Ask HN: Liability due to lack of SSL - <AUTHOR> I have family member who sells stuff online. As part of his checkout experience he asks for CC info as well as SSN info on a HTTP website. I am trying to explain to him why this is bad, but he doesn't really care. What can I say to him factually that might help him make the investment in SSL (and not storing PII in SQL db) for that matter. <comment><USER2> I would focus his attention on the possibility that his card processor will cut him off for violations of their agreement. This would result in large- scale loss of business and it may not be easy to arrange for a new processor on short notice. Keep his eyes on the money.

I would not bother with a technical explanation of any of this stuff. He doesn't care, and bluntly it's not particularly easy to point to major compromises in which the lack of SSL played a key role. Most of the time, data is siphoned out of "PCI-compliant" shops that do use SSL, and they get it through database compromises and/or compromised POS terminals. MITM doesn't seem to be worth the effort, if only because the other stuff is so easy and yields so much data.

Nor would I bother talking about PCI. Most of their requirements are silly and do little or nothing to prevent exposure of PII or fraud. What matters to him is the agreement with his processor, not some 4000-page document that wants to tell you how to take a piss.

Eyes on the money. No processor, no business, no money. Keep it simple. If that doesn't do it, you've done your part and should walk away. It's not your problem.

</comment><comment><USER3> Unless he is a government, insurance, credit card, bank, real estate organization he should not be asking for a SSN online or storing it unless they are for his employees or the transactions being conducted requires notification to the IRS or the transaction is subject to the customer identification program rules. Either way PII like this should be securely stored offline.

For Credit Card information it has to all be transmitted and stored in an securely in accordance to the credit card merchant agreement he has agreed too.

The HTTP protocol is not secure, when your family member is hacked or audited they may be liable for many civil and criminal charges.

Have them read all the information for PCI DSS compliance - [https://www.pcisecuritystandards.org/merchants/](https://www.pcisecuritystandards.org/merchants/)

You have done your part by advising him about the risks, privacy concerns and how bad it really is. Either way it is ultimately a risk he is accepting for himself and the business which he will have to deal with the consequences when something bad occurs in the future.

If he needs proof of how bad the decisions he has made can be, point him to many of the recent credit card and government organization breaches.

<comment><AUTHOR> I should clarify that it is for Real Estate, thus the SSN. That link might be helpful.

</comment></comment><comment><USER4> I'd say an even bigger question is, why is he even doing it that way at all, and not using a service like Stripe, Braintree, Shopify or similar? They've invested in polished checkout experiences, it's what they do, and it moves the burden of PCI compliance, PII storage, SSL etc to the service. When Stripe exists, why would you even go down the merchant account route anymore?

Scaring them with the bad stuff might not be effective, people don't react well to being told they're doing everything wrong. Perhaps showing them an easier solution that reduces their admin hassles & could potentially increase their sales is a better way to approach this.

<comment><USER5> Both Stripe and Braintree require you to use SSL (really TLS) on your checkout pages. They also both require you maintain PCI compliance (although you likely qualify for a reduce set of requirements).

<comment><USER6> They 'require' it, but it is still possible to use the service without SSL. At least it was possible on stripe a few months ago. I'm not sure if they end up cutting you off after they notice the non ssl traffic, but I setup some test apps that worked fine without ssl.

</comment></comment></comment><comment><USER7> Beside the point, but why in the world is he collecting SSN numbers? That in itself is more concerning to me than not having SSL. But that's just me. I have had my identity stolen and know first hand how difficult, to almost impossible, it is to clean up.

With that said, I do know that many states have strict laws regarding the collection/use of SSN numbers via websites and/or for the sale of goods.

As for the credit card info, I believe most processors have in their terms that SSL is required for live transactions. I was also going to point to PCI compliance, but I am not sure how aggressive they are at going after the "little guy". Although with credit card theft in the US being a hot topic right now, I am sure anyone that is non-compliant will be a target for violations.

EDIT: To add link, starting at Page 12 talks about various state laws regarding SSN collection: [http://www.gao.gov/new.items/d051016t.pdf](http://www.gao.gov/new.items/d051016t.pdf)

<comment><USER8> Can someone explain how identity theft is even possible in the US? I hear a lot about it, but I can't understand how broken a system must be that makes it possible for someone to steal your identity just by having one identifier.

<comment><USER9> Hypothetical situation: what do you do if you lose all of your ID (e.g. house fire)? You have to start somewhere, and your SSN is a good choice.

You can't do it solely based on one single number, but in this case a data breach would include name, address, credit card number, SSN, and probably security questions. You can turn around and use that information to play the part of a person to another organization, and then go from there. Combine that data with social engineering, and you can get a lot of information about someone and then use it in further attacks.

That's not to say the US's system isn't broken; lots of companies ask for (and require!) the SSN even though they shouldn't. The problem is that it's not just one identifier that holds the key to your life, but that the SSN is an _extremely strong identifier_ which is _assumed to be secret_.

<comment><USER10> Well, sure, but the government's information on you will also include... parents, other family, a photograph of your face, and so on.

It should never be possible to do what you're suggesting, not unless the USA is failing to collect that info in the first place.

<comment><USER11> stolen identity doesn't usually mean that someone has convinced a government office that they are you, that would be a lot harder for the reasons you say. It's more often someone having enough information to open a credit card in your name and start using it, or take out a loan—things for which the government is not really involved.

</comment></comment></comment></comment></comment><comment><USER12> The first thing I'd think of with a site asking for SSN is an active intent to commit fraud: ID theft, or fraud. That's before SSL (which is obsolete anyway, only TLS should be considered now).

The second thing, the fact it's http and not https suggests he's collecting and storing this information, which is almost certainly a violation of his credit card agreement with his bank. Credit card information is not supposed to be stored, he passes that off through a secure connection with his processing service, who will only do that through a secure connection, and he gets a transaction ID and authorization and that's all he references from that point on.

So this is less about SSL/TLS as it is, he's doing it all wrong. And it's depressing that he's in business, only made possible by the ignorance of his customers who actually agree to give him all of this information, and on an insecure connection no less.

</comment><comment><USER13> If a storefront on the web asked me for an SSN, HTTPS or HTTP, I'd probably file a police report for the attempted identity theft. There's literally no other plausible reason to collect that information, unless he/she is a registered financial institution extending credit to people.

</comment><comment><USER14> There is also the case for a potential increase in his conversion rates as a result of adding SSL.

Online shoppers I've observed in usability sessions often scour sites looking for evidence of security measures (e.g., green EV certs in the browser, various icons in the footer). This is especially true when you're asking for something like SSN info...

If appealing to the desire for security of user info doesn't work (unfortunately), appeal to his desire for more customers...

</comment><comment><USER15> [https://www.ftc.gov/tips-advice/business- center/guidance/sta...](https://www.ftc.gov/tips-advice/business- center/guidance/start-security-guide-business)

Read section 4 specifically.

</comment><comment><USER16> >I am trying to explain to him why this is bad, but he doesn't really care.

"You are losing sales. People look for the lock icon on the address bar."

Also, he can get SSL on his site for FREE in < 5 minutes using Cloudflare.

<comment><USER17> Cloudflare may be a good option for him. But, the quick and free Cloudflare SSL would still be non-SSL from Cloudflare to his site – an improvement against many home/public-Wifi threats but not a total fix (nor true compliance with credit-card agreements).

Also, for a totally non-technical person, it will take – and be billed as – more than 5 minutes of someone else's time to get even that free half-measure into effect.

<comment><USER16> Good points.

That raises an interesting question: how could a person determine if the connection between an edge (say, Cloudflare) and the destination server is actually encrypted? I can't think of a way to do this unless you know the address of the true IP of the destination and poke it on the SSL port. That still doesn't guarantee SSL is being used, though.

<comment><USER17> In general there's no way to know: you have to trust the destination's internal choices, once you've reached their chosen perimeter.

In my opinion best practice would be to obscure what the "true IP" of the backend server is, _and_ only accept connections from Cloudflare. (I don't know if Cloudflare offers any options for this stronger than trusting their IP ranges, such as a client certificate on their outbound-SSL.) So if you _could_ "poke [the true origin] on the SSL port", that could itself be evidence of suboptimal security.

<comment><USER16> >obscure what the "true IP" of the backend server is, and only accept connections from Cloudflare

This is what I was planning to do when I launch the app I'm working on now. Thanks for the reply.

</comment></comment></comment></comment></comment><comment><AUTHOR> So I dived in a bit more while I wait for him to call me back. It's a Magento build using Autorize.net I haven't worked with Magento in years, but should be really simple right. Set up some forwarding rules in Cloudflare to always to go the HTTPS and of course the cert.

At least it isn't some guys backyard CMS.

<comment><USER18> _Set up some forwarding rules in Cloudflare to always to go the HTTPS and of course the cert._

Please do not do that. That doesn't solve the problem at all if the origin server is still serving the content over HTTP. You're just lying to visitors by making them think it's secure when it's really not.

Magento is like any other PHP app.. there's Apache (or some other webserver) in front of it.. so just setup Apache properly.

</comment></comment><comment><USER19> [http://www.pcistandard.com/card-association- fines/](http://www.pcistandard.com/card-association-fines/) might be a starting point? (I don't know if it actually applies in this case though).

</comment><comment><USER20> Seriously? Do cc vendors allow any random home hacker to create collection forms for credit cards. If I were visa I would at minimum have a checklist that must be fulfilled otherwise the store get their license withdrawn.</comment>


Why I'm leaving Facebook for good this time - <AUTHOR> http://bwsewell.github.com/2012/07/31/why_im_leaving_facebook_for_good_this_time.html

<comment><USER2> Facebook is not for everyone. Quit it if you don't like it. You've quit 6 times already? Why do you keep coming back if it's so awful?

