A Startup Trying to Help Car Dealers Weather Hailstorms - <AUTHOR> https://www.bloomberg.com/news/articles/2019-11-12/how-one-startup-is-trying-to-help-car-dealers-weather-hailstorms <comment><USER2> Wouldn't installing canopy systems be a more cost efficient solution to this problem?

Let's do some math, The dealership listed in the article (Rickenbaugh Automotive Group) currently has ~536 cars listed on their website(s) for sale. I'm going to assume that this number is a little lower than what is actually in inventory given that there are trade-ins and they probably don't restock inventory during the middle of the month. So I will round up to 600 cars to give them wiggle room for expansion and sales. Given their insurance policy is costing them $600k per year we are approximately spending $1,000 per car per year for insurance.

There seem to be companies that make canopies for this exact situation. While I can't find pricing I would have to imagine that the ROI looks pretty attractive given the sheer cost of their insurance and the simplicity of the materials involved in building a canopy. (metal beams and mesh netting)

Why not just solve the problem entirely instead of coming up with an exotic insurance policy?

<comment><USER3> It's a good idea to solve the problem instead of what the article describes, but there's an issue with canopies.

The types of storms that produce hail, usually supercellular, often have damaging straight-line winds. While out storm chasing, I've seen several gas station canopies collapse from strong winds - I'm struggling to think of a canopy solution that wouldn't have the risk of collapse.

<comment><USER4> Maybe a soft one-inch foam canopy secured closely to the vehicle so wind can't catch it, with couple straps under the vehicle chassis? Could that work? Could it be put in place in time?

Alright, that's not really a canopy, more like a shield or body armor.

</edited>

<comment><USER5> Just armchair engineering here:

It wouldn't be hard to make some thick foam mats with straps sewn to them that can be rolled out and fastened to cars in under a minute each. Maybe toss in a couple plastic strips to make it unroll itself like the reverse of a slap koozie. Weather forecasting is pretty good. It's not like you don't have decent warning. You can cover everything out back and leave the cars that are on display out front uncovered until the last minute.

Tossing a mat over a high roof van or large pickup wouldn't be easy but the hordes of crossovers could be well protected.

<comment><USER4> Alright! StormShield, YC S20, is officially launched! First round starts at $20m!

OK, maybe it does almost sound feasible, but I wonder what someone with outdoor car dealership experience would say? Is this a practical idea? How often do you need to unroll those mats?

<comment><USER6> Where are you storing the mats also? I can't imagine that they'd be small, even rolled up.

<comment><USER4> Right, those mats wouldn't be small. They would need lots of storage area.

Maybe a few be stored, rolled up, under vehicles at the back of the lot that are less likely to be moved?

And the rest could be stored indoors. They shouldn't be heavy, so maybe they can be stashed in the ceiling, or somewhere high up out of sight?

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> [https://outline.com/psTmaB](https://outline.com/psTmaB)

[https://web.archive.org/web/20191112155656/https://www.bloom...](https://web.archive.org/web/20191112155656/https://www.bloomberg.com/news/articles/2019-11-12/how- one-startup-is-trying-to-help-car-dealers-weather-hailstorms)

<comment><USER8> You are a gentleperson and a scholar.

</comment></comment><comment><USER9> Let's apply some old school tech. Forget about insurance and canopies, think Atari Missile Defense.

A swarm of small pulse lasers surrounding lots, along poles on the inside, and generally build a defense network that takes out hail on the way down. Design it after Israel's Iron Dome. Sure, the targets are smaller, in a adversarial environment, and don't have heat signatures but it would be amazing. :)

<comment><USER10> Gut reaction: Because Ice/Snow needs an incredible amount of energy to go from solid to liquid, the lasers would have to be melt-flesh-in-an-instant powerful. Not so good for the eyes of airplane pilots.

</comment></comment><comment><USER11> I live in a city with big, annual summer hail stones. Many dealerships have built canopies and it seems to be working.

I also have friends in the auto industry and the interesting thing is they said hail isn't the worst thing, they actually profit quite a bit. Basically insurance will appraise the new value of each car and write a cheque (ex. $10k for each car). The dealership can still sell the car as "hail damaged" and offer the buyer a $5k discount. Buyer thinks they are getting a great deal, the car just has some dimples, but $5k is $5k right. The deal then makes an additional $5k off the car. However this breaks down if hail insurance premiums are going up.

<comment><USER12> Dealers can take the money, fix the damage and still sell the car as brand new - if it hasn't been titled yet, body work doesn't need to be disclosed to the buyer. Dealers usually have in house body shops or relationships with body shops and pay labor + supplies in the repairs. A bigger issue is the backlog of work that quickly accumulates in the aftermath of a hailstorm.

</comment></comment><comment><USER13> >"Two years ago he paid about $160,000 to insure $20 million worth of Cadillacs and Volvos on his lot, where about a third of the inventory is kept outside. This year he's paying almost $600,000."

Surely a dealer could install some hail-proof canopies for a lot less than $600,000?

Something like this perhaps? [http://www.wssl.com/Car_Lot_Canopy.html](http://www.wssl.com/Car_Lot_Canopy.html)

<comment><USER14> A little weird I can answer this, but I bought my Volvo through this exact dealership.

They have a very space constrained layout especially for inventory display, as their dealership is at the junction of some odd angled non grid streets (namely Speer).

I.e they're an urban dealership that just doesn't the have room.

</comment></comment><comment><USER15> Am I missing something or will this make no real difference?

Ultimately if there is a hailstorm then the insurer has to pay out, premiums have to cover that. Measuring whether there was a hailstorm or not might help to prevent fraud. Fixed payouts would help to reduce the cost of accessing damage. But neither change the core maths here: more, heavier hail means more payouts, means higher premiums.

<comment><USER16> Yeah, reading the headline I was suspecting it would be something that would erect a cheap weather-proof roof or something like that. Why not put on inflatable car covers when there's bad weather coming up?

Or invest in a bigger showroom or a roof without windows; if the insurance premium for not having that is 100's of K's a year then it makes financial sense to invest in something like that.

</comment></comment><comment><USER17> Can anyone help me understand how having this data actually lowers insurance premiums? The same number of cars are being damaged by the same number of hailstorms with or without them.

<comment><USER18> You want to look up adverse selection and moral hazard in an economics text about insurance.

Basically if you have some mixed population where some are lower risk and some higher, and they're separable, the low risk people will decide the insurance is not worth the premium. That leaves the higher risk population on the books, which will cause problems for the insurer of they had assumed they'd get a nice sample of the population.

So maybe some car dealers are aware of possible hail storms in their region but for some reason their particular shop is protected. Maybe by hills that drop the hail on the other side or something that which gross aggregates might miss.

Moral hazard plays in as well. If you're protected maybe you place more cars outdoors than you would otherwise, raising the costs to the insurer.

</comment></comment><comment><USER19> I can see where relying on a black box could get really hairy though. What if it's a light storm that produces virtually no damage but the device produces a payout? What if the exact opposite happened? Who is programming and vetting the code?

<comment><USER3> Great points. Basing a damage payout on anything besides actual damage feels counter-intuitive.

Insurance companies already know where heavy hail falls - there are several companies with products that correlate hail reports with the dual-pol radar Hydrometeor Classification Algorithm product.

Any sort of black box won't be able to assess the hardness of hail, the distribution of hail or how the wind is driving it. I've seen damage from dense, hard 1" hail cores, and I've driven through softball hail thrown out the back of a storm without any damage.

</comment></comment><comment><USER20> ok, so a canopy is likely to catch the wind and possibly cause additional damage. But what about a net canopy system. Say, perhaps with 1cm sized holes. Big enough holes that the wind can't do a ton of damage, but small enough that the really disastrous hail gets caught and the mid size stuff gets slowed down as it likely deflects off the net. Anything that gets through undeflected is unlikely to damage the vehicle.

</comment><comment><USER21> I've never understood why car lots carry so many redundant inventory choices to just sit around in the elements and rot. It seems immensely wasteful.

<comment><USER22> Money is cheap to borrow and selling used cars is fairly profitable. Better to sit on a car for an extra 6 months, paying 2-3% than lose a sale entirely.

</comment></comment><comment><USER23> The startup may be new, but the rain lottery has been around for a while. Are car dealers really just now getting wind (no pun intended) of it?

</comment><comment><USER24> What if we built solar farms on top of car dealership lots that doubled as a canopy? Canopy + energy. I wonder if anybody has done that yet.

</comment><comment><USER25> This was basically The Climate Corporations business model to the T, before they switched to farm insurance. Their name was Weatherbill.

</comment><comment><USER26> I was wondering how they were going to do this with AI and drones...

<comment><USER27> Drones fly around and use ML to recognise hail, and when it detects hail, sends a signal to self-driving cars to (cue Monty Python's Holy Grail:) "Run away! Run away!"

</comment></comment><comment><USER28> Please stop trying to help this industry, let it die.

</comment><comment><USER29> Wohooo! Real people solving real problems.</comment>


Show HN: Medium Bookmarklets – easy way to save your place in Medium articles - <AUTHOR> https://addons.mozilla.org/en-US/firefox/addon/medium-bookmarklets/ <comment><AUTHOR> I read a lot on Medium and I often don't have time to finish entire articles, especially longer ones, so I wanted an easy way to save my spot without having to add native highlights or comments.

