Moral Dilemma for Google's Driverless Vehicle Control Software - <AUTHOR> http://marginalrevolution.com/marginalrevolution/2012/06/the-google-trolley-problem.html

<comment><USER2> Moral dilemmas involving driverless vehicles are best solved by programming the intelligent agent governance to simulate an ethical human driver. In this fashion, the agent reuses the existing human-applicable laws and conventions.

To be sure, laws will have to be revised to accomodate certain super-human powers of vehicle-controlling intelligent agents. For example, I suppose that such agents will be much more aware of various environmental aspects due to their mesh-networking with other vehicles, roadside features, etc.

Suppose that blind pedestrians have smartphones that mesh-network with nearby driverless cars. Existing driving laws could then be revised to require driverless cars to yield right of way, even if the blind pedestrian is not holding a cane, or is not otherwise visible.</comment>


There is no evil like reCAPTCHA - <AUTHOR> https://thestoic.me/there-is-no-evil-like-recaptcha <comment><USER2> Google did not create reCAPTCHA. They bought it; it was started by Luis von Ahn, who went on to create Duolingo.

When reCAPTCHA was created, the alternative was CAPTCHA, which tried to impede bots but did not generate any social benefit. This was the genius of the original reCAPTCHA concept: the time taken to 'confirm humanity' could be channeled into the socially-useful endeavor of digitizing books. Capture some of the heat emissions of impeding bots for a useful purpose, rather than letting it all go to waste.

Now, yes, Google is using it to train their self-driving car AI, and there's a bunch else happening in it to connect to Google's surveillance apparatus. There's much to legitimately criticize there. I personally don't view training Google's proprietary AI as the same kind of intrinsically altruistic purpose as digitizing the world's pre-digital books.

But putting the entire concept on blast with erroneous history that can be corrected with about 60 seconds on Wikipedia doesn't help the argument at all.

<comment><USER3> > but putting the entire concept on blast with erroneous history that can be > corrected with about 60 seconds on Wikipedia doesn't help the article at > all.

Nor does an entirely fallacious premise. ReCAPTCAH v3 is entirely transparent and non invasive to users. In fact it's retroactive to help the site admin figure out what to do with the score:

[https://developers.google.com/recaptcha/docs/v3](https://developers.google.com/recaptcha/docs/v3)

<comment><USER4> > non invasive to users.

Except for the invasion of my time and attention, used to train Google's AI to get better at recognizing traffic signals. I took that as the main point of the article.

<comment><USER5> That's v2.

v3 is "invisible" and is supposed to be deployed to every page on the site, and the site is the one who decides how to punish you for not matching their normal audience.

<comment><USER6> Not just invisible but unlike "invisible recaptcha" which was kinda between v2 and v3 which does spawn a challenge on its own, but v3 is entirely non interactive and as you said the site/admin decides the punishment.

</comment></comment></comment></comment></comment><comment><USER7> Isn't the author talking about recaptcha v2? My understanding of recaptcha v3 is, that it just gives you a score for how well google can track you and then leaves it up to the site operator to block users who aren't transparent enough.

What I really hate about recaptcha v2 are those artificial delays before loading the next image (which it can happen to several times on a single card). And then in the end you frequently fail, despite answering everything correctly.

<comment><USER8> > Isn't the author talking about recaptcha v2?

Yes.

> My understanding of recaptcha v3 is, that it just gives you a score for how > well google can track you and then leaves it up to the site operator to > block users who aren't transparent enough.

Yeah, that's the one where you're supposed to put it on every page of your website so that Google can collect more information on your users. If they can't, they'll return a low score that you'll use to mark users as "bots".

> What I really hate about recaptcha v2 are those artificial delays before > loading the next image (which it can happen to several times on a single > card). And then in the end you frequently fail, despite answering everything > correctly.

I think this is just what Google does when it thinks you're a "bot": i.e. they don't know who you are.

<comment><USER9> > I think this is just what Google does when it thinks you're a "bot": i.e. > they don't know who you are.

I do wonder _why_ though. For a long time, I assumed it was a rate limiter, but then another HN commenter pointed out to me that time is more valuable to humans than bots. Bots can work on multiple captcha's in parallel.

<comment><USER10> My thoughts exactly. A bot doesn't care if it takes 2 seconds to fade the images out and in for another challenge round, but a human viewing it perceives it as a frustrating delay.

I've become accustomed to just closing any page that presents me with a v2 reCAPTCHA.

<comment><USER11> Unfortunately one of those pages was the Equifax settlement. And other similar "important" sites. I never seem to come across them when it's a service I could easily quit or avoid.

<comment><USER9> This might not be so sinister. It so happens that "important" operations, like a class action lawsuit settlement, are also the type of thing you'd particularly want to protect from bots.

</comment></comment></comment></comment></comment></comment><comment><USER9> It's such a shame that this poor article is getting attention, given that reCAPTCHA v3 is actually a terrible privacy violation.

Sadly, I don't think the author knows the difference between v2 and v3. The article is definitely not talking about v3.

<comment><USER12> A lot of articles posted on hacker news are by people who don't really understand what they're talking about, but use a lot of emotionally charged language. A lot of times this is fine, because it's articulating something that bothers a lot of people and wastes their time. But in this case it's absurd. I don't think he understand just how much crap bots were/are putting out there, especially before we had good services like cloudflare and the whole web hosting cloud to filter it. It's not Google's fault every small/medium sized company decided to put important customer services on a web portal which could be easily abused, they just capitalized on it. Sys admins can't stop random executives from making crap decisions like having an inherently insecure system, but at least they can pitch on reCaptcha to fix it a tiny bit. But they wrote an article where they used a lot of CAPS LOCK, so they must be an authority.

<comment><USER13> > A lot of articles posted on hacker news are by people who don't really > understand what they're talking about, but use a lot of emotionally charged > language.

This seems to be the best strategy for getting to the top of the front page these days. Even better if the target of the emotionally charged language is Facebook, Google, or Amazon.

</comment></comment></comment><comment><USER14> Here is my earlier comment when somebody was bashing reCAPTCHA

[https://news.ycombinator.com/item?id=20297764](https://news.ycombinator.com/item?id=20297764)

\- Running a high profile, or even low profile. service which attracts automated or spearhead attacks makes you appreciate reCAPTCHA

\- Web services and users are often low value and reCAPTCHA offers a free medicine

\- Cleaning up attacks and such as a devops/webmasters is pain in the ass - getting all those alerts ad Saturdat 11:00pm in a bar - you do not want to cover them from your $100 budget

\- reCAPTCHA makes _many_ problems go away for a service provider

\- People complaining about reCAPTCHA are often low value users (they do not buy anything) - though I have only subjective point to confirm this

Long term solutions can be only moving away for CAPTCHAs to strongly authenticated humans by a trusted party

\- Strong human authentication on every service controlled by Apple/Google/Facebook who has vast data to keep bots in the check

\- Start paying for the services - though you still need to do CAPTCHA at least once in the card authorization to prevent cardsters

Alternative for reCAPTCHA - though I do not vouch in for the quality yet: hcaptcha.com/

Bonus: Micropayments instead of ads or make botting too expensive - welcome to cryptocurrency land

<comment><USER15> We had an alternative to reCAPTCHA for a moment - proof of work coin miners, when properly set up it is also very privacy-friendly by having the possibility of fully self-hosting it. Yes it had it's downsides, but IMHO less downsides than doing work for Google. Same goes for coinminers instead of adsense.

<comment><USER16> No you didn't. A few seconds of proof of work is trivial for a bot, any amount that makes it hard for a bot is unusable to a human. This is why nobody uses hashcash.

<comment><USER15> The same way you can buy captcha solves, it's trivial for a bot.

</comment></comment></comment></comment><comment><USER17> With some of these I'm left debating what is a traffic light. Is the pole itself a traffic light? I really don't know.

Also when it asks to select all the cars. Is a bus a car? Is a truck a car? I really don't know what it is expecting and I must pick wrong as I often fail.

<comment><USER18> It's very frustrating that there's no "your AI is an idiot, there isn't one" button. I saw an example of one that said "click the tiles containing the bus" where it was clear what the AI _thought_ was a bus, but it definitely wasn't.

<comment><USER19> This reminds me of Janelle C. Shane's work on AI[1]. Computer vision's been learning based on the photos that people take, not the visions that people see, and this is giving AI a preference for photogenics instead of reality.

People generally don't take pictures of rolling green hillsides. But they very often take pictures of rolling green hillsides _with sheep on them_. So if you ask the robot to draw a picture of rolling green hillsides, it will include sheep. Or, if you ask it to draw a picture of the savanna, it will want to include giraffes.

Now you're being asked to find a bus in a photo without a bus because it's a street scene, and every street scene has a bus in it.

I haven't read her book, yet, but her Twitter[2] is often full of amusing anecdotes like this.

[1] [https://aiweirdness.com/](https://aiweirdness.com/)

[2] [https://twitter.com/JanelleCShane](https://twitter.com/JanelleCShane)

<comment><USER9> > People generally don't take pictures of rolling green hillsides. But they > very often take pictures of rolling green hillsides with sheep on them. So > if you ask the robot to draw a picture of rolling green hillsides, it will > include sheep. Or, if you ask it to draw a picture of the savanna, it will > want to include giraffes.

Don't humans do this too, though? If I asked someone to draw a picture of rolling green hills, they may well add sheep as an additional detail.

<comment><USER19> Well, personally, I had the "bliss" image from the Windows wallpaper collection in my head while I was writing this. But I'm cognizant that most of the photos of hillsides I took in Ireland had sheep in them.

<comment><USER9> I wonder if that would still be true, though, if "bliss" wasn't a default Windows wallpaper. In other words, you're _still_ referring to common pictures, you're just particularly biased to one in particular that you've seen a lot.

I haven't done the experiment, but I'd posit that if you walked up to a group of 8-year-old children, gave them crayons, and asked them to draw pictures of "rolling hills", a significant portion would add sheep, cows, flowers, or some other details—even though a majority of rolling hills in the world don't have any of these features.

