How I sent 300k emails through Github's API in a matter of minutes - <AUTHOR> http://www.badlogicgames.com/wordpress/?p=3176 <comment><AUTHOR> That took my server down i'm afraid. Good day today. Here's a "cached" version.

To all watchers of the libgdx repository: i'm terribly sorry and hope i didn't interfer with your work in any way

This is meant as a cautionary tale about using Github's API on a repository with quite a few watchers (460 in this case).

Earlier this year we migrated our code from Google Code to Github. We didn't have a good migration plan for the 1200 or so issues back then, so we kept them on Google Code. We now have about 1700 issues on the tracker

Today i finally wanted to tackle the issue tracker migration, using a Python script [1] i found on Github. The script requires one to specify a Github user account that owns the repository the issues will get migrated to. I did a dry run on a fork of the main repo using my Github account, fixed up some issues in the script, and validated things to the best of my abilities. Things looked good.

Then i ran it on the main repository. Luckily i was watching our IRC channel. After about 4 minutes, people started to scream. They each received 789 e-mails from Github. Every single issue i migrated, and every single comment of each issue triggered an e-mail notification to all watchers of the main repository.

This wasn't apparent to me during the dry runs, as i used my own Github account. The script posts all issues/comments with the user account i supplied, so naturally, i did not get any notification mails.

I stopped the script after 130 issues (4 minutes), and immediately started sending out apologies and a mail to Github support, to which i haven't received an answer yet. I send roughly 300k mails through their servers in a matter of minutes. If i hadn't watched IRC, i'd have send out about 4 million mails to 460 people within an hour.

Let me assure you that i'm extremely sorry about this incident. I know that things like this can interrupt daily workflows quite a bit, even if getting rid of those mails is not a Herculean task. I'd be rather upset if a repo maintainer pulled something like this on me. Please accept my deepest apologies.

The lesson for Github API users: think hard about the implications of automating tasks through the Github API if you have more than a few watchers.

The lesson for Github/API designers: consider safe-guarding against such issues in your API, in case other idiots like me pull off something similar in the future.

[1] [https://github.com/tgoyne/google-code-issues- migrator](https://github.com/tgoyne/google-code-issues-migrator)

<comment><USER2> Install W3TC[1], enable all the caches. Test to make sure it doesn't screw up your CSS and JS. Problem solved.

[1]: [http://wordpress.org/plugins/w3-total- cache/](http://wordpress.org/plugins/w3-total-cache/)

<comment><USER3> Why don't they make this the default? Almost every time I see this happening to a blog, its a Wordpress instance...

</comment></comment></comment><comment><USER4> It's not your fault.

It's actually a PITA to overcome issues like this on a technical level because you have to run something akin to buffer queue, that works similar to how "debouncing" works.

The best approach as I have found is to...

\- You rate limit events as they happen... So you might let 5 events through (within 10 minutes), and then start to rate limit them by adding each item to a queue which you will merge down every 10 minutes (but that exponentially/incrementally back off each time you exceed the 5 items, so the next queue takes 30 minutes before it's popped, and then 90 minutes... etc)

\- So for example, you might have an instant pop from queue where less than 10 events have been triggered within 10 minutes.

\- Then if more than 10 events have been triggered, you add each item to a queue, and after X minutes, you pop each item off and send a bulk email.

\----

It's a real pain to manage such a system, because your "typical" job server, such as Gearman, doesn't let you add a "delay" on jobs...

Ideally, you'd want to make sure that you ignore any new events for at least X minutes... So you are left with the only option of running _another_ pseudo- queue system just to catalogue all of your throttled events.

Let's talk strategy. How else do you guys handle instant email notifications?... without this spamming issue. PS. I'm referring to GitHub implementing this strategy, not the OP in case there was any confusion.

<comment><USER5> The problem is github makes all notifications STD-level contagious. They broke out "watching" and "staring" a while ago, but they are still _very_ overzealous with notifying everybody about everything.

The poster didn't use "send email" API, he was just automatically importing things, and every import triggered emails nonsensically.

<comment><USER6> The problem is that GitHub doesn't really have an import/export API; when you migrate from google code or sourceforge, all issues will appear created and commented from your own account, and at the current date/time.

I guess there's a commercial reason for this: [http://giovanni.bajo.it/post/60836467126/github-is- missing-i...](http://giovanni.bajo.it/post/60836467126/github-is-missing- import-export-for-commercial-reasons)

I was going to make the same mistake myself (thanks OP!). Is there a workaround?

<comment><USER7> > Is there a workaround?

Not that I know of. I added a note to the README about it sending lots of emails to help others avoid accidentally doing this, though.

<comment><AUTHOR> I was about to send a PR for the README, will save a few folks some headaches.

</comment></comment></comment></comment></comment><comment><USER8> I caused a similar issue while running edits on a Confluence Wiki instance as an intern. I was helping our publications department add some macro to every single page of the site, which I found out they were doing by hand! A bit shocked, I told them I could write something to automate that in a matter of minutes.

Sure enough, several minutes later all of the pages were updated. All 50 or so pages in each of the 15 spaces. And everyone who had ever touched one of those pages got an emailed for that page.

The nice thing about the Confluence API is that you can specify "minor" updates to prevent exactly this scenario from happening.

I guess since GitHub is built on the git foundation, adding some sort of "silent" flag might not be as easily possible, but certainly it's desirable.

</comment><comment><USER9> I'm surprised that Github has not implemented a feature for repo migration from google code and sourceforge.

<comment><USER10> I don't think they view that as a significant growth vector. Skimming an existing market is rarely a good tactic.

Plus it's up to the developer. We can't have one-click-do-all buttons for everything.

<comment><USER7> Even if there's no one-click option, it'd be nice if the API exposed a much more flexible set of issue editing options to make it possible for us to write better importers ourselves.

<comment><USER11> If only they had access to some kind of command line tool which lets you bulk pull and push and merge histories. Do you think they have something like that at github? :-)

<comment><USER12> There is a command line tool, unfortunately it's not very usable.

<comment><USER13> I don't think the GP was talking about ed scripts.

<comment><USER11> They say you shouldn't explain your own jokes. My comment was that github is built around a tool that makes it really easy and efficient to import and merge histories. Namely git. It's amusing that the value-add portion of github, the web bits, suffer from problems like this, that a tool like git could conceivably be applied to.

<comment><USER13> Indeed they do say that. My – admittedly rather poor attempt at a – joke was that the 'command line tool' to which you were referring is indeed quite usable and user-friendly; as opposed to, say, ed scripts.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> Following just one busy repo can take over your inbox (ahem, Docker.) So, I'm sure your people have good filters in place so that they aren't too distracted from a flood of messages from Github.

<comment><USER15> Take a look at [https://github.com/jpetazzo/gunsub](https://github.com/jpetazzo/gunsub) to get the notifications under control.

</comment></comment><comment><USER16> Not his fault and pretty cool he was in touch with users of the library enough to catch it and stop it.

Always figured I'd do Cocos2d-x or Unity for any serious game I do next. I used Cocos2d before and written Unity plugins before. I even have a contractor working on a Unity project right now. Will have to give libgdx a few extra points when deciding in the future, though, for having a caring maintainer.

I actually wrote an OpenGL game engine for Android back before any of the later things came out like Replica Island, AndEngine, the Cocos2D port, etc.. Almost makes me wish I'd open sourced it. It did have some awesome stuff like batching all the sprites with similar draw states together into one draw call.

<comment><AUTHOR> I hope there's plenty of other reasons to give gdx a few extra points, at least compared to Cocos2d-x. Being able to write your game for desktop, iOS and Android with Scala or better performance than Cocos2d-x for example. SCNR

Glad to see other Android "old-timers", would love to see what you came up with back then.

</comment></comment><comment><USER17> Do people actually let GitHub emails go to their inbox? After they got really aggressive about signing me up as a "watcher" to repos I found it necessary to just route all GitHub email to a a dedicated folder that I never read, then only whitelist repositories I actually care about.

<comment><USER18> > After they got really aggressive about signing me up as a "watcher" to > repos.

You may want to turn off auto-subscriptions to repositories you have push access to: [https://github.com/watching](https://github.com/watching)

<comment><USER19> Wow finding that page is a nightmare. I was recently trying to find out how I can stop auto-watching repos I'm giving access too (like if someone creates a repo under an organization) and I searched all over the settings for this.

Thank you.

</comment></comment></comment><comment><USER20> Well, that is a big yikes, but crises (mostly) averted.

</comment><comment><USER21> I did this with my a company repo, when I wrote a script to migrate issues from a spreadsheet into GitHub. I only sent 50 issues * 15 people though.

</comment><comment><USER22> Anyone have a mirror or cached copy of this page? This site hit the front page of hn/proggit twice this week, and it was down both times.

<comment><USER23> Yes, pretty annoying. We should have something that takes a copy of a page before it will be shown here.

