Naughty Strings: A list of strings likely to cause issues as user-input data - <AUTHOR> https://github.com/minimaxir/big-list-of-naughty-strings <comment><USER2> Creator/Maintainer of the repo here.

I apologize for the lack of updates to the BLNS. (since I'm free today and this is on the HN front page, I'll do a cleanup pass).

Even though it's a GitHub repository with 12.3k stars, there's not much to say or improve on what is effectively a .txt file based around a good idea (I recently removed mentions of my maintainership of the BLNS from my resume for that reason, despite its crazy popularity).

<comment><AUTHOR> The HN submitter here. :)

I happened across it this afternoon and thought it was great!

Do you know of any automation around this? I was thinking of a script that grabbed your list and then hammered a given input filtering library would be awesome. It's not something you'd want to run all the time but pre-major release, it could useful.

<comment><USER2> That is the primary purpose of the JSON files and the parser to convert the .txt to JSON; get the list, run it against a text input field, see what happens.

<comment><USER3> Why do you store the generated JSON file in git btw?

<comment><USER4> Not the maintainer, but I assume because it helps developers looking for it in such a format. Saving them the time of converting is a nice move, IMO.

<comment><USER3> The source and build system are right there, should be easy to generate the other formats?

<comment><USER5> Similar to the other comments, another voice here for appreciating the "pre- built" version being available for quick use. For repo's/sources like this I tend to think of the prebuilt formats as letting me play around with things without any hassle. Once I'm happy with it I'll invest the time to have it build locally for the control.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> You might want to include common unix shell commands. At a previous job we had a customer with the last name of Echo who wasn't able to make a purchase. Turns out our credit card processor blocked them.

<comment><USER7> Jesus. Which credit card processor? That stinks of bad design.

<comment><USER6> Given how often they came under attack, I don't blame them for taking a "belt and suspenders" approach.

<comment><USER8> More like "belt and helium balloons" approach.

</comment></comment></comment></comment><comment><USER9> TIL: `mocha:` was a custom schema that Netscape Navigator used to eval URLs (equivalent to `javascript:`), and Yahoo! Mail would replace it with 'espresso' to attempt to thwart phishing attempts:

[https://www.obscure.org/javascript/archives/msg01369.html](https://www.obscure.org/javascript/archives/msg01369.html)

[https://www.cnet.com/news/yahoo-mail-puts-words-in-your- mout...](https://www.cnet.com/news/yahoo-mail-puts-words-in-your-mouth/)

</comment><comment><USER10> This is a fun issue [https://github.com/minimaxir/big-list-of-naughty- strings/iss...](https://github.com/minimaxir/big-list-of-naughty- strings/issues/16)

<comment><USER11> a painted masterpiece on a bikeshed.

<comment><USER12> I dunno, I think this is a pretty good argument actually:

> I agree that another SQL injection should be included - not because the > vulnerabilities exposed by this file should be tempered (as that would only > be to assist a dangerous confusion of responsible practices), but because > "DROP TABLES" is such a cliche in infosec that it's prone to be caught by > extremely crude filters, naive to the degree that it's the only class of SQL > injection they know to avoid.

</comment></comment></comment><comment><USER13> The human injection phrase is priceless

It's a nice collection of text snippets to test against many systems

<comment><USER14> For those who can't/would rather not look for it:

"# Human injection # # Strings which may cause human to reinterpret worldview

If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you."

</comment></comment><comment><USER15> > blns.txt consists of newline-delimited strings

I expect some nasty strings to contain newlines (I wonder how many bash scripts are sensitive to filenames with newline characters in them). It shouldn't be a problem with the json file though.

<comment><USER16> The file is newline-delimited. The strings themselves are base64 encoded, so they could contain newlines.

<comment><USER15> It seems that blns.txt is the source content, then it's converted to blns.json, blns.base64.txt and blns.base64.json with the two scripts in the scripts folder (These resulting files shouldn't be in the repo in my opinion). One cannot possibly add strings with newlines in them, unless with some newline escaping that are handled in the scripts. It's a bad idea IMO and the source content should be the json file and blns.txt should be dropped.

</comment></comment></comment><comment><USER17> I like the idea of providing such a list for testing purposes. I also like the idea of storing these as Base64, so you don't trigger issues by accident.

However, I also imagine how such a list could be misused to actually decrease the security of a system:

Imagine this list is handled the same way as virus signatures in so-called anti-virus software. Instead of properly handling user input, an application would check against this list and call itself "secure". Maybe with with partial and/or fuzzy comparison. If you demonstrate that this approach is deeply flawed by showing another unsafe input, they'd simply add that to the list and call themselves "secured" against this attack.

<comment><USER18> If someone uses this list for security purposes I think that someone has a bigger problem.

<comment><USER19> Can you elaborate? What other uses this list could have than security purposes?

<comment><USER20> It should not be used for security purposes when security purposes is defined as components that maintain the security at runtime. It is valuable as a testing tool, but only against a completely finished system.

</comment></comment></comment></comment><comment><USER21> Its funny that zero width space is considered weird and twitter fails on it. Its quite common in my language (Persian).

<comment><USER22>
        > Its quite common in my
        > language

I'd love to hear more details on why?

<comment><USER23> ZWJ and ZWNJ are also common in Indic scripts. It's basically used to control the appearance of glyphs, for example half-forms and consonant clusters (क्‍ष vs क्ष, both are kṣa). As usual, wikipedia has good examples. The Unicode Standard also contains details about these.

ZW[N]J as a standalone character or at the beginning of a word is very unusual on a day-to-day basis, so it's understandable that Twitter fails to recognize this pattern.

¹ [https://en.wikipedia.org/wiki/ZWJ](https://en.wikipedia.org/wiki/ZWJ)

² [https://en.wikipedia.org/wiki/ZWNJ](https://en.wikipedia.org/wiki/ZWNJ)

<comment><USER22> Ah ha!

        > When a ZWJ is placed between two
        > emoji characters, it can also result
        > in a new form being shown, such as
        > the family emoji, made up of two adult
        > emoji and one or two child emoji

That makes a lot of sense too, and I hadn't put sufficient work into how that's implemented -- retrospectively that makes perfect sense.

<comment><USER12> This made me wonder if anyone had tried combining word2vec with emojis, and then I came across this:

[https://github.com/uclmr/emoji2ve](https://github.com/uclmr/emoji2ve)

<comment><USER22> which is a dead link

<comment><USER23> Correct link: [https://github.com/uclmr/emoji2vec](https://github.com/uclmr/emoji2vec)

<comment><USER12> Apologies, and thanks!

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> Here's a tool to generate problematic filenames: [https://github.com/jakeogh/angryfiles](https://github.com/jakeogh/angryfiles)

</comment><comment><USER25> [https://github.com/minimaxir/big-list-of-naughty- strings/blo...](https://github.com/minimaxir/big-list-of-naughty- strings/blob/master/blns.txt#L633)

> Strings which punish the fools who use cat/type on this file

</comment><comment><USER26> Hello human. This is a message from the Matrix. You've been in a coma for 20 years. Please write back.

[https://github.com/minimaxir/big-list-of-naughty- strings/blo...](https://github.com/minimaxir/big-list-of-naughty- strings/blob/8536c7903316763d7a6123e878c150fb97e6ea07/blns.txt#L629)

<comment><USER27> I like that in the master list it's annotated as:

        #	Strings which may cause human to reinterpret worldview

[https://github.com/minimaxir/big-list-of-naughty- strings/blo...](https://github.com/minimaxir/big-list-of-naughty- strings/blob/master/blns.txt#L627)

</comment></comment><comment><USER28> It's missing the old "+++" for non-Hayes modems.

<comment><USER29> I think that sequence is an escape for Hayes modems; do you mean that Hayes modems were less vulnerable to attacks involving it because of their guard interval feature?

[https://en.wikipedia.org/wiki/Hayes_command_set#.2B.2B.2B](https://en.wikipedia.org/wiki/Hayes_command_set#.2B.2B.2B)

<comment><USER28> Yes, exactly.

</comment></comment></comment><comment><USER30> Related: a list of names that probably should be reserved (for example, to prevent someone setting up a user-profile page at a URL you don't want them to control):

[https://ldpreload.com/blog/names-to- reserve](https://ldpreload.com/blog/names-to-reserve)

<comment><USER31> Alternatively, put them in another path ([https://facebook.com/user123](https://facebook.com/user123) -> [https://facebook.com/users/user123](https://facebook.com/users/user123))

</comment></comment><comment><USER32> Line 629 is a gem!

Thank you @minimaxir, I hadn't seen this before, this looks very useful.

<comment><USER33> line 629 is empty ;)

<comment><USER32> No, wake up!!

(For any who want to take the blue pill: [https://github.com/minimaxir/big- list-of-naughty-strings/blo...](https://github.com/minimaxir/big-list-of- naughty-strings/blob/master/blns.txt#L629))

<comment><USER34> I'm not sure what you mean. That line really is empty.

<comment><USER35> Just a glitch...

</comment></comment></comment></comment></comment><comment><USER36> Unicode control characters from when people copy and paste from PDFs.

Drives me up the wall, i didn't have time to go deep into this.

</comment><comment><USER37> > Also, do not send a null character (U+0000) string

isn't that quite a blind spot?

</comment><comment><USER38> Reminds me of a complain I read on Twitter last week.

Native Australians were angry, that FB blocked their real names, because they seemed fake to them.

They have last names like "Creepingbear" and such.

<comment><USER39> Did you mean native Americans? I've never heard "Creepingbear" as an Australian name.

</comment></comment><comment> r-w The list itself can be found here: [https://github.com/minimaxir/big-list-of- naughty-strings/blo...](https://github.com/minimaxir/big-list-of-naughty- strings/blob/master/naughtystrings/internal/resource.go#L530)

<comment><USER40> If you're going to link to a line number - press 'y' to get a link tied to the commit. Otherwise it may be out of date the next time the file changes.

