Ksonnet: Simplify working with Kubernetes configurations - <AUTHOR> https://blog.heptio.com/ksonnet-intro-43f6183a97a6 <comment><USER2> This links to a blog post that is mostly marketing fluff and quotes from fawning CTOs. Useful documentation and examples are here: [http://ksonnet.heptio.com](http://ksonnet.heptio.com)

<comment><AUTHOR> Also look at [http://ksonnet.io](http://ksonnet.io) that redirects to the github org for now. We will work on a community page to host there soon.

</comment></comment><comment><USER3> BCL is infamous inside google for being a very powerful footgun; jsonnet is a nice reboot of the idea, with a much saner semantics

<comment><USER4> I thought I was done with BCl/GCL when I left Google. But I guess there is no escape from it. BCL has really weird late binding behavior, very little tooling support.

Can I use ksonnet without knowing what the generated YAML looks like? If I still have to fully understand the underlying YAML formats, then using ksonnet just increases the cognitive load.

I think a parallel is say you decide to use TypeScript since it is all the rage;. But when you try to learn it, most docs says if you do this in TypeScript, this really happens in JS. Now, you need to know both TS & JS to do your job. This is why I personally never found coffeescript etc simpler JS exciting.

<comment><USER5> The idea is that we can support both simultaneously: \- people who want/need full expressiveness can do that, and \- people who _don 't_ need that can happily use higher-level templates that someone else has put together.

Previous efforts at "simplifying" k8s make you choose between one or the other use-case. ksonnet is trying to provide something that can be more continuous along this spectrum. .. At least that's the hope.

</comment></comment></comment><comment><USER6> Glad someone put in the effort for this.

I wrote something that fills this econiche sometime last year in Ruby ([https://github.com/matsuri-rb/matsuri](https://github.com/matsuri- rb/matsuri)). Same ideas: mixins, generation of Kubernetes resources, etc. For better or worse, it also adds the idea of combining all the deployment environments into a single workflow and command line interface.

The big difference? Ksonnet is better documented and promoted, lighter-weight, and now better supported within the community.

<comment><AUTHOR> [OP here]

Another goal here is to have something that is easy to embed/repurpose. ruby is pretty heavyweight from that point of view.

While jsonnet is a C program right now ([https://github.com/google/jsonnet](https://github.com/google/jsonnet)) we are looking at picking up work on a go port so it is easier to integrate with the kubernetes universe.

<comment><USER6> Looking forward to seeing the go port!

</comment></comment></comment><comment><USER7> jsonnet is great. We've been using it at my company to generate our configurations for ElasticBeanstalk, Terraform, and other various auxiliary services.

We've been looking into moving towards Kubernetes. I'm looking forward to seeing if ksonnet can fit our needs.

<comment><USER8> you may use this tool for JSON Formatting and Validation.

[https://jsonformatter.org](https://jsonformatter.org)

</comment></comment><comment><USER9> I have been working on a UI based system for managing these configurations in a way that doesn't rely on any particular syntax but allows you to construct object graphs (that is what they all boil down to) directly: [http://blog.crudzilla.com/2016/10/managing-configurations- wi...](http://blog.crudzilla.com/2016/10/managing-configurations-with- object.html)

I will be interested in feedback on how such an approach could be helpful in managing complex configurations.

<comment><USER10> This looks very interesting, but there's not much info there, I guess without being able to login.

<comment><USER9> I might regret this but you can login with: developer/developer

:) be nice!

<comment><USER10> Wow, that's a huge piece of work. Unfortunately, I don't have the time to dig in deeply enough to truly appreciate it.

<comment><USER9> feel free to poke around when you have time, it is a very powerful platform...happy to give a demo session to you or a team if you're interested at some point.

<comment><USER10> Thanks! It does look pretty powerful, and I hope you're getting some traction with it.

</comment></comment></comment></comment></comment></comment><comment><USER11> Is there a dockerhub image or linux binary available? Trying to figure out the context of best way to use this in a job. Currently have been using containerized [https://github.com/andreasjansson/envtpl](https://github.com/andreasjansson/envtpl) in my builds and been pretty happy with it.

<comment><USER11> If anyone is looking for the same, I made a quick docker image here: [https://github.com/moondev/ksonnet- docker](https://github.com/moondev/ksonnet-docker)

</comment></comment><comment><USER12> nit/rant: I think it would've been better if JsonNet was named differently, since there is "Json.Net" and googling for "JsonNet" find it (or looking at say ht.algolia.com).

It's not that critical to the project itself, just naming and discoverability.</comment>


No One Cares About the Security of Unlocked Android Phones - <AUTHOR> https://hackernoon.com/no-one-cares-about-the-security-of-your-unlocked-android-phone-cd8ad4aae4c5#.xvdmxs2g7 <comment><USER2> But who cares about security of your locked Android phone either?

<comment><USER3> That's sort of what I was wondering. Not the overall issue of security so much as the title's focus on "unlocked" devices.

Sounds like they're talking more about disreputable or negligent OEMs than anything to do with having an unlocked bootloader or unlocked SIM.

Past phones I've owned that weren't as good with security updates depended on me being able to unlock the bootloader so I could keep them as up to date as was feasible. No timely security update from Samsung or HTC? Find a patched version of the ROM image built by some helpful developer on XDA and flash the phone.

Even today, as I only buy Nexus/Pixel/etc Android phones, they're still sold as "unlocked" in terms of SIM because I don't have any desire to give a carrier more influence over my device than I have to. Again, not an issue with security as even my older Nexus devices are getting security patches (if not the big, hardware-dependent OS updates).

</comment></comment><comment><USER4> The general consumer really needs to start caring about this kind of stuff and start demanding more secure devices. They should refuse to upgrade their phones to the next model until devices are reasonably secure. Problem is that the average person cares far too much about convenience and having that sleek, next-gen gadget. Which is why this problem persists.

Personally, I purchased a BlackBerry Priv (which runs Android) and couldn't be happier. Phone is/was very cheap compared with the other flagship devices and it runs really fast. Came factory unlocked direct from BlackBerry and has zero bloatware on it. I get frequent O/S updates for security patches as well, which is far more than I can say about my previous phone (Galaxy S3 from AT&T).

Despite most people's apathy, or even hatred, of BlackBerry, they have always done security very well. The Priv is no exception - secure boot, hardware keystore, modified Linux kernel, FDE enabled by default, work/personal account separation, external SD card protection, their DTEK software, etc. Some of their security features are included as part of the base Android OS, yes, but their security model as a whole from start to finish is far ahead of all competitors.

<comment><USER5> is it also ahead of the Nexus / Pixel (and if so, how ? ) ?

Also, does it get the security patches in a timely manner ? I kinda remember them refusing to commit to that

</comment></comment><comment><USER6> Which is exactly why we need to fix this problem. Consumer products don't have good security at all and it's making the world a worse place

<comment><USER7> The strange thing is that I have less people around me with virus problems, stolen card problems, scam problems, etc than 10 years ago. Despite the fact that we deem those devices less secure.

Something is off.

<comment><USER8> I guess a lot of people have moved to platforms which are essentially virus- proof, like the iPad. I have several members of my family who used windows computers before, now they use iPads exclusively for all their work and pleasure. Previously any of them would open anything that they got in an email, and I guess they still do - it's just that with some devices, it's not an issue. A zipped up virus won't do any harm on an iPad, and probably most Android devices are secure from that too.

So while I think that windows devices are as easy to infiltrate as ever, a lot of people have simply stopped using them, and replaced them with - coincidentally, not intentionally - more secure platforms.

<comment><USER9> Pretty much this, security isn't improving, its just those infected zip & doc files usually aren't targeted at Android or iOS.

<comment><USER10> From trivial to apply app and OS updates to code signing and disabled sideloading, the mobile platforms (either one) make it really much harder to fall prey than on desktop OSes, _by design_. Malware authors have to hit a homerun on 0-days to even begin to get a foothold on the mobile OSes† these days.

† on properly updated devices such as the Apple ones as well as Nexus+Pixel. Probably this is where some form of vertical integration starts to really matter in practice.