That's where Medium Bookmarklets (MB) comes into play - it adds a highlight to the article and a card to the MB sidebar that when clicked, takes you directly to the highlight in the article. Right now it's pretty bare-bones but accomplishes my needs; if there's anything you'd like to see improved or added let me know or open an issue on GitHub:

[https://github.com/cedricium/medium- bookmarklets](https://github.com/cedricium/medium-bookmarklets)</comment>


Australian startup Magikcraft set world record with 12-year old developers - <AUTHOR> Australian startup Magikcraft, which teaches kids to code in JavaScript using Minecraft, set a world record this week. In partnership with Microsoft and IBM they killed 13,854 Minecraft Zombies using JavaScript lightning in 10 minutes, using the most performant Minecraft system on the planet - 48 physical cores, 256GB RAM.
Here's the world record: https://recordsetter.com/world-record/zombies-killed-minecraft-10-minutes-using-javascript-lightning/51109
And the engineering behind it: https://blog.magikcraft.io/engineering-a-world-record-at-magikcraft-3b5698f936d5#.vng24n6me <comment><USER2> Sweet - That is a heck of a server!</comment>


Hacking and defeating Google's reCAPTCHA with a 99% accuracy - <AUTHOR> http://www.dc949.org/projects/stiltwalker/ "Note: In the hours before our presentation/release, Google pushed a new version of reCAPTCHA which fully nerfs our attack." <comment><USER3> One exciting thing about this: the entire model of reCaptcha (at least the text ones; I assume the audio ones are similar) is to make people do useful work when solving captchas by having them complete tasks that they consider too hard for computers to do well (in the text reCaptcha case, OCR). If someone writes software that can defeat the captcha, it does mean the security model is broken, but it also means the state of OCR technology (or audio recognition or whatever) has been advanced, and the digitization of books that had previously required human intervention can now be accomplished by automated means. In other words, spammers are incidentally creating the tools to expand the scope of digital human knowledge. Win-win, really.

<comment><USER4> Unfortunately, this attack does nothing to advance the state of the art in OCR (or audio recognition). It's basically the same story as every other CAPTCHA attack to date: take advantage of some accidental statistical regularity in the generation function. As soon as this kind of flaw is discovered, it only takes a few hours for the generation code to be patched in such a way that completely prevents this sort of attack from working.

<comment><USER5> So either the code is easy to patch, or we DO advance. Win/Win?

<comment><USER6> Not really... Even if the code is difficult to patch, speech/audio recognition doesn't advance much when an attacker figures out how to remove the (non- random) noise added by a machine over the sound file. Actual speech recognition relies on the ability to filter out background noise - which is a lot more complex/random - added by surroundings, not a machine.

It's very difficult to generate some sort of noise via algorithm that a) humans can filter out and b) can't be removed by some algorithm. As a result, audio captchas are a huge vulnerability and the weakest link in almost any captcha system, although you can't get rid of them by law.

Hypotheticals aside, the code was easy to patch - note the footnote: > In the hours before our presentation/release, Google pushed a new version of reCAPTCHA which fully nerfs our attack.

<comment><USER7> Could one take real recorded noise and add that rather than noise generated via algorithm? Wouldn't that force attackers to solve a real problem (removing background noise from an speech sample)?

<comment><USER8> Yeah, you would think they could record thousands of hours of real world noise then randomly use sections of it on each audio captcha.

<comment><USER9> If the attacker manages to obtain all the random noise, they could index every window in the noise in a k-d-tree and perform an efficient nearest neighbour search for the exact background from the CAPTCHA audio, and then simply subtract the background, giving perfect segmentation in O(log(N)) asymptotic average time complexity for N windows (at 64kHz and 2000 hours of audio, N=460800000, log N = 19.95).

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> After so much work, gotta love the footnote here: "Note: In the hours before our presentation/release, Google pushed a new version of reCAPTCHA which fully nerfs our attack."

<comment><USER11> This isn't a huge problem for security people. Indeed, at most academic security conferences, by the time you present your work it has usually already been broken and/or countered.

To goal of good research (and one that differentiates researchers from criminals) is to present a proof of concept and to _advance the state of security_. The fact that security is a perpetual arms race is incidental.

Well, at least that's what security researchers tell themselves anyway to avoid going mad. :)

<comment><USER12> What makes it funny is that the bulk of the article isn't "here's how we did it and what we learned," but "here's what you need to do to get our code running on Ubuntu." Then you get to the footnote: "PS: It's pointless to get our code running on Ubuntu."

I spent the whole article wondering why they were so interested not only in presenting a proof of concept, but in getting as many people as possible actively breaking captchas. Then I got to the end and switched to wondering whether the whole thing is an elaborate prank.

<comment><USER11> Yes, I thought this particular link was perhaps not the best way to present the work, mainly because the interesting part is actually this: "We accomplished this with a combination of Machine Learning, hashing methods, keyspace reduction tactics, and taking advantage of an overall limited number of captchas. Specifically, Stiltwalker goes head to head against reCAPTCHA'S audio captcha system and defeats all but a sliver of it's challenges."

On the other hand, it looks like they provide a corpus ([http://www.dc949.org/projects/stiltwalker/stiltwalker- corpus...](http://www.dc949.org/projects/stiltwalker/stiltwalker-corpus.tar)) [1.5 GB!] that you can still use to run the program.

</comment></comment></comment></comment><comment><USER13> This may be very interesting to crack, but who is responsible for Google making their CAPTCHA almost impossible for human to decipher now? I seriously have to click 5 times before even seeing anything resembling letters I can parse

<comment><USER14> You only have the type one word correct, and they make sure one word is readable so with some practice you can easily recognise which word is the key- word.

<comment><USER15> He isn't speaking of reCAPTCHA but google's nearly impossible to read captchas that take way too much time to decipher.

If you'd like to see it you can usually get it by putting in a bad password to a gmail account too many times (though I don't know if that has other consequences).

Edit: Here is an image example <http://www.techian.com/wp- content/uploads/captcha.png>

<comment><USER16> I wonder what they do for non-Latin locales?

</comment></comment></comment></comment><comment><USER17> Google's captcha system is horrid. I've mentioned this to people on the accessibility team but to no avail. They used to have a wheel chair icon next to the bloody scrambled text. I taught a computer class to seniors and it was painful watching them deal with the account sign up process (also, I thought it was insulting asking a mobile senior to click on the wheel chair icon ... to the designer ... FU!). Clicking on the wheel chair would give audio that barely made any sense to me. The whole process was stupid.

Like many others, I can barely get through their captcha service. I'm actually happy people circumvented it. Maybe someone will think it through this time around.

<comment><USER18> I also thought that was insulting with the wheel chair icon. A person in a wheel chair has problems walking, not (necessarily) their vision. How about "Help" in text?...less confusion and possible anger

<comment> excuse-me Since the point of the audio version is not to be hit with lawsuits under the ADA - perhaps it should just be a little icon of a lawyer?

<comment><USER19> I imaging that whole sites could be designed using only your proposed lawyer icon, possibly with some additional icon representing political correctness.

</comment></comment></comment></comment><comment><USER20> Here's the Ars Technica article which does much better job explaining the system:

[http://arstechnica.com/security/2012/05/google-recaptcha- bro...](http://arstechnica.com/security/2012/05/google-recaptcha-brought-to- its-knees/)

<comment><AUTHOR> agreed, thanks for posting the ars link.

the youtube video in the OP does a great job of explaining and the thinking behind the attack, and even though it's an hour long, it's worth the watch.

<comment><USER21> Video tutorials are awful if they're the only option. I read very quickly, and videos are typically paced at the lowest "average" comprehension level, so they're a painfully inefficient way to relay technical information.

Plain text wins again, at least for one-way technical communication.

<comment><USER22> I tend to agree with you, but FYI you sound pretty arrogant when you say it that way.

<comment><USER23> How about when I say I hate videos of what should be written text because years of exposure to gunfire in the Army has impaired my hearing?

I will never understand why people think that the crappy audio channel of a youtube video of some guy "umming" and gulping through a poorly prepared speech, all recorded on a $5 microphone, is a suitable way of passing information.

</comment></comment></comment></comment></comment><comment><USER24> I actually tried hacking reCaptha via audio and the Google Speech to text API a few days ago. It didn't work unfortunately, it really frustrates me at times when I have to refresh reCaptcha 10 times to actually be able to read the damn thing!!

<comment><USER25> What problems did you run into when trying to use the speech API? It's quite an interesting avenue for bypassing these in the future as speech recognition gets better. Also highly entertaining when you use Google's own service against them.

<comment><USER24> Exactly my thought, with using their own service! The thing was, is that the background noise made the API not recognise the actual words (I think - <USER2> you can't really "debug"), but maybe if you reduce the noise, it might be possible - I wanted to give that a go, but haven't had a chance yet. I just don't know of any ways to automatically reduce noise.

<comment><USER26> I suspect you haven't gotten around to it, but did you study the noise at all? According to Wikipedia <[http://en.wikipedia.org/wiki/Voice_frequency>](http://en.wikipedia.org/wiki/Voice_frequency>), 85-255 Hz is the usual range of human speech. You could try a band-pass filter with that pass band, and probably a pretty high roll-off (this will cut off sounds like S and X, but I suspect voice recognition software is often capable of dealing with those, given how often they fail to be represented well in discrete audio).

Audacity can do this, and there's almost certainly automatible tools out there. Worth a shot, anyway.

<comment><USER24> I found Audicity when I was playing around, but I didn't get round to actually trying it. Didn't know about the frequency so thanks!!!

<comment><USER27> The coursera Machine Learning course references an algorithm that can separate speech from noise, which a fairly high degree of accuracy. May be worth looking into. Noise removal tools like audacity tend to introduce "watery" or "bubbly" effects when pushed hard.

</comment></comment></comment></comment></comment></comment><comment><USER28> In systems that are less secured than Google, the audio catchpa seems trivial to break...I think I've seen one on court sites that read a combination of numbers from 1 to 9 with some variance in the vocal speed. I'm not an audio engineer but that seems fairly trivial to crack (though maybe their visual catchpa would be easier...I dunno, not an expert in OCR either).

It's a good lesson in a form of social engineering. Sites have to provide this alternative access for the visually impaired...yet I bet the resources/creativity put behind it is not at the same level as the kind put into the catchpa used by 99% of the userbase. Furthermore, the most important client -- your boss -- is likely to not be blind him/herself, which eliminates that extra critical layer of oversight.

</comment><comment><USER29> > Note: In the hours before our presentation/release, Google pushed a new > version of reCAPTCHA which fully nerfs our attack.

I take it that "fully nerfs" means this defeat of recaptcha is no longer useful?

</comment><comment><USER30> Pretty sure I don't have 99% accuracy at solving reCAPTCHAs. Perhaps it's become a CAPITCHA, Completely Automated Public Inverse Turing test to tell Computers and Humans Apart...