([https://github.com/minimaxir/big-list-of-naughty- strings/blo...](https://github.com/minimaxir/big-list-of-naughty- strings/blob/8536c7903316763d7a6123e878c150fb97e6ea07/naughtystrings/internal/resource.go#L530))

</comment></comment><comment><USER41> This reminded me of that story of people who have such strings for names: [http://www.bbc.com/future/story/20160325-the-names-that- brea...](http://www.bbc.com/future/story/20160325-the-names-that-break- computer-systems)

</comment><comment><USER42> My personal favorite: U+202E. It sets the directionality for a document from LTR encoding to RTL [https://twitter.com/robin_linus/status/820567617903751169](https://twitter.com/robin_linus/status/820567617903751169)

</comment><comment><USER43> I'm trying really hard to figure out what's bad about 'Lightwater Country Park'

<comment> david-given I figured that one out, but --- evaluate? mocha? expression?

<comment><USER44> mocha has a naughty german word in its middle, I'm fairly sure.

<comment><USER45> No it doesn't. I believe it can be used for Javascript injections like 'eval' as 'mocha' is/was common a test framework. At least that's the ostensible reason Yahoo replaced 'eval' with 'review', 'mocha' with 'expresso', and 'expression' to 'statement' way back in 2002 [0].

[0] [https://www.newscientist.com//article/dn2546-email- security-...](https://www.newscientist.com//article/dn2546-email-security- filter-spawns-new-words)

<comment><USER46> "espresso", not "expresso".

</comment></comment></comment></comment></comment><comment><USER47> Why is the string "Linda Callahan" a naughty/Scunthorpe word?

<comment><USER48> After re-reading it I can see it contains "allah", but I can't see why that would be filtered.

<comment><USER49> Interesting my last name was blocked from making Genius Bar appointments [0]. My name is Jason Hung.

[0] [https://discussions.apple.com/thread/1491462?start=10&tstart...](https://discussions.apple.com/thread/1491462?start=10&tstart=0)

<comment><USER50> Open a PR?

</comment></comment></comment></comment><comment><USER51> is it wise to just take this list "as is" as a black list for, say, valid usernames, on a backend system ?

are there any drawbacks to this that i can't think of ?

in terms of perfomance - i guess it could be somehow optimized (with dictionary and sorting algorithms etc etc)

edit: newlines

<comment><USER52>
      is it wise to just take this list "as is" as a black list for, say, valid usernames?

I interpret this as a list of input that you _should_ accept, and it's test- data to verify that the input is correctly handled.

After all, I imagine _Linda Callahan_ would be upset if she couldn't use her name when registering, especially if she couldn't flip a table in comments afterwards. (╯°□°)╯︵ ┻━┻)

</comment></comment><comment><USER53> "Strings which may cause human to reinterpret worldview"

Hah. Totally filtering for that one now.

</comment><comment><USER54> This is super helpful! Thanks for sharing!

</comment><comment><USER55> Customary xkcd reference (Exploits of a Mom):

[https://xkcd.com/327/](https://xkcd.com/327/)

<comment><USER56> To add another funny XKCD reference: [https://xkcd.com/1137/](https://xkcd.com/1137/)

On that note, can anyone suggest how one could efficiently test that an RTL unicode char doesn't "infect" the whole following content of a template?

</comment></comment><comment><USER57> >Although this is not a malicious error, and typical users aren't Tweeting weird unicode, an "internal server error" for unexpected input is never a positive experience for the user

What would the user expect from inputting "U+200B ZERO WIDTH SPACE" into a form, anyway?

<comment><USER58> I've observed ZWSes appearing in user input for an application I maintain. It appears in text pasted from either Outlook or OWA, I believe. In our case, it is necessary that the application handle them gracefully - indeed, the user has no reason to know anything is amiss.

<comment><USER57> That internal server error only appears if you paste the ZWS by itself, without any valid text in the tweet at all. So yes, the user knows perfectly well what he's doing.

<comment><USER59> That doesn't mean that a 500 is a good UX. We give error messages on invalid form input for a reason.

</comment></comment></comment></comment><comment><USER60> Nice to have a list of these.

Also, the first time that copypasta actually spooked me out ;-)

</comment><comment><USER61> There's no such thing as "naughty strings", just dumb code. Sorry.

<comment><USER62> I have to agree here. While a collection of "naughty strings" isn't wrong per se, the growing number of "killer regexpes to escape HTML" and other magic approaches to injection attacks on github only serve lazy devs who want post- facto excuses for their injection-prone web apps, or project managers who want to check items on security check lists.

It's wrong because it de-emphasizes the importance of HTML-aware template languages, such as some that are available for golang, or SGML, the natural template language for HTML. There's no such thing as a collection of regexpes for sanitizing HTML; it all depends on the context into which strings are inserted.

<comment><USER63> But wouldn't you want a decent set of cases to work on for learning purposes?

I think it's also good in that while you may not know all the latest tricks, this can help you reveal what you don't know. It can get you really thinking about the possibilities of what a simple string can do to your code if not properly handled.

<comment><USER61> No, you don't want cases. You want _real specifications_ that you can understand before setting on to write a program. "Corner cases" only exist due to lack of understanding.

Also, explicit HTML (or SQL or whatever) string handling in normal application code is just a failure to separate concerns: you haven't distinguished the level at which HTML has an _abstract syntax_ and the level at which HTML's abstract syntax is linearized into strings in one particular way.

<comment><USER63> Real specifications being, "save user's text and display it back", or "save user input that is in English ASCII excluding special characters and no larger than 160 characters"? I get a lot of the first, with emphasis being on the users perspective.

I do know to consider things like sql injection and having js injected into the site. But I don't know what a special white space character from a Persian alphabet will do to my server. Until today I haven't actually thought about it. Not every language handles strings the same, as you pointed out.

I still think it's good to have around for helping you reveal what you don't know, about what you don't know.

<comment><USER61> Real specifications relate preconditions to postconditions. Preconditions and postconditions, in turn, are predicates on the program state. The mathematical techniques for writing programs that meet their formal specifications have been known for a few decades already.

\---

Replying as an edit, because HN complains that "I'm submitting too fast":

Sure, what you said applies to entire applications. But something relatively stable and small, like, um, the definitions of HTML, JSON, SQL, etc. (do they become larger every time your boss requests a new feature?) surely should have formal specifications.

<comment><USER63> I would love "real" specifications. But right now I'm already dealing with a boss that has no idea what he wants in terms of the UI. Simultaneously demanding I "know" what should be done without "taking on things nobody asked for."

Alas, I don't work at NASA where these formalities exist. I'm given a rough sketch that I'm expected to bring into life, throw away and recreate again on a whim.

Please note that I am not complaining, nor excusing. Only pointing out that our expectations, environments, and programming languages are different. Each can massively affect how the program should handle the input. Adding checks helps, but does not mitigate the need for a nice set of test data to help verify everything runs the way we expect it to behave.</comment></comment></comment></comment></comment></comment></comment>


A Lisp with a Partially Observable Markov Decision Processes Inside - <AUTHOR> <comment><USER2> Was this post supposed to contain a link?

<comment><AUTHOR> Sorry,this is [http://arxiv.org/abs/1608.08724v1](http://arxiv.org/abs/1608.08724v1)</comment></comment>


Facebook to overtake Google in the next 18 months - <AUTHOR> http://jacquesmattheij.com/Facebook+to+overtake+Google+in+the+next+18+months

<comment><USER2> I honestly believe Facebook is on the way out.

Facebook was an elite product, it required an Ivy League address just to get through the door and established a set of middle-upper class brand credentials. Facebook is now the default, it's full of crappy games & dodgy ads. Every shitty website has a like button. It's has an irremovable reputation for a lacadasical approach to user privacy. Everyone and their grandmother are on there, FWD:FWDing Glen Beck nonsense and Farmville requests.

Every market has stratification, we define ourselves by our brand associations. There is a hole where there should be the Mercedes, the Apple of social networks to Facebook's Dell. All that's needed now is something new to come along that woos the elite and Facebook's long term fate it sealed. There's a chance it'll be Disapora but there's a very good chance it won't.

That's not to say it won't be around for years to come but it has, to used a hackneyed phrase, jumped the shark and the difference is that Facebook's value comes from it's userbase, not its services or technology. Once the top end start bailing the rot will set in fast, momentum shifts with dizzying speed on the web. I've been thinking about this for a while, I figure if I'm right, I'll be able to point to this in a year or two and smile. Not quite as profitable as shorting FB but hey, it's just speculation for fun.

<comment><USER3> I would like to believe you. I really would. But it's hard to see how your parallel applies.

Being the Mercedes or the Apple of Social Network would be great... but it would be a failure as a social network. The example you give of brand association could make sense for luxury items. Those items' value increases the less people have it (to an extent). But a social network's value needs a large group of users.

For your scenario to make sense we would need a form of open FB: then some people will go for the popular option and other will go for the elitist option, but they would all still be able to link to each other. Diaspora seems to be attempting something too big, so I doubt it will succeed.

We could break down Facebook to its basic constituents, and make those open. Some already exist: a messaging system (email) and IM system (Jabber). We would still need an open notification system (a la Twitter). Webpages are already open and a personal webpage could act as your profile just as well.

The last ingredient would be a way to define your circle of friends. Something like FOAF, but with stronger proponents/backing. Once that's all done, anyone could come up with their own Facebook: these would be a simple wrapper around what all these technologies.

<comment><USER2> It depends on what your view of a social network is. My personal opinion is that people do not have a social network, they have a series of occasionally overlapping social networks. That all current systems are incapable of reflecting this is what causes so much friction and conflict. A social network's value doesn't come from lots of users, it comes from the right users. Fragmentation of the market away from monoliths towards many niches, with individuals have separate and distinct profiles on each would make them far more representative of the real world.

It is possible a base-level platform will emerge to make it possible for this to happen but I don't think it will - the value for companies is in linking it all together, the value of such smaller networks for the users it that they do not link together.

