What can we learn from the matrix.org compromise? - <AUTHOR> https://medium.com/@tomsparks/what-can-we-learn-from-the-matrix-org-compromise-c6ae06dcaab <comment><USER2> This is such a poorly written article:

* no detailed analysis of how the attack was undertaken. Its not even clear how the attacker managed to get in (was it a publicly exposed Jenkins? vulnerable bastion? what?)

* no analysis of what the existing matrix.org security perimeter looked like or how it could be made better.

* repetition of security tropes. Use VPN. Use Github Enterprise (wait wtf? Why not private repos in Github?). Don't use Ansible, use salt.

Ridiculous. I was looking forward to a nice long read about how this breach was undertaken. Hugely disappointed.

<comment><USER3> If you click through to the GH Issues I linked to there are some pretty good data points as to what happened. I didn't feel the need to copypasta.

But yes, publicly exposed jenkins and repos lead to the compromise, not an uncommon story unfortunately.

Perimeter - I didn't see much evidence of one existing and I didn't go probing their networks to find out.

Security tropes are real for a reason, you don't have to believe me though.

Private repos in GitHub are still publicly hosted and are orders of magnitude easier to get into than having an in perimeter repo. They've leaked before and they'll keep on leaking. GitHub even made it harder for people to fork private repos to their own public accounts but it still happens.

<comment><USER2> > They've leaked before and they'll keep on leaking. GitHub even made it > harder for people to fork private repos to their own public accounts but it > still happens

Can you provide some actual instances of this happening? Genuinely curious, as my org is currently migrating from enterprise to cloud.

<comment><USER3> I've mostly seen this reported in forums and during discussion, if you Google around you'll find some pretty useful hits.

Here's a good one from reddit: [https://www.reddit.com/r/github/comments/9odnvw/someone_fork...](https://www.reddit.com/r/github/comments/9odnvw/someone_forked_a_private_repo_and_made_it_public/)

Its also discussed reasonably well in the infosec community. Basically GitHub is a great place to find other people's passwords and API keys.

<comment><USER4> Thats unrelated to github though. It sounds like the person did a git clone and then created a new repo and pushed it. You could do that with a self hosted git repo as well. To stop that you would have to have your git server block logins from non company machines and have some serious logging on all company machines to stop anyone moving it off via usb

</comment></comment></comment></comment></comment><comment><USER5> Why aren't people reporting the fact that Matrix.org actually lost control of their network a second time within hours of their first all clear sounding?

I feel like this is an important part of the story for anyone looking for teachable infosec moments.

<comment><USER6> Because the second tine was a dns hijack, not a network compromise. I'm a little fuzzy on the details, but it had something to do with cloudflares API not revoking some access token.

Either way, a DNS hijack is not great, but not nearly as bad as the initial compromise.

<comment><USER3> It wasn't CloudFlare's API not revoking a token, they just didn't revoke all the tokens. Basically human error.

"The API key was known compromised in the original attack, and during the rebuild the key was theoretically replaced. However, unfortunately only personal keys were rotated, enabling the defacement."

</comment></comment></comment><comment><USER7> If it wasn't clear, this article wasn't written by the Matrix.org team, nor did the author discuss any of it with us to our knowledge.

We'll publish our own full post-mortem in the next 1-2 weeks.

<comment><USER7> also, reading this article more carefully, much of this just plain wrong:

> One of the more interesting pieces of this was how Ansible was used to keep > the attacker in the system.

Fwiw the infra that was compromised was not managed by Ansible; if it had been we would likely have spotted the malicious changes much sooner.

</comment></comment><comment><USER8> It's been a few years since I last used Saltstack but if you have access to the master you have instant root on all minions or did that somehow change? salt '*' cmd.run 'find / -delete' and game-over?

<comment><USER3> Very true, however I'd rather have that problem than an ever multiplying number of user accounts on systems that can su/sudo.

<comment><USER9> Make golden images with packer, or something similar, and then roll your fleet over.

You should not be running package managers on production servers. Or any of the other things salt, ansible, chef, puppet can do.

<comment> yjftsjthsd-h As in, no _human_ should run a package manager in prod? (But salt/ansible/etc. running it is fine) Same idea as "if you're SSHing to prod, something is wrong" (where provisioning tools make all changes, logs are all aggregated and delivered in their own tool, and even debugging is built into the app or logging system).

<comment><USER9> More as, you should not modify images running in production. By human or machine.

Rather build new images and roll over the fleet. If you need to debug, remove from production (quarantine) and work on it there.

Don't run master / agent setups for ansible / salt anymore. You can still use them for creating images, which are later turned into running VMs. Think about it like containers. Do you update the contents of your running containers, or log into your containers to make changes?

Better yet, use OSes that cannot be modified.

<comment><USER10> But golden images on Linux are, well, messy. It's very annoying to make a clean VM template without some post-provisioning like cloud-init. And for most shops if you're running cloud-init you could do that post-provisioning with Ansible or Salt. And since your images are built with Ansible/Salt in the first place you might as well just build each VM fresh and use the vendor's ISO. One less thing to maintain and update.

Plus when you're in a pinch, which never happens of course, you can make changes without having to roll your VMs.

I feel like Atomic distributions are basically the happy medium between the two worlds.

<comment><USER9> It's a trade-off. The point is the matrix security lapse turned worse because they ran this master / agent setup. You can still use ansible (or similar), just do it localhost during the build process.

Yea it's easier to not do these things, because good security posture takes work to set up. Once you're on the immutable train, you'll find it's not actually harder day to day. You learn to deal with issues in the pinch another way.

On the point of building VMs fresh each time vs building golden images, you'll find you boot time reduced, your roll over more reliable and autoscaling more responsive. Why build the same thing dozens or hundreds of times? What happens if a remote package is updated in the middle of your upgrade? Does this sound messier to you?

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Why is it considered safer to expose a VPN to the internet than SSH? Is it just that there is one exposed service for the organisation rather than one per machine?

<comment><USER3> SSH tunneling is handy but if you want to push anything else over it, its a pain for the "layperson". You're not going to have a great time supporting people with it. I've done it, it sucks. Scripts and special SSH config files are the pits. VPNs are way easier, they can support multiple access levels and roles, are often not blocked by other people's packet filters and firewalls and the good ones can even validate that a host is in "compliance" before they're allowed onto the network.

</comment></comment><comment><USER12> Can anyone explain the Jenkins vulnerability that was used to initially gain access? Reading the CVEs didn't give me the impression that they enabled remote exploits

<comment><USER3> My 5 second lazy summaries of the CVEs:

CVE-2019-1003001, CVE-2019-1003002 -> Anyone with read access to Jenkins can own the build environment.

CVE-2019-1003000 -> I didn't get a lot of the details on this but it basically looks like "broken sandboxing, you can run bad scripts".

This is also a good resource: [https://packetstormsecurity.com/files/152132/Jenkins-ACL- Byp...](https://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass- Metaprogramming-Remote-Code-Execution.html)

</comment></comment><comment><USER13> The attacker gained network access through Jenkins.

Don't deploy a public-facing Jenkins, especially if it has credentials attached to it. It's really hard to secure, especially if pull-requests can run arbitrary code on your agents.

Jenkins / CI is the sudo access to most organizations.

<comment><USER3> I agree with you 100% here, I would not deploy any CI publicly unless its heavily fenced off into "read only" territory.

</comment></comment><comment><USER14> One thing I learned was where to modify the pageant source code (Windows equivalent of ssh-agent) to make my agent prompt before signing (with the default focus on "no"). This feels much safer and is a very minor inconvenience. I wonder why more agents don't have this built in.

Example: [https://twitter.com/R1CH_TL/status/1118559239084158977](https://twitter.com/R1CH_TL/status/1118559239084158977)

</comment><comment><USER15> I'd like to take this opportunity to plug my in-development decentralized, distributed, completely open forum, using PGP as the "account" system, and text files as the data store.

So any reasonably competent hacker can re-validate the entire forum's content and votes, reasonably quickly reimplement the whole thing, and/or fork the forum at any time.

[http://shitmyself.com/](http://shitmyself.com/)

<comment><USER16> This is very interesting! I have so many questions. If you see this, kindly send me an email. It's in my profile. I love the idea!

</comment></comment><comment><USER17> That medium.com has a paywall and doesn't want to share content? (is what I learned)

<comment><USER3> This might work: [https://medium.com/@tomsparks/what-can-we-learn-from-the- mat...](https://medium.com/@tomsparks/what-can-we-learn-from-the-matrix-org- compromise-c6ae06dcaab?sk=0517b377c873db74a6fb1d8c29e18baa)

</comment></comment><comment><USER18> I have gone on some long verbal rants about the dark patterns (bordering on malicious behavior) exhibited by key agents such as SSH agent, GPG agent, Pageant, and the like.

What can you learn from the compromise? Never use an agent. Kill it with fire^H^H^H^H -9.

<comment><USER19> How about using hardware tokens instead? With a right setup, private keys never leave it.

<comment><USER20> Smart cards? They were designed for this.

<comment><USER3> Ever seen anyone working in a Coffee shop using one? Me neither.

Good security technology exists, the problem is that people don't want to use it because its easier to ignore it.

<comment><USER21> I have, and I have myself used one until it was stolen from me with a bag it was in.</comment></comment></comment></comment></comment>


Securing Browsers Through Isolation versus Mitigation - <AUTHOR> https://email@example.com/securing-browsers-through-isolation-versus-mitigation-15f0baced2c2 <comment><USER2> Edge got destroyed at this year's Pwn2Own, which happened 3 weeks after that Microsoft post. So, enough said?

<comment><USER3> Were those mitigations live though?

Microsoft announced Edge Application Guard[0] back in September and it still doesn't ship on the latest stable release.

[0] [https://blogs.windows.com/msedgedev/2016/09/27/application-g...](https://blogs.windows.com/msedgedev/2016/09/27/application- guard-microsoft-edge/)</comment></comment>


Ask HN: How do you translate a dynamic website into different languages? - vanilla-almond What are some approaches for translating a dynamic website or web app into different languages?
For example, do you place all the copy and error messages into separate files which are then loaded by the app depending on the language chosen?
How do you keep translations in sync when copy in one language is updated?
And finally, if you have an open source project that relies on volunteer translators, how do you verify the quality of the translations? <comment><AUTHOR> Same as any other localized software -- pass every translatable string through a dynamic call to a localization function (e.g. `tr` in Qt [1]) and load localization files for the translated strings.