</comment><comment><USER31> What are we going to do once all CAPTCHAS are completely broken?

<comment><USER32> CAPTCHAs are ultimately already completely broken - they don't really slow anyone down except ordinary users, because spammers are using human labour to solve CAPTCHAs at the rate of one or two dollars per thousand solved.

</comment></comment><comment><USER14> Their testing and high success rates on the public Google reCaptcha test probably tipped off a Google employee internally.

</comment><comment><USER33> captchas are very annoying. it is surprising that they have lasted this long. what would be the best alternatives?

<comment><USER34> Obscurity. If you're not a significant target, you can get by with simpler methods.

Deciphering obfuscated text is one of very few verifiable tasks that humans can do which computers cannot.

Alternatively, you can look at other methods of identity verification. If you ask for $5 to create an account, you'll have few spam problems.

</comment></comment><comment><USER35> Now here is some serious hacker's news! Was getting nagged by 'what NewEgg can/can't do' posts off late.

</comment><comment><USER36> A company that relies on a bot that accesses others' resources to make money and at the same time relies on reCAPTCHA to frustrate other bots from accessing it own resources.

It may be easy to do today, but, going forward, how do we determine which bots are "good" and which ones are "bad"?

Clearly, simply being a "bot" does not imply "bad" intent. If it did then we should all be blocking search engine bots. Yet this is what reCAPTCHA does: it blocks not based on intent, but based on the characteristic of being a "bot".

<comment><USER37> It's easy. One bot reads a text file and only accesses the resources outlined in the file. The other maliciously tries to eat up resources without restraint. Good - Bad.

<comment><USER36> Like I said, it's relatively easy today. But how about going forward?

There will be lots more bots and lots more usages. Things might not be so simple. For example, some sites might exclude all search engine bots except a chosen few despite the fact they all honor robots.txt and behave essentially the same.

(BTW, if by "text file" you mean robots.txt, isn't that an _exclusion_ list? You seem to be saying it's an inclusion list.)</comment></comment></comment>


New Apple Watch Has Lowest Ratio of Hardware Costs to Retail Price - <AUTHOR> http://www.businesswire.com/news/home/20150430006412/en/Apple-Watch-Lowest-Ratio-Hardware-Costs-Retail <comment><USER2> Note that this data is all just made up. The components listed are probably close to right (though I don't see anything about the haptic device--could be I overlooked it) but the cost for each is just a random guess. I'm guessing they also well undershoot the assembly cost, given the extreme care Apple puts into its manufacturing process.

And even if all the per-unit costs are correct, the fact that they leave out R&D and logistics costs is very misleading, especially given that this is not just a new revision of a well-understood product like a new Mac or iPhone. This is a new product altogether, and that overhead is significantly higher. So in the end the number is misleading and ultimately pointless, except to Apple's cost accountants.

<comment><USER3> The article is only concerned with unit costs, not overall cost with various amortizations built in.

<comment><USER4> Is that a meaningful analysis?

<comment><USER5> No.

</comment></comment></comment></comment><comment><USER6> R&D also costs a few pennies...

<comment><USER7> Nobody is suggesting that.

<comment><USER8> Errrr... the person you wrote a reply to suggested it...

<comment><USER7> I misread his post and thought he was being sarcastic.

</comment></comment></comment></comment><comment><USER9> And yet, on the earnings call Tim Cook specifically said the Watch doesn't have a profit margin as high as other products.. yet.

<comment> shawn-furyan That's not inconsistent with this analysis. As the article states, there are several factors, many of which would tend to be higher for a first generation product than a latter generation product (i.e. setup costs), that the bill of parts doesn't take into account.

<comment><USER10> There could also be a very high internal defect rate which would significantly impact the net cost per unit.

<comment><USER11> They could also be expecting a high external defect rate, and be factoring, say, 10% into the sale price to defray warranty costs.

It's also the first of a new product line, so it likely also has to cover some of the costs of creating and entirely new division inside of Apple, from line support up to executives. NOT just the R & D costs.

</comment></comment></comment></comment><comment><USER12> <sarcasm>Greedy bastards!</sarcasm>

I always find it interesting to note that nobody ever acuses Apple of being greedy. The typical punching bag on the "greedy bastards" bandwagon are the oil companies. Interestingly enough they operate at gross profit in the order of 7% while Apple is running somewhere around 40%.

Just google "apple profit margin" for that data. Here's a Forbes article on oil companies, including the revelation that the government makes far more money per gallon than the oil companies themselves. Data is a bitch.

[http://www.forbes.com/2011/05/10/oil-company- earnings.html](http://www.forbes.com/2011/05/10/oil-company-earnings.html)

<comment><USER13> > _At the gas tank integrated oil companies make about 7 cents per gallon_

This has to be the figure for what the owner of the gas station makes, which in some instances is the oil company itself, but in many instances is a franchisee. Some states actually have price controls on gas to protect small "mom and pop" stations from "integrated" competitors(!) So, Exxon, et al. are making a hell of a lot more than $.07 per gallon of unleaded gas, not to mention the fact that gasoline is just one product that comes out of a barrel of oil.

I think people do see Apple as greedy, but even more people perceive thier products as non-commodity, luxury goods and think Apple is justified. A lot of people also identify with the Apple brand on a personal level. I don't think anyone thinks of themselves as an Exxon or BP person. Millions of people think of themselves as "Apple people."

<comment><USER12> No, it's about 8%

[http://cdn.exxonmobil.com/~/media/global/Reports/Other%20Rep...](http://cdn.exxonmobil.com/~/media/global/Reports/Other%20Reports/2015/2014%20Financials)

</comment></comment></comment><comment><USER14> $2.50 to assemble and test?

<comment><USER15> That works out to it taking about an hour to assemble and test, sounds reasonable to me.

At least based off the wage from 2012, allowing for an over 10% increase.

"At that salary, the wage ranges between $1.50 and $2.20 an hour, based on the exchange rate of 6.3 renminbi to the dollar." [http://economix.blogs.nytimes.com/2012/02/24/the-ieconomy- ho...](http://economix.blogs.nytimes.com/2012/02/24/the-ieconomy-how-much-do- foxconn-workers-make/?_r=0)

<comment><USER16> That's a sad reminder of the level of labor exploitation that goes into luxury products and profit margins.

<comment><USER17> Is it exploitation though? If that's a prevailing wage in the area, it's not exploitation. It's just lower than they'd pay elsewhere. (if they are making them work for less or in unreasonable conditions, then yes, it's exploitation, but not because it's cheaper than US labor)

</comment></comment></comment></comment><comment><USER18> Apple usually has a 1:3 cost to retail price ratio (based on mobile devices). Maybe they need the headroom for additional sensors (to maintain the current price).

</comment><comment><USER19> This is typical of fashion items.

</comment><comment><USER20> Highest* ratio

<comment><USER21> No I think they mean lowest. They're saying the actual cost of the hardware (numerator) is low relative to the purchase price (denominator).

</comment></comment><comment><USER22> Hardly surprising for what is essentially a piece of jewelry. The cost inflation for the gold piece especially has nothing to do with the cost of the most expensive material (the gold itself).</comment>


Python 3 in Science: the great migration has begun - <AUTHOR> http://astrofrog.github.io/blog/2015/05/09/2015-survey-results/

<comment><USER2> > The main reason for Python 2 users to not switch to Python 3 is the lack of > motivation/killer features. We need to therefore be more proactive in > encouraging people to switch to Python 3 by (a) making sure that any new > users are always directed to the latest Python 3 version, and (b) releasing, > in the near future, new major versions of packages for Python 3 only, while > maintaining long term bugfix support for Python 2 versions.

That's the evil right there. Read carefully what's written.

" _The_ main reason for Python 2 users to not switch to Python 3 is the lack of motivation/killer features". Which says that users _are_ familiar with what Python 3 has to offer but consider it not good enough. Why would you then jump to a conclusion that you have to be more proactive in directing people to switch to Python 3. Or even better, to stop adding features to what 81% of people use.

<comment><USER3> In my experience the main reason is actually people who just looked at 3.0, decided it didn't have anything new and required work to port over, and then never looked at 3.1, 3.2, 3.3, 3.4 or the in-progress 3.5.

Which means those people don't know about/don't get to use, among other things:

* Vastly improved unittest module, including mock objects

* Dictionary-based logging config

* The sysconfig module

* The pathlib module

* Built-in enums

* Single-dispatch generic functions

* The statistics module

* The asyncio module

* The "yield from" syntax to delegate to generators

* The lzma module

* The ipaddress module

And that's without getting into 3.5, which adds things like the matrix multiplication operator that science-y packages _will_ care about and probably port for.

<comment><USER4> Almost none of these things are used in scientific computing though. Maybe asyncio and yield from.

<comment><USER3> I suspect enums have uses, as do the improved async code constructs (and there's more of that in the pipeline).

<comment><USER5> Yes, I do use python for scientific applications and enums are one of the things I miss - I've built around it in python 2.x by using this construct:

        def enum(*sequential, **named):
            enums = dict(zip(sequential, range(len(sequential))), **named)
            return type('Enum', (), enums)

        Init = enum("NOTHING_LOADED",
        "DEPENDANT_ENTRYNODE_ATTRIBUTES_LOADED",
        "ROUTINENODE_ATTRIBUTES_LOADED",
        "DECLARATION_LOADED"
        )

        myState = Init.NOTHING_LOADED

3.x is still a non starter for me since many clusters where I want my software to work still only come with 2.6, e.g. I can't even use dictionary comprehensions. Adoption for scientific software is heavily influenced by how many external dependencies you have - requiring users without root access to compile python 3.x for their cluster home is a no-go.

<comment><USER3> No offense meant, but if you're at a stage where you use a pre-2.7 version because that's what comes with the OS, then it's not really a case of "looked at 3.x and decided it didn't have anything".

OS vendors who will be supporting ancient Python versions until the next decade are a blight on the entire ecosystem.

<comment><USER5> > it's not really a case of "looked at 3.x and decided it didn't have > anything"

I agree, this isn't the main reason why I'm not looking at 3.x.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> I'm a scientific user with no incentive to switch; I'm still on Python 2.7.