But at least admit that all of the things on your list are not really real excuses. So many birthday wishes is such a problem? Hide your birthday. People tagging you as animals? What kind of friends are those - unfriend them. Or turn off the ability for people to tag you. Twitter is so much better, with no privacy and getting spammed every time you mention the word iPhone?</comment>


Ask HN: Will countries matter more or less in the future? - <AUTHOR> With globalization, and wealthy people's financial, and therefore political interests, spanning multiple countries, will countries as coherent political entities matter more or less? <comment><USER2> How far in the future? Matter to what?</comment>


A post from Virgin America's inaugural GoGo WiFi flight - <AUTHOR> http://www.engadget.com/2008/11/22/on-virgin-americas-inaugural-gogo-wifi-flight-this-post-publis/ <comment><USER2> Say it ain't so!

I love the fact that I can force myself to disconnect on flights...</comment>


About Gatekeeper - <AUTHOR> http://www.panic.com/blog/2012/02/about-gatekeeper/# <comment><USER2> _If my app were to do something nefarious, my developer ID would get revoked and that would be the end of that._

Sure, but this strikes me as naïve. It can take less than being nefarious to get booted off of a service (like having an Apple developer ID) like having a corporation or government agency filing a potentially unfounded complaint against you (as we've seen with YouTube videos and, this very week, Jotform's Web site.)

The problem _I_ have with Gatekeeper isn't in the pleasant, straightforward scenario Apple wraps into its copy. The problem is giving a corporation direct control over whose apps can and cannot work on a computer by _default_ is a set up for some depressing abuse stories that can only be rectified by turning off security or performing UI acrobatics.

<comment><USER3> The problem with your comparison is that the stakeholders of SOPA/PIPA are people who want to screw you. They don't care about your experience they want to make the most possible money off you.

I'd argue that to Apple the consumers are their stakeholders. They want to do everything in their power to make the user's experience better.

If we see Apple pulling apps of honest hard working people then I'll eat crow but in the five years of the iOS App Store how many horror stories do we have (if any)?

I will continue to give Apple the benefit of the doubt until they do something to make me question. So far I've never been inconvienced and only had a better computing experience since I got my Mac and my iPhone. That is why I, and many other people, will continue to use their products.

<comment><USER2> There are stories. Some of the recent ones:

[http://www.appleinsider.com/articles/12/01/03/ataris_legal_t...](http://www.appleinsider.com/articles/12/01/03/ataris_legal_threats_prompt_apple_to_pull_some_games_from_ios_app_store.html) <http://mashable.com/2011/12/12/apple-pulls-app/> [http://www.iphonehacks.com/2012/01/process-killer-app- that-a...](http://www.iphonehacks.com/2012/01/process-killer-app-that-allowed- users-to-close-all-apps-running-in-the-background-was-briefly-available-in- the-app-store.html) [http://www.neoos.ch/blog/30-quickpick-pulled-from-app- store-...](http://www.neoos.ch/blog/30-quickpick-pulled-from-app-store-our- statement) [http://lifehacker.com/5614752/grooveshark-iphone-app- pulled-...](http://lifehacker.com/5614752/grooveshark-iphone-app-pulled-from- app-store) [http://www.joystiq.com/2011/12/28/imame-app-pulled-from- ios-...](http://www.joystiq.com/2011/12/28/imame-app-pulled-from-ios-app- store-after-a-few-short-days-of-fr/) <http://techcrunch.com/2011/12/01/match- com-app-store/>

Most (but not all) orient around violations of Apple's developer TOS which are famously fickle and changeable. No emulators? Can't use "private APIs"? Microsoft was hauled in front of the DOJ for better. Could those using an Apple account to sign their non App Store apps be subject to similar, shifting rules about what's kosher and what's not?

And if Atari has _really_ had apps pulled for supposedly bearing a "passing resemblance to an Atari classic", we're in weird territory. From my POV, there's just a creepy potential for blacklist first, ask questions later style arbitration on Apple's part.

As a once Apple fanboy who's still surrounded by Apple gear, this all seems a bit weird to say, but as a developer I'm not keen on this move at all.

<comment><USER4>
      > Can't use "private APIs"? Microsoft was hauled in front
      > of the DOJ for better.

Utter bullshit.

<comment><USER5> [http://www.crn.com/news/channel- programs/18821233/microsoft-...](http://www.crn.com/news/channel- programs/18821233/microsoft-to-publish-385-windows-apis-protocols-to-make- antitrust-case-go-away.htm)

</comment></comment></comment></comment></comment><comment><USER6> While I can't say much bad about Gatekeeper (yet), I can't help but feel this article is a bit scare-mongery (" As Macs enjoy increased popularity, they become a more attractive target to identity thieves and other criminals. Sooner or later, bad people ruin every nice thing. It's an immutable law of humanity.") And I think the author takes a scary turn, in that he grows used to the loving walls of the closed garden. Just the quote("You can let anything run on your system, whether or not it is signed. This is the Mac OS of today. It's like having a jailbroken iPhone.") makes it feel like a walled garden of ios is the norm, not a computer where you have full root access, and undoubtedly, that kind of sentence has the average computer user thinking "omg!, you mean my computer is out in the wild, just like a jailbroken phone, that sounds dangerous!". If this starts to become the prevailing viewpoint, it's lights out, free and open world.

[Edit]: Obligatory Ben Franklin quote: "They who can give up essential liberty to obtain a little temporary safety, deserve neither liberty nor safety."

<comment><USER7> This feature isn't for us. Playing Captain Hindsight and telling a regular user "you shouldn't have opened that suspicious attachment" doesn't get their data back.

Put simply, a computer is a dangerous tool in inexperienced hands, no different than a table saw or a gun. A user has the ability to do serious damage to themselves, by destroying or leaking personal information; adding a reasonable safety feature that is activated by default is not an infringement of your freedom when you have the ability to disable it trivially.

Now, if we're talking the App Store, then I agree with you completely. iOS should behave exactly like Mountain Lion, and if I had my druthers, the level of vendor lock-in they employ on that platform would be considered anti- competitive and illegal. If it turns out that Gatekeeper is merely a stepping stone to similarly walling off the Mac ecosystem, then I suppose I will have to eat my words.

<comment><USER8> For anyone who manages "IT" for their relatives, I'm sure they'll upgrade to Mountain Lion and lock down the application execution to "App Store and Signed Only" right away.

Some people have a talent for getting malware on _anything_.

<comment><USER9> I'd actually like a setting that says "Install nothing, change nothing, bloody leave it all alone" for my Dad's computer.

<comment><USER10> That'd be nice but the "App Store Only" option should be pretty damn close.

</comment></comment></comment></comment></comment><comment><USER11> I have no issues with signing applications and I heartily support it.

I have many (so many) issues with trusting apple to tell the world which applications are the 'trustworthy' ones, when they have proven time and time again that they will purposefully hobble their software/devices in such a way as suits their business models and bank balance.

As a life-long open source enthusiast who has been pragmatic around the existence and use of propriety systems, this entire situation is the straw that broke the camel's back. I won't give them any more of my money, regardless of how sexy the hardware is, because ultimately the Price is just too high.

<comment><USER12> _"As a life-long open source enthusiast who has been pragmatic around the existence and use of propriety systems"_

If you're boycotting Apple over this, you're no longer being pragmatic, you're being fanatic. Yes, Apple has closed platforms (iOS, iTunes, Mac App Store), but they aren't adding Macs to that list or doing anything else objectionable _yet_. If you _were_ ok, you should still be. Macs are, and will continue to be, awesome Unix workstations that you can run whatever you want on.

Apple also has nothing to gain from completely closing off OS X. It would destroy their developer base and be really bad PR, with only potentially a bit of added revenue (and Apple is anything but financially desperate).

If you're pissed that Apple is merely _capable_ of acting unethically, and you're going to boycott them because of that, then don't call yourself "pragmatic".

<comment><USER11> I'm hardly being fanatic and I'm not "pissed at apple for being capable of acting unethically". I simply don't trust them enough to act ethically, it's more of a resignation to that fact.

I have just reached the limits of what freedoms I am comfortable with relinquishing to Apple. Having to ask Apple for the permission to be able to write and distribute software that can actually be used on the majority of computers crosses that line for me.

I don't care if apple has anything to gain from closing OSX, because it has become too closed for me to consider it a serious option anymore. That wasn't always the case. I've loved all my macs, including this snow leopard MBP i am writing this on.

To boycott something would mean not buying something that you might have bought otherwise. 'as punishment'.. That's really not what is going on here. OSX has changed in ways that make it no longer meet my requirements for what a computing device needs to be, so i won't buy another one. that's all.

<comment><USER12> OS X is _not_ becoming more closed in any real sense. As described so far, launching an unsigned app (or even one signed with a blacklisted key), regardless of system settings, will take at most _one_ extra click. If that's your "pragmatic" definition of "too closed", then I can't imagine what you must think of Windows these days, especially with what's on the menu for Windows 8.

<comment><USER11> You said before : "If you were ok, you should still be."

I wasn't OK with it when they introduced the mac app store, I got really unhappy with it when random open source tools suddenly disappeared offline and became $2 pay-to-play software on the mac store. Then the sandboxing restrictions and now the signature things.

I never wanted to play in apple's walled garden. It was fine when it was all the way over there on ios. But the walls are going up around OSX as we speak, and someday they might even remove the back gate, but at that point it will be too late.

Because you will already be living in a world where to get into the nickle- and-dime scam that is the mac app store, you need to bow to apple's wishes, which get even more erratic as it gets more powerful (see sandboxing).

For anyone who doesn't want to play on the app store they now have to now get 'certified' by apple that they are allowed to write software for the mac. If you don't play by those rules, you can expect your software to be widely ignored regardless of the quality or malware status.

And really, the operating system is so much less important than the browser these days.

*edit: typo

<comment><USER13> _I wasn't OK with it when they introduced the mac app store, I got really unhappy with it when random open source tools suddenly disappeared offline and became $2 pay-to-play software on the mac store._

So that's Apple's fault? You wouldn't be referring to Growl, would you? They're complying with open source licenses; you can get the source code and build it yourself: [http://growl.info/documentation/developer/growl-source- insta...](http://growl.info/documentation/developer/growl-source-install.php)

<comment><USER12> That's actually exceeding the requirements of the license, since Growl uses the BSD license: [http://code.google.com/p/growl/source/browse/License.txt?nam...](http://code.google.com/p/growl/source/browse/License.txt?name=Growl.app+1.3.3)

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> As pointed out in other Gatekeeper threads, it would be nice if users could choose which signing authorities to trust. Signing is a good security model, but a single authority sounds risky to me. Perhaps I feel that Signing Authority Foo has a better definition of malware (read: which certificates to reject) than Apple has.