[1] [http://doc.qt.io/qt-5/i18n-source- translation.html](http://doc.qt.io/qt-5/i18n-source-translation.html)

<comment><USER2> As for quality checks, this gets MUCH harder. You basically need more than one translator and some of them do translation review.

<comment><AUTHOR> Yes, that part is a major problem. I don't think there is a simple path for quality localization -- you definitely want multiple people fluent in the target languages to review the UI, with expert knowledge of the domain.

Watch out for adjectives becoming verbs, positives becoming negatives, phrases going from half a line to three lines, etc.

\--

I've unfortunately worked with US-based UX companies whose employees had zero understanding of the non-American world: 24h-clocks, ISO 8601 dates, no italics in Asian scripts, ...

There was even one who wanted the verb to be colored blue or red depending on positive/negative connotation, as if that "system" could reliably or easily be "translated" and coded.</comment></comment></comment>


Advice finding independent contractor (corp to corp) work in Bay Area - <AUTHOR>

I moved back to the bay area about half a year ago, currently work as a salaried employee but I would like to start taking on some corp to corp work. I do realize what this entails and my plan is to do this properly, where I am actually independent, only go on-site for meetings, etc and would eventually have more than 1 client.<p>I'm interested to possibly work with startups or more established companies, have a background in some of the newer web technologies as well as Java-based search engines, etc. I'm curious if anyone has advice as far as where I can get the most "bang for my buck" as far as networking with people who are open to contracting out work on a corp to corp basis, I'm fairly busy as is and it seems not everyone is open to this (they just want full-time in-house employee). Would appreciate any advice. <comment><USER2> Please excuse my ignorance but what is "corp 2 corp"?

<comment><AUTHOR> It is when you interact with a client as your own business rather than as an individual, similar to an independent contractor. Essentially, the focus is on deliverables and overall project completion rather than the day to day control that an employer has over an employee.</comment></comment>


Would you rather work at Google or Yahoo - RWW - <AUTHOR> http://www.readwriteweb.com/archives/would_you_rather_work_at_google_or_yahoo_poll_goog.php

<comment><USER2> Actually I think I would rather work at Yahoo. You would have more freedom but less job security which suits me just fine.</comment>


1971 B5500 Eliza clone written in Lispified Algol - <AUTHOR> http://elizagen.org/ <comment><USER2> Now who will write something that allows that GTL source (or the equivalent) to run? It looks quite nice conceptually as the "program" is nicely separated from the "knowledge" and the program is just 360 lines:

[https://github.com/retro- software/B5500-software/blob/master...](https://github.com/retro- software/B5500-software/blob/master/CUBE-Library-13/Files/ELIZA-Z100010.gtl)

The documentation for the language is here:

[http://www.bitsavers.org/pdf/georgiaTech/GTL_Programmers_Ref...](http://www.bitsavers.org/pdf/georgiaTech/GTL_Programmers_Reference_Manual_for_the_Burroughs_B_5500_Aug1974.pdf)

as [http://retro-b5500.blogspot.com/2018/05/the-cube-library- tap...](http://retro-b5500.blogspot.com/2018/05/the-cube-library-tapes.html) report:

"GTL -- Georgia Tech Language. Another clone of Extended Algol by Martin Alexander at the Georgia Institute of Technology in Atlanta, Georgia. This compiler has significant extensions for strings, records, complex arithmetic, list processing, plex processing, and extended I/O features. Documentation is also available on bitsavers.org."

I see also:

[https://github.com/pkimpel/retro-b5500](https://github.com/pkimpel/retro-b5500)

"Web-based emulator and operating environment for the Burroughs B5500 computer system."

<comment><USER3> GTL does indeed run in the retro-b5500 emulator, although I have not yet tried to compile and run Eliza with it.

The emulator runs in a standard web browser. It requires some setup. The easiest way to get started is to run the emulator from the project's hosting site:

[http://www.phkimpel.us/B5500/](http://www.phkimpel.us/B5500/)

First, follow the link to the Getting Started wiki page, which explains what you need to do in detail. There is a link on the page above to a forum if you have questions or need assistance.

GTL is written in B5500 Extended Algol and is based on the compiler for that dialect. The source we found on the CUBE tape does not compile with the standard Mark XIII Algol compiler. We think that may be due to some local Algol patches in use at Georgia Tech. I have posted a compile deck with patches that works for me:

[https://github.com/retro- software/B5500-software/blob/master...](https://github.com/retro- software/B5500-software/blob/master/CUBE-Library-13/Patches/GTL-Compile.card)

After running this, you will need to do a "MC GTL/NEW" command on the SPO (console teletype).

<comment><USER2> Thanks, wow, there are really some new news:

[https://github.com/retro- software/B5500-software/tree/master...](https://github.com/retro- software/B5500-software/tree/master/CUBE-Library-13)

"Tapes for version 13 of the library were acquired several years ago by Jim Haynes from the B5500 site at the University of California at Santa Cruz and donated to the Computer History Museum in Mountain View, California. _The CHM was finally able to read these tapes in May 2018_ , producing binary images in .tap (taput) format. For information on the .tap format, see..."

</comment></comment></comment><comment><USER4> See [https://github.com/jeffshrager/elizagen/blob/master/cosellel...](https://github.com/jeffshrager/elizagen/blob/master/coselleliza1969and1972.lisp)

<comment><USER2> It's much bigger (close to 3000 lines) than the version from the original post, which is only around 700 lines for the program and the separate "knowledge":

[https://github.com/retro- software/B5500-software/blob/master...](https://github.com/retro- software/B5500-software/blob/master/CUBE-Library-13/Files/ELIZA-SCRIPT.dat)

[https://github.com/retro- software/B5500-software/blob/master...](https://github.com/retro- software/B5500-software/blob/master/CUBE-Library-13/Files/ELIZA-Z100010.gtl)

<comment><USER4> The first 380 lines are used to change the Common Lisp environment so that it can read and evaluate the two different versions that follows.

There are comments that add information about the original page numbers, etc, but roughly speaking, the code is split as follows:

      - From 381 to 749 (368 lines)   : DOCFN (1969 doctor functions)
      - From 751 to 1831 (1080 lines) : 1969 script (knowledge)
      - From 1834 to 1870 (36 lines)  : Eliza 72 header
      - From 1870 to 2242 (372 lines) : 1972 Doctor program
      - From 2245 to 2915 (670 lines) : 1972 Script (knowledge)

</comment></comment></comment><comment><USER5> If you knew what the 'B' stood for without reading the article you're over 50.</comment>


Amdahl's law in reverse: the wimpy core advantage - <AUTHOR> http://www.yosefk.com/blog/amdahls-law-in-reverse-the-wimpy-core-advantage.html <comment><USER2> This isn't really correct, because it ignores the fact that modern out-of- order CPU's also have out-of-order memory pipelines.

The reason the four slow CPU's are faster in the author's example is that they are issuing four concurrent requests at once, while the single CPU is issuing one request at a time. If requests have fixed and high memory latency, the four CPU's will get back four times as many results in each waiting period as the single CPU. This presupposes that the problem has enough memory parallelism to support four memory requests in flight at once.

But if the problem is highly memory parallel, then the faster CPU can take advantage of that memory parallelism just as easily. It doesn't have to only issue one request at a time, then wait until it is fulfilled. It can shoot off four requests at a time and wait for them all to come in. Indeed, "brawny" CPU's tend to also have "brawny" memory controllers that can support more simultaneous requests.

<comment><USER3> I agree with everything except for "just as easily". It's trivial to extract memory parallelism from separate instruction streams and heroic to impossible for a single stream. Think processing 1000 linked lists sequentially vs processing 4 groups of 250 lists each. Which OOO CPU will parallelize the processing of 4 lists given a program processing 1000 lists serially?

Even "rather wimpy" cores - single-issue cores branded as in-order - can issue "outstanding loads" (issue a request, keep executing until the result is needed). It's way way better than nothing but it's also very far from succeeding as consistently as separate instruction streams.

<comment><USER2> > I agree with everything except for "just as easily". It's trivial to extract > memory parallelism from separate instruction streams and heroic to > impossible for a single stream. Think processing 1000 linked lists > sequentially vs processing 4 groups of 250 lists each.

You're not comparing like with like. Do you have one linked list with 1,000 nodes, or do you have four linked lists with 250 nodes each? Those are two different problems. The latter problem has 4x as much memory parallelism as the former one (and indeed, is probably the pedagogical example of explaining memory parallelism). A single out-of-order CPU with out-of-order memory pipeline can traverse four linked lists in parallel just as easily as four CPU's can do so sequentially. Just keep four cursors and advance each one in a round-robin fashion.

<comment><USER3> I specifically said "1000 linked lists" with an unknown amount of nodes in each.

"Just keep four cursors" - why four and not N? This involves rather ugly and not quite portable/"scalable" code (different processors can issue different amounts of outstanding memory requests). For a large N, you run out of register names for variables, and register renaming only gets you so far.

There are cases when ILP is easier to express than TLP and there are the opposite cases; it's not "just as easy" - in many cases one is much easier than the other. Having to keep multiple cursors is the perfect example when TLP is easier; consider the fact that different lists have different lengths, which a load balancing scheduler can take care of nicely without any programming effort and your single-threaded version will have trouble with.

</comment></comment></comment></comment><comment><USER4> That's not Amdahl's law in reverse, that's just Amdahl's law as applied to mulitcore. This was all worked out over a decade ago [1].

[1] M. Hill and M. Marty. Amdahl's law in the multicore era. Computer, 1998.

<comment><USER5> Two things, first the link is better:

[http://minds.wisconsin.edu/bitstream/handle/1793/60554/TR159...](http://minds.wisconsin.edu/bitstream/handle/1793/60554/TR1593.pdf?sequence=1)

And second that was done in 2007 (did they do an earlier version?)

Its worth a read.

<comment><USER6> This is an excellent reference, I also thought of it when I read this post. Here is the version from IEEE Computer. It's the same article, but has more colors. ;-)

[http://research.cs.wisc.edu/multifacet/papers/ieeecomputer08...](http://research.cs.wisc.edu/multifacet/papers/ieeecomputer08_amdahl_multicore.pdf)

</comment></comment></comment><comment><USER7> Do you define "brawny" via higher clock frequency or more internal logic (out- of-order execution,prefetching,etc) or both? I would say "both".

