Fravia's web-searching lore (2009) - <AUTHOR> http://search.lores.eu/indexo.htm <comment><USER2> With all the changes in search engines(only Google and bing left, personalization, Google disregarding a lot of your search operators and intent) - do you still find the lore usefull ?

<comment><AUTHOR> I think it's rather sad what Google has become; in an attempt to make search "more human", they have also quite successfully replicated all the _disadvantages_ of asking a not-so-intelligent human to find what you're looking for, complete with second-guessing and subtly modifying your queries as well as not showing everything that does match. I am not completely convinced there is an ulterior motive behind it, but it could certainly be one way of controlling what the population thinks or even the language: if all searches for foo are silently redirected to fob or a similar but actually different thing, then it reduces the ability to discover --- and subsequently propagate --- information about foo.

Near the turn of the century(!), I remember hearing that the Internet was one of the places you could find information on very obscure/fringe subjects, and for a while that was actually true; but now it seems that search engines are gradually cutting off that fringe in optimising for the popular and mainstream.

I also noticed Google's search results took a nosedive in quality (~2010) not long after Fravia passed away --- I doubt there's any correlation there, but that felt a little surprising to me.

<comment><USER3> Sad I know.

Selling advertisement (tied to a "free" service) is mass market. My guess is power users are a) harder to capitalize on b) more demanding. There's plenty of low hanging fruit in general public so why bother?

</comment></comment></comment><comment><USER4> One of my all time favourite websites.

</comment><comment><USER5> Oh the memories!

<comment><USER6> Indeed, I was going to say the same thing. Fravia+ was where I had read about Orc+ if I remember the name correctly, who had a series of tutorials on how to crack games. I think I downloaded his entire site back in the day, I wonder where in my terabytes of junk data I have it.

<comment><USER7> How To Crack - a tutorial by the Old Red Cracker.

One of my favourite quotes: a red flower in our mouth, a cold determination in our fingers, a computer not far away... death to Gates!

At the time I took ORC very seriously and to this day I still have the same contempt for MicroSoft as back then, even though nowadays MS has become mostly a bad joke, a pathetic shadow of its former self.

<comment><USER8> why is Microsoft so lame?

I think much of the industry a joke, and Microsoft a exception.

I have lived through a 30 year saga of battles for really basic baselines to be established, insofar as the wars over office software databases and operating systems are concerned. Yes, I am impressed by what I see now, so much has evolved fantastically, but mostly users perform the same tasks and there is no recorded gain in productivity I am aware of. Gates wanted ubiquity of computers. His actions probably did more to enable that than any other individual. Without Microsoft the sometimes seemingly embittered motivation for Linux would not have been anything like it was. I think Gates always wanted to move on to more interesting goals in computing, and am inclined to think the company open source decisions do more for enabling advancement than anything else, because they make a ubiquitous platform more consistent to write for, the perennial monopoly complaint of a aggressive Microsoft. The cash cow applications are bundled now with facility permitted only by integration at prices only low as they are enabled by dominance, and I see nothing not dominant or lame, about that. I only recently benefitted from VS Community, and am still really happy at that, and I bet BillG would dearly love to give SQLServer away if only he could earn from it like a operating system (it is enough one already) and it's a peculiar delight to think Larry E may actually lay awake at night, one day, fearful that possibility is real. I think the reason has more to do with necessity to pay big sales commission to maintain the ecosystem around Microsoft database business, which provides for the channel welfare in turn supporting the rest. Meanwhile there is no Linux competitor because the GPL is anti competition. Except and unless, like all the big convert lovers of open source, someone uses the ability of cloud VDI to never have to release their code. Then we'll have incentive to make a Linux ecosystem selling desktop seats. I'm sure that's why Microsoft is porting so much, even experimentally.

</comment></comment></comment></comment><comment><USER9> I notice that certain sections of the site are "closed" and designed for clever searchers. Unfortunately the site's integrity is somewhat poor since 2 of the 3 mirrors are down, and the site's internal search function is broken. Sad. Is there zipped archive of the site anywhere?

<comment><USER10> [http://mirror.search.lores.eu/](http://mirror.search.lores.eu/)</comment></comment>


Ask HN: What's your favorite HN thread? - <AUTHOR>

<comment><USER2> The one on recursivity: <http://news.ycombinator.com/item?id=3550767>

<comment><USER3> I see what you did there...

</comment></comment><comment><USER4> My favorite (sub)thread

<http://news.ycombinator.com/item?id=328819>

from 1211 says ago described Japan during its "lost decade" in the context of a thread about predictions of a downturn in venture capital funding for start- ups.

"Q: Anyone here lived through the Japan depression care to share their experiences with us?

"A: It was terrible. People were forced to eat raw fish for sustenance. They couldn't get full-sized electronics, so they were forced to make tiny ones. Unable to afford proper entertainment, folks would make do by taking turns to get up and sing songs."

That made me feel a lot less bleak about the recession in the United States, which may now be ending.</comment>


The password "ji32k7au4a83" has been seen over a hundred times - <AUTHOR> https://twitter.com/rqou_/status/1101331385632022528 <comment><USER2> I once used a password which our IT department gave me and it was !'a;@,oq and at least for me it looked random enough. I had it as a root password on a server and I enabled password login for about 2 minutes because I wanted to resize some virtual hard drive or something and couldn't be logged in as a normal user and then switching with su to root because then the normal user would have open files on the file system and I wouldn't be able to unmount or something.

Within those 2 minutes some chinese hacker scripts took over the server and started DDosing some chinese IP adresses. We had to shut it down and blast it and set it up from scratch again.

I later found out that this password was everything but random. It was difficult for me to see because I've been using Dvorak for a couple of years now and didn't see the pattern that it was just the first two rows of the characters on a qwerty keyboard. So actually it was !qaz@wsx (I just put the Dvorak version on top of the comment to give you the same unknown feeling for the password which I had back then.)

I've never reused any passwords since then and always create new ones with my password manager.

<comment><USER3> columns, not rows.

<comment><USER4> actually it was columns, he just put "rows" to give you the same unknown feeling

</comment></comment></comment><comment><USER5> Related story: For some weird reason, I memorized the serial key for a very popular software (I must be fifteen then). Even today, I can recite the 25-letter key without a hitch. And I have used its first ten letters as a password to one of my accounts. Guess what? The password has been used 4000+ times before [1]. It's hard to digest the fact that there are at least a thousand people in the world who did the same thing.

[1]: [https://haveibeenpwned.com/Passwords](https://haveibeenpwned.com/Passwords)

<comment><USER6> Is your password "fckgw rhqq2"?

<comment><USER5> Holy shit! Now that I have changed the password, can you please tell me how did you guess that?

<comment><USER7> Because bunch of us memorized fckgw rhqq2 yxrkt 8tg6w 2b7q8 for the very same reason back in early 2000s

<comment><USER8> it's even on wikipedia: [https://en.wikipedia.org/wiki/Volume_licensing#Leaked_keys](https://en.wikipedia.org/wiki/Volume_licensing#Leaked_keys)

<comment><USER9> If I recall correctly this image helped make it famous: [https://marco.org/2007/06/18/wow-fckgw-has-its-own- wikipedia...](https://marco.org/2007/06/18/wow-fckgw-has-its-own-wikipedia- mention-flickr)

</comment></comment></comment></comment></comment></comment><comment><USER10> This is using the zhuyin keyboard which most likely means Taiwanese users since Taiwan is probably the sole user of the zhuyin keyboard.

Typing that out on a zhuyin keyboard gets you: ㄨㄛˇㄉㄜ˙ㄇㄧˋㄇㄚˇ

In Pinyin that is wo3 de mi4ma3

Or in English "my password"

<comment><USER11> For the unfamiliar, "ㄨㄛˇㄉㄜ˙ㄇㄧˋㄇㄚˇ" is an example of "bopomofo" script, the phonetic system used to teach kids reading and pronunciation in Taiwan, and adapted to Chinese keyboard input (zhuyin). I learned it in the 1990s studying Mandarin in Taipei. It maps closely to pinyin romanization used in China (i.e., "ㄨㄛˇ" = "wo3" which is the sound in the Mandarin dialect for "我" and potentially other characters with the same pronunciation and tone. "我" means "I" or "me").

I am wondering if it was modeled after Hiragana/Katakana during Taiwan's colonial period?

<comment><USER12> It does have some resemblance to katakana. The first character at least looks very similar to メ.

<comment><USER13> It comes from China, was developed in the republican era. It's based on a shorthand modification of seal script - though Japan was very influential on the elite of China at that time so it's possible Katakana played some role.

