TeX and LaTeX in industry applications - <AUTHOR> http://tex.stackexchange.com/q/40720/213 <comment><USER2> My experience tells me that until you are an expert, you have to fight with TeX- sometimes you even have to fight it when you are an expert.

So, much like anything open source vs. Microsoft, you will get excellent results for low effort with the Microsoft tools when doing anything "normal". When doing something really unusual, turn to TeX because it will be easier to wrangle than Word.

For example, I tried really hard to use TeX for my resume. It was a tremendous pain for weeks, and the most popular template hadn't been updated since 1970. I switched to Word and made a better resume in about twenty minutes. On the other hand, when working on a hundred-page collaborative report with a team of eight people working together through a VCS, TeX was a godsend- most notably for \include, inherited layouts, figures, and citations. (Each of which is easy for an individual in Word, but hard to manage with eight people)

<comment><USER3> _you will get excellent results for low effort with the Microsoft tools when doing anything "normal"_

If you have basic LaTeX skills, you get excellent results for low effort with LaTeX when doing anything _normal_.

 _For example, I tried really hard to use TeX for my resume. It was a tremendous pain for weeks, and the most popular template hadn't been updated since 1970._

As far as my resume is concerned, I can't share your complaint: using an up- to-date template generated by somebody else, it was very easy to adjust it to my needs to get a decent looking resume in no time.

(La)TeX can be quite a hassle for some (mostly complex) issues. But especially for easy tasks, it beats Word and alike easily IMO.

</comment></comment><comment><USER4> On the one hand, using a modern TeX like ConText can be maddening. On the other hand, there really isn't an open equivalent for dumping out high- resolution arbitrarily complex reports that I'm aware of; all the Jasper reports-inspired reporting systems absolutely suck in terms of printed quality.

Getting HTML to high-quality print status is easier than it used to be, but frankly, it just wasn't designed with printed reports in mind.

The SE comments note that while your colleagues may be impressed with the niceness of your reports, they will be annoyed when they need to edit them: this is my experience as well.

</comment><comment><USER5> Some people use LaTeX on multi-institution research proposals.

The usual competing tool for this is Word. But coordination of multiple contributions in Word docs can be a hassle, even with the tracking features of Word.

But you can use LaTeX and a good VCS to track and merge changes. Kind of slick. Works best with academic or quasi-academic collaborators, of course.

Most of the automation-type applications mentioned in the thread probably could also use HTML+CSS, which is what I prefer for this stuff now.

I don't know anyone who has used HTML+CSS in a research proposal.

<comment><USER6> For HTML/CSS, PrinceXML produces beautiful results, but it is not free.

<http://www.princexml.com/samples/>

</comment></comment><comment><USER7> When I worked on Wall Street about 10 years ago, somebody tried to used it to make a daily report and got slapped by the IT dept. for using "unsupportable" software. There weren't as many freshly minted PhDs floating around then. Maybe the attitude would be different. The report looked great.

<comment><USER8> Early on at Amazon, the forms you got with your order was generated with TeX ( LaTeX? )

It was probably installed by ( <http://en.wikipedia.org/wiki/Paul_Davis_%28programmer%29> ), but he was gone by that point.

The system was running on a couple of the Sparcstations and at that time (97) the zon was switching to Alpha.

I remember looking at that the build system and thought that it was "unsupportable" by myself or any other systems admin there at that time.

Recently, I've wrote some docs in LaTeX and was told to convert it to Word/Confluence.

</comment></comment><comment><USER9> We split our time between consultancy and our startup projects. The consultancy side produces a lot of documents (specs, quotes, reports, etc.) Sometimes we write these collaboratively with the customer. Then we use Word. When we write them on our own we use Latex. We use XeLatex for pretty fonts and the very flexible memoir class. We have a standard template all our docs use. Latex is so much more productive than Word, due to abstraction, easy VCS integration, and living in our text editors.

</comment><comment><USER10> Can somebody tell me what the primary use of TeX is and what the standard alternative is? I can't believe that it's Word, as I'm pretty sure Word is for something else (e.g. intra-office docs).

<comment><USER11> For serious publishing, the usual workflow is that authoring and editing happens in Word, and once the editing is finished the text is imported into software such as Indesign for typesetting.

With Tex-based publishing workflows, authoring and editing is typically done using Latex (in tandem with a Latex-aware text editor, and typesetting phase is carried out with a Tex-based form as well.

An alternative workflow used by several Context-based publishers (Context is an alternative format for Tex, now tied to Luatex) is to use one of several XML-based authoring software and turn the XML document into Context for typesetting.

</comment></comment><comment><USER12> Knew a couple people attempting to use it for an 8k self filing solution. Uploaded word docs get transformed and typeset behind the scenes then output to the SEC's version of HTML for filing.

</comment><comment><USER13> I'd imagine Tex/LaTex would provide great productivity boosts for K-12 and university-level textbooks, assuming publishers (and authors?) actually knew how to use it..

</comment><comment><USER14> From the stackexchange thread: """Probably not before you are hired but you can impress with your good looking reports, presentations etc. after you're hired."""

I don't think so. The stock standard LaTeX templates are not that good looking compared to the kind of reports presentations etc a competent guy versatile in graphic design (not necessarily a graphic designer) can achieve -- perhaps even using some ready made presentation/report template bundled with his office suite or third-party.

Slightly better typography is the main advantage, but people would fell asleep reading a LaTeX template report or presentation. Lack of color, imagery, drab looking charts and diagrams etc --unless you really dive full in and peruse all of LaTeX. And it's not like anyone sweats over typography details when reading a bloody report.

<comment><USER11> I think the commenter was thinking of Beamer, which does have some attractive layout in its standard suite.

Beautifying Latex and Beamer is really not that difficult. An issue, though, is that the techniques to do so are different to those used in standard graphic design.

<comment><USER14> If we're to judge from this:

<http://www.hartwork.org/beamer-theme-matrix/>

I wouldn't say that Beamer presentation themes are any better --actually worse--, than what's included with Pages/Powerpoint.</comment></comment></comment>


Russian photographer matches random people with social network photos - <AUTHOR> http://rbth.com/science_and_tech/2016/04/12/russian-photographer-matches-random-people-with-social-network-photos_584153 <comment><USER2> The first thing that struck me (After I got over the whole, creepy/horror/revulsion thing) was how much more fun people seemed in their social media lives.

Rather than seeing this as an exposition of "people on social media are so much more bland than they appear" I found myself feeling "people on the subway are so much more beautiful and interesting in their 'real life'"

I feel like that might be backwards from how it gets presented elsewhere.

But, if you look for example at the blonde woman snarling a piece of cake [https://birdinflight.com/ru/vdohnovenie/fotoproect/06042016-...](https://birdinflight.com/ru/vdohnovenie/fotoproect/06042016-face- big-data.html) (second last) I thought, that was charming and funny... But you'd never know that from under they grey fluorescent lights of the subway car.

It's really interesting to be confronted with the realization that every single person filling up space on the subway around you has a rich and lustrous story that brought them to that place and time.

Still, super creepy.

<comment><USER3> > It's really interesting to be confronted with the realization that every > single person filling up space on the subway around you has a rich and > lustrous story that brought them to that place and time.

The dictionary of obscure sorrows[1] names this feeling "Sonder" _The realization that each random passerby is living a life as vivid and complex as your own—populated with their own ambitions, friends, routines, worries and inherited craziness_

1\. it's a made-up word, not a formal English one. [http://www.dictionaryofobscuresorrows.com/post/23536922667/s...](http://www.dictionaryofobscuresorrows.com/post/23536922667/sonder)

<comment><USER2> Lovely! But quite the opposite of a sorrow, I felt it was a somewhat beautiful realization.

I'm sure if I was having a low day it could take it as a sort of "we're insignificant specks on a floating rock" but I was having a great day so tra- la-la :)

</comment></comment></comment><comment><USER4> I don't see why this can't be done in real time. Point your phone towards a person in a cafe and immediately figure out her name, age, maybe relationship status, social class, augmented reality style.

5 minutes later accidentally bump into her .. and start a conversation, armed with lots of private info about the person.

Or even more basic - thieves picking their targets - is this woman's purse likely to contain a lot of money and jewelry ?

I guess you could even write a tool which picks all the faces from a photo, and detects who's probably richest, most popular, most followed, etc.

But this is unavoidable, right ? We just have to accept it as a fact of life and adapt to it..

<comment><USER5> How long before anti-facial recognition makeup, hair, and accessories becomes fashionable? [https://cvdazzle.com](https://cvdazzle.com)

<comment><USER6> That doesn't seem like it would work at all. The makeup and hair styles suggested would make you stand out even more! Sure, 1990s-style facial recognition won't work as reliably, but surely today's systems would flag you right away!

<comment><USER5> I haven't tested it myself but according to CVdazzle it works. So the next question is how long before facial recognition technology overcomes efforts to confound it. Or how long until legislators get involved.

Yes the looks are ridiculous, but most fashion starts out that way. People often look for ways to stand out and being "retro" could enhance the cool factor.

What does someone care if a mugger's facial recognition software "flags" them? And who exactly is being flagged? And if a security surveillance system flags you what is the consequence? Who does that consequence apply to?

<comment><USER7> >And if a security surveillance system flags you what is the consequence? Who does that consequence apply to?

