Google.com has an animated logo using an HTML/JavaScript particle simulator - <AUTHOR> http://www.google.com

<comment><USER2> Here's a copy for anyone that can't see it: <http://www.rubypay.com/google/Google.htm> The version on Google's site is a little different, it clears away the static particles when the logo is in motion.

</comment><comment><USER3> Love it, one of the more interesting google logos. I'm still not sure whether dynamic identities are good or bad for a brand. The pros are it keeps the brand fresh, it allows the users to interact with the brand. But the cons are it can make the brand less recognisable and maybe the confusing for some users. Thoughts?

<comment><USER4> Sure, that's a consideration for smaller brands, but I don't think google has any trouble with consistent brand recognition.

</comment></comment><comment><USER5> Anyone else finding it...slightly annoying? I mean it's neat-looking, but having a big distracting animation pop up every time I open a new browser window (google.com is my home page) is a little less neat.

<comment> mike-cardwell The SSL version of Google doesn't have it:

<https://www.google.com/>

<comment><USER6> or use IE 7 :-)

</comment></comment></comment><comment><USER7> The particles are divs styled with border-radius and position:absolute. Seems like SVG, Canvas, or CSS transforms would be better; I wonder if they chose border-radius and position:absolute for speed or compatibility? I don't have a copy of IE around to try; do they do something different there?

It's amazing the hoops people are willing to jump through to get fast graphics on the web. When WebGL comes out and makes all these hacks obsolete you're going to start seeing some _really_ amazing stuff.

<comment><USER8> IE doesn't support SVG, Canvas, or CSS transforms.

<comment><USER7> Or border-radius. So they have to have a special IE mode regardless.

<comment><USER9> They should just have used a static logo for IE ...

</comment></comment></comment></comment><comment><USER10> I don't see it in ANY browser.

<comment><USER11> Try <http://www.google.co.uk>

That is the only Google site I found it on.

<comment><USER10> Thanks! It worked there for me too.

</comment></comment></comment><comment><USER12> Here is a gist of of the JavaScript file that helps to create the experience: <https://gist.github.com/eeae3d6aa1ac04f074cf>

At a glance, it looks remarkably simple. It also looks as though Google is using parts of the Closure library as well.

<comment><USER13> Most of google's js web apps use closure pretty heavily. It's not that big a stretch to think that there would be some cross pollination.

</comment></comment><comment><USER14> Never mind that, does everyone else get the funky new streaming search results on google using Chrome?

      1. Go to google.com
      2. Start typing
      3. It moves the search box while you're still typing
      4. It starts streaming and updating results in real time as you type.

It's crazy awesome.

<comment><USER15> Strange, mine doesn't do that. I'm even on chrome.

<comment><USER14> Looks like I'm one of the privileged few! ;)

</comment></comment></comment><comment><USER16> This is seriously distracting and I really wonder how many users are going to be completely dumbfounded by the circles floating around where the logo used to be.

An event-based illustrated logo is a simple switch-out. There's not much resistance to understanding the meaning there. The Pac-Man game logo was a bit more complete, but Pac-Man is universally recognized. This on the other hand - how may people will see the logo when they move their cursor away and understand that something on the page isn't broken - that it's intentional?

It will be interesting to see the larger reaction from everyday Google users.

<comment><USER17> Tweeps seem to like it, and it doesn't showup in IE.

<comment><USER18> It works in IE7 (pretty fast), just all particles have the same size.

</comment></comment></comment><comment><USER19> Anyone know if the logo has any meaning beyond the cool tech demo?

<comment><USER20> Google's birthday, I am assuming. Although they tend to flipflop between the 7th and 27th.

<comment><USER21> [http://searchengineland.com/google-balls-logo-not-googles- bi...](http://searchengineland.com/google-balls-logo-not-googles- birthday-49965) claims to have an official statement:

"Today's doodle is not related to a birthday but is fast, fun and interactive, just the way we think search should be."

and mentions that there's a Google press conference tomorrow.

</comment></comment></comment><comment><USER22> Really interesting (at least a few drinks into the night). I tried to click on the logo (obviously to no avail).

Anyone know if it has any deep meaning?

<comment><USER23> That Google engineers are bored?

<comment><USER24> That they have a new toy to play with. It looks to me like the part of the Arcade Fire video where the birds are flying away from your mouse cursor.

</comment></comment></comment><comment><USER25> I surprised they screw with their logo as much as they do. I know for a fact this confuses the heck out of less technically savvy individuals.

<comment><USER26> I'm not... I must have seen about 100 tweets today from people talking about the logo, plus stories on social news sites like HN and Reddit etc.

It's a genius idea because the frequent changes are enough for some people to keep Google.com as their homepage and it gets people talking about Google as well.

</comment></comment><comment><USER27> It's really cute and clever, and if my grandmother has used Google today, she was probably overcome with fright that she had broken something.

</comment><comment><USER28> I don't like their links fading-in (I could click faster on, say, language tools if I had not to wait). Now they make my browser choke (firefox on netbook, cpu in powersave).

</comment><comment><USER29> any way to direct-link to it? I think it might not show up for non-US locations. certainly nothing to see on google.co.jp

<comment><AUTHOR> Tried to think of a way before I posted it but couldn't come up with anything. I would happily change the URL if somebody knows how to direct link.

<comment><USER30> As somebody above says, <http://www.google.co.uk> works :)

</comment></comment></comment><comment><USER31> hmm.. a clever trick for non-chrome users to realize how slow the javascript in their browser is?

<comment><USER32> If we're playing that game, I suspect the reason it doesn't show up in Opera is that Opera's JS engine is faster. ;-)

<comment><USER33> I've been developing a Javascript intensive bookmarklet for the past month or so. It works on FF, Chrome, Safari, even IE6. But on Opera, I cannot figure out why it behaves so glitchy. Sometimes it works, sometimes it doesn't, but it never, ever shows me any errors. Maybe this has to do with the fact that it caches things even when you tell it not to. In addition to that, AFAIK there's no way to deselect text (without breaking other things), which makes developing drag and drop pretty much impossible on it. It's "developer tools" show you a big list of "errors" which are mostly it knit-picking various CSS properties things that it doesn't support, like rounded corners for example.

Perhaps I'm wrong. Maybe my code is getting run perfectly, but it's just happening so blazingly fast that it doesn't affect anything at all. In which case, I'd still give Opera the big "fuck you" that I'm feeling after writing this.

But hey, when you open a new tab it animates.

<comment><USER34> > that it doesn't support, like rounded corners for example.

Maybe you should use the current version for your tests, which supports rounded corners.

<comment><USER33> I am. Or at least the update checker says I am. I'm running windows if that matters.

</comment></comment></comment></comment></comment><comment><USER35> Works on <http://www.google.co.uk>

</comment><comment><USER36> fun game: try to see how many particles you can trap in a corner while the rest of the logo stabilizes. I can get two easily and have almost gotten three.

</comment><comment><USER37> I see it in Firefox but not in Chrome from some reason...

<comment><USER38> Working for me. Running 7.0.514.0 canary build.

</comment></comment><comment><USER39> very cool love it, html5 I assume?

</comment><comment><USER40> Best Google Doodle of all time?

</comment><comment><USER17> What's really cool is that when you move the browser window around, the particles move accordingly.

</comment><comment><USER41> I really hope this is part of a campaign to kill off IE6.</comment>


How to fix recruitment: Hit Reply - <AUTHOR> https://medium.com/@xcambar/tell-recruiters-whats-wrong-d428b63ced1a#.kkgzliss9 <comment><USER2> > Keep the dialogue open between recruiters and developers.

The problem is that recruiters are too dumb to (try to) understand the field they recruit for and too dumb to listen. The former results in meaningless buzzwords spaghetti in offers and completely mismatched offers only based on trivial keyword matching (e.g. as a seasoned Linux admin/sysprog I get offers for Active Directory admins with RHEL as a "nice to have" point, but I matched "sysadmin" and "linux", so I must be a fit). The latter is a conclusion from my own clear description how and with what information to contact with me -- I constantly get notifications that go against that, despite that I ensured it's public and prominent.

> [...] if we don't act to fix what we think is broken while we have the > ability to, we're part of the problem [...]

This assumes we _have the ability_. We don't, because the other side doesn't listen for some reason.</comment>


Ask HN: How do I find out where my competitors are advertising online - <AUTHOR>

I have a small list of competitors who are already established in the market I want to break into.
I want to find all the places online that they advertise. After all they have already done the hard work in finding these places.
If they continually advertise in the same places it must be working for them and will be a great place to start advertising too.
My starting point is the domain names of the companies. <comment><USER2> From an article I read earlier today:

 _"Follow competitors' ads around the web. Search for competitor names, features, products, etc, or get their keywords from a keyword research tool. Look at the search results for their name and main keywords. Are there any sites there that have AdSense? Any blogs that have written reviews of a competitor's product? Those are all prime advertising opportunities."_

[http://insight.io/blog/2010/11/startup-marketing-lessons- lea...](http://insight.io/blog/2010/11/startup-marketing-lessons-learned- part-2-adwords-is-only-the-beginning/)</comment>


Are Pixels Productivity? A study 24 years in the making - <AUTHOR> https://msgooroo.com/GoorooTHINK/Article/13036/Are-Pixels--Productivity--A-study-24-years-in-the-making/6042

<comment><USER2> "Perceived productivity" is a worthless metric, making plots out of it is just ridiculous. How can you rate your productivity when you were 8 years old? You should know better as a data scientist.