[https://en.wikipedia.org/wiki/Seal_script](https://en.wikipedia.org/wiki/Seal_script)

</comment></comment></comment></comment><comment><USER14> I'm a scientist. Information theory always felt curious to me because it adopted terminology and concepts similar to that from statistical mechanics but in practice was always much more difficult due to what could be considered what was "random" vs. what was non-random. After sitting back and thinking about it, what is considered "random" of course is a statement of the probability distribution for the set under consideration. For info theory, that set is some set of strings (say passwords) which is really culturally and historically contigent, while in physics land, the set is microstates that determine macrostates, for which the degeneracy of a macrostate depends on the hamiltonian, full stop. I think mathematically, of course the statements you make are similar (hence why you apply the same prob theory to both) but the systems I study are comparatively easier, while really, the underlying probability distribution for strings is really hard to know in practice because it essentially depends on human history and culture up to that point. For example, in a universe without English, English words (say one-to-oned to a discrete set, so strings of positive integers less than 26 + 10 (including decimal numbers)) would be random. In fact, a universe without that particular Chinese IME, if it was done somewhat differently, then ji32k7au4a83 could be random.

It's just interesting to me, another reminder that physics is just that much more easier than anything else.

<comment><USER15> Hold up. In my physics classes, no one ever gave me a straight answer on what constituted a "macrostate". It always sounded arbitrary for similar reasons to the ones you describe for language. Are you telling me it's literally defined by the energy of the system (the Hamiltonian, right?) alone?

<comment><USER16> The degeneracy of a macrostate is just a matter of the Hamiltonian but what counts as a macrostate is, in a sense, arbitrary.

It's really just a state you, the observer, can distinguish. This would typically involve things like pressure, volume, and temperature but if you developed a new way of measuring the properties of a system suddenly the possible macrostates multiply in number, each contains fewer microstates, and the entropy of the state decreases. Take this far enough and you could create a Maxwell's Demon to extract energy from thermal motion. But while it's subjective in some sense it was later shown that our subjective knowledge of the world is limited by the laws of physics in other ways and perfect subjective knowledge is impossible.

So you could say that entropy is a measure of your ignorance about the exact state of the world, which corresponds nicely to the information theory definition. It's just that in physics everyone is in practice going to be using the same pressure, temperature, and volume measurements while in information theory what constitutes a macrostate is very fuzzy.

</comment></comment></comment><comment><USER17> From the linked Twitter thread: It's the Chinese equivalent of "password": 我的密码

<comment><USER18> Password would be 密码. 我的密码 is "my password".

In China they just use pinyin, so I was baffled as to how ji32k7au4a83 could represent 我的密码. Turns out it's the keys you press if you have Taiwanese input.

</comment></comment><comment><USER19> After a brief Googling, a lot of Taiwanese websites are encouraging users to come up with password by typing Zhuyin in English, and specifically giving "ji32k7au4a83" (my password) as an example. So this may explains why a lot of people actually followed the advice to the word.

<comment><USER20> Interesting, so it's a Taiwanese correct horse battery staple, basically.

It's a bit sad to see how people in a position to formulate password suggestions on a register form can fail so hard at realizing that a uniform transformation of a dictionary word will still be prone to dictionary attacks.

</comment></comment><comment><USER21> Searching a little (it's easy because it's unique) and then automatically translating 2014 article titled:

"How to set up a safe and easy to remember password"

reveals:

[http://www.netqna.com/2014/05/do-not-set-up-weak- password.ht...](http://www.netqna.com/2014/05/do-not-set-up-weak- password.html)

"4\. _Using Chinese input method_ :

For example, the phonetic input method of the four" (I guess in Chinese, op. acqq) "words "My Password" is the combination of "ji32k7au4a83"."

Sure, safe. Just for you and everybody who read that. No problem at all.

And some user of some gaming(?) site used it for his username:

[https://web.poe.garena.tw/account/view- profile/ji32k7au4a83](https://web.poe.garena.tw/account/view- profile/ji32k7au4a83)

<comment><USER22> Here's the entire translated version

Using the above principles, how can we design a good password?

Tip 1: Replace characters with ones that sound the same

For example, you can replace the letter e in succeed with the number 1 {note this sounds the same in Mandarin}, so that it becomes succ11d, which is easy to remember and combines numbers and letters.

Tip 2: Replace characters with ones that look the same

For example, you can replace the o in dog with 0 and it becomes d0g. It mixes letters and numbers.

Tip 3: fill with special symbols

For example, the above password d0g is not long enough, so you can add special symbols at the end, e.g. d0g!(!(!(!(!(!(, it will be easy to remember, but hackers will need 12,340 centuries to crack it.

Tip 4: Using Chinese input method

For example, the phonetic input method of the four words "My Password" is the combination of "ji32k7au4a83". At first glance, it is a random combination, but it is meaningful.

Pretty hilarious all around, anyone checked if d0g!(!(!(!(!(!( is in the database too?

<comment><USER23> The hilarious part is these are used as examples to illustrate an algorithm, not to suggest you use them as actual secrets.

<comment><USER20> No, the algorithms are bad as well. Transformed dictionary is hardly any better than dictionary if the transformation isn't unique.

All those annoying rules about required character classes are mainly there to prevent dictionary attacks, but "s3cr3t" is not much of an improvement over "secret" ("s4cr5t" would, because it's not the result of a popular transformation).

<comment><USER23> Not much of an improvement, but never worse -- unless the function is not injective. You can't argue with Kolmogorov complexity. If the algorithm is secret and has computational complexity it gets better.

<comment><USER20> Sure, but we are talking about trivial substitution schemes here. I could have been more specific.

</comment></comment></comment></comment></comment></comment><comment><USER24> That follow-up tweet freaks me out. What does that have to do with anything, really. I think it's rather unprofessional and would prefer people not make self-congratulatory statements about their personal beliefs.

<comment><USER25> How condescending and moral relativistic of you to say that there is a wrong time and place to assert what is and is not a human right, that there is no unselfish reason to do so, and that human rights are merely a matter of individual preference.

<comment><USER26> How are trans people excluded from human rights, again? I seem to have missed that part in my source [0], because that should certainly be covered most formidably by article 3, "Everyone has the right to life, liberty and security of person".

[0] [http://www.un.org/en/universal-declaration-human- rights/inde...](http://www.un.org/en/universal-declaration-human- rights/index.html)

<comment><USER25> Rights that aren't asserted are not likely to be respected. Yes, of course these rights apply to everyone, but the laws and policies being enacted aren't taking those rights away from everyone, they're taking them away from trans people. If there were laws passed to do things like prevent cisgender men and women from using anything other than unisex bathrooms, it wouldn't make much sense to rally support for trans rights, would it? But that's not what's happening, what's happening is an infringement against trans people, specifically. Would it make much sense for firefighters to ignore individual fires and only put fires out when everything was on fire?

<comment><USER26> > Rights that aren't asserted are not likely to be respected.

I don't see that happening at all. I find this whole activism trope a dangerous game, they indoctrinate each other with a mindest to disregard empirical data and disrespecting authorities put in place by governments.

> do things like prevent cisgender men and women from using anything other > than unisex bathrooms

I'm pretty convinced that where I live you can use whichever bathroom you like, while dressing like the unicorn you are. I'll still be using a urinal, though, because I don't want to make a mess for people, cis or not cis, that need to use the bathroom for more serious business.

> infringement against trans people, specifically

I condemn violence, especially against one-legged single-parent dwarves. They deserve better and you damn well know it.

<comment><USER27> you are a bigot in denial. have fun being hateful!

</comment></comment></comment></comment></comment></comment><comment><USER28> Let this thread be a reminder for everyone to use a password manager.

<comment><USER29> I'm willing to bet that a major upcoming security disaster is a compromised password manager that leaks out tens of millions of accounts and passwords in nicely structured XML that's perfect for automated attacks and frauds.

Yes, I use a password manager too, but an ancient one that has no Internet connection, no syncing, and no cloud storage.

The only "modern" password manager I've been able to find that works completely offline and is open source is KeePass -- _so long as you don 't install any of its plugins that open it up to Internet access_.

<comment><USER30> What I do is use a password manager, but when it enters a password into an app or site, I type a few more characters after the end of it before logging in.

Kind of a secondary master password that's not stored anywhere except my memory and my safe.

Best of both worlds in my opinion.