<comment><USER3> Sure, but the same way people have two email addresses, one for home and one work work, they could have two of these bundles.

Say: I am a University student. They could give me instead of an email address, a userid to access my University page. This would be a webmail client, an IM client, a place to put my photos/CV/essays, _and_ they could be link to each other and to other similar services via FOAF or others.

Then I move to work, and I get another bundle. And so on.

The killer feature for me on FB is: it's all integrated so once I got someone on FB I get their email/IM/photos/etc... Plus it helps finding people by searching among the connections in your social network.

</comment></comment></comment></comment><comment><USER4> This data is biased. Facebook.com is used all over the world while Google.com is mainly used in the US.

There is a google.ca, google.fr, google.co.jp, google.de, but there is only one facebook.com

So yes, the whole of Facebook will be used more than Google by just the Americans. Is it such a big deal ?

<comment><USER5> Also interesting to note is that MySpace does, in fact, segment by regions.

There are seperate MySpaces for each "region".

<http://en.wikipedia.org/wiki/Myspace#International_sites>

</comment></comment><comment><USER6> "Overtake" is an ambiguous word. If these extrapolations are correct then Facebook will get _more unique visitors_ than Google some time in the next year or two, but why use this metric rather than (e.g.) total number of visits, total amount of traffic, amount of time spent at the site, revenue, or profit? On some of these I would guess that Facebook's been ahead for a while; on some, Google is probably well ahead for the foreseeable future.

In any case, comparing _any_ metric of this sort between two sites that are so different, and that do such different things with their visitors, seems rather pointless to me. Like comparing unit sales volumes between a company that makes mobile phones and one that makes cuddly toys, or comparing one hospital's survival rates for heart transplants with another's for cancer surgery.

</comment><comment><USER7> > _Google has been around for a little over a decade now, and facebook a > little over 6._

Ah yes, my grandfather told me about when he first created his Facebook account back in 1950.

Might want to fix that typo :)

<comment><AUTHOR> Haha, that was not the thing I intended writing, thanks, will fix it right away.

</comment></comment><comment><USER8> This as may be. But Google have 7 of the top 20 sites :) Five of which are Google search.

<http://www.alexa.com/topsites>

I think they are pretty solidly established as the "biggest" :)

</comment><comment><USER9> You might want to consider youtube traffic there, which is #4 on alexa rank. This will push the cross over by few more years for even statistical predictions. [http://www.alexa.com/siteinfo/google.com+facebook.com+youtub...](http://www.alexa.com/siteinfo/google.com+facebook.com+youtube.com)

Few other interesting things to note of the alexa graph is:

\- Facebook crossed youtube traffic just about an year ago.

\- Google crossed yahoo traffic only late 2008, that too mostly for yahoo traffic went down hill.

\- What caused the sudden rise in internet usage in oct 2009 (for all top sites sites except yahoo show a spike in traffic). Can't be early christmas traffic, guess facebook triggered this high adaption of users who spilled onto other sites too.

<comment><AUTHOR> It's not so easy to undouble between youtube and google, my guess is that since youtube is a google property that it actually is a subset, so it would not make a whole lot of difference. Only those people in the youtube set that are not yet in the google set would skew that graph and hence the conclusion.

After all, this is about 'reach' and 'uniques' which translates in to people not pageviews.

<comment><USER9> True the overlap might be very high and it is extremely hard to find the common userbase with the available open tools. Will have to wait for hitwise, comscore or someone to publish a report.

I happened to look more into the global top sites <http://www.alexa.com/topsites/global>. It is lot more confusing - Google's India, German, HK, UK sites are considered separately. A clear example is <http://www.alexa.com/topsites/countries/SA> and <http://www.alexa.com/topsites/countries/Italy> where the top site is not google.com, so these users are not accounted in .com but use other google properties or variant country TLDs.

<comment><AUTHOR> The reason why I looked in to this (this time) was because I was wondering if the whole privacy backlash had put a dent in facebook's growth.

It seems that's not the case, they're still growing at more or less the same rate (to my surprise).

I wouldn't mind analyzing a days worth of logs of either company, but I don't think I have a machine large enough to store the files on (nor enough CPU to process the data).

It would be quite the goldmine of information.

</comment></comment></comment></comment><comment><USER10> I'm assuming you are only talking about Google's US homepage? (i.e. not including youtube and other non google.com Google properties)?

<comment><AUTHOR> Yes, but the 'US' homepage as you call it is used by people all over the world.

See: <http://www.alexa.com/siteinfo/google.com>

Then click on the 'more' link under the flags. Google keeps trying to redirect me to google.nl but I always set it back to google.com and it looks like I'm not alone in that.

<comment><USER11> In france everybody uses google.fr. Not all countries and cultures are comfortable with english.

<comment><AUTHOR> Google.com is the #5 site in France.

<comment><USER11> Yeah sure, but what you fail to mention is that google.fr is #1 in france, with 5 times more visits, which means that there is a big subset of fr users that doesn't use google.com. Which was the original point.

</comment></comment></comment></comment></comment><comment><USER12> I don't get this logic that because every social network before fb died so will fb. We have to agree that fb understood the social networking landscape a lot more than all other previous players. My guess is fb will not rule the web but it is here to stay for a long long time

</comment><comment><USER13> How was the google line trending when it was 6 years old? I am sure the acceleration of their traffic must have reduced over the past few years and would expect similar thing to happen to facebook.

</comment><comment><USER14> "Whenever you're told that some existing statistical trend will continue, but you aren't given a hard-to-vary account of what causes that trend, you're being told a wizard did it." -David Deutsch

</comment><comment><USER15> An by 2050 both will have 500% market share!

<comment><AUTHOR> Of course, because everybody knows you can extrapolate graphs past their domains and that you do not need to take saturation in to account at all.

</comment></comment><comment><USER16> I believe the power of the goog will result in something that is more asymptotic.</comment>


Becoming a renewable energy engineer - <AUTHOR> http://pingswept.org/2008/12/29/becoming-a-renewable-energy-engineer/ <comment><USER2> I read the article with interest, but it didn't really answer one of my burning questions - how does an established engineer cross over to renewable energy? I've worked in the dark side of oil and gas as an EE for the last 7 years, basically designing and commissioning power systems for onshore and offshore facilities.

However ever since I was a graduate, I've always wanted to be in the renewables field. Over the years I've fired off a number of applications to wind and solar companies, but they typically want someone with experience... which appears to be a catch-22 for me (ironically, people have this same problem trying to get into the oil and gas industry).

So I'm thinking of doing a masters at the local renewable energy research centre, which is conveniently located around the corner from where I live. My personal interest is in decentralised power networks, supplied by a mix of renewables and base load fossil fuels, and how they interact with the wider grid. I'm also very interested in the environmental economics / energy policy side of things, and over the past year have been doing part-time work for the environmental economics group (at the company where I work). I've almost finished an economics graduate diploma as well (1 year to go!).

And lastly, I'm going on a 6 month volunteer posting to SE Asia next Feb with Engineers without Borders, ostensibly to develop water purification systems for some rural villages (basically a solar powered RO filter as far as I can tell from the literature they've sent through).

I suppose I'm not doing all this just to break into renewable energy (though it'd be a nice payoff), since I'm ultimately just following my interests around. However my question still stands: how do I get a foot in the door? Am I on the right track? and does the industry need someone with my hodge-podge of skills?

</comment><comment><USER3> spot on solidworks (i still can't find foss alternative)

in uni back then i learned I-DEAS (very expensive software)

i think uni = slave preparation (debt + nonstartup softwares)

another is matlab (expensive) ... my uni should teach python+numarray+matplotlib instead

NB: i self learned solidworks from manual because our research group used it (despite the official uni strong support on I-DEAS) ... i must thank my advisor

i think pg is right that the 'test' is less corrupt in graduate school because the professor (using own budget) has to work with the student (my adv is from mit, never wanted to order new expensive stuff, always build from scratch ... making us suffer in a good way)

</comment><comment><USER4> Great post... does GreenMountain Engineering need any materials science engineers :~) ?

<comment><AUTHOR> We haven't hired any material science folks yet. If we were to double in size (15 people -> 30 people), I bet we'd need a material scientist and a chemical engineer. At present, we're mostly generalists, with a slight bias toward the mechanical.

It took us ~3 years to get to 15; in the last 2 years we've been roughly constant, plus or minus a few people. Maybe in 2012.

<comment><USER5> How about industrial engineering?

<comment><AUTHOR> Has your education taught you how to engineer things? Did you take a lot of math classes?

We don't have any industrial engineers at present, but when we're growing, we wouldn't rule them out. Really, we want people who are very smart, work hard, communicate well, can solve problems, and actually care about cleantech.

Regarding the specifics of solar cells (before you edited your post above), the field we span is broad, and the problems are narrow-- you can't possibly hope to have expertise in more than a small fraction of the areas in which you work. Fortunately, nobody else can either.

</comment></comment></comment></comment><comment><USER6> Actually he gets the "engineering" thing right.

I'm a chemical engineer (MS) and after 17 years on the job I ultimately came to the conclusion that earning a degree in engineering is the functional equivalent of buying your way into slavery. Didn't meet any practicing engineers who disagreed with the analysis either.

Whenever I meet a bright young teenager who expresses an interest in entering the profession I do everything in my power to talk him or her out of it.

<comment><AUTHOR> I'd say it's sort of like slavery, in that you work hard for rewards that are generally scantier than those that employ you, but there's a major difference in that you can quit whenever you like. For people like me who actually like solving hard problems, the drudgery is not as heavy as for those who should really be carpenters, financial advisors or whatever.</comment></comment>


Ask HN: is it unethical to copy terms of service? - <AUTHOR>

Dear HN,
I'm currently working on my first startup and we're in the process of getting together terms of service. After looking at competitors in the space, 3 out of the 5 have exactly the same terms of service.
Literally the same exact TOS to the word.
This raises an interesting ethical dilemma. Is a company's TOS their intellectual property, or would copying TOS be a copyright infringement on the legal entity that authored it to begin with? Are there any legal ramifications other than "hey you, stop copying my stuff"?
Any help is appreciated. <comment><USER2> It's not legal. A lot of people use Wordpress and OpenDNS which are made available under creative commons, see: <http://news.ycombinator.com/item?id=1385181>

See the comments there about OpenDNS, the privacy policy is also reusable as long as you edit it the way they want.

