comment><USER5> SELinux is on the list :)

</comment></comment><comment><USER35> I see the PR department is getting smarter...

<comment><USER36> Federal government is required to open source at least 20 percent of its code now:

[https://sourcecode.cio.gov/](https://sourcecode.cio.gov/)

<comment><USER37> The cynic in me wonders _which_ 20% we'll get. The repo linked here is pretty impressive, so I may have to eat crow. I would have expected to get every html template and vba macro ever written, instead of the value add stuff.

<comment><USER38> My thoughts exactly. That 20% will probably provide you with a map of Russia while you're flying over the Swiss Alps. Some things are better not learned (or known) at all than learned (or known) the wrong way.

</comment></comment></comment></comment><comment><USER39> Femto ([https://github.com/femto-dev/femto](https://github.com/femto- dev/femto)) looks pretty interesting to me just based on some work I've needed to do in the past that it would've come in handy for.

It looks like the last commit was over a year ago, though. Is there information I'm not seeing of whether these projects are actively maintained (or still in use at NSA?).

<comment><USER24> Im also curious, without digging into it deeply is it something comparable to Solr or Elasticsearch? If so i wonder how it stacks up

</comment></comment><comment><USER40> This is nice. It should all be about protecting electronic systems. To help individuals and companies build resilient systems. It protects the USA and the world economy as a whole. It should never be about spying people or even catching criminals IMHO.

</comment><comment><USER41> If they're looking for pull requests, they won't find any salvation in the OSS world.

</comment><comment><USER42> It's generous to have all in royalty free license.

<comment><USER43> Why should it be generous? It's been paid through taxes.

<comment><USER44> Well, it's generous for non-americans ;)

<comment><USER45> A small compensation for the invasion of their privacy...

</comment></comment></comment></comment><comment><USER46> Fun sidenote: I was the very first civilian to contribute to their GitHub project back in July 2015, when SIMP was the only project they had up on GitHub.

It was literally a one letter change in the README file, but I still have the privilege to call myself the very first civilian to contribute to the NSA's open source project: [https://github.com/NationalSecurityAgency/SIMP/pull/1](https://github.com/NationalSecurityAgency/SIMP/pull/1)

<comment><USER47> I'd shake your hand

</comment></comment><comment><USER48> Why are people so welcoming to the filthy spies invading citizen privacy?

<comment><USER45> Some of the are defending against other filthy spies.

<comment><USER49> Down With All The Filthy Spies!

</comment></comment></comment><comment><USER50> Some very cool stuff.... useful from both a practical and anthropological standpoint.</comment>


Some Lesser-Known Deep Learning Libraries - <AUTHOR> http://blog.paralleldots.com/technolgy/deep-learning/lesser-known-deep-learning-libraries/?utm_source=forum&utm_medium=group_post&utm_campaign=Hacker%20News%20 <comment><USER2> We use seq2seq frequently, I think it is quite popular so won't exactly call it lesser known !!

<comment><USER3> It's quite recent though. Explains why it might be slightly popular. But mostly ppl(who don't follow Denny) don't really know of it.

</comment></comment><comment><USER3> Lot of good platforms are listed as well, not just libraries. Good collection!</comment>


A practical proposal for migrating to safe long sessions on the web - <AUTHOR> https://developers.google.com/web/updates/2016/06/2-cookie-handoff <comment><USER2> Note that the article buries a much easier way to deal with this problem:

"some websites don't verify the user's authentication on each request (i.e. there is no way to revoke the session cookie once issued)"

Which implies that if you do verify the session on the server and have a mechanism for invalidating these sessions on password change, etc, you can just use very long cookies and you're done.

There are very good reasons for doing that anyways, so no need for this hack.

<comment><USER3> You don't need to verify the session on the server all the time. Session verification very quickly becomes a bottleneck to app performance, since you're doing a separate database/cache lookup for each rest endpoint request. It's far easier, and provides much better performance, to just cryptographically sign a cookie that says "I'm this user".

This is where the short/long-term cookie comes into play, and is actually a neat idea to take care of the "how do I periodically check that the user hasn't logged out/changed their password/invalidated their sessions/etc" problem that the cryptographically-signed cookie brings up.