> Faster processors are exactly as slow as slower processors when they're > stalled - say, because of waiting for memory;

But they might not wait as often, because they have bigger caches, better prefetching logic, etc.

> Many slow processors are actually faster than few fast ones when stalled, > because they're waiting in parallel;

Only if your memory supports those parallel accesses. If the memory access is a bottleneck, they might just as well wait for each other.

> All this on top of area & power savings of many wimpy cores compared to few > brawny ones.

The "brawny" cores still have a lot of room to improve their power saving.

This fight is not over. I believe reality just stay complex and the answer will be "it depends" forever.

<comment><USER3> Of course this fight is not over, and I agree with your points to some degree or other (especially "they might not wait as often" - memory access being the bottleneck is in my experience less likely for a moderately sized multi-CPU system; and as to room to improve power savings - muscle needs calories :)

In fact my point was only that fight is never over, as a counterpoint to "brawny cores beat wimpy cores most of the time" - not that the reverse statement is true.

</comment></comment><comment><USER8> This isn't correct because in either case you're almost certainly sharing the same memory controller, which still has to service requests one at a time (if they are randomly dispersed in memory). Furthermore if the memory access takes long enough the single-core can context switch to another process and run non- blocked instructions there. The 4-core version doesn't magically have 4 times the memory pipelines, and the 1-core version won't stupidly sit waiting for a memory access to return.

<comment><USER3> You don't need 4 times the memory pipelines. If you have one pipeline and cores issue few enough requests for _bandwidth_ to not be a problem, then contentions between cores only cost you 0-3 cycles of _latency_ , which is a tiny cost compared to DRAM latency these days.

A more relevant factor is how many banks the DRAM has compared to how many cores are issuing bank-missing requests in parallel.

</comment></comment><comment><USER9> Other than scrypt it's hard to find examples of such memory-hard code.</comment>


Rails Testing with Factory Girl - <AUTHOR> http://www.hiringthing.com/2012/08/17/rails-testing-factory-girl.html <comment><USER2> I hate when people are using it in the unit tests. It just makes testing very convenient, so they start using it everywhere. In the end, the test suite gets very slow. Unit tests should not hit the database.

First example there: test_new_customer_defaults. Really, it needs 3 saved models to test this? FactoryGirl isn't solution here. It's just hiding the problem.

<comment><USER3> If I could upvote the parent any harder, it would hit orbit.

If you need a complex network of collaborators to test a method, the answer is not to obscure the creation of those collaborators, it's to refactor so that each object talks only to its immediate neighbours, and then stub the heck out of them. If it absolutely has to be something that acts like an ActiveModel, then use mock_model().

<comment><USER4> And I'd upvote it to Mars. FactoryGirl is completely an anti-pattern, unless maybe you're doing acceptance testing, but you know even then I wouldn't want FactoryGirl in my codebase, people would be too damn tempted to use it everywhere.

<comment><USER5> That's where we find ourselves currently: constructing 3-4 levels out due to Law of Demeter violations, and it becomes incredibly brittle when seemingly unrelated classes change.

IMO, DHH (and others) argue too hard against core OO principles (like SRP and LoD) that have the possibility of helping out when the domain model becomes more complex. "Just use Rails" is fine when spinning up, but as the app grows, it becomes increasingly less pleasant. Coupling increases in the name of less code.

Ideas like hexagonal architecture look nice, but I'm left wondering how to implement them when the framework insists on infecting core domain classes (AR::Base).

<comment><USER6> As an FYI to your last point - in Rails master (which will be Rails 4), you can active-record-ify a class by including ActiveRecord::Model, rather than inheriting from ActiveRecord::Base. In fact, that is all ActiveRecord::Base does itself - [https://github.com/rails/rails/blob/master/activerecord/lib/...](https://github.com/rails/rails/blob/master/activerecord/lib/active_record/base.rb#L324).

<comment><USER5> But your core domain classes are still coupled to their persistence mechanism in the name of 'pragmatism.'

<comment><USER6> Who says they have to be? That's a design decision. There is literally nothing (besides maybe inertia?) that enforces that "rule".

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> A response from a naysayer:

 _Factories are slow._ Yes, they really are. Persisting everything along a chain of associations will _always_ be slower than properly isolating the dependencies of the unit under test, SSD or not. It's easier to enjoy Ruby when not constantly waiting minutes for tests to run.

 _Factories increase the over-all complexity of your app._ Are you kidding me? Yes, they _do_. Expertise and huge, easy gains have nothing to do with reducing complexity and more often (but not always) increase it. A test suite where every test depends on state in a database is more complex than one that tests units in isolation.

None of these points are arguing against Factory Girl, which is a great tool for doing what it does; they are arguing against integrating with the database in "unit" tests.

</comment><comment><USER7> As a guy who recently switched from years of ASP.Net MVC to Rails, I read this post and wanted to shout...

"Watch out everybody, he's hitting the database!!!"

Ruby is a great language that I love, but this is one of those cases where Ruby's conciseness and readability hide a TON of complexity. And complexity in tests is death.

I've seen it for myself -- there's a lot of technical debt interest in those tests. It looks manageable at the beginning, especially within the scope of a blog post, but when the app grows and grows and grows, the tests fail.

</comment><comment><USER8> To get the best form both fixtures and factories, I can strongly recommend <http://github.com/rdy/fixture_builder> It utilizes factories to build up your fixtures. This way you only need to specify what you actually care about in you r fixture which preserves readability. But you still get the speed of fixtures. The one downside is that you can never assume a complete knowledge of what's in your DB. This might break test for scopes for example.

However I more and more agree with the general notion that your unit test should not hit the DB. However, Rails works against that. Avdi Grimm's "Object's on Rails" (<http://objectsonrails.com/>) has some interesting suggestions on how to get some good test isolation out of Rails.

</comment><comment> rob-anderson Factory Girl has saved me countless hours - I love it.

You can use build instead of create to avoid the db, as per previous comments. You don't have to use it at all if writing a simple unit test.

But for teeing up complex scenarios prior to a fat integration test, it rocks.

</comment><comment><USER9> I'm coming to the later stages of implementing an MVP with Rails and for me, FactoryGirl and RSpec have been a godsend.

</comment><comment><USER10> Old news!

</comment><comment><USER11> Yea, once your model gets more complex than a dozen or so objects, then something like this is awesome. I only with there was an equivalent in ASP.Net MVC which is the current bill payer. (Plant is the closest I've seen, but not quite as elegant, and I'm a little concerned over support).

<comment><USER12> How is this different to mocking frameworks like RhinoMocks or the new Microsoft.Fakes?

<comment><USER11> You're creating an actual instance of that object preloaded with whatever you need rather than a mock of that item which implements a fake implementation. They're not really competing since Mocks are most useful when mocking an interface, and Factory Girl is best at creating a number of usable objects.

</comment></comment></comment><comment><USER13> Factory Girl is good but Fabrication is far better.</comment>


San Bruno seeks housing, then rejects it: 'I don't know what you can get passed' - <AUTHOR> https://www.sfchronicle.com/bayarea/article/1-council-vote-kills-San-Bruno-housing-plan-near-14112359.php <comment><USER2> The article touts this as "near" BART and Caltrain, but it's _1.4 miles_ to BART, and most BART users won't walk that 3 mile round trip... which means adding traffic. It's also .7 miles to Caltrain.

<comment><USER3> I used to be able to take BART to work. Half hour each way. But it was also a half hour walk each way on both sides. So total commute was 3 hours.

So there is a good reason why there is a push to force cities to allow multifamily developments within quarter to half a mile of mass transit. Personally I don't think this can be mitigated on the city level. Especially in a fractured metro like the Bay Area. You have six counties, three major cities and two dozen small cities and towns.</comment></comment>


"Hey team, I'm taking today and tomorrow to focus on my mental health." - <AUTHOR> https://www.attn.com/stories/18200/how-email-helping-break-mental-health-stigma <comment><USER2> Not exactly revolutionary, as I had an HR generalist tell me twenty years ago: "yeah, we all need a mental health day from time to time." when I made some mention that my sick day involved neither sickness nor a doctor visit.

That said, kudos to the parties involved for bringing it out into the open- source and an "approved" rubber stamp from the CEO.

</comment><comment><USER3> We have something called 'Fuck It' days that allows any member of the team to walk out and have day to get back on track. We have almost unlimited of these (at line manager's discretion) who intervenes if you take too many which indicates an underlying problem. It works for mental health and a whole host of other purposes. For me this is the best perk ever, i have availed it 2 times in the last couple of years, both times it made a marked change to my mental state. It is amazing to get up and go 'fuck it' i am going to movies instead and be able to do it with zero emotional baggage.

</comment><comment><USER4> Wow that site had a in page pop up that covered the entire page. Seems fitting for a site named "attn".</comment>


Who Stole the Four-Hour Workday? - <AUTHOR> http://www.vice.com/read/who-stole-the-four-hour-workday-0000406-v21n8 <comment><USER3> People who don't work at all. That's the choice (maybe more like outcome) the society went with. For what might the first time in history, the rich are working more than the poor[1] and labour participation rates are dropping[2].

In many ways this is a superior alternative. Children don't work. They used to. People spend a lot more time in school at the beginning of their life when it has the potential to have the biggest impact. It's not all bad. Although not quite living up to the dreams from 20th century either.

There's also something to be said about positional goods. A lot of people are driven by status and they work to be ahead of others. Elizabeth Warren believes that this explains why, despite technological progress, regular middle class family needs two incomes where one was enough a couple decades ago[3], they're competing for the same house, or school district. It doesn't explain everything but it's a factor.

[1] [http://www.economist.com/news/finance-and- economics/21600989...](http://www.economist.com/news/finance-and- economics/21600989-why-rich-now-have-less-leisure-poor-nice-work-if-you-can- get-out)

[2] [http://equitablegrowth.org/2014/08/18/equitable-growth- make-...](http://equitablegrowth.org/2014/08/18/equitable-growth-make- confused-cyclical-recovery-monday-focus-august-18-2014/)

[3] [http://www.amazon.com/The-Two-Income-Trap-Middle-Class- Paren...](http://www.amazon.com/The-Two-Income-Trap-Middle-Class- Parents/dp/0465090907)

<comment><USER4> I think competition is the main villain here. Zero-sum games, prisoner's dilemmas, arms races and tragedies of the commons stole the four-hour workday from us, and many other good things besides. A nice toy example is "20% time" at companies like Google, which tends to evaporate as soon as your performance evaluation compared to your peers becomes tied to your performance at your main project.