<comment><USER15> It could be useful to be able to remove the Apple root from trust as well, only running locally signed applications.

(Could be useful for public environments, schools, libraries, enterprise etc.)

<comment><USER16> I wouldn't be all that surprised if this were already possible through Keychain Access.

</comment></comment></comment><comment><USER17> Two concerns.

Say you've made a bunch of apps and you are signing them and one day Apple judges that one of them is nefarious and revokes your developer key. Does that mean that /all/ of your apps will now fail to run in the "signed apps only" mode, rather than only the nefarious one? If so that's more punitive than the iOS App Store, where I've heard of individual applications being taken down but never of a developer itself being black-balled. (Will you be able to apply for another key? Will you have to play identity games to try and pass yourself off as another person?)

Secondly, I've said above that an unsigned app will no longer "run", which is what the language on the Panic blog implies. Will it really check the validity of the developer's certificate every time a program is /run/? Will you be happily using someone's app one day, and then the next day find it doesn't start up anymore because some other app from the same developer which you might have no interest in or knowledge of has been judged to be bad? That doesn't sound very user friendly. I mean, I would have assumed that such a check would only apply at /install/ time, rather than run time, but everything I've read so far seems to be leaning towards the latter.

(Sorry - doing a quick check before posting this of Gruber's article - which I hadn't actually read yet - seems to confirm that both of my concerns are real. Oh my.)

<comment><USER18> > _Does that mean that /all/ of your apps will now fail to run in the "signed > apps only" mode, rather than only the nefarious one?_

Probably. From what I've read, it sounds like Apple's revocation mechanism more or less involves simply pushing a blacklist of keys. Thus, if your key appears on that list, none of your apps signed by that key will work.

</comment></comment><comment><USER19> So if I upgraded to that version (which after nightmares I've seen my fellow coworkers undergo after upgrading to Lion I'm not very keen to do) I'll be greeted by the system that by default does not let me to install any software except one approved by the OS maker without annoying me with scary warnings that will not be even read, let alone understood, by 99.9% of its users? I think I know one OS that already does that. There was a view held by some that Apple innovates and then other companies (including certain Redmond one) copy. Now it seems to be going in the opposite direction.

<comment><USER3> You actually don't know of a OS that does that.

Windows Vista's UAC was to ask "Are you sure?" for everything, not just running applications. There was no whitelist of secure apps short of what was installed with Windows.

The major difference with Mountain Lion is Apple actually has an App Store which 99% of the people who need this feature will use by default.

Everyone else will turn of(or turn down) this feature just like they did with UAC.

Changing one setting so I don't get emails from my mother saying she ran virus.app and now her computer is acting funny is worth it to me.

<comment><USER19> No, 99% of people will be using whatever they used before to get programs. Because these programs won't be in App Store, at least for quite a while, so people will get trained in ignoring those warnings and turning them off. The direct consequence of the system that brands thousands of legit and safe apps "dangerous" would be desensitizing of users to this system and training them that the warnings system gives mean nothing and proper reaction to them is turning it off. You yourself would do this once asked to install new IM program that somehow isn't in Apple store. And then virus.app would have absolutely no problem running.

<comment><USER3> The app does not have to be in the Store, it only has to be signed by Apple. The default setting is to allow any app that has been signed by Apple to run. If a developer does not have the time in the next six months to sign their app then I do want a warning.

I agree with you in that too many modals can desensitize a person but let us look at what would need to happen to occur in this space.

Your average consumer would buy their new Mac with Mountain Lion and would immediately be prompted to look at the App Store. It is right in their dock and constantly promoted by Apple. This person downloads an app or two that they heard they MUST get (through friends/family/colleagues whatever). Some of the apps the person hears about are not in the App Store so they go to Google. Maybe they've been told about Adium or VLC or Chrome or Firefox or any of the other extremely popular Mac apps that have active developers. These apps are all signed by Apple because it takes like 15 min to get a certificate generated.

So now let's say we're at 4-8 apps downloaded. I would say a case could be made that your typically consumer isn't going to install 50 apps right after they get their computer but let us assume they download some app that is not signed by Apple. They are prompted with this warning and here is the valuable first impression and the learning experience. If this warning can properly convey to the user why the app doesn't start then you've won. The user will either decide they don't want to run "unsafe" apps or they will change the setting.

This warning isn't going to be constantly popping up because you wouldn't see this each time you went to run the app because you can't even run it. The only options are "don't run this" or "don't run this an get rid of it". The user can't just blindly click past this they need to understand it before they can advance.

Now let's say your typical use sees this and is scared and decides installing this apps isn't worth the risk. If for whatever reason they have been told to download a lot of unsigned apps they will then need to make a choice. Do I turn this feature off or am I OK with not having this app.

If you think the typical user is going to be installing dozens of apps from lazy developers then yes the user could be desensitized.

I believe that from past experiences we can see that even having to download a DMG is a jumping off point for so many people. Most users are going to experience this just a few times and if Apple controls the experience correctly then the user will be smarter and more protected than before.

</comment></comment></comment></comment><comment><USER20> Allowing only App-Store-signed apps on the Mac would be suicide for Apple. They know this. It wouldn't happen, and if it does happen, then it would mean the end of the platform. Techies only have locked-down iPhones and iPads because they can still run any open-source or third-party tools they want, wether to write their own programs or just create content like websites, or play indie games, etc..

It just won't happen. If anybody was going to do this on the desktop already, it would be Microsoft, and they've already made it clear that "trusted computing" is just a feature along side that all-important cornerstone of computing: running whatever the flip you want.

<comment><USER21> > _Techies only have locked-down iPhones and iPads because they can still run > any open-source or third-party tools they want ..._

This is not my experience. All of the iphone-carrying techies I know have them jailbroken.

</comment></comment><comment><USER22> I think it almost goes without saying that the messaging will be changed before the public release.

<comment><USER18> Does it? Without strongly worded messaging, users would be apt to blindly forge ahead and run untrusted binaries, wouldn't they?

It's exceptionally frustrating to see this situation playing out. I really, fundamentally, do _not_ trust Apple, but at the same time, this sort of pervasive code signing is an _enormous_ boon to the majority of their users. And I think fear-mongering dialogs may be an important part of actually making that work.

</comment></comment><comment><USER23> That all sounded really thoughtful and was pacifying me until that very last bit ("One worrisome rift"). If Apple is going to make non-App Store apps begin to look inferior, then eventually they will want every one to move to their distribution network.

<comment><USER24> Agreed. I'm trying to figure out the logic behind the decision to restrict iCloud and Notification Center access to Apple-signed apps, and I just can't. If you have installed malware on your machine, you have bigger problems than a few spam notifications showing up.

<comment><USER25> The difference is that for those, services - which cost Apple to provide on an ongoing basis, they want your app to go through App review. I could easily imagine a poorly written app that still worked and was useful, but that caused a disproportionate load on the iCloud service perhaps even through just a bug. If it went through app review, Apple would be able to enter into a dialog with the developer to fix the issue.

If it was just signed and wasn't actually malware, then would Apple be able to legitimately disable all of that developer's apps because of a performance problem with just one of them?

Basically, signing apps provide some assurance against obviously ill intentions, but no quality control. Since it's your machine, this is a reasonable balance - if you're ok with an inefficient app that does something you need, then that's your choice.

App store apps can use infrastructure _outside_ of your machine that is provided by Apple. This means they have a stake in quality control as well as assuring benign intent.

<comment><USER23> I guess that is fair. The point I guess is that developers will always be able to develop and distribute outside of Apple's channels, so I guess all this sky is falling talk is unwarranted.

</comment></comment></comment></comment><comment><USER26> I don't understand the "Move to Trash" default for Apps that are unsigned if your default is to only run signed apps.

I think the chances are greater that a user intentionally downloaded a piece of software that happens to be unsigned rather than unintentionally downloaded malware. Wouldn't it be more appropriate to prompt the user something along the lines of "This application was not created by a trusted developer. Run anyway?"

<comment><USER27> Most users don't read dialogue boxes and will just click on 'Yes'.

<comment><USER26> I guess that's true, but they already take a similar approach with the "This program has been downloaded from the internet," box.

</comment></comment></comment><comment><USER28> >So it seemed feasible that we'd wake up one day and Apple would decree that all Mac apps must be sold through the App Store. >But instead, Apple went to considerable effort and expense to find a middle ground.

Offering an option to users that locks out even signed apps is a middle ground? Huh.

</comment><comment><USER29> for some warm-and-fuzzies, mac old-school nostalgia: [http://homepage.mac.com/chriswjohnson/gatekeeper/gatekeeper-...](http://homepage.mac.com/chriswjohnson/gatekeeper/gatekeeper- intro/gk-installing.html)</comment>


Aptitude, apt-get, and apt Commands - <AUTHOR> https://debian-handbook.info/browse/stable/sect.apt-get.html <comment><USER2> Online complete version of _Debian Administrator 's Handbook_: [https://debian-handbook.info/browse/stable/](https://debian- handbook.info/browse/stable/)

</comment><comment><AUTHOR> No more apt-cache search vs. apt-get install needed: apt is a second command- line based front end provided by APT which overcomes some design mistakes of apt-get.</comment>


Announcing the Founder's Library - tomh- http://swombat.com/2011/4/22/founders-library <comment><AUTHOR> Excellent! Thank you, swombat.

Don't worry about tags, layout, formatting, RSS feeds, ebooks, or anything else. If people want that stuff badly enough, someone in this community will step up and do it, providing additional value and showing us what they can do.

You are already on the critical path, using your background and experience to curate all the noise out there into something really useful. Please keep doing that.

<comment><USER2> Thanks for the good word :-) it means a lot!

</comment></comment><comment><USER3> I would suggest that tagging these articles would add a great deal of value. The chronological list is good, but adding tags or categories of some sort would make it easier to navigate.