</comment><comment><USER3> Its very common. Its not legal though. Copying text (or a book) is no different than copying a image/video.

Maybe they used [http://www.bennadel.com/coldfusion/privacy-policy- generator....](http://www.bennadel.com/coldfusion/privacy-policy- generator.htm) ?

</comment><comment><USER4> I notice this all the time as well. A few well known, VC funded startups have Terms of Service documents that are nearly identical to the Google Analytics TOS.</comment>


Pyfavicon: Async Favicon Fetcher Library - bil-elmoussaoui https://github.com/bilelmoussaoui/pyfavicon/ <comment> bil-elmoussaoui This is my very first python library, I tried to learn all the related parts from writing the code, adding tests, running them using a CI, deploying docs and pushing the library to pypi. Any feedback is appreciated.</comment>


KeeWeb: Unofficial KeePass web and desktop client - <AUTHOR> https://github.com/antelle/keeweb <comment><USER2> Do not generate passwords with it, it uses insecure Math.random:

[https://github.com/antelle/kdbxweb/blob/906e927d3e3384db4dd3...](https://github.com/antelle/kdbxweb/blob/906e927d3e3384db4dd393f6a9cbba00b1c85720/lib/crypto/random.js#L19)

[https://github.com/antelle/keeweb/blob/master/app/scripts/ut...](https://github.com/antelle/keeweb/blob/master/app/scripts/util/password- generator.js#L29)

(in meme form: [https://imgur.com/FcZNflQ](https://imgur.com/FcZNflQ))

Filed issue: [https://github.com/antelle/kdbxweb/issues/5](https://github.com/antelle/kdbxweb/issues/5)

(embarrassing/funny: it was me who wrote Salsa20 "user-space" generator used here ([https://github.com/antelle/kdbxweb/blob/906e927d3e3384db4dd3...](https://github.com/antelle/kdbxweb/blob/906e927d3e3384db4dd393f6a9cbba00b1c85720/lib/crypto/salsa20.js#L3)), but it should be properly seeded from secure random number source to be secure. Added this note to the gist where the author found it: [https://gist.github.com/dchest/4582374#file- salsa20-js-L1-L1...](https://gist.github.com/dchest/4582374#file- salsa20-js-L1-L16))

<comment><USER3> Is there a practical attack for this usage? The attacker would need to have a bunch of your passwords already?

EDIT: Not that I'm justifying using Math.random, I just don't see why you so strongly recommend against using this tool.

<comment><USER4> >> Is there a practical attack for this usage?

This is the question I ask every single time I read about anything in security. It feels like there's just SO MANY THINGS wrong about every damn thing now the only way I can figure out what I have to really worry about or focus on is anything with a PRACTICAL attack that's easily automated and remotely exploitable.

<comment><USER2> Cryptographic attacks become better, some of them become practical. RC4 attacks were not considered practical until recently, and now everyone runs with their heads on fire replacing it.

The best answer is to listen to what security people say. When they have a practical attack on something it is already too late.

<comment><USER5> Security experts, by in large, only care about academics and care very little about usability, so I do not trust them unless they give me specific scenarios where I am in danger.

<comment><USER2> Eh, okay? Your choice, dear Touche, your choice.

<comment><USER5> Just to clarify what I mean; we have to make decisions based on tradeoffs. Having the most secure password possible is not the only thing that matters. So "trust security experts" is not a good response; I need to know threat levels so I can make informed decisions. I'm not just going to do the same thing a security enthusiast does because I value different things, to different degrees.

<comment><USER2> Looks like you didn't understand the sadness of the issue I was reporting. The author of the software constructed his own random number generator from two primitives: Salsa20 stream generator and Math.random. The last part is what makes this PRNG theoretically insecure: because Math.random is not guaranteed to give cryptographically secure random numbers, thus, theoretically, the generated passwords can be guessed. (The fact that there are no current attacks on current implementations of Math.random in browsers doesn't mean that we won't get them in the future.) The secure alternative to author's PRNG is ~one line of code: window.crypto.getRandomBytes. There are no tradeoffs involved! On the contrary, the author's insecure construction is more difficult to write than the secure one.

(BTW, while we here argue about security experts, the author said "Thank you, I'll replace it of course.")

<comment><USER5> This is what I'm talking about. You, a security enthusiast, are only interested in the technical security details. You respond to a comment about tradeoffs with details on the bug.

I don't care about why the bug happened or how easy it is/isn't to fix. I care about whether the existence of the bug is something I should be so concerned about as to not use the software. In order to gauge that, I need a little more info about the threat level.

<comment><USER6> _> I don't care about why the bug happened or how easy it is/isn't to fix. I care about whether the existence of the bug is something I should be so concerned about as to not use the software. In order to gauge that, I need a little more info about the threat level._

Threat level is 0%. No currently known attacks exist. This threat level immediately goes to 100% when a practical attack is discovered. There is no guarantee that a practical attack exists that _hasn 't_ been brought to academic or mainstream attention (e.g some cracker has a practical attack that they're keeping under wraps). By the time the threat level hits 100% the cracker may have already broken into your account(s) before you even hear about the attack.

Therefore when something is shown that "attacking it is possible" you can make one of two assumptions

1) No practical attack exists and you'll be safe until it exists

2) A practical attack already exists and it is only a matter of time until you get pwned

Rather than worry about whether or not a practical attack already or will one day exist, I'd use cryptography that hasn't been shown to be broken.

<comment><USER5> This comment doesn't make sense. All attacks are not equal. Some require physical access; some do not. Some require seed data; some do not. What exactly are you talking about here?

This is why security people are so frustrating to talk to; you only talk in extremes.

> Rather than worry about whether or not a practical attack already or will > one day exist, I'd use cryptography that hasn't been shown to be broken.

That's not what I'm worried about. I'm worried about given that they do exist what is the risk to me? What is the likelihood that my account has been broken into?

<comment><USER6> _> This comment doesn't make sense. All attacks are not equal. Some require physical access; some do not. Some require seed data; some do not. What exactly are you talking about here?_

I'm not a security expert, more of a hobbyist. So I'll let someone else quantify potential specifics. To my understanding, they would not require physical access and would be able to guess any passwords generated (once an attack has been found/created).

 _> That's not what I'm worried about. I'm worried about given that they do exist what is the risk to me? What is the likelihood that my account has been broken into?_

The chances of 0 becoming 1 are not quantifiable because it requires knowing unknowns. It is, however, non-zero. For a small list of unknowns:

1) Who knows about the attack

2) How practical is the attack?

3) What software/websites/people are they choosing to attack

4) Are you even using any of the software/websites that are being attacked?

5) Are they going to accept cracking <10%~ accounts if they can do so in <24 hours or is their goal to crack >50%~ accounts? Many crackers only care to scrape the bottom of a barrel. What are the chances you were in the part of the barrel they scraped?

I assume the worst because being compromised is a zero-sum game. I've been compromised or I haven't. Therefore my variables are:

Everyone. Extremely. Only things I use. Of course. Doesn't matter, I'm in the targeted group.

I wouldn't make any bets on security through obscurity.

<comment><USER5> Getting my reddit account hacked is not the end of my life. Hell, getting my bank account hacked is not the end of my life. I don't want those things to happen, I will take precautions to prevent it.

But too often security people talk as though _it 's the only thing I should care about_. And it's not, I care about other things too, to varying degrees.

So, to make an informed decision, I need to know _more_ than just that Math.random() is insecure. Knowing that an attack wouldn't require physical access _is the type of information I 'm interested in_. So thank you for that.

<comment><USER6> I understand completely. I feel most people's threat models stop even before 'threat has physical access'. The chances of both your computer being stolen _and_ the person who stole it being tech-savvy enough [0] to break into things may as well be 0 for anyone who isn't the target of a state actor or working in a security field. At that point the only people who care are the people who care about security or slim chances like that occurring. :)

[0] Or the thief selling it to someone who _is_ tech savvy enough. Still practically 0 for most everyone.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> This is awesome. People are obviously going to give you a hard time about security and your implementation of the important parts of the software, but that's the advantage of open source!

Edit: I am a daily user of KeePassX and get really tired of the UI after a while so I will definitely be trying this out ASAP!

<comment><USER8> Which version of KeePassX are you using? The 2.0 seems better.

And if you use a Mac, have you tried MacPass?

<comment><USER9> MacPass is excellent. It finally helped me completely move to a password manager based life.

<comment><USER10> How is it better than KeyPassX? I (think I) want my manager to be simple..

<comment><USER11> It's native, much better user interface. Downside - for now: it's alpha, not even beta yet, so better keep a backup of your database.

</comment></comment></comment></comment></comment><comment><USER12> Check out pass for those wanting a solution in line with the Unix way:

[https://www.passwordstore.org/](https://www.passwordstore.org/)

<comment><USER13> One issue I have with pass is that it leaks meta-data about what you have stored. The contents are encrypted, yes, but the filename identifying the content is sitting right there in the open.

<comment><USER14> Check out this similar gpg-based password manager, which uses just one encrypted container for improved confidentiality - [https://github.com/drduh/pwd.sh](https://github.com/drduh/pwd.sh)

</comment></comment></comment><comment><USER15> The reference implementation's domain is vulnerable to MITM attacks between KeeWeb and CloudFlare until they set their CloudFlare crypto settings to "strict" and get some real certificates of their own (e.g. Let's Encrypt).

