Vulnerability scanner for Linux and FreeBSD - <AUTHOR> https://github.com/future-architect/vuls <comment><USER3> TL;DR "Give a single machine root access across your entire enterprise so you don't have to manually check each machine for security updates in the vendor- supplied packages"

Instead of dealing with this thing, I suggest looking at some existing system management tools like Landscape for Ubuntu or Spacewalk for CentOS/RHEL to handle managed updates... or learning how to set up a cron job to email you when security updates are available.

<comment><USER4> Also, it means that one machine is going to have to be ssh'ing into every server that you have on a constant basis, which creates load on that centralized server doing computational part of the ssh connection setup and tear down and all the encryption and hmac'ing. And ssh is not designed to be a lightweight protocol, and it would be simply awful to try to maintain persistent authenticated ssh connections from the management host to every server being monitored.

Really "agentless" is all a lie. The "agent" in most cases is usually sshd and you can really do better.

Also for this kind of software it makes sense to simply leverage the underlying configuration management system the admin is using. If they're using chef/puppet/cfengine they push out the client over the top of an agent- based protocol. If they're using ansible or salt they'll deploy it "agentless"-ly.

They've actually done more work to support this root-trust remote management model when they could have simplified the problem domain to just running their code (as an agent) and reporting on the one host its running on.

It seems to have been developed to tick off a buzzword ("agentless") which could have been avoided altogether.

</comment></comment><comment><USER5> "Vuls doesn't support SSH password authentication. So you have to use SSH key- based authentication. And also, SUDO with password is not supported for security reasons. So you have to define NOPASSWORD in /etc/sudoers on target servers."

No thank you.

<comment><USER6> Alternatively - <USER2>

<comment><USER5> I was complaining more about the sudo part. Probably should have just had that in the quote.

<comment><USER7> I think you misunderstood Perixoog's comment. Sudo uses PAM to ask for the password. pam_ssh_agent_auth is a PAM module that uses ssh-agent authentication instead of a password. Perixoog is saying that instead of setting NOPASSWORD, you could configure pam_ssh_agent in /etc/pam.d/sudo, and have it use the pre-existing SSH authentication as the "password", instead of having it prompt for a password.

But the part I'm concerned about is that they seem to think that having password-less sudo is a security win.

<comment><USER8> _But the part I 'm concerned about is that they seem to think that having password-less sudo is a security win._

I thought they were saying they don't want people's passwords. People reuse them, naive people giving up an actual root password, etc.

Not sure they mean always using NOPASSWORD is good for security.

<comment><USER7> Sure, giving the password to an application is a mess. Because if the application is compromised, the attacker now has the application's sudo password (ie, the vuls user's password, not the root password), and that's a bad deal. But just having it NOPASSWORD wide open is strictly worse. A knee- jerk reaction is to avoid passwords because it's another attack surface that can be broken open, but in this case just getting rid of it is strictly worse. With SSH, disabling password auth is turning the locked door into a solid brick wall. With this, NOPASSWORD is taking the door off the hinges because you are afraid of someone picking it.

</comment></comment></comment></comment></comment></comment><comment><USER9>
        // install aptitude
        cmd = util.PrependProxyEnv("apt-get install --force-yes -y aptitude")

I really don't like saying bad things about someone's project, but a "scanner" really really really shouldn't be making configuration changes to boxes, especially without prompting.

<comment><USER10> I see. I will improve.

<comment><USER9> Excellent. Don't take the comments here too much to heart. Off the top of my head, a couple of things you could look at:

* Don't use root where you don't need to - can you parse package lists / vulnerability databases as a normal user?

* Would the design be better inverted? Systems push their list of installed packages / versions to your application to be checked.

<comment><USER10> Thanks :)

> * Don't use root where you don't need to - can you parse package lists / > vulnerability databases as a normal user?

Yes, Vuls can scan without root on FreeBSD and Amazon Linux. If you know how to scan without root on CentOS, Debian, RHEL, Ubuntu, please let me know. I also do'nt want to use root.

> * Would the design be better inverted? Systems push their list of installed > packages / versions to your application to be checked.

Not so easy. The package version, release name is not semantic versioning format.This is a output of show package versions command on Ubuntu.

      locales            2.13+git20120306-21
      login              1:18.104.22.168-1.1ubuntu7
      lsb-base           9.20160110
      make               4.1-6
      mawk               1.3.3-17ubuntu2
      mime-support       3.59ubuntu1
      multiarch-support  2.21-0ubuntu5

Impossible!!

<comment><USER9> But how is the command you mention getting that information? Couldn't you parse the package database in the same way?

<comment><USER10> Vuls parse the changelog of upgradable packages on Ubuntu, Debian, CentOS.

For details, see the flow chart in Scanning Flow section. [https://github.com/future-architect/vuls#scanning- flow](https://github.com/future-architect/vuls#scanning-flow)

</comment></comment></comment></comment></comment></comment><comment><USER11> Anyone know of good resources for securing USB and disk firmware? I've found the CCC presentations rather enlightening, as well as Andrew Huang's amazing work, but still feel like we live in the dark ages with respect to hardware security.

<comment><USER12> presumably an OS-level mitigation could intercept (some) attempts to write to drive firmwares, but I'm not aware of any actual implementations. it's a very ugly situation.

</comment></comment><comment><USER13> Hypothetical question: If all these OS software was written in a memory safe language like say rust, would it be possible to get rid of these 'off by two' and 'out of bounds' error completely making the world a better place?

<comment><USER14> Hypothetically, yes.

But please don't think of Rust (or anything else) as a silver bullet. If you are doing systems programming you are going to deal with unsafe code somewhat frequently. And, by not being exposed to this kind of programming often enough, it's possible that more errors will slip through the cracks.

Then there's a whole class of errors that cannot be prevented by memory safe languages. They cannot prevent crappy practices.

<comment><USER15> While true, it is quite different have to worry about lets say 10% of the code easy tracked down by unsafe blocks, or every time a string, array, memory allocation, numeric manipulation is performed.

</comment></comment></comment><comment><USER16> How does this compare with, e.g., `pkg audit` for FreeBSD? [https://www.freebsd.org/doc/handbook/security- pkg.html](https://www.freebsd.org/doc/handbook/security-pkg.html)

<comment><USER17> Freebsd doc says that their database is maintained by their developers. Vuln page shows it takes data from nvd. I haven't looked into the details, but a rough guess would be that pkg-audit is better is it's really kept up to date. Nvd's version patterns have lots of issues in my experience and often need manual verification.

<comment><USER18> If I understand the diagram in the README right, this one is no different. It just analyzes changelogs of not-yet-updated packages, which are in turn prepared by distribution maintainers. NVD is just used for adding details of the CVEs that has been found.

<comment><USER10> >NVD is just used for adding details of the CVEs that has been found.

yes.

Vuls issues below command.

      FreeBSD ... pkg audit -F
      RHEL ... yum plugin security
      Amazon LInux ... yum plugin security
      CentOS ... analyze changelogs
      Debian ... analyze changelogs
      Ubuntu ... analyze changelogs

</comment></comment></comment></comment><comment><USER10> VulsRepo is visualized based on the json report output in Vuls. [https://github.com/usiusi360/vulsrepo](https://github.com/usiusi360/vulsrepo)

It is useful to analyze vulnerabilities that are detected by Vuls.

</comment><comment><USER19> Spring for Nessus if you're looking for a solid vulnerability scanner.

</comment><comment><USER20> Use `pkg audit` on FreeBSD and read the "periodic" emails.

<comment><USER21> Or run pkg audit -F (with a nice random sleep) from your monitoring system.

<comment><USER10> FreeBSD's pkg command is awesome.

Vuls issues pkg audit -F and parse the results, and then send notification via slack or email with some additionarl informaiton ( NVD data )

</comment></comment></comment><comment><USER18> See debsecan for Debian

[https://packages.debian.org/jessie/debsecan](https://packages.debian.org/jessie/debsecan)</comment>


NSA Exposes Tool Used by Russian Hackers - <AUTHOR> https://www.bloomberg.com/news/articles/2020-05-28/national-security-agency-exposes-tool-used-by-russian-hackers <comment><USER2> Most intriguing part of the story is the new ability of governments to call each other out, the deterioration of diplomatic tone and language whereby nation states would never explicitly attack each other verbally. Since the the controversy with Iran, foes have been more like five year olds in their criticism for each other. I'm sure everyone is aware of the mutually assured destruction brought forth by conflict (no one really wants a war), but none of these leaders are willing to back down at any cost.

<comment><USER3> I'm not sure openly calling out other countries like this is really new. See for instance [1]:

> By 1987, the Soviets began to sour on the campaign as Moscow's scientific > establishment rebuked it. Secretary of State George P. Shultz also accused > Mikhail S. Gorbachev, who was then the leader of the Soviet Union, with > hawking "bum dope about AIDS." Mr. Gorbachev ordered the K.G.B. to stop > spreading the conspiracy theory and after the collapse of the bloc, former > Soviet intelligence officials owned up to it.

[1] [https://www.nytimes.com/2017/12/12/us/politics/russian- disin...](https://www.nytimes.com/2017/12/12/us/politics/russian- disinformation-aids-fake-news.html)

<comment><USER4> Ironic that nowadays the US government is the one promoting conspiracy theories about a pandemic. Even the theory is almost exactly the same: that the virus comes from a lab.

<comment><USER5> You're taking about the assertion that the virus spread from an accidental contamination at a lab in Wuhan. It is crossing into conspiracy theory territory to believe the assertion without proof. However, the theory itself is completely reasonable and sound. This is an unproven claim; a conspiracy theory is something different.

<comment><USER4> The theory is just as "reasonable" as the Soviet misinformation about HIV was. That is, not at all. It's a wildly implausible assertion that there's no evidence for.

People outside of labs are exposed to bat coronaviruses all the time. The chances that one of a very small number of highly trained researchers working according to strict protocols was patient zero - as opposed to the millions of regular people who come into contact with bat coronaviruses with absolutely no protection or training - is minuscule.

Just like the Soviet misinformation in the 1980s, the theory can't be disproven right now, in exactly the same way that any other malicious accusation made with zero evidence can't be disproven. The Trump administration is acting extremely recklessly by spreading this unsupported conspiracy theory.

<comment><USER6> > implausible

Explain the previous sars releases then.

<comment><USER4> SARS spilled over naturally, not from a lab.