That said, I have a 24" screen at home, but I use it mostly for gaming, while most of my programming is done on a 13" mbp.

<comment><AUTHOR> You are quite right, it is a ridiculous metric that doesn't stand up to any scientific rigour.

The article was just supposed to be a bit of fun about my personal experience with different monitor configurations. I thought that this might be interesting to the HN crowd since so many of us spend so much time in front of screens.

<comment><USER3> i liked the article, i think I'm going to go out and get another screen in the next week.

</comment></comment></comment><comment><USER4> How do the find the portrait vs landscape orientation works for you? Any change in productivity between the two?

I had a team-mate who swore by having one monitor in portrait mode where he kept his word/specs/reading whilst he worked primarily on the landscape monitor. Seemed to work for him.

<comment><AUTHOR> I think that I would prefer 2 landscape (one on top of each other) then 2 portraits on either side. The problem is in getting the mounts to make it all work properly.

Also, HN seems to have dropped the "∝" symbol from the title!

<comment><USER5> What video cards do you use with your current setup?

It wouldn't take much carpentry to set them up in landscape, maybe with a cinder block or something in the back as a counterweight.

<comment><AUTHOR> I have a pair of AMD Radeon 5700 Series cards (apparently released in 2009!), which seem more than up to the challenge. One thing to consider is that with 2 graphics cards, you needs at least a 550W power supply (I had a 500W power supply that died trying its best).

Unfortunately my carpentry skills lacking, and the Dell Single Monitor Arm [1] are NOT suitable for mounting 2 monitors on top of each other (not enough height).

[1]: [http://accessories.us.dell.com/sna/productdetail.aspx?c=us&l...](http://accessories.us.dell.com/sna/productdetail.aspx?c=us&l=en&s=eep&cs=6099&sku=332-1235)</comment></comment></comment></comment>


Meta-study finds robust sex differences in children's toy preferences - <AUTHOR> http://www.psypost.org/2017/12/study-finds-robust-sex-differences-childrens-toy-preferences-across-range-ages-countries-50488 <comment><USER2> "Feminism as a movement for political and social equity is important, but feminism as an academic clique committed to eccentric doctrines about human nature is not. Eliminating discrimination against women is important, but __believing that women and men are born with indistinguishable minds is not __. Freedom of choice is important, but ensuring that women make up exactly 50 percent of all professions is not. And eliminating sexual assaults is important, but advancing the theory that rapists are doing their part in a vast male conspiracy is not."

~ STEVEN PINKER

</comment><comment><AUTHOR> Google would fire those scientists.</comment>


'Erase Mac' Doesn't? - <AUTHOR> https://eclecticlight.co/2019/12/30/erase-mac-doesnt/ <comment><USER2> From the article, who knows? There's some fear, uncertainty, and doubt thrown on the question, but the author doesn't seem to have tried it, just analyzed marketing language and usage documentation.</comment>


Map/Reduce: A visual explanation - <AUTHOR> http://ayende.com/Blog/archive/2010/03/14/map-reduce-ndash-a-visual-explanation.aspx?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed:+AyendeRahien+(Ayende+@+Rahien)&utm_content=Google+Reader <comment><USER2> Wow, still no comments?

Well, for those seeing this but debating clicking through, it's a quite good breakdown of how / why Map/Reduce works, and gives a good idea of why it's useful and some of the advantages. It's only a conceptual overview, but it goes a long way to understanding what's become a buzz-word lately (probably due to the NoSQL uprising).</comment>


Chloroquine is a Potent Inhibitor of SARS-Coronavirus Infection & Spread (2005) - <AUTHOR> https://www.ncbi.nlm.nih.gov/pmc/articles/PMC1232869/ <comment><USER2> Chloroquine's efficacy in treating COVID-19 was found not to be effective and potentially harmful, right? But was it effective against SARS as the paper suggests?

<comment><USER3> [https://www.henryford.com/news/2020/07/hydro-treatment- study](https://www.henryford.com/news/2020/07/hydro-treatment-study)

DETROIT – Treatment with hydroxychloroquine cut the death rate significantly in sick patients hospitalized with COVID-19 – and without heart-related side- effects, according to a new study published by Henry Ford Health System.

In a large-scale retrospective analysis of 2,541 patients hospitalized between March 10 and May 2, 2020 across the system's six hospitals, the study found 13% of those treated with hydroxychloroquine alone died compared to 26.4% not treated with hydroxychloroquine. None of the patients had documented serious heart abnormalities; however, patients were monitored for a heart condition routinely pointed to as a reason to avoid the drug as a treatment for COVID-19.

The study was published today in the International Journal of Infectious Diseases, the peer-reviewed, open-access online publication of the International Society of Infectious Diseases (ISID.org).

<comment><USER4> Neither your comment nor the summary at the link (I didn't read the actual paper) say anything about whether they adjusted the statistics for plausibly relevant differences in the two populations.

It says the results "require further confirmation in prospective, randomized controlled trials", but surely what we all want to know is whether the non- random assignment of patients to the with/without groups was compensated for at all?</comment></comment></comment>


Why We Hear Some Silent GIFs - <AUTHOR> https://www.nytimes.com/2017/12/08/science/why-we-hear-some-silent-gifs.html <comment><USER2> does this mean there exist non-silent GIFs?</comment>


Linus Torvalds did not commit this - <AUTHOR> https://github.com/amoffat/masquerade/commit/9b0562595cc479ac8696110cb0a2d33f8f2b7d29 <comment><USER2> Linus actually commented on this lack of identity handling in 2012 in his famous explanation of why he doesn't use GitHub: [https://github.com/torvalds/linux/pull/17](https://github.com/torvalds/linux/pull/17)

"since github identities are random, I expect the pull request to be a signed tag, so that I can verify the identity of the person in question."

And:

"github throws away all the relevant information, like having even a valid email address for the person asking me to pull."

<comment><USER3> Yeah, the GPG signing support in Git would be the best solution to this, unfortunately GitHub doesn't offer integration for that.

<comment><USER4> Maybe this is where Keybase.io could come in?

</comment></comment></comment><comment><USER5> Kinda hard to not come up with it when setting up your credentials is the first thing git wants you to do before you can commit anything. BTW. You can also overwrite them by command line switches per commit instead of setting environment variables.

I guess it's worth noting here that you can sign your commits with GPG: [https://git-scm.com/book/tr/v2/Git-Tools-Signing-Your-Work](https://git- scm.com/book/tr/v2/Git-Tools-Signing-Your-Work)

<comment><USER6> Similarly, nothing stops you altering the time claimed in the commit. Or -- for that matter -- from taking someone's diff and claiming credit for it.

For that reason, I jokingly created `git-upstage`, which streamlines the process of abusing commit edits and plagiarizing code! It squashes a branch, backdates it 5 minutes, and claims you wrote it.

[https://github.com/SilasX/git-upstage](https://github.com/SilasX/git-upstage)

Edit: Looks like my last commit left the important stuff commented out and can't fix it at the moment. Ah well, you're going to use the tool to rip it off anyway ;-)

<comment><USER3> I love this. Had a project in college that was supposed to be time limited... based on repository times. Oops. Big mistake prof. We rolled back the times on our repo and laughed maniacally about our free 6 hour extension.

<comment><USER7> Should professors really be spending their time locking down all the ways students may try to cheat? At Caltech, proctoring exams (for example) is not allowed by institute policy. A student's honor that he didn't cheat is considered good enough.

<comment><USER8> Why wouldn't you proctor exams? The time spent is small, less than 10 hours a semester, and the proctors can answer student questions or make corrections and clarifications to test questions. That it's a small disincentive to cheat is nice too, though in my experience only the most blatant of cheating would be caught. I say all this as someone who proctors exams.

<comment><USER9> > Why wouldn't you proctor exams? The time spent is small, less than 10 hours > a semester, and the proctors can answer student questions or make > corrections and clarifications to test questions.

Because Caltech faculty (and, for undergraduate student exams, grad students) have better things to do with their time than proctor exams (and, perhaps more to the point, because Caltech wants to attract faculty and grad students that _feel_ that they have better uses for their time that baby-sitting exams.)

And, frankly, like many aspects of the trust extended to Caltech students, its a recruitment policy -- Caltech is an extremely selective, extremely small school that is competing with other elite institutions to attract the best students.