</comment></comment><comment><USER24> Site is majorly foobared

</comment><comment><USER25> Recently: And a bottle of rum ([http://www.amazon.co.uk/And-Bottle-Rum- History-Cocktails/dp/...](http://www.amazon.co.uk/And-Bottle-Rum-History- Cocktails/dp/0307338622))

I loved it. A history of rum, including all of the politics around it (like the role it played in the slave trade and American independence), great read :)

<comment><USER26> Ehh? Is this spam or what?

note: the site is down so I don't know if this is a reference to the original article

<comment><USER27> The author has posted the article in the comments. Read the third or fourth comment.</comment></comment></comment>


Room temperature quantum transfer in biological systems - <AUTHOR> http://www.nature.com/ncomms/2014/140109/ncomms4012/full/ncomms4012.html

<comment><USER2> You should watch this before looking at the article: [http://www.ted.com/talks/jim_al_khalili_how_quantum_biology_...](http://www.ted.com/talks/jim_al_khalili_how_quantum_biology_might_explain_life_s_biggest_questions)

<comment><USER3> Brilliant talk, more:

Jim Al-Khalili's Quantum Biology Conference, Videos of talks, IAS Surrey 2012

[http://www.ias.surrey.ac.uk/workshops/quantumbiology/](http://www.ias.surrey.ac.uk/workshops/quantumbiology/)

BBC 4 is currently airing Jim's 4 part Science Documentary on Biology exploiting Quantum Weirdness.

[http://www.bbc.co.uk/iplayer/episode/b04v85cj/the-secrets- of...](http://www.bbc.co.uk/iplayer/episode/b04v85cj/the-secrets-of-quantum- physics-2-let-there-be-life)

</comment></comment><comment><USER4> This is not brand new (not this particular research, but quantum systems in nature). It has long been known that some enzymatic reactions take advantage of quantum tunnelling to bridge reaction energies

\- sources to come (mobile)

<comment><USER5> I'm not sure I've seen reliable examples other than photosynthesis, and it hasn't been "a long time". Happy to inspect your sources.

<comment><USER6> Depends on what you mean by reliable examples, but it's been researched for well over 25 years. And point where something goes from probably to clear cut gets fuzzy.

(2009) "Quantum biology? Tunneling in enzymes" _Over the past two decades the possibility of quantum tunneling of protons in enzymes has attracted considerable attention. (See for example a piece in Nature by Philip Ball (my favourite science writer) or the proceedings of a meeting at the Royal Society

The observed large kinetic isotope effects and their temperature dependence are inconsistent with semi-classical transition state theory,_

[http://condensedconcepts.blogspot.com/2009/07/quantum- biolog...](http://condensedconcepts.blogspot.com/2009/07/quantum-biology- tunneling-in-enzymes.html)

PS: This post ended with _I align myself with the skeptics_ , but it's hardly a new idea.

<comment><USER5> That work is highly speculative (I've studied, but not as my primary work, enzyme kinetics and reaction mechanisms). Finding holes in transition state theory isn't hard and I don't see that it's necessary to invoke tunneling protons to come up with better theories. Even the physical experiments cited in the Ball article, are pretty speculative, and aren't accepted by the mainstream.

I find it pretty amusing, because I proposed tunneling protons in a journal club once, but got laughed down by all the physicists who said "that's silly, proton mass is too high, so probability of proton tunneling is basically zero" (they were being overconfident).

The only real work in this area, which is to say, work that is heavily backed up with data, is the work on quantum mechanisms in photosynthesis: [http://newscenter.lbl.gov/2010/05/10/untangling-quantum- enta...](http://newscenter.lbl.gov/2010/05/10/untangling-quantum- entanglement/) This work, since it has a huge amount of high quality experimental work, is considered pretty solid.

<comment><USER7> And i had a committee member forbid me from including quantum effects in the modeling of _my_ enzyme. He said it was "too speculative". All science is speculative, until it isn't. You would be well served to reduce your "highly speculative" filters. That is, continue to propose your interesting new chains of causation. If there were braver people than me (which shouldn't be hard) then perhaps understanding enzyme mechanisms would be further along by now.

<comment><USER5> People need to back up their speculations with evidence.

Also, did you push back against the committee member? Show data? At least create a plausible doubt in their mind?

The reason enzyme mechanisms are so hard to study is that getting proteins into a state where you can capture data from that femtosecond where the reaction occurs is hard. Recent improvements in free electron lasers for fourth generation synchrotrons will greatly improve this.

</comment></comment></comment></comment></comment></comment><comment><USER8> I did some research on this top a few years ago. It's interesting that quantum behavior could exist in such a warm, wet and complex environment.</comment>


Volkswagen Stock Plummets as CEO Apologizes for Emissions Cheat - <AUTHOR> http://www.npr.org/sections/thetwo-way/2015/09/21/442174444/volkswagen-stock-plummets-as-ceo-apologizes-for-emissions-cheat?utm_source=twitter.com&utm_campaign=npr&utm_medium=social&utm_term=nprnews <comment><USER3> I looked a bit into this and it seems strange that this happened only now.

Consider this [1] 2014 study (scroll to last page of executive summary, page 5). Basically they tested 15 vehicles from 6 manufacturers for emissions while on the road and NONE OF THEM passed the euro 6 average (!) limit. 1 was exactly on the limit, the worst one emitted on average 24 times more than the norm. They noted the vehicles emit more when driving uphill.

Then there is this article [2] from 2014 which says the emissions in city traffic are 3 times the norm.

In 2013 this study [3] was published which measured diesel NO2 emissions and found out that Euro 5 class vehicles have exactly the same emissions as Euro 2 (from 1992) cars.

[1] [http://www.theicct.org/sites/default/files/publications/ICCT...](http://www.theicct.org/sites/default/files/publications/ICCT_PEMS- study_diesel-cars_20141013.pdf)

[2] [http://www.telegraph.co.uk/motoring/news/10862975/Emission-t...](http://www.telegraph.co.uk/motoring/news/10862975/Emission- tests-substantially-underestimate-pollution-pumped-out-by-diesels.html)

[3] [http://uk- air.defra.gov.uk/assets/documents/reports/cat05/13...](http://uk- air.defra.gov.uk/assets/documents/reports/cat05/1307161149_130715_DefraRemoteSensingReport_Final.pdf)

<comment><USER4> Would that mean emission limits are set lower than technically achievable?

Car manufacturers still provide more powerful cars every year. I always wondered, how they can claim their engines emit less while they get faster and faster. Everybody knows that a modern car does not consume so much less fuel than a car of then comparable standard 20 years ago. But lets face it, consumers require more power, less fuel consumption and less emission - <USER2> this order. Probably the development of on paper values has been disconnected from the real world for marketing reasons (that is no excuse, its an observation). Before everybody throws stones at Volkswagen only, please measure other cars (again, no excuse).

From time to time I rent cars of different brands and at the gas station I see proof that there has been little progress in fuel efficiency. That said, Volkswagen and Audi diesels seem to be the most fuel efficient engines around for the pure power they deliver. The only diesel I know that felt more advanced was a Volvo V60, but mostly because of a geniously constructed gear system and a perfectly rectangular torque (so I had to change gears at 3500 rpm).

In Europe (and that means in this case in Germany), car manufacturers invented the fleet consumption and emission. That means, the consumption and emission of a whole class of cars is averaged. This is to trick high powered engines on paper into an acceptable consumption and emission range. The goal is clearly not transparency and openness.

<comment><USER5> > Everybody knows that a modern car does not consume so much less fuel than a > car of then comparable standard 20 years ago.

Actually a modern car does consume a lot less fuel than models from 20 years ago. CAFE standards have had a great effect.

[http://www.rita.dot.gov/bts/sites/rita.dot.gov.bts/files/pub...](http://www.rita.dot.gov/bts/sites/rita.dot.gov.bts/files/publications/national_transportation_statistics/html/table_04_23.html)

For a new passenger car the average MPG in 1995 was 28.6 and in 2013 (latest available data for that report) was 36 MPG. That's a 25% increase which when multiplied across millions of vehicles is an enormous amount of fuel.

<comment><USER6> It's a 20.6% decrease in gallons per mile.

<comment><USER7> That is misleading. We should calculate percentage improvements against the better value. Fewer gallons per mile is better. For instance, if you cut in half the gallons per mile, it only looks like a 50% decrease. But it's actually a doubling of the mileage: you go twice as far on a tank of gas. The _improvement_ in gallons per mile is 100%.

Using something other than mileage: suppose you optimize a program so it takes half the time to run. It's running twice as fast: it is 100% faster. Looking at it as a mere 50% reduction of time can be misleading. If you calculate the speedup using the running time, you have to divide the time difference by the smaller, better running time: 100 x (Tpoor - Timproved) / Timproved.

The main problem with the "percent reduction" is that arbitrarily good improvements only approach 100%. If we make a car go a million times longer on a gallon of gas, it's only around a 99.9999 reduction in gallons per mile, which looks only about twice as good as a 50% reduction. :)

<comment><USER6> Suppose you're going on a 100 mile trip and you want to know how much better off you are if you replace your 50 mpg car with a 100 mpg car. You now only need 1 gallon of gas instead of 2. Even if the car can run without gas, you aren't any better off than a savings of 2 gallons for the trip. You're not > million times better off.