<comment><USER4> That sounds like a time-space trade-off to me. I'd think cryptographic signature verification would be more expensive computationally than a cache lookup and compare, but not require much space. Also, and maybe this is the key part, it would be more distributable since you don't need shared state.

<comment><USER3> Yes; and CPU is cheap as hell. Round trips to a cache are _expensive_.

<comment><USER5> That depends on where your cache is.

If your cache is on a separate box and you have to make a network round trip, yeah it is expensive.

But if your cache is in-process, the access is cheap.

</comment></comment></comment></comment></comment><comment><USER6> I wonder why this couldn't just be handled with two cookies, period: one a short-lived authentication token; one a long-lived revalidation token.

The former could be self-certifying (i.e., trusted if it's properly signed, with no auth service round-trip); the second could require a round-trip to the auth service). On a request, when the server see that the short-lived token has timed out, it checks the long-lived token; if still valid, then it reissues a short-lived token and sends it as a cookie value replacing the old short-lived token.

If multiple requests are in-flight, no matter — short-lived tokens require no session state, so all that happens is generating a few too many signatures.

Am I missing something?

<comment><USER7> Isn't the original problem that someone could steal the long-lived cookie in the first place?

<comment><USER8> The intent is not to provide an "unstealable" token, but a revocable one. You can't (don't need to) revoke the refresh token but you can revoke the access token by disallowing refresh.

</comment></comment></comment><comment><USER9> I don't really understand what the service worker that makes an extra network request adds here.

Why not just have the code that validates the session just do an `if (short_session != valid) { lookup_long_session_in_db() }` then return a fresh short session cookie with whatever request you're currently handling?

<comment><USER10> 1\. This assumes that every page you might make the request to can issue auth tokens. This might be fine for small sites where auth isn't a concern (but then just issue a long-lived token and don't bother with all this), but for larger sites, capability to issue auth tokens is generally isolated from the rest of the services.

2\. Your pseudo-code returns a legitimate short session cookie in response to gibberish. I'm hoping that this is just because you elided a lot of detail.

<comment><USER9> 1\. Why does every end-point being able to refresh a token (or whatever you want to call it) imply that auth must not be a concern? I will fully admit that I've never worked on really large scale web services, so hopefully that's not a super obvious thing.

I would think that having all pages be able to handle auth is just a architecture question. Maybe I've just been too deep for too long in writing a webserver in Iron [0], but the way you handle auth in it, by using middleware and wrapping any endpoint that needs auth with an auth handler, makes doing something like this trivial.

2\. Definitely left out a lot, I mean it doesn't really return anything at all. Just meant it as some shorthand pseudo code to make explaining it shorter. :)

[0] [https://github.com/iron/iron](https://github.com/iron/iron)

EDIT: Actually now I'm not sure if you're talking server-side or client-side, but I think the argument still stands. I was assuming auth "tokens" could actually be cookies, but even if not, your API library just needs to have a check to see the the request returned updated auth. It's still just in one place, handled in all calls, rather than just the single call that would otherwise handle it.

<comment><USER10> I was referring to server side. If you're really serious about security, you probably want to isolate the login process to a dedicated server. If your web server is breached, do you really want your auth keys leaked? And do you really want access to your user's creds available en masse to the breached server?

If you're running a small scale service, you're unlikely to build a dedicated login service. If you're running a large scale service, you probably should.

Edit: Based on Thomas's answers here, I am wrong about this, so I guess take my thoughts with a grain of salt.

</comment></comment></comment></comment><comment><USER11> > We all love how native apps will ask you to login only once and then > remember you until you tell them you want to log out.

I wish that were true more often. There's a handful of native apps that don't remember my credentials and I have to go look them up on the desktop in my password manager. For example, I installed Pokémon Go but haven't looked into it further because I don't have my Google password memorized; it's a randomly generated password that I expect my computer to remember for me.

It seems like every native IoT widget controller I try wants me to remember more credentials.

<comment><USER12> Get a password manager that syncs to your phone. I'd be completely lost without it. I love 1Password for syncing. Just pop it open, copy/paste, done.

<comment><USER13> I use KeePassX and Keepass2Android, with the database file stored on Dropbox. It's free and runs natively on Linux.