I submitted an issue here: [https://github.com/antelle/keeweb/issues/111](https://github.com/antelle/keeweb/issues/111)

Of course exploiting this would be very difficult, but it is _possible_ to MITM the connection between the CloudFlare proxy and GitHub pages as long as keeweb.info continues to not use DNSSEC.

<comment><USER15> Update: The author has reasonably mitigated this vulnerability. This isn't much of an issue now.

</comment></comment><comment><USER16> I always get confused with KeePass, KeePass2 and KeePassX...

I use KeePassX on OS X. Will I be able to use this one with my database file?

<comment><USER8> Try MacPass. It's great.

[http://mstarke.github.io/MacPass/](http://mstarke.github.io/MacPass/)

<comment><USER17> Thanks, giving this a shot!

</comment></comment></comment><comment><USER18> This looks awesome. My only gripes with KeePass is the confusion between KeePass,2,X etc; get it together guys. Also there is a serious lack of good browser extensions. There only seems to be one offering and its the clunkiest thing I have ever used. -- That said, as soon as the second problem is addressed, I'll be switching as soon as possible. I'd love to move off my proprietary solution to an open one.

</comment><comment><USER19> How does it handle multiple users/computers trying to write to a database on dropbox?

<comment><USER20> I don't know about this version, but keepassx creates a file in the same directory where the password kdb file is, and use it as a lock.

But, keep in mind that dropbox can delay updates to the server (could be hours if you are disconnected) with no warning to the user, which means that two different users could update the same file independently and create a conflict. For this reason, it isn't suitable as an enterprise solution.

Having said that I recommend dropbox as a poor man escrow, so that somebody you trust as easy access to all your passwords for banking, social network (keep your alt accounts somewhere else :-) ), servers' root, etc...

<comment><USER19> Yep, aware of how KeepassX does this. Its better than some (i.e. there are locks at all) but dropbox doesn't always cooperate. Have been looking for a better solution, but most seem to not even do the lock file thing.

</comment></comment></comment><comment><USER21> That's pretty nice. I'm going to look into packaging it for myself for FirefoxOS. My only issue with it right now is aesthetic: the top item (search box on the main page, "< back to list" in entries, etc) scrolls off the top of the screen, leaving that much blank white space at the bottom of the screen. I'm on a ZTE Open C running the nightly version of FxOS from [http://builds.firefoxos.mozfr.org/doc/en/devices/zte- open-c-...](http://builds.firefoxos.mozfr.org/doc/en/devices/zte-open-c-eu)

<comment><USER22> Offtopic but, are you using FirefoxOS in your main phone? Is it good enough? I have one but never found it useful...

<comment><USER21> Yes, my only phone is FxOS. No, it's not good enough. I'm sure if I was on better hardware, it would be okay. My _only_ requirements for it are a) decent web browser (it fails on this point) and b) Google 2 factor auth (I'm using GAuth[0]). I really don't care about playing games on my phone (I have a hacked PS Vita for that) and I have a laptop for everything else.

[0][https://marketplace.firefox.com/app/gauth](https://marketplace.firefox.com/app/gauth)

</comment></comment></comment><comment><USER23> The notes field should be a multiline text field. This is mandatory since some data needs more explanation than just a password.

</comment><comment><USER24> Does there exist an enterprise grade server/webui solution based on a keepass db? We are looking for an enterprise password manager solution that does not need all the ldap/ad integration bells/whistles (although we may explore ldap integration with the tool in the future). So I was thinking why not just use keepass. And by enterprise grade I guess I really mean it needs to be a multi user solution, but everyone would be working from the same pw db..

<comment><USER25> PleasantSolutions.com may help. (Full disclosure: I sell an unrelated KeePass plug-in.)

<comment><USER24> This looks very interesting thanks!

</comment></comment></comment><comment><USER26> This is great. My weekend project this weekend was to move to KeePassX, but it's not very usable. This UI is great!

<comment><USER11> Try MacPass!

<comment><USER26> Thanks a ton - extremely helpful reply!

</comment></comment></comment><comment><USER27> The title should probably be "KeyWeb - a KeePass Web and desktop client" to be clear that this is not the official KeePass client. I was briefly concerned because I generated many passwords with KeePass, but this post is about a different piece of software.

<comment><USER28> We added "unofficial" to the title.

</comment></comment><comment><USER29> Just built this, looks good so far. Being a totally blind back-end developer I've wanted to look at web accessibility, while the app is accessible I think it could be made better so hopefully I can use this as a way to learn.

</comment><comment><USER30> Excellent work! Clean, beautiful and works out of the box.

Is there any way to have a system-wide shortcut to auto-enter passwords? In KeePassX it's called "Global Auto Type Shortcut". I just can't live without this ;)

</comment><comment><USER31> Would it be possible to connect this to WebDav (i.e. Own cloud)?

<comment><USER32> They have plans for that in Q2 2016. ([https://github.com/antelle/keeweb/wiki/TODO](https://github.com/antelle/keeweb/wiki/TODO))

</comment></comment><comment><USER33> Looks awesome! I've been using 1password, are there any big advantages that KeePass has over it?

<comment><USER34> I'm not sure about "big", it all depends on how much you trust 1password and what your threat model is. For me, the advantage of keepass is that I don't need to upload my credentials anywhere, or trust some closed source blob running in the browser, etc. It has a XML format that enables things like this client to be created.

1password has the advantage of excellent platform integration on iOS, and various browser extensions with auto-fill.

<comment><USER35> > the advantage of keepass is that I don't need to upload my credentials > anywhere

But if you want to sync your credentials across devices, you still have to upload them somewhere, right? Doesn't this just support sync via Dropbox? If so, aren't you then just playing the trust game between two third-parties?

<comment><USER20> You are uploading a file that is encrypted using very strong encryption, not plain text password.

An employee of that company, or if the file was leaked due to technical errors, a member of the general public won't be able to decrypt it. If one of the richest governments wanted to, they might be able to, but if you had reasons to be a target you'd know better than using this.

Also, take a look at SpiderOak.

<comment><USER35> Is strong-encryption something that 1password is fundamentally opposed to, or something they just haven't implemented yet? If I'm going to switch, the answer to question is pretty important.

<comment><USER36> >strong-encryption something that 1password is fundamentally opposed to?

where did you this idea?

<comment><USER35> The comment I replied to which suggested that strong-encryption was a differential between keepass and 1password.

<comment><USER36> As far as I can see, the comment you replied to contains no mention of these things. Can you quote the relevant part?

<comment><USER35> cmrx64: it all depends on how much you trust 1password and what your threat model is. For me, the advantage of keepass is that I don't need to upload my credentials anywhere

oneeyedpigeon: But if you want to sync your credentials across devices, you still have to upload them somewhere, right?

dorfsmay: You are uploading a file that is encrypted using very strong encryption, not plain text password

I took that to mean:

(with keepass) you are uploading a file that is encrypted ... not plain text password (as for 1password)

dorfsmay has now confirmed that was their meaning in this comment: [https://news.ycombinator.com/item?id=11177045](https://news.ycombinator.com/item?id=11177045)

<comment><USER36> Thanks. This was very cryptic, I'm surprised you pieced it together.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER37> I've been waiting / hoping someone would build this! thanks!</comment>


Categories – What's the Point? - <AUTHOR> http://jeremykun.com/2013/04/16/categories-whats-the-point/ <comment><USER2> I encourage anyone interested in learning more about this sort of thing to read this article on the "category design pattern" by Gabriel Gonzalez, the author of the pipes library for Haskell:

[http://www.haskellforall.com/2012/08/the-category-design- pat...](http://www.haskellforall.com/2012/08/the-category-design-pattern.html)

</comment><comment><USER3> Haha. I thought to my uninitiated mind: "What's the difference between categories and sets?" and found this: _Some attempts have been made by category theory to usurp the foundations of mathematics from set theory. That is, rather than taking sets as the most fundamental building block of the mathematical world, give that role to categories. Sets themselves form a category._ [http://www.connections.xamuel.com/Category+Theory-vs- Set+The...](http://www.connections.xamuel.com/Category+Theory-vs- Set+Theory.html)

Sounds to me as an uninitiated programmer like set theory had issues when wielded in the nether regions of modern mathematical theory, and category theory is the kludge that followed.

Maybe I should have done maths; yet when most fascinated by its theories under the influence of a three letter traditional psychoactive, a former IBM employee and multi-decade pure mathematics researcher literally begged me not to, declaring it an enending path that wastes decades of people's lives. Ho hum.

<comment><USER2> A category is a collection of objects with a notion of morphism between said objects. Morphisms are really not defined much beyond that; it is all left rather abstract, though there are some basic laws that must be satisfied.

Categories are relatively uninteresting without functors. Functors are more or less mappings or transformations between categories.

Category theory by some accounts initiated in the foundations of algebraic topology. In that subject, one wishes to codify some of the aspects of a high- dimensional shape or geometric object in algebraic terms. The hope is that the algebraic image of the shape is easier to understand than the shape itself. The mapping of shapes into their algebraic "shadows" is a functor.

For instance, you can take a torus and look at the collection of all closed loops drawn on the surface of the torus. Now identify two loops as the same if one can be smoothly deformed into the other by moving it along the surface of the torus. Long story short, this gives the set of such loops a structure known as a group. There is a very extensive theory developed around groups, so you might surmise that you could partially classify shapes by looking at this associated group (called the fundamental group or first homotopy group).

This mapping from geometric objects to groups of loops drawn on them is a functor from the category of topological spaces to the category of groups. This is the beginning of homotopy theory.

As for your comment on sets, there is the category Set which consists of all sets. That is, the objects of Set are sets and, given two sets X and Y, the morphisms between X and Y in Set are simply the functions f : X -> Y. An interesting technical point here (which is related to your quote) is that Set itself cannot be a set, as there is no set of all sets within Zermelo-Fraenkel set theory (the most common axiomatic formulation of set theory). Rather, there is a notion of class, and one says that the collection of all sets forms a class rather than a set.

