Security vulnerabilities fixed in Firefox 67.0.4 and Firefox ESR 60.7.2 - <AUTHOR> https://www.mozilla.org/en-US/security/advisories/mfsa2019-19/ <comment><USER2> They've released two versions of Firefox in a span of 2 days. First 67.0.3 on June 18 [1] and 67.0.4 on June 20 [2]. Each release fixes a separate component of what seems the same exploit chain, the June 18 release the RCE and the June 20 release the sandbox escape. Link to the June 18 discussion [3].

Link to the first fix: [https://hg.mozilla.org/releases/mozilla- release/rev/99a829d2...](https://hg.mozilla.org/releases/mozilla- release/rev/99a829d2a2a7859b10508b6f05e99780c5e2dc68)

Link to the second fix: [https://hg.mozilla.org/releases/mozilla- release/rev/ea5154be...](https://hg.mozilla.org/releases/mozilla- release/rev/ea5154beddff08b919697e3bed6f38cfe3a3d82f)

[1]: [https://www.mozilla.org/en- US/firefox/67.0.3/releasenotes/](https://www.mozilla.org/en- US/firefox/67.0.3/releasenotes/)

[2]: [https://www.mozilla.org/en- US/firefox/67.0.4/releasenotes/](https://www.mozilla.org/en- US/firefox/67.0.4/releasenotes/)

[3]: [https://news.ycombinator.com/item?id=20218560](https://news.ycombinator.com/item?id=20218560)

</comment><comment><USER3> Interesting to see a sandbox escape that doesn't involve a kernel exploit (unlike the attack against Chrome users that leveraged a Windows kernel vuln). I wonder if seccomp has pushed things to the point where the boundary between broker and child is the softer spot. More evidence to that being that the attack on Chrome didn't work on Win10, which has a sort of similar mitigation.

Perhaps in particular for Firefox, which has had the sandbox for less time?

Would love to hear some expert opinions. I can't derive much from this since I don't personally see any trends.

</comment><comment><USER4> Another demonstration of why browsing with JS off by default is a good idea.

<comment><USER5> Only in the sense that a car accident is a demonstration why walking places is a good idea.

<comment><USER4> You're not wrong. Cars are usually by far the most dangerous activity most first-world people partake in, and individuals' driving habits are horrifying.

Anyone who drives should spend 5 minutes a week watching dashcam videos.

</comment></comment></comment><comment><USER6> I'm curious. Are these exploits in code written in Rust?

Edit: Clarification, I was asking a question, not trolling.

<comment><USER2> No, it's a vulnerability in privileged JavaScript. [https://hg.mozilla.org/releases/mozilla- release/rev/ea5154be...](https://hg.mozilla.org/releases/mozilla- release/rev/ea5154beddff08b919697e3bed6f38cfe3a3d82f)

Only few components of Firefox are written in Rust. Servo has no privileged Javascript per design choice, while it does have some components written in C/C++ (mostly taken from Firefox).

</comment></comment><comment><AUTHOR> CVE-2019-11708: sandbox escape using Prompt:Open

Reporter Coinbase Security

Impact high

Description Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer.

References Bug 1559858

</comment><comment><USER7> I guess that's why the JavaScript type confusion fixed in 67.0.3 was "exploited in the wild"? Because on its own, the rendering/JS process is compromised (which of course is bad) but it should still be sandboxed from the rest of the system assuming no sandbox escapes (like this one) are known?

<comment><USER8> Right. The first CVE gets you for example, cross window access. The second gets you system access outside of the sandbox.

</comment></comment><comment><USER9> Looks like the Firefox-based Tor Browser plans to lag a day behind, on an update for a critical vulnerability that's disclosed by the Mozilla update, like they did the last time. (Does that lag leave a substantial window for second-tier actors to compromise some security-sensitive dissidents and journalists?)

Also, a bit less concerning to me, the Debian package of `firefox-esr` still hasn't been released, as I type this, hours later.

Of course this is a tricky problem, but should there be more coordination on such updates, in the spirit of responsible disclosure?

<comment><USER10> I suspect that the ~1 day delay is just the time needed to run automated tests, rebuild packages, retest them, upload them on the various channels, turn updates on, etc.

I've worked with people who work on release engineering. Many things can go wrong by accident and silently, so you take your time to avoid distributing a broken binary that you could not upgrade.

<comment><USER9> Of course, but perhaps that can be coordinated better?

</comment></comment></comment><comment><USER11> Is there any reliable source that says which browser is the most secure for a regular user?

Pwn2Own: One change in the 2016 event is that the Mozilla Firefox Web browser is no longer part of the contest. "We wanted to focus on the browsers that have made serious security improvements in the last year," Gorenc said.

The implication is that Firefox just wasn't as secure as other browsers.

My gut feeling is that Chrome is far more secure than Firefox, but I would like an expert opinion.

<comment><USER12> Secure is obviously a very wide term but as an approximation you can look at how much exploit vendors will pay for an exploit, assuming higher price = harder to exploit = more 'secure'.

On that measure Chrome wins easily: [https://zerodium.com/program.html](https://zerodium.com/program.html)

<comment><USER13> Don't you think market share is a factor?

</comment></comment></comment><comment><USER14> Anyone have knowledge of how Firefox's security model compares to Chrome's?

<comment><USER15> See this for a potential starting point: [https://news.ycombinator.com/item?id=17287376](https://news.ycombinator.com/item?id=17287376)

</comment></comment><comment><USER16> 404 Not found

<comment><USER17> I'm not getting a 404 error

<comment><USER16> Link was broken when I commented.

</comment></comment></comment><comment><USER18> Can I ask what led the vulnerabilities to be missed in the development process?

</comment><comment> a-wu Not a good few days for Mozilla and Firefox. They just pushed 67.0.3[0] two days ago to fix a zero day.

[0] [https://www.mozilla.org/en- US/security/advisories/mfsa2019-1...](https://www.mozilla.org/en- US/security/advisories/mfsa2019-18/)

<comment><USER6> This is not bad. This is good.

The more code inspected, the more zero days that are identified. Every large code base has security issues. What is scary are the ones that only the wrong people know about.</comment></comment>


Fullstack GraphQL Book - spell-slinger https://www.graphql.college/fullstack-graphql <comment> spell-slinger Hi HN, author here!

Worked really hard on this open source book about building apps with GraphQL, Node and React.

I appreciate every kind of feedback.

Cheers! Julian</comment>


Ask HN: How would you convince someone to hire you without your resume? - <AUTHOR> <comment><USER2> When you're getting hired you're just selling someone on the idea of you. You just need to create a signal that you're worth the purchase. There is nothing magic about a resume other than it's the most typical way an employee sells themselves. Other signals of your worth could be recommendations, credentials, publications, intelligent conversation, etc.

I prefer the "meet and greet" approach to job hunting. If we have a good conversation about their needs and how I'd satisfy them, I'm inclined to feel a little insulted when a resume is asked for.

<comment><AUTHOR> I totally agree with you. "Meet and greet" has worked for me so far. I'm tired of reading "send your updated cv/resume" line on every job description. While lot of things are changing in hiring process, this is the area where I see very few companies being innovative.

A person is more than his/her resume and I wish companies could realize this.

</comment></comment><comment><USER3> The conversation need to start from the other end. _Them_ approaching you personally to be hired.

This does not mean being spammed by AMZN or GOOG or other recruiters. This means being approached by hiring manager or higher.

</comment><comment><USER4> I scored a job doing investigative due diligence by threatening the hiring manager's family.

I didn't know I was being interviewed, we were just two people seated alongside one another at a wedding reception, having pleasant casual conversation. She made me feel totally at ease, complimented my suit, laughed at my jokes, and was really inquisitive about me. After an hour of answering her questions, I began to notice that she wasn't answering any of mine. She would subtly bring the conversation back around to me. In isolation, it never felt evasive, but the pattern of doing so did.

So, I casually commented that she must have been a middle child to be so adept in conversation. She smiled and indicated that, in fact, she had just one younger brother. To which I responded: "And now I know you have a younger brother, so why don't you tell me what this interview is all about."

After collecting her jaw from the floor, she offered me a job.

I guess you can file that under being approached by them first, but I thought y'all might enjoy the story.

<comment><AUTHOR> I indeed enjoyed the story. If this was on quora, you would be famous by now. While these kind of scenarios happen in a rare case, I'm wondering why companies still stick to old-fashioned hiring process?

May be we all can put our thoughts on this problem and come up with some innovative solution that can change it. Thanks for sharing your story.

<comment><USER4> Hiring is a difficult process and I presume that you are specifically interested hiring for tech-focused positions. For my employer, they knew they needed a specific skill set and knew how to look for it. The interviewer told me later that she was looking for someone who had competence in the local language, who could stay engage at several levels in a conversation, and who could demonstrate quick thinking.

Those aren't easy skills to extract from someone on first meeting or through conversation, but their firm consistently does so. For a tech position, I think a similar approach could be possible, but I have to admit I neither know how, nor do I know how it can be initiated.

Maybe the same thing could be accomplished by a savvy tech interviewer at a conference or other networking event? Again, knowing what they need, using casual chatter, directing a conversation toward a tech problem and seeing how it engages the person (and how they handle the puzzle). That approach might work, but it probably isn't practical for a huge corporation. In any event, thinking about it is a neat exercise.

</comment></comment></comment><comment><USER5> Word of mouth.

