Github seems to be experiencing security issues - <AUTHOR> https://github.com/settings/security <comment><USER2> The list of IPs from China (& Indonesia, etc) - that most are seeing on their page - making failed login attempts, looks like a botnet or automated bruteforce on the GitHub authentication service. Hit enough usernames with a dictionary attack and they'll get some accounts. I assume that GH are doing some basic rate-limiting or 'fail2ban' style blacklisting on these attempts.

As anyone who's put an EC2 up without securing it knows, an automated SSH attempt at 'root' will be made within a few hours of it coming online.

<comment><USER3> I wonder if this is related to the recent Adobe and vBulletin user database breaches. They might be trying those passwords on GH.

<comment><USER4> Very likely.

We've just added a kill-list of known decrypted passwords and English language words and forced people to reset their passwords who are listed in the adobe breach.

<comment><USER5> How do you find out that someone's using a known decrypted password on your service?

<comment><USER4> From here: [http://stricture-group.com/files/adobe- top100.txt](http://stricture-group.com/files/adobe-top100.txt)

We wrote a script that hashed these passwords with the stored salt for each user and compared the result with the stored hashed value. Basically we brute forced everyone's accounts with the dictionary provided. Anyone who was found with an account that was in the dictionary was locked out with forced password change. We changed the password policy before doing this to increase complexity and block dictionary and the decrypted list words. We also force people to change their password every 28 days anyway and keep the last 7 hashed passwords and salts to verify that the user hasn't reused.

We store financial data so it's pretty hardcore auth requirements.

</comment></comment></comment></comment></comment><comment><USER6> A reply from Zach Holman on twitter confirms that it's an automated attack that they are currently working on mitigating: [https://twitter.com/holman/status/402720736650874880](https://twitter.com/holman/status/402720736650874880)

</comment><comment><USER7> I would strongly suggest people enable two factor authentication: [https://github.com/settings/two_factor_authentication/config...](https://github.com/settings/two_factor_authentication/configure)

<comment><USER7> Just one foot note (as I have just taken my own advice and turned it on). Suddenly I couldn't push/pull through the git command line access as it would not accept my password.

Took me a bit to work it out but you need to go here [https://github.com/settings/applications](https://github.com/settings/applications) and create personal access tokens.

<comment><USER8> If you need to store a personal access token in order to pull or push to your own repos, how is two-factor auth any better than a normal account with a secure (ie reasonably long, unique, randomly generated) password?

<comment><USER9> I use 2FA with GMail and the same question could be asked. The answer is that an application password does not have admin rights to the account. It can be revoked at any time. It traces the breach directly back to a particular application. They are not meant to be memorized but rather to be set and remembered in a particular application which means they can be extremely complex and are by default. I have to think that at least some of this is applicable to GitHub's 2FA.

<comment><USER8> Your points are good ones for something like GMail (where a single account allows access to many Google services and includes a potentially huge trove of other private data).

For github though, the the repos you have read (or commit if vandalism is the risk) access to _are_ the data in question, so unless you use your github account for other things, I'm still not really seeing the benefit to the end user if you still have to store OAuth tokens everywhere you actually use git.

Can github issue OAuth tokens that are restricted to a specific repo? At least that would prevent a token leak exposing other repos that you had access to.

</comment></comment></comment></comment></comment><comment><USER10> I just checked my account's security history, and there's been a failed login attempt every 7 hours for the past two days, all from different IP addresses.

It reminds me of the "Hail Mary Cloud" posted previously on HN - [http://bsdly.blogspot.com/2013/10/the-hail-mary-cloud-and- le...](http://bsdly.blogspot.com/2013/10/the-hail-mary-cloud-and-lessons- learned.html)

</comment><comment><USER11> Very strange; I just checked my security history and see that there have been 5 unsuccessful login attempts from China/Venezuela to my account (last 14 hours). Everything before that is pretty clean and without fake logins.

Does anyone have more information on this?

<comment><USER12> I too have the following, which cannot be attributed to me since I was asleep.

      user.failed_login: Originated from 126.96.36.199 9 hours ago
      user.failed_login: Originated from 188.8.131.52 11 hours ago
      user.failed_login: Originated from 220.127.116.11 a day ago
      user.failed_login: Originated from 126.96.36.199 a day ago
      user.failed_login: Originated from 188.8.131.52 a day ago

</comment></comment><comment><USER13> I don't get it... this is my own security page which looks normal to me.

[edit] I see one failed login attempt from a chinese IP like other people are saying. Maybe that is what OP meant to point out?

<comment><USER14> I guess the point is that these auth failures were rare. I've seen 5 failed login attempts in the past 3 days, on an account that had none in its previous two years.

</comment></comment><comment><USER15> user.failed_login: Originated from [http://ipinfo.io/184.108.40.206](http://ipinfo.io/18.104.22.168) 12 hours ago

user.failed_login: Originated from [http://ipinfo.io/220.127.116.11](http://ipinfo.io/18.104.22.168) 18 hours ago

user.failed_login: Originated from [http://ipinfo.io/22.214.171.124](http://ipinfo.io/22.214.171.124) a day ago

user.failed_login: Originated from [http://ipinfo.io/188.8.131.52](http://ipinfo.io/22.214.171.124) a day ago

user.failed_login: Originated from [http://ipinfo.io/22.214.171.124](http://ipinfo.io/220.127.116.11) 2 days ago

user.failed_login: Originated from [http://ipinfo.io/18.104.22.168](http://ipinfo.io/188.8.131.52) 2 days ago

</comment><comment><USER16> Not sure if it's related to what the OP meant, but I can see 5 failed login attempts from different IP addresses over the past 48 hours (and pretty much none before that).

</comment><comment><USER17> Why does this page mean GitHub is experiencing security issues?

I didn't know this page existed. Its pretty handy, though I don't like how it shows failed logins. 6 attempts in the past 24 hours unnerves me. Probably trying my email and my use-all password from vBulletin or one of the numerous other sites which have been broken into.

<comment><USER10> Check your previous history. You probably don't have many failed attempts before the past 24 hours. It seems to be some sort of botnet attack.

</comment></comment><comment><USER18> It's showing a page of security history. That doesn't mean there is a problem with security. It's just for the curious ones, or the paranoid ones, or those that surf around on suspicious networks or committed something last night and can't remember it at all.

It's just a reality check.

# my $0.02

</comment><comment><USER19> Hmm, 13 failed attempts for me as well. Glad I have the "Two-factor authentication" On just in case.

[https://github.com/blog/1614-two-factor- authentication](https://github.com/blog/1614-two-factor-authentication)

</comment><comment><USER20> I wonder if these failed login attempts are using passwords from the Adobe breach.

<comment><USER21> I think that is unlikely. The Adobe breach data looked like this:

       84557956-|--|-[redacted]@parponline.org-|-0tlHzKbr18uO6Wu5iaXtPQ==-|-mother's maiden name-Wilson|--

These logins are targeted at usernames. Adobe data didn't contain usernames, hence I don't understand how the Adobe data could help here.

      user.failed_login

      actor	<redacted>
      actor_ip	126.96.36.199
      created_at	2013-11-18 21:03:47
      note	From GitHub.com
      user	<redacted>

<comment><USER22> Github users frequently have public email addresses or email addresses on their commits. It is also reasonable to try to match $email@example.com with the username $foo.