After it spilled over naturally, it became the subject of intense study, sometimes in labs with poor procedures. Huge amounts of SARS-CoV were being cultured by people with little training.

That's an entirely different circumstance from now. The lab where they study coronaviruses in Wuhan operates at a much higher standard than poorly run Chinese labs in 2004. The lab in Wuhan wasn't even conceived back then.

It's essentially proven that SARS-CoV-2 was not under study before the outbreak, because the it's not in any of the standard databases where all known coronaviruses are published. But even disregarding that, the idea that huge quantities of a virus that nobody has ever heard of would be cultured is implausible.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> The CVE is from mid last year: [https://www.exim.org/static/doc/security/CVE-2019-10149.txt](https://www.exim.org/static/doc/security/CVE-2019-10149.txt)

So I guess this is an attempt to get exim users to update.

<comment><USER8> Exactly this. By one estimate 1/4 of all MTAs on the Internet were running vulnerable versions of Exim.

</comment></comment><comment><USER9> Maybe I'm mistaken, but wasn't exim created as a more secure alternative to sendmail?

Edit: on a second thought, "more secure than sendmail" means nothing. It is probably impossible to be _less_ secure than sendmail.

<comment><USER10> My recollection it was billed as easier to setup than Sendmail. During the vote to make it default[1] it was also helped by being smaller than Postfix (at a time when Debian was still supporting floppy disks for installation). There may have been some (with hindsight naive) justification that the easier configuration would make systems more secure by avoiding common Sendmail pitfalls. But I don't think we were thinking about security 20 years ago the same as we do now. It was mostly a "if you can put it in a chroot you'll be fine" attitude.

[1] [https://wiki.debian.org/Debate/DefaultMTA](https://wiki.debian.org/Debate/DefaultMTA)

</comment></comment><comment><USER11> There is no evidence presented that Russia and the GRU used this. None. Could be true. Could be false. Could be trying to propagate this ridiculous "it's the Russians" narrative so prevalent to explain everything those in 3 letter agencies don't like politically. From the electoral unpopularity of Hilary Clinton, through why Wikileaks publishing secrets of their crimes is not in your interest to now why people are protesting (not record unemployment, not continuing police brutality, not the existence of an underclass in the richest nation on the planet no. Russians).

So yeah, could be true but if you laugh at anyone claiming *Russians" with no evidence to back it that's probably the safest thing to do.

No evidence at all of Russian hacking Hilary's email if you were paying attention in the last week or so other than from evidence free DNC claims. Maybe they did, sure. And maybe Saddam had WMD - believing that lie, and i did, cost us rather a lot. It would be silly to fall for it again.

</comment><comment><USER12> Heck, I'm impressed that enough people are running an MTA that touches incoming mail for this to be effective. It was never "easy", even in the 90s. Back then it was an issue of having a performant, secure config. But these days, it's way more complex and too much money.

I wouldn't think that many people are using fetchmail + local MTA anymore, but maybe I'm wrong.

I used to do it for my family, but maintaining an MTA, spam filtering, IMAP/POP, webmail, CalDAV & CardDAV is rough. And supporting folks hooking up their devices that increasingly needed to go 8 menus deep to punch in the settings for something that wasn't gmail/hotmail/outlook was just too much.

And then you can't run it out of your house, unless you pay money for static IPs, or you pay for hosting and make sure you keep yourself off blocklists. Just the cost of doing it made it not worth it unless you hit economy of scale number of users.

That said, sendmail did improve my M4 skills FWIW.

<comment><USER13> I recently paid for a Debian VPS instance, and when I logged in it had Exim already installed.

(I think it was running by default, too, but I don't trust my memory. I uninstalled it pretty quickly.)

</comment></comment><comment><USER14> Once again, this feels politically motivated. 1\. It's old news. 2\. They blame Russian hackers, but we rarely ever have full certainty into the true source of an attack. This is due to false flags (for example, the Germans adding some Russian comments to their code) and hackers routing their attacks via a daisy chain of compromised machines all over the world. 3\. The NSA are the worst offenders when it comes to exploiting software vulnerabilities.

<comment><USER8> This isn't some conspiracy theory. The NSA is simply doing what people have been asking of them for years: be more proactive and public on the defensive side of things. The fact they are also burning RU methods is just icing on the cake for them.

</comment></comment><comment><USER15> Exim is installed by default in many popular web hosting panel platforms, cPanel for example.

</comment><comment><USER16> You know what would be interesting?

Someone should do the following:

1) Get all of the source code for Exim, and other codebases, codebases for which vulnerabilities have been discovered -- but before the vulnerability has been removed from source code.

2) Run machine learning on the code, with the understanding that different parts of code may have been written by different authors.

3) Use those ML models to see if other codebases, codebases which are as-of- yet unknown if they contain vulnerablilties, to see if those might have the same coding patterns in certain areas as the affected software above, indicating potential tampering.

In other words, via ML, software which has been tampered with -- might be able to be detected preemptively...

Disclaimer: I am not a ML expert, and this might be a somewhat futuristic idea, due to various constraints...

</comment><comment><USER17> I haven't run across many who use Exim. Any benefits over postgress/dovecot?

<comment><USER18> EXIM is much easier to configure than postfix. Postfix is faster than EXIM.

They are both mail-trasport daemons (basically mail relays).

dovecot is comparable to Cyrus, it's not a mail relay, it's POP/IMAP server used for accessing mail from storage.

<comment><USER13> > EXIM is much easier to configure than postfix. Postfix is faster than EXIM.

You might have the two reversed?

I don't have hands-on experience with Exim, but every "getting started with email" document on the internet seems to recommend Postfix as easier for a beginner to install.

<comment><USER19> Before Debian made exim default and made an ungodly mess of macros and unintelligible crap out of their config, it was pretty simple to configure.

In fact, as an old hand (been dealing with exim configs since 2001), the very first thing I did and still do is delete the default debian hell and copy- paste a simple two-screen config which then needs only 3-4 lines tweaked.

</comment></comment></comment></comment><comment><USER20> So the NSA is doing what they actually should be doing?</comment>


Not as SPDY as You Thought - <AUTHOR> http://www.guypo.com/technical/not-as-spdy-as-you-thought/ <comment><USER2> This was on HN eight months ago, when the post was actually made. And the takeaway is pretty clear, you probably won't see a benefit in using SPDY in front of a site optimized in ways that don't take advantage of SPDY's strengths. If you want to see big improvements with SPDY (like Google does) then you need to adjust how you're serving your resources. Resource prioritization is a perfect example of this: [https://insouciant.org/tech/prioritization-is-critical-to- sp...](https://insouciant.org/tech/prioritization-is-critical-to-spdy/)

<comment><USER3> Seconded. Might as well look at our experience using SPDY over Nginx and its performance/impact etc.: [http://blog.bubbleideas.com/2012/08/How-to-set-up- SPDY-on-ng...](http://blog.bubbleideas.com/2012/08/How-to-set-up-SPDY-on- nginx-for-your-rails-app-and-test-it.html)

</comment></comment><comment><USER4> [http://www.belshe.com/2012/06/24/followup-to-not-as-spdy- as-...](http://www.belshe.com/2012/06/24/followup-to-not-as-spdy-as-you- thought/)

</comment><comment><USER5> Like others said, an old post. To be sure, he is testing the SPDY speed from a client to a SPDY proxy that then connects to a real HTTP site.

It makes no sense to correlate these results with real SPDY web servers serving real traffic.

</comment><comment><USER6> Http vs Spdy: He didn't mention http features like, keep-alive and pipelining both can make huge difference when sending data over connection having notable latency

<comment><USER7> pipelining can break sites because of broken proxies that don't understand pipelining (and there are many). without pipelining, keep-alive only saves you from extra TCP connections. This is a big improvement, but not enough to go all the way to what SPDY offers.

</comment></comment><comment><USER8> Yeah, this is a pretty old post.. Domain sharding, which is how resource rich sites enhance parallel loading, doesn't suit SPDY at all.

<comment><USER7> domain sharding has been unnecessary since 2011 when browsers increased the number of parallel connections they make to a single domain. With these increased connections, domain sharding might end up hurting performance if all shards point to the same IP address. This is so because many home wireless routers and DSL modems start dropping packets if too many SYNs go out to a single IP without an ACK coming back -- they think the client is mounting a DoS attack and try to block it.</comment></comment>


Wear a mask while having sex and avoid kissing, Canada's top doctor advises - <AUTHOR> https://edition.cnn.com/2020/09/03/health/coronavirus-masks-sex-canada-trnd/index.html <comment><USER2> To my surprise, although I don't know why anymore, it's not actually an Onion article.

</comment><comment><USER3> I advise also keeping a minimal distance of 1.5 meters

</comment><comment><USER4> > "The lowest risk sexual activity during Covid-19 involves yourself alone," > [Dr. Theresa Tam, Canada's Chief Public Health Officer] advises.

Hilarious.</comment>


Ask HN: Perl 6 looks interesting. But what's the current status? - <AUTHOR>

Last night I read the open source perl6 book and played some with it. It definitely looks different and more expressive compared to the languages in the same league - perl5, python and ruby.
Changes to regex and rules & tokens make pattern matching pleasant. Grammars bring formal parsing to mainstream. The perl6 OOP way looks promising.
But on the other hand, the status page doesn't say anything meaningful - http://dev.perl.org/perl6/status.html. The wiki shows timelines only till 2007 - http://www.perlfoundation.org/perl6/index.cgi?when_will_perl_6_be_released
I can't find any information about using existing cpan modules with Perl6 or a replacement; I did stumble upon a mailing thread about perl5to6 conversion tool or something.
So, overall, what's the time-frame we are looking at when perl6 can safely be used for a new project? It looks like north of 2 years to me. <comment><USER2> What kind of project do you have in mind?

One of my client projects needs an object serialization and indexing mechanism, a (stronger) HTTP library, a file-based cache, and a wrappers for a couple of POSIX functions for me to port it from Perl 5 to Perl 6. As it's a project for a client, the opportunity cost for writing those libraries themselves has been too high to justify porting to Perl 6.

<comment><AUTHOR> But won't these concerns arise in almost all of the projects? The lack of libraries? It rules out doing web based projects - no framework(I don't think catalyst for perl6 is there yet), no supporting libraries(esoteric orm, multiple db backends, playing well with other components viz. 0mq, gearman, memcache etc).