<comment><USER31> This is awesome! (I think). I've never used a password manager, because I was afraid one breach there is worse than many breaches everywhere else. But, I am curious, if I use a complex formula in my mind to create passwords that are unique to every website I visit, and I store those in Chrome am I not safe? The only problem I see is that I do not update passwords regularly.

<comment><USER20> If that database in the browser ends up somewhere it should not, a curious attacker will have a nice list of examples to figure out the formula. I share your vulnerability and "password manager + brain-stored component" has been my unexecuted upgrade plan for many years.

</comment></comment></comment></comment></comment><comment><USER32> I just keep the RandomKeyGen [0] site on the top of my bookmarks, and whenever I need to set a password for a newly spun up server, or SQL DBA admin password etc., I just pick a random one from there.

Advantage over a password manager? - sometimes I have to document what the password is in offline technical notes or a password vault for the customer, and doing it this way lets me kill two birds with one stone.

[0] - [https://randomkeygen.com/](https://randomkeygen.com/)

<comment><USER33> Is there a similar site that makes memorable passwords but long? (basically I get entropy and can remember if needed). I use keepasaxc which doesn't have this.

<comment><USER34> Try [https://www.rempe.us/diceware/](https://www.rempe.us/diceware/)

Disclaimer: I don't know much about this site and don't have any trust relationship with it. Have a read of the FAQ on the page and verify for yourself.

</comment></comment></comment><comment><USER35> Speaking of good passwords, I wrote a passphrase generator once that I still use to this day. You can have a copy of it if you'd like. The README explains all there is to know about it but feel free to ask any questions anyone might have.

[https://github.com/ctsrc/Pgen](https://github.com/ctsrc/Pgen)

<comment><USER36> One of the password generation tools -- so long ago I forget which one, but probably 1Password -- generated a password for me, and I loved the scheme it used. I still use a variety of it but now I make them up myself. The rules:

1\. Make up a short nonsense word (so it's pronounceable).

2\. Pick 3 numbers.

3\. Make up another short nonsense word.

4\. Concat them with hyphens, capitalising the first letter.

So let's go with...

        Terp-745-mula
        Mang-288-pung

The benefits:

1\. Heaps 'o entropy. Need more? Just make longer words.

2\. Crucially: _really_ easy to type on an iOS keyboard. You often start with caps on by default, and the dash-number-dash sequence in the middle only requires one use of the symbol shift key.

3\. And, of course, fairly memorable.

I still use 1Password and the vast majority of my passwords are 16 characters of truly random nonsense, but for those times that you want a memorable password that you'll actually type quite a bit, this is gold.

\---

And now I await the inevitable teardown of this method ... what did I miss? :-)

<comment><USER28> An attacker that knows your algorithm can restrict the search space to only sequences that follow the algorithm.

<comment><USER37> That's why when I describe my password generation scheme - which is _kind of_ similar - I never pinpoint it. Oh, and I don't necessarily stick to it as long as the result is a good password ;-)

But yes, entropy is lost if you decide it has to be pronounceable. On the other hand pronounceable is in the eye of the beholder and a it allows me to memorize long sequences of nonsense (up to the point where it gets annoying to type for someone who consequently lock his computer every time.)

For everyone who are just starting to think of this here are some more tips:

\- Do store passwords in a password manager! The only reason to memorize passwords is because you need the password for your password manager and your OS and certain other things available even if you aren't logged in to your password manager.

\- Use real two factor auth whenever possible. Please be aware though that just adding "sms something" doesn't necessarily make things more secure. A common (AFAIK, and sadly) mistake seems to be to use SMS for both password reset and for the second factor. In this case whoever gets access to you phone for just a moment can reset your password and immediately get a "2-factor" login code as well. (Scare quotes because this isn't 2-factor since one only needs access to one thing, the phone, to get access in this case.)

\- Some people will say that using SMS at all is hopeless, but from what I can see they can still make sense in a number of cases: not everyone has targetet attacks from three letter agencies (domestic or foreign) as part of their threat model. More people have - or should have - a point about losing access to login information as part of their threat model I guess.

</comment></comment></comment></comment><comment><USER38> in Taiwanese, sometimes we "encode" message by pretending typing bopomofo [https://en.wikipedia.org/wiki/Bopomofo](https://en.wikipedia.org/wiki/Bopomofo) while input method is english just like here "My password" => "我的密碼" => "ji32k71u4a83"

</comment><comment><USER39> I can imagine the cold sweat of reading this title when that is actually your password

<comment><USER40> I'm curious to know if this is right. If you use the zhuyin keyboard method, wouldn't you just remember your password in Taiwanese, and not even recognise the version in Roman characters?

</comment></comment><comment><USER41> Am I the only person that thinks it's weird that we encourage using unique passwords everywhere, but the second piece of information needed to login (username, email etc) we tend to keep the same for everything?

I posted a Show HN last night for a side project I've built that can solve the email part of this: [https://news.ycombinator.com/item?id=19296936](https://news.ycombinator.com/item?id=19296936)

<comment><USER42> I did a cheap version of this where I didn't have to build anything but I could test out the concept because I thought it would be awesome and I thought I wanted it.

Long story short it became problematic pretty quickly and I ditched it. You need to also be able to reply as that email address too etc. It's been done a bunch a times I understand.

<comment><USER43> For my custom domain I set up a catch-all so *@sharparam.com gets routed to my main address. If I end up needing to reply from such an address I set up a proper alias for it (currently I use GSuite to manage it).

<comment><USER41> Another alternative if you don't have your own domain is to put a plus in the email address. The mail server will ignore anything after that plus, eg firstname.lastname@example.com will have all email sent to email@example.com, but it will preserve the To header in the email.

This is useful for detecting the origin of spam, however it's trivial for a spammer or hacker to workaround (just strip the plus and anything after it before sending)

</comment></comment></comment></comment><comment><USER23> Some sites are throwaway (example: they force a sign-up). Don't assume all weak passwords used are not conscious decisions. Entropy is too precious to give up to throwaway sites of uncertain backend security.

<comment><USER28> What do mean by giving up entropy? Password reuse? You can use a password manager to generate a secure pass for every site, there's no excuse for weak passwords.

Here's a few I made with `pwgen`, get it while it's hot:

      aiPh9toh_ti{XeS(a=a9ohCheeV`o8pu8woh3Epu
      ahth6AiT6xahaiw:ie1li`xeeF0ohf!ikeih4Joh
      zah6cusohNei6feithain4aeH5uul5coh/nap0ea
      uet7ed"ohhooquoosh3ooh8ZeeY+iepeg0eewena
      UuNg'aes:i!Quohp0eiGh1ibieghe&o9eiSh7ac9
      aexu0Vio3eitheiV=aiweo$ng@u3Seidoo-phoV1

<comment><USER44> I'd like to try out #3. "zah" has a nice ring to it. Do you guys minding not using it?

<comment><USER28> It's yours :)

</comment></comment></comment></comment><comment><USER45> Searching for that password for pages on or before Feb 27, 2019 does the trick: [https://www.google.com/search?q=ji32k7au4a83&client=firefox-...](https://www.google.com/search?q=ji32k7au4a83&client=firefox-b-1-d&source=lnt&tbs=cdr%3A1%2Ccd_min%3A1%2F1%2F2015%2Ccd_max%3A2%2F27%2F2019&tbm=)

</comment><comment><USER46> Even though it turned out to be perfectly explainable why this seemingingly random password is used so often, I find it a great opporturnity to self promote my more secure version of passwords:

[https://news.ycombinator.com/item?id=19290613](https://news.ycombinator.com/item?id=19290613)

</comment><comment><USER47> Just maybe many taiwanese people use it. Or kids.

</comment><comment><USER48> I can relate. I thought I was being smart with 1qaz2wsx only to be pretty shocked when it appeared in a last of top ten passwords!

</comment><comment><USER49> I wonder how many people use uuddlrlrbastart

I'm sure there are so many culturally significant codes that get used as passwords all the time.

</comment><comment><USER50> Let's consider the scale for a moment. How may people? (Billions, yes?) How many accounts? (Min: 10x those billions).

Or as I like to say when I see stupidity online or on TV: There are close to seven billion people in the world, dumb shit is bound to happen.

p.s. You're assuming that those first 10 characters are random and unique. But perhaps, not really. Maybe it's two 5 char strings of some other significance?

</comment><comment><USER51> Forgive me if it's been mentioned already, here is the dish on passwords v. pass phrases FWIW.