[http://www.bbc.com/news/technology-35111363](http://www.bbc.com/news/technology-35111363)

> "What you can do now is link your face-recognition system to Facewatch and > it will pull down the watch list that's relevant for your premises and your > group," he says. "Then, if someone walks into your premises, it will send > you an alert."

So if you have a criminal record, or your face somehow ends up in that database, you could find yourself followed around shops and asked (or told) to leave. These sorts of massive watch lists aren't feasible with merely human recognizers.

</comment></comment></comment></comment></comment><comment><USER8> The artist (or the article) suggests that the pictures he took on the metro are the 'real' person, whereas the pictures on the social site are the 'ideal' person.

I'm not so sure. I think its very possible that the person in the social network photographs is actually far closer to the person they really are than the photo of them riding alone on the subway.

<comment><USER9> I thought exactly the same - and the photos chosen for the article don't really back up the point either. The pairs look like the same "person" to me, not one real and one fake.

Anyway I don't know anybody who busts out their truest expression of self to ride the subway.

<comment><USER10> > The pairs look like the same "person" to me, not one real and one fake.

I seem to be alone in this, but... they don't even look like the same person to me. Do we have any confirmation that the pairs show the same person? About 10 million Russian men look like the guys in the second pair of photos.

<comment><USER11> I think they just picked the two most striking examples for that article. Look at the rest here: [https://birdinflight.com/ru/vdohnovenie/fotoproect/06042016-...](https://birdinflight.com/ru/vdohnovenie/fotoproect/06042016-face- big-data.html)

Most of them are clearly the same person.

<comment><USER12> I dunno. Some of them clearly are because you can see they have moles in the same place and stuff like that, but a bunch leave me dubious. For example, that woman with the dyed white hair: the hair looks much frizzier/curlier in one than the other. And some I wonder how the face algorithm could possibly have matched them up - the guy in the parka vs the soldier don't even have the same facial hair, never mind how the parka fuzz obscures most of his head. (And you can't see more than a quarter of the next woman's face!) I wonder how much of this matching was manual.

<comment><USER13> Did it have to match those exact photos? I think he took a photo (or a few), used that (or those) to find the social media account(s). Then he could use whatever photos of that person he wanted to match up with a photo he had teken.

</comment></comment></comment></comment></comment></comment><comment><USER14> I keep trying to figure out why this feels so wrong and creepy. You're in public, you can't avoid some random person from taking your picture. You have a public profile, you post pictures of yourself there, in public. But some how this feels... wrong, why is that?

Something about the surprise of it? It feels like a surprise, it feels like something that shouldn't be so easy.

<comment><USER15> I think it feels wrong because for all of human history a person could take for granted a degree of anonymity while among strangers, and more and more that seems to be no longer the case.

Forever, if someone recognized you, chances are you recognized them. People were either within some extended social circle or they were not, and this social circle was face-to-face. Now, we have something of an arms race going on with respect to anonymity, or the lack thereof. Maybe someone will scan me and identify me. What's my recourse? Either I go about in disguise, or I scan everyone around me in order to equalize things.

How could all this not feel strange or wrong? Based on the norms of 10,000 years of human society, it's either a-social or downright anti-social.

<comment><USER16> > I think it feels wrong because for all of human history a person could take > for granted a degree of anonymity

I think for most of human history, humans knew the majority of the other humans within travelling distance and people were wary of strangers because there was no reciprocal trust relationship.

</comment></comment></comment><comment><USER17> FindFace is a very interesting piece of technology. It's legit (the authors, N-Tech.Lab, have successfully competed against google and other strong opponents in MegaFace Benchmark). It's not real-time, but fast enough (0.5-1.0 minute time required to recognize faces and provide their profile links). Their business model is freemium (first 10 or 30 searches per month are free), and they're trying to make it a matching service, you can narrow search by age and relationship status, and then you can like photos of people you find to allow searching for "your type" of partners.

<comment><USER18> their website was pretty unhelpful is there a signup page somewhere i want to try it out

<comment><USER19> Here you go: [http://findface.ru/](http://findface.ru/)

Looks as though it's only available in Russian and only works for VKontakte (the social network).

Warning: It highjacks your back button.

<comment><USER18> thank you

</comment></comment></comment></comment><comment><USER20> This is one of the cool features people have discussed for the past 20 years for wearable computers. I was hoping it would come to fruition with Google glass until Google got all weird about facial recognition on glass (and subsequently glass as a whole).

On one side it is creepy, on the other it would be nice to have your digital assistant suitably remind you the name of the person who is walking towards you and recognizes you but you cannot remember who they are. A quick summary of who they are and perhaps a summary of your last interaction whispered in your ear could be handy. Or even a couple of relevant recent headlines about their company, etc.

Of course creepy side is pointing at random stranger on street and instantly having their digital dossier overlaid on their face.

<comment><USER21> I personally would be pretty disgusted if someone used it on me. If someone doesn't remember my name or their last interaction with me, maybe it's for the best. The last thing I need is people faking nice and friendly after they just scanned me without my consent.

<comment><USER22> But this could be useful for someone with Alzheimers, or maybe a teacher that needs to remember his pupils.

<comment><USER23> Or normal people who, like me, can't connect names to faces without at least several interactions with a person in a short interval of time.

<comment><USER21> So instead of working on your memory or coming up with a mnemonic or just asking their name again (everyone forgets a name), you think it'd be less intrusive to scan someone without their permission?

<comment><USER23> Of course. Why would I need permission to analyze the same image that hits my eyes and to consult a digital database I maintain (or public one I have access to)? Going this way I'd end up rejecting bicycles and notepads because they're not "natural" enough.

Personally, I believe that your tools are extensions of your body.

<comment><USER21> I'm sorry but your social faculties are way out of whack if you think it's a better option to scan someone than to simply ask their name. Do you not understand that I may feel uncomfortable if you've just scanned me and then use that data to try and strike up a conversation? Talk about making me feel like a product or mark. Bicycles and notepads do not actively analyze and reduce people nor do they enable a surveillance state. Don't make such specious extrapolations.

Tools are an extension of your body, yes, but you don't go using your hands to feel up someone because you needed more texture data. You don't stare at someone for a long time because that's rude and intrusive. Same goes for using technology like this.

<comment><USER23> > _Do you not understand that I may feel uncomfortable if you 've just scanned > me and then use that data to try and strike up a conversation? Talk about > making me feel like a product or mark._

Do you feel uncomfortable about the fact that most of your friends don't even know your birthday date or phone number, and have both noted down somewhere (be it a phone or indirectly via profile info of your Facebook account)? Is it weird for you that some may even note down things you like so that they can check them out when looking for a good gift for you? Do you feel "like a product or mark" when a conference badge you wear displays your occupation or interests (sometimes used as an icebreaker)?

(Also, you shifted from just scanning to using the results to "try and strike up a conversation"; those are two different things.)

> _Tools are an extension of your body, yes, but you don 't go using your > hands to feel up someone because you needed more texture data._

By scanning I'm not touching you. That would be a violation, yes. But why should I let you be a master of _my_ eyes, and the (hypothetical, at the moment) tools I use to augment them?

People will get used to it, like they do with everything we've invented since dawn of time. Social conventions will adjust. Just because my eye implant can tell me what's your name doesn't mean I get to stop you on the street and start talking to you, no more than it is an acceptable behaviour today.

<comment><USER21> The difference is that for my friends I have granted them explicit privileges beforehand to have access to that kind of data. It's different when a stranger is scanning me, mining me for data. And actually yes I do feel like a product or mark at conferences when people come up to me and just chat me up because of the company I work for (you've heard of it) - they almost always want quid- pro-quo type interactions or otherwise don't care about _me_ per se, but just the quantification of me that exists on the badge. It's one of the reasons I don't enjoy industry conferences that much or when I do go, I prefer not to wear a badge.

And honestly, scanning from a distance is still incredible invasive.

You can be the "master of your eyes" but don't get offended if I or others think you're a creep. You may not be touching me but you're definitely noticeably staring. The rejection Google Glass actually gives me some faith in the decency of people, but you're probably right, society at large will adjust because the profit motive and law enforcement capabilities for this sort of technology are too great for them not to become entrenched by media and government interests. Personally I find it inhumane and repulsive, but I'm old fashioned like that. I prefer more organic human interactions, nuance, getting to actually know someone beyond a readout on a screen. I'm a private person in an increasingly public circus of society.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> Another corollary of this is that if you take a good image of someone else, you can build a model of it (sometimes automatically), and you can map it on to your face and appear as them digitally. I've built tools like this that even let you do it live in the browser using this library [https://github.com/auduno/clmtrackr/](https://github.com/auduno/clmtrackr/)

</comment><comment><USER25> Reminds me of "Stranger Visions" from Heather Dewey-Hagborg. She created 3D faces by using DNA found in public places: [http://deweyhagborg.com/projects/stranger- visions](http://deweyhagborg.com/projects/stranger-visions)

</comment><comment><USER26> Direct link to the photographer's site: [https://birdinflight.com/ru/vdohnovenie/fotoproect/06042016-...](https://birdinflight.com/ru/vdohnovenie/fotoproect/06042016-face- big-data.html)

</comment><comment><USER27> I've seen this happen in real time with augmented reality googles. It had a bunch of the Facebook profiles in advance though so it was a much smaller search space.