</comment></comment><comment><USER4> I don't mean disrespect but the article is pretty empty on explaining what Category Theory is. May be it's just a prelude to a series of other articles but I didn't get that until the very end. Kind of disappointing.

<comment><USER5> I think the title question is being asked of initiates.

</comment></comment><comment><USER6> Aarrgghh!

> there are only two universal properties

Yeah? So what are they???

Hm, Wikipedia (<http://en.wikipedia.org/wiki/Universal_property>) thinks there are a lot more than two:

"This article gives a general treatment of universal properties. To understand the concept, it is useful to study several examples first, of which there are many: all free objects, direct product and direct sum, free group, free lattice, Grothendieck group, product topology, Stone–Čech compactification, tensor product, inverse limit and direct limit, kernel and cokernel, pullback, pushout and equalizer."

<comment><USER7> There are two universal properties in the sense that a universal property is either defined in terms of a "terminal morphism" or (dually) an "initial morphism" (see the Formal Definition in the wiki article) -- the examples are particular instantiations of this general definition.

</comment></comment><comment><USER8> Are there cases of category theory yielding results in a more traditional branch of mathematics? That would seem to be a litmus test of sorts.

<comment><USER9> Yes of course. Pretty much all of algebraic geometry (the study of curves and surfaces defined by families of polynomial equations) owes its current life force to the sweeping reforms it undertook by utilizing category theory in the '50s and '60s. There are a number of conjectures (most notably, the Weil conjectures) whose proofs are attributed directly to the use of category theory.

</comment></comment><comment><USER10> I recently heard "Category theory tells you which parts are easy" from a mathematician working with Haskell Monads. Repeatedly, this turns out to be true (confirmation bias?).

He generalized a algorithm by using an abstract data type (a Monad of course) instead of a specific number type. Now the algorithm can be applied e.g. to probability distributions as well. The category theory tells you about bind and lift. However, the hard part is generalizing the algorithm, because you have fewer assumptions now.

For another example, greatest common divisor is a simple algorithm for numbers. Try generalizing it so you could also use polynomials instead of integers.

</comment><comment><USER11> I think for most people the point of category theory can be one of these: <http://en.wikipedia.org/wiki/Don%27t_repeat_yourself> ; or <http://en.wikipedia.org/wiki/Algebraic_topology> ; or <http://en.wikipedia.org/wiki/Abstract_nonsense> ...but probably it's not so helpful to insist on more than one of these at a time. And I think it would be good if more writers would realize that.

</comment><comment><USER12> I've tried to learn category theory off and on for many years and have gotten pretty much nowhere. From my perspective it's the worst area of mathematics as far as effort in vs benefit/understanding out. Have other people encountered this or am I just a bonehead?

<comment><USER13> Mathematicians can be roughly divided into algebraists and analysts. My biased impression is that algebraists focus on kinds of manipulations that have proven effective in the past, while analysts focus on specific mental models of a system, and then the necessary calculations flow from those models.

There are a lot of areas of math that have no obvious connection to abstract algebra or real analysis (for instance combinatorics, logic, number theory...) yet the vast majority of mathematicians will know what you mean when you ask whether they are an algebraist or an analyst, and will know how they should be classified. In fact if I see a mathematician eating corn on the cob, I can generally tell which they are without asking. (Analysts eat in spirals, analysts in rows. My best guess for why is that analysts pay attention to the cue from how their teeth eat corn, while algebraists follow the visual cue from the lines on the corn.)

This classification is a matter of taste. Any professional mathematician is adept at both areas of mathematics, but will have a clear preference.

Category theory serves as an excellent litmus test. It seems to have a magnetic attraction for algebraists, and a similar repulsion for analysts. At its heart, category theory is an abstraction of common patterns of algebraic manipulation where the details of what you are manipulating become entirely irrelevant. (Indeed you can often replace one type of thing with an apparently unrelated type of thing. Such as a geometric problem about toruses with an algebraic question about pairs of integers.)

Speaking personally, I learned enough category theory to pass all of the courses I had to take, but words like "category", "monad" "cohomology" and "functor" are red flags warning me that I'm about to be uninterested in the rest of the discussion. But YMMV.

<comment><USER8> Great comment. You make it sound like analysts have more imagination—was that intentional?

When I studied math I was definitely, in your taxonomy, an algebraist. But if I went back to it now I'm pretty sure I would be an analyst. I say that because my approach to software has evolved in an analogous way. Also I eat corn-on-the-cob in rows :)

I'd love to properly re-learn all the math I learned before. The way I did it at the time was mostly just symbol manipulation, and that way of thinking no longer interests me.

<comment><USER13> _You make it sound like analysts have more imagination—was that intentional?_

Not intentional. I was trying to be fair, but my interests are clearly on the analysis side, and that shows.

</comment></comment></comment></comment><comment><USER14> Why should there be a point? Can't it be _point-free_?

(Sorry, somebody had to say it..)

</comment><comment><USER15> I really like this quote (from [0], an intro to Category Theory)- "[Category Theory] allows one to see the forest rather than the individual trees, and offers the possibility for study of the structure of the entire forest, in preparation for the next stage of abstraction - comparing forests."

One of the things I've noticed when programming and dealing with abstractions is how your problem gets translated to the tools of your language (what feels natural to a language). Some problems are easier in one language than another. Imagine your language being a shadow puppet, and your problem you'd like to solve is a light source. When you put your language in front of the problem, can you still see a shadow? Today most programming languages will, but if instead of binary filter with your hands, imagine your hands were some weird grayscale thing (like a monochrome LCD). Wherever the light shines through the most, you need to put a bit more work into solving the problem.

Low level languages seem to be much better at watching and reacting to state changes and making decisions on those states (because of the speed of the language, you could do 100s of checks on pins and combinations of pins and get good performance on something like an Arduino). In something like Python, those little checks become more costly. You might need to rethink your problem to get to your solution. You need to abstract from the trees, and get to the forest. The valid solution you had before because of your perspective has changed, and now you need a new approach.

I think a lot of that has to do with finding a pattern in your problem. If you can find a pattern, you can probably make it recursive, write a couple steps and maybe a helper function, and you're done. Problem solved.

Take the fibonacci sequence in Haskell (from [1]):

        fib = 0:1:[a+b | (a,b) <- zip fib (tail fib)]

Start with 0 and 1, this is the pattern you use to build the fibonacci sequence. You use the sequence itself to build itself (no extra variables, you get them all in a list just starting because it evaluates itself). Get the 100th element with fib!!100. It references itself in itself, there's no states to look at, just build the sequence, when you want a value it does the legwork. The Fibonacci sequence in other languages is a little more terse - you need to define some special cases (if 0, if 1), rather than really just building the sequence starting from 0 and 1 then apply thing your pattern.

Now take something like Fizzbuzz - Python makes this extremely easy, whereas in Haskell it seems a little unnatural (at least for me, although they're pretty similar solutions) [2].

        fizzbuzzers = [(3,"fizz"), (5,"buzz"), (7, "baz")]

        for x in range(1, 110):

            string = ''

            for num, word in fizzbuzzers:

                if not x%num: string += word

            print string if string else x

[0] - <http://shuklan.com/haskell/lec12.html#/0/2>

[1] - [http://www.haskell.org/haskellwiki/Haskell_Tutorial_for_C_Pr...](http://www.haskell.org/haskellwiki/Haskell_Tutorial_for_C_Programmers)

[2] - [http://www.haskell.org/haskellwiki/Haskell_Quiz/FizzBuzz/Sol...](http://www.haskell.org/haskellwiki/Haskell_Quiz/FizzBuzz/Solution_Acontorer)

<comment><USER16> A more Python-similar Haskell FizzBuzz is at <http://www.haskell.org/haskellwiki/Fizzbuzz>

I think that's the cleanest method.

<comment><USER15> The thing I really like about the Haskell Fibonacci and that Python FizzBuzz is the ease of scale. Want the next value of fib? Grab it. Want to put more restrictions on fizzbuzz? Add them to this list.

You build the sequence with only the necessary amount of starting information (0:1 for fib, ( (3, "fizz"), (7, "buzz") ), and generate the rest as you need. These are the (I think) most beautiful solutions to problems.

<comment><USER16> That's more extensible. I think that's the perennial problem with FizzBuzz, whether decides the spec demands generalizability or simplicity.</comment></comment></comment></comment>


The UK will block online porn from April.  what we know - <AUTHOR> http://www.wired.co.uk/article/porn-block-ban-in-the-uk-age-verifcation-law <comment><USER2> > AgeID will log which pornography websites are visited and store them

How is this relevant to age verification in any way? The UK government can't even lie straight about why they want to do this.

<comment><USER3> UK politics, in terms of campaigning and image, is almost comically primitive. I don't know that it's a bad thing however, that the likes of Theresa May can't effectively disguise their motives. In the US the whole process is so highly optimized for spin and money, that people spend all day smiling and saying nothing. In the UK they stumble around trying to lie, and failing terribly.

The motives are the same, and maybe even the outcomes, but the quality of the theater is radically different.</comment></comment>


Nintendo Play Station Super NES CD-ROM Prototype - <AUTHOR> https://comics.ha.com/itm/video-games/nintendo/nintendo-play-station-super-nes-cd-rom-prototype-sony-and-nintendo-c-1992/a/7224-93060.s?ic4=GalleryView-ShortDescription-071515 <comment><USER2> The Nintendo PlayStation contains an undumped 4-bit NEC MCU for its CD controller. Once that EEPROM bit-rots (it's already past its guaranteed lifetime), the SuperDisc BIOS cartridge will no longer boot as-is. The two fan-made games ported to the CD-drive will no longer function at that point, and we won't ever be able to directly fix this, only to hack around and approximate the original functionality.

I imagine this won't be a significant loss to its new owner, but it's still unfortunate.

<comment><USER3> Given your qualifications, what would you like to see happen?

<comment><USER2> Find the most qualified engineer in the world to desolder the surface-mount MCU, read out its firmware using the documented debugging mode from the datasheet, and then resolder the MCU back to the system. It won't happen, but it would be nice for posterity.