</comment></comment></comment></comment></comment><comment><USER11> I commented about something similar two days ago, and once again there's no mention in the article or here about the fundamental problem of proprietary software:

[https://news.ycombinator.com/item?id=12957927](https://news.ycombinator.com/item?id=12957927)

True security and privacy cannot be had without free/libre software. It's not a solution in its own right, but it's a necessary step to mitigate issues such as these.

A commenter in the linked thread also mentioned other Android OSes working on hardening.

<comment><USER12> It's worth elaborating on exactly _why_ this is.

When software is Free, the end-user's relationship is inherited from the developer's relationship to the software [0]. As such, the definition of security is a completely _shared_ one.

When software is not Free, the developer's and end-user's perspective are at odds. For starters, they're likely on _opposite_ sides of a financial transaction [1]. The security of non-Free software is thus defined in terms of the _developer 's_ interest. Many desires will still align, like securing against most third-party attackers. But some will certainly not, like the business interests of the company and its partners (including the domestic nation-state).

[0] Indeed, a source of much complaint / usability problem.

[1] I'm certainly not rejecting the idea of trading money for software/services, but highlighting a deep-seated principle agent problem. It'd be really nice to find a way to set up a workable economy around Free software, lest we continue to lose to app stores and "open-washed" webcrapps.

</comment></comment><comment><USER13> Oh, great. My BLU R1 HD from Amazon is sitting next to me as I type this. Anyone know if this is patched in the latest software update, or how I can tell if I'm affected? I don't see anything "AdUps" in the applications or services list.

edit: Per an email from Amazon, [http://www.bluproducts.com/security/](http://www.bluproducts.com/security/) has instructions.

<comment><USER14> The lack of corporate BS on that page really surprised me:

 _BLU Products has identified and has quickly removed a recent security issue caused by a 3rd party application which had been collecting unauthorized personal data in the form of text messages, call logs, and contacts from customers using a limited number of BLU mobile devices. ... The affected application has since been self-updated and the functionality verified to be no longer collecting or sending this information._

<comment><USER15> Similarly, their phones are refreshingly free from carrier-lock or (obvious) crapware.

</comment></comment></comment><comment><USER16> As always the SoC manufacturers are to blame. Google could probably fix these problems by writing yet another layer of software to abstract the hardware even further but the simple solution would be to fix these problems at the root.

<comment><USER10> > at the root

While in theory everything could be made to work fine and the right people would be held accountable and dropped from any use, probably this is where some form of vertical integration starts to really matter _in practice_.

</comment></comment><comment><USER17> Why would Mediatek go through the trouble of changing the socket instead of removing the backdoor?

<comment><USER9> They want this data, and they know Google will let them get away with it. Just like how they segment SOCs based on what version of Android they support for each SOC, so if you want Android 6 or kernel 3.10, your paying for a higher end chipset.

</comment></comment><comment><USER18> "Google eventually accepted a CTS patch to check for the ADUPS system socket. That should have solved the problem, but then Mediatek just changed the name of the socket to purposely evade Google's CTS check."

That just left me gaping at the sheer brass required to do this, but I understand how it could happen. I'm sure there are some people who want to fix the problem, and others who say "Why bother? We may lose a few technically savvy (aka pain in the neck) end users, but the great unwashed are never going to know or care about whether this was fixed. Our customers know that their customers are the great unwashed, so they aren't going to care either as long as we're cheaper for them."

Or TL;DR, "Screw 'em, what are they going to do, organize a boycott by people who think chips are something you eat?"

</comment><comment><USER19> Maybe we should build a new bootloader that can be locked down once installed, but with our own keys in the device.

</comment><comment><USER20> I'm flagging this article because it is making a blaming statement nobody cares about the security of my unlocked phone, which is provably false. Let's start eliminating dissonance from HN by taking the time to think about the content we are consuming and how it affects us!

<comment><USER21> If you're across the threshold for flagging, you can flag any story on the site in the sense that a link will appear and change to "unflag" when you click it.

If you expect your flag privileges to mean anything more than that, you should probably avoid using "flag" as a downvote, because your flag privileges can be quietly stripped from your account --- in fact, there's any number of heuristics that can do it by cron job, without the moderators even knowing who you are.

The "flag" feature is there to mark stories as off-topic and wholly inappropriate for HN. Nobody on HN thinks this is off-topic for the site.

Just some advice!</comment></comment>


Ask HN: My personal info was on the Internet, and so is yours - <AUTHOR> Some colleagues just alerted me to some sites that aggregate your full name, address, phone number, e-mail addresses, and personal associated with you, and past location.
Go ahead and look yourself up, if you have the misfortune of living in the United States, where no legislation exists to prevent this unethical behavior.
https://www.usphonebook.com/ - saw my name, father's name, e-mail addresses, and several addresses.  Luckily, they screwed up relatives.
I opted out easily after agreeing to TOCs I didn't read (criminal bastards, what choice did they leave me with).
https://www.spokeo.com
I opted out after googling the link.  This was sleazier:  they wanted an e-mail address (used mailinator), and then promised me that the info might come back because they can't control the aggregators.
So we're not allowed to force these companies to opt us out, we're not allowed to physically beat up their CEO's and we're not allowed to hack these places to smithereens.  So essentially, what ARE we allowed to do other than beg legislators?
ASK HN:  What other places exist like these for those of us who want privacy, and want to opt out of all of them? <comment><USER2> I wouldn't bother opting out. You'll just get added back in. They don't care.

In fact, opting out may end up giving them more information about you that will end up in their databases.

I routinely use all of these tools for OSINT-type investigations.

I myself tried to opt-out, got a confirmation, and soon ended up back in again. I've talked with many others who've gone through the same fail.

These businesses don't care. There's no legal protections in place. There's no benefit for them to care what you want.

</comment><comment><USER3> I wanted to try the first one but did not feel comfortable entering a phone number (it seemed counterproductive and kind of ironic).

As for the second link, it turned up nothing for me. I'm not sure if that says more about my online habits or the websites service. I would the former.

</comment><comment><USER4> I was pretty shocked by how the first link found the first (or second?) email address I ever had. I was trying to remember what it was, and they knew!

privacy on the internet is a farce

</comment><comment><USER5> Sure. So what?

Yeah there is this information out there, but so what?

</comment><comment><USER6> Google "online identity cleansing"

<comment><AUTHOR> That's too extreme, though. Also some of the top links are useful but a bit old. I do love how the WaPo says to give the middle finger (figuratively) to the Terms and Conditions of sites and lie about your birth date.

Definitely change you birthdate on Facebook and family associations (remove the 'this is my relative' type of status)</comment></comment>


Should I pursue CS over MBA? - <AUTHOR> The corporation I work for highly values the MBA, however I am struggling to justify the cost and ROI. I work in M&A and Corporate Strategy for a FTSE 100 in the data and analytics space and interested in having a long career in entrepreneurship and investing.
Curious if anyone has a viewpoint on how a degree in CS would serve me. Considering taking a few undergrad level courses and/or pursuing a masters. <comment><USER2> If you are already in a business savvy position like M&A, then I'm guessing you understand accounting and finance. If you want to be an entrepreneur, I don't see an MBA helping much - it's just a credential to help you get a job working for others.

A CS degree probably isn't necessary either. You can take some free or cheap courses online and teach yourself the tech you want to use.

<comment><AUTHOR> You're spot on - very comfortable with accounting and finance. I've created a lot of value so far through financial modeling for organizations.

Great feedback on CS degree.

</comment></comment><comment><USER3> Follow your heart. What do you really want to learn? CS does not limit your future choices, but imho makes more things possible compared with a mba

<comment><AUTHOR> Thanks for the feedback - it can be difficult to break out of the "corporate group think"

</comment></comment><comment><USER4> There was another thread earlier today about how CS degrees don't give you any social status, so that may be something to consider.

<comment><AUTHOR> I saw that, which inspired this post. I'm going less for social status (lived the ibanker thing and didn't like it) and more for building a product or business I'd be proud of.</comment></comment>


ASLSpeak: Intuitively decode sign language using the Leap Motion, and speak it - <AUTHOR> http://devpost.com/software/aslspeak <comment><USER2> Using gesture recognition and machine learning to translate sign language to speech - brilliant!

Of all the interesting things people have been doing with Kinect, Leap Motion, etc., this seems to be one of the most practical and helpful application. I hope they pursue it further and develop a product for the general public, it could be of great benefit to people.