<comment><USER2> I've thought about this a lot, but I'm not entirely sure how to tag it in such a way as to be useful... do you have any suggestions as to the types of tags you'd like to see?

Possibly part of the problem was that I was looking at it from a "general startup" point of view (the narrowing down to early founders is recent). Perhaps with a narrower focus, tags will make sense.

<comment><USER4> I'm not entirely sure if this is possible, but how about categorizing the articles based on different stages or phases, which a startup founder has to go through, from start to going public with the startup and making it go huge. Something like that?

<comment><USER5> Indeed better than tagging. Those who know the 'stuff' might not agree but the 'step by step' is always better for novices (read me). And not to mention, 'step by step' will be a useful keyword for SEO.

</comment></comment></comment></comment><comment><USER6> Bookmarked. Thanks Swombat!

I'd like to take the chance again to pitch the idea of somebody coming up with a more useful navigation system for all this information. There's a tremendous amount of good stuff out there. Any type of organization helps, therefore this list alone makes for a great resource. Just wish we could do something better with nav.

</comment><comment><USER4> Awesome resource for people who are, or want to be, startup founders. The OP links to the blog post. But here is the URL for the actual page: <http://swombat.com/founders_library>

</comment><comment><USER7> Sweet library!

I've also started a more broad collection of articles useful to entrepreneurs at <http://founderswiki.com/>

If you want to collaborate in some way I'd love to talk more - firstname.lastname@example.com

</comment><comment><USER8> Would be interesting to see this list imported into something like delicious (not sure where since I wouldn't trust such a resource on that site now) to get all kinds of useful features built in by default.

</comment><comment><USER2> If you have any questions, or suggestions about how this could be made better, I'd love to hear them. The goal is really to build a collection of articles that are useful to the early startup founder.

<comment><USER9> Have you considered coordinating with the original authors to compile them into a book? It's really easy to self publish to Kindle now.

<comment><USER2> Someone has mentioned that... It would probably take a fair bit of work, and I'm not convinced the material is ready for book form yet, but it's definitely an option for the future!

Right now I definitely look at it as more of a living, evolving resource...

<comment><USER10> Let me know if you'd like help with that; I have several tools for converting web pages to ebook chapters, or, if you're so inclined, I could give you a free code for eBookBurn.com (my startup's site) and you could do it yourself.

<comment><USER2> Oh, the conversion is not problem, I can figure that one out - it's getting permission from all the authors that would take ages...</comment></comment></comment></comment></comment>


New recordings and personal stories with AI expert systems pioneers - <AUTHOR> https://computerhistory.org/blog/chm-releases-new-recordings-and-personal-stories-with-ai-expert-systems-pioneers/ <comment><USER2> What would be a modern, open source expert system dedicated to natural language understanding? If feel like this is non existant and any attempt will find dead code from the 80s</comment>


30 Days Without Sugar - <AUTHOR> http://jdbentley.com/30-days-without-sugar/ <comment><USER2> After noticing the percentage differences and the weight drop, I wanted to do the math to figure out how much muscle vs. fat he lost.

He went from 219.2 at 35% body fat to 195.8 at 28.1%. If you do the back of the napkin math real quick that works out as follows:

        219.2 * .35 = 76.72 lbs of initial fat
        219.2 - 76.72 = 142.48 lbs of lean mass

        195.8 * .281 = 55.02 lbs of final fat
        195.8 - 55.02 = 140.78 lbs of lean mass

That means he lost ...

        1.7 lbs of muscle
        21.7 lbs of fat

Normally I say that these diets are often bad, and end up putting you back further where you started because you lose so much muscle and therefore regain it all much quicker.

However in this case 92% of his weight loss was fat, which is awesome.

<comment><USER3> I am not at all up to speed on these things but I guess there's more to the human body than fat and muscle. Those 1.7 lbs will certainly also include water, for example.

<comment><USER2> Typically how these things are measured is body fat and lean mass. Lean mass is all the stuff other than fat (muscle, water, organs etc).

You're right, I did assume that the lean mass lost came out of muscle in retrospect. Given his weight loss ratios I'd guess that it has to be, but it may be all water.

One interesting point here is if he lost significant water weight then he could have actually gained muscle as he lost fat. (that one's hard to tell though)

</comment></comment></comment><comment><USER4> You would be surprised how much better you can feel by just staying away from conventional sweets and sugars. It's a pretty low hanging fruit (sorry) in making your self healthier. Just don't eat ice cream, candy, desserts, or soda. You will look and feel excellent without putting yourself through some crazy diet that may end up killing you.

</comment><comment><USER5> I've been doing this since 30th March, as I worried I was potentially becoming pre-diabetic. Biggest learning point was: yep, sugar is addictive. I've lost quite a lot of weight in that time, and feel like I have a lot more control over my eating in general. I've not been being too precious about fruit, I just don't eat much.

This NYTimes article as probably the other big motivator:

[http://www.nytimes.com/2011/04/17/magazine/mag-17Sugar-t.htm...](http://www.nytimes.com/2011/04/17/magazine/mag-17Sugar-t.html?pagewanted=all)

</comment><comment><USER6> For the past month, I've done something similar, just following Atkins. I've monitored my calories using myfitness.com so I know my daily caloric intake has varied between 900 and 1400 calories. I've monitored whether I am in ketogenesis with some nice pee strips.

Following Atkins first phase, I am maintaining about 20 carbs per day, mostly from interesting salad elements and some yummy cheeses. I've been drinking 0 calorie flavored seltzer water and regular water and coffee (with cream.)

And mostly cooking/reheating Costco and Trader Joe like foods that are about 50/50 fat/protein with zero or few carbohydrates. (Burgers, steak, pot roast, shredded beef, chicken with skin.)

There are definitely some days I am hungrier than others, no big deal, I eat what I want. But many days after 15 - 18 hours I am pretty full at 1200 calories.

I have noticed that on days when I eat very little, even though I was not hungry that day, I get a pretty nasty headache the next day -- so I try to ensure I get at least 1000 - 1200 calories each day.

Saw my MD last week, and got my blood tests back today, and I'm doing just fine. Before doing any diet, or shortly into that diet, you probably should see your doctor.

So I'm 5'8" and lost 14 pounds in 30 days -- would like to lose another 20 -- that would be great.

<comment><USER7> "I have noticed that on days when I eat very little, even though I was not hungry that day, I get a pretty nasty headache the next day"

Well, the most common reason is lack of water. Practically every food contains a lot of water and burning fat is a more inefficient process. So if you don't consume enough calories then you must drink more water/salt than usual.

<comment><USER6> Thanks, that's very likely and I have been much more conscious of drinking water in the past few days, and my doc called this morning to tell me I was dehydrated on the blood test from last week (although I put that down to a 10 hour fast before the test.)

</comment></comment></comment><comment><USER8> Awesome job! I did this last year and lost almost exactly ~100lbs (along with exercise).

Would you mind editing your post and adding in some resources for other people interested in the scientific information? I'm assuming that others will be really interested in your sources (I know I found r/keto very helpful) so they can have background information.

Anyhow, congrats on the awesome loss!

<comment><AUTHOR> That's a great idea. I visit r/keto all the time. I'll list out some resources now and tack them onto the bottom of the post.

</comment></comment><comment><USER9> Cutting out Diet Coke (and artificial sweeteners) has been key for me. I feel much healthier, and my head is clearer. Sugar is next.

One other body hack: my knuckles were starting to ache like I had arthritis. At first I thought it was from programming too much, but then I discovered that peanuts can cause inflammation -- I was eating peanuts all the time as my go-to snack -- I eliminated those and my arthritis symptoms went away within a few days.

<comment><USER10> Aspartame has been proven to be safe. The worst thing about Diet Coke is probably effect of the acid on your enamel.

<comment><USER9> What study are you referring to? There are studies that show diet soda and/or Aspartame are linked to metabolic syndrome ([http://www.nytimes.com/2008/02/05/health/nutrition/05symp.ht...](http://www.nytimes.com/2008/02/05/health/nutrition/05symp.html)) and other studies regarding its excitotoxicity (<http://en.wikipedia.org/wiki/Excitotoxicity>).

</comment></comment></comment><comment> matthew-wegner If you'd like to try a 30-day challenge with your diet, I heartily recommend Whole30: <http://whole9life.com/2012/01/whole-30-v2012/>

In short, you remove:

      * Grains/legumes
      * Dairy
      * Sugar
      * Alcohol
      * Weird additives (sulfates/MSG/etc)

If you eat the standard American diet, this is probably a lot of your food! Which begs the question--what _can_ you eat? The guy who runs my gym also runs The Foodee Project, a recipe collection site. Here's the Whole30 tag: <http://www.thefoodee.com/tag/whole30/>

P.S. And if you're too busy/lazy to do a Whole30, the best thing you can possibly do with your diet is cut sugar. Not reduce; cut. Remove it, 100%, no fucking around. Sugar is a really easy-to-use energy source for your body, which actually screws you up if you constantly intake it. More info here: [http://www.marksdailyapple.com/what-does-it-mean-to-be- fat-a...](http://www.marksdailyapple.com/what-does-it-mean-to-be-fat-adapted/)

</comment><comment><USER11> According to his graph, he lost almost a pound a day for a full month. He didn't just cut out the sweets. He effectively went on a starvation diet!

That is _not_ safe.

He is not to be congratulated, he is to be ushered into a doctor's office so some sense can be talked into him before he does himself permanent damage. When you go on a starvation diet your body breaks down muscle as well as fat, and some of that muscle is rather important not to lose. Heart damage is just one major risk of starvation diets.

Additionally, when you throw the yo-yo that hard it is going to be exceedingly difficult to keep it from coming right back up. My money's on him being back at 230 or higher within a year.

<comment><AUTHOR> This most certainly wasn't a starvation diet. I didn't starve myself at any point. I'm not at all convinced my body has broken down any muscle. I'm not in any danger whatsoever.

<comment><USER11> Don't take my word for it. Certainly don't take the internet's word for it. Just go see your doctor.

<comment><USER12> If we're seeing medical professionals, a registered dietitian would be the right person to see.