</comment></comment></comment><comment><USER23> Same here

        6 hours ago user.failed_login: Originated from 220.127.116.11
        12 hours ago user.failed_login: Originated from 18.104.22.168
        16 hours ago user.failed_login: Originated from 220.127.116.11
        a day ago user.failed_login: Originated from 18.104.22.168
        a day ago user.failed_login: Originated from 18.104.22.168
        2 days ago user.failed_login: Originated from 184.108.40.206

</comment><comment><USER24> Looks like some of the IPs are proxies: [http://webcache.googleusercontent.com/search?q=cache:HIFaDGu...](http://webcache.googleusercontent.com/search?q=cache:HIFaDGufvkcJ:venezuela- proxy.blogspot.com/2013/11/live-proxy-list-on- november04-2013.html&client=firefox-a&hl=en&gl=us&strip=1)

</comment><comment><USER25> Strangely, I use a unique email for github, like I do with most sites that allow attaching "+comment" to the localpart of email addresses. Are attackers really this sophisticated, or where did they get the list?

Edit: Nevermind, I guess github allows authenticating with a username, in addition to the email.

</comment><comment><USER26> I count five failed attempts within two days (126.96.36.199, 188.8.131.52, 126.96.36.199 ,126.96.36.199, 22.214.171.124). Good to know the password -that I almost manage to forget- is strong enough.

</comment><comment><USER6> I'm seeing similar failed attempts in my logs as well.

</comment><comment><USER27> If anyone from GitHub is reading, it would be cool if the failed IP addresses had an approximate location appended to them.

<comment><USER28> That's only useful if they plan to use location algorithms like banks to detect possible fraud login's. For example banks do basic location tracking to detect fraud, if you mostly shop in New York in a specific area and they suddenly detect a purchase in Canada your bank _should_ block it, I know my bank does and they'll call me within 20 minutes to confirm it was me (enough time for me to call them and authorize it or if I switch to another card, quick enough for me to tell them I'm in Canada for the week.)

</comment></comment><comment><USER29> Only have one failed login attempt, from Ecuador. Should i be offended ?

</comment><comment><USER30> Here are my logs from the last two days:

user.failed_login

actor_ip 184.108.40.206

created_at 2013-11-18 14:45:30

\---

user.failed_login

actor_ip 18.104.22.168

created_at 2013-11-18 06:05:01

\---

user.failed_login

actor_ip 18.104.22.168

created_at 2013-11-17 12:55:31

\---

user.failed_login

actor_ip 220.127.116.11

created_at 2013-11-17 12:40:34

</comment><comment><USER31>
      user.failed_login: Originated from 18.104.22.168 2 days ago

</comment><comment><USER32> They should provide the password used to attempt to log in too.

<comment><USER33> no, they definitely shouldn't, for the same reason they don't store the real passwords in plain text. it would be a terrible security hole.

<comment><USER32> Sorry for being ignorant, but why is providing the passwords they guess/automate a security issue?

<comment><USER34> For one, because if someone _does_ find a hole that gives them access to Github data, they'll have all password attempts, which would include typos of the real password. Which is a terrible, terrible thing to store in a hard drive (see Adobe)

</comment></comment></comment></comment><comment><USER35> Someone from Venezuela tried to log in, but failed.

</comment><comment><USER36> Care to elaborate?</comment>


BlackBerry Abandons Sale Process - <AUTHOR> http://online.wsj.com/news/articles/SB10001424052702303482504579177491399001678

<comment><USER2> Oh BlackBerry. What are we going to do with you?

FWIW, developing on their BlackBerry 10 series phones was an absolute joy. Great hardware and lots of options for realizing apps.</comment>


Never edit a method, always rewrite it? - <AUTHOR> https://dave.cheney.net/2017/11/30/never-edit-a-method-always-rewrite-it <comment><USER2> It has been my experience that after a substantial period of being in real use, methods embody tacit knowledge about the problem domain that isn't necessarily evident from their public interface. Because initially they didn't embody that, and it caused bugs, so people edited in fixes.

It has been my experience that rewrites from scratch typically lose all this tacit knowledge and re-implement the original bugs.

<comment><USER3> That's sort of the point of the suggestion, I think. If you _always_ rewrite from scratch rather than edit, this sort of tacit knowledge won't get embedded undocumented and untested into the middle of a function.

This is sort of the great contradiction of software development. Untested legacy software is hard to work with. So should our focus be on how to work with legacy software or how not to create it in the first place? There's really no answer to that.

<comment><USER4> One thing the OP doesn't address is, is the rewrite intended to be black-box or not? If not, then every "rewrite" will just be someone copy-pasting the old code with the new fixes, which seems completely pointless. And if it is a black-box rewrite, then all that tacit knowledge will be lost, leading to having the exact same bugs over and over and over and over again, forever.

I understand that this is all just a thought experiment, but there has to be a better way of framing it that isn't so immediately farcical.

<comment><USER3> > And if it is a black-box rewrite, then all that tacit knowledge will be > lost,

This is a thought experiment on how to avoid that tacit knowledge, not how to deal with it. Consider approaching every edit in the same way you'd approach new code: is the function adequately tested, does the function have a single responsibility, is the intent clear, etc.? The idea is that if you do this, then you won't reach the point where you have a 200-line method with tons of hidden business rules.

I agree there's probably a better way of framing this. Still, as a thought experiment, it's worth thinking about when you can and/or should do this.

</comment></comment></comment></comment><comment><USER5> A tangential thought but related: I would find this absolutely frightening. I understand the motivation behind it but I always like to start from something existing and editing it -- even if by the end nothing remains of the original. To some, an empty editor window is infinite possibility but to me, it's a "coders block", not sure how to phrase it. Infinite analysis paralysis perhaps.

<comment><USER6> But this is different, because you already have:

\- the method's signature and spec

\- the changes in behavior you want

<comment><USER7> \- tests

\- history for file (and any bugs listed in there that had to get fixed more than once)

<comment><USER8> The first thing I thought when I read the title is what that would do to the history.

Looking at a diff and seeing a small modification to a method tells me more than a method that has entirely changed with for loops changed to while loops, indices replaced with iterators, different whitespace and brace placement, etc...

<comment><USER9> That's where commit messages come in. Sadly, those can be just as poor as inline comments for telling you why something was done.

</comment></comment></comment></comment></comment><comment><USER10> The headline is misleading IMO. The author is proposing "Never rewrite a method" _as a thought experiment_ to guide you to writing better code. Even the original proponent walked back from that idea moments after he proposed it.

<comment><USER11> Funny, a modern day waterfall method example.

<comment><USER12> Seems like Poe's law could be generalized into a heuristic about memetic hazards - no matter how much you guide and warn people, any idea you speak or put in writing can be taken in a way you did not intend. The chances increase with the size of the audience.