They could have volunteers provide more input to teach and improve the algorithm, and even branch out into other sign language dialects..

<comment><USER2> Just realized the team is a pair of 18-year-olds! My goodness, so smart and socially conscious.

</comment></comment><comment><AUTHOR> I originally found this on MSDN BLOGS: [http://blogs.msdn.com/b/microsoft_student_developer_blog/arc...](http://blogs.msdn.com/b/microsoft_student_developer_blog/archive/2015/11/03/what- s-the-secret-to-winning-hackathons-a-great-idea-22-hours-without-sleep-and- microsoft-azure.aspx)

        Like Nick Bowmen (18) and Nelson Liu (18, pictured left). The duo
        forms team ASLSpeak - winner of both the Microsoft Hack Award and the
        EMC Isilon Hack Award.

        Knowing they wanted to create something to help the disabled in some
        way, they came up with an idea that aims to aid American Sign Language
        (ASL) speakers.

Truly inspiring work.

github link: [https://github.com/nelson- liu/ASLSpeak](https://github.com/nelson-liu/ASLSpeak)</comment>


DeepMind's 'StarCraft' Victory Was as Worrying as It Was Impressive - <AUTHOR> https://waypoint.vice.com/en_us/article/wjmj84/deepminds-starcraft-victory-was-as-worrying-as-it-was-impressive <comment><USER2> I hadn't caught an analysis of alphastars performance so this was interesting. The consensus in the HN comments seemed to be that alphastar was overall not very impressive, relied on manipulating lots of ui elements really quickly, but machine learning experts were very impressed that this result was achievable at all with modern ML.

We haven't even filled out the potential of basic computing. It wasn't until very recently that lots of people started carrying out mainstream culture over the internet. And there are still tons of things that are yet to transition to being done through computers. The tidal wave of stuff that is going to be radically changed by ML is coming. I think people have this idea that it's already here and look, things are still pretty normal. We haven't even seen the results of general computing and networking. We haven't even begun to see the result of ML. It's going to be unpleasant.</comment>


Can the average person discover reliable facts? - <AUTHOR> TL;DR:  As a lay person (non-scientist/academic), how do I find if a topic has been studied?  Given knowledge of the existence of a study, how do I find that study?  Given a study, how can I easily evaluate the general reliability of it?
In this age of easy-to-distribute (mis|dis|)information I search for lots of info on the web.  I have to filter through the fluff pieces and hopefully find out a study exists.  Fluff news pieces appear to be the only real gateway to actual studies outside of academia, which can't be good incentives for study authors.   Then I must get access to the study itself, which seems to usually involve paying a surprising amount of money to various paygates that themselves have varying veneers of trustworthiness.
If I actually manage to get a study, I don't know how to establish if it has been: peer-reviewed, published in a respected journal, replicated, and/or if it has good RELEVANT p-values.  I can look for obvious logical errors/omissions, but this gives more strength to the communication skill of the author(s) than in the validity of the research.
An example topic I struggled to find studies for was "people find in-person communication to be more effective than text, but (1) how much of that is comfort/familiarity and (2) how much is a false FEELING vs FACTUALLY effective?"
An example study that I don't know how to evaluate: https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3092984/
Other topics/studies are welcome, these are just to pre-answer any "can you give an example" responses.
I don't mind proxying reliability evaluation to a third party if they are considered reliable themselves, but I've not found any general answers for that (and knowing which evaluators in a niche are reliable becomes a chicken/egg problem).
Is it realistically possible for us to have confidence in "facts" outside our areas of expertise without an intense level of effort? <comment><USER2> It's difficult. The internet if full of crackpots and overhyped press release from the universities, so read a lot, but be aware that a lot of that is misleading or false.

Some pessimistic tips:

* Ignore any result that has less than 5 years. In 5 years it should have been confirmed or debunked. Enjoy the news and try to keep track of them for 5 years ...

* Look at the Wikipedia page. It's not 100% sure but at least there is a good chance that someone review the content.

* Photos or it didn't happen. (Preferably videos.) What evidence are they providing? Has anyone reproduced the experiment?

* Some field like nutrition have an history of extreme claims that are proven wrong a few year later. (How many eggs should you eat per week?) Assume that all field have the same level of rigor. After 10 or 15 years you can start to assign more reliability to some fields. (Why your phone battery is not 1000000 better than now?)

* Peer review is good, but not infallible. In particular be aware of p-hacking and publication bias. Also there are good and bad journals.</comment>


French workers win legal right to avoid checking work email out-of-hours - <AUTHOR> https://www.theguardian.com/money/2016/dec/31/french-workers-win-legal-right-to-avoid-checking-work-email-out-of-hours <comment><USER2> I've generally considered out-of-hours checks to emanate from employees. There will always be employees who want to do a bit of extra, stay a bit longer, answer emails at 10pm, to help make progress in their career and get promotions.

Now, you obviously can't prevent these people from doing that without disabling corporate accounts and door access between 5pm-9am. So there will be people doing that, to appear in better light than others. The practice just spreads to less ambitious employees as well, and then to less motivated ones.

While I support that you should be able to cut off work after the day is done and switch to your free time I don't see how you could regulate something like that.

To even try you would have to ban giving promotions to people who work some extra for their employer (remove the incentive to do extra) or give some sort of employment protection to people who do disconnect (pretty much like you can't fire an employee who's pregnant or on parental leave because such is collectively agreed to be worth some serious shitstorm).

In the end, the only enforcement I can think of is that each person needs to make that decision themselves. If they value their free time and life outside work then they must equally deprioritise work in their life, to the extent where they might be fired because they will disconnect from work outside of the hours agreed, and then find an employer who shares the same values. If good employees do that, employers will have to realise that in order to retain or get good employees they must give in and let the employees enjoy their free time in peace. Now, the only problem is that there is always someone more hungry for money than you, willing to sacrifice more than you. The remaining question is that which people are the majority.

<comment><USER3> A sane and simple solution seems to be that any email sent after 8pm is delayed by the company smtp server, and will actually be sent at 6am.

You can still check your emails and get stuff done. But stuff will not accumulate after 8pm, you will not be bothered by other employees working at night, until early morning.

This configuration of the smtp server can be billed $5/employee/month which is a bargain to make sure your employees (1) have a sane life after 8pm and (2) can still get stuff done if they want to!

<comment><USER4> 8pm in which time zone?

<comment><USER5> Recepient's zone I imagine.

<comment><USER6> I think it has to be the sender's time zone, to disincentivise working late.

Also, a mail can have multiple recipients, each in a different timezone, but only one sender.

</comment></comment></comment></comment></comment><comment><USER7> Agree with this. Best thing I ever did was remove all work related apps from my phone. That way I only checked email if I'm on the laptop. More advantages include: saving on your phone bills, storage on your phone, employers spying on you, and of course your sanity. Doing this, I found that most "urgent" emails were not really urgent.

Also if there is ever a lawsuit for whatever, the company has a right to seize your phone if there is company content on it.

<comment><USER8> Same here, if it's really that urgent someone will eventually call.

<comment><USER9> I like how old tech limitations acted as a natural weighting. Now with everything possible all the time we somehow loss an important source of information.

<comment><USER10> I was just thinking about that the other day, as it relates to kids and TV.

You definitely _can_ still limit children's TV watching, but they're not dumb, and it takes more effort now that they know you _could_ play an episode of their favorite show on Netflix any time you please than when your hands were tied by the broadcast schedule. "Sorry, you'll have to wait for next Saturday" was an easier sell when it was impossible for you to do anything about it (well, tape, but if you hadn't already recorded it there was nothing that could be done after the fact).

<comment><USER9> I meant more about value attached to signals. Before if someone came to see you it meant they made some effort compares to a SMS. Now that everything is the same, lines are blurred and we feel overwhelmed.

</comment></comment></comment></comment></comment><comment><USER11> I barely check work email at work. One of the nice things about having slack, at least at my company, is that no one seems to communicate outside of business hours anymore.

<comment><USER12> My team has largely switched to slack as well. Initially I had it installed in my phone, and so then I would look at it anytime I got a message, even outside of work hours.

