Quiet for Android – TCP over sound - <AUTHOR> https://github.com/quiet/org.quietmodem.Quiet <comment><USER2> Today I learned that you can actually abuse the system bus on some macbooks to actually send audio over AM radio[0]. Even scarier, you can do it from the browser[1]. And now this library[2] will let you open a TCP connection over the radio to download off that data machine. This is shaping up to be a pretty cool attack PoC!

[0]: [https://github.com/fulldecent/system-bus- radio](https://github.com/fulldecent/system-bus-radio)

[1]: [https://fulldecent.github.io/system-bus- radio](https://fulldecent.github.io/system-bus-radio)

[2]: [https://github.com/quiet/quiet-js](https://github.com/quiet/quiet-js)

<comment><USER3> Code running in your browser gaining a TCP connection seems like the least scary use case of this possible- presumably it already has a TCP connection in the first place.

<comment><USER4> Could you possibly use the radio transmission to triangulate someone's location?

<comment><USER5> The range is quite low. If you can hear the radio you already know where it is.

</comment></comment></comment></comment><comment><USER6> For those of you interested, there was an app called Chirp by Animal Systems that allowed you to transfer messages and shortcodes of hosted media content over audible frequencies. Despite being rather ear-piercing each time a Chirp was sent, it was still a very interesting principal. I remember reverse engineering the protocol and error correction mechanisms (it was a varient of the Reed-Solomon algorithm iirc) with a friend for a little household "internet of things" that communicated over sound. I still have a few temperature monitoring devices around the house that sing a little tune based on the RE'd code every few hours to report back to my RasPi on home temperature data.

Judging by the fact that this was in my GitHub stars list from about a year ago, it looks like I was considering transitioning to something more open. With the right encryption and error correction mechanisms I think this type of technology could be really useful for short-range home iot communication.

<comment><USER7> Using something that sounds like bird calls - or something else that's pleasant - to transmit data sounds like a pretty neat idea for a smart home. It would expose the otherwise-invisible artificial ecosystem you're living in.

<comment><USER8> Imagine your smart home ecosystem that sounds like the Amazon ecosystem. That sounds like the kind of thing that would actually push me the extra edge to wire my home up.

<comment><USER9> Back in the mainframe days I spent many late nights in the machine room doing systems janitor work. I could easily identify which workload was running, and what phase, by the ambient noise of disk and tape drives.

I can imagine your house chirping and tweeting about, when suddenly you wake from a deep sleep saying "what was that!" when some unusual pattern of sound happens.

The pattern matching and decoding portions of our brain never, ever, stop their efforts and are wired deeply in to the survival mechanisms we have.

<comment><USER10> I once read that Brian Eno did an experiment about this. He recorded something like 30min of outside noise in order to see if he could learn "how it goes," just like you learn how a piece of music goes. "Wind rustle, dog barks, more wind, a horn honk, then the garbage truck goes by and a bottle falls out and breaks," etc. It was a successful experiment.

<comment><USER11> I had a similar personal experience. For years growing up I slept to a white noise machine that played a 3-second recording of a mountain stream. I became intimately familiar with the clip and could anticipate every trickle, the changing pitches of different water droplets, and the length of the loop. I can still conjure it from memory in great detail.

Intriguingly, on a single night I experienced some sort of hypnogogic auditory hallucination that caused the sound to lose all familiarity. Instead, I perceived the sound of a male singer arpeggiating rapidly. I found it highly disturbing.

<comment><USER12> never knew how to phrase it, but I've had that a couple of times in the past few years. I've had to get really picky abouth the white noise sounds I listen to. Eventually, almost all the loops become identifiable - I can tell when the loop restarts, etc. I had two different loops (both of water sounds - waterfalls, maybe? - iirc) that, at some point, started to register as human voices, and it freaked me out more than a bit.

fwiw, the only thing that works well for me is masking any other sounds with a mix of grey and brown noise on top. i use 'white noise app' to achieve this, and it helps me get to sleep, masking out many other ambient disturbances (road/car noises, mostly).

<comment><USER13> For everything about noises, I highly recommend mynoise.net. It has a ton of high quality sound generator which does not loop. If it is too monotonous, you can automatically "animate" the sounds which modify continuously the sounds at different frequencies.

</comment></comment></comment></comment></comment></comment></comment></comment><comment> brian-armstrong Hey everyone, author of the library here.

There's a live JS demo of this you can try for yourself at [https://quiet.github.io/quiet-js](https://quiet.github.io/quiet-js) which demonstrates the audible and ultrasonic modes.

The JS version is compatible with the Android version. There's also iOS ( [https://github.com/quiet/QuietModemKit](https://github.com/quiet/QuietModemKit) ) and C ( [https://github.com/quiet/quiet](https://github.com/quiet/quiet) ) which interop as well.

The throughput you can get changes depending on conditions. Across a cable, you can achieve about 64kbps. Across a short air gap, about 3-4 kbps. Across a room, you can maintain 5 bps or so. There's no capacity negotiation/detection, instead you preconfigure using a modem profile.

A good demonstration of Quiet's flexibility can be seen here [https://quiet.github.io/quiet-profile-lab](https://quiet.github.io/quiet- profile-lab)

<comment><USER14> Do you have any recommendations for microphones suitable for desktop use?

</comment></comment><comment><USER15> Our team worked on a similar idea and the test phone speakers died pretty fast, probably 2 out of 3 within a month. The cause may be (1) we over- stressed them too much (2) they were cheap Samsung phones and (3) we used frequency around 20kHz to avoid annoying human users (this library seems to operate at 17+kHz at most). Our conclusion at the time was consumer speakers and microphones are not good enough. Would love to hear whether Quiet has the same issue.

<comment><USER16> Funny, I say my cheap, 2 year old, $60 huawei phone die a couple of months ago. At the end it was emitting weird sounds from its speaker. It would not boot properly anymore.

</comment></comment><comment><USER17> I was always thinking that broadcasting high pitched audio signals would be an awesome way to drive a companion website in a theater or museum. As you follow the play subtitles advance or text for a painting comes up on your phone.

<comment><USER18> I've been wanting theaters to adapt a protocol like this to control the color of light sources in the theater (row lights, emergency exit sign). Make all those lights with color leds and let the color be controlled by signal embedded in the audio track of the movie — then subtle mood lighting effects would become an option for movie makers... would be fun for some movies — the stars wars scene in the emperor's thrown room comes to mind as a good example.

<comment><USER19> Maybe the law is very specific in the color and amount of light that emergency signs and row lights are allowed to have?

I'm just speculating, but I don't remember the last time I saw a non-green exit sign. I think I've seen them red but very seldomly.

Could that be something preveting such innovations?

I do agree however that it would probably be cool. Sometime ago I got a lightpack (I think it was called?) from a kickstart project, that had a similar effect but for your tv of computer monitor and it looked great.

<comment><USER20> > I'm just speculating, but I don't remember the last time I saw a non-green > exit sign. I think I've seen them red but very seldomly.

In North America?

At least here in Canada, I see almost only red exit signs like this: [http://www.mulelighting.com/product/E-StarSeries.jpg](http://www.mulelighting.com/product/E-StarSeries.jpg)

Only in new construction have I started seeing these green signs: [https://lerablog.org/wp-content/uploads/2013/05/emergency- ex...](https://lerablog.org/wp-content/uploads/2013/05/emergency-exit.gif)

<comment><USER19> In Mexico at least.

Now that I think about it, I do have seen red ones in Canada and the US.

In any case, it seems that it's a color chosen to comply with some law, instead of just an arbitrary choice. In that sense I'm not sure if regulations would let movie theaters (or other businesses) change the color.

<comment><USER18> I agree that there is probably a regulatory obstacle — i imagine its at least theoretically possible to overcome and would be pretty cool!

</comment></comment></comment></comment></comment></comment><comment><USER21> Here's another idea: TCP over vibration. Put one phone on top of the other, the bottom one in vibration mode, the other using its accelerometer to receive.

<comment><USER22> accelerometers are way too imprecise for that to work

<comment><USER23> How? A naive solution would use only "upwards acceleration" and "lack of upwards acceleration"; phone accelerometers should be able to handle that quickly enough to get _at least_ couple dozen bps.

<comment><USER24> Yeah, you just need put a wide margin between "high" and "low" states. The bitrate will be low, but it would work.

</comment></comment></comment></comment><comment><USER25> Google has a SDK called Nearby which is supported on iOS and Android. In the first version only some sort of address / ID was exchanged using audio and then the actual message was transferred using GCM, which meant an internet connection was required. v2 apparently didn't need an online connection but haven't tested it.

<comment><USER26> Their newest payment app in India, called Tez, also uses sound to secure transactions I believe.

<comment><USER25> Yep, made by Google

</comment></comment></comment><comment><USER27> For headless smallish servers (consumer hardware or SoC like Raspberry Pi) the sound interface is awesome because it needs no additional hardware (as with bluetooth + software stack) and almost all mentioned devices have a sound card on board. I think it's not too hard to setup a getty instance in an old modem fashion with this.

Additionally, as a client already a smartphone is suitable. This can be helpful in weird situations (think of non-working network).

</comment><comment><USER28> Dogs' hearing extends to 45 KHz. Cats hear up to 79 KHz. How do all these ultrasonic audio systems affect them? Do they cause pain? Do they damage the animals' hearing?

I won't (knowingly) use ultrasonic audio systems until I see some research on this topic.

<comment><USER29> Presumably the amplitude is no louder than normal speakers. 120db will be dangerous to humans and dogs. 20db won't.

Listening to white noise isn't painful.

</comment></comment><comment><USER30> Can someone with more knowledge expand on the bandwidth limitations here - what are the hard limits for TCP/sound? Are the speeds here technically able to improve marginally, significantly, or not at all?

<comment><USER31> Sound can be used as part of a handshake process and then real communication done over the internet: [https://en.wikipedia.org/wiki/Interactive_Connectivity_Estab...](https://en.wikipedia.org/wiki/Interactive_Connectivity_Establishment)

<comment><USER21> That could be nice to setup/connect devices that don't have buttons and a display. E.g. connecting a printer to a tablet, sending wifi passwords to the printer. (At least, as long as nobody else is listening).

<comment><USER32> Isn't that solved by RSA? Printer broadcasts its public key saying "hey, printer here, send me the wifi password please". Your phone uses the printer's public key to encrypt the wifi password and send it out. The attacker cannot snoop on the key, because it doesn't have the printer's private key necessary to decrypt the message.

<comment><USER33> An attacker could still man in the middle the initial key handshake.