<comment><USER7> I'm only not one million times better off because I have other costs to deal with which are completely unrelated to the gas.

If the gas were the only resource I have to worry about (whatsoever), then I would in fact be a million times better off.

<comment><USER6> So if the 50 mpg car cost $5,000, you would be willing to pay >$5,000,000,000 for the 100 mpg car?

<comment><USER7> In fact, I understand economics well enough to recognize that I've already put more time and effort than necessary into this thread.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Test tuning seems to have a long history at VW. The VW subsidiary Porsche tuned the 918 spyder with a battery just large enough to pass fuel consumption test at ~78mpg, or 3l/100km which is ridiculously far from reality.

I am very curious, as to who wrote that patch. Afaik, almost all German manufacturers buy their common rail Diesel motor control units from Bosch. Stuff like pressure adjustment, valve control, or silly 'sports mode' buttons are all designed at Bosch. They ship a modular firmware which the manufacturers customize. Maybe VW were not the only customers of this special 'feature'.

<comment><USER9> The post from yread makes this seem very likely...

</comment></comment><comment><USER10> I have to hand it to them, it takes a huge pair to actually design, develop and ship something like this to customers. I'd always assumed if anything this crazy as going on at least one employee would have blown the whistle at some point.

I guess this answers my Bond-villain henchman recruiting problem. I'd always wondered how those super-villains recruited henchmen and grunts necessary to run their island fortresses. Turns out it may not be all that hard ^_^

<comment><USER11> When I worked at the now defunct Nortel, I was asked to implement a feature that would allow a large bank to spoof it's telephone numbers in long distance telephone calls. I was told that the feature was necessary to make a $60 million sale.

I looked at the spec and, of course, the change they were requesting was disallowed. Even worse, there was an actual law specifically forbidding running equipment with that ability in the country where the request was being made. I refused to implement it.

The B level manager came to my lowly cubicle (I was still pretty young back then, so didn't actually hobnob with people in that stratosphere often). I was told that it would cause a lot of people a lot of trouble if I didn't do the work. And besides, _we_ weren't running the equipment, so _we_ weren't breaking the law. I refused again.

They never asked me again and I never knew if they found someone else to patch the code without my knowledge. I'm pretty sure they did. But how do you whistle-blow that? They just cut cut everyone who doesn't play ball out of the loop.

I can well imagine something like that happening here. It's pretty easy to find someone with kids, or someone who needs their job for keeping their work visa, or someone who just doesn't care. You can patch it in the load build in most large companies and nobody would ever know the difference.

<comment><USER12> Great story. Your refusal to do illegal, unethical work took courage. The B level manager should have gone to bat for you and put his job on the line, too.

<comment><USER13> 'mikekchar was working for a salary. The manager might have received a bonus for making 60 million sale.

</comment></comment></comment></comment><comment><USER14> Meanwhile GM gets away with a laughable $900m settlement for knowingly using faulty parts that have caused the deaths of hundreds and many more severely injured.

Reason I'm saying this is I expect VW will end up paying magnitudes of this amount for their wrongdoing that did not result in anyone's death.

EDIT: Toyota had to settle for $1.2b in the unintended acceleration lawsuit that may have caused the death of 3 people where, up to this day, there is still no proof that there was something wrong with the cars, let alone that any employees were knowingly approving the installation of faulty parts.

[http://www.bloombergview.com/articles/2015-09-18/gm-s- cynici...](http://www.bloombergview.com/articles/2015-09-18/gm-s-cynicism- pays-off-in-ignition-settlement)

<comment><USER15> _for their wrongdoing that did not result in anyone 's death_

It's well-established that fossil fuel emissions actually do cause many deaths due to increased cancer rates and other respiratory illnesses. Burning diesel without proper emission control systems will also create larger particulate pollution which is especially detrimental to the public health.

Unlike the GM case, it will be impossible to trace exactly how many premature deaths VW has contributed to, but that doesn't mean they should be punished any less harshly.

<comment><USER16> Don't forget the contribution to climate change. It's probably negligible, since the cheating VW cars make up a very small portion of cars worldwide, but it's still worth thinking about, in my opinion.

<comment><USER17> This is not about climate change. The main climate change contributor from emissions is CO2 - which relates 1:1 to fuel consumption (and how could it be otherwise). Fuel consumption is hard to fake and is tested independently all the time.

What this is about is particulates and NO and NO2 - which aren't a significant contributor to climate change, but have detrimental effects such as emphysema or bronchitis in humans, acid rain or creation of surface ozone that damages lungs.

</comment></comment></comment></comment><comment><USER18> There's no defense for what they did. I mean it's so silly it's the sort of thing you expect to be part of the evil guy's plans to destroy the world in a Bond film... not something that a stupid corporation actually does.

<comment><USER19> Sure there is.

"We consider this law illegitimate and do not consent to be bound by it."

You may not LIKE that defense, but it's a defense - pretty much the canonical anarchocapitalist one.

<comment><USER20> Very well stated, and I agree a defense exists for the accused.

Gaming tests and parameters doesn't seem too far fetched to me. In high school one class allowed for one 3x5" notecard to be brought to the final exam, and it could have notes written on it. Following the letter but not the spirit of the rule, I used a razor blade to gently split the notecard and was able to peel it open for about 70% more writing space. Though a technicality, I did manage to use my device with approval in that case.

<comment><USER21> I don't really agree. Air pollution isn't like test notes at all, it kills people.

If you had "Followed the letter but not the spirit of a rule" and wound up endangering people's health, do you honestly think there would be no repercussions other than a "haha, clever you! You can get away with it on a technicality this once" ?

<comment><USER20> Can you empirically show that Air Pollution in the US killed more people in 2015 than listeria in Blue Bell ice cream?

Being good stewards of the Eart is important, and as long as there are regulations and rules, there will be different attitudes to contend with. I consider air quality to be valuable, I genuinely do. I also think the entire annual production of all VW automobiles globally does less air quality "damage" than one season of wildfires in the western United States. Or a vocanic eruption.

<comment><USER21> > Can you empirically show that Air Pollution in the US killed more people in > 2015 than listeria in Blue Bell ice cream?

"empirically show" is a stupefyingly high standard for a comments thread.

I assume that you are familiar with the scale of the problem for starter?

e.g. [http://www.who.int/mediacentre/news/releases/2014/air- pollut...](http://www.who.int/mediacentre/news/releases/2014/air- pollution/en/) [http://www.theweathernetwork.com/news/articles/study-air- pol...](http://www.theweathernetwork.com/news/articles/study-air-pollution- deaths-to-double-by-2050/57507/) [http://www.bbc.co.uk/news/uk-26973783](http://www.bbc.co.uk/news/uk-26973783)

It's a misdirection on your part anyway, comparing a knowingly harmful and deceptive like this to Some industrial accident is not valid: People die in accidents; this does stop murder being a thing.

<comment><USER22> If something really wants to be done about pollution from burning fossil fuels then bunker fuel may be a good place to start, that low grade crud burnt by shipping our wonderfully cheap crap from around the world... [http://www.gizmag.com/shipping- pollution/11526/](http://www.gizmag.com/shipping-pollution/11526/)

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> Four days ago, GM was fined $900 million for a known defect that _killed_ over 100 people. If the VW fine exceeds that, something is clearly out-of-line with corporate prosecutions in the US.

<comment><USER24> US loves prosecuting foreign companies. Not so much local companies. So sure they could go after Volkswagen, what do they have to lose?

<comment><USER25> What about VW going after the US through the TPP ?

From [http://www.dailydot.com/politics/tpp-leaked-investment- chapt...](http://www.dailydot.com/politics/tpp-leaked-investment-chapter- isds/)

> Corporations may be granted through "Investor-State Dispute Settlement" > (ISDS) tribunals the authority to demand taxpayer compensation for domestic > energy, health, environment, land use, and other policies. With the > exception of Australia, all of the countries involved in the TPP talks have > agreed to submit to the jurisdiction of ISDS tribunals.

*edited to format the quote. Giving up.

<comment><USER24> Corporations bite back?

</comment></comment></comment></comment><comment><USER26> So, the real moral here is that Volkswagen took advantage of the fact that our emission standards basically trust the cars own on board diagnostics to determine if they pass emissions...

CA, at least, uses the BAR-OIS inspection for diesel cars, coupled with a "visual inspection" to make sure that the car does not produce visual pollutants. Effectively, this means that the software reads whether the car is passing from the OBD-II port in the car, and then, as long as the car has the necessary parts (Exhaust recirculator, catalytic convertor, etc) then it passes.

It would not surprise me to find out that more than just VW have these kind of issues. Effectively, we don't actually verify with any instrumentation whether the emissions are within spec.

Sure, VW may have duped the system on purpose, but, the fact that this has gone on for _years_ has to weigh in a bit on a critical mind. Our tests don't work very well if this stuff can go on this long.

