OSX.Pirrit Mac Adware Part III: The DaVinci Code - <AUTHOR> https://www.cybereason.com/blog/targetingedge-mac-os-x-pirrit-malware-adware-still-active <comment><USER2> This "legitimate adware" is abusing an installation process to gain persistence.

I have a feeling BlockBlock (Objective-See) would be able to intercept and block the installation of the plist.

> [https://www.objective- > see.com/products/blockblock.html](https://www.objective- > see.com/products/blockblock.html)

If a third party app is installing a com.apple.<whatever>.plist, be aware of it.

<comment><USER3> That's a very useful security program. Thanks for the heads up!

Reminds me of the security monitoring software that Google released for MacOS.

</comment></comment><comment><USER4> The most disappointing thing I saw is the resumé. It makes me very sad for the software development profession that actively subverting the privacy of users and controls of their operating system is something seen as a positive.

<comment><USER5> I suppose you could say the same about those who worked on Intel ME, Computrace[1], and maybe other DRM technologies too?

Personally, I can refuse an offer from Google or Microsoft because I do not agree at all with their vision, regardless of how much they want to compensate me, but it really is a difficult situation to be in --- people get asked to do things which are against their personal beliefs all the time, and there may well be other reasons why someone would work for such companies, so I don't find it unusual that he would try to make the best of it.

[1] [https://news.ycombinator.com/item?id=2500472](https://news.ycombinator.com/item?id=2500472)

</comment></comment><comment><USER3> TIL you can use AppleScript to inject Javascript into every browser page you visit, regardless of browser, as an alternative to using a browser plugin to (for example) monitor every website you visit.

<comment> yjftsjthsd-h As with many power tools, that's actually really cool and there are some neat ways to use such a thing. It's just that in this case it's getting horribly abused to subvert the user's control of their own system.

(Examples: You could use such a thing to block ads, or archive sites as you browse them)

</comment></comment><comment><USER6> The images were broken for me, so I found the PDF a lot better of a read: [https://www.cybereason.com/hubfs/Content%20PDFs/OSX.Pirrit%2...](https://www.cybereason.com/hubfs/Content%20PDFs/OSX.Pirrit%20Part%20III%20The%20DaVinci%20Code.pdf)

</comment><comment><USER7> I worked for other adware maker in IL (left after couple of months, when I realized how the company actually makes money), it's pretty big industry here since we have a lot of adtech and endless appetite for easy money. AMA.

</comment><comment><USER8> OK, so how do I see if I am infected?

<comment><USER9> Look for com.<dictionary_word>.plist in ~/Library/LaunchAgents/ where <dictionary_word> is a random word from /usr/share/dict/words (the unix word file).

<comment><USER10> KnockKnock [1] is also a very nice tool that scans your system for stray launch agents, kexts, and browser extensions. It also passes what it finds through VirusTotal.

[1] [https://objective-see.com/products/knockknock.html](https://objective- see.com/products/knockknock.html)

</comment></comment></comment><comment><USER11> Gross. If you want your adware/pup to act like malware, expect to be treated like malware.

</comment><comment><USER12> Wait, osascript can inject HTML and Javascript into the DOM? How is that okay?

<comment><USER13> I agree with my sibling comments that in current OSs, desktop apps — especially ones with root — are generally as privileged as the user, and that's (supposed to be!) a good thing.

However, Chrome's AppleScript support was used almost exclusively by malware, so it's disabled by default now: [https://crbug.com/661810](https://crbug.com/661810).

<comment><USER4> If Apple had invested as much in AppleScript as other parts of the OS I'm sure we'd see a 'Can automate other applications' setting in the Privacy controls. Not sure that'd help much here as the app is a Trojan but it'd be helpful to limit the activity while removing it.

<comment><USER14> We have one, to an extent. AppleScript is supposed to be IPC, so the published interfaces for AppleScript are governed by the applications responding to the requests. However, the generic "simulate human input" response is restricted using the "Allow these apps to control your computer" setting in System Preferences -> Security & Privacy -> Privacy -> Accessibility.

</comment></comment></comment></comment><comment><USER15> This was a nice write up which I enjoyed a lot. Thank you!</comment>


Why the US stores 700M barrels of oil underground - <AUTHOR> http://www.bbc.com/future/story/20150921-why-the-us-hides-700-million-barrels-of-oil-underground <comment><USER2> > _But there's an important line to draw between that and using an SPR for ad > hoc manipulation of the world's markets. On this point, Martin Young is > emphatic: "The oil stocks are not there for price management as such," he > explains, "they're there to correct a shortage in the market because of a > supply disruption."_

Strategic reserves can absolutely also be used as an offensive economic weapon, however. As one example, when Salvador Allende became President of Chile in the early 1970s and nationalized Chilean copper mining, the US dumped >250,000 tons of copper from its strategic reserves onto the world market, crashing the price, in a (quite successful) attempt to destabilize the Chilean economy, which was heavily reliant on copper exports. Of course when that still didn't lead to Allende's downfall, plan B was a CIA-sponsored military coup.

<comment><USER3> I am not beyond believing that the current gutting of oil prices was done at the US's behest to damage Russia. It wouldn't take too much in the way of guarantees to Saudi Arabia to have them swamp the markets. Far more effective than military intervention.

<comment><USER4> Sorry but that's nonsense. It's a well known and indeed publically admitted strategy by the Saudi's to drive US shale producers out of business. Google "saudia arabia united states oil price" for many authoritive hits on the subject.

Russia was collateral damage.

<comment><USER5> Why not both? Gives a better reason for the Saudi's to go along with the plan. They help the US political side and get paid in political good will and getting to damage the US competitors.

<comment><USER6> because we don't care that much about Russia. This isn't the 80's.

OPEC got greedy, that created room for shale, and Russia got hurt.

<comment><USER7> Hello, there's a fairly warm little proxy war going down right now in Ukraine and an increase in Russian forces in Syria. The 80's were the nice hopeful bit.

<comment><USER6> yes, those were the days when Russia could at least hope they would win a war with us

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> The use of "hides" is a bit clickbaity, if they said "stores" then people would have thought it a perfectly reasonable thing to do.

<comment><USER9> Not just clickbaity but factually incorrect. There are right there for everyone to see (from Google Maps) ...

[https://www.google.com/maps/place/Bryan+Mound+Strategic+Petr...](https://email@example.com,-95.3769125,1289m/)

<comment><USER10> It has its own webpage at the DOE. Some secret. Sadly, HN often falls for click-baity articles with an anti-US or conspiratorial spin to them.

[http://energy.gov/fe/services/petroleum- reserves/strategic-p...](http://energy.gov/fe/services/petroleum- reserves/strategic-petroleum-reserve)

<comment><USER11> There's no shortage of conspiratorial comments and posts about Russia and China on HN either. There's something about conspiracies which captures our imagination but there needs to at least be some basis in the facts.

</comment></comment></comment></comment><comment><USER12> Don't think of it as 700 000 000 barrels.

Think of it as 0.13 years of oil for the USA alone or 0.02 years of oil for the World.

<comment><USER13> Or think of it as X years of oil for the USA military (where I don't know X).

<comment><USER14> Or several decades worth of oil for our cyborg overlords.

<comment><USER15> Or 1 million of our brave, cyborg killing, wind powered, polymer constructed, automated freedom fighters.

<comment><USER14> Or infinite eons of entropic sex toys for the post eschaton neuro-orgey.

<comment><USER16> Please don't try to turn this place into Reddit with comment chains like this...

</comment></comment></comment></comment></comment></comment><comment><USER17> When my Uncle worked out in China about 15 years ago, a local dignitary was giving him a tour of the local area.

He noticed what looked line capped oil wells in the fields. When he asked what they were the official confirmed that they contained oil, which "we will only start using once we can't buy anymore from anyone else".

I've never heard of China having their own oil fields so I assume that there was something lost in the translation but regardless, it was an interesting insight into the Chinese psyche.

<comment><USER18> Charlie Munger has mentioned the same "use theirs first" approach:

"The imported oil is not your enemy, it's your friend. Every barrel that you use up that comes from somebody else is a barrel of your precious oil which you're going to need to feed your people and maintain your civilization."

[http://seekingalpha.com/article/1631292-charlie-munger- think...](http://seekingalpha.com/article/1631292-charlie-munger-thinks-oil- is-absolutely-certain-to-become-incredibly-short-in-supply)

<comment><USER19> The disingenous (or ignorant) thing about that sort of thing is that it makes no mention of alternative fuel prices. Coal and natural gas can be refined into gasoline. This is obviously not a great idea from an environmental standpoint, but from a cost standpoint it becomes economically viable when oil hits about $70/barrel.

Electrolysis-refined hydrogen becomes economical when oil hits $200/barrel, and that has a lot of environmental benefits. I would bet if oil stayed over $120/barrel for several years the economic incentives would kick in and someone would find a way to make hydrogen cost-competitive, probably even eventually bringing the cost down so it's similar to current oil prices.

[http://www.greencarcongress.com/2014/06/20140609-lux.html](http://www.greencarcongress.com/2014/06/20140609-lux.html)

<comment><USER20> The US tapped out its highest-profit traditional oil wells a long time ago, and used the export profits to grow its economy. Now the US is awash in fracked gas.

The "sit on it" strategy assumes that the resource held in reserve will not become obsolete. It makes more sense to me to pull it all out of the ground as fast as you can, so you can sell more of it when the global price is highest, rather than being forced to buy at that time.