Printer: "Printer here, my pubkey is A"

Attacker (races phone): "Alright bro, I got it"

Attacker: "Printer here, my pubkey is B"

Phone: "Alright bro, I got it"

Phone: "Here is the WiFi password, encrypted with B"

Attacker: "Thanks!"

This example is pretty simplistic, but the idea still works even if there is some form of authentication (e.g., challenge-response).

The way around this is to pre-share some sort of info to verify the authenticity of any new incoming key.

For example, the user downloads a printer app on their phone that contains a master pubkey. On the other side, the printer would have a device pubkey _signed_ with the master private key. When the phone receives a new printer message, it first veriffies the key signature to ensure that it actually came from a legitimate printer.

If you can't get some sort of key onto the phone, your best bet is to perform key exchange out of band. One common technique for phones is NFC: it requires proximity, making the attack above difficult to execute.

<comment><USER34> > For example, the user downloads a printer app on their phone that contains a > master pubkey. On the other side, the printer would have a device pubkey > signed with the master private key. When the phone receives a new printer > message, it first veriffies the key signature to ensure that it actually > came from a legitimate printer.

To further increase security, the certificate (signed pubkey) presented should also contain some unique per-device identifier (serial number or some PIN code or something). Otherwise attacker could possibly extract keys from a similar device to conduct the attack.

</comment></comment></comment></comment></comment></comment><comment><USER35> I see the library has both Android and iOS versions.

I have a question. Is this AppStore-safe? (As in "Is there a chance Apple or Google may reject the app because it includes this feature?")

<comment><USER36> Chromecast is already using it on their SDKs for Android and iOS apps (they call it "audio tokens"): [https://developers.google.com/cast/docs/guest_mode](https://developers.google.com/cast/docs/guest_mode)

</comment></comment><comment><USER37> Reminds me of Google's tez payment system (does over ultrasonic tough)

</comment><comment><USER38> Oh imagine the world of exploit for IOT... the drive-by remote 0wns, beauty

</comment><comment><USER39> I wonder if this would work over radio such as Ham or Two-Way.

<comment><USER40> For low power stuff in amateur radio check out WSPR and FT8.

</comment></comment><comment><USER41> Hammmm. IT Need to disable all audio drivers now?</comment>


Box Response to Covid-19 - <AUTHOR> https://blog.box.com/box-response-covid-19 <comment><USER2> Anyone heard any rumblings about storage supply chain issues causing issues with cloud storage availability or pricing? I remember the floods in Thailand that caused a critical disk shortage in 2011. I'm worried that might happen again with Chinese and other factories offline.

</comment><comment><USER3> What's Dropbox stance on the epidemic?</comment>


Python code to solve xkcd 1313 by Peter Norvig - <AUTHOR> http://nbviewer.ipython.org/url/norvig.com/ipython/xkcd1313.ipynb <comment><USER2> This is a great article. It's pretty fun to play around with this heuristic:

      lambda c: 3*len(matches(c, uncovered)) - len(c)

Here's a trivial way to explore it: say we generalize the heuristic to H(a, b).

      H(a,b) = lambda c: a*len(matches(c, uncovered)) - b*len(c)

The original heuristic is considered H(3,1) by this definition. Then we can play around with a and b to see if we'd get smaller results.

      def findregex_lambda(winners, losers, a, b):
          "Find a regex that matches all winners but no losers (sets of strings)."
          # Make a pool of candidate components, then pick from them to cover winners.
          # On each iteration, add the best component to 'cover'; finally disjoin them together.
          pool = candidate_components(winners, losers)
          cover = []
          while winners:
              best = max(pool, key=lambda c: a*len(matches(c, winners)) - b*len(c))
              cover.append(best)
              pool.remove(best)
              winners = winners - matches(best, winners)
          return '|'.join(cover)

      >>> findregex_lambda(starwars, startrek, 3, 1)
      ' T|E.P| N'
      >>> findregex_lambda(starwars, startrek, 3, 2)
      ' T|B| N| M'

Or, to automate this:

      def best_H_heuristic(winners, losers):
          d = {(a,b) : len(findregex_lambda(winners, losers, a,b)) for a in range(0,4) for b in range(0,4)}
          return min(d, key=d.get)

      >>> best_H_heuristic(starwars, startrek):
      (3,1)

Looks like H(3,1) is pretty good for this case. What about the nfl teams?

      >>> best_H_heuristic(nfl_in, nfl_out)
      (3, 2)
      >>> findregex_lambda(nfl_in, nfl_out, 3, 1)
      'pa|g..s|4|fs|sa|se|lt|os'
      >>> findregex_lambda(nfl_in, nfl_out, 3, 2)
      'pa|ch|4|e.g|sa|se|lt|os'

Not the best heuristic there. H(3,1) wins or ties for the boys/girls set, left/right set and drugs/cities set, which just goes to show you that picking a heuristic off a gut guess isn't such a bad approach.

You could also explore heuristics of different forms:

      M(a,b,d,e) = lambda c: a*len(matches(c, uncovered))^b - d*len(c)^e

Or trying completely different formats:

      L(a,b) = lambda c: a*log(len(matches(c, uncovered))) - b*len(c)

</comment><comment><USER3> I don't know why Randall's regex incorrectly (?) matches "Fremont", but it's worth noting Wikipedia's primary spelling has an accent aigu "Frémont":

[https://en.wikipedia.org/wiki/John_C._Frémont](https://en.wikipedia.org/wiki/John_C._Frémont)

<comment><USER4> Frémont still matches "[rn]t", so the problem persists regardless of this spelling.

</comment></comment><comment><USER5> One thing not mentioned in this article:

1\. The greedy algorithm has an O(log(n)) approximation ratio, meaning it produces a regex guaranteed to use a number of terms within a multiplicative O(log(n)) factor of the optimal regex.

2\. Unless P != NP, set cover cannot be approximated better than the greedy algorithm. In other words, the only general solutions you'll find (unless you're using some special insight about how regular expressions cover sets of strings) will be no better than a constant factor improvement in produced regex size than the greedy algorithm.

That being said, regexes (esp disjunctions of small regexes) are not arbitrary sets. So this problem is a subset of set cover, and certainly may have efficient exact solutions.

</comment><comment><USER6> I love Norvig's Python posts. He really gets the spirit of the language and has fun with it.

<comment><USER7> Yes, I love expressions as this one:

      winners, losers = (winners - losers), (losers - winners)

<comment><USER8> Was that in an earlier version? I can't find that in the article now.

<comment><USER9> Yep, he originally threw out all names that appeared on both lists, while he's now arbitrarily assigning them to the winners' set. Not sure about the reasoning behind the change, but there it is. The quoted line computed new winning and losing sets that excluded all commonalities.

<comment><USER10> I actually also really liked that line, it helped flesh the article out to be an impromptu tutorial on using sets in python (which it still is, to a certain extent). I remember reading that sets overloaded some sensible operators a while back, but I really appreciated this reminder.

In other words, very nice of you to highlight it in a comment, as new readers wouldn't have seen it otherwise (as it turns out).

</comment></comment></comment></comment></comment><comment><USER11> This was posted a few days ago on Code Golf:

[http://codegolf.stackexchange.com/questions/17718/meta- regex...](http://codegolf.stackexchange.com/questions/17718/meta-regex-golf)

That link includes a perl 10-liner to do the same.

<comment><USER12> I dunno if calling a pre-implemented solution is quite the same as writing one yourself.

</comment></comment><comment><USER13> I thought it was going to be meta-meta-regex golf, and couldn't imagine how that would be possible. But meta-regex golf is an interesting exercise, and is far more tractable. :)

<comment><USER14> "Write the shortest regex that only matches programs that successfully generate the shortest regex given lists of inclusions and exclusions."

<comment><USER15> Such a regex cannot exist:

1\. Take an existing solution to finding the shortest regex given a list of inclusions an exclusions.

2\. Take another unrelated arbitrary program.

3\. Combine the two, when the arbitrary program terminates, use the existing solution to solve the problem.

4\. Such a regex would have to solve the halting problem to know if the arbitrary program terminates and the existing solution solves the problem.

5\. Since the halting problem cannot be solved, no such regex can exist.

<comment><USER16> So long as the unrelated arbitrary program is of finite length, and the regex golfer / arbitrary program composite is running on a machine with a finite amount of state, the halting problem can be solved by running each program for 2^(bits of state) steps or until a state is repeated.

So as long as you can show that a program that is not finite in length will not halt in a finite amount of time (I think this is the case, but am not actually positive), I think that a rexex-finding-program-finding-regex should be possible to write, at least in principle (though not in practice).

<comment><USER15> Yes, the halting problem can be solved for any programs which can only exist in a finite number of states, but most common definitions of a program would include things such turning machines, which can hold an infinite number of states. Really it comes down to the semantics and bounds of the problem.

However I think the most interesting result is mine :P

</comment></comment></comment></comment></comment><comment><USER17> When I read 'subtitles', i wondered about the .srt files of the movies.

<comment><USER18> Same here, and was blown away.

<comment><USER19> "subtitles" ? I'm not seeing that anywhere here nor on norvig.com. link?

<comment><USER20> first panel of the cartoon

<comment><USER19> d'oh. thanks :)

</comment></comment></comment></comment></comment><comment><USER21> Exercise for the reader, write a regex to distinguish random noise from English

EDIT: possibly down-voted because someone though it was sarcastic???

I was actually thinking of this problem before the XKCD comic, for detecting hashes on hardrives efficiently...

<comment><USER22> Almost any regex containing a common English phrase of a few words, like /of course/, would give you a very high accuracy rate on a large enough dataset and a very low false positive rate. English has low entropy per bit.

<comment><USER21> That strategy would return results for any phrase not containing "of course". Which would be rather a lot of results in any document. I am envisioning a regex that plucks hashes from emails, for example. Some parts English, some parts cryptographic "noise". Pick the noise from the English

(note the inspiration was a nefarious regex scanner for finding bitcoin hashes. I have no intention of building such a thing, but the idea of a random detector regex intrigued me. Is it possible?)

My idea was more like calculate the statistics of character n-grams in english (all of which exist in random noise too), but count the most unlikely occurrences until you hit some probabilistic threshold that indicates some well thought out decision boundary.

<comment><USER23> I had to recognize English for a cryptography project in college. This was my entire strategy, which the professor advised for rejecting non-English (it turns out recognizing non-English is easier than recognizing English), and works well:

1\. Parse the full text of some long book available on Project Gutenberg. Record every trigram that occurs. Frequency is irrelevant; we just want to know whether a trigram occurs or not.

2\. Go through your text, counting the number of trigrams that didn't exist in the sample text. If the number of strange trigrams exceeds a threshold (for my project I used a threshold of 3, but you can tune this), reject the text as non-English.

