PuTTY Tray - <AUTHOR> https://puttytray.goeswhere.com/ <comment><USER4> Alternatives to PuTTY linked in the thread so far:

[https://puttytray.goeswhere.com/](https://puttytray.goeswhere.com/)

[https://code.google.com/p/futty/](https://code.google.com/p/futty/)

[https://code.google.com/p/superputty/](https://code.google.com/p/superputty/)

[http://kitty.9bis.net/](http://kitty.9bis.net/)

[http://www.thegeekstuff.com/2009/03/putty-extreme- makeover-u...](http://www.thegeekstuff.com/2009/03/putty-extreme-makeover- using-putty-connection-manager/)

Which one is the best? I currently use Putty Tray, for no real reason except that someone linked it to me awhile back and it is, imo, better than vanilla PuTTY. But how does it compare to the alternatives?

Edit: added more!

<comment><USER5> It's not a matter of which one is best, it's which one do I trust. I know source is available but these applications may not be subject to the kind of scrutiny and monitoring that better know packages might be. How long would it take before anyone noticed if the binaries for one of these was altered? How difficult would it be to carry out spear phishing attack against one of the authors allowing that to happen?

<comment><USER6> That's an accurate summary of the threat looking back in time. Looking forward in time, when a bug is found, which has a larger mass of humanity working to fix it, the intensely scrutinized original, or a UI theme mod that about ten people use?

This is the kind of thing that always scares me away from little two person linux distros forked off a "real" distro. Imagine in six months there's yet another mistake in Debian's SSL libs much like happened before. Or insert your own analogy. Who's more likely to quickly push patches out, the thousands in the Debian keyring pushing the hundreds who are active pushing the tens who are into security pushing the (small number) in the FTPmaster team to push the patched packages out as fast as 100 wpm keyboards humanly allow, or the two guys who made Zombie-nix which is merely a fork of Debian with everything they don't personally like removed, a scarey animated gif zombie themed boot screen, and some "marketing", who can't be reached because they're out camping, drinking, and shining deer until next month? (not that there's anything wrong with camping and drinking, although deer shining I suppose depends on your state/local laws)

<comment><USER7> _...deer shining I suppose depends on your state /local laws_

Hey, spotlighting is a traditional hunting technique of my people!

</comment></comment></comment></comment><comment><USER8> [https://github.com/FauxFaux/PuTTYTray/wiki/Other-forks-of- Pu...](https://github.com/FauxFaux/PuTTYTray/wiki/Other-forks-of-PuTTY) _edits madly_

</comment><comment><USER9> It's probably a great app - but PLEASE datestamp update release notes announcement etc so I know the age of what I'm reading and whether I'm seeing a development/change history stretching over 3 months or 3 years etc.

<comment><USER10> This is one of the reasons why I love GitHub/Google Code - you can see the commits they have made and see how active a project is before jumping into it.

<comment><USER8> A problem with both of these is when the stable branch of the project is reasonably dead (on account of being stable, and, say, hasn't had a release for 8 months[0]), but the actual development branch[1](es[2]) are much more alive, nearly even this week.

[0] [https://github.com/FauxFaux/PuTTYTray/tags/](https://github.com/FauxFaux/PuTTYTray/tags/) [1] [https://github.com/FauxFaux/PuTTYTray/commits/next](https://github.com/FauxFaux/PuTTYTray/commits/next) [2] [https://github.com/FauxFaux/PuTTYTray/commits/unix2](https://github.com/FauxFaux/PuTTYTray/commits/unix2)

</comment></comment></comment><comment><USER11> What I never really got is why Simon Tatham refuses to improve the original PuTTY. He must know it is used mainly on Windows (is anyone actually using the Unix version?).

His wishlist stated that tray support was tricky ([http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/s...](http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/system- tray.html)), but when I wrote the original Tray patch I was shocked to find that I could do it with a few lines of code (and I didn't have any experience with C or the Windows API)...

<comment><USER12> Reading the wish list I do get the impression that he doesn't have a great intuition about Win32. (My own background: I worked in the Windows division at MSFT for a few years). Particularly telling is the item about not knowing what form of IPC to use to simulate Unix domain sockets in pagent (no mention of Win32 rpc or named pipes), alongside some weird ideas about SendMessage and modal dialogs... Or the part where he says he won't do a wince port since he'd have to rewrite with wide strings (not that wince is as relevant as it used to be). I am surprised that the author of such great windows software is writing some of these things.

It does bear repeating though that putty is a great application and the list of stuff he has knocked off on his changelog (same page as the wish list) looks impressive.

</comment></comment><comment><USER13> I've been using this for a while. It is just like normal putty except it can launch/minimize to the tray. That's the only thing I needed so it was perfect for me. I haven't tried any of the other forks listed here and have had no reason not too.

</comment><comment><USER14> These days I use MobaXterm for SSH and SFTP [http://mobaxterm.mobatek.net/](http://mobaxterm.mobatek.net/) MobaXterm is an excellent program and that has way more features than I actually use.

<comment><USER15> +1 for MobaXterm!

Excellent program, includes bash and some other basic linux tools and an X server so you can run forwarded applications via SSH. It doesn't beat running an actual linux distro, but it's the closest thing to it that I've found.

</comment></comment><comment><USER16> With some of these alternatives that wrap the PuTTY executable, it is worth pointing out that if you provide the wrapper with the password to login with (as opposed to typing it in the PuTTY console window), it will probably just pass the password to PuTTY as a command line argument. This means that the password will be visible in plain text to any other process running as you or any elevated user/process (unlike on Linux, I don't think you can view detailed information about another user's processes, like the full command line, without elevation).

I have verified this with SuperPuTTY - just launch a session by entering the credentials in the toolbar then use the following PowerShell command to see it -

      get-wmiobject win32_process -filter "name like 'putty.exe'" | select commandline

Alternatively, fire up Process Explorer from live.sysinternals.com.

<comment><USER17> automaticly inputting passwords is a terrible idea, please use ssh keys (and password them!). Pageant makes doing this not a pain, plus stuff like filezilla will automaticly use pageant keys to login for sftp!

[http://the.earth.li/~sgtatham/putty/0.62/htmldoc/Chapter8.ht...](http://the.earth.li/~sgtatham/putty/0.62/htmldoc/Chapter8.html)

[http://the.earth.li/~sgtatham/putty/0.62/htmldoc/Chapter9.ht...](http://the.earth.li/~sgtatham/putty/0.62/htmldoc/Chapter9.html#pageant)

</comment></comment><comment><USER18> Personally I prefer FuTTY which includes a decent mish-mash of patches and modifications.

[https://code.google.com/p/futty/](https://code.google.com/p/futty/)

Supports all kind of terminals, like telnet, ssh, adb, cygterm, etc. Supports clickable links. Good unicode/wide-char support.

</comment><comment><USER19> How does it compare to Kitty [0]?

[0] [http://kitty.9bis.net/](http://kitty.9bis.net/)

</comment><comment><USER20> I use Putty Connection Manager, which has a pretty good tabbed interface.

[http://www.thegeekstuff.com/2009/03/putty-extreme- makeover-u...](http://www.thegeekstuff.com/2009/03/putty-extreme-makeover- using-putty-connection-manager/)

</comment><comment><AUTHOR> Whoa! there seem to be a lot of forks for the original PuTTY.

I never used anything else other than this and putty itself.

Perhaps there should be a wiki page for "Comparision of PuTTY Forks" on wikipedia.

</comment><comment><USER21> I've been using xShell for quite some time now, it has great 'supported' automation features, links, tab based, x support, session saves, etc..

This is a free product for schools and home users :). I highly suggest using it.

[http://www.netsarang.com/products/xsh_key_features.html](http://www.netsarang.com/products/xsh_key_features.html)

</comment><comment><USER22> I use putty _and_ cygwin openssh on windows. (In fact, I use putty as my terminal on windows.)

Having to have two separate ssh-agents annoyed me, so I hacked together something that let me use just pageant: [https://github.com/wesleyd/charade](https://github.com/wesleyd/charade)

</comment><comment><USER23> I used to use PuTTY; however, Cygwin provides a more consistent environment with other Unixy systems (standard OpenSSH with all of its normal configuration files and key formats, plus an X server), and MinTTY provides a nice native-feeling terminal emulator (originally based on PuTTY).

</comment><comment><USER24> Does anyone actually find URL hyperlinking useful? Kitty has that as well and it just causes me problems. There are URLs in logs that I look at, and I do not want to click on them but do sometimes. (I've since gone back to PuTTY.)

</comment><comment><USER25> I recommend mputty if you are looking for something with tabs/window splitting: [http://ttyplus.com/multi-tabbed-putty/](http://ttyplus.com/multi- tabbed-putty/)

</comment><comment><USER26> I am using mRemoteNG ([http://www.mremoteng.org/](http://www.mremoteng.org/)).

What's great is that in one tabbed interface I can do VNC / RDP and SSH connections.

<comment><USER27> +1 for mRemoteNG. It's by far the best of all I've tried.

<comment><USER9> Well, if we're counting votes, you can have one from me too mRemoteNG's tabbed interface and supported protocols really helps with remote/local support

</comment></comment></comment><comment><USER28> Nice to see this maintained again, I used it in the 0.59 period, but changed to vanilla putty when 0.60 came and puttytray wasn't updated (iirc, might have been 0.61 too)

</comment><comment><USER29> Comparison to SuperPuTTY? [https://code.google.com/p/superputty/](https://code.google.com/p/superputty/)

</comment><comment><USER30> just in case there's anyone who hasn't seen it before, Xming[0] combined with {putty,kitty,alternative} allows you to `ssh -X host`

[0] [http://sourceforge.net/projects/xming/](http://sourceforge.net/projects/xming/)

</comment><comment><USER31> tabs?