[https://www.xkcd.com/936/](https://www.xkcd.com/936/) "Password Strength"

"Diceware" [http://world.std.com/%7Ereinhold/diceware.html](http://world.std.com/%7Ereinhold/diceware.html) [https://en.wikipedia.org/wiki/Diceware](https://en.wikipedia.org/wiki/Diceware)

</comment><comment><USER52> I prefer to use the last 4 digits of pi..

</comment><comment><USER53> And7hisIsWhyYouUse4PassLikeThis123.

</comment><comment><USER54> I like how they took the opportunity of the popularity of the post to promote their political viewpoints on trans people (post immediately under first post by same author). It just makes the first post look like clickbait. Why do people feel the need to introduce politics into something that isn't political once they get an audience? Boo.

<comment><USER55> Plugging something when your post blows up on Twitter is a time honored tradition, usually someone will plug their sound cloud or Instagram in an attempt to capitalize on the attention. This author chose to direct attention towards an underprivileged group, and you're angry about it? Get over yourself.

<comment><USER54> I didn't state I was angry, and I'm not lol. I just thought it was stupid. Maybe don't assume things not stated?

</comment></comment></comment><comment><USER56> If you just use the latter part "au4a83", which is "password", it's been seen more than thousand times on HIBP. And the best part is, If you tried "ji394su3", it's 20000 times! Want to guess what is it? It's "I love you" lol

</comment><comment><USER57> So, maybe it's not random as it seems?

</comment><comment><USER58> qlalqjsgh is my password.

</comment><comment><USER59> hunter2

</comment><comment><USER60> Probably the same guy reused it a hundred times on a hundred different bitcoin exchanges that all got hacked. (tongue in cheek I hope)</comment>


Nestlé leads $77M round for healthy meal startup Freshly - <AUTHOR> https://techcrunch.com/2017/06/19/freshly-series-c <comment><USER2> > That doesn't mean you order from Freshly every time you want to eat — > instead, you get one delivery of all your meals for the week. Then, when > you're hungry, you just heat one of them up in your microwave or stove.

That doesn't sound fresh at all...

<comment><USER3> Taking a look at reviews, this appears to be basically a mail order delivery service that delivers high quality TV dinners.

The meals even come in the same black plastic containers sealed with a film on top as a TV dinner or microwave meal from your grocer's freezer. So with Nestle's acquisition, this is basically a higher quality Lean Cuisine as a service.

</comment></comment><comment><USER4> I feel like the pre-made meal delivery sector is one where the company that throws the most money into advertising is the one that will win. The market is so saturated.

Personally, I'm not a fan. They don't end up being much cheaper than eating out, and by circumstance of being microwavable food in a plastic container, they never plate anywhere near as well as they show the pictures. They will never taste as good as you'd hope either, because microwaved salmon steaks just aren't that good.

I actually got some from a local company that does paleo meals, but I just found them to be too expensive for what they are.

<comment><USER5> I order a lot of food from my local pre-made meal startup. The food is never particularly good, but it wins out because:

1\. They deliver fast. I usually get my food within 20 minutes.

2\. They have single-person portions, so there is no food wastage or leftovers.

It's honestly nothing that my local restaurant can't do. But somehow, they just haven't wizened up to it.

<comment><USER6> I find it a bit mind-boggling that this is quicker than just going to the supermarket to get the same thing. I'm in the UK, and if you live in a city where pre-made meal startups can deliver within 20 minutes, you can probably walk to a small supermarket within 5-10 to buy essentially the same sort of thing for less money.

<comment><USER7> Delivery is the added value here

<comment><USER8> With a dash of externalized cultural decoherence.

Even if I trusted Nestle's motivations here, which I do not, supporting your local farmers market/grocer/coop is a more ethical way to go.

<comment><USER7> The chance you have a local farmers market/coop within 5 minute walk from your home/work is pretty slim unless you live/work at a farmers market (or downtown of a city in Vermont).

<comment><USER8> Agreed. We've had 75 years of the modernist industrial program, e.g. tearing up trolly lines in favor of cars, or suburbanization as a civil defense initiative (among others). The point is not a quick solution, however the point _is_ to have livable cities focused on the human _first_.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> I enjoy mealkits, but it seems like it would be trivial for existing grocery stores to swoop in if/when this model gains broad popularity. I could see Costco, which already has an upscale prepared foods department, offering Blue Apron/Freshly style meals at 50%-60% of the cost if they determined that they could sell a few hundred meals a week. I don't see what the moat for these businesses is.

<comment><USER10> Grocery stores in Houston already offer this. HEB, Whole Foods, Central Market, and a few others have prepared meals. It is also inexpensive and the meals tend to be good

Is this in other cities?

<comment><USER11> How inexpensive are they ?

</comment></comment></comment><comment><USER12> Crossing the Chasm for all these new food business will be difficult.

If you scale up, are you're quality and customer service could drop, or you'll be just another mass-produced food entity.

I think they all need to look into In-n-Out or starbucks to get ideas how to maintain brand and control and scale.

The issue is, how will consumers decide which brand to try as the choices and options grows and how will they maintain customer loyalty.

Ultimately, I believe any food business will become a restaurant business. Low margin high-volume to survive, or high margin, low volume, high quality.

<comment><USER13> You better be really into cheeseburgers.

</comment></comment><comment><USER14> And another soul sold to the devil.

<comment><USER15> Those who downvoted should read the history of Nestle and see that it is almost as poisonous to society as Monsanto/Bayer.

<comment><USER16> Any particular reading you suggest?

I grew up with plenty of Nestle products around (mainly chocolate related) so I've got a generic positive childhood nostalgia for them. Should I not?

<comment><USER17> Nestlé have deceptively and aggressively marketed formula milk in the developing world.

It's a cynical and greedy exploitation of poor people with low levels of literacy.

This has caused death and harm.

Here are a few, but there are literally dozens of stories over many years of Nestlé being deceptive and misleading.

2001: [http://www.irinnews.org/report/16921/pakistan-dispute- over-b...](http://www.irinnews.org/report/16921/pakistan-dispute-over-baby- milk-formula-heightens)

2005: [http://www.irinnews.org/news/2005/08/19/nestl%C3%A9-jack- inf...](http://www.irinnews.org/news/2005/08/19/nestl%C3%A9-jack-infant- formula-supply)

2011: [http://www.irinnews.org/news/2011/06/23/ngos-flay- nestl%C3%A...](http://www.irinnews.org/news/2011/06/23/ngos-flay- nestl%C3%A9%E2%80%99s-infant-formula-strategy)

2013: [http://www.irinnews.org/report/97943/pressure-philippines- en...](http://www.irinnews.org/report/97943/pressure-philippines-end-ban- formula-milk-aid)

</comment></comment></comment></comment><comment><USER18> How long until Amazon starts supporting these approaches into automated ordering and delivery with Whole Foods?

<comment><USER19> Kale drone delivery.

<comment><USER20> >Kale jokes

Enjoy it while it lasts, Whole Foods is headed down-market to compete with Walmart.

<comment><USER21> Why is kale such a punchline in the US?

<comment><USER22> It was largely unknown, then became briefly popular among health nuts and hippie-yuppie types, which some businesses took advantage of to overcharge for a super cheap crop. It became a symbol of overpriced healthy foods marketed to suckers.

<comment><USER19> Pretty much this. Kale is effectively wild cabbage, it's a salty leaf that is common in Europe as garnish or a side dish (usually boiled). It pretty much can grow anywhere it's an extremely cheap crop to produce and it was 100% marketing fad that capitalized on the ignorance of consumers.

</comment></comment></comment></comment></comment></comment><comment><USER23> This isn't tech news.

Let's just agree that everything that's not related to tech, when it happens on/through the internet, is still not tech.

It would be tech if there was a robot preparing my Freshly meals.

<comment><USER24> This isn't a tech news website. From the Guidelines:

 _On-Topic: Anything that good hackers would find interesting. That includes more than hacking and startups. If you had to reduce it to a sentence, the answer might be: anything that gratifies one 's intellectual curiosity. _

<comment><USER23> That's hard to argue with.

</comment></comment></comment><comment><USER25> Meh. All these pre-made things will die out when we have robots prepare food from fresh ingredients on demand ... [http://8-food.com/](http://8-food.com/) ... maybe they will live on as niche options for people in low density areas.

<comment><USER26> Yes, and these robots that prepare food from fresh ingredients will die out when we have nanobots measuring all our vitals and providing minerals where needed. Doesn't mean we should not take intermediate steps towards the future :)

<comment><USER27> That doesn't sound very tasty.

<comment><USER24> The nanobots in your brain's pleasure center will disagree.