</comment></comment></comment></comment></comment></comment><comment><USER20> I've had a blog for about a decade now - I wanted to host it myself rather than use some blogging infrastructure, since I was afraid that blogging infrastructures would become evil in the future (see: Medium). I also wanted a comment section, but as soon as I turned it on, I got hundreds of spam messages every. single. day. I shut it down and started working on adding captcha support. My custom captcha solution did pretty much nothing to slow down the spammers, and I realized how much time and effort I was going to have to spend developing and maintaining it… I decided to hand the reins over to the fine folks at Google, instead. If they want to recoup their costs by having visitors on my site spend a few seconds training self-driving cars, that's a trade-off that's worth it. It's also worth noting that the article doesn't actually point out anything that's particularly evil - just points out the potential for some evil in the unspecified future. Although I agree that the best time to tackle evil is now rather than later, I also don't see any alternative for recaptcha, so I'm going to continue to use it and hope for the best.

<comment><USER21> Perhaps the wordpress method of comments would work for you without a captcha - you allow comments but hold for review any comment that has a potential link in it. Most spammers skip posting links in WP comment sections unless they specifically are trying to market to the site admins.

<comment><USER22> No they don't, WP sites left unattended this way will amass millions of posts pending approval

</comment></comment></comment><comment><USER23> > human right of mental comfort

Hahahahahah hahhaha ahhah hah. Lol.

I'm sorry, I just can't help myself. This cultural tendency toward naming everything you prefer as a right is just... It's hilarious to the extent it's not just sad. I'm willing to give the author the benefit of the doubt that it was just hyperbole. In which case, bravo.

<comment><USER24> That was the exact point when I decided this article was a waste of time. What a ridiculous statement. Even if it was meant to be comedic hyperbole, the effect is that it's impossible to take seriously anything else the author has to say.

<comment><USER25> Well I suppose "Hahahahahah hahhaha ahhah hah. Lol" is a better example of the kind thought-provoking serious writing one should aspire to consume.

<comment><USER26> Yeah I'm not sure whether to flag the comment as an unconstructive personal attack on the author or if it's just within the lines of what we like to see in this community.

<comment><USER27> If it's marginal enough to give you pause for more than a few seconds, down- vote it. If HN becomes _too_ dry and technical there's always Reddit...

</comment></comment></comment></comment></comment><comment><USER28> For those of you asking for alternatives, I've tried a few of the things posted in [https://kevv.net/you-probably-dont-need- recaptcha/](https://kevv.net/you-probably-dont-need-recaptcha/) to some success, but obviously it depends on your use case.

<comment><USER29> thanks for your overview !

Does anyone knows a recapthca2-like service/software, that would help solve such tasks (OCR, object recognition..) on a custom provided dataset ?

It could provide an alternative to recaptcha, and a "Mechanical Turk"/crowdsourcing for universities, institutions or companies to help solve some of their repetitive tasks.

</comment></comment><comment><USER30> My two main frustrations with reCaptcha:

1\. No (or at least piss poor) localisation. It asks me to locate English words, sure, but the images are of things familiar only from American films - sorry, movies. ReCaptcha is how I know (and my only use for knowing) what a 'crosswalk' is.

2\. Sometimes it's just wrong. But I have to select the images that it incorrectly thinks is a bridge or whatever anyway, otherwise I'm not allowed to login.

Everyone's one of N top complaints:

\- How much of the damn structure counts as a traffic light?!

<comment><USER31> Yep, they've trained my neuronet that they always show the images in a 3-2-1 or a 3-1-1 sequence, so now even if shows me something weird, I know I need to select the number of most likely things they want me to. This way I almost always finish it on first try.

</comment></comment><comment><USER32> Would appreciate thoughts on this alternative that we are developing:

[https://github.com/librecaptcha/lc-core](https://github.com/librecaptcha/lc- core)

The idea is to develop a framework for Captcha generators. A few sample generators are provided out of the box, but new ones can be written easily. The framework takes care of storing entries in the database, serving them as challenges through an HTTP API, and checking the responses.

From the README, why libreCaptcha:

      * Eliminate dependency on a third-party
      * Respecting user privacy
      * More variety of CAPTCHAs, tailored to your audience

The implementation has a long way to go (it was written by students trying to learn Scala), but would appreciate thoughts on the concept.

<comment><USER33> If you give me a captcha generator I can give you a captcha solver. You have no idea

<comment><USER32> Agreed; a determined programmer could solve almost any Captcha given sufficient time and resources.

But we are not trying to create an unsolvable Captcha. For those websites that need something good enough to deter generic bots while not compromising privacy of their users, this might be a good enough alternative to reCaptcha.

Imagine a docker image which just works with out-of-the-box generators. Those who need more variety could create a custom generator with Javascript and drop it into a docker volume.

<comment><USER34> e.g. the difference between a general intelligence and the AI we have today. Generators that vary what is being asked from site to site make generic solutions much more difficult.

</comment></comment></comment></comment><comment><USER35> I love competition, but I hate Google.

So I wish them luck while hoping that they'll go die in a fire.

Manifest v3, tracking everything, this... Only validates my decision to scrap all Google services 2 years ago.

<comment><USER36> I can't get behind this google hate. I can think of many companies that aren't providing any sort of public good.

</comment></comment><comment><USER37> Recaptcha is a free mechanical turk for Google. Right now they re training waymo's cars, but soon they 'll need to train other networks. Prepare for "Click on all images showing intraductal papillary biliary neoplasm". C'mon, don t be lazy

<comment><USER38> This conspiracy theory has been debunked many times.

<comment><USER39> What conspiracy theory? That's what Google say it is for:

> Hundreds of millions of CAPTCHAs are solved by people every day. reCAPTCHA > makes positive use of this human effort by channeling the time spent solving > CAPTCHAs into annotating images and building machine learning datasets. This > in turn helps improve maps and solve hard AI problems.

[https://www.google.com/recaptcha/intro/v3.html](https://www.google.com/recaptcha/intro/v3.html) (under "Creation of Value - Help everyone, everywhere - One CAPTCHA at a time.")

</comment></comment></comment><comment><USER40> The title mentions reCAPTCHA v3 but then the article goes on to rant about the challenges you have to solve. reCAPTCHA v3 is completely automatic, there are no challenges at all. Of course, it's not perfect either, because occasionally actual humans fail the challenge too.

<comment><USER8> > reCAPTCHA v3 is completely automatic, there are no challenge at all.

Yeah, if you're signed into Chrome and Google has enough information to know who you are (yes, I know the new one is score-based…this just means that anyone who isn't the above is going to get a poor score and be blocked.)

<comment><USER41> You can actually set the minimum score requirements to whatever you want. The default is 0.5, but there's nothing stopping you setting it to 0.0 and letting everyone through.

<comment><USER42> Can you set it to only allow people with score < 0.5?

No, I'm not joking.

</comment></comment></comment></comment><comment><USER43> reCAPTCHA v2 has prevented me from doing so many things. A recent example: I attempted to make a LinkedIn account. When I got to the captcha, it gave me one of the really nasty ones where you wait for each new image square to slowly appear, and almost every new square also contains a bus or whatever it wants me to click. Then after hitting submit, it still thinks I'm a bot, so I get sent back to another captcha, infinitely. I never ended up creating the account. I attribute this to me using ublock and not using google products, but I can't say for certain, and I'm not changing that just so I can pass a captcha. One of the stated purposes of reCAPTCHA v2 is to prevent actions from taking place altogether by wasting a user/bot's time, so this was probably one of those cases. Somehow it felt certain I was a bot, so to prevent the signup from being possible it instead sent me on an infinite captcha solving tangent. It would have been nice to know before solving tons of them that this would never work and I was just wasting my time.

<comment><USER26> Same here. I got a gift card, went to the site to check its value, didn't get a cookie banner but they still hired this third party from the other side of the planet to try and identify which human I am, allegedly the only way to tell whether I'm human (y'know, a 21 digit account number isn't proof enough). The third party decided I'm not. Wanted to contact customer support, guess what? Form broken. Turned of tracking protection, ad blocker, etc. No dice. Tried a second browser, same issue. Called the next day and finally got to the amount... Of course they couldn't reproduct the ReCAPTCHA issue and the form didn't give them an Internal Server Error either. Must be me.

If this were about not being able to see cat pictures, alright, but this is about accessing money that I'm supposed to own. This is so backwards to me.

<comment><USER44> Which brings us back to the old way of using cash instead of gift cards, it might have a number of other issues, still it remains simpler.

</comment></comment></comment><comment><USER45> Would downvote this if I could.

1) Google bough reCAPTCHA in the first place. 2) Google's latest captcha isn't even a captcha, you just click a button saying you are human and it analyzes your mouse movement and probably a fingerprint of sorts and you are in.

The article just isn't accurate and seems unnecessarily hateful about things that are not exactly true.

<comment><USER41> Google's latest reCAPTCHA is v3, which works behind the scenes to generate a 'trustworthiness' score for each user. There is no longer any button for the user to click. You're thinking of v2, I think.

<comment><USER45> I am talking about V3 it appears, just checked here [https://www.google.com/recaptcha/intro/v3.html](https://www.google.com/recaptcha/intro/v3.html), at 0:11 on the splash video is the image I am talking about ([https://youtu.be/tbvxFW4UJdU?t=11](https://youtu.be/tbvxFW4UJdU?t=11)).

I guess I didn't mean a button, but a checkbox.

</comment></comment></comment><comment><USER46> reCAPTCHA is turning into a punishement for those who don't want to consent to full tracking by Google.

Apple is working on their SSO project (Sign in with Apple); I hope they will also consider the use-case of being able to tell a site that you're a human without sending any information.

</comment><comment><USER47> That article aside, what are everyone's experiences with reCAPTCHA? We are using it to secure one of our contact forms and get a lot of spam through it. Upon research (googling) I found that reCAPTCHA is "broken", e.g. [https://threatpost.com/uncaptcha-googles- recaptchas/140593/](https://threatpost.com/uncaptcha-googles- recaptchas/140593/)

<comment><USER48> We use it to stop bots from opening thousands of trial accounts. We don't have bots anymore, but instead we have humans who open hundreds of trial accounts hourly. I guess it's an improvement.

<comment><USER33> Whats the service fir? I know game miners and some other niche services that attract these kind of actors. Do you know what they want from your site?