I wiped and reset my phone recently, and apparently IBM has upped the security requirements to sign into Slack since I first set it up: now I can't sign in on my phone for an undisclosed reason. (Probably because its rooted, I know that's why I'm not allowed to have my work email on my phone.)

It's been kind of nice, honestly.

<comment><USER13> How do they know the phone is rooted if you are just getting emails? Or do you mean they don't like it when you do, but have no way to really know?

<comment><USER14> I don't know about rooted but Microsoft's Exchange App on Android demands that it becomes a device admin so it can remotely delete everything on your phone if your company desires. There is an app called MailWise[0] that will allow you to get around that though. I did this as my company pays for my phone nor my service yet demands I install their email on my personal device.

[0][http://support.mail- wise.com/knowledgebase/articles/391797-w...](http://support.mail- wise.com/knowledgebase/articles/391797-what-is-exchange-security-bypass-and- how-to-use-it)

<comment><USER15> My wife had a similar problem at work a while ago. Policies changed and the company required the ability to wipe her phone in order to get email on it. She basically told the company that, if they wanted her to have access to email/calendar on her phone (given that requirement), they would need to provide her with a company phone. She went for a couple months without access to email/calendar (when not at the computer) and then they provided a company phone.

Giving your company (or anyone) total access to your personal phone is insane. Your phone, with access to your email, is effectively a master key to your life. Through it, they have the ability to do almost anything to you (reset your bank password and take all your money, etc).

</comment></comment></comment></comment></comment><comment><USER16> Making it harder to fire employees for another reason might protect the existing jobs, but it lacks the foresight to understand that these practices simply disincentivize employers from making future hires in the country. As a result, this is another move by the French gov to protect the status quo. The French labor market has already been regulated to the point of anti- competitiveness. This immediately hurts younger workers who are willing to work harder than their entrenched counterparts, but instead find themselves unemployed at a rate nearing 25%. More business as usual for paternalistic government lawmakers.

<comment> yjftsjthsd-h But in this case the alternative is to punish workers for having work/life balance. The "younger workers who are willing to work harder than their entrenched counterparts" are an actively harmful influence, and all this does is level the playing field.

<comment><USER17> > The "younger workers who are willing to work harder than their entrenched > counterparts" are an actively harmful influence

Even if that's true, the solution should not be to actively penalize young workers, which this might do.

<comment> yjftsjthsd-h Given that the rule is uniform, I'm curious how younger workers are penalized? I'd expect everyone to benefit here.

</comment></comment></comment></comment><comment><USER18> There is a discussion about this going on my company whatsapp group and all are talking about how good it is to respond to emails at any time of day or night. The company has a culture of pushing people to work more and more? Think you have too much in your hands? Guess what, everyone else does as well so it's no big deal. Sometimes I feel I am in the wrong type of company

</comment><comment><USER19> Will be interested to see studies of cultural effects as time goes on.

</comment><comment><USER20> To all fellow software engineers out there: STOP reading company emails after work ALREADY! I don't care what your boss has told you or what your co-workers do. Just don't do it.

Warning: this only applies to regular office workers, not management or freelancers.

Are you getting paid for checking company emails after working hours? You are not, right? How is offering your limited, private time FOR FREE to a company worth it? Is your private life SO boring, you need to do something that many of us do not even like doing during office hours? Are you afraid to be the only one in your team to bring some sanity? Do you think your boss is going to respect you less if you put clear boundaries between work and private life? Do you think you might lose your job if you don't check emails at all hours? Might be time to start looking for a new job...

I know, this post is a bit on the rough side, but I'm just trying to challenge the status quo for some people. I have personally met a lot of good, nice people who would think that they MUST do stuff for the company for free, after hours. Without any good reason. Actually, I had this one colleague who would check emails even very late at night, and if there was someone reporting a bug would jump in and try to fix it. And guess what? Countless times his code was really bad and it caused many more issues than it intended to solve in the first place.

<comment><USER21> > Is your private life SO boring, you need to do something that many of us do > not even like doing during office hours?

Yes. Or rather, what happens at work is so interesting that it usually beats refreshing reddit for the 5th time in 10min while in the train.

<comment><USER20> Why not start a little side-project? Try new things? Or maybe find a hobby that is going to fill those boring hours with joy?

<comment><USER22> You write: _" fill those _boring_ hours"_

... in response to what the poster actually wrote: _" work is _so interesting_"_

If you're _rewriting_ what the poster wrote into words of opposite meaning, it doesn't seem like you're engaging in real discussion.

<comment><USER20> What are you even talking about?

<comment><USER22> "interesting" != "boring"

When the poster writes a response, one can either honestly try to understand his position, and then ask followup questions that are relevant to what he _actually_ wrote.

It seems like you didn't do that. Instead, you distorted his choice to read work email as "boring" and therefore, your followup questions (side projects? hobby?) had the tone of "lecturing" about his habit.

In reading all of your replies to everyone, the gap in your worldview is that _some non-managers like their work_ such that reading email outside of office hours is a natural response. However, that doesn't mean everyone should do it. For workers that feel strongly that reading email after-hours is wrong, telling others not to do so isn't going to work.

If some people have different viewpoint about after-hours email, are you interested in thoughtful discussion about it? Or do you prefer to lecture people regardless of what they say?

</comment></comment></comment></comment></comment></comment><comment><USER23> You don't have to do it in the United States, it's just that your coworkers will.

In reality it has never made a difference for me. I can quickly scan my email inbox and if anything is urgent and important it's known that you should either call or speak to me in person.

</comment><comment><USER24> Ridiculous. You have a moral right to refuse to enter into an employment contract that obligates you to respond to emails out-of-hours. You do not have a moral right to prohibit business owners from offering employment terms that include an obligation to respond to emails out of regular work hours.

Once again, demagoguery wins over human rights. And people wonder why Europe's economic growth rate has steadily stagnated over the last forty years. The answer is social (demagogic) democracy.

<comment><USER25> I think what's more ridiculous is unpaid overtime and letting employers, who naturally have the upper hand in any employment negotiation, set the rules for all employees in the exploitive manner the US does.

<comment><USER24> People have every right to refuse to enter into an employment contract that imposes such obligations.

What they don't have a right to do is deny employers the right to offer any terms they want. You're promoting authoritarian infringements on the right of consenting adults to engage in voluntary interactions.

<comment><USER26> Yes indeed, and it's also a disgrace that children lack the freedom to work! Many children want to work in factories, why let the state interfere? Absolute bollocks.

<comment><USER24> Children are not "consenting adults", but in any case, child labour was essential for survival in the 19th century, because productivity was much lower than it is today.

If you were to invade Myanmar today, and impose a social democratic government that bans child labour, the result would be an increase in mortality.

Child labour only became unnecessary as a result of economic development increasing the average level of wealth in society.

Going back to the article, it's telling that you're trying to justify the authoritarian prohibition by comparing adults to children. Your ideology sees ordinary people as effectively children, and the state as their parent.

<comment><USER26> Then how are workers supposed to win better terms from their capitalist employers, outside of collective bargaining or state intervention? Is a football player being infantilized when he joins a union -- because he ought to be able to negotiate contracts by himself? When a union helps him extract a more equitable share of the profits, is he being infantilized, or is he being smart?

You're free to frame this argument in terms of individual rights or "economic competitiveness" or state paternalism. Unfortunately it amounts to little more than economic handwaving. At worst it's a disingenuous ploy to undermine the interests of the labour class, deluding workers into thinking you're giving them economic rights and freedoms ("you should be able to choose when you work!") when really you're just justifying your extraction of an even bigger share of their labour.

The common labourer has no economic power. The state, the firm, and (to a diminishing extent) unions do. I hate paternalistic states (and unions) as much as you do, but when you place no limit on firms' ability to extract labour from their workers, you end up in twisted situations where people are being paid sub-livable wages and expected to be on call 24 hours. Not because it's an economic "inevitability" (child labour inevitable? You seriously believe that?), but because it's the most amenable socioeconomic arrangement for the capitalist class.

<comment><USER24> >Then how are workers supposed to win better terms from their capitalist employers, outside of collective bargaining or state intervention?

I recommend you study a bit of economics.

Start with Adam Smith:

>It is not from the benevolence of the butcher, the brewer, or the baker that we expect our dinner, but from their regard to their own interest.