Given the constant finite threshold I used, that does amount to a regex, but I don't recommend trying to write it out explicitly.

<comment><USER24> How effective was your algo?

Presumably it would false-negative texts with neologisms and spelling errors and such.

There must be trigrams which simply don't appear in dictionary-English? Do you have results posted somewhere.

</comment></comment></comment></comment></comment><comment><USER25> Interestingly, finding a minimal-size regexp satisfying a set of positive and negative examples (words that should match, and should not match) is NP-hard. Here is a nice discussion: [http://cstheory.blogoverflow.com/2011/08/on- learning-regular...](http://cstheory.blogoverflow.com/2011/08/on-learning- regular-languages/)

</comment><comment> z-e-r-o Can someone explain what does this line mean and why does he use it as heuristic?

      key=lambda c: 3*len(matches(c, uncovered)) - len(c)

<comment><USER26> IMHO, sadly, that part is serving as a shibboleth.

The clue is how he explains all the simple parts of the script with comments, but leaves this part unexplained, making some of us feel left out of the cool club. Implying: if you don't grasp it immediately you must not be up to it.

Overall it's a great post, but as to the cryptic parts of it, it's disappointing to see this kind of thing on the part of someone we all look up to. It would be more generous of spirit if he were to have written this in a readable, self explanatory way, like the rest of the code... as python should be written.

Sigh. Norvig has a posse, but I thought it had to be said.

        >>> import this
       ...
       "Readability matters"
       ...
       "Sparse is better than dense"
       ...
       "If the implementation is hard to explain, it's a bad idea"

<comment><USER27> First, it is explained in the text above it.

Second, seriously?

A line of code that isn't as clear as it could be in an ipython notebook he probably dashed off in an hour is somehow a reflection on his generosity of spirit? I think you need to recheck your expectations.

<comment><USER28> > First, it is explained in the text above it.

A minor correction: the explanation for this heuristic was added later. (I first opened this in a tab, and then didn't read the tab till much later. I also wondered about the heuristic and didn't think to hit reload till I saw your reply.)

But you're right, there is certainly nothing ungenerous from Norvig here. Quite the opposite.

</comment></comment></comment></comment><comment><USER29> I think it fails for: findregex(set(['abc']), set(['abcd']))

<comment><USER30> Pretty sure that's impossible within given constraints (only disjunction positive regexes allowed).

<comment><USER31> trivially fixable by including start-of-string and end-of-string as tokens in the initial string breakdown, so instead of analyzing {abc, ab, bc, a, b, c} as candidate regexes, you start out analyzing {^abc, abc$, ^ab, abc, bc$, ^a, ab, bc, c$, ^, a, b, c, $}; would rapidly home in on c$ as an optimal solution.

Thus would fail against a 'must fail' target of abcabc, but then you fix that by extending the maximum allowable regex fragment length from 4 to 5 and it'll find ^abc$. More generally, you extend the maximum allowable regex count to the longest 'must match string' plus 2, and it'll always succeed, even if it has to create a regex consisting of ^word1$|^word2$|^word3$...

</comment></comment></comment><comment><USER32> Is Python Peter Norvig's preferred language (along with Lisp, I suppose)?

<comment><USER33> [http://norvig.com/python-lisp.html](http://norvig.com/python-lisp.html)

practical tradeoffs, but yes, his preferred language is Python.

</comment></comment><comment><USER4> I am not sure why Norvig omits president Obama. That said, "[mtg]a" does match him, so at least Munroe tries.

<comment><USER34> His source page doesn't list Obama, for whatever reason.

[http://www.anesi.com/presname.htm](http://www.anesi.com/presname.htm)

<comment><USER35> It's just out of date. It says there have been 53 presidential elections since 1789; there have been 56.

</comment></comment></comment><comment><USER36> It's too bad he didn't try to tackle the optimal regexp problem and settled for approximations - it may be a NP-hard problem, but all the example solutions are short enough that the instances might be still tractable. Would've been nice to know for sure.

<comment><USER37> I coded a brute-force one before: [https://github.com/darius/sketchbook/blob/master/regex/find_...](https://github.com/darius/sketchbook/blob/master/regex/find_min_re.py)

Though it cares about the size of the AST rather than the concrete syntax. I can't try running it now, I'm on an iPad.

</comment></comment><comment><USER38> If you just want to play regex golf this site appeared before Christmas and there was quite a discussion [1] although there are a few more levels now: [http://regex.alf.nu/](http://regex.alf.nu/)

I'm still not happy with my 214 on Alphabetical including one false match (I was 202 or something with everything correctly matched).

[1] [http://news.ycombinator.com/item?id=6941231](http://news.ycombinator.com/item?id=6941231)

</comment><comment><USER5> What tool does Norvig use to create this json file? Does iPython have this as a feature (somehow allowing formatted text)?

<comment><USER39> By "this json file", do you mean the ipython notebook itself? (It's saved as JSON behind-the-scenes. That's what you'll get if you click "download notebook".)

If so, yes, that's what a saved ipython notebook is. See: [http://ipython.org/notebook.html](http://ipython.org/notebook.html) for an overview of ipython notebooks.

You can export it to html, latex, etc using "ipython nbconvert --to <format_you_want>". See: [http://ipython.org/ipython- doc/dev/interactive/notebook.html...](http://ipython.org/ipython- doc/dev/interactive/notebook.html#notebook-documents)

Basically, the website you're seeing (nbviewer) hosts ipython notebooks (json files) and converts them to static html for viewing.

<comment><USER28> What's the best way to install ipython on a Mac? Mine's from Macports, and I have ipython notebook, but when I try to use nbconvert I'm told I'm missing pandoc. A 'port install pandoc' wants to install yet another copy of gcc (I have two--including one from Macports for another ipython dependency), ghc, and about three dozen packages prefixed with 'hs'.

Is there any nice bundle of everything you need for ipython, for the Mac, that's both easy to install and uninstall?

<comment><USER39> If you just want to install pandoc so you can convert things, see: [http://johnmacfarlane.net/pandoc/installing.html](http://johnmacfarlane.net/pandoc/installing.html) (There's an OSX binary there)

Seeing as how you already have a functioning install of ipython and a setup you're otherwise happy with, this is probably the easiest route.

Also, just so it's clear what's going on, ipython notebooks and (especially) format conversion are optional (but very useful) parts of ipython. They're not part of the core functionality, so `pandoc` isn't a strict requirement to build ipython.

Otherwise, as long as you don't mind switching the python interpreter, etc as well, look into Anaconda or Canopy. I'm not 100% sure if either comes with pandoc, but they're stand-alone scientific python distributions that make it a good bit easier to get ipython, numpy, matplotlib, etc set up.

<comment><USER28> Thanks for the pandoc link, I'll try that tonight. My ipython does already have notebook, numpy, matplotlib, and more set-up; I didn't realize I was missing anything till I tried nbconvert.

But I've just recently installed all this, and have only kicked it around a little. Mostly, I wanted plotting.

</comment></comment></comment></comment></comment><comment><USER40> With the given set,

      /M | [TN]|B/

is suboptimal, but could be

      / [TMN]|B/

But that (and the article) leaves out the subtitle for Star Trek 1: "The Motion Picture". For that, Randall's original expression works.

</comment><comment><USER41> What would be a use for finding a minimal discriminating regex? Perhaps understanding the difference between boys' and girls' names?

<comment><USER42> Performance. For example if you are syntax highlighting a programming language with hundreds of keywords, then using a regexp like "(kwd1|kwd2|...|kwdn)" is not very efficient. An optimized regexp can do the same matching much faster.

<comment><USER43> You would be much better off just generating the DFA of the straightforward regex and minimizing that DFA. This is simpler _and_ faster to generate _and_ faster to execute. Furthermore, in a parser for a programming language you do not want to match some things in one list but not in this other list, you want to match some things in this list _and nothing else_.

</comment></comment></comment><comment><USER44> Could this be used as an alternative to a bloom filter ?

<comment><USER36> If you know everything ahead of time, you could probably just use something like a [https://en.wikipedia.org/wiki/Perfect_hash_function](https://en.wikipedia.org/wiki/Perfect_hash_function)

</comment></comment><comment><USER45> <meta-comment on meta-golf>

Judging by the amount of fawning here, this guy must be a HN celebrity. Interesting post nevertheless!

I can only hope, one day, I'd be writing and publishing joyful little hacks like this, to such general applause, instead of eking out a living. I have to say I'm a bit envious here!

Well done to the dude. An inspirational post, in many ways.</comment>


Ask HN: 18.104.22.168 DNS (Cloudflare) outage? - <AUTHOR> I'm experiencing an outage with the new 184.108.40.206 dns resolver. Anyone else? <comment><USER2> It's back up:

        ; <<>> DiG 9.9.5-9+deb8u15-Debian <<>> @220.127.116.11
        ; (1 server found)
        ;; global options: +cmd
        ;; Got answer:
        ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21908
        ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 1

        ;; OPT PSEUDOSECTION:
        ; EDNS: version: 0, flags:; udp: 1536
        ;; QUESTION SECTION:
        ;.                              IN      NS

        ;; ANSWER SECTION:
        .                       2179    IN      NS      a.root-servers.net.
        .                       2179    IN      NS      b.root-servers.net.
        .                       2179    IN      NS      c.root-servers.net.
        .                       2179    IN      NS      d.root-servers.net.
        .                       2179    IN      NS      e.root-servers.net.
        .                       2179    IN      NS      f.root-servers.net.
        .                       2179    IN      NS      g.root-servers.net.
        .                       2179    IN      NS      h.root-servers.net.
        .                       2179    IN      NS      i.root-servers.net.
        .                       2179    IN      NS      j.root-servers.net.
        .                       2179    IN      NS      k.root-servers.net.
        .                       2179    IN      NS      l.root-servers.net.
        .                       2179    IN      NS      m.root-servers.net.

        ;; Query time: 10 msec
        ;; SERVER: 188.8.131.52#53(188.8.131.52)
        ;; WHEN: Thu May 31 18:14:31 UTC 2018
        ;; MSG SIZE  rcvd: 431

</comment><comment><USER3> This issue should be resolved. It is early but appears our DDoS systems kicked in when they shouldn't.

<comment><USER4> You might want to put a link to your system status page on your home page:

[https://188.8.131.52/](https://184.108.40.206/)

I googled "126.96.36.199 service status" and that was the top result and there was no link to your actual status page.

So then I did what I always do and hit [https://news.ycombinator.com/newest](https://news.ycombinator.com/newest)

<comment><USER5> [https://www.cloudflarestatus.com/incidents/2mz3wly2g7dy](https://www.cloudflarestatus.com/incidents/2mz3wly2g7dy)

Sorry about that. [https://www.cloudflarestatus.com/](https://www.cloudflarestatus.com/) should also encompass 126.96.36.199 and 126.96.36.199.