The only solution to competition is centrally enforced precommitment. First, the government should actually enforce the eight-hour workday. Then it should reduce the workday, for all employers at once, so no one can get ahead by cheating. I don't see any other solution.

<comment><USER5> > The only solution to competition is centrally enforced precommitment. First, > the government should actually enforce the eight-hour workday. Then it > should reduce the workday, for all employers at once, so no one can get > ahead by cheating. I don't see any other solution.

This would not really be a solution. All it would result in is more people taking work home, because job evaluations would still be based on how much progress one made on the primary project. To get ahead and get that next promotion, many people would still feel compelled to work extra (unreported) hours. I suspect a madate such as what you propose would simply push the long work-days into being unreported.

This is basically what happens in graduate school (in the US, at least). I just finished a PhD program; as part of our contrats students agreed to only work 20 hours per week. There is no way one could finish a dissertation working on 20 hours per week, so everyone worked longer hours. Sure, you could complain about how many hours you worked (and some people did), but that did not change the fact that only 10–20% of Astronomy PhDs get faculty jobs, so if you want that faculty job, you need to put in the hours to do great research, regardless of the mandated 20 hour limit.

<comment><USER6> Do you think there /is/ a solution to the problem? Or is this just one of the side effects of capitalism?

I'm not trolling here...just curious. My own mind tends to go in the direction of the parent, but, I also see how enforcement would be next to impossible.

<comment><USER7> I think you're trying to solve a wrong problem. Work isn't a problem. Work is what propelled humanity to explore, understand and conquer the world around us. Human work is a requirement for the development of medicine, greener technologies, safer transportation and even space exploration and colonization.

If there are any problems about work, they are about making it more enjoyable, making good work more widely accessible and distributing the proceeds fairly.

<comment><USER8> That is the exact problem with the 4 hour workday and other forms of part-time work. As I've heard many people describe part-time work : 40% of the pay for 80% of the work.

Until that changes, I would not expect part-time work to happen for anyone but really high up managers where such a trade may actually make sense.

</comment></comment></comment></comment></comment></comment><comment><USER9> Capitalism`s greatest strength is also its greatest weakness. The profit motive is so strong that it often ends up creating irrational scenarios such as the economic situation we have today.

European countries seem to have struck a far better balance by harnessing the profit motive of capitalism while preventing disasters such as for-profit healthcare, for-profit education, for-profit government policies (for the rich), for-profit prisons, etc.

It is fascinating how powerful cultural and institutional momentum can be. I regularly run into very intelligent and rational Americans (particularly on HN!) who defend American institutions (e.g. healthcare) in spite of all the widespread data about them being massively inefficient.

In the end, we reap what we sow. The profit motive brings great riches, but to a tiny few. The rest, sadly, often become the servants who enable the lifestyles of these outliers. Conversely, the outliers become the American Dream, seducing the average worker ever onwards with promises of riches and comfort just a few lucky breaks away.

<comment><USER10> Please explain how for-profit education is a disaster. By all measures, private schools in the US are superior to public schools, and the US's private universities are consistently rated best in the world.

You also can't generalize about e.g. for-profit healthcare based on the American situation, because the regulatory environment is so extreme as to have to created a government-controlled crony-capitalistic oligopoly. The for- profit healthcare in less regulated countries like Mexico is inexpensive and amazing.

<comment><USER11> I can only assume the parent is blaming the spiraling cost of education on Capitalism, when in fact it's the perpetually increasing federal loan guarantees spurring massive inflation that is the root of the cause.

The spiral in healthcare was also caused by the government taking over the industry in the late 1960s. No coincidence both industries began to skyrocket in cost at exactly the same time, shortly after Nixon ended the gold standard, and the Fed acquired free reign to generate immense inflation and aggressively tamper with interest rates (spurring the cheap consumer debt boom of the past 40 years).

Everyone recognizes that healthcare and education became very expensive recently. Nobody seems to ask what changed in the last few decades to cause that. They act like Capitalism didn't exist in 1960.

<comment><USER12> _The spiral in healthcare was also caused by the government taking over the industry in the late 1960s._

I'm guessing that you're referring to the introduction of Medicare and Medicaid in 1965, which is hardly "taking over the industry".

</comment></comment></comment></comment><comment><USER13> Poor negotiation and group think stole the 4 hour workday.

I've seen companies where you can have 2 devs working on the same project, one making say $30,000-40,000 and one making like $60,000-70,000. They do the same work, but have wildly different valuations because of their ability to negotiate.

If people negotiated higher rates and fewer hours, that is entirely possible to achieve and eventually could be the norm, but most people don't negotiate for anything. They think an extra $2,000/yr. is a big win, but then turn around and work an extra 10 hours a week at a job they hate.

The value in unions was that they would negotiate harder than individuals will. They perhaps outlive their usefulness and aren't great as an entity that should last forever because demanding more money every year doesn't always work if the company isn't having a good year, but the point still stands that lack of negotiating power is a problem.

C levels executives make outsized amounts of money because of 2 things - <USER2> higher you get in an organization, the better you probably are at negotiating (otherwise you wouldn't make it to the top), and many have agents that negotiate on their behalf (just like pro athletes).

I'm not an expert at negotiation, but I do know that the people who know how to negotiate well can get wins that the average person can't comprehend. A lot of people could negotiate their way into a 4 hour workday if they tried, they just don't know how.

<comment><USER14> It puzzles me how Americans don't want to discuss how much they make with coworkers.

<comment><USER13> Well, bosses have been known to threaten to fire workers if they are found to be discussing how much money they work. People act as if it would be impossible to work at a company where people could know what other people make.

Yet, public school teachers have a pay schedule that is pretty cut and dry, government workers' salaries are public record, etc. Somehow people manage to work those jobs without any kind of mutiny due to freely available information. I'm sure there are other companies where this works out just fine.

Mostly, companies take advantage of the information asymmetry to pay as little as they possibly have to. It works for them as long as people don't find out their getting screwed. If people find out, they negotiate better. Ultimately, that probably leads to people getting paid better or getting a better paying job.

If companies just took care of the employees well to begin with, it wouldn't matter if people knew how much other people were getting paid. At the end of the day, it's a problem of greed, and that's an unsolvable problem as long as humans are involved.

</comment></comment></comment><comment><USER15> This is not well thought out: "If everyone worked fewer hours, for instance, there would be more jobs for the unemployed to fill. The economy wouldn't be able to produce quite as much, which means it wouldn't be able to pollute as much, either; rich countries where people work fewer hours tend to have lower carbon footprints."

The economy is not a zero sum system, almost by definition. Working less will not mean more jobs are available. In fact, lower economic output may reduce the number of jobs available significantly.

Also, correlation does not imply causation. Modern societies with lower carbon footprints are those with smaller industrial/shipping industries and good public transit. That probably correlates pretty well with reduced working hours, but selling this a ecological alternative is a bit of a stretch.

</comment><comment><USER16> I prefer to think about USA as no-vacation-nation. Just because it's good to think that there a lot of guys working 24/7 and if you don't do so, you are retired.

You can't do the smart work more than 4 hours a day, right, maybe it's just beyond energy exchange capacity in our brain that support extra concentration.

But everyone have a lot of a dumb work, documentation, settling professional conflicts in mail, pinging standstill tasks, routine refactorings or other forms of small product polishing, whatever.

I'm not sure that the 4 of "smart work" is including all those 20% of work giving 80% of value, its sounds funny but sometimes you have too much energy to do very valuable routine.

If you have predisposition to depression (as i do) you can liberate your own time and just waste it to extension your depression experience. Wow it's really worth it.

Depression is just negation of any actions. When external factors is punching your arse its hard to negate. When not, welcome to slow way down.

<comment><USER17> How is documentation dumb work? Explaining technical concepts clearly is hard.

<comment><USER16> Sorry, i don't want to injure any of the technical writers. They are the only guys keeping big projects from informational collapse. Moreover, they are some kind of project detectives, collecting clues about how this pile of __* actually works.

But if you are making something, you have to make some pieces of human- readable information about it and the poor quality is significantly better that no internal documentation at all. That the way developer or manager can help real technical writer.

Also you can express your thoughts in short notes, schema drafts, checklists, documenting your mindflow. It's very usable and nearly impossible to delegate. You can steer at the lines and rectangles or lists, looking for missing points or removing redundant. Not hackworking, just harmonizing the details because it's odd to have time to polish shoes and no time to polish work.

</comment></comment></comment><comment><USER18> Maybe the stuff we want to buy has gotten increasingly expensive. College, phone and internet, all on a stagnating wage.

<comment><USER19> Depends on the place. Phone & internet is not it, but college, rent, cars & health care are.

<comment><USER20> I guess it does depend highly on lcoation. I live in Vancouver, Canada. For my fiancee and I, our cell phone bill comes to about $150/m and internet is $40. That alone is $1,200 a year.

Cars are another expense that's gone up substantially over the last 20 years. We pay $140/m in insurance and at $1.40/L gas, at least $150/m in gas. That's $3,500 a year not including servicing (minimum $100 every ~3 months) or car payments ($280/m). All in, just owning a car costs us about $7,200 a year.

<comment><USER21> A year ago in Vancouver, I was paying $28 a month for cell, $30 for wired broadband internet, and $81 for a transit pass ($91 now).

But if you want to spend a lot of money, cars and Canadian telecoms definitely make it easy.

<comment><USER20> Transit is alright in Vancouver, but not sufficient for a small family. I live in North Delta and work downtown Vancouver. I have a 7 year old daughter that needs to be dropped off at school, and picked up from her Grandma's in Surrey. I also coach her soccer team and play myself. For the individual transit alone is typically sufficient, but as soon as you have certain responsibilities a car quickly moves into the 'necessity' column.