Didn't China learn anything from its rare earths play? The supply curve never really hits a brick wall. As long as the price keeps going up, the market keeps producing more to sell. And even if you hit a hard limit, such as by exhausting all the cheap wells and mines, human ingenuity often produces an acceptable substitute.

Many countries are burning the petroleum as fast as they can, keeping the computers running for the engineers researching wind, solar, nuclear fission, geothermal, hydrogen, fracking, cellulose enzymes, algae oils, nuclear fusion, radioisotope thermal, external combustion engines, generator-electric hybrids, fuel cells, denser batteries, more efficient motors and transmissions, and a whole host of other technologies that will finally be ready to take over, once the last oil on Earth is being burned by China to keep its lights on and tractors running.

Everyone else will be running their tractors with fuels mixed up from agricultural waste, and keeping the lights on with a dozen different competing technologies.

It seems like a bad strategy to me, but I'm not Chinese.

<comment><USER21> What was China's rare earths play?

<comment><USER20> After China became practically the sole supplier of rare earth elements to the entire world, they restricted exports in 2011, creating shortages everywhere outside of China.

It caused a lot of companies to reexamine their supply chains, this time considering factors _other_ than just price per ton. Several nations started subsidizing domestic production from mothballed facilities for strategic economic reasons. China went from 95% share of that market to less than 80%.

Essentially, they were expecting to get higher prices by restricting output as a monopoly supplier, but it blew up in their faces.

</comment></comment></comment></comment></comment></comment><comment><USER22> > "Periodically when caverns are empty you can actually shoot sonar images of > the caverns," says Corbin. "And that gives you a three-dimensional way of > looking at them." Some have interesting shapes, he adds. The outline of one > chamber, for example, would resemble a large flying saucer.

Mm yes this is a conspiracy theory waiting to happen

</comment><comment><USER23> Not entirely related to the US supplies, but did this stand out to anyone else?

> The facility at Shibushi, for example is just off-shore. Following the > catastrophic earthquake and tsunami which struck Japan in 2011, calls were > made to expand the country's oil stocks in case of crises in the future > which might hamper oil distribution again.

One of the most volcanically and tidally affected and nautically food- dependent nations on earth thinks it's a good idea to hold _millions of barrels of oil_ on their coastlines?!

</comment><comment><USER24> China is aggressively trying to do the same thing, attempting to boost their storage to 500m barrels, and buying a lot of oil right now while it's cheap (something the US should be doing, to further bolster its 700m barrels):

[http://www.bloomberg.com/news/articles/2015-09-17/even-a- slo...](http://www.bloomberg.com/news/articles/2015-09-17/even-a-slowing- china-is-oil-s-best-defense-against-deeper-slump)

</comment><comment><USER25> I always wondered how they stored the oil- salt mines are a good way of doing it I suppose. Reminds me of a certain science-y game...

</comment><comment><USER26> >largest of the four, near the tiny city of Freetown, Texas

A little weird that I cannot find a "Freetown, Texas" using Google. I like to look at places on a map when they are mentioned in articles.

Maybe they got the name wrong, or is it so small it's not on the map?

Or I'm using Google wrong :)

<comment><USER27> It's Freeport, not Freetown: [http://energy.gov/fe/services/petroleum- reserves/strategic-p...](http://energy.gov/fe/services/petroleum- reserves/strategic-petroleum-reserve)

</comment></comment><comment><USER28> Two quick comments:

"Hides" is a stupid word. It's not hidden; it's well-advertised.

The reporter calls it "expensive" because it costs $200m/year. That's not expensive, that's ridiculously cheap insurance; it's surely one of the most cost-effective government programs in existence.

(I stopped reading at that point.)

<comment><USER12> It's an insurance and once it is really needed it will be worth more than all dollars combined.

In my opinion the amount of stored oil is ridiculously low with about 8 days of world oil consumption. It can only be used to iron out minor hiccups on the world production or to power the US military and US emergency food supply for some time. Is this reporter telling us that this little safety measure isn't worth that amount of money?

<comment><USER29> I think it would make sense to compare the barrels with _US_ demand and not global demand. I couldn't find a good recent estimate of US oil demand. Wikipedia says it was ~18M/day in 2011. That would mean about 40 days of reserves, which is pretty good, IMO.

<comment><USER28> More recent figures can be found here: [http://www.eia.gov/dnav/pet/PET_SUM_CRDSND_K_M.htm](http://www.eia.gov/dnav/pet/PET_SUM_CRDSND_K_M.htm)

We (the United States) produce around 9 million barrels per day, and could produce more if necessary. We import a bit more than 7 million barrels per day.

We wouldn't need to replace domestic production, so the strategic reserve would cover about 100 days of lost imports. But there are few if any scenarios where we'd lose _all_ imports -- most likely we'd lose access to only a small fraction of imports, and even that kind of shock would spike prices and thus our consumption would drop and domestic production would increase -- so the reserve can be expected to last far more than 100 days. (If we are ever in a situation where it seems plausible the reserve might be exhausted, e.g., a major global war, then extreme conservation measures will be enforced, and the discussion changes state.)

</comment></comment></comment></comment><comment><USER30> 700 megabytes is a lot of barrels....</comment>


YC startup launches: Project Wedding - <AUTHOR> http://www.projectwedding.com/ <comment><AUTHOR> The company name looked familiar, and sure enough: it's the YouOS company. https://www.youos.com/

So have they decided the web desktop thing isn't in demand?

<comment><USER2> I think they wanted to build a specific webapp as a way of learning what webapp developers need. I believe there's YouOS code under this.

<comment><USER3> From the source, it looks like this is running on RoR... wasn't YouOS re- written using web.py a bit back?

</comment></comment></comment><comment><USER4> Hrm

I don't know how they're going to compete with theknot.com. I've thought of this idea before and searched out the competitors. Every women and girl out there knows theknot is where you go to plan weddings. theknot is featured in every women magazine available. Heck, I don't plan on getting married anytime soon and I even know you go to theknot.

But hey, it's cool they're trying new things out but they seriously need talk to women before diving into a woman industry related area.

<comment><USER5> Well, ProjectWedding.com was designed by women and it is steadily growing (it currently receives 10,000 page views a day from northern california bride-to- bes).

It's assumptions like yours about theknot.com's monopoly which make this "project" (pun intended) particularly enticing :)

</comment></comment><comment><USER6> I had this same idea about 6 months ago (right around the time I got engaged ;). What is going to set you apart from theknot.com? I don't disagree that you could do it better than the knot but competing what that marketing machine is right up there with fighting Google.

</comment><comment><USER7> Logo is misleading. Wedding rings are traditionally plain gold bands. Engagement rings are the ones with the rock.

<comment><USER8> Great to point out, but isn't that irrelevant?

<comment><USER9> Knowing tonnes of women might be using the site, many WILL notice it:) For such sites details matter a lot; and getting the basics such as this wrong can get your users to lose trust in your site.

<comment><USER10> Engagement rings are closely related to weddings. If you polled women about the logo, I doubt you'd get any who would consider it "wrong".

<comment><USER9> Point taken. If that's the case then I guess there is nothing broken here and I'm assuming folks behind the site did their homework when creating the logo.

I do love the overall site design.</comment></comment></comment></comment></comment>


The Most Desirable JavaScript Frameworks of 2015 - <AUTHOR> http://hackajob.co/blog/desirablejavascriptframeworks2015/

<comment><USER2> Which of these is not like the other?

<comment> bmir-alum-007 Maybe the platform runtime one, but I could be wrong. ;)

<comment><USER3> Also, is React a framework?

<comment><AUTHOR> What would you say is the best way to describe React?

<comment><USER3> Hard to say.

"A JavaScript library for building user interfaces" is what React calls itself.</comment></comment></comment></comment></comment>


How 'Do Not Track' Ended Up Going Nowhere - <AUTHOR> http://recode.net/2016/01/04/how-do-not-track-ended-up-going-nowhere/ <comment><USER2> I didn't read much of the article, because to me at least it's fairly obvious why advertisers who have a large financial motivation for tracking, and no disincentive for tracking users who don't wish to be tracked; will track.

As far as I understand the implementation is a lot like RFC 3514[0], which was published as an April 1st joke.

[0]: [https://www.ietf.org/rfc/rfc3514.txt](https://www.ietf.org/rfc/rfc3514.txt)

</comment><comment><USER3> I don't know what was proposed. My understanding of the original Do Not Track was it was about as effective as wearing a t-shirt that says "do not look at me" and expecting the world to obey.</comment>


No one could see the color blue until modern times - <AUTHOR> http://www.businessinsider.com/what-is-blue-and-how-do-we-see-color-2015-2

<comment><USER2> Gladstone wasn't aware that the Greeks and other ancient peoples used brightly coloured paints on their statues and buildings.

Because articles like the linked one keep coming up, I've just submitted on HN an article from the British museum about the extensive findings of "Egyptian blue" on the Parthenon:

[https://news.ycombinator.com/item?id=9972478](https://news.ycombinator.com/item?id=9972478)

This shows that Lapis lazuli was available throughout the Mediterranean, not just Egypt.