</comment></comment></comment><comment><USER6> How to check if you're having trouble from your specific location:

\-- Windows --

Cloudflare DNS:

      nslookup www.google.com 18.104.22.168

Google DNS:

      nslookup www.google.com 220.127.116.11

\-- Linux --

Cloudflare DNS:

      dig @184.108.40.206 www.google.com

Google DNS:

      dig @220.127.116.11 www.google.com

<comment><USER7> Using dig on windows 7 it seems to be up.

</comment></comment><comment><USER8> Cloudflare explained this incident on this post [0]. You can also check the discussion on HN here [1].

[0]: [https://blog.cloudflare.com/today-we- mitigated-1-1-1-1/](https://blog.cloudflare.com/today-we-mitigated-1-1-1-1/)

[1]: [https://news.ycombinator.com/item?id=17201830](https://news.ycombinator.com/item?id=17201830)

</comment><comment><USER9> Confirmed in The Netherlands.

Was concerned it was another hijack, but a hijack would probably try to act like a dns...

</comment><comment><USER10> Confirmed from India.

Are we even supposed to use the same DNS provider for both the fields? That seems like a bad idea

</comment><comment><USER11> Confirmed from Argentina.

From Cloudflare Status: "Resolver Timeouts" [https://www.cloudflarestatus.com/incidents/2mz3wly2g7dy](https://www.cloudflarestatus.com/incidents/2mz3wly2g7dy)

</comment><comment><USER12> funny that no one links to the cloudflare status page: [https://www.cloudflarestatus.com/](https://www.cloudflarestatus.com/)

<comment><AUTHOR> Thanks for posting, I had checked originally, but didn't see that update, probably too early.

</comment></comment><comment><USER13> It made my router lockup for some reason, even changing DNS locally on PC seemed to give some routing issues. Router reboot seemed to sort out.

</comment><comment><USER14> Yeah - Europe side too. Thought my raspberry pi hole setup was broken...nope.

Maybe related to the recent attack on that DNS server?

</comment><comment><USER15> New Jersey on Fios, same here. Secondary DNS set to 220.127.116.11 which probably makes more sense as a backup anyway.

</comment><comment><USER16> Just had to change my DNS forwarders, it was stupid of me to use 2 from the same provider.

</comment><comment><USER17> Could this be more hacking originating from China? Same thing from just a few days ago.

</comment><comment><USER4> Confirmed in Silicon Valley, seems to be working now though.

</comment><comment><AUTHOR> Denver/Comcast Business Cable currently (fyi)

</comment><comment><USER18> yeah I just had to change to 18.104.22.168 as well

<comment><AUTHOR> yep same, guess I'll need to put a backup dns back in my settings.

<comment><USER4> Yea I just updated my Google Wifi settings to 188.8.131.52 primary and 184.108.40.206 secondary.

</comment></comment></comment><comment><USER19> Down in London, both 184.108.40.206 and 0.0.0.0

<comment><USER20> 0.0.0.0 might be down for a little bit longer ;)

<comment><USER21> Just a little bit longer... ;)

<comment><USER13> It's still down, shall we let Cloudflare know .. ;-)

</comment></comment></comment></comment><comment> j-e-k Confirmed from LA, dig times out...

</comment><comment><USER22> Yep. Seems to be global too.

</comment><comment><USER23> Confirmed from Austin, TX

</comment><comment><USER24> Confirmed from St. Louis

</comment><comment><USER25> yea, I set the secondary dns to 18.104.22.168 due to that

</comment><comment><USER26> Yup, same here.

</comment><comment><AUTHOR> confirmed back up here (denver)</comment>


Terrain Generation with Diamond Square - <AUTHOR> http://stevelosh.com/blog/2016/06/diamond-square/ <comment><USER2> Discussion of related article: [https://news.ycombinator.com/item?id=11136145](https://news.ycombinator.com/item?id=11136145)</comment>


Ask HN: What should I do with my side project that has 14,000 users? - <AUTHOR> I have around 14,000 users of a web app and chrome/firefox extension I wrote a few years back. Usually I see 300 users a month logging in, and approximately 1,300 active monthly users (you don't have to log in to use it).
It gets ~20+ users a week registering, mostly through direct / social referrals, as the service is built around sharing URLs. The number of chrome extension installations remains constant at 13-14,000.
I have maybe a couple of hours a week spare to work on it.
What should I do with it?
You can see it here: https://tab.bz/ <comment><USER2> Given that you don't want to sink a lot of time into this, I think a donate button is your best option.

A freemium version might work if you can identify and implement a feature your users would be willing to pay for.

</comment><comment><USER3> Unless you are financially independent, sell it if you can

<comment><AUTHOR> I did look at this, but the only people willing to buy were the kind of outfits that will immediately load it with spyware. Where could I find someone who wouldn't do this and would pay a reasonable amount?

<comment><USER4> Curious how you know they'll load it with spyware. Not doubting you, but just curious what the signs are that tipped you off.

<comment><AUTHOR> There are a few things that combined point to an unfavourable outcome for users:

\- They offer to purchase the chrome extension, and have no idea that there's a web service behind it that makes it work. When I explain how it works they just ignore it completely / don't understand

\- They offer an increased price if we have active users and users in high value geographies (e.g. USA, UK, Japan)

\- They are from Russia

\- googling the company sometimes reveals that they are an extensions monetisation service, or related to one, and can be integrated in a couple of lines of code (a script tag)

\- sometimes they just say what they're planning to do if you ask

The offers are around $1000 USD. My morals have a price but it's a lot higher than that!

<comment><USER5> Generally I ask what their plans are going forward to extend the product and it's obvious they have none plus don't even know what the product is. When they just want to know the user base and location of the users that's a really bad sign.

> sometimes they just say what they're planning to do if you ask

Haha, I wonder why they would do that.

</comment></comment></comment></comment></comment><comment><USER6> Maybe try with a donate button somewhere, it might give you insight if people are (even) willing to pay for it? You could still sell it afterwards but if you received donations it at least shows potential buyers it raises interest.

</comment><comment><USER7> hmmm, why not monetize it somehow?

<comment><AUTHOR> any suggestions on how? Subscriptions seem unlikely to yield significant results, and ads suck...

<comment><USER8> \- Free — one ad related to the combined list of tabs (stackoverflow / programming blogs links => tech job offers).

\- 1€$/mo (billed annually because banking fees) to remove those ads.

Ads are a necessary evil when the average person considers that software has no cost.

<comment><AUTHOR> I quite like the relevant ad suggestion there actually. I would be surprised if there was an ad network that could give consistently relevant results?

<comment><USER9> The Carbon network has high quality, relevant ads for developers. You might want to look into it.

[https://carbonads.net/dev_code.php](https://carbonads.net/dev_code.php)</comment></comment></comment></comment></comment>


Are accelerators to blame for derivative startups? - <AUTHOR> http://www.andrewcross.ca/2012/05/31/are-accelerators-to-blame-for-derivative-startups/

<comment><USER2> Accelerators definitely help develop this "derivative startup" atmosphere, but it is not the root cause. The reasons given in the bullet points are the root causes, accelerators were created in response.</comment>


Possible Evidence for Hawking Points in the CMB Sky - <AUTHOR> https://www.sciencealert.com/penrose-b-mode-hawking-points-sign-previous-universe-in-conformal-cyclic-cosmology <comment><AUTHOR> Penrose'paper is here: [https://arxiv.org/abs/1808.01740](https://arxiv.org/abs/1808.01740)</comment>


Wireframing Mobile Apps or: How I Learned to Stop Worrying and Love Index Cards - <AUTHOR> http://lytol.com/articles/mobile-wireframing.html

<comment><USER2> I love the Dr. Strangelove reference!

The advice is sold too! Unplugging is often the most helpful way to get sh*t done. Another technique I came across recently is to start off your day with production rather than consumption. i.e. start your morning writing a 500 word essay or going outside, sitting in a park, and just making those wireframes. Your day will be exponentially more productive!

<comment><USER3> This Dr. Strangelove reference has been waaaaay overused lately, it's just starting to be annoying now.

As far as using index cards for wireframing, seems like a decent enough idea if you have a really small team. Doesn't really scale that well for larger teams/projects.

<comment><AUTHOR> I'm just hoping to edge out "How I Learned To Stop Worrying And Love Pooping During Childbirth" in Google search results.

</comment></comment></comment><comment><USER4> Delightfully simple.

Additional benefit (not explicitly mentioned) is that you can test your UI/flows with potential users.

Imagine having a deck of cards with you in the pub. You could let someone navigate the app, card by card, and quickly identify the sticking points & user confusion. All _without_ having to build anything.

<comment><USER5> As an interesting alternative, I've gotten tons of mileage doing this in Powerpoint. You can even setup hyperlinks on the "buttons" to quickly move to different slides in the deck showing different interface states.

</comment></comment><comment><USER6> Thank you! I always start with paper and pen - there is just no faster way to iterate and, more importantly: focus. I need to get out of the office to do creative work like this and taking a tablet with me just leads to distractions rather than just "out of the office for the next couple of hours in the park, don't email me".

</comment><comment><USER7> Awesome (concise, yet detailed) post, Brian! I was just talking to a co- founder friend the other night who suggested the same approach. It's brilliantly-simple and is ideal for people looking to talk about their ideas without having to build them or smaller teams.

Thanks for sharing, Luke (<http://LukeRB.com>)

</comment><comment><USER8> Hackers need intuitive design tools. Nothing's more intuitive than drawing with a pen on some cards. No commands to remember.</comment>


Get Me Off Your Fucking Mailing List (2005) [pdf] - <AUTHOR> https://www.scs.stanford.edu/~dm/home/papers/remove.pdf <comment><USER2> The story behind this is here: [https://scholarlyoa.com/bogus-journal-accepts- profanity-lace...](https://scholarlyoa.com/bogus-journal-accepts-profanity- laced-anti-spam-paper/)

"After receiving a spam email from the International Journal of Advanced Computer Technology, Dr. Peter Vamplew of Federation University Australia's School of Engineering and Information Technology sent the anti-spam article as a reply to the spam email without any other message, expecting that they might open it and read it, but not that it would be considered for publication.

To his surprise, the journal accepted the paper and sent him an acceptance email that had two PDF attachments. One was a formal statement of acceptance and the second was the reviewer report."

<comment><USER3> There are so many stories like this. My favorite (although this one is very good) is that that a bunch of academics got together and pasted together some absolute nonsense (I assume this is from the era before SciGen) and submitted it to a conference.