<comment><USER21> > but as soon as you have certain responsibilities

True, kids in suburbs aren't cheap

</comment></comment></comment></comment></comment></comment><comment><USER22> This could be done, but it'd need to be some kind of modern take on the old labor movement. People want 4 hour workdays, but they don't believe it'll change. Set up a site to allow people to specify their employer and essentially "opt-in", expressing their support for a 4-hour workday, but make it anonymous insofar as you'll only see a number of people at your workplace that share the same sentiment. There'd need to be some unique key to confirm that each person can only opt-in once. Compare the opt-in number to the number of employees reported on a company's tax paperwork, have the site get popular (whole project in itself unless there's good grassroots support), and suddenly you've got a nice obvious display of support within various companies for the 4-hour workday. Making it harder to ignore the will of the masses (or at least verifying that such a will exists) is a good start, I think.

</comment><comment><USER23> Universal basic income is the case that gives the rich, ruling class the maximum power over everyone else. Everyone gets dependent on government money, and it takes an act of Congress to increase the baseline pay.

<comment><USER24> If everyone would receive X money then X would be the new 0.

<comment><USER25> ... No. That's not how those numbers are related. Consider a case where I give every US citizen $500/mo, and a software engineer makes an additional $5000/mo. Then 11 unemployed persons have the same spending power as a software engineer, which is _markedly different_ from 0...

<comment><USER24> Wouldn't it lead to massive inflation making those $500 practically worthless? The engineer's nominal salary would rise meaning you would need a magnitude more unemployed persons to have the same spending power.

</comment></comment></comment></comment><comment><USER14> People "need jobs" to be able to "afford" things, so we have a lot of people basically generating work for each other, as per Parkinson's Laws.

</comment><comment><USER7> > "If every man and woman would work for four hours each day on something > useful," Benjamin Franklin assumed, "that labor would produce sufficient to > procure all the necessaries and comforts of life."

True, but I hope we aspire to more than necessities and comforts of life. If we worked more and directed the effort, Armstrong might be a name of a town 240,000 miles away.

</comment><comment><USER26> Four-hour workday is simple: do not marry and do not have a children.

<comment><USER27> and work part-time?

<comment><USER22> and have no hobbies?

<comment><USER28> And don't get sick.

<comment><USER29> And where do I find the employer who will let me work only 4 hours a day?

</comment></comment></comment></comment></comment><comment><USER30> The guy next to me stole it. And some pens from my desk too. If you see him, tell him to please return them. Thanks.

</comment><comment><USER31> so many people wanting stuff combined with far too many wanting someone else to pay for it.</comment>


Facebook Blames Lack of Available Talent for Diversity Problem - <AUTHOR> http://www.wsj.com/articles/facebook-blames-lack-of-available-talent-for-diversity-problem-1468526303 <comment><USER2> Meanwhile, this timely article posted to HN earlier today quotes Mark Zuckerberg thus:

<In 2007, a fresh-faced Mark Zuckerberg famously ruffled feathers among some older colleagues when he suggested that tech companies should not hire people over 30. "Young people are just smarter," the Facebook chief executive, then 22, told a crowd at Stanford University.>

[https://news.ycombinator.com/item?id=12097005](https://news.ycombinator.com/item?id=12097005)

Having 90% of your workforce be white and Asian between 22 and 35, and predominately male at that, is an odd definition of "diversity".</comment>


Ask HN: What HN-like sites do you visit? - <AUTHOR>

I love Hacker News. So much so that I can't get enough.
What other HN-like sites are out there? By HN-like I mean
A. Digg style submissions. B. Latest Internet technology. C. Web development. D. Hacker culture. <comment><USER2> I've been pretty fascinated with the IAmA subreddit lately.

<comment><USER3> I want to figure out how to get that out of my rss feed. I think that subreddit is destroying the place....

(and I know how to turn it off my front page, just not the rss feed).

<comment><USER4> I use Yahoo Pipes to filter feeds from reddit. Works pretty well for me.

</comment></comment></comment><comment><USER5> Some times I go to the programmer Reddit but 9 times out of ten the page is close enough to identical to HN new that I just check here.

</comment><comment><USER6> Stack Overflow - it might not fall into all of your above categories but I frickin' love that site! :)

</comment><comment><USER7> Engadget, Hack a Day, Hacked Gadgets for my hardware news, but it's pretty tough to beat HN. You can always use an RSS reader and sync with all of the blogs that get most often linked to here.

</comment><comment><USER8> New Mogul is my #2 visited site... when nickb remembers to reset the server ;). HN for macroecon/stock trading/fed bashing

</comment><comment><USER9> Lambda the ultimate forums.

</comment><comment><USER10> I wrote a HN clone for .NET developers: <http://www.managedassembly.com>

</comment><comment><USER11> I try to visit prog.reddit every week or so. But I find most comments there to be highly annoying and child-like.

</comment><comment><USER12> I think HN has their niche covered.

</comment><comment><USER13> Arstechnica, RWW, Mashable (less frequent), Twitter (if I may say it), LWN

</comment><comment><USER14> Off the top of my head, dzone.com

</comment><comment><USER15> <http://moobunny.dreamhosters.com>

it was better years ago, but still..

</comment><comment><USER16> Gizmodo, TechCrunch, Hack a day, Yahoo technology page, and techzing for their podcast.</comment>


The Painful Truth About Snowden - <AUTHOR> http://20committee.com/2015/07/19/the-painful-truth-about-snowden/ <comment><USER2> There is no truth in this article, only conjecture by someone who clearly has a grudge to bear. For all we know, the author (un-named) of this article is working for Russian intelligence right now, by trying to paint Snowden as anything less than a concerned and patriotic citizen of the United States.

Everyone who works in the spy business has something to hide - and therefore, you really can't trust anyone who works in the spy business. Patriotic jingoism might work 80% of the time - but there will always be folks who can read between the lines and are unwilling to just put up with the state of affairs because some Authority told them it was so.

This article is full of authoritarian indoctrination. "Anyone who has worked in CI knows..", "as anyone who knows anything about intelligence can tell you..", "I've worked as an expert in this field for years" (and yet remain an un-named author), etc.

Be careful as you read this article, that your buttons are not being pushed. Of course, we know that the USA and Russia are engaged in an ideological war with each other - and of course, we know that there are reasons for all the secrecy.

But the fact remains that the US government, which is supposed to be democratic and representative of the desires of its people, has given itself unsavory powers that bring the world every closer to its destruction, in the name of its own 'safety'. "All countries do this", you will hear them say - "but then, what good are they?" will be the reply. And the answer is: if you're going to spy on the worlds population, unhindered and uncontrolled by anyone by your own agency, and use that power for your own wealth and survival, then, your country is no good at all.

<comment><USER3> He's not unnamed thats the personal blog of John Schindler.

He is a bit odd and crazy [http://blackbag.gawker.com/the-crazy-emails-that- took-down-n...](http://blackbag.gawker.com/the-crazy-emails-that-took-down- nsa-spook-john-schindle-1610203101)

But your comment is quite rhetorical and can be copied almost word for word as a reply to your statements as well.

Snowden's intentions are quite possibly altruistic, his actions however aren't well as white as snow (;)) you need to be really out of touch with reality to think that Russian intelligence didn't not debrief the hell out of him once he got to Russia, heck if he had sought refuge in Canada event he Mounties would have interrogated him, this isn't an opportunity any nation would ever pass.

Was he an asset? we never know, most likely not a direct one, did Russian intelligence contact him when he was in H&K and offered him a way out quite possibly.

</comment></comment><comment><USER4> Check out the rest of this guy's articles.

He has a very clear axe to grind and some of his other offerings are just insane.</comment>


Show HN: A simple note-taking app built in React - <AUTHOR> https://notello.com <comment><USER3> Is there a reason why typing is so slow? It seems like it's really chugging away on something as I type. I would guess there's a 500ms or so delay between hitting a key and it ending up on the notepad. Same goes for clicking to change the cursor placement.

<comment><AUTHOR> If you could tell me some of the specs of your system so I can check why it is so laggy that would be great.

One thing that is hacky/a problem with the app is that I wanted to be able to hash tag notes and have the hashtags a different color. Also very soon i'd like to add the ability to highlight text. It's pretty hard to do that smoothly even with the contenteditable attribute.

I decided on a transparent textarea over a div and I sync and transform the content. It is a bit clunky as you say but I anticipate it will get better.

<comment><USER4> Slow for me Mac Pro 2.6Ghz i5, 16GB ram, SSD.

Run a JS profile on your code, I think there's some performance bugs.

<comment><AUTHOR> Frustrating. Not able to recreate. There are some unnecessary repaints but can't see much other than that.

<comment><USER4> Fixed now - whatever you did worked.

</comment></comment></comment></comment></comment><comment><USER5> Does anyone else miss the days when you could right-click on any page and see what magical incantations drive what you see? I feel like modern Javascript pipelines and the drive for loading speed is endangering what used to be how we all learned Web technologies.

<comment><USER6> Everyone loves pagespeed and github far more fun than view source!

Are you suggesting you dont want things minified?

<comment><USER5> I'm not suggesting the solution to this problem is to abandon compression. I'm suggesting that we make "View Source" do what it says on the tin. Perhaps a "readable-src" attribute on the <script> tag.

<comment><USER7> That's what source maps are for. I only enable them for development, though.

</comment></comment></comment></comment><comment><USER8> Its fantastic. Simple on the one hand, but pretty sophisticated on the other.

A UI suggestion: When I am "in" a box, there should be a clear indicator of how to go back to the top level. The "x" for closing the box is a little too subtle, and possibly overoaded with "delete". I'd rather see a back arrow utilized. Hovertips helped of course.

I also think when your view is with the box open, then adding a note should by default add that new note to be a child of the box.

</comment><comment><USER9> Might be worth-while making the search case-insensitive - looks good, though!

EDIT: Hmm. I tried logging in with the token emailed to me using Safari - <USER2> worked. I then tried logging in using Chrome with the same token, and got this error: [http://i.imgur.com/D4j45c3.jpg](http://i.imgur.com/D4j45c3.jpg). I then tried going back to notello.com, but seem to constantly get re-directed back to the error page.

<comment><AUTHOR> Hmm, yea I made it so that each password token can only be used once in case someone gets a hold of your email. I can see how that can be annoying. I'll work on a solution to that. Thanks for the feedback.

<comment><USER10> If someone gets a hold of your email, they could easily request another login token anyway. I think it's fine if it doesn't expire.