My first job: my high school CS teacher knew I was good with computers anecdotally. (He heard second-hand from another staff member that I had looked at another student's buggy code, written in a language I had never seen before, and identified and fixed the bug in a few minutes, before I had ever taken a formal CS class at the high school.) One of the teacher's former students had a small business that was hiring people to do some one-off data entry work over winter break and asked if I wanted to give it a go. (I said yes.)

Boss liked my work ethic, and offered to hire me back the following summer to work on their C#/ASP.NET code base (even though I'd never coded C# in my life).

<comment><AUTHOR> Agree. Word of mouth helps. My first job was through word of mouth.

I would like to describe this as a "social proof". You're recommended by genuine people for a particular job.

</comment></comment><comment><USER6> Show a keen interest in the individuals problems, priorities, and mission-- share ideas on how you can help assist them. Gitomer has a good piece on Buyer's (Hiring Executive) Motivations > [https://www.youtube.com/watch?v=v1w-BX8jMJQ](https://www.youtube.com/watch?v=v1w-BX8jMJQ)

</comment><comment><USER7> You might have noticed a few triblebyte blog posts on the front page lately. They don't do resumes. (Of course, you have to be ok with YC companies, or else they're not much use to you.)

</comment><comment><USER8> Demonstrate relevant skill.</comment>


Student Invents Bottle Made of Paper (video) - <AUTHOR> http://www.cnn.com/video/#/video/tech/2009/06/12/dnt.wa.paper.water.bottle.king

<comment><USER2> Not to rain on his parade or anything, but didn't he really just invent putting water into a cardboard milk carton?

<comment><USER3> Ahh yes, but that's got to be worth what, 30, maybe 40 patents at the good 'ol USPTO?

I remember getting Vittel water in cartons like this in Germany in the late 80's. I do think he might be a little late to the party. His carton actually looks a lot like the Tropicana orange juice cartons in stores now.</comment></comment>


Vocal SOPA opponent Senator Rand Paul detained by TSA.  - <AUTHOR> http://dailycaller.com/2012/01/23/report-tsa-detains-sen-rand-paul-in-nashville/

<comment><USER2> Wouldn't a full-body scan be more revealing than a pat-down? I guess i understand where he's coming from, but I thought most people went the other way (opting-out of the full-body scan in favor of a pat-down).

<comment><USER3> The scan is entirely digital, and uses a generic image (to "protect passengers(sic) privacy") to show an agent the targeted alarm.

In that way, a pat-down is more intrusive, to me.

On another note, I always assumed Senators to be immune to this sort of "questioning".

<comment><USER2> Thanks. I don't think that part of the article had been posted when I read it.</comment></comment></comment>


Ask HN: Who started a company in the industry they initially knew nothing about? - <AUTHOR> How long did it take you to break into the industry? What are some tips that you can share? <comment><USER2> I opened a mortgage company. I learned a lot about sales teams.</comment>


Steve Jobs's worst decision was promoting Tim Cook - <AUTHOR> https://qz.com/819739/why-tim-cook-is-steve-ballmer-and-why-he-still-has-his-job-at-apple/ <comment><USER2> > If you think the job of a CEO is to increase sales, then Ballmer did a > spectacular job; he tripled Microsoft's sales to $78 billion and doubled > profits from $9 billion to $22 billion

> Apple under Cook has doubled its revenue to $200 billion while doubling > profit and tripling the amount of cash it has in the bank (now a quarter of > a trillion dollars)

I think the picture could be even less rosy than that. It could be argued that Ballmer was just there while the enormous untapped value and momentum that had been accumulating in Microsoft over the years started to get released. It's possible any other CEO could have done the same or better by being in that position at that time. Could be true of Cook as well. He inherited Apple with an extreme amount of untapped potential.</comment>


Apple shows us the amazing process of making the Mac Pro - <AUTHOR> http://guru8.net/2013/10/apple-shows-us-the-amazing-process-of-making-the-mac-pro/

<comment><USER2> The manufacturing processes shown in the video have been commonplace for 25 or more years. Amazing, no. Interesting to those who are not familiar with manufacturing automation, perhaps.

If the general public thinks that video is amazing, then perhaps the general public has no idea how advanced the manufacturing sector really is.

<comment><USER3> Eh. This product designer thinks otherwise: [http://atomicdelights.com/blog/how-apple-makes-the-mac- pro](http://atomicdelights.com/blog/how-apple-makes-the-mac-pro)

<comment><USER2> From 1979-1984, I programmed and operated NC & CNC lathes and milling machines that made parts far more complex and precise that what they are showing. One of our customers was the beer bottling industry.

In the period from 1984-89 I watched pick & place circuit board assembly, pick & place robotics, robotic polishers, robotic bead blasters and spray painters operate in local machine shops, automotive plants and electronics manufactures.

I've never worked in a shop that punched out cylinders, but I'm sure that the process they are using for punching out the cylinder from a block of aluminum is how beer cans get made.

It's not amazing.

<comment><USER3> You may well be right, but I think the key claim is this:

"Most metal stampings go through one or two die tools to produce the final shape. With the Mac Pro though, the challenge is to produce a massive amount of plastic deformation without tearing, rippling or deforming the perfect cylindrical surface."

and, below the figure:

"The results of the first (of between 4 and 5) deep draw stamping operations. Notice how the Mac Pro part is nowhere near the final length."

As I'm sure you know, there's a big difference between a single-use aluminium can, which is both small and thin, and a large part like this, which has to have both structural stability, very high dimensional tolerances, and a good surface finish. That said, you obviously know more about this than I do, so maybe you can comment on the quotes from the article?

<comment><USER4> I'm not an expert, but if they are simply swaging the tubes out until correct length is met, it's not amazing.

</comment></comment></comment></comment></comment><comment><USER5> The making of the fancy, hip Mac Pro is really-really simple compared to a much less fashionable Korean car. Except Hyundai users usually don't spend their time watching videos on car manufacturing. :)

Sometimes, however, simple things can require a lot of expertise: during the '90s, many jet builders went to Shimano and Campagnolo and sought help in manufacturing small, but reliable metal parts for airplanes as the bicycle part industry was quite ahead in this field.

</comment><comment><USER6> Video here:

[http://www.youtube.com/watch?v=IbWOQWw1wkM](http://www.youtube.com/watch?v=IbWOQWw1wkM)

The site is just a container for ads.

<comment><USER7> The video is an advert.

</comment></comment><comment><USER8> Still looks like a small dustbin.

That and the dust bunny acquisition system...sorry bottom drawing fan inlet.

</comment><comment><USER7> Not pictured: The factories in china that make most of the parts.

</comment><comment><USER9> It's mainly amazing because in the US it's cheaper to have a $75k robot do a job than a human.

<comment><USER10> It's more that robots can do tasks with unrivalled precision at temperature/pressure extremes that would kill a human.

<comment><USER9> OTOH, in the US, you use a robot arm to load a piece into an automated machine. In China, you use a person.

<comment><USER11> [http://www.pcworld.com/article/2043026/foxconn-to-speed- up-r...](http://www.pcworld.com/article/2043026/foxconn-to-speed-up-robot- army-deployment-20000-robots-already-in-its-factories.html)

Or, you know, you use a robot.</comment></comment></comment></comment>


CERN's Future Circular Collider (FCC) Conceptual Design Report [pdf] - <AUTHOR> https://www.researchgate.net/publication/334148892_FCC-hh_The_Hadron_Collider <comment><USER3> would love to read comments on Sabine Hossenfelder book "Lost in Math" related to this

[https://www.goodreads.com/book/show/36341728-lost-in- math](https://www.goodreads.com/book/show/36341728-lost-in-math)

She basically makes the claim we have no good scientific reason to build this at the moment

<comment><USER4> A Problem with accelerator physics particularly is that there is a large scientific industry around the actual experiments that depend on these experiments continuing. The engineers just get told what to build and they get going, without having a deep understanding why this particular experiment is really necessary. I worked in accelerator physics for 5 years and on all the conferences, meetings etc. I had yet to meet anyone who understands, why we are doing this (with an understanding that goes deeper than Wikipedia).

<comment><USER5> Well, accelerator physicists work with particle physicists who do understand these things. More often than not particle physicists don't understand how the accelerator works. Particle physics is complicated, and so is the LHC. I am not sure it's right to expect people to be experts on both, it's surely better for people to specialise.

Regarding Hossenfelder: I think she is an iconoclast and arch contrarian.

<comment><USER6> "arch contrarian"

Could make a good title for one of her German synthpop music videos, which I kindof dig.

</comment></comment></comment></comment><comment><USER7> The omega tau podcast had an interesting episode on this.

[https://omegataupodcast.net/231-the-future-circular- collider...](https://omegataupodcast.net/231-the-future-circular-colliders/)

There is also an interesting episode on mega projects in general.

[https://omegataupodcast.net/181-why-megaprojects-fail-and- wh...](https://omegataupodcast.net/181-why-megaprojects-fail-and-what-to-do- about-it/)

<comment><USER8> yes, the few omega tau podcasts I have listened to, have been excellent. Alas, many of them are not in English.