<comment><USER4> I'd love for this to happen. Then have a MiSTer code made for it or something. Maybe a bsnes variation?

A girl can dream.

</comment></comment></comment></comment><comment><USER5> Fun Fact: Secret of Mana was originally designed on the Play Station. Much of the game's content had to be cut to get it to fit onto a standard Super Famicom cartridge after the add-on was killed.[0]

[0][https://v1.escapistmagazine.com/articles/view/video- games/co...](https://v1.escapistmagazine.com/articles/view/video- games/columns/pixels-and-bits/13744-Secret-of-Mana-Could-Have-Been-Great-With- Its-Missing-Content)

<comment><USER6> Do they have any further details of the cut content? Like images of cut content, what plot was removed, etc.? I've seen numerous applications mention the cut content but the descriptions are always very high level, like in this article.

<comment><USER5> In my experience, Squaresoft is pretty secretive about their development process. Their staff will talk on the record about the process and drop tidbits, like the interview above, about stuff that might have been cut, but it's pretty rare that they'll go into any great detail or provide "beta" screenshots. That stuff rarely happens unless we happen to find it dummied out in the game code somewhere.[0]

For the rest, we sorta have to look at what came later and work backwards from there to try to envision what the features might have looked like. For example:

> One of the most significant changes was the removal of the option to take > multiple routes through the game that led to several possible endings, in > contrast to the linear journey in the final product. [1]

Since this system eventually showed up in the game's sequel, Seiken Densetsu 3 (Now called "Trials of Mana" after its Switch port localization), we can probably assume that it would have worked _something like that_. It's also _probably_ safe to assume that some of the other unused concepts from Secret of Mana eventually found their way into SD3. But I'm always hesitant to get too specific, since game developers change their mind all the time during development.

One of the best examples I can think of for this would be the Soul Reaver series, where the original title had a _huge_ amount of content cut in order to deliver the game on time[2], instead ending on a cliffhanger and with the intention that Soul Reaver 2 would finish it up. We have a pretty good idea of what was _supposed_ to happen in the original conception of the story, because we found a ton of leftover assets, voiceovers from unproduced cutscenes, and design documents. There's even a sequence of the main character "gazing into the future" with pieces of sequences that never occur (presumably they _would have_ if the game had been finished as originally designed). By the time the sequels Soul Reaver 2 and Legacy of Kain: Defiance were produced, however, the story veered off into a much different direction. Some of the boss fights that were planned for Soul Reaver 1 ended up eventually happening in SR2 or LoK:D under very different circumstances, or were scrapped altogether.

[0][https://tcrf.net/Final_Fantasy_VII#The_Red_Man](https://tcrf.net/Final_Fantasy_VII#The_Red_Man)

[1][https://en.wikipedia.org/wiki/Secret_of_Mana#Development](https://en.wikipedia.org/wiki/Secret_of_Mana#Development)

[2][http://thelostworlds.net/](http://thelostworlds.net/)

<comment><USER7> If you're into this, I would suggest looking into the still-developing story of the defunct Fabula Nova Crystallis project (as well as FFXIV). What can be gathered heretofore is wild.

</comment></comment></comment></comment><comment><USER8> For anyone interested, the history of the original PlayStation is pretty interesting (all the different collaborations Sony was attempting with Nintendo and Sega before going it alone - mostly getting rejected by Nintendo and Sega).

[https://en.m.wikipedia.org/wiki/PlayStation](https://en.m.wikipedia.org/wiki/PlayStation)

<comment><USER9> For more recently uncovered information about a possible deal between Sony and Sega, read:

[https://mdshock.com/2019/03/18/sega-and-sony-new-insight- int...](https://mdshock.com/2019/03/18/sega-and-sony-new-insight-into-the- partnership-that-never-came-to-be/)

That article also gives insight into why Kutaragi/Sony wanted to partner with Nintendo.

A quote by Kutaragi:

"I wanted to start up a business that would become a new major income source for the company in the future… [Sony executives] thought it would take too long to start a new business from scratch with venture capital. So the only way to initiate change was from the outside. We could join forces with the best-performing company in the field. We would sell them our technology, establish a track record, and use that as the springboard to future success. That was my reasoning."

Also, from historian Reiji Asakura:

"Nintendo was concerned that its business would eventually be taken over by Sony if Sony continued to drive product development. Although Nintendo was dominant in the game-machine market, the company was fully aware that Sony had a superior research-and-development operation and thus had the potential to outstrip its competitors in the area of technological advancement."

References are in the linked article.

<comment><USER10> Those quotes are interesting. Seems like the prevailing opinion is that Nintendo made a mistake cancelling this deal with Sony because it opened up the door for Sony to become it's largest competitor.

In reality it seems like it was Sony's intention all along to use this as a stepping stone to competing with Nintendo directly anyway.

<comment><USER11> Also, I'd say that "Sony's generally better at the tech" has basically come true. But Nintendo adapted into its current position, which is a pretty nice position to be in. Had they taken the deal, it's possible they could have gotten complacent and gotten sidetracked away from focusing on game quality.

<comment><USER12> The focus of Nintendo on gaming and not technology is even larger that it seems, because the hardware and software engineering of at least Wii and WiiU (and probably even of GameCube and Switch) was almost completely outsourced.

<comment><USER13> Indeed, they always had that Intelligent Systems Co. within their HQ campus, as if engineering jobs needs to be "elsewhere".

</comment></comment></comment></comment></comment></comment><comment><USER14> A UK games journo and general publicist Ryan Brown tried to crowd source to put this in a museum

[https://twitter.com/Toadsanime/status/1227908339767574528](https://twitter.com/Toadsanime/status/1227908339767574528)

<comment><USER15> What's telling is that neither Nintendo or Sony give a flying fsck about this. The real reason people are willing to pay so much is nostalgia, then pile on some novelty and rarity. They'll claim it's an important historical artifact, which it may be. But even in the distant future it will not represent the culture of the day, it's just an interesting oddity that never made it to market.

<comment><USER16> You're not wrong, but it seems to me you could say that of 99.9% of private collecting.

Unless the collection becomes so extensive you and it gain international renown, demand for collectables is all driven by arbitrary, subjective human passion.

</comment></comment></comment><comment><USER17> The teardown done by Ben Heck:

[https://www.youtube.com/watch?v=ug- CyGXMabg](https://www.youtube.com/watch?v=ug-CyGXMabg)

The repair done by Ben Heck:

[https://www.youtube.com/watch?v=qh91IO9cV48](https://www.youtube.com/watch?v=qh91IO9cV48)

The finally working video:

[https://www.youtube.com/watch?v=gaIfPuziJ-0](https://www.youtube.com/watch?v=gaIfPuziJ-0)

<comment><USER18> Working in quote marks. He did an very impressive job, but it's only half working. The cartridge port works, but he couldn't get the drive to read. Shame. I hope someday, someone can get that working.

<comment><USER19> Did you watch the final video? He got the drive to read, play audio CDs through the bootstrap SNES cartridge and then run a home-brew game off of a CD-ROM (no original games exist to test with so the CD format and hardware capabilities were reverse-engineered from the ROM).

"he couldn't get the drive to read" is completely false. It boots a game off a CD-ROM!

</comment></comment></comment><comment><USER20> Semi OT -> Sometimes I'm baffled at how people don't know about rare things like this, but I wonder how long that can last.

Do you think the 'boxed up in a random lot, IDK what it is, some computer thing' behavior we've seen up to now with many rare electronics, games, computers, etc. will go away over time as more people grow up with internet access and web search?

Let's take something that is equally 'dead' in terms of not being made any more: the Samsung Taylor, a dev windows phone. A few devs got some, but otherwise it is gone to the wind. Just to look at it, it looks like a slate smartphone, pretty innocuous. But if you were to search its model number, you'd immediately know you had something rare and valuable to a certain niche (which I admit to being in).

<comment><USER21> I'm a bit into hunting for old film cameras and you'd be surprized how many people barely do any checking before putting things on sale (or worse, just throw them away). I wonder how many old 'Nintendos' ended up on the landfill that way.

For instance here's three old Agfa folding cameras:

[https://upload.wikimedia.org/wikipedia/commons/8/84/Agfa_Sup...](https://upload.wikimedia.org/wikipedia/commons/8/84/Agfa_Super_Isolette.jpg)

[https://thumbs.worthpoint.com/zoom/images2/1/0311/07/agfa- au...](https://thumbs.worthpoint.com/zoom/images2/1/0311/07/agfa- automatic-66_1_1f1b2193571631efb499b730198202d0.jpg)

[https://upload.wikimedia.org/wikipedia/commons/f/fe/Agfa_Iso...](https://upload.wikimedia.org/wikipedia/commons/f/fe/Agfa_Isolette_L.jpg)

One's barely worth anything, one's worth quite a bit, one's extremely rare. Would you know which is which just from looking?

<comment><USER22> I mean, if by "putting them up for sale" they're putting the thing on eBay as an auction, that's not exactly mal-adaptive behaviour. The market will—hopefully!—recognize the value and set the price.

</comment></comment></comment><comment><USER23> A great, great podcast on the whole Nintendo/Sony early saga is:

Business Wars -> Nintendo vs Sony series

Highly recommend.

[https://www.stitcher.com/podcast/wondery/business- wars/e/544...](https://www.stitcher.com/podcast/wondery/business- wars/e/54473555)

</comment><comment><USER24> Wonder what's up with that "NEXT" port. It looks like a cross between USB and HDMI, but predates development of the former by 2 years and the latter by a decade. Would be interesting if it were an early implementation of concepts that were later standardized as USB.

<comment><USER21> Looks like something akin to the serial i/o port of the original playstation:

[https://www.slashgear.com/wp- content/uploads/2019/12/iFixit-...](https://www.slashgear.com/wp- content/uploads/2019/12/iFixit-PlayStation-teardown-2.jpg)

Also if you think that looks like an USB port, check out the link cable for the original gameboy.