That said, I'll bet folding money that his blood panel has improved.

</comment></comment></comment></comment><comment><USER13> Does anyone know whether it's OK to use Stevia as an alternative during such a sugar-free diet?

<comment><USER14> It probably is but to be honest, stevia is the grossest thing i've ever tasted in my coffee ... I used to put one sugar in my coffee, dropped added sugar all together 2 months ago and tried stevia one single time. I can't exactly pin the taste but it's way too sweet and tastes chemical even though it's a natural product.

That being said, if you HAVE to add sweetener stevia is probably your best choice.

<comment><USER15> Stevia alone is pretty awful, very bitter aftertaste. But there are some new stevia derivates that aim to remove the bitterness and turn it into an acceptable sugar substitute. Pepsi has developed one, and the Coca-Cola Company, with Cargill, have recently developed Truvia (<http://en.wikipedia.org/wiki/Truvia>), which is already being used in some of Coca-Cola's beverages. You can buy it in packets for home use. So far, TruVia is the best-tasting artificial sweetener I have come across. Much better than aspartame, sucralose etc. No bitterness to speak of.

Another natural sweetener called erythritol (<http://en.wikipedia.org/wiki/Erythritol>) is also very good. Unlike stevia, I believe it works on its own, with no modifications required to remove bitterness etc.

</comment></comment></comment><comment><USER16> To clarify, were you on a Paleo _and_ no-sugar diet at the same time, or am I misinterpreting something?

<comment><AUTHOR> Yes. I've been eating paleo for about a year. I cut back on sweets to beat the sugar addiction and further along my weight loss.

</comment></comment><comment><USER17> Getting a database connection error :-(

<comment><USER12> Wordpress strikes again, by the looks of things.

OP, if you haven't already, install WP-Supercache or W3 Total Cache ASAP.

<comment><AUTHOR> Will do.

<comment><USER17> We're back - thanks!

</comment></comment></comment></comment><comment><USER18> He's not in ketosis; he's in starvation mode. He's losing massive amounts of muscle as a result of this diet, which is why he is losing so much weight. He's also losing fat, but not as efficiently as he would in a normal diet.

If he keeps this up, he'll be lucky if he has the strength to pick up a coffee mug.

<comment><USER19> Who put this idea into so many heads? I'm really very curious to know, where did you learn of this starvation mode idea?

<comment><USER20> It's the same as 'lactic acid is poison', some day the good science will win and the textbooks will be updated.</comment></comment></comment>


Adventures with ffmpeg and color ranges - <AUTHOR> https://www.facebook.com/permalink.php?story_fbid=2413101932257643&id=100006735798590 <comment><USER2> Not sure if this kind of meta-comment is appropriate, but I find it difficult to follow a link like this because of the lack of human readable information contained in the URL.

If the story was hosted on a personal blog I recognised (like Julia Evans to take a random example), then perhaps the domain would be enough for me to choose to read the article to see if the content is interesting.

If the link was to a broader domain that hosts many writers, I might use the parts after the domain to filter my interest: example.com/news-opinion vs example.com/science-blog gives me more information that might not be clear from the post title.

With a site like Facebook, which hosts so much different value levels of content, it is harder for me to visit facebook.com/233555323 rather than facebook.com/ffmpeg-interest-group/post6665443. For whatever reason, the URL remains something I use to filter my internet consumption.

Perhaps it has something to do with the amount of scams or other general reasons not to trust non-human readable URLs, or perhaps it is more due to my distrust of article titles (sensationalism) and seeking a second source to verify my interest. Perhaps I simply bias against Facebook - I don't know.

Regardless, I visited the story after thinking about this, and was very surprised to see it was an article by John Carmack - an author I certainly respect. It is a shame for me that both the URL and the title don't reflect that.

<comment><USER3> Another site that comes to mind is the Financial Times, which uses UUIDs for article urls, with no other indication of content.

[https://www.ft.com/](https://www.ft.com/)

[https://www.ft.com/content/13be9132-8149-11e9-b592-5fe435b57...](https://www.ft.com/content/13be9132-8149-11e9-b592-5fe435b57a3b)

<comment><USER4> Oh wow, you really have to hope these are not the canonical links. If so, they are doing themselves an incredible disservice and the fact that no one has brought it to management's attention speaks gravely to the workplace culture there.

<comment><USER5> Not only does the full URL not show in my browser (Safari), the full URL doesn't even show on this forum (for me it is cut off after "content"). When you receive a URL via chat or on social networks, it is in the form of a preview and might not even show the domain name. The user also isn't typing these URLs in, with or without human readable text in the path. Essentially all of the arguments for making URLs more brittle (which is what you are doing by adding human readable text) are obsolete in a world where URLs have been relegated back to what they were always supposed to be: permanent identifiers to a semantically stable unit of content.

<comment><USER6> > Essentially all of the arguments for making URLs more brittle (which is what > you are doing by adding human readable text)

Not if done right, like e.g. stack overflow, see [https://stackoverflow.com/questions/517355/string- formatting...](https://stackoverflow.com/questions/517355/string-formatting- in-python)

The human readable text is actually meaningless, and anything after the id will redirect there, e.g. [https://stackoverflow.com/questions/517355/this- could-be-any...](https://stackoverflow.com/questions/517355/this-could-be- anything)

<comment><USER5> This technique (which I almost commented on in my original comment, but didn't) is brittle in a different way (making it so that attempts to search for the URL have no well-known canonical representation), and quite simply totally undermines the entire argument being made (which is why I didn't comment on it) that someone can use the slug of a URL to decide whether or not they want to click on the content: you can change the URL to say anything you want. At this point, there is no value in bothering with having done this: it is just extra text in the URL for no concrete benefit.

meta.stackexchange.com/questions/148454/why-does-stack-overflow-use-title- slugs/

</comment></comment></comment></comment></comment></comment><comment><USER7> Funnily enough, I actually ended up giving myself a crash course in this very topic when encoding frag movies for Quake 3/Quake Live. It was/is common practice to use 'brightskins' on your enemy models in competitive play to make them easier to see, typically being a colour like '#00FF00'. I noticed that when uploading to online media hosting sites like Youtube these bright colours would become noticeably washed out and degraded. My investigation of why this happened led me all the way down this rabbit hole. This was the better half of ten years ago now so I have no idea if it still occurs, but I ended up just rendering the videos using a better brightskin colour that appeared less degraded after conversion... Going through the cycle of 'rerender/reupload/check' to find a replacement colour again and again to experiment sure was a major pain!

</comment><comment><USER8> For all of our sanity, please don't start producing 8-bit H.264 videos with full 0-255 range.

If you have enough control over the _decoder and renderer_ to make that hack work, you should just be producing 10-bit HEVC/AV1 video – which does not suffer from these 8-bit banding issues – with a modern color space (Rec 2020, PQ, etc.).

And if you _don 't_ have choice or control over the decoder and renderer, then it's a good sign that this would be a fragile hack.

<comment><USER9> My primary concern is for immersive VR media on our Go and Quest platforms, which use Snapdragon 821 and 835 SoC, respectively. The 821 doesn't support 10 bit on anything, and the 835 only supports it on h265. Software decoding a 4k60 video on mobile isn't an option, and you can see every bit transition with dark adapted eyes in a vr headset, so getting full 8 bit range is pretty valuable.

<comment><USER10> You forget to mention which colorspace you're using. It matters.

From Rec. 2020 wikipedia article: Since a larger color space increases the difference between colors an increase of 1-bit per sample is needed for Rec. 2020 to equal or exceed the color precision of Rec. 709.

The "correct" solution is to use a modern colorspace (rec 2020) with 10 bits encoding (or 12 bits, if you can). UHD standard mandates at least 10 bits.

On the '821 you _could_ gain 1 bit by degrading to an older color space - 709.

Full 0-255 range should never be used - they are invalid according to the standard. None of the hardware codecs are validated for 0-255 - you're asking for trouble here. Expect ghosting and weird motion artifacts accumulating from one I-frame to the next I-frame.

<comment> the-dude Are you sure about that? Logitech sells H264-encoding cameras which do yuvj420p ( which is full range as I understand it ).

YT and other platforms have no problem ingesting these videos. Also the RPi Broadcom chipset does not seem to care.

</comment></comment></comment></comment><comment><USER11> > _This is usually visible as ugly banding or blocking in dark scenes._

I was just complaining about this a couple weeks ago with some friends after the "Dark" episode of GoT. I was saying the codecs don't seem to have caught up or they are just being fed at too low a bit rate to really excel at dark scenes.

It's hard to imagine this is just a scaling issue with the color ranges, and if so, how could it possibly not have been fixed?!

I have a high end OLED screen in a very dark room, and I was very disappointed by the picture quality. Enough to wish I hadn't watched it through HBO Go and that I had a better source.

I would love to see some before/after scenes showing the effect of the patch.

<comment><USER12> The Amazon 720P version had noticeable banding several times during that episode that was distracting even the day after so it's probably not a bandwidth issue, the Dothraki charge into the dark might have been a cool idea on paper but what a disappointment in execution. I think the director and cinematographer are just ignorant of how stuff gets delivered to consumers.

[https://news.avclub.com/was-game-of-thrones-the-long- night-t...](https://news.avclub.com/was-game-of-thrones-the-long-night-too- dark-to-see-t-1834416256)

<comment><USER11> From a tweet linked from that article:

[https://pbs.twimg.com/media/D5SmDG7WwAAMhdf.jpg:large](https://pbs.twimg.com/media/D5SmDG7WwAAMhdf.jpg:large)

I think that particular screenshot makes it look even worse than it was, but it was definitely sub-par. I assume that a hardcopy 4K Bluray would not exhibit the same effects?

</comment></comment></comment><comment><USER13> Interesting find.

I have encoded video for over a decade, and I don't think a two month period has gone by where I haven't learned something that convinces me to completely change how or what flags I'm using.

This is way beyond that but still.

<comment><USER14> At the risk of telling you something you know, there's a lot more things to trip on with proper color space conversion than just going from scaled to full range color in 601. It's something of rat's nest to cover all the cases.