Then read this:

[http://nyti.ms/2cfMjs4](http://nyti.ms/2cfMjs4)

This isn't free market dogma. This is what 400 years+ of economic history shows us, and what any economist would confirm.

Wages and benefits improve as the wealth of society increases, and wealth increases as a part of the normal course of history, particularly when market institutions are strongly in place. Wage growth slowed as a result of the institution of economic-growth-destroying socialist laws and programs in the US and Europe.

And putting all of this aside, you have no moral right to violate another person's right to freely contract to increase your own wages. So even if economies didn't work as they do, such authoritarian prohibitions would be unjustiable.

<comment><USER26> And I recommend you read some Dickens. Good night.

<comment><USER24> I can't stress enough that the conditions found in Dickens's time had nothing to do with a lack of prohibitions limiting contracting rights, and everything to do with people being poor and technology being less advanced.

That is what all the statistical evidence suggests.

Anecdotally, I've spent a fair bit of time in the developing world, and to me at least, it's obvious that the root source of the difference in working and living conditions between the developing world and the developed world is the comparatively lower levels of capital (tools, equipment, machinery, social capital, skills, knowledge) in the developing world.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER27> France as usual leading in workers' rights.

<comment><USER28> More like France catching up to the US. This is already the law in the US for hourly employees, which is what the new law in France is scoped to.

<comment><USER29> That's funny. Most people who are working in a place where they would be pressured to continue doing work after hours are not paid hourly.

And then there is those long term contractors that are hourly but basically on a fixed number of hours per week who still are 'encouraged' to do what little extra is needed to get this project done so their contract can be renewed for the next one once they've shown they can be counted on.

<comment><USER28> > That's funny. Most people who are working in a place where they would be > pressured to continue doing work after hours are not paid hourly

Whether or not they are paid hourly, as long as they are not classified as exempt, they are entitled to overtime pay. (Tech workers are classified as exempt in California, which is indeed a problem and IMHO a mistake, but that's a much smaller issue)

> And then there is those long term contractors that are hourly but basically > on a fixed number of hours per week...

Well, that's a bad way to write a contract, but even so, that's a totally different situation because they're not even an employee. And the French law referenced in the original article wouldn't apply in that situation either.

</comment></comment></comment></comment><comment><USER30> Same shit, different toilet.

<comment><USER31> Please don't post unsubstantive comments.

We detached this comment from [https://news.ycombinator.com/item?id=13291386](https://news.ycombinator.com/item?id=13291386) and marked it off-topic.

</comment></comment><comment><USER32> I'm not exactly sure this is "winning a right". It's something that makes it more difficult to serve customers.

<comment><USER33> Out of hours? So you should check email at 03.00 just in case some insomniac customer needs something that you can't probably fix/send/prepare till next day. That's called slavery even if it's volunteer.

<comment><USER34> > 'insomniac customer' ...

Many companies these days have branches in all parts of the world. 1) Out of hours for oneself could be perfectly office hours for the customer. 2) you might be the only person knowing this part of the product or tech, and all is required could be just a quick yes/no answer.

I am not advocating for either side, but please -- the world is more complex than it seems.

<comment><USER33> Then my boss should contract some people that can service that customer during their work hours and the rest I'll answer the customer in my work hours, that's what i'm paid for, if my boss wants me 24 hour service he/she should pay me for it, otherwise it's voluntary slavery. They pay me to do my work during my hours not to be at his/her wishes.

<comment><USER34> > Then my boss should contract some people that can service that customer > during their work hours...

See my pt 2.

> if my boss wants me 24 hour service he/she should pay me for it...

I think your boss wants result from you, not any random metrics like 24 h/on the job. If you consider that you are underpaid for the result you have been delivering -- have you demanded a raise?

<comment><USER35> Re: point 2 - having a sole member of the team be the only person who can answer an urgent question is a failing, and a fairly obvious and large one, of the company, for reasons beyond just working overtime.

Think about it - were you in the managers shoes in this position, you're forcing someone who is the only holder of critical knowledge of your business to work extra without compensation, and against his will - don't you think there's a pretty big risk there?

Regarding metrics, I think any manager who has even a tiny bit of empathy for his employees would realize that "time spent at work" (or more accurately - time spent _not_ at work) is an _incredibly_ critical metric for his employees' well being, and any discussion should look at what's important for the business as well as the employee.</comment></comment></comment></comment></comment></comment>


Demovfuscator - <AUTHOR> https://github.com/kirschju/demovfuscator <comment><USER2> Previous HN discussions on the movfuscator:

[https://news.ycombinator.com/item?id=9751312](https://news.ycombinator.com/item?id=9751312)

[https://news.ycombinator.com/item?id=10021259](https://news.ycombinator.com/item?id=10021259)

</comment><comment><USER3> From movfuscator's FAQ [1]:

Q: Why did you make this? A: I thought it would be funny

Is the motivation of demovfuscator to be not funny?

[1] [https://github.com/xoreaxeaxeax/movfuscator#faq](https://github.com/xoreaxeaxeax/movfuscator#faq)

Edit: Not sure why the down vote. It was intended as a joke, if it means anything

<comment><USER2> _> Not sure why the down vote. It was intended as a joke, if it means anything_

My guess (I didn't downvote you) is that your post added nothing to the discussion. Joke posts tend to be frowned upon here.

</comment></comment><comment><USER4> For people wondering what movfuscation actually is and how it works: [https://www.cl.cam.ac.uk/~sd601/papers/mov.pdf](https://www.cl.cam.ac.uk/~sd601/papers/mov.pdf)

</comment><comment><USER5> I know that capstone, keystone and unicorn are marketed to the "security community" but these projects are some of the most promising I've seen for programming in general, e.g., for the few people who still might want to write small, simple (and fast) programs that run on multiple architectures.

Great work.

(This project relies on keystone and capstone.)

</comment><comment><USER6> I wonder how well it can work once you mix different variants of the movfuscator (using xor or load instead of mov etc).</comment>


A note to Y Combinator - mkr-hn https://plus.google.com/111091089527727420853/posts/aLgYnGJ77er

<comment><AUTHOR> I agree watching 63 presentations is burdensome for journalists. But Demo Day is designed for investors, not journalists, and for investors watching 63 brief presentations is way less burdensome than having even half that many individual initial meetings.

</comment><comment><USER2> In my humble opinion: if YC has found a way to scale up to 63 (or more) companies per session and the media is having a hard time documenting everything on demo day, perhaps the two should be separated into a demo day and respective media day. It may even warrant a longer durration of time per activity.

</comment><comment><USER3> I agree...when there were a dozen startups in a class (circa 2007), you could keep track of them in your head, and the various blogs could fit them all in a single article. I think there's a point where the class size is so big that you'll start seeing more "Top 5 YC Demos" or "10 YC Startups to Watch" articles while the others get less coverage. I think a rolling (even overlapping) set of classes with multiple demo days might do the trick.

</comment><comment><USER4> I agree, but only because 62 is my favorite number. Its the age when you can reverse your mortgage. House pays you.</comment>


Discrete Mathematics and Functional Programming - <AUTHOR> http://cs.wheaton.edu/~tvandrun/dmfp/ <comment><USER2> I too took this course as a freshman, and it was one of the most enlightening things I've ever done for my software engineering career. It's worth getting the most recent copy--it has a lot of corrections and entire new chapters on interesting things (automatons, lambda calculus, lattices, graphs...)

Let me know if you have any questions about its content or my experience.

<comment><USER3> There is a way on buy an digital copy (no US citizen here) of this book (new edition)? Don't find any in Google/Amazon.

<comment><USER2> There's one for sale here: [https://www.redshelf.com/book/16734/discrete- mathematics-and...](https://www.redshelf.com/book/16734/discrete-mathematics- and-functional-programming-9781590282663-thomas-vandrunen)

<comment><USER3> Thanks :)

</comment></comment></comment></comment><comment><USER4> See also "The Haskell Road to Logic, Maths and Programming" which seems to cover similar material, although not as much.

[http://homepages.cwi.nl/~jve/HR/](http://homepages.cwi.nl/~jve/HR/)

I am still waiting for someone to do this for applied maths.