</comment></comment><comment><USER9> Well, why not? As many point out it has interesting engineering challenges, and gives particle physicists something to do.. However, maybe there is nothing to do after all. One wonders if this is a last hail mary for those clinging to super symmetric particle theories or maybe for multiple higgs ideas. Or just for a job. There doesnt seem any sound reason to me to think the particle desert isnt real and wont stretch all the way to GUT energy. Though i suppose 13.4 - 100 may yield extra discoveries of some nature. I used to read this blog [http://resonaances.blogspot.com](http://resonaances.blogspot.com), though im not a particle physicist, it was interesting. The posts dried up and it was hard not to detect pessimism after a null result via supersymmetry. Indeed i seem to remember hearing no one would want to go into particles as a career now and many will pivot into condensed matter physics etc. So what are they gonna do for 25 years? I guess the youngsters 25 years hence will have to dust off the particle books. Meta materials, gravity waves and plasma physics are so much more intetesting now.. I seem to remember reading about plasma wave accelerators the size of a table top many years ago with giant theoretical energies. Interesting to note the ssc had 40 Tev energy which would have fairly concretely answered the ss question without the need of another machine

<comment><USER10> Contrary to popular belief, there's lots of work going on in experimental particle physics, and there's a lot planned. Physics didn't stopp in 2012 with Higgs discovery, it is not likely to stop in the near future either.

<comment><USER11> High energy experimental physics died in the 1973. It's long since been time to pull the plug on this zombie. It was obviously true in the 90s when I was picking a specialization. It's even more true today.

<comment><USER10> I've spent 18 years in the field. But what would I know...

<comment><USER11> Compare the last 18 years with, say, the period from 1955 to 1973. There are still people who write poems in Latin as well. They don't cost much, nor do they channel large populations of intelligent people away from real problems.

<comment><USER10> You imply there were no benefits from lhc? It's not incredibly expensive per scientist (there are single hospitals with larger budgets than a lhc experiment), and it had a massive impact - for instance you know about it. Basic research is important, if you don't agree, try educating yourself - <USER2> won't do it for you.

<comment><USER11> >You imply there were no benefits from lhc?

I have overtly stated as much, in as public a way as I had access to at the time. I don't care if it's "not incredibly expensive per scientist" -it is a wasted effort, and an awful lot of what gets published (with 1000 "authors") as being bullshit. I've also seen the lifestyle and read the "results" of both experimental high energy and the theorists: it's basically a cargo cult at this point, imitating the glory days in the 50s and 60s.

Let me ask you a question: what lack of result would convince you that high energy as practiced today is a waste of time? I look at stuff like this and see sheer decadence:

[https://kirstenhacker.wordpress.com/2019/09/29/the-walrus- an...](https://kirstenhacker.wordpress.com/2019/09/29/the-walrus-and-the- carpenter/)

The "muh basic research" argument doesn't work forever. "Which basic research" is a question we should be asking, and building yet another giant accelerator and detector set up is not necessarily the answer, just because that's been useful in the (now distant) past. Phil Anderson is probably right.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Some interesting numbers:

\- From the abstract:

> _Combining ingredients from the Large Hadron Collider (LHC), the high- > luminosity LHC upgrade and adding novel technologies and approaches, the > FCC-hh design aims at significantly extending the energy frontier to 100 > TeV._

\- From the paper:

> _The overall project duration of FCC-hh as a "stand-alone" project is 23 > years, composed of two major parts: the preparation phase spanning 8 years > and the construction phase spanning 15 years._

\- From Wikipedia [1]:

> _First collisions were achieved in 2010 at an energy of 3.5 > teraelectronvolts (TeV) per beam, about four times the previous world > record. After upgrades it reached 6.5 TeV per beam (13 TeV total collision > energy, the present world record)._

[1] [https://en.wikipedia.org/wiki/Large_Hadron_Collider](https://en.wikipedia.org/wiki/Large_Hadron_Collider)

</comment><comment><USER13> Annoying that this apparently isn't on the arXiv. Here's an alternative direct link.

[https://www.repository.cam.ac.uk/bitstream/handle/1810/29453...](https://www.repository.cam.ac.uk/bitstream/handle/1810/294539/FCC- hh.pdf)

</comment><comment><USER14> This is super fun! It's huge but just skipping through to check out diagrams and read bits and pieces is great.

</comment><comment><USER15> The LHC, has 13 TeV total collision energy, this intends to go to 100TeV in about 20 years. Is that sufficient to find new science? Should they be aiming for a much higher energy? Less than 10 times increase doesn't seem much, for a multi billion dollar project.

<comment><USER7> It isn't a simple matter of making a number bigger. The size and cost goes up exponentially. There are potential new particles that can be teased out of 100 TeV. Some important particles aren't expected to be seen in colliders smaller than a thousand light years.

</comment></comment><comment><USER16> A dozen (!) pages listing the contributors, then an abstract which ends with the paragraph quoted below which essentially says it's more powerful and wth vague aims.

I hope the intended audience aren't political and financial decision makers who are otherwise laymen on the subject.

Presumably this is aimed at fellow scientists? What's the goal of the document? What is the specific Higgs-equivalent target of the proposed collider? I didn't read further tbh, I wasn't encouraged by the first few pages, but then I'm not a physicist so perhaps that isn't intended.

From the abstract:

 _the FCC-hh design aims at significantly extending the energy frontier to 100 TeV. Its unprecedented centre- of-mass collision energy will make the FCC-hh a unique instrument to explore physics beyond the Standard Model, offering great direct sensitivity to new physics and discoveries._

<comment><USER17> Sorry, but I am afraid you are ill informed on the ammount of complexity that this document cover.

Please note that never ever in the history of mankind a project so ambitious has even be thought. Already the amount of complexity in LHC is considered far greater than the complexity of the Apollo mission. FCC is a different order of magnitude than LHC already.

Then if you just skim the report you will notice how wide are the topic covered.

Leaving aside the physics, the document talk about the magnets, how to detect quenches, how to discharge magnets that hold 37MJ of energy, how to monitor the beam of particle, how to dump the beam, how to inject the beam into FCC, how to accelerate the beam,how to keep 100km of magnets at 1.9k when particles at 100TeV are running inside and doing it not for a bit, but continuosly for months and months.

And then other points more pragmatic, where to get the electric energy to run the whole machine?

And this just skimming the document and looking at pictures.

Honestly, how many would you expect to write such a document?

<comment><USER16> I think you've completely missed my point and have not answered a single of my questions.

In particular, I'd like you to not "leave aside the physics" \- my understanding is that's quite important here - and specify what part of theory this will confirm or reveal.

I may well be "ill-informed", I'm happy for you to clear that up with an example along Higgs-discovery lines - the abstract and first dozen pages were unable to.

You reference the Apollo mission as a relatively minor affair in comparison, so that could serve as an example.

What is the "putting a human being on the moon" thing we are doing here? The abstract as it stands is more like "we're gonna shoot some multi billion dollar rockets into space and see what happens".

<comment><USER18> I wonder whether it is worth spending as much as this would cost, but I don't expect that to be answered in a "Conceptual _Design_ Report. Design time is not where you justify _why_ you're building what you're building; you only describe _how_ you're planning to do it.

Presumably (I haven't looked hard for them) there are earlier report(s) that argue _why_ we would want to look at 100 TeV.

Edit: [https://fcc-cdr.web.cern.ch/](https://fcc-cdr.web.cern.ch/) has some more high-level info, such as 'FCC Physics Opportunities' ([https://fcc- cdr.web.cern.ch/#FCCPO](https://fcc-cdr.web.cern.ch/#FCCPO)), which refers the "European Strategy for Particle Physics" ([https://europeanstrategyupdate.web.cern.ch/](https://europeanstrategyupdate.web.cern.ch/)) which, presumably answers the 'why'

<comment><USER16> That's a fair answer thank you (and why I asked about the intended audience and purpose of the document); however as they put the blue sky goals in the abstract, I would have expected something more specific as well.

Wrt your first observation, yes it's particularly the amount that it costs that I think makes this clarity in communication especially important.</comment></comment></comment></comment></comment>


Your code of conduct is not enough if your guests are illegal - <AUTHOR> http://blog.ryanstenhouse.jp/your-code-of-conduct-is-not-enough-if-your-guests-are-illegal/

<comment><USER2> This is important because "silence gives consent" to hate and violence directed at unprotected minorities. Revoking business dealings is one of the main levers to encourage countries/groups/companies to play nice. Tyranny of the majority (or to a lesser-degree, minority beyond a sensible point) are incompatible with civility.</comment>


The Asus Prime Utopia is a radical concept for the future of motherboards - <AUTHOR> https://www.theverge.com/2019/5/29/18643912/asus-prime-utopia-motherboard-concept-computex-2019 <comment><AUTHOR> I was a bit surprised to see this coming out of ASUS, as the logical conclusion to designs like this is the complete commoditization of the motherboard. I think, however, they got things right in that the current specifications on case/mounting/power are detrimental to the future value and growth of computing.

Motherboards used to be pretty standard fare: CPU socket, RAM slots, expansion slots, with differentiation coming from peripheral, BIOS, and stability/overclockability. Nowadays, CPU manufacturers have taken over a segment of the differentiation (chipset, or platform capabilities), so most of the differentiation is in aesthetics and branding. In this world, the grab bag of peripherals become a tradeoff, the cost per unit versus the percentage of market share it opens. Manufacturers have to increase their overall cost per unit in order to get access to the users who each have their own must-have peripherals.

Something like this moves things in the right direction by removing a lot of the overhead in motherboard manufacturing. If you look at the bandwidth required for todays peripherals, even in the most maxed out possible configuration, you won't be able to saturate an x16 PCIe 3.0 link: * 1.2 GB/s 10Gb Ethernet * 3.0 GB/s 6 SATA ports * 9.6 GB/s 8 USB 3.1 ports * 0.2 GB/s Wifi 6 * 0.1 GB/s Audio

The Utopia concept allows for multiple mini-PCIe blocks, but you could simplify it and just make the case one big PCIe device that handles IO.