<comment><AUTHOR> Now I remember why I made it expire and/or only usable once. Consider public places or caching. Since the temporary authentication token is exposed in the URL there is a risk that someone else can reuse it. Whereas if it's a one time temporary token then you should be OK. I think I need to be more explicit in that this is a one time token. The whole passwordless thing is new so there are some pain points.

</comment></comment></comment></comment><comment><USER11> When I have a box open with a single file, I don't see my current file, which is out of the box, in the top bar.

Upon closing the box, the file appeared. Felt confusing to me.

Example: [http://imgur.com/QKBr3lb](http://imgur.com/QKBr3lb)

Looks fancy, but I think the animations are too much/long for frequent / intensive usage.

</comment><comment><USER12> Doesn't seem to work on android. Can't even type a title.

<comment><AUTHOR> Can you hold the title box instead of tapping to see if that allows you to type? Not sure why that is the case.

<comment><USER12> Works.

</comment></comment></comment><comment><USER13> I really like your animations! What library is that?

My only concern is that you call this a "simple note taking app". Taking a look here: [https://github.com/asm-products/notello](https://github.com/asm- products/notello) it's anything but simple! Not only are you selling yourself short but to a user new to react, they might think "Great, I can learn from this!" and it's actually quite complicated!

I've been doing JS for many years and you're the first project I've seen with a "gulp" folder for example! I still don't even know what that's for (vs a gulpfile.js).

I think I would just say "Notello: A note taking app" :)

<comment><AUTHOR> Point taken. The animations are just pure CSS3 although the fades still use jQuery. I got the gulp folder idea from this blog post as a way to decouple gulp tasks from individual projects: [http://viget.com/extend/gulp-browserify- starter-faq](http://viget.com/extend/gulp-browserify-starter-faq)

</comment></comment><comment><USER14> This is great! Also, much thanks for making the source available.

Quick question - I can see that you're using Facebook flux as a data flow library in your app. Is there a particular reason you chose not to try the, albeitly simpler, Reflux / Alt etc? I'm working on a decent sized React app myself and would love to know your thoughts on this.

Thanks and great work!

<comment><AUTHOR> I honestly just wanted to try flux. I ran into some problems with my architecture however and maybe reflux would of helped me simplify it. I think you made a fine choice.

</comment></comment><comment><USER15> The note text box breaks iOS autocomplete support. It's doing something funky where the keyboard api can't recognize previous words. May want to consider just using a native text box instead of something custom and funky with JavaScript. Will probably resolve the typing performance issues others have mentioned.

</comment><comment><USER16> Looks nice.

You should add `-webkit-backface-visibility: hidden;` to the elements that have that weird shifting behavior, such as your `.modal-form-wrapper`. Pretty much anything you've done a non-3D transform on.

</comment><comment><USER17> I'm a bit conflicted - I actually quite like both the skeuomorphism _and_ the 3D transitions separately, but the two in combination doesn't really make much sense to me!

<comment><AUTHOR> I hear you. It was actually supposed to be like you're looking down at a desk and then seem as if you were moving your head up at the bookshelf. The bookshelf doesn't move so it's a bit odd right now.

<comment><USER18> BTW, thanks for not going completely flat.

</comment></comment></comment><comment><USER19> also: [http://todomvc.com/examples/react/#/](http://todomvc.com/examples/react/#/)

</comment><comment><USER20> One of the things I'd like to learn next in React is animations / transitions. Got any tips on how you did yours?

<comment><USER21> The CSSTransitionGroup component that comes with the React "addons" is very useful.

</comment></comment><comment><USER22> After editing the default note, I am unable to create a box.

\- Firefox 36.0.4, Windows 7. Let me know if you need additional information.

</comment><comment><USER23> \- Click on the top left icon to see some animations.

UX issues:

\- I couldn't exit a box; (is done by pressing the x in the box)

<comment><USER24> After you open that bar, click on the title area, drag up while still holding and release outside the wooden desk. Now you can continue typing the title with the view in perspective, and see it update live in the title of the file.

</comment></comment><comment><USER25> React is currently #1 on my list of things to learn. Any chance this is open source?

<comment><AUTHOR> I was developing it on assembly and therefore there's this repo: [https://github.com/asm-products/notello](https://github.com/asm- products/notello). It's quite a few commits behind so there's probably tons of bugs but at least it's a start. I'm still learning this stuff myself.

</comment></comment><comment><USER26> FYI, this app just crashed Firefox 33 on Ubuntu 12.04.

<comment><USER18> What video card/drivers? Open source or closed binaries? It's working great for me on Debian 7 (wheezy), which is similar to Ubuntu 12.04, w/ non-standard Firefox 38.0a2 Dev Edition and nvidia/GL closed-source drivers.

</comment></comment><comment><USER27> What is the size overhead react adds to an app?

<comment><USER28> React is 121 KB minified. Compare to JQuery at 84 KB, Angular at 125 KB, and Ember at an impressive 408 KB.

</comment></comment><comment><USER29> looks pretty. how do you get something out of a box? drag and drop looks like box can be placed inside other box but it cant.

<comment><AUTHOR> I still have to implement that. Not sure how to represent that in the UI yet. Maybe drag it back to the open box. Not sure yet.

</comment></comment><comment><USER10> Love the password-less login!

<comment><AUTHOR> Thanks! I'm sticking to it. Why trust anyone with passwords these days. I may add social logins though.

</comment></comment><comment><USER30> Looks pretty slick! Nice job!</comment>


36 Days of Type - <AUTHOR> https://36days.reflektor.digital/ <comment><USER2> Reflektor is doing some great & innovative WebGL work.

Shameless plug: this was using canvas-sketch[1] to build out some of the sketches.

[1] [https://github.com/mattdesl/canvas- sketch/](https://github.com/mattdesl/canvas-sketch/)

<comment> 52-6F-62 I did notice the name and logo were awfully familiar, though.

[https://lh3.googleusercontent.com/proxy/MMOg-_aR48tAdBU- crlM...](https://lh3.googleusercontent.com/proxy/MMOg-_aR48tAdBU- crlM10dhWLSHMxTZiQvmQ0KcYJhSOtGq4yrnD1HrqgDosbP3vTlkF5FPkQT1U-x8HysTJDAmekP9c3xLFNyVFp29rl6RsTIcjrtf)

[https://en.wikipedia.org/wiki/Reflektor](https://en.wikipedia.org/wiki/Reflektor)

It's not the exact same, but it's really uncanny.

They appear to be Canadian judging by some of the clients, so maybe it was intentional?

</comment></comment><comment><USER3> Why do contemporary designers fall for the following trends over and over:

\- Magenta/Purple colors \- Gradients \- Large Typography \- Animations \- Hijacking scroll \- Excessive use of white space

This seems the trend these days.

</comment><comment><USER4> Sadly, some of those shot my GPU (not exactly the newest one), requiring a full restart.

(The dilemma of WebGL & Co: either we need better bound checking, which somewhat neglects the point of having fast graphics, or we're living dangerously.)

</comment><comment><USER5> > Pleased visit on the desktop.

Moves into another Website.

<comment><USER6> I agree that nowadays everything should be responsive, however I feel discarding someone else's effort when they are mentioning that the site is for desktop, is inconsiderate.

Also, if you're browsing sites which reach the front page of HN, the same way you visit other social sites, I think you're already in the wrong company.

<comment><USER7> I got the message on my desktop. Because my monitor is configured portrait, not landscape.

When I stretched the browser into a second monitor, it came to life.

So it's the browser window dimensions, apparently. But it was still unnecessarily restrictive.

<comment><USER8> Same for me with the browser occupying the right half of my screen.</comment></comment></comment></comment>


Java 4-Ever trailer - <AUTHOR> http://www.youtube.com/watch?v=A1zySeNpW20

<comment><USER2> It's been a long time since Java was the future.</comment>


Mountain lion P-61 known for freeway crossings and surviving Woolsey fire, dies - <AUTHOR> https://www.latimes.com/local/lanow/la-me-ln-p64-dead-20181207-story.html <comment><USER2> is there an EU friendly source?</comment>


Little Snitch 4 released - <AUTHOR> https://blog.obdev.at/little-snitch-4/ <comment><USER2> This was released a couple months back, and already discussed on HN. Good release - the UI and taskbar visual improvements are nice. The map view is cool, but not sure how much practical value it added.

<comment><USER3> Previous discussion of new features: [https://news.ycombinator.com/item?id=14628332](https://news.ycombinator.com/item?id=14628332)

<comment><USER4> Oh, how I'd love a FOSS, cross-platform, OS-wide, uMatrix-like, firewall!!!

</comment></comment></comment><comment><USER5> I'm sure this has a handful of legitimate users for privacy purposes but I'm genuinely curious how minuscule that user group is vs. the massive user base for piracy, preventing apps from 'phoning home.'

I mean, back in the MSJ days, this was 'the tool' for Mac piracy. It may have more legitimate uses now, but that's how I remember it from back in the day.

And doesn't MacOS' more current built-in firewall potentially take care of a lot of what this would do?

<comment><USER6> Wouldn't know about the piracy bit, but no, MacOS has no built in service even remotely as capable as Little Snitch.</comment></comment>


Show HN: Launched my first react app (to track your spending) - <AUTHOR> https://budgt.eu <comment><AUTHOR> Hi everyone. I just wanted to show you my latest side project. It's a small React app I built to learn reactjs.

I ended up learning quite a bit more as it turns out, notably CouchDB and it's javascript implementation, PouchDB. Some great tools for what I wanted to do: a web app that doesn't care whether I'm online or not.

I initially wanted to track my own spending, so I built an even simpler app that only worked on my computer localhost, and I often forgot to save a purchase when I only had my phone handy.

Now I can track everything I spend, wherever I am !

Let me know what you think.

By the way the code is here: [https://github.com/jfoucher/budgetTracker](https://github.com/jfoucher/budgetTracker)

It will probably look awful to experienced react users, but please let me know what you think, feedback is the only way to grow.

Thanks again !

</comment><comment><USER2> Pretty neat to see you bring it full circle from learning React to deploying something.

I like the colors.

It'd be nice if the side menu closed when you clicked or tapped outside of it.

I saw you were storing a component in state, for the alert, it's something I don't see very often. Where did you pick that up?

<comment><AUTHOR> Thanks for the comments.

Yeah I think having the sidebar close on click away would be nice, definitely something that needs to be done.