Cobalt was used to colour glass during the Bronze age:

[https://en.wikipedia.org/wiki/Uluburun_shipwreck](https://en.wikipedia.org/wiki/Uluburun_shipwreck)

The Mycenaeans used blue glass for necklace pendants:

[http://www.cmog.org/artwork/necklace-glass-pendants-and- faie...](http://www.cmog.org/artwork/necklace-glass-pendants-and-faience- beads)

The colour blue has also been found in mosaics and paintings unearthed at Pompeii:

[http://www.pompeionline.net/pompeii/painting.htm](http://www.pompeionline.net/pompeii/painting.htm)

When examining the existing ancient literature to extrapolate on colour perception, it's important to remember that only a minuscule fraction of ancient literature survives to this day.

</comment><comment><USER3> This article claims that some Himba subjects were entirely unable to discriminate blue from green, but this alleged experimental finding is a myth owing to irresponsible BBC producers. See these Language Log posts:

[http://languagelog.ldc.upenn.edu/nll/?p=17970](http://languagelog.ldc.upenn.edu/nll/?p=17970)

[http://languagelog.ldc.upenn.edu/nll/?p=18237](http://languagelog.ldc.upenn.edu/nll/?p=18237)

</comment><comment><USER4> And people couldn't communicate before email.</comment>


Police sent warrant to Facebook for information on Philando Castile's girlfriend - <AUTHOR> https://www.techdirt.com/articles/20170623/06000037650/cops-sent-warrant-to-facebook-to-dig-up-dirt-woman-whose-boyfriend-they-had-just-killed.shtml <comment><USER2> There are so many things I can't even believe about this case.

One of them is how many people are willing to believe absurd theories in order to justify this murder.

Castile was a law-abiding citizen, with a job, a girlfriend, people who cared about him, and no criminal record. Why would _anyone_ believe he would reach for a gun with an officer pointing a gun at his chest? Why is that even a claim that can be taken seriously?

So many people say, "We can't know what happened in the car." Unless you believe a rational, by all accounts kind-hearted, adult with no history of violence or crime would suddenly decide to have a shootout with cops with a little girl in the car, we _can_ know what happened in the car.

What must you think of black men to believe a story that is so absurd on the face of it? I've heard the argument that it was the gun that made it possible for people to believe the officer's version of events. But, would anyone believe this story if it had been a white man in his 30s in the same situation?

And, how horrifying must it be to wake up each day, as a black man in America, knowing that a jury of Castile's peers believes that at any moment any black man could snap and go on a murderous rampage? That's the only thing I can come up with that makes any of this work; that white America still believes black men are inherently dangerous.

I'm horrified by every police execution of an innocent person, and one shouldn't have to be a perfect citizen to not be subject to being killed by police. But, this one is the most stark example I can think of where there is no excusing it, and no way to assume the officer had legitimate reason to be afraid (aside from Tamir Rice, a 12 year old with a BB gun, who was given mere seconds from the time of arrival of police on the scene before he was gunned down...by an officer who also faced no consequences).

You have to believe black people are inherently dangerous to believe the police officer's story on this. And, a jury did just that.

<comment><USER3> It was a jury of the officer's peers since Castile is dead and it was the officer on trial. And with demographics being what they are and since the defense is permitted to evaluate and whittle down the jury pool ...

> There were just two black people on the jury of Castile's supposed peers. > Juror One was a young African American man who "works as a shift manager at > Wendy's and personal care attendant for his mom." He expressed some lack of > faith in the criminal justice system, reportedly expressing a belief that > "the wealthy and powerful could get off in the legal system because they > could hire better attorneys." Juror 8 was an 18-year-old Ethiopian American > who has lived in the U.S. since age 10. The Tribune notes that "the defense > tried to strike her due to unfamiliarity with the U.S. legal system, but the > judge denied the attempt."

> The rest of those selected for the jury were overwhelmingly middle-aged > white Minnesotans, many of whom expressly stated support for police or a > belief in the infallibility of the criminal justice system.

[http://www.salon.com/2017/06/23/the-philando-castile-jury- wa...](http://www.salon.com/2017/06/23/the-philando-castile-jury-was-stacked- with-pro-gun-pro-cop-middle-aged-white-people_partner/)

<comment><USER2> You're right, and I shouldn't have phrased it that way. Even with my awareness of my own racism, I used language that put Castile on trial.

Anyway, I'm heartbroken and deeply disappointed in America right now. I'm most disappointed in every white American who will defend this officer, and all the others like him, based on a deep-seated belief that black people are always criminals and never to be trusted.

</comment></comment></comment><comment><USER4> This is revolting.

Do the police just get to go to a judge and literaly say "blah blah blah we want a warrant" and the judge goes "OK"? Because it sure does feel like it sometimes.

In this case FB seems to have done right by its users (or tried to). However is that always going to be the case? Are they always going to be willing, are they always going to find their rebuttal in the hands of someone who is friendly to their argument?

<comment><USER5> It helps if you throw around phrases like "based on my training and experience" but yes, there's plenty of judges who act like literal rubber stamps when it comes to warrants. This is why "due process" doesn't necessarily mean too much, because a lot of the time it's just a case of the law-enforcement agent finding the right judge to show the warrant application to.

<comment><USER6> These systems all really need some kind of feedback loop. E.g. when a judge approves a warrant that is later found to be unjustified, they have to take responsibility. Likewise for not approving a justified warrant, otherwise you might get chilling effects. If both kinds of feedback are present, it should help the judge stay calibrated to an acceptable interpretation of "justified".

<comment><USER3> > Fruit of the poisonous tree is a legal metaphor in the United States used to > describe evidence that is obtained illegally.[1] The logic of the > terminology is that if the source (the "tree") of the evidence or evidence > itself is tainted, then anything gained (the "fruit") from it is tainted as > well.

[https://en.wikipedia.org/wiki/Fruit_of_the_poisonous_tree](https://en.wikipedia.org/wiki/Fruit_of_the_poisonous_tree)

</comment></comment></comment></comment><comment><USER7> I hope it's apparent to more people now how little difference there is between police in America and the gangs they allegedly "protect" us from. Both are unchecked forces doing whatever they want, killing whomever they want for whatever convoluted reason they want. The main differences are that police get to live to potentially kill another day and their gang territory is the entire country. But it's not just the cops. The inhumane jury members led by an inhumane supreme court decision clearly shows that this is what the system is created for. To allow police to get away with murder and anything else. This Facebook warrant is a clear example that there was never any intention of justice in this case, that police only care to serve and protect themselves, and that no one is safe from police in America. No one.

</comment><comment><USER8> > The only upside... is Facebook refused to hand over the information

</comment><comment><USER9> Why is this on Hacker News?

<comment><USER10> Because it highlights the sometimes disturbing intersection between technology and the real world

<comment><USER10> And a counter question: why do techies pretend they have no stake in the civil society they live in?

</comment></comment></comment><comment><USER11> "Yanez was acquitted and Philando Castile is still dead -- a man who did nothing more than try to comply with an officer's orders."

That's a bold claim. If we watch the video, we can see the officer repeatedly saying "stay away from the gun." It's not clear what's happening, but I can at least say I don't know for sure what did in this tragic case.

<comment><USER12> Seems to be pretty clear that the officer was paranoid and shot him without any real reason other than in the officers imagination.

<comment><USER5> Yanez fucked up, hard. He was clearly on edge and nervous from the start, put himself in a bad position, and the verbal commands he gave were utterly _atrocious_.

He asked for proof of insurance and ID, and then once Mr. Castile informed him of his weapons permit, Yanez said "don't pull it out". However, to someone who _isn 't_ intending on pulling out his concealed-carry weapon, "don't pull it out" _does not_ adequately and unambiguously signal "stop moving". Mr. Castile was obeying the command to show his ID and also had acknowledged the order not to pull out his gun. Yanez did not even entertain the possibility that Castile might not be reaching for a gun -- and the phraseology Yanez used is indicative of that. Had Yanez wanted Castile to stop moving altogether, he should have issued an unambiguous command _to that effect_ ; such as "stop moving" or "hands on the dashboard" or "put your hands out the window now".

Yanez got himself all worked up and panicked before even making contact with the people in the car, issued verbal commands that were obeyed to the letter, shot up a compliant person, and then gave weird excuses about the smell of marijuana during questioning. Yes, someone in Castile's position _could have_ stopped moving altogether when hearing "don't pull it out", but it really shouldn't be up to people stopped by police to try to reverse-engineer an officer's intentions and de-escalate the situation to avoid being shot by a nervous policeman. Obeying commands should be sufficient to not get shot up.

<comment><USER11> When you have a cop repeatedly yelling at you to stop pulling out a gun, it's pretty clear the situation is getting intense. After the second time, you'd figure whatever you're doing is wrong and at that point you'd stop... especially with all the police shootings as a black man.

Regardless this is all us trying to put ourselves in that situation when none of us were in it, the videos don't conclusively show what he was doing, and the officer wasn't worked up / nervous from the start – he started off very calm.

We can only speculate on the situation, without living it and fully seeing it how can we judge one way or the other? Clearly there's a larger problem with so many black people in prison and killed by cops in this conntey, but to do justice you have to look at every situation individually.</comment></comment></comment></comment>


WebAudio MIDI-fied Drum Machine - <AUTHOR> http://webaudiodemos.appspot.com/MIDIDrums/index.html <comment><USER2> While neat, all the web audio stuff I've seen fundamentally relies on setTimeout() for sequence playback. This only works at all because the apis let you schedule playback events ahead of time, against their special high resolution timer. To see how it doesn't work, press play and then move to a different browser tab.

The audio processing itself works fine while in the background, but the api makes no facility at all for any sequencing or any user-supplied control-rate data which runs as part of the audio graph. This is rather unfortunate and makes it hard to build real applications.