USB4 goes a bit beyond that, with each port using up to an x4 PCIe 3.0 link, so you might want have direct access to motherboard USB4 slots (especially since this allows exposing integrated graphics cards via alternate mode).

I hope one day to see the motherboard simplified to a plug-in card which holds CPU socket and RAM sockets, and exposes PCIe and M.2 slots for connectivity.

<comment><USER2> I agree that while ASUS's implementation might not be "it", and I'd imagine that if they released that today it'd be a proprietary mess, they have the right idea that there's a lot to gain from moving I/O off the motherboard to expansion cards/slots. Right now I'd bet most PC enthusiasts barely use any of the motherboard's integrated I/O except for USB and maybe ethernet. Mini-ITX is especially limited by ATX's growing pains - just a single PCIe x16 slot for expansion. If instead of the integrated I/O we had several Mini-PCIe slots to pick and choose I/O like Thunderbolt, wifi, 10GbE, optical audio, etc, I think there'd be a much more vibrant PC ecosystem and motherboards could see much longer longevity.

</comment></comment><comment><USER3> Err arn't current moth-boards modular? I can put various things in PCIe slots.

</comment><comment><USER4> Is this the modular Mac Pro everyone's waiting for (not from aesthetics point of view, of course)?

<comment><USER5> Aside from the Apple-y-ness and aesthetics of whatever the module attachment system ends up being, how is the expected/desired modular Mac Pro any different from a regular desktop PC?

<comment><AUTHOR> I suspect the major innovation they're looking for is usability. I can really only think of a single product that is both modular, and very usable in it's modularity, and that would be cameras (not the point and shoot variety).

You have a few major camera systems to work within, but aside from that variable, body, storage, mount, flash, lenses are modular and exchangeable in a very usable way.

When it comes to computing, most IO could be made readily modular, as PCIe is quite stable, and the bandwidth needs are easily exposed.

Where the problem comes, however, is making compute and RAM modular. Connecting multiple compute units with multiple RAM elements is a completely different problem than IO expansion, as the devices are much more sensitive to trace length and layout, and much higher bandwidth.

If the expected/desired Mac Pro is truly going to be fully modular, then I suspect it will have to be NUMA, and have a compute backplane separate from IO.

I'm imagining compute blocks that have RAM plugged directly to CPU that can be connected to the compute backplane (something like QPI, UPI, or InfinityFabric) that also has an IO block attached. One big problem is that these interconnects are proprietary, which means any IO unit plugged into that backplane will only be useful for that brand of processor.

The problem with this, however, is you lose access to CPU-exported PCIe bandwidth, which is very valuable (e.g. for GPU links). If you don't want to lose that, than you're back to a compute unit with one point of modularity, the RAM, a second point of modularity, PCIe/USB4, and a third point of modularity, CPU interconnect/backplane.

It's probably possible to deliver a design that enables this, but it's a very tough problem, and hasn't yet been solved.

<comment><USER6> What is interesting is that a lot of old computers operated by this standard where you would have one big backplane and a lot of IO cpu's etc attached to that. I find it interesting how we have gone full circle. I do not understand what the use of modularity would be. Modern gaming rigs are already fairly modular. The only trick is that a lot of peripherals are not hot-swappable which I have trouble understanding why one (outside of the server and mainframe world of course) would want a hot-swappable gpu or cpu.</comment></comment></comment></comment>


Bees Solve Complex Problems Faster Than Supercomputers - <AUTHOR> http://www.dailygalaxy.com/my_weblog/2010/10/bees-solve-complex-problems-faster-than-supercomputers.html

<comment><USER2> Can we _please_ stop with these articles, that with due consideration I will refer to as "fucking pieces of shit"? My HP48-G could probably brute-force the instance size of the problems that they threw at these bees in less time than the bees took, and there is also no particular reason to believe that the bees actually _solve_ the problem, which is to say, 100% of the time find the _perfectly optimal_ solution. Anything less is not a _solution_.

There is a long history of people simply assuming that things could _solve_ an NP-hard problem when in fact you only get an approximation: <http://www.scottaaronson.com/papers/npcomplete.pdf>

Bees may not be dumb, but they work at the speed of living things. In one flap of the wings of one of the bees I bet a naive brute-force algorithm could have solved the entire instance these researchers threw at the bees with time to spare. TSP is exponential to truly solve, but I guarantee the researchers didn't throw a very big instance at the bees, because if they had I guarantee at some point the bees would have chosen a non-optimal path.

This isn't even abstractly cool; it's anti-knowledge of a kind with quantum mysticism, if not quite as toxic. Reading these types of reports and taking them at face value leaves you with a _less_ accurate understanding of the world.

<comment><USER3> Bees have evolved for 100M years. During this time an enormous amount of bees have lived and finding a shorter path between flowers is obviously a very strong evolutionary pressure.

Generally the bee species is a genetic algorithms supercomputer that have worked for a very long time to find good solutions to the traveling salesman problem. I'd guess your suggestion, that we should not even try to find the results of that 100M years computation, is based on some personal feelings ;-)

<comment><USER4> Bees no doubt have a very good biological implementation of some _heuristic algorithm_ to the traveling salesman problem. It is extremely unlikely (as in aliens in area 51 unlikely -- wishful thinking unlikely) that they have a biological implementation of an _exact algorithm_. The Daily Galaxy article makes it seem as if the bees are solving the problem using an exact algorithm, and, moreover, that they are faster at doing so than a modern supercomputer, which is all complete wishful-thinking nonsense.

</comment></comment></comment><comment><USER5> This article is incorrect on two counts:

First of all, the travelling salesman problem is not actually about travelling salesmen; a solution has to work on an arbitrary graph, not just one that is constrained to the actual geometry of space.

Secondly, the bees' solution to the problem is heuristic; there is no guarantee they will always find the optimal solution, though they'll almost always be very close. Computers can apply heuristics too (with the same caveat), and when they do so it's much faster than verifying an algorithmic solution.

<comment><USER6> I hope this meme won't enter the public mind like "science can't explain how bees can fly"

<comment><USER5> Yeah, the bumble-bee thing is unfortunate. But there is something to this: we can trade away a verifiably optimal solution for something more useful, like a timely one. (Coincidentally, I submitted an article on that general theme this very morning: <http://news.ycombinator.com/item?id=2371977>) If _that_ concept entered the public mind it would be a great thing.

Unfortunately the article never touched on that, and all we get is "bees > supercomputers!!!".

</comment></comment></comment><comment><USER7> I like how the bees are said to figure out the answer faster than a supercomputer, when the problem involves "several" flowers. Unless "several" is 15+ flowers, a supercomputer is going to have an optimal solution within milliseconds, before the first bee has even reached the first flower. Now, if the bees had 1000 flowers to visit, I would be more interested.

<comment><USER8> I've seen this BS reporting before. The original paper, I believe is this: <http://www.jstor.org/pss/10.1086/657042>

Money quote:

      We analyzed bee flight movements in an array of four
      artificial flowers maximizing interfloral distances.

_Four_ flovers…

<comment><USER9> Wow, how many different paths is that? Somewhere around 256 at a guess? So a computer could work out the optimal solution in microseconds purely by testing all possible combinations. Though I'm guessing the bees don't just sit there at the start working through all possible routes they're going to take that day, it's surely something that they work out as they go along. Maybe that's where they gain some efficiency advantage.

Though four flowers is hardly likely to be a real world scenario for bees. Surely bees would encounter tens of thousands or more flowers in a field, so it is there performance here that ultimately counts. Though perhaps four flowers is better for determining how they make their actual decisions?

</comment></comment></comment><comment><USER10> The article seems to mention a heuristic method the bumblebees use to improve their path, which consists of changing subpaths. A heuristic doesn't necessarily give the optimal solution, while there are methods that do give the optimum. An example is Concorde at GAtech, that solved problems with 15k nodes: <http://www.tsp.gatech.edu/concorde.html>

</comment><comment><USER11> "Bees need lots of energy to fly, so they seek the most efficient route among networks of hundreds of flowers using angles of sunlight, which helps them find their way home, researchers say."

How much energy do bees really need to fly? Is there any data available on the subject?

<comment><USER12> Why was the reply killed? It's very relevant.

\-----

1 point by jws 1 hour ago | link [dead]

The energy consumption of a fully laden Apis mellifera is in the neighborhood of 55mW.

[http://www.culturaapicola.com.ar/apuntes/anatomia/130_efecto...](http://www.culturaapicola.com.ar/apuntes/anatomia/130_efecto_polen_nectar_curva_metabolica.pdf)

I had no idea it was so high.

\-----

<comment><USER13> I don't understand either. I see this more frequently lately, that (informative, on topic) posts are randomly killed. It's not like the poster was a negative-karma user, either. Who decides which posts get killed?

<comment><USER14> Often it's because a user accidentally double-posts, the second post gets auto-killed, the user can't see their own dead posts, and they delete the live one rather than the dead one (because they can't tell which is which).

<comment><USER15> bbatsell hit this correctly. I saw two replies appear and immediately killed one. It surprises me to see replies on the dead one, there were no replies when I did the kill.