When it was accepted they revealed the hoax, and the conference admins claimed that it was because these academics were obviously very good, they figured the paper was just a placeholder and would be fixed up in the final version. The only problem was that the academics in question had used fake names on the submission and the affiliation of "The Austrian Naval Academy".

(amusingly, there historically _was_ an Austrian Naval Academy and an Austrian Navy, back during the Austro-Hungarian Empire period - Capt von Trapp of Sound of Music fame is a famous example of one of their officers)

<comment><USER4> For the geographically-challenged: present-day Austria is land-locked, and thus has no call for a navy, let alone a naval academy.

<comment><USER5> Why would that prevent them from having a small navy? Assuming some country is happy for them to pay to have a port somewhere. Although they don't it wouldn't surprise me much to learn that they did have one despite being land- locked.

<comment><USER6> Many moons ago I reconnected with an old friend who moved to Switzerland years before; just imagine my face when he told me he was working for a Swiss shipowner:).

<comment><USER7> Well, Switzerland may not have access to a sea, but it has a haven. A tax haven. A lot of ships are owned by corporations in those.

</comment></comment></comment></comment></comment></comment><comment><USER8> This reminds me of Doug Zongker's "Chicken Chicken Chicken: Chicken Chicken" [0]. Sadly, Google Scholar appears to no longer be showing its citation count, although, IIRC, it used to be well in the hundreds.

[0]: [https://isotropic.org/papers/chicken.pdf](https://isotropic.org/papers/chicken.pdf)

<comment><USER9> [https://www.youtube.com/watch?v=yL_-1d9OSdk](https://www.youtube.com/watch?v=yL_-1d9OSdk)

<comment><USER10> A classic. For those who haven't seen it before, it's worth watching the whole thing.

</comment></comment></comment><comment><USER11> I notice the Mail Avenger link at the top.

> Mail Avenger is a highly-configurable, MTA-independent SMTP server daemon. > It lets users run messages through filters like ClamAV and SpamAssassin > during SMTP transactions, so the server can reject mail before assuming > responsibility for its delivery. Other unique features include TCP SYN > fingerprint and network route recording, verification of sender addresses > through SMTP callbacks, SPF (sender policy framework) as a general policy > language, qmail-style control over both SMTP-level behavior and local > delivery of extension addresses, mail-bomb protection, integration with > kernel firewalls, and more.

</comment><comment><USER12> Double opt in required should be a law. When my email is given by mistake by similarly named people but I can't correct the mistake because only customers can contact them. Oh the iritating irony of getting security tips from the coop bank when I'm not the account holder.

<comment><USER13> I've had this problem with a Netflix subscription in a foreign language. I kept getting mail for it, but couldn't read what it was about, and couldn't easily opt out. The only option was to reset password, login, change the language, and then cancel the subscription.

At least I was fortunate I could easily cancel the subscription. You can't do that with bank accounts.

<comment><USER14> Cut-n-paste into Google Translate to fix the unreadable problem. Interesting they made it that easy to cancel.

</comment></comment></comment><comment><USER15> Jesus christ the graphs are even borderline hilarious

</comment><comment><USER16> Should have used pdflatex with

       \usepackage{microtype}

in the preamble. The hyphenation would have been much nicer.

</comment><comment><USER17> We need the same but for newsletter modal ads on websites. And newsletters themselves.

</comment><comment><USER18> Anyone had a professional mailing list or spammer add your email and have no unsubscribe feature? Had this happen and had to find the guy on LinkedIn and tell him to remove my email.

<comment><USER19> You reminded me of something Cory Doctorow wrote about a few years ago. He wanted Mail Chimp to tell him all the mailing lists he was on and they wouldn't.

I don't know if they've changed it since then, but as soon as he mentioned it I thought that it was a great suggestion. There should definitely be a way that I, as the owner of an email address, can log into Mail Chimp and manage what they are going to send to me.

<comment><USER18> I like that idea. Reminds me of how some credit cards now show you all the stores that have re-occurring or automatic payments. I like the added transparency because then it makes it easier to opt out if needed.

</comment></comment></comment><comment><USER20> Did they get off the fucking mailing list?

</comment><comment><USER21> Do you know what software was used for the graph on p. 3? Usually I'm using GraphViz, but the arrows are not as nice.

<comment><USER22> It looks like Kernighan's Pic.

[https://en.wikipedia.org/wiki/Pic_language](https://en.wikipedia.org/wiki/Pic_language)

<comment><USER21> Thank you. I had a brief look at the existing implementations like the GNU PIC and and unfortunately the arrows lack the finesse of the original.

</comment></comment></comment><comment><USER23> I've been in the habit for years of making liberal use of the catch-all feature of email to make up email addresses unique to everything. This makes it easy to add NDR bounces to specific email addresses that end up on f-ing mailing lists I don't want or for which the address was sold/given to other groups (political parties are the WORST about this!).

<comment><USER14> Right there with you. There are exceptions in all the (US, at least) rules for spam email, spam sms, do-not-call list, etc. for political parties, and boy do they take advantage.

</comment></comment><comment><USER24> Is there one of these for recruiters?

<comment><USER25> I just ask them honest questions that are insulting to their ability to recruit

<comment><USER26> Can you elaborate?

<comment><USER27> Probably along the lines of "This position is for a front end developer with 5 years of React, but my resume clearly indicates that I do .NET backend work. What made you think I was a good fit?"

<comment><USER25> You nailed it exactly.

</comment></comment></comment></comment></comment><comment><USER28> The three certainties of modern life: death, taxes, and unsolicited marketing emails.

</comment><comment><USER29> When Kohler and Maziéres win the Turing award, we'll know why.

</comment><comment><USER30> Funny, I wrote an article about why people don't cite Wikipedia as a source for information in scholary papers when in fact Scholary papers can fall to the same trap of being "not reliable" the same way wikipedia is here: [https://news.ycombinator.com/item?id=21989531](https://news.ycombinator.com/item?id=21989531) not so long ago</comment>


Newsgator turns NetNewsWire free for everyone - <AUTHOR> http://www.tuaw.com/2008/01/09/netgator-turns-netnewswire-free-for-everyone/ <comment><USER2> I had to check the calendar to make sure it wasn't April 1st.

I was literally seconds away from buying NNW when this news appeared. The free version has been great, and when I heard that the full version can archive articles on my hard drive I was sold.</comment>


Ask HN: Do you use FreeBSD as web server? Why or why not? - <AUTHOR> <comment><USER3> Yes, because it is a great platform to learn system administration. First, it's so simple that eg. it takes only few lines to automate installation or create a customised internal repository. Second, the documentation.

edit. And oh yes, the memory usage of the default installation is so low, that you can virtualize dozens of them on your laptop. This helps when you want to locally reproduce the stack you run in cloud.

</comment><comment><USER4> Yes, I use it for my personal web servers. I completely rid myself of Linux when Debian switched to systemd. I run nginx for static and proxy services. I wrote some Scala/Play apps that I run in jails on OpenJDK8. I run some open source PHP, Python, Ruby and C and perl CGI scripts for various admin things and "cloud" things but all on my own hardware. I use iocage to manage the jails. I replicate the jails between two physical servers asynchronously, and also send them to my house for an off site. I run PostgreSQL on the two servers in a failover setup with WAL shipping. It takes about 30 minutes a month to keep security patched. I use saltstack to manage as much as possible. It took about 2-3 weeks to set everything up using just evenings and weekends, it's a lot more hacky than stuff I do for dayjob because I'm the only one that needs to understand the setup so I can elide some robustness I'd use in a team environment (i.e. no test suite, no branches, no CMDB just simple text files assigning roles, no multi-platform or abstractions everything is decisivly coded for my tech stack of choice like FreeBSD, Postfix, Dovecot, PostgreSQL)

I also use it at work. The scale is much different as one of the largest CDNs, the network interface stats are eye popping. This is proprietary caching software and nginx and apache for certain types of origins or admin services.

</comment><comment> chao- No.

I have a high tolerance for trawling through documentation and reading the code of open source libraries in pursuit application logic and the fiddly bits of related services. I have low tolerance for the same work in pursuit of infrastructure configuration and systems administration.

I run various flavors of Debian and Ubuntu across a desktop, 2 laptops and a home server (various audio/video projects). Thus I tend to default to the familiarity of these systems, and get back to the part of the stack I enjoy working in. Another word for this might be "laziness", but that doesn't quite tell the full story.

<comment><USER5> As work on Debian/kFreeBSD progress, hopefully you can have both!

<comment><USER6> Is work on Debian/kFreeBSD going to survive Debian's systemd transition? (I see articles from late 2014, but not sure the current status)

As a FreeBSD user and a Debian user, I was excited to try Debian/kFreeBSD around 2012ish? but it was kind of painful -- a lot of important FreeBSD userland tools weren't available in packages, so you had to do a lot of messing about to get things you might need. It might be interesting to run a Debian/kFreeBSD jail inside a regular FreeBSD install, but at that point, you may as well just bite the bullet and do things in regular FreeBSD.

<comment><USER5> From what I can see from keeping half an eye on the Debian/kFreeBSD Devel list[1], work is progressing nicely.

It should be noted that a) FreeBSD is doing work to keep software working without SystemD (an obvious point, I know, but it might not be obvious that this means that work also benefits Debian) - so long as we don't see any crazy dependency on SystemD from Apt or the installer itself (hopefully unlikely) - there shouldn't be any issues. b) Debian/GNU Linux still supports more than one init-system[2] -- at least for now.

While the long fingers of SystemD reaches for more and more of Linux, as long as developers are supporting other systems _at all_ , there should be a way forward for distributions that doesn't want to incorporate SystemD. So this includes stuff like native Windows support, building on OS X, and packaging for the various BSDs -- all that work that goes into the big packages should continue to benefit Linux users that want to avoid SystemD for one reason or another.

> I was excited to try Debian/kFreeBSD around 2012ish? but it was kind of > painful -- a lot of important FreeBSD userland tools weren't available in > packages

As far as I know, this should've improved quite a bit. The biggest bar for entry (last I checked) was that the nightly installer builds might not work out of the box (one possible workaround would be to install Wheezy/7.0 and then dist-upgrade).

To be clear, I've yet to play with Debian/kFreeBSD, so this mostly from impressions from the list (and I'm not quite caught up with the latest). AFAIK the installer should now support installing on zfs rootfs, for example.

[1] [https://lists.debian.org/debian-bsd/](https://lists.debian.org/debian- bsd/)

[2] [https://wiki.debian.org/systemd#Installing_without_systemd](https://wiki.debian.org/systemd#Installing_without_systemd)

<comment><USER6> Thanks for the detailed response (and link to installing without systemd!)