</comment></comment></comment><comment><USER13> I've been doing something similar. I name the new method Method, rename the old one as MethodOld and in Method, before the return value, I put an assert(MethodOld(args) == return value). It's one of the things that when I do, I appreciate the value of, but I'm not disciplined enough to do as much as I would like to lol.

<comment><USER14> For some hairy stuff that require live data you can also reverse the practice: call both yet return the _old_ one, and gather data in production before switching.

Obviously this does not work for side-effectful methods (beware of caches!).

<comment><USER15> I'm interested in what fields you would use this methodology. Machine learning?

In most fields we have a sample of known input vectors, including edge cases, that map to known outputs. A unit test is enough to test these methods with different implementations.

<comment><USER16> An example of when you might use this is when you're cutting over to a new service, and you want to validate that the new service behaves the same way as the old one before transitioning all the traffic to the new service. In order to build confidence in the new service, you can assert that the expected output is the same, and raise alerts when there is an inconsistency. This incremental rewrite approach allows you to slowly replace pieces of an application with a new service and helps prevent regressions in behaviour.

Or consider when you're performing a database migration (on large databases) with 0 downtime. Typically this involves something like:

1\. Dual Writing: Create 2 tables and write to both and keep them in sync (by duplicating new data, and back-filling old data)

2\. Update read paths: Change all code to read from the new table, and validate that the data being read is consistent with the old table. You can use a library like Scientist [0] to validate that the reads are the same.

3\. Update write paths: Change all code to write to the new table (and raise alerts if the old path is exercised)

4\. Deleting old data: Remove code and data that relies on the old data model

[0] [https://github.com/github/scientist](https://github.com/github/scientist)

<comment><USER15> I see, thank you.

</comment></comment></comment></comment></comment><comment><USER17> When writing functions often I end up deciding fairly quickly if the function I am writing is intended to be reusable or not. If it is reusable I'll write it as a utility function, helper, lib, ... whatever the project's convention and language paradigm might be. Usually similar reusable functions already exist within the project.

A significant portion of functions fall in another category; functions that actually get some real work done. They are specific and not intended for reuse at all.

Applying the "never edit a method, always rewrite it"-rule to those helper/utility functions would just be painful. The public API you designed is designed with a certain purpose and reuse intent. Improving it slightly to fix an issue and forcing yourself to entirely rewrite it would just break things. Most likely you'll end up writing lots of small copies of the original method (how painful this exactly might be depends on the language you're using).

Applying that rewrite-rule to specific functions/methods makes slightly more sense. Here the logic is more tightly bound by business rules/logic, which if they change will quite often warrent a rethink. Particularly because business likes to just slap a feature on top of everything else; which means for us finding ways to keep everything sane in the codebase requires continuous refactoring. Rewriting a function here does not intend to make the function more reusable, it attempts to make the code more clear. Sometimes reusable patterns emerge, but often they don't.

Obviously the above is a simplification of things. Often programmers are obsessed with abstractions and design patterns (read too much GoF, Martin Fowler & Uncle Bob); or don't bother with anything at all (script kiddies, prototype developers, or any code written during a PhD...). The truth lies somewhere in the middle.

<comment><USER18> I'd call it "bricks" vs. "mortar". Write your bricks to be reusable and modular. Write your mortar to be simple but don't stress too much about it, because it really only exists to glue your bricks together.

</comment></comment><comment><USER19> The metaphor that biological systems undergo continuous renewal and so therefore code should be rewritten not edited i think is actually off, code is the dna and thus undergoes evolution not replacement

<comment><USER20> The DNA is rewritten from scratch each new generation.

It even gets rewritten over and over during the life of a single cell.

<comment><USER21> It gets copied, not rewritten. This is the same with software that gets copied to machines so that we can run it.

Here we're talking about modifying a specific function, not duplicating all the code.

</comment></comment></comment><comment><USER22> A big part of what this approach is trying to fight is function complexity. If you really re-wrote the entirely of your functions everytime you went to edit them I think it would end up slowing the programmer and the program down.

Programming is often a state of flow where you have a grand idea for how a mechanism should act and then you task yourself with implementing that idea in code. Sometimes large complicated functions are the best way to translate that idea. The approach the author describes sounds like it would create lots of small functions that don't really help you solve the problem at hand.

Good idea to keep in mind though. Everytime you go to edit a function and find yourself dreading it, maybe it's time to rewrite that one.

</comment><comment><USER23> TLDR; Cheney is asking "what if we always rewrote functions", not advocating a position.

</comment><comment><USER24> Devils advocate:

If you make this a strict requirement for your code base people write wrappers all the time, which creates a huge mess:

       def newMethod(x):
           if x*2 == 42:
                return 36
           return oldMethod(x)

You cannot enforce the requirement anyway, because people will just copy-paste the code and edit it under a new name.

You just cannot push this methodology unto developers.

<comment><USER25>
        def foo_with_edge_case(x):
          if x == EDGE_CASE:
            return 36
          return foo(x)

seems clearer to me than stuffing the edge case handling into the foo method

<comment><USER26> If only you could pattern match x in the function def, would remove the need for this whole thing.

<comment><USER27> Aside from compile-time optimization, pattern matching is just this additional if at runtime. It is questionable if pattern matches make code more readable since when you see foo(42) call and def foo(42) is defined elsewhere, you can spend some time on original function until realizing that it's not what you're looking for. The same for type-based and operator overloading. It only makes code beautifu^W hard to guess.

Though it does look nice for fib and fac.

</comment></comment></comment></comment><comment><USER28> I had a similar idea some time ago, that all the code should be write only. That is, you should always write new functions (and give them new names) instead of trying to rewrite them (if the spec changes, this assumes they were correct in the first place).

I think it's only really doable in purely functional language (like Haskell), though. It sort of means versioning of individual functions, and also types. It's very similar to rebinding values only as opposed to modification of variables.

But naming is a problem. Maybe.. There are two kinds of names of types and functions - intrinsic and extrinsic. Intrinsic name only describes what the thing is (e.g. array.search()). Extrinsic name relates to the problem being solved (e.g. product.findByPrice()). Maybe the functions (and types) that have only extrinsic names should be versioned and short name should be assigned to the latest version.

All in all, I think it's a concept worth researching.

<comment><USER29> Why? Your revision history is already in version control.

<comment><USER28> With VC, you can only call the latest version. With versioned functions, all the old code would still call the old functions, until you would explicitly refactor it (or type system would fail).

I guess there is a philosophical debate behind this - what's in a name? Should a name of function refer to a specific body of code only, or all possible function bodies, past and future? What did the caller of the function want?

You can only guarantee correctness if the former. But the latter gives you more flexibility. I am not saying that this is the right answer.

<comment><USER30> Sounds similar to [https://thedailywtf.com/articles/best-of-2016-the-inner- json...](https://thedailywtf.com/articles/best-of-2016-the-inner-json-effect)

Keeping all versions of the same method in the source files has a lot of drawbacks:

1\. Readability. Autocomplete gives me 50 versions of that method. Which one do I choose? The latest? Why do the rest need to exist?