But the release of the @ matrix multiplication operator in Python 3.5 gives me strong incentive to switch. I'll be switching as soon as Anaconda support Python 3.5.

</comment><comment><USER7> I'm a scientific user, and work in a R&D environment for scientific instrumentation. I'm probably the most advanced Python user at my site, but have inspired a number of colleagues to give it a try. We use it for pretty much everything but developing our actual commercial software.

Perhaps an added dimension worth studying is that Python is so widely used by people who have little chance of even understanding the differences, aside from the print() function. I'm not sure that I could clearly articulate them myself.

I migrated to 3.4, just so I could find out and then tell people from my own experience that 3.4 is not broken, and that it supports a sufficiency of packages. In other words I'm using myself as a guinea pig. At the same time, I offer to help people by maintaining my own programs in a way that lets them run on 2.7 or 3.4 systems, e.g., with some kind of "if version > 3" verbiage.

Given that I know my audience, I can tell them confidently that they will not get hung up by the 2 vs 3 dichotomy, and that I will help them if it ever becomes an issue. I think the benefits of Python, including the giant ecosystem of packages, outweigh the risks of choosing the wrong version for most of us.

Edit: One more thing for beginners, a lot of us have working Python installations on our computers, but we don't quite know how or why. A useful migration tool might be a program that analyzes your 2.x installation, tells you what you've got, and maybe even offers to build an identical 3.x installation for you.

</comment><comment><USER8> > _But this is all wrong – we should be teaching new users to use Python 3! > New users won 't thank you if you teach them Python 2 and they have to > migrate all their scripts to Python 3 in a few years..._

Believe me, they won't have to. Python 2 will stay with us for a loooong time, and most NEW web stuff AND scientific work is done with it.

> _However, the Python developers have now stated that there will be no Python > 2.8 release. Essentially, no new features are going to be added to Python 2. > In fact, after 2020 (which is not so far in the future), Python 2 will no > longer be supported._

Yeah, let's see how this works out. After all it's the same guys who said that Python 3 transition would end with 3 being the default choice by 2014.

<comment><USER9> Whatever the result of this, the transition Python 2->3 will remain as one of the most troubled ever for a mainstream programming language (of course, nothing beats Perl 5 on this area). If you consider that Java is on version 8 and C++14 is here, we can see that even old languages have done this in a much more organized way.

<comment><USER4> Isn't Python the only one with breaking changes out of this group?

<comment><USER10> Which group are you referring to? Mainstream languages? The languages mentioned above? Perl 6 was designed from start to be very breaking, but even putting Perl 6 aside, Ruby had quite a few breaking changes going from 1.8 to 1.9 - and that was a merely point release.

Breaking changes are tough, but many libraries with a large codebase managed to update to Python 3 and even maintain dual-version support using compatible features, compatibility libraries and automated conversion tools.

For the everyday users things would be much simpler, and hence the main reasons for converting is not "too many breaking changes" but rather "not enough compelling changes".

<comment><USER11> It's probably reasonable to compare the breaking changes in Ruby 1.9 to Python 1.6/2.0, when Python first added language support for Unicode. There wasn't much in the way of blow back.

If there is at some point a decision to significantly change the semantics of string handling in Ruby (I think tagged strings are the addition of string handling, not a change to it), expect just as much whining as Python has seen (but I think people will look at how it has gone and avoid doing it).

</comment></comment></comment></comment></comment><comment><USER12> > Firstly, most users are using either Python 2.7 or 3.4

That was an amusing statement. His data shows 81% using 2.7, so that 3.4 could be replaced with any version and the statement would remain true.

<comment><USER13> The usage of 3.4 is 16% and combined with the 81% for 2.7 that gives us 97%. You can't replace 3.4 with "any version" and keep the statement true.

<comment><USER14> "Firstly, most users are using either Python 2.7 or 100" That is 81% (0% version 100) using Python 2.7 or 100. AFAIK anything over 50% is most :)

</comment></comment></comment><comment><USER15> Why can't those who want to use Python3 just use 3? Why do they have to push the rest of us over? This read as war against the silent majority to me.

The transition has failed. Python is now 2 separate communities and we only have the 'leadership team' to thank for that. Until they make more compromises this will continue.

That ~17% userbase is your new Python3 community.

<comment><USER16> There's a definite "screw the 2.x users" attitude in the Python community. Report a bug in 2.7 and see what happens. This attitude is encouraged by Python's little tin god.[1] The big excuse for Python 3 is that it does Unicode. Python has done Unicode since Python 2.6; it just wasn't the default. I've been writing all-Unicode Python for about five years.

The killer problem is that many package developers, faced with the 2->3 conversion, abandoned their packages. New packages were written by others to replace them. Users are thus forced to convert to using different packages, packages with different bugs and a much smaller user base. I wrote previously on converting a medium-sized production system from Python 2 to Python 3. I was finding bugs in third-party Python 3 packages, bugs so blatant that they would have been found years ago if the packages were being widely used. This was in the web space; the article indicates similar problems in the scientific space.

[1] [https://www.python.org/dev/peps/pep-0404/](https://www.python.org/dev/peps/pep-0404/)

<comment><USER15> Worse it becomes an emotional plea, "do the right thing". As if not switching sides to 3.x is a moral issue. And the myth that 3.x is in our best interests or "inevitable". The author is fooled into this even though his own numbers show they can't crack 20% even though 3.0 was released in late 2008.

Using those numbers, even if the Python3 community doubles in another 7 years they'll still be at 34%. I think that would be an optimistic outlook as many people are simply finding something else to use instead of move to 3. I'd be as interested in Ruby 3.0 or Go as I would Python3. Many programmers for some reason cannot resist technical churn. To me that's what Python3 is. All things considered not better, not worse. Just different. But with the library issue.

My guess is Pyston will catch on and maintain the 2.x line after 2020. Pyston may end up the innovation that Py3 wasn't, but without breaking everyone's code. LLVM JIT compiler with C extension support. It's music to my ears and transitioning from being a Python programmer to a Pyston programmer sounds good. I suspect by 2020 it'll be ready as a spiritual 2.8, and the 80%+ will move to that.

Only this core dev team could've achieved defeat from the jaws of success by shooting itself in the face.

<comment><USER16> The successor to Python 2 may, in practice, be Go. That's the direction Google is going. Google used Python internally for non-speed-critical tasks, but the performance was too low for anything that had to scale. A few years ago Google hired von Rossum, and Google had a project, "Unladen Swallow" to produce a faster Python.

It failed.[1]

Von Rossum is no longer with Google. Google hired others to develop Go, which seems to be a good language for doing server-side web-related work. It's fast, memory-safe, scales well on multiprocessors, and has lower development costs than C++. That's what Google needed in their business.

Google maintains many of the key Go libraries. They're well-exercised production code. This is not the case for Python 3, as I spent a painful month discovering. I have some technical criticisms of Go, but when I write something in Go, it usually works as expected without surprises. You can use Go for important work with confidence. Python 3, six years on, isn't there yet.

[1] [https://en.wikipedia.org/wiki/Unladen_Swallow](https://en.wikipedia.org/wiki/Unladen_Swallow)

<comment><USER15> Failing something like Pyston taking over for 2.x, that is my plan. Going from Py2 (what I currently use) to Py3 doesn't really do anything for me at all. There's the constant threat online from people about 'support' and guilt trips, but the support that matters (library support) isn't going away anytime, if ever, with a 80%+ userbase in 2015.

So I'm going to stick with Python2, and if I migrate to anything it'll be Go. Though it'll likely just be _also_ using Go. I've already worked through a book on Go a couple years ago. I have my complaints about it, but I also have my complaints about Python.

Nothing is perfect, but Go IS really easy to get started with, which is worth a lot to an individual programmer or to a team. I'm not sure it's flexible enough as a drop-in replacement for Python, but if forced it's good enough to completely replace Python, if this Python2/3 debacle isn't resolved.

I'm seeing Python as 2 separate communities now. Of course the Python3 diehards see that as the worst-case outcome, since their community is always the short stick. But I think we're here now and it'll remain this way.

</comment></comment></comment></comment></comment><comment><USER17> Python 2.7 is an extremely productive language, for a lot of us. I want to move to 3.x at some point, but there's very little I can't do with 2.7, and it is the default on OSX, and many linux platforms.

The _one_ killer feature that would make me move almost straight away would be making it a lot faster.

But since I have pypy, I'm much more interested in installing that as my 'extra python version' than I am in going to 3.x straight away.

</comment><comment><USER18> Is the high % of mac users still on 2.7 partly because that is what OS X ships with?

</comment><comment><USER19> Python 3.2 is the latest version that is PyPy compatible, so support for 3.2 shouldn't be dropped if that's a concern.

</comment><comment><USER20> I'm currently working on a _new_ project using Python 2.6. You see, I'm creating an analysis tool that absolutely must run on an old, isolated (no internet connection) RedHat system, and have access to only a very limited number of packages I can install. Which, in my case, means Python 2.6, fairly old versions of NumPy and SciPy, and Tk for the GUI.

This is actually my first significant project in Python, so naturally I wanted to use the latest and greatest (learning opportunity and all), but no such luck.

<comment><USER21> I've never quite been convinced by this argument. If you can deploy and run .py files, surely you could deploy and run a local copy of python3? It's not like it needs root.

The target system not having an internet connection is a best-case for a local python3 package, since the lower attack surface makes package security updates less urgent.

</comment></comment><comment><USER22> Perhaps off topic, but this was the most interesting to me:

[http://astrofrog.github.io/images/survey_plots/os.svg](http://astrofrog.github.io/images/survey_plots/os.svg)

People really use Linux in scientific communities? Like, non-computer people? In the Netherlands Linux usage (or anything other than Windows and OS X), even among university software engineering students, is almost non-existent. Three out of seventy students I know use it (4%), including myself.

<comment><AUTHOR> Linux is very common in the physical sciences. Back in the 80s and 90s a Unix box from Sun Microsystems might have been more common, but Linux has been firmly in place for more than a decade now.