I think Perl 6 in the current incarnation is only suited for some algorithmic, stand-alone mini-projects which are basically raw code and don't depend on external components.

What's the plan for cpan for Perl 6? cpan6.org is dead. Google is at loss of words when asked about it. I found only 2 relevant results - 1 was about should perl 6 use cpan and other was a stack overflow thread. I found this modules page - <http://modules.perl6.org/>, but the coverage is severely limiting.

I wanted to put perl 6 in practice but looks like it isn't happening in the coming 2 years. I can work on mathematical/algorithmic problems, but then most of the algorithmic problems I need to solve need to be integrated in production code and hence, I would rather solve it in python(or whatever the codebase is) rather than playing with perl 6.

As of now, the cons outnumber the pros, but for sure, perl6 is going to have an interesting future.

<comment><USER2> _I wanted to put perl 6 in practice but looks like it isn't happening in the coming 2 years._

I don't see the connection between "Perl 6 doesn't have every module Perl 5 has right now" and "I can't use this for two years". Perl _5_ doesn't have every library I need (and certainly didn't when I started using it 12 years ago).

Now you can use _some_ Perl 5 modules from Rakudo right now, and people are writing more Perl 6 modules (and Perl 6 has as core language features many of the modules used in modern Perl 5). The question is what you need for any specific project.</comment></comment></comment>


Looking for a summer job? Don't. - <AUTHOR> http://www.college-startup.com/creativity/looking-for-a-summer-job-dont/ <comment><USER2> What a bunch of bullshit. Some people have to work in order to pay for college and can't risk not having the money to pay for tuition.</comment>


Call Them the Beatles of Electronic Dance Music (1997) - <AUTHOR> https://www.nytimes.com/1997/06/15/arts/call-them-the-beatles-of-electronic-dance-music.html <comment><USER2> For anyone who doesn't want to read the article to find out who, they're talking about Kraftwerk.

<comment><USER3> Thanks for saving me the click.

</comment></comment><comment><USER4> I was at that concert. It was the best concert i have ever been to. Everything you usually think of as essential for a great concert, like stage energy, and the personalities of the band, was entirely absent. Instead it was Minimalistic, focused, an exercise in precision. It was probably closest to a religious ceremony. It made you "get" songs you didn't think was that special before.

The best part was when they left the stage and left only four displays, showing images of their robots during "we are the robots". Then as the song ran out 5 minutes later, the screens slowly lowered and revealed the 4 real robots back lit. The crowd went nuts and they started the German version of the song.

I have seen them 5 times, all amazing, but that first time will be with me forever.

</comment><comment><USER5> Kraftwerk is not dance music. Yes people have tried:

[https://youtu.be/z6sQy5cd8ic](https://youtu.be/z6sQy5cd8ic)

[https://youtu.be/jdjEqP6mhV4](https://youtu.be/jdjEqP6mhV4)

EDM began with Giorgio Moroder's "I Feel Love" in 1977. At 2:30 in the video here he describes the moment the song came together:

[https://www.theguardian.com/music/2018/oct/10/giorgio- morode...](https://www.theguardian.com/music/2018/oct/10/giorgio-moroder- announces-first-ever-live-tour-at-78)

Drum machines go back to Sly and the Family Stone in 1971 or George McRae "Rock Your Baby" in 1973.

"Popcorn" by Hot Butter was not dance music. John Michael Jarre was not dance music. And Kraftwerk was not dance music.

Little known: DJ Kool Herc invented breakbeats (please do watch this video):

[https://youtu.be/Hw4H2FZjfpo](https://youtu.be/Hw4H2FZjfpo)

<comment><USER6> > _Kraftwerk is not dance music._

It's an American thing. Popular US audiences after having discovered electronic/dance music in the mid 2000s (after 20+ years of it being huge in Europe [1]), they call everything "EDM".

Stuff for which Europe has names for decades, and has split into 10s of genres (from techno, house, and trance, to garage, 2-step, hardstep, dubstep, goa- trance, big beat, and dozens of others). is all bundled under the "EDM" moniker. Whereas in Europe, if used at all, the term EDM would refer to the BS played at big festivals...

[1] Of course Techno and House originated in the US, but compared to Europe they have been fringe there for the longest time, it was all rock/country/soul/hip hop in the US as far as popular audiences are concerned. In the US those genres were only for clubs (and not that many at that), not charts...

<comment><USER5> In the US, the term EDM is also used mostly to refer to the BS played at big festivals.

But no matter how you define the terms, Kraftwerk is not dance music. They are awesome, and pioneers of electronic music. Just not dance music.

<comment><USER7> That's really not true. People were definitely dancing to Kraftwerk in clubs in the late 70s and 80s. I know because I was one of them.

Those albums are only "not dance music" because they don't have the stereotypical disco cliches of the era. But they were very popular for dancing. And they were absolutely influenced by disco, because the band spent a lot of time in disco clubs after recording sessions.

By the time you get to Numbers on Computer Love the techno/disco influence is a lot more obvious, and it's a real stretch not to call that track core EDM. And the remixes on The Mix are straight-down-the-line early EDM.

Kraftwerk are unusual for creating a unique style that blended elements of disco/techno with proto-synth pop, classical music, and a weirdly ironic modernist Schlager.

Most EDM is more either more formulaic or it lacks the strong melodies and inspired feel for structure and form that makes Kraftwerk stand out. They put it all together, made it work, added the kind of branding and imagery that's usually labelled "iconic", and eventually updated it with video to turn it into a kind of conceptual art project - which is why they've spent as much time performing in big galleries as at festivals.

<comment><USER8> > _Most EDM is more either more formulaic or it lacks the strong melodies and > inspired feel for structure and form that makes Kraftwerk stand out_

Those qualities that make Kraftwerk stand out are what sets them apart from the genre of EDM! From a pre-2010 USian perspective, coldtea's comment is on point.

But looking up the term, apparently it does now refer to more than just one genre. But that itself feels like a forced result of commercialization - Wikipedia: By the early 2010s, the term "electronic dance music" and the initialism "EDM" was being pushed by the American music industry.

Unfortunately it's also exclusionary to electronic music that isn't primarily intended for dancing, which is why you're arguing over whether people were dancing to Kraftwerk.

</comment></comment></comment></comment></comment><comment><USER9> "Call Them the Beatles of Electronic Music"

Fixed that for you.

</comment><comment><USER10> Kraftwerk were absolutely going for the comparison, which is why they were a quartet, while only two of them really wrote and produced the music.

</comment><comment> the-dude Nihilists</comment>


Mark Cuban: If I were responsible for Box's Bad Numbers, "I would combust" - <AUTHOR> https://twitter.com/mcuban/status/448271766557696000

<comment><AUTHOR> Should be noted that Cuban was Box's first seed investors giving Levie and company $350K, but he pulled his investment just a year later: [http://pando.com/2014/01/31/box-is-the-unicorn-that-mark- cub...](http://pando.com/2014/01/31/box-is-the-unicorn-that-mark-cuban-let- get-away/)</comment>


JOLED Demos 21.6-Inch OLED Monitor for Gamers - <AUTHOR> https://www.anandtech.com/show/13751/joled-demos-oled-monitor-for-gamers <comment><AUTHOR> _JOLED, a joint venture between Sony and Panasonic, has demonstrated multiple PC-oriented printed OLED-based monitors at Finetech Japan trade show. Among other things, the company exhibited OLED displays for gamers, home applications, and professionals. Some of the products are already on the market, or are about to be released, and others are prototypes._

I don't think I've seen any of these products actually on the market.</comment>


Critical: Vulnerabilities in Windows TCP/IP Could Allow Remote Code Execution - <AUTHOR> http://www.microsoft.com/technet/security/bulletin/ms09-048.mspx <comment><USER2> I _reallllllllly_ want to know if the TCP/IP Timestamp Options vulnerability --- the one where they keep a stale function pointer in memory that winds up controlled by an attacker --- refers to the IP Timestamps Option or the TCP Timestamp Option.

The IP Timestamp Option is more likely --- it's crazy complicated (among other things, you can play tricks with IP timestamps to determine whether two IP addresses are virtually hosted on the same machine). The good news about IP Timestamps is your router probably doesn't pass packets that have that option set.

<comment><USER3> There is a good chance that they just put the pointer itself in a timestamp field, presumably allowing the responder to tweak it to point at something else.

<comment><USER2> My read of the advisory was that it's a memory lifecycle issue --- having to do, as the advisory said, with not cleaning up state properly. Which, come to think about it, suggests that it's TCP timestamps --- IP timestamps are stateless.

</comment></comment></comment><comment><USER4> Whenever I see a bug this serious I always wonder if it's been floating around in the wild all this time.

<comment><USER5> Of course. I doubt they _just_ introduced it, considering it affects operating systems stretching back a decade.

<comment><USER3> Well, actually no, not a decade. Remote execution vulnerability was clearly introduced in Vista, most likely due to the much touted network stack rewrite.

</comment></comment></comment><comment><USER6> Does the vulnerability stretch back into any of the BSDs it was forked from? :)

<comment><USER7> Actually unlike the previous TCP/IP stack I believe the Vista/Win7/Serv2008 stack is new from the ground-up.

<comment><USER8> They rewrote it so carefully that they duplicated the same teardrop bug they created back in windows 3.1/95 and didn't fix for half a decade.

</comment></comment></comment><comment><USER3> Note how XP does not have this particular vulnerability.

<comment><USER9> XP is affected by this but XP is not vulnerable in the default configuration because there is no service listening set up with the firewall by default and the firewall is on by default. I am curious to see if this causes problems for Microsoft down the road.

</comment></comment><comment> cool-RR I thought that was the title of all Windows hotfixes.

</comment><comment><USER10> You know, I just don't get it, Microsoft is reputed to hire pretty smart people, but somehow this slips through? This is on the border of professionally negligent. I can see if my foomatic open source project allows someone to run remote code (hell, even IIS or maybe apache for that matter), but the TCPIP stack itself? sheesh....

<comment><USER11> It's hard to find this sort of thing statically in C code, especially if your static analysis tool is configured to treat C typecasts as necessarily correct because there's no syntax in C for expressing how dangerous a cast you intended, unlike C++. Of course, I don't know whether this code is C or C++.

</comment></comment><comment><USER12> I wonder if this particular vulnerability can be stopped by a firewall.