<comment><USER28> Good to know that the future holds mostly parasitic nanobots.

<comment><USER29> Seems plot for reboot of Matrix, where Zion population is infested with nanobots.</comment></comment></comment></comment></comment></comment>


Show HN: Flasher.js – Easily Install JavaScript on ESP8266 WiFi IoT Devices - <AUTHOR> http://forefront.io/a/introducing-flasher-js/ <comment><USER2> Had a chance to see some of the early work on this. Excited to see it officially launched. Nice to have such an simple and easy way to get JS on an ESP8266 dev board. Building connected projects just got a whole lot easier.</comment>


WordPress And Thesis Go To Battle. Mullenweg May Sue. - <AUTHOR> http://thenextweb.com/socialmedia/2010/07/14/wordpress-and-thesis-go-to-battle-mullenweg-may-sue/ <comment><USER2> It looks like Drupal just picked up a lot of themes developers. Talk about a way to shot yourself in the foot, going after developers and threatening them with lawsuits is a sure fire way to kill momentum.

I mean a theme is just glorified HTML it is not like it provides additional functionality. I think he would have a more valid argument if he was going after plug-in developers but themes is a bit ridiculous, in any event he has showed where his head is at and anyone developing a commercial product on top of Wordpress should take notice.

</comment><comment><USER3> this is a really interesting issue. If themes have to open source, shouldn't commercial plugins?

(I don't think they should inherit the GPL licence - I believe this would harm wordpress in the long run)</comment>


Show HN: A Pintrest clone for code snippets (using gist) - <AUTHOR> http://gistrest.pckl.me/

<comment><AUTHOR> Built this over the weekend, to play with heroku mostly. Stack is Django / Python / Coffeescript / lesscss.

Must say, Heroku has blown my mind at how simple it was to get going and I was even using a custom python/npm buildpack.</comment>


New insights into mitochondria reveal how life expends energy - <AUTHOR> http://aging.nautil.us/feature/173/yes-life-in-the-fast-lane-kills-you <comment><USER2> Bear in mind that the evolution of aging is anything but a settled field. It is a battleground of many competing views and theories. The evolution of aging is one of those topics for which the wikipedia page is actually a good place to start, because right from the top it correctly delivers the understanding that this field is (a) complicated, (b) not at all unified, and (c) in flux.

[https://en.wikipedia.org/wiki/Evolution_of_ageing](https://en.wikipedia.org/wiki/Evolution_of_ageing)

The fellow here is outlining one particular set of views out of something like half a dozen with varying degrees of mainstream support, and that any random selection of evolutionary biologists would take issue with, point by point. He also simplifies down to a level at which some important points are missed, such as the existence of mitochondrially targeted antioxidants and what their ability to slow aging means for various theories of aging and mitochondrial function.

In fact all of the appearances of mitochondria in this article are in that bucket of missing important but subtle points. If you want to chase down more on the viewpoint he discusses in the last section of the article, you should read up on the membrane pacemaker hypothesis:

[https://www.google.com/#q=Membrane+Pacemaker+Hypothesis](https://www.google.com/#q=Membrane+Pacemaker+Hypothesis)

This is really driven by trying to understand why the outliers on the chart of resting metabolic rate versus species life span are outliers: naked mole rats, birds, microbats, etc.

When it comes to what to do about damaged, bad mitochondria in aging, there are better options than replacement. In fact delivery of good mitochondria as a therapy is probably not useful at all; the bad mitochondria already outcompeted the good mitochondria once, and will quickly do so again. It is so rapid that scientists have never observed this in progress, they only see cells with all bad mitochondria and cells without any bad mitochondria, never the transitional state.

(There are two separate things going on in aging vis a vis mitochondria. Firstly the type of damage to mitochondria that results in bad mitochondria, under discussion here. Secondly changes in cell signaling and environment that leads to a sort of general malaise in mitochondrial function and replication thoughout a tissue without this damage or formation of bad mitochondria, and that is not really under discussion here or in the article. It is probably a secondary consequence of other forms of damage and change in aging).

The SENS approach of allotopic expression, moving mitochondrial genes into the cell nucleus, currently demonstrated for three of the necessary thirteen genes, is the best and most permanent of solutions to prevent mitochondrial damage, being a one-time therapy. If something else is used, such as periodic delivery of replacement mitochondria, it would have to coupled with some kind of targeted destruction of bad mitochondria. That is a thorny problem, as anything less than complete destruction is just a short postponement. These things replicate quickly, and bad mitochondria of the aging-causing sort have a replication advantage over normal, good mitochondria. I'm not aware of anyone with a credible approach to that selective destruction yet, however.

<comment><USER3> Briefly, what's your point?

</comment></comment><comment><USER4> "There is a strong relationship between metabolic rate—the rate at which we're taking in oxygen and burning up food—and lifespan."

I thought this was disproved. Anyone care to clarify?

</comment><comment><USER5> Mitochondria is the powerhouse of the cell</comment>


World's biggest solar-battery farm for SA by Xmas - <AUTHOR> http://www.afr.com/business/energy/solar-energy/lyon-solar-1b-solarbattery-farm-for-sa-by-xmas-20170330-gv9tvc <comment><AUTHOR> It seems the "world's largest" claim is correct by a decent margin, I can't seem to find any battery installation that comes close to the 100MW output and 400MWh capacity claimed here. What is the second largest (that is at least financed and in-planning as it is here) solar-battery farm I wonder? Or is there bigger?</comment>


Facebook executive: Your News Feed will likely be "all video" in 5 years - <AUTHOR> http://www.niemanlab.org/2016/06/facebook-executive-your-news-feed-will-likely-be-all-video-in-five-years/ <comment><USER2> People have been saying this since the invention of the television. I can read much faster than I can listen to someone talking. If I had a disability this might be useful, however since I don't I'll pass, thanks.

<comment><USER2> Also let me know when I can "skim" a video.. whatever that would mean?

<comment><USER3> Skimming a text seems to be a skill that is on the decline.

I thought that videos presenting a tool or library was a fad, but now I suspect that watching a video is actually faster and more convenient than reading a text, for a lot of young people.

This concerns me a bit, since it is very time inefficient. I can skim a whole book in a minute. Webpages are harder, but still much quicker than waiting for some schmuck droning on and on in a video.

<comment><USER4> Do you know of any resources or tips to improve skimming skills? I am impressed that you can skim a book in a minute (even skimming a sentence or two per chapter might take longer than that for me).

I've been trying to improve my reading speed - I feel like it's actually degraded over time - but I don't know that I am making much progress.

<comment><USER3> I guess just read a lot of books, and keep doing it for several years. I learned to read when I was four, so I can't really remember, but I don't think I've gotten any faster since I was 16 or so. At that time I think I read for at least one hour, more or less every night.

</comment></comment></comment></comment></comment><comment><USER5> 1\. If video is superior to text to convey information, why isn't this article a video?

2\. They mention that text is declining year over year... I don't think they can expect this trend to entirely phase out text... seems like more users are gaining the ability to post videos and images (increasing smartphone ownership and better access to mobile data) and utilising it in addition to text.

3\. Facebook is pushing towards video because prefacing videos with an ad is acceptable whereas the same cannot be done with text or images.

<comment><USER6> Point 2 seems significant. It's like charting the rise in time spent on email and predicting that eventually we will be reading emails 24/7 without ever sleeping.

Someone (who hopefully isn't doing analysis work) has failed to differentiate "increased access to video posting" from "increasing desire to post videos".

</comment></comment><comment><USER7> I know it's not a statement of intent, but the quote nonetheless makes them implicitly sound like they'll be taking on Youtube, Twitch, Snapchat. Those are some big crosshairs. On two of those platforms, you can consume content without being logged-in. The third, Snapchat, you're always your pseudonymous identity. All of them allow you to cultivate a personality that's distinct from your real-life one.

I think they overestimate the likelihood and volume of people with real-name identities posting video content.

<comment><USER8> Thats okay, the majority of the video would be stolen from youtube anyway

</comment></comment><comment><USER9> I do not believe that, nor do i want that. I can read way faster than I can watch.

<comment><USER10> Same here. Apart from instructional videos, I avoid video at all costs. Takes too long. Interrupts my workflow. Is not office friendly. Video ads are way more annoying and waste bandwidth.

I can't recall any useful video in my news feed thus far.

</comment></comment><comment><USER11> Looking at the trends towards more video, forced video, intrusive ads, I really see my WWW usage declining going forwards.