<comment><USER10> Honor codes and not proctoring exams (rather, the students doing it themselves) are a fairly common feature of engineering colleges, it isn't really something that contributes to Caltech standing out.

<comment><USER9> > Honor codes and not proctoring exams (rather, the students doing it > themselves) are a fairly common feature of engineering colleges, it isn't > really something that contributes to Caltech standing out.

> Honor codes and not proctoring exams (rather, the students doing it > themselves) are a fairly common feature of engineering colleges, it isn't > really something that contributes to Caltech standing out.

I'm not saying Caltech is _unique_ in doing that, I'm saying that in the universe Caltech operates in it would conflict with their recruiting interests -- both for faculty and students -- to operate in a different way.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> It's a github 'social' issue , not really a git issue. It might also be a legal issue (identity theft). And i'm a bit surprised github let people impersonate others through their 'social' features.

<comment><USER12> It is really not possible for github to track the origin of commits.

For example, consider a fork. If you pull some commits from the original and then push them to your fork then that would look just like this.

The only thing I can think of is that it may be possible to track commits if everyone would sign them as they were created, but that would require all users to change, so I don't see how that can happen.

<comment><USER13> A checkbox that requires push commits to be signed (you don't have to sign each one, but the top level of any push would have to be signed) would be nice. So would _any_ indication that commits are signed in the GitHub UI. I've started signing my commits to GitHub, but verifying even that a signature is present (let alone correct) requires you to clone the repo and investigate it with commands you'd probably have to Google, as far as I know. No UI visibility whatsoever.

</comment></comment></comment><comment><USER14> TBH we "exploit" this when accepting PRs for an open source project I work on. It's not really feasible for us to expect / force each PR author to have a clean commit history, so we basically do some squashing, then commit the "single" change as the original author before merging.

<comment><USER15> So, when submitting to your project it can happen that I'm afterwards blamed for things I didn't do? (Or praised)

<comment><USER16> That's the problem with all these guys obsessed with clean commit history.

<comment><USER17> What's wrong with having a clean commit history?

I think it's something people take too lightly.

<comment><USER5> Nothing. Just like there's nothing wrong with not having it clean.

<comment><USER18> Depends on the project. If I ran the Linux kernel, I'd insist on clear commits too.

<comment><USER19> Oh no no no. If you are handling something as important as the Linux kernel, you will absolutely want traceability over anything as trivial as clean history. You will impose signed commits and signed merges only... none of these FF stuff. If you want clean history on top of that, you will enforce that on original pull request not after the fact.

<comment><USER18> I'm responding to, "there's nothing wrong with not having it clean."

Yes, there often is. And I do enforce it on the original pull request.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> The issue at hand here is interesting: GIT _commit_ integrity is not guaranteed over all operations, even if you sign commits.

The problem is that GIT often changes commit details. If you, for example, rebase or cherry-pick a commit, the identity changes - as the commit includes a reference to the parent commit(s). This means that once you do any of those (standard) operations, the signature becomes invalid.

Signing only makes sense on a tag level or in repositories that keep all commits and never change them (e.g. by explicitly merging and adding merge commits).

There are systems that preserve commit integrity during all of those operations, e.g. DARCS.

<comment><USER21> IMHO git does it right. If signature was only at the commit level you could do a variant of replay attack.

For example you could cherry-pick all commits except security fixes and create a malicious version of the software that has all commits still signed by the original author.

<comment><USER20> I was not saying that the signature is _just_ at a commit level ("patches" being the DARCS lingo).

DARCS, just as git, has tags for that. A tag depends on all previous patches, so a signed tag guarantees just the same as a signed git tag does.

In that regard, git is strictly less powerful.

</comment></comment></comment><comment><USER22> You can use github's api to identify out who pushed a commit:

Currently the event in question is on page 3 so you can use: [https://api.github.com/repos/amoffat/masquerade/events?page=...](https://api.github.com/repos/amoffat/masquerade/events?page=3)

It i will roll to further pages as new events come in.

Github comment with formatted json event output: [https://github.com/amoffat/masquerade/commit/9b0562595cc479a...](https://github.com/amoffat/masquerade/commit/9b0562595cc479ac8696110cb0a2d33f8f2b7d29#commitcomment-12528903)

The login of the push is identified of course as the owner of the repo 'amoffat'

</comment><comment><USER23> Yeah this is known, and you can get yourself an awesome list of contributors if you want: [https://github.com/zixan/uberfareestimator/graphs/contributo...](https://github.com/zixan/uberfareestimator/graphs/contributors)

I think github should allow me as a user to confirm contributions made out of the system, at least the first time per repo.

<comment><USER24> That's a great solution. People should tweet it at Github and see if they implement it.

</comment></comment><comment><USER25> Also you may send email from any address you want if you put it in the "MAIL FROM" SMTP transaction.

Thankfully the Linux kernel project accepts only signed commits.

<comment><USER26> > Thankfully the Linux kernel project accepts only signed commits.

This is false, FWIW.

<comment><USER27> Well, the signoff line that Linux requires is a legal signature, not a cryptographic one. It is meaningless to us, but it's good enough for lawyers.

</comment></comment></comment><comment><USER28> I think this is pretty well known. You could always sign your commits if you're really worried about someone sticking your email address in their git config.

<comment><USER29> While it's probably well known from a command line perspective, I doubt it's well known from a web service (GitHub) perspective. I have a healthy distrust of git logs but trusting a photo and username on GitHub is a pattern reinforced by every other social app.

<comment><USER30> Not only it's not well known, but it breaks them:

some years ago I reported this issue on gitorious, which yielded an HTTP500 when the repository contained a signed commit:

[https://issues.gitorious.org/issues/193](https://issues.gitorious.org/issues/193) (it's now down, but hopefully it'll reappear on archive.org)

and it'll prevent Launchpad from automatically mirroring git repositories (which is paramount to be able to automatically update PPA with recipes)

[https://bugs.launchpad.net/bzr- git/+bug/1372149](https://bugs.launchpad.net/bzr-git/+bug/1372149)

</comment></comment></comment><comment><USER31> I can imagine a scenario where a malicious employee is intentionally injecting malicious code (backdoor, whatever) and wants that commit tied back to someone else (their enemy, boss).

<comment><USER32> If they have push access, would github log who actually pushed it (i.e. ssh key)?

<comment><USER33> Yes, Github's authenticated push logs will tell you that. However, Github won't make those public, because they consider user identification private info.

(Or at least they won't provide those push logs to the Apache Software Foundation, which is how I know this.)

<comment><USER32> They won't even give it to the owner of the repo in question?

<comment><USER33> They will not. For instance, the ASF cannot get the push logs for all the repositories under <[https://github.com/apache>](https://github.com/apache>).

</comment></comment></comment></comment></comment><comment><USER34> So this is a Github feature, which might be useful in some cases, I get that. The good news here is that it only goes one level deep, i.e., it does not automagically show up on Linus' account in any way.

This also has been an issue with Git for a long time. In any repository, you can see the email of the person who committed it, and it can be spoofed, because there are no checks. So while here we see it linked to Linus' account, the problem with plausible identity theft has always been a part of Git.

There are ways to solve it. Git can just put "<unsigned>" next to non PGP commits. Github can also put "<unverified>" when commits are made outside of Github realm (not using their keys of https auth), or are unsigned.

Just be careful while merging pull requests, which one has to anyway. And because one has to, these issues never seem to get a fix.

</comment><comment><USER35> I don't get it, I never really looked at github comments before. Why are these comments so low-quality? Aren't developers who commit to github the only readership?

<comment><USER36> I had a relatively sane comment (IMO) about whether github should instead consider allowing users to opt-in to "show unsigned commits which claim to be from this address as unknown."

Oddly enough my comment itself was altered to be a mindless obnoxious comment! (does github use git commits to track the comments themselves?)

<comment><USER37> Repository authors can edit anyone's comment.

</comment></comment></comment><comment><USER38> You can just use this and not have to overwrite your name/email:

        git commit -m "message" --author=<author>

You can even pass a different commit date with --date=<date>.

It's actually a really useful feature when you're migrating a project from a different SCM system to git.

</comment><comment><USER39> Another example of why email addresses cannot serve as "identities" like so many people, somehow magically, assume.

If you know it, everything about email and its protocols would make you assume the exact opposite.

Now PGP signatures on the other hand … but hey, nobody wants those, right?! Far too complicated! /rant

<comment><USER40> This has nothing to do with emails serving as identities and everything to do with not believing user's input without verification.

If github was linking to user's profile based on first/last name rather than email the issue would be the exact same.

</comment></comment><comment><USER41> There is a _huge_ UX problem with validating the legitimacy of anything online. I have to know that credentials are available, and I have to know that it's possible to validate them. How do I even know if a particular set of credentials are legit? I'd have to know where to find validation for them. That's a whole other ball of wax in itself.

