IOS Integration Testing by Square - <AUTHOR> http://corner.squareup.com/2011/07/ios-integration-testing.html

<comment><USER2> Ok, this might be somewhat dumb; I'm just starting to get into testing. How does KIF[1] compare to Kiwi[2]?

\--

[1]: [http://corner.squareup.com/2011/07/ios-integration- testing.h...](http://corner.squareup.com/2011/07/ios-integration-testing.html)

[2]: <http://http://www.kiwi-lib.info/>

<comment><USER3> Kiwi is for unit testing, KIF is for integration testing. They don't do the same thing (nor try to). Since you said you're just starting to get into it, here's what that means:

Integration tests simulate a user using your app - tapping on controls, manipulating views, typing in text, etc (see the video in the blog post). As these steps run you have simple tests to make sure the app is behaving as you expect it to.

Unit tests exercise more discrete things like model objects, controller logic, validations. Tons of small tests like "when we add these money values together, is the sum what we expect?".

At Square we use KIF for integration tests and GHUnit for unit tests. We run both on a continuous integration system (CruiseControl.rb) that runs the tests whenever we push new code.

</comment></comment><comment><USER4> The best thing I got out of this is that I discovered Square's GitHub account... with an astonishing _65_ repositories. I already held Square in high regard; this just icing on the cake.

<comment><USER5> Project followers might be a more relevant metric for impact than the number of repo's

<comment><USER6> Indeed. I have over a hundred repos, and I'm useless ;)

</comment></comment></comment><comment><USER7> Semi-related, does anyone perform automated unit test deployment, execution, and reporting on iOS devices? If so, how do you do it?

At my current company we have a rather large automated test infrastructure that builds and runs ~50 or so individual libraries and their associated unit test programs on around 20 different configurations for 10 different platforms. Most of these platforms have a way of doing an unattended deployment of our test programs (and associated data) to the device, execute the programs, and retrieve the output.

This isn't working on iOS though because of its dependency to Xcode. We've tried scripting Xcode with AppleScript but this is fragile and routinely breaks.

Has anyone tackled this problem and succeeded?

<comment><USER8> Yup. I've setup a Jenkins server that uses a combination of xcodebuild and xcrun. The process:

      - clones the repo from git
      - builds with xcodebuild
      - signs/provisions with xcrun
      - creates a manifest file for over-the-air installs
      - copies the build to a server where users can install
      - saves off the symbol file for our crash server so it can symbolicate crashes
      - sends emails

It would run unit tests and integration tests if we had them. :)

<comment><USER7> Thanks for the xcrun hint! Does that still handle the application/data deployment and execution, or does it just automate the packaging? All the information I can gather about doing OTA deployment points to still requiring the user to initiate the download, and then run it. I'd like to avoid that if possible because of the sheer number of libraries we need to test.

</comment></comment></comment><comment><USER9> Any questions? We'll be around to answer them.

<comment><USER10> How hard would it be to add gesture support? double tap here, swipe left there, etc.

Are accessibility labels the only way to reference views?

<comment><USER9> Indeed, accessibility labels are the only way to reference views. Granted, your tests are running within your process, so they sky is pretty much the limit.

We're still considering the best way to implement gestures. There's some rudimentary support, but it's incomplete right now. Your input is welcome!

</comment></comment></comment><comment><USER11> Thus far, my team has likewise been unable to find a good functional testing suite for iOS. We will definitely be giving this a shot.

</comment><comment><USER12> A nice collection of iOS testing posts:

[http://softnoise.wordpress.com/2010/11/14/ios-setting-up- a-t...](http://softnoise.wordpress.com/2010/11/14/ios-setting-up-a-test- environment/)

</comment><comment><USER13> Wow! I think I just came.

Seriously, unit testing in iOS is not great, and this kind of simulation is exactly what we need. Regular unit tests are great for model-layer stuff and data-processing code, but they will not help with most real-world problems that occur.

"Does my login flow still work?" and "Can I still use every feature of my app successfully?" is the kind of thing you need to know after committing code.

</comment><comment><USER14> how does this compare with selenium ?</comment>


The culture war at the heart of open source - <AUTHOR> https://steveklabnik.com/writing/the-culture-war-at-the-heart-of-open-source <comment><USER2> I was hoping to hear about the recent ideas (least few years) around what Mongo/ES did, ethical licenses, what is happening to the phrase "open source..."

[https://coss.media](https://coss.media) is another great line of thinking.</comment>


Clojure-powered Startups - <AUTHOR> http://www.infoq.com/presentations/Clojure-powered-Startups <comment><USER2> Frankly, the selling point that clojure minimizes risk is not a compelling one. It sounds sexy, but its nonsensical.

Risk encompasses many aspects of technical decisions and there's a complicated set of interactions between these aspects. Saying a single language minimizes risk makes little sense.

For instance, if you're building a straight-up CRUD web app Ruby on Rails minimizes risk best. If you're building a realtime chat service node.js minimizes risk best (and I say this as a longtime detractor of node, its not the best thing engineering wise, but it's an 80% solution).

While I'm glad the speaker enjoyed success using Clojure, I don't think we need a slogan to promote Clojure, we need more killer platforms. We need problem-spaces where when someone asks "What's the highest quality implementation of X?" people say, well, clojure has XYZ, it's way ahead of the pack.

To my mind where clojure hits the sweet spot is in mixing performance with elegance. It's got a fantastic balance there for web apps. I would love for clojure to be the answer to the question of "our app servers are too slow". However, the ecosystem is just not there yet.

Between noir, immutant, aleph, and vert.x I think we have a bright future there, but whether clojure will hit critical mass to become a dominant platform anywhere is nigh impossible to predict.

<comment><USER3>
          if you're building a straight-up CRUD web app Ruby
          on Rails minimizes risk best. If you're building a
          realtime chat service node.js minimizes risk best

I do not agree with you on this one. I'm not into Node.js precisely because (for now) I consider it to increase the risk of any project.

Yes, your realtime chat will be easy to do with Node.js, but most web applications also need to talk to a database, and also need to do some background processing, and also need to communicate with third-party services through many protocols, sometimes hip, sometimes obscure and long-forgotten. And your app will also probably need at some point a freakishly boring admin filled with freakishly boring reports.

And building a multi-platform, multi-lingual project does lead to resource drainage and duplicate effort. This is one reason why Node.js is popular in the first place, because presumably people can share logic between the client and the server ; but in the larger context of things with Node.js I feel like I'm digging myself into a corner, just like I did with PHP several years ago.

Personally I'm starting to like the JVM more and more. Want to do a really scalable chat app in several lines of code? There's a solution for that [+]. Want to talk with the most obscure database in existence? The JVM can do it. Want to have your binaries work in 10 years from now? The JVM can do it. Want to use your hardware to the maximum? The JVM is the second best choice after C/C++. Want to make your sysops happy? The monitoring/profiling/deployment tools available for the JVM have absolutely no match.

[+] <https://github.com/Atmosphere/atmosphere>

<comment><USER4> I'm probably too cynical, but I think a big reason for node's popularity these days is the same as it was for rails 5-6 years ago - greenfield projects.

If I'm doing node now, it's not maintaining some legacy crap from 5 years ago - it's straight up new development. I get to do what I want. I don't think that factor comes in to the equation enough when people are talking about efficiencies and productivity metrics and such.

I still do a fair amount of PHP - my productivity maintaining PHP apps written by other people 5-10 years ago is pretty different from PHP I write from scratch, getting to use modern tools/libraries/techniques.

Yes, atmosphere is pretty cool - I'm looking at adding it to a project this fall. grails install-plugin atmosphere ;)

</comment></comment></comment><comment><USER5> Here is a shameless plug:

<http://www.vixu.com> (my startup) is based on open source Clojure/ClojureScript CMS (and soon webshop) software. See <https://github.com/fmw/vix> for the code (planning some refactoring over the summer before the first official release). Also doing search related stuff in Clojure (see <https://github.com/fmw/alida> for demo code I wrote for my EuroClojure presentation).

Clojure brought the fun back to software development for me and made me a better developer in general. It is also a very pragmatic choice, with the expressiveness of Lisp and plenty of reusable Java code being available.

</comment><comment><USER6> There are two ways (and of course, the paths in between) you can run your startup

1 - You can go for the most popular languages: VB.NET, PHP, etc. Very easy to find people, lots of plugins, lots of support. This may be the way to go if you want something simple done in a small budget

2 - You can go for the niche languages: Haskell, Clojure, Go. that's more or less the "hipster hacker" way of doing things. Very difficult to find someone that can do even a Hello World, but once you find, they can write a scalable website in about 3 lines and connect to the newest nosql db in 2 lines more. This is good if you're the next twitter, fb, etc and your servers begin to melt even if serving login

(but then again, fb is in PHP and they added 'magic' in HipHop and infrastructure)

<comment><USER7> Yup Facebook and Yahoo are PHP. Google/Amazon/eBay/Walmart.com are all primarily a combination of Java and C++.

<comment><USER8> Although Facebook uses Erlang for chat.

<comment><USER9> ... and Haskell for programmatically manipulating said PHP code base. [<http://www.haskell.org/haskellwiki/Haskell_in_industry>]

</comment></comment></comment></comment><comment><USER10> I've hijacked a couple of components at Game Closure in Clojure, much to the chagrin of our CTO. (Just kidding, kinda.) For the places we've used it, Clojure has worked wonderfully. The only disadvantage is that few engineers know it, and few are willing to pick it up because they're afraid of it.

But if I were starting a new startup, I'd pick Clojure over anything else, hands-down.

<comment><USER11> _The only disadvantage is that few engineers know it, and few are willing to pick it up because they're afraid of it._

That's the advantage.