<comment><USER48> An email provider. Interestingly enough they don't even send anything. They just... sit there. And who knows why. Not really doing anything harmful afaik, but obviously fradulent so our support still kills them in bulk just in case they were a proper threat waiting for the activation.

<comment><USER33> Huh, interesting, thanks for sharing. Maybe they're just using it as an address to open up accounts for other stuff?

<comment><USER48> Perhaps – but I'm pretty sure there's some that don't even receive emails either. It's as if someone was just creating a "standing army" of accounts in preparation to unleash something. Spooky :)

</comment></comment></comment></comment></comment></comment><comment><USER49> Absolutely, trying to avoid any website with reCAPTCHA.

If you're non-Chrome user, don't even try playing with images - Google force you to click 3-5 times more than Chrome users, it's just stupid.

<comment><USER50> This! I use FF with uBlock Origin without being signed into Google and it is absurd how many tries it takes to solve the crosswalks, bikes, and storefront riddles. Sometimes I give up due to frustration and open the site in Chrome.

<comment><USER51> Seems like just another way for Google to funnel non-Chrome users into Chrome

<comment><USER15> Hate to say this, EU please help.

</comment></comment></comment></comment><comment><USER52> >Select all pictures of storefronts.

Hmm, if only I could read Bengali, I could tell if this were a storefront or not.

</comment><comment><USER53> See also: "You (probably) don't need ReCAPTCHA"[0]

(submitted to HN here: [https://news.ycombinator.com/item?id=20158386](https://news.ycombinator.com/item?id=20158386))

[0]: [https://kevv.net/you-probably-dont-need- recaptcha/](https://kevv.net/you-probably-dont-need-recaptcha/)

</comment><comment><USER54> reCAPTCHA is the most annoying and presumptuous tracking spyware online. I've come to close websites almost immediately when I discover that they use it. "Discover" is the correct word here, as website developers are usually too careless, to provide any noscript hint that reCAPTCHA is even used and I find myself wondering, why that damn website does not work, until I check my uMatrix and see the evil that reCAPTCHA is. If the service is really needed, I need to allow stuff and reload pages up to 5 times, as script loads script loads script from other domain loads frame ...

This makes for the most shitty experience ever, when I try to use such a website and I give the middle finger to the person who decided they need to have a reCAPTCHA there and to the person who put it there and I tell them the F work in my mind. The disregard for people's privacy cannot get much worse than with reCAPTCHA.

</comment><comment><USER55> My payment provider (Braintree) required me to implement reCAPTCHA v3, despite the fact that I had already implemented server-side fraud checks (MaxMind). I didn't have a choice if I wanted to continue taking credit card payments.

<comment><USER8> Do they specifically require reCAPTCHA v3, or just any sort of bot-prevention CAPTCHA?

<comment><USER55> The specifically told me to use reCAPTCHA v3. I don't know if they would have accepted another one. I didn't want to take the time to research them. Honestly, from a UX perspective I also preferred the "no user interaction" part of reCAPTCHA.

</comment></comment></comment><comment><USER56> I'm glad someone is talking about this and we can have a healthy discussion about it. Things like PrivacyPass[0] are a step forward, but for those who don't know about such a tool, they will continue to be 'tortured' and get repetitive strain injury from constantly having to solve recaptcha v2, at least, well if they browse under Tor heavily and will have to pass recaptcha's test multiple times, and even after proving they were not a bot countless times.

[0] [https://privacypass.github.io/](https://privacypass.github.io/)

<comment><USER57> The problem with PrivacyPass is that it is a (not nearly as peer-reviewed as Tor) privacy-related cryptosystem that lets you bypass the reCAPTCHA _that CloudFlare put in your way in the first place_.

Using it with Tor is almost certainly not a good idea because it changes your own behavior from other Tor users thus compromising your anonymity (and the Tor folks are not in favour of PrivacyPass, because they think the solution is that CloudFlare shouldn't be putting the reCAPTCHA in the way in the first place). And that's assuming that the cryptography is actually solid and there is no way to distinguish between different PrivacyPass users. Tor has decades worth of research put into it -- what level of scrutiny does PrivacyPass have? How many people actually use it and how many have tried to break it?

<comment><USER21> I've said this before but:

> When 80% of traffic from an IP is malicious and the other 20% is regular > traffic, but both sources look like the same traffic (impersonating browser > headers, sometimes running headless chromium), what else can you do? Cookies > and stateful cookie-like objects, such as privacy pass.

</comment></comment></comment><comment><USER58> turn on comments on your blog without recaptcha, i dare you.

<comment><USER59> There are other techniques that do a reasonable job at stemming the flood. The "hidden field" technique still reduces spam by quite a lot.

<comment><USER60> I wrote about another technique at the end of my own captcha rant: [https://inimino.org/~inimino/blog/kill_captcha](https://inimino.org/~inimino/blog/kill_captcha)

The proposed solution would replace captcha entirely, but to my knowledge nobody has tried it.

<comment><USER61> How about different revocable secret keys to your mailbox given only to those who you wish to contact you

<comment><USER60> If people have to request to be able to contact you, it is not a public inbox anymore. This is the way most walled gardens work, you have a separate step before you can interact, so it works, but it lacks some of the affordances of the public inbox model of email or blog posts, such as allowing anonymity.

</comment></comment></comment></comment></comment><comment><USER62> It's quite the rant, meanwhile I don't quite remember the last time I did something where I had to solve a captcha that wasn't the "click once" one.

<comment><USER63> To offer a counter-experience, I don't remember the last time I actually HAD the "click once" captcha. It's always "click the buses/traffic lights/store fronts" etc.

<comment><USER64> Your experience will differ based on how much Google tracking you block. If you're not letting them surveil your every move, they're less convinced you're human by default (or perhaps spite).

<comment><USER65> I have a hard time assigning malice to the recaptcha more blocking = lower score because while it's a fun conspiratorial position it's also true that the more you block the less you look like the average user who doesn't. Also the less info they can pull from to determine how likely it is you're an actual person so of course people without a trail are going to be more suspicious.

</comment></comment></comment></comment><comment><USER66> What's the next best alternative to reCaptcha? this is something I will be in need of soon.

<comment><USER36> People on the other side of the world that solve captchas for $1 an hour. Sadly, I'm not kidding.

</comment></comment><comment><USER67> Companies use recpatcha in inappropriate ways. Especially on contact forms. Imagine you'd have to solve a captcha before sending every mail (or possibly be rejected completely).

Contact forms should just send an e-mail and let the e-mail's content based statistical filter deal with spam.

Blocking people from communicating with your company based on Google's whims is really not smart. It's giving too much power to Google.

</comment><comment><USER68> I got dragged into clickbait, read _15_ paragraphs of fluff till I actually got to the point of the article, and now I hate myself.

</comment><comment><USER69> Another technology that needs to be regulated and banned in many cases. Paying bills and handling finances online should be accessible to everyone. This prevents it from being so. It may already be a violation of the ADA. After all, how is a blind person supposed to pass? Impossible. For other websites, well they can do whatever. The internet is mostly a cesspool and anything that can't be visited with JavaScript turned off is not worth visiting. That includes "clever" spa blogs that could just be static sites and all types of other garbage. Maybe one in a thousand or one in a million sites other than finance, shopping, etc might be an exception to that but no website with recaptcha is. I wonder if we can sue Google for ada violations. I'm sure there are plenty of disabled people on the internet for q class action.

<comment><USER40> > After all, how is a blind person supposed to pass?

There's an audio captcha option.

<comment><USER70> I have a friend who is both blind and deaf: audio is also out. It is possible to use a braille terminal to access the web, so while I don't know if he uses the internet, it is possible.

Okay, he isn't really a friend, I only met him once. We have a friend in common who speaks sign language and was able to translate. Seeing him read sign language with his hand was interesting.

</comment></comment></comment><comment><USER71> What's the alternative to the recaptchas? Is the difference to just to use a different captcha service?

<comment><USER5> CAPTCHA is a divisive topic on HN, so you'll get a lot of people suggesting it's vital, and a lot saying it just isn't, depending on their own experiences.

"You probably don't need ReCAPTCHA" [0] is an article discussing techniques that has had decent discussion [1] on HN before.

[0] [https://kevv.net/you-probably-dont-need-recaptcha/](https://kevv.net/you- probably-dont-need-recaptcha/)

[1] [https://news.ycombinator.com/item?id=20158386](https://news.ycombinator.com/item?id=20158386)

</comment></comment><comment><USER72> There's plenty to write about this, but this is just a rambling rant that struggles to stay coherent

</comment><comment><USER73> This article seems to be confused about reCaptcha v2 vs. v3, as others have mentioned. That said, the broader point about the amount of time they take and the fact that Google is farming out labeling has some validity. It seems like the value to Google is high enough that they could easily remit some money or value to the people taking them.

There's an argument to be made that this would incentivize even more investment in bots that can pass them. My reply: Google should just create a bounty for anyone who successfully beats it worth more than the black hat value.

</comment><comment><USER74> I wish they mentioned [https://github.com/dessant/buster](https://github.com/dessant/buster) which I love using

</comment><comment><USER75> I joke about signs of the robot apocalypse eventually showing-up in reCAPTCHA:

"Click on the photos of humans with weapons."

Sometimes I feel like I'm only half-joking, though.

</comment><comment><USER76> life's too short to solve these things - i view it as the equivalent of a rude host at a restaurant (meaning I'll take my business elsewhere)

</comment><comment><USER77> I just tweeted a video of me doing nonsensical "Rotate the ball" puzzles to login to Hotels.com. I couldn't even tell what the pictures were! [https://twitter.com/AustinZHenley/status/1158430726888407040](https://twitter.com/AustinZHenley/status/1158430726888407040)

</comment><comment><USER6> The post talks about recaptcha v3 but shouldn't it be v2? Because correct me if I'm wrong, but as far as i remember recaptcha v3 does NOTHING with the user as far as i remember and only tells the admin what it thinks about the user and then he can spawn a normal recaptcha v2 if needed.

</comment><comment><USER78> Google moved puzzles from interviews onto random Internet users ;-) There must be some sophisticated internal metrics registering increase of puzzle takers somewhere, with a hidden goal of increasing general intelligence levels, adversarial-style. It's the only scientific explanation! :D

</comment><comment><USER79> I didn't realize how bad reCAPTCHA is until I started trying to protect my privacy.