<comment><USER32> Tabs are evidence of poor window management capabilities on the part of the host windowing environment, which is why they are ubiquitous in PC web browsers.

<comment><USER33> This comment is evidence of poor reference citing capabilities on the part of the original commenter, which is why such comments are ubiquitous in Hacker News threads.

<comment><USER32> Not every comment on HN is intended to eventually make it unscathed onto Wikipedia.

I intended to spark discussion around the question _"Why do so many people want applications to provide tabbed windows?"_. I can see that people might have misinterpreted my comment as attacking the OC for wanting tabs (wanting tabs is a rational response to not having faith in the OS's window management capabilities) or as an attack on MS-Windows (I used PC as opposed to tablets/phones, which use non-windowed guis; so to include Macs/Gnome/KDE/etc; perhaps there is an obscure windowing environment that allows me to group and manage tens of windows without the aid of application-level tabs, but I am not aware of it). Never mind.

(No references: original research.)

</comment></comment></comment></comment><comment><USER34> superputty is quite good compare than other putty .

</comment><comment><USER35> Putty - may aswell install cygwin then a X11 windowing manager!

</comment><comment><USER36> If you're not going to own a mac (to run MacOS), why on Earth would you run Windows?!

<comment><USER37> You should answer the question: Why would you not run Windows?

Then, depending on how well I think you've answered that question - <USER2> I'll answer yours.

<comment><USER36> The only reason I use Apple software products versus open source ones is because of their incredibly well-executed integration of hardware and software.

If you switch away from Apple hardware or Apple software, you lose that - <USER3> at that point, the huge benefits of open source software (if only from the security side) outweigh any potential benefits of Microsoft value-adds.

I might argue in favor of Microsoft software if they'd switched gears years ago, and now Windows 8 was simultaneously released coupled with a laptop as polished as a Macbook Air from a few generations back. Unfortunately, PC hardware has spent the last few years playing catch-up with Apple hardware (c.f. "ultrabook" silliness) and, even were that race to be nearing an end (it's not), there'd be the non-trivial task of appropriately coupling software to the optimized hardware.

It just ain't gonna happen. It's enough of a win to get me to eschew open- source crypto for medium-value stuff (e.g. I still PGP confidential stuff, but use FileVault for disk).

I honestly wish that someone else made a laptop as high quality as the MBAir, and that Ubuntu (or any other open source option, but Canonical is the only contender really) spent the time and resources to make a truly polished release specifically for it.

The Chromebook Pixel comes to mind (excellent hardware and near-perfectly aligned software (though it is missing pinch-to-zoom)), but having to trust the vendor to that extent (signed OS, etc) undermines the benefits of an open- source stack anyway.

It may well come to pass that the ideal machine for a hacker is something like a Pixel in developer mode to allow for a toolchain. I'd have probably bought one instead of the rMBP I use now if it had come with more local storage and could run real apps (I edit video in FCP and have a 250GB photo library in Aperture).

Google needs to stop touting "the cloud" so much and make ChromeOS a serious contender. It's almost there, and the MBAir knock—err, ultrabooks are really catching up. I love the idea of a thin client but until commonplace WAN connections are two+ orders of magnitude faster, I'm not going to be able to relocate my HD video NLE's execution environment to the Googleplex. We're getting closer to that day for photos and audio.

There's no place for closed-source stuff in that world, though.

Apple's only winning the handset war with the closed-source model right now because of their hardware advantage. Microsoft doesn't have that angle.

<comment><USER37> Alright, I think I can see where you're coming from.

To answer your original question with just one of the possible reasons that people might run Windows - developers specifically in this example - it's because they are developing programs that will integrate tightly into the Microsoft/Windows software ecosystem. Why? Because millions upon millions of business and consumers run Windows. Why? Because it does what they need it to.

Now, I will address the points you made in your answer.

> ... incredibly well-executed integration of hardware and software.

What specifically? In general, that's highly debatable. It's not incredible because I have plenty of other hardware that is tightly integrated to it's operating system. For instance: My Android tablet or phone, Samsung Smart TV, Surface Pro, Google Glass and even my car (Tesla Model S).

Honestly, you'll have to be more specific about what in fact is so well- executed...

Here's my opinion: It's not well-executed, at least not anymore so than at least half a dozen other PC products that I can think of. I have a Macbook Pro and I can't even make the external monitor turn off without having to physically turn it off. Windows has had the ability to turn off the external monitor since 1998 - by switching from a multi-monitor profile to a single one.

Furthermore, what they do offer is extremely limited; bare-bones. For instance, you'll never have an integrated fingerprint scanner in your laptop. You'll never have convenient, clearly-labeled physical media-player buttons (play, stop, ff, rewind, volume). You'll never have a professional Wacom digitizer pen that draws right onto the screen like my Surface Pro. You'll never have the Thinkpad/Lenovo mouse-dot-thing that many people love. Why? Because Apple would rather convince their customers that "less is more" by all means, in pursuit of higher profit-margins on their hardware.

In general, can you think of a reason that people might view "tightly integrated" as a negative though? Just why is it that every financial institution on the planet is running Microsoft software (at the very least) and not Apple?

> ... the huge benefits of open source software.

This is humorous. Apple is the purveyor of one of the most closed-source computing hardware and software ecosystems in the world. Their OS is so closed, that if you wanted to make a replacement for the Dock that doesn't have a particularly nasty bug, you wouldn't be able to. I know this because I did research on that very topic and I found that non-Apple software cannot access the API that the Dock uses to change NSScreen.visibleFrame. Turns out there are a lot of APIs like that in the Apple universe.

At least Microsoft has (historically) left such APIs open. Now thanks to Apple being so successful at fleecing people with their walled-garden salad - Microsoft is following suit in their Mobile/Consumer products.

> Unfortunately, PC hardware has spent the last few years playing catch-up > with Apple hardware...

You mean like how Mac Pro users waited 4-5 years for an update? Oh, did you want to limit this to just laptops? What comparisons are we making here? Give me a Macbook model and I'll compare it to something else that was available at the time. There's really no need to wonder about this, the facts are available on this point if we can be specific.

> Apple's only winning the handset war with the closed-source model right now > because of their hardware advantage. Microsoft doesn't have that angle.

In what way? Market-share? Profit-margins? Global/National? I'm pretty sure Android is winning in market-share. [http://pocketnow.com/2013/06/04/smartphone-os-marketshare- ap...](http://pocketnow.com/2013/06/04/smartphone-os-marketshare-april)

I'm gonna need you to go ahead and give me some more specifics. A for effort though.

<comment><USER36> You are misunderstanding my argument, but it's late and I'm not getting into a Mac vs Windows debate in 2013, though you get points for making me almost consider it for a second.

<comment><USER37> > You are misunderstanding my argument

Not at all. I quoted each point that I responded to. Which one do you think was misunderstood?

> I'm not getting into a Mac vs Windows debate in 2013

Hopefully next time you'll realize that _before_ you invite one by making bigoted comments towards the vast, vast majority of people who run (and prefer) Windows.

In any case, it's time for me to check my mail in my open source email client (Thunderbird) after I close this (mostly) open source web browser (Chrome) and then I'm going to get back to developing some closed source software using some of Microsoft's open source .NET packages before I go to bed. Good night!</comment></comment></comment></comment></comment></comment>


Stealing Sensitive Browser Data with the W3C Ambient Light Sensor API - <AUTHOR> https://blog.lukaszolejnik.com/stealing-sensitive-browser-data-with-the-w3c-ambient-light-sensor-api/ <comment><USER2> What was the purpose of exposing the Ambient Light Sensor to web pages in the first place?

The W3C document[0] has a few suggestions:

> A Web application provides input for a smart home system to control > lighting.

> A Web aplication checks whether light level at work space is sufficient.

> A Web application calculates settings for a camera with manual controls > (apperture, shutter speed, ISO).

> A Web application monitors light level changes produced by hovering hand > user gesture and interprets them to control a game character.

While these applications are all potentially valid, it seems like each use case would be better served by a native app.

[0] [https://www.w3.org/TR/ambient-light/#usecases- requirements](https://www.w3.org/TR/ambient-light/#usecases-requirements)

<comment><USER3> > While these applications are all potentially valid, it seems like each use > case would be better served by a native app.

That is the threat. They're pushing hard to keep the "open web" competitive with native apps, so that the web is not abandoned as an app platform.

<comment><USER4> Well said. I'm surprised this is the only comment focused on this. WASM fits in that spot as well.

Eventually there's a point where the web platform is good enough that some companies choose to sunset native apps.

Delivering the same functionality across 3 disparate platforms is a waste of time and energy. Especially when the form factor in the end users hands is the same.

I get why it's that way now, but the question will come up over time. Especially for any app that needs live remote API calls to function.

<comment><USER5> The goal of keeping the open web "competitive" seems a little dubious, however, considering who's favor shall ultimately be competed for, no?

Offering up every last conduit one could possibly expose on a general purpose platform, so that competing interests on the other side of the wire are all fighting on a level playing field to harvest all the imaginable minutia of every quiver of flesh (whether voluntary or reflexive) against a piece of smartphone glass, in an effort to line pockets, starts to feel a little obscene after a while.