</comment></comment></comment></comment></comment><comment><USER16> I think a lot of this "bees are computers" business started back with this

[http://www.math.rochester.edu/about/newsletters/spring98/bee...](http://www.math.rochester.edu/about/newsletters/spring98/bees.html)

</comment><comment><USER17> After given the "travelling salesman" optimization assignment, on the handup, I handed up my KD-tree implementation and at the end of the write up I suggested the lecturer check out a similar article on bees to this (may have been the same one, was a while ago)

got extra 2% bonus :)</comment>


Sails.js – Real-time MVC Framework for Node.js - <AUTHOR> http://sailsjs.org/

<comment><USER3> I have had the chance to play with Sails and I really like it. Just a warning, this is a great tool for _simple_ web apps. I wouldn't take the Sails path if you are going to do something a little more tailored, (like Nodejs + PostgreSQL w/ Sequelize + Redis for sessions + memcached + MongoDB for analytics + passport w/ Oauth2 + etc.. ), I would leave that to express + express-routes. I would definitely chose Sails for demo'ing a product idea or personal projects I want to get up and over with as quickly as possible, and Sails is REALLY quick.

I can't wait to see how Sails evolves, they are some damn good dev's.

</comment><comment><USER4> Great stuff.

Whilst getting in to Node from Rails (& Meteor) I've found the lack of backend, structured MVC frustrating. Apparently it's not 'Nodey' to make a big framework like Rails, but I'd rather figure that out myself in due course rather than using Express and having no idea what to do after the trivial stuff you see in tutorials…

<comment><USER5> Correct me if I'm wrong, but isn't Meteor built on top of Node? Though I suppose it does, as far as I remember, completely hide the Node container. (Or did I misparse your sentence?)

<comment><USER4> Yup, but it's super abstracted — I run the London Meteor meetup but still have no idea how Fibers work :)

I've now written a couple of production apps with Meteor but it always feels like I'm writing frontend JS with a magical backend (and a couple of server methods) ala Parse, rather than building apps with Node.

</comment></comment></comment><comment><USER6> Not sails-specific, but

sudo npm -g install sails

Why do so many projects require sudo? Why are we writing to any area which would require root write privileges? Why do we not default to just writing stuff in to user home directories and patching off that?

Possibly naive question, but one which is increasingly bugging me.

<comment><USER7> I think on github [https://github.com/isaacs/npm/issues](https://github.com/isaacs/npm/issues) is the right place to ask this, or tho add a feature request.

"-g" ist for global installations and you want a "-l" for user local installation.

<comment><USER8> -l does not mean "local". -l means "\--long" and has no relevance to the install command.

Local is the default state. If you want to force non-globalness, you can do `--no-global`

</comment></comment></comment><comment><USER9> GET requests to create users. What could go wrong?

<comment><USER10> How did you manage that? o.0 Re-wiring the routes?

<comment><USER11> I believe he's refering to this

        # Create a new user
        http://localhost:1337/user/create?name=Fisslewick
        (or send an HTTP POST to http://localhost:1337/user)

From: [http://balderdashy.github.io/sails/](http://balderdashy.github.io/sails/)

</comment></comment></comment><comment><USER12> The back button is broken and it doesn't appear to support HTML5 history by default in browsers that support it. (uses hash for tracking pathing)

<comment><USER13> That's really more of a concern for your front-end framework than your back- end framework, though.

</comment></comment><comment><USER14> It doesn't have associations between models yet but it does have amazing branding.

<comment><USER15> I don't think you're forced to use their model layer.

<comment><USER16> Technically you're not forced to use Sails.js at all. I'm not sure that's the point though.

</comment></comment></comment><comment><USER17> Totally off-topic and maybe even trollish, but I noticed the cute little illustration here: [http://sailsjs.org/#getStarted](http://sailsjs.org/#getStarted)

Interesting that the female is skinny, with a trendy little mid-riff baring shirt, and attractive (so far as a stylized comic character can be). One of the male characters is a pudgy dude with glasses. It seems the norm in characterizing girls in tech is "you can be a developer, but stay sexy - <USER2> don't have to be a nerd!" Does this risk marginalizing normal women?

<comment><USER18> One of the two designers who worked on it is a woman-- feel free to ask her:

[https://twitter.com/KallunaLovegood](https://twitter.com/KallunaLovegood)

<comment><USER17> Whether or not a woman did the design isn't the point. This particular design wasn't even the point. I was questioning what seems to be a trend.

<comment><USER19> The person you're responding to didn't say that a woman designer was the point.

They said you can feel free to ask her your question.

I wish you would too, because I can't stand coming into a thread about some cool new technology and having it turn into a melodramatic women's study.

</comment></comment></comment></comment><comment><USER20> Hmm seems to be broken currently on OSX. (Not sure if sails or node is the problem) Following the steps on getting started guide.

      brew install node

      sudo npm -g install sails

      sails new testProject

command not found: sails

Also from a UX standpoint I would point the user to another page where they can continue learning about the framework after the download is finished.

Right now it states "Now, let's get Sails to do cool stuff." and leaves the user hanging with nowhere to navigate to.

<comment><USER21> Npm should be used without sudo, like homebrew. I guess thats the problem. They should change that.

<comment><USER22> I don't think npm install -g works without sudo under most default configurations.

</comment></comment></comment><comment><USER23> I know nothing about the framework (and I don't see any examples or anything that tells me _why_ it's any good), but that is a _beautiful_ landing page.

<comment><USER24> It does look amazing, and maybe its just my PC but on Windows 7, the bullet text below is almost impossible to read. Could also be my display. It looks fine on my Nexus 4, and is _ok_ on Ubuntu.

Maybe my font aliasing is just messed up. Thin fonts have never really looked great on windows for me.

<comment><USER4> Have you got Cleartype disabled?

</comment></comment></comment><comment><USER25> This looks like an awesome project and the overall design is absolutely great, kudos. One thing that amuses me though is how part of bootstrapping the Node user base was built upon a lot of Rails-bashing, only to find out a few years later that most of the frameworks are basically trying to recreate some form of Rails in Javascript.

All the best to the authors nonetheless.

</comment><comment><USER26> It looks pretty well thought-out, which is a big +1 when I'm framework shopping. However: use pushState/replaceState! Or at least fix your buggy back button. Your hash-based navigation totally breaks the back button to a point where I can't believe you shipped this.

<comment><USER26> Also: don't forget to use manifest files to concatenate your compiled CSS :)

<comment><USER22> Or you could just use LESS and @import your styles. LESS @import for other LESS files works much like C's #include, rather than simply converting to a CSS @import line.

<comment><USER26> He's using rails, so he can use SASS (which personally I like better than LESS, but they accomplish the same things). Manifest files are better though, because with LESS's @import, you might import more files than you actually want. I believe you also have the recursive import issue, just like C. Manifest files give you more granularity by existing outside of the actual stylesheet.

</comment></comment></comment></comment><comment><USER18> Hey if anyone's curious about what this is, here's my video: [https://www.youtube.com/watch?v=GK- tFvpIR7c&feature=youtu.be](https://www.youtube.com/watch?v=GK- tFvpIR7c&feature=youtu.be)

</comment><comment><USER27> This Sails.js tutorial is really good: [http://net.tutsplus.com/tutorials/javascript-ajax/working- wi...](http://net.tutsplus.com/tutorials/javascript-ajax/working-with-data-in- sails-js/)

</comment><comment><USER28> This word real-time. I do not think it means what you think it means.

<comment><USER29> But.. Socket.io is built in sooo realtime ... Right?

<comment><USER30> Yes, it is. We are mostly professionals here and understand the limitations of technology, specifically when talking about latency and implementations ranging from websockets to long polling. We look past these minutiae and get to the real subject of getting data to the user as soon as possible. Generically, this is referred to as "real time".

<comment><USER16> I actually wish we called this something else like say "persistent". Real-time systems have a very specific meaning for many people and while yes we all _get it_ , it is probably a point of distraction for a lot of people to hear this term constantly misused.

</comment></comment></comment></comment><comment><USER16> How does sails handle assets, do you have something similar to sprockets that can be added to this?

<comment><USER31> In the upcoming v0.9.0 release we are using Grunt for assets.

</comment></comment><comment><USER32> Off topic, but the choice of port for a Sails app is quite interesting, "1337" [1].

[1] [http://sailsjs.org/#getStarted](http://sailsjs.org/#getStarted)

</comment><comment><USER33> Hi! I've tried a couple of days ago and after running the getting started, noticed that none of the tutorials in the right column were available. Did this changed ?

</comment><comment><USER34> I'm not too versed in Node frameworks : is Sails a direct competitor to Meteor ? If so how is it different ?

<comment><USER7> I did not see the difference, only that Sails has a smaller scope. With Meteor you can change all frontend-data of connected clients "in realtime", but Sails did not have this key feature. So iam not sure why i should use Sails, when i can have more with meteor?

<comment><USER21> Warning, this is a rant.

I've started a Meteor.js Project 3 Weeks ago and I'm regretting it. It's an architectural nightmare. It uses global variables for everything. One would think the news, that this is a bad idea, would have spread since the 70's. Unit tests are not possible in this style. You can do integration tests with the Laika Framwork though.

The next problem is a severe case of "note invented here" syndrome. Packaging, data access, Templating - Meteor.js has it's own. For example, they have their own version of Handlebars which I did not realize until yesterday. It has some documented and some undocumented differences to the original one. I had lots of fun with some custom Handlebar helpers that I wrote. I tested them against the original Handlebars and they passed all my unit tests. In the project however they did not work at all.