</comment><comment><USER28> I don't believe these claims.

These photos are matched too well, and I suspect he did it manually. Some of the train photos are so bad, there's no way they got automatically recognized.

Not to mention the resources you would need just to get the data on 280 million users, let alone train a neural net on it, and make it work with a 70% success rate.

I think it's a viral way to get app installs. The app reviews are really bad btw, it doesn't work.

<comment><USER29> I agree that this seems very far-fetched. From what I know about facial recognition (admittedly very little) for an algorithm to be able to recognize these profiles in such different conditions as displayed in the article seems very unlikely.

Incidentally, is there anyone who could ELI5 how picture data like this is treated in order to run these algorithms on it?

</comment></comment><comment><USER30> I am not sure this works or that success rates like claimed are possible:

> In 70 percent of cases, he was quite easily able to identify the people he > had photographed.

VKontakte has 280m+ accounts and is the second most popular website in Russia ([https://en.wikipedia.org/wiki/VK_%28social_networking%29);](https://en.wikipedia.org/wiki/VK_%28social_networking%29\);) the Russian population is ~144m. I can't find any decent estimate of how many Russians use VK, but it seems to be at least as dominate in Russia as Facebook in the USA, which is to say, ~71% ([http://www.pewinternet.org/fact- sheets/social-networking-fac...](http://www.pewinternet.org/fact- sheets/social-networking-fact-sheet/)). So from non-VK usage alone, he should be able to identify no more than 70-80 percent since you can't identify those who aren't on VK in the first place.

Facial recognition is a notoriously difficult machine learning task, and doing facial recognition on the VK population of St Petersburg (>249688 * 0.7 = >174781) will be challenging even with extremely good facial recognition. I don't know what this 'FindFace' application is, but I'll be charitable and assume it matches the 2015 state of the art, "Facenet: A unified embedding for face recognition and clustering" [http://arxiv.org/abs/1503.03832](http://arxiv.org/abs/1503.03832) AFAIK, with a best-case binary classification accuracy of 99.63% ([https://en.wikipedia.org/wiki/Accuracy_and_precision#In_bina...](https://en.wikipedia.org/wiki/Accuracy_and_precision#In_binary_classification)):

0.9963 = true positives + true negatives / true positives + true negatives + false negatives + true negatives

If each person = 1 profile photo, then to classify a photo of someone there would be 1 true positive, 174781-1 true negatives, and unknown number of false negatives.

0.9963 = (1 + (174781-1)) / 1 + (174781-1) + x + (174781-1) 0.9963 = 174781 / 349561 + x 0.9963 _349561_ (1/174781) = x 1.9925943 = x

There would be ~2 false negatives for every true positive. So there would be a <1/3 chance the photographed person is not on VK at all, and when one searched for them when they are in fact on VK, they would only show up <1/3 of the time (the other two-thirds their subway photograph would not 'match' when tested in the dataset and it would be a false negative, and it gets much worse if the face detection has one of the lower state of the art accuracies on the other datasets). So on net you would expect to turn up a person <07 * 0.3 = <0.21 of the time. (It gets worse if we take into account the false positives as well but that particular paper doesn't report precision.)

There is no mention of any attempt to validate the findings, so I think for many of his results, he may have merely found a similar-looking person (possibly in some cases, look-alikes [http://www.nytimes.com/2014/08/26/science/looking-at-twin- pe...](http://www.nytimes.com/2014/08/26/science/looking-at-twin-personality- through-look-alikes.html) [https://en.wikipedia.org/wiki/Look- alike](https://en.wikipedia.org/wiki/Look-alike) ). Look-alikes are far from identical twins, so it's not necessarily surprising that

> Often, there was a striking difference between a person's real look and the > image they projected on their social network profile: a shy and grim young > man might appear to be the life and soul of the party and a lover of extreme > sports on his VKontakte page.

This could be due to care in social presentation. Or it could just be that they're not the same person in the first place. (The photos are not that persuasive. I'm sure there's more than one grim young men with widow's peaks in St Petersburg, or young women with curly black hair.)

<comment><USER31> I appreciate your skepticism. And I mean that in the most positive way possible. Seems like most of HN visitors areskeptical about almost everything except extraordinary claims regarding AI prowess.

But really, you're being _way_ too generous. 99.63% accuracy was reported on a relatively constrained dataset[1] when being asked a yes-no question: "are these two faces the same"? In our case, however, we're speaking about a search algorithm that tries to match something in a huge database. The accuracy will be way, way worse.

[http://vis-www.cs.umass.edu/lfw/](http://vis-www.cs.umass.edu/lfw/)

</comment></comment><comment><USER32> Completely missing the point. "Social Media Site" aka, a place where we put (mostly) public imagery. By definition this is curated, and as the prof says is a self-selected view of ourselves.

But, the point being missed is that OF COURSE people don't look the same "in day to day life" because those social media pics are just a moment of one day. If the prof happened to meet the person moments after the social media picture was taken then ... he would have concluded that "people present themselves truly as they are in reality" ...

My point, the point ignored in the article, is that Social Media is a self- reflective, self-curated snapshot. Not a continuous, objective representation.

</comment><comment><USER33> Maybe it's not a popular look over there but I couldn't help but notice there were no photos of guys with a full beard, ball cap and aviator style sunglasses...

</comment><comment><USER34> We are not far off AR-type scenarios where someone in public is overlaid with info about them and their interests. Keen on that girl? It instantly tells you she likes a particular band and movie genre, giving you quick access to small talk cues. Or that she never mentions a boyfriend online.

Or that the guy about to get off the subway earlier thanked his friend for giving him that money he owed him.

</comment><comment><USER35> Minority Report's personal advertising is getting closer and closer: [https://www.youtube.com/watch?v=7bXJ_obaiYQ](https://www.youtube.com/watch?v=7bXJ_obaiYQ)

And they won't even need retinal scanners. Facial recognition will probably be good enough.

</comment><comment><USER36> I found it interesting that with out exception in the photos on the artist's Website the people on the subway are activity using their smart phones and/or have headphones on. The transformation of the human race into cyborgs, of sorts, over the last two decades is uncanny.

</comment><comment><USER37> So, you can no longer assume being anonymous when walking down the street. If your random photo is matched with your profile, you can be basically fully identified anywhere. With all those cameras everywhere, you could be fully tracked.

<comment><USER38> Given that there are public images with your face in them and name connected to them, that can be searched by a neural net... Yes.

<comment><USER39> No need for the images to be public. A police state could match images taken by street CCTV to e.g. the drivers license database and track the citizenry in real time.

You could easily reduce the search space to match a face taken by a CCTV camera by using cell phone location data to limit it to people in the general area...

<comment><USER38> A police state has always been able to do this. Of course it gets easier by automatic face recognition and the possibility of sharing databases over long distances etc.

The difference from before I guess, is that it's less in your face, and can thereby happen without people noticing as easily.

<comment><USER40> >A police state has always been able to do this.

Not for everybody all the time, though...

</comment></comment></comment></comment></comment><comment><USER41> I have registered [http://wikiface.org/](http://wikiface.org/) some time ago to create an open facial recognition database as a proof of concept project.

</comment><comment><USER42> It's interesting how almost everyone he photographed completely ignored him by either closing their eyes, diving into their cellphone or just pretending to be interested in something else

</comment><comment><USER43> And friends bash me for always using a caricature avatar of myself on my social media accounts! I'll have to run it, and see if it matches a photo. It's a greyscale line drawing sketch.

</comment><comment><USER44> This is very much a study of bad vs good lighting.

</comment><comment><USER45> If this becomes more common then dating websites, like Badoo are doomed :)

</comment><comment><USER46> If drones have Facial recognition software they'll become ultimate killing machines;

</comment><comment><USER47> And this is exactly why, 11 years ago, I set up Famipix (www.famipix.com).

<comment><USER48> Link is to a "private photo sharing" website.

I'm curious naskwo, it says in the tour "We don't synchronise any content to any external sites or social networks." \- this implies you don't have off- site backups?

Second, for the birthdays calendar do you do anything like attempting to recognise photos of birthdays and log them, or use image meta-data to do the same?</comment></comment>


Building a simple static site generator in 100 lines - <AUTHOR> https://smalldata.tech/blog/2018/08/16/building-a-simple-static-site-generator-using-node-js <comment><USER2> Out of interest, in the first nodejs code sample why are you including Bluebird to just call main()? It seems redundant, wouldn't 'main()' in the outer scope have the same effect?

Interesting read through. The core of a static generator is not complex, but adding all the extras that people want and making it more general is where the problems lie.

<comment><USER3> > Out of interest, in the first nodejs code sample why are you including > Bluebird to just call main()? It seems redundant, wouldn't 'main()' in the > outer scope have the same effect?

As well as that, making everything async feels like it's a very premature optimization. It's only a static site generator for feck's sake.

<comment><AUTHOR> I find using async await leads to a lot more simpler and understandable code. Moreover, one can stick to the try ... catch semantics.

It's also a fewer lines than promises and the then calls with the anon functions.

<comment><USER3> > I find using async await leads to a lot more simpler and understandable > code. Moreover, one can stick to the try ... catch semantics.

> It's also a fewer lines than promises and the then calls with the anon > functions.