<comment><USER2> If it's IP timestamps, then certainly yes --- your firewall should be blocking this by default.

</comment></comment><comment><USER13> So what? MS found a security bug. Lets look on linux forms about all the security exploits fixed here and there.

MS fixed a critical bug. Yay. Why complain? Its better than Apple ignoring security bugs for years :)

<comment><USER14> Remote code execution vulnerabilities on widely-used systems is generally noteworthy.</comment></comment>


Air pollution causes 'huge' reduction in intelligence: study - <AUTHOR> https://www.theguardian.com/environment/2018/aug/27/air-pollution-causes-huge-reduction-in-intelligence-study-reveals <comment><USER2> What's really amazing to me is when you realise that the UK executive and legislative branches are based in London. MPs, Lords, and often their partners and children are all living and working in an extremely polluted environment for years on end. Even so, with the knowledge that they are seriously harming their own health and the health of their closest relatives, they persist in resisting and blocking attempts at actions to improve air quality in London.

Whenever somebody defends the quality of democratic representation in the UK, I just remind myself that these are people who would rather they and their own children suffered illness and premature death than take action that might piss off business and motorist lobbying groups.

<comment> Al-Khwarizmi I think you're overthinking this a bit. I don't think politicians prefer seeing their children suffering illness and premature death rather than pissing off lobbies. The real problem is that most people see the results of studies like this as something abstract, not as something that affects them directly. It's clearly visible with smokers: it's not that they are especially tolerant of dying a horrible death from lung cancer or a stroke (no one is), it's mostly that they don't really think it will happen to _them_ (yes, I know it might be an imperfect analogy because physiological addiction also factors in... but I also know a smoker that found quitting "physically impossible" until he had a stroke, and survived. Once he had saw death's face, and the risk turned from abstract to very concrete, he quit smoking overnight).

<comment><USER3> It doesn't help that studies like this are also usually wrong. Don't change anything in your life until something has been replicated a dozen or more times.

<comment><USER4> There's a Pascal's wager in this situation. In the worst case, there's no cognitive effect from pollution, but you clean up the environment anyway. Even without the possibility of improving your ability to reason, there are many other obvious benefits to reducing pollution, quitting smoking, and many other major changes about which the effects have been debated and exaggerated over time.

<comment><USER5> > There's a Pascal's wager in this situation. In the worst case, there's no > cognitive effect from pollution, but you clean up the environment anyway.

And, as with Pascal's wager, that's unconvincing: one could spend all that money differently, on things one would like (just as in Pascal's wager, choosing to believe in God isn't cost-free: it means loving others, being charitable &c., even if one would rather not).

</comment></comment></comment></comment></comment><comment><USER6> > Chen said air pollution was most likely to be the cause of the loss of > intelligence, rather than simply being a correlation.

Why? You can't just say that and expect people to trust you. The fact that they followed the same people may reduce the chances of certain DNA traits having an effect but how does that rule out other commonalities in environmental conditions. If you're in a polluted city it seems likely that you're in a large city. So do all the common traits of a large city also reduce your intelligence?

I want to read the study but I don't want to subscribe. If there is logical proof in the study that this is not simply a correlation, the guardian piece does not represent it.

<comment><USER7> The Guardian is headquartered in London, which is a major polluted city, maybe the effects are becoming visible.

<comment><USER8> That's vastly insufficient as far as empirical evidence is concerned. There are many things that coincide with pollution, which is what the commenter is saying. You need to demonstrate how you picked out pollution from everything comingled with it. That's what's being asked about here.

EDIT: Disregard this stuffy reply, my humor detector was off.

<comment><USER9> The response was tongue-in-cheek: the commenter implied that the article was insufficient due to the journalist being less intelligent due to living in a polluted city.

<comment><USER8> Hah, I see it now. Shame you had to spell that out for me :)

</comment></comment></comment></comment></comment><comment><USER10> There was a recent large scale study that claims PM2.5 levels present in cities have a significant effect on healthy children's lung capacity, that by the age of eight children who live within 100 meters of a busy street have a 6% reduction in lung capacity compared to those who don't. Now this study. Jeesh.

I am particular interested in these studies because my family lives in a very clean rural mountainous area in Thailand and my son is attending a pretty good international school here. But I am considering moving him to a bigger and better school in Bangkok - a dirty, polluted, congested city. If this study is true then am I really gaining anything? The difficult tradeoff was health impact for improved educational opportunity. But if the pollution equates to a one year loss of education then maybe there is little to no gain.

<comment><USER11> I have a lot of experience tutoring math in small classes to many students, including a couple who went on to earn gold medals in International Physics and Chemistry Olympiads. (I no longer teach due to my current research and startup work.)

I'd say your child would gain much more from having good private tutors you hand-pick from local schools/universities/private tutoring centers (depending on the level of your son's attainment and the qualifications of the teachers). Also, for certain subjects, you could be a great teacher yourself.

Even without taking pollution impact into account, using the hours saved from commuting in a very congested city to study one-on-one or in a small group would likely net a bigger gain than what quality difference there is between the good local school and a top school in the capital city. The key conditions are 1) having qualified tutors who fit with the student's personality and interests and 2) regular schedule so the student does not spend the extra hours playing mobile games instead.

Another key advantage is your child can use the best educational materials available on the Web, paid and free, such as Khan Academy, 3Blue1Brown, and the likes for learning. The presentations there are often head-and-shoulders above the techniques most school teachers typically use to explain concepts in class.

Edit: For a downvoter who I assume might disagree with the last paragraph, you need to go visit average schools in a developing country to see how the teaching is like.

<comment><USER10> I am glad to read your suggestions, coming from someone with experience. And indeed I have been doing some of this. The teachers at his school are very good. It's other issues that I'm not satisfied with (detailed in my other comment [https://news.ycombinator.com/item?id=17867556](https://news.ycombinator.com/item?id=17867556)). I do teach him a lot. I'm an EE and can write code. So I have had him do a bunch of code.org, robotics projects, maker projects, and we do lots of reading together. He's strong in those areas. Currently do tutoring only in Chinese and music. And yes, he has pretty strict limits on game playing time. So maybe I should stay the course as you suggest, supplementing as needed.

<comment><USER12> Keep in mind that one good thing about air pollution is it's relatively straightforward to mitigate once you're aware of the problem. PM2.5 filters can be had for relatively cheap (see Smart Air), and you can wear a mask when you're out on bad days. Unless you're really lucky, his peers in Bangkok probably won't make him feel great about wearing a mask, but just having clean air at home will help a lot. Then maybe you can talk the school into filters, plus policies about athletics on bad days. I'd be surprised if they don't have these already.

</comment></comment></comment></comment><comment><USER13> This is no surprise to people who have lived in Salt Lake City. During the winter, as a consequence of inversion (pollutants being trapped in the mountain basin), it becomes the most polluted city in North America. During this time, resident IQs also drop. [0]

[0] [http://health.utah.gov/enviroepi/healthyhomes/epht/AirPollut...](http://health.utah.gov/enviroepi/healthyhomes/epht/AirPollution_PublicHealth.pdf)

<comment><USER14> > During this time

Do they perform on the normal level after the pollution? That would be a hint that the results of the IQ tests just temporarily drop (I would be careful to say that the intelligence dropped).

<comment><USER13> Correct. To be clear, this is a reversible and temporary response to the air quality.

<comment><USER14> This puts the article in perspective.

If people leave the polluted area, they'll restore their normal intelligence. When I hear "reduction in intelligence", I immediately think that they talk about permanent reduction (because a big part of fluid intelligence is genetics, the efficiency of synapses and the amount of neurons - although some research [1] indicates that nurture and training can have significant effects on fluid intelligence).

It's unclear if they talk about permanent and irreversible damage IMO. For me it seems like they want to frame it that way which could be a bit clickbait-y depending on the matter of facts.

[1]: [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2383939/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2383939/)

<comment><USER15> From the study TFA is based on (on Sci-Hub: [https://sci- hub.tw/http://www.pnas.org/content/early/2018/08...](https://sci- hub.tw/http://www.pnas.org/content/early/2018/08/21/1809474115) )

 _First, in general, air pollution inhibits respondents ' test performance. Except for the effects of 1-d and 7-d air pollution exposure on math test scores (first and second columns in panel B), all of the coefficients for mean APIs over a longer period are negative and statistically significant._

 _Second, the damage of air pollution on cognitive performance is more sizable when using longer window of exposure measure. As shown at the bottom in panel A, an increase in the 7-d-mean API by 1 SD lowers verbal test scores by 0.278 point (0.026 SD), while a 1 SD increase in average API over 3 y before the interview is associated with 1.132 points (0.108 SD) drop in verbal test scores._

 _Third, air pollution exposure appears to exert a more negative effect on verbal test performance than math test performance._

That doesn't imply that the effect is irreversible, but it does mean that there are long-term changes which accumulate with longer exposure to air pollution.

<comment><USER14> Thanks. If air pollution decreases cognitive capacity in the short term, it's clear that learning efforts have a lower return on investment for that period of time. This means it directly affects parts of the crystallized intelligence. It's like a temporary learning disorder which inhibits neurogenesis and decreases working memory.

Please correct me if I'm wrong. Sounds very interesting and I hope that people will finally fight against air pollution. Undoing it is not only healthier but also economically relevant. Sad that such studies seem to be necessary, but it's good that such revelations lead to more pressure for the policy makers.

</comment></comment></comment></comment></comment></comment><comment><USER16> As an Indian living in India, this saddens me a lot. India has perhaps the world's biggest share of most polluted cities [1], and there are next to none measures taken. PM 2.5 in Delhi regularly shoots beyond 200 (while general guidelines for good quality air is <50).

The sad part really is that the pollution is more of a political and enforcement problem than a technological one. And none of the wonders of our technology will help us solve the "messy" problems that occur in a democracy of heterogeneous people (of India).

<comment><USER17> What does heterogenous have to do with it? U.S. is by far more of a melting pot than India.

<comment><USER18> > U.S. is by far more of a melting pot than India.

What do you mean? Basically the only reason India is one country is because the British ruled it as one country. It is about as culturally and linguistically diverse as all of Europe.

<comment><USER19> Not exactly the same entity (British India ended up stretching further east) but Mughals ruled it as one country too, and the East India Company kept up the fiction that the Mughals were still in charge for as long as possible.