<comment><USER5> Available here: [http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.137...](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.137.9312&rep=rep1&type=pdf)

</comment></comment><comment><USER6> Wish I could've done a course like this in college! I suspect it would bridge a lot of missing gaps from my maths education.

<comment><USER7> Did you take a Discrete Mathematics course at all? At Georgia Southern Discrete Mathematics is a required course for all IT and CS Majors. Struggling with my other math classes (College Algebra, Survey of Calc) that class created a good bit of anxiety for me, until I actually got into and realized to me at least it was not like any of the other math classes.

<comment><USER6> Did a bunch of it. Had a blast. But our CS courses were object oriented stuff in Java. Useful, but not very 'mathy' imho.

</comment></comment></comment><comment><USER8> The book appears to be available as a PDF at:

[http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.115...](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.115.9659&rep=rep1&type=pdf)

<comment><AUTHOR> The PDF is from 2006 and contains 231 pages.

The printed book is from 2012 and contains 670 pages (including index). I bought a used copy of the book from Amazon for $27.

<comment><USER9> Are you a current student?

<comment><AUTHOR> No, I often buy used text books when I find them cheap so I can fill in what I missed by skipping out on a degree.

I have a separate title on discrete math (Epp) but its companion only had some solutions to exercises available in a separate $60 [used] book. I found this title and figured that with the intersection of ML and discrete math I'd have better luck. (Staring at a ton of problems in a text book without knowing which ones I'd be able to verify my solutions against - the Epp book - was a daunting prospect for self-study).

</comment></comment></comment></comment><comment><USER10> Fun to see this here. I TA-ed for this course--one of my favorite undergrad classes. I highly recommend picking up the full book. The merging of proof and program is really cool as a way to teach CS concepts.

I'm actually working on porting a lot of the examples over to idiomatic Clojure. Email me if you're interested in following the progress there.

<comment><USER11> You were my TA! I emailed Dr. VanDrunen to let him know that he was on HA.

</comment></comment><comment><USER9> I took this course as a freshman CS Major at Wheaton College and helped edit Dr. VD's textbook. He used to give extra credit for finding typos in his book. I got a bad grade on one of the exams and then came to him the next week with 20+ corrections to his book.

It was a great course and VanDrunen is one of the best profs I've ever had.

</comment><comment><USER12> Really great book! I took this course as a sophomore and wish I had as a freshman as the ideas and themes presented in the book and course are so integral to forming proper thinking in the subject of programming.

</comment><comment><USER13> Just a note "I am produce a series of videos to accompany the text" was bugging me. Its nice that this is available for their students.

<comment><USER9> You should let a current student know about that. I think he still gives extra credit for mistakes.</comment></comment>


Microsoft's First Windows XP Patch in Years Is a Bad Sign - <AUTHOR> https://www.wired.com/story/microsoft-windows-xp-patch-very-bad-sign/ <comment><USER2> XP has been out of support for 5 years. I get it, IT is hard and expensive, but you've had 5 years (and multiple years leading up to it) to find a solution. At this point it's your fault, not Microsoft's or your software vendor's.

<comment><USER3> I look at it another way.

XP is almost 18 years old. If you were running an 18 year old operating system in 2010, you'd have been running Windows 3.11 while everyone else is on Windows 7.

Running XP now is like running Linux Kernel 2.4 today.

If the computer in question is connected to any network, to keep it so out-of- date is simply irresponsible.

<comment><USER4> Not particularly. Most large enterprise networks rely upon many more layers than the OS to protect and secure their infrastructure.

The cost and logistics involved in replacing legacy systems trumps the need/inability of highly skilled engineers to protect an old OS.

<comment><USER5> And yet attackers routinely make it onto "secure" networks and stay ahead of attack signature databases.

Other layers might save you, you hope, sometimes. It is still irresponsible. Most actively developed and diligently patched software is bad enough; after EOL it is beyond the pale.

The cost needs to be properly internalized so that getting owned really is more expensive than migrating legacy; today I'd have to agree with you that it isn't.

</comment></comment></comment></comment><comment><USER6> More "let's hate on Microsoft because it's trendy" bandwagoneers. I guess the 25 year old vulnerability in bash was not a bad thing, eh? Or scp's 35 year old vuln did not affect anyone? Come on, people. Stop acting like Microsoft is the only vendor worth criticizing

<comment><USER7> That's not what I took from the article at all. Here are the two points I got:

1\. Microsoft is releasing a patch for Windows XP, which is odd because they no longer support it. This could indicate that a very serious vulnerability is about to be revealed - one which likely goes beyond XP itself.

2\. There are still far too many computers running Windows XP. Doing so is a dangerous practice - especially if the device is networked - and keeps getting harder to justify.

</comment></comment><comment><USER8> A bad sign? Far from it. It's good that they're still supporting a vintage OS when it matters, even though Windows XP users really should have moved to better options (GNU/Linux, ReactOS, whatever) by now.

<comment><USER9> consumers who buy and use ten year old machines to read facebook and email their grandkids aren't going to install reactos

</comment></comment><comment><USER10> Actually, support for XP for POS terminals was terminated on 2019-04-09, that is, less than 2 months ago. One may argue that a POS connected to the Internet would be a no-no, but the hack that enabled faking normal XP installs as POS devices to keep getting updates has been well known for years, and just a registry key away, so the number of connected XP/"POS" devices might well be much higher than expected.

</comment><comment><USER11> >The saving grace for all of this is that computers running Windows 8 and up aren't affected.

Burying the lede? The implication here is that all unpatched Windows 7 computers will be utterly pwned within 24-48 hours of that announcement - i.e. a week ago. That's _way_ more serious than a Windows XP problem. Tons of people are still on Windows 7 - justifiably.

<comment><USER12> There really isn't a justifiable reason to use windows 7 anymore.

<comment><USER13> There absolutely is. A significant amount of software hasn't been updated to work on Windows 8/10\. If you need a specific piece of software that only works on Windows 7, that is a perfectly justifiable reason.

Windows 7 is only 10 years old at this point.

<comment><USER14> I still own perfectly functioning hardware... but functioning only if the Windows 7 is running on it. Nobody made newer drivers: Intel didn't and Microsoft didn't. And the hardware is surely nothing obscure: it's the Intel chips.

</comment></comment></comment></comment><comment><USER15> WinXP is still very much alive in the retail sector. Retailers are extremely sensitive about migrating their systems.</comment>


Last.fm is ending their streaming radio service in April - <AUTHOR> http://www.last.fm/forum/21717/_/2226535 <comment><USER2> I am more disappointed by the comments than the announcement itself. The first few comments seem to be blaming last.fm for 'giving up' without actually trying to understand why they made those (extremely) difficult choices.

The music publishing and licensing industry (vastly different from the actual creators, mind you) isn't as straightforward as people believe it to be. Music licenses are extremely tricky and (often) subject to the whims of the publishing labels.

There is no standard rate for a licensing specific tracks (or set of tracks) and the licenses that are available in the market are either too broad and expensive or too narrow and useless.

The entertainment industry in general is a mess - nobody knows how to handle the internet as a viable platform and nobody is willing to risk their profits to attempt and make mistakes either. They are trying to force an outdated method built for a one-way channel (needle-hour plays) on a platform that primarily believes in two-way interactivity.

In other words, they are trying to license content by syndication in a world where RSS, APIs and interactive conversations are the norm - not only is it a ridiculously laughable concept, but it goes against the very grain of the entire thing.

The whole entertainment publishing and licensing industry is in dire need of an overhaul. Unfortunately, the question everyone is too busy asking, is the question everyone should be trying to answer together: "Who will bell the cat?"

<comment><USER3> The Music and Video game industries are already "fixed". The web is bursting with quality independent content that is either Free, free or priced well and delivered without DRM. The choice is already there, it's no ones fault but your own if the only content you care about is the stuff pushed by these toxic companies.

Your comment does seem to apply to the TV and Film industry though. An indie film equivalent of Bandcamp would be great. Bollocks to the current movement with their film festivals and limited screenings, at least make a fucking effort to be accessible.

<comment><USER4> Would you provide links? I would be interested in them.

<comment><USER3> Is there something specific you would like me to link? I'm really not exaggerating when I say the web is overflowing with this content. I could link some of the "big" names, but for every one there are dozens or hundreds of similar sites. It's never-ending, especially since almost every indie artist/dev promotes other indies.