The internet became practically unusable thanks to the constant, unsolvable CAPTCHAs. You can click the correct image tiles until your finger falls off but you still won't get through.

</comment><comment><USER80> I agree completely. I've just stopped using any website which asks me to do reCAPTCHA. In fact, I've got uBlock to block it from even loading. If you use reCAPTCHA for any reason then you don't deserve my business.

</comment><comment><USER81> One of my favorite takes on captchas is John Mulaney's SNL skit from the past year: [https://youtu.be/en5_JrcSTcU?t=337](https://youtu.be/en5_JrcSTcU?t=337)

</comment><comment><USER82> Recaptcha is now a rate limiting service for people not signed into their Google account. That's about all it does. The score on v3 falls through the floor if you block third-party Google cookies.

</comment><comment><USER83> I agree that reCAPTCHA (all versions) are terrible. (At least, sometimes it is possible to avoid the problems by selecting the audio CAPTCHA, which tends to work better as far as I can tell.)

Instead, use the protocol-independent CAPTCHA. It is a SASL mechanism, which sends a challenge with plain ASCII text (and may include line breaks), and then accepts a single response of plain ASCII text, and then the server decides whether or not the response is acceptable. The similar thing can also be done with a simple HTML form, but using SASL would then allow working with any protocols and work with command-line interface just as well as HTML interface, too.

</comment><comment><USER84> Didn't facebook try "Is this your friend Bob?" (showing you a picture of some random people) as their forgot password captcha, in the past?

Now that was evil!

<comment><USER85> In India it is common to set your profile pic as flowers and little girls for women, supercars and superbikes for men.

</comment></comment><comment><USER86> Not that I would do it, but couldn't someone create a bot to purposely give incorrect results and screw up Googles AI learning machine?

</comment><comment><USER87> I'm curious, what's the best option for protecting web forms if not using reCAPTCHA? Specifically for things like account sign ups?

<comment> _-___________-_ It depends what value there is in an account, but for a service I run, I just let the bots sign up accounts.

Accounts don't really cost me anything, and they get automatically deactivated if they didn't get any activity in the first 30 days anyway. Activity on my service costs money, so if someone wants to make a bot that pays me money, I have no problem with that.

The only time I'd consider implementing something like reCAPTCHA is if I was giving something away for free (e.g. a free trial) such that a signup actually had a cost for me.

<comment><USER87> I was more concerned about triggering activation emails to people

<comment> _-___________-_ If you collect email addresses, then yeah that's a concern. Then again, if you send a single activation email and never send another email unless the link is clicked, there's no value to the bot in signing up accounts, so it's unlikely to be a major problem.

</comment></comment></comment></comment><comment><USER88> If recaptcha is so good at finding bots, then why does google still show ads to bots?

</comment><comment><USER89> reCAPTCHA on a site forces me to use Google and quite a few sites now use it. There are other ways of detecting bots that aren't as intrusive nor require you to allow Google everywhere.

</comment><comment><USER90> Ug, can't stand reCAPTCHA. But seems like a necessary evil.

</comment><comment><USER91> the tone of this article is awful. it also has the history of recaptcha wrong.

I can't imagine it actually taking 30 seconds to solve a reCAPTCHA. That needs a citation.

<comment><USER92> In Firefox, log out of your google account, block cookies and enable the anti- fingerprinting features. Or just browse with Tor Browser.

You will start getting challenged more often, you'll find you're asked to solve several multi-select challenges in a row even if you get them right, the multi-select challenges will replace tiles after you select them, and the tiles will start fading in and out very slowly.

See [https://www.youtube.com/watch?v=en5KSZSpDFY](https://www.youtube.com/watch?v=en5KSZSpDFY) for an example video.

These are (AFAIK) intentional features deployed Google - you just don't see them if they can already track you via something like your Google account.

<comment><USER91> Ok I did as you suggested and then went to [https://www.google.com/recaptcha/api2/demo](https://www.google.com/recaptcha/api2/demo)

Took me all of 5 seconds to solve

<comment><USER57> Try using Tor and a real website that is using reCAPTCHA (I don't think they have their actual scoring system enabled on the demo). GP posted a link to a video of someone solving a single reCAPTCHA prompt for 2.5 _minutes_. I also regularly have to solve several CAPTCHAs in a row, often with increasing levels of image distortion.

Before being so brazenly dismissive of other people's experiences, take the few measly minutes it would take to actually try it out. Even doing a simple Google search with Tor Browser usually gives you a reCAPTCHA to solve.

<comment><USER91> > being so brazenly dismissive of other people's experiences, take the few > measly minutes it would take to actually try it out

?? I did try it exactly as was requested of me. I didn't know where to find a recaptcha so I went to the demo page.

It's possible the video is the result of a bug and not normal behaviour. I wouldn't know as I don't often browse with tor.

<comment><USER93> I've experienced that in the past, without using tor, but using Firefox. I go to great lengths to block anything Google. Google Fonts, Google CDNs (and I now use Decentraleyes so CDNs are mostly not even reached). I have to explicitly unblock reCAPTCHA scripts for it to even work - or use a clean and disposable browser profile. I've occasionally seen the behavior on the video when I really need to access the page (though usually I just complain to the webmaster).

I once had to request a new password for my online bank account. I ended up asking the bank manager to reset my password, pretending that reCAPTCHA is preventing me from resetting the password myself. My bank is not paying me for solving captchas for Google's benefit (this is so screwed up…).

The biggest offender is CloudFlare for me.

</comment></comment></comment></comment></comment></comment><comment><USER94> I prefer the newer captchas personally.

</comment><comment><USER95> Google sucks nowadays. So much of what it does just makes technology and the web worse, not better.

</comment><comment><USER96> tldr: Author claims reCAPTCHAs will get incrementally harder and force users to do strange things like turn on their webcams or open other devices to confirm their identity. Eventually people will pay Google to bypass the system.

All plausible...

</comment><comment><USER97> The current new captcha is invisible. It's no less evil since Google recommends to put it on all your pages...

<comment> andrewl-hn Well, it's only invisible if all pages / tabs you visit share the same cookie / session store. With browsers implementing more and more of privacy-focusing features this becomes less and less frequent.

If I use Safari private mode (each tab has its own cookie store) or Firefox with containers and cookie auto delete extension every tab I open, every page I visit gets a brand new Google session. Obviously, Google treats my like a bot.

</comment></comment><comment><USER98> Not true. Google has made a new capture system that only requires you to click a checkbox.

<comment><USER57> Try using Tor with one of those captchas -- you will get a whole load of puzzles and picture matching goodness (usually having to solve multiple in a row). It can easily take me several minutes to pass a reCAPTCHA challenge when using Tor. And even then, sometimes Google will even refuse to give you a challenge _at all_!

</comment></comment><comment><USER99> Hmm I don't know. It's been 10 years since I've been hearing that self driving cars are right around the horizon. And we now know we're nowhere close to it.

If this recaptcha helps google, or for that matter, any company, accelerate their self driving capability, I'd fully support it.

<comment><USER100> Billions of tax dollars and breaks are going to self-driving research, which is fucking insane. America needs to build back it's public rail infrastructure. Passenger rail is a solved problem, and the US use to have more passenger rail that Europe. We have one of the best freight rail systems in the world, but we have high speed rail in New England and Florida. That's it. Maybe California if they can get their shit together.

I wrote an article about this before, and talk about how even if you had a four lane high way with nothing but self driving cars, all filled and traveling at 120kph bumper to bumper, you wouldn't even come close to approaching 10% of the capacity of a single track metro light rail line running with 2 minute headway (during rush hour headways can be less than 2min, and with automated systems like those in Singapore and the new ones coming to London's underground--DLR is already automated--you can get headways of less than a minute or even 30 seconds)

[https://penguindreams.org/blog/self-driving-cars-will-not- so...](https://penguindreams.org/blog/self-driving-cars-will-not-solve-the- transportation-problem/)

Sure self driving cars could help in Europe with the last leg where they have real transport infrastructure, but the US is so far behind that successful self driving cars would just add to grid-lock.

<comment><USER101> This discussion has been well hashed before, but comes down to the US being very big. People are far more spread out here than anywhere in Europe or Asia. This also makes last-mile transport even more critical if you aren't close to the station. The distances also drive up the cost and waits between trains, further reducing ridership.

High-speed mid/long distance passenger rail just isn't viable given our population densities, and we already have metros/subways/light-rail in core metropolitan areas. Without major construction with hundreds of new lines and a shift in city planning, it's unlikely to ever change in the US.

<comment><USER100> That is the worst possible argument. Australia has a fraction of our population and every one of their capitals (except for Darwin and Hobart) has a very good rail system. Sure they don't have high speed, but they could easily saturate a Sydney to Melbourne high speed route (if Melbourne didn't waste a few billion on their ticketing system).

Russia has high speed rail and it's less dense than the United States. China created their high speed system in less than a decade.

This argument comes up all the time and it's so poor. The United States use to have more passenger rail than Europe does now! You build light city rail and immediately, new housing and commercial stuff pops up around it. It can potentially reduce drunk driving as well.

The US/density argument is really tired and just doesn't hold up when you really look at it.

<comment><USER101> We _do_ have passenger rail, it's not fast but you can travel the whole country. We also do have intra-city surface and underground lines.

The issue of why we don't have _more_ and _faster_ rail is a multifactorial problem of city size, zoning, spread, and alternate transportation. The US only has 3 major population centers, and they're very wide. The rest of the population lives in thousands of small and midsize cities spread far apart.

This is the worst combination for expensive railways and stations, and requires solid last-mile coverage. This means cars, and if you have cars then they already provide similar speeds, better coverage, more freedom, and lower costs. The only feasible plan is high-speed long-haul that doesn't stop anywhere in the middle, but demand for that is weak because people do live in the middle, and air-travel is faster and cheaper at those distances.

Lower population with a few big cities like Australia is a much better fit. If the US just had 3-5 major cities all along a single coastline then we would also have a similar railway network.</comment></comment></comment></comment></comment>


If you must drink Red Bull do not drink a full can or bottle - <AUTHOR> http://www.futurepundit.com/archives/007716.html <comment><USER3> People drink Redbull to avoid feeling tired, not because it will cause them this awesome skill to press a keyboard key when a green thing flashes on their monitor. Also, Squirt doesn't have the color nor the taste of Redbull. What's the use of this if the test subjects probably could identify which was Redbull and which wasn't?