Promises + call with anon functions is still asynchronous code. I'm wondering why not just use easy-to-reason-about, easy-to-read _synchronous_ code for something like this rather than messing around with async/await.

<comment><AUTHOR> Ah I see now - yes you are right that would be an option since both fs an fs- extra provide sync functions.

Depending upon the number of files, the async approach will be faster (to be benchmarked) but you are correct that for 100 files or less on a modern computer at least there is probably no perceptible difference.

For me personally, I'm just so used to writing it this way, I didn't even think that it could complicate the tutorial - thanks for pointing it out!

</comment></comment></comment></comment></comment><comment><USER4> Bluebird maintainer here - not sure why you included it in your example. I've been working with the V8 team and they've been making a ton of progress making native promises fast.

Bluebird has more of an API appeal as well as performance in older apps/servers.

Also, if you're bring it - you can `Promise.try(() =>` and don't forget to add a:

``` process.on('unhandledRejection', e => { throw e; }); ```

<comment><AUTHOR> Aha, thanks for the info - I've been using bluebird for so long it's pretty much reflex at this point. I'll edit it out to simply use native promises :)</comment></comment>


Blink-dev – Intent to Ship: SharedArrayBuffer - <AUTHOR> https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/dnzvgTswfbc/AFIUge2oDQAJ <comment><USER2> If Chrome is going to ship SharedArrayBuffer, then why will the resolution of performance.now() and other timer APIs continue to be neutered? I don't have any preference one way or the other for implementing SharedArrayBuffer, but I am fully against neutering timers with jitter if a vendor does choose to implement SharedArrayBuffer. Random additional timer jitter becomes a false layer of security in this scenario, and [https://bugs.chromium.org/p/chromium/issues/detail?id=506723](https://bugs.chromium.org/p/chromium/issues/detail?id=506723) should be reverted.

With SharedArrayBuffer you can easily implement extremely high resolution sub- nanosecond timers and open the door to new timing attacks. For example, here is a high resolution SharedArrayBuffer timer: [https://codepen.io/yossioren/pen/LVBNMR](https://codepen.io/yossioren/pen/LVBNMR)

For more discussion regarding the security implications of this change, see [https://github.com/tc39/ecmascript_sharedmem/issues/1](https://github.com/tc39/ecmascript_sharedmem/issues/1) . Some of the security problems may be mitigable with Intel CAT, although I am not aware of Chrome making use of that yet.

<comment><USER3> Is there any layman's introduction to this subject? I can't comprehend how having an accurate timer lets me steal information from other processes.

<comment><USER2> The papers "The Spy in the Sandbox -- Practical Cache Attacks in Javascript" at [https://arxiv.org/pdf/1502.07373.pdf](https://arxiv.org/pdf/1502.07373.pdf) and "ASLR on the Line: Practical Cache Attacks on the MMU" at [http://www.cs.vu.nl//~herbertb/download/papers/anc_ndss17.pd...](http://www.cs.vu.nl//~herbertb/download/papers/anc_ndss17.pdf) are good starting points, though they are not very accessible to a layman.

There have even been timing attacks that let you recover AES keys from analyzing a device's power usage.

In layman's terms: computers are extremely complicated beasts of coordinated timing of software and hardware, and timing data leaks many things about what a piece of software is doing. This is the reason that many modern encryption libraries pad operations as a defense against timing attacks.

<comment><USER3> Thanks. I had actually started reading The Spy in the Sandbox but it was too hardcore for me.

So, how does this work? I set a timer, and then read the time a bit later, and somehow I recovered an AES key from a different process? I'm still missing a piece :-)

Notably, how can timing data _leak_ things?

I mean, I can see how I can do

        1. Start hi-res timer
        2. Kick off something that involves out-of-sandbox data
        3. Stop hi-res timer

and do this often enough and with well-tuned input to read useful data out. Is that how it works?

But how can I use this to read stuff in entirely different processes? Moreover, how can I do that in a targeted manner? Eg I suspect my target is using internet banking but I don't know which other programs are running, how many cores the machine has, etc etc etc.

<comment><USER4> > Notably, how can timing data leak things?

That part's simple. Naive crypto code will often vary in speed based on the data. A 0 bit in the key causes some behavior, a 1 bit causes some slightly different behavior, and suddenly if you can measure the length of each step you can recover the secrets.

Getting the timing data is a little bit trickier from javascript, but it's also simple in concept. As sensitive code runs, it affects the CPU cache. Javascript can use memory locations that go in the same cache slots as sensitive code. This goes a few nanoseconds faster or slower based on what parts of the sensitive code have finished. Now you have timing data.

If you don't know what else is running or if you're on the same core, you just have to try repeatedly.

</comment></comment></comment></comment></comment><comment><USER5> I am not sure I like some of the new changes. It seems to me like JS is expanding both towards an _upper level_ language and a _lower level_ language, which frankly makes it look more like a Frankenlanguage. I guess it's the limitations of having a single real language to be used in the browsers.

Edit: just check this tutorial. I'd venture to guess to 99% of JS developers it sounds totally bizarre: [https://github.com/tc39/ecmascript_sharedmem/blob/master/TUT...](https://github.com/tc39/ecmascript_sharedmem/blob/master/TUTORIAL.md)

<comment><USER6> But that is exactly what is needed. JavaScript is essentially a becoming a ~native~ language (like C, C++, Java) which is used to implement all kinds of abstractions.

Think of C++ for example. It's used to implement frameworks like JUCE, used for high-level application logic and UIs, but underneath that there are a lot of optimised abstractions. Some of these abstractions can only be so good or so deep until the language they are implemented in can get closer to the "metal" (or in this instance, VM).

I for one welcome these new additions to the ECMAscript spec.

<comment><USER7> > ... ~native~ language (like C, C++, Java)

One of those is not like the others.

<comment><USER8> Surprisingly enough, Java is a native language in some parts of the embeded world (see smart cards for instance, but not only [1]).

[1]: [https://en.m.wikipedia.org/wiki/Java_processor](https://en.m.wikipedia.org/wiki/Java_processor)

<comment><USER9> Also Android.

</comment></comment></comment></comment></comment><comment><USER10> This is great. It opens up a lot of possibilities for our online 3D editor - background worker threads that each work on a segment of an array.

Now if only Node.JS could support worker threads at all.

<comment><USER11> In NW.js you can use Node.js in Web Worker: [https://nwjs.io/blog/v0.18.4/](https://nwjs.io/blog/v0.18.4/) . HTH.

<comment><USER12> why is it available in NW.js but not Node?

<comment><USER11> I think Node community is working on it. In NW the implementation of webworker from browser can be leveraged.

</comment></comment></comment></comment><comment><USER13> The main benefit here will be realized in Shared Workers. Unfortunately Edge support is "not planned" and WebKit support is "removed" [http://caniuse.com/#feat=sharedworkers](http://caniuse.com/#feat=sharedworkers)

I guess it may come in handy for Electron apps.

<comment><USER14> You don't need Shared Workers to benefit from this. I haven't ever actually _used_ Shared Workers, but as I understand it the normal sort of case for them could be polyfilled without too much difficulty.

Using Web Workers instead of Shared Workers just means that any actual communication beyond the shared memory must be posted via the instantiator of the worker.

<comment><USER15> You're right about Shared Workers not being needed for this, but just to continue going off on a tangent...

I think a polyfill would be pretty difficult. First you have to make sure only one tab starts a Web Worker. Maybe that's not impossible, but it's tricky. And then the real difficulty... when the tab that spawned the Web Worker closes while another tab is open, you'd need to spawn another Web Worker in that tab and copy the state of the first Web Worker to the second Web Worker before the first one is destroyed by the browser. Not sure if that's possible.

<comment><USER16> You can use broadcastchannel to coordinate multiple tabs and workers. And I think once you receive a message from such a channel you get a proxy for the sender, which means you can establish a 1-1 channel, which in turn means you can can transfer objects like sharedarraybuffer.

</comment></comment></comment></comment><comment><USER17> I've just stumpled once again on atob/btoa not working with characters like or 𝒞 and here I read about SharedArrayBuffers, which is way a greater goal. Of course they're right to work on such projects, go for it, but I can't avoid to be baffled by the fact that (apparently) more mundane operations don't receive love.

Other examples would be MD5 removed from subtlecrypto, killing any way to speak with services that use it for non-cryptographic operations, or the missing functions to encode/decode hex strings, which maybe are not everyday use cases but are provided by most languages and would need an afternoon to write with tests.

I want a better standard library. Just my discouraged 5 cents.

<comment><USER18> I'm just curious since I never used this feature, are you talking about this issue?

> The "Unicode Problem"

> Since DOMStrings are 16-bit-encoded strings, in most browsers calling > window.btoa on a Unicode string will cause a Character Out Of Range > exception if a character exceeds the range of a 8-bit ASCII-encoded > character. There are two possible methods to solve this problem:

[https://developer.mozilla.org/en/docs/Web/API/WindowBase64/B...](https://developer.mozilla.org/en/docs/Web/API/WindowBase64/Base64_encoding_and_decoding#The_.22Unicode_Problem.22)

<comment><USER17> Yes, that one

</comment></comment></comment><comment><USER19> > Gives JavaScript access to shared memory, atomics, and futex.

Holy fuck, this is going to be _bad_ , introducing a whole continent of new bugs into JavaScript land. And also giving JS even more and even better options to spy and attack other applications on the same computer.

<comment><USER20> Yes, it introduces a whole new range of multithreading issues also to JS land.