___

Of course, it is also trivial to find an inspection location that will pass almost any diesel vehicle, if you know where to look. For any interested parties, try googling "diesel exhaust delete" or some similar query for any number of Ford f-350s, Ram 2500s or any other large turbo diesels. This basically consists of taking a saw, and cutting out the EGR, and some other flow restricting parts of the exhaust to increase exhaust flow, typically done in combination with a chip/turbo map.

The results can be significant. A person I know got a fairly significant bump in both power and MPG at the expense of needing to carefully plan how to pass emissions tests. The main question that weighs in is whether it is better to pass emissions and get 13-15mpg, or to fail emissions technically, but get 24-26Mpg with diesel. Those are real numbers with a 2008 Ram 2500.

I think this VW thing should spark a larger conversation about how we measure emissions in the first place, and what cost the emissions passing imposes.

<comment><USER27> I think you mean the Diesel Particulate Filter delete. [http://news.pickuptrucks.com/2013/01/epa-says-dont-touch- pat...](http://news.pickuptrucks.com/2013/01/epa-says-dont-touch-paticulate- filter.html)

<comment><USER26> That is certainly one part of it, though many people go significantly further. frequently, this involves simply sawing off the whole exhaust system and having a local muffler shop fab a new set of pipes and mufflers for you.

The truck that my friend has is a ram 2500, with a chip/tune and the exhaust removed, it dynos at about 490HP/1100 ft-lbs of torque, and still achieves ~25mpg highway. The downside is that there is an unknown emissions toll for doing that modification.

Again, I have to wonder though, at almost 10mpg better, is the reduced emissions actually logical? i.e. do the emissions reduction systems really make up for needing to burn additional fuel to do the same work?

<comment><USER28> Whether it's "logical" depends on your goals.

If you value public health more than fuel efficiency, then yes, emissions controls are a logical choice.

<comment><USER26> well, thats what I'm getting at. By getting 10mpg better, do you produce fewer total emissions than if you had the emissions controls in place, but burned more fuel?

I imagine than there are many possible solutions where it makes sense to use strict emissions controls at the cost of fuel consumption, but there are also others where the increase in mileage would reduce total emissions further than the emissions controls would.

rough estimate. on a 25 gallon tank of diesel, with emissions controls in place, the truck goes 350 miles. on that same tank, the truck goes 625 miles with the emissions removed. so, to go 625 miles with the exhaust controls in place would use ~44 gallons of fuel vs 25. Is that actually a net environmental benefit? My gut tells me that the environmental costs of refining, transporting and burning the extra fuel are higher than the marginally higher emissions in the unrestricted truck. I don't expect those numbers would work out the same in all vehicles or cases though.

I think public health and fuel economy go hand in hand. the total environmental costs of petroleum are much higher than the emissions that come out of cars. reducing demand through greater fuel economy should be factored in to the overall emissions equations.

<comment><USER28> EPA emissions limits are based on grams of pollutant per horsepower-hour. In order to reach compliance, your emissions control equipment needs to reduce pollution much faster than it reduces efficiency.

It's not uncommon for illegally chipped/straight-piped trucks to see 50% improvements in fuel efficiency, but they're belching out tens or hundreds of times the volume of common pollutants (depending on the pollutant)

<comment><USER26> Thanks for that info. Out of curiosity, is there any accounting for the other emissions involved in making the fuel, though? Full transport and refining is energy intensive. on-vehicle emissions controls are also costly, and also use energy to make. Finally, petroleum is a finite resource.

I am all for emissions controls on vehicles if they genuinely reduce net emissions. If the reduced fuel economy doesn't equal out though, then at best, we're simply moving the emissions out of cars and into refineries/shipping/factories instead.

<comment><USER28> I have a hard time believing that we're moving the emissions.

1\. The efficiency/emissions tradeoff is almost entirely a diesel problem. For intrinsic reasons, gasoline engines suffer much less from emissions controls. The relevant systems are both much less complicated and much less intrusive. There is very little efficiency gain available by e.g. removing your catalytic converter.

(The vapor reclamation requirements can be very complicated, but those parts do not intrude on the function of the engine, so they are not making the system less efficient)

2\. The math doesn't work out on the back of a napkin. Emissions controls can reduce total tailpipe pollutants by as much as 99%. Even if it caused 2x the fuel consumption, how on earth would that result in a 100-fold increase in emissions in the distribution chain?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER29> They should try the bank line:

* hey we are just playing the game, it's the regulators who set the rules

* it's business, if we didn't get innovative with the rules we'd loose customers and go out of business

* it was one rogue guy, the culture here is fine!

If all these fail then just make sure the fine is less than the profit you make from the "transgression".

<comment><USER30> "We have a legal obligation to our shareholders to maximise our profits."

</comment></comment><comment><USER31> Presumably VW had a project (either in-house, or through one of their tier-1 suppliers) to develop this technology.

A crime was committed, so who is criminally liable?

The sales-people who agreed the deal? The project manager who was given the project to manage? The release manager who signed-off the release? The systems test manager who tested the vehicle? How about all the software developers and other engineers who were assigned to work on the project?

I'd particularly like to know what people think the extent of criminal liability for individual software developers in the automotive industry is and should be?

<comment><USER32> Convicting someone of a crime requires proving all of the elements. Most crimes require a culpable state of mind (or mens rea). So the issue would be whether an individual has the requisite mens rea (recklessly, knowingly, etc.) These are very fact-intensive inquiries.

Having worked in the antitrust world, I saw lots of cases where mid-level managers and employees were engaged in anticompetitive conduct. The fact that their bosses demanded that behavior as part of their job function didn't absolve criminal liability.

<comment><USER31> What would the appropriate actions on the part of those mid-level managers and employees have been to avoid criminal liability?

<comment><USER32> Refuse to participate in the scheme. Yes, it is possible (or likely) that you will be fired. But going to federal prison is a very real possibility. I visited several witnesses in prison. They are "normal" guys - the kind you see standing on the sideline of a kids' soccer game. They have kids, two car payments, a mortgage, etc. It's a tough situation to walk away from (especially because the crime is often just a phone call or a few emails with a competitor).

Keeping a conspiracy going year after year is difficult. There is "cheating" by conspirators, turnover of personnel, etc. The DOJ also has an immunity program that protects whistleblowers from criminal liability (and sometimes the company from treble damage civil liability). The immunity program makes it much more likely that someone quits the conspiracy and turns themselves in.

So while losing your job sucks, if your company is violating federal antitrust law, chances are your job is not secure or desirable anyways.

</comment></comment></comment></comment><comment><USER33> The EU announced earlier this year that they were changing the test procedures and certification rules for diesel cars to more accurately assess and control NOx output and to prevent gaming of the tests by manufacturers. Defeat devices were explicitly called out:

[http://www.theguardian.com/environment/2015/feb/03/car- maker...](http://www.theguardian.com/environment/2015/feb/03/car-makers-face- real-world-emissions-tests-in-eu-pollution-clampdown)

</comment><comment><USER34> Even with the looming threat of billions of dollars of fines, big co's STILL try to cheat the system.

In a deregulated market, how can we ever expect these co's to act honestly? We can't.

<comment><USER35> It is regulated... They just didn't follow the regulations.

<comment><USER36> The point was that if they don't follow regulations, how can we expect corporations to act ethically if they're deregulated?

<comment><USER29> Pretty sure we have seen this worked well with banking /s

</comment></comment></comment></comment><comment><USER37> Environmental impact aside, this is the same practice employed by Samsung and HTC with regards to performance benchmarks:

[http://bgr.com/2013/11/27/samsung-benchmark-cheating- banned-...](http://bgr.com/2013/11/27/samsung-benchmark-cheating-banned-htc/)

I saw a documentary about other manufactures removing seats and using different tires for tests. I expect this is rife with any industry imposed tests :(

</comment><comment><USER38> This is why I believe in corporate death sentences.

You ship millions of cars that don't actually slowly poison the drivers but the people on the side of the road instead, you should have more than a little justice coming your way.

<comment><USER39> It would be a bad idea to shut the company down totally, but if you wanted to enact a death sentence, just cease the shares and auction them off again.

The company still operates--which allows employees to keep their jobs and the economy doesn't take a huge GDP hit--but the owners pay the price.

<comment><USER40> How would this proposal solve _any_ problems? The executives of the firm are the ones who, ahem, _actually decided to break the law_. Why should they keep their freedom, to say nothing of their jobs? The various index funds and pension plans that you want to penalize were never informed of the scheme.

<comment><USER39> New ownership would presumably clean house.

And this wouldn't prevent those who were involved from being charged as well for their individual role.

>The various index funds and pension plans that you want to penalize were never informed of the scheme.

I only meant this how you'd carry out a corporate death penalty without hurting third parties. Any corporate death penalty would wipe these share holders out anyway.

</comment></comment></comment></comment><comment><USER41> It is strange that he is apoligfising for misleading people. The damage is the excessive toxic gas that was released into our communities.

<comment><USER42> Nobody cares about the actual damage, it's the _reputational_ damage that is important. "If they cheated on this, how do we know they followed all other safety/environmental regulations and their cars won't just blow up? How do we know their published accounts are truthful?" etc etc.

The apology is basically "sorry we lied in this case, _usually we don 't lie, please keep trusting us_."