</comment></comment><comment><USER12> Large junk of Polish startup Fablo (fablo.pl, e-commerce instant search engine based on natural language processing) is written in Clojure [1].

[1] <http://jan.rychter.com/blog/2010/7/5/clojure-w-fablo.html>

<comment><USER12> (nasty) typo: junk = chunk

Fablo is actually one of the most interesting startups on the Polish scene regarding technological challenges involved.

</comment></comment><comment><USER13> Hope I'm not hijacking this post, but does is the CLR version of Clojure any good? We have a lot of code in C#/F#/IronPython and am interested in trying some new components in Clojure just for kicks.

Is the CLR version have parity with the JVM version? Is it worth using at all?

<comment><USER14> I don't think it has parity, for all of the reasons halgari noted, but I really don't feel that it offers much over F#, either. F# is a very solid answer to Clojure in all ways except macros: it solves similar problems in the same problem space, doing some things better and some things worse. I happen to have a slight preference for F#, but at any rate, I don't think you're missing anything by being on one or the other.

<comment><USER15> You are selling an ML variant for someone looking for a lisp variant. Good luck with that!

<comment><USER16> "Any sufficiently well-documented Lisp program contains an ML program in its comments."

(My Google-Fu is failing me; I can't find an attribution.)

</comment></comment></comment></comment><comment><USER17> I'm curious about how startups using Clojure are generating their HTML. Are you guys doing it in Clojure code (e.g. Noir) or are you using some sort of HTML templating support (e.g. JSP)?

While I really like the idea of writing HTML in Clojure, I like even more the idea of being able to have a HTML/CSS/etc expert, who doesn't necessarily know Clojure, be able to maintain the HTML instead of me.

Has anyone found what they think is a good solution?

<comment><USER18> > I like even more the idea of being able to have a HTML/CSS/etc expert, who > doesn't necessarily know Clojure, be able to maintain the HTML instead of > me.

Check out Enlive, it solves exactly this problem. HTML/CSS is separate from Clojure code and you fill out templates and stuff via CSS style selectors. It's sweet.

<https://github.com/swannodette/enlive-tutorial>

<https://github.com/cgrand/enlive>

Btw I think you can use Enlive with Noir, even though some of the examples from Noir use Hiccup, it's not a requirement.

<comment><USER19> That tutorial is truly excellent - I've been looking for something to replace Hiccup, and this looks to be it!

</comment></comment></comment><comment><USER20> Hotelicopter also runs on Clojure. And I would recommend Colin Steele's description of his decisions as CTO, as he took the codebase away from PHP, first to Ruby and then to Clojure. The bit about the failures of Ruby are (in my opinion) the most interesting. Basically, it was too much work to get Ruby to go fast enough, and their problems were solved by using Agents in Clojure.

This I think is the key bit of the story:

"At this point, we were still focused on using Ruby/Eventmachine as a cornerstone of our technology stack. But here we hit a snag. Yep. I'm gonna beat up Ruby, because it was a mistake.

...it doesn't scale. ::ducks::

OK, that's not completely fair. Ruby does scale. But it doesn't scale well, or easily, and in benchmarking and stress testing, I was seeing that we were going to have a use a small truck load of resources at AWS, or spend a bunch of preciousssss developer time making it scale. It was too expensive. I wanted high user::machine density, and I didn't want to have my developers do handstands to get it.

Yeah, I could've done lots of things. I didn't have time to do that shit. Not with a four person team. Not with cash running out, and promises to keep, and no time to work for Ruby. I needed something that would work for me. This thing had to be FAST. It had to drive hardware to the limit without driving us crazy.

The bottom line is that it was too much work to make Ruby go fast enough.

...A little background on our application might help. Our job is to give prospective hotel bookers a view into what their options are. At the time we were making the decision to migrate from Ruby to Clojure, the system was using so-called "realtime" rates and availability checks with hotel suppliers to get that information. That meant that when a visitor conducted a search, we would spin up dozens of individual HTTP requests to hotel supplier sites to get rates and availability data at that very moment. We'd parse the responses, collate them, and present them back to the UI in just a few seconds.

You might ask why we didn't cache that information, but suffice it to say there were significant business drivers for that decision.

Managing this concurrent (and long-running) IO was a major theme for us, and Ruby did so reasonably well using EventMachine. However, we had to normalize the returned data into a single unified data model, and none of our partners had simple (or compact) XML representations of the data, so not only did we have IO issues, but CPU-bound processing issues as well. The combination of the two made the EventMachine implementation suffer from less-then-stellar throughput, and because of Ruby's green threads implementation and global interpreter lock, we had to run oodles of Ruby processes on each box to achieve reasonable throughput.

Perhaps just as importantly, the reactor pattern's upside-down flow of control style of programming was (and is) a pain in the ass. It was hard to read, hard to maintain, and generally obstreperous.

..I can already year you Ruby folks protesting "Fibers!" and so on. Heh. Have fun storming that castle.

Clojure was a whole different story, and addressed these issues admirably, for all the reasons you'll discover when you look into it further. "

[http://www.colinsteele.org/post/23103789647/against-the- grai...](http://www.colinsteele.org/post/23103789647/against-the-grain-aws- clojure-startup)

<comment><USER21> From this description it seems that Erlang/OTP would be even better choice than Clojure: we literally pack million of concurrect users into 1 high memory AWS instance.

Though Erlang not as modern or elegant as Clojure, but there is also LFE and Joxa.

<comment><USER22> It depends on how many external libraries you need. We considered both Clojure and Erlang in our project, ended up going with Clojure mostly because of available and easily accessible Java libraries.

I still find it amazing that I can:

1) add a single line to my project.clj (which will set up dependencies and download libs),

2) add a single line to my :import section at the top of the source file,

3) there is no point 3. Just call Java libraries.

But the choice really depends on your application.

<comment><USER23> Leiningen probably has its root from Maven, which IMHO the killer tool for Java. I've done .NET, a bit of Python, and RoR development/toying/experimentation in the past, and you need Bundler+Rake+RubyGem (at least) to emulate the core (important) feature of Maven.

</comment></comment></comment></comment><comment><USER24> Am I the only one who finds the InfoQ website too cluttered. I'd much rather watch this on Youtube.

</comment><comment><USER25> Does it make sense to try using both Clojure and Rails in web app, Rails for UI and Clojure for more sophisticated business logic?

<comment><USER26> It should interact pretty well with JRuby on Rails, but I'm not sure you would get any benefit from using rails over a Clojure web framework like Noir.

<comment><USER27> I honestly think you should avoid this. We did this, and it's a nightmare, and we had to get rid of it.

Rails works very well if you stick to defaults. Each time you veer a little bit further from the defaults, things start to break (or at least require a lot more advanced knowledge to keep working).

We had a front-end in in JRuby-on-Rails, backend in clojure, in the same app/process. We had a "middle-end" which translated clojure->ruby and ruby->clojure, allowing us principally to use futures for parallelism and queuing. It worked really well at the start, but had tons of bugs. A nasty example was that we did email in SimpleMailer in Rails, but it was triggered from some backend functions, which in turn were triggered from the front-end. That meant that Ruby objects were being used in two different Ruby runtimes! Bugalicious.

Here's the library we extracted, if you really want to use this: <https://github.com/circleci/cljr>. My cofounder Allen talked about the experience at ClojureConj/west: [https://github.com/arohner/clojurewest2012-slides/blob/maste...](https://github.com/arohner/clojurewest2012-slides/blob/master/Rohner- JRuby.pdf?raw=true)

<comment><USER26> Thanks for the correction, good to know. In the example you describe, the main mismatch seems to have been getting the two Ruby runtimes to communicate effectively. Was that a common theme?

<comment><USER27> I think the most important thing is "complexity is multiplicative". Every slight deviation from normal led to subtle errors that took days to fix, and kept coming back in different ways. The runtimes was just the most WTF way this happened.

</comment></comment></comment></comment></comment><comment><USER28> I believe the data is deceptive. Growth is fine and dandy but if you look at this graph [http://www.indeed.com/jobtrends?q=clojure%2C+scala%2C+java&#...](http://www.indeed.com/jobtrends?q=clojure%2C+scala%2C+java&l=\(Absolute\)) Tells a wholly different story than this one: [http://www.indeed.com/jobtrends?q=clojure%2C+scala%2C+java&#...
Also didn't reddit switch from clojure/lisp-like language to python?

<comment><USER29> They switched from common lisp to python, which is an entirely different beast. CLisp is an awesome language, and obviously has the same roots in McCarthy's work, but they have different advantages/disadvantages (the library situation is better on the JVM, for example).

</comment></comment><comment><USER26> That was embarassing, and 20 minutes of my life I regret losing. Even the speaker appeared to be embarassed at times.

It's interesting that this thread has stayed on the front page of HN all day. I wonder how many people upvoted/participated in it without watching it? (I must admit, I participated without watching the whole thing.)

<comment><USER30> Noticed how your comment doesn't mention any actual complaints with the presentation?

<comment><USER26> It was vacuous, basically an extended resume for the presenter, mixed with empty platitudes about principles for clojure evangelism. And worst of all in terms of wasting my time, it was misrepresented. It comes across in the blurb as a talk about the contexts in which Clojure has been useful to startups, and the presenter represents it this way in the introduction, when instead it's "here are these vague descriptions of how I effectively evangelised Clojure in each of these startup companies."</comment></comment></comment>


It's Time to Start Writing (2019) - <AUTHOR> https://alexnixon.github.io/2019/12/10/writing.html <comment><USER2> You go Alex :) I think more people, even supposed "nonwriters," should write more! Jeff Bezos may be a chunk of hot garbage, but his bizarre writing policy is at least something good.