And we default to not requiring such authentication because the means we have are either completely useless (i.e. passwords) or so onerous (I always have to Google when I setup cryptographic credentials on anything, and we expect lay users to do this?) that they ruin adoption rates for software and services.

State-of-the-art secure credentialing should be as easy as passwords. Easier, even. Yet they're currently as "easy" as configuring Apache.

<comment><USER42> Any information you can get online or over the phone can be forged. (Passwords can be discovered, as can private keys, fingerprints, and the results of genetic tests.) Certain kinds of physical evidence, such as dead skin cells with usable genetic material in them, are to my knowledge effectively impossible to forge, but they can be "accidentally" contaminated beyond usability. Doing things in-person face-to-face is only an improvement if you knew the person before anyone had any incentive to fool you on the person's identity, which is hard; even then, allegiances can be bought, sold, and changed for other reasons.

My point is that fixing this issue is out-of-scope for a DVCS. It could, however, be improved a bit.

</comment></comment><comment><USER43> So it seems the author has identified a real issue here, but I will go meta on this and identify issues with his demonstration. In my organization this would count as a bug report, so I wondered why this issue was not communicated privately to the operators of Github so they can have a chance to fix it before some un-educated person does some damage. Then I realized this issue might affect other git content hosters, so going public might alert them as well as forcing Github to fix it. Regardless, would the best approach not be to communicate privately first and allow Github to fix it before going public? If this was raised privately and not acted upon, then why are Github's internal processes so slow? So many questions, so little time...

<comment><USER44> I reported this to Github privately about a year ago – specifically, I asked why there isn't some visual indication when Git's `user.email` fails to match any of the Github account's verified e-mail addresses. If you commit with a `user.email` that doesn't match _anyone_, you get a little question mark; it seemed like they could do a similar thing when you commit using a `user.email` that matches someone-who-isn't-you. Even just showing which Github user made the HTTP or SSH connection to push the changeset would be an improvement.

The tech told me that the current behavior was by design, and then pretty much said I didn't know how git worked and didn't understand Github's team/sharing/trust philosophy. I was pretty disappointed by their response, all told.

</comment></comment><comment><USER45> It's pretty much the same as forging email. Most won't notice. Both can be signed with pgp, but few check and it's clumsy for the mainstream.

</comment><comment><USER46> In other words, a lot of people haven't the slightest clue how Git works. Luckily Github record push history separately

<comment><USER47> This is not just about Git, it's also that Github is implicitly trusting user data, by linking to the user profile.

In Git, it's clear that there's no authentication, a user is just a tuple of strings, but on Github the same doesn't apply, a user is actually a well defined entity which is secured by one or even two factors of authentication, so the expectations are different.

</comment></comment><comment><USER48> I found that github's automatic identity resolution is actually helpful in some cases. I migrated a bzr repo into github recently and was pleasantly surprised to see my contributors matched up to their github accounts. I understand that many people might not want this, but it is a feature that can be useful.

</comment><comment><USER49> This has been around for quite a while now; I made a post on my blog about it back in 2013: [http://www.jayhuang.org/blog/pushing-code-to-github-as- linus...](http://www.jayhuang.org/blog/pushing-code-to-github-as-linus- torvalds/)

Of course this doesn't actually give you access to the person's account, but UX wise, it's incredibly misleading for someone to click a commit in my repository by "torvalds" and have it actually go to his profile. My issue is very much with the social implications of this as opposed to it being an actual security issue (see: signed commits).

There should be some indication at the very least that a commit is not signed.

</comment><comment><USER50> So, this actually works:

[https://github.com/zixan/uberfareestimator/commit/b4c5a16408...](https://github.com/zixan/uberfareestimator/commit/b4c5a16408d906b06310c6b232bbd947aca1226f)

<comment><USER5> Why wouldn't it? I'd say it's "supported by design".

<comment><USER50> It was a test to test the design.

</comment></comment></comment><comment><USER51> Unfortunately so far the same is possible for gitlab too.

Isn't it the general problem that each user is authenticated as the "git" user and the rest (all the git commands) is just "user.name" and "user.email" fields in prefs?

<comment><USER52> They could identify users by their auth and store that data with the commits instead of relying on the user email. You either have to provide username/password, API token, or ssh key to push to a github repo. All of these identify you as you.

Edit: It is important to note that this would not replace git authorship info as it is very possible that you pushed something that someone else committed. It would allow you to have a UI trail to who pushed it which could help if you theorize that someone is impersonating someone else.

</comment></comment><comment><USER53> Interesting, there must be some level of validation because it does not show up in his public activity feed[0]

[0] [https://github.com/torvalds?tab=activity](https://github.com/torvalds?tab=activity)

<comment><USER54> That's because there's a difference between a GitHub account (usually authenticated by a key) and a git commiter (only identified by the name and email). It would be pretty annoying if hundreds of commits popped up in his feed every time somebody forked Linux or git.

</comment></comment><comment><USER55> GitHub issues become ridiculous places full of mindless stupidity whenever an issue breeches a certain level of popularity. I'd love to see a mechanism to improve signal to noise ratios, it's not a place for Redditisms.

</comment><comment><USER56> I don't like github's dependency on some git EMAIL variables and stuff.

First of all already of course there is the problem that putting your email on the internet is asking for spam.

But a bigger problem is, if I'm on a machine that doesn't happen to have those variables configered, and I push something to github, even if I use my github username and password then, it does not show me as author. Very annoying.

EDIT: I don't like git itself's email dependency either. But at least github could have done something with the fact that you login with a username... :)

<comment><USER57> You can put anything you like in the email field. I use fake addresses such as tom@tmbp (me on my laptop), tom@tw7 (me on my Windows 7 PC), and so on.

Add these addresses to your email addresses list on the settings page of your github account if you want your github avatar, etc., to be shown against commits using these addresses.

</comment></comment><comment><USER58> One workaround would be to remove any public email address you commit under from your Github profile. Github uses these email addresses to tie back to your user profile so if you don't want commits pointing at your profile, don't tie email addresses to your profile.

Perhaps some mechanism is called for here for approving tying back to your user on new repositories or making any repository not owned by you or your organizations require an explicit opt-in to tie back to your profile.

Edit: This is kind of the equivalent of spoofing the From address in an email.

<comment><USER59> My github profile email is different from my git author email. The latter is even more accessible. Just run git-log on any repository an author has committed to.

<comment><USER58> Yes but if you remove that git author email from your list of emails on Github, any commits done under that email will no longer link back to your profile.

</comment></comment></comment><comment><USER60> Yeah, this is one of those "feature not a bug" things that's been known for some time. As others have pointed out, sign your commits if this bothers you. It's even possible to get your fellow open source contributors to sign commits to your project, as we do with the Metasploit Framework: [https://github.com/rapid7/metasploit- framework/wiki/Landing-...](https://github.com/rapid7/metasploit- framework/wiki/Landing-Pull-Requests)

</comment><comment><USER31> Another good article on git-signing: [http://mikegerwitz.com/papers/git- horror-story](http://mikegerwitz.com/papers/git-horror-story)

<comment><USER61> Yes one have to be careful when merging and signing. But otherwise it works really well.

</comment></comment><comment><USER62> we even do not know if he REALLY did not commit this ;)

</comment><comment><USER33> To guarantee the origin of the commits in a Git changeset, you need either PGP-signed commits or the authenticated push logs for a centralized server.

[http://www.sunstarsys.com/essays/git-and-non- repudiation](http://www.sunstarsys.com/essays/git-and-non-repudiation)

</comment><comment><USER63> If i recall right, it's abuse of this that got the farcical/satirical "c plus equality" project drummed out of nearly every code hosting site. The name and email pulls in a Gravatar, the same one probably used on many other sites, with the result that it amounts to a really convincing forgery.

</comment><comment><USER64> [https://github.com/warner/git-lockup](https://github.com/warner/git-lockup)

Makes it so that when you "git pull" it automatically checks a digital with a certain public key and refuses to apply the patch unless it has a valid signature.

</comment><comment><USER61> We use signed commits in the Cryptech project and it works really nice. So much in fact that I now sign all commits for all git repos I work on. It would be nice if Github displayed the signature though.

</comment><comment><USER65> git should really make it possible to use openssh/openssl keys for signing - so that I have one key both to push to github and sign my commits. I know that they can be converted from one form to another ... but its really inconvenient, especially on Windows, etc.

The GPG key is designed for a email based collaboration flow - that Linus uses. But most of us use Github or Bitbucket's UI to collaborate.

Github/Bitbucket should use this key in their UI as well - to show verified users.

<comment><USER66> I bought a YubiKey[0] a while back and was able to get it to do exactly what you're talking about--even on Windows, which I use most often. It wasn't necessarily easy to set up, but it has been working pretty consistently. It would have probably been easier if I had known more than just the basics of GPG.