Actual damage is relatively nonimportant. You can always donate to this or that green group, develop a magic air-cleaning machine or something... but only if you keep getting money out of customers trusting you.

</comment></comment><comment><USER43> I worked with them and know that before they release software they do a risk calculation. They do it even for small mobile apps and if the risk is too high because they would need to regain public trust they don't release that app / software. So how in the world can it be that they released this? Normal employees there are not allowed to make such decisions.

</comment><comment><USER44> IMO, EPA should seize the cars till there is a legal solution. Let the consumers sue for being sold a vehicle on false pretenses. Being a car enthusiast, I already see posts on the forums from car guys stating they will refuse to allow VW to fix the problem on their cars, because they know the fix will sacrifice performance and economy.

</comment><comment><USER45> How likely is it that other manufacturers are doing the same thing?

<comment><USER46> All of them optimize for those well defined regulatory test cases. It's all shades of gray as long as they are just tuning parameters to yield favorable results in the test scenarios without bothering with possible drawbacks in other situations. But things suddenly turn solid black when a method of optimization is employed that is explicitly disallowed in the rules.

It's not unlikely that this infraction was enabled by "motivated disbelief" questioning that software alone can be a "defeat device". And without court- actionable "defeat device" this thing would clearly be in the gray range, even if the "up to forty times" that are being talked about would probably make it one of the darker shades.

They might have even checked this with some lawyers, who can sometimes be very eager to look at the law in the way most favorable to the client: "Yes, it may hold in court" (and if not I will still get my money, also, the negative PR caused by the lawsuit even if you wirll will be your problem, not mine)

</comment></comment><comment><USER47> I can say so much: many VW employees in my "vicinity" are baffled, too.

<comment><USER48> Really? I've heard those rumors (that many car makers build cars that try to detect whether they are tested) years ago. The reasoning back then was that hybrid cars could cheat the results, by completely emptying their batteries during the 20 minute test...

[Edit: Clarifications after reading the replies]

<comment><USER47> Well, it's not R&D I work with. And it is possible, that this "feature" was not even developed by VW itself, but by a supplier. However, someone must have known this within the company. And since the CEO is also head of the R&D department.....

<comment><USER48> Sorry, I wasn't clear. I have not been talking about VW in particular. I've heared the rumor that "many car makers" do this...

</comment></comment></comment></comment><comment><USER49> In my cursory search, I've not found any numbers for just how badly they cheated. Anyone know what the test vs defeated emission numbers were?

I imagine there's gonna be a huge class action suit on top of everything.

Edit: 10-40x the EPA limit of NOx according to the EPA letter to VW (pdf: [http://www3.epa.gov/otaq/cert/documents/vw-nov- caa-09-18-15....](http://www3.epa.gov/otaq/cert/documents/vw-nov- caa-09-18-15.pdf))

</comment><comment><USER50> I don't understand this "defeat device". What's the incentive for VW to do this? If the car can emit in the target range during a test, why not do it all time?

<comment><USER51> Performances. The engine's efficiency is much lower under restricted emissions conditions.

Quoting from [https://np.reddit.com/r/engineering/comments/3lhhjk/have_you...](https://np.reddit.com/r/engineering/comments/3lhhjk/have_you_ever_been_asked_by_your_boss_to_violate/cv8ypjk)

> They were caught cheating on NOx emissions primarily although all emissions > are in a way connected.

> NOx is created when temperatures and pressures are very high during > combustion. Sadly NOx emission is generally higher when your combustion is > nice and hot and rapid, which gives higher efficiency (closer to the ideal > thermodynamic cycle).

> […] [A lying] car will produce a lot more NOx in normal driving, and have > better fuel economy.

> […] If VW correct this via recall the car will be required to run on the > "clean" calibration all the time. This will mean poorer fuel economy, I > would be speculating to say by how much but VW wouldnt have bothered > cheating if it wasnt a significant gain. It may even have implications on > durability if certain parameters (like exhaust gas temps, turbocharger RPMs > or oil life) are affected as they often are.

</comment></comment><comment><USER52> Previous discussion; [https://news.ycombinator.com/item?id=10240001](https://news.ycombinator.com/item?id=10240001)

</comment><comment><USER53> Nice discount on VW stock

</comment><comment><USER54> Probably a great time to buy some VLKAY:

[http://money.cnn.com/quote/quote.html?symb=VLKAY](http://money.cnn.com/quote/quote.html?symb=VLKAY)

</comment><comment><USER55> It looks like the stock is pricing in an enormous fine, because otherwise a 500k recall would not do anything like this to the price. Even adjusting for VW's disgraceful wrongdoing, do I smell veiled protectionism? Payback for Europe's hounding of GOOG in there somewhere?

<comment><USER56> At the moment $17B is wiped out -- the fine could be even bigger than that, and then there's the backslash of the damaged reputation...

<comment><USER57> I don't read annual reports, but it would be interesting to see next year's paragraph on "good will."

</comment></comment></comment><comment><USER58> Hint: Buy VW stock now.

</comment><comment><USER59> Did VW have to do this in Europe as well or are their air standards more lax?

<comment><USER51> Current european standards are laxer, especially when it comes to diesel. In fact, the whole thing was busted because a european supporter of cleaner diesel thought "look they've got much cleaner figures in the US market so they know how to do it and we can way tighten emission standards".

Then they went to road-test US-market cars, and found out the real-world emission profile was more or less identical to the EU one, and completely out of spec for the US regulations.

See [http://www.bloomberg.com/news/articles/2015-09-19/volkswagen...](http://www.bloomberg.com/news/articles/2015-09-19/volkswagen- emissions-cheating-found-by-curious-clean-air-group) for a timeline and a rundown with names and all.

</comment></comment><comment><USER60> Huh, this was days in the coming. I am surprised it just happens today. I should have bet on it...

<comment><USER61> The market was closed on the weekend.

<comment><USER60> Ah, I did not know that. Thanks!</comment></comment></comment>


Announcing Hank: A Fast, Open-Source, Batch-Updatable, Distributed K-V Store  - <AUTHOR> http://blog.rapleaf.com/dev/2011/03/15/announcing-hank-a-fast-open-source-batch-updatable-distributed-key-value-store/

<comment><USER2> It actually sounds fairly promising. Maybe I read it wrong but didn't like the implication that clients would need to manage and handle connection and routing issues? Maybe that's just part of the fun nosql party.

</comment><comment><USER3> hey now

<comment><USER3> sorry, random reference -- no larry sanders fans on HN?

<http://www.youtube.com/watch?v=4AdHpQW-pEs></comment></comment>


A New Way for the Wealthy to Shop for Citizenships - <AUTHOR> http://www.newyorker.com/news/news-desk/a-new-way-for-the-wealthy-to-shop-for-citizenships?mbid=rss <comment><USER2> > The U.S. ranks twenty-eighth on the Q.N.I., behind nearly every E.U. > country. Kalin told me that the U.S.'s rank is partly due to its restrictive > immigration policy, and partly because "there are so many weapons, and a > high incarceration rate."

Why does the fact that there are "so many weapons, and a high incarceration rate" make the US a bad place to live for millionaires?

There is a lot of subjectivity here. If you want to live in America, then an American citizenship is the most important one to have. However, if you want to live abroad, an American citizenship is terrible because you still have to pay income tax no matter where in the world you are.

(I do like measuring travel freedom though!)

<comment><USER3> This "QNI" value that law firm invented seems mostly of interest to wealthy people who want to visit a lot of countries with short visa delays (if any) and little to no red tape at points of entry.

QNI seems minimally useful/relevant to people who live in a country full time and rarely if ever leave that country. For them, other indices and statistics are of greater interest.

<comment><USER4> Also taxes. Tax rates and laws differ based on citizenships.

</comment></comment></comment><comment><USER5> Firstly, I think this is a fascinating subject that isn't discussed on HN enough. A lot of friends of mine have multiple citizenships, so this is an interesting subject for me personally. I know two people with dual Russian-US nationalities, which they both loudly proclaim to be the best. I also know a number of people with dual European-US citizenships, and a handful of people who have a smaller non-EU country and a US citizenship. I also know some people who only have just one smaller non-EU country's citizenship.

I've personally had the discussion several times about what the best citizenships to hold are. Some people I know are wealthy enough that they could simply afford to purchase additional citizenships; some are undocumented in their country of residence and holding even dual citizenship is only a dream.

I'm personally of the opinion that there are a few "classes" of passports: European, American, Russian, South American, and everyone else. Russian, because it allows you free travel between the former Soviet states; European and American for obvious reasons, and South American because most South American countries permit free travel with citizenship.

Less commonly known passports I have special love for are the Chilean passport and the Dutch passport (which I have). The Dutch passport because it is very difficult to obtain (and requires you to give up all other citizenships unless obtained by birth), and the Chilean one because it is the only passport to allow free travel to all G8 countries.

It's also interesting to watch how the Syrian passport fell from "medium quality", relatively close to high quality, to the fourth worst passport ranked. In the same time, only a few countries fell positions: El Salvador went from high quality to medium quality, and the Congo went from medium to low quality.