If somebody knows some solution for scheduling playback events while in a background tab, please speak up. In my own experiments, the very best I was able to do was synthesizing control-like signals inside of a ScriptProcessorNode. I quit before I got it to work, but that's all I could really come up with. The other option would have been to start scheduling 500ms ahead once the tab goes into the background, but you have to know it's coming.

<comment><USER3> Background: I am working on a live music competition game (with video) for freestyle rap. We require an accurate tick in order to synchronize the beat playback across many clients during a freestyle rap battle.

When developing client-side javascript I get the impression that time is running on a thin sheet of rubber. I have also wanted to have a more reliable tick but I often have to move onto other parts of what I am working on.

One useful technique is to try to create a fixed tick that all clients can receive, at least you can use this to nail down some of the rubber sheet. I use a shared tick emitting from the websocket server, and then calculate -- every sec -- how that differs from client time. In order to give clients a synchronized event I "schedule ahead" using setTimeout and this client-server time diff.

</comment></comment><comment><USER4> Now somebody needs to make a 303, hook them up to each other via websockets and we can have a banging html5 rave.

There are a couple of synth examples on the root page of that domain, just need to make 'em scream and squelch. Easier said than done unfortunately.

</comment><comment><USER5> This is great! Here's mine:

{"kitIndex":0,"effectIndex":1,"tempo":100,"swingFactor":0,"effectMix":0.10204081632653061, "kickPitchVal":0.5102040816326531,"snarePitchVal":0.5,"hihatPitchVal":0.5,"tom1PitchVal":0.4285714285714286,"tom2PitchVal":0.5,"tom3PitchVal":0.5,"rhythm1":[2,2,0,0,0,0,1,2,2,0,0,0,1,2,2,2],"rhythm2":[0,0,0,1,0,0,0,0,0,0,0,1,0,1,0,0],"rhythm3":[0,0,0,2,2,2,0,0,0,2,2,0,2,0,2,2],"rhythm4":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"rhythm5":[0,0,0,2,0,1,2,0,0,2,0,0,2,0,0,2],"rhythm6":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]}

<comment><USER3> Could you throw in a couple of CRs in that js, it makes the rest of us have to scroll sideways! Thx...

<comment><USER5> Sorry - have seen my mistake, but there's no Edit link...?

</comment></comment></comment><comment><USER6> Give me a clue... I assume it only works in Chrome. Does it need a developer build? A hidden option to be switched on?

<comment><USER7> works in the latest version of Chrome on OSX for me. Unfortunately I think this line in drummachine.js proves it wont really work in FF/IE: context = new webkitAudioContext();

(I believe FF has a separate mozAudioContext(), cant wait till this stuff is standard in browsers).

<comment><USER8> MIDI is a pretty recent addition to AudioContext so I don't know when you'll ever see it in Firefox or Safari or anything like that. Maybe Safari will get it faster if it's done at the webkit level and not the chromium level...

</comment></comment></comment><comment><USER8> It's too bad it totally chokes as soon as the tab enters the background. I wonder if Google's done any work to ensure it's safe to let web pages send arbitrary byte data to MIDI devices? It seems like that wouldn't necessarily be safe, but maybe they're filtering the data behind the scenes?

</comment><comment><USER9> navigator.getMIDIAccess! When did THAT get here?

<comment><USER10> <http://www.w3.org/TR/webmidi/>

This is awesome!

<comment><USER11> well, i guess this is useless now :) <https://github.com/catshirt/midi.io>

except for cross browser compatibility, which i don't particularly care about for audio experiments.

</comment></comment></comment><comment><USER12> This works brilliantly. You should definitely diable the effect level by default. It sounded awful with it on</comment>


Lessons from Lessing - <AUTHOR> https://www.the-tls.co.uk/articles/public/review-free-woman-feigel-lessing/ <comment><USER2> I clicked because I thought this was Johann Gotthold Lessing. Doris Lessing seems an odd sort to take lessons from.</comment>


Hello from GitHub - <AUTHOR> https://github.com/sindresorhus/refined-github/issues/1469 <comment><USER2> Nice use of emojis. I loved reading those picture stories in Highlights magazine as a kid.</comment>


PC-BSD Evolves into TrueOS - <AUTHOR> https://www.trueos.org/2016/09/01/pc-bsd-evolves-into-trueos/ <comment><USER2> The same excellent team at [http://ixsystems.com](http://ixsystems.com) is behind this. I've not only had a breeze integrating TrueNAS gear into a VMWare environment but I have personally had a FreeNAS mini for years at home and recommend it for many SOHO users who want local storage.

</comment><comment><USER3> Hire a designer to make Lumina less ugly. Sorry I know that sounds harsh, but it looks very 2005.

Make this install on modern laptops. I'm tired of being recommended five year- old Thinkpads.

Fix those and I would consider overwriting my Ubuntu installation

<comment><USER4> > Hire a designer to make Lumina less ugly. Sorry I know that sounds harsh, > but it looks very 2005.

I'm not trying to sound harsh and just have to respectfully disagree.

I don't use Lumina because I don't use DEs, but the looks of it are just right. It's not a regression like most "styles" these days where it's impossible to know half the time what's an interactive widget, or why suddenly the designers think large empty white spaces and large widgets and titlebars are a feature. If I'm at a desktop, I need a desktop environment, not a tablet experience.

<comment><USER5> > I don't use Lumina because I don't use DEs [...]

In fairness, that probably means your preferences will be very different from those people who actually do use desktop environments.

I also think a lot of people (myself included) have a certain nostalgia for older, leaner desktop environments. That doesn't mean they can't be designed _better_ , with more polish, using those same older design cues.

<comment><USER6> I failed to see how control panel was any better in each 95/xp/7/10, except that my enemies can't find anything in it just like me. I also fail to see how w7 explorer became more 'convenient' without up button (and changing backspace key to back) but with annoying Libraries that are not even folders. Or removal of quick launch, so that icons on our taskbars now float and you search for a button to start that app.

What you call polishing is just breaking familiar old-simple and building new- super-innovated-final-solution _each year_. Leave us power users alone, you hipsters!

<comment><USER7> > What you call polishing is just breaking familiar old-simple and building > new-super-innovated-final-solution each year. Leave us power users alone, > you hipsters!

I wish it was only confusing to power users. If it was _actually_ intuitive to end users, it would have a justification. But no. I've yet to see a single user who can wrap their head around Windows 7's virtual libraries and why they're sometimes not acting like a real folder but most of the time do.

</comment></comment></comment></comment></comment><comment><USER8> If anyone else was concerned that they are claiming this without actually being affiliated with PC-BSD, check out [http://pcbsd.org/development/moretrueos/](http://pcbsd.org/development/moretrueos/).

<comment><AUTHOR> Yeah, there's a post on the PC-BSD blog [0] also, but it just links to the submitted URL.

[0]: [https://blog.pcbsd.org/2016/09/pc-bsd-evolves-into- trueos/](https://blog.pcbsd.org/2016/09/pc-bsd-evolves-into-trueos/)

</comment></comment><comment><USER9> > TrueOS® soars above the competition with advanced security features, such as > PersonaCrypt and GELI disk level encryption, to keep your important data > safe and secure.

Has it got kernel/userland ASLR yet?

<comment><USER10> Does their ZFS implementation supports dataset level encryption?

<comment><USER11> Both ZFS and ASLR are more interesting for servers than for desktops. I would like ASLR on my desktop OS, but it's a rather high hanging mediocre fruit. WRT to ZFS, I couldn't care less if it existed on my desktop OS.

<comment><USER12> > ... I couldn't care less if it existed on my desktop OS.

Then you either don't know about snapshots, don't care about data integrity, or have a backup system in place and don't want to replace it with:

      zfs send zroot@snap63 | gzip > /mnt/remotebackup/snap63.gz

<comment><USER13> I remember just before Oracle took over Sun, OpenSolaris was a pretty viable desktop machine. They had a feature called "Time Slider" that was built into Nautilus. It was like Apple's Time Machine, only based on ZFS snapshots instead of backups to a separate disk. You could slide a widget back to get to a previous snapshot of the disk. OS upgrades also worked together with ZFS snapshots so that you could atomically roll back to a previous version just before the upgrade took place. It was all really awesome.

<comment><USER14> PC-BSD ... sorry ... TrueOS Desktop (and Server) has had that idea of ZFS snapshots for "boot environments" for some time.

* [https://blog.pcbsd.org/2012/07/9-1-feature-multiple-boot-env...](https://blog.pcbsd.org/2012/07/9-1-feature-multiple-boot-environments/)

* [https://blog.pcbsd.org/2013/06/pc-bsd-status-update/](https://blog.pcbsd.org/2013/06/pc-bsd-status-update/)

* [https://www.ixsystems.com/blog/a-closer-look-at-the-changes-...](https://www.ixsystems.com/blog/a-closer-look-at-the-changes-in-pc-bsd-trueos-9-2-part-1/)

* [https://www.ixsystems.com/blog/the-revamped-life-preserver/](https://www.ixsystems.com/blog/the-revamped-life-preserver/)

<comment><USER12> Beadm first appeared in Solaris, long before it hit FreeBSD (and then PC-BSD) - so the idea had been around for a while. The issue is fit and finish. Solaris had it tightly integrated and made full use of it. I haven't used PC- BSD for a very long time, but I don't remember it coming anywhere close to Solaris in that regard.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> Is there a way to download the ISO hashes over valid HTTPS? I'm not sure how to verify the ISOs I've downloaded

<comment><USER16> FWIW, this reasonable request can be accommodated without necessarily setting up HTTPS on the download site. The devs could post the checksums on a distinct, 2FA-protected HTTPS site like Twitter, for example [1]

[1] [https://twitter.com/coreinsiderprog/status/69213854723989504...](https://twitter.com/coreinsiderprog/status/692138547239895041)

<comment><USER17> Wouldn't it be easier to just setup an automated Let's Encrypt set up and avoid depending on a third party website?