<comment><USER7> Since upvotes are invisible, I will comment to say I second this. Keepass2Android is a amazing and I love this solution, even though I've always otherwise hated password managers.

</comment></comment></comment></comment><comment><USER14> You don't necessarily need to authenticate every request. For example, Amazon.com allows a user to be "semi-logged in", but forces you to authenticate yourself when doing something like making a purchase.

</comment><comment><USER15> That's what we did except that the short lived token is a GWT no in a Cookie. While the Long Lived Hash is a Cookie with a database. But the Cookie will only live for the session of your browser. Mostly we only query the database every 5 minute, cause of that.

Actually we also have a workaround to support Safari by trying to put stuff in LocalStorage that tells the other Tab that it recently got a new token and so on.

</comment><comment><USER16> So is this like oauth2 refresh token?

</comment><comment><USER17> In the long run it would be better to find a standard way of doing this so that browsers implement it without the need for a worker initiated from JS. Static pages could benefit from safe long lived sessions as well.

</comment><comment><USER18> I've explored this in the past. Wouldn't it be possible to simply set two 1yr cookies one at the mid-expiry point of the second. Then re-set the first when it expires and vice versa?

<comment><USER19> But if the user resets their password, it should log out all the user's sessions. But you have to wait for the cookies to time out before they are re- authenticated. (Or make a check on every request to see if the password has been changed, which is just a pain.)

<comment><USER2> You don't check on every request to see if the password has changed, you check to see that the session is valid on every request. You should be doing that anyways.

Then all you have to add is a way for password changes to invalidate the session.

<comment><USER9> The thing is that the way that a session is usually "validated" these days is to just store a userid in some serialized format then encrypt that and send it off as a cookie that expires in a relatively short amount of time (and hopefully put the expire time in the encrypted message too). Then the server just has to try to decrypt the cookie and if it results in a valid userid then the session is valid. This way you don't cause an extra database request for every user request.

I'm not saying it's good or secure, but it's the way I often see it done/suggested to be done.

</comment></comment></comment></comment><comment><USER20> I just hope that that other tabs cannot see the cookie within a tab. Or if there was some other way of isolating identity.

My concern is privacy.

<comment><USER19> It's just a cookie. It works like every other cookie.

<comment><USER20> Yeah, but I mean before they implement this scheme, I hope they modify the browser (or someone comes up with one), so that you can pick which group of cookies are accessible within different tabs.

With apps, I know that this app doesn't know my identity from that app unless I explicitly give it permissions.

<comment><USER19> Firefox is starting a project on this, it's still in research stages though. [https://blog.mozilla.org/tanvi/2016/06/16/contextual- identit...](https://blog.mozilla.org/tanvi/2016/06/16/contextual-identities- on-the-web/) In the meantime, you can use different user profiles in Chrome or Firefox, but they work per-window not per-tab.

<comment><USER20> Great news. Thanks. Didn't realize that Chrome and Firefox do that on a per- window basis. I browse everything in incognito mode.</comment></comment></comment></comment></comment>


China Unveils its 2020 Mars Mission - <AUTHOR> http://www.spaceflightinsider.com/missions/solar-system/china-unveils-2020-mars-mission/ <comment><USER2> USA, Russia, China and even the UAE are all aiming for the 2020 launch window... it's about to become a very crowded place.

<comment><USER3> Its a very good opportunity for international cooperation something that space programs historically have a very good track record of (i.e. coordinate target locations and instrument sets to get the best possible combined data)</comment></comment>


Show HN: 3D Terrain Sun Simulation for Android - <AUTHOR> https://www.youtube.com/watch?v=RqZxh2oail8 <comment><AUTHOR> Sun Locator predicts the sun's position at a specific location during the course of the day. The 3D Terrain Simulator is the newest feature, which simulates the lighting conditions in mountainous terrain. The user can fastforward the time to see how the shaded areas change in the course of the day and the year.

There's a free version available here: [https://play.google.com/store/apps/details?id=com.genewarrio...](https://play.google.com/store/apps/details?id=com.genewarrior.sunlocator.lite)

And the full version here: [https://play.google.com/store/apps/details?id=com.genewarrio...](https://play.google.com/store/apps/details?id=com.genewarrior.sunlocator.pro)</comment>