</comment></comment></comment></comment><comment><USER20> It is interesting to me that they use years of education as a measure of intelligence. As an American I am more used to thinking of intelligence as an innate, almost fixed characteristic (IQ). In that view education increases knowledge and skills but isn't expected to much affect general intelligence.

But to this article's authors, "intelligence" is increased by education, so harmful effects of pollution can be measured in years of education lost.

Is there a general cultural difference in how intelligence is thought of in China as opposed to the US?

<comment><USER21> I must admit that from perspective of the someone from the UK I've never really understood the US obsession with the desire to represent intelligence as a single number.

<comment><USER22> Fluid and crystallized intelligence (which is what IQ test measure) are the most robust ways of measuring intelligence, and IQ is the single most reliable metric ever discovered in psychology, in terms of making predictions. If you're interesting in measuring how smart somebody is, there's no better way of doing it than with that single number.

<comment><USER23> Which IQ test? IQ as a number alone mean nothing, as you can't make a standardized test for it. And IQ number is a comparison (you calculate the standard deviation). Also, even in clinical tests, multiple scales can be used, and this mesure evolve. And there is no "single number", multple subjects are tested, and now we have another limitation: those tests don't mesure everything, or mesure thing that can evolve. I "scored" 123 on the weshler when i was 8 (or 9) with a really bad spatial visualisation score of 90 (89?). Since i'm now able to play blindchess or to chart a course on a marine map, either my spatial visualisation skills have improved, either people i know hide a lot. And i'm sure i would score way less on the other subjects too, looking back i was a pretty interesting kid, while now i'm an average adult.

I'm not saying it's useless, but to me it is way overvaluated by some people. Maybe you can approximate intelligence with an IQ test, but the number itself is meaningless imho. The classification can be used though.

<comment><USER24> The hypothetical g which IQ tests are trying to find is the extent to which every test of mental abilities that anyone has ever devised plus some things like reflex speed all seem to be fairly strongly correlated with each other and all seem to be correlated via a common factor. You can certainly be more skilled at one test than another. These tests are also fairly noisy when applied to individuals.

For individuals the results of IQ tests probably are oversold as you say given their noisiness. But for public health problems like air pollution where the results are averaged over populations they're probably undervalued if anything.

</comment></comment></comment></comment></comment><comment><USER11> From the paper:

> Cutting annual mean concentration of particulate matter smaller than 10 μm > (PM10) in China to the Environmental Protection Agency's standard (50 μg/m3) > would move people from the median to the 63rd percentile (verbal test > scores) and the 58th percentile (math test scores), respectively.

It seems like HEPA air purifiers should help quite a bit if one spends on a lot of time indoor. At least having one in the bedroom would reduce exposure time by at least one-third, which should be useful.

It also sounds like by investing modestly in air purifiers, most offices in polluted cities could even net productivity gains from healthier employees who suffer less from allergy and congested airways, in addition to long-term maintenance of their cognitive function.

<comment><USER25> Why spend money in air purifiers when you can invest in things that reduce the emissions of pollutants at the source?

Don't production, usage and waste treatment of air purifiers contribute to air pollution over their entire product life cycle?

<comment><USER11> That is an ideal situation most of us do not have much influence on. We can help lobby/advocate at the margin but check out who we are up against esp in developing countries, where the problems are most acute.

In the meantime, air purifiers reduce the extent that our health deteriorates. The effect of air purifiers production is relatively tiny compared to pollutants from the rest of the economy.

</comment></comment></comment><comment><USER26> Discussed on reddit here [https://www.reddit.com/r/worldnews/comments/9as5p3/air_pollu...](https://www.reddit.com/r/worldnews/comments/9as5p3/air_pollution_causes_a_huge_reduction_in/e4xvev4/) in particular /u/gen_0 looked into if/how the study controlled for poverty, household income and other factors (they do).

</comment><comment><USER27> There are also studies hinting at a potential pathway involved in this: exposure to particulate air pollution appears to reduce the activity of brain- derived neurotrophic factor (BDNF). [1] [2]

[1] [https://www.ncbi.nlm.nih.gov/pubmed/21708224](https://www.ncbi.nlm.nih.gov/pubmed/21708224)

[2] [https://www.ncbi.nlm.nih.gov/pubmed/25816123](https://www.ncbi.nlm.nih.gov/pubmed/25816123)

</comment><comment><USER28> Any tricks to improve the air around and in your house ? without resorting to air filtering machinery if possible.

<comment><USER29> I didn't do much research into this but there are a number of house plants that NASA says improve air quality.

<comment><USER30> There's a list of some of these plants here:

[https://learn.allergyandair.com/houseplants-indoor-air- quali...](https://learn.allergyandair.com/houseplants-indoor-air-quality/)

One minor trick I use when walking down the street is to rapidly exhale if I've breathed in a particularly bad volume of exhaust pollution, like concentrated diesel fumes, walking on a few paces before re-inhaling. I expect it takes ~1s to detect the bubble of bad air and the surrounding air is polluted too. So just mitigation.

</comment></comment></comment><comment><USER31> Based on the amount of carbon monoxide and other pollutants that enter a car's cabin at highway speeds, this is likely a huge cause of road rage, speeding, and other reckless driving behaviors. These strong emotional states don't always end when we exit our vehicle, and so may affect us through our day. Our commuting time becomes a divisor of our overall daily intelligence, and quality of life.

<comment><USER32> I speed in reverse out of my drive, friend; how do you account for that?

</comment></comment><comment><USER33> In hindsight, European car makers' decision to go all out for diesel was a spectacular blunder, with horrendous consequences for health. Looking forward to the day they finally ban this filthy, choking fuel.

</comment><comment><USER34> > The study followed the same individuals as air pollution varied from one > year to the next, meaning that many other possible causal factors such as > genetic differences are automatically accounted for.

That's already much better than what I had feared. Not perfect, of course, but better than the usual "corellation == causation" journalism.

</comment><comment> rooam-dev Educated guess #1 - more toxins + less oxygen = bad for your brain, body and adds distraction (can you study/focus when you have health issues?)

Educated guess #2 - less pollution = better environment, country side and/or nature rich + less stress

</comment><comment><USER35> Hopefully electric vehicles can alleviate at least some of the air pollution in major cities- I applaud efforts to restrict ICE cars and trucks.

</comment><comment><USER36> If this was absolutely true, China and India would stop having any maths/science/arts/medicine/CS people.

Pollution control is on my mind constantly, and I hope we get a hold on pollution soon. But to be honest, the western media is after it a bit like how they were after Salt or Egg yokes earlier. I don't know why but the press constantly needs a target to pile everything on.

</comment><comment><USER37> > Impact of high levels of toxic air 'is equivalent to having lost a year of > education'

Since when is education equivalent to intelligence?

I thought that the current definition of intelligence is a relatively stable performance measure that is entirely independent of education (though it does predict academic performance).

</comment><comment><USER38> As usual, the actual scientific results are paywalled [0]. I guess we just have to make informed opinions based on science journalism, which is pretty much impossible.

[0]: [http://www.pnas.org/content/early/2018/08/21/1809474115](http://www.pnas.org/content/early/2018/08/21/1809474115)

<comment><USER39> May I introduce you to my bird friend?

[https://sci-hub.tw/http://www.pnas.org/content/early/2018/08...](https://sci- hub.tw/http://www.pnas.org/content/early/2018/08/21/1809474115)

<comment><USER38> The only reason I posted this in the first place is that I was having trouble verifying the captcha on my phone, and it made me think about how this site shouldn't even need to exist.

</comment></comment></comment><comment><USER40> The crazy thing is, as far as I'm aware, it wouldn't be a difficult engineering feat to get standard air-filters on exhaust pipes. Most air filters are merely a sac of activated-charcoal.

<comment><USER41> I don't even know where to start. Activated charcoal stuck in a car exhaust would not filter PM2.5 and wouldn't even do what was intended once it becomes saturated.

<comment><USER40> Maybe you should start with a little bit of humility, and citing sources?

Once it became saturated, you'd obviously replace it, likely at an annual exhaust inspection.

[1] [https://www.sciencedirect.com/science/article/pii/0016236189...](https://www.sciencedirect.com/science/article/pii/0016236189903141) [2] [https://university2.taylors.edu.my/EURECA/2014/downloads/46....](https://university2.taylors.edu.my/EURECA/2014/downloads/46.pdf)

</comment></comment></comment><comment><USER42> Reminds me of the studies that claim that putting lead in our petrol for decades also decreased the average IQ globally by 2-3 points.

</comment><comment><USER43> A conclusion like that seems very prone to data misinterpretation and bad methodology. Skimming the article I couldn't find any mention of the method used to reach the conclusion. Can anyone shed a light on the method used in the study?

</comment><comment><USER44> Sigh. Average IQs have significantly increased as pollution has significantly increased. We have objective data on this.

[https://ourworldindata.org/intelligence](https://ourworldindata.org/intelligence)

[https://ourworldindata.org/air-pollution](https://ourworldindata.org/air- pollution)

We have decades of data to show this positive correlation. Now I'm wondering how the study measured intelligence and of course who funded this study.

Edit: Seems like a lot of people are misunderstanding my point. I'm not saying air pollution is good. I think air pollution is bad. I'm just pointing out raw objective data which contradicts the study.

<comment><USER45> Perhaps IQs would have increased more without pollution?

<comment><USER44> Sure. The objective data I provided shows a correlation and not a causation. But it contradicts the study of a "huge" reduction in intelligence due to air pollution.

If air pollution causes reduction in intelligence, IQs would not have increased so much in the past 100 years as air pollution skyrocketed.

Can't say air pollution causes huge reduction in intelligence while IQs have drastically increased in an increasing air pollution environment.

The study claims a causal relationship - air pollution causes huge reduction in intelligence. The objective data of the last 100 years clearly shows that's not true.</comment></comment></comment>


DynamoDB Compatibility Layer for Apache Cassandra - <AUTHOR> https://github.com/datastax/dynamo-cassandra-proxy/blob/master/docs/Summary.md <comment><USER2> Interesting that this comes out a day after ScyllaDB announced DynamoDB compatibility. It wouldn't be a bad thing if DynamoDB's API (or something else) became a sort of ODBC for NoSQL databases. (Edit: corrected spelling)

<comment><USER3> Git history suggests it's been around for a year. It's not super interesting really, clearly there's a poke here that someone felt this feature was worth a press release and their more established competitor just "meh, here"'d them.