For those in the thread asking for a copy of the 2016 report: [https://www.henleyglobal.com/files/download/HP/hvri/HP%20Vis...](https://www.henleyglobal.com/files/download/HP/hvri/HP%20Visa%20Restrictions%20Index%20160223.pdf)

<comment><USER6> I would think that Canadian and German passport would be quite excellent.

Canadian because it gives you access to free healthcare and the United States, as well as visa free entry to so many countries and the German one gives you all of the EU.

I knew a person with Canadian, Swiss, and New Zealand -- now that's an awesome combination.

<comment><USER7> Canadian passport does not give you free healthcare; it is completely unconnected with citizenship.

Health care, like most thing, is the responsibility of the provincial governments. You have to be a resident of a province for a period of time, usually 6 months, to get free healthcare in that province. Provinces do cover out of province travel and some limited international travel though usually not the US -- but that all varies by province.

If you are a non-resident Canadian citizen, you will __not __be covered and have to pay full even if you are treated in Canada. For example, if you move to the Bay area for work, go home at christmas and break your leg, you will be out of pocket the total costs.

However, if you a resident non-citizen (i.e., PR, TFW, Student), you will be covered after your residency is established.

<comment><USER8> It's 3 months for Quebec and 153 days for Ontario [http://www.health.gov.on.ca/en/public/programs/ohip/](http://www.health.gov.on.ca/en/public/programs/ohip/)

<comment><USER9> What happens to you if you move and then get in a terrible accident? Does your former province cover you during this in-between residency establishment phase? Do you need to move back to your old province (or be moved back) before the waiting period expires? Or are you completely SOL?

<comment><USER8> I'm not sure, I think that in the specific case of an inter-province move you're still covered by the older province

Or you get a separate private insurance if you're coming into Canada to stay

I suspect that even without any coverage you're not SOL because of things like the mandatory insurance that vehicles must have

<comment><USER9> Okay, I figured there must be some provision for movers but was unwilling to assume - so the old province would cover me if I had some incident in the new province (car accident, heart attack, mega food poisoning, whatever)...

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Referenced but not linked by the article: [https://www.nationalityindex.com](https://www.nationalityindex.com)

</comment><comment><USER11> I feel that it's a much more interesting comparison. Other rankings simply compare the number of countries your passport can enter visa-free, which obviously ignores many factors.

I'm lucky enough to hold three citizenships (no I'm not rich), so I have no trouble entering most countries. I just wish one of them was from the EU... it would make working there much easier.

</comment><comment><USER12> 1\. I wish they had published their list

2\. The simple metric that might help us understand the value of the list: access to high paying jobs

3\. From #2, you can derive other properties as corollaries (freedom to travel, settle Etc)

<comment><USER13> they did publish it. emptybits posted a link to their index

[https://news.ycombinator.com/item?id=11886215](https://news.ycombinator.com/item?id=11886215)

</comment></comment><comment><USER14> Yeah, passports.io does a better job than this firm. I incorporated in Seychelles, have citizenship in antigua. All thanks to them.

Remember, kids: tax evasion is illegal. Tax avoidance is _discouraged_.

<comment><USER15> Where do you usually reside? First of all you've got issues with visas, but also in a lot of countries you automatically become a tax resident after staying there for more than ~180 days per year (as in most EU countries).</comment></comment>


Introduction to Public Speaking - <AUTHOR> http://chodounsky.net/2013/07/17/introduction-to-public-speaking/ <comment><USER2> Some additional tips:

\- You have to understand the topic you will be talking about. While this may seem very straightforward it's very easy to overlook some key things. The better you personally understand (and believe in) things you are talking about, the better talk you will give

\- Try not to eat too much before you have a talk. Even if you don't feel nervous or have some experience, your body could give you a hard time if you're too full

\- Before starting talking, while at the microphone/stage, take few deep breaths and look around your audience. Find a friendly and smile to him/her. It will eat up a lot of stress for you.

\- Drop in a joke or two in some non-critical parts of your speech. Especially if something went not as you expected (demo went bad, you forgot something or tripped over something). It can do wonders to your stress levels and makes the audience more comfortable. There's a caveat though: too much jokes and you won't achieve your goal since people will remember only the jokes, not the core of your talk.

\- Have eye contact with people you are talking too. There is nothing more boring than listening to someone who always looks in his notes and never on his audience.

\- Make sure everyone hears and understands you. Speak louder than you normally would. If you use a microphone, have it 10-20 cm from your mouth, at height of your chin. Listen to previous tip and occasionally scan the audience for reactions that would suggest that they can't hear you well. If that's the case - raise your voice levels.

Source: As a JW I gave hundreds of talks in my life, some worse than others, until I found the proper way to do it. I still don't consider myself as a pro in this topic, though.

</comment><comment><USER3> Two recommendations if you want to learn more,

How to Win Friends and Influence People [http://www.amazon.com/How-Win- Friends-Influence-People/dp/06...](http://www.amazon.com/How-Win-Friends- Influence-People/dp/0671723650)

and Romancing the Room [http://www.amazon.com/Romancing-Room-Engage-Audience- Success...](http://www.amazon.com/Romancing-Room-Engage-Audience- Successfully/dp/0609805975).

Both of these definitely helped a lot with my public speaking.</comment>


Speakers in the programming and design communities - <AUTHOR> https://github.com/karlhorky/awesome-speakers <comment><USER2> I couldn't find any info on the list what makes the people awesome speakers or criteria for being included on the list. Don't mean to sound negative, but anybody can put up repo with random people names and call them awesome.

<comment><USER3> Yeah, without any criteria it's just a random list.

There's already a pull request by mashhoodr to add Mashhood Rastgar. (I don't know this person, I'm sure he is legitimately awesome, but if you can add yourself the list is worthless)

<comment><AUTHOR> Found this - [https://github.com/karlhorky/awesome- speakers/blob/master/CO...](https://github.com/karlhorky/awesome- speakers/blob/master/CONTRIBUTING.md)

<comment><USER4> It would be interesting to see how many of these people self-asserted their awesome speaking skills.

</comment></comment></comment></comment><comment><USER5> I don't want to derail the topic, but why is Israel listed under "Europe"?

I'm asking because it's the second time I see Israel listed as a European country around the net, but I've always been taught that it's an Asian country. Has there been any explicit effort to make it part of Europe?

<comment><USER6> It seems to be considered European in at least some contexts, e.g. Eurovision Song contest.</comment></comment>


First Rigorous Study: Microdosing Fights Depression, Improves Focus - <AUTHOR> https://futurism.com/study-microdosing-fights-depression-improves-focus/ <comment><USER2> No control, self reporting. Hardly seems Rigorous. This is essentially saying that yes, 63 people who microdose because they believe it works also report that yes, they do in fact believe it works.

</comment><comment><USER3> How is any of this rigorous?

Edit: quote from one of the researchers in the original article "As such these results highlight some important possible effects of microdosing but more careful follow up research is needed to confirm these findings."</comment>


ASK HN: Microsoft blocking 'offensive' words in password - <AUTHOR>

I tried using the word dxxk/pxxxy in my password, but it says character not allowed. Is it fair. Screenshot  http://imgur.com/rbQdbYP<p>URL: https://signup.live.com pass: microsoft are dicks <comment><USER2> > microsoft are dicks

It's triggering an error because you're using the word "are" (plural) after "Microsoft", which is singular. I'm sure "Microsoft is a dick" or "Microsoft is dickish" would pass muster.

<comment><AUTHOR> seems to be the space that is not allowed

</comment></comment><comment><USER3> You're incorrect. I had no trouble creating a password Testd\ _\_ ks1! with the word in question. I think it's because you tried to use a space? Or else didn't meet their password requirements.

</comment><comment><USER4> I mean so what? I am more concern that they do not allow passwords longer than 16 chars.

</comment><comment><USER5> Are you sure it's not blocking on 'microsoft'?

<comment><AUTHOR> i am sure

</comment></comment><comment><USER6> if the password is a private information, why can't the user have any password we wish, as long as is secure, really stupid measure.</comment>


Apple support page for the ancient iBook is still live - <AUTHOR> http://www.apple.com/support/ibook/ <comment><USER2> 6 years ago is ancient?</comment>


Documenting conceptions of AI in a short survey - <AUTHOR> https://ischooluw.co1.qualtrics.com/jfe/form/SV_eWDnUFB1cyKjDrn?Q_CHL=hackernews <comment><AUTHOR> Feedback and replies with thoughts here are also welcome. :)</comment>


Sweet Pay and Perks for Tech Interns in NYC - <AUTHOR> https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0CCAQqQIwAGoVChMIkJDOwPehxwIVSlk-Ch1d_QFu&url=http%3A%2F%2Fwww.wsj.com%2Farticles%2Fsweet-pay-and-perks-for-tech-interns-in-nyc-1439239261&ei=t2PKVdDYMcqy-QHd-ofwBg&usg=AFQjCNFO_S9lKrX-VE8LnTi3gejibTGrNA&sig2=Q0JHhUL1tl7NZeHNzffyVA&bvm=bv.99804247,d.cWw <comment><USER2> Please don't post stories using Google redirectors. They obscure the origin of the post and typically don't work for everyone or for very long.</comment>


Show HN: AlgoDaily – One-a-day programming challenges for web developers - <AUTHOR> https://www.algodaily.com/ <comment><USER2> The second question says "Select the proper order" but only lists single options, then when I clicked (thinking I was supposed to rearrange them) it just showed me the answer. From what I can tell it cannot be marked as correct or incorrect like the others. The use of the word "select" is confusing in that case.