2\. Code size. Can you imagine the compilation times? IDE indexing times? Binary size?

3\. Consistency / Correctness. How do you know when each call should update it's version. How do you increment all calls to the latest version?

Simplicity is the ultimate sophistication.

</comment></comment></comment></comment><comment><USER31> Coming from EE, I like the thinking behind this. Components are similar to functions, they are tested to the nth-degree out of inventory, liability, and other concerns, and everything goes along well enough.

What would really help for that style of development would be a sort of _apropos_ feature for your own code where you could look up methods by keywords rather than just identifiers. For larger projects, having people re- write several variations of what is basically the same method can be a problem even with mutable code. Perhaps Knuth's _literate programming_ would help?

edit: And I bring _apropos_ up because if you break things down into very small functions, and you don't have that, you end up writing several invariants of the same function because you can't find the one you're looking for.

<comment><USER32> Literate programming, as a concept, is super interesting. But it has a fundamental problem, when applied to software-as-an-industry, that I think is difficult to solve: many, if not programmers, may be literate but are not _literate enough_. If you go look at a Knuth example of literate programming, there emerges a few fundamental capabilities.

One: the ability to look at code fresh, as if it were to someone wholly unfamiliar with the module or function in question. And to do so without leaping to the smarmy-tech-nerd "I understand it so this is easy" thing--we're talking about a baseline level of empathy cultivated so as to be able to return to the mindset of a novice in order to help them climb from there.

Two: the ability to explain, without the prior knowledge of that module (unless you are to reference that module, which has the same rules), what it does and why it matters. In words. Not "the code is the documentation", but words.

Three: the ability to do both of the above engagingly enough that people don't go take a nap instead of read it. You don't need to be able to write hot fire, but you need to be able to write.

These are difficult things unless you have a decent grounding in the humanities, and even on a place like HN, which self-selects for people who _want to write things about stuff_ , you see pretty serious capability gaps on the regular.

(To be clear, I wish it _was_ the answer, I just don't think it is. Not without a fairly radical rethinking of how much humanities matter to software development.)

<comment><USER31> True enough, though at this point I'd be grateful for _any_ kind of consistent method-to-description binding.

Having it be compiler enforced would also be nice. Even if most of the descriptions end up along the lines of "do some stuff with the string", at least that's _something_.

</comment></comment></comment><comment><USER33> N.B. This is not advice! The headline reads like advice, but if you read the article it's a "what if..." exploration to get you thinking.

</comment><comment><USER34> If only business requirements, specs and use cases didn't evolve.

For our Christmas campaign, calculateCostOfGadget() needs to account for the compounding discount. Preferably yesterday, as we need to complete this month's billing to make payroll.

</comment><comment><USER35> Usually when I want to simplify something I do a copying garbage collection of code. Manually shifting the good stuff from the old version to the new version, this means all code gets reviewed, and poor code gets left behind.

</comment><comment><USER36> I had a different rule, which I was advocating for PHP 5.3 back in the day:

Have functions take regular parameters and the last one will always be an associative array of options.

This matches how functions evolve. You have some required parameters, then introduce more but the old callers don't know about them so they're optional.

I was trying to argue that PHP could unify the function call syntax and array definition syntax to encourage this. In other words the options would actually be virtual, as the caller would just supply the optional named parameters at the end of the function.

<comment><USER37> This is basically the same as how many Python functions often have a long list of arguments with defaults. When calling you can ignore them or set them as you like using keyword arguments. I'm a big fan.

</comment></comment><comment><USER38> Well, just ask a perl dev ;-)

[https://en.wikipedia.org/wiki/Perl#Criticism](https://en.wikipedia.org/wiki/Perl#Criticism)

<comment><USER39> Every old idea will be new again.

</comment></comment><comment><USER40> This is an interesting thought experiment.

Following the rewrite-not-edit method rule forces one to either sink or swim. And the only maintainable way to swim is to write small focused orthogonal methods that do one thing only. Otherwise, it is impossible at any scale to follow rewrite-not-edit.

I like take on different perspectives like this. Doing so ensures one thinks about how to design and what to code before simply diving in.

</comment><comment><USER41> Perhaps the "Second system effect" would not apply if methods are kept small, but is a method really a good unit of work for these kinds of ideas? Better rewrite units, classes, whatever can be isolated/encapsulated in a meaningful way.

</comment><comment><USER42> I'm not sure rewrite is the right word here. Always write a new version from scratch, use a different namespace, and never delete old code is a better idea. You can't cause regressions if you never change old code that's in use.

</comment><comment><USER43> What if we did this (where methods are immutable) and also architected a runtime to do this? Also we would use our source control to operate on functions instead of files? All methods would have a UUID and a hash of the contents .

</comment><comment><USER39> Looks like businesses have finally caught on to developers' obsessions with constant product rewrites and started saying "no."

So now we come up with this technique as a way to get our fix to rewrite everything from scratch.

</comment><comment><USER44> This is actually the APL way. You make the language so high level and dense that even complex methods are one-liners. When you need to update it, you rewrite it. APL people have been screaming this for years.

</comment><comment><USER45> I understand the sentiment behind this, but in practice this is going to be a terrible idea, in my opinion. I can imagine the codebase littered with method1, method2 kind of edits all over quickly.

</comment><comment><USER46> This is similar to what's happening to the functions in Ethereum contracts where there is an actual cost of updating code.

</comment><comment><USER47> What if every time we hit a bug in a method, we split that method into two methods?

</comment><comment><USER48> It is similar to say to a writer:

"Never edit a paragraph, always rewrite it".

Looks weird.

</comment><comment><USER49> how is that different to writing a test for the old method then writing the new method from within the test then moving it to the old location when you're finished.

</comment><comment><USER50> Saw the headline, first though "I'll bet this is about dynamically typed languages", and lo and behold

> At a recent RubyConf...

EDIT: just wanted to add that when I code in dynamically typed languages I'm inclined to do the same thing. Without rigidity provided by a strong type system it's too easy to mess things up. That's why I prefer strongly typed languages so I can benefit from the structure they enforce.

<comment><USER51> Dave Cheney is well known in the go community, and works at Heptio. I don't think dynamic typing has much to do with this article.

<comment><USER50> The author says Chad Fowler proposed this idea at RubyConf

<comment><USER52> Yes, but the author of _this_ article, which is discussing the idea, was written by Dave Cheney.

</comment></comment></comment></comment><comment><USER53> i thought rich hickey already did this talk about accretion</comment>


People Are Still Trying to Build a Space Elevator - <AUTHOR> http://www.smithsonianmag.com/innovation/people-are-still-trying-build-space-elevator-180957877/?utm_source=twitter.com&no-ist&is_pocket=1 <comment><USER2> The article says, "His conclusion: The space elevator could be built with existing technology—minus the super-lightweight tether necessary to make the whole thing work." In other words, it cannot be built with existing technology.

NASA uses the idea of "Technology Readiness Level (TRL)" [1] to help assess speculative technology, the (obvious) idea being that each stage of deployment of a technology relies on passing tests at previous stages.