Heck, I recommend _everyone_ set up a blog. It can be totally pseudonymous, that's fine. Just collect your thoughts and write little personal think pieces that you publish into the void. If they gain traction somewhere like HN, great! But it's not the main attraction.</comment>


Burt Rutan's last airplane - A hybrid electric roadable aircraft - <AUTHOR> http://www.aviationweek.com/aw/blogs/aviation_week/on_space_and_technology/index.jsp?plckController=Blog&plckBlogPage=BlogViewPost&newspaperUserId=a68cb417-3364-4fbf-a9dd-4feda680ec9c&plckPostId=Blog%3Aa68cb417-3364-4fbf-a9dd-4feda680ec9cPost%3Ace084daa-4385-40ee-9664-b29f4a0cfecb&plckScript=blogScript&plckElementId=blogDest

<comment><USER2> He is just retired, not dead---hard to say when his real 'last airplane' will be. It is not like he is just going to stop thinking about flight...</comment>


John Carmack's BAFTA Introduction, Speech and Interview [video] - <AUTHOR> https://www.youtube.com/watch?v=fyjJrF2gJ34 <comment><USER2> Really inspiring. I really loved his comment about how there are always new opportunities and new waves for people to ride. This is something I've always personally struggled with, the feeling that everything has already been done and that I've missed the boat.

I guess a lot of these things are only obvious in hindsight. People are exploring all sorts of ideas right now, but it won't be obvious which ones are the winners and the losers until 10 years from now.

<comment><USER3> Depending how far down the ladder you go, some ideas take longer than that.

For example, geometric algebra, invented by Hermann Grassmann more than 150 years ago, is the biggest "new" idea in mathematical modeling of geometry, and it'll probably take another 50 years more to percolate down throughout math education and physics and engineering practice.

<comment><USER4> Do you have any interesting reads about geometric algebra being the "new" thing?

<comment><USER5> Not the parent poster, but I have some experience of geometric algebra being promoted as a superior language for geometric computing. This started for me in the first year of university with a tutor who was keen to introduce bivectors (a GA concept) though officially they weren't on the syllabus. (Bivectors can represent 3D angular momentum in a slightly more useful way than straight vectors.) David Hestenes was presented as a bit of a hero, the pioneer of GA for physics. It didn't stick for me.

At Siggraph 2001 there were for the first time a couple of "GA for computer graphics" presentations given by Leo Dorst and Steve Mann. They were promoting GA as "the way" for doing geometric computations on computer. Dorst is an interesting and pleasant speaker and the apparent brashness of the "one true framework for geometric computing" claim didn't really colour his delivery of the presentation. Again, for me it just didn't stick, though the idea of a breakthrough in the design of geometric mathematics, with strong historical roots in the 19th C, was appealing.

Since then the GA bandwagon has rolled gently on but I haven't seen any killer apps produced so far.

[http://www.geometricalgebra.net/](http://www.geometricalgebra.net/) [http://www.cgl.uwaterloo.ca/smann/GABLE/SIGGRAPH01/](http://www.cgl.uwaterloo.ca/smann/GABLE/SIGGRAPH01/)

</comment></comment></comment></comment><comment><USER4> "...I'm just getting started..."

What a hero! Very excited to see the innovations coming out of VR/AR over the next few years.

<comment><USER6> Right? His speech is really good. Not a lot of engineer (or people, as the matter of fact) can give a speech that fluently.

<comment><USER7> Not to diminish Carmack's significance and genius, but, from waht I can tell from the first minutes of the interview, he knew he was going to be awarded, so je had plenty of time to prepare and rehearse his -- very inspiring, I should say -- speech.

<comment><USER8> For something like a decade (2004~2005 until 2013), Carmack gave a fluent hours-long speech/discussion/brain-dump at QuakeCon. I doubt a few minutes's speech is something he needs "plenty of time to prepare and rehearse" for at this point.

Recent examples:

2h50 2013 QuakeCon keynote [https://www.youtube.com/watch?v=Uooh0Y9fC_M](https://www.youtube.com/watch?v=Uooh0Y9fC_M)

2h20 2014 SMU talk [https://www.youtube.com/watch?v=3_oTvUl88hs](https://www.youtube.com/watch?v=3_oTvUl88hs)

1h30 2014 Oculus Connect keynote [https://www.youtube.com/watch?v=nqzpAbK9qFk](https://www.youtube.com/watch?v=nqzpAbK9qFk)

<comment><USER9> His 2013 keynote where he touched on functional programming is what inspired me to attempt learning and writing a game server in Haskell.

</comment></comment></comment></comment></comment><comment><AUTHOR> Intro is OK but most people on HN will be aware of its contents:

Speech starts at 4:10, interview at 7:20

</comment><comment><USER10> John Carmack is such an inspiration. It was his early blog that taught me the techniques for raycast engines. I was working at an educational software company in my home town, we were doing a 2D educational game for Famous Five on a Treasure Island. I convinced my boss to allow me to make the bit where they go into a dungeon to be 3D, and I wrote a raycast engine for it. Not long after that, I used it to get my first job in the London games industry as a Playstation 1 lead programmer!

His willingness to share what he's learned must have given many programmers a boost, as it did with me. Well deserved.

</comment><comment><USER11> I'd encourage anyone in the twittersphere to follow @ID_AA_Carmack. His musings there waste few words and he often tosses questions out there that will get you thinking.

Congrats to him on the BAFTA, but yes, he really is just getting started. I hope to see the fruits of his current labors but I'm not sure if I'm cut out for the VR tech as I'll most likely just puke on my shoes :-(</comment>


Architecture awards and relationships (Derek Sivers married today) - <AUTHOR> http://sivers.org/married

<comment><USER2> Even when sharing good news, he does it in a way that his readers can find insightful.

</comment><comment><AUTHOR> The title is Sivers' roundabout way of saying he's getting married today - while sharing a useful perspective for everyone else. :)

</comment><comment><USER3> Always nice to hear when the good guy gets the girl.

<comment><USER4> I'm not sure about that...Sivers seems more like a bad-ass that _appears_ like a good guy.

<comment><USER5> What do you mean? Can't a bad-ass be a good guy?

</comment></comment></comment><comment><USER6> Congrats sivers !

</comment><comment><USER7> The book he mentions is the best book I've read about software architecture that will never be found in the Technical/Computer books section. I've given away at least five copies as Thank You gifts. The beauty of the book is that he presents such a convincing case for the importance of adaptability and a core architecture to enable that - that you start to view the codebase you are working on, heck, even your life through the perspective of: "what decisions am I making now that might impact the ability to change"

<comment><USER8> '97 BBC series <http://video.google.com/videoplay?docid=8639555925486210852#>

It seems the author himself uploaded the videos and encourages their use. Amazing.

<comment><USER7> Stewart Brand was a pioneer in sharing information even before information was _easily_ shareable (2400 baud modems)

"In late 1968, Brand assisted electrical engineer Douglas Engelbart with The Mother of All Demos, a famous presentation of many revolutionary computer technologies (including the mouse) to the Fall Joint Computer Conference in San Francisco.

Brand surmised that, given the necessary consciousness, information, and tools, human beings might reshape the world they had made (and were making) for themselves into something environmentally and socially sustainable. The fact that he had builders, designers, and engineers as friends surely influenced his reasoning."

Father of The WELL (One of the first and most influential BBS)

And: Whole Earth Catalog

More: <http://en.wikipedia.org/wiki/Whole_Earth_Catalog>

<http://en.wikipedia.org/wiki/Stewart_Brand>

</comment></comment></comment><comment><USER9> Smart guy, great writer, successful entrepreneur, pretty woman -- all of this is full of win. Congrats to both!

</comment><comment><USER10> Hooray! One more person finds his way out of the darkness.

<comment><USER11> Are you saying single life is dark?

<comment><USER10> I should have been more specific:

> a great relationship is not something you find. It's something you (both) > make.

This is something many people haven't figured out. I was happy to see one more who now has.</comment></comment></comment>


Ask HN: How should employees judge startup founders? - <AUTHOR>

I've been working in the industry for about a year now, but since I'm self-taught, I don't really have a big network to fall back on.  Given that, how would you suggest trying to judge the qualifications of the founders of a startup? They seem like nice people, but their profiles are pretty thin and it's hard to tell if they're just talking a good game.  They previously worked together on a startup that sold to a major company for about $35M - does that seem like a reasonable indicator that they have some sense of what they're doing? <comment><USER2> I think it's easiest to "judge" them in the context of your personal goals. So, rather than thinking about if they know what they're doing, look for indicators that they'll provide an environment suitable to whatever it is that you're there for. If you're there primarily to learn, for example, then different characteristics will be important than if you were there to get rich.

All that being said: Yes, the fact that they've done this before is a good thing. It doesn't really matter if they failed or were successful in their last venture; both types of experiences are educational and should help them in this new project.</comment>


Legal Advice: who owns rights of personal Heroku account? - <AUTHOR>

I need a quick legal advise. I'm in a situation where I was fired by a company but within a few days after they're threatening me with legal actions if I don't provide "company's property". By this they mean that I need to share my personal login info of a Heroku account that I had created while I was still employed there. That Heroku account just points to their Github account so they can run the server and view the app. Should I share my username and password with them if I don't want to? <comment><USER2> Why are you coming to HN for legal advice? Get advice from a Proper Lawyer (TM) before you even reply to their request.

<comment><USER3> I doubt it'll hurt the OP to ask out here, along with consulting a lawyer. IMHO, if you could simply remove the hooks between the company's Github repo and your personal account, you don't need to share your account details.

</comment></comment><comment><USER4> Heroku has a transfer app feature. Just transfer it to them and keep your username / password secure.

</comment><comment><USER5> My friend, its best to contact a lawyer for such cases. This is not a starting point for you.