</comment></comment></comment></comment></comment><comment><USER7> HN does, because pg and rtm liked it from way back, we inherited it, and it works well.

<comment><USER8> By the way, when are you going to come to a BSD conference and talk about running HN? We love "view from the trenches" talks, and I'm sure Arc makes things interesting in unusual ways.

<comment><USER9> Back when HN was still running with millions of files in one directory on UFS, _maybe_ there was something to talk about (not much more than sysctl tweaks). Oh, and UFS snapshots (for tarsnap to reference) sometimes panic'd the box.

When I left we'd added nginx in a jail and switched to ZFS, which solved most of the problems we had been having. There were a few ZFS deadlocks, but I never got to the bottom of it and FreeBSD 10 seemed to fix them. I'd imagine things are even less notable now.

<comment><USER8> _UFS snapshots (for tarsnap to reference) sometimes panic 'd the box._

Ick. Yeah, UFS snapshots had issues for a while... had I known you were using them I would have encouraged you to switch to ZFS sooner.

 _There were a few ZFS deadlocks, but I never got to the bottom of it and FreeBSD 10 seemed to fix them._

Yes, FreeBSD 10 definitely fixed a bunch of ZFS deadlocks.

</comment></comment></comment></comment><comment><USER10> I started out using fbsd back when 4.4 was a thing, and the performance was much better than anything GNU/Linux could do, for running Apache.

Back then fbsd had something called accept filters, which basically made the accept call only return when a http request was received in the network buffers.

Systems running fbsd loaded up different than Linux, kept being responsive. On same hardware, could do 3-5x more rps with lower load iirc.

As my applications at the time became more cpu bound, I switched to Debian around 4.11.

I've recently been using 10.x, coming back to fbsd from 10 years of Debian. I love what you've done while I was gone. Especially binary packages and easy upgrades, but especially jails and zfs.

</comment><comment><USER11> Yes, on a small fleet of node.js (and some other services) VPS' on DigitalOcean in production, after a year or so playing with it for personal playthings.

Default system uses less memory than Ubuntu (~50MB last time I checked which means something on .5, 1GB RAM instances). I could swear memory consumption in general has fallen down, but haven't done any measurements.

I don't have to jump all over the web to figure out how something works - <USER2> just go to handbook. Which means one gets tendency to study topics instead of copy-paste snippets from around.

Since base system (maybe things were different before) does not abruptly change or pull the rug under your feet, combined with handbook studies, this has the effect of compounding knowledge that'll be effective in years to come.

Firewall (pf) is a thing of beauty. I've barely scratched the surface of it.

Base/userland abstraction split, as well as consistency throughout the system helps one maintain a solid mental map of the system. After a short while, you just _know_ where stuff is, how to configure it, and where its defaults are even when you're in completely new territories.

Bonus: You can really go the distance without compiling anything, but if you're keen on maintaining a low memory profile by dropping various features from your packages, this is a great new build system I use to have all my pkgs up to date - [https://github.com/jrmarino/synth](https://github.com/jrmarino/synth)

</comment><comment><USER12> Yes. Because it is simpler. Less moving parts. This means more predictable interaction between components. No systemd. Slightly more efficient and faster. Quicker startup. And ZFS is useful for snapshots.

</comment><comment><USER13> Absolutely. It's the only OS where I can be certain that I know where everything is and how everything works. It has few deviations from the Unix architecture and the ports repository enforces adherence to the filesystem layout.

I don't buy into the "increased performance" though. Every well done benchmark I've seen is at least several yaers out of date, and my personal benchmarks usually put linux ahead on any sort of operations that include networking. Not to say FreeBSD doesn't perform well, it does.

Simplicity is key.

</comment><comment><USER14> Yes because it has lower response latency and performs about 12-15% better than Ubuntu on top of much lower CPU and RAM usage on AWS for hosting the same nodejs apps.

<comment><USER15> Quantify what you mean by "better," please. I'd assume you're still talking about latency (quantify that, too; TTFB? TTLB? Lower median? p95?) but there's an "and" in there, so I'm not sure. RPS? Throughput? Utilization? Fan0 RPM? Revenue?

I might have been kidding at the end there.

Pardon the questions -- I'm suspicious (seems high) but willing to be surprised.

</comment></comment><comment><USER16> Using for 16 years because I want little hassle from my machines. FreeBSD tends not to blow up everything for new features, yes major technologies have been introduced but rearly at the detriment to others.

</comment><comment><USER17> I use it. I use a pretty standard stack - nginx, postgres, php and a few other things so I don't have the issues some of the other posters have mentioned here about needing to hunt down source and patches and everything is installed via the standard package manager pkg.

One thing I really like about it besides the things others have mentioned is that by default it sends emails every day/week/month regarding security and system usage statistics, so it tells me when a security vulnerability has been found for a package I have installed and that I should upgrade it.

I've found this makes me much more likely to keep things up to date.

</comment><comment><USER18> Yes, because Jails and ZFS are cool. FreeBSD has superb documentation and a giant software repository.

</comment><comment><USER6> Yes, all the other servers where I work are FreeBSD, why would we run something else for www?

It works fine, but Linux is probably ok too. There's some things you need to tune if you're high traffic -- most of them are sysctls you can tune at run time, but there's a couple boot time values; basically if you have enough ram to do webserving at 10gbps, some of the auto tuning for network buffers are going to be oversized, you'll likely actually allocate that much during peak, and FreeBSD won't return free'd network buffers to the overall pool; so you can't just drop the per socket sysctls, you need to reboot with lower network buffer caps (and per socket buffers, probably too). Depends on what kind of traffic you're serving though, and I'm guessing a lot of people won't hit 10Gbps out anyway. There's some other minor tweaking of that nature required too; and I would suggest running 10.3-RELEASE, if possible, there's some useful bug fixes in there.

</comment><comment><USER8> Yes. Because it just works.

</comment><comment><USER19> No[t yet].

Migrating to FreeBSD for both dev and server work is on my personal roadmap for around June / July this year, once 11.0 is released and my laptop chipset is supported.

<comment><USER8> _laptop chipset_

You're talking about Intel video driver issues, I assume? If you can, I'd suggest trying 11.0-ALPHA1 ([https://lists.freebsd.org/pipermail/freebsd- snapshots/2016-M...](https://lists.freebsd.org/pipermail/freebsd- snapshots/2016-May/000208.html)) in case there are bugs you can report. It's always difficult with new hardware to get enough people testing before the release to get everything fixed.

<comment><USER19> Yup. I hadn't realised there was an alpha out; last I checked 11.0 was still on nightlies. I'll definitely give the alpha a look, and try it out if all seems good. Thanks for the heads-up :)

<comment><USER8> The release cycle just started. It's basically a weekly snapshot with a different name, but we've moved into "code slush" (prelude to "code freeze") so from now on there should theoretically be more bug fixes and fewer new features.

<comment><USER19> I gave it a whirl - both in FreeBSD and PC-BSD forum - but couldn't get anything other than VESA drivers running.

</comment></comment></comment></comment></comment><comment><USER20> Yes, because pf is how a firewall should work.

</comment><comment><USER21> Yes, because I rather enjoy using FreeBSD.

</comment><comment><USER22> Yes, because I wanted to reduce response latencies, and wanted something efficient to serve more people with minimal hardware. (I might go unikernel later, once I build a custom HTTP server.)

Linux also seemed to have changed quite a bit since the last time I used it in the 90's/early 2000s. With systemd, it doesn't seem like Unix anymore.

I also looked up recent Linux distributions to use, and was largely overwhelmed at the choices. I looked up FreeBSD, and it was just one distribution.

</comment><comment><USER23> I use FreeBSD for hosting personal web sites. I've used it on and off since version 126.96.36.199. I like BSD in general and have hosted small web sites using NetBSD and OpenBSD. I came back to FreeBSD, mostly because of the broader ports support and binary updates. The packages do most of the work for setting things up. With NetBSD and OpenBSD, there is more integration work to do at setup time. I'll add the caveat that this is for small all-in-one web sites.

</comment><comment><USER24> What reliable and reasonably inexpensive hosting services allow you to use FreeBSD?

<comment><USER25> I've been using Vultr ([https://vultr.com](https://vultr.com)) for a couple of years. Good, reliable service and responsive, helpful support. Very documentation too. Cost is lower than most competitors, especially for FBSD instances, though I haven't checked around for a while.

</comment></comment><comment><USER26> No, because the JVM is more supported, tested, used, and developed for linux.

<comment><USER4> This is no longer really valid with OpenJDK 8. I run a production Hadoop and HBase cluster on FreeBSD at work. I run Scala applications on my personal FreeBSD servers.

<comment><USER27> What about performance, have you benchmarked this? Java 7 was in my experience 50% slower on FreeBSD.

<comment><USER4> Something sounds suspicious there, I would use DTrace to see what is going on with locking. I have no performance complaints, including the HBase cluster that is very demanding.

</comment></comment></comment></comment><comment><USER28> Yes, because of it's superior networking stack

<comment><USER29> I see this a lot. Do you know of any good benchmarks comparing FreeBSD to Linux with similar hardware and whatnot?

<comment><USER30> As a user of FreeBSD and Linux, int's not the benchmarks of FreeBSD that draws me to it - it's the reliability. My FreeBSD firewalls just work, while my Linux ones need a reboot now and then.

</comment></comment></comment><comment><USER31> Yes, because it performs well.

</comment><comment><USER32> Yes .... and I have for years, both locally hosted on services like Digital ocean.

Contrary to what others here have written, FBSD is no more 'fiddly' than any other server class OS. It is faster, smaller, and better conceived than linux - which is a achieving Microsoft-levels of accretion and cruft.

Moreover, FBSD is not constrained by the execrable GPL and its variants, uses a far more modern compiler chain, has better release control, etc.

I do use Linux as well - both professionally and for my desktops. Linux is a worthy replacement for the desktop, but Berserkely is an overall more solid server platform.

</comment><comment><USER33> Did for years, prior to that I started on BSDi. Flirted with Linux a few times, but ran into dependency hell. Came back a few years later, the package manager finally worked, so I moved most things to Centos.

</comment><comment><USER34> Yes, because upgrades can be done without fear and because of ports in general. To say nothing of better TTFB I've observed in my personal experience.

</comment><comment><USER35> I am away from FreeBSD because today is OpenSource is mostly Linux-only development, no interest from software author to get application on FreeBSD, no support. Nothing ;-( If demand technology appear in FreeBSD it occurs many years after Linux. All companies invest money and develop pwoer only in Linux.

</comment><comment><USER36> I use FreeBSD as my VPS OS. I use nginx as my web server. FreeBSD because I am used to it (used BSDi a long time ago, and stuck to BSD ever since), and is an excellent OS. Nginx because it is rock solid.