While I realize these are toy problems, I would stay away from using "==" in an interview (or at all, unless you are contributing to a codebase that uses it). The reason is pretty clear from looking at the equality diagrams[1,2]. If you use "==" in an interview you should expect to be asked questions about how it works.

Will this evaluate to true? ( [1] == true )

How about this? ( [0] == true )

This one? ( [] == true )

This one? ( [[]] == true )

This one? ( undefined == null )

I would rather not spend my time in an interview talking about the JavaScript equality operator's Bizzaro World counterpart.

1\. === chart [https://i.stack.imgur.com/62vxI.png](https://i.stack.imgur.com/62vxI.png)

2\. == chart [https://i.stack.imgur.com/35MpY.png](https://i.stack.imgur.com/35MpY.png)

<comment><AUTHOR> Thanks! Those are great points.

The hint mechanisms could definitely be worked on. I'll be building a component that lets you click to choose order.

And yeah, the part about the equality operator is something I hadn't considered, but you're absolutely right that you don't want that to be the focus of your interview.

</comment></comment><comment><USER3> Nice site, a lot prettier than most coding problem sites. I'm also digging that JS is the language of choice! Some quick feedback:

\- For the landing page, I'm not sure where my attention should be going. There's the daily challenge, but do you want me to sign up? Or to go through the challenge? The scrolling navigation is a bit unintuitive, it made a lot more sense when I opened the full page.

\- The code editor is decent but I had no idea how to run code. Cmd+Enter isn't really a default shortcut anywhere for executing code (more so for line breaks).

Congrats on shipping!

<comment><AUTHOR> Really appreciate the feedback :-)

Will take these things into consideration as we iterate.

</comment></comment><comment><USER4> Code for today's problem has an issue... uses 'const' on something that it redeclares... Also couldn't get my solution to run.

<comment><AUTHOR> Good catch hacym! I've updated the challenge a little at [https://algodaily.com/challenges/daily](https://algodaily.com/challenges/daily) to make things clearer. Thanks for trying it out :-)</comment></comment>


Latin America's second-biggest airline, Avianca, driven to bankruptcy by Covid - <AUTHOR> https://www.reuters.com/article/us-avianca-holding-bankruptcy/colombias-avianca-airline-files-for-bankruptcy-over-coronavirus-impact-idUSKBN22M0N1 <comment><USER2> United Airlines has a $700 million exposure to this through a loan they provided.</comment>


Explaining X11 for the rest of us - <AUTHOR> http://magcius.github.io/xplain/article/index.html <comment><USER2> How did you write this embedded X server? Emscripten and a touch of magic?</comment>


Bicycle Desks: Better Than the Gym - <AUTHOR> http://www.theatlantic.com/business/archive/2015/08/workplace-sitting-pedaling-bicycle-desk/401729/?single_page=true

<comment><AUTHOR> Seems like the standing desk market is getting a lot more differentiated now: treadmill desks, FluidStance desks, bicycle desks.</comment>


Finding potential software vulnerabilities from Git commit messages - <AUTHOR> https://github.com/cve-search/git-vuln-finder <comment><USER2> In case anyone else was curious, the regular expression used is:

vulnpatterns = re.compile("(?i)(denial of service |\bXX E\b|remote code execution|\bopen redirect|OSVDB|\bvuln|\bCVE\b |\bXSS\b|\bReDoS\b|\bNVD\b|malicious|x−frame−options|attack|cross site |exploit|malicious|directory traversal |\bRCE\b|\bdos\b|\bXSRF \b|\bXSS\b|clickjack|session.fixation|hijack|\badvisory|\binsecure |security |\bcross−origin\b|unauthori[z|s]ed |infinite loop)")

<comment><USER3> This seems to be tuned towards web applications; I'd add things like "overflow", "corruption", and "disclose".

<comment><AUTHOR> Indeed, good point. I'll add a set of regular expressions for bugs related to overflow, double-free or alike. Don't hesitate to make a pull-request or open an issue if you see anything missing.

</comment></comment></comment><comment><USER4> This reminds me of a paper from google, where they try to determine how risky a change to a file is, according to its commit history. Given you use semantic commit messages, you can just look on the number of fix() commits and infer a risk level. Later, depending on the calculated risk, you may run a different set of tests.</comment>


BCHS Stack - BSD, C, Httpd, SQLite - <AUTHOR> http://www.learnbchs.org/ <comment><USER2> > "BCHS (pronounced /biːtʃəz/, beaches) is for real development. It's a > hipster-free, open source software stack for web applications."

Everything about how this is written is _so_ hipster. Cool idea though.

<comment><USER3> I thought that, seems to me writing web apps in C is one of the most hipster things you can do.

<comment><USER4> I'm using an obscure assembler. You've probably never heard of it.

</comment></comment></comment><comment><USER5> I'm not sure how this is significantly better than using say Rust or Go with sqlite embedded, which can be built statically and target any number of hosting platforms with less chance of memory bounds, leaks and the host of issues that tend to surround applications built in lower-level languages at any kind of scale.

It's a nice advertizement for OpenBSD, and in general, I feel the BSDs don't get enough recognition as an alternative to "Linux Everywhere"... that said, I'm not in favor of C as a core tech stack language for higher level line of business applications, which is a majority of software developed (in isolation from other, or more popular or more widely used software).

<comment><USER6> IMO Nim language (which compiles to C) is a better option than writing web applications in C.

[http://nim-lang.org/](http://nim-lang.org/)

</comment></comment><comment><USER7> Having actually written web applications with C as my very first web-dev job, my opinion of this is... not high.

I'm sure at this point there are better abstractions to use (nobody knew how to structure a web app way back when) and there's less ad hoc templating and other string cobbling now, but I can't imagine going back unless there were compelling performance gains I needed and couldn't get any other way.

C also:

[https://news.ycombinator.com/item?id=6402885](https://news.ycombinator.com/item?id=6402885)

</comment><comment><USER8> Seems like a hilarious parody. The only problem is that it isn't typeset in Comic Sans, the official font of the OpenBSD web presence.

</comment><comment><USER9> I like this little project. Nice combo. Let's take it to another level:

BALS (pronounced "Balls"): What you have when you combine [Open]BSD, Ada, Lighttpd, and SQLite. Smokes BCHS in both safety (Ada) and probably speed (web server). Especially when you rewrite the web server in Ada/SPARK with all checks on. :)

<comment><USER10> Is lighttpd still in use? It's had terrible memory leaks gone unfixed for years and the development is awfully slow.

<comment><USER9> Idk. I thought YouTube ran on it, it was fast, and also lightweight. I figured hackers already had plenty of goes at it given that.

</comment></comment></comment><comment><USER11> "hipster-free" really? :-) I think it's the definition of _hipster_ : Low value framework(compared to established web frameworks), will be used a bunch of devs for corner cases OR (mostly I guess) to brag about it (on hackernews, reddit, mailing-lists, forums, chats, etc.)

That said, I'm glad it exist, the more choice we have the better :D

<comment><USER12> Hipster is one of those words whose meanings have shifted over time towards their complete opposite.

In this case I believe it goes hand in hand with the "hipster look" growing into the mainstream a few years ago. With many people going for the "I'm not like other people" mindset, ironically they ended up looking like everyone else in the "hipster" group, thus kind of reversing the meaning of the word in the eyes of most people.

<flameshield> In the case of the programming world, Ruby/RoR used to be the go-to hipster language/framework, but even as Rails grew into the mainstream with big actors like Microsoft adopting bits and pieces from it for their own tooling the label never really left, creating a situation where you have a big popular... hipster thing. </flameshield>

</comment></comment><comment><USER13> > BCHS (pronounced /biːtʃəz/, beaches) is for real development. It's a > hipster-free, open source software stack for web applications. To prepare a > BCHS environment, install OpenBSD. Then get started.

Referring to something as "hipster-free" automatically classifies you as hipster. It's similar to how asking " _Am I cool_?" automatically disqualifies you from being cool.

</comment><comment><USER14> "It's a hipster-free, open source software stack for web applications." :-D

<comment><USER15> Doesn't the act of declaring yourself "hipster-free" in some way actually make you "hipster"?

<comment><USER16> the hipster proclamation paradox.

<comment><USER17> For a brief period in 2009 I decided to self-identify as a hipster, to like totally short-circuit the concept, man.

But nobody really cared much and it's not come up since.

</comment></comment></comment></comment><comment><USER18> There's buffer overflows missing in the list of features.

<comment><USER19> That's better than the hipster references. Well done!