I have since switched to using my YubiKey and GPG for SSH authentication on pretty much everything, as well as using it to sign my tags in my public git repositories. I don't think I would want to go back to moving keys between devices or setting up unique keys on each device now that I've got my YubiKey set up. Worth the investment, in my opinion.

[0] [https://www.yubico.com/products/yubikey- hardware/](https://www.yubico.com/products/yubikey-hardware/)

</comment></comment><comment><USER37> Related: [http://mikegerwitz.com/papers/git-horror- story](http://mikegerwitz.com/papers/git-horror-story)

</comment><comment><USER67> Wow the comments there are on par with 4chan.

</comment><comment><USER68> Isn't github just a mirror? I doubt serious kernel development happens there. tl;dr who cares?

<comment><USER67> It isn't just about Linux. You can masquerade as _anyone_ on any public project and cause confusion.

</comment></comment><comment><USER69> This is more of a problem with GitHub than git.

Remember, it's not that hard to host your own git repo. There's no need to use GitHub.

<comment><USER37> This has nothing to do with GitHub. The commit author field in Git is like the "From" field of an email; you can put whatever you want in it.

<comment><USER70> This has everything to do with GitHub.

Git provides mechanisms to sign both commits and tags, and to verify those signatures. GitHub fails to make use of those mechanisms.

</comment></comment></comment><comment><USER71> related: [https://github.com/will](https://github.com/will)

<comment><USER72> No, not related.</comment></comment>


"AI bookkeeper" startup that raised $100M and failed used humans instead of AI - <AUTHOR> https://www.forbes.com/sites/davidjeans/2020/07/20/scalefactor-raised-100-million-in-a-year-then-blamed-covid-19-for-its-demise-employees-say-it-had-much-bigger-problems <comment><USER2> There has been faked AI ever since the invention of the original Mechanical Turk in 1770.

<comment><USER3> No wonder my Turk stock took such a hit.</comment></comment>


Breaking: Diebold Accidentally Leaks Results Of 2008 Election Early - <AUTHOR> http://www.theonion.com/content/video/diebold_accidentally_leaks

<comment><USER2> I thought about submitting this, if only to raise awareness of the fradulent system of electronic voting machines. It's only funny because it's true.

See this for congressional testimony about the problem. <http://news.ycombinator.com/item?id=88924>

</comment><comment><USER3> heh, "Voter"</comment>


Ask HN: Which companies hire remote only or remote first? - <AUTHOR> I'm looking to move to a remote working situation, I have read about a couple small companies that are remote only or remote first, are there any lists of companies that are by default open to remote working? Particularly for software engineer positions. <comment><USER2> Automattic Inc. (WordPress), Buffer, and many more... [http://blog.cloudpeeps.com/top-10-companies-winning-at- remot...](http://blog.cloudpeeps.com/top-10-companies-winning-at-remote-work- culture/)

</comment><comment><USER3> I started doing remote work as a freelancer (less hassle with foreign companies) last year.

Always find a few companies to hire remote workers on AngelList. And when I post my profile on Hackernews' "Seeking Freelancer"</comment>


Car locks hacked with a single swipe device. - <AUTHOR> https://youtube.com/watch_popup?v=l7OadDz3Ums

<comment><USER2> The title might be a bit misleading... from the videos, it doesn't look like there's any "swiping" of the device (unless by "swipe", you mean "steal", in which case I stand corrected). I wouldn't be surprised to see that they're all bluetooth-enabled cars, I believe there are some known exploits in that area.

</comment><comment><USER3> I hope the device in Texas is positively identified, I want to see how exactly the car thieves do it.</comment>


Is H.264 a legal minefield for video pros? - <AUTHOR> http://news.cnet.com/8301-30685_3-20000101-264.html <comment><USER2> The article appears to be taking the position that it _isn't_ a legal minefield, saying:

      "Personal and non-commercial activity" sounds ominous for professionals.
      But it turns out it's not, exactly.

But it goes on to explain, case by case, how essentially any commercial use of the video produced from these products is in fact _not_ covered by the Final Cut Pro or Adobe Premiere h.264 licenses. It seems the only kinds of professionals who are safe are those who are part of a supply chain where someone further on the supply chain is responsible for procuring the h.264 license, like employees of a movie studio where the studio itself has a license.

</comment><comment><USER3> [http://www.mpegla.com/main/programs/AVC/Documents/AVC_TermsS...](http://www.mpegla.com/main/programs/AVC/Documents/AVC_TermsSummary.pdf)

"For (b) (1) where an end user pays directly for video services on a title-by- title basis (e.g., where viewer determines titles to be viewed or number of viewable titles are otherwise limited), royalties for video greater than 12 minutes (there is no royalty for a title 12 minutes or less) ..."

This probably explains the maximal duration of most videos on youtube.

<comment><USER4> I wonder how they came up with that 12 minute figure. I mean a half-hour lecture doesn't make you Hollywood, nor does a 10 minute long short film mean you're an amateur.

How long is a standard US half hour TV show minus adverts and credits? Or did someone do a survey of adult sites to see how long the clips were?

</comment></comment><comment><USER5> That's not the scariest part for Pros

Here's the EULA for our PRO camera :

[http://www.facebook.com/photo.php?pid=584693&l=d37e6ecc2...](http://www.facebook.com/photo.php?pid=584693&l=d37e6ecc2a&id=1429834573)

That's right, a MPEG2 camera that can't be used for anything but home movies without paying MPEG-LA more money.

And when you pay them for using your own camera, you find that you have to pay again to import MPEG2 into Final Cut

[http://www.facebook.com/photo.php?pid=584692&l=a8a46fa56...](http://www.facebook.com/photo.php?pid=584692&l=a8a46fa560&id=1429834573)

And according to MPEG-LA encoders & distributors must pay, so by using your camera you are exposing the venus you show it in to royaslty payments to MPEG- LA.

Want to know how much that'll cost :

[http://www.mpegla.com/main/programs/AVC/Documents/AVC_TermsS...](http://www.mpegla.com/main/programs/AVC/Documents/AVC_TermsSummary.pdf)

It's still cheaper than doing a Blu-Ray</comment>


.NET Framework Version Comparision - <AUTHOR> http://jinaldesai.net/net-framework-version-comparision-table/ It is frequent usage to see all the .NET Version with it's features on one page. While surfing on net it is difficult to find or even not a single site provides all version on one plate with features. Following is a try to put all the .NET Framework versions together with other release and features details. <comment><USER2> C# as a language had numerous and interesting features implemented in the last years. I always wished that Java was that fast in making improvements, instead of spending years for every decision.

<comment><USER3> Agreed, apart from nullable types which I think is a misfeature (having dealt with the inevitable null reference/null value tristate hell left by some developers).

<comment><USER4> I thought .NET types were optionally nullable? I don't think they are by default.

<comment><USER5> Basic types are optionally nullable. int? is nullable, int is not.

It is a fantastic tool in many cases where a null is much clearer than something like -1 to denote a missing value.

However, I can see the issue with some developers using nullable types for everything. But any sufficiently powerful/flexible tool is always going to be misused by some.

<comment><USER6> I had the misfortune in the past to maintain C# code that kept everything as strings; whether it was an integer, a floating-point number, a guid, a date or a boolean. Lousy developers can abuse anything, in itself in my opinion this is not a reason to not have it included.

(I have a the same opinion about goto and operator overloading; clearly the folks at Microsoft agree with me here.)

</comment></comment></comment></comment></comment><comment><USER7> I'm so desperate for C# .NET stuff to show up on HN that I'm even willing to vote up this uninteresting, unreadably-formatted blog post.

<comment><USER8> C# needs to be decoupled from MS. It is too cool a language to be tied up with windows.

<comment><USER9> As a certain lawsuit is illustrating, C#/.NET is much less coupled to MS than Java is to Oracle. Oracle is suing Google for creating an implementation of Java without their blessing, a clear indication that they believe they own and control the platform. By contrast, Microsoft has issued a legally-binding pledge not to sue people for creating their own implementations, and published the platform's spec as an open standard.

Mono admittedly lags a bit behind Microsoft's implementation of the platform _, but that's mostly a question of resources. If Mono had been embraced by the open source community the way Java has been (as it should - see previous paragraph), then that wouldn't quite be the case.

_ Though not by much, and not in all respects. That crew is doing some really great stuff.

</comment></comment></comment><comment><USER10> Be aware that there also exists a "NET Compact Framework" used on the XBox, Silverlight and Mobile devices. This caught me off guard when I tried to get JavaScript running on the XBox[1], since it has a different, stripped down feature set than the _real_ NET Framework.

[1] [http://www.phoboslab.org/log/2012/04/javascript-on-the- xbox-...](http://www.phoboslab.org/log/2012/04/javascript-on-the-xbox-360)

<comment><USER11> The compact framework can also be used on Windows desktops and can make sense if you want to bundle dotnet with your app (because you want to improve the installation experience) while minimizing download size and you don't need features from the real dotnet framework.