The audience for this survey is also probably somewhat biased, since it was mostly promoted on twitter. That said, none of my colleagues use Windows. I'd say 75% Mac with the rest various flavors of Linux.

<comment><USER23> Currently I am doing some consulting work in life sciences for well known multinationals.

On my specific case, Linux is only used in their HPC clusters and for hosting some DB servers.

All researchers use Windows systems as their desktops and control systems for their automated robotic systems.

</comment></comment></comment><comment><USER24> The scientific community should focus on moving to PyPy and helping to excise CPython C extensions from more scientific libraries.

That's at least a change that will benefit them.

<comment><USER25> The C extensions shouldnt be cut out of Python. I get that PyPy is better but cutting out c sxtensions and rewriting them in pure python would hurt performance more.

<comment><USER26> Personally, I would really like to see more Python extensions written using the ctypes foreign function library. This has two advantages:

* Supported on more than just CPython. I.e. you can use them on PyPy as well.

* The extensions are far easier to install, since one doesn't need both a full C compiler as well as all development headers for the library installed on the server where you install the extension.

<comment><USER27> ctypes overhead is horrendous though, at least in CPython (I don't know about PyPy). Fine if you're doing array operations on huge arrays, but not so if you have lots of small objects.

I wanted to use ctypes to wrap a C library for a recent project (for the ease of installation and development that you mention) but had to give up when it turned out to be more than 10x slower than a wrapper written in Cython, and barely faster than doing a pure Python implementation of the C library itself.

</comment></comment></comment></comment><comment><USER28> On a related note, Apache Spark recently landed Python 3 support in master, which will be released as part of Spark 1.4 in the next month or so. [0]

[0] [https://issues.apache.org/jira/browse/SPARK-4897](https://issues.apache.org/jira/browse/SPARK-4897)

</comment><comment><USER29> Does this[1] type of plot have a name?

[1] [http://astrofrog.github.io/images/survey_plots/python_vs_exp...](http://astrofrog.github.io/images/survey_plots/python_vs_experience.svg)

<comment><USER30> hmm... I would describe it as something like a '2D histogram square-bin plot' a 'categorical plot' or perhaps a variant of a 'mosaic plot' using color density instead of area.

[http://www.math.yorku.ca/SCS/sugi/sugi17-paper.html](http://www.math.yorku.ca/SCS/sugi/sugi17-paper.html)

[http://en.wikipedia.org/wiki/Mosaic_plot](http://en.wikipedia.org/wiki/Mosaic_plot)

<comment><USER29> Thanks, that is a lot more than I hoped for yet _very_ appropriate considering what I plan to do with it.

</comment></comment></comment><comment><USER31> My conclusion is: if there were no Python 3, Python would be much better

</comment><comment><USER32> Only 10% Windows? Has ESO switched to Linux?

<comment><USER33> And half are astrophysics?

</comment></comment><comment><USER34> I'm assuming you chose science for the basis of this analysis because scientists would be more likely to provide thoughtful replies, if any reply at all correct? I did like the analysis, but once the proselytizing kept popping up, it started to lose value and actually stoke some some of the existing tensions on this matter (we should stop teaching Python 2??)

So now we have to come down from the clouds into reality. For one, having limited yourself to scientific fields (sort of) you have literally chosen the tip of the iceberg. Let's ignore the fact that the stats clearly show abysmal adoption of Python 3 among those who make a living by being on the cutting edge and can most afford to adopt. But 786 replies?? And we should stop Python 2 for THAT (even though ~700 in that set aren't using it)??? If you venture into the commercial world, this entire analysis becomes irrelevant. My field of finance and derivative trading is one of the big up and comers in the Python space for a number of reasons but likely to costs - rapid prototyping, powerful testing, ease of training, etc. And I can say with a fair degree of confidence that there are more Python developers at my firm than this entire set - and all of them use Python 2.6. Or at least they did until a multi year upgrade migration finally brought us to Python 2.7 just this year ( and cost millions to achieve). Most are still using 32 bit, develop in Windows (on in house built IDEs) and have some split of deployment between Window client side projects (GUIs) and Linux server deployment. This is not to say we are simpletons - we have vast and complex systems, globally distributed compute grids with tens of thousands of cores (and equivalent disaster recovery clusters), reactive caching graphs, time shifting time series, cutting edge data stores manipulating massive data sets in the tens of billions of rows and basically run huge swaths of the HUNDREDS OF TRILLIONS in notional derivatives that drive the entire global economy. These systems have BILLION dollar budgets. And mine is one firm out of thousands employing tens (if not hundreds) of thousands of well compensated software developers.

If my point isn't abundantly clear by now, then to put it frankly: WE (and many other industries like ours) ARE the Python community. And it shifts all your stats to the point where Python 3 isn't even statistically significant. So perhaps it would be wise to work with the elephant in the room instead of trying to pull the rug out from under him. Because elephants are big and don't like that shit. Moreover, as a multitude of examples can attest to, any features left out of Python 2.X ultimately just get developed in house and become closed source, with a huge inefficiency in developing the wheel again and again but also locking up the critical knowledge on the best way to do it, backed by proven production deployments with big money at stake.

I don't want to disway this sort of analytical review, but if it's going to be science, it should bear at least some resemblance to it.

<comment><USER35> I wonder if you and I have crossed paths at some point in the industry.</comment></comment>


Qacker.com - create quick anonymous post - <AUTHOR> http://www.qacker.com

<comment><USER2> If I understand the purpose of qacker, I think it would be more useful if it participated in "trackbacks" and other blogospheric/social network like protocols.

There are some blogs that disallow comments, but that do allow trackbacks. This would allow people to more easily add their own comments to such blogs.

There are other blogs that seem to promote anonymity but where, well, it can't quite be trusted up to the blog owner or to the other bloggers at that blog. And qacker with trackbacks would make it easier to comment at those blogs as well.

<comment><AUTHOR> Thanks for your suggestion!

</comment></comment><comment><USER3> <http://www.qacker.com/lfnc>

What do you do when your urls run out? Just cycle through them? BECAUSE COOL URLS DON'T CHANGE, and it's a shame that my lfnc could disappear.

What do you do if Stupid_Bob writes something like a death threat to the President? What information is logged; what information would "the feds" get if they seized your servers?

<comment><AUTHOR> The urls will never run out, when 4 digit urls are used up, there will be 5,6,7 digits and so on.. just like any other url shortening services. So your lfnc url would not be "recycled". If there is some "Stupid_Bob thing", I will review it manually and carefully upon complain and block it only if it is really necessary. Since there is no account/login stuff in this site. No one could get any personal info from you while posting.

</comment></comment><comment><USER4> Looks like they go in order...

<http://www.qacker.com/lfny>

Edit: I kind of want to write a script to see if I can get a word I want...increment until it gives me it.

Edit2: This is as anonymous as the person who posts the link to it is....</comment>


Why is this Java raytracer slower than the JavaScript version? - <AUTHOR> http://www.redcode.nl/blog/2012/07/java-speed-of-math/

<comment><USER2> This comment ([http://www.redcode.nl/blog/2012/07/java-speed-of- math/#comme...](http://www.redcode.nl/blog/2012/07/java-speed-of- math/#comment-4306)) reminded me why I learned Ruby instead of Python: the flow of Python code becomes completely unreadable when whitespace gets mangled.</comment>


Show HN: A bookmarklet to remove clickgates on New York Times, Medium, etc. - <AUTHOR> Recently i stumbled on too many clickgates on the Medium blog Towards Data science. Considering that most people publish to share knowledge on Medium and are driven into putting their content behind a paywall, without actually getting paid for it, including myself. I felt like Medium is running the academic publishing scheme. Get free content and get paid for it. So I decided to create a small script to bypass the paywall on Medium, it turns out it also works on other newssites. Heres the website: https://sugoidesune.github.io/readium/ For the curious I will explain the technical aspects in a comment. <comment><AUTHOR> Here is a gist of the commented code. It works by fetching the HTML content of the website, anonymously with no cookies. Using the fetch API. In a second step the HTML is preprocessed, removing javascript, inserting elements like images that might be done through javascript etc. The third step is to rerplace the current windows HTML with the clean-preprocessed HTML with the article.

[https://gist.github.com/sugoidesune/884bfdf8a975920e98e7307e...](https://gist.github.com/sugoidesune/884bfdf8a975920e98e7307e981e8daf?fbclid=IwAR1Hb8Og5_u8bbWbePfZi- tpN2lObKybZS01kICH_pwxIR4lFUbPY96qm8Q)

<comment><USER2> Nice...

</comment></comment><comment><USER3> [https://medium.com/@tgaul/introducing- unobstruct-230e4e95cf5...](https://medium.com/@tgaul/introducing- unobstruct-230e4e95cf5e)

works nicely for iOS/mobilesafari.

</comment><comment><USER4> Good stuff timar - this definitely beats my trick of hitting the Esc key at just the right moment to stop JS from loading. I've gotten very good at that, but also life is very short and I shouldn't need to! So your bookmarklet will come to the rescue :)

Could this be integrated with Firefox's Reader mode somehow?

<comment><AUTHOR> Not very familiar with firefox or reader mode. But if it's something firefox does with the html of the website youre currently on. Than I see no reason why it couldn't work together. First getting the article with Readium, secondly starting Reader mode.

</comment></comment><comment><USER5> This one is also quite helpful:

[https://github.com/iamadamdev/bypass-paywalls- firefox](https://github.com/iamadamdev/bypass-paywalls-firefox)

... for all of the folks out there who don't have a university picking up the tab for the articles that they want to read.

It's important to remember that paywalls disproportionately impact those who are not "working" in an academic setting.

<comment><USER6> And evading paywalls disproportionately impacts the journalists creating the stories you seem to value, though for some reason refuse to pay for.

<comment><USER7> Do you think that people reading newspapers for free at the library negatively impacts journalists?

</comment></comment></comment><comment><USER6> Do you think the 1,600 journalists at The New York Times, many of whom work in difficult environments (including the White House, lol), should work for free? Quite the Scrooge move.

<comment><USER8> Calling someone a scrooge or cheap for finding a hole in a technical limitation device that is sloppy in its implementation as it is click-bait in it's dark patterns of pretending the page is an open page/free page so it can compete in the search engines but in reality it presents a paid-gate that only appears after leading content is very unhackernews like.