Also, cql is now implemented by like 5-6 nosql databases and is becoming the implicit standard (Cassandra, cosmosdb, datastax, yugabyte, etc).

</comment></comment><comment><USER4> Is dynamo affordable yet? When I did my AWS certs a few years ago they seemed to be pushing it hard for almost every data persistence use case that was non- relational. In practice the throughput provisioning meant that you knew exactly what your read/write load was and that it was constant; or you had to set it to peak levels and pay a fortune. If not, Dynamo would simply reject your request and it's up to you to build retry logic back up the chain.

This got a little better when autoscaling went from a workaround to an actual feature; but there's still a fair bit of ramp-up time so you still have to handle request limits.

I haven't paid much attention to it since, but was wondering if these things are a non-issue nowadays?

<comment><USER5> You can now pay a per-request rate and skip the autoscaling / wcu & rcu math.

[https://aws.amazon.com/dynamodb/pricing/on- demand/](https://aws.amazon.com/dynamodb/pricing/on-demand/)

<comment><USER6> last I ran the numbers this was still roughly 10x more expensive than 100% utilization of provisioned capacity. But for many use it will still end up roughly equivalent since you won't have to over-provision.

<comment><USER7> I'd argue that running at 100% of provisioned capacity is something that only makes sense for a very, very small subset of DynamoDB users. Actually I'd only do it if my access patterns were really predictable and if it's fine if requests get throttled.

The more common use case is that you over-provision your provisioned capacity to be able to handle some spikes in the number of accesses well. While there was already DynamoDB Autoscaling, I suggest everybody using it checks out DynamoDB OnDemand, as that might (depending on the access patterns) still save a lot over DynamoDB Autoscaling and is overall way less hazzle, because you simply don't have to care about scaling the provisioned capacity at all anymore.

<comment><USER8> That would be assuming you don't write more than 40k ops per second. See here in AWS's document [https://docs.aws.amazon.com/amazondynamodb/latest/developerg...](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Limits.html)

<comment><USER9> 40K is just a soft limit. You can contact support to increase the limit to any number you like.

In OnDemand mode tables have practically no limits on throughput or storage (just like provisioned mode).

Disclaimer: I work for DynamoDB but comment is my own.

</comment></comment></comment></comment></comment></comment><comment><USER10> I wish to see more of this, compatibility layer for all AWS products. Let's have enough of this to make it easy so you can run an "AWS app" else where. I figured kubernetes is that path, but AWS has too many customer API/products that it's still easy to be baked in.

<comment><USER11> S3 has the open source Minio, and it seems every cloud provider has adopted the S3 API for object storage.

</comment></comment><comment><USER12> This is a pretty nice video (for those of us who prefer watching over reading)... [https://twitter.com/syllogistic/status/1172537068783898624](https://twitter.com/syllogistic/status/1172537068783898624)</comment>


Show HN: LaraOne – Ultimate workstation for programmers - <AUTHOR> https://coderthrones.com/ <comment><USER2> If you sit in a chair for 14 hours a day like the inventor of this chair does you will develop life threatening blood clots in your legs. It doesn't matter how many ultra marathons you run the other ten hours a day. Your heart can't actually pump the blood out of your legs so your body is designed to have muscle activity in the legs do the work. If you sit for 8 hours you are at serious risk for blood clots (this is why doctors tell you to get up and walk around on a coast-to-coast or trans Atlantic or trans Pacific flight).

And yes, I'm a guy in otherwise great shape who was rushed to the ER with a potentially life threatening blood clot caused by sitting at my laptop in coffee shops for 8 hours a day coding. All that hyper attention and focus capability may be great for coding or gaming but it's a serious risk factor in other ways. The best solution is drink lots of water (so you feel the need to get up) or get a Fitbit and pay attention when it tells you you haven't walked around recently.

<comment> toper-centage So what you're saying is the chair needs a leg device the periodically squeezes your legs a little to pump out those clots. Gotcha.

<comment><USER3> Would some sort of g-suit help?

[https://en.wikipedia.org/wiki/G-suit](https://en.wikipedia.org/wiki/G-suit)

<comment><USER2> I've often wondered the same but not found any studies answering the question.

</comment></comment></comment></comment><comment><USER4> It needs driven wheels. Programmer spaces could be large empty warehouses, these mobile workstations gliding across the open space. If you needed to collaborate you could drive over to colleagues, be latched together for pair programming, able to move as a unit. Team meetings could have a flocking function to literally bring everyone together. Team leaders could have an override summon for those recalcitrants who are tardy attending the "stand- up". There could be coffee-maker modules bolted on too, like saddle bags. ...jk

<comment><USER5> Just make it self driving and roadworthy, with a hardened shell to double as a residence and 180 degree tilt to go flat as a bed, and now you can live in SF rent free and never leave the chair.

</comment></comment><comment><USER6> Mildly intriguing. My personal cavils would be:

-No desk space and only token storage space. If one needs to access books/paper documents, have additional computers & hardware (yes, we exist), or just needs a place to sketch or write something, this doesn't seem very practical.

-16:10 monitors are not mentioned in the monitor mount configuration section; hopefully that's just an oversight, not an actual limitation.

-Monitor distance is non-adjustable, an issue for older developers or those with vision problems

-No headrest; a serious omission for a reclining seat, particularly at that price point.

-How on earth does one get out of this thing when the power goes out?

<comment><USER7> > -How on earth does one get out of this thing when the power goes out?

I guess they figure if you're the type of person to drop $3600 on this, you'd also have sufficient battery backup.

On a more serious note, I _assume_ the "button" is just a mechanical latch to prevent it from opening during use. I'm just speculating, so I'm interested in knowing the answer to this question myself.

</comment></comment><comment><USER8> I have a hard time believing this is a serious product, the number associated with this, is someone's person cellphone.

and never in all the years have I been coding have I thought, you know if I was just pitched at 140 degrees, my life would be so much easier.

but hey, if someone has 3600 bucks to throw away on an awkward "nerd throne" this is the place to pitch it right?

<comment><USER6> > " _but hey, if someone has 3600 bucks to throw away on an awkward "nerd > throne" this is the place to pitch it right?_"

I blinked at the price as well but it's actually not that bad; ergonomic office furniture is surprisingly expensive. An Aeron with a third party headrest plus a hand-crank height adjustable desk is about $2000 already.

<comment><USER8> I suppose it boils down to need, I find that I can be just as happy with a standard height desk, and a $200~ range chair from amazon, as I was with the Aeron and fancy desk.

At a price point difference of nearly $1700, I know that my spartan needs aren't perhaps typical, but I just find all the fancy trapping a waste, once I find a functional, durable, reliable, and replicable set up, I tend to stick with it.

What works for me, cost about $400 every 3-5 years depending.

</comment></comment></comment><comment><USER9> The idea of spending 14 hours a day in a chair reminded me of a particular Homer Simpson invention:

[https://simpsons.fandom.com/wiki/Lazy_Man_Toilet_Seat](https://simpsons.fandom.com/wiki/Lazy_Man_Toilet_Seat)

</comment><comment><USER10> > I spend 14 hours in a chair

That is unhealthy to spend 14 hours in a chair. If someone finds themselves spending 14 hours in a hair unnecessarily (i.e. they can't walk) then they should probably re-eavaluate their life.

</comment><comment><USER11> I'm picturing a room full of these in the next season of "Silicon Valley"...

</comment><comment><USER12> Given the styling I think the subtitle should be "Ultimate workstation for male programmers" because really, how many women do you know who would look at that and say "oh I definitely want to sit in something that looks like that!"

</comment><comment><USER13> [https://preview.redd.it/l0vx7t2vkk5z.jpg?width=960&crop=smar...](https://preview.redd.it/l0vx7t2vkk5z.jpg?width=960&crop=smart&auto=webp&s=8a7bf82b13fdde04bde597ce95d16fa48996b9ac)

</comment><comment><USER14> Reminds me of the movie Grandma's Boy:

[https://goo.gl/images/mk6nvU](https://goo.gl/images/mk6nvU)

It would help if this company posted a pic with someone actually sitting in it/ using it.

</comment><comment><USER15> You need to change position every couple of hours max to avoid RSI, it's critical for me that desktop can change from sit to stand position Otherwise nice idea, hope they keep improving

</comment><comment><USER16> Apparently the competition is on: [https://youtube.com/watch?v=Hwkbj26BQxM](https://youtube.com/watch?v=Hwkbj26BQxM)

</comment><comment><USER17> Intriguing, but I think I would fall asleep in it, when reclined. It looks just too comfortable.

</comment><comment><USER5> Is this for PHP programmers? Laravel?</comment>


JavaScript tooling: madge - <AUTHOR> https://blog.jpalardy.com/posts/javascript-tooling-madge/ <comment><USER2> This is actually something I've been looking for recently. Does it handle full ES6 destructuring syntax within import statements? Does it handle import() expressions?</comment>


Voice search enabled on Google homepage (Chrome) - <AUTHOR> http://www.google.com/insidesearch/voicesearch.html

<comment><USER2> Did anyone else feel uncomfortable with Chrome turning on the mic, recording sound and posting it to a foreign server without asking whether it was allowed to? Feels like this could be abused. Would have appreciated an "Allow goolgle.com to access your microphone?" security question.

<comment><USER3> I'm ok with it. Much in the same way I don't expect to be asked if it's ok to send data to their servers every time I do a normal text search.

In what way do you think it could be abused?

<comment><USER4> It's one of those web things, without a prompt it feels like any site ever could just recording through the mic and saving it.

<comment><USER5> Didn't you have to click the mic icon before it started recording anything?

<comment><USER6> Yes, but I don't know what the mic icon is. Does it just call a function? Is it a Chrome-provided icon that is always on top? Can the menu that is shown be edited by the website?

<comment><USER7> It calls a browser function, not a javascript function.

</comment></comment></comment></comment></comment></comment><comment><USER8> On blind faith alone, I have to imagine this will be improved significantly going forward.

I use Google's voice recognition algorithms/systems on my Android phone all the time. Every day. Often to dictate complete SMS and Emails, while I'm driving, via my car's AD2P bluetooth mic, with all the ambient noise/etc present in a car on the interstate. (Though to be fair it's not an aftermarket bluetooth solution and I'm sure the mic is high quality and well placed.)