As KaoruAoiShiho said the bindings suck terribly. Well, they don't exist really, you just use jQuery. (Thank god, they don't roll their own version of that.)

The elephant in the room is data access. If you're a MongoDB fan like I am they will lure you in with the fact that you can use MongoDB directly form the client. Don't fall for that, it's a terrible idea. It's such a terrible idea, that they introduced 'server methods' to kind of fix all the problems with it. Server methods are not REST. Server methods are RPC style web APIs. Welcome to 10 years ago. They dislike REST because it's stateless. (at least that's what i've taken form this talk: [http://www.youtube.com/watch?v=NnMqMAYmTuo](http://www.youtube.com/watch?v=NnMqMAYmTuo)) As you might have realized by now these guys just LOVE state. State and global variables.

If you're a Haskell programmer and you are not jet curled together into a ball and crying, id's suggest to quickly read a monad tutorial before continuing.

Dependency management is also a big problem. You can't just use nodes good old `require` and `module`. The order in which files are loaded is determined by their name and position in the directory structure. I shit you not.

They have also their own build tool. (who would have thought...) It watches your files and compiles them. Which works great most of the time. You can't have includes in your SASS/LESS/Stylus files tough. I guess the notion of having a proper module system scares it a little. I found this thing to be the best aspect of my whole Meteor experience. Not as good as Grunt though.

Per default, there is no routing. There is an unofficial routing package which works good, but is by far not as feature rich as the Express one. It also introduces some more global variables in true Meteor.js spirit.

In my opinion Meteor is good for prototyping. You can get a small app up in no time. Just don't build anything real with it.

<comment><USER7> Thx for that huge info! I only read about meteor and their informations on the webpage, i want to use it in some weeks for a smaller project, but now i will look closer at meteor before i use it.

</comment></comment></comment></comment><comment><USER35> I keep reading it as "snails". It looks like fun, though. I look forward to playing with it.

</comment><comment><USER36> I don't think "real time" means what you think it means.

</comment><comment><USER37> So how is it different from Express.js?

<comment><USER38> Express isn't really much of a client side MVC framework. It is still a very clean and simple framework.

If you want to drink the cool aid of single page apps, 'rich' client side etc, you have to invest into some MVVC/MVC frameworks like Angular, Ember or now Sails, which works well with Node.js apparently.

<comment><USER39> imo Sails is a backend framework to be used with Node, while you can use Ember/Angular/whatever on the frontend side.

<comment><USER38> You are right. Having not gone through what Sails was, I have mis-represented it a bit. Its more RoR than Sinatra (Express) as others have expressed here.</comment></comment></comment></comment>


W3C invites implementations of WebRTC 1.0: Real-Time Communication b/w browsers - <AUTHOR> https://www.w3.org/blog/news/archives/6619 <comment><USER2> the W3C has lost all credibility</comment>


Show HN: A new, clean, open source Hacker News reader for Android - <AUTHOR> https://play.google.com/store/apps/details?id=io.dwak.holohackernews.app

<comment><AUTHOR> I posted this months ago with the initial design that looks nothing like it does now.

Since then I've adopted the Material Design specs from Google as well as added a tablet layout for large Android tablets. Let me know what you think!

Source can be found here: [https://github.com/dinosaurwithakatana/hacker-news- android](https://github.com/dinosaurwithakatana/hacker-news-android)

</comment><comment><USER2> Would be cool if this uses the official HN API :)

<comment><AUTHOR> Hey cheeaun, this is using an older version of your api, I plan on updating it this weekend :D</comment></comment>


Ask HN: Have a Happy Christmas - <AUTHOR> <comment><USER2> You too</comment>


Show HN: Mojimess – Cryptography for Kids - <AUTHOR> https://mojimess.com/ <comment><AUTHOR> Just wanted to share this quick webapp me and my 6 year old put together. He wanted a way to send messages to one another using his 'secret coding' he had recently learned at school. It's emojis!!</comment>


Where to move in the Bay area? - <AUTHOR>

I am thinking about moving  to SF, but I am not familiar with the area. Where is good area to live? I want to be somewhere close to shops etc so i can ride a bike to most places. I am not trying to spend a lot money.
<comment><USER2> All of Sillicon Valley is just a strip mall wasteland. If you are European, or lived in Boston/Nyc/D.C. it will be the most boring place in earth to live. (I have no clue how people living there are not shooting themselves with a shotgun. maybe paxil is helping). San Jose was named the most boring large City of USA (actually it is more of a suburb itself). SF is much more fun, but it has its problems of bums, trash, urine smelling streets, car break ins, ugly girls with no fashion sense, etc.... ah and lots of fog. But there is lots of stuff to do, good night life, great house music scene, you can walk to places.

Rents are crazy right now, and it is VERY VERY hard to find a decent place for a decent ammount. Get ready to pay 1600/mo per bedroom, or $2200/mo + for a two bedroom.

Berkeley is fun too. It would be my second choice as a place to be. Avoid Palo Alto, and most of the Peninsula, same boring stuff as south bay. Oakland can be very gheto, and not safe, (except few pockets such as Montclaire, )

<comment><AUTHOR> thank you for the details

</comment></comment><comment><USER3> It sounds like you are unattached and without kids, so the short answer is SF.

San Francisco is expensive. The Mission District is best IMO: good nightlife, good transport, but the noise, fog, and urine-in-the-street levels are lower than the Tenderloin. Expect to pay 1600+ for a 1 bedroom.

I have friends who live in East Oakland, and love it. It's much cheaper and very accessible if you land near a BART station.

<comment><AUTHOR> thanks will chek although i believe 1600 is way too much for me.

<comment><USER2> Get roomates than. With another roomate, you can split a $2200 bedroom, and end up paying around $1100, which is more reasonable. Another warning: Find a job before coming here. It can be hard to find a good one, and usually takes time. The city is expensive, and there is lots of fun things to do, and you will see that money evaporates fast in here. The only other place more expensive in SF is NYC.

</comment></comment></comment><comment><USER4> San Francisco is the best place to live that I know of.</comment>


Pot causes schizophrenia and triggers heart attacks, experts say in study - <AUTHOR> http://www.dailymail.co.uk/health/article-4114634/Marijuana-DOES-cause-schizophrenia-triggers-heart-attacks-experts-say-landmark-study-slams-drug-s-medical-benefits-unproven.html <comment><USER2> Sure, it is well-known that people with schizophrenia are more likely to use marijuana, but correlation is _not_ causation.

"But here's the conundrum: while marijuana went from being a secret shared by a small community of hepcats and beatniks in the 1940s and '50s to a rite of passage for some 70% of youth by the turn of the century, rates of schizophrenia in the U.S. have remained flat, or possibly declined. For as long as it has been tracked, schizophrenia has been found to affect about 1% of the population."

[http://content.time.com/time/health/article/0,8599,2005559,0...](http://content.time.com/time/health/article/0,8599,2005559,00.html)

</comment><comment><USER3> Talk about focusing on the negative, Not quite what it says... (from other post on HN)

[http://www8.nationalacademies.org/onpinews/newsitem.aspx?Rec...](http://www8.nationalacademies.org/onpinews/newsitem.aspx?RecordID=24625&_ga=1.232139931.524626704.1484279064)</comment>


Hunter S. Thompson meets a Hell's Angel (1967) [video] - <AUTHOR> https://www.youtube.com/watch?v=ccyu44rsaZo&feature=youtu.be <comment><USER2> "...to keep a woman in line, you have to beat her on the rocks once in a while."

"I agree."

The audience laughs it up. Disgusting.

I used to work for the CBC and I think most of my colleagues are utterly ashamed of this outside the context of looking back on the wrong parts of our history.

<comment><USER3> It shows how different of a time it is with the whole crowd laughing along. Are there other videos of HST this young? He seemed even sharper back then, or not stoned.

edit: you edited in the same sentiment as my first sentence

<comment><USER4> If I understand the timeline, this interview is either before his love affair with LSD, or right around the beginning.</comment></comment></comment>


A Third of Valve Is Now Working on VR - <AUTHOR> http://uploadvr.com/valve-third-vr/ <comment><AUTHOR> The by far most interesting comment from the thread is this one (It's by Alan Yates who works on Vive/SteamVR) [https://www.reddit.com/r/Vive/comments/4osav8/lighthouse_tra...](https://www.reddit.com/r/Vive/comments/4osav8/lighthouse_tracked_osvr/d4geko7).

>Of course. We want AR/VR/MR to be ubiquitous. Over the past four years or so I've seen many companies big and small bring their demos to show and tell. They all have bits and pieces of the larger puzzle. Good eye tracking, interesting haptic techniques, next generation display technologies. But most of them are narrowly focused on their thing, and struggle alone to make a successful product. Partially this was just because the market didn't exist but also many of them were/are just trying to boil the ocean. The minimum viable product is now a pretty high bar and that can stifle innovation. We can offer a running start, the traditionally "hard" parts of HMD technology, the things other than GPUs that kept VR niche for so long. In return we ask that your device leveraging our technology works with our platform. And mostly that is it. We won't ask that it only works on our platform, we won't stop you from targeting other industries. This gives both you and your users freedom of choice and security that isn't dependant on either party's future decisions. It is a pretty good deal really. Our platform has a rapidly growing collection of great content for your end-users so your product won't be an orphan and you don't need to convince anyone to author for it. Day one people can fire up Tilt Brush and have their minds blown by your awesome new hardware.