And if any quarter should be given, the big bad companies will pack up their wares and refuse to conduct business in the commons, leaving the web to disintegrate and decompose back unto what geocities, myspace and aol used to look like? Not sure that'd be so terrible, tbh.

<comment><USER6> _The goal of keeping the open web "competitive" seems a little dubious, however, considering who's favor shall ultimately be competed for, no?_

No.

I like my ebook reader app to automatically adjust to the light. I'd like to be able to build similar apps on the web platform.

I agree getting the security balance right is important though.

</comment></comment></comment></comment></comment><comment><AUTHOR> Such evil genius - and what is the solution? Yet another popup so sites can ask for permission to access the ambient light sensor?

We're already past the point where the average consumer is confused by what they are actually allowing when they click "Allow" for the various permissions.

<comment><USER7> The obvious solution is not having an ambient light sensor API, or a much more granular one, like the battery API should've been.

<comment><USER8> Exactly. Same with vibration, accelerometer, and gyro. For me personally there is zero reason why my browser should ever need these yet they can use them without any permission on Android Chrome and they cannot be disabled without rooting your phone.

<comment><USER9> Games can use all three of those very effectively. Agree they should be behind a permission prompt, though.

</comment></comment></comment></comment><comment><USER10> Mozilla response: ignore problem.[1]

        Component:▸ Security
        Importance: P3 normal
        Status: NEW
        Reported: 6 months ago

This wouldn't be hard to fix. Filter the signal down to about 0.5Hz, which is comparable to how fast most displays auto-adjust for brightness.

[1] [https://bugzilla.mozilla.org/show_bug.cgi?id=1357733](https://bugzilla.mozilla.org/show_bug.cgi?id=1357733)

<comment><USER11> This "vulnerability" is extremely hypothetical and they have not given proof that it can be exploited in the field. Just conjecture and a demo in a totally unrealistic environment.

<comment><USER12> It's not hypothetical at all. Watch the demos; they clearly demonstrate data being exfiltrated. Additionally, the article mentions several times that yes, the bits/sec is quite low due to several factors. I don't think the author is exaggerating the situation at all.

Would you rather wait for the API to go live and then be abused to steal real data? I would much rather researchers discover and report on possible attack vectors long before they are enabled by default. "Trust by default" long ago proved foolish.

<comment><USER11> > Although in our proof of concept demonstrations we rely on the assumption > that the light conditions do not change during the exfiltration phase, > extending the demos to handle these situations shouldn't be a problem

They say themselves that their demo is not real world and wont work in the real work and then say it "shouldn't be a problem" to make it work.

Not to mention that it takes 20 seconds of flashing the users screen to do the thing (how is that supposed to work without setting off alarm bells).

As I said, they have no proof of a real world vulnerability, only proof it a staged environment, and they readily admit it.

<comment><USER13> > they have no proof of a real world vulnerability

So what. This "default allow" attitude is easily more damaging than any other source of security problems. You (or anyone else) cannot know all of the ways exposing new data could be exploited, or might already be exploited in ways that we are not _lucky_ enough to know about.

Caring about security - which includes the future unknown unknowns you don't yet know to even look for - means minimizing what is exposed to the public attack surface to what is both _needed_ (which does _not_ include anything merely "wanted") and demonstrated/proven to have trivial risk with known limits.

</comment></comment></comment></comment></comment><comment><USER14> Actually extracting data this way sounds like the kind of hack that would gain someone an impressive reputation as a hacker, instead of triggering serious privacy risks.

Compare it to the iPodLinux project, when nilss extracted a bootloader using a piezo buzzer. Yes, this type of hack can be done, but something tells me it's not going to be a frequent worry.

[https://web.archive.org/web/20050301010451/http://ipodlinux....](https://web.archive.org/web/20050301010451/http://ipodlinux.org/stories/piezo/)</comment>


Inside the Amiga 1000 (25th Anniversary) - <AUTHOR> http://www.vintagecomputing.com/index.php/archives/672

<comment><USER2> I had a 2 Megabyte RAM expansion for my Amiga 1000. This was so much RAM that I could put a bootable floppy into it and boot from RAM. The RAM-Disk survived reboots and some crashes.

Crashes happened quite often because the OS had preemptive multitasking but no memory protection.

</comment><comment><USER3> I've still got an Amiga 3000 in a drawer around here somewhere that was working the last time I turned it on.

It was the last _interesting_ computer I used as my primary machine, before I starting buying PCs. They were definitely ahead of their time.

</comment><comment><USER4> Still have my Amiga 500 with 3rd party add on Hard Drive/RAM in a box plus 1080 monitor, extra floppy drive, modem, and lots of disks.....

<comment><USER5> unfortunately I just recycled my two A500's. They'd been sitting in the crawl space under the house and weren't being used. Not even sure they worked anymore. My 1080S broke several years (decades) ago so I hadn't used them in a while. One I remember had the 1MB chip ram upgrade that you did yourself by cutting a trace on the mobo between the 68000 and Agnus chips. Suddenly I feel old...

<comment><USER6> I have a bunch of 1200's w 040 accelerators, extra memory and whatnot boxed up somewhere. Still have a library of boxed games too... and Amiga Power of course ;)

</comment></comment></comment><comment><USER7> The Amiga was so amazing. I truly wish that platform could have prospered instead of... DOS.

</comment><comment><AUTHOR> Link directly to the slideshow, rather than his blog:

[http://www.pcworld.com/article/200083/inside_the_amiga_1000....](http://www.pcworld.com/article/200083/inside_the_amiga_1000.html)

</comment><comment><USER8> This article really brings back memories.

The first computer I ever owned.

Hayes 1200 baud external modem -- about the size of a paperback book, lots of flashing lights, and five-hundred bucks. I even had the sidecar, which as I remember was a little box that carried it's own PC. The whole thing was over $2K</comment>


Show HN: Google pagerank applied to employee appraisals - <AUTHOR> http://www.groupraisal.com/

<comment><USER2> this is how i would like to get reviewed!</comment>


Need Feedback for a Android App - <AUTHOR> Hi guys,
We've been working on a new products , the app is useful for accessing files and folders across multiple cloud storage providers. Many useful features such as multi-account support, encrypt and decrypt across multiple files and folders compress and extract functionality and many many more new features are included.
The app is called: Syndoc  (https://play.google.com/store/apps/details?id=com.syndoc.merlin&hl=en)
A quick summary of the main features you'll see (so you can get a sense of what it does, and if you'd like to beta test) - Unified view to view all your cloud drives
1.Upload/download files to Google Drive, OneDrive, Amazon S3 and DropBox 2.Copy and move files quickly between multiple accounts and providers 3.Rename and export files and documents, preview and edit files 4.Compress and extract folders on the go with quick & easy zipping. 5.Designed to protect your data whenever you transfer, store, or access it. 6.Change access permissions for files & folders whenever you need.
Do you guys have any suggestions/advice/feedback? <comment><AUTHOR> Clickable link to playstore for app "Syndoc" \- [https://play.google.com/store/apps/details?id=com.syndoc.mer...](https://play.google.com/store/apps/details?id=com.syndoc.merlin&hl=en)</comment>


Mozilla fears DarkMatter 'misuse' of browser for hacking - <AUTHOR> https://in.reuters.com/article/us-usa-spying-darkmatter/firefox-maker-fears-darkmatter-misuse-of-browser-for-hacking-idINKCN1QL28T <comment><USER2> Can the admins change this to point to the actual mailing list thread[0]?

I'm still reading through the thread, but it seems that DarkMatter have some small technical issues around issuing certifications. Specifically, the claims seem to be:

1\. using 63 bits of entropy for the serial number instead of the required 64.

2\. name constraints were incorrectly filled in for their intermediate certificates.

3\. DarkMatter's other business units may compromise the CA internally for malicious purposes.

[0]: [https://groups.google.com/forum/#!topic/mozilla.dev.security...](https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/nnLVNfqgz7g)

EDIT: more background - DarkMatter have an open request to be included in the Mozilla CA Store[1], and are currently trusted through intermediate certificates rooted with QuoVadis, who were recently acquired by DigiCert.

[1]: [https://bugzilla.mozilla.org/show_bug.cgi?id=1427262](https://bugzilla.mozilla.org/show_bug.cgi?id=1427262)

<comment><USER3> I think DarkMatter is right on 64 bit entropy discussion, requirements are clearly wrong unfortunately.

\- it says you should use 64-bit entropy as output from a CSPRNG

\- it says Serial number is a signed number

If you use 64bit serial, you clearly lose 1 bit. That means any certificate with 64bit serial is not conforming to the standard.

<comment><USER4> > If you use 64bit serial, you clearly lose 1 bit.

That's not clear to me at all. A 64-bit signed integer can still contain 64 bits of entropy, it just has to be negative 50% of the time.

<comment><USER5> Some things don't like negative serial numbers, and so the Baseline Requirements (which is where this 64-bit entropy requirement comes from) say to only use positive serial numbers. Thus, "you clearly lose 1 bit".

</comment></comment></comment></comment><comment><USER6> I've got to say, DarkMatter seems suspicious to me just because they're trying to enter the CA business when Let's Encrypt already exists.

I can understand legacy CAs staying around as long as their existing customers keep paying. And I'm sure there will be an ongoing market for one or two other CAs specialising in the needs of big corporations.

But starting a new CA today, trying to sell a product that's available for free? You've gotta wonder where they think they're going to add value.

<comment><USER7> Well, we shouldn't want a single CA, no matter the organization. We should always have at least several that are independent in its leadership, ownership and auditing.