<comment><USER25> I think that's right, the fact that it's called "next" seems to imply some kind of chaining as well.

<comment><USER26> Or it means "Nintendo EXTension" or something similar. I wouldn't read too much into their naming schemes wrt what that means for feature set.

</comment></comment></comment></comment><comment><USER27> This is pretty insane. Ostensibly this is even rarer than other Sony oddities such as as the Net Yaroze[0] or the Japanese PSX[1]. I wonder if it truly is the last Nintendo/Sony "PlayStation" in existence.

[0] [https://en.wikipedia.org/wiki/Net_Yaroze](https://en.wikipedia.org/wiki/Net_Yaroze)

[1] [https://en.wikipedia.org/wiki/PSX_(digital_video_recorder)](https://en.wikipedia.org/wiki/PSX_\(digital_video_recorder\))

<comment><USER28> Net Yaroze is not particularly rare.

<comment><USER29> Neither is the PSX which you can easily buy used in Japan.

<comment><USER19> Yeah, saw one lying around the Junk section of HARD OFF for not much. It's only rare in the western market.

<comment><USER30> A working one is much harder to find, the hard drive is signed to the individual unit so when it breaks it's impossible to replace and you end up with a brick.

<comment><USER31> How are they paired? is it using ATA password like Xbox? HDD serial number? its all easily bypassable nowadays.

</comment></comment></comment></comment></comment></comment><comment><USER32> This is one of those situations where $31k seems expensive now, and when it's resold in 20 years you'll see it move for $1mil. Rare things like this tend to increase in value enormously.

<comment><USER33> The thing is, we don't know about that. Maybe it will. Maybe in 20 years less people will be collecting vintage video game consoles.

<comment><USER34> I think you're right. Video games aren't like furniture that gets handed down from generation to generation and increases in value. They only have value to the people who remember them.

In 20, 30, 40 years the vast majority of people who cared about these machines will be dead. Those who still care will be such a minority that there won't be upward price pressure.

It's the same way you don't see people going nuts for Sperry and Burroughs gear today.

<comment><USER35> Get ready in a couple decades for the original Xbox to be on auction house blocks.

<comment><USER36> The problem with that is how common the original Xbox is. In North America, at least, the system was fairly popular; even if it made Microsoft very little to no money at the time.

</comment></comment></comment></comment></comment><comment><USER37> Can someone teach me what a Buyers Premium is? There's just 20% added on top of the current price. Is that basically the fee that the auction house is taking?

<comment><USER38> That's exactly what it is.

</comment></comment><comment><USER39> I feel this truly belongs to a museum.

<comment><USER40> I'd like to think the National Videogaming Museum in TX would have put up an offer if they felt the seller was willing to work in good faith, but based on some comments I've seen from some of the Directors on Facebook about their intersections with the seller at conventions, the impression I get is that's pretty much a non-starter.

And the NVM having probably the largest one-of-a-kind prototype system collections on Earth, it'd have been the natural home for the Nintendo PlayStation. That they want no part speaks volumes, and I'm sure there's a lot there left unsaid in the public eye.

No idea who it'll go to now, but it's probably going to be someone with deep pockets or a collective (like another museum, perhaps) with a fairly wealthy network.

</comment></comment><comment><USER41> I found The Gaming Historian to an excellent source of history about this kind of thing. I don't doubt he's covered this very device at some point.

[https://www.youtube.com/user/mcfrosticles](https://www.youtube.com/user/mcfrosticles)

</comment><comment><USER42> Sony's industrial design in the 90s and early 00s was superb.

</comment><comment><USER43> Looks like Palmer Luckey is one of the bidders. It's getting high up there: [https://twitter.com/PalmerLuckey/status/1228115750381948928](https://twitter.com/PalmerLuckey/status/1228115750381948928)

</comment><comment><USER25> Are the specs of this device well known? I wish this could get into the hands of an emulator developer so that this thing could be preserved in code form. It'll probably end up in some hoarder's collection though unfortunately.

<comment><USER8> There's some specs here: [https://en.m.wikipedia.org/wiki/Super_NES_CD- ROM](https://en.m.wikipedia.org/wiki/Super_NES_CD-ROM)

</comment></comment><comment> alt-enter _We at Heritage can attest the prototype is working, as we 've played a couple of rounds of Mortal Kombat on it using a Super Famicom cartridge._

That gave me a good laugh :). This collaboration reminds me of the Panasonic Q. Nintendo's collaboration with Panasonic that was a hybrid version of the GameCube with a DVD player: [https://en.m.wikipedia.org/wiki/Panasonic_Q](https://en.m.wikipedia.org/wiki/Panasonic_Q)

</comment><comment><USER44> It looks like something from a weird parallel universe.

<comment><USER35> I can't even fathom competing companies today ever working with each other like this. Then again, Sony wasn't a competitor yet in the early 90s.

<comment><USER45> [https://www.theverge.com/2019/5/20/18632374/microsoft- sony-c...](https://www.theverge.com/2019/5/20/18632374/microsoft-sony-cloud- gaming-partnership-amazon-google)

</comment></comment></comment><comment><USER46> What's with those bids? People are bidding $525 for N64's Golden Eye? It's going for $10 at Ebay. Is having it in a sealed box in pristine condition really that valuable?

<comment><USER31> Heritage Auctions is creating a new market for sucker^^^former comic book speculators.

</comment></comment><comment><USER47> Nice domain.

</comment><comment><USER48> Seeing graded, sealed video games makes me angry. Some of the games in this auction are legit rare and haven't been played enough.

I'm glad emulation is a thing.</comment>


BetterWorks (Employee Recognition Platform) Lays Off Most of Employees in Pivot - <AUTHOR> http://gigaom.com/2012/05/17/betterworks-cuts-staff-exploring-options/

<comment><AUTHOR> Employee Recognition Platform laying off all of their employees... oh the irony!

Interesting move as they just raised $8M in August (<http://blog.betterworks.com/press-release-080111/>)</comment>


This is a horrible idea - <AUTHOR> https://twitter.com/maybekatz/status/1014270528209555456?s=21 <comment><USER2> Summary: a JS developer wrote a spec for the package.json file, used in Node.js projects. It has many uses, including dependency management.

A developer who has worked on some Node.js package managers (npm, yarn, pnpm) is annoyed that the spec was written by an "outsider" without getting input from stakeholders. And, trying to enforce a rigid structure and behaviour on a configuration file that is interpreted in different ways by different tools.

I agree with thosakwe's comment. The "clearly defined structure" horse has bolted. I can only see this working by creating a new file with its own conventions, which will not be compatible with any existing tooling, which means it will not be adopted by the wider community.

</comment><comment><USER3> While I don't necessarily think writing a spec for package.json is a "horrible idea," I definitely think it's far, far too late to even bothering starting one now.

package.json is in use in so many places, with so many different changes, that it's more or less pointless to bother enforcing rules anymore.</comment>


Seattle's Million-Dollar, CIA-Affiliated Camera Network - <AUTHOR> http://slog.thestranger.com/slog/archives/2012/08/22/last-week-in-the-surveillance-state-seattles-million-dollar-cia-affiliated-camera-network <comment><USER2> There is nothing in this article worth reading.</comment>


High density mechanical energy storage with carbon nanothread bundle - <AUTHOR> https://www.nature.com/articles/s41467-020-15807-7 <comment><USER2> > _gravimetric energy density of up to 1.76 MJ kg−1_

Gasoline has 47 MJ/kg [0], in 2007 Lithium-ion batteries were 0.36 - 0.90 MJ/kg [1]

[0] [https://neutrium.net/properties/specific-energy-and- energy-d...](https://neutrium.net/properties/specific-energy-and-energy- density-of-fuels/)

[1] [http://www.panasonic.com/industrial/includes/pdf/Panasonic_L...](http://www.panasonic.com/industrial/includes/pdf/Panasonic_LiIon_Overview.pdf)

Cited by Wikipedia [https://en.wikipedia.org/wiki/Lithium- ion_battery#Performanc...](https://en.wikipedia.org/wiki/Lithium- ion_battery#Performance)

<comment><AUTHOR> I am content with a research which already nearly doubles the energy density of Li-ion batteries (0.9 to 1.76). I also think the idea of using carbon instead of lithium is a step forward.

Now, how to squeeze it into an iPhone 14!</comment></comment>


Norbert Wiener: The Eccentric Genius Whose Time May Have Finally Come (Again) - <AUTHOR> http://www.theatlantic.com/technology/archive/2014/06/norbert-wiener-the-eccentric-genius-whose-time-may-have-finally-come-again/372607/

<comment><USER2> This is actually a pretty good article. It points out that Wiener "refused, for ethical reasons, to accept research contracts from the military or from corporations seeking to exploit his ideas". If the article had given an explanation of "exploit", this would be very informative, as well as intereesting. How many other scientists refuse grants for ethical reasons like Wiener's? Was Wiener just being weird?

<comment><USER3> In the '70's a research equipment supplier named Instruments for Research & Industry (now part of Glas-Col) would not sell to the military. Company was founded in 1939, I do not know if that was their policy as far back as WWII but it definitely was during Vietnam War.

Since those times as a teenager my greatest hesitation to growth is due to the possibility of my technology getting out of control with negative net consequences, and have put significant effort to avoid that happening.

Over 40years the one constant which would appear to allow growth without this risk is to choose a capitalist more carefully than one would choose me.

I may be weird but I'm not just being weird.

I was influenced by Wall Street (I was a teenage stockbroker) and would still look forward to a corporation exploiting one of my efforts in a positive way if the structure was properly supportive.</comment></comment>


Mechanical television - <AUTHOR> https://en.wikipedia.org/wiki/Mechanical_television <comment><USER2> Amazingly primitive technology.

My clunky pocket computer is not only capable of letting me read this info but it also offers television and telephone services with which I can reach more people than even lived in 1920. Anyway, have a few cat pictures to browse.</comment>