<comment><USER4> You beat me to it. There are a ton of different energy drinks that taste the same to me as Red Bull but it in no way has a lemon flavor. I don't even think Sprite has that much of a lemon flavor. It has always tasted more like grapefruit. Most people who have had Red Bull would know that they weren't drinking it.

<comment><USER3> Exactly. Lots of energy drinks taste similar. Redbull and Ciclon taste pretty equal (you have to really be looking to actually notice the difference). I find it retarded that they're using Squirt as a replacement when they should be looking for a way to imitate Redbull's flavor to perform such experiment. Also, I think the candidates should be within a 10 year range, people in their 20's react very different from people in their forties to big amounts of sugar. In any case, my past employer used to pay for one or two sixpacks of Redbull for when I had to do 3 or 4 day marathons to achieve a deadline (I loved those because once I hit the bed I slept for 24 hours straight and the company gave me a few days to a week off and bonus for my efforts. The good times.

</comment></comment></comment><comment><USER5> For what it's worth, a can of Red Bull has 80mg of caffeine, while a double shot of espresso has 150 mg and a 12 oz drip coffee has more like 260mg.

<comment><USER6> Agreed. Red Bull is not "high caffeine." The active ingredient in Red Bull is taurine. The study was on caffeine but yet they didn't isolate the drug in question. The margin of error for this experiment is at least 1/√(80) or 11%.

This is science?

<comment><USER5> I'm sure there's lots of research out there on the effects of caffeine. A review of the literature on its short-term effects on tiredness, concentration and ability on various tasks would be pretty interesting, but a single result in isolation on some artificial test really isn't.

</comment></comment></comment><comment><USER7> It doesn't say if they controlled for existing caffeine tolerances. Take someone who never drinks energy drinks and give them a full can of Red Bull and they'll be so hyped up they'll likely miss on tests like the one in the study.

<comment><USER8> I can attest to that. Before my final high school exams (oral - this is quite serious in our country) I drank a can of red bull - the first of my life. I was so hyped that despite knowing everything I had trouble concentrating - <USER2> passed but without the red bull I'd undoubtedly have passed with better grades.

Coffee still affects me strongly even though I now drink a cup a day. I also get a strong come-down effect so the net result is about even. Others I know drink coffee all day long and don't have a come down effect either.

<comment><USER7> You actually touched on another issue with memory and information retention with respect to the current chemical state of your mind. If you study with caffeine then you need to also take the test with caffeine. Basically you want to come as close as possible to recreating your study environment for the test.

</comment></comment></comment><comment><USER9> Red Bull tastes nothing like Squirt.

</comment><comment><USER10> I drink Red Bull just for the taste. It has zero effect on me, so does coffee. I can drink a cup of coffee and a can of Red Bull and go to sleep. This is the problem if for some reason I must stay up when I am getting sleepy—I just don't know any means to stay alert.

<comment><USER11> You're drinking for taste and Red Bull is really your choice? At $2.79 a can? Let me introduce you to Dr. Pepper.

<comment><USER12> Cranberry juice, soda water, and simple syrup is even closer.

</comment></comment></comment><comment><USER13> Link to the actual release: [http://www.eurekalert.org/pub_releases/2010-12/apa- im120210....](http://www.eurekalert.org/pub_releases/2010-12/apa-im120210.php)

</comment><comment><USER14> I still don't get it. Why can't I drink a full can of Red Bull? The article doesn't say anything about drinking a full can versus a part of the contents.

<comment><USER15> True - important since there are other ingredients in Red Bull that could have factored into the result.

</comment></comment><comment><USER16> Often times just the feeling of being less tired and more stimulated is what is necessary, not actually being so

</comment><comment><USER17> completely misleading since it can take up to 45 minutes for body to absorb caffeine. so what's the point making tests merely after 30 minutes.

and by the way, it's proven that caffeine decreases reaction time, improves memory and focused thought.

<comment><USER5> "up to 45 minutes" presumably means that at least some of the caffeine is absorbed within 30 minutes?

It's actually weird; I have heard that 45 minute thing before, and yet the effect of drinking a cup of coffee _feels_ almost immediate.

<comment><USER18> It is immediate.

Your body is immediately flooded with a warm, familiar, acrid liquid, with a particular aroma. All of this is associated with the upcoming caffeine hit. There is also a certain amount of caffeine absorption from the mucous membranes of the mouth and throat, which goes straight to the bloodstream; it's not the full dose, but again, your body knows what's coming and can shift blood flow, glucose levels, and neurotransmitter balances to compensate.

<comment><USER19> That's why a year ago, when I was experimenting with the effects of caffeine on myself, I switched between regular coffee, decaff, and coffee with caffeine pills. And the acclimatization effects is why I used each for a full week before switching. It turns out that caffeine has no detectable effects on me at all; I already knew it didn't have much effect, that's why I used such an elaborate trial.

</comment></comment></comment></comment><comment><USER20> As far as I'm concerned, any amount of processed sugar should be avoided...

<comment><USER21> Sucrose is sucrose is sucrose.

No need to be a sugar racist man.

<comment><USER22> There's more to unprocessed food than sucrose. Unprocessed food is really quite dirty from a chemical point of view.

<comment><USER23> Dirty? That's a fairly loaded wording. How about varied or heterogeneous?

<comment><USER22> Does sound too guarded. But I did cave in and specified `from a chemical point of view' already.

</comment></comment></comment></comment></comment><comment><USER24> I would be interested in seeing a comparison between a reasonable amount of caffeine and a 15 minute nap.

For years now (High School, College, now work + grad school) a power nap followed by continued work has been a mainstay in my fight against the need to sleep regularly. (Although lately I've been trying for better time management... because I like sleeping regularly, and I suspect all-nighters are bad for the health).

I don't think caffeine has any benefit in terms of getting work done. It will make me 'feel' more alert, but it doesn't seem to improve my brain function at all. If I'm tired, my output is still just as bad as it was before the cup of coffee; I just will not fall asleep at the keyboard... (Akin to being a wide- awake drunk from mixing alcohol and caffeine). After the nap I might be able to pull off intelligent thought for a few more hours.

<comment><USER25> Be thankful. I've never been able to nap -power or otherwise. After an hour or so of lying there, I'm a bit more rested. If I try to sleep briefly at night, I wake up more tired than before. Alternatively, some well timed caffeine and some driving music makes a short stretch in the zone a lot more effective.

</comment></comment><comment><USER26> _"Must"_?

I'd rather go entirely without. It'll probably net-dehydrate you too, so even if you're given the choice in a desert between Red Bull and nothing, it'd be better to choose nothing.

<comment><USER27> Soda and caffeinated beverages won't dehydrate you. That's a misconception.

<comment><USER28> They just make you want to drink more because of the sugar.

The report (linked above) doesn't mention anything about the existing caffeine consumption habits of those in the experiment. I think that unless they controlled for that, it could possibly skew the experiment one way or another.

Also, one possibility regarding the lower reaction time in the high caffeine group is that they feel jumpier and attempt to compensate for the increased jitteriness by slowing down a bit. I know that this was suppose to be a blind test, but if they gave me this test... I could probably tell the difference.</comment></comment></comment>


Figuring out how to contribute to open source - <AUTHOR> https://jvns.ca/blog/2017/08/06/contributing-to-open-source/ <comment><USER2> The only part I disagree with is "close the PR if nobody replies". Open PRs without a clear blocker are important indicators of project health. If a PR stays open for a long time, it might mean that the maintainers have trouble reviewing outside contributions, or aren't that interested in incorporating them. If I see that in a project repo, I think twice about doing the work to contribute when it might end up ignored.

<comment><USER3> Had a quick look at the article and this immediately caught my eye. Leave the PR open! The maintainer might need a few more days to respond or might eventually reconsider. Also do not forget about other developers interested in the project. I've more than once merged PRs locally to profit from them before they were merged. Last but not least, open PRs are a good health indicator, I have to agree there.

</comment></comment><comment><USER4> Good post. For me what helped most is definitely to get into the habit of reading more code.

It is not something I did all the time previously. But coming in with a goal and then just reading code tends to help a lot, whereas I normally lean more on my coworkers when getting familiar with a new codebase (where do we do X?) simply getting into the habit of reading more code helped.

I think an important realization is that there is (hardly ever) a deadline. You can take your time to get as comfortable as you wish with the code before you start.

As a PS: I have seen this blog a few times, I gotta say I love the orange bars around the post.

</comment><comment><USER5> > But a lot of open source projects have a mailing list / Slack / gitter / IRC > channel for discussion. I haven't really figured this out yet because the > social norms are kind of unclear to me (there are often hundreds or > thousands of people in the Kubernetes Slack channels and I don't know almost > any of them), but it seems like something I should figure out.

Glad to know I'm not the only person who is intimidated by talking in a large open source chat room.

<comment><USER6> In my experience, usually the worst that will happen is that you'll get ignored. In that case, you can try making your question simpler or just go back and try and figure it out on your own (possibly coming back with another question later on). Usually, you're not really any worse off than if you don't ask at all.

<comment><USER7> I think people worry that they'll hit one of the rare but bad outlier responses. A good sign of project health are things like codes of conduct and other social cues that this isn't tolerated in that community.

<comment><USER5> I think the thing that really intimidates me is not seeing other people asking beginner level questions. If I see a channel for newbie questions or I see that people are asking newbie questions I feel welcome. If I can't easily see something like that I feel like I'm intruding in a chat for "real" contributors.

</comment></comment></comment></comment><comment><USER8> "code-reading is a muscle that maybe I don't always exercise as much as I could and so this was a good reminder of how far I can get without asking any questions at all"

Always read the code before asking is good advice for people starting out. Because when you are finished you'll have other questions.</comment>


The First Men on the Moon: The Apollo 11 Lunar Landing - <AUTHOR> http://www.firstmenonthemoon.com/?