<comment><USER15> After ProRes became a thing, there was a lot of confusion where the metadata saved within the MOV started to include the HD vs SD color primaries. Some programs were able to correctly read this data. Most did not. Most programs did not include the data including Final Cut. The iTunes team started rejecting files exported from FCP because they claimed they were not made correctly and not a valid file. The iTunes team were just reading the spec and built their automation based on that, but not what the real world output from FCP was doing.

</comment></comment></comment><comment><USER16> I still find it kinda odd that this is still the best tool out there for this sort of work. Archaic parameters and options and exceptionally hard to read documentation.

Maybe I'm just dumb and not in the domain enough to get a decent handle but everytime I use ffmpeg I feel like a Norse Shaman trying through trial and error to locate the correct orientation of runes for the blessing.

<comment><USER17> there are two problems here. the main problem is that nobody reads the manual, which actually starts out half-decent. the description is very clear, concise, and even contains the oft-whinged-about examples. [https://ffmpeg.org/ffmpeg.html](https://ffmpeg.org/ffmpeg.html)

the second problem is that ffmpeg has a _lot_ of features, and nobody wants to go through and fully document hundreds of formats, codecs, and filters.

<comment><USER18> Part of the problem is that the documentation is so vast (the page you link is only one of many, many pages; the documentation has been split out into multiple pages for a while now) that as a user, it's fairly insane to try and consume and comprehend it all, especially if all you want to do is something quick.

</comment></comment></comment><comment><USER19> [http://archive.is/K5Fpv](http://archive.is/K5Fpv)

<comment><USER20> TIL: EE, a mobile provider, blocks archive.is as unsafe content for people under 18. [https://twitter.com/nvartolomei/status/1133644305812381696](https://twitter.com/nvartolomei/status/1133644305812381696)

<comment><USER21> That sounds correct to me, since it could contain NSFW content, and by default, mobile providers in England have content controls switched on.

</comment></comment></comment><comment><USER22> The ffmpeg documentation for YouTube videos[1] suggests using `-pix_fmt yuv420p` with H.264 and there are warnings against using other pixel formats (such as yuv444p) for compatibility reasons. Should the documentation instead be suggesting `-pix_fmt yuvj420p`? What are the risks associated with choosing that output format?

[1]: [https://trac.ffmpeg.org/wiki/Encode/YouTube](https://trac.ffmpeg.org/wiki/Encode/YouTube)

<comment><USER23> No, limited range is the most common and expected range for YUV videos. Many players don't look or respect the container metadata such as nclx in MP4 or the bitstream VUI flags and assume limited range.

<comment><USER24> This is correct. In fact, the following statement from the post is nonsense:

> For arcane reasons related to TV broadcast limitations, many video formats > restrict the YUV color components to be in the 16..235 or 16..240 range > instead of the full 0..255 range. Losing 14% of the already-barely-enough 8 > bit dynamic range is bad enough, but it also often results in the black > range starting at a quite visible grey value because most players don't > rescale the range. This is usually visible as ugly banding or blocking in > dark scenes.

Of _course_ players "rescale" the range. (It's not exactly rescaling, it's just that a value of 235 _IS_ reference white in Rec. 709.) In fact, the thought if them _not_ doing this is kind of crazy, as Rec. 709 (used in Blurays and elsewhere) as well as Rec. 601 explicitly use limited range YUV. Players that don't use limited range correctly would be out of spec and couldn't play a single Bluray disc correctly. So for the overwhelming majority of use cases, you want regular old yuv420p.

The author _is_ picking up on something that actually happens, however. There are Blurays out there that have incorrectly converted YUV values. This happens when for example something is in limited range YUV, and then that data is passed to a converter that treats the data as _full_ range YUV, and compresses it _again_ to fit in limited range YUV. This "doubly compressed" data is embarrassingly common (maybe 5% or so of Blurays have this problem). If you get a Bluray like this, or any video with the same issue, the blacks will be bright grays and the whites will be dull (similar to how the author describes limited range YUV). The player on the end _is_ reading the YUV values correctly, but the data has been doubly compressed so it only undoes one round of this.

The issue is well known in the pirate communities as an example. Reliable release groups always fix these broken Blurays in their encodes. This is usually described as "fixing levels" or something like that.

<comment><USER25> Interesting post!

I have one question about terminology though: when you refer to "players", do you mean all kinds of players or just physical hardware devices like Blu-ray players?

I ask because I haven't had/observed any issues or defects with colour in software/PC-based desktop serious at all.

Disclaimer: not in the Blu-ray-authoring business.

<comment><USER26> It's pretty easy to verify: create a uniform white png and convert it to yuv420p h264 via ffmpeg:

ffmpeg -i input.png -pix_fmt yuv420p movie.mp4

Open in VLC or your favourite player and take a screenshot. Now check with a color picker whether you have white as 255 or 235.

Update: checked with VLC and QuickTime Player, both handled it correctly and displayed white as 255.

</comment></comment></comment></comment></comment><comment><USER27> I see a lot of people confused about the host (Facebook). Carmack initially posted a lot of high quality articles on AltDevBlogADay. However, that site went down. Carmack said he moved to Facebook because he feels it's more reliable than other (cleaner) third-party hosts, which might not be around 10 years from now.

<comment><USER28> I've seen a lot of similar posts hosted on Google Plus and shared on HN in the past. They are all gone, now.

Sure, Google has a horrible track record when it comes to service durability, but I wouldn't trust Facebook as a reliable host either. Anyone having relied on their @facebook.com email address (2010-2016) may agree.

</comment></comment><comment><USER29> John Carmack 7 hrs ·

Adventures with ffmpeg and color ranges.

A video legacy issue that can cause a lot of problems is the issue of "limited" versus "full" component range. For arcane reasons related to TV broadcast limitations, many video formats restrict the YUV color components to be in the 16..235 or 16..240 range instead of the full 0..255 range. Losing 14% of the already-barely-enough 8 bit dynamic range is bad enough, but it also often results in the black range starting at a quite visible grey value because most players don't rescale the range. This is usually visible as ugly banding or blocking in dark scenes.

For ffmpeg, the trick to avoid this is to use '-pix_fmt yuvj420p', which says to use the j-for-jpeg full range in a 420 YUV subsampled p-for-planar format.

If you are starting with either RGB images, a 10/12 bit format, or a yuvj420p format video as input, then with the libx264 codec, you would get a full range output. Note that any video processing tools used along the way could also limit the range, and once it is gone, there is no getting it back, so you must be very careful and check your entire pipeline!

When you us this format, ffmpeg complains about 'deprecated pixel format used, make sure you did set range correctly', but you should ignore this warning.

Ffmpeg would like the world to move to specifying the range independently from the YUV channel subsampling and layout:

Setting '-color_range 0 -pix_fmt yuv420p' makes the output format yuv420p Setting '-color_range 1 -pix_fmt yuv420p' makes the output format yuv420p(tv) Setting '-color_range 2 -pix_fmt yuv420p' makes the output format yuv420p(pc)

Unfortunately, this isn't yet uniformly handled throughout all the internal format tests.

The libx265 integration in ffmpeg didn't support the deprecated yuvj420p pixel format, only the basic yuv420p one, and no matter what I did, my test videos were always coming out limited range. It didn't matter if you add a '-color_range 2', or '-x265-params range=full'. Those will change the settings in the VUI (Video Usability Information) section of the output, but the values are still compressed to the limited range.

Regardless of the input data, any 8 bit h265 video coming out of ffmpeg was limited range!

I walked through the libx265 code looking for range compression, but it turned out that all the damage was being done by ffmpeg before it got to x265. Ffmpeg will automatically convert formats when the output differs from the input, and since x265 only supported yuv420p, any full range input will be processed.

Adding '-v 48' to ffmpeg will dump more information, including this auto_scaler invocation, which is what is killing the full color range: [auto_scaler_0 @ 000001f55ecd1a40] w:2048 h:2048 fmt:bgr24 sar:0/1 -> w:2048 h:2048 fmt:yuv420p sar:0/1 flags:0x4

I was about to start hacking the code to at least do what I wanted for my use case, but I tried an appeal to Twitter:

[https://twitter.com/ID_AA_Carmack/status/1131715388067274753](https://twitter.com/ID_AA_Carmack/status/1131715388067274753)

My suspicions were confirmed, but Derek Buitenhuis went ahead and submitted an official patch to get yuvj420p accepted by libx265, and windows builds are already available at [https://ffmpeg.zeranoe.com/builds/](https://ffmpeg.zeranoe.com/builds/).

I suspect there was probably some way of working around this involving explicit format conversion filters with -src_range and -dst_range overrides, but this is now working as you would expect it:

ffmpeg -i source.mp4 -c:v libx265 -pix_fmt yuvj420p dest.mp4

Bravo to ffmpeg!

</comment><comment><USER17> also see "Falsehoods programmers believe about [video stuff]": [https://haasn.xyz/posts/2016-12-25-falsehoods-programmers- be...](https://haasn.xyz/posts/2016-12-25-falsehoods-programmers-believe- about-%5Bvideo-stuff%5D.html). previously discussed: [https://news.ycombinator.com/item?id=13259686](https://news.ycombinator.com/item?id=13259686).

</comment><comment><USER30> Version you can view with JS disabled: [https://mbasic.facebook.com/permalink.php?story_fbid=2413101...](https://mbasic.facebook.com/permalink.php?story_fbid=2413101932257643&id=100006735798590&_fb_noscript=1)

</comment><comment><USER31> Fun fact: sRGB also has a non-black black point that is (fortunately) virtually ignored by everyone.

<comment><USER32> Source?

As far as I can tell in XYZ black is (0,0,0) and the only sRGB value that maps to that is (0,0,0)

<comment><USER33> This is incorrect.

If sRGB (1,1,1) is XYZ (1,1,1), then sRGB (0,0,0) is XYZ (0.0025,0.0025,0.0025).

Or if you are using absolute XYZ values, sRGB (0,0,0) is XYZ (0.1901,0.2,0.2178).