<comment><AUTHOR> Getting a lawyer is an obvious action. Prior to investing into this it would make sense to ask the community. Also, I see this discussion would help other developers to understand their legal rights when they're in the similar situation.</comment></comment>


Human in A.I. Loop - <AUTHOR> https://sanealytics.com/2016/09/09/human-in-a-i-loop/ <comment><USER2> "What we need to build is a gamified quick truther thingy that all our 200 employees in main office can log in during their lunch break and rate a few items."

Lunch break? Or you could just, I don't know... go with me here, I know it sounds crazy at first..., _pay_ them for providing this value to your company.

<comment><USER3> Or, strange concept, the employees benefit from their efforts to improve the company, and idea of working during lunch on a trival task makes sense if they don't have anything else worth doing.

<comment><USER4> its no longer a break if you're still working.

<comment><USER5> And the break is worth doing. Do you want your highly paid managers, engineers, salespeople, etc. properly recuperating? To better tackle the nontrivial tasks you pay the big bucks to tackle?

Or do you want really really expensive mechanical turks?

</comment></comment></comment></comment><comment><USER3> "In the loop" is a reference to the OODA loop, which is the decision cycle of observe, orient, decide, and act, developed by military strategist and United States Air Force Colonel John Boyd. "In the loop" has a specific tactical meaning, which is that you're able to do a full OODA loop cycle faster than a comparable AI/man system which gives a strategic advantage and maybe used against oppositional forces in a variety of ways; most interesting is applying it to PsychOps.

"Man in the loop" reference can be found in use by the US AirForce going back to the 80s for weapon systems design; specifically between fighter jet systems and pilots. I've heard that US AirForce used brain implants as early as the 90s in fighter pilots.

Here's an example of the US Army reads soldier's brain waves to speed up image analysis:

[http://newatlas.com/us-army-eeg-brainwave-image- analysis/403...](http://newatlas.com/us-army-eeg-brainwave-image- analysis/40309/)

<comment><USER6> I'm pretty sure it's just a reference to the phrase "in the loop", which dates back beyond the 80s:

[http://idioms.thefreedictionary.com/in+the+loop](http://idioms.thefreedictionary.com/in+the+loop)

<comment><USER3> Yes, "in the loop" does date back further, but as used to reference human/systems integration earliest reference I was able to find was the 80s which was the same time that Boydian like systems started popping up.

</comment></comment></comment><comment><USER7> Looks like what CrowdFlower calls "human in the loop computing" which is a nicer name for it.

[http://www.computerworld.com/article/3004013/robotics/why- hu...](http://www.computerworld.com/article/3004013/robotics/why-human-in-the- loop-computing-is-the-future-of-machine-learning.html)

<comment><USER8> Also called human computation. The past paper awards from this conference [0] gives a good flavor for the field.

[0] [http://www.humancomputation.com/2016/past%20meetings.html#aw...](http://www.humancomputation.com/2016/past%20meetings.html#awards)

</comment></comment><comment><USER9> It seems that the name of the concept this guy is looking for is: Mechanical Turk service.

<comment><USER10> The concept is actually more commonly called "human computation" (which includes stuff like digitizing books using CAPTCHAs).

It has academic journals/conferences under that name: [http://hcjournal.org/ojs/index.php?journal=jhc](http://hcjournal.org/ojs/index.php?journal=jhc)

</comment></comment><comment><USER11> Applications of human-in-the-loop systems like this are exactly why we built Scale API (www.scaleapi.com, YC S16).

Unfortunately, Mechanical Turk is often a bad choice these days for these types of applications—it's extremely difficult to guarantee quality, not to mention hard to use. Using employees also works well to a point (we did some of this at companies I've worked at too), but it doesn't scale, and should be done sparingly.

Great application of humans in the loop—this is the type of thing that really excites me. We're trending towards more and more human-augmented software, and it opens up so many possibilities for what software can do!

</comment><comment><USER12> Does anyone know any good tools to make that sort of page quickly in Python? I mean, I could cobble together a web app, but I feel like dataset annotation is so common that there should be something out there already.

<comment><USER3> Why Python? Why not just focus on finding the best open source data annotation framework?

(Love Python, but normally don't bias my selection of a solution by the language it's written in.)

<comment><USER12> You're right, though I do need a way to interact with it programatically from python, since that's what I prefer to write my scraping & munging code in.

It would probably be fine if it was a solution that had an API that was easily callable from Python without a silly amount of overhead, specifically being able to dump data into a named dataset is what I want.

Python would also be nice since it would be easier for me to customize; though I could deal with Java or Node. I've avoided Ruby for this many years and would prefer to keep it that way.

</comment></comment></comment><comment><USER13> we wanted flying cars - instead we got tagged couture.</comment>


Guide to Mathematics and Mathematicians on the Simpsons - <AUTHOR> http://homepage.smc.edu/nestler_andrew/SimpsonsMath.htm <comment><USER2> Simon Singh, a well known popular science & math writer, also wrote _The Simpsons and Their Mathematical Secrets_.

[http://smile.amazon.com/Simpsons-Their-Mathematical- Secrets/...](http://smile.amazon.com/Simpsons-Their-Mathematical- Secrets/dp/1620402785/)

<comment><USER3> The webpage posted in this thread authored by Dr. Andrew Nestler & Dr. Sarah J. Greenwald was one of Simon Singh's main sources for that book.

</comment></comment><comment><USER4> > The images on these pages were taken from episodes of The Simpsons that are > copyrighted by Twentieth Century Fox. I will not distribute audio, video or > image files.

sorry, but you already did. it's ok though.

<comment><USER5> IANAL, but maybe that phrase carries some protective legal powers?

<comment><USER6> IANAL either, but as far as I know it does not.

The page does state that it "is for educational use only", which arguably makes it OK vis-à-vis fair use [0], but I'm not sure about the specifics of U.S. copyright law regarding these exceptions.

I imagine, though, that there are some restrictions on what constitutes "educational use" in a legal sense – an open access internet page being available for any use by anyone and all.

To me, it does bear a superficial resemblance to "no copyright infringement intended" [1], though the latter makes no sense at all.

[0]: [https://en.wikipedia.org/wiki/Fair_use](https://en.wikipedia.org/wiki/Fair_use)

[1]: [http://www.urbandictionary.com/define.php?term=No+copyright+...](http://www.urbandictionary.com/define.php?term=No+copyright+infringement+intended)

<comment><USER7> Fair use isn't just about education. Fair use should cover the images posted in the article

<comment><USER6> I know; I'm saying that the website arguably falls under the education-part of fair use.</comment></comment></comment></comment></comment>


Mainline Linux inclusion – zfsonlinux/zfs - <AUTHOR> https://github.com/zfsonlinux/zfs/issues/8314 <comment><USER2> Isn't this the same approach that Google used with Android version of java and it didn't work out for them?

</comment><comment><USER3> I didn't follow it but is it safe enough? Does it work exactly like the original ZFS?</comment>


Mac OS X version of AutoCAD due out in October - <AUTHOR> http://www.appleinsider.com/articles/10/08/30/mac_os_x_version_of_autocad_due_out_in_october.html <comment><USER2> Great news. I haven't used AutoCAD since my high school drafting class, but this will be fun to play around with. Even more so once some _more_ affordable 3D printers become available.</comment>


What technical reasons are there to have low maximum password lengths? - <AUTHOR> http://security.stackexchange.com/questions/33470/what-technical-reasons-are-there-to-have-low-maximum-password-lengths <comment><USER2> It's amazing how all the comments so far have entirely missed that it's the top answer that was really submitted, not the question.

<comment><USER3> I found one of the comments interesting: that the monkey/ladder experiment could be a myth.

<comment><USER4> It's probably just a thought experiment, a nice allegory. [http://skeptics.stackexchange.com/questions/6828/was-the- exp...](http://skeptics.stackexchange.com/questions/6828/was-the-experiment- with-five-monkeys-a-ladder-a-banana-and-a-water-spray-condu)

<comment><USER5> It's fun to try to apply it recursively.

That is, if I take a lesson from a story about an experiment that never happened, I'm acting like the hapless chimpanzees that merely learn to fear the ladder. So I must choose to not model other people as cartoon chimpanzees.

</comment></comment></comment></comment><comment><USER6> I actually emailed my credit union, pleading for them to increase their 10 character limit to something reasonable, and got a response saying that the way their database handles passwords made it impossible.

Needless to say, I found that to be even more disconcerting than the existence of the character limit.

<comment><USER7> My credit union enforces similar limits (and only 0-9 are valid characters), but I realized the validation was only enforced in Javascript. I disabled the validation and I was able to use any password I wanted.

<comment><USER8> Did you try any SQL injection attacks?

</comment></comment></comment><comment><USER9> There's one reason I haven't seen mentioned yet:

Because the developer is storing passwords in plaintext, and he wants to save database space.

Now, this is not a _good_ reason, but it is a reason nevertheless. Please note that you should never, ever, ever, ever store passwords in plaintext.

<comment><USER10> _Because the developer is storing passwords in plaintext, and he wants to save database space._

This seem far fetched, not sure what thought process would lead anyone to come to this conclusion. Even if you have a million users, you have ~8MB worth of passwords. I'd imagine even developers who are not competent in cryptography realise that.

<comment><USER11> If you allow truly _unlimited_ -length passwords, malicious users can set gigabyte-long passwords. Whether you hash them or just store them, that's a DoS waiting to happen with every login.

So, there actually _is_ a reasonable limit for the length of passwords, email addresses, and most other user-editable fields that end up either being hashed, or shoved through to the database. That limit is just probably somewhere around 100KB to 1MB, not "eight". ;)

More importantly, that limit is an _infrastructure concern_ , not a _business- domain concern_ ; it's best enforced by something like nginx spitting out a 400, not the model-validation logic in your app server.