And yes, there are things LE doesn't yet offer. They still don't do EV, SANs, or wildcards do they?

<comment><USER8> They do wildcard certificates now, I have several of them. I _think_ they do SAN as well.

</comment></comment></comment><comment><USER9> If you thought the title was nonsense, it gets worse when the author tries to explain what a certificate authority does:

> Websites that want to be designated as secure have to be certified by an > outside organization, which will confirm their identity and vouch for their > security. The certifying organization also helps secure the connection > between an approved website and its users, promising the traffic will not be > intercepted.

<comment><USER10> That is a perfectly reasonable description for a non-technical reader.

<comment><USER9> The biggest issue with it to me is the "vouch for their security" part, perpetuating the myth that HTTPS means the site is "safe" or that a certificate is a security audit of some kind.

</comment></comment></comment><comment><USER11> Sometimes I find Reuters stories boring compared to all the superficially exciting news produced by everyone else. But these are the kind of stories that make me thankful they exist. That contrast, in distracting times, reminds me of what choices I make when I consume news.

Kudos to Mozilla for keeping things open. Holding on to your values, in cut throat competitve times is fucking hard. Mad respect.

<comment><USER12> I'm not sure for what you praise Reuters here.

This story has been reported by multiple news sites before, and I don't see that Reuters adds anything that hasn't been reported before.

(Except if you mean the original Reuters / Project Raven story that was indeed exceptionally.)

</comment></comment><comment><USER13> I had to read it twice to get that they were writing about a CA. Definitly a writer without a clue.

<comment><USER14> Compounding the problem was that the author kept using the word "safe".

FTA: "While Mozilla had been considering whether to grant DarkMatter the authority to certify websites as safe, two Mozilla executives said in an interview last week that Reuters' report raised concerns about whether DarkMatter would abuse that authority."

Conflating "safe" or "secure" with "this website is who they say they are" may make it easier for a lay person to understand, but is wrong and creates a dangerous impression.

</comment></comment><comment><USER15> The main thing this thread (going with steventhedev's link) demonstrates to me is that the CA program is completely broken. Here we have a potential CA that is

\- Demonstrably involved in internet surveillance [0]

\- Doesn't understand the word "entropy" [1] or intentionally interprets the guidelines in an obtuse manner in which the sequence 0, 1, 2, ... can be considered randomly generated with 64 bits of entropy [2].

\- Likely in the business of lying [3] (either they are lying or reuters is thoroughly mistaken or lying)

How could whatever public benefit is gained by including these people as a CA possibly outweigh the risk? I'd think that any one of the above should disqualify them.

It also seems completely backwards that the root CAs publish certificates that give subCAs equivalent power while not having the subCAs go through the same level of scrutiny as root CAs.

[0] [https://www.reuters.com/investigates/special-report/usa- spyi...](https://www.reuters.com/investigates/special-report/usa-spying- raven/) \- also whatever you think "defensive cyber security" means.

[1] This is after repeated prompting and consulting with engineers (hint for those not familiar with entropy, it's not possible to have more than x bits of entropy in a x bit random number, and they are using a 63 bit number) [https://groups.google.com/forum/#!msg/mozilla.dev.security.p...](https://groups.google.com/forum/#!msg/mozilla.dev.security.policy/nnLVNfqgz7g/_OPSSs2uAAAJ)

[2] Kindly pointed out by Matt Palmer: [https://groups.google.com/d/msg/mozilla.dev.security.policy/...](https://groups.google.com/d/msg/mozilla.dev.security.policy/nnLVNfqgz7g/c6HoK97RBQAJ)

[3] Compare mentions of dark matters in the first link, to there statement in the second link (one assumes that any reasonable definition of defensive does not involve spying on people in other nations)

\- [https://www.reuters.com/investigates/special-report/usa- spyi...](https://www.reuters.com/investigates/special-report/usa-spying- raven/)

\- [https://groups.google.com/d/msg/mozilla.dev.security.policy/...](https://groups.google.com/d/msg/mozilla.dev.security.policy/nnLVNfqgz7g/C2A-t0xMBQAJ)

<comment><USER16> >It also seems completely backwards that the root CAs publish certificates that give subCAs equivalent power while not having the subCAs go through the same level of scrutiny as root CAs.

AFAIK the logic is that the since root CA is fronting the risk (in case of any misissuance), there doesn't need to be any extra scrutiny on the part of browser vendors. Besides, if this was somehow outlawed, then the root CA will simply provide a API that rubber-stamps whatever certificate is requested.

<comment><USER15> > AFAIK the logic is that the since root CA is fronting the risk (in case of > any misissuance), there doesn't need to be any extra scrutiny on the part of > browser vendors.

This logic doesn't make sense (though I think it is the logic)

\- We audit CAs precisely because the cost of being caught isn't high enough to provide a reasonable deterance.

\- No one is suggesting removing digicerts root certs over this. The cost to the public is too high.

> the root CA will simply provide a API that rubber-stamps whatever > certificate is requested.

\- We audit CAs precisely to prevent them from doing things like this... Any CA caught doing this after it was forbidden isn't worth anyones trust and could be immediately removed.

\- Even that would be an improvement because they would presumably keep logs...

</comment></comment></comment><comment><USER17> This is a pattern. Mozilla and others are furthering the interests of gatekeepers under the pretext of 'end user security'. The browser community have been scaremongering against self signed certs for years now and yet are happily handing 'authority' to shady projects in the middle east. What does one make of that?

Because of this obsession with 'central authority' even local ajax calls to 127.0.0.1 and localhost are blocked by Mozilla. What is even worse is they are doing this intentionally inspite of the standards explicitly not requiring this for localhost or 127.0.0.1 and are misleading users on bug reports and wasting their time. [1][2][3]

Some have wasted days mucking about with cors headers and ssl only to realize this is a Firefox only issue. Even Chrome which is not shy about furthering gatekeepers and their own interests doesn't do this. Needless to say this is not a problem on any other browser.

[1] [https://bugzilla.mozilla.org/show_bug.cgi?id=903966](https://bugzilla.mozilla.org/show_bug.cgi?id=903966)

[2] [https://bugzilla.mozilla.org/show_bug.cgi?id=1440370](https://bugzilla.mozilla.org/show_bug.cgi?id=1440370)

[3] [https://stackoverflow.com/questions/51269439/why-are-my- requ...](https://stackoverflow.com/questions/51269439/why-are-my-requests- from-https-domain-to-http-localhost-failing-cors)

<comment><USER18> Reading the bug reports, it seems that Firefox allows access to 127.0.0.1 ports if the originating website is _not_ https. This is weird - I would never want some random site control my local services (including LAN) without getting an explicit permission. This leads to vulnerabilities: [https://lwn.net/Articles/703485/](https://lwn.net/Articles/703485/)

<comment><USER17> A standard website cannot access your local services. 127.0.0.1 and localhost are local addresses to the server, not the end user system. Private addresses cannot be accessed over the public internet.

This is about a server accessing backend local services on the server or local private network via a SSL terminating reverse proxy etc.

<comment><USER18> I don't understand a couple of things from this answer.

> 127.0.0.1 and localhost are local addresses to the server, not the end user > system.

If localhost is relative to the server, then a browser running on an end user device cannot access it due to unroutable IP in the first place, obviating the problem, which is not the case, seeing that the bug is open in Firefox.

> Private addresses cannot be accessed over the public internet.

That makes sense, the 127.0.0.0/8 space is routed only to localhost.

> a SSL terminating reverse proxy

If the proxy endpoint is on the localhost, it looks the same to the browser as any other local service before a connection attempt. If the proxy cannot certify that it matches the website (using a SSL cert?), then it's indistinguishable from any actual local service, and therefore should not be accessible by default.

EDIT: I genuinely do not understand what those sentences mean in the context of that discussion - they seem to be using terms not in a way I've always seen them used.

<comment><USER17> The standards explicitly name and allow 127.0.0.1 and localhost. Is there any value in rehashing this?

This works perfectly on Chrome and all other browsers. Its only Firefox which is a problem. So its for Mozilla to explain why they are going against the standards and other browsers.

<comment><USER18> If Firefox is doing something that's closer to the right thing to do in terms of security, then it's not Firefox that is the problem, but the standard.

It would not be the only Web standard that acts against the users (WebRTC enumeration of IP addresses, canvas fingeprinting, 3rd party cookies, many others come to mind).

<comment><USER17> Then what's the point of having standards?

One could make the case Firefox is trying to 'protect users' if they resisted or protested any of the user hostile standards you mention, but Firefox has implemented all of them.

It's just this case and this is not 'user hostile'. If they are going their own way there must be transparency, disclosure and reasoning. But in the bug reports they are denying it.

<comment><USER18> Okay, I'm not saying Firefox is trying to protect the users in this case. Based on [0], they care about following the standard, and they implemented a patch once they saw they were not compliant. About 6 months ago, the bug came back. With a charitable outlook, it looks like a bug they don't give much priority to.

When it comes to the bigger topic of standards, they are meant to increase interoperability. However, there are many ways to interoperability, and they can serve different masters. Seeing how standards are just codified behaviours, they are similar to law, and it's quite clear that law is not always good. Civil disobedience is widely recognized as a valid way to influence laws.

In this light, I would say breaking standards can be a form of civil disobedience, if the standard doesn't serve the regular, disenfranchised person.