Regarding the component stored in state, it just came out that way I guess ! Is that considered bad practice ?</comment></comment>


Dear J. J. Abrams, here's how to make Star Wars great again - <AUTHOR> http://www.loopinsight.com/2013/09/27/dear-j-j-abrams-heres-how-to-make-star-wars-great-again/ <comment><USER2> Want to make Star Wars great again? Don't put a hack like JJ Abrams in charge of it!

I'm one of the many who would love to see our beloved Star Wars in Joss Whedon's hands. Sadly (or not), he's busy with the Avengers, and I can't see Lucas being comfortable with him anyway. But wow, someone who can write ensemble cast work like that could do wonders with Star Wars.</comment>


Conversational Speech Recognition System [pdf] - <AUTHOR> https://www.microsoft.com/en-us/research/wp-content/uploads/2017/08/ms_swbd17-2.pdf <comment><USER2> So, for people that aren't aware:

There are a couple big shops that publish papers like this every year. The sole reason they do so is so that they can tell their managers and potential professional services customers that they have "the best ASR system". It's BS.

IBM and Microsoft are among the most guilty.

If you're seriously interested in ASR state-of-the-art performance, "systems" papers like this are largely nonsense. Usually they spend most of their time tuning hyperparameters to small publicly available datasets, to the point that the model will often not generalize well to real world settings because of how aggressively they've overfit the benchmark set.

<comment><USER3> I do find it strange that their test WER is uniformly lower than their devset WER. I would expect validating on the devset to lead to the opposite effect, where the model overfits to the devset and performance degrades during test.

Or do you mean by "tuning hyperparameters to small publicly available datasets" that the datasets do not have enough real-world variability and can be fit too easily? Are there no large, realistic datasets or are those just not available to the public?

<comment><USER2> Even though they'll use the dev set to tune hyperparameters, they'll end up making a "is this a good model for the paper" decision based on the test set. So, e.g., they'll try different architectures, tune hyperparameters on the dev set, then decide whether to use that architecture by looking at the test set. So that's part of it. AKA "gradient descent via grad student"

The other part is, as you say, relatively constrained data sets.

</comment></comment></comment><comment><USER4> We're so close to voice recognition being perfected but we can't seem get over the final hurdles for everyone to use it.

Is it simply a matter of collecting more data?

Google is collecting more voice data in Docs.

[http://www.pcworld.com/article/3038200/data-center- cloud/how...](http://www.pcworld.com/article/3038200/data-center-cloud/how-to- use-voice-dictation-in-google-docs.html)

And Mozilla is doing common voice:

[https://voice.mozilla.org](https://voice.mozilla.org)

<comment><USER5> I dislike the way Google collects AI training data for reCaptcha to the extent I often will not bother rather than log in to sites like Stack Overflow that use it. Common voice sounds like a much more open approach to which I would actually be interested in helping.

From this paper Microsoft are hitting similar accuracy to professional transcribers, so it may not be accuracy that's holding back adoption.

There also seems to be a trend away from voice interaction these days, I send messages far more than I talk to people by phone and I don't think I'm alone in preferring this in many cases. Having automatic transcription of voice messages might be useful, but I suspect privacy issues would prevent that becoming widespread without more trust in the companies providing these services.

<comment><USER4> I send more text messages these days too. However, I try to dictate them. Basic editing by voice is definitely needed.

</comment></comment></comment><comment><USER6> This is from oct 2016. Previous discussion [https://news.ycombinator.com/item?id=12736409](https://news.ycombinator.com/item?id=12736409)

Are you sure you didn't mean to link to this one [https://www.microsoft.com/en-us/research/wp- content/uploads/...](https://www.microsoft.com/en-us/research/wp- content/uploads/2017/08/ms_swbd17-2.pdf)

It just came out and is an update of the original 2016 system

<comment><USER7> Ok, we'll change to that. Thanks!

From [https://arxiv.org/abs/1610.05256](https://arxiv.org/abs/1610.05256) via [https://blogs.microsoft.com/ai/2016/10/18/historic- achieveme...](https://blogs.microsoft.com/ai/2016/10/18/historic-achievement- microsoft-researchers-reach-human-parity-conversational-speech-recognition/).</comment></comment>


Opscode Cookbooks - <AUTHOR> http://cookbooks.opscode.com/ <comment><USER2> Nice! I really need to look into Chef. I used to work with their CEO and he has some really good ideas on reliability and maintainability of systems.

Don't forget to check out his O'Reilly Radar Blog - <http://radar.oreilly.com/jesse/>

</comment><comment><USER3> Thanks for the kind comments. We're working on improvements to the site now. More information on packages is definitely in the works.

\- Barry

</comment><comment><USER4> Cool concept and a really nice implementation.

I would love to see some more information on the listed packages though</comment>


How DNS Works - <AUTHOR> https://howdns.works/ <comment><USER2> This is awesome! I know most of you guys know how DNS works but I didn't have clue. I knew what it did but not how it did it.</comment>


Infrastructure as Code, Part One - <AUTHOR> https://crate.io/a/infrastructure-as-code-part-one/ <comment><USER2> What I find unfortunate about infrastructure-as-code tooling is that a lot of the tooling isn't actually using code, but instead uses esoteric configuration languages. Indeed, the article refers to Terraform with its custom syntax.

Imho tools should use actual code (whether it's TypeScript or Kotlin or whatever) instead of reinventing constructs like loops and string interpolation.

Thankfully these tools are getting more popular, because frankly I can't stand configuring another Kubernetes or GCP resource using a huge block of copy/pasted YAML.

<comment><USER3> Could you name some of those code-based tools?

<comment><USER4> [https://www.pulumi.com/](https://www.pulumi.com/)

</comment></comment></comment><comment><USER5> Nice piece. Looking forward to Part II.

What I am missing (often, in these type of articles as well as in actual production environments) is the fact that if you develop (infrastructure) code, you also need to test your (infrastructure) code. Which means you need actual infrastructure to test on.

In my case, this means network equipment, storage equipment and actual physical servers.

If you're in a cloud, this means you need a seperate account on a seperate creditcard and start from there to build up the infra that Dev and Ops can start deploying their infra-as-code on.

And this test-infrastructure is _not_ the test environments other teams run _their_ tests on.

If that is not available, automating your infrastructure can be dangerous at best. Since you cannot properly test your code. And your code will rot.

<comment><USER6> I found that Kubernetes + minikube (or a variant of that) is a fairly straightforward way to handle this. Teams / developers can easily set up a local testing environment, product owners can QA that way, etcetera.

This of course depends on your level of lock-in with various cloud environments.

<comment><USER7> IaC tools often handle more than kubernetes, but agreed that k8s is a fantastic way to get reproducible behavior which is absolutely imperative for testing.

This is kinda why I love Google Cloud and don't see myself moving to another cloud provider until they match GKE. I want all developers to throw everything into GKE, and Operations manages only the VPC's, firewalls etc. Developers get complete ownership over compute (and networking within the cluster) while broader network management can still be managed by an operations team.

</comment></comment></comment><comment><USER8> Nice article! What Crate advocates here might be common sense to a lot of people here on HN, but I can assure you that there are lots of people in leading positions out there who has no clue about this paradigm. Hopefully some of them will read this article.

<comment><USER9> I might be one of those people that doesn't completely grok IaC yet. I understand the necessity of configuration tools such as Ansible, I wouldn't live without it, but in the case of my company (~15 apps, 20 servers) I still don't understand the use case of orchestration tools such as Terraform.

All our servers configuration is managed through Ansible, apps are containerised and run on Kubernetes (on CoreOS, so even less configuration required), apps are deployed automatically with CI scripts.

Why would I need to describe the hardware/infrastructure as code? I create VPSes manually, once in a blue moon, and they just get added to our K8S cluster, using the same Ansible template. It takes 2 minutes from VPS creation to adding the new node to the cluster. It'd be nice to describe in code the exact hardware provisioning, but that can be done easily with a couple lines in the internal documentation. And actually, having heterogenous server sizes might be a feature, to be able to schedule less demanding apps on less powerful and cheaper servers.

What benefit would Terraform give me? Not being snarky, I just don't know how to fit it in our process.

<comment><USER7> \- _Scalability_ since you're a small shop, it doesn't seem a huge deal to have to setup networking and other scaffolding manually. But as your company grows and more teams join, will you provision these things for every team by hand? What if they want to experiment with different networking configurations?

\- _Disaster Recovery_ : Imagine for whatever reason your VPC is completely destroyed, all your VM's are gone. You still have data backed up (you do backups don't you? :)). Your company has to inevitably be down for some time, but how long would it take to restore everything? Terraform can reduce this from days/weeks to minutes; all configuration is there in code, is reproducible. Even if you don't/can't use terraform itself, you still have captured all your infra config information in code and not just in a Google Doc/Evernote/Post it notes.

\- _Audit Trail_ : You want to empower developers to make changes to infrastructure without opening a ticket and asking you to do it. But if they don't open a ticket, it might make your compliance story much harder. If they do open a ticket, you now have a huge ticket backlog so you hire more engineers .... kinda relates to the point about scalability. Using Terraform, and enforcing infra changes through terraform, you have a super simple audit story, and will know exactly who made the changes, when they were made, for what reason etc.

\- _Infra Convergence_ : Its a fact of life that you need to make temporary infra changes for fixing fires, hotfixes, super important custom customer request etc. If you allow your infrastructure to be cluttered with these one off changes, it will be messy, developers won't give a shit when making new changes, and often everyone will have permissions over everything. Using terraform, every time you make changes to infra, you discover these manual changes and either revert them (if they're one offs) or commit them to code (if they're meant to be permanant)

I'm a new user to terraform, and it certainly has its problems (its still 0.* for chrissake). But... it has been a very useful tool when used correctly and with discipline.

</comment></comment></comment><comment><USER10> _You spend the rest of the day investigating what went wrong. Eventually, you figure it out. Somebody logged on to the third machine last week and manually updated some of the software. These changes were never propagated to the other servers, or back to the staging environment, or dev environments._

I'm sorry -- how many people are still doing this in 2019?

<comment><USER11> Many, especially for tweaks after installation.

</comment></comment><comment><USER12> I'm sorry, but infrastructure as a code is a fake news.

Most popular tools offer infrastructure as a config with some horrible and limited scripting language (in some cases even JSP doesn't look like a horrible idea - hello helm). Declarative VS Imperative Holywar is getting a bit old (like any other tech war).