<comment><USER9> While this is true, hashes use a set number of characters. For example, SHA-256 hashes can be stored in 32-character hex strings. In that sense, there's no point in allowing for a variable length field for password hashes.

<comment><USER12> It's not only dealing with password length. You could DoS the server by tying up all threads in processing the upload. Uploading 4GB isn't instantaneous.

<comment><USER13> That's why the client should perform the hash and only submit the result.

<comment><USER11> No; this is effectively the same as doing no hashing at all. If your database gets stolen, people can replay the "hashed" passwords from it to the server, without having to hash them themselves.

<comment><USER13> I didn't mean to imply that you'd just store the hash the client comes up with. That's idiotic, of course. Not everyone uses SSL, even though they should, and it's not always secure, and even with the use of SSL, it seems that there would be a potential length attack that could be employed to effectively guess a user's password length. So in all cases, IMO, it makes more sense to be receiving a fixed-length thing that is fairly insensitive to attack in itself. So perhaps a user has 2 salts associated with their account, per password: an auth salt and a storage salt. Then an auth looks something like this:

        hash(saltFromServer + hash(password))

And then the server would do

        hash(user.salt + clientHash)

I'm not sure, but this seems reasonable to me.

<comment><USER14> Now you have quite a restricted domain, so if your database is compromised there are a lot fewer values an attacker needs to enumerate to try and crack the password.

<comment><USER13> That reasoning doesn't really sit well with me as a mathematician.

I would expect the image of MD5 on its codomain is almost a bijection (would love to be demonstrated wrong here, if anyone knows of a paper that studies this, but it seems reasonable that any good hash would have this property).

This doesn't really protect against a dictionary attack, but to guarantee a collision, an attacker would still need to try approximately 2^128 passwords for each password in the database, which is already the worst case for the attacker, so no strength is really lost.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> My bank limits my password to 8. When I questioned while creating my account, they asked me to visit the login page - in the login page you are asked for the answer of the security question and also presented with 8 input boxes - one for each of of the password characters - but having to enter only randomly selected few from the password ( for preventing key loggers from getting password, of course ). This seemed like a valid technical reason to limit passwords to 8.

<comment><USER16> Wait. Doesn't that imply your bank is storing your password in plaintext, or at best salted and hashed each individual character of your password? (Which is still horrible, because it now takes O(n) instead of O(n^8) to crack stolen hashes)

<comment><USER17> The client, or server, could just concatenate all the chars and then calculate whatever hash you desire of the result. Or?

Yes, if the machine is compromised the attacker could do it as well but the point was to prevent keyloggers specifically.

<comment><USER16> If I understand correctly, you are only asked to fill in a few of the 8 characters. (I have seen this before.)

You are presented with

* * [ ] * [ ] * * [ ]

and you are supposed to submit

* * [3] * [5] * * [8]

so neither side would have enough information to reconstruct the full password based on the user's input alone.

</comment></comment></comment></comment><comment><USER18> Whenever you see a password field that is limited to 8 characters you'll often also see a notice that the minimum value is 6 characters. Why? IBM. CICS[1] had this specific restriction on password length until the 4.2 release in 2011[2]. CICS is hugely popular in the banking industry, which is why you'll see this kind of thing most often with banks.

[1]<http://en.wikipedia.org/wiki/CICS>

[2] [http://pic.dhe.ibm.com/infocenter/cicsts/v4r2/index.jsp?topi...](http://pic.dhe.ibm.com/infocenter/cicsts/v4r2/index.jsp?topic=%2Fcom.ibm.cics.ts.whatsnew.doc%2Fpassphrase%2Fdfhe4_overview.html)

</comment><comment><USER19> For how much people like to repeat the "Use bcrypt!" mantra I'm amazed no one has mentioned the password length limit of bcrypt.

The hash output of bcrypt stops changing after 72 characters but almost all bcrypt documentation mentions a 55 character limit. I'm not quite sure what that is about, can anyone clarify?

<comment><USER20> Brute-forcing a 55-character password is a transcomputational problem (<http://en.wikipedia.org/wiki/Transcomputational_problem>), i.e., it's impossible to accomplish using a computer the size of the earth within the expected lifetime of the earth. So I wouldn't worry too much about it.

</comment></comment><comment><USER21> Wow what a dumb question obviously the OP has very little experience in dealing with real people, probably one of those code monkeys disconnected from the real world. Tune out of World of Warcraft, turn off your Xbox and think for a second: If people could choose long passwords with special characters how could our customer support reps read them back to the users in case they loose it? How could they check them on the phone? Geez and people here are complaining they are valued less than a manager.

<comment><USER22> if you don't keep the password lists in plain text you wont have this problem...

<comment><USER23> Actually his post was sarcastic (I think that's the word). Of course passwords should be hashed, and moreover they should not be read to customers over the phone.

</comment></comment></comment><comment><USER24> Why does a site limit password lengths at all? Because at some point, some _other_ limit will be exceeded. For example, HTTP POST size or even working- set size. But the question is specifically about low maximum password lengths. This boils down to hashing vs encrypting. Hashing (with or without salt) will produce a fixed-length output. The size of storage for this hash output is pre-determined. For example a varchar(20) for SHA1. For encryption, you have to take the plaintext _bytes_ and produce a ciphertext of a maximum number of bytes to store. Now we have both a limit on the number of input characters, but also on which characters are permissible. Let's say a site allows the Euro symbol, passes that UTF8 byte stream through an encryption algorithm, base64 encodes the result and stores it in a varchar field. The trouble is that the Euro symbol is composed of a 4-byte multi-byte UTF8 sequence - F0 A4 AD A2. If a password system didn't take account of this, they could easily overflow the storage limit and potentially expose internal details via an error message to the user.

The simple answer is just to hash+salt and then to limit the input length to some large value to prevent blowing HTTP POST or process vm limits.

</comment><comment><USER25> I'd say there are three main reasons:

1) Legacy systems not supporting special characters, 2) The desire to keep support overhead down, and use of the system up, by keeping users' passwords actually rememberable. In other words, if you let users make and use paswords they can't remember, they will, and as a result they'll either annoy you about it or stop using the site due to the hassle, and 3) Developers not wanting to have to worry about parsing special characters from untrusted users, which could potentially be dangerous.

In the past the top reason was probably the lack of ability to support the passwords (#1), and today it's probably the lack of desire to support them-- mostly from #2, but partially from #3.

</comment><comment><USER26> Remember that until the early-mid 90s, file names were limited to 8 characters. Lots and lots of enterprise financial software was written in those days, and a lot of it still runs. We're talking about tremendously complicated systems that support trillions of dollars in transactions a day. You don't change level of interleaving complication fast nor easily.

With that said, the rest is just my own guess. Banks are slow moving. They're built on these old systems that run well, but would be prohibitively expensive to rebuild from scratch with modern principals. We see the edges of these systems when it comes to things like passwords.

<comment><USER27> I believe that is true for a lot of cases. People seem to overlook this, but I'd guess that is the reason for a lot of cases.

90s though? I think you need to go further back a couple of decades. Royal Bank of Scotland still has COBOL/IMS powering their core system [0].

[0] [http://ovum.com/2012/06/27/rbss-core-system-meltdown- assessi...](http://ovum.com/2012/06/27/rbss-core-system-meltdown-assessing- the-implications/)

</comment></comment><comment><USER28> The usual one I've seen is that it's hardcoded into a system in some way that, while changeable, nobody wants to touch for fear of collateral breakage, which is a variant on the "don't touch the ladder" argument given by the first response.

This is usually something like a fixed width database or file field that works with code written a long time ago...

Does it suck? Yes. In nearly all cases, Authentication, Authorization, and Access should be separated in ways where they don't interact/overlap other than at an absolute minimum.

<comment><USER29> The only way "fixed width database field" makes any sense is if they're storing in plaintext, which is stupid all on its own.

<comment><USER30> Wouldn't a password hash, possibly truncated, fit into a "fixed width database field"?

<comment><USER29> Why would you truncate it? My point was simply thus: if one is hashing a password... every password will be the same length (strlen(sha1("a")))==(strlen(sha1("somereallybigstring"))).

Thus, the column would be the right size for the hash _always_ and would be completely unrelated to the user's inputted password.

Not sure I interpreted your message correctly, but either way, the DB field should be unrelated to the length or limit of length put on the user password. It should only be correlated to the length of the hash produced. (Truncating seems like it would narrow the space for collisions, those bits are there in the hash for a reason).

</comment></comment></comment></comment><comment><USER31> I work for a company that does the banking websites for several major banks (not going to mention any names here). We have a few customers who have quite low password length limits. There isn't any technical reason for this. We provide a configuration option that the bank can set to limit password lengths. So from my experience, the limits have less to do with technical reasons, and are instead arbitrary "business logic" limits.

<comment><USER32> Why don't you just tell them that for technical reasons, the lowest you "can" limit it to is 12 characters?

<comment><USER31> I'm just not part of any of those discussions. Besides, the code around passwords and their configuration has barely changed in the last decade; and the people who wrote it are now the ones discussing security with the banks.

</comment></comment></comment><comment><USER33> [http://skeptics.stackexchange.com/questions/6828/was-the- exp...](http://skeptics.stackexchange.com/questions/6828/was-the-experiment- with-five-monkeys-a-ladder-a-banana-and-a-water-spray-condu)

Funny that the experiment was mentioned many times in different occasions, and it's not clear if it was ever conducted. Still Bears around the Internet believed it and just kept repeating it in every opportunity ;)

</comment><comment><USER34> "Because it's hard enought remember 12 characters already"

-my bank's tech support

<comment><USER35> Typically bank tech support have no idea about the inner workings of their website.