</comment></comment><comment><USER12> For what it's worth 4.0 also added co-variant and contra-variant generics which are surprisingly useful.

<comment><USER3> I've written about 400kloc in C# 4.0 and I haven't had a need yet :(

<comment><USER13> How is that ironic?

<comment><USER3> Corrected - thank you :)

</comment></comment></comment></comment><comment><USER14> Missing .NET 4.5, which introduces C# 5 with async support. C# is a great language. Shame it's stuck on Windows and the "enterprisey" .NET framework.

<comment><USER15> What is "enterprisey" about .NET?

Mono is a real alternative, many businesses run it production, including the likes of Fog Creek.

<comment><USER4> .NET is very "enterprisey". It seems to be designed to make creating line-of- business applications easier.

<comment><USER15> What exactly makes it enterprisey? I am always really unclear on what makes something "enterprisey" other than perceptions.

<comment><USER16> IMO, complete integration (one solution, one vendor) across the board (from OS, to IDE, to Database, to Frameworks, etc) is what makes something "enterprisey". That, and a large and mature ecosystem built around it.

<comment><USER15> But that's not true. Plenty of .NET users do use other OSs (through Mono) and databases (I use MySQL). Sure, the best IDE is VS and there's tons more docs and support on using it all on Windows, but the same can be said of Rails with Linux and Textmate for example.

Enterprisey is a matter of perception and shouldn't be a slur.

<comment><USER14> If you step outside of the startup bubble, you'll find that the bulk of .NET stuff is boring line-of-business apps developed by large corporations using the MS stack from top to bottom because MS is "safer" than open source.

I actually work at a .NET startup doing non-traditional things with .NET and we have the hardest time hiring new developers because of the "enterprisey" nature of .NET and the type of developer that generates.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> The thing I like most about C# is the new 4.5 async method decorators CTP which are frankly async methods done right.

For those not in the know, you just need to add an async to the front of the method and then put in await on whatever operation is going to take a while.

You can literally take synchronous network code modify a few methods and get 100x the throughput.

<comment><USER18> > You can literally take synchronous network code modify a few methods

A few methods? Visible async taints, always (think haskell monads, because that's pretty much what it is), you have to convert the complete dynamic scope leading to those newly async method or it'll never work correctly.

It's more than "a few methods" unless your system is absolutely trivial.

So no, you literally can't do that, let alone literally.

Not to mention, `async` marks the method as asynchronous, it does not _make_ the method asynchronous:

> put in await on whatever operation is going to take a while.

That operation also needs to be async itself, and ultimately it needs to be _implemented_ as running on a separate execution queue. At the very least, this means wrapping "whatever operation" in a `TaskFactory.StartNew`. Not just adding an `await` to synchronous code.

Ultimately, `async` and `await` still are nothing but sugar over the Tasks API.

<comment><USER19> I appreciate your perspective on this. I've been using the new Tasks from the Parallel Library and really enjoy them. But, once I started reading about the async markup I was a little unsure as to what I gained from it since as you mentioned it's really just a new way to write the task.

Personally, I haven't had the time to really sit down and play around with both to see how I feel about code legibility and maintainability between the two techniques.

Are you aware of any extra functionality gained by marking methods async? It seems the new markup is more useful for frameworks. Think async action methods on controllers for mvc rather than your own little methods.

<comment><USER18> > Are you aware of any extra functionality gained by marking methods async?

As far as I know there isn't any, the gain is in code readability/simplicity from the POV of an imperative developer: async/await are hints which the compiler transforms into CPS by thunkifying code following an `await`. According to Eric Lippert's series on async/await[0], the compiler also performs complex code generation to try and make try/except blocks behave "sensibly" in this imperative-looking code. While necessary for the coding style, I still am not sure whether that's an advantage or a drawback of async/await.

> It seems the new markup is more useful for frameworks. Think async action > methods on controllers for mvc rather than your own little methods.

Technically, from outside the method `async T foo()` is no different from `Task<T> foo()` I believe, it's only the internal detail which change (mostly composing async callees and returning the result of an async chain). On the other hand (again this is something drawn from Eric's post) alongside async/await the framework team will add new APIs the Tasks API set, one of them being "multiplexing" of tasks (waiting for all tasks of a set of tasks, or any task of the set, although I'm sure the community has already implemented that separately)

[0] <http://blogs.msdn.com/b/ericlippert/archive/tags/async/>

</comment></comment></comment></comment><comment><USER20> The DLR + IronPython is some impressive and really useful stuff.

</comment><comment><USER21> > 9\. .NET Micro Framework – a version of the .NET Framework related to the > Smart Personal Objects Technology initiative

What are those?

<comment><USER4> Well Java has its Java Rings...

<comment><USER21> I think I still have one...</comment></comment></comment>


Show HN: 20-Things – a friendly community without dark patterns - <AUTHOR> https://20-things.com/ <comment><AUTHOR> This is still very early stage (hoping to be able to launch in December this year) and many features are missing (such as threaded comments).

The Frontpage is limited to 20 things and auto-scrolling (endless scrolling) is not used, hoping to allow users to "get their fix" and not get lost in the content rabbit hole.

Signups require a valid SMS-capable phone number and some 40 countries are supported at this stage. Each user signup comes at a cost and I hope to achieve quality engagement and content rather than quantity.

By requiring a phone number (twitter and others seem to have this too), I hope to deter users with bad intentions. I hope to build a community where diversity is embraced and celebrated and users are kind and respectful of other viewpoints and ideas.

It would mean a lot if you could try it out and provide constructive feedback/thoughts/ideas.

Tech stack: ASP.NET MVC+SQL and several other amazing libs/things credited at [https://20-things.com/about](https://20-things.com/about).

Thank you.</comment>


Google Instant - Is it good for environment? - <AUTHOR>

Yesterday i was searching on Google with firebug ON, and observed instant search consuming more bandwidth than normal search (3-10X).
see - http://www.twitpic.com/30o2cv/full
I had searched for "google videos", total bandwidth consumed - - Without Google instant-9k, With Google instant-49k (5 times normal search)
Is it good for environment?
If more bandwidth is consumed means more resources are consumed which adversely affects the environmental.
After Google Instant lot of other websites are implementing the instant versions which can deteriorate the situation further.
One more issue, in developing countries bandwidth is very precious, people have to pay lot for low bandwidth.
Is the instant search feature good for developing nations (with limited internet resources)?
Is the instant search feature good for environment? <comment><USER2> Your observations are correct, but I wouldn't worry too much about them.

If you're concerned about the environment, I should point out that Google has a policy of being carbon neutral. Therefore all of the environmental impacts on Google's side have already been offset.

As for developing countries, <http://www.google.com/instant/> says that Google autodetects slow connections and turns instant off for them. So the feature should be a non-issue for them - you only get it if your connection is good enough for it to be worthwhile for you. (If you have a fast connection but pay by the megabyte, there is an option to turn it off as well.)

</comment><comment><USER3> Tbh, this is far too complex to just look at bandwidth...

On your side, not only is it more bandwidth, but it's more CPU time on their servers, granted I'm sure the shorter the search is, the more the raw search data is cached (not a static output cache, so it still is customizable on-the- fly).

On the other hand, the amount of time spent searching on the Google scale is so much less that it could honestly end up saving energy. 350 million hours of user time per year saved is a VERY impressive projection, that could mitigate the costs pretty significantly, especially for users who refine searches multiple times anyway.

</comment><comment><USER4> This indeed correct, If you see consumption in terms of KBs they are not significant 20-100kb, but you see in terms of multiples, 2-4X bandwidth consumption will be very significant considering Google search having very higher network consumption world-wide.

</comment><comment><AUTHOR> <http://www.twitpic.com/30o2cv/full>

</comment><comment><USER5> That's an interesting observation</comment>


How to hack Silicon Valley, meet CEOs, make your own adventure - <AUTHOR> http://www.jperla.com/blog/post/how-to-hack-silicon-valley-meet-ceo-s-make-your-own-adventure

<comment><USER2> Summary: Apply to lots lots of jobs you know nothing about and have no interest in taking.</comment>


JPMorgan Discovers Further Cyber Security Issues - <AUTHOR> http://dealbook.nytimes.com/2014/10/02/jpmorgan-discovers-further-cyber-security-issues/ <comment><USER2> Is anyone really surprised?

IT Security is a cost center and, honestly, the damage from this hack (money wise) to JP Morgan is likely less than the cost of better security.

Also, the larger the payoff ... the more effort people will put into the attack. No IT system is 100% secure unless its been shredded. Even a no- network PC in a vault is still vulnerable to a vault door breach.

<comment><USER3> Chase has a "feature" where their passwords don't allow special characters and ignore upper/lowercase, at least on their mobile app. I'm not surprised other things are amiss.

<comment><USER2> Ya. It isn't really excusable.

</comment></comment></comment><comment><USER4> "In the filing, JPMorgan said there was no evidence that account information, including passwords or Social Security numbers, were taken."