On this scale, it's not clear to me that space elevators are at TRL1 ("basic principles observed and reported") yet. Space elevators depend critically on having a material that's strong enough to build the cable. Feasible designs for climbers, debris avoidance systems, power transmission and so on, can't make up for the lack of this critical component.

[1] [http://www.hq.nasa.gov/office/codeq/trl/trl.pdf](http://www.hq.nasa.gov/office/codeq/trl/trl.pdf)

</comment><comment><USER3> The article could have mentioned Skyhook [1], which can be built with existing materials.

[1] [https://en.wikipedia.org/wiki/Skyhook_%28structure%29](https://en.wikipedia.org/wiki/Skyhook_%28structure%29)

<comment><USER4> The way these are described in Seveneves is _awesome_. I didn't realize there's so much theory behind it!

</comment></comment><comment><USER5> Carbon nanotubes are seductive. They are very strong, diamond like, in that circularized plane. But when you extend the tube to macro dimensions, you have problems with phonons and the 'rogue waves' that add up over such long distances (relative to atoms). These phonon effects can and do add up to break the nanotube as there is so much energy in the phonon that it overcomes the intermolecular bonds. You can help a bit with an onion layering of nested nanotubes, each a little bit bigger. But that doesn't get you much further. Doping the tubes with other atoms reduces the strength by a lot, but may increase the length. Isotopes of carbon, like C10 or C14, do help a fair bit. However, they tend to be too radioactive to be stable for a project like this. You'd have to continually replace the rope as the dopant isotopes would decay away and the nanotubes would self destruct again. In the end, we need new ideas to help with this. Perhaps some strange electron-phonon interaction? I don't know.

<comment><USER6> Yes, but so what if you need to continuously replace parts of the cable? As long as you can identify the damage and cheaply perform the repair, it doesn't seem that bad.

<comment><USER5> The idea is that the cable would be one long crystal, not sections. You'd have to continuously extrude the crystal from orbit to the ground or something. You can't bolt in new pieces. Whatever the solution will be, cheap is not one of the answers. Just the maintenance on it would be a world-wide effort. And for what? Cheap orbital travel? The real hard part is to find a reason to leave Earth that the oceans and Antarctica don't already fulfill. The only one I can think of is orbital foundries or other processes that need 0g. Living space we have a lot of, though cold, Antarctica has air, something Mars and Venus do not.

</comment></comment></comment><comment><USER7> > pls don't ask me about space elevators until someone at least builds a > carbon nanotube structure longer than a footbridge

[https://twitter.com/elonmusk/status/559557786514632704](https://twitter.com/elonmusk/status/559557786514632704)

</comment><comment><USER8> Yes, people are still working on it. It's not going to get built if no one tries.

<comment><USER9> Some things aren't worth trying because they are batshit insane.

<comment><USER10> It might be more cost effective to build a really long, narrow elevator into space vs. paying $450 million per launch of a rocket/large spacecraft.[1] And keep in mind that launching a large spacecraft usually carries less than 12 individuals.

[1] [http://www.nasa.gov/centers/kennedy/about/information/shuttl...](http://www.nasa.gov/centers/kennedy/about/information/shuttle_faq.html#10)

<comment><USER11> Not really this is like saying that It would be more cost effective to build jumbo jets instead of sail boats in the 15th century. Even if an alien descended from the sky and gave you the materials to build it we don't have a single analogy as far as the actual engineering and construction process goes to even begin drawing blue prints.

So yeah in the "long run" it might be more cost effective but it's irrelevant you can say the same thing about any hypothetical technology but you can't stop spending money in the mean time if nothing else we need to be able to be really good at launching extremely heavy payloads and building stuff in micro- gravity before we can even begin to start dreaming about how to build a space elevator. We also need rockets that can go out quite far and come back with a huge payload like a small asteroid for the anchor and even most likely have to master asteroid mining for the raw materials for any potential space elevator. My bet is that it may become feasible around 2250-2500 (yes I know this is a 250 years window :)) if it's possible at all (because when all said and done even carbon nano-tubes aren't good enough they are a good candidate and most likely will be used but we need much stronger composites than what carbon-nano tubes alone can offer).

</comment></comment></comment></comment><comment> matt-attack What I never seem to see addressed, is the following: As the elevator ascends the cable, it's "ground speed" must continually increase. What is the source of the force that provides that acceleration (parallel to the ground)?

A traditional rocket expends a great deal of energy firing its rockets with a component parallel to the surface of the earth to gain acceleration in that direction. Where is the equivalent coming from w/ the space elevator?

<comment><USER12> The earth's rotation. Much like how your rotational velocity increases when you climb stairs. Also, the cable is not vertical, you want a large mass past geostationary orbit which pulls the cable fairly thought though there is some bend.

PS: Try and calculate just how much energy is in earth rotation it's a rather large number.

<comment><USER13> > climb stars

I love this typo.

</comment></comment></comment><comment><USER14> A space elevator only provides access to geostationary orbit. One can climb up to LEO altitudes along an elevator, but that doesn't mean much. You wouldn't be in orbit, but sitting stationary as if atop a tall building. So we would still need to launch rockets for any space use in LEO (GPS and imaging sats for example). And any such orbiting objects would of course have to be navigated around this obstruction. Many useful orbit types would have to be outlawed to protect the elevator.

I wonder, is easier to launch into a LEO from the ground or from a fixed point at say 300km altitude? If you climbed a space elevator you would still need 8km/s of speed laterally. So you jump off and fire your rocket. You still fall towards the ground, requiring some thrust to keep out of the atmosphere. Without the arcing trajectory of a ground launch you would have to accelerate roughly twice as quickly, requiring larger engines. Is that really any better than starting from the ground as we do today?

Or you could climb to a near-geostationary position, burn retrograde until you touch the atmosphere, then aerobrake down to LEO. That's still a heck of a lot of effort.

<comment><USER15> Any height is an advantage in achieving orbit. It's an exponential problem - you need fuel to go up, and you need more fuel to lift the fuel you need to go up, etc.

Also, air resistance is much more at the surface than higher up.

So by starting your ascent at a high altitude you need much less fuel both because you need less fuel, and because there is less air resistance (friction).

Space elevators still need to use the same energy to lift something, but they use an external power source so do not need to lift their own fuel, and they lift more slowly and greatly reduce the effect of air resistance.

So no, a space elevator won't get you to "outer space", but it creates a stepping stone which greatly reduces the cost of getting there.

<comment><USER14> Air resistance is a very minor issue for rockets. Long/thin things are very slippery and once at 10-20-30,0000 meters the air is basically gone.

Jumping off the elevator from LEO altitudes would still require one to fight gravity, to avoid dipping back into the atmosphere before getting to orbital velocities. So there are still gravity-related losses to account.

<comment><USER16> This isn't correct. Air resistance increases at the rate of velocity squared. At the speed those rockets achieve, is is a big factor. Elon Musk himself likened the atmosphere to a "thick soup" when it comes to launching rockets to space.