</comment><comment><USER6> Well, that would be the nail in the coffin for my interest in using Facebook. I have auto-play off for News Feed videos, and I'm pretty sure it's been months since I engaged with a video that I found there. It's my least favorite form of content in mixed settings, I frequently use Facebook in places where playing sound is out of the question, and it's almost always less content rich than text or image.

I'm not sure if this is a statement of intent or a prediction about trends, but if it pans out it will render the News Feed worthless to me.

</comment><comment><USER12> That's so true. All the text and photos and the users that need them will move off Facebook to a new platform where you don't broadcast yourself.

</comment><comment><USER13> I'll likely stop visiting facebook in five years.

</comment><comment><USER14> Do not want.

</comment><comment><USER15> Hyping up videos so they can sell more ads?

</comment><comment><USER16> no it won't... cause I don't have a "Face Book News Feed" ;-)

</comment><comment><USER17> And all of them auto play

And play ads...

Oh god no</comment>


This is what happens when FlightFox copies your entire site without attribution - <AUTHOR> https://levels.io/flightfox-copies-nomad-list/

<comment><USER2> To say FlightFox 'copied [the] entire site' is a bit of a reach, to put it mildly. The idea, perhaps, but I wouldn't hold my breath hoping for attribution for that.</comment>


Julian Assange, WikiLeaks founder, denied asylum in France - <AUTHOR> http://www.cbc.ca/news/world/julian-assange-wikileaks-founder-denied-asylum-in-france-1.3136798

<comment><USER2> Sad for France! We welcomed Jean-Claude (baby doc) Duvalier and ayatollah Khomeini, but I guess Assange and Snowden will not receive asylum.</comment>


How often do plane stowaways fall from the sky? - <AUTHOR> http://www.bbc.co.uk/news/magazine-19562101

<comment><USER2> It is a sad thing when someone is so desperate that they will attempt this. Its a stupid thing when someone who watched a movie thinks this is actually possible and tries to re-create it on a lark. Maybe a message that said "Be sure to clean off the dead people who try to stow away here." So that people attempting it would realize they were in fact already dead.

Even with a canister of oxygen, at 35,000 feet you can't breath if you aren't in a pressure suit. Just doesn't work that way.

<comment><USER3>
        Even with a canister of oxygen, at 35,000 feet you can't
        breath if you aren't in a pressure suit.

Why not?

<comment><USER4> Partial pressures.

You can breath at 35,000 ft without a pressured suit, but go much higher and you can't.

At sea level, you have 760 mmHg of air pressure. Oxygen is 21% of the air mixture, so you have a partial O2 pressure of 160 mmHg.

At 35,000 ft, air pressure is 179 mmHg [1], so if you breath 100% pure oxygen, you're getting the same amount of oxygen you'd get at sea level.

Go up to 50,000 ft and the air pressure is only 83 mmHg, so even breathing 100% oxygen, you're only getting 50% of the oxygen you'd get at sea level.

[1] [http://www.engineeringtoolbox.com/air-altitude-pressure- d_46...](http://www.engineeringtoolbox.com/air-altitude-pressure-d_462.html)

<comment><USER5> Sea level is not the minimum oxygen levels tolerable by your body. Why, just a month or two ago I climbed to 14,000ft. Made me dizzy and nauseous , but the partial pressure was somewhere around 80mmHg.

<comment><USER6> Unless you hadn't showered for a long time prior, you were probably nauseated, not nauseous.

<comment><USER7> The OED attests that silverstorm's usage is the older one, predating yours by 8 years (1604 vs 1612).

Regardless (and I feel like such a broken record saying this), meaning in language is determined by consensus, not dictum, and at least for me (a 21 year old who grew up in the United States), "nauseous" can have no meaning but "sickened". "Nauseating" is what I would use for your meaning.

</comment></comment></comment></comment></comment></comment><comment><USER8> >How often do plane stowaways fall from the sky?

just once

<comment><USER9> Reminds me of...

I approached a couple of old fellows top-roping a route on the Niagara Escarpment. I asked if they would be long, as I wanted to do the route. They invited me to jump on their rope. I had a look. It was dirty and the sheath seemed to be detaching from the core. The end was kinked and frayed. How of ten do you change your ropes, I asked in horror.

"Every time they break. Why?"

</comment></comment><comment><USER10> _But actually preventing someone slipping into the undercarriage depends on checks and procedures that are not always present, Shanks warns.

"In a lot of places around the world, the control of movement and airside control areas is not the same as what we have here."

"It's much easier in some locations to access the airside areas than it is in the UK. The only way it could be prevented is if the rest of the world tightened their procedures."_

I would think the obvious solution would be to slap a big old multilingual warning sign on the wheel wells, clearly stating "flying in wheel wells WILL result in death by asphyxiation, hypothermia, and severe physical trauma".

<comment><USER11> This really shows up how much of our security is theatre - if people can get into the wheel well of a flight landing at Heathrow there's very little stopping someone putting a bomb there. Yet legitimate, paying travellers have to jump through all the hoops.

<comment><USER12> Keeping bombs out of the cargo bay is one of the things we seem to do very well, and has little to do with all the screenings we instituted since 9/11.

How many planes have been bombed by someone sneaking something into the wheel well?

<comment><USER13> None, yet.

I can't imagine it would be too hard to place a bomb in the wheel well of a plane parked in Nairobi, for example. The biggest issue would be avoiding the pilot's pre-flight check.

That wouldn't be to hard to do if you are a member of a ground crew that has access to the aircraft _after_ the pilot is on board.

BTW, we keep bombs out of the cargo area well because there was a time we didn't do this well at all. Then this happened: <http://en.wikipedia.org/wiki/Air_India_Flight_182> along with this: <http://en.wikipedia.org/wiki/Pan_Am_Flight_103>

</comment></comment></comment></comment><comment><USER14> Wheel-well stowaway is just about the worst thing you can do, ever. The wheel- wells are unpressurized, unheated, and designed to snugly fit the wheels in there (airplane designers don't waste space!). If you're not crushed to death upon retraction then you're almost certainly going to freeze to death or die of hypoxia. Just don't do it.

<comment><USER15> Hitching a ride on a boat full of drug-running pirates is actually safe by comparison.

</comment></comment><comment><USER16> There must be a way to monitor wheel well activity with cameras? And abort the flight if someone tries to get on?

<comment><USER17> It was only 73 recorded deaths starting from 1946. This would be one of the crappiest cost/result ratio in lifesaving efforts in the history of humanity.

<comment><USER18> ...but in the context of aircraft (where we go through ridiculous security theatre; and where we cannot use any technology; etc) we're used to that kind of spending.

</comment></comment></comment><comment><USER19> We all know how to deal with these parasites in the landing gear:

[http://www.youtube.com/watch?feature=player_detailpage&v...](http://www.youtube.com/watch?feature=player_detailpage&v=JijblXY0Mkc#t=6s)

</comment><comment><USER20> Anyone who googles "wheel well stowaway" finds out the risk. In one google.

I almost want to go to the class graduation ceremony of every high school in america and say "tl;dr AT LEAST FUCKING GOOGLE IT." :)

</comment><comment><USER21> I'm pretty sure that military pilots have to go unpressurized to 25,000 feet in order to be qualified. however they don't have to stay there for very long. and certainly not as long as the duration of a commercial flight.

<comment><USER22> When I did my training (Canadian Air Force, in the early 90's), we only had to go through controlled hypoxia training that allowed us to experience high altitude sickness, and therefore (hopefully) recognize the symptoms of it so we could react to some failure at altitude.

We basically had to do menial tasks, like read a deck of cards, play "paddy- cake", etc., and then put our oxygen masks back on once we thought we were too impaired, while a technician was there with us.

However, I think the simulated altitude was 20k or 25k feet.

Needless to say there's a reason that O2 is (legally) required in unpressurized aircraft for anything over 10k feet.

<comment><USER23> Here in the US oxygen is required for the primary crew at over 14k cabin altitude. At 12.5-14k it's required after 30 minutes. No requirement under 12.5k.

I have flown at 12k for 1 hour and could tell that the air was much thinner and that going much higher would have started to impair.

I think that most commercial aircraft run somewhere between a 6k and 8k cabin altitude and as such a whole different set of rules apply. I don't know for sure - I'm only a private pilot.

</comment></comment></comment><comment><USER24> I've got "It's Raining Men" on my internal jukebox now :-(</comment>


New Modular Solar Towers Promise Easy Green Power - <AUTHOR> http://www.pcworld.com/article/249757/new_modular_solar_towers_promise_easy_green_power.html

<comment><USER2> Here is a clue if the title says "Easy Green Power" you know they haven't built it yet.

tl;dr version a media company releases 3D renders of a concentrated solar project.