If Valve games are "locked" to SteamVR and won't play on Oculus, then nobody is going to buy an Oculus. Does Facebook really think that people are going to choose Lucky's Tale over Portal 3 or Half-Life 3? Facebook is going to have to capitulate and focus on their hardware advantage.

<comment><USER2> Amazing to hear someone who works for Valve actually mention "Half-Life 3".

<comment><USER3> That paragraph wasn't part of the quote, it ends the sentence before "If Valve..."

</comment></comment></comment><comment><USER4> In all of my experiencing of the new VR products, I am firmly in the position that it's not ready for public consumption yet and won't be for quite some time. The only real reason it's being pushed hard is because people have a fear of missing out. Meanwhile, if I were a company I'd be focusing on AR, because at least there you can push for enterprise customers which won't need the full immersion yet that a general consumer will clamor for. (I also think AR has a much brighter future)

I expect a lot of VR units are shown off to friends and thrown into the closet or put on a shelf to collect dust. It's something you show off, but not something you'll (at least 98% of people) use.

<comment><USER5> VR fundamentally conflicts with how the eyes focus, and it will never be solved with the current technology. For some people it's not a big problem, but a sizeable portion of the population will be unable to use VR at all or for any extended period without ending up with eye strain, headaches, nausea, and/or a general sense of malaise. It will always be something of a niche technology IMO - very cool, but of limited use.

It's the same basic problem that 3D films have. There's a reason that films are still shown in 2D. I have only ever watched one film in 3D and it was overall an unpleasant experience that I don't care to repeat.

Application developers could work to mitigate the worst of the effects on the eyes, and that's something that would help adoption. That has, however, not happened with films and I doubt it will with games - everyone seems to want to give people as great a sense of depth as possible, which simply doesn't work _at all_ for many people.

AR largely eliminates these problems, and I'm inclined to agree there is more overall promise there.

<comment><USER6> Do you own a CV1 or Vive? How many hours do you have in them? How many people have you demoed them to?

The last pair I demoed to spent 3 hours in the Rift, with a single person spending two hours without stopping. This was their first experience ever with VR.

VR sickness is a thing and it's varies from person to person and use case to use case, but I have never experienced (personally or vicariously) issues related to eye strain. The lenses are supposed to take care of that by allowing your eyes to focus at a distance.

One of the reasons room scale is making so much noise is that it's a very different experience in terms of VR sickness. Far fewer people get sick in room scale because positional and rotational tracking are good enough that it feels "right". There are fewer motion cues mismatched with visual cues because you are physically moving and the headset is tracking 1:1.

Room scale also has vastly improved immersiveness (now we are calling it presence) especially when combined with tracked controllers and environments that afford all the interactions you would expect from whatever environment you are in.

<comment><USER7> I've had similar experiences. Showed Edge of Nowhere to someone a week ago, they spent 3 solid hours in.

Tried talking to them to see if they wanted to go for a walk or something. No response, too engrossed in game.

<comment><USER8> _> Tried talking to them to see if they wanted to go for a walk or something. No response, [too] engrossed in game._

Future in a nutshell.

<comment><USER9> The Fermi paradox has been solved.

</comment></comment></comment></comment></comment></comment><comment><USER10> The Valve publications page has a few slides and documents relating to Valve presentations regarding VR:

[http://www.valvesoftware.com/company/publications.html](http://www.valvesoftware.com/company/publications.html)

One of my favorite tidbits comes in the presentation, "Lessons learned porting Team Fortress 2 to Virtual Reality", on preventing VR motion sickness: [http://media.steampowered.com/apps/valve/2013/Team_Fortress_...](http://media.steampowered.com/apps/valve/2013/Team_Fortress_in_VR_GDC.pdf)

> _Don't change the user's horizon line, ever. You can see here how the camera > follows the motion and rotation of the character's head and so it rolls. > Your actual head isn't going to roll when you get killed by an Eyelander, so > the mismatch will make you sick._

Here's the presentation's video, bookmarked at the aforementioned insight:

[https://youtu.be/Gpr0FE2ATaY?t=19m36s](https://youtu.be/Gpr0FE2ATaY?t=19m36s)

For those of you non-TF2 players, the "Eyelander" is the name of a player- wieldable sword, and when it connects, the victim's head flies off and rolls around the ground. Apparently simulating that effect (changing the user's "horizon line") will make people very sick.

<comment><USER11> To be fair, being decapitated in such a way that your head bounces and rolls around will leave you feeling, at the least, very sick.

<comment><USER12> So what can be learned from this tidbit? Don't get decapitated.

</comment></comment></comment><comment><USER13> Of all the gaming companies, Valve makes the most sense to be this heavily invested in VR--given their stake in the PC-industry.

Or maybe too many devs thought VR was the coolist project to work on and moved to it. (Valve is known for their flat structure [http://www.valvesoftware.com/company/Valve_Handbook_LowRes.p...](http://www.valvesoftware.com/company/Valve_Handbook_LowRes.pdf))

<comment><USER14> > Or maybe too many devs thought VR was the coolist project to work on and > moved to it.

I think it's this. That's the problem with hype waves in majority-ruled organizations. Or I'm wrong and people will soon be sitting in the subway with a VR headset on and playing Fruit Ninja in VR.

<comment><USER15> Valve doesn't make games that you can play sitting in the subway.

<comment><USER16> Valve also doesn't make Fruit Ninja, but they were just trying to make a point.

<comment><USER17> No, but they do profit from it being sold on their platform:

[http://store.steampowered.com/app/400760/](http://store.steampowered.com/app/400760/)

Well, technically not the brand name, but hey close enough.

</comment></comment></comment></comment></comment><comment><USER18> Half-Life 3 on VR would be the killer app. It would be this generations Lotus 1 2 3.

Though I personally feel VR for video games are a lot like Wii its awesome for a while then its collecting dust throughout the world. I really think the future is Augmented Reality and VR will be for mostly media consumption.

<comment><USER19> I disagree with that. I played (and finished) HL2 in VR and while it was more of a prototype (e.g. loading screens were static) it already proved modern(ish) FPS games are not the best application of VR. Too many kinks of the genre do not translate well, while other features of VR are left unexplored. For that matter, racing or space exploration games (where the protagonist is seated) translate way better.

So I think the killer for VR will be something else entirely. Still from a first person perspective, but way different from a modern shooter. In the same way it took us a while to perfect what FPSs should be like, or what platformers should be like, we're a bit far from what the perfect VR experience genres will be.

<comment><USER20> I don't think it's fair to judge the potential of VR FPS games based on playing a game that's over a decade old and was in no way designed for VR.

<comment><USER19> But that's my point. It is still a good indication of what a modern FPS is, and of what HL3 would be. I don't see them changing the game radically to be a "native" VR title, which is what VR needs (and which may not even be what we call a FPS anymore).

<comment><USER20> I agree, if HL3 is going to be one of the killer apps for VR then it will be radically different. I think Valve have the resources to pull it off, and I suppose we'll see what path they take.

</comment></comment></comment></comment></comment><comment><USER21> Jeri Ellsworth of CastAR (ex-Valve AR/VR hardware guru) did an interview recently* where she mentioned that Valve was kind of "painting themselves in a corner" by gearing their system's performance to play AAA-title games.

Now owners of those consoles will expect _every_ game to be an AAA title.

* [http://embedded.fm/episodes/156](http://embedded.fm/episodes/156) @ 53:20

<comment><USER22> I don't quite follow her argument there. Valve's push for a powerful platform will just mean that games that don't aim to be VR-Crysis have plenty of performance to work with, making development much easier.

The 'office simulator' example doesn't really seem to be about graphics, though, but about game length/most VR experiences being more tech demo than game.

I don't think people are going to be surprised by that. The HMDs are so expensive, and at least right now, so are the GPUs that can drive them, that people won't just impulse buy them. People who are spending that much money on a niche hobby like this will most likely know exactly what they are getting.

<comment><USER23> If AMD can come through with the RX480 and works with VR for around $199 USD. That makes VR a lot more accessible.

</comment></comment></comment><comment><USER24> I wish they would get back to what they used to do - make actual computer games. I still can't shake the nagging suspicion that the recent VR hype is just the product of the every-decade-or-so fad cycle (similar to what happened in the 80's with it).

<comment><USER25> Have you tried a headset yet? I think this time is different.

I thought it sounded like an early adopter money pit myself until I actually tried a Rift. It won me over even while underpowered (MB Air!) in very simple demos.

</comment></comment><comment><USER26> Side observation.

So Valve now has an better VR Set then Oculus. And all of a sudden every news on VR seems to flowing in Valve direction.

This reminds me a lot of the early days when we move from iD 's Doom to Valve's Half Life.

Note: ( John Carmack = CTO of Oculus and Founder of iD )

<comment><USER27> I like competition as much as the next guy, but I'm happy as long as the more open platform is more popular. Wish Oculus took a different route.

<comment><USER28> My prediction: Valve VR will be the choice for hardcore games/gamers. Oculus VR will shift focus to more casual gaming (quick, fun, not graphically superior), and more importantly media consumption (think: Facebook live 360 video of major media events like E3, or ComicCon, and eventually paid subscription for viewing of live sporting events like courtside NBA games)

<comment><USER29> This. Facebook is more interested in VR for sports, messaging, telepresence, news, ads, and entertainment media than it is for games.