I wonder what was actually "compromised" about the 76 million accounts if not account information.

<comment><USER2> Read the filing:

User contact information – name, address, phone number and email address – and internal JPMorgan Chase information relating to such users have been compromised.

The compromised data impacts approximately 76 million households and 7 million small businesses.

However, there is no evidence that account information for such affected customers – account numbers, passwords, user IDs, dates of birth or Social Security numbers – was compromised during this attack.

[http://www.sec.gov/Archives/edgar/data/19617/000119312514362...](http://www.sec.gov/Archives/edgar/data/19617/000119312514362173/d799478d8k.htm)

<comment><USER5> "However, there is no evidence that account information for such affected customers – account numbers, passwords, user IDs, dates of birth or Social Security numbers – was compromised during this attack."

Perhaps someone who has more experience with security and system administration can answer this: If you get root access to a system (as mentioned in the original article), isn't it fairly easy to make it nearly impossible to find evidence that any particular piece of information has been compromised?

It's funny that this wording (there is no evidence) should be used. I don't know if JPMorgan can confidently assert that this information has not been compromised, yet when stated this way it sounds like they are.

<comment><USER6> There is security software which can restrict even root access to files. One such example is CA ControlMinder.

It can protect files/programs/processes at the kernel level and redirect authorization attempts through its own authorization engine and then back through the original syscall (if permitted). So, you shouldn't, but you could chmod a file to have world-read/world-write access and then set default access to the file to 'none' via this authorization engine and it would still be inaccessible to all users (even root).

You can form more granular controls, such as 'this file can only be accessed by the process launched by program with device/inode xx/yy', and 'this program cannot be launched if any of these 8 attribute checks show as being modified'..

By the same interception mechanism, auditing can be performed which records when specified files are accessed, by whom, and which server they had originally connected from when they did it. An audit only mode can simply monitor activity without performing any denials. Add in a keylogger that targets terminals of specific users, or just specific surrogate accounts (eg, when any user su's to root) and you can get a closer inspection of all activity performed (and not just activity to specific protected files/resources).

So, it's possible to tell what's been compromised, but one would need to be running such security software and have it properly configured for auditing the right resources. This isn't a trivial task to perform across environments with tens of thousands of servers.

</comment></comment></comment></comment><comment><USER7> JPMorgan Password Said to Lead Hackers to 76 Million Homes

         Oct. 3 (Bloomberg) -- Hackers exploited an employee password to crack a JPMorgan Chase & Co. server and ultimately pull off one of the largest cyber-attacks ever, accessing data on 76 million households and 7 million small businesses.

[http://www.bloomberg.com/news/2014-10-03/jpmorgan- password-s...](http://www.bloomberg.com/news/2014-10-03/jpmorgan-password- said-to-lead-hackers-to-76-million-households.html)

</comment><comment><USER8> This is interesting: "made off with a list of the applications and programs that run on every standard JPMorgan computer". That would mean source codes of the applications?

<comment><USER9> I would not infer that the "list of the applications and programs" would mean the "source code of the applications".

I would assume its _literally_ what it says, the lists most big orgs maintain of their standard system configuration(s).

<comment><USER10> I wouldn't assume that at all. They say "a list of the applications and programs", not "program listing...". In this case, it reads to me as just that, a list, such as Word xx.xx, Outlook xx.xx, girlfriend 2.0, ms-dos 5.5, etc.

<comment><USER9> That's what I meant (see the second sentence). The first sentence of my post was, however, originally missing a "not" (now added), so I see the confusion.

</comment></comment></comment></comment><comment><USER11> Title is inaccurate. The only thing new here is the press release stating the # of records compromised. This doesn't really constitute "further" breach.</comment>


Ask HN: How much does it cost to browse the web on a Kindle 3? - <AUTHOR>

After feeling disgusted over the prices of wireless data packages in the US, I noticed Amazon is offering its Kindle 3 with "Free 3G" access. Does that mean I can really browse the web anywhere for free, or only download purchased books over 3G? Also, does the experimental web browser support rich web apps like Google Maps and Gmail? <comment><USER2> it doesn't support rich apps, and you can only browse wikipedia on 3g.

<comment><AUTHOR> Are you sure? I just found this saying you can browse anything: [http://answers.yahoo.com/question/index?qid=20090506230833AA...](http://answers.yahoo.com/question/index?qid=20090506230833AAVQbmj)

<comment><USER2> [http://www.wired.com/gadgetlab/2009/10/international- kindle-...](http://www.wired.com/gadgetlab/2009/10/international-kindle- crippled-at-launch-no-web-access-outside-us/)

<comment><USER3> If I'm reading it correctly, it sounds like the browser still works in the US.</comment></comment></comment></comment>


Copyright Infringement: British Man Faces Extradition To U.S. - <AUTHOR> http://www.deadline.com/2012/01/copyright-infringement-tv-shack-extradition-to-u-s/#utm_source=someplace <comment><USER2> I'm scared of a world where governments become the policemen of large corporations, specially corporations like movie studios that largely work like a gambling operation.

In fact, 'henchmen' would be a more appropriate term, because the laws they are enforcing is not the law of the country but rather a law dictated by their mafiosi overlords.

I _hate_ being this political this early in the morning (heck, I need some coffee first!), but the US is increasingly becoming like a magnified version of the corrupt governments I grew up despising.</comment>


Move over, Impossible Foods: fungi-based "steaks" are here - <AUTHOR> https://newfoodeconomy.org/move-over-plant-based-meat-fungi-steaks-are-here/ <comment><USER2> One aspect I'm curious about is that since these fungi will get ~100% of their energy from sugar water, how do they end up comparing energy & water usage wise compared to regular meet.

Instead of growing alfalfa, you are growing sugar cane/beats. Instead of feeding/growing cows, you are feeding fungi.

Certainly, I'm willing to bet that this uses less water and energy, but is it 1 order of magnitude less or 10? The other meat alternatives (Impossible ,etc) have similar issues.

I live relatively near this, so hopefully I'll get a chance to try and cook this meat alternative in the next year. I love cooking meat in many of the traditional manners and niche like suos vide so I'm really interested in seeing how it differs and how versatile it is.

One thing I've disliked about the current plant based ones, is that they have limited availability in stores and are usually preformed and/or seasoned and super expensive (seems they should be cheaper than meat* if they are less resource intensive to produce).

*Given meat has many forms of subsidies (insurance, cheap water, etc.), direct price comparison is difficult.

<comment><USER3> Cows aren't paid for their labor producing meat. Farmers don't pay carbon taxes methane taxes for cow externalities.

</comment></comment><comment><USER4> The author describes how it tasted etc. going in. May sound silly, but I have to wonder how it was coming out.

<comment><USER2> Considering that people eat mushrooms all the time, most likely fine.

<comment><USER5> In fairness, it's not a crazy question - mushrooms contain a lot of undigestable and fermentable carbs (raffinose, chitin) that can affect ...passage...in some people, and cause flatulence in others. Westerners outside of central Europe tend not to eat meat-replacement-sized portions of mushrooms and are probably more familiar with the digestive dynamics of meat.</comment></comment></comment>


Messed up a freelancing project, client is threatening legal action - <AUTHOR> Hello.
I'm a junior who has recently took up a freelancing project. We agreed on a milestone based scheme $6000 for the whole project. For the first two months everything went smoothly and I delivered on time, and have been paid on time as well.
However the project was increasing in scope, and unfortunately we did not draft a contract/explicit milestones and I found the project was beginning to get more complicated than I thought. All of the code I wrote was already pushed to git. Due to I guess the pressure at school (finals week), some issue with my SO, financial problems, I just got burned out and stopped replying to my client. At this point I was paid half ($3000) of the amount, and I feel like I've completed half of the milestones as well.
A few months later I received a letter threatening legal action such as fraud from my client. I knew it was a shitty thing to do to simply stop replying to him, but I was at a precarious time in my life where I even contemplated suicide. Thankfully I don't contemplate those thoughts anymore, but I feel myself going through that spiral of depression again seeing this threat of legal action.
What are my options? <comment><USER2> First thing you should do is realize your feelings are irrelevant to a business arrangement. I point this out because I'm not sure you realize this.

Second, talk to a lawyer at least for a free consultation on this matter. The answers you'll get her will range from past experiences to wild guesses, and will be of dubious helpfulness in your specific situation. In dealings where summertime brings up lawyer, it's wisest to stop taking to them and talk to a lawyer.

If the later advises you should work with the client to finish the project. Ultimately what the client wants is the work done. For the remainder of the work work with them to build a detailed statement of written with your deliverables.

</comment><comment><USER3> Most of advice in this thread is bad advice.

1\. Fix your mental health issues. Top Priority. If you kill yourself at some point because you can't get out of the depression spiral by yourself everyone will be at loss.

2\. Get a lawyer. Nobody here can and should give you legal advice.