<comment><USER14> My understanding is that atmospheric drag on a standard launch vehicle to leo is on the order of 300-400m/s, a small fraction of the total budget.

</comment></comment></comment></comment></comment><comment><USER17> A space elevator on Earth is very hard to build and would require exotic materials which we can't yet synthesize in bulk. But you can make a decent lunar space elevator with Kevlar.

[http://hopsblog-hop.blogspot.com/2012/09/beanstalks- elevator...](http://hopsblog-hop.blogspot.com/2012/09/beanstalks-elevators- clarke-towers.html)

</comment><comment><USER18> I certainly believe an underthought of this article, which is that improved capabilities with materials such as carbon nanotubes might lead to a paradigm shift in the possibilities of what can be done with materials.

</comment><comment><USER19> "But you've had civilizations rise and fall by a change in material strength by a decimal point, and now you're talking about orders of magnitude."

Does anyone know what he's referring to in this comment?

<comment><USER20> I would assume Bronze -> Iron -> Steel would be the changes he's alluding to.

</comment></comment><comment><USER21> My understanding of the biggest challenge is that each point in the cable must be strong enough to carry the weight of all the cable beneath it, which by the time you reach the upper atmosphere would be tremendous even using carbon nanotubes. The cable would also be perpetually struck and damaged by high velocity micrometeoroids.

<comment><USER22> Can't you have multiple stages with multiple cables? I guess acceleration and deacceleration between stages could be costly, though.

<comment><USER23> What do you connect your stages to other than the next stage?

<comment><USER22> I would imagine the cabin could stop halfway, were it would attach to some magnetic or mechanic lock system. There it would detach from it's cable and be attached to another one that would pull it out the rest of the way. Actually, the first cable could be the lock system; you just have to keep it attached until you setup the second one.

</comment></comment></comment></comment><comment><USER24> Space elevator shadow wouldn't look like that: [https://en.wikipedia.org/wiki/Umbra,_penumbra_and_antumbra](https://en.wikipedia.org/wiki/Umbra,_penumbra_and_antumbra)

</comment><comment><USER25> I remember back in the early 2000's when predictions for when it would be built was 2015-2020. 4 years to go.....

<comment><USER26> To be fair, the advances in space tech by the private sector have been nothing short of amazing as of late. It's really an exciting time.

<comment><USER27> I fear we're heading into Year of Linux Desktop memes with the private sector. I'd love to be proved wrong.</comment></comment></comment>


NC Police Issue Sweeping Warrants to Search All Google Devices Near Murder Scene - <AUTHOR> https://gizmodo.com/north-carolina-police-issued-sweeping-warrants-to-searc-1823845667 <comment><USER2> Previous: [https://news.ycombinator.com/item?id=16610088](https://news.ycombinator.com/item?id=16610088)

<comment><USER3> Ok, since that article is the original source and this one points to it, we've merged the threads there.

</comment></comment><comment><USER4> So it means all criminals just need to switch to iPhones?</comment>


Best CMS Ever - <AUTHOR> http://www.bestcmsever.com/index.html

<comment><USER2> Aw. I was expecting a CRM (which is what the original title says) but all I got was a CMS.

</comment><comment><USER3> That's a really freaking beautiful website.

<comment><USER4> Thank you :3

</comment></comment><comment><USER5> CRM, CMS, RGB, DNS. What's the difference. Our search is still over.

</comment><comment><USER6> But can this CMS cure halitosis?</comment>


Why People don't take Public Transport - an economic analysis - <AUTHOR> http://www.uwgb.edu/dutchs/PSEUDOSC/MassTransit.HTM

<comment><USER2> The time/value calculation doesn't apply like illustrated if you can work on the bus or train. Or even if you can't do a full amount of work, you can discount the hourly rate by how useful the time is to you (reading emails, reading a book, etc).</comment>


UK: Mast fire probe amid 5G coronavirus claims - <AUTHOR> https://www.bbc.com/news/uk-england-52164358 <comment><USER2> This is a whole new level of crazy to me, what on earth do people think 5g has to do with the current pandemic?

>One suggests 5G suppresses the immune system, the other claims the virus is somehow using the network's radio waves to communicate and pick victims, accelerating its spread.

What on earth??? Do they think the virus is a conscious thing that can communicate.

This is insane.

<comment><USER3> They think the effects people are experiencing aren't from a virus at all, but from millimeter-wave 5G radiation. Same fear as the TSA nude-body imaging scanners but on a worldwide scale.

<comment><USER4> They think the effects people are experiencing aren't from millimeter-wave 5G radiation at all, but from mass hysteria. Same fear as WiFi but on a newer context.

</comment></comment></comment><comment><USER5> When you don't have the technological and scientific literacy to understand even the basics of the modern world around you it's all magic.

</comment><comment><USER6> What's up with the BBC even writing that there is "no _credible_ link" between the two? Why qualify with "credible", when it's more correct to say "the two are unrelated", ie indicating that there is no link whatsoever.

Then again, maybe it's a lost cause, and no amount of clear editing would get the point across to the unthinking idiots who harm us all.

<comment><USER7> you have to say it that way... if you say there is no link then you're immediately discounting without considering evidence.

Then you break what the scientific method is all about.

Evidence must be considered then thrown out or used based on its merits.</comment></comment>


End-to-end encryption in the browser - <AUTHOR> https://blog.excalidraw.com/end-to-end-encryption/ <comment><USER2> I appreciate the effort, but this is one of those cases in which there isn't much security added by encryption.

If I assume the website owner is malicious (or subverted by powers that be), I cannot trust the JS code provided by the website. Key disclosure is as trivial as one line hidden somewhere in megabytes of JS code delievered from the server. Which makes "end-to-end" part nearly meaningless.

<comment><USER3> How does that differ from a native app? In any E2E context you have to trust the client code.

Sure, there are a couple extra steps needed here:

\- The website author needs to avoid casually throwing in dependencies (unlike perhaps the average JS project)

\- HTTPS for loading code resources is crucial; maybe even CDNs need to be avoided

\- The user needs to avoid having browser extensions enabled

But the fundamental problem doesn't seem different nor intractable.

<comment><USER2> I can build a native app from the codebase myself. I can be sure that a native up won't change in-between launches.

> In any E2E context you have to trust the client code.

I don't have to trust code which is continuously being delievered from the server. This is an intractable problem.

<comment><USER3> Others have said it's open-source. Build it yourself, inspect what your browser downloads, hash and compare like normal.

<comment><USER4> How do you hash your browser downloads? Also you need to perform that on every request. It should be possible with additional addons, but definitely not out of the box.

<comment><USER3> You can easily open the dev tools, view the payloads, and copy them locally. It would be trickier to prevent evaluation before you've done so, but all you have to do is not enter anything sensitive until you've checked

</comment></comment></comment></comment></comment></comment><comment><USER5>
        const encrypted = await window.crypto.subtle.encrypt(
          { name: "AES-GCM", iv: new Uint8Array(12) /* don't reuse key! */ },
          key,
          new TextEncoder().encode(JSON.stringify(content))
        );

This looks wrong. The iv should be a randomly generated string that is only used once. I'm not super familiar with modern Javascript, but I think you're just initializing a bunch of null bytes.