However I think threading issues won't be as common as in C++/Java/C# land, since the only thing that will be shared between threads/workers is byte arrays -> There's no shared access to other Javascript objects. As most normal JS developers won't be dealing with plain byte arrays the potential for misuse is not too high.

</comment></comment><comment><USER21> SharedArrayBuffer and Atomics is already in Chrome, unluckily behind the flag.

</comment><comment><USER22> This is GREAT! Transferable's didn't make sense in a few situations.</comment>


Samsung Blu-ray players bricked because of an XML config file - <AUTHOR> https://www.theregister.com/2020/07/18/samsung_bluray_mass_dieoff_explained/ <comment><USER2> _One thing you have to understand is that these internet-connected Blu-ray players in question are programmed to log their activities and send copies of this information to Samsung._

In some ways, this is even more disturbing than the bricking.

Only corporate greed can create a media player that watches you and needs constant firmware updates.

I have a VCR and DVD player which still work, and things like this are the reason I'm not buying any newer standalone players.

It reminds me of this old meme (I'm not aware of a Blu-ray version): [https://files-cdn.sharenator.com/pirate- dvds-s800x825-43988....](https://files-cdn.sharenator.com/pirate- dvds-s800x825-43988.jpg)

<comment><USER3> It's worse than you think - it's not just your DVD player that's spying on you, but your TV is too -- many TV's use Automated Content Recognition to detect what you're watching regardless of source (DVD, over the air, streaming app, etc). They even detect commercials, and which language you're listening to.

[https://www.adexchanger.com/ad-exchange-news/the- marketers-g...](https://www.adexchanger.com/ad-exchange-news/the-marketers- guide-to-acr-tech-in-smart-tvs/)

<comment><USER4> How do you think manufactures can afford to sell these large screens at such cheap prices. They continue to make money off of you long after the initial sale. I'm surprised they just don't give them away (except it would probably raise too many questions).

Your digital cable boxes have been doing this for even longer.

<comment><USER5> They aren't getting much back from selling the data. Maybe $20 off.

<comment><USER4> And that is based on what data? BigCorps tend to not continue doing something if it's not going to bring them much return.

<comment><USER6> Somewhat tangential, but Facebook's average revenue per user was less than $9 in 2019. I can't imagine TV manufacturers can eek out nearly that much revenue from the data they collect. Especially considering that almost everyone is streaming or using cable and all of that data is going to Hulu/Netflix/Cable providers and then passed on to advertisers anyway.

<comment><USER4> FB has 1.5B+ daily users. $9 * 1.5B = A LOT OF CASH. Is that per month, per year? Plus Insta, plus WhatsApp

TV Manufactures may not sell 1B units (maybe they do), but it's still a large enough number that it will not be unnoticed in a balance sheet

<comment><USER7> In the case of Samsung and smart TVs, and to fully support the argument you are supporting, it is not sufficient that Samsung makes a lot of money. They need to make a lot more per user selling data than they would adding $20 to the price of that TV.

But that $20 price difference would probably mean that less people buy Samsung, so the maths isn't going to be that straightforward.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> That's why: " _What_ does a factory reset entail?" is a fascinating question.

Everyone assumes you'll lose your settings during a factory reset, but what isn't as clear cut: Does it revert the firmware to whatever it was shipped with (bugs and all)? Some vendors do, but most vendors do not.

A legitimate factory reset (inc. firmware) mechanism or USB boot/reflash would have likely saved Samsung considerable amounts of money here (relative to mailing all of them two ways, they could have e.g. sent out free USB keys with the firmware).

<comment><USER9> > Does it revert the firmware to whatever it was shipped with (bugs and all)? > Some vendors do, but most vendors do not.

I think that's the only reasonable thing to do. Have the original firmware either as an actual rom, or only writable with an enable jumper flipped; use a power on key sequence to boot from the original firmware, copy to normal firmware and reboot into normal firmware (which is now the original firmware). Run through that process during manufacturing to confirm it works.

Regularly test that all released firmware images, especially those in the original firmware slot can successfully upgrade (or at least not crash). Preferably include current firmware version in all requests so you can give workaround responses as needed when you figure out you broke something -- in the hostname is ideal, as you can use that to work around version specific certificate issues.

The reason a Blu-Ray player (or a video game console) might not let you go back to original firmware is to prevent reverting to earlier firmwares that allowed copied media, etc. For those, you probably want to have a 'safe' firmware slot (or two, ideally) that drives the factory reset process, and only reflash those slots on some updates (to reduce testing needs)

<comment><USER10> >I think that's the only reasonable thing to do.

But that'd also mean you need double the flash capacity, which drives up the BOM cost.

<comment><USER11> Not necessarily. I worked on the team the managed the OS for an embedded hardware project (radio equipment) and our disk was partitioned four ways:

1\. current operating system

2\. previous operating system (and next, on upgrade)

3\. data partition, shared across both current and previous OS

4\. factory reset partition

That means if we needed to do a factory reset we could just load the firmware archive from the fourth partition onto the second partition and execute a normal upgrade, albeit to an older version. Since upgrade packages were small, maybe 500MB?, we could easily cut a little space from the rest of the partitions to make it fit without having to increase the flash capacity.

<comment><USER12> Yeah, but this is 2020... the blu-ray drive needs a copy of React with node_modules sized at 26Gb :P

</comment></comment></comment></comment></comment><comment><USER13> I think the best approach is to never, ever connect a device like a TV, Blu- ray player, etc to the internet. That's the only way they'll survive. So far no HDMI-based attacks.

Hotglue the ethernet port?

<comment><USER14> At least TVs on the (originally) European DVB broadcast system can pick up firmware from broadcasts.

Packets in the transport stream include the necessary firmware.

<comment><USER15> This is still used for set-top boxes, at least in Belgium. It happens in the background now, but up until a few years ago when you first got one you'd only see the firmware downloader for an hour or two, with this block diagram where you could follow along: [https://i.imgur.com/hh7eWZr.jpg](https://i.imgur.com/hh7eWZr.jpg)

The worst part about that was if your signal quality wasn't great. You'd see blocks fail, and it'd take ages for them to come up again.

The boxes now ship with usable firmware preloaded, and will update in the background in the first few days usually.

<comment><USER12> That is the most LCAR upgrade screen I have ever seen...

<comment><USER16> that can't be an accident surely; i want it.

</comment></comment></comment></comment></comment><comment><USER17> You broke it, you bought it Samsung. Full refund. Pick up the device at your expense or provide disposal costs as well.

Warranty is not any part of the issue if you come into my house and break a thing I own and is my property.

<comment><USER18> What makes you think that what they broke is your property?

Read the EULA. It almost certainly specifies that what you think you own, has in fact just been licensed to you.

<comment><USER17> No. This is actually nonsense.

Nobody has read the Eula. Nobody has knowingly and willingly agreed to those terms (if they exist). No vendor has expected those terms to be read (if they even exist). No vendor has explained those terms to a customer.

There is a contract for exchange of ownership. You can't actually break that contract with unconscinable means such as fine print that nobody reads nor is expected to read nor has had explained.

Read a EULA if you like but it will do absolutely nothing for you nor will it alter the law and the application of the law. Maybe you'll enjoy the read though?

It is an item, purchased in a shop in exchange for money. There's rather a lot of established law about that.

<comment><USER18> > You can't actually break that contract with unconscinable means such as fine > print that nobody reads nor is expected to read nor has had explained.

You _shouldn 't_ be able to, but I think in most jurisdictions you most certainly can.

[https://en.wikipedia.org/wiki/End- user_license_agreement#Enf...](https://en.wikipedia.org/wiki/End- user_license_agreement#Enforceability_of_EULAs_in_the_United_States)

</comment></comment></comment></comment><comment><USER19> These things can get really tricky.

We once almost bricked our devices (electronic magnifier/OCR for low vision people) with an update that added automatic calibration for the cheap crappy OEM touchscreen we used in some devices. It was so crappy all the screens we had in our company had the same serial numbers and returned different coordinates when you clicked in the same spot :)

Fortunately libev has calibration - you can provide a matrix to transform all touchscreen events with. We added calibration step - the software asked user to touch 4 corners on the screen, calculates inverse matrix and saves it to configuration for better touchscreen accuracy. We tested it extensively, and uploaded the version to our update server.

The next day customers started calling :) turns out libev (which reads the configuration during booting) had a "feature" that parsed the numbers in the configuration using the default system locale.

German locale uses . as thousands separator and , as fraction separator.

So, when you did the calibration and restarted the device with German locale your screen transformed the touschscreen events multiplying them by thousands - so you couldn't click on anything, so you couldn't use the device or click "update software".

It was even worse if you used german locale, saved the calibration configuration and then changed locale to English - then it simply crashed during boot because of wrong number format :)

Fortunately we left one usb port accessible so users could attach usb mouse and click "update" if they had the first situation, or download the whole firmware on an usb pendrive and update from it.