My bank uses 2 stage auth to login which works really well. However, they have a sort of shortcut service where you can activate and pick a password and then use that password to do quick stuff online or in their mobile app. The quick stuff still let's you transfer away all your money to someone else so it's basically a gaping hole.

That password has the wildest restrictions I've seen. It allows only a-zA-Z0-9 and it must consist of exactly 6 characters. No restriction on containing at least one digit or anything like that.

I've e-mailed them several times about this but their response is that this particular service has been out sourced to one of the many companies they out source things to, so they have no control at all over it.

And it's rather funny because you can tell that when you use this service, you're taken to a completely different server farm than the rest of the internet site. Fucking scary is what I call it.

<comment><USER36> I imagine there's the possibility of a huge PR scandal, especially if a blog post is written eloquently and carried by the right news sources.

Unless the bank doesn't care about their image, of course.

<comment><USER35> You know you really got me going with your post.

I've spent the whole day thinking about this and now I've been looking up ways to write a PoC. Because I don't think a blog post without a proper PoC will do much good.

So first of all assembling a wordlist was easy using Python. The hard part will without a doubt be interacting with one of the entry points to their service.

It's a flash application, with a login form.

I've discovered Selenium for this purpose, and theoretically Selenium can act as a browser, clicking input fields in the flash form relative to where the element is created on the page. And then I can take a picture of the current page after each operation and compare it to how the page should look at login, or at failed login.

Jesus did you just ruin my weekend. ;) (in a good way)

Edit: Found sikuli and was amazed by how simple it is. Jython script that let's you essentially use images from your screen as conditional expressions in Jython. So you can do

      if exists(screenshot of bank login form.jpg):
        click(screenshot of first input field.jpg)
        type('bla')

And so forth. Very powerful stuff! Sikuli scripts can then be called by external programs such as CPython Popen for example, and passed arguments.

</comment></comment></comment></comment><comment><USER37> Discover (the credit card company) doesn't allow non alphanumeric characters in their passwords. I harangued them until I got a reason why: that way, they got fewer people bothering customer support with password problems.

(I wonder if they got any other people besides me bothering them because of that rule...)

<comment><USER38> I'm pretty sure this is no longer true. I use my strongest password (techniques) at discover, including symbols.

<comment><USER39> That's not your strongest password any longer.

</comment></comment></comment><comment><USER40> Before you comment, read the top answer!

</comment><comment><USER41> I used a small regional bank until recently and they had both a small (might be 8, I can't remember) character limit and stored them in plaintext. When I was emailed my current password after having to reset it, I left.

</comment><comment><USER42> As mentioned in the link I've seen it mostly due to modern web-apps that have to interact with legacy systems.

Also, I just did some Googling and it wasn't until 2009 that HP/UX supported passwords >8 characters!

</comment><comment><USER43> Primo Levi, _The Periodic Table_ , Chromium, tells a similar story of something that was done once for a good reason, but then became 'just what you do'.

</comment><comment><USER44> I don't really get the "legacy" systems bit. Are you passing around the person's password to every back end server? Why? Just auth once and pass around the user id. You should trust your internal systems, not require each system to reauth. Security around the perimeter, once you're in, you're in.

Though to be fair, when's the last time you heard about a bank's password database getting stolen?

</comment><comment><USER4> Why does paypal limit the password to 20 characters?

<comment><USER45> I vaguely also remember typing a password into Paypal and it said, "hey! no spaces are allowed!" and I definitely lost a significant chunk of confidence in their process.

</comment></comment><comment><USER46> I'm not up on this topic, but I've always wondered why password length is so important if dictionary and other automated attacks aren't allowed. I hope you don't tell me that banks allow millions of password attempts in a short period of time, certainly not from the same ip address and even from what might be a bot net.

<comment><USER47> The usual concern is the database storing the passwords/hashes being stolen. This has happened to dozens of small to medium size web services. The attacker could then hash away at the passwords to his heart's content. Then end-goal of this is to get user/pass combos to be tried on other, higher-value sites, like email services and, uh, banks.

Which gets us to the strange part. Who hacks a bank's service to steal a password DB in hopes of using the passwords against some other target? I'm thinking nobody. If you managed to compromise a bank's web service to that extent, you'd be trying to transfer all of the money from all of the user's accounts to one you control, not trying to crack their passwords.

That means that your bank's password storage method and complexity is not very important. What is important is that, whatever password you use, you never use that password on any other site. And that you use a bank that requires real 2-factor authentication, via text or mobile app or something like that, not with "security questions".

<comment><USER48> If the passwords are stored somewhere that's easier to access than your real target at the bank, then cracking the passwords might be helpful... I totally agree with your recommendations, but bank password storage/complexity definitely could be important.

If an attacker got hold of a large number of bank account user logins, I'm not sure what they'd do. My bank doesn't provide a feature to quickly transfer cash from the website... Several hundred large billpay changes would show up and be easy to cancel... Perhaps they'd just gather personal info useful to a social engineering attack...

</comment></comment></comment><comment><USER49> Does Paypal still do this? It said my password was too long when I first set it. I really really hate that.

</comment><comment><USER50> I could swear learning somewhere that it's because forcing short/simple passwords makes it harder to recognize the password in keystroke logs, which is the attack vector banks face the most. Can't find any sources to back that up, though... has anyone else head this explanation?

<comment><USER32> I'd expect that the attack vector banks face most is that oblivious users simply _give away_ passwords through phishing schemes. And banks with reasonable security don't rely on passwords (alone), but on some kind of token generator, in which case such a phishing scheme which directly transfers money to the attacker is the only option (any keystrokes captured are useless after x minutes).

</comment></comment><comment><USER51> I.m.o incompetence. If not I'd love the "guilty" ones to explain this annoying ting once and forever.

</comment><comment><USER52> In today's world, password length is like zombo.com: The only limit is your imagination.</comment>


Decovar – A multistyle decorative variable font - <AUTHOR> https://www.typenetwork.com/brochure/decovar-a-decorative-variable-font-by-david-berlow/ <comment> j-pb Like the vulcans say: "Infinity ugliness in infinite combinations."

Seriously I couldn't find one decent looking version of that font...

<comment><USER2> Then you really aren't trying hard enough.

</comment></comment><comment><USER3> That's pretty cool, but in order to use it on my desktop, do I need an all-new font widget that can control every aspect of the specification? Or do I fiddle on a webapp until I get the one that I want, download it and use it as normal... and now I have a thousand variants of Decovar that I have to squint at very carefully to differentiate?

I'm not complaining about choice, I just want to know if anybody has thought about usability.

<comment><AUTHOR> Yes, all applications now need an all-new font widget. The first program with such a widget is [https://github.com/googlei18n/fontview](https://github.com/googlei18n/fontview)

</comment></comment><comment><USER4> This is really cool. Did anyone else try to drag the "Drag Me!" bubble for 10 seconds, though? Instead of the line itself, I mean.

<comment><USER5> Yup, it's like a door that says "PUSH" or a button that says "Click me!", I automatically -and I think understandably- assumed I should drag the thing it's written on, not the thing next to it

</comment></comment><comment><USER6> Wow, thanks for all your comments. I even clicked on the Drag sign myself. We can make it that way too.

Ugliness vs Beauty, is a subjective judgement, and if one person, or 1,000 thinks it either way, the type designer is usually trying to please just one person.

In this case, the designer is trying to please a range of tastes, in both print and animation, from subtle stroking of the style, barely perceptible like the sound your fingers make parting to drop a pin, which is one whole tradition in type use, to making your eyes bleed, the range of which variations are all about, and has been for centuries.

We'd certainly appreciate the Hacker News hackers' perspective on Use! User Interfaces! CSS, and how applications should continue to support variations, in more sensible ways.

You can do that here, and also there are several other places you can sound in if you start hacking around. Google, Microsoft, Adobe, and many others will be offering pretty fonts soon. I felt it'd be good to make sure to get people's eyes to bleed first, to open them up. Thanks for that confirmation.

<comment> j-pb Font is about readability. You can use it to convey emotion and style as well but readability must come first. It takes carefull tuning to achieve that in a stylistic font and I doubt it is possible at all in a font like this. The kerning in this thing is just painful. Additionally the rendering engine has to be even more complex then that stuff already is.

This entire thing is an anti feature, it looks worse and is less readable, makes the implementation of stuff harder, and nobody needs it, but hey some people can feel smug.

<comment><USER2> _> but readability must come first._

Not so. Typefaces are (as with most two dimensional design) about _communication_. Legibility is merely the most straightforward means by which a typeface enables communication (of the text), but there are many other things that can be communicated (emotions, age, time, place, personality, intellect, attitude, sanity, ideology, and on and on).

Sure this typeface has some pretty extreme variations, and the interface certainly encourages the use of the entire gamut, but nothing says that you can't be subtle. Remember when drop-shadows were new and everything looked like it was levitating at least a half-inch off the background? Ignoring for the moment the "flat design" interregnum, we've used dropshadows ever since, but over time in a much more restrained way.

Anyway, this _particular_ typeface is clearly meant as an eye-catching demo of the technology, and even a lighter touch still leaves you with an all-caps display font. Less overt and garish variations (along the lines of the older Multiple Master fonts) are possible and are clearly in the works: [https://www.typenetwork.com/brochure/opentype-variable- fonts...](https://www.typenetwork.com/brochure/opentype-variable-fonts-moving- right-along/)

</comment></comment></comment><comment><USER7> Sounds an awful lot like METAFONT.