It is _very_ good. The most common type of mistake -- and still rare at that -- is stuff like "let's not go until..." is transcribed as "let's not going tell" and stuff like that.

When I first started using the voice features when I got the phone (HTC Evo), i was _blown away_ at the quality of the results.

And of course, Google has been practicing this stuff for a very long time. Everybody knows about Goog-411 (which was heaven before I got a smartphone) but does anybody else remember the little gimmick Google Labs page where you can click on the page, then call the number it displays for you, speak your query into the phone, and then right before your eyes your page reloads with your query and results.

That was at least nine years ago.

</comment><comment><USER9> Non-native English speaker:

      Haskell web frameworks - √.
      Tigers in India - √.
      Friedrich Nietzsche - what is a meter.
      Programming best practices - √.
      Contemporary philosophy - √.
      I bet you look good on the dance floor - √.
      Random beatboxing - the gap at the top of the pita pit.

<comment><USER10> Native English speaker – I had the same problems with non-Anglo names. It seems to discount the possibility that one is searching for a foreign name (in my case, an Italian name), and instead tries to interpret the name as if it were an English phrase.

</comment></comment><comment><USER11> This is a big step – millions of people becoming more comfortable with searching for information just by speaking to their computer. Historical moment.

<comment><USER12> This technology has been around a few years. If I'm not mistakken, wasn't voice search originally implemented on the Google iPhone application? Now with the proliferation of microphones on computers, it makes sense for Google to implement this feature on the Google webpage.

<comment><USER11> Yes, technology was around for years but it was just made more accessible to a much larger demographic.

</comment></comment></comment><comment><USER13> Interestingly enough, I notice it on <http://www.wunderground.com/> homepage using Chrome.

Not exactly sure how they're using it?

<comment><USER14> All you need to do is add the x-webkit-speech attribute to the desired input element:

<input name=query x-webkit-speech>

<comment><USER15> [http://www.w3.org/2005/Incubator/htmlspeech/2010/10/google-a...](http://www.w3.org/2005/Incubator/htmlspeech/2010/10/google- api-draft.html)

I, for one, can't wait till Android and iOS implement this.

</comment></comment></comment><comment><USER16> Seems like this is using the HTML5 speech input API. [http://chrome.blogspot.com/2011/03/talking-to-your- computer-...](http://chrome.blogspot.com/2011/03/talking-to-your-computer- with-html5.html)

</comment><comment><USER17> Does anybody know a keyboard shortcut to activate the voice search without having to click on the microphone?

<comment><USER18> Yeah, seriously. Also, from the Google web site: "Searching without typing Use it in the kitchen, in the garage or anytime your hands might be full."

Oh, really? I want to see you move your mouse pointer into position and click the microphone...anytime your hands might be full. Silly bints.

</comment></comment><comment><USER19> Just went 0 from 4, anyone getting good results? Not ruling out a bad mic or pronunciation on my end, although I imagine because searches are short and abstract they could be pretty hard to parse.

<comment><USER20> I sent a bunch of Cocoa classes at it, for no other reason than that's what's on my mind right now.

NSView -> "nfcu". OK, fair enough.

NSViewController -> "nfcu controller". OK, I guess.

CAAnimation -> "salvation".

This is probably a place where that controversial "profiling" could probably help, since I'm an atheist Cocoa developer.

</comment></comment><comment><USER21> For those of you who gets redirected to the localized version of google without the new feature, go to <http://www.google.com/en>

</comment><comment><USER22> Well apart from "coca cola" it didn't get any of my search phrases right, a couple of words that seemed to be based on past search history though ....

"paulstretch" = balls "poor" = p __* [presumably 'porn'?] "text to speech" = x

etc.

Just tried "pepsi" and get 'speech not recognised'. But for "pepsi cola" I get the right search ...

</comment><comment><USER23> Didn't work for any query. Crashed my browser once (Chrome 14.0.794.0 dev / OS X 10.6.7).

<comment><USER24> Works just fine on 14.0.797.0.

</comment></comment><comment><USER25> I noticed I finish searching by typing faster and more accurately than speaking into the mic. I understand the data collected by Google is valuable for its own use but what's the real benefit to the user?

<comment><USER26> Theoretically they use said data to make the speech search better.

</comment></comment><comment><USER27> It works pretty well for calculations. Tried phrases like "natural log of 77", "80 miles in kilometers", "17 times pi" and got the correct answer. Cool!

</comment><comment><USER28> Combined with the best search engine in the world, this is nothing short of magical. We _are_ living in the future.

</comment><comment><USER29> Now all we need is google instant with voice capabilities. I would like for it to predict what I am going to say.

</comment><comment><USER30> Too bad it' hardly working though. =( 7/10 was totally failing.

</comment><comment><USER31> "Please note Voice Search is available for US English only."

Damn, and there I was going to search for Crocodile Dundee quotes.

<comment><USER32> I can't go to google.com without being automatically redirected to google.co.uk. (I'm in the UK).

<comment><USER28> There's a link at the bottom which says Go to google.com.

<comment><USER32> Thanks - link at the bottom (I'm blind!).

</comment></comment></comment></comment><comment><USER33> When I see this - I really appreciate how good 'Watson' is with speech to text!

<comment><USER34> Watson had no speech to text, the questions were fed to it as text.

<http://en.wikipedia.org/wiki/Watson_(computer)#Operation>

</comment></comment><comment><USER35> Yeah, I got "Hacker News" after four times. Now it would be nice if I could say "Open" then it clicked on the first result.

</comment><comment><USER36> Gonna be great for searching lyrics</comment>


Fog detected on Titan - <AUTHOR> http://www.mikebrownsplanets.com/2009/08/fog-titan-titan-fog-and-peer-review.html

<comment><USER2> Hmm Im starting to think that the really interesting articles cant be recognized by high karma points but by the lack of tens of comments. (tho obviously HN is best for the comments!) This is really interesting and nicely written article!

<comment><USER3> This is probably because the articles which are interesting people a) upvote and b) don't understand well enough to comment on.

For example, if we were given an article on protein folding, it might be very interesting - causing upvoting - but also difficult to comprehend for many of us - causing a lack of comments.

A nice heuristic. I think I'll try it a few times.

</comment></comment><comment><USER4> _"I thought I would try an experiment of my own here. It goes like this: feel free to provide a review of my paper! I know this is not for everyone. Send it directly to me or comment here. I will take serious comments as seriously as those of the official reviewer and will incorporate changes into the final version of the paper before it is published."_

I love that - crowdsourcing of peer review. Interesting experiment.

</comment><comment><USER3> What I personally find most interesting about this article is the demonstration of purely human _insight_.

We're used to new techniques and new discoveries, but many of them seem obvious, just yet unimplemented. What the author does in the article, on the other hand, is just completely brilliant deductive logic.

<comment><USER5> Yes, it's a great example of deductive reasoning.

From my logic studies ten years ago I recall that an argument is considered 'Valid' if true premises must lead to a true conclusion (ie, no gaps in the logic); to be 'Sound', however, it must be Valid _and_ have true premises.

This seems Valid to me so far. I guess the peer review (formal and crowd- sourced) will test for Soundness.

</comment></comment><comment><USER6> This isn't another viral marketing campaign for FogBugz is it?</comment>


Swift on Mac OS 9 - <AUTHOR> https://belkadan.com/blog/2020/04/Swift-on-Mac-OS-9/ <comment><USER2> In response to:

> Fun aside: I've always assumed this is why Core Foundation exists—to provide > a common interface between Carbon and Cocoa. I don't actually have a > citation for this, though.

This (very enjoyable) blog post from 2006 confirms it: [https://ridiculousfish.com/blog/posts/bridge.html](https://ridiculousfish.com/blog/posts/bridge.html). I believe ridiculous_fish was working at Apple at the time.

<comment><USER3> Of course, while toll-free bridging is still around, its implementation details are somewhat different these days.

</comment></comment><comment><USER4> I suddenly felt the old Amiga fanboi inside of me pop up... :-)

At one time, up to at least 1996 the fastest Mac for running Photoshop, was not a Macintosh at all, but an _Amiga_ tricked out with a graphics card and a CPU upgraded from the standard 68020 or 68040 to Motorolas last entry in the 68k line, the 68060. (Roughly equivalent to a Pentium - a bit slower clock but slightly more powerful instructions.)

How could this be? Photoshop 4 used 68k instructions, and the fastest 68k based Mac was the Quadra with the 68040 CPU. The first PowerMac was released in 1994, but it had to emulate the 68k to run Photoshop, which had a serious performance hit. Once Photoshop was released for the PowerPC, this anomaly ended.

(And Photoshop on Windows must have been faster than both Amiga and Mac pretty much immediately, but if I recall correctly it wasn't as capable on Windows right then. Or maybe people used to working on Macs for magazines etc just weren't prepared to switch platforms on a whim.)

So, Amiga was the original Hackintosh. :-)

But the copyright situation was even thornier then - to start the emulator you'd have to copy ROM images from a real Mac, and the only legal way to do that was to buy a Mac.

(Not that anybody did that, they just copied the ROM onto a floppy.) I think the preferred emulator was Shapeshiter. It worked remarkably well because most Macintosh programs did not use any direct hardware access but used the Apple provided official APIs.

Another anomaly was that Amiga was dead as a commercial gaming target by then, and so did not receive a port of Doom - but you could run the Macintosh version of Doom:

[https://www.youtube.com/watch?v=spHpv3NKQhI](https://www.youtube.com/watch?v=spHpv3NKQhI)

Earlier, there was even an older Mac emulator for the Amiga which tried to go the legal route by having a little hardware board you could put Mac ROMs into. (And then of course people copied the original ROMs and put them on EPROMs.)

Edit:

the same CPU upgrade _almost_ happened to 68030 based Macs:

[https://lowendmac.com/2016/cpus- motorola-68060/](https://lowendmac.com/2016/cpus-motorola-68060/)

<comment><USER5> Remarkable. Today the fastest Mac is also a hackintosh, so some things have not changed so much.

That said, the first PowerPC Macs shipped in March of 1994 and Photoshop 3.0 for Mac in November. While the application was not native, a number of the filters were, so depending on what you did, they could be faster. Photoshop 4.0 was indeed fully native (November 1996).