BTW the libev bug is fixed, now it always reads the configuration using C locale. Guess what happened when we updated the linux on our systems half a year later and that change was included :)

</comment><comment><USER20> Programming errors happen, but thats why I don't get, that companies still use programming languages, where such errors result in a crash vs. an error which can be handled and recovered from. A faulty XML file shouldn't render the whole machine unusable.

<comment><USER21> What language makes it impossible to write if parse(config) == false then reboot?

<comment><USER20> Impossible is a big word :). But while a C or C++ program tends to crash in the presence of an error, like with a segfault, a lot of languages just throw an error which you can catch. So you could proceed with the default values, if the file cannot be read correctly.

<comment><USER22> "can catch" doesn't give you anything, unless you actually do the catching.

C and C++ programs tend to crash in the presence of an error, but so do rust programs (panic), C# and java and js and python programs (unhandled exception). Some languages make it harder to footgun yourself for certain types of errors, but never all types of errors.

I have seen js programs (and similar stuff in other languages) crash because of something like

        JSON.parse(response).list[0].string.length

where the response was valid json, just the .list property was an empty array (or even undefined because omitted in the json).

Does rust protect from such mistakes (because I know some people on here like to claim rust is the answer to everything)? Verbatim from their docs:

        let v = vec![0, 2, 4, 6];
        println!("{}", v[6]); // it will panic!

I'd guess it's exactly such type of bounds error at play with the Saumsung thing, from the mention of that empty <list/> element in the article.

I have written such code myself because I was lazy or distracted or "need performance" or "this can never be empty per spec" or "oops, my range calculation was off by one", tho luckily I didn't outright brick anything, yet.

<comment><USER23> There is one difference in Rust: they are so confident of their memory model, panic!() only kills the current thread. The exception is if it happens in the main thread it kills everything.

In Samsung's case, if they put the parsing of the telemetry config xml file in a separate thread the default Rust behaviour is not to kill the entire thing. Sending the telemetry back to servers sounds like something you would do in a separate thread, so perhaps it would have saved them.

Other languages with similarity strong memory models like Java / Python / Haskell could do the same thing of course. And in those languages programmer could just emulate it in any case. C / C++ with their weak memory models could not sanely do it. A programmer could emulate it in those languages by using separate processes if the OS supported it, but they would have to forgo shared memory.

Not a huge difference perhaps - but Rust's strong memory model does buy you something.

</comment></comment></comment></comment></comment><comment><USER24> Yet another reason for the warning _don 't connect your 'smart' TV, DVD player, or any other entertainment device to your wifi router._ If you need Netflix, use a standalone device such as a Roku and connect it to the TV with HDMI.

<comment><USER25> smart my arse. it's as smart as the guy who designed/programmed it.

</comment></comment><comment><USER26> Our Samsung home theatre sound system's bluray stopped working years ago, everything else works fine.

We have a few Samsung products and each one has a particularly annoying problem.

The worst part is the support, I post a polite request on their website and always get a very concise unhelpful answer.

I no longer buy Samsung products.

</comment><comment><USER27> Are these running Tizen?

<comment><USER13> Probably. Samsung hired thousands of c++ developers in a particular low-cost country to build Tizen. You can't really hire that many quality developers that quickly, and it showed.

<comment><USER28> Tizen is not a bad system by itself. For example, all Samsung watches run it, and they're the best wearables after iwatch.

<comment><USER13> It kinda is shitty, though. Do remember that it was built as a replacement for Android on smartphones, then when that, in a 100% expected way completely failed, was was relegated to the TV and smartwatch platforms where general requirements are perhaps 5x less.

Those two platforms probably only use the best 20-30% core functionality of what was built. And they're still second tier...

</comment></comment></comment></comment><comment><USER29> I was wondering what had happened to my blu-ray player; thanks for posting this!

</comment><comment><USER30> This is one of the many reasons hardware companies stop supporting older tech. It's just not in their interests to push updates down to them, and can seriously back fire</comment>


COM vs SOM: The Component Object Model and Some Other Model (1999) - <AUTHOR> https://web.archive.org/web/19990127184653/http://www.develop.com/dbox/COM_vs_SOM_Summ.htm <comment><USER2> COM is pretty much alive on the Windows world.

After winning the war against the Longhorn team, the Windows team picked up their .NET ideas and reimplemented them in COM.

So since Windows Vista the large majority of new Windows APIs got implemented as COM.

With the Windows 8 release, an improved COM was released as WinRT, which basically picked up on the ideas of COM Runtime before it got redone as CLR.

After that we got UAP with 8.1 release, as the phone, tablet and desktop APIs got a bit closer.

Then with Windows 10, we UWP as the whole set of APIs (IoT, phone, tablet, desktop and XBox) got the same common base.

Every single Windows 10 release has been closing the distance between legacy Win32 and modern UWP, bringing the models together and merging the sandbox models (old style Win32 and UWP).

At BUILD 2019, Microsoft also announced that they will be rewriting React Native for Windows on top of UWP.

Meanwhile C++/CX was deprecated, and thanks to the work lead by Kenny Kerr, it got replaced by C++/WinRT, a C++17 compliant framework for doing UWP programming on Windows (aka Modern COM).

BUILD 2019: "Meet C++/WinRT 2.0: Faster and smarter in the open"

[https://www.youtube.com/watch?v=X41j_gzSwOY](https://www.youtube.com/watch?v=X41j_gzSwOY)

</comment><comment><USER3> If you're looking for a gentle and free introduction to COM and a few other component and object models, you could do worse than my thesis from 2009 (licensed under a Creative Commons license):

[http://www.polberger.se/components/read/](http://www.polberger.se/components/read/)

When Ericsson's cell phone business split into Ericsson Mobile Platforms (EMP) and Sony Ericsson (SEMC) back in 2001, they created an object model named Ericsson Component Model (ECM/OPA), which was heavily inspired by COM. The intent was to create an API separating the lower-level Ericsson software from the user-facing software developed by Sony Ericsson.

Sony Ericsson then expanded upon ECM, calling it ECM Extended (or ECMX, though the technology was universally known as "IDL" internally). ECMX was supposed to enable their aging software stack to be modularized by providing an object model for code written in C.

For the future, though, they wanted to switch to writing application code in Java. Back in these feature phone days, Java games were written to Sun Microsystems's MIDlet specification. Sony Ericsson expanded upon that specification and created the SEMClet specification for their internally- developed applications. By writing software in Java and not C, Sony Ericsson not only wanted to use a modern, garbage-collected language, they also wanted to break free of their monolith. All native code was linked together statically as this monolith, and this process could take hours. MIDlets and by extension SEMClets could be installed dynamically, significantly streamlining development.

ECMX was the technology used to enable SEMClets to communicate with native code. If you're familiar with Mozilla and XPCOM, this may all sound very familiar -- and you'd be right.

All this was back in 2005, when I did my thesis work as part of Sony Ericsson's software architecture group. As part of that work, I had to figure out what COM was, what it really meant for COM to be a binary standard (and how that differed from the approach taken by CORBA) and how all that fit together with the Java component model OSGi, .NET assemblies and ECM/ECMX. I felt that I had to have a handle on all that history in order to write my thesis.

None of this is very fashionable today, but I still think that there's a lot we can learn from this era.

</comment><comment><USER4> Reading about COM really takes me back to my VisualBasic (classic) days. I was an inexperienced teenager at the time, and I remember the excitement I'd get when browsing through the different COM controls I could add to my projects, picking some just to see what they did and trying to figure out how to use them (pre-Google and mostly didn't have internet at home at the time). Learning to make my own COM controls and distribute them was highly instructional, if also maddening at times when trying to get the right version of a .DLL registered and installed.

<comment><USER5> I was 11, but I managed to make a HTML page which played Shrek trailer from filesystem on loop (with audio of course) and mount that as wallpaper in Windows 98. Frontpage, IIRC.

</comment></comment><comment><USER6> > _Object enabling technology consisting of an simple yet elegant object model > and a lightweight runtime support system sufficient for implementing > language-independent objects on virtually any platform that supports dynamic > linking._

I don't know about elegant, but circa 2001, I ported some COM objects to Linux, including enough of the surrounding Win32 API's to make it work. I had a fake registry based on text files, with CoCreateClass and all that junk working. The shared libs continued to have a DllMain, and DllCanUnloadnow and so on.

</comment><comment><USER2> One thing from SOM that made me envy was that SOM had metaclasses, just like Smalltalk, so it was possible to do some interesting designs.

COM Type libraries and now UWP metadata aren't really the same.

</comment><comment><AUTHOR> This article comparing SOM and COM was written by Don Box. (first archived in January 1999, but doesn't say when published):

The Component Object Model and Some Other Model: A comparison of technologies revisited yet again:

[https://web.archive.org/web/19990127184653/http://www.develo...](https://web.archive.org/web/19990127184653/http://www.develop.com/dbox/COM_vs_SOM_Summ.htm)