In any case, they could also just include the keys somewhere in trueos.org, which does support HTTPS.

</comment></comment></comment><comment><USER18> Reading behind the link made me learn about Lumina desktop. I'm curious to why it is not making use of the LxQt effort? They seem to be pretty close in goals...

<comment><USER19> Development on LXQt's been rough lately. I really wish the Lumina guys would have contacted us at some point, reached out to us.

There is a very big lack of manpower, lack of designers, lack of general availability from sysadmins or developers competent at UX.

It saddens me greatly. I used to take care of releases, outreach and UX but focusing on my company means I don't have the time to do that anymore. Despite taking great care to reduce the bus factor as much as possible, right now, LXQt is stuck without a release because there's nobody that both cares about the project and has the time and skills to do this kind of stuff.

This is how the Linux desktop dies. A couple of "big" players doing their own thing and a plethora of small players never trying to partner up with similar projects. LXQt was successful for a long time because it was two small projects that merged into a larger one, but people move on and the momentum gets lost.

<comment><USER17> Just like LXDE and Razor-Qt merged, wouldn't it be a good idea for LXQt to merge with Lumina?

It would not only ensure that LXQt's torch is carried on but also set a great example to all other open source projects that merging provides as great a solution as forking does, although for opposite problems.

<comment><USER19> Sure would be, unfortunately nobody's talking or available to actually do it.

The Razor-Qt merge wasn't an easy project - it took us almost 6 months to complete.

</comment></comment></comment></comment><comment><USER20> Previous discussion: [https://news.ycombinator.com/item?id=12366140](https://news.ycombinator.com/item?id=12366140) (6 days ago, 30 comments)

</comment><comment><USER21> Maybe I'm getting old and my eyes are on the way out, but the readability of this web page can be greatly improved by using the following custom css:

article { font-size: 1.4em; line-height: 1.4em; }

<comment><USER22> It's not just you: [http://imgur.com/a/CfFaS](http://imgur.com/a/CfFaS). Fails WCAG AA accessibility for contrast. (even at your increased font size, I think)

<comment><USER23> God save us from the insane low-contrast mafia. No, that's _not_ intended as sarcasm.

<comment><USER24> I really despise this trend. People who make such webpages completely disregard the existence of users with bad eyesight and those who still use low contrast TFT displays mostly because they can't afford to buy a fancy new IPS panel or just don't know any better. We all should complain about it, otherwise soon it might get to the point where you only will be able to read some webpages on the newest 40 inch OLED displays.

</comment></comment></comment></comment><comment><USER25> Having not followed the development of PC-BSD for the last 5-6 years, can somebody please explain to my why they felt the need to fork FreeBSD? FreeBSD by itself already has a really tiny market share, and to a certain extent many things are much more easily deployed with better package management on a mainstream Linux platform (Debian stable or CentOS 7).

OpenBSD has its own unique niche, but I don't see what great need PCBSD fills that FreeBSD wasn't already doing.

<comment><USER26> Effectively, TrueOS _is_ FreeBSD, plus the work in progress graphics stack that will eventually land in .org base or ports, plus an installer, plus some opinionated settings (kernel build, /etc, /boot/loader.conf), plus some original software (control panels, lumina DE).

This is a valid way to contribute to *NIX -- downstreams that push and pull code to evolve the entire ecosystem.

</comment></comment><comment><USER27> So, is this a fork, or...?

I know they're affiliated with PC-BSD, and I know that PC-BSD is a separate system, but beyond that, I'm lost.

It looks like it may be an RHEL/Fedora thing, with PC-BSD being stable and rock-solid, and TrueOS being bleeding edge. But I could be wrong.

Also, while Lumina looks kind of nice, if I installed this, my next step would be installing either XFCE (the best full-on DE out there) or i3 (the best tiled WM out there).

<comment><USER28> PC-BSD to TrueOS is like BackTrack Linux to Kali Linux.

An evolved product from the same developers.

<comment><USER29> PC-BSD

</comment></comment></comment><comment><USER30> How does this handle turning off Intel ME or the AMD equivalent ? Having a always on PC on my motherboard not under my control does bother me ...

<comment><USER23> That has nothing to do with the OS. The Intel ME is nothing more than some tech which can be leveraged/controlled by the BIOS/EFI - or not. There should always be a setting to just turn it off.

The hysteria over Intel ME amuses me. The clamor should be for a simple on/off switch to always be present in the BIOS/EFI.

<comment><USER30> But A) can you trust the switch really turns it off

B) there is not yet a switch ... So what do we do now while we wait?

</comment></comment></comment><comment><USER31> Great decision unifying PC-BSD under TrueOS.

The real innovation lies in SysAdm:

A new way to manage your Server, Desktop or Cloud-based system. By exposing an API via encrypted REST or WebSockets, it is now possible to remotely control all aspects of your machine, including management of software, updates, boot environments, users, backups, and more.

Truly a flagship FreeBSD "distro".

</comment><comment><USER32> I'd love to learn more! <Clicks "Learn More" button on main page> "Localhost not found". No, not on an iPhone it won't be. EDIT: ah, good, looks like it got fixed.</comment>


The Ultimate Website Prelaunch Checklist - <AUTHOR> http://boagworld.com/business-strategy/pre-launch-checklist <comment><USER2> I'm much more excited about this than the iPad.</comment>


The Chimp and the Surgeon: A History of Heart Transplants - <AUTHOR> http://thechirurgeonsapprentice.com/2015/02/14/the-chimp-the-surgeon-a-history-of-heart-transplants/ <comment><USER2> The article mentions the first human-to-human heart transplant in these words: "It wasn't until 1967 that the first human-to-human heart transplant took place at the Groote Schuur Hospital in Cape Town, South Africa, where a young surgeon named Christiaan Barnard was experimenting with pioneering surgical procedures." I still remember the day when his heart transplant operation in South Africa was front page news in Minneapolis. I told the news to my mom, a nurse, and she startled me by saying she knew Dr. Barnard.

Christiaan Barnard did his surgical residency at the University of Minnesota in the 1950s, the same time my mom moved to Minnesota to work on the pioneering open-heart surgery the university was famous for in that era. A science writer, Leonard Engel, wrote a book about the heart surgery research at Minnesota called The Operation,[1] mentioning many of my mom's acquaintances by name. It was frightening to do any kind of heart surgery in the 1950s, when heart-lung machines to sustain a patient's circulation while the patient's heart was stopped were still new and in development. Barnard, on his part, used to tell the Minnesota surgical teams about his research in South Africa before coming to Minnesota. He was curious about how giraffe circulatory systems could boost blood up the long neck of a giraffe to the giraffe's brain, which requires some amazing adaptations of the usual vertebrate circulatory system.

Dr. Norman Shumway, the third doctor to perform a human-to-human heart transplant, described as the first successful heart transplant in the United States, did his internship and residency at Minnesota.[2] He then moved to Stanford University and performed many dog-to-dog heart transplants before he first had opportunity to transplant a human heart. All the pioneers of heart surgery started out with animal experiments and worked for years on "simpler"\--but still amazing, for the time--operations before their first human heart transplants. There was an international effort at the time to figure out ways to treat heart disease surgically. To this day, heart disease is still a leading cause of death, but age-adjusted death rates have dropped a lot in my lifetime,[3] in part because of prevention and in part because of successful surgical treatment.

[1] [http://catalog.hathitrust.org/Record/006711200](http://catalog.hathitrust.org/Record/006711200)

[2] [https://med.stanford.edu/news/all-news/2006/02/norman- shumwa...](https://med.stanford.edu/news/all-news/2006/02/norman-shumway- heart-transplantation-pioneer-dies-at-83.html)

[3] [https://www.nhlbi.nih.gov/files/docs/research/2012_ChartBook...](https://www.nhlbi.nih.gov/files/docs/research/2012_ChartBook_508.pdf)</comment>


Windows 10 is getting a built-in video conferencing feature - <AUTHOR> https://www.bleepingcomputer.com/news/microsoft/windows-10-is-getting-a-built-in-video-conferencing-feature/ <comment><USER2> Ouch. I would have thought that Microsoft would have learned the hard way that shoving a product into's peoples faces is a great way to kill them. If they did that with Tik _Tok, then Tik_ Tok would be gone in ten minutes. Even Oracle would need a decade to kill Tik*Tok.</comment>


Digispark Pro – tiny, Arduino ready, mobile and usb dev board - <AUTHOR> https://www.kickstarter.com/projects/digistump/digispark-pro-tiny-arduino-ready-mobile-and-usb-de <comment><USER2> Interesting. They appear to be using a software USB-serial implementation on an ATtiny; last time I checked that didn't work on some OSes because CDC serial on a USB low-speed device violated the USB spec.

</comment><comment><USER3> It's sort of surprising to me how many of these kinds of things there are out there that are apparently successful. I guess the key is that they make it accessible to a wider audience by making it Arduino compatible so you don't need to be a full on EE to make use of it like you might if you bought a raw Atmel AVR chip off digi-key or something like that.