<comment><USER8> The thing I absolutely miss the most from grad school is porting my advisor's whiteboard chicken scratch into parametric METAPOST graphics. It let us size & scope images to their target: posters, conference papers, slides, journal publications, etc.</comment></comment>


Reforms to Ease Students' Stress Divide a New Jersey School District - <AUTHOR> http://www.nytimes.com/2015/12/26/nyregion/reforms-to-ease-students-stress-divide-a-new-jersey-school-district.html <comment><USER2> I think it's strange to see this sort of conflict crop up as a cultural, racial division. Providing time to goof off, unwind, relax, and release tension isn't really a "dumbing down" of curriculum.

Hyper-competitive atmospheres, based on an immersion in a perpetuity of dictated, goal-oriented projects, where objectives and achievements are assigned, and not chosen, without any opportunities for... (dare I say?) "fun" won't provide for memorable experiences that last beyond childhood. This sort of thing voids the personality, wouldn't you say?

A childhood of constant, unrelenting cerebral challenges, and compulsory learning, is going to produce some real fuckin' jerks down the road, I'd say.</comment>


"God" == God - <AUTHOR> http://omniorthogonal.blogspot.com/2013/10/god-god.html

<comment><USER2> This idea that viral ideas are like cultural software running in society that result in real-world results (like cathedrals and other infrastructure) is a brilliant observation and I would suggest it applies similarly to other perhaps less viral ideas that grow into institutions, governments, and other social constructs. I'm not a sociologist or anthropologist but I would like to hear one of either provide input on this topic.

<comment><USER3> That's exactly what a meme is.

<comment><USER2> Are you saying a meme can result in real-world creations cathedrals and other infrastructure? I think I see what you're getting at in that they are related as far as cultural virality goes. However my understanding of a meme is a flash-in-the-pan viral idea that gets '15 minutes of internet fame' and then people forget about it.

<comment><USER4> Value Memes ala Spiral Dynamics are probably more applicable here.

[http://en.wikipedia.org/wiki/Spiral_Dynamics](http://en.wikipedia.org/wiki/Spiral_Dynamics)

</comment></comment></comment></comment><comment><USER5> I like the quote at the top of the page:

      "A philosopher...is a sort of intellectual yokel who gapes and stares
      at what sensible people take for granted." – Alan Watts

I'm not a philosopher, but I find myself gaping and staring at common things like money and colors, astounded that they seem so concrete yet only exist as a figment of our collective imagination.</comment>


Bower development is stopped. Move to npm, if you haven't already - <AUTHOR> https://twitter.com/nachocoloma/status/663622545162280960 <comment><USER2> [https://twitter.com/sheerun/status/666050273538924545](https://twitter.com/sheerun/status/666050273538924545)

Bower development hasn't stopped, instead the (single!) maintainer is asking for resources to continue development:

"Bower needs resources for its maintenance. Please fill Support Declaration ([http://goo.gl/forms/P1ndzCNoiG](http://goo.gl/forms/P1ndzCNoiG)) if you think you can help."

(from the Bower readme)</comment>


Why did a humpback whale save a seal's life? (2016) - <AUTHOR> https://www.sciencemag.org/news/2016/07/why-did-humpback-whale-just-save-seals-life <comment><USER2> So, as in many cases when scientists (or science writers) discuss the motivations of mammals with big brains, they go to a lot of effort to avoid the obvious conclusion, which is that the humpback did it for a similar reason to why a human might make a coyote lay off an attack on a raccoon or possum. We wouldn't always, but plenty of humans would, and it wouldn't be for any particularly abstract or intellectual reason, it's more like, "the coyote is being mean, make it stop because I can."

Sometimes, scientists remind me of mid-20th century behaviorists trying to explain human behavior.

<comment><USER3> Isn't the entire idea of "being mean" an abstract and intellectual idea? Furthermore that thought process would have a number of complex implications. Do whales equate eating another animal with "being mean"? Does that mean they view hunting as "wrong" in some way? Do they have guilt over continuing to hunt? Are there some whales that morally object to hunting? Is there some orca out there that feeds on plankton because it is the whale equivalent of a morally motivated vegan?

It is much cleaner to isolate the motivation and equate it with something more animalistic like "it is instinctually initiating a preemptive attack on a predator and the seal was just a lucky but coincidental bystander".

<comment><USER4> > Isn't the entire idea of "being mean" an abstract and intellectual idea?

Not really, it boils down to harm prevention.

I believe that, as humans, we greatly overestimate our own reliance or abstract ideas.

If we notice someone is harming another, and we intervene, we simply act.

The explanation for our behaviour (someone was being mean) comes later as post-hoc rationalisation.

Ironically, we then further rationalise and extrapolate from this incorrect idea that human behaviour comes from a fount of abstract values and ideas, and use it to devalue animals and their behaviour (assuming they have no complex cognition, and so must be dumb).

<comment><USER5> I've lived with dogs and birds and seen dogs intervene when other dogs fight, birds intervene when other birds fight and dogs intervene when birds fight.

I don't think stopping aggressive acts in one's vicinity requires more reasoning ability than plotting to long term ruin the outlooks for other specific species X, species Y is cute or some thoughts about the moral act of hunting. Most animals have some experience with others acting aggressively and would like that reduced. We don't think about who is involved either when we see a fight break out between humans or animals.

I just happened to come across a magpie that was fighting a mouse outdoors today, and the mouse got pinned in a hole in a tree where the magpie kept pecking. I don't know why but I walked over so that the magpie went up in a nearby tree and the mouse ran away. That same magpie then attacked some nearby other magpies before calming down.

<comment><USER6> A YouTube video I enjoyed several years back involved chickens (hens) breaking up a rabbit fight.

Edit: it proved surprisingly easy to find: [https://youtu.be/D35uQCtr4EY](https://youtu.be/D35uQCtr4EY)

</comment></comment></comment></comment></comment><comment><USER7> The hypothesis at the end of the article assumes humpback whales are just acting instinctively. I think it is much more likely that the whales are able to reason that denying other prey to their babies' predator is a good thing. In addition to keeping the orca population in check and reducing the energy available to them, the humpbacks might also be fully capable of holding a grudge.

<comment><USER8> Instinctively? Dunno, whales seem pretty smart. They communicate, they take care of their young, have advanced feeding strategies, and interesting interactions with humans.

Seems quite plausible they understand the relationship between feeding, reproduction, and population growth. They are clearly aware that killer whales feed on baby humpback whales. Doesn't seem a stretch that humpbacks would do whatever they can to prevent killer whales from feeding.

</comment></comment><comment><USER9> I know somebody who studied orcas in school and she said that humpbacks tend to give orcas a hard time whenever they meet them. It's understandable since orcas often attack their young ones.

<comment><USER10> Yes exactly, and thats what the article says.

</comment></comment><comment><USER11> The simple answer might be the right one, it just felt bad for the seal. Nobody really knows how intelligent humpback whales are.

<comment><USER12> I suspect they are much smarter than we give them credit for.

It is also why I feel commercial whaling (or in Japan's case "scientific research") is such a horrific thing to do.

<comment><USER13> with that said, I suppose you don't eat pig or cow products?

<comment><USER14> I agree that we should all eat less meat and the way we treat "factory" animals is cruel. But with that said, would you really argue hunting chimpanzees is the same as killing pigs?

My point is, it's not wrong to apply different standards for different animals. GP says they feel whaling is wrong because they relate more to whales than they do with cows or pigs. If GP sees news articles on how cows are actively saving other helpless animals from getting hunted, maybe they'll start applying similar standards to cows too. You may find this illogical and annoying, but bringing up cows and pigs in this way is not constructive in my opinion.

</comment></comment></comment></comment><comment><USER15> I hate this tendency of trying to reduce the behavior of _conscious_ living things (such as whales, dolphins etc.), who are capable of emotions to simple "inadvertent" rules.

That's like saying: I believe Mr. Pittman, who is otherwise capable of complex behavior, did not consider the meaning of his words before uttering them. What he said was simply an inadvertent response to being asked a question.

You wouldn't even say that about a dog following orders.

</comment><comment><USER16> "If a lion could talk, we would not understand him."

I would differentiate being able to characterize the behavior from being able to 'understand' the behavior. If for the sake of argument, we assume orcas and humpback whales have higher brain functions around the level of humans, I would argue it's still impossible for us to understand the humpbacks motivation because his mind is completely alien to ours.

<comment><USER17> All life on earth comes from the same competitive biology though. The motivations of all species and organisms follow some predictable trends and patterns.

The ROI of preemptively attacking a predator while the dolphins are busy/tired from hunting while also taking food away from them in the process isn't a giant mystery.

The chances of it being Occam's Razor competition being species is just as likely as it crossing some higher abstract threshold for actually _caring_ about some other 3rd party specie's individual survival because they're 'nice' or disgusted by the site (as others in this thread have implied).

Ultimately they don't seem to face much personal risk while doing this as the Killer Whales aren't big enough to take them on.

</comment></comment><comment><USER18> Crazy that the commentators have to insist on selfish reason in the end. May be for one second even if unthinkable for human that whale has a good heart.

Good save.

<comment><USER19> Is letting the killer whales starve the act of a good heart?

<comment><USER20> Yeah, I'd believe more in the "it really hates killer whales" theory.

</comment></comment></comment><comment><USER21> SETI pointed at the sky, with intelligent species abound at home.

</comment><comment><USER22> The enemy of my enemy is my friend.

</comment><comment><USER23> Might be that they are feeling pressure in the environment making them more aggressive for whatever is remaining of their habitat. Also, a shrinking ice habitat will make it more probable that they will cross paths. This are just thoughts, not an expert.

</comment><comment><USER24> Maybe they do it for similar reasons humans have for finding baby non human mammals cute and worth saving?

That said, do we know why we find baby non human mammals cute? I've always figured that it was a false positive based on features shared with human babies.

<comment><USER25> It may be a false positive on our part. But for animals that are likely to be in contact with humans it's a true positive.