Honestly, I feel like whoever designed AES intended for people to make this mistake, because half of the sample code I see has this error, and it would have been easily avoided by specifying the IV length in the standard and requiring libraries to automatically generate it and prepend it to the ciphertext rather than letting callers have control over how it is initialized and stored.

<comment><USER6> Well on the site it was said

"We encrypt the content with that random key. In this case, we only encrypt the content once with the random key so we don't need an iv and can leave it filled with 0 (I hope…)."

Anyone think that is a good idea?

<comment><USER7> It's a good idea if you encrypt with the same key _once_ — you can avoid attaching nonces to your ciphertext (less code and data), and have only 16-byte key in the URL.

In fact, using a random IV with AES-GCM is not exactly safe: 12-byte nonce is too small to avoid collisions with many encryptions. The recommendation is to not encrypt more than 2^32 messages with the same key if you use the random nonce.

<comment><USER4> What would happen if an attacker gets two different messages with identical IV and key?

<comment><USER7> They'll get the XOR of the two original messages, and also can break authentication: [https://crypto.stackexchange.com/questions/26790/how-bad- it-...](https://crypto.stackexchange.com/questions/26790/how-bad-it-is-using- the-same-iv-twice-with-aes-gcm/68525#68525)

<comment><USER4> That's scary, thanks!

</comment></comment></comment></comment></comment></comment><comment><USER8> Super excited to see that excalidraw made the front page! We published an article yesterday explaining how the end to end encryption works when sharing a link: [https://blog.excalidraw.com/end-to-end- encryption/](https://blog.excalidraw.com/end-to-end-encryption/)

<comment><USER9> Any chance you could add actual pen-like drawing? That would make it much more versatile, and make it fit its description better ("Excalidraw is a whiteboard tool that lets you easily sketch diagrams that have a hand-drawn feel to them."). Bonus points for using PointerEvents to change the line width with the pen's pressure.

Saving the diagram automatically and restoring when the site is revisited is a nice touch.

<comment><USER10> There is an issue up for grabs: [https://github.com/excalidraw/excalidraw/issues/25](https://github.com/excalidraw/excalidraw/issues/25)

</comment></comment></comment><comment><USER11> As with every in-browser encryption deployment - what's the threat model here ?

> I now sleep much better at night. If the hosting service gets compromised, > it doesn't really matter as none of the content can be decrypted without the > key.

Which can be easily exfiltrated by the compromiser as they are now in a position to deliver and run arbitrary javascript in your users browser where the keys reside

Also, why can't I draw an actual non-flawed circle ?

<comment><USER12> > As with every in-browser encryption deployment - what's the threat model > here ?

I believe the biggest win is that existing content will not be accessible to a hacker even if they fully compromise the website, unless users re-open them. So, sure, plenty of content _may_ get compromised if the site gets hacked, but some large percentage of old content will not be.

> Also, why can't I draw an actual non-flawed circle ?

Adding sloppiness when white boarding is a common pattern to indicate roughness. It subtly cues the viewer not to treat it as a completed product, and allows them more freedom to make changes. If you wanted clean lines, there are many web drawing tools for that too.

<comment><USER11> > I believe the biggest win is that existing content will not be accessible to > a hacker even if they fully compromise the website, unless users re-open > them. So, sure, plenty of content may get compromised if the site gets > hacked, but some large percentage of old content will not be.

The attacker won't need to wait for the users to open a specific drawing - just browse to the website, from there they can grab the keys for all drawings they have assuming that not that many of them exist in the first place and the attacker has the list of key ids from the compromised backend.

It does call for a much more noisy and visible attack which is by itself a valuable mitigation.

<comment><USER12> Either I'm not understanding you, or you're not understanding the tech. The website does not store _any_ of the keys. They exist as a url fragment that only the user has ever seen.

So if I create an image today and encrypt it, only I see the key. If you hack the website tomorrow, you have access to my encrypted content, but not the key.

 _Now_ that you control the website, you can modify the code so that the key gets sent up every time a user encrypts or decrypts something. But you don't have any access to anything created before you hacked it, if no user decrypts it.

</comment></comment></comment></comment><comment><USER13> Looks neat!

End-to-end encryption in the browser is not perfect security, as other comments are saying, but it's significantly better than having user data in clear on a MySQL database somewhere.

PS. I'm the founder of Userbase.com — an open source service to help you build end-to-end encrypted web apps like this.

</comment><comment><USER14> One of the problems with hacking the hashtag (#) in the URL is that this fragment identifier is supposed to be used to identify a portion of the document. As such unexpected things can happen when you try to exploit the hash tag for other purposes.

For example, with older of versions of Microsoft Office you cannot use a pound character in a hyperlink:

[https://support.microsoft.com/en-us/help/202261/you- cannot-u...](https://support.microsoft.com/en-us/help/202261/you-cannot-use-a- pound-character-in-a-file-name-for-a-hyperlink-in-an)

Some email applications may unexpectedly strip the tag, attempting to be smart about handling it in the RFC 3986 sense (not anticipating this use-case at all). When the data appended to the # is a dependency to view the link, it can more easily render the link unusable.

<comment><USER15> What would be a valid alternative?

</comment></comment><comment><USER16> For anyone else uninitiated:

> Excalidraw is a whiteboard tool that lets you easily sketch diagrams that > have a hand-drawn feel to them.

It appears to be free open-source software on an MIT license.

[https://github.com/excalidraw/excalidraw](https://github.com/excalidraw/excalidraw)

</comment><comment><USER17> More information about the project (I'm unaffiliated, just wanted to learn more!) [https://blog.excalidraw.com/reflections-on- excalidraw/](https://blog.excalidraw.com/reflections-on-excalidraw/)

</comment><comment><USER18> Awesome work! Definitely not common knowledge that parameters after # isn't sent over the wire. Can be used in fun ways.

I did the same thing but for text with [https://anolog.org](https://anolog.org).

Sadly, since I used anonymous gists hosted on Github as my Data store, which they shut down last year, the service doesn't work anymore. :(

</comment><comment><USER19> From one of HN's own stars:

Javascript Cryptography Considered Harmful: [https://www.nccgroup.trust/us/about-us/newsroom-and- events/b...](https://www.nccgroup.trust/us/about-us/newsroom-and- events/blog/2011/august/javascript-cryptography-considered-harmful/)

There are some out of date bits, but the core of the post is still as true as it was back in 2011.

<comment><USER20> Very little of that article is applicable. The website is served over HTTPS, the browser has a crypto API now. The encryption in this project decreases the impact of any future compromise of the server (if a share link is never visited post-compromise, it's safe) _and_ makes it necessary for an attacker to show their hand by serving malicious code to the client. (With browsers as they are now, that can be made hard to detect, but it's a start. There's always the risk of serving it up to someone who's logging every response.)