<comment><USER4> Not that you need to be an EE when the devices are integrated this much and vendors provide reference implementations but it is worth the money to get a decently built PCB quickly instead of doing it yourself.

</comment></comment><comment><USER5> For those who are interested, there is also another one called Femtoduino, very small too: [http://www.femtoduino.com/](http://www.femtoduino.com/)

</comment><comment><USER6> It is not clear what they mean by "Mobile Development Ready". Does that mean I can use it with a 3G radio? If so how?

<comment><USER7> From the Kickstarter page:

> With Bluetooth Classic, BLE, and Wi-Fi shields and examples for Android and > iPhone - and USB Serial (built-in) connectivity for Android (devices with > USB OTG supporting Serial devices) .

</comment></comment><comment><USER4> Funny how those wireless "shields" have 10x performance of the AVRs on the main board.</comment>


What is a proof, really? - <AUTHOR> http://profkeithdevlin.org/2014/11/24/what-is-a-proof-really/ <comment><USER2> _The usual maneuver by which mathematicians leverage that formal notion to capture the arguments they, and all their colleagues, regard as proofs is to say a proof is a finite sequence of assertions that could be filled in to become one of those formal structures. It's not a bad approach if the goal is to give someone a general idea of what a proof is. The trouble is, no one has ever carried out that filling-in process. It's purely hypothetical._

False. What is "hypothetical" about this formal proof that the reals are uncountable? [http://us.metamath.org/mpegif/ruc.html](http://us.metamath.org/mpegif/ruc.html)

Each step is clickable, and just a few clicks take you back to the axioms. For more, see chapter 1 of the Metamath Book ([http://us.metamath.org/downloads/metamath.pdf](http://us.metamath.org/downloads/metamath.pdf))

How is it that Devlin is unaware of logical systems like Metamath? It's at least 10 years old. [Edit: Maybe 20 years? [http://us.metamath.org/copyright.html](http://us.metamath.org/copyright.html) says "The name "Metamath" has been used publicly by Norman Megill since 1994 to refer to a computer language and related software."]

<comment><USER3> Well, the author's point is probably still generally correct - in almost all fields proofs are not presented from axioms, and you could easily go your whole life as a mathematician without encountering such a proof, except perhaps by accident. The example you gave is the sort of proof presented to bright high school students - I'm sure you can do more interesting things with metamath, but I feel confident in saying that if you're a research mathematician, you'll lose a lot of time learning it and using it.

Where proof assistants are used, they're frequently totally counter to the style of thinking traditionally taught in mathematics and computer science - I've heard them described by experts in the field as 'proof obstructions'.

I'm currently writing my undergraduate project in a proof assistant, and you end up with tonnes of unreadable garbage like ASM_SIMP_TAC (srw_ss ()) [DETERMINACY_LEMMA, simp_expand_def] THEN1 METIS_TAC [] THEN RW_TAC (srw_ss ()) [ss_ecases] THEN FULL_SIMP_TAC (srw_ss ()) [].

which has no real relation to any normal thought. Proving the determinacy of a relation took a matter of days of careful thinking (as a newbie to the package) - despite being able to prove it in a couple of lines of handwritten prose.

I can imagine that this would be a massive turn-off for almost any research student.

I also think that his line

 _(it almost certainly is not, but more pertinent, how could you ever be sure it is?)_

is still a good point - you're trusting your correctness to a computer program, and all of the libraries built on top of it. The chances that one of these has a bug in (by this I mean a bug in the rules of inference of the theory) that could lead to the theory outputting garbage is probably quite high.

<comment><USER4> > I'm sure you can do more interesting things with metamath, but I feel > confident in saying that if you're a research mathematician, you'll lose a > lot of time learning it and using it.

And then save time because you can be sure that the proofs you write are correct.

> I'm currently writing my undergraduate project in a proof assistant, and you > end up with tonnes of unreadable garbage like ASM_SIMP_TAC (srw_ss ()) > [DETERMINACY_LEMMA, simp_expand_def] THEN1 METIS_TAC [] THEN RW_TAC (srw_ss > ()) [ss_ecases] THEN FULL_SIMP_TAC (srw_ss ()) [].

> which has no real relation to any normal thought. Proving the determinacy of > a relation took a matter of days of careful thinking (as a newbie to the > package) - despite being able to prove it in a couple of lines of > handwritten prose.

Did you try isar?

> I also think that his line

> (it almost certainly is not, but more pertinent, how could you ever be sure > it is?)

> is still a good point - you're trusting your correctness to a computer > program, and all of the libraries built on top of it. The chances that one > of these has a bug in (by this I mean a bug in the rules of inference of the > theory) that could lead to the theory outputting garbage is probably quite > high.

It's not at all a good point. There are theorem provers that rely on the correctness of just a very small kernel. Everything on top (libraries) is then guaranteed to follow the rules imposed by the kernel.

<comment><USER3> > And then save time because you can be sure that the proofs you write are > correct.

For better or worse, we both know that's not required to be a successful mathematician. I remember reading a presentation from a guy advocating mechanised proof who realised that almost every important proof in his field had been later shown to be false.

> Did you try isar?

I had a go at using Isabelle (in general) and truthfully never really got onto Isar - I discovered that both my supervisors have written large theories in HOL4 (JIT compilers etc), but have no recent experience with Isabelle, so that's what I'm using. I've seen examples of Isar which look nice, but I'm skeptical about its scalability. You make a good point, thouugh.

> It's not at all a good point. There are theorem provers that rely on the > correctness of just a very small kernel. Everything on top (libraries) is > then guaranteed to follow the rules imposed by the kernel.

Yes, of course - but the richness of a theorem prover comes from the logics you define on top of it.

If the library implementation of a particularly complex structure defined externally to the logic with no easy to coverify definition had a mistake in its definition which is not caught, any entailed inconsistencies are transmitted to the theorems that rely on this data structure.

Sure, your theorems are correct in the logic - but they might not be useful. I obviously pick the more engineering based example, but that's merely due to my being ignorant of most pure mathematics - there are probably analogues.

This is a growing problem for companies like Intel, who use a software model to test their firmwares before the hardware is available [1] - they want to verify that the operations are identical.

[1] - [http://www.cs.utexas.edu/users/hunt/FMCAD/FMCAD13/papers/44-...](http://www.cs.utexas.edu/users/hunt/FMCAD/FMCAD13/papers/44-Formal- Covalidation-Low-Level-Interfaces.pdf)

<comment><USER4> > For better or worse, we both know that's not required to be a successful > mathematician. I remember reading a presentation from a guy advocating > mechanised proof who realised that almost every important proof in his field > had been later shown to be false.

Some professors I know told me something along those lines about various topics of mathematics. The more advanced the topic gets the less people cope with the complexity. In the end it gets so specialized that only a few people in the world can and are willing to follow the advance. That situation combined with human notorious fallibility brings mathematic research in a very bad situation.

I makes me sad - and angry I have to admit - that the professors I met don't recognize computer-aid as the solution. Besides that I personally had the most pleasure doing mathematics while being guarded by a computer against my stupidity[+].

> Yes, of course - but the richness of a theorem prover comes from the logics > you define on top of it.

> If the library implementation of a particularly complex structure defined > externally to the logic with no easy to coverify definition had a mistake in > its definition which is not caught, any entailed inconsistencies are > transmitted to the theorems that rely on this data structure.

> Sure, your theorems are correct in the logic - but they might not be useful. > I obviously pick the more engineering based

[+] You raise a good point. The computer can't do all the work. Nevertheless it's a huge advance to only have to verify the definitions and theorem statements instead of all that combined with the proofs. It's like having to remember the summary of a book instead of the whole book. Someday we will hit a wall even when using computers but that shouldn't stop us know.

> This is a growing problem for companies like Intel, who use a software model > to test their firmwares before the hardware is available [1] - they want to > verify that the operations are identical.

Thats awesome! Nice problem to work on. Stories like this keep my dream alive that there are interesting workplaces in this world.

</comment></comment></comment></comment></comment><comment><USER5> This is a pretty sensational piece, but there's fundamental truth in that what-a-proof-is is based on an individual's ability to understand it. This is just how all ideas work.

In the end, you can then take a proof and make it empirical easily, and this (while not being anything like a proof) can be more convincing, because it's not tested by your understanding, but rather by your ability to observe... this also is fundamental to proof-by-contradiction, which convinces you simply by showing an example of a situation that doesn't work (and those disproves the assumption).

I think there's a lot of criticism floating around here, but there's something fundamentally right about a proof being about communication. The truth the proof reveals is pretty much objective though.

</comment><comment><USER6> Absolutely false. We have a large number of machine-checked proof that are 100% "filled in".

As a trivial example that a fair number of CS people might have been exposed to: every time someone compiles an Agda program, the compiler does a complete formal proof that the program is total and terminating.

</comment><comment><USER7> "What kind of a proof? It's a proof. A proof is a proof. And when you have a good proof, it's because it's proven." \- Jean Chretien

[https://www.youtube.com/watch?v=aX6XMIldkRU](https://www.youtube.com/watch?v=aX6XMIldkRU)

</comment><comment><USER8> It seems like the author is conflating the accuracy of the language of a proof with the accuracy of the proof itself, which may be the same thing to some extent, but overall to try and refute something like this:

> In particular, they believe proofs are fundamentally and exclusively about > truth, and that they are either right or wrong.