[0] [https://bugzilla.mozilla.org/show_bug.cgi?id=903966](https://bugzilla.mozilla.org/show_bug.cgi?id=903966)</comment></comment></comment></comment></comment></comment></comment></comment>


Who holds the most US government debt - <AUTHOR> http://thesoundingline.com/which-countries-hold-the-most-us-government-debt/ <comment><USER2> Who had that much money to loan in the first place?</comment>


How to dismantle a compiler bomb - <AUTHOR> https://codeexplainer.wordpress.com/2018/01/20/how-dismantle-compiler-bomb/ <comment><USER2> I had a famous machine learning professor send me a C program that crashed in init on a 32-bit machine because it allocated a 8GB array...

It was particularly strange to set a breakpoint at the beginning of main() with gdb and see the program never got there. Oddly enough, he never actually used the 8GB array, even though he had no problem allocating the array on the POWER workstation he was using.

<comment><USER3> Not sure what OS he used but some operating systems, Linux for example, overcommit memory. You can alloc an 8GB array just fine and as long as you don't use it no actual memory gets used.

That's why it worked on his machine. It didn't work on yours because of the lack of address space.

<comment><USER4> The typical cause of this problem is not that the program runs out of memory but that it overflows its stack. In this case, of course, 8GiB would wrap right back around to the start — but I would think that would result in failing to generate an executable, not generating a crashing executable, unless the compiler was super slapdash.

<comment><USER5> Compilers rarely have any idea how large your stack space is. Quite often it's determined at runtime in various ways, especially in multithreaded environments.

(There are some surprising exceptions such as PIC hardware stacks where you might be allowed exactly 8 call frames, and your whole program's call stack must be a DAG with no recursion)

<comment><USER4> Okay, but in this particular case, we're talking about an 8GiB array on a 32-bit platform. Its size truncated to 32 bits is 0x00000000. If the compiler doesn't detect that, it's a compiler bug.

</comment></comment></comment></comment></comment><comment><USER5> I'm reminded of the C++ exploding error competition: [https://tgceec.tumblr.com/post/74534916370/results-of-the- gr...](https://tgceec.tumblr.com/post/74534916370/results-of-the-grand-c- error-explosion)

</comment><comment><USER6> Also interesting are the other compiler bomb submissions:

[https://codegolf.stackexchange.com/questions/69189/build- a-c...](https://codegolf.stackexchange.com/questions/69189/build-a-compiler- bomb)

All are short bits of code in a variety of languages that expand to massive files.

</comment><comment><USER7> This would be an interested DDOS attack for open source CI systems that check pull requests. Especially when combined with some sort of distributed network build cache like bazel, you could easily fill it the cache by making a few pull requests with this.

</comment><comment><USER8> The main practical takeaway is to prefer iterators over pre-generated arrays.

Also, TIL according to the C standard, 'main' is not a reserved identifier! ([https://stackoverflow.com/questions/34764796/why-does- declar...](https://stackoverflow.com/questions/34764796/why-does-declaring- main-as-an-array-compile))

If anyone can clarify: I assumed that the gcc read literals directly into their 'target' type, but it seems like some literals (such as '-1u') are read as signed integers first then typecasted to the the target type?

<comment><USER9> > according to the C standard, 'main' is not a reserved identifier!

In fact, main() is just a convention of libc. You can have C without libc. (Such as when writing a kernel!)

Now, attempting to link a standalone executable without a '_start' symbol, on the other hand...

<comment><USER10> > In fact, main() is just a convention of libc.

No, it's not just a convention. 'main' is defined as the execution entrypoint in at least the C11 [0], C90 [1] standards. Both have both these forms defined:

        int main(void) {}

        int main(int argc, char* argv[]) {}

You don't have to follow that convention, but then it becomes implementation- defined behaviour.

C without libc can still expect to have a main. One doesn't imply the other. It's just without a main, you also have to manually link to _start as well.

[0] [http://www.open- std.org/jtc1/sc22/wg14/www/docs/n1570.pdf](http://www.open- std.org/jtc1/sc22/wg14/www/docs/n1570.pdf)

[1] [http://www.open- std.org/jtc1/sc22/wg14/www/docs/n1256.pdf](http://www.open- std.org/jtc1/sc22/wg14/www/docs/n1256.pdf)

</comment></comment></comment><comment><USER11> I'm a little baffled to discover -1u is exactly 0xFFFFFFFF — the maximum value of unsigned int.

I would have expected a type error.

Likely there's some important code out there that relies on this strange behavior.

<comment><USER12> This is common knowledge for C programmers. In the embedded/firmware space, I've seen #define UINT_MAX (unsigned int)(-1) very often. It's convenient because it is always the maximum unsigned integer value regardless of whether int is 8/16/32/64 bits.

<comment><USER13> According to standard, (unsigned int)(-1) is undefined behavior (as is signed overflow) because the machine can use some other representation of signed integers than twos-complement. On the other hand you will probably never find non-twos-complement architecture in any vaguely production use today.

<comment><USER14> Nope, casting signed to unsigned is well-defined. The C standard requires it to act like two's complement regardless of what the machine actually uses:

> Otherwise, if the new type is unsigned, the value is converted by repeatedly > adding or subtracting one more than the maximum value that can be > represented in the new type until the value is in the range of the new type.

[https://stackoverflow.com/questions/50605/signed-to- unsigned...](https://stackoverflow.com/questions/50605/signed-to-unsigned- conversion-in-c-is-it-always-safe)

<comment><USER15> ~0u is also a safe equivalent if there is unwarranted fear around wrapping.

</comment></comment></comment></comment></comment><comment><USER16> Why doesn't the {1} in this case initialize the array to all 1s?

<comment><USER17> It's because you can initialize the array with particular values, like: `type a[3] = { 1 , 2, 3 };`.

But I agree that it would make sense to fill the array (or have an easier method to do that), it may just be an argument of speed. I think OSes generally hand over uninitialized memory zero'ed out to prevent reading of memory from previous programs - so it's a case of allocating the memory space and then continuing, as opposed to setting values for each position.

<comment><USER16> Until now, I always thought this:

        int array[5] = {X};

Could be be used to set all values of the array to X, but have never used it for anything other than 0. That's somewhat surprising behavior.

</comment></comment></comment><comment><USER18> Or when you use range instead of xrange with big numbers (python)...

<comment><USER19> Not an issue anymore on Python 3.

<comment><USER20> Because xrange became range.

</comment></comment></comment><comment><USER21> Mildly interesting at best. Other languages have range operators you can abuse, or other similar tricks with macros, constants, etc. I'm not sure this is a problem that needs attention.

<comment><USER22> If you're compiling/running random unverified source you have plenty of other problems already. :)

</comment></comment><comment><USER23> TL;DR: a one liner source file tells the compiler to set main as a 4GB array; in the process the compiler might run out of memory.

<comment><USER24> s/4GB/4GBx4 = 16GB/

<comment><USER25> To add to this, a "tl;dr" is only useful if written by people who actually read the whole article. That is, written by people who did not apply "tl;dr" themselves.

In this particular case, the article clearly says:

 _> The array will contain 4294967295 integers, each with the size of four bytes, taking up 17179869180 bytes in total._

Later, the article again stresses again that you have to multiply by four:

 _> having the size of 10000 integers, that is, 40000 bytes_

It's really hard to imagine how somebody who actually did read the article could have missed that.

<comment><USER26> Its easy it was too long so they didn't read they skimmed.

<comment><USER27> Well, right. So we're back to the starting proposition: That you shouldn't write a TL;DR if you didn't read the article.

Anyhow, this was more of a short blog post than a full article. It was a 2 minute read (not exactly a novel). And the thought experiments at the end are interesting, and illuminate some important points about how the language operates. Definitely worth the read.

<comment><USER28> I think their interpretation of "tl; dr" is: "it was too long so I didn't read it, and here is what I think anyway".</comment></comment></comment></comment></comment></comment>


Java Reflection, 1000x Faster - <AUTHOR> http://norswap.com/fast-java-reflection/ <comment><USER2> > The simple approach is to simply add a children() method to the interface > and implement it in every kind of node. Very tedious, and boilerplaty as > hell.

The best approach without boilerplate would be to generate this at compile time, not runtime. You could use an approach like in [http://hannesdorfmann.com/annotation- processing/annotationpr...](http://hannesdorfmann.com/annotation- processing/annotationprocessing101) to create at compile-time, using reflection, a ChildWalker class that accesses the relevant properties for every class annotated with @Node. At runtime, the JIT should get this down to a vtable lookup and field lookups - just about as optimized as you can get.

EDIT: Always remember [https://xkcd.com/1205/](https://xkcd.com/1205/) \- if it would take 5 seconds to write each children() method, and you write no more than 5 Node classes per day (amortized), then you shouldn't spend more 12 hours writing the code for this blog post ;) Unless, of course, that was the point all along!

<comment><USER3> Developing, debugging, using an annotation processor is opposite of productive. Not recommended.

<comment><USER4> It really depends on the annotation processor and what kind of code you are trying to generate. In the author's case it shouldn't take that long nor would it be hard to develop and debug.

<comment><USER5> I think it depends more on your IDE playing ball with the code generator and custom build steps. Most do an awful job.

I'd love one that I could just point to a build tool/script instead of creating it's own.

<comment><USER6> Also I've worked places with this magic and no induction or documentation or time for anyone to explain anything. The more behind the scenes hard to discover stuff you implement the better the docs and onboarding needs to be. It can't just be done to fulfill a architect astronaut fantasy.