NYT one of the largest most profitable companies pretends to show you an article baits you and demands money and you are a scrooge for not paying? In that context they are the rich entity and should give the content away (the way Scrooge should have). No where in the story does it mention Tiny Tim finding coal in Scroogle's garbage and someone stopping him and calling him cheap for not paying full price because Scrooge employes so many people.

<comment><USER7> > it is click-bait in it's dark patterns of pretending the page is an open > page/free page so it can compete in the search engines but in reality it > presents a paid-gate that only appears after leading content

This is the most important point here. If your content is not actually public, you really shouldn't get the benefits of search engine exposure, HN exposure, or even the distribution from sharing what appears to be a URL to a hypertext document.

</comment></comment></comment><comment><USER9> Thanks! I've been looking for something like this for ages. I use Brave browser on my android and pc. This will be super handy!

</comment><comment><USER10> I though people are paid for posting on medium?

<comment><AUTHOR> They do, but you have to apply and be selected. Compared to all users, its a fraction. And everyone else gets pushed into the paywall, because medium basically says: "If you don't we will not promote it and your post will die in obscurity"

<comment><USER11> so medium is running a business? Did you apply and get turned away?

<comment><AUTHOR> No, I don't aspire to be a writer for a living. If I publish something I do it to share knowledge or for personal branding.

</comment></comment></comment></comment><comment><USER12> How to use it with mobile Chrome on Android?

</comment><comment><USER13> This is fantastic

</comment><comment><USER2> Thank you. Both for the code and for giving me an inspiration. :)

</comment><comment><USER14> this it's literally facilitating copyright infringement

if you don't want to pay for them is fine, just don't read them

<comment><USER7> It's certainly not copyright infringement to download a hypertext document from a company's public web servers.

<comment><USER14> did I say it's copyright infringement?

no.

"facilitating" is not just there for shit and giggle.

[https://www.law.cornell.edu/uscode/text/17/1201](https://www.law.cornell.edu/uscode/text/17/1201)

<comment><USER15> That's stretching the definition. By your argument any parsing of a payload containing copywritten work is copy right infringement.

<comment><USER14> no? section 3a circumvention definition is exceptionally (and intentionally) wide in the and section 3b does the same for what is considered a restrictive measure.

> any parsing of a payload

again, no? authorized parsing does not.

<comment><USER15> As far as I'm aware most websites don't have (enforceable) eulas that state what parsers can and can't be used. If I want to read the binary stream from the wire that's my prerogative.

If you have a website that shows a blank page, to everyone that doesn't send a specific token to your webserver, and I discover that I can view said page by manipulating the dom with any old browsers console I am not violating your copyright. You willingly sent that information.

To bring this home, if I can read an article visually obscured by code that has otherwise been given to me in an unencrypted form I am not violating copyright. If a company has a problem with people seeing everything said company sends to them then they're woefully ignorant of how browsers work. The solution is to stop including the article. Rightfully, this kills seo rankings.</comment></comment></comment></comment></comment></comment>


Summer holidays for 5yr old. what should I do to keep him engaged? - <AUTHOR> My son has two months of summer holidays from next week. we have a nanny to take.care of him and his toddler sister. wife and I will be at work during daytime.<p>What should I do to keep him occupied and sane? <comment><USER2> With all due respect, what do you do with them the other 10 months of the year? Do those same things.

I have a 5 and a 2 y/o. They will spend 2 months home from school with my spouse. Some of their plans include:

\- visit local farms

\- visit local children's museum

\- play dates with other kids

\- gardening (Gettig outside and learning about food)

\- help with light chores (ie feed the dog, sweep the floor, put away toys)

\- "writing" letters (ie drawings with some words) to relatives

\- learning to cook more recipes (they love mixing ingredients for baking)

<comment><AUTHOR> He goes to preschool rest of the year so it was not a problem before. now, an old nanny looks after his younger sister and him.

All the items you mentioned need my or wife's attention. I was hoping for something to keep them engaged easily.

<comment><USER2> What does the nanny do then? Can't they lead activities like ones I've suggested?</comment></comment></comment>


Gnuspeech - <AUTHOR> https://www.gnu.org/software/gnuspeech/ <comment><USER2> Steps to get this running on Linux, without messing with GNUstep:

        wget https://ftp.gnu.org/gnu/gnuspeech/gnuspeechsa-0.1.5.tar.gz
        tar -zxvf gnuspeechsa-0.1.5.tar.gz
        cd gnuspeechsa-0.1.5/
        mkdir build
        cmake -D CMAKE_BUILD_TYPE=Release ..
        make
        ./gnuspeech_sa -c ../data/en -p /tmp/test_param.txt -o /tmp/test.wav "Hello world." && aplay -q /tmp/test.wav

This uses Gnuspeech_SA, the cross-platform version. No idea how to get it to use a voice other than the default male one.

<comment><AUTHOR> Shouldn't there be a "cd build" command just after "mkdir build"?

<comment><USER2> Yes, thanks. Unfortunately I can't edit my comment anymore.

</comment></comment></comment><comment><USER3> Can anyone in the field comment on what is the best offline TTS available today? This project is old, hardly maintained and the samples sound horrible. Festival is... not very good, but 'acceptable'. The MS build-in TTS engines are OK-ish. Dragon has some TTS but hard to use outside the use cases they designed it for it seems, and I'm not sure if they're even using their own TTS engine? Haven't had a chance to try it out myself. Any major ones I'm missing? And just how much better are the online ones, like Google's? Anyone have any quantitative data on that?

<comment><USER4> More open-source speech synthesis options:

[http://espeak.sourceforge.net/](http://espeak.sourceforge.net/)

[http://hts-engine.sourceforge.net/](http://hts-engine.sourceforge.net/)

[http://mary.dfki.de/](http://mary.dfki.de/)

<comment><USER5> >[http://espeak.sourceforge.net/](http://espeak.sourceforge.net/)

Can't confirm how well espeak works, since I didn't try it, but I have tried pyttsx on Windows. (pyttsx is a Python library which uses SAPI5 on Windows and espeak on Linux.)

Worked okay for me. Not tested a lot though. Here's my simple Python snippet for trying pyttsx on Windows:

[http://code.activestate.com/recipes/578839-python-text-to- sp...](http://code.activestate.com/recipes/578839-python-text-to-speech-with- pyttsx/)

(A commenter on the above ActiveState recipe said my pyttsx recipe worked fine for him with espeak on Crux Linux.)

and more details on the same here:

[http://jugad2.blogspot.in/2014/03/speech-synthesis-in- python...](http://jugad2.blogspot.in/2014/03/speech-synthesis-in-python-with- pyttsx.html)

"The pyttsx library is a cross-platform wrapper that supports the native text- to-speech libraries of Windows and Linux at least, using SAPI5 on Windows and eSpeak on Linux."

Also, check out the synthesized train announcer's voice in my blog post above - somewhat eerie and cool :)

<comment><USER5> And a similar small trial of the reverse problem - speech recognition, using the Python 'speech' library:

[http://jugad2.blogspot.in/2014/03/speech-recognition-with- py...](http://jugad2.blogspot.in/2014/03/speech-recognition-with-python- speech.html)

</comment></comment></comment></comment><comment><USER6> And GNU drops the ball again...missing a perfect opportunity to call one of their projects "GNUSpeak". ;-)

<comment><USER7> Egads! It was so obvious that I kept calling it GNUSpeak in my head, enjoying the cleverness of it all, and only now, following your comment, noticed it's actually GNUSpeech...

</comment></comment><comment><USER8> Audio samples:

[http://pages.cpsc.ucalgary.ca/~hill/gnuspeech/gnuspeech- inde...](http://pages.cpsc.ucalgary.ca/~hill/gnuspeech/gnuspeech-index.htm)

<comment><USER9> Thanks, I was looking for some.

Also, holy crap! [http://pages.cpsc.ucalgary.ca/~hill/extra-synthesis- examples...](http://pages.cpsc.ucalgary.ca/~hill/extra-synthesis-examples/Pat- a-pan.wav)

<comment><USER10> GNU vocaloids?

</comment></comment></comment><comment><USER11> If you're on a Mac, you can have some fun with voices (plenty designed for multiple languages):

        say -v ?

Or just run this script to pass hours of time in joy and terror: [https://gist.github.com/DelvarWorld/3f700aac8d7972b053f0](https://gist.github.com/DelvarWorld/3f700aac8d7972b053f0)

</comment><comment><USER12> Honestly, this sounds absolutely terrible. Why is the quality so much worse than, say, Google's TTS running on my phone?

<comment><USER13> It's probably the best technology that the early 90s had to offer.

FTA:

        gnuspeech is currently fully available as a
        NextSTEP 3.x version in the SVN repository
        along with the Gnu/Linux/GNUStep version,
        which is incomplete though functional

Wikipedia[1]:

        3.0 September 8, 1992
        3.1 May 25, 1993
        3.2 October 1993
        3.3 February 1995

[1] [https://en.wikipedia.org/wiki/NeXTSTEP#Release_history](https://en.wikipedia.org/wiki/NeXTSTEP#Release_history)

</comment></comment><comment><USER14> I was recently looking at voice generation. The newer Festival is better than the one that's probably in your package manager.

[http://www.cstr.ed.ac.uk/projects/festival/morevoices.html](http://www.cstr.ed.ac.uk/projects/festival/morevoices.html)

I wonder if we will see any of the deep learning libraries try to do voice recognition, a good open source implementation is lacking, or voice generation.

<comment><USER15> Do you mean: Speech to text (called "automatic speech recognition") Speech to identity of the speaker (called "speaker id")

?

(Also, "voice generation" is called "TTS" or "text to speech")

There are multiple world class open ASR systems using DNNs. Check out Kaldi.

<comment><USER14> I am not sure of the source of the confusion. I meant TTS in the first part of my comment ("voice generation" isn't far from "speech synthesis", which is the title of the Wikipedia article for it in English) and both ASR and TTS in the second. Regarding ASR I'd not heard of Kaldi, thanks for the tip.