3\. Learn from your probably expensive mistake. You are an adult, whatever decision you make in life will have consequences. Man up and take responsibility for your mistakes.

</comment><comment><USER4> Talk to some of the senior law students at your school or the law professor. But in the end you failed to honor a contract. You need to repay in full the owner. You need to finish the project for your self health. Next time you do contract work, make sure its all mapped out milestones etc. Make the client agree about extra scope of services work (more money for you). And have a backup plan formulated if you need third party help to meet deadlines, extra people or whatever.

</comment><comment><USER5> IANAL, so take these with a grain of salt. A few suggestions:

1\. Explain him the problem and offer a full refund. 2\. Explain him the problem and offer to continue work for a smaller fee if he drops the lawsuit.

Worse thing you can do is to completely cut communications with a client. People tend to understand that you are going through a rough patch if you talk to them.

</comment><comment><USER6> Even if the following seems extremely client focused, I am a fellow freelancer.

First acknowledge that a client pays you to produce something, he finds valuable. He does NOT pay you to spend x hours programming... (even if you bill by the hour).

The milestone based payment is for your benefit (so that you have a steady cashflow, and that your risk of him not paying goes down towards completion).

The client really only cares about one of the milestones... the last.. (or at most a few, that enables him to do stuff with the software he wanted).

That you completed 50% of the milestones might be either something useful to him, or not. Even if he has access to the source code you already wrote, chances are, that any new contractor wants to start over from scratch (I would).

So from his perspective, he paid you 3,000 dollars and you delivered nothing (worthy to him). No wonder he is unhappy. 3k$ may be pocket change for him, or it may have killed his project forever..

As for options. First of all, don't run from him, that only makes stuff worse. If possible, set up a meeting in person (that is gonna suck for you, but it really makes a difference).

Tell him, honestly, what went wrong. As for the expanding requirements, try to agree to share the blame for that. Most of the other stuff is on your shoulders only, and you have to accept the blame for that.

Apologize unconditionally, except for the expanding requirements.

Now, it is time to look forward.

Offer him to complete the project, or offer him some refund if he won't let you complete it. Ideally you should offer him close to a full refund, but you probably don't have cash for that.

If the project is completed by somebody else and you cannot pay anything back, offer him to do something else as a freebie...

And most important of all, learn from the experience. As much as you depend on the clients to pay you on time, the clients depend of you to deliver something useful.

For most clients (especially not steady businesses) they have allocated something like three-quarters of all their money to you, and they probably cannot raise more...

Don't take on project you know will be hard/impossible to finish due to time or skill constraints WITHOUT being frank about it...

I know it probably looks bleak now, but if you are any good you will have a long career in front of you. The soft skills (negotiations, keeping your word etc) matters as much as the hard skills (programming or what ever).

Especially your word, do what you can to keep it! and if you are in risk of not keeping it, tell the client up front. You client might accept a slightly reduced version to hit an important date and then get the final version slightly later - but you don't know if you don't communicate..</comment>


VC Funding for Robotics in 2015 - <AUTHOR> http://www.hizook.com/blog/2016/01/12/venture-capital-vc-funding-robotics-2015 <comment><USER2> Who's profitable? Once upon a time, 1983 was the year of the robotic startup. That didn't end well.[1] It looked so promising back then; mapping using ultrasonic sensor was starting to work. But it wasn't good enough.

So far, the only profitable autonomous products are industrial robots and vacuum cleaners. (The surgical robots like DaVinci are teleoperators.) Even Boston Dynamics, in the end, failed to produce a usable product; the LS3 (the militarized version of BigDog) was canceled.

The technology is much better today than ever before, and there's a lot that could be done. But so far, there's nothing that's cost effective enough to be produced in volume. Except robot vacuum cleaners.

If robot vacuum cleaners were cost effective and able to keep out out of trouble (such as getting snagged in cords) most offices would be using them. That's not happening yet.

[1] [https://www.frc.ri.cmu.edu/~hpm/project.archive/robot.papers...](https://www.frc.ri.cmu.edu/~hpm/project.archive/robot.papers/2000/Denning.Mobile.Robotics.bankruptcy)

<comment><USER3> Are drones considered robots? If so then they're a smashing success.

<comment><USER4> Some level autonomy is a requirement to call something a robot. Lots of drones are remote controlled and thus not (fully) autonomous and not robots in my eyes.

</comment></comment></comment><comment><USER5> Great to see this list on HN. It is a huge resource to the robotics community.

</comment><comment><USER6> Great list. What do you think is driving the growth?

<comment><USER7> There have been massive improvements in AI in the last few years. Particularly things like machine vision, speech recognition, and reinforcement learning. AI is one of the major things that has been holding back robotics. It may be that it's time has finally come, or at least is very close.

<comment><USER8> At least in the flying-robot space, I think cheap batteries and sensors have been at least as important.

The sensors -- primarily accelerometers -- are etched in silicon, and benefit from a lot of the same cost and quality improvements as other microelectronics.

Batteries don't get better as fast as processors, but they do get better. About 7% per year for the past two decades. That has been adding up, and finally tipped us over the point where you can have your own tiny flying helicopter for $15.

</comment></comment></comment><comment><USER9> It may requires great protection on intelligent property since there are too many copycats in the market. If they can "copy" with good quality, it would be more acceptable (although it is not right). But if they are only produce electronic rubbish as usual, they would destroy the industry and lower consumers' confidence with their low cost rubbish.

</comment><comment><USER10> How has Sphero/Orbitix raised so much money? They have raised $88M total.

</comment><comment><USER11> When will be the year when a robot will clean my room? I've been waiting 28 years. Please just make it happen, someone.

<comment><USER12> Are you dirtier than a Roomba can handle?

<comment><USER4> The thing is that a Roomba (or Neato, I have one and they work great) only vacuums the floor. I have a kitchen, toilet, furniture that needs cleaning and dusting as well every once in a while. I still have to do my own laundry, except for the actual washing itself.

I want a robot that does all my cleaning, not just the floor. Preferably without buying 10 different robots but one that does it all.</comment></comment></comment>


The Apple doomsday clock. - <AUTHOR> http://time.com/32775/if-theres-no-iwatch-in-60-days-apple-is-doomed-doomed-doomed/

<comment><USER2> Why only 60 days, assuming they are making a watch? The moto 360 isn't being released for a while, and nobody is impressed with the samsung smartwatch.

</comment><comment><USER3> What a stupid sensationalistic article. How about the Time Magazine doomsday clock?</comment>


OnStartups.com redirects to birch.com – did they forget to renew their domain? - <AUTHOR> http://onstartups.com <comment><AUTHOR> I just noticed when my RSS feed filled up with trucker software posts. [http://onstartups.com/all](http://onstartups.com/all) still shows the original posts though.</comment>


Why are modern sneakers so ugly? - <AUTHOR> http://www.37signals.com/svn/posts/1151-why-are-modern-sneakers-so-ugly <comment><USER2> They're ugly because the market which was once (in, say, the 1980s) the "sneaker" market has segmented into two markets: casual sneakers, whose purpose is to look cool, and serious exercise shoes, whose purpose is exercise.

Serious exercise shoes need to be ugly to distinguish themselves from all- purpose sneakers.

</comment><comment><USER3> do you also complain about how ugly 'modern' computers are? How bout emacs?

No. He's right, it is more about function than form.

as a runner, you don't really care how they look (unless you're on the cover of Runner's World you ain't gonna look pretty anyways), but rather how they are built.

honey combed webbing? for breathability . metallic silver? reflectors so you don't get run over by that guy in his F-150 who 'didn't' see you, or maybe that lady obsessively talking on her cell phone.

'gel-ified?' gel in the soles to help the shoes endure the punishment a real runner will give them.

shiny gold? see: metallic silver

Do these shoes correct the flat-footed stride that I have? Do they correct the over-pronation of my ankles? Will they endure 100-mile weeks while I train for a marathon? Do they have enough padding and support because I'm overweight?

go take your 'stan smiths' and run 5 miles and come back when your calves are shot to hell and flinders. would be better off running bare feet than in those junkers.

<comment><USER4> _go take your 'stan smiths' and run 5 miles and come back when your calves are shot to hell and flinders. would be better off running bare feet than in those junkers._

He said he preferred the look.

</comment></comment><comment><USER5> This is a weak post. There are literally thousands of sneaker variants available these days. He didn't have to buy the ugliest model. Also, if you actually run, your shoes get stankdified and munged up very quickly making them a poor choice for occasions where tasteful footwear might be important.

</comment><comment><USER6> > I'd prefer the minimalist look of a pair of Stan Smiths

Those are very ugly shoes.

</comment><comment><USER7> Why is MySpace so ugly? Because your tastes are not those of the majority.

<comment><USER8> Wait, are you saying MySpace is not ugly? Number of users/Popularity != Site Not Ugly.

</comment></comment><comment><USER9> In somewhat more surprising news, a man actually notices and cares about the appearance of his running shoes.</comment>