<comment><USER13> The best language is "the one you know" which is why I think pulumi looks like the best answer so far.</comment></comment>


How Twitter could be worth a billion dollars in a year: Mobile payments - <AUTHOR> http://www.alleyinsider.com/2008/6/how-twitter-will-be-worth-a-billion-in-a-year

<comment><USER2> This is nothing but fluff. Amazon and PayPal already do this and (not surprisingly) it's not too popular. I'd rather just buy you a damn beer at the bar than send you a few bucks.

I'd much prefer RFID inside mobile phones to catch on so that I can just do payments with it instead of cash/cards.

<comment><USER3> Paypal isn't popular? Ruh? Amazon isn't popular because it didn't create a "killer app" for the concept.

I think the idea is fucking brilliant. Instead of ad injection for revenue, take Paypal on directly.

I'm a buy-my-buddy-a-beer kind of guy, too -- but there are circumstances where it would be convenient to move money to family and friends.

If my brother buys me movie tickets because I'm getting to the theater late, twittering him payment during previews beats trying to mentally remember how much I owe him when I am buying ice cream later.

If you are already familiar with the Twitter UI, it isn't a stretch to learn an additional command.

<comment><USER2> PayPal and Amazon are extremely popular. Their mobile payment services, while quite easy to use, are not popular. I think PayPal even shuttered their SMS service and is keeping with the mobile site. Amazon's was actually a YCombinator startup (TextPayMe.com). If you're looking to pay your brother for ice cream, get on it:

[https://payments.amazon.com/sdui/sdui/productsServices?sn=mo...](https://payments.amazon.com/sdui/sdui/productsServices?sn=mobilePayments/whatIsIt)

It's almost exactly what this clown thinks is going to make Twitter with a billion dollars, but already in existence and not worth a billion dollars. Oh and you can count on Amazon's service working for more than 10 minutes without going down. That's gotta be worth something.

</comment></comment></comment><comment><USER4> If Twitter could make it really easy to pay for something, then tweet about stuff you liked, this would be gold! Marketers would be drooling over this stuff. Also, this opens the path to micropayments.

Another drooly - enable the infrastructure as a series of browser plug-ins. This way, every site becomes a part of the system by default.

<comment><USER5> Right. Because every internet user spends time installing browser plugins.

</comment></comment><comment><USER6> I have to pay $0.15 for each SMS I send. I'd rather use my credit card.

<comment><USER7> Each credit card transaction costs someone at least $0.15. You just don't see it.

<comment><USER6> I don't pay it, the retailer does.

<comment><USER7> And you think this doesn't influence the price you pay?

</comment></comment></comment></comment><comment><USER8> I agree that the microblogging was an convenient excuse for building an infrastructure. I think this is why Jeff Bezos is excited about Twitter.

</comment><comment><USER9> This sounds like PayPal's original intention: transfer money using Palm devices.

PayPal/Max Levchin Interview, Founders at Work, Jessica Livingston, 2007.

</comment><comment><USER10> What stops Jaiku from stealing Twitter's thunder?

I bet Google has way more resources and brilliant minds to see it go live before twitter even think on the database design.

Mix with google checkout and there you have a killer payment option.</comment>


Learn more, earn more for less. Way Less - <AUTHOR> http://www.wunderbal.com <comment><AUTHOR> Choose what you want to learn, when you want to learn it, with educators and employers competing for you.

I'm curious, what do you think this service is about? What's compelling and what's different? Does that difference matter?</comment>


Boeing unveils autonomous submarine - <AUTHOR> http://www.gizmag.com/boeing-echo-voyager/42272/ <comment><USER2> The article is a little thin on details.

The big breakthrough seems to be mission duration - possibly months. With such a long duration, some other possibilities open up. Primarily, rather than launching from a ship close to the target, the sub can be launched from shore, navigate out to the target and then return.

I wonder what the "hybrid rechargeable power system" is. Diesel with batteries? well understood and effective. It's gotta be something pretty energy dense to move around that mass and still have space for useful stuff.

<comment><USER3> James Gosling (the inventor of Java) has several videos on-line that describe the hardware and software used in his company's WaveGliders. While they're not submarines, they are autonomous and are powered by the waves they travel through. Solar cells provide power for instrumentation as well as navigation.

I have no idea how you'd power such a vehicle as large as the Boeing system without either fossil fuel or a nuclear reactor but it would be interesting to compare the vehicle's missions.

<comment><USER4> > _powered by the waves they travel through._

How does this work? Wouldn't they expend more energy than they gain?

<comment><USER5> I happened to remember reading about a wave powered design that propels a small model boat. I recall seeing it in an old Popular Mechanics and that the year was maybe 1948. I read it while in I was in 7th or 8th grade in a stack of my Uncle's old magazines stored in my Grandmother's basement over half a century ago!

With the help of Google I found the article in less than a minute; I was off by a year: [https://books.google.com/books?id=9NgDAAAAMBAJ&pg=PA182&sour...](https://books.google.com/books?id=9NgDAAAAMBAJ&pg=PA182&source=gbs_toc_r&cad=2#v=onepage&q&f=false) . Take a look it explains how such a design works.

<comment><USER4> Interesting. Thanks for sharing. I can see some challenges with this, but the basic principle seems strikingly similar.

Not sure what's more impressive: your memory or how easy it is to access relatively obscure information from well over a half-century ago.

</comment></comment></comment></comment></comment><comment><USER6> Anyone else's first thoughts jumping directly to the exploration of Europa? (Or Enceladus, or Ganymede?)

<comment><USER7> Not me, I jumped right to WWII/Cold War. While the obvious extension of the technology would be aqueous mobility because:

> Autonomy is a lot less complex in high friction environment with restricted > pull of gravity and speed.

> The ocean being less spacially constrained

> less actors and objects to contend with relative to area/volume

> An extra dimension to use(if sub-surface) although this could make for more > complex models to some degree, it likely would be much easier given the > above points.

So this is somewhat obvious and expected, and likely being employed currently but it is pretty fucking scary, because:

> indefinite deployment of war machines

> unlimited strike capability

> no human governance for last call strike decisions

> 100% likelihood of dead-hand insurance for all nuclear nations

> attack vector, while likely insane to penetrate, would imply remote control > nukes. A human may not be needed on the other end to execute a strike.

It would be awesome to use this on Europa or even deep sea exploration and research activities as we could really derisk the endeavor and also limit costs as this reaches economies of scale, I think that may be a small part of how humans employ this short term.

</comment></comment><comment><USER8> The should send a few to the Indian Ocean. MH370 is down there somewhere.

</comment><comment><USER9> Could this be used for smuggling?

<comment><USER10> Of course it could. I was thinking of adding "In related news, Boeing has over $1B in bookings for the new sub from South American customers."

In the US at least one way to get a quick introduction to the local representatives of the 3 letter agencies is to start sea trials of a long duration autonomous underwater vehicle.

<comment><USER11> >In the US at least one way to get a quick introduction to the local representatives of the 3 letter agencies

Of course, if you're Boeing it's not really a concern to have the three letter agencies knocking on your door. They call that a sales meeting.</comment></comment></comment>


Show HN: No coding needed to track form submit events in Google Analytics - <AUTHOR> http://blog.customerlabs.co/post/162785970698/tracking-form-submits-in-google-analytics-without-coding <comment><USER2> Hey, interesting stuff, indeed time-saving for digital marketers. Can you please elaborate more on the difference between Action Recorder and Google Tag Manager? Thanks!

<comment><AUTHOR> Hey Action Recorder is an alternate to GTM, however you don't need to write code to track events like button clicks, form submits, add to cart etc</comment></comment>


Meeting Mr George: Did Andrew Marvell Spy for the Dutch? - <AUTHOR> https://www.the-tls.co.uk/articles/did-andrew-marvell-spy-for-the-dutch-essay-holberton-dzelzainis-coster/ <comment><USER2> [https://archive.md/WOxbk](https://archive.md/WOxbk)</comment>


Rebuilding The British Bombe Which Cracked Enigma - <AUTHOR> http://www.jharper.demon.co.uk/rebuild1.htm

<comment><USER2> Enigma was really cracked in Poland years before WWII. Then after German invasion Polish mathematicians moves to France, then to Great Britain, and here continue work.

It always makes me sad when people forget about their ingenious work, and in Hollywood films it always looks like all that was done by English speaking people.

Sources: <http://www.enigmahistory.org/enigma.html> <http://en.wikipedia.org/wiki/Enigma_machine></comment>


Show HN: How to use Gmail API and automatically sent multiple customized emails - <AUTHOR> https://github.com/astorfi/pythonic-automatic-email <comment><USER2> "automatically send multiple customized emails"</comment>


AppGyver Composer Pro launched: full visual dev platform for React Native/React - <AUTHOR> https://techcrunch.com/2020/04/06/appgyver-launches-composer-pro-its-new-no-code-editor/ <comment><AUTHOR> Disclosure: I work here and I'm super proud of the diabolical machine we built which transpiles the JSON config created by the visual builder into RN/React apps for iOS, Android, web, macOS and Android TV. :)</comment>


[Python] aredis – an effcient and user-friendly async redis client - <AUTHOR> aredis is an effecient and user-friendly async client. 1. It can be used howerver you install hiredis or not. 2. aredis' API are mostly ported from redis-py, which is easy to use indeed and make it easy to port your code with asyncio 3. aredis can be run both with asyncio and uvloop, the latter can double the speed of your async code.<p>http://github.com/NoneGG/aredis <comment><USER2> clickable > [http://github.com/NoneGG/aredis](http://github.com/NoneGG/aredis)

<comment><AUTHOR> Gotcha, thanks ^_^

</comment></comment><comment><AUTHOR> looking forward for your pull request and bug reports.</comment>


Amazon and the Future of Work - <AUTHOR> http://danieltenner.com/2015/08/29/alternatives-to-amazon-in-the-uk/

<comment><USER2> As an American with UK dual Citizenship, I see a disturbing trend in the UK: The Americanization of labo(u)r law.

Employment-at-will needs to be abolished worldwide, and a resonalble set of rules based on "just-cause" need to be imposed at the trade treaty level which level the playing field, and discourage these tough employer cultures from developing.

If there are set of workplace rules in place which are the same in all developed countries, and there are consequences for breaking these rules, the problem would not exist.</comment>