</comment></comment></comment><comment><USER34> Its weird to think how John Carmack went from .plan files to Facebook Posts. I think it might be safe to say he had the most widely read .plan file in existence. Wish he would go back to it.

<comment><USER35> I suspect it's not his decision to make.

<comment><USER36> That's totally absurd. Luminaries like Carmack are anything but prisoners; any firm in SV would pay big bucks to say "John Carmack works here".

Facebook may be a big conglomerate these days, and they may not be the cool kid on the block anymore, but that doesn't mean that they're idiots. If anything, they treasure the presence of someone like Carmack all the more, because it's no longer reputionally-free for people like him to come on board. I'm sure that Facebook is _appreciative_ when he blogs on their platform, but it's patently ridiculous to pretend that anyone would -- or could -- force it.

In fact, Facebook has already been forced to pay at least dozens of millions of dollars essentially as a direct consequence of employing Carmack [0], and I'd be willing to bet they'd happily pay (at least) dozens of millions more.

If you want your mind blown even harder, look up some of the paperwork around the Waymo / Uber debacle [1]. SV companies pay big bucks for this type of talent, even the ones you haven't heard of, like Anthony Levandowski.

If the roll of the dice is in your favor, SV stardom is at least as valuable as Hollywood stardom (and, for the most part anyway, you still get to walk around in public unharrassed).

Disclaimer: I have no special connection with any of the companies or people mentioned, I don't know the inside baseball, and this is all conjecture. But at least it's better supported than yours. ;)

[0] [https://en.wikipedia.org/wiki/ZeniMax_v._Oculus](https://en.wikipedia.org/wiki/ZeniMax_v._Oculus)

[1] [https://www.cnbc.com/2017/04/03/waymos-uber-lawsuit- reveals-...](https://www.cnbc.com/2017/04/03/waymos-uber-lawsuit-reveals- anthony-levandowskis-120m-pay.html)

<comment><USER37> Picturing The Zuck leading two mutant mandogs on leashes: the audience is horrified to realize they're Yann LeCun and John Carmack, though 'heavily modified' and almost unrecognizable in their snarling ferocity.

"This fist holds the Ego. This fist holds the Id. I bring you a new existence: the GlobalCoin. I came up with that myself. As Super-Ego."

<comment><USER38> I appreciate your imagination.

[not the person you responded to]

</comment></comment></comment></comment></comment><comment><USER39> The best part about these blog posts is that people discuss the hosting service more than the content of the article at this point.

No one is nearly as interested in Carmack's thoughts on codecs as they are about the domain name of the server he's posting to.

And yet, we'd all read his stuff no matter where he puts it. But maybe he reaches more outsiders this way? I doubt it.</comment>


NASA: using the sun as a gravity lens to study distant exoplanets - <AUTHOR> https://www.technologyreview.com/s/601331/a-space-mission-to-the-gravitational-focus-of-the-sun/ <comment><USER2> This post on Centauri Dreams discusses another possible way to use the Sun's gravity lens, as a way to effectively communicate with an interstellar probe: [http://www.centauri-dreams.org/?p=10123](http://www.centauri- dreams.org/?p=10123).</comment>


Ask YC: Is it just me? - <AUTHOR>

isn't twitter pretty much facebook status messages. If someone just makes a service which uses the facebook api to get your friend's status messages, would they not have cloned twitter. Facebook has a much larger userbase and obviously scales much better than twitter.
You can update your status in facebook using a number of different ways (api, web, mobile etc...). Whats the big deal with twitter? I can't understand it. <comment><USER2> No, but almost. First, twitter, unlike facebook, is asymmetric. Therefore, I can follow all my favorite web-celebrities, and they can totally ignore me. Second, because twitter is about more then just the most recent message from that user. It's an aggregation of those messages.

I think the real use for twitter comes from either sending out links, or mentioning breaking news (like, for example, tim russert's death, which zipped around twitter long before it broke).

In that regard, I think the a more "proper" mental model for twitter isn't so much as aggregated facebook status messages, but more like distributed reddit (except, in a central place... so.. psuedo-distributed?).

</comment><comment><USER3> Or...get ready for the deep philosophical epiphany...

are facebook status messages pretty much tweets?

</comment><comment><USER4> I almost always write tweets beginning with 'is...'.

I use twitter as a substitute for blogging, which I can't possibly commit to (takes me too long to write a post).</comment>


A neurotic's guide to small talk - <AUTHOR> http://nytimes.com/redirect?to-mobile=http%3A%2F%2Fwww.nytimes.com%2F2015%2F12%2F06%2Fopinion%2Fa-neurotics-guide-to-small-talk.html <comment><USER2> garbled link.</comment>


Remote Working - <AUTHOR> What is the future of remote working? What kind of challenges we can anticipate? <comment><USER2> Companies outsourcing office costs to employees

Young staff having no opportunities to learn from senior colleagues or develop

Those without spare rooms or a home environment conducive to wfh seeing their productivity nosedive

Social isolation

Further normalisation of spending all your time at home staring at a screen

</comment><comment><AUTHOR> A disbalance between work and personal life?</comment>


Modern Monetary Theory Survey - <AUTHOR> http://www.igmchicago.org/surveys/modern-monetary-theory <comment><USER2> "Question A: Countries that borrow in their own currency should not worry about government deficits because they can always create money to finance their debt."

What's surprising is how much self-reported confidence the majority of the Chicago school-style respondents had in their disagreement with the straw man question posed.

<comment><AUTHOR> Wikipedia says IGM Panel is geographically and ideologically diverse and are a good sample of the leading economists in the nation. The reason you see the diversity in confidence is because it is represented by a diverse variety of economic schools of thought.</comment></comment>


The Failure of the PCI-DSS? (2014) - <AUTHOR> https://www.anitian.com/blog/the-failure-of-the-pci-dss/ <comment><USER2> There are details of this article that are pretty spot on. For example, I've personally seen an institution fail, then just turn around and change QSA to one that passed them without any changes. This is right in line with the "The current state of QSAs is appalling" introductory sentence.

I do disagree with PCI being a great standard—it isn't.

* It is often vague leading to unnecessary debates between managers and engineers. (E.g., is a smart router that has a login screen a server?)

* It forces unnecessary password resets

* It doesn't do a great job defining changes to the server so again you can interpret that different ways. If there is a typo and I change it in a content view, is that the same thing as changing a typo in code? (You should see the fights this causes amongst engineers and managers in large organizations.)

* Two factor doesn't seem largely recognized. It is sometimes talked about by QSAs, but, in my experience they don't really seem to get it...

* There is some situation where a QSA said to my organization at the time that everything needed to be N many hops away, but wouldn't define concretely what a hop was. Nor did it matter because we had already seen attacks where the attacker took more than 2 hops internally to escalate their privileges.

What it is great at, and I'll give it that, is that PCI echoes the old adage of "Nobody went broke by hiring IBM." It gives great deniability if something does go wrong by saying "Hey we followed PCI! See?!" despite its actual usefulness being pretty doubtful to me.</comment>


Okay, Feminism, It's Time We Had a Talk About Empathy - <AUTHOR> https://medium.com/@maradydd/okay-feminism-its-time-we-had-a-talk-about-empathy-bd6321c66b37#.g4cw1kb3e <comment><USER2> Meredith L. Patterson, author of "Okay, Feminism, it's time we had a talk about Empathy" points to her perceived lack of empathy from feminist critics because while they are talking about pervasive gender discrimination she is talking about how good she's had it - it's okay, she is autistic and has "blazingly single-minded focus" that 'just allows her to get on with her work regardless, and other's should too'.

</comment><comment><USER3> [https://news.ycombinator.com/item?id=9941712](https://news.ycombinator.com/item?id=9941712)</comment>


NeverSSL – helping you get online - <AUTHOR> http://neverssl.com/# <comment><USER2> I'm using [http://lambda-the-ultimate.org](http://lambda-the-ultimate.org) for this purpose for quite some while. They are lambda's, so I'm confident they won't jump onto the secure by default bandwagon when it's completely unneeded.

</comment><comment><USER3> Heh I just made the same thing for myself: [http://72848480.xyz](http://72848480.xyz)

</comment><comment><USER4> My go to site is [http://example.com](http://example.com)

</comment><comment><USER5> Why not just use a VPN?</comment>


Riverside.fm – Video Podcasting Tool - <AUTHOR> http://riverside.fm/ <comment><AUTHOR> I just started using this platform for my podcast. It allows me to record video locally for my podcast. It's pretty cool.</comment>


Show HN: Avremu – An 8-Bit Microcontroller in Pure LaTeX - <AUTHOR> https://gitlab.brokenpipe.de/stettberger/avremu/tree/master

<comment><USER2> That reminds me of this, a slightly bigger AVR emulating an ARM SoC running Linux:

[http://dmitry.gr/index.php?r=05.Projects&proj=07.+Linux+on+8...](http://dmitry.gr/index.php?r=05.Projects&proj=07.+Linux+on+8bit)

Emulate _that_ system instead, and now you can theoretically boot a Linux system inside of TeX.

<comment><AUTHOR> I already considered that, but until now i did not implement many peripheral devices. But when implemented those, it should be possible. But at the moment i'm rather thinking of an VHDL netlist emulator in TeX.

</comment></comment><comment><USER3> In the 1990s, when I was in college, I wrote a 6502 emulator in a text editor macro language (the text editor was QEdit, a DOS editor that was popular at the time). It was completely useless but a lot of fun.

There was a very low hard limit on the number of jumps (32, if I recall correctly) that complicated things. I eventually had to resort to a two step process, first translating 6502 code to a simpler virtual machine (using and abusing the find-and-replace command), and then executing that simpler code.

</comment><comment><USER4> I wonder if this could be modified to control actual hardware? It looks the `\write18` command can be used to execute shell commands if LaTeX is run with the `--shell-escape` option. So in theory you could intercept all writes to the GPIO control registers and use a shell command to send bytes over the serial port to a physical MCU (or something like the SparkFun SPI Shortcut.)

Imagine a LaTeX document that, when processed, reads a series of measurements from a sensor over the serial port, then renders nice graphs directly to a PDF! :)

<comment><USER5> I was looking for this workflow for my research, and ended up going with an ipython notebook.