</comment></comment><comment><USER26> Isn't it possible that a significant fraction of mature humpback whales have had bad encounters with killer whales when they were younger and just always mess with them when they can?

</comment><comment><USER27> And why do killer whales never kill humans in the wild?

<comment><USER13> Human beings don't really share the same habitats with orcas?

Maybe we don't taste good?

<comment><USER27> They eat deer and moose swimming by (transients), not to mention sea lions. There are a lot of divers in their waters world wide.

</comment></comment></comment><comment><USER28> May be it could not see properly and thought seal was a baby whale.

<comment><USER16> "I thought it was my cousin."</comment></comment>


Ask HN: What is the Current State of HTML5 WebSockets? - <AUTHOR>

I've loosely tracked the development of HTML5 WebSockets from its inception to, what I understood to be, its eventual decline.<p>My question is, what is the current state of WebSockets? Is it basically dead? And if so, what are my options for developing a real-time web application? <comment><USER2> WebSockets was used for the recent Unumbered Sparks installation at TED in Vancouver. People below the sculpture could connect to a local access point on their phones and control lighting and color from a phone web view in their browser (http requests were redirect to the webapp a la login page)

I had the chance to try the sculpture and the projection was extremely responsive, the delay was not very noticeable even moving from phone > access point > renderer on a chrome instance > projector. I'm not sure how indicative of the general development progress this is, but the API seemed very capable.

There's more implementation info on the webpage:

[http://www.unnumberedsparks.com/](http://www.unnumberedsparks.com/)

</comment><comment><USER3> WebSockets are more or less ubiquitously supported [1]. Still, for compatibility and ease of development, your best bet for real-time web is to use SockJS [2], which wraps WebSockets and other transports.

[1]: [http://caniuse.com/#feat=websockets](http://caniuse.com/#feat=websockets) [2]: [https://github.com/sockjs/sockjs- client](https://github.com/sockjs/sockjs-client)

</comment><comment><USER4> I believe websockets are still very much alive and popular (at least I hope so, I'm using them!).

I actually use socket.io [http://socket.io/](http://socket.io/) , which not only makes websockets easy to use (accommodating a few different frameworks, I use node), but provides support for old browsers by selecting a real-time transport that works, be it flash, ajax polling etc.

</comment><comment><USER5> Not dead at all. I just saw Disqus using them a few days ago for realtime votes updates.</comment>


Ask HN: What happens to acquired companies IP?  - <AUTHOR>

After the recent acquisition of Gowalla by Facebook, I began to wonder, what happens to all the great little logos that Gowalla has? When Gowalla gets shut down(which seems to be what is indicated is going to happen), do they just get buried? I wonder the same about all the startups Google has acquired. Where does all the graphic design and code go? <comment><USER2> It is owned by the acquirer.

<comment><USER3> The OP probably understands this, but is trying to get information on what typically happens to the property itself. Is it discarded and forgotten? Kept and used internally, perhaps also saved for a rainy day? Is it ever resold separate to the parent product/services they belonged to?

Does anyone here have any relevant anecdotes?</comment></comment>


Emulating the Original Gameboy's CPU - <AUTHOR> https://medium.com/@raphaelstaebler/building-a-gameboy-from-scratch-part-2-the-cpu-d6986a5c6c74 <comment><USER2> Emulating a gameboy is a fun project, I highly recommend it.

The most patience testing element of it is you won't really see any direct results for quite a while, but once you get that Nintendo logo scrolling down the screen, achieved from implementing a lot of the core components (cpu, memory, ppu, screen etc) it's almost like magic and extremely satisfying!

<comment><USER3> Seconded, had a similar experience. I never made it to emulating audio, though, myself...

<comment><USER4> The Gameboy sound chip is definitely one of the trickiest part of the console, if only because there are a million tutorials out there on how to _start_ a Gameboy emulator but very few go all the way, and generally the sound chip is what you do last. It's also surprisingly quirky and many games will misbehave if you don't implement some weird edge cases.

It's also annoying to debug because it's not as obvious as video when something is wrong, especially when you've just spent two hours listening to the same chip tune square waves in a row...

<comment><USER5> I'm interested in writing my own GB emulator mostly because sound is so patchy across all existing JavaScript implementations.

My entrance into the GB scene coincided with my interest in LSDJ, and I really want to write a web app around it[1], but I'm stymied by outdated implementations and my own lack of domain knowledge.

[1] [https://github.com/andrewrabon/little-web- dj](https://github.com/andrewrabon/little-web-dj)

^ Still unfinished. My own emulator will probably have to come first.

<comment><USER4> The most thorough reference I've found for the Game Boy SPU is unfortunately the Gambatte source code itself since it's a fairly accurate emulator and open source. Unfortunately it's also not the most human-readable code (due to micro-optimizations and lack of comments, plus it's C++ which is already a -10 handicap in readability).

In the meantime you can try to dig around my code which is not nearly as accurate but (hopefully) should be easier to understand: [https://github.com/simias/gaembuoy/blob/master/spu.c](https://github.com/simias/gaembuoy/blob/master/spu.c)

It seems to work fine with all games I've tested, although of course that's only a tiny subset of the console's library...

</comment></comment></comment></comment></comment><comment><USER4> That's a good introduction. The GameBoy is really a good starting point to get into emulation, I recommend it.

I've been thinking about making my own tutorial for Gameboy/Gameboy Color emulation over the past few months, I've even finished writing the emulator itself: [https://github.com/simias/gaembuoy](https://github.com/simias/gaembuoy)

I've made sure to rebase all of my fixes to have a single, linear, clean commit history that should be easy to follow. It can play most GB and GBC games. Now I _just_ need to make the actual tutorial, but I want to make videos and I know nothing of video editing so I'm afraid that writing the emulator was actually the easy part.

If somebody has tips for video editing on Linux, I'll gladly take them...

<comment><USER6> Well, talking on the video will be faster than writing out articles but will it result in materials best suited to your intended audience ?

edit: also, video editing is the final process of putting everything together. Which learning style are you going for ? What visuals are you using to support that ? How are you going to assess your audience's progress ?

Pedagogy is a really interesting and rewarding field ! So many ways, so many questions !

<comment><USER4> I believe it can be, I find that explaining things using animations and being able to use a more casual tone while narrating can be helpful and easier to follow.

I've already tried writing a PlayStation emulation guide: [https://github.com/simias/psx-guide](https://github.com/simias/psx-guide) (only covers the very basics unfortunately). I found that in order to really get in-depth I had to write big walls of text to explain relatively simple concepts. Being able to talk more casually and expressively over illustrations can be less daunting for somebody looking to get into emulation.

Regarding your edit: I already took a bunch of notes while actually implementing the emulator so I have a fairly clear idea of what my script will look like (i.e. Intro -> CPU instructions -> timings -> basic GPU -> controller input -> sprites -> sync to real time -> etc...). I won't focus on the code too much because it's not a programming tutorial, it's meant to me an emulation tutorial. It would be targeting people who already know how to program but might not be comfortable in the low-level and don't know where to start.

</comment></comment></comment><comment><USER7> I can also highly recommend the PyBoy[0] project for Game Boy emulation. It is written in Python, has an accompanying report for documentation, and is still being developed.

It provides an interesting basis for student projects to work on, such as machine learning on games, rewinding time and replaying (great for machine learning), adding the sound-subsystem, link-cable, and much, much more.

[0]: [https://github.com/Baekalfen/PyBoy](https://github.com/Baekalfen/PyBoy)

</comment><comment><USER8> Anyone interested in how the Game Boy works should watch "The Ultimate Game Boy Talk" by Michael Steil.

[https://www.youtube.com/watch?v=HyzD8pNlpwI](https://www.youtube.com/watch?v=HyzD8pNlpwI)

</comment><comment><USER9> One of the reasons I first got into programming was due to a fascinations with emulators. Several years later, I'm finally working on a Gameboy emulator of my own. It's a really rewarding experience, I had taken a brief look at GB assembly code before and couldn't make head or tails of it, but after implementing the CPU and memory, a lot of the actions taken within code finally make sense.

I'd like to write my own document on emulator development someday, but I need to finish my own first. I'm nearly at the point where I can display a screen, hopefully sometime within the next week.

</comment><comment><USER10> "The Gameboy's CPU is known as the DMG CPU. It is equipped with 6 registers of 16 bit each and they're called AF, BC, DE, HL, SP and PC."

Those look like Z80 register names. Guess it's a Z80 and the article autor doesn't know that?

<comment><USER11> It's not really a Z80. This article talks about the differences: [https://realboyemulator.wordpress.com/2013/01/01/the- nintend...](https://realboyemulator.wordpress.com/2013/01/01/the-nintendo- game-boy-1/)

Or this one: [https://gbdev.gg8.se/wiki/articles/CPU_Comparision_with_Z80](https://gbdev.gg8.se/wiki/articles/CPU_Comparision_with_Z80)

<comment><USER12> I suspect Nintendo may have started with a Z80 core and then customised it a little bit, similar to what they did with the almost-6502 in the NES.

<comment><USER4> It's definitely based on the Z80, but it's also different enough that you can't really base yourself on Z80 docs to implement the Game Boy CPU (I learned that the hard way). The flags are different, the timings are different, some instructions are removed, some instructions are added etc...

</comment></comment></comment></comment><comment><USER13> How long did it take to make? I been thinking about writing my own emulator in JavaScript for a while now. I know there's a lot of great projects out there, but I like to make one myself.

<comment><USER14> Depends how accurate you want to get.

Getting an implementation of the CPU instructions in a high level language with instruction level accuracy and approximately correct timings is a weekend or two project.

Going for extra components like the graphics or audio support, or higher accuracy in terms of cycle counts and timing can make it a lot longer.</comment></comment>