<comment><USER5> I don't care so much about the documentation, as long as it's part of the build script (it's own documentation) and not checked into source control. By not checking it into source control it won't be edited, there won't be a mix of generated and custom code. By being part of the build process you avoid the generation tool and scripts being lost to the sands of time.

<comment><USER6> I like the build process to be committed personally for build reproducibility. It can be in a seperate more secured repository though.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Seems to me this is approaching this totally the wrong way. First off, the current implementation is just looping through all the methods of the implementing class and the first one that matches a Node or [Node] return type is supposedly its children? That seems extremely brittle.

The fact that you have 100 classes implementing this is a good sign you should turn the design on its head. Why not just have a single tree structure built using generics?

edit: also I would point out that you're not really making reflection any faster, just your code

<comment><USER8> On top of that, he acknowledges that there is a much, much simpler solution, known from the dawn of Java, and this is to have a polymorphic children() method.

But that would (gasp!) require adding those implementations. Which is tedious (it is not with a bit of inheritance or some other technique but ok). OK, so, it requires a bit of work. But those methods would take a few (or a dozen) nanoseconds to dispatch; you can't go faster than that. What's the alternative? To build your brittle infrastructure? Hmmm, I must be missing something...

<comment><USER9> This is assuming you have full control over all the implementations. I see this frequently in large Java and Scala code bases in enterprise, you have a generic library you built awhile back and now has all sorts of users in all different places that you may not even have source code access to, only jar access though Nexus or Artifactory. Then you need to do some operation like OP notes but you can't expect everyone to commit your code immediately or even at all. Thus OP is left with only reasonable solution detailed.

<comment><USER10> So your complaint is that it is hard for users if you make a breaking change in your library, big surprise. This is why breaking changes in libraries should only be done with utmost consideration, preferably after first deprecating the usage.

And if you make a breaking change to the interface, you better be damn well breaking it at compile time and not hiding it with reflection shenanigans.

In the example of the OP, it's easy to think of an example that would totally be broken by the author's reflection approach, while the user has no warning at compile time and no reasonable way of knowing that what he's doing isn't allowed:

        class MyWeirdNode extends Node {
            private final int i = 1;
            public IntNode asIntNode() {
                return new IntNode(i)
            }
        }

<comment><USER11> That's where client provided implicit converters in Scala are actually useful magic

</comment></comment></comment></comment></comment><comment><USER12> If you are using reflection and encountering performance problems, the correct approach is pretty much always to write an annotation processor and generate that code instead.

<comment><USER13> Or generate code without using annotation processor

<comment><USER3> ReflectASM is the fastest, most general purpose reflection solution. It uses runtime bytecode generation.

[https://github.com/EsotericSoftware/reflectasm](https://github.com/EsotericSoftware/reflectasm)

When I needed something more custom, I've done the bytecode strategy a few times, using ASM library or equiv. But the cost of change (brittleness, aggravation) is pretty high.

Now I just write Java source and use the JDK's built-in javac to generate the bytecodes.

Some people like StringTemplate. [http://www.stringtemplate.org](http://www.stringtemplate.org) For whatever reason, I still prefer Velocity. Template languages are mostly evil, and variations of terrible, so I just stick to what I know.

Annotations are never the correct answer. For any use case, purpose.

Edit: Whoops. May have spoke too soon. JDK 8's MethodHandle and some other features (inlining simple getters) may have mooted ReflectASM. [https://github.com/EsotericSoftware/reflectasm/issues/23](https://github.com/EsotericSoftware/reflectasm/issues/23) I may have to retool some of my older code.

<comment><USER14> JavaPoet is a relatively nice library for generating Java sources: [https://github.com/square/javapoet](https://github.com/square/javapoet)

<comment><USER3> Thanks. I tried JavaPoet, once apon a time.

I'm just a simple bear. I can't keep all the details straight.

One strategy I use to cope is round tripping, as a way to confirm I get the expected results.

My current approach to code generation: painstakingly hand craft the desired source code output. Then turn that into a template (progressive refinement). Then compare (diff) generated output to manual. Iterate. Many times that means adjusting target to make it easier to generate.

Using bytecodes (class file) as the target output adds complexity and more steps. I've been reversing bytecodes for a long time, manually using javap, the decompilers (which are now quite good), and using ASMs code generator plugin for Eclipse (super clever). But it's too fussy, compared to the Java source code strategy.

</comment></comment></comment></comment></comment><comment><USER15> Didn't look too deep, but this might be due to the fact that call sites are memoized for invoke calls as part of the invokedynamic improvements (but really MethodHandle::invoke and MethodHandle::invokeExact are where the magic is as is mentioned by the JVM spec IIRC).

Regardless, MethodHandle invocations are always going to be faster than reflection Method invocations. A primary reason is that the parameters for invoke and invokeExact are not subject to the same boxing and runtime- validation requirements as reflection.

</comment><comment><USER16> > I had an interface (representing a tree node)

No you didn't. An interface representing a tree node would have a children() method.

<comment><USER17> Why? I see why it might be a good idea depending on what problem you are trying to solve, but I don't see why anything has to have any references to its children in order to be a tree node.

</comment></comment><comment><USER18> I assume the JIT isn't optimizing until the functions execute a certain number of times. Given the speed difference maybe it isn't even natively compiling at first and using the interpreter.

I don't know about Java but in .NET there's a call you can make to force the dynamically generated lamba expression to be compiled immediately.

Of course if you're being really adventurous you can use IL emit to build a function up from IL opcodes.

<comment><USER19> Yes. The author didn't note his testing methodology. JMH (Java Microbenchmark Harness) is the gold standard for executing Java benchmarking tests:

[http://openjdk.java.net/projects/code- tools/jmh/](http://openjdk.java.net/projects/code-tools/jmh/)

It takes care of details like JVM warm-ups. ensuring sufficient invocations for JIT compilation to have occurred, etc.

<comment><USER20> Although sometimes the performance when interpreted before warm-up is important.

Testing with CompilerControl.Mode.EXCLUDE in JMH is still more reliable than testing manually, when you don't know if it got compiled or not.

Interpreted code is a case where method handles should be much faster than the generated accessor classes used by reflection - lambdas and method references are faster than an inner class implementing a functional interface before jit compilation. Afterwards, performance tends to be sameish.

</comment></comment></comment><comment><USER21> In the past, I've used Introspector API [1] for property reflection. It's part of the JDK, and provides a lot of the caching this article is talking about. Doubt this would provide the same level of improvement as adding the direct children() method, or even ASM based approaches, but it's certainly faster than naked reflection.

[1] [https://docs.oracle.com/javase/7/docs/api/java/beans/Introsp...](https://docs.oracle.com/javase/7/docs/api/java/beans/Introspector.html)

</comment><comment><USER22> There's another, and IMO, a better way to make Java reflection faster. It's to disable checks on reflection calls. Just call setAccessible(true), and you will notice substantial improvement.

<comment><USER23> Isn't setAccessible required before you can interact with fields?

<comment><USER22> If they are private, yes.

</comment></comment></comment><comment><USER24> What I do for these situations is do the reflection as a unit test to confirm that the hand written children() is correct.

When the unit test fails for a node type it prints what it should be and you just copy and paste that code for children() should be.

This is also nice for the case where nodes have some sort special children(). You can make the unit test ignore those.

</comment><comment><USER25> I wonder if this could be used by JVM languages that sometimes fall back to reflection, like Clojure. Transparently profile the reflection calls and recompile the hot ones?

<comment><USER26> Clojure provides a var called _warn-on-reflection_ that can be set to true during dev, and all (or a vast majority of) reflective calls can be optimized away by adding type hints wherever it warns. This is to say that Clojure devs get rid of reflection instead of trying to make it faster.

<comment><USER25> Sounds like doing it automatically, instead of requiring code changes, would save a lot of work and speed up many programs where the programmers haven't gone through the trouble of doing this.

</comment></comment></comment><comment><USER27> I wonder if the clojure devs use these techniques. IIRC clojure relies a lot on reflection.

<comment><USER26> Clojure devs get rid of reflection by adding type hints where required. The compiler has a flag to help with this, called _warn-on-reflection_.

</comment></comment><comment><USER28> C# reflection is also slow, and even slower in Unity3D with the IL2CPP ahead- of-time compiler, where there is no just-in-time compiler or System.Reflection.Emit to dynamically generate code at runtime (which is impossible and prohibited on iOS, for example).

Here are the limitations of the Mono runtime:

[https://developer.xamarin.com/guides/ios/advanced_topics/lim...](https://developer.xamarin.com/guides/ios/advanced_topics/limitations/)

However, there are ways of compiling the little snippets of the code you need ahead of time, then plugging them together with delegates at runtime, which avoids much of the overhead.

Much of the cost is the overhead of converting from unknown types to specific types. So you can pre-compile loosely typed adaptor thunks that take generic "object" arguments, convert them to the required type, and directly call strongly typed delegates (which you can plug into the adaptor, so adaptors can be used for any number of compatible delegates).

Check out how the following code uses FastInvoke, ToOpenDelegate, Delegate.CreateDelegate, Expression.GetActionType, and Expression.GetFuncType.

It may be that some of these general techniques could be applied to Java.

Faster Invoke for reflected property access and method invocation with AOT compilation:

[https://web-beta.archive.org/web/20120826100615/http://whydo...](https://web- beta.archive.org/web/20120826100615/http://whydoidoit.com/2012/04/18/faster- invoke-for-reflected-property-access-and-method-invocation-with-aot- compilation)

The bane of the iOS programmers life, when working with reflection in Mono, is that you cant go around making up new generic types to ensure that your reflected properties and methods get called at decent speed. This is because Mono on iOS is fully Ahead Of Time compiled and simply cant make up new stuff as you go along. That coupled with the dire performance of Invoke when using reflected properties lead me to construct a helper class.