</comment></comment><comment><USER6> To be pedantic: this code is largely in TeX, not LaTeX.

<comment><AUTHOR> This is true, but largly in TeX and only Parts of it in LaTeX is still LaTeX. But you're right, I did use only a few rudimentary features.

<comment><USER6> I think this is the minority view of LaTeX: it's built on top of and is a subset of TeX, not a superset. No one would ever consider \def to be LaTeX for example.

Not to denigrate what you produced of course.

<comment><USER7> I've always thought of LaTeX as more of a superset, but I see where you are coming at (I've read the TeXbook)

</comment></comment></comment></comment><comment><USER8> This is mental and I love it.

</comment><comment><USER9> Nice work, though I liked the dataref package even more!

<comment><AUTHOR> The dataref package is intended to be useful (and it acutally is). Avremu was only a long trip in sweden without internet, an editor and a reference manual.

</comment></comment><comment><USER10> We need more of this.

</comment><comment><USER11> this is cool and you seem obviously intelligent, have you considered making something people want?

<comment><USER12> sometimes, cool is enough :) I might actually want this though. C is much more convenient than TeX to code in, and yet sometimes you have no choice. Until now.

</comment></comment><comment><USER13> why?

<comment><AUTHOR> Sweden, Too much time, Masterthesis was submitted.

</comment></comment><comment><USER14> "Are you insane? Not that anybody knows of."

hahaha that cracked me up, especially that i actually considered the possibility when i read the title.</comment>


Show HN: RedditKit – Ruby and Objective-C libraries for the reddit API - <AUTHOR> http://redditkit.com

<comment><USER2> You've saved me from building my own. This is amazing, thanks.

<comment><AUTHOR> Thanks man, I'm really glad you like it.</comment></comment>


Ask HN: What is your favorite screen recorder? - <AUTHOR> To build video tutorial, what software and tools do you use? <comment><USER2> [http://www.maartenbaert.be/simplescreenrecorder/](http://www.maartenbaert.be/simplescreenrecorder/) my version only works with X11, not wayland though.

<comment><USER3> I took at look at this and had to try installing it on my Raspberry Pi. It worked great!

I couldn't get it to recognize my microphone but I didn't fiddle with that much. It was easy to capture an audio track on my Mac while recording the screen on the Pi and bring the movie over into Quicktime and sync them up.

I've been looking for a way to record the screen on my Pi so I thank you too!

</comment></comment><comment><USER4> I have recorded many hundreds of hours of content. I first used Quicktime on MacOS, it worked well enough. Great quality, fast, and easy to use.

More recently I moved over to OBS, which I consider to be far superior to Quicktime for one important reason: more control over audio settings. With OBS I can use just about any mic and get reasonable sound quality with a few tweaks. At present, I'm using a $20 headset and it works just fine.

</comment><comment><USER5> OBS has been useful, so has Overwolf, but I think the best tool I've used has been Quicktime on OSX. It's much easier to use than most things. My go-to on Windows is the XBox Game DVR recording functionality but I only use it because the alternatives are pretty slow.

</comment><comment><USER6> shareX for windows! Been using it for prob 10 years and its donate-ware

[https://i.imgur.com/qOQIWoi.png](https://i.imgur.com/qOQIWoi.png)

records in MPEG or GIF and lots of screenshot options as well. auto-upload to lots of free sharing sites if you choose. for screenshots I use Windows10 built-in "snipping tool" you dont get any simpler than that.

</comment><comment><USER7> For simple recordings, I use [https://screencast-o- matic.com](https://screencast-o-matic.com)

</comment><comment><USER8> My answers are platform-specific:

For Windows: Camtasia

For macOS: Screenflow

</comment><comment><USER9> Screenflow or Quicktime.</comment>


Ask HN: Developing on VPS with Vim and tmux? - <AUTHOR>

I'm a freelance web developer. I primarily develop locally using Sublime Text 3 but I'd love to change this and be able to develop entirely remotely on a VPS. I've tried a couple of times to get into using Vim but I've found it quite difficult.<p>How many others are developing like this and what tools and resources can you recommend? <comment><USER2> I'm a Ruby developer and 100% of my workflow I spend in the Vagrant with the Ubuntu server and zsh/tmux/vim environment which is virtually the same what you are talking about here. I use my own dotfiles [https://github.com/smileart/omg/tree/develop](https://github.com/smileart/omg/tree/develop) setup (still quite peculiar and raw but can be used as a source of inspiration for your own installation).

I suggest starting with basic operations in the vim without learning all the possible key bindings and plugins and then quite slowly googling or asking someone all your practical questions and emerging issues as they appear (based on the premise that everything is possible and there are always more than one good way of doing things). Like: how to quit, how to delete a line, how to search for something, how to replace/select/move and so on and so forth. It would help you to know just what you need and not to distract yourself with learning excess things.

Then start to explore possibilities and useful plugins for your language and particular case. Good resource for it is: [http://vimawesome.com](http://vimawesome.com) Then you will form your own setup and configuration and since then there is no way back :D

Good luck!

</comment><comment><USER3> After you're done with vimtutor, check out the book 'Practical Vim' by Drew Neil. Also check out his vimcasts.org site, which has some great screencasts for free.

</comment><comment><USER4> I'd start with `vimtutor` and [http://tmuxcheatsheet.com/](http://tmuxcheatsheet.com/)</comment>


Japan, Refutation of Neoliberalism (2005) - <AUTHOR> http://www.paecon.net/PAEReview/issue23/Locke23.htm <comment><USER2> >This is a formidable set of potential liars, equipped with money, technical expertise, transnational reach and state power. The Japanese government is centralized, elitist, and quite capable of fudging statistics if it wants, particularly since there are few Westerners who understand Japanese accounting. National accounting is notoriously susceptible to creative accounting anyway, as the world learned at the time of the Asian Crisis of 1998. So the assumption that the standard published figures about Japan's economy are true is dubious at best.

I'm very skeptical of any theory which requires me, from the outset, to assume that all the published statistics are deliberate lies.

<comment><USER3> There are quite a few other bright red flags here. For example:

\- the author claims that the growth of net exports is incompatible with a stagnating economy, because the economy is "export-centered." In 2012, Japanese exports were worth around $800 billion; Japanese GDP was almost $6 trillion. I don't find it particularly unbelievable that 15% of the economy can do better than the other 85%.

\- the author claims that "although a declining Japanese economy would imply a declining yen, the reverse has been the case." This is one of those things that drives economists crazy. Non-economists associate "strong" currency with economic "strength" essentially because it feels right. But there is _no_ reason to expect this relationship in reality. The USD became 30% more valuable between 1930 and 1932--that was not an indicator of economic strength. Inflation expectations for the USD fell dramatically during and after the financial crisis--that was not an indicator of economic strength. (In fact, the persistently low rate of inflation in Japan is a sign of low aggregate demand.)

<comment><USER4> Wallerstein's explanation of the overall greater advantages of a strong currency: ([http://dollarsandsense.org/blog/2009/05/the-sinking- dollar-w...](http://dollarsandsense.org/blog/2009/05/the-sinking-dollar- wallerstein.html))

</comment></comment></comment><comment><USER5> Very interesting, I'd love to hear an update on the author's views several years after he's penned that.</comment>


Ask HN: Hypothetically, could cancer be "controlled" to repair the body? - <AUTHOR> Would it be possible to introduce "controllable" forms of cancer to repair parts of the body that are otherwise too complicated to approach? <comment><USER2> Cancer is not really a disease, it's not a virus or a bacteria. It's just a collection of cells with broken apoptosis (cell death).

While you could theoretically make cells do anything (within the limits of biology), stem cells is what you should be thinking of. Or nanobots.</comment>


Hylogen: Haskell EDSL for live-coding fragment shaders - <AUTHOR> https://github.com/sleexyz/hylogen <comment><USER2> Very cool. I mainly use Extempore [1] for livecoding visual and audio, but this would be a great complement to Tidal [2], a Haskell-based livecoding system for audio.

I wonder how difficult it would be to marry the two, instead of separate windows with web sockets, so you could inline Tidal code as you build your shader in the same editor? Sort of what Shadertone [3] does by combining the Clojure-based audio generating Overtone, with a Shadertoy GLSL interface. The graphics are right behind the text in the editor window.

I would suggest Euterpea [4], the Haskell-based music coding environment, but it is not as suited to livecoding as Tidal is. Nonetheless, a great Haskell environment. Great work!

[1] [http://extempore.moso.com.au/](http://extempore.moso.com.au/)

[2] [http://tidalcycles.org/](http://tidalcycles.org/)

[3] [https://github.com/overtone/shadertone](https://github.com/overtone/shadertone)

[4] [http://www.euterpea.com/](http://www.euterpea.com/)

<comment><USER3> yoo author here! I haven't played with Tidal, though I have done livecoding audio with Vivid[1], a Haskell-to-supercollider DSL.

Never heard of shadertone; thanks for the link! Always cool to see another point in the livecode space.

You could definitely do livecoding of visuals and audio in the same haskell file! One interesting idea is to define a light higher level DSL/collection of functions that would allow one to actually program both simultaneously, as in write a line of code that affected both audio and visuals.

[1] [https://hackage.haskell.org/package/vivid](https://hackage.haskell.org/package/vivid)

<comment><USER4> Tidal user here. Would love to see these working together!

Edit: if you didn't yet, join livecode.slack.com!

</comment></comment></comment><comment><USER3> Here's a short demo reel with audio-reactive shaders made with Hylogen:

[https://hylogen.com/](https://hylogen.com/)

(works with Chrome, Firefox, Safari)

(includes a GPU Game of Life implementation!)

<comment><USER2> Using Chrome, I could only see two examples, but they were cool. Thanks!

</comment></comment><comment><USER5> Worth pointing out that sleexyz's live performances with Hylogen are AMAZING and you should totally check them out if you're in NYC.

</comment><comment><USER6> The examples appear to only run on Chrome (not available on this PC).

Other than that, it looks cool from what I could read.

</comment><comment><USER7> Finally! Been wishing for something like this for a while, good job!</comment>