...is just semantics. Arguing that a Euclidean proof is wrong because it makes contextual assumptions about the reader's frame of reference is just pedantry. Mathematics is much more rigorous in 2014 because the value of the time of the average mathematician is worth much less.

</comment><comment><USER9> Professional mathematics is more like English Literature than computer programming: you need extensive background in the area to follow it; and you can't just run it to see if it works.

<comment><USER4> I don't agree. Did you ever try Isabelle/HOL? It let's you "run it" to see if it works.

<comment><USER10> How many professional mathematicians use Isabelle/HOL? Honest question!

<comment><USER11> Close to none. Part of that is a social problem. People who do computer assisted proofs are not particularly well regarded, in my experience.

Another big issue with those tools is that they don't work as well for analysis as they do for algebraic geometry and graph theory. This might be in part due to the fact that most of the folks constructing them are logicians, not analysts.

</comment></comment></comment></comment><comment><USER12> > with a once comforting illusion of crisp, clean certainty rapidly giving way > to a panicked feeling of sinking into shifting quicksand.

Sounds like he is describing the intellectual development of Bertrand Russell, who spent ten years proving that 1+1=2. Legend has it that his huge book on the subject (Principia Mathematica) has never been read cover to cover.

With such precedents as Russell and Wittgenstein it's ridiculous for any modern person to expect "crisp, clean certainty" in anything involving language.

<comment><USER11> He didn't spend 10 years proving 1+1=2. He spent 10 years constructing an axiomatic system in which arithmetic and everything else could be proved.

<comment><USER12> Which then got the rug pulled out from under by Gödel

</comment></comment></comment><comment><USER13> You think you know when you learn, are more sure when you can write, even more when you can teach, but certain when you can program. -- Alan Perlis

As they say, that is, until you do machine learning.</comment>


PayPal Reverses Indian Accounts - <AUTHOR> https://www.thepaypalblog.com/2010/02/personal-payments-and-local-bank-transfers-in-india/

<comment><USER2> The Reserve Bank of India has not approved wallet services yet -- and Paypal function as a wallet.

What it means is that you can receive payments into your paypal account, but you can't transfer them to an Indian bank account.

That sounds like a fund freeze to me .. you can make the money, but you can't have it.

Bugger.

<comment><USER3> Can you transfer via a bank outside of India?

<comment><USER4> Greetings,

I am Expert Programmer Dinesh Singh, of India. Due to certain political disagreements with PayPal, I am unable to receive $1,000,000 payment for much work I have done. If you will assist me to receive this money through your account (PayPay -> your account -> my account) I will give you 5% ($50,000). Please reply promptly with your bank account number and routing number that I may do the needful.

Gratefully,

Expert Programmer Singh

</comment></comment></comment><comment><USER5> Don't you love it when they have _0_ comments posted on their blog post.

"Comments are moderated and generally will be posted if they are on-topic and not abusive. For more information, please see our "

\- Guy with ~45K$ of _Paypal money_ , and massively pissed of right now at

1\. Lack of communication. (Found it via blogs.) 2\. No Email back from support.

<comment><USER6> It is more likely due to timezone issues - it must be night there, that is why no one to approve comments

<comment><USER5> Hard to believe, I first read that post after reading pluggdin, [http://www.pluggd.in/paypal-india-outage-no-payments-to- or-f...](http://www.pluggd.in/paypal-india-outage-no-payments-to-or-from- india-297/), and that post has been up for at least 24 hrs now. In all fairness, the comments must have been scathing. I know I cant bring myself to be polite to anyone at Paypal if I meet them now.

<comment><AUTHOR> Some speculation about RBI documents and stuff going on there. If that's true then it might take months before the suspension is lifted.

</comment></comment></comment></comment><comment><USER7> A lot of web masters in India receive their payments through Paypal. Everybody is stuck.

<comment><AUTHOR> Safety in numbers. Hopefully the money won't disappear from the PayPal account.

<comment><USER8> _I'm writing to let you know that personal payments to and from India..._

I read this line. But does that also mean that I also cannot send a cheque to myself? If thats blocked too, then it really worries me.

</comment></comment></comment><comment><USER9> This issue is starting to cause some widespread panic on the Digital Point forums. I had some outsource work done for me there and I've tried two times to get my payment to go through and each time it's been reversed and I've been credited back the amount spent.

It's made it impossible to get anything done over there, at least for the time being, as more and more of DP's user base is located in India.

</comment><comment><USER10> does this is why the fund transfer i made on 27 jan is not showing in my bank account. contacted paypal but no reply.

<comment><AUTHOR> Same here. It was supposed to be credited by 4th Feb, but nothing till now. The response I got from support was they can initiate a trace after 2 weeks. But that wont work too I guess since they have suspended all bank transfers.

</comment></comment><comment><USER11> Last time I had a need(this was a few years back) there was a myriad of companies you could use to send money from US to India. Some of them had major backers. Back then Paypal wasn't really a big player in India.

How much has this changed lately?

</comment><comment><USER12> Sounds like a good opportunity to open bank accounts in another country? Or could you paypal it to another account and have them withdraw and wire cash?

</comment><comment><AUTHOR> looking for more info. please share.

</comment><comment><USER13> I'm guessing security issues. Of the funding of guns and bombs kind.</comment>


Computer Science Programs Make a Comeback in Enrollment - <AUTHOR> http://www.nytimes.com/2009/03/17/science/17comp.html <comment><USER2> "we don't have Lehman Brothers, Bear Sterns and Citibank to compete with."

So this might not indicate any particular health in computer science in itself, just comparatively.

<comment><USER3> Or that the current climate in the computer industry is similar to that of ten years ago.

I'd be curious to see a serious breakdown of which schools are seeing increased enrollment, and in which subprograms of CS.

<comment><USER4> While they don't break down results by school, the complete report has a lot of nice additional data, including a list of all schools surveyed:

[http://www.cra.org/info/taulbee/CRATaulbeeReport- StudentEnro...](http://www.cra.org/info/taulbee/CRATaulbeeReport- StudentEnrollment-07-08.pdf)

I think (hope) this is encouraging news, but it's hard to call it a trend this early

</comment></comment></comment><comment><USER5> This happens whenever there is a crisis. All the people who would normally go in to industry decide to take on grad school as a way to ride off the storm for a few years. As soon as things improve, enrollment levels will go back to "normal".</comment>


Clojure and Testing - <AUTHOR> http://tech.puredanger.com/2013/08/31/clojure-and-testing/ <comment><USER2> Maybe this is unique to the field that I work in, but I can pretty safely say that if our organization didn't strive to maintain 60%-80% unit test coverage at any given time, we'd have been sunk a long time ago.

We don't "ship" a product. We're a humanoid robotics research laboratory, we have a fairly large and old codebase for what we do (~1MLOC of Java, plus a whole big whack of C++ for JNI), and since we neither have a customer nor an OSS community then we make no guarantees about our API nor do we frequently generate stable, frozen binary releases. As such, the code is _constantly_ being refactored and evolving; especially our numerical based stuff; things like physics, controls, etc. (we use an in-house simulation environment that one of our PI's created while he was in grad school, so even stuff like the 3D engine or the simulator data viz GUI's can change at any given moment).

I realize that this is entirely anecdotal and highly specific to what we do, but without high coverage and solid CI (We use a self-hosted Bamboo instance with nightly and every-commit builds), our code would be in complete and utter disarray. The build routinely breaks a dozen times a day when one of the control theory guys checks in a parameter tweak to our state estimator or introduces a new component to one of our modular controllers (we have test suites that actually run headless versions of our sims and mathematically verify the walking behavior).

I guess my point is that, as is the case with _anything_ in programming, choose the right tool for the job. Evaluate what you're doing, what your goals are, the nature of your code-base, and decide (as is brushed over in the source article) whether or not the opportunity cost is worth it. For us, we'd be up shit creek if we didn't have high coverage.

</comment><comment><USER3> Humm, I completely agree with Alex, however for different reasons.

If you write clojure, you use immutable structure (in most of the case, if you don't this comment doesn't apply), and so you end up writting only functions that take some data in, and return some data out.

If you are smart enough to work bottom up and you can create different layer of abstraction once a layer is finished and once you are sure that it does what it is suppose to do, then you can really stop to test that layer. (I hope is clear what I mean...)

The only test I can see having a real sense in clojure is when you use impure functions (functions that don't only get something in and spit something out, but that also do some work, writting in a DB maybe...) or when you think that your function/abstraction will be re-factor someday-somehow.

However in the case of the refactoring, the test need to be written still in a clever way: you have such functions tunnel A->B->C->D where you know that you will refactor C so there is no point in test A, what we really need to test is just C and its direct "neigbourd", or even better making sure that B returns what C needs and that C returns what D needs.

Or even better, since a clojure functions is way too long if it is more than 10 lines of code, well maybe all this testing is already too much, maybe the pre-post clojure's condition are enough. (This if we are talking about small functions, if A, B, C and D are abstraction layer you can't just keep all in your mind, so tests really makes sense here, still however doesn't makes sense to test A at all, nor the whole B, nor the whole D)

</comment><comment><USER4> I agree that testing getters/setters and other libraries functionality is a waste of time, but...

You know, the "pragmatic" approach that many programmers take - "writing tests is hard and time consuming, so let's write fewer tests" is a recipe for disaster and frankly the idea that if you just think about the problem more, that you're make fewer mistakes is very much along those same lines.