</comment><comment><USER37> I'm doing a coreos + containers thing at the moment.

</comment><comment><USER38> No, because it is not popular and i want to be popular and use linux.

</comment><comment><USER39> Yes and I've upvoted all the posts with opinions I agree with as well.</comment>


Creative Market (YC W10) Nabs $1.3M To Become An Etsy For Digital Design - <AUTHOR> http://techcrunch.com/2012/06/07/creative-market-second-round/

<comment><USER2> I love Colourlovers and use it often because it fills a gap designers need and no one else has provided, but the quality of the content on CM insofar seems comparable to free offerings on deviantArt, Dribbble, Premium Pixels, Forrst, et al. Will there ever be a barrier-to-entry/quality-control aspect to this or is it truly free-for-all-even-the-crap like Etsy?

I also wonder if the better-looking assets are going to create a Twitter Bootstrap effect, where we see so many sites using the same UI packages, icons, etc. that it becomes sort of a joke and pushes people away from using the site to avoid the potential to look like other sites. Do you plan on implementing a TemplateMonster-like approach where you can pay a premium for exclusive rights to a design to ensure there won't be clones?

<comment><USER3> We don't plan to have a barrier to entry, because we want to build a platform that is accessible to everyone. The pressure is then on us to do a great job surfacing the best content for you, for whatever your need is.

And there will always be people looking for design shortcuts. Much of the web is not breakthrough design of new experiences, it's new faces on existing ideas. I hope we provide a short-cut for designers to get the template easily so they can spend their creative energies making it really unique.

</comment></comment><comment><USER4> What's wrong with Themeforest/the Envato network? They say they've already got 500k users - that's a long ways to play catchup.

<comment><USER3> Envato is great and does a lot of things well. We see a lot of opportunities in providing a service that is more affordable, more fair to the sellers & simpler to understand licensing. We're also building in easy integrations to allow our marketplace content to reach creatives where they work.

And we already have 75k people on our early access list... so that long ways isn't all that long. ;)

</comment></comment><comment><USER5> Congrats on the funding! Looking forward to see the collection of design elements you've got to offer.</comment>


Lessons learned about marketing while building a startup - <AUTHOR> https://miguelgfierro.com/blog/2016/lessons-learned-about-marketing-while-building-a-startup/ <comment><USER2> I'm upvoting for the Latex look alone.

<comment><AUTHOR> Hehehe yes I'm a little geek ;-) the code is on github if you want it</comment></comment>


CS5 Countdown is on - <AUTHOR> http://blogs.adobe.com/conversations/2010/04/cs5_countdown_is_on.html

<comment><USER2> Of course you would, there is nothing wrong the feature in itself and even if the applications compiled with it get rejected it will still cause a headache and put apple under pressure to change their decision.

<comment><USER3> At this point, there are plenty of Objective C developers. Apple doesn't need to change its minds. A few years ago perhaps. There will continue to be a steady stream of great apps.

What could happen is that a developer might get permanently banned for using the Adobe tools, thus locking themselves out of the iPhone market.

<comment><USER4> Yeah, that's exactly the scenario that has me really thinking that it is not good to be the test subject. Maybe they start banning people instead of Apps.

Imagine your company gets banned. Not good.

<comment><USER2> Sounds a bit like adwords, keep well in line otherwise we reserve the right to destroy your business.

<comment><USER5> Sir, are you or have you ever been a member of the Adobeist Party?

Just answer the question.

</comment></comment></comment></comment></comment><comment><AUTHOR> \</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>--

 _"So, what's all the fuss about the Apple proposed revised SDK license?

Yesterday Apple released some proposed changes to their SDK license restricting the technologies that developers can use, including Adobe software and others such as Unity and Titanium.

First of all, the ability to package an application for the iPhone or iPad is one feature in one product in Creative Suite. CS5 consists of 15 industry- leading applications, which contain hundreds of new capabilities and a ton of innovation. We intend to still deliver this capability in CS5 and it is up to Apple whether they choose to allow or disallow applications as their rules shift over time.

Secondly, multiscreen is growing beyond Apple's devices. This year we will see a wide range of excellent smartphones, tablets, smartbooks, televisions and more coming to market and we are continuing to work with partners across this whole range to enable your content and applications to be viewed, interacted with and purchased."_

\</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>--

</comment><comment><USER6> Apologies if this is off topic, but I found this particular quote worrying, with regards to whether the Content Aware Filter would be included:

 _...you can find out on Monday whether these have made the cut for Photoshop CS5._

As the most popular new addition and selling point of CS5, I feel a bit mislead that there's a possibility it won't even make the cut. It's essentially the only thing I would upgrade for.

</comment><comment><AUTHOR> Here is a walk-through video of how it works:

<http://www.gotoandlearn.com/play?id=116>

</comment><comment><USER7> My takeaway on all that is Adobe CS:

All of this can be yours for the low, low price of $700. No partial refunds for defective or useless software.

<comment><USER8> It seems like you're saying CS is overpriced, but it's not clear how that's relevant.

<comment><USER7> I guess you would think that if you only read the title of the HN article and the part pertaining to the iPhone capabilities. I was commenting on the hype surrounding CS that Adobe is perpetuating in that blog entry.

<comment><USER8> Still, your post was essentially "CS is overpriced", but more verbose. If you have some analysis of their pricing (and why it might be wrong), share it, but to just state your personal opinion like that is kind of pointless.

<comment><USER7> When is a valid opinion considered distasteful? They hardly mention ANY of the features that are new in CS5 and yet they are putting out a new product and hyping it up considerably (e.g. "In 3 short days, we will be launching what is arguably the most compelling release of Creative Suite to date. I don't want to spoil any surprises, but I feel this release is going to thrill designers and developers."). Maybe it will be great, but I've had buggy/dodgy experiences with all of the CS products through the years (non-hardware related), and pretty much all of them stay broken until they put out a major release.

For example, Dreamweaver has 0 FTP threading capability. Also in Dreamweaver, you cannot drag-and-drop files to upload to the remote site. Dreamweaver also has some trouble when you drag-and-drop files to the local site with putting it in the right folder. There are just a ton of things I "put up with" when I have no viable option but to use them.

<comment><USER8> Not distasteful, but lacking information. People around here are very sensitive about the signal to noise ratio. (FWIW, I didn't downvote you.)

This latest post has a little more effort put into it, and I think it probably would have fared better.</comment></comment></comment></comment></comment></comment>


Show HN: Rush Hour - <AUTHOR> https://github.com/fogleman/rush <comment><AUTHOR> Recently bought this puzzle game for my kids. Naturally, I had to write my own solver. My son loves that I wrote a program that can generate new puzzles. I even 3D printed some "traffic cones" that can be placed on the board as immovable obstacles.

This was a fun little side project - hope you like it!</comment>


Pushing a commit, eh? Opinions about working with others with git - <AUTHOR> http://flowa.fi/blog/2015/03/29/pushing-a-commit-eh.html

<comment><USER2> I feel like source control is a fundamental tool in software development. There have been far too many instances in my work when I just feel I've tangled my code up too much and need a fresh start. working from the past is simple with Git and has saved me from my own mistakes too many times to count.

<comment><AUTHOR> This. And well, usually you work with other people. I've been in a few projects, also "enterprise"-level ones and I'm really amazed how fucked up the way people treat source code management can be. I'm all for quite light practices to be used, but man, the worst are the places where there just ain't none.</comment></comment>


Ask HN: A cross registrar DNS management API? - <AUTHOR> Changing DNS records is incredible pain as every registrar/host has different way of accessing and changing configuration.<p>Is there an API that allows you to update DNS records for at least the most popular registrars under one roof? <comment><USER2> [https://www.terraform.io/](https://www.terraform.io/) supports various providers for DNS.</comment>


As couples age, humor replaces bickering - <AUTHOR> https://news.berkeley.edu/2018/12/03/marriagemellows/ <comment><USER2> Surely sampling bias would be really hard to remove from this.

How did they control for couples that remove themselves from the sample set because they broke up due to bickering (or a correlation with bickering)?

<comment><USER3> Seriously, this is literally survivorship bias!

<comment><USER4> Only if non-survivors (broken up relationships) matter.

If the idea is "what happens while still in the context of a couple" then it doesn't. In fact that's already implicit in that the couple must "age".

<comment><USER3> That's a good point. They did stay away from "the key to happy marriages is more humor" trope, so it really is just observational.

</comment></comment></comment></comment><comment><USER5> I wonder how much of this is related to where these couples are in life, financially, career-wise, etc

<comment><USER6> I have a feeling, based on absolutely nothing, that it isn't until later in life that we realize that this is it. As in, you can basically consider what you are doing now to be your life. There really isn't some big shift ahead where finally, all of a sudden you manage to bicker your spouse into who you wish they were. It's just... this.

Life is sort of a joke, but it takes a bloody long time to get.

<comment><USER7> Life is really a sort of a joke. But it's one thing to know something and quite a different thing to admit and accept it.

As I grow older, I still try to resist those thoughts - I still like to think that there is that big shift ahead, that something life-changing will happen. That this is not all there is.

And I rationalize this to myself by saying - "otherwise what would be the point?"

Anyway, thank you for putting it the way you did. It was another bump for me to accept the inevitable.

Maybe, the big shift would happen once I've accepted! And then it wouldn't matter!

Edit: Yes, I haven't got the joke yet!

</comment></comment></comment><comment><USER8> I wish it would hurry up, I don't have too much longer left before death is going to do the replacing.</comment>


Two-Factor Theory Can Teach Companies to Hire and Retain the Best Engineers - <AUTHOR> https://www.7pace.com/blog/two-factor-theory-hiring-engineers <comment><USER2> A private, quiet office. Two or more monitors. Free snacks and free lunches. One conference a year.

</comment><comment><USER3> Great post!</comment>


VP9 Codec Nears Completion - <AUTHOR> http://blog.webmproject.org/2013/05/vp9-codec-nears-completion.html <comment><USER2> Slightly related to the discussion here: yesterday I found out that the Rasberry Pi is about 10% cheaper because it doesn't include licences for proprietary codecs [1]. As consumer electronics are getting cheaper and open/free licenses are becoming more popular, hopefully we'll see more of this happening.

[1] <http://www.raspberrypi.com/license-keys/>

<comment><USER3> It sucks though, because to watch H.264 on it you have to buy a license key for it to unlock the hardware on the device.

<comment><USER4> No, you don't. H264 can be decoded on the hardware out of the box. The licenses are only for MPEG-2 and VC1.

<comment><USER3> Ah, my bad.