[https://bandcamp.com/](https://bandcamp.com/)

[http://www.jamendo.com/](http://www.jamendo.com/)

[https://soundcloud.com/](https://soundcloud.com/)

[http://freemusicarchive.org/](http://freemusicarchive.org/)

[http://itch.io/](http://itch.io/)

[http://www.gog.com/](http://www.gog.com/)

[https://www.humblebundle.com/](https://www.humblebundle.com/)

[http://www.indieroyale.com/](http://www.indieroyale.com/)

[https://libregamewiki.org/Main_Page](https://libregamewiki.org/Main_Page)

<comment><USER5> Don't forget [http://www.ektoplazm.com/](http://www.ektoplazm.com/) . Completely free music, mostly psytrance and dance, 100s of cds worth, you can't even buy it if you wanted. Lots of it is very good. The business model for artists seems to be to release free music and get yourself promoted enough that you get invited to DJ at electronic music festivals. The record sales are total peanuts so why even bother. The site crowdfunds redesigns and such but mostly people work on it because they really like the music.

</comment></comment></comment></comment></comment><comment><USER6> If last.fm disappoints you, consider helping GNU FM by improving the software, using [http://libre.fm](http://libre.fm), or starting up your own GNU FM server.

Libre.fm is the main instance of the GNU FM software. GNU FM is compatible with the audioscrobbler API and supports streaming. Additionally, you can mirror your scrobbles from GNU FM to last.fm if you want. Libre.fm is a great if you want to check out some free culture music.

<comment><USER7> I guess it can only stream libre music though ?

I can't imagine how it could stream music from artists I already know..

<comment><USER6> It is the policy of libre.fm to only host free culture music, but that doesn't mean that you (or another motivated person) could take GNU FM and start up a service that streams music that's licensed differently. Provided that you have the right to do so, of course.

<comment><USER8> Unfortunately (from the perspective of a songwriter), a lot of people will take that as wink-wink nudge-nudge. Anyway, a non-profit streaming service that is voluntarily populated _only_ by indie artists that control their own licensing terms (in exchange for revenue share) would a good thing.

<comment><USER6> What is "wink-wink nudge-nudge"? Do you think I'm promoting violating licenses?

I'm a musician, too. I meant that someone could start a GNU FM service and stream music that has been licensed legally from musicians.

<comment><USER9> pertinent [http://youtu.be/ona-RhLfRfc](http://youtu.be/ona-RhLfRfc)

</comment></comment></comment></comment></comment></comment><comment><USER10> I've been scrobbling for many years, and marking tracks as "loved", but never used the radio itself. I used the recommendations for new music and events, and now I use Spotify for listening music, and the last.fm app inside Spotify to discover new music. It works pretty well for me.

</comment><comment><USER11> Well, that sucks! I've discovered so many awesome bands and great songs over the years from Last.fm's streaming service, including a lot of underground stuff I wouldn't expect a site like that to have. I always wondered how they managed to keep the doors open without a paid service. Guess they cant =/.

<comment><USER12> Try grooveshark, they also "similar artists". It's less precise - it shows artists which are quite different (but I can imagine people listening to them both) but that may be an advantage you get a wider set of bands

<comment><USER13> This is an interesting problem. I want to discover new music, but not at random. However, being offered a whole lot of "sounds just like" music tends to reinforce a local maxima (so to speak).

What I want are people with taste kinda-sorta like mine to tell me, Hey check this is out, and pass me something _not_ like everything else I listen to, yet somehow in the realm of stuff I might probably like.

<comment><USER14> I had a similar problem and Grooveshark helped me (But they now removed that feature, I've complained but they don't care.)

My hack was to search for playlists containing a song I liked. So I would find a "rock" playlist with lots of songs I knew but a couple very good ones I didn't.

As a startup idea, I was thinking of a "Github for playlist". Basically, abstracting the different "streaming" services and really focus on the quality of the playlist.

Anyone could fork your playlist, add a few songs, and do a "pull request". The cool thing is how I could be subscribed to your playlist and since I trust your taste, I would get notifications when you add or accept new songs.

I see some kind of hierarchy where there could be "stable" playlist that are updated conservatively but also other "unstable" playlists where it changes often so you can discover more song.

That would definitely be a service I would use by following other good playlists but also curating mine and welcoming suggestions from friends.

<comment><USER15> _Basically, abstracting the different "streaming" services and really focus on the quality of the playlist._

bop.fm of YC S13 is doing exactly that. Their UI is way too clunky for me to think about using it yet, but the idea is solid

<comment><USER14> Hey, I've just tried it, that's great. As you said, UI is very clunky but I managed to explore and listen to new songs based on songs I already liked thanks to the playlist of other users.

</comment></comment></comment></comment></comment></comment><comment><USER16> Was being acquired by CBS the deathblow to Last.fm? It seems they easily could have been the social network for music, but they never really innovated beyond their streaming radio and scrobbler products.

<comment><USER17> I find it strange how slow Last.fm is to do anything. I've been a user for 9 years, and almost nothing has changed in that time. You're lucky if you get one minor feature update in a year - they seem to be incredibly slow moving.

That being said, I'd be very sad if they closed, though I assume a competitor which could import your Last.fm history would spring up very quickly for those who only want the data history and not streaming.

</comment></comment><comment><USER18> Here is the best link to transfer you data from Last.fm to Libre.fm: [http://www.omgubuntu.co.uk/2010/09/easily-export-you-last- fm...](http://www.omgubuntu.co.uk/2010/09/easily-export-you-last-fm-scrobbles- to-libre-fm)

See that they say that the scrobbling service will still work. No FUD here, but since some applications allow multi-scrobbling now, it is just a tip.

</comment><comment><USER19> If Spotify can sell unlimited streaming for $9/m why can't last.fm? I'd rather pay $9 (or more) to last.fm for the same streaming service along with scrobbing and their much better discovery engine.

<comment><USER8> I think it's because Spotify is debt-financed and can't actually afford to sell unlimited streaming for $9/m, even though they're doing it. It leads to listeners feeling entitled to their streaming, and seeing music publishers (which are often the songwriters themselves) as the bad guys for not accepting lower royalties.

</comment></comment><comment><USER20> Is this pretty much the end of last.fm, will they be able to keep paying subscribers without streaming radio?

</comment><comment><USER7> This is very sad - I don't know how else to listen to a mix of music I like along with new music throughout the day.

<comment><USER21> Do you know Pandora? If you can't access the site, you could use a browser extension called "MediaHint". There's also [http://rd.io/](http://rd.io/).

<comment><USER7> I'm not sure that pandora is available in the UK ?

I tried it when it started and wasn't so keen on the recommendations... might try rd.io

</comment></comment></comment><comment><USER22> AFAIK, Last.fm has the largest library and listening data on the Internet. However the only remarkable feature that they offer was the radio and they will end it. They couldn't use that power in order to create a paid music streaming service like Spotify or Rdio. I really wonder why they didn't even try it.

<comment><USER23> I agree it is a bit mind-boggling, they have the users who love their service. I love having my history there and they are the only ones other than iTunes that know so much about my music tastes.

Bands have even got big on last.fm, MGMT pretty much hit it big on there: [http://en.wikipedia.org/wiki/MGMT](http://en.wikipedia.org/wiki/MGMT)

</comment></comment><comment><USER24> I think theres a good opportunity here for people considering getting into the streaming space. For example, SoundCloud and Youtube allow you to access streams without tying yourself in with DRM. Artists want to be heard and fans want to be able to access that content easily. With services out there being really good for publishing music, a streaming service that allows an artist to directly engage their fans would be really interesting.

The challenge is creating a community for both the musicians and fans to interact meaningfully. Musicians want to be free from being lumped in with the noise and fans want to be explore that content freely. I think for most streaming services out there, this hasn't really been totally figured out, although Spotify and SoundCloud are trying to.

<comment><USER25> That's far from an original thought :)

Problem is, it's like a pot of gold in the middle of a minefield. No one seems to be able to put the whole puzzle together in a way that pleases all the stakeholders. Just the other day, Twitter bowed out of the space, as well.