Here is the real problem - humans are fallible and we make mistakes. This is why pilots have flight checklists, why manufacturing has quality checks, why engineers have building codes, and why at hospitals checklists and procedures save lives

If pilots and mechanics just "thought more about the problem" they would still make mistakes. You might be a brilliant surgeon, but thinking you're too smart or too good to go through a checklist could cost someone their life because of a small oversight.

Would you feel good going under the knife if you knew that your life was in the hands of someone who thought they were too smart to scrub in?

We are a young profession with very few actual quality standards. Luckily, most of the software that we build isn't critical to people's safety, but I'd be terrified if the software powering medical robots, life support machines, and airplane autopilot systems were built by people who were "too smart" to write tests.

When a software bug costs people their lives because some programmer thought writing those tests was "too expensive" or "a waste of time" how smart is that programmer?

<comment><USER5> _I agree that testing getters /setters...is a waste of time, but..._

But it isn't necessarily. Say I have multiple implementations of a class, e.g.:

        trait TimeSeries {
            def datapoints: Seq[DataPoint]
        }

        case class SequenceTimeSeries(datapoints: Seq[DataPoint]) extends TimeSeries

        class ArrayTimeSeries(times: Array[Long], values: Array[Double]) extends TimeSeries

It's pretty straightforward and nearly pointless to test that `sequenceTimeSeries.datapoints` does what I expect. On the other hand, applying the same test to `arrayTimeSeries.datapoints` exposed an off by one error in my implementation.

<comment><USER6> Out of curiosity—I'm not so familiar with Scala—how does an off-by-1 arise here? Aren't you just going to zip (times, values)?

<comment><USER5> I did this a while back, so I don't recall the exact off-by-one error. But I don't want to to times.zip(values) - that would involve constructing explicitly a List[DataPoint] which is precisely what I'm trying to avoid with the ArrayTimeSeries. Rather, I defined a custom Seq[DataPoint], which had the apply(i: Int) method construct datapoints on the fly from the arrays.

(I admit that the error was entirely stupidity on my part and not the result of anything complicated. If I was as smart as Rich Hickey, I probably wouldn't need so many tests.)

<comment><USER6> Ohh, I see, array-of-structures/structure-of-arrays trouble.

</comment></comment></comment></comment></comment><comment><USER7> When I test at the REPL, I feel like I spend lots of time trying to re-enter updated code. This means I do a lot of:

A: Pasting changed code into repl

B: Re-typing code

C: Hitting "previous command" and "return"

The overhead of automating this process (by making a test suite) seems high, but I haven't ever regretted it.

<comment><USER8> You can also get rid of this overhead by using an editor with an integrated repl (emacs+nrepl.el/slime/inferior-lisp-mode, vim+slimv/fireplace, LightTable all do this). I can type ,e to send an updated function to my repl for instance. ,b to evaluate an entire buffer.

That said, you can also develop your test suite like this as well (which is a sublime experience, particularly with a generative test tool).

<comment><USER9> It helps to make a sandbox file that has everything imported already and just reeval the whole file - [https://github.com/jamii/strucjure/blob/compiled/test/strucj...](https://github.com/jamii/strucjure/blob/compiled/test/strucjure/regression/tests.clj)

Then you can also run the file as a free regression test - [https://github.com/jamii/strucjure/blob/compiled/test/strucj...](https://github.com/jamii/strucjure/blob/compiled/test/strucjure/regression.clj)

</comment></comment></comment><comment><USER6> Test when you lay down abstraction. If you know your expectations about some code, then it's worth testing in proportion to the amount of dependency you have on those expectations holding.

If you don't yet know the expectations/abstraction you have for some code then you're still deep in the design phase whether or not you like it. Good tests—like good static types or property checks—can be useful to smoke out the properties your abstraction will eventually fulfill. If they slow you down, don't use them.

But once you know your abstraction and start depending on it then please test. Most likely a good test will, right there, show you that you don't actually know your abstraction very well.

<comment><USER10> Good advice. Have you tried using contracts (pre/post conditions, assertions, invariant checks) in your code? I find them to be a useful way to encode those expectations in the code before you test.

<comment><USER6> I'm a huge proponent powerful static checking, so I haven't written much code with contracts. My understanding is that they're quite wonderful for dynamic property elaboration, though, so by that fiat I'd say I'm a fan.

</comment></comment></comment><comment><USER11> I mean, there's a spectrum here. I don't think anybody is going to argue that that java.util.LinkedList shouldn't have tests. On the other end of the spectrum, there are things that obviously shouldn't be tested (getters and setters, whether some div has 10px of padding, etc). Tests are are how you lock down your software once it's ready to be frozen. You use them to turn software into hardware, to use an analogy from Steve Yegge [1].

[1]: [http://steve-yegge.blogspot.com/2007/01/pinocchio- problem.ht...](http://steve-yegge.blogspot.com/2007/01/pinocchio-problem.html)

</comment><comment><USER12> Could not disagree more. For reference, my company ([https://circleci.com](https://circleci.com)) probably has one of the largest test suites in Clojure (approx 16kLOC in the test suite, > 5000 assertions).

The value is testing is that it saves time in the long run. If you don't have a decent test suite, then as your product matures, you become unable to do anything because each new feature breaks a dozen old things.

Alex is right about the opportunity cost (see my own post "Testing is bullshit": [http://blog.circleci.com/testing-is- bullshit/](http://blog.circleci.com/testing-is-bullshit/)). But not testing is also an opportunity cost.

Basically you can spend T minutes writing tests, or D minutes debugging problems that tests would have found. If you don't test at all, then D will rapidly (within weeks possibly) become so high that you can't get anything done. By contrast, T will rarely go above 50% of time spent on a project (and if it is, you need to rethink how you test, unless you're building rockets or medical equipment).

<comment><USER10> What in particular are you disagreeing with?

You seem to be implying that I'm saying not to write tests or that testing isn't valuable but that's not what I said. As I said: "I think tests are highly valuable. I don't know how I could write high quality code without writing tests." Every Clojure dev I've ever worked with wrote tests and relied on them. My point is that there are costs to consider.

I observe that the Clojure community is interested in trying a wide variety of testing approaches that may mitigate some costs of testing, perhaps more so than other communities.

I have also worked on a system with a large Clojure test suite (at least 30kLOC), primarily example-based. We found that there was substantial cost (even with many custom-built tools) to maintaining those tests. I've had the same experience maintaing large Java test suites. Recently, I've been doing more with generative testing - I think generative and contracts may give you a better return on your effort than example based testing. But that's a hypothesis I look forward to investigating.

</comment></comment><comment><USER13> Note: I only have experience with my one-man Clojure projects.

My favorite poor-man's test-feedback-loop in Clojure is to use the built-in core.assert function to put tests at the bottom of the source file in combination with my editor's eval-buffer command.

Test DSLs, test directory/file boilerplate, and setting up an autorun cycle are the three things that constitute enough of a barrier to prevent me from testing, so those are the three things this example eludes.

Here's a file of a `to-slug` function that normalizes drug names into URL slugs.

        ;; Production code

        ...

        (defn to-slug [s]
          (hyphenize (simplify-name s)))

        ;; Tests

        (defn assert-slug [a b] (assert (= (to-slug a) b)))
        (assert-slug "ocusert pilo-20" "ocusert-pilo")
        (assert-slug "ogen .625" "ogen")
        (assert-slug "ogen 1.25" "ogen")
        (assert-slug "hydralazine hydrochloride, hydrochlorothiazide and reserpine"
                     "hydralazine-hydrochloride")
        (assert-slug "hydralazine hydrochloride w/ hydrochlorothiazide 100/50"
                     "hydralazine-hydrochloride")

        ;; Sandbox

        (to-slug "00-d-amphetamine")

Every time I hit C-c C-k (eval-buffer in Emacs w/ nrepl), the asserts are run which will throw an error on failure.

And since eval-buffer always returns the result of the last expression evaluated, the above "Sandbox" section represents whatever case I'm currently trying to extend `to-slug` support for. The result of which is returned on every eval-buffer.

In this case, `to-slug` doesn't correctly handle "00-d-amphetamine" yet, so as I modify the production code to handle it, I can mash eval-buffer after every change to (1) see if my change introduces regressions and (2) visualize my progress on handling "00-d-amphetamine". Once it works, I add an "00-d-amphetamine" assert-slug and move on to the next case.

As to-slug matures, I can then move the asserts to a dedicated test directory if I want to and replace the slime with minimal case tests. -- Things that otherwise slow down my exploration phase.

\----

I think core.assert fills the chasm of a function's/file's lifecycle between "I'm not even sure if I want this function or what its input/output will look like" and "my source code definitely needs this and this is its API".

In Ruby, I like [https://github.com/sconover/wrong](https://github.com/sconover/wrong).

<comment><USER14> I do this in Common Lisp. It also makes sense as a technique for documentation: why leave examples rusting in comments when you can incorporate them into the program?

Add a Quickcheck-ish type-based test case generator and you start to blur the line between tests and types.

</comment></comment><comment><USER15> I have a suggestion for people who are very pro unit testing for understanding people who do not test as much: try working in areas that are traditionally light on unit testing. For example, graphics, multimedia, and games. People write stuff in these areas all the time that still work, despite minimal automated testing. There are other paths we might take, Frodo.

</comment><comment><USER16> [https://twitter.com/davidrupp/status/375290808640884736](https://twitter.com/davidrupp/status/375290808640884736)

"Not all who wander are lost."</comment>