Actual web site is here: <http://staimanmedia.com/Aora/>

They've built two, one in Israel and one in Spain, for a combined 270kW of power generation. Neither seems to improve on Solar-One which was built in the Mohave Desert outside of Barstow in the 90's and provided 250kW of CSP generated power for 10 years before being dismantled.

Building a CSP power plant in the desert is not hard, its been done and anyone with money can do it again. Building infrastructure that can transfer that power somewhere useful, that is hard.</comment>


Attrs – The python library everyone needs (2016) - <AUTHOR> https://glyph.twistedmatrix.com/2016/08/attrs.html <comment><USER2> If I'm not mistaken, python 3.7's data classes will make attrs mostly obsolete?

</comment><comment><USER3> Thanks for the link. I'm just starting out in python so any tips are great.</comment>


Three Things You May Not Get About the Aaron Swartz Case - <AUTHOR> http://www.popehat.com/2013/03/24/three-things-you-may-not-get-about-the-aaron-swartz-case/

<comment><USER2> This is what I get: "You have been banned. You might have been banned because you are a spammer. You might have been banned because you're a troll of some sort. You might have been banned out of sheer malice. Perhaps you just caught one of us on a bad day. If you believe that you have been banned unjustly, drop us a line.

Rex non potest peccare!" And this is the first time I am visiting this site.

<comment><USER3> I had no such problem. Nor have I ever had a problem with Ken's site.

That said, Google cache is an easy workaround:

[http://webcache.googleusercontent.com/search?q=cache:http%3A...](http://webcache.googleusercontent.com/search?q=cache:http%3A%2F%2Fwww.popehat.com%2F2013%2F03%2F24%2Fthree- things-you-may-not-get-about-the-aaron-swartz-case%2F)

</comment></comment><comment><USER3> This deserves to be read.</comment>


The Man Who Saved Russia from the Soviet Union - <AUTHOR> https://fee.org/articles/the-man-who-saved-russia-from-the-soviet-union//amp <comment><USER2> Oh my fucking god.

<comment><USER3> We've banned this account for obvious reasons. Would you please stop creating accounts to break the site rules with?

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)</comment></comment>


Lisp-based OSes - <AUTHOR> http://linuxfinances.info/info/lisposes.html <comment><USER2> The Unix-style process model has virtues that the OP doesn't seem to grok. It's sometimes helpful to be able to restart one server from a completely clean memory image without taking the rest of the system down.

Beyond that: the OP sez that "if the whole system is constructed and coded in Lisp, the system is as reliable as the Lisp environment. Typically this is quite safe, as once you get to the standards-compliant layers, they are quite reliable, and don't offer direct pointer access that would allow the system to self-destruct."

But as I write, we've got two Lisp posts on the front page, and the _other_ one[1] is about the performance of code compiled with

      (declaim (optimize (speed 3) (safety 0) (space 0)))

That is --- "omit safety checks, just trust me that my array accesses are all in bounds and I'm getting the types right." Code compiled this way is _not_ inherently safer than C, and has to be coded up with equal care.

So, at the very least, the "quite safe" guarantee applies only to code compiled with full safety checks, which typically come with a very large performance hit.

[1] <http://news.ycombinator.com/item?id=2192629>

<comment><USER3> The other half of his point was specially tuned hardware - the author seems to believe that the type-checking, gc, etc. don't cripple performance the way they do on x86.

I don't know if he's _right_ , but that seems to be his point.

<comment><USER4> The idea is that you would have bits in the hardware dedicated to type checking and garbage collection. The example being, that in the assembly language/machine code, you may have a single arithmetic '+' operation.

Determining which hardware path to use to add two numbers would be done in the hardware itself. Check the type bits of the numbers and feed it into my ALU. Compare this to an x86 lisp, or compiled C, where 'type' of a 'number' is determined by the assembly code instruction that is used on it.

This isn't just a performance improvement, it is also an improvement in the safety of the dynamic language.

There are a lot of different things that you could do for garbage collection. You could have in-hardware reference counting, or 'dirty' and 'clean' (or color) bits, for a mark and sweep collector, or 'generational' bits for an ephemeral garbage collector.

The idea is that any time you take something out of software, and put it into specialized hardware, you should get a performance improvement.

This doesn't mean that the lisp on a chip would be faster than C on a comparable x86 chip, it means that the things that make lisp (and other functional languages) safer and easier to use would be supported in hardware-- therefore not slowing things down as noticeably.

<comment><USER5> > it means that the things that make lisp (and other functional languages) > safer and easier to use would be supported in hardware-- therefore not > slowing things down as noticeably.

Or, at least, forcing every language implementation on that hardware to use the same safety mechanisms, making some apples-to-apples benchmarks impossible.

It would be interesting to see what a C implementation for that hypothetical modern Lisp machine (CADDR?) would look like.

A close parallel is AMPC, which compiles C to JVM bytecode.[1] The vendors say it's standards-compliant, and I actually am pretty sure it is, but it doesn't do a lot of the nonstandard things C programmers have come to depend on. For example, the 'struct hack', where you pack data of multiple types into a struct and proceed to index into it as if it were an array (usually an unsigned char array), flatly does not work, due entirely to the runtime type checking done by the JVM. This always seems to lead to major debates over whether it's a very good compiler.

[1] <http://www.axiomsol.com/>

<comment><USER6> The 'struct hack' is when you leave the type of the last member of a struct undefined (effectively making structs variable-sized). This is actually not a problem for runtime type checking, and is C99 compliant.

What causes problems is casting pointers to ints and back, and casting all other crap to chars. This is not standards compliant.

Casting ints to pointers will never be type-safe, but one way to get around that is to just ignore the cast, and overload arithmetic operators to work correctly on pointers - the pointers will carry around their type info, and everything should work ok.

Casting other crap to chars will never work because it interferes with the way the other crap has its type encoded. Luckily in most cases this casting is done to perform I/O, where you can also just ignore the cast, and specialize the lowest-level I/O functions to dispatch on the actual types.

The moral of the story is that you should basically ignore all the line noise the programmer produces about types, and look at the actual objects. This is exactly how Java works, btw.

WRT hardware tagging and type checks, there's really no reason to do it on a byte-addressed superscalar processor. If you look at 64-bit Common Lisp implementations today, you'll actually find that they use only about half the available tag bits in each word. The only thing that needs to be boxed is double-floats.

</comment></comment></comment></comment></comment><comment><USER7> DARPA recently assigned a grant to Olin Shivers, along with members of Northeastern University's and University of Utah's faculty, to "seek to develop bug-free, secure technology using brand-new programming languages that enable programmers to write large, complex software."[1]

Around campus, it's been described as an opportunity for Shivers et al. to write a Operating System built completely with functional languages, from the low-level drivers up to user space tools and new programming languages.

My personal thoughts is that it'd be awfully cool to have something like "Emacs as a real OS." Perhaps it is lack of knowledge and self-confidence or the limited nature of Emacs, but I find it way easier to change the way Emacs works than to change the way the Linux kernel, GNOME, GNU tools, etc. work.

[1] Page 12 of <http://www.ccs.neu.edu/news/CCIS-Newsletter-Fall-10.pdf>

<comment><USER8> I think it would be interesting to chop a *macs into an operating system. I would approach it in an iterative fashion with these initial goals:

\- Replace elisp with Common Lisp

\- Build os-level threading support

\- Build a hardware abstraction layer / target a 'bare' machine.

That gets someone a 'ways' towards a traditional Lisp OS.

I think one of the big questions that arises in for a modern Lisp system is the design of of multiple processes and multiple users.

<comment><USER7> Personally, I'd rather toss Lisp entirely and go with Scheme, but something definitely needs to be done about elisp. There's a small group of undergrads here at NU hacking on Edwin, a Scheme based Emacs clone originally developed at MIT. They're (we're, I suppose) porting it to Scheme48.

Those last two would certainly be important as well, but something I have no context on.

</comment></comment></comment><comment><USER9> I bought a Xerox 1108 Lisp Machine in 1982 and loved it for the great display, windowing system, and awesome InterLisp-D development tools.

That all said, I prefer the modern world of general purpose operating systems with good commercial (Franz, LispWorks, etc.) and free (SBCL, Clozure, Clojure, etc.) Lisp development environments.

<comment><USER10> On a whim, have you ever looked into any of the LISP machine emulators?