</comment></comment><comment><USER6> You'd have to go through a lot of hoops like LLVM, compiler, etc CPU support just to get a Mac OS app written in Swift visible on the screen on OS9. Very interesting technical read on CPU support, compiler support, no matter the usefulness.

Impress me further if you can do that with BeOS.

<comment><USER7> It would be interesting to upstream the LLVM-related work. And I do wonder how much work would it take to support other PPC32-based platforms - not just Apple and BeOS but AmigaOne, GameCube/Wii, *NIX and WinNT 3.51/4.0 systems etc.

<comment><USER8> AFAIK LLVM only picks up backends that are production-maintained.

<comment><USER9> See also the debate about adding m68k backend to LLVM.

[https://lists.llvm.org/pipermail/llvm- dev/2020-March/140282....](https://lists.llvm.org/pipermail/llvm- dev/2020-March/140282.html)

m68k seems to be mostly a hobbyist interest rather than a commercial interest at this point. The problem is, if the person whose hobby it is gets busy and then either the whole project is getting held up by that backend, or it just gets removed.

At least in case of PPC and System z, IBM has a commercial interest in making LLVM work for them – and the former has some hobbyist/retrocomputing benefits as an unplanned side-effect. (System z, much less so – modern System z is 64-bit, whereas most of the mainframe hobbyist community focus is on the legacy pre-1980s 24-bit architecture.)

<comment><USER7> m68k isn't just one person's hobby however - there's a sizeable retrocomputing community around it.

> and then either the whole project is getting held up by that backend, or it > just gets removed.

LLVM has a notion of "experimental" backends that's precisely meant to avoid this. Unfortunately it's a bit misused at present, with backends that have little reason to be "experimental" being marked as such for historical reasons, while stuff like m68k (and perhaps this new PPC-based stuff) that could use it gets left out altogether. This should be fixed.

<comment><USER9> > m68k isn't just one person's hobby however - there's a sizeable > retrocomputing community around it.

But how many people in that community have the skills to maintain the LLVM backend?

I agree it would be great if m68k made it in LLVM, I'm just trying to explain why the LLVM developers seem so hesitant about it.

A thought: if there is really enough interest in LLVM for m68k, those interested could set up a not-for-profit membership association with annual dues, and then the association could use those dues to hire a developer to work full-time (or even just part-time) on LLVM+m68k. I think if an arrangement like that existed, the LLVM development team would be far more likely to say "Yes". If 1000 people were all willing to pay $100/year to support this, that would make available $100,000 per annum to fund development.

</comment></comment></comment></comment></comment></comment><comment><USER10> This is the coolest, awesome most useless thing I've read in awhile. I can't wait to see where this goes.

<comment><USER7> Far from being useless, this sort of work could ultimately make it easier to preserve existing Classic Mac OS-based apps and code, and run them on modern systems. Just as having FreeDOS around and even in active development makes it easier to support the DosBox platform.

<comment><USER11> Uh, how does making Swift compile new code to Mac OS 9 help with preserving old code?

<comment><USER3> It ensures that toolchains for the system continue to work on modern computers.

<comment><USER10> Why? You can already run the original toolchains used to write classic software using emulators.

<comment><USER12> In addition, there is a modern GCC-based toolchain for classic MacOS:

[https://github.com/autc04/Retro68](https://github.com/autc04/Retro68)

</comment></comment></comment></comment></comment></comment><comment><USER13> I recently have been getting into making a lot of small swift apps for personal use AND now have MacOS 7 and 8 running on my iPad since they've added mouse pointer support. Excited to dig into this article!

<comment><USER14> Okay, I'll bite: How are you running Classic Mac OS on an iPad?

<comment><USER13> These two projects:

[https://github.com/zydeco/minivmac4ios](https://github.com/zydeco/minivmac4ios)

[https://github.com/zydeco/macemu/tree/ios/BasiliskII/src/iOS](https://github.com/zydeco/macemu/tree/ios/BasiliskII/src/iOS)

The first is more stable, and recently got the pointer support added, but doesn't go up to MacOS 8 AFAIK. I copied a bit of the stuff from that to the MacEmu one to get the pointer working ok.

Thank you Zydeco!

<comment><USER15> Haven't looked, but gotta ask: does it run HyperCard?

<comment><USER16> If it is like mini vmac for other platforms, and I don't see why it wouldn't be, yes.

</comment></comment></comment></comment></comment><comment><USER17> Awesome project and a great read! (Is it weird for anyone else to see such a nostalgic meme?)

</comment><comment><USER18> The big takeaway for me is the MPW emulator that lets you run the tools from MPW.

Gonna give that a go!

</comment><comment><USER19> This article encouraged me to finally buy the iMac G4 I've always dreamed about.

<comment><USER20> This post is obviously written with sarcasm. However, I've been enamoured with the G4 Cube and 12" PowerBooks since they first came out and haven't been able to find a device that's been as aesthetically pleasing since.

This may have something to do with those being as objects of desire from my youth.

<comment><USER19> No, I was absolutely serious! Bought one on ebay tonight. :-)

</comment></comment></comment><comment><USER21> This is so wonderfully utterly useless. I love it.

</comment><comment><USER3> Cool! Is there a copy of the Swift BitPaint code anywhere? I couldn't see it. Just trying to gauge how much this could support.

<comment><USER22> [https://belkadan.com/source/ppc-swift- project/tree/HEAD:/exa...](https://belkadan.com/source/ppc-swift- project/tree/HEAD:/examples/BitPaint)

</comment></comment><comment><USER23> Now, let's run Swift on the original Macintosh.

</comment><comment><USER4> I wonder if this was inspired by the person who compiled .NET for Windows 3.11?

</comment><comment><USER24> I would be happy already if the swift>3.x would run on my osx sierra machine

</comment><comment><USER25> OS X was released 19 years (+ 1 week) ago...</comment>


Ask HN: Resources on creating a simple game engine in C/C++ - <AUTHOR> I want to learn how a game engine works by getting my hands dirty by designing one. I would like to find some resources that I can start with <comment><USER2> [https://www.redblobgames.com/](https://www.redblobgames.com/) talks about map generation, A*, and algorithms for hex based grids.

[https://blog.molecular-matters.com/](https://blog.molecular-matters.com/) talks about a task scheduler and several types of memory allocators.

[https://www.gamasutra.com/blogs/ChrisSimpson/20140717/221339...](https://www.gamasutra.com/blogs/ChrisSimpson/20140717/221339/Behavior_trees_for_AI_How_they_work.php) is an overview of behavior trees.</comment>


Time to get my life back - <AUTHOR> http://i.imgur.com/4gvSi.png

<comment><USER2> Excuse me for asking a question that might be obvious to many, but, what application are you using to track your time like that?

<comment><AUTHOR> toggl

<comment><USER3> Thanks for this. This looks like it'll be extremely useful for me, and I'm going to take a cue from you and track unproductive time, as well.</comment></comment></comment>


Entrepreneur with Down's Syndrome - <AUTHOR> https://www.youtube.com/watch?v=bD2ki1rlpMM <comment><USER2> The correct term is actually "Down Syndrome".</comment>


Car.o.l – An A.I.-Powered Exercise Bike That Gets You Fit in 40 Seconds - <AUTHOR> https://carolfitai.com/ <comment><AUTHOR> Designed for busy people, CAR.O.L provides the minimum effective dose of exercise by using clinically proven high intensity interval training (HIIT) principles programmed into its A.I.-powered stationary bike. Riders receive the same cardio benefits of a 45-minute jog in less than nine minutes by performing two 20-second sprints at their perfectly calculated resistance.

Each rider can track their progress through CAR.O.L's built-in touchscreen and its mobile app, including a proprietary Octane Score measuring their fitness level (power per heartbeat). Every CAR.O.L account is connected to the cloud, allowing users to resume each ride at their latest resistance level, whether they are using a CAR.O.L bike at home, work or the gym.</comment>


NeRF: Neural Radiance Fields [video] - <AUTHOR> https://youtu.be/JuH79E8rdKc <comment><USER2> This is incredible research!</comment>


Yahoo Pluton - <AUTHOR> https://github.com/yahoo/Pluton

<comment><USER2> So, from what I can tell, Pluton : C/State-Threads :: Twisted : Python/select. It's a hybrid evented/threaded framework using cooperative thread scheduling, but it hides the thread scheduling in its API to make programming feel even more natural.

There are a lot of random projects that chased this idea; maybe someone here can list a couple? I'm just fascinated that Yahoo fielded major apps built on this one. Neat!

</comment><comment><USER3> Very cool, glad that got out, it's good to see stuff like this happening. Its been in use for 5+ years so hopefully others can find use for it as well.

</comment><comment><USER4> Stop linking to github home pages without context.

<comment><USER5> The Readme.txt at the bottom provides some context.

<comment><USER6> But you have to know to scroll down to it, and for non-GitHub users, that won't happen until one day they randomly scroll down and notice there's more info cunningly hidden at the bottom of the page.

GitHub (probably correctly) seems to prioritise ease of use for people actually using it as a source repository over ease of discovery for projects using it as their homepage. Which is why projects shouldn't use it as a homepage, and people shouldn't treat it as such, until it gets better landing- page support.

I suppose there may be some argument in that non-GitHub users may not be the target audience for these projects, mind you :)

</comment></comment></comment><comment><USER7> Is it similar to ZeroMQ(<http://www.zeromq.org/>)?

<comment><USER8> Kind of, as I am using Mongrel2 and ZeroMQ, I cloned the repo and took a look at it.

ZeroMQ is a message passing toolkit with a lot of goodies where Pluton is to solve the concurrency problem, that is, when you generate a web page, you can access maybe 20 different services and merge the results in the page. If the 20 services requires each 5 ms to answer, you get 100 ms compute time when called in series, but imagine you can call the 20 in 2 batches, you can get an optimal 10 ms.

This what is provided by Pluton, a framework to call many services in parallel to improve the overall latency of your application from the end client point of view. Each small service run by default on the same system, but they can in return use ZeroMQ to communicate with other components.

The HTML documentation of the project is really good.

<comment><USER7> Can we build a system above ZeroMQ for such purpose easily? I think the async semantic of ZeroMQ is suitable to mitigate the latency of multiple RPC.

</comment></comment></comment><comment><USER9> Is this similar to <http://mongrel2.org/> ?

<comment><USER2> It's orthogonal to Mongrel. It's more a lightweight alternative to ACE, with co-op threading.</comment></comment>