<comment><AUTHOR> Reposted for the anniversary of the landing. The original thread is here: [https://news.ycombinator.com/item?id=5503225](https://news.ycombinator.com/item?id=5503225)</comment>


24 people arrested and charged with arson causing Australian wildfires - <AUTHOR> https://www.newsweek.com/australia-wildfires-arson-new-south-wales-police-1480733 <comment><USER2> Australian here. Reckon our local news source might have better context when dealing with NSW police: [https://www.smh.com.au/national/teenager- among-180-people-fa...](https://www.smh.com.au/national/teenager- among-180-people-facing-legal-action-over-lighting-fires-20200107-p53pla.html)

> This fire season, police have taken legal action - ranging from cautions to > charges - against 180 people including 24 people charged over deliberately > lit bushfires, 53 who allegedly failed to comply with a total fire ban and > 47 who allegedly discarded a lit cigarette or match.

These are all separate charges. The 47 people who discarded lit ciggies likely got cautioned or fined, the 24 who lit fires are going to end up in gaol.

There are currently 131 fires burning in NSW alone, according to the RFS[0]. Not all of them were caused by arson, many of them are caused by lightning strikes and other natural causes. The reason this year is so bad is because of the drought that has increased the amount of fuel and hampered our ability to backburn, and cuts to funding in firefighting services.

[0]: [https://www.rfs.nsw.gov.au/fire-information/fires-near- me](https://www.rfs.nsw.gov.au/fire-information/fires-near-me)

</comment><comment><USER3> The headline is misleading. In the actual article, these weren't people deliberately trying to create wildfires, just selfish people flouting the fire ban and having a campfire/bbq. Presumably, at least.

*Edit: [https://www.smh.com.au/national/teenager-among-180-people-fa...](https://www.smh.com.au/national/teenager-among-180-people-facing-legal-action-over-lighting-fires-20200107-p53pla.html) More details. There was deliberate arson (like a teenager setting fire to cars), but not intentionally aimed at burning down forests.

<comment><AUTHOR> From the article:

>Police in Australia have arrested and charged two dozen people they say deliberately lit blazes during the wildfire season that has so far killed at least 18 people, destroyed thousands of homes and ravaged over 10 million acres of land.

>New South Wales police said that since the beginning of November, 24 people have been charged over allegedly deliberately lighting fires as officers continue to investigate the role that arson has played in the devastation. Starting a wildfire can result in a jail sentence of up to 21 years.

<comment><USER3> "Deliberately lit blazes" definitely sounds intentional, but the rest of the details is so scant on details other than accidents that I have to presume stupidity over malice.

<comment><USER4> Is there a formal enough definition of 'blazes' that we can be sure it isn't talking about a blaze in a BBQ grill or something similar and instead is referring to an act of arson?

</comment></comment></comment></comment><comment><USER5> > New South Wales police said that since the beginning of November, 24 people > have been charged over allegedly deliberately lighting fires as officers > continue to investigate the role that arson has played in the devastation.

> Police in the state have also taken legal action against a further 159 > people. Among them are 53 people who allegedly failed to comply with a total > fire ban and 47 people who allegedly discarded a lit cigarette or match on > land.

So is the premise these people deliberately attempted to set wildfires ablaze or are they charging them with arson for ignoring a total fire ban?

<comment><USER6> I think this is also part of the disinformation campaign. AU's current administration has a lot bet on proving some other root cause and the not caused by ruling coal lobby.

<comment> t-writescode Exactly this. They have found the scapegoats and are now going to enact extreme and cruel destruction on them, likely beyond what can be considered 'justice' so the people feel good about what has happened.

</comment></comment></comment><comment><USER7> On a related note: Twitter bots and trolls promote conspiracy theories about Australian bushfires

[https://www.zdnet.com/article/twitter-bots-and-trolls- promot...](https://www.zdnet.com/article/twitter-bots-and-trolls-promote- conspiracy-theories-about-australian-bushfires/)

</comment><comment><USER8> Shouldn't this be removed for the misleading title ? This hints as if the fires were caused solely by arson which is not the case here.

</comment><comment><USER9> What's the idea there? Insurance fraud, just causing chaos?

<comment><USER10> I really hope it's just not an entire continent out for blood.

<comment><USER2> That's not really how it works in Australia. We're more focussed on (in order):

1\. Helping the people who lost everything 2\. Holding the country's leadership to account on why they refused to meet with fire experts before this season. 3\. Prosecuting arsonists under the laws we have

You'll note that their names weren't shared, and they will be dealt with in our legal system like any other offender, from underage drinkers all the way to Cardinals in the Catholic Church.

But people starting fires (intentionally or not) is not new in Australia, sadly. What is different this year is the conditions that caused the scale of the destruction, funding cuts to fire services and the prime minister refusing to meet with fire experts, who were trying to warn him that this was going to happen.

</comment></comment></comment><comment><USER11> It doesn't sound like terrorism (or even intentional arson) in this case, but I've always thought dry, windy, wildland-urban interface areas would be vulnerable to terrorist attacks. No smuggling of explosives etc needed, just a few guys in cars with some molotov cocktails.

(and now I'm on "a list"...)

</comment><comment><USER12> And no fines for the people that pumped CO2 into the atmosphere and warned the climate</comment>


Ask HN: What is preventing rust from replacing c/c++? - <AUTHOR> <comment><USER2> Basically I think it boils down to the fact that the c/cpp tooling is actually really sophisticated at this point and developers have already learned how to deal with the pain points of c/c++ so there is little incentive to change. Especially, since it means swapping out a highly advanced ecosystem i.e. UnrealEngine for the chance to spend the next 5 years building your own not- as-good system to then be able to start to program your own game. And its like this in every C/C++ industry I'm aware of (embedded devices / games / desktop apps).

I'm a rust fan, even more so of cargo (wish C/C++ had a cargo). But at the end of the day it almost always boils down to transition costs vs. benefits, and the benefits currently don't outweigh the transition costs IMHO.

<comment><USER3> I think you are correct in regards to the people who are currently using C/C++. They already have done the hard work to make it usable for their systems. But newer developers will look at the complexity of C/C++ development and choose anything but.

Maybe it is like politics, rather than attacking your opponents you should offer something that they do not. Then you will build your own constituency and gain influence. It will take a long time, but if you keep on providing benefits to users, then attrition might take you to the top. When someone attacks your camp, ignore them. You do not need a better way to attack them, you just need to stick to the knitting and make your offer provide benefits to users. External forces will likely decide whether or not you overwhelm your opponents.

<comment><USER4> The problem with this approach is that you would really have to offer something groundbreaking to displace C and C++ while also matching portability (only matched by Java variants) and performance (often unmatched).

The about only languages that could compete right now are extended Ada for high assurance environments and Fortran variants for HPC. They are old but not dead and quite usable if you have the dollars to buy proprietary or invest time.

Microcontrollers and constrained environments are another critical niche for C and C++, especially given proprietary compilers.

Rust does not go far enough in safety to displace Ada (or Spark variant) while not offering improved performance and comparable portability with all the pains of a new language. It also does not do build once deploy everywhere stuff Java and JS attempt. Rust is neither here nor there. A good effort but not a solution.

<comment><USER5> > _you would really have to offer something groundbreaking to displace C and > C++ while also matching portability_

If you offer something groundbreaking, you don't need to match portability. Many people will be willing to make the tradeoff.

> _Microcontrollers and constrained environments are another critical niche > for C and C++_

Why do you assume Rust can't be used for these niches? I understand the potential issues with old environments, but what about modern/future ones?

> _It also does not do build once deploy everywhere stuff Java and JS > attempt._

Rust compiles to JS today. It will eventually compile to WebAssembly.

<comment><USER6> (It compiles to WebAssembly today too)

<comment><USER4> Interesting, but is there any advantage there over more dedicated languages?

If not, then again, Rust has no clear selling point. It really has to be better at something. Matching is not good enough.

It definitely is not easier to use nor embed. (To compete with the likes of Python, Ruby or Clojure.)

<comment><USER5> > _easier to use nor embed_

"Easy" has no objective definition. Does it mean "getting code to run"? Or does it mean "writing bug-free code"?

For me, easy means the latter. It means that human error is harder to introduce into the code. A great language should not rely on the shaky pillars of discipline or expertise, because neither of those are easy to find or enforce, nor are they consistent. A disciplined expert might be too sleepy to write safe code, for example.

Rust is much easier to use than C and C++ because the compiler helps you so much and replaces discipline/expertise. That's the whole point. Rust prevents you from doing something you don't intend to do (or at least it does it better than most languages).

Python, Ruby, and Clojure don't have the same guarantees, and none of them can be used without garbage collection, making them unsuitable for a variety of cases where Rust can be used.

<comment><USER4> Compiler does not help you. It is not a proof suggestion system like Isabelle/HOL or the like.

In fact error messages rust produces rival the terrible nature of ones in older C++ compilers thus far.

The compiler only prevents you from making mistakes. Intentions do not even enter into it. See, some of the performance critical code in our apps has to work around even the lax C++11 rules. It is completely impossible in rust without using unsafe stuff liberally - specifically gets about 1000x slower and this matters a lot. Compilers know nothing about intentions, nor can a borrow checker enforce intentions unlike a type system.

<comment><USER7> > Compiler does not help you. It is not a proof suggestion system like > Isabelle/HOL or the like

This seems like a gratuitous misrepresentation. A compiler does not need a proof suggestion system to help you.

> In fact error messages rust produces rival the terrible nature of ones in > older C++ compilers thus far.

No, it doesn't. The error messages are wonderful and constantly improving.

> It is completely impossible in rust without using unsafe stuff liberally - > specifically gets about 1000x slower and this matters a lot.

Can you give specific concrete examples?

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> What's preventing the tree you planted from replacing the old tree next to it? Nothing really, ask again in 30 years.

Software is slow, your OS and browser have taken 20+ years of C/C++ development with top professional development teams to become the nearly tolerable products they are.

<comment><USER9> > What's preventing the tree you planted from replacing the old tree next to > it? Nothing really, ask again in 30 years.

That's... actually one of the best descriptions I've ever heard about these tradeoffs. :)

</comment></comment><comment><USER10> Rust will never take off until someone (or some group) uses it as the basis for a new, mind-blowing, must-have thingie.

For C it was Unix.

For JavaScript it was the web.