[https://en.wikipedia.org/wiki/Component_Object_Model](https://en.wikipedia.org/wiki/Component_Object_Model)

It was in response to IBM's somewhat misleading article comparing their SOM with Microsoft COM, last updated July 1994:

The System Object Model (SOM) and the Component Object Model (COM): A comparison of technologies summarized

[https://web.archive.org/web/19990117055950/http://www.develo...](https://web.archive.org/web/19990117055950/http://www.developer.ibm.com/library/ref/SOM_vs_COM_Summ.html)

[https://en.wikipedia.org/wiki/IBM_System_Object_Model](https://en.wikipedia.org/wiki/IBM_System_Object_Model)

Don Box wrote an excellent in-depth book about COM: "Essential COM": "Nobody explains COM better than Don Box" -Charlie Kindel, COM Guy, Microsoft Corporation.

[https://en.wikipedia.org/wiki/Don_Box](https://en.wikipedia.org/wiki/Don_Box)

[https://archive.org/details/essentialcom00boxd](https://archive.org/details/essentialcom00boxd)

Unfortunately COM had the most un-googlable name possible (even before there was a Google), so Microsoft renamed it ActiveX.

For more comtext, here are some notes I wrote about Win32, COM, OLE, OLE Controls, and ActiveX in 1996:

[https://donhopkins.com/home/interval/pluggers/win32.html](https://donhopkins.com/home/interval/pluggers/win32.html)

[https://donhopkins.com/home/interval/pluggers/com.html](https://donhopkins.com/home/interval/pluggers/com.html)

[https://donhopkins.com/home/interval/pluggers/ole.html](https://donhopkins.com/home/interval/pluggers/ole.html)

[https://donhopkins.com/home/interval/pluggers/olecontrols.ht...](https://donhopkins.com/home/interval/pluggers/olecontrols.html)

[https://donhopkins.com/home/interval/pluggers/activex.html](https://donhopkins.com/home/interval/pluggers/activex.html)

Here's a synopsis of COM I wrote in response to "Can someone link to a synopsis describing what "COM" is? It's hard to search for. (e.g. microsoft com visual studio)":

[https://news.ycombinator.com/item?id=12975257](https://news.ycombinator.com/item?id=12975257)

Don't get me wrong: I'm not advocating everybody jump on the COM bandwagon! I just think it's interesting and useful to know where it came from, how it evolved, what different layers were built on top of it, and how it compared to the alternatives at the time it was designed. And it's still pretty widely used, and will probably never go away.

It certainly had a lot of problems and limitations, and OLE/ActiveX/DCOM/DirectX/etc took it way too far, then Mozilla XP/COM cloned it and also took it way too far (and then back again: see "decomification" and "decomtamination"), but it really was a pretty elegant and successful solution to the problems it was designed to address at the time.

[https://wiki.mozilla.org/Gecko:DeCOMtamination](https://wiki.mozilla.org/Gecko:DeCOMtamination)

[https://news.ycombinator.com/item?id=12968830](https://news.ycombinator.com/item?id=12968830)

[https://bugzilla.mozilla.org/buglist.cgi?query_format=specif...](https://bugzilla.mozilla.org/buglist.cgi?query_format=specific&order=relevance+desc&bug_status=__all__&product=&content=decomify&comments=0&comments=1)

It's always good to study history to avoid repeating the mistakes of the past!

WebAssembly is going through a similar evolution, and might benefit from some of the lessons of COM and SOM.

<comment><USER7> > Unfortunately COM had the most un-googlable name possible (even before there > was a Google), so Microsoft renamed it ActiveX.

All ActiveX components are COM components, but the opposite is not true.

</comment></comment><comment><USER8> There's also a (deliberately provocative) bit Rob Pike wrote - "There has been much talk about component architectures but only one true success: Unix pipes"

<comment><USER2> COM has been a success on Windows.

Plenty of companies live from selling ready made components to integrate into Windows applications.

How many are making a business from selling UNIX pipes?

<comment><USER9> This is a silly framing, but I'll bite: All Chromium and Gecko browsers are based on Unix pipes (and Windows named pipes) for IPC. Chrome and Firefox together bring in billions of dollars of advertising revenue.

<comment><AUTHOR> Ironically, Firefox is also based on XP/COM (though less and less over time, thanks to deCOMification and deCOMtamination).

<comment><USER9> Right. Note that at the time Gecko was initially developed, it wasn't at all clear that JS would win. Having to support VBScript in addition to JS was a very real possibility. So COM made a certain amount of sense as a way to expose Web APIs to multiple languages simultaneously.

Thankfully, the Web avoided VBScript, and later Dart.

<comment><USER2> Given market share of Chrome, WebAssembly and Flutter, you should hold on to that "thankfully".

Also from BUILD React Native talks regarding React Native vs Electron performance on Windows, I wouldn't be surprised if VSCode eventually moves away from Electron into React Native.

<comment><USER9> > Given market share of Chrome, WebAssembly and Flutter, you should hold on to > that "thankfully".

WebAssembly doesn't need COM because it's integrated into the JS engine and uses the same JS engine bindings.

I don't think anyone, even Googlers, seriously thinks that native Dart is going to make it onto the Web at this point.

<comment><USER2> Chrome never used COM as part of its implementation.

My reply had nothing to do with it.

Naturally from Mozilla's employee point of view it is easier to ignore what I actually meant.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> "First there were VBXs. Then there were OCXs. Then, Microsoft wanted us to call them OLE Custom Controls, but we persisted in calling them OCXs. So they must have figured that we wouldn't accept any control technology that didn't have a name ending in X." -Curt Hagenlocher</comment>


Show me your immutable flux stores - <AUTHOR> https://discuss.reactjs.org/t/show-me-your-immutable-stores/823

<comment><AUTHOR> From the initial post:

Many of my flux stores manage collections and I find myself repeating a lot of boilerplate code for finding / updating / removing objects. In an effort to avoid pulling in something like ampersand-collection, I was hoping to use immutable.js to cut down on some of the duplication but I'm having a hard time wrapping my head around immutability. It actually feels wrong to be using immutable data within the stores since a store's primary job is to mutate data. I must be doing something wrong.

Anyone have some complex stores backed by immutable data structures they could share?</comment>


Pregunte HN:  ¿Adonde encuentran nueva información tecnológica en español? - <AUTHOR>

For the hackers that speak spanish:  Where do you find your technology information?  In English, there's Hacker News, Proggit, Slashdot, etc...<p>Any great sites in spanish? <comment><USER2> Maybe we are in for something here. Having been lectured with the infamous Joyanes' books, I quickly learned to get my info in English the minute I found gopher (way before I knew what an actual gopher looks like).

This bias has made me consider the English language as the fist gatekeeper for computer geeks in Latin America. There are here nice people with lots of potential who cannot read English, this is always going to be a liability for them. Fool you not. No matter how good you think you are, you would be better if you could drink directly from the source. (take that from I guy who has thought himself great one or two times, just to find otherwise the hard way)

In spite of that, I still believe that language shapes our thoughts (there is formal name for this, cannot recall it). We are missing of so much because have to express ourselves in a foreign language, and the community as a whole looses our collective perspective because there is no place to share it.

<flamebait> Said that, I don't think a news agregator would be useful at this stage. The moronic crowds would take over (think moronic as in Slashdot, not as a racial comment). Maybe some arbitrated site a la StackOverflow would do. </flamebait>

<comment><AUTHOR> I really appreciate the input. I'm bilingual. My parents lived as expatriates in Central America for 20 years. I lived down there for the first 14 years of my life. I spend most of my time online in English, but I'm curious to find out what information is out there in Spanish.

I'm about ready to release a beta of a social news application I've been working on. I'm wondering if releasing a site in Spanish would be worth it. There seems to be a lot of competition for the geek news market in English. I don't know if there's enough news to aggregate in Spanish or not. It seems that it might help the programming community if we could create a site dedicated to aggregating the information that's out there.

The troll problem is, I think, separate from the content problem. Hopefully, we can build safeguards into the system to avoid the worst excesses.

<comment><USER2> hang in there, buddy. You are on to something. My 2 cents:

<http://www.noticiaslinux.com/> [http://gruporeforma.mural.com/suplementos/interfase/?plazaco...](http://gruporeforma.mural.com/suplementos/interfase/?plazaconsulta=mural) (this is a local newspaper site, some news might require subscription to read)

</comment></comment></comment><comment><USER3> LaPetiteClaudine sometimes does tech stuff.

There's also microsiervos.com and mangasverdes.org

I haven't found any hardcore stuff like HN, but maybe the microsiervos guys can help if you ask.

<comment><AUTHOR> Thanks a lot

</comment></comment><comment><USER4> Second <http://www.microsiervos.com/>, add Alt1040.com, and thats about it, AFAIK. I wonder if theres a hacker scene somewhere, but i guess it isnt.

<comment><AUTHOR> Thanks. Great info on those sites.</comment></comment>


The Illuminating Geometry of Viruses (2017) - <AUTHOR> https://www.quantamagazine.org/the-illuminating-geometry-of-viruses-20170719/ <comment><USER2> High-brow pop science can be so precious.

> Mathematical insights into how RNA helps viruses pull together their protein > shells could guide future studies of viral behavior and function.

Insights into virus behavior could guide studies of...virus behaviour. A dizzying thesis!</comment>


Facebook and MySpace giving user private data to ad firms - <AUTHOR> http://www.computerworlduk.com/management/online/new-media/news/index.cfm?newsid=20378&utm_source=ycombinator&utm_medium=sb&utm_content=rplant&utm_campaign=sb <comment><USER2> It seems that the WSJ article is talking about http referrer headers. If you happened to click a link from your profile page, then the referrer header points to that page.</comment>