</comment></comment></comment><comment><USER16> It might be just me but I can't figure out how to even start compiling this to test it out on linux. That said, I'm always happy to see alternatives to Festival TTS. Hopefully it'll become a bit more user friendly in time.

</comment><comment><USER17> The GNU project has _so much stuff_ in it. It seems like I'm always hearing about something I didn't know about before.

<comment><USER18> Very true, though the first release of this package just came out a few days ago.

<comment><USER19> Apparently it's been part of GNU for 13 years... but never had an official release?

[https://en.m.wikipedia.org/wiki/Gnuspeech](https://en.m.wikipedia.org/wiki/Gnuspeech)

<comment><USER18> Interesting! Thanks! Also, I interpreted the statement about the v1.0 release as being the initial release; perhaps there was a v0.1 release before that...

</comment></comment></comment></comment><comment><USER20> This seems super interesting! They say that they are using a novel approach that models the actual way humans create sounds. Is this completely new? I would assume this implies that you can reuse so much more among languages, and have a more flexible system - like getting it to shout or sing, making strange noises, whistling, etc. But I don't know a lot about it. Is what I'm saying Science Fiction?

This is the kind of article in which i'd love (and I have almost come to expect!) to find comments that provide so much more breadth and depth of information that the actual link, here on HN; this is one of the things that make this community so great.

<comment><USER21> The idea is actually quite old (as they half-way admit, this is based on a program that was developed on NeXT machines when those were current; the research goes back to the late 60s and 70s). Wikipedia has some background naturally: [https://en.wikipedia.org/wiki/Speech_synthesis#Articulatory_...](https://en.wikipedia.org/wiki/Speech_synthesis#Articulatory_synthesis)

There is also research into using this type of physical modeling for singing[1] and laughing[2], so its not far-fetched to imagine a model that can speak, sing, laugh, shout, and perform any of the various vocal articulations humans can make. The main obstacles seem to be figuring out how to control the model over time, how to smoothly transition between control states, and how to capture enough fine details to cross the uncanny valley.

[1] [http://www.cs.princeton.edu/~prc/SingingSynth.html](http://www.cs.princeton.edu/~prc/SingingSynth.html)

[2] [https://ccrma.stanford.edu/groups/mcd/publish/files/2013-nim...](https://ccrma.stanford.edu/groups/mcd/publish/files/2013-nime- lolol.pdf)

<comment><USER22> > The idea is actually quite old (as they half-way admit, this is based on a > program that was developed on NeXT machines when those were current; the > research goes back to the late 60s and 70s).

I don't think linking the papers that form the basis of the work, and describing the history in fair detail (including the original development for the NeXT, and the technical change from real-time DSP-based synthesis to realtime CPU based synthesis enabled by CPU speed improvements since the NeXT was current) constitutes "half-way admitting" that the idea has been around for a while. Its pretty outright explicit.

</comment></comment></comment><comment><USER23> Requires GNUStep on Linux? This is very baked into the NeXT world it would appear.

<comment><USER24> Unar uses GNUStep too, and it's not the same as a full GNUStep desktop setup. It uses far less dependencies.</comment></comment>


Mind-Altering Cat Parasite Linked to Multiple Neurological Disorders - <AUTHOR> http://www.sciencealert.com/mind-altering-parasite-transmitted-by-cats-linked-to-several-brain-disorders <comment><USER2> Holy crap, the mandatory few months have passed since this entire fear- uncertainty-doubt bologna gets re-pushed into the "news". This has been going on for years now: it's like click farming, with rotation of the bologna like rotating crops.</comment>


Founder Stories: Reham Fagiri of AptDeco (YC W14) - <AUTHOR> https://blog.ycombinator.com/founder-stories-reham-fagiri-of-aptdeco/ <comment><USER2> Agree that a big thing tech founders need, that MBAs know, is forecasting and financial modeling.

Many tech founders are obsessed with traction, but have no real understanding of how to manage growth from a financial perspective.

Would love recommendations for good resources on financial modeling and forecasting.

<comment><USER3> Hmm, but most startups fail from lack of traction, and rarely because of poor financial modeling.</comment></comment>


Habits of True Strategic Thinkers - <AUTHOR> http://www.bloomberg.com/video/89340777/

<comment><USER2> Err. The video is about other stuff?</comment>


Life Under the Algorithm - <AUTHOR> https://newrepublic.com/article/155666/life-algorithm <comment><AUTHOR> "What Guendelsberger found in her experiment was that employers now 'demand a workforce that can think, talk, feel, and pick stuff up like humans—but with as few needs outside of work as robots. They insist their workers amputate the messy human bits of themselves—family, hunger, thirst, emotions, the need to make rent, sickness, fatigue, boredom, depression, traffic.' The results are 'cyborg jobs,' and they account, by Guendelsberger's reckoning, for almost half of the American workforce. The hidden moments of reclaimed freedom that make any job bearable are being discovered and wiped out by bosses everywhere: That trick you used to use to slow down the machine won't work anymore; or that window of 23 minutes when you knew your boss couldn't watch you is vanishing. Whatever little piece of humanity survived in these fragments dies with them. "</comment>


The source code to healthcare.gov used to be here, removed. - <AUTHOR> https://github.com/CMSgov

<comment><AUTHOR> This was the original link which was buried when it was originally posted 20 days ago:

[https://github.com/CMSgov/healthcare.gov](https://github.com/CMSgov/healthcare.gov)

Discussion:

[https://news.ycombinator.com/item?id=6476905](https://news.ycombinator.com/item?id=6476905)

<comment><AUTHOR> There are forks: [https://github.com/greggersh/healthcare.gov](https://github.com/greggersh/healthcare.gov)</comment></comment>


HTTP static server one-liners - <AUTHOR> https://gist.github.com/willurd/5720255 <comment><USER2> I'm pushing the definition of "one liner" here, and it's got some major shortcomings (including directory traversal!), but here's one with Gnu awk:

      gawk '@load "filefuncs";func send(s,e,d,t,b) {;print "HTTP/1.0 "s" "e|&S;print "Content-Length: "b|&S;print"Content-Type: "t|&S;print d|&S;close(S);}func mt(f) {;c = "file -b --mime-type " f;r="";while ((c|getline z)>0) {;r=r z;}  ;close(c);return r;} ;BEGIN {RS=ORS="\r\n";while(1){;S="/inet/tcp/8080/0/0";while((S|&getline l)>0) {;split(l,f," ");if(f[1]=="GET"){p=substr(f[2],2)}if(p==""){p="index.html"}stat(p,s);if (s["type"]=="file") {;m=mt(p);while ((getline i
0){o=o i}send(200,"OK",o,m,s["size"]);break;} ;n="Not Found";send(404,"Not Found",n,"text/html",length(n));break;}}}'

edit: Added better mime-type detection and 404s. It actually sorta works well now.

<comment><USER2> Oof. It wasn't handling binary files. Also fixed directory traversal, and you can optionally specify a content directory on the cmd line.

      gawk '@load"filefuncs";@load"readfile";func send(s,e,d,t,b){print"HTTP/1.0 "s" "e|&S;print"Content-Length: "b|&S;print"Content-Type: "t|&S;print d|&S;close(S);}func cf(x){split(x,y,"/");for(z in y){print "FOUND "y[z];if(y[z]==".."){return 0;}}return 1;}func mt(f){c="file -b --mime-type "f;r="";while((c|getline z)>0){r=r z;}close(c);return r;}BEGIN{if(ARGV[1]!=""){if(chdir(ARGV[1])){print "Failed to chdir to "ARGV[1];exit;}ARGC=1;}RS=ORS="\r\n";while(1){S="/inet/tcp/8080/0/0";while((S|&getline l)>0){split(l,f," ");if(f[1]=="GET"){p=substr(f[2],2)}if(p==""){p="index.html"}stat(p,s);if(cf(p)&&s["type"]=="file"){m=mt(p);o=readfile(p);send(200,"OK",o,m,s["size"]);break;}n="Not Found";send(404,"Not Found",n,"text/html"RS,length(n));break;}}}'

<comment><USER3> You are a hero good sir or madam. Is this redistributable with attribution?

<comment><USER2> Heh. Sure...licensed under WTFPL. [http://www.wtfpl.net/about/](http://www.wtfpl.net/about/)

<comment><USER4> Very clever command but be warned, the link is NSFW.

</comment></comment></comment></comment></comment><comment><USER5> There is of course rclone: [https://rclone.org/commands/rclone_serve_http/](https://rclone.org/commands/rclone_serve_http/)

        rclone serve http .

You can replace . with any of your other cloud storage backends too (s3, google drive, dropbox, etc), or http with sftp, webdav, ftp, dlna. It works on Windos/macOS/Linux.

(Rclone author ;-)

<comment><USER6> rclone is our backup solution at work, huge props to you!

</comment></comment><comment><USER7> Asked for an HTTPS one liner on stackoverflow a while back and got this answer:

        ruby -r webrick/https -e '
          WEBrick::HTTPServer.new(
            Port: 8000, DocumentRoot: ".",
            SSLEnable: true, SSLCertName: [%w[CN localhost]]).start'

[https://stackoverflow.com/a/37986354/59325](https://stackoverflow.com/a/37986354/59325)

<comment><USER8> Caddy is brilliant for this task.

<comment><USER9> For reference the HTTPS one-liner with Caddy [1] would be:

        caddy file-server --domain example.com

And similarly for HTTPS reverse proxy:

        caddy reverse-proxy --from example.com --to localhost:9000

[1]: [https://caddyserver.com/](https://caddyserver.com/)

This plus hosts file can be a quick way to test secure cookies, secure headers, etc.

</comment></comment></comment><comment><USER10> Netcat ones are my favourite, I use them frequently: [https://gist.github.com/willurd/5720255#gistcomment-2851087](https://gist.github.com/willurd/5720255#gistcomment-2851087)

The same thing, in `batch` for Windows: [https://github.com/rahuldottech/netcat-http-server-for- windo...](https://github.com/rahuldottech/netcat-http-server-for- windows/blob/master/simple/simple.cmd)

</comment><comment><USER11> Using `nix` I have an alias called `serve` that runs `nix run nixpkgs.caddy -c caddy -host 0.0.0.0 -port 8000 browse` which will download Caddy if it is not in my cache and then run it. It's one of my favorite aliases and I use it way more frequently than I'd expect.