</comment></comment><comment><USER20> With sufficient sandboxing, and depending on the needs of the site in question, this is actually possible to do securely.

When you use sandboxing properly, the security of your application doesn't depend on how complex it is or how many features it has. This is a huge advantage over secure programming languages, where bugs are less likely but still some constant factor of KLOC.

That said, not every application can be sandboxed easily.

</comment><comment><USER21> Man, there's so much irony with using OpenBSD (an OS designed with security in mind) with a web app written in C.

While half asleep the other night, I randomly found a very obscure but also dangerous remotely exploitable buffer overflow in C++11 code I had written a while ago -- it's still very possible even with a modern C++ codebase.

<comment><USER22> Keep in mind that OpenBSD also has a very much locked down malloc in addition to everything else, so buffer overflows are more likely to crash loudly and quickly than to corrupt data and/or allow for exploits. The malloc used in glibc -- ptmalloc2 -- is absolutely terrible for pretty much anything modern, and really should be set on fire and pushed off a cliff.

<comment><USER21> Out of curiosity, does the Android OS use ptmalloc2? I'm using the NDK for my current project. How performant is the OpenBSD allocator in comparison?

<comment><USER22> Android uses dlmalloc, which is basically the parent of ptmalloc2 and rather similar. With using the NDK, I have doubts that you'd be able to mix and match mallocs. I'm not finding any benchmarks one way or another with OpenBSD's malloc, other than the caveat that in debug mode, it becomes a lot slower, so I imagine that performance is similar.

</comment></comment></comment></comment><comment><USER23> > [http://man.openbsd.org/OpenBSD-current/man1/gcc- > local.1](http://man.openbsd.org/OpenBSD-current/man1/gcc-local.1)

Wait, is it really true that OpenBSD's gcc is from the 4.x series?

Apart from the general idea that you shouldn't be writing network-facing software in C when good alternatives (Rust, Go, C++11, Haskell, just about anything else) exist, there's a lot of good work happening in _upstream_ GCC. How up-to-date is OpenBSD's -fstack-protector compared to GCC 6's?

> _Write portable and secure C._

If you're running on the BCHS stack, why? And how is it possible to reconcile this with the suggestions to use systrace(4), pledge(2), and capsicum(4), which aren't even portable _among the vibrant BSDs_?

</comment><comment><USER24> On a non-joke tangent, I do like the new httpd for OpenBSD. It works quite nicely for our small websites.

</comment><comment><USER25> That acronym has some... unfortunate... plausible pronunciations.

<comment><USER26> Looks like it's official pronounciation:

BCHS (pronounced /biːtʃəz/, beaches)

<comment><USER27> I'm Reach Beach

</comment></comment></comment><comment><USER28> Should I be concerned that all the FastCGI links are to an now dead site and that fcgi seems to be unmaintained?

</comment><comment><USER29> I'm 95% sure this is a joke; like it links to this site: [http://www.fastcgi.com/](http://www.fastcgi.com/)

<comment><USER30> That was previously the home of the fast cgi specification.

</comment></comment><comment><USER31> I should write up my stack BSTD (pronounced b'stard) - BSD, SQLite, TUX, D.

</comment><comment><USER32> I used SQLite for development sometimes, how good does it scale in production?

<comment><USER33> SQLite is one of the world's most popular databases in production (I heard it's _the_ most deployed database in the world, but I'm not entirely convinced) so it surely can't be _awful_ at least..

For webapps, it's a mixed bag. I've run a few sites with low 6 figure pageviews per month (i.e. as big as probably 90% of all sites) on it without problems but in situations with high levels of concurrent writes, it's classically been advised against. If your app or framework of choice likes to timestamp every database record it touches or logs heavily to the database, be careful ^1.

(^1 - SQLite 3.7, which I've not played with yet, supports a write-ahead log mode which means writers and readers don't block each other. This could resolve a lot of potential performance snafus.)

<comment><USER34> > I heard it's the most deployed database in the world, but I'm not entirely > convinced

That's absolutely true but not really a fair comparison. sqlite is the go-to method for storing structured data in desktop and mobile applications (Android, iOS, Windows, Chrome, Firefox, ...), accounting for many billions of installations, whereas the other things that people usually call "databases" (e.g. MySQL) obviously aren't meant for that use case.

</comment></comment></comment><comment><USER21> Sqlite isn't even sharded, good luck scaling your next unicorn startup!

<comment><USER35> Except that it can be sharded just by splitting your databases on to separate storage mediums. Dismiss SQLite at your own peril.

<comment><USER21> I can't downvote yet, so I'll just _facepalm_ instead

<comment><USER35> Reinforcing the stereotype I see.

</comment></comment></comment></comment><comment><USER36> Given that a C server is most likely multithreaded, wouldn't it be more heavy weight than an equivalent green thread/coroutine setup like golang?

</comment><comment><USER37> I've worked with that exact same stack before, it's pretty fun, there's a lot of cool libraries and tools for C.

</comment><comment><USER19> Almost as funny as [https://threatbutt.com/](https://threatbutt.com/)

</comment><comment><USER38> I really like the design of this page!

</comment><comment><USER30> I wonder why slowcgi over libfastcgi?

</comment><comment><USER39> It is kinda funny... but it would be funnier if this was not a joke.

</comment><comment><USER40> >forget your LAMP instincts to desperately search Google and StackExchange for every parameter: man pages are your new best friend.

The amount of arrogance here is astounding. For one thing it's a trope that Linux doesn't have good documentation, RHEL has better docs than anything I've seen from BSD. C is a whole software language and AFAIK you can't just "man c" and even if you could why would you want to read the whole manual/handbook for the C programming language to figure out something trivial? You would google it anyway.

The only reason using man pages on BSD might be better than google is because 90% of the answers you'll find on google will be from a Linux perspective and you'll have to do a second search to figure out how to apply the answer to BSD. Yes, 90% of the time the Linux solution will work on BSD but the 10% of the time when it doesn't is a huge pain.

<comment><USER41> That was my first thought too, but there actually might be something to it.

The thing about man pages is that they require effort and force you to develop deeper understanding about the tools you use. From that perspective, it can actually be helpful to apps quality. I genuinely think that most of web developers now (myself included) got used to solving problems by quick and dirty means. Our whole development process seems to be based on piling technical debt until we can't figure out what's going on.

I'm not actively encouraging using this stack for development, but as a wake up call it's not without merit.

</comment></comment><comment><USER42> Lol this is funny.

</comment><comment><USER43> this page is garbage. no useable information what so ever. just a fucking joke site</comment>


Ask HN: Need Help (Looking for volunteers) - <AUTHOR>

I'm trying to validate a potential business offering and looking for volunteers to help me with suggestions/insights
You'll be an ideal person if 1. You work long hours/eat junk food? and/or 2. You find making home cooked meals to be an issue?
If your answer is 'YES' to any of the questions above !! I would appreciate if you can give me 15 mins of your time for a phone interview
Thanks <comment><USER2> While it's good to find people interested, You aren't going to get a very good sample of normal people. Your business offering may be very applicable to a grand total of 20 people. Those 20 people may be the ones you are going to interview. They all say they love it, and you launch a business that only 20 people are interested in.

On the other hand, I'm sure you've done your homework and have figured out how big the target market is and now it's just a case of getting a sample within a market you already know to be big.

<comment><USER3> Also, I think you'd get more people to volunteer more readily if you did an online survey. Phone interviews, who does that anymore?

<comment><AUTHOR> Well - I did conduct a survey already and the results showed an interest and strong viability for the offering. From that we took it to the level we have defined a basic feature set on how we see we can solve the problem but now as phamilton understood - I need a set of people 5-10 who can validate some of the assumptions which we have made.

Ofcourse I can prorate the assumptions from the survey itself and start to go ahead and develop the functionality but before I do that I see value in talking to people who I reckon might be the ones using the service end of the day.

</comment></comment></comment><comment><USER4> Sure. Send me an email at email@example.com and I'll send you my phone number.</comment>


New Yorkers Will Pay $56 a Month to Trim a Minute Off Their Commute - <AUTHOR> http://fivethirtyeight.com/features/new-yorkers-will-pay-56-a-month-to-trim-a-minute-off-their-commute/ <comment><USER2> Kind of a click-baity title, as even the article acknowledges:

> _Those trade-offs aren't just about commuting time. Places with short > commutes are also often places with other desirable characteristics: > restaurants, nightlife and convenience, both in terms of getting to other > places in and around the city and of getting people from other parts of the > city to come to your neighborhood._

So no, we're not paying $56 a month to trim a minute off; we're paying to be near more interesting things. (I think my commute actually got longer since we moved from an express stop to a local.)

<comment><USER3> Another way to put it might be to say that because neighborhoods near the center are more valuable and attract more people, they also tend to attract other desirables, and that those other desirables tend to further drive up their value. When you rent in New York, you pay for location. A big part of the location equation is your commute. Another huge chunk of it is your neighborhood. And because the two are heavily correlated, commute time by itself tends to track total value of location quite accurately, to the point where on average every minute in reduced commute results in a $56/month increase in rent.</comment></comment>