</comment></comment></comment></comment><comment><USER5> In case anyone was wondering, like I was how VP9 quality stacks up, here's a comparison: <http://www.youtube.com/watch?v=Ctjm1kxw-BM> (although it's a bit weird since everything is re-encoded for youtube, so take with a grain of salt).

To my eyes, VP9 looks roughly on par with h264, but not as good as h265.

<comment><USER6> That would be a pretty big grain, Comparisons like that are basically useless. Your YouTube is likely to be using H.264. H.265 and H.264 will be sharing much of their encoding technologies, so they gain fewer encoding artefacts and loose less quality by taking a H.264 and re-encoding it as a H.265 than you would by taking a VP9 and re-encoding is as a H.264.

The only real way is for someone to shoot raw video, and compress them both separately.

<comment><USER7> See the description for a link to the source and lossless downloads.

</comment></comment></comment><comment><USER8> Will WebP switch from VP8 to VP9?

<comment><USER9> Found this:

"yes, vp9 would be helpful with its larger transform sizes. Plus the improved coefficient coding scheme, assymmetric transforms, new intra prediction modes, etc. There's also some investigation going on around genuine yuv444 support, or even lossless. However, keep in mind that most improvements of vp9 compared to vp8 are related to video coding (inter-frame prediction). And there's the cost inherent to introducing another bitstream format, which is a long-haul effort. Takeway: need some experiments and data point about extra-gain vs extra-complexity (including project complexity)"

[https://groups.google.com/a/webmproject.org/d/msg/webp- discu...](https://groups.google.com/a/webmproject.org/d/msg/webp- discuss/yYYb1hI9FM0/saUBY8vBpCgJ)

</comment></comment><comment><USER10> I am still a bit confused what the point of VP9 is.

Microsoft and Apple pay for the licenses on behalf of developers and users so licensing cost only affects a very tiny minority. And with the likes of Sony (PS), Microsoft (Windows/XBox) and Apple (iOS/OSX/Final Cut) firmly in the H.265 camp why would you produce content for VP9 if no one can play it.

<comment><USER11> Because "Microsoft and Apple pay for the licenses on behalf of developers and users so licensing cost only affects a very tiny minority" is not really true. See [http://www.microsoft.com/windows/windowsmedia/licensing/mpeg...](http://www.microsoft.com/windows/windowsmedia/licensing/mpeg4faq.aspx#MPEG4VideoFAQ_1_2)

If you encode a video into mpeg4 format, even using a commercial tool whose makers pays mpeg4 license, that license doesn't extend to the resulting video.

If you post such video on your website, you're violating mpeg4 patents and have to pay mpeg4 licensing fee (up to $5 million/year).

That basically puts mpeg4 out of reach for 99.9% content creators that cannot afford even talking to mpeg4 consortium about the license.

Not to mention that most people don't use commercial tools. We use ffmpeg/x264, which is not only free but has better quality than expensive commercial tools. Even using those tools without paying a license is not permitted (although, obviously, most people simply don't understand that or willfully ignore banking that mpeg4 la won't sue them).

Microsoft and Apple pays so that users of their software can CONSUME mpeg4 format.

All CREATORS are left out in cold and have to license the patents.

Given that video becomes more and more ubiquitous, it's not an acceptable situation for the web just as it wasn't acceptable to have to pay for using .gif format to post a picture on your website (<http://www.gnu.org/philosophy/gif.html>)

<comment><USER10> I don't believe any of this is correct.

If I use my Canon 5D/iPhone to film a movie then edit with Final Cut Pro and upload my video to YouTube at what point am I required to pay the MPEG-LA for a license ? Are you really suggesting that tens of millions of people are in breach of MPEG-LA licensing requirements ?

<comment><USER12> When Apple shipped an encoder they paid a license fee, and YouTube has to pay a license fee as well. So you're fine.

But yes, quite possibly millions of people have been violating the H264 patent terms without knowing it.

<comment><USER13> So let me get this straight -- Patents not only cover the right to produce instances of an invention, but also for usage of those instances/devices also? So what happens if for example Ford is found to be violating someones patent on an engine part. Then even if Ford pays up a license, could the patent owner sue me for driving the car, and charge me a per mile royalty?

Part of me would love to see this happen, simply so that enough "regular people" will force their politicians to change the laws.

<comment><USER14> Yes. That's how patents work. Patents violations cover both creators of the infringing device and users.

<comment><USER15> This is, after all, why many U.S.-based distros refused to package and ship patent-encumbered code by default, is because end-users would also be theoretically liable.</comment></comment></comment></comment></comment></comment></comment>


MonkMed-What the world needs now - <AUTHOR> My story is about an innovative young company called MonkMed who are a small business with a 'whole lotta love'. MonkMed are changing lives for the for the better 'right now' not 'some time in the future' by helping sick patients to access affordable medicines.I first encountered Tim from on Twitter while researching the new anti-viral medicines (DDAs) and engaged him in a long 2 hour chat. I'd read that licensed generic meds were being manufactured in India for around $1000 a treatment not per pill. Tim told me MonkMed wanted to help the millions without access to the medicines and wanted to do it properly with prescriptions, Dr support, legally (it's legal to import 3 months worth of life-saving medicines into many countries for personal use) and good communication. They were on a mission. I decided to trust them. It was the right decision. This is a long story and a learning curve for all involved, but it has a happy ending. MonkMed joined forces with another innovative maverick, a Dr from Australia called James Freeman of 'Fix HepC' who was working along the same lines, this brave and brilliant pair have now helped thousands of patients world-wide access Indian generic forms of the life-saving medicines via the official Redemption Trials. Many are now cured and many more on treatment and getting cured. Parents, grand-parents, most baby-boomers I would guess average age 55 who have contributed to society and have been devastated to discover they have this virus usually many years after infection (it develops slowly). Now these people have hope and a gift of life, is a gift of love. I have talked to Tim from MonkMed nearly every day of my life since December15, the caring attitude of him, his staff and the Drs who they work with is something special. Their efficiency and communication is faultless and their compassion is real. <comment><AUTHOR> " What the world needs now ..is love, sweet love" ...

Some people reading may remember that classic song by Bacharach/David but for many people of a certain age this means much more as many are sick and dying from the Hepatitis C virus. A heavy opener I know but this is fact and baby- boomers are most at risk from this virus,

The crazy thing is that there are new treatments that can cure almost everyone of this condition that untreated can lead to a nasty death by liver failure and cancer but many people around the world cannot access these medicines due to the extortionate cost, around $1,000 per pill in the USA. Insurance cos and health authorities are being forced to restrict treatment only to the very sickest with severe disease while the rest wait in limbo as their health deteriorates to danger level. Apart from the moral issue this is not remotely cost-effective, causing transplants and end stage liver disease. How can it be in such wealthy countries like the 'USA/UK? Aren't we supposed to be civilized? The anxiety of waiting to see if you can get treated, requests and refusals to insurance cos and health commissioners, always waiting ...for the new medicines to be approved, the next medical appointment that it may offer hope, reading & researching, meeting others some who are very sick while the rest of us head that way and some we lose way too young.

</comment><comment><USER2> Monkmed is a source of live.

in my country access to medical consultations is not available to everyone. when we had lost all hope, help came from a modest website with great promise. Communication was smooth, the interest was sincere, diligent efforts and finally succeeded in his mission. place effective medical treatment for my deadly disease on my door. they took care of all medical, legal and customs details, so I just worry me to recover. Today, me and four other people, thank monkmed to improve our lives by helping us eradicate this disease and we want this number grows up in our country and the world. Thanks

</comment><comment><USER3> A "whole lotta of love" is an understatement! The world needs more people like Tim and his Monkmed team. When my own country failed in giving me the treatment to cure my HepC the efforts of Dr. Freeman, Tim and Monkmed did not.Tim held my hand throughout the process which was just what I needed. I am forever indebted to Tim and Monkmed for giving me the gift of a cure to live a normal life.

</comment><comment><USER4> Susieq said "their efficacy and communication is faultless and their compassion is real." I can vouch for that! Their mission is to get affordable generic medicines that cure hepatitis C to those who need them. I was one of those people. They are so committed to what they do. In a world driven by greed and exploitation, Monkmed are one of the good guys.</comment>


How a Warren Buffett empire preys on the poor - <AUTHOR> http://www.seattletimes.com/business/real-estate/the-mobile-home-trap-how-a-warren-buffett-empire-preys-on-the-poor/

<comment><USER2> "Billionaire philanthropist Warren Buffett controls a mobile-home empire that promises low-income borrowers affordable houses. But all too often, it traps those owners in high-interest loans and rapidly depreciating homes."

How is this a trap? It allows low-income borrowers, who are high risk and have little income, access to something they wouldn't normally have: a home. Yes, it may depreciate, but it's not meant to be an investment..it's meant to provide a roof over someone's head.

I thought we were supposed to be getting rid of overly negative comments on HN. This article is written from a biased and overly negative perspective.

<comment><USER3> You're misrepresenting the article. It gives multiple, clear, specific examples of the "trap".

Buffett's mobile-home empire engages in typical predatory practices, taking advantage of ignorant poor people. For example:

       But the closing documents he set before them
       held a surprise: The promised 7 percent interest
       rate was now 12.5 percent, with monthly payments
       of $1,100, up from $700.

Gotta hand it to Warren, he's got great PR people working for him. He cultivates an image of a folksy, down-to-earth elder statesman. He advocates feel-good social policies such as having the rich pay more taxes. He claims he runs his companies for the long term. But when push comes to shove, he has no qualms about making money from the "little people".</comment></comment>


No, Facebook did not patent secretly turning your phone mics on when it hears TV - <AUTHOR> https://www.theverge.com/2018/6/28/17514968/facebook-patent-rumor-phone-microphone-tv-ads <comment><USER2> _> There are some parts of the specification that describe triggering microphones with a silent-to-humans sound, but again, the specification does not matter. Just the claims._

nitpicking.

<comment><USER2> and how would one know in practice? Android doesn't even tell you until you if an app access the microphone (while app is in the background) until upcoming Android-P:

[https://www.theverge.com/2018/3/7/17091104/android-p- prevent...](https://www.theverge.com/2018/3/7/17091104/android-p-prevents- apps-using-mic-camera-idle-background)

The whole Data over Sound space needs a standard:

[https://static1.squarespace.com/static/5129591ae4b0fd698ebf6...](https://static1.squarespace.com/static/5129591ae4b0fd698ebf65c0/t/5941371ff7e0ab31c3720431/1497446177106/Chirp+-+DA+White+Paper+Final.pdf)

If it isn't facebook it's going to be others (SilverPush, Drawbridge, Flurry (now Yahoo), ...)</comment></comment>