My guess for when something like that will happen with Rust? Never.

Unfortunately, verbose, anal-retentive languages like Rust are simply poorly- suited for writing new, mind-blowing, must-have thingies. On the scale of languages that support exploratory programming, I'd put Lisp at the top, JavaScript fairly near the top, C somewhere above the middle (though it was quite close to the top when it was new), and Rust somewhere down in the FORTRAN and COBOL region of the spectrum.

Note that this is completely orthogonal to type-safety, running speed, or any other traditional measure of programming language merit. The shoals of the language ocean are littered with the wreckage of "better" languages (the various Wirth languages, e.g.). What really matters is whether a programmer can sit down and casually explore a cool idea in a few minutes of spare time, and you can't do that in a language that requires half a page of code to concatenate two strings.

Swift has managed to roll type safety (more or less) into a language that's actually fun to use, or at least not actively painful. Rust hasn't.

<comment><USER11> Elixir brought a sane syntax to Erlang.

A Swift or Go inspired simple syntax could revive Rust.

<comment><USER4> Syntax is not even really a consideration. See how much people put up with in Perl and PHP world. PHP used to be language for web until displaced by JS.

<comment><USER11> That's your opinion. PHP, JS (nowadays to some extend also Go and Swift) are so successful, BECAUSE they have a simple and C-like syntax. Rust syntax is rather an afterthought, unfortunately.

</comment></comment></comment></comment><comment><USER12> Code already written in C/C++. I don't think there's anything stopping Rust from snowballing at this time. It's built some very strong libraries for certain problem domains, and because there's package management, it's possible to reuse it. This has already substantially reduced the friction of "systems" programming since you don't run into a challenging build process. But for the majority of folks the answer for an immediate need is still a tool or framework they already use.

</comment><comment><USER3> 1\. Rust is not C/C++ 2\. Lots of software is already written in C/C++ 3\. Rust follows the same convention as C/C++, that you integrate functionality by writing a library, compiling and linking it into a monolithic binary 4\. Systems that rely on a monolithic binary are NP hard to replace with something different 5\. Replacing a monolithic binary works best, in practice, when it is done by refactoring into services that are integrated by something other than a link editor. Although the buzz is all about web microservices, the reality is that message queuing to tie together microservice, macroservices and monolithic binaries, provides better performance more consistent with the linker/monolithic model. 6\. Go with its channels and packages may be a more advanced model, and is also competing with Rust. In other words, it is not just a question of comparing Rust to C/C++ 7\. The JVM with its JIT has in many cases equaled or exceeded the performance of C/C++ monoliths, but languages like Clojure and Scala take it well beyond mere Java. 8\. It may be that replacement of systems is driven more by economics than by technology. In other words it is not Rust that will determine the fate of Rust, but the economic sucess of companies using Rust for mission critical systems. In 20 to 30 years, the businesses that have succeeded will determine which technology is better.

<comment><USER4> Java Achilles foot has always been memory use and really compute constrained environments. Things like high end video game engines are not being written in Java, Closure or Scala for these very reason.

I would be very careful about JIT performance being even close. See, the language does not even expose SIMD well. Doing anything hard realtime (heck, even more complex UI) with a JVM in the way is a big pain.

</comment></comment><comment><USER13> Inertia. You don't rewrite an existing codebase unless the current one is simply not capable of doing what you need it to. And there are a lot of existing codebases in C and C++.

<comment><USER4> Even when you do rewrite, there has to be a clear benefit. Rust does not offer a clear one.

(No, reducing amount of bugs does not do anything when pitted against well tested mature software that already exists.)

<comment><USER14> Rust does much more than reducing bugs. It is able to reduce memory consumption, decrease the required amount of CPU cycles, and increase maintainability / adaptability. ADTs aren't a joke, and neither is Cargo, move semantics by default, and the borrow checker / borrowing and ownership mechanics as a whole. Shipping solutions in Rust can be done at record speeds, and integrate with existing software. Rust is wildly successful, and there's no way of stopping it.

</comment></comment></comment><comment><USER15> This question is both a leading and also ill-posed. What is preventing Rust from replacing C/C++ _where_? In existing applications? For new code development? In some particular application (e.g. game engines)?

There are lots of good answers in the comments here. I think Rust has a good story for why you might choose it over C/C++ for some uses today, but it's still early days. If Rust is going to take share from C/C++, it will do so over the period of decades, not years.

</comment><comment><USER16> Just one data point, but: I'm currently learning about embedded microcontrollers. The standard starting point for this is arduino, which is C/C++ based, so there is a strong pull towards C++ already. But I really wanted to avoid C/C++, and I spent a long time researching alternatives. Rust was one of the most mature for MCUs, but a) it's not very mature and b) you have to pick an MCU with a lot of flash memory as even the smallest rust binary is >100kb. For reference, one of the chips I've been testing out for this project has 127kb of flash. This evening I loaded on a medium-sized C++ project and it took just 24kb.

So that's what's preventing ME from using rust instead of C++

<comment><USER17> There's really no way to trim down the rust binaries??

<comment><USER6> There absolutely is; the smallest known Rust binary is 151 bytes.

<comment><USER4> How about a smallest real application that doors something useful? Say, basic networking on the level of static pages like uhttpd. (Used in many routers.) Or a busybox ash equivalent at least.

</comment></comment></comment></comment><comment><USER18> The chorus of Rust zealots who can't let a week pass by without writing yet another "Why won't you stupid plebeians stop using C++?" article.

That alone makes me want to crack open some STL code just to spite them, and I _hate_ C++!

</comment><comment><USER19> Why hasn't another language, like Ada with similar goals to Rust, replaced C/C++?

<comment><USER20> Its the operating systems libraries. They're in C.

I did a lot of ada programming (radar) and we had a fairly large library of wrappers to the C network/ ipc / process control that the operating system provided. It was a royal pain. So much so that at least a couple subsystems moved to C (mainly to use the math libraries......)

<comment><USER4> More modern styles of Ada work pretty well. The trouble is in getting the code to run in a restricted environments. MCU compiler authors tend to provide C only.

Perhaps a transpiler would be better.

</comment></comment></comment><comment><USER21> Changing languages isn't free. Rust isn't enough better than C++ for most developers (or their management) to switch.

Or, if you're more of the skeptical sort, Rust doesn't _seem to be_ enough better. You could argue that C++ developers don't think they write code that creates memory issues very often. So they underestimate the benefits. (And the borrow checker is a different concept, so they may also overestimate the costs of switching.)

The net result, though, is that they perceive the benefits to not be worth the costs.

<comment><USER22> Perhaps they estimate the benefits correctly. In that case, they may never switch.

<comment><USER4> More modern styles of C++ just wholesale avoid most problems that are solved by the borrow checker. Smart and owning pointers, dynamic and checked data structures thanks to operator overloading. There are remaining warts but not bad enough in practice.

<comment><USER23> That's not really all that relevant for most existing commercial code since legacy code tends to not get rewritten at all unless it's absolutely necessary, and thus remains stuck with the Old Ways.

<comment><USER4> Indeed, but unlike a rewrite, you can refactor staying in the same language at your leisure, piece-wise.

Plus the argument was mostly pertaining to new code.

</comment></comment></comment></comment></comment><comment><USER24> For me, equivalent support for the MSVC toolchain on Windows. Obviously it won't ever be 100% without support from Microsoft, and a lot of work has been done, but some items on [https://github.com/rust- lang/rfcs/issues/1061](https://github.com/rust-lang/rfcs/issues/1061) feel important enough to give me pause before spending much time with Rust.

<comment><USER6> I use it daily, and it works well. I'm still a newbie Windows person so I probably don't notice these pain points...

</comment></comment><comment><USER25> Another reason that I don't see given its fair chance might be politics. The human race has a wide variety of values that are often counteracting. Forcing a specific set of values participants must adhere to in order to interact with the community will undoubtedly alienate adopters.

That's why most projects, companies, and even governments tend to strip down the rules that govern them to what is necessary for them to function (e.g. separation of religion from state for governments).

The common reason given by the rust community to justify their behavior is that technology does not exist in a vacuum, and that technology can not be separated from politics. I completely agree. However, politics should be tackled on a layer incompletely independent from technology. Mixing the two only causes instability and uncertainty for rust. Here are two risks that arise from this mixing. I'm sure there are many, far more serious, risks besides these two:

\- What happens when (not if) a significant shift in values occurs in the community? Will it collapse?

\- What about technical or legal changes to the project that were driven by community values rather than technical or legal merits? This is not far fetched when technology and politics are made inseparable in the way it was done in Rust.

I use rust in a professional context, and I appreciate what it brings in terms of technical benefits. but I would be lying if a said this aspect of it didn't worry me. I can not recommend its adoption to colleagues from other companies if asked for this very reason (I was asked once so far).

Community instability or the mere perception of such is a big barrier to adoption, at least for companies.

<comment><USER14> Using a programming language does not force you to join a community; and what is the Rust community, anyway? Which Rust community? The Code of Conduct pertains to the official venues of communication, not the language itself. All communities have rules. And the rules are quite normal of any community that wants something resembling civility.

</comment></comment><comment><USER26> Why would it?

As a C++ developer, I think Rust's main selling point (memory safety) isn't as big of a problem as it's made out to be. For every unsafe memory access that results in a crash or exploit, there are millions and millions of memory accesses that work just fine and never cause a problem. Tools like Coverity and Valgrind can catch a ton of errors, and its not clear Rust offers any significant advantages over C++ with Coverity.

Parallelism is nice, too, but C++ already has a ton of options there: OpenMP, MPI, TBB, OpenCL, standard library threads, boost/standard library async tools, etc.

On the other hand, as an end user, "written in Rust" or "written in <any language>" isn't something I care about. I don't even remember the last time I had a piece of software crash due to a seg fault, so a vague promise of being "safer" isn't good enough to accept an otherwise inferior product.

I guess to summarize, C and C++ developers are going to keep writing C and C++ and if Rust is going to take over the world, the people advocating for it will have to write better software in it and beat out software written in the other languages.

<comment><USER27> Coverity is expensive and majority of software people use are open-source which don't make use of it(hence all the CVEs).

As an end user running a server, i __very __much care about whether my web server has vulnerabilities. And the promise about safety is not vague, it has clearly defined semantics.