<comment><USER9> Yes. I found a simulator for the 1108 bundled with a NLP package and ran it for an hour, then deleted it. Not the same experience as using my old 1108.

</comment></comment></comment><comment><USER11> Combining the Unix style process separation with mechanisms in the language might be useful.

A problem with such environments might be the availability of widely used applications like Google Chrome or Firefox. A way around this might be to expose the language's Virtual Machine as bytecode or some other intermediate, and target C compilers to that. This way, an entire POSIX environment could be built on top of the Lisp based OS, which would be more comfortable for many users, yet still offer an omnipotent, seamless access to code everything "from the bare metal-up" in Lisp.

<comment><USER12> I recently found this Scheme to C/JVM/C# compiler: <http://www- sop.inria.fr/mimosa/fp/Bigloo/>

<comment><USER13> I've heard people having good results using Gambit to generate C code from scheme to write software for unusual platforms. <http://www.iro.umontreal.ca/~gambit/doc/gambit-c.html>

</comment></comment></comment><comment><USER14> Surprised no one has mentioned MonaOS. It's a small, Scheme-based, x86 OS. It's got a lot of parts written in C and assembly and is occasionally buggy, but is fun. It is largely a one-man show, but it's already fairly functional. There are images at <http://monaos.org/> and the github repo is at <https://github.com/higepon/mona> .

</comment><comment><USER15> I'm surprised that none of the efforts listed seem to target hypervisors like Xen or KVM.

A few weeks ago, Azul's VM was on HN, and its GC benefits from tight integration with the virtual memory system.

<comment><USER6> You can get Azul's Linux patches here:

<http://www.managedruntime.org/>

From what I understand, the main win is that they use nested page tables to let the JVMs handle page faults directly, which is how they implement high- performance read barriers.

I don't know a lot about garbage collection, but read barriers seem to be the essential piece for implementing real-time (which really should be called "non-blocking") GC.

There's a good discussion on LtU about this: <http://lambda-the- ultimate.org/node/4165>

[edit] I should mention how this relates to Lisp operating systems: if you replace the virtual memory system with a garbage collector (ie push the GC into the kernel), you can get the same effect but without needing nested page tables/VT-x/RVI, even for user-space processes.

It should also be more efficient and waste less memory on fragmentation than going through a dumb VM.

</comment></comment><comment><USER16> While not a Lisp OS, StumWM <http://www.nongnu.org/stumpwm/index.html> is an interesting project. I run it on Debian, and I like to pretend I using a Lisp Machine.

</comment><comment><USER17> Unix as in POSIX days are either numbered or is going to be perpetually hacked into something it can't do without issue. Distributed computing is becoming more of a norm with consumers having many devices. A look into what future operating systems might look like are Midori or Inferno (which was way ahead of it's time) or any other vm based operating system.

</comment><comment><USER8> Does anyone know if there's any sort of open source project for a modern Lisp OS that is ongoing?

<comment><USER6> <http://common-lisp.net/project/movitz/>

Frode V. Fjeld doesn't seem to have much time to hack on it anymore, but the mailing list is active and you can hack on it today.

</comment></comment><comment><USER18> If there really was a tool (whether that be hardware or software or a combination) that for a couple of thousand dollars would genuinely make you 10x more productive, you'd be an absolute fool not to run out _now_ and buy it.

Since people aren't willing to do this it goes to show that the claims of the Lisp junkies are just pipe dreams.

If programming on an all Lisp environment really was 10x more productive even a ten thousand dollar price tag would be chicken feed.

Lisp fans like to talk it up about how great it is, but at the end of the day are unwilling to put their money where their mouths are.

<comment><USER19> This is only the case if productivity is your only concern. There are also considerations such as support, security, and familiarity.</comment></comment>


Five HOT CSS3 SKILLS OF 2012 - <AUTHOR> http://dolody.com/#!/quick-tutorial/five-hot-css3-skills-of-2012.html

<comment><USER2> I do believe the use of # urls has just passed its limit.

</comment><comment><USER3> Why all the capital letters?</comment>


Ant Simulator Canceled After Team Spends the Money on Booze and Strippers - <AUTHOR> http://news.softpedia.com/news/ant-simulator-canceled-after-team-spends-the-money-on-booze-and-strippers-499697.shtml <comment><USER2> Not sure how much they raised on kickstarter, but unless it was a pretty trivial amount, it seems like there's got to be more to the story.

<comment><USER3> There's a lot more convo on this on the reddit thread:

[https://www.reddit.com/r/nottheonion/comments/43nvsm/ant_sim...](https://www.reddit.com/r/nottheonion/comments/43nvsm/ant_simulator_canceled_after_team_spends_the/)</comment></comment>


Julia by Example - <AUTHOR> http://www.scolvin.com/juliabyexample/

<comment><USER2> I used Julia for both a machine learning course and a neural networks course this past semester, and I really enjoyed the experience of developing in the language. I found it really a lot faster than python/numpy and a lot more sane than Matlab. Some key syntactical structures are also very purposefully kept similar to Matlab so it was very easy to translate code between the two, which is incredibly useful in scientific computing. I definitely recommend people check it out; however, I will warn any potential users that the run times of Julia programs right now (as of 0.3.x) are incredibly slow if you need to include any third party libraries. I understand they're working on this for a future release (maybe 0.4), but even including a simple plotting package in your code currently causes a 20-40 second overhead before your code actually starts running because the packages aren't precompiled.

Oh, and one more tip for OSX users wanting to try out Julia. You might want to just use the app bundle provided on the Julia homepage rather than compiling from the homebrew tap. I spent close to an hour waiting for all the dependencies to compile before giving up when I realized I don't want to be doing this every time it's updated.

<comment><USER3> For what it's worth, when building from source, the first time compile is the only one that takes an hour. After that, incremental updates are pretty quick since the only thing that usually changes is Julia itself, not the bucket load of source dependencies (LLVM, OpenBLAS, FFTW, GMP, etc.). Most devs pull rebuild Julia from source several times daily – this is the best way to stay bleeding edge (if that's what one wants). Even if one doesn't want to live on the bleeding edge, checking out the release-0.3 branch and building that from source is also an option. That said, the binaries are also a good way to get Julia.

</comment></comment><comment><USER4> For a while now I've been interested in learning more about Julia, though not exactly sure yet what use-case I have for it. I guess I wouldn't know until I do study the language enough to figure it out.

This tutorial looks promising, building knowledge carefully but not too much "hand holding", like it's for programmers experienced in other languages. Got part of the way though it so far, obviously not a "one-shot" kind of exercise.

My only complaint is the same one I make with many other tutorials of this kind. I find it very annoying when some feature or function is used in an example, but the function comes "out of the blue", not defined or explained, as though the reader is supposed to magically divine its meaning or definition.

In this case, everything goes along swimmingly until encountering the function/method "repr(a)" in "Arrays" examples. I dutifully spend several minutes tracking it down, and what do you know, basically the same as (->string ...) in Scheme (i.e., object->string representation).

I'm not giving up on Julia. I'll carry on from that point when I return to the site. But really, IMO _every_ newly introduced term/function/feature should be defined so that the example can actually be completely understood.

Otherwise there's a substantial risk of losing readers who will not so likely be motivated to keep trying to figure it out.

</end of minor rant mode>

<comment><USER5> You can say ?symbol in the prompt and it will tell you what it is

        help?> repr
        Base.repr(x)

           Create a string from any value using the "showall" function.

</comment></comment><comment><USER6> I don't do any scientific computing, as such I have zero use cases for Julia.

However as language geek, I do follow its development.

It is quite interesting to see another dynamic language in the same footsteps of Lisp dialects and Dylan, where performance, ability to compile to native code and simple FFI are considered important features to be part of the main implementation.

Really looking for Julia becomes widely used.

<comment><USER7> I also don't have a lot of need for scientific computing; Julia has the potential to be a really compelling replacement for Python for general purpose scripting.

<comment><USER8> I do wonder if the 1 based indexing puts off a lot of developers. I have no issue with it but it seems to come up in most threads discussing Julia, here and on Reddit.

<comment><USER6> Personally I think it stems from a C influenced culture in terms of array indexing.

People from my age remember programming languages where you index from one, can select the base index or use enumerations as indexes.

Tooling, performance and libraries are much more important than base indexes.

Then again, I favored those C alternatives back when C wasn't an option at all. So I am biased.

</comment></comment></comment></comment><comment><USER9> Great post! This is by far the best way to learn a language for people who can already program in another language.</comment>