Bridging the Gap Between Electronics and Biology - <AUTHOR> https://spectrum.ieee.org/biomedical/devices/bridging-the-gap-between-electronics-and-biology <comment><USER2> Ha, like Eve's sniffer ring from my Internet of Smells story [http://telegra.ph/Internet-of-Smells-04-26](http://telegra.ph/Internet-of- Smells-04-26)

</comment><comment><USER3> Can someone link to the paper in question, if there is one?

<comment><USER4> Link to NSF announcement, with extra information: [https://www.nsf.gov/news/news_summ.jsp?cntn_id=295968&org=NS...](https://www.nsf.gov/news/news_summ.jsp?cntn_id=295968&org=NSF&from=news)

Here's a paper from one of the professors: [https://www.nature.com/articles/ncomms14030](https://www.nature.com/articles/ncomms14030)</comment></comment>


Super 'superlattices' could enable 'superfast' transistors - <AUTHOR> http://www.newelectronics.co.uk/electronics-news/super-superlattices-could-enable-superfast-transistors/170605/ <comment><USER2> > Such superlattices __are believed to__ hold the prospect of enabling > improved and new classes of electronic and optoelectronic devices, with > applications including 'superfast and ultra-efficient semiconductors' for > transistors.

Not to take a way from the accomplishment by the UCLA team. But I know when I see the good old research funding motivation/validation rethoric. The same phrasings are used, e.g., by the "topological insulator" community. Before that by the Graphene community ("lossless electron transport, super-fast transistor switching") for over a decade now and even earlier, by the quantum dot community ("single electron transistor").

This lead to next to nothing in term of actual consumer devices or improved performance of existing technology.

<comment><USER3> Not shilling for any "revolutionary" ideas. Just look at the history of the transistor, sometimes these developments and implementations take longer than what's convenient from a users perspective. And one could argue the difference now too is work done in the first half of the 20th century was relatively low hanging fruit compared to the limits we're trying to push now. It was a good twenty years between the first patent for the transistor and a demonstrable transistor, and then another seven years on top of that before a commercial implementation.

Ten years is an arbitrary length of time. And these things might lead to nothing, sure. But...

1\. There's a long road between discovery and implementation and no reliable length of time that can always be pointed to say "that's how long it takes".

2\. Road blocks and expense in implementation. Some things are just hard and depend on yet to be discovered or perfected technology to make them viable.

3\. Existing technologies and processes are still sufficient, mature and cost effective. So we'll use those until the new technology can do it better and cheaper. We probably won't be using x86 and current technologies forever.

I like to think of an example I probably got from a Carl Sagan book that deals more with why throwing money at a problem doesn't guarantee results, but it was an argument for funding all science and discovery because we can't predict what discoveries will yield. It went something like: The British empire in 1850 could have spent every penny it had to develop television and it would have failed because it depended on science discoveries yet to be made. It doesn't mean television wasn't viable or that it was impossible. And no one could have predicted that some of the things discovered, which probably seemed inconsequential to the general public and a waste of time and money would help lead to television decades later.

<comment><USER4> Peter Thiel has a strong critique of this where he asserts the opposite: that both governments and science research spending today is too indeterminate.

Governments don't believe in the capacity to make big plans any more, and it's made it impossible for us to achieve big goals in the last 40 years on the scale that we used to (like with the moon landing).

Instead... failures are excused with portfolio theory, hundreds of universities end up doing hundreds of different things, with nobody really understanding the meaning or connection between any of it. Grant funding is based more on politics than on merit, and this slows down science, because few people are simultaneously both good scientists and good politicians.

[https://www.youtube.com/watch?v=iZM_JmZdqCw](https://www.youtube.com/watch?v=iZM_JmZdqCw)

</comment></comment></comment><comment><USER5> Personally, I'm waiting for Lattice 64.

</comment><comment><USER6> By "superlattice" are they referring to van der Waals heterostructures?

<comment><USER2> No. You call the regular configuration of atoms of a particular material like GaAs a lattice.

Now when you start to grow one type of material on top of another in a regular fashion like layers in a sandwich:

10 nm GaAs 5 nm InAs 10 nm GaAs 5 nm InAs

You get what is called a super lattice. It is not an atomistic lattice, but a lattice of material type A and B.

<comment><USER6> Got it, so they've figured out how to deal with lattice constant mismatches?

<comment><USER2> Yes they did. That's why you will mostly see combinations of binary materials like GaAs, InAs, AlAs to form super lattices.

</comment></comment></comment></comment><comment><USER7> So, what's the catch?

</comment><comment><USER8> I really 'like' the title,

<comment><USER9> It's 'super.'

</comment></comment><comment><USER10> Obligatory reference to ice-nine: [https://en.wikipedia.org/wiki/Ice- nine](https://en.wikipedia.org/wiki/Ice-nine)

We're almost there! EDIT: Oh wait, it does exist: [https://en.wikipedia.org/wiki/Ice_IX](https://en.wikipedia.org/wiki/Ice_IX)</comment>


Looking for a Co-Founder(s) - <AUTHOR> After 17 years in Financial Services, I resigned to solve macro problems plaguing the trading workflow. I'm going to work on the foreign exchange market first (5trillion average daily volume).
I'm looking for co-founders. I'd consider myself a below average coder now. I can get stuff done, but most of you hardcore techies would slap me, and rewrite it.
But the business problem is real, and there is significant revenue possibilities in the problem set.
I'm looking for people who love capital markets, love challenging status quo, and want to work on solving FinTech problems (plumbing to trading).
Let me know if you know anyone. <comment><USER2> Do you have any contact info? This is interesting to me, I've worked at a hedge fund before, and I have more than 10 years of professional experience (mostly in startups). I have the coding skills, and I live in Manhattan.

You can email me if you prefer: brenden at diddyinc dot com (that domain is also my personal site, if you want to research me first).

</comment><comment><USER3> not a coder here but if you will need a security architect (focused on cloud security) feel free to drop an email to fabrizio [at] fdicarlo (dot) com

</comment><comment><USER4> Do you have any contact info? We would live to talk. (Contact in email)

[https://Kloudtrader.com](https://Kloudtrader.com)</comment>


CMU's Bar-Joseph gains bio insight w/computers + computer insight from bio - <AUTHOR> http://news.cs.cmu.edu/article.php?a=2927

<comment><AUTHOR> Here's a link to a PDF of the paper referenced in the article:

<http://www.tau.ac.il/~nogaa/PDFS/misbios.pdf></comment>


First Bitcoin investment fund launches - <AUTHOR> http://finance.fortune.cnn.com/2013/09/25/bitcoin-investment-trust/

<comment><USER2> What benefit does a fund investing in bitcoin have over simply exchanging some money into bitcoin?</comment>


YouTuber and Repair Specialist Louis Rossmann Alludes to Apple Lawsuit - <AUTHOR> http://www.gamerevolution.com/features/free-speech-under-attack-youtuber--repair-specialist-louis-rossmann-alludes-to-apple-lawsuit <comment><USER2> The articles and comments indicate that his posting of schematics appears to be the concern, not his ranting about Apple or his repairing of said devices.

As a repair shop owner, this is some serious BS. After watching several hours of videos on YouTube, including some of Louis's, we invested in some industrial equipment that fixes seriously water-damaged iPhones, and I invested some time in learning the whole process.

This week _alone_ , since we got the equipment, I've managed to fully restore 3 iPhones that wouldn't even turn on because they had been dunked in water. These tutorials, along with the equipment and our own knowledge gained from thousands of phones we've repaired, will help us make our customers happy every week.

Apple Store won't even touch water-damaged phones--they just tell you to buy a new one (or sell you an "in-kind replacement.") Now, with this knowledge, we're able to fix 70-80% of the water damaged phones we get in, and usually for about 1/3 the cost of buying a new one.

People keep their lives on their phones and laptops these days, and no matter how much we techies tell them to back their data up, many people don't. If I can rescue a phone or a computer that wouldn't turn on before I repaired it, I can make someone's day hugely brighter. People like Louis who shoot these videos help make this possible.

I really hope we can get these Right to Repair laws passed so people continue to have a choice in where and how their devices get repaired.

</comment><comment><USER3> The article does not confirm Mr. Rossmann is facing legal action by Apple, and despite the word 'alludes' in the headline, the article itself is extremely disingenuous:

"Apple isn't happy about it."

"[I]t's clear that Louis has been threatened by Apple"

"Apple appears to not only want his YouTube channel removed, but his business terminated."

"Apple is successful, free speech will have lost yet another major battle"

None of these statements are supported by either Mr Rossmann or Apple; in the relevant video, Mr Rossmann does not even mention Apple.

This is all idle speculation. Even HN was caught up in the Apple blaming, despite a complete lack of supporting evidence: [https://news.ycombinator.com/item?id=12016253](https://news.ycombinator.com/item?id=12016253)

<comment><USER4> Agreed. I'm all for repairing devices, but this really seems like an attention grab, at least until there is any actual evidence otherwise.

<comment><USER5> Using this as an attention grab doesn't seem to fall in line with Rossmann's character based on his 'philosophy' videos he posts.

<comment><USER6> You think someone would do that? Just lie, on the internet?

</comment></comment></comment></comment><comment><USER7> If you go to the source video, he has updated its title to say "update: I am NOT getting sued".

[https://www.youtube.com/watch?v=F7N254MTA4Q](https://www.youtube.com/watch?v=F7N254MTA4Q)

</comment><comment><USER8> did he break any laws?</comment>