To comment on your last point, it's seeing some light already, ripgrep is already beating grep in performance and is purely written in rust. And i agree that this is how rust will beat C++(if ever), by writing "better" tools than those already exist.

<comment><USER26> > Coverity is expensive and majority of software people use are open-source > which don't make use of it(hence all the CVEs).

It's definitely an area where the closed source tools are ahead of the OSS alternatives, but there are open source (and free closed source) alternatives to Coverity. PVS Studio, for example, has a free download: [https://www.viva64.com/en/pvs-studio/](https://www.viva64.com/en/pvs-studio/)

> As an end user running a server, i very much care about whether my web > server has vulnerabilities. And the promise about safety is not vague, it > has clearly defined semantics.

You say that, yet you're still running a ton of software written in C and C++.

<comment><USER14> > You say that, yet you're still running a ton of software written in C and > C++.

Nice assumption. Much of the software I use is actually implemented in Rust. And soon, I'll be using an operating system that's 100% written in Rust, with a 100% Rust Servo-powered web browser. It's only a matter of time.

In addition, I've also implemented my servers (web server included) in Rust, and they have zero dependencies upon C/C++ software, so your entire point is rendered invalid.

</comment></comment></comment></comment><comment><USER28> People to write code instead of sitting on their high horse. That and performance as good as c, not c-like, not selective benchmarks, not other nonsense.

</comment><comment><USER29> Greenfield systems work by startups isn't really done these days. If it's not greenfield, it's probably already in c/c++. If it's not a startup, they probably already have a bunch of expensive c/c++ tooling (static analyzers, IDEs, CI systems, ...) that they aren't going to get in rust.

<comment><USER14> Rust has made major strides in the cryptocurrency industry. Cryptocurrencies are largely becoming powered by Rust, because with cryptocurrencies, there is no room for error.

</comment></comment><comment><USER30> I would've started using Rust way sooner if academia hadn't forced me to use c++ or c for anything systems related. Upon graduation I felt like a kid in a candy store with all the languages and platforms I hadn't tried in my four years of fun.

</comment><comment><USER31> Partly time, but also it's much more difficult to get "something that works" in Rust than it is in C++ due to the borrow checker.

Of course your C++ code will probably not be as safe as your Rust code, but many people don't care about that.

<comment><USER4> It probably will be just about as safe. The benefits of the borrow checker only become apparent when you're doing complex things. C++ allows you to write bad code easily though, though the most obvious modern way is safe typically.

At least until multiple threads or processes happen or you have hard realtime requirements.

</comment></comment><comment><USER32> I guess that, if you can dislodge C in the embedded space, everything else will follow.

So my question is: when can I use Rust on the Cortex M0 (or on a 32 bits RISC-V), with an interactive debugger, preferentially from a simple IDE?

<comment><USER6> Cortex M works today, but since I'm not in the space I can't comment on debuggers or IDEs.

<comment><USER4> Rust produces quite fat code even without safeties on and when using a tiny libc...

If you have megabytes of flash to spare, it could probably be fine...

<comment><USER6> > even without safeties on

Most of Rust's "safeties" are only compile-time, and so have no effect on binary size.

<comment><USER4> Many of them cost nothing over base rust tax, but that is not the issue.

</comment></comment></comment></comment></comment><comment><USER33> Over 30 years of momentum.

</comment><comment><USER34> It doesn't need to replace it (it's not like c++ is being deprecated), and there has to be real reasons to port over existing code, because there are real costs.

The technically best format doesn't always win. Just look at Betamax vs VHS.

</comment><comment><USER35> If it happens, it will take some time. Java has been replacing C++ for many years now...

<comment><USER36> A big difference is that Rust has a zero overhead interop with C, so it it allows mixed projects or gradual porting.

So Scala or Kotlin replacing Java, or F# replacing C# may be a better analogy. What happens there, is that Java and C# are improving just enough that many people are simply not considering the change... And C++ are trying really hard nowadays too - new version with interesting features every few years etc...

(By the way - I'm a Rust fan, and also a functional programming fan, so I would be happy if C++, C#, Java would slow down a little to let the alternatives really catch up popularity;)

<comment><USER35> I am actually on your side on this one. But the changeover, I think you will agree, will be somewhat slow. So no one should judge Rust too harshly, for not replacing C++ in the Unreal Engine, Microsoft Office Suite, &al. even in the next 5 years.

</comment></comment></comment><comment><USER37> Binary compatibility. As a developer I want to be able to:

1\. Write an app in rust.

2\. Use a rust library in that app, via the native rust interface (using c interfaces negates a lot of the pros of rust).

3\. Dynamically link that app to the distro repository version.

4\. Have the distro apply security updates to that library without recompiling my app.

5\. Ignore cargo completely.

As a user I want to:

1\. Not download and install multiple copies of common rust libraries (as is the cargo norm).

2\. Not be in doubt whether a particular application is using the latest patched libraries.

It seems that rust community has learned from the mistakes of c, c++, and java. But they failed to learn the successes as well.

<comment><USER23> While your use cases are definitely valid for you, this is not a Rust issue, but something that's 100% decided by your distro. They decide if, when and how they integrate Rust into it.

As for the multiple copies issue with Cargo: I generally agree with you that this definitely feels like 1 source of major blow up in project compile times, and it would be nice and useful if that were reduced as much as possible. But there is a reason that this system is in place: each crate defines how it compiles and consumes its dependency crates, so if crates A and B both depend on crate C, then A might compile and consume C differently than B does. This results in effectively different libraries once compiled, and ATM there is no way to predict in advance what the effect of any given compile flag will be since any flag can switch on/off arbitrary code. Hence Cargo keeps A's C dependency separate from B's.

Then there's the not doubting whether an application uses the latest patches. Up to a point, this can be automated through exploitation of SemVer: if Cargo could figure out that a new library version is API and ABI compatible with the previous version then I'd argue that Cargo should perhaps just auto-update it. A bigger issue is what happens when a new major version of the library is released, as those tend to break APIs in order to perform maintenance. That is something that as of yet has not been automated.

<comment><USER37> > While your use cases are definitely valid for you, this is not a Rust issue, > but something that's 100% decided by your distro. They decide if, when and > how they integrate Rust into it.

It's a rust issue because it's up to the rust compiler to generate ABI compatible binaries, at the moment there is no ABI so there isn't much distros can do. It seems they have no intention of adding one any time soon: [https://github.com/rust-lang/rfcs/issues/600](https://github.com/rust- lang/rfcs/issues/600)

This is why system libraries are nearly always in c and not c++. The ones that aren't (Qt) have a long history of broken language bindings.

<comment><USER23> This is not as much as a problem as you believe. Rust is perfectly capable of making objects that have a C API and ABI precisely for this reason, and the most popular distros only work with supported compile targets anyway. That said, a distro like Debian might indeed encounter some issues at this time for the less prominent platforms eg MIPS or PowerPC based chips. That shouldn't prevent Debian from including Rust altogether though, they merely should exclude it on those less or even unsupported platforms.

</comment></comment></comment></comment><comment><USER38> Also some people just do not like coding in rust and that combined with the fact that its new means they refuse to switch.

</comment><comment><USER39> Time.</comment>


Is Hacker News Filtering News Related to an Asian Country? - <AUTHOR> This is just an innocent inquiry. I posted about an Official App in China that has full spying / backdoor capabilities and I can't fine the post related to it. <comment><USER2> From the FAQ ([https://news.ycombinator.com/newsfaq.html](https://news.ycombinator.com/newsfaq.html)):

> _" How are stories ranked?"_

> _" The basic algorithm divides points by a power of the time since a story > was submitted. Comments in threads are ranked the same way."_

> _" Other factors affecting rank include user flags, anti-abuse software, > software which demotes overheated discussions, and moderator intervention."_

As you're new, you might find the guidelines informative as well.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment><comment><USER3> You can ask the moderators using the |contact| link at the bottom of the page. They tend to be helpful, responsive and patient.

</comment><comment><AUTHOR> I'm new and probably violated a rule here.

<comment><USER4> it's there: [https://news.ycombinator.com/submitted?id=thiefmeister](https://news.ycombinator.com/submitted?id=thiefmeister)</comment></comment>


Why elephants rarely get cancer - <AUTHOR> http://www.csmonitor.com/Science/2015/1009/Why-elephants-rarely-get-cancer <comment><USER2> Makes me wonder if you could shove p53 into a viral transposon and give us thousands of copies...

<comment><USER3> Yea, wouldn't that be great.</comment></comment>


Adobe is developing software to let home users create movie-quality 3-D graphics - <AUTHOR> http://www.technologyreview.com/printer_friendly_article.aspx?id=19344

<comment><USER2> This article was posted a day ago:

<http://news.ycombinator.com/item?id=51081>

and only got 2 upvotes. Maybe a time of day difference? Maybe a better headline?

</comment><comment><USER3> I'd be excited to see graphics cards with multi core processors that can do this...

</comment><comment><USER4> the math behind this stuff is very interesting...too expensive right now though. Raster will be here for the foreseeable future :(</comment>


Elon Musk Is Working Too Hard - <AUTHOR> https://www.bloomberg.com/view/articles/2018-08-17/elon-musk-is-working-too-hard <comment><USER2> Poor Elon. Shall we start a GoFundMe campaign for him? I mean nothing is sadder than seeing a billionaire going broke. Not even drowning puppies.

See also:

"Tesla factory workers reveal pain, injury and stress: 'Everything feels like the future but us'"

[https://www.theguardian.com/technology/2017/may/18/tesla- wor...](https://www.theguardian.com/technology/2017/may/18/tesla-workers- factory-conditions-elon-musk)

<comment><USER3> You're being sarcastic, but: [https://techcrunch.com/2018/04/17/the-internet- just-crowdfun...](https://techcrunch.com/2018/04/17/the-internet-just- crowdfunded-billionaire-elon-musk-a-new-couch/)

</comment></comment><comment><USER4> Musk obviously needs a vacation to get some physical rest as well as recover some mental perspective. It would be a win for him and his endeavors if someone in his circle could convince him of that.

I've seen too many instances where that kind of self-exhaustion crosses a threshold and bad decisions start getting made.</comment>