Downside of that strategy is that the Valve/Vive bloc could produce radically superior technology because gaming creates seductive technical barriers to overcome. FB's intended uses do not.

<comment><USER30> Either Indy or F1 recently had a 360 degree view of the race from the top of the car. I could imagine some fans would love that for all types of racing (NASCAR included). Just turn your head to look left/right.

</comment></comment></comment></comment></comment><comment><USER31> I have been using an Oculus Rift for a few weeks and the experience is breathtaking. For example, there is an Apollo 11 educational game where you get to experience the mission from the point of view of Neil Armstrong or Michael Collins. I think it is hard to argue that "experiencing" history isn't far superior than reading about it. And the pure games like EVE Valkrie give you a cold sweat they are so immersive. Just my The cost right now are high, but no more than an iPhone. I think mainstream isn't too far away. My $0.02 at least.

</comment><comment><USER32> Why wouldn't they? The computer industry is stagnating because people can use phones and tablets for most of their computing needs. VR has the potential to drive sales of high-end hardware again. And Valve has skin in that game.

</comment><comment><USER33> I've just spent a week here in Shenzhen, China. What was the most impressive thing? There are literally entire floors in the electronics markets here filled with VR headsets. Even if it's early stage hardware, someone has to be buying them.

As for killer apps, like every other technology it's a fair bet that commercial success #1 will be porn.

From a more cognitive standpoint, I've long felt that what segregates spatial awareness from other senses is the sheer volume of data that can be presented, reasoned with and remembered. As old school hunter-gatherer-wanderer primates, it's our highest bandwidth input. This reality will eventually be utilized for problem solving (eg. VR excel spreadsheet visualizations and black box / static code analysis may become a non-gimmick norm).

</comment><comment><USER34> I've come to realise that Valve is no longer a game developer.

</comment><comment><USER35> VR is amazing and the opportunity is incredible. However, I am worried worried that the technology to produce high enough resolution displays will take some time to get here. Without smartphones driving the demand, will we get to 5-10k dpi displays for VR tech? We have 800 or so dpi displays rolling out, with current generation devices filling their FOV with about 500 dpi screens. We're driving 1.3-1.8m pixels per eye, but that is not enough if you want to pretend to gaze at something 20 meters away. The pixel density, especially in the center area of the display, should be much higher. Otherwise only abstract low polygon count content will work.

<comment><USER36> I'm also worried about the actual effects of motion sickness once it becomes actually mass consumer affordable. Generally, reports are that VR can be particularly rough for most folks.

<comment><USER37> While I enjoyed the DK2, I got unbearably sick from Half-Life 2 within a half hour. Playing with Tilt Brush on the Vive, I didn't feel the slightest bit queasy.

Not sure if the difference was the hardware or the software, but it seems like a solvable problem.

<comment><USER38> FPS games are inherently a million times worse for VR sickness than room-scale walking around, since the former has the mismatch of the avatar walking around with the player sitting in a chair, while the latter is 1:1

</comment></comment></comment></comment><comment><USER39> So one third of Valve is working on VR... absolutely definitely not working on Half Life 3 or Portal 3. Which pushes their possible/probable/hypothetical release dates even further into the future. :-(

<comment><USER40> Or... they could be working on Half Life 3 in VR?

<comment><USER41> When you think about it, Half Life would actually be a prime setting for a VR game. The reason being that VR FPS work best when you can teleport rather than physically move (or move the camera through a continuous operation). Half Life always has had characters that can teleport, so it's not a big leap.

<comment><USER42> Additionally, HL3 will have to be _big_ to wow fans, or it will be a disappointment. People have been waiting a long time, and riding the hype- train the whole way. The HL games were revolutionary, and, this would be another revolutionary step for them.

<comment><USER43> Which is too bad. I really just want a conclusion to the story. If they used the old modified Quake Gold engine to deliver that, I would be psyched.

</comment></comment></comment></comment></comment><comment><USER44> I wish Valve was publicly traded so that I can invest.

<comment><USER45> Invest in Clash of Clans, not this nostalgic shooter company. New generation never played such quakey games. Even Valve already knows that Half-life and so on has commercial value comparable to Nethack and is building new click-to-pay free-to-play mobile-first responsive disruptive VR-first AI-first isomorphic madness.

[http://www.theverge.com/2016/6/21/11986712/tencent- supercell...](http://www.theverge.com/2016/6/21/11986712/tencent-supercell- softbank-majority-stake-acquisition)

<comment><USER46> Valve would be a fantastic investment. Steam is essentially the app store for PC gamers -- which is an extremely dedicated (albeit smaller) userbase that consistently spends money buying and installing new games that come out on the platform (unlike actual mobile apps, installations of which are on the decline).

</comment></comment></comment><comment><USER47> After reading this thread, I have to comments:

1\. Exclusivity on a headset? Replace "headset" with "monitor" and you get how childish, stupid, and impractical that will be.

2\. I don't think monitor based games will transition well to headsets.

</comment><comment><USER48> And in the meantime no Half Life 3. What about priorities?

<comment><USER45> They can outsource it to Chinese companies. Gamers nowadays are not choosy and will play anything that has "Half-life" franchise label on it, "Doom" of 2016 confirmed it.

</comment></comment><comment><USER49> Half Life 3 will have VR confirmed!

</comment><comment><USER50> Half-Life 3 Confirmed

</comment><comment><USER51> HL3-D

</comment><comment><USER52> Valvr</comment>


Taking Inspiration from Failed Projects - <AUTHOR> http://avc.com/2015/05/taking-inspiration-from-failed-projects/

<comment><USER2> This seems to be more about thinking about timing of a project. What has changed since this project failed that could make it successful today.</comment>


'Sea Nomads' Are First Known Humans Genetically Adapted to Diving - <AUTHOR> https://news.nationalgeographic.com/2018/04/bajau-sea-nomads-free-diving-spleen-science/ <comment><USER2> So the spleen is larger. We don't even know what the spleen does. It appears to do something with the immune system. Possibly holding an infection at bay better. Not too long ago we'd just remove it and toss it. Rather than genetics, the enlarged spleen could be from the constant onslaught of bacteria they are fighting off.</comment>


Moving the needle - <AUTHOR> http://www.gabrielweinberg.com/blog/2012/07/moving-the-needle.html <comment><USER2> Interesting opening paragraphs but this seems like Part 1 to a series of posts.

 _That's a lot of people and is why early traction verticals like blog posts and non-mainstream press won't get you there. However, you have other options and usually more resources now that you're bigger._

Well, what are the other options? I don't mean this in a derogatory way at all, I sincerely want to learn.

<comment><USER3> It's thinking behind part of a book chapter we're writing for <http://tractionbook.com>

<comment><USER2> Cool, I subscribed to the email list.

</comment></comment></comment><comment><USER4> _This reality is also why viral growth is so powerful: growth % is built in and works somewhat regardless of user base size._

You technically don't need viral growth to have this. You just need _sustainable_ growth[1]

[1] <http://www.deviantbits.com/blog/engines-of-growth.html>

</comment><comment><USER5> "take the big tech giants like Google, Microsoft and Apple. To them, if it is not an x $billion opportunity, it isn't worth expending resources on it." ...? Surely it's worth them spending x $billion - $1 (or some similarly small but less pedantic amount).

<comment><USER6> The question is not "is this opportunity capable of making a profit at cost X?" but "if BigCorp could spend X on this opportunity, or spend X on a different opportunity, which one (or neither) should they choose?"

Consider the chances of getting a larger share of a different market, the opportunity cost of one investment over another, the possible synergy with other investments, total returns on total investment, and "if we spend X, how much will that move the needle?"

<comment><USER5> That would be their opportunity cost, which falls under the general umbrella term "cost".

</comment></comment></comment><comment><USER7> Too abstract, and very fluffy piece. So how is DDG gonna make revenue again?

<comment><USER8> Agreed. He spends 326 words saying what can be summed up as "when you're small, small changes will be noticeable. When you're large, you'll need to make some larger changes to notice a difference".

Actually, that's not a summary, so much as I challenge anyone to find more value or detailed analysis in the original piece.I read it and thought "what did I learn here?", not to mention how utterly vague it was.

<comment><USER9> Funny how when Gabriel Weinberg writes something, random anonymous HN commenters get voted to the top of the thread explaining how obvious and superficial the article is.

But when 37signals, which, like Weinberg, actually runs a real business that has to deal with these issues, acts in a way that is entirely consistent with that article, so much so that you have to wonder whether Weinberg's post is literally a response to them! --- the peanut gallery is up in arms about how "no company would ever walk away from 6 figure passive income".

<comment><USER10> This kinda reminds me of an article Gabriel Weinberg wrote a couple months ago about eliciting emotion: [http://www.gabrielweinberg.com/blog/2012/05/eliciting- emotio...](http://www.gabrielweinberg.com/blog/2012/05/eliciting-emotion.html)

</comment></comment></comment></comment><comment><USER11> Case in point: Every time I post my project <http://iwaat.com> in a relevant HN comment I see a noticeable bump in the analytics graph for that day. Hopefully, I won't be noticing HN comment traffic for very much longer.

<comment><USER12> What do you use to convert the web pages to images?

<comment><USER11> <http://shrinktheweb.com>.

Although I'm looking into switching over to a cheaper solution (<http://url2png.com> or <http://linkpeek.com>)

<comment><USER13> see also wkhtmltoimage: <http://code.google.com/p/wkhtmltopdf/></comment></comment></comment></comment>