This works by registering a series of method signatures with the compiler, so that they are available to code running on the device. In my tests property access was 4.5x faster and method access with one parameters was 2.4x faster. Not earth shattering but every little helps. If you knew what you wanted ahead of time, then you could probably do a lot better. See here for info.

You have to register signatures inside each class Im afraid. Nothing I can do about that.

So to register a signature you use:

        static MyClass()
        {
             //All methods returning string can be accelerated
             DelegateSupport.RegisterFunctionType<MyClass, string>();
             //All methods returning string and taking an int can be accelerated
             DelegateSupport.RegisterFunctionType<MyClass, int, string>();
             //All methods returning void and taking a bool can be accelerated
             DelegateSupport.RegisterActionType<MyClass, bool>();
        }

Then when you have a MethodInfo you use the extension method FastInvoke(object target, params object[] parameters) to call it. FastInvoke will default to using normal Invoke if you havent accelerated a particular type.

myObject.GetType().GetProperty("SomeProperty").GetGetMethod().FastInvoke(myObject);

myObject.GetType().GetMethod("SomeMethod").FastInvoke(myObject, 1, 2);

You can download the source code for FastInvoke from here.

[https://web-beta.archive.org/web/20120826100615/http://www.w...](https://web- beta.archive.org/web/20120826100615/http://www.whydoidoit.net/Downloads/DelegateSupport.cs)

Newer version from unityserializer-ng:

[https://gitgud.io/TheSniperFan/unityserializer- ng/blob/maste...](https://gitgud.io/TheSniperFan/unityserializer- ng/blob/master/Assets/Plugins/OpenUnityTools/unityserializer- ng/Radical/System/Delegates/DelegateSupport.cs)</comment>


RubyTu.be, a community driven Ruby video & screencast index - <AUTHOR> http://rubytu.be/

<comment><USER2> Ugh. I hate it when this kind of thing turns up in my search results. I'm looking for "actionable intelligence", and I get some 25 minute long video that I can' really scan through, and certainly can't cut and paste from.

<comment><USER3> I'm working on some tech that resolves some of these problems, and I'll be unleashing it first in the Ruby circle (merely because that's the topic I know most about). Since you seem to have a real feel for what can be irritating about videos (thoughts I share), I'd love to let you (and/or others here) have a look at the alpha stage in the next few weeks.

<comment><USER4> That sounds like a big project. I've never encountered anything related to video that is solved with a simple technical solution. Unless you're talking about something like Google's Video Sitemaps.

<comment><USER3> No, nothing like that I'm afraid. I'm approaching it from the content producer's POV, so it won't be viable for videos that already exist, although with a little work they could be brought into it..

<comment><USER4> Good luck. I'll keep my eye on the usual Ruby channels then.

</comment></comment></comment></comment></comment><comment><USER5> How about a site for Daytime Soap Operas from Spain?

day.rubytu.es</comment>


The Shadow Superpower - <AUTHOR> http://www.foreignpolicy.com/articles/2011/10/28/black_market_global_economy <comment><USER3> Meanwhile in the highly planned and regulated Swedish economy... they are planning to end cash, a step which the government elites tout as progress and sell as a safety measure. Looks like the underground will need to find an alternative currency. Bitcoin? [http://www.newjerseynewsroom.com/economy/voice-of- opposition...](http://www.newjerseynewsroom.com/economy/voice-of-opposition- grows-as-sweden-considers-going-cashless)

<comment><USER4> Hmm...

Not really sure bitcoin could compete well in Systeme D. You are dealing with a lot of people who believe in cash or precious metals. These bring trust in Systeme D.

One thing the article doesn't mention is that the Somalis are actually making a pretty big impact as proprietors of a sort of 'banking' system for these kinds of transactions. If you give a Somali 'banker' ... say ... 2000 Euro in Norway, you can count on your cousin in St. Paul, MN getting 2000 Euro from one of the local Somalis. The same is true if you want money to go from Sao Paolo to Capetown. Or Shanghai to Dubai, etc.

Their system is robust, extremely trustworthy, and most important, quiet. It is DEEPLY lodged in shadow trans african trade, and rapidly growing in shadow global trade. It will be hard to displace a system like that. Unless the world's Governments decide to invade Somalia, which does seem to be the case lately.

One place bitcoin might be useful is in large transactions. The Somalis don't seem to be interested in facilitating these yet, and for obvious reasons, merchants do not want to use cash. If bitcoin builds a reputation for trust on large transactions, perhaps through the convenience of mobile phones it can work its way down the food chain so to speak.

But... yeah ... right now there are a lot of Africans for instance, who trust the Somali networks more than the banks in their own countries. Trust like that is hard to earn...and very expensive to buy. It could happen for bitcoin though if boosters put in the work.

<comment><USER3> Agreed, but if there is no paper or coin cash like Sweden is proposing, how would the "Somali Banker" get digital currency to a party in the jurisdiction without paper currency? I assume it is all done in paper cash today. Barter seems impractical.

<comment><USER4> You might have noticed I used the example of inputting Euro into the Somali system in Norway. The fact that Norway uses the Krone does not mean that Euro are not readily available. Likewise, Sweden may switch to digital, but Euro and dollars, and certainly silver and gold will be readily available. Doesn't matter that a person gives the Somali CFA in Cameroon, Euro will come out in Paris.

The Somalis are good with that sort of thing. You just tell them how much and exactly who is supposed to get it. They can make it happen. What's crazy is that they can even make it happen in war zones. Even in a place like Goma with genocidal Hutus and lunatic Tutsis running around. I suspect it actually works better in places like that because the corrupt generals need some way to get their ill gotten gains out.

</comment></comment></comment></comment><comment><USER5> Single page view: [http://www.foreignpolicy.com/articles/2011/10/28/black_marke...](http://www.foreignpolicy.com/articles/2011/10/28/black_market_global_economy?page=full)

EDIT: Nevermind my suggestion to post the single page view. It was my belief that readability ought to be valued more than double-submission-prevention mechanisms, but it seems like a lot of people disagree with that notion.

<comment><USER6> To the contrary, please post the canonical URL of any article,

<http://news.ycombinator.com/item?id=3571353>

and let the user decide what page view or what display defaults to show. (On a well designed website, the user's user agent will be autodetected, and the default display will be a reasonable view that leads to options for single- page or other special display formats.) That lets the Hacker News duplicate submission detector do its best work. It is, of course, all right (but not strictly necessary) to mention a link to another view of the article, as you kindly did, in a comment.

</comment></comment><comment><USER7> Also described in this excellent wired article, which I think is a more concise overview of the subject:

<http://www.wired.com/magazine/2011/12/mf_neuwirth_qa/>

<comment><AUTHOR> Thanks for that link. The Wired article is less in-depth and lacks links to all the external research and data, but it's a good alternative for readers who just want to grok the key points quickly.

</comment></comment><comment><USER8> tl;dr: Having conducted an exhaustive study of the world's economic future, it turns out that it conforms almost exactly to my libertarian worldview!

<comment><USER9> I definitely believe the "dr" part.

The article is just describing an economic ecosystem that is in play today. It reads like someone's attempt to wrap his head around something new and different that needs to be understood.

If this economy is as large and successful as it's claimed to be, then we should be making an effort to understand it as well.

You'd need to be pretty heartless to decry it on face value when it does something so basic in our modern world as provide electrical power for people who have been denied it by their current economic system or government for one reason or another.

If you have a reason to counter the facts in the story, by all means speak up.

<comment><USER10> _You'd need to be pretty heartless to decry it on face value when it does something so basic in our modern world as provide electrical power for people_

Have you ever been at a large campground with widespread portable generator use? There are >definite< externalities.

I would take steps to further lubricate commerce. Technology that can leapfrog the build-out of infrastructure like roads is one possibility.

<comment><USER9> I don't understand your point.

No one is lubricating commerce for these people. Their current government and economic system is failing them miserably.

What they've done to better the lives of themselves and those around them, they've done for themselves in spite of their current government and its forced economics.

These people aren't trading in drugs or slaves. They're doing something quite remarkable and how they're doing it should be studied.

<comment><USER10> _No one is lubricating commerce for these people. Their current government and economic system is failing them miserably._

Yes, so imagine if we came in with technical solutions that leapfrog their failed government? For example, there's a program to replace mail service with small parcel delivery by quadcopter drone. No roads during the rainy season? No problem!

</comment></comment></comment></comment></comment><comment><USER11> It's a good read and instantly made me think of Bitcoin. "Bitcoin - <USER2> currency for the System D generation"

<comment><AUTHOR> Agree. An expert on e-money on crypto currencies just articulated exactly the same point here: [http://www.forbes.com/sites/jonmatonis/2012/03/19/could- bitc...](http://www.forbes.com/sites/jonmatonis/2012/03/19/could-bitcoin- become-the-currency-of-system-d/)

<comment><USER11> Thanks for the link! I think he's dead right (the last sentence says everything).

<comment><AUTHOR> I think there's a good chance he will be proven right over time. You may appreciate this blog post too: [http://cs702.wordpress.com/2011/05/29/on-the- potential-adopt...](http://cs702.wordpress.com/2011/05/29/on-the-potential- adoption-and-price-appreciation-of-bitcoin-in-the-long-run/)

</comment></comment></comment></comment><comment><USER10> "Shadow Superpower" is perhaps misleading. To me, a Superpower can project concerted military or economic power over an extended period of time, and has considerable resistance to the tried and true tactics of "divide and conquer."