</comment><comment><USER12> Like some others in this thread I'll throw in my own shameless plug for `serve`: [https://github.com/philippgille/serve](https://github.com/philippgille/serve)

It's similar to the others mentioned here, with the nice extras that there's optional basic auth, optional HTTPS with automatic creation and use of a self- signed certificate, there are installers for most popular OS's package managers (snap, homebrew, scoop, chocolatey), tiny 2-5 MB zero-dependency binary and some other features.

I've had plans to add automatic Let's Encrypt certs, Onion service creation and reverse SSH functionality (either using one's own SSH server or one of the public ones) for a while and hope I'll get to them soon. Does anyone have any specific preferences for one of those or another feature specifically for the use case of serving files to another person as quickly as possible?

</comment><comment><USER13> I'm surprised there's no one-liner for Node without dependency since it has a server by default.

Edit: Didn't know there was an `eval` flag for Node, so that will do the job:

node --eval "var fs = require('fs'), http = require('http'); http.createServer(function (req, res) { fs.readFile(__dirname + req.url, function (err,data) { if (err) { res.writeHead(404); res.end(JSON.stringify(err)); return;}res.writeHead(200);res.end(data); });}).listen(8080);"

<comment><USER14> Doesn't protect against folder climbing/traversal like `curl :8080/../../etc`.

<comment><USER15> Huh .. that'd be a fun post; see how many of these can be susceptible for climbing out of their web root. The author does list which ones support dir indexes.

<comment><USER16> hopefully you're not using a one-liner for your actual deployment. I use it for no stakes development

<comment><USER14> Caddy is a one-liner. Plenty of the one-liners are suitable for production. There are so many solutions that you might as well use one, even in development, that doesn't have such glaring issues, because you're basically training your muscle memory to reach for it.

</comment></comment></comment></comment></comment><comment><USER17> It's missing my personal favorite:

ngrok http file:///Users/alan/share

<comment><USER18> You might want to include a disclaimer that you're the author, maintainer and person behind the company that operates ngrok ;)

Just wanted to chime in and say I love ngrok too, not allow allows you to easily create proxies, it allows you to create proxies that also works on the public internet (ngrok assigns you a x.ngrok.io address) and with tcp connections. Great work on it inconshreveable!

</comment></comment><comment><USER9> Another good option for static site development is devd [1] [2] which can automatically open the site in browser with livereload:

       devd -ol .

[1]: [https://github.com/cortesi/devd](https://github.com/cortesi/devd)

[2]: [https://news.ycombinator.com/item?id=10436111](https://news.ycombinator.com/item?id=10436111)

</comment><comment><USER19> Shameless plug: [https://github.com/svenstaro/miniserve/](https://github.com/svenstaro/miniserve/)

</comment><comment><USER20> Some of these aren't one line but could be (for example the one for node.js can use npx instead)

</comment><comment><USER21> I was pleased and surprised that the Python 3 one works with Termux on this cellphone. I've had trouble with Python socket stuff on here in the past, but now I suspect that may have been specific to IP multicast.

<comment><USER22> The busybox one works too

</comment></comment><comment><USER23> There is woof: [http://www.home.unix- ag.org/simon/woof.html](http://www.home.unix-ag.org/simon/woof.html)

When -U is specified, it provides an upload form, allowing file uploads.

</comment><comment><USER24> I've been using this:

        npx serve

(This is a node.js thing.)

<comment><USER25> Unlike `python3 -m http.server`, `npx serve` doesn't redirect `/path/to/dir` to `/path/to/dir/`. This is a problem if you are using relative paths in your `/path/to/dir/index.html`.

<comment><USER24> For my purposes that hasn't been a problem.

I guess I would normally just start with 'path/to/dir/' or '/path/to/dir/index.html'

</comment></comment></comment><comment><USER26>
      php -S localhost:8000

</comment><comment><USER27> Lwan ([https://lwan.ws](https://lwan.ws)) can also be used like this, although I wouldn't call it a "one liner" like many of the examples listed there:

        lwan -r /path/to/files/to/serve

</comment><comment><USER28> I still have a copy of bash-httpd laying around, if any of y'all remember this: [http://frakir.org/~morty/lue/bash- httpd.html](http://frakir.org/~morty/lue/bash-httpd.html)

</comment><comment><USER29> Don't forget socat.

Or tcpserver from djb

.

</comment><comment><USER30> Does someone know if there is a way of doing this purely with POSIX tools?

<comment><USER31>
      while TRUE; do { echo -e 'HTTP/1.1 200 OK\r\n'; cat /path/to/thing; } | nc -l 8000; done

From: [https://krypted.com/](https://krypted.com/)

<comment> ainar-g Neither echo -e nor nc are POSIX. I don't think there is a strictly POSIX one- liner.

<comment><USER30> `echo -e` should be easily replaceable with `printf` but nc remains to be a problem.

<comment><USER2> Is inetd "Posix"? It has command line switches to not fork, and to specify the config file. Maybe it takes a config file of "-" to mean stdin.

<comment><USER30> I doubt it. At least I can't find it anywere here:

[https://pubs.opengroup.org/onlinepubs/9699919799/utilities/c...](https://pubs.opengroup.org/onlinepubs/9699919799/utilities/contents.html)

</comment></comment></comment></comment></comment></comment><comment><USER32> If you use npx http-server -p 8080

You don't need to fully install globally

</comment><comment><USER33> How many of these can output a "standard" access log?

Instructions for how to do that would be a helpful addition to this page.

<comment><USER34> The Crystal version can. I just commented an update for it that will run on 0.32.1, but for logging you can include the HTTP::LogHandler:

      crystal eval 'require "http/server"; server = HTTP::Server.new([HTTP::LogHandler.new, HTTP::StaticFileHandler.new(".")]); server.bind_tcp(8080); server.listen'

</comment></comment><comment><USER29> rarun2 from radare2

       rarun2 listen=80 program=/usr/bin/printf arg1="HTTP/1.1 200 OK\r\nContent-type=text/html\r\nConnection: close\r\n\r\n"

</comment><comment><USER35> Last revised in 2013 FYI.

</comment><comment><USER36> My favourite...

        apt install nginx

Why settle for less.

</comment><comment><USER37> Bit of a stretch but you can also use curl if you proxy it through my patchbay.pub[0] service:

curl [https://patchbay.pub/abcd1234.html](https://patchbay.pub/abcd1234.html) \--data-binary @index.html

[0] [https://patchbay.pub](https://patchbay.pub)

</comment><comment><USER38> Lots of people use these one liners for Dev/test environments.

Most of those people aren't aware how insecure they are.

For example, with the python SimpleHTTPServer I can simply request [http://localhost/../../.ssh/id_rsa](http://localhost/../../.ssh/id_rsa)

All your SSH private keys are now mine. I can steal your browser cookie database and get into your email/Facebook/Twitter in the same way.

 _Any_ web page can request that, or any software on any machine on your local network.

<comment><USER39> > _For example, with the python SimpleHTTPServer I can simply > request[http://localhost/../../.ssh/id_rsa](http://localhost/../../.ssh/id_rsa) > _

Eh! That's not true. I just tried and both Python 2.7.16 and Python 3.7.6 return a "404 Not Found" when I try to download and existing file that is located one or more levels up from the directory where the HTTP server was started. Here is a screenshot showing both results: [https://i.imgur.com/uizp7zV.png](https://i.imgur.com/uizp7zV.png)

<comment><USER38> Maybe behaviour has changed recently? In a past version someone has demonstrated this attack on me...

<comment><USER40> AFAICT SimpleHTTPServer has been protected against basic traversal attacks for a very long time.

There have been bugs though, like [https://bugs.python.org/issue26657](https://bugs.python.org/issue26657)</comment></comment></comment></comment>


Static Web Apps - <AUTHOR> http://www.staticapps.org/

<comment><USER2> why call it "static", when it's obviously dynamic?

<comment><USER3> Because the server isn't dynamically producing web pages?

(I actually moved to this model myself recently - server producing data, client using Angular to display it.)

<comment><USER2> It's still misleading. There's already a term for it. It's "single page web apps". Also they are quite dynamic, as they change the browser state through Javascript and HTTP requests to the server. Nevermind.

<comment><USER4> Static Apps also encompass statically compiled web apps (e.g. Jekyll sites), so it's not just SPA. I've also always hated the term Single-Page App, it's like "horseless carriage." I prefer the term "Web Client."

That being said, there is lots of confusion out there because of the term static. While the term is accurate in terms of using static file servers to run web applications, I'm beginning to think a new term might be necessary.</comment></comment></comment></comment>


Euclid's algorithm in the Shell - <AUTHOR> http://shiroyasha.github.io/arithmetic_in_the_shell.html

<comment><USER2> Once you go to the trouble of naming the script, might as well show off a recursive version as well:

      #!/bin/sh

      a=$1
      b=$2

      # base case
      if [ $b -eq 0 ]
      then
        echo $a
        exit
      fi

      echo $(./gcd.sh $b $(($a % $b)))</comment>


Modeling with Uncertainty - <AUTHOR> https://blog.sigopt.com/posts/modeling-with-uncertainty <comment><AUTHOR> Hi, I'm one of the founders of SigOpt (YC W15). This is part 1 of a 3 part series we'll be doing on uncertainty in modeling and optimization. Let me know if you have any questions about this post or SigOpt in general. Mislav was recently a Research Engineering Intern with us and wrote this post with our research team lead, Michael Mccourt. If you're a student looking for internships please check out our careers page [1]. Our platform is also free for academics [2]. You can find more of our research (including NIPS, ICML, AISTATS, etc papers) here [3].

[1]: [https://sigopt.com/careers](https://sigopt.com/careers)

[2]: [https://sigopt.com/edu](https://sigopt.com/edu)

[3]: [https://sigopt.com/research](https://sigopt.com/research)</comment>