</comment></comment><comment><USER26> :(

Last.fm had a huge library of music, about 100 times more variety than Pandora has. I discovered tons and tons of bands, that are obscure in other countries.

This is a huge blow to my listening experience and I'm sure will hurt a lot of obscure bands from being discovered.

<comment> guard-of-terra Consider vk.com :)

</comment></comment><comment><USER27> At least scrobbling will still be around.

<comment><USER28> Why is that good?

<comment><USER29> On my end? Because I've logged 162,000 tracks since 2004/01/14, and would like to keep building this database for as long as possible.

Edit: Approximately 11,000 hours worth of listening time has been kept track of for me thanks to last.fm. About 12% of my life-hours since 2004/01/14 are accounted for in my last.fm data.

<comment><USER30> Please consider backing up your data.

[http://webapps.stackexchange.com/questions/3080/how-can-i- ex...](http://webapps.stackexchange.com/questions/3080/how-can-i-export-track- scrobble-data-from-last-fm)

Also, my project GNU FM (running at Libre.fm, amongst others) can give you a local or private scrobble server that can also talk to Last.fm for you. Indeed, we have federated Last.fm as part of the GNU FM network of federated scrobblers.

<comment><USER31> The link to GNU FM at the bottom of libre.fm leads to a 404: [http://foocorp.org/projects/fm/](http://foocorp.org/projects/fm/)

<comment><USER30> Damn. We're moving stuff around between our boxes at the Internet Archive and our boxes in the UK.

I'll get that fixed.

</comment></comment></comment></comment></comment></comment><comment><USER32> I was using Last.FM the other day and it looks like they were showing off a player that was in Beta. That player was basically just loading YouTube videos. Is this going to go away as well?

</comment><comment><USER33> too bad. last.fm is a great service, and their radio was often better than the equivalent service on pandora/spotify.

guess its time to go back to grooveshark. i've heard it is fantastic lately.

</comment><comment><USER34> This is bittersweet for me, because I loved their streaming services. I'm happy that there are so many (non-Pandora) alternatives now to last.fm streaming, and I'm happy they're keeping their core scrobbling/discovery functionality intact, but it's disappointing that there have been so many obstacles for this company to provide all of its excellent services up to this point. I hope this one day will change.

</comment><comment><USER35> Music industry is screwed in that sense and that's understandable move from LastFM's side.

What I cannot understand from LastFM team is why are they loosing the "Music Events" market (basically, making mobile app easier to discover / add them). I think they could make a huge success in that sense to keep up.

</comment><comment><USER36> I've been on the alternative last.fm beta streaming player for a while. The alternative is using their recommendations and scrobbler for youtube hosted content. This version is not shutting down. It could use a little curation, but overall I haven't minded the switch so much.

</comment><comment><USER37> After TT, this sort of shakeout is unsurprising.

Pandora and Spotify are ripe for moves. And Rdio possibly.

</comment><comment><USER38> Anyone here that knows a way to export all (my) scrobbles?

<comment><USER39> Not exactly what you asked for but I spent about 5 minutes searching.

1\. I navigated to [http://last.fm/api](http://last.fm/api)

2\. I immediately found [http://www.last.fm/api/feeds](http://www.last.fm/api/feeds)

3\. From there I found [http://ws.audioscrobbler.com/1.0/user/CGamesPlay/recenttrack...](http://ws.audioscrobbler.com/1.0/user/CGamesPlay/recenttracks.rss)

4\. I guessed, and found [http://ws.audioscrobbler.com/1.0/user/CGamesPlay/recenttrack...](http://ws.audioscrobbler.com/1.0/user/CGamesPlay/recenttracks.xml)

5\. The documentation on [http://www.last.fm/api/show/user.getRecentTracks](http://www.last.fm/api/show/user.getRecentTracks) includes info on how to fetch scrobbles during a given time period.

</comment></comment><comment><USER40> I never used it for anything other than scrobbling anyway.

<comment><USER30> If you're just in it for the scrobbling, you might like GNU FM -- run your own scrobbling server in private.

</comment></comment><comment><USER41> I think this has something to do with Spotify acquiring Echonest; I believe Echonest powered Last.fm's recommendation and radio functionality.

</comment><comment><USER42> Consumer services never live on w/o revenue.

</comment><comment><USER43> which means 8tracks won't work? They have to close it down? Because the last time I checked, 8tracks used last.fm to stream music and had limitations like skipping tracks.

</comment><comment><USER44> I loved last.fm back in the day but cancelled my account after CBS bought them.

</comment><comment><USER45> I have had faith in Last.fm when they started, thinking they gonna change the music industry quite a bit. It seems they could not achieve that, but there is a great progress, there are so many music producers preferring the social music sites to distribute their work that sooner or later the music industry we know is going to be dead.</comment>


Ask HN: Distributed tracing service with critical path analysis? - pseudonom- The Dapper paper mentions "An engineer working on long tail latency debugging built a small library which infers hierarchical critical paths from DAPI Trace objects. These critical path structures were then used to diagnose problems and prioritize prospective performance improvements for universal search."<p>Do any of the distributed tracing services (e.g. Datadog APM, AWS X-Ray) offer this? I don't see any services which tout this functionality. <comment><AUTHOR> See if you can find a tool that creates flamegraph input files from the traces, or if not write one yourself. My causal logging library, Eliot ([https://eliot.readthedocs.io](https://eliot.readthedocs.io)), has an experimental branch for that, and it wasn't particularly hard to create the input files.

[https://github.com/brendangregg/FlameGraph](https://github.com/brendangregg/FlameGraph) will then create nice graphs that can help spot bottlenecks.

</comment><comment><USER2> Disclosure: I work at Datadog --

Tracing requests across services and hosts to identify bottlenecks is one reason why Datadog decided to build a tracing component in APM! A flamegraph is one such method to visually infer critical path analysis that Datadog APM supports. Some obvious things to consider are ease of setup and whether the libraries and languages you use are supported. Some not-so-obvious things to consider are:

      (1) whether you wish to infer this from a single request, or across multiple requests,
      (2) how to define "interesting" traces -- as you could be collecting millions or billions of traces in production
      (3) how to create a bigger, "aggregate" picture across individual traces.

We're working on additional ways to easily identify critical paths as well.

</comment><comment><USER3> I think what you're looking for is Zipkin [0]. We use it in our microservers at Nulladmin.com via the opentracing Go library [1] and the zipkin-go- opentracing library [2]

[0] [https://github.com/openzipkin/zipkin](https://github.com/openzipkin/zipkin)

[1] [https://github.com/opentracing/opentracing- go](https://github.com/opentracing/opentracing-go)

[2] [https://github.com/openzipkin/zipkin-go- opentracing](https://github.com/openzipkin/zipkin-go-opentracing)

<comment> pseudonom- My company actually has and uses Zipkin. The thing that I'm looking for that I think is lacking is a way to identify critical paths without manually clicking through a bunch of traces and eyeballing them.</comment></comment>


The Strange Failure of the Educated Elite - <AUTHOR> https://mobile.nytimes.com/2018/05/28/opinion/failure-educated-elite.html <comment><AUTHOR> To me it seems that corporations first went for the "what's best for me" and insane optimization routes while ignoring social responsibility decades before people did individually.

But when people do it, as in the mortgage crisis, it becomes something that is "toxic to society" to the same capitalists that cheered on the large corporations maximizing profits.</comment>


Alphabet revenue climbs 13%, but company warns of slowing ad sales - <AUTHOR> https://finance.yahoo.com/news/alphabet-google-q1-2020-earnings-204421431.html <comment><USER2> "though there have been indications that the firm is undertaking cost-cutting measures".

Are they going to let people go?</comment>


The Numerical Renormalization Group (2016) - <AUTHOR> https://compphys.go.ro/the-numerical-renormalization-group/ <comment><USER2> after all these years I would love a simple explanation of what renormalization group is (at the level of someone that knows non-relativistic qm and has a rough understanding of second quantization)

<comment><USER3> Me too. FWIW I pointed out [https://www.amazon.com/Renormalization-Methods- William-David...](https://www.amazon.com/Renormalization-Methods-William- David-McComb/dp/0199236526) to an expert and they said it looked promising (only based on that page).

<comment><USER2> nice book. thank you</comment></comment></comment>