Then again, perhaps it's not. Is the US so resistant to "divide and conquer?" Can we still project concerted military or economic power over an extended period of time?

</comment><comment><USER12> "Systeme D.", débrouillard, resourceful, ingenious, inventive, self-starting, entrepreneurial, "l'economie de la débrouillardise." ingenuity economy, the economy of improvisation, self-reliance, do-it-yourself, or DIY, economy of skill, joy.

</comment><comment><USER13> Isn't this essentially the Star Trek economy? These people work to improve themselves and their surroundings.

<comment><USER14> The exact opposite. They lack any financial security or a society that protects then so they must hustle to survive.

In Star Trek they live in a society with abundance and so the state can provide everything.</comment></comment>


Apple in talks with Aetna to bring Apple Watch to millions of customers - <AUTHOR> https://techcrunch.com/2017/08/14/apple-reportedly-in-talks-with-aetna-to-bring-the-apple-watch-to-millions-of-customers/ <comment><USER2> Let's not forget that what's even more profitable than 'pricing insurance according to actual activity' (which is a nicely sounding PR cover up) is 'dropping people with early symptoms of a disease before it gets found by their doctor'. Which is unethical, but legal (right?) and extremely, extremely profitable.

Keep all premiums, drop people with cancer before they find out about it. And yes, if it's possible to infer pregnancy from shopping bills, then inferring a early health problem from a detailed 24/7 tracker data will be much easier.

And if you want to opt out of this? 'Here are our rates without a fitness tracker discount, they cost 5 times more, ok?'

<comment><USER3> .. which is why a government guaranteed insurance with good overall coverage is necessary. severe market defects in health care furthermore make dictated prices for services/prescriptions necessary. Adjusting Obamacare for that you end up with the Swiss system - still expensive bur at least effective and IMO fair.

Thinking about it, increasing information asymmetry due to machine learning applied to marketing may make heavy regulations necessary in most other sectors as well. Imagine software that tracks every person and figures out what they need when, identifies a monopoly of opportunity for any given good and them jacks up the price just for that person individually - in real time, while the person walks up to it.

Maybe that's how capitalism ends. Slavery 2.0.

<comment><USER4> _" Imagine software that tracks every person and figures out what they need when..."_

aka the status quo.

People are profiting from my data. I want my cut. Screw privacy. I want my cut.

Any one storing or using my data for any reason owes me money.

Sell my address to a direct mail campaign. I want my cut.

Need my health history for some longitudinal study that may ultimately save lives. Awesome. Pay me.

Use my purchase history to recommend a new pair of shoes or sell ads. Woot! Pay me.

Micro target my snowflake demographic for targeted political agitprop (aka campaigning). That's worth at least $50. Pay me.

<comment><USER3> Have you looked at the BAT project? Seems to me that something along these lines could bring such a vision closer.

As in, your browser blocks tracking / identification by default (integrated TOR?). Sites can offer you a bit of tokens if you agree to share your identity / if you let them track what you're looking at. It's a bit of an extension of what BAT aims for, but I think their vision goes in such a direction.

I could see such a thing taking hold, just like AdBlock Plus and co. have become a thing that advertisers / publishers need to work around.

<comment><USER4> Do you mean Basic Attention Token? [https://basicattentiontoken.org](https://basicattentiontoken.org)

Looks interesting. Thank you.

<comment><USER3> Yep, that's the one. Disclaimer: I hold some of those ;).

</comment></comment></comment></comment></comment></comment><comment><USER5> _" Aetna now reportedly has ambitions to offer it to a wider field — adding large swaths of new health data to pull from and giving the health insurance company insight into the activities of its customers."_

Oh God no!

<comment><USER6> It'll be opt-in and this isn't a new thing - there's several UK insurers that'll give you discounts and bonuses for life insurance if you log workouts with their apps. This just makes it easier for both sides.

<comment><USER7> honestly I'd support a program where the more you work out the lower your insurance premiums would be. Pretty hard to cheat workouts with Apple Watch when it has a heart rate sensor and all that.

<comment><USER8> You're okay with corporations having extremely intrusive tools to track your behavior and control it through price for their own benefit?

<comment><USER6> For health (which we're talking about), life, or car insurance (since a bunch of UK insurers also have "safe driving" apps that earn you points, etc.), yeah, sure, why not?

<comment><USER9> Because obviously they can use those to profit by dropping eg people they diagnose (or just infer statistically) with serious problems before they develop, or raise their prices, etc.

This is not about some extra win-win motivation to be healthier...

It's about turning risk (which is supposed to be what insurance companies are paid for) into rent-seeking...

</comment></comment></comment></comment></comment></comment><comment><USER10> If Aetna wanted to offer customers discounts on insurance for healthy activity, it would make far more sense to do it with something like a Fitbit. A purpose-built device for tracking activity and heartrate. The Apple watch doesn't do as good a job as the fitbit at fitness tracking, is bigger and heavier, is far more expensive, and gets far worse battery life. Not to mention the fact that the Apple Watch only works with iPhones meaning that it would be useless for the majority of US smartphone users whereas the Fitbit works with both iPhone (as much as Apple lets them) and Android.

Side Note: I switched from an Android watch to a Fitbit for activity and sleep tracking for many of the reasons outlined above.

<comment><USER11> my speculation is that these talks are specifically in regard to tracking some biometric that the current line of apple watches doesn't yet have sensors for.

</comment></comment><comment><USER12> It would be pretty good business as a very healthy person to walk around with your arms full of other people's trackers.

</comment><comment><USER13> The secret Apple project for potentially blood glucose monitoring would be amazing. Non-interstitial fluid / noninvasive sounds like a really hard problem that may require a very bright light source and/or a sensor more sensitive than used for heart rate. It's a worthy goal. Even more awesome would be a limited generic mass-spectrometer that could do more, arbitrary blood chemistry quantification in software without having to develop many/additional specialized sensors.</comment>


Fun with radiation - X-Ray machine in a department store   - <AUTHOR> http://www.thingamababy.com/baby/2006/05/fun_with_radiat.html?l

<comment><USER2> My dad's first job was in a shoe store with one of these scopes.

He told me stories about how his coworkers would fool around with the machines during the slow periods. Many of them lost their toes or entire parts of their feet years later.

</comment><comment><USER3> A friend of mine actually refurbished one of these machines a couple years ago for a collector. We got to play around with it a little (no body parts in the scope) and make some radiation measurements. It's certainly a scary machine, knowing that it was operated as a sales gimmick by people with no radiation safety training.</comment>


New York City's Graveyard Shift - <AUTHOR> http://www.newyorker.com/culture/portfolio/new-york-citys-graveyard-shift <comment><USER2> I have such respect for these people. Partly because without them, NYC would be devoid of life. NYC is unlike any city in the world. I challenge anyone to live there for a time in their life. You won't regret it.

<comment><USER3> How is it different than other metropolises like London or Paris, Tokyo or Seoul? (I live here and I'm not sure).

Sometimes I hear people say these things and I wonder if you have to live in Manhattan to understand, I commute from Brooklyn.

<comment><USER4> The real never-ending life of it. Most cities have off-hours- NYC is literally a 24/7 city.

<comment><USER5> So do London, Berlin, Tel-Aviv and a few other cities.

<comment><USER6> I think one telling feature is that the New York subway runs 24/7; every other metro in the world shuts down for nightly maintenance.

<comment><USER7> Berlin's U/S-Bahns certainly give the impression of being open 24/7 -- I've never had problems getting to/from clubs or airports at any time of day.

London can also claim a useful 24/7 service, with the night tube starting a couple months ago and the third and fourth lines (Jubilee and Northern) just opening up this week[1].

[1]: [https://tfl.gov.uk/campaign/tube-improvements/what-we-are- do...](https://tfl.gov.uk/campaign/tube-improvements/what-we-are-doing/night- tube)

<comment><USER8> It's been a few years, but I remember getting stranded at the U-Bahn station a few times when I was in college because we got out of the bar too late and having to walk home or wait around for daylight.

<comment><USER9> It's open 24 hours on weekends but close at nights preceeding working days.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> I love how the images are in grayscale!

Represents the fact that all these photos were taken during the graveyard hours far better than if they were in color.

<comment><USER11> Also, it's likely pretty dark everywhere the photos were taken so the available light for photography is not great. So, shooting with high ISO/gain settings is going to be pretty noisy, which is less noticeable when in black and white.

<comment><USER12> You'd be surprised what a modern full-frame sensor picks up these days. They're not shooting with a D2H in 2004.

</comment></comment></comment><comment><USER13> I love the coast guard picture.

<comment><USER14> I'm wondering how they got such a large depth of field at night.

</comment></comment><comment><USER15> Great photos, getting a big Brassaï vibe from them.</comment>


'Urgent needs from head to toe': Clinic had two days to fix a lifetime of needs - <AUTHOR> https://www.washingtonpost.com/national/the-clinic-of-last-resort/2019/06/22/2833c8a0-92cc-11e9-aadb-74e6b2b46f6a_story.html <comment><USER2> What shame to live in the richest country in history while leaving millions of people like this behind. Note that their circumstances were the direct result of the Republicans in the state legislature refusing to accept Medicaid expansion, which is 90% paid by the federal government.</comment>