<comment><USER19> All the other js resources on the page can still backdoor the app, though, and exfiltrate your keys. SRI and no longer executing javascript served with the right content-type in an img src is helpful along these lines, but even with SRI on every script tag, the sub-scripts pulled in from the integrity-checked third party js can pull in arbitrary further resources which can then overwrite your functions to steal your keys.

Even a strict CSP doesn't totally close the hole.

It's sort of crazy how difficult (that's a euphemism—I would term it "impossible") it is to even attempt to secure browser-based crypto, over and above the normal challenges involved in crypto implementation. I wouldn't use clientside js crypto for anything more secret than a grocery list.

</comment></comment></comment><comment><USER21> I like that this is nice and simple and intuitive: if I want a bazillion menus and options there are many other tools. I also like the hand-drawn font.

</comment><comment><USER22> Wait, so you're sending the key in the url?

I thought urls weren't encrypted in HTTPS? Am I missing something?

<comment><USER23> URLs are encrypted. Hostnames aren't encrypted in HTTPS, unless TLS SNI is encrypted.

The problem with URLs is that a lot of products will log the URL to disk, and many operators forget or aren't aware they might need to have security plans around data in the logs.

<comment><USER24> A worse and impossible to mitigate problem in other scenarios is that user agents will cheerfully "bookmark" or "favourite" a URL or just let you "share" it and it's often not obvious to the end user that this shares their current state which they probably don't want not just the thing they're looking at. Example: you try to share the forum help link but instead give the recipient your logged in account...

This is the reason not to put authentication tokens into URLs for example.

When the state users want to bookmark or share literally is the state that's encrypted anyway this mismatch isn't a threat. If I send you the URL for this drawing of a cat and then I'm astonished you can now see the drawing of the cat I've got real problems technology can't fix.

<comment><USER22> yeah, this.

Having the key in the url seems insanely insecure to me.

<comment><USER25> Why? It makes it easy to share a sketch with someone else while still preventing the server from decrypting the data. Anything stored in a location hash (after the # symbol) does not get passed to the server.

The threat model the author tried to work around is not the user dumbly compromising their own work. The author wants to prevent proprietary and PII data from being stored on their own server. End-to-end encryption significantly reduces the author's potential liability hosting something like this in case something goes wrong.

<comment><USER23> > _Why? It makes it easy to share a sketch with someone else while still > preventing the server from decrypting the data. Anything stored in a > location hash (after the # symbol) does not get passed to the server._

I'll hit the URL bar and hit control-C. That's way better than any javashit which wants to touch my clipboard.

Copying the current URL also copies the key in that case. Now I'm accidentally sharing my encryption information with another user.

<comment><USER25> That's literally the use-case of pasting the link to your sketch to someone. The app itself is not touching your clipboard. Take a careful look at how this works, it's perfectly innocuous.

</comment></comment></comment></comment></comment></comment></comment><comment><USER26> Another similar effort:

[https://github.com/Spark-Innovations/SC4](https://github.com/Spark- Innovations/SC4)

(Disclosure: SC4 is my project.)

</comment><comment><USER27> I'm a fan of [https://precursorapp.com/](https://precursorapp.com/), but will give excalidraw a go.

</comment><comment><USER15> This works well for sharing stuff like notes, drawings, etc. But what if your platform was more like a forum or a chat room? How could you share the keys?

</comment><comment><USER28> Is this going to be legal in the US under EARN IT?

<comment><USER29> Almost certainly not. EARN IT doesn't technically forbid encryption, it just lets an unelected board decide the legal requirements for communication without being sued into oblivion. But the unelected board will be under the control of those who object to encryption they can't break.

It would probably be legal if the program also sent the crypto keys somewhere for later use.

</comment></comment><comment><USER30> JavaScript "encryption" is like sending someone a letter in a package with a TSA lock on it, asking them to communicate secretly with you. They send you back the package with the lock, and instructions on how to communicate securely. You send the package back with the lock and your message encrypted according to the instructions.

It doesn't matter what your encryption scheme is. The TSA lock means the TSA can control the content. But the user assumes their communication isn't controlled by the TSA, because they are receiving instructions that appear normal.</comment>


Median YouTube views/subscribers ratio – 30% (among channels I'm subscribed to) - <AUTHOR> https://github.com/efojs/yt_views_subs <comment><AUTHOR> Recently I found a cooking channel with 139K subscribers, but less than 500 views per new video.

I was confused and still don't know what's the deal, but to dig deeper firstly wanted to check if this channel really stands out and find:

— if it's unusual to have <500 views per video for 150K channel,

— if there is any visible relation between subscribers and views count.

So I used YouTube API to fetch data about all 346 channels I'm subscribed to and found that:

— some channels provide no stats, so after filtering them out only 333 left,

— having less than 500 views per video for 100K+ channel is unusual, and

— that in general 30% of subscribers watch new posts.

If you want to repeat the exercise with your channels, you'll need some basic Git and Python experience and get YouTube Data API key.

Post with more details on GitHub: [https://github.com/efojs/yt_views_subs](https://github.com/efojs/yt_views_subs)

<comment><USER2> Back on Google+ a "views per follower" (VPF) metric was in vogue for a while, see: [https://globerunner.com/introducing-new-google-plus- quality-...](https://globerunner.com/introducing-new-google-plus-quality- metric-views-per-follower-vpf/)

A few things stood out:

\- VPF was typically low. Ghost town...

\- High-follower counts typically had low VPFs, lower-but-modest follower counts: higher. This follows from an attention basis: low follower counts tend to be more directly engaged.

\- Actual values were all over the map, and informal sampling tends to be highly biased.

\- Useful sampling probably starts with at _least_ both of most-heavily-viewed channels and most-heavily-subscribed channels. Those are the ones which are succeeding by at least some metric. You'd likely also want to include most- viewed videos, though one-hit-wonders can also distort results. (Tom Scott's observation that you _don 't_ want instant success, but more of a slow burn, is very apt.)

Again, from G+, here looking at Communities, what I found was that it was _not_ the total number of members that mattered most, but _the rate of new content_ \-- and no, more isn't always better, but _none_ is fatal.

Looking at visible metrics (community name, subscribers, visible recent comments, plus-ones ("likes"), and re-shares, correlation was highest with _more posting activity_ , at least to a point (based on the visible rate of new posts).

Large groups with no posts => no activity.

Small groups with relatively frequent posts, often => high activity.

After a point, size seemed to count against communities (~10k members or so).

This is based on a comprehensive dataset of summary data from _all 8 million_ G+ communities, provided me by Friends+Me during the G+ shutdown. See:

[https://social.antefriguserat.de/index.php/Migrating_Google%...](https://social.antefriguserat.de/index.php/Migrating_Google%2B_Communities#Google.2B_Community_Characteristics_and_Membership)

Also:

Activity crossplots: [https://joindiaspora.com/posts/13680950](https://joindiaspora.com/posts/13680950)

Membership distribution (log-log): [https://joindiaspora.com/posts/13738258](https://joindiaspora.com/posts/13738258)</comment></comment>


How to Design Programs: An Introduction to Computing and Programming - <AUTHOR> http://htdp.org/2003-09-26/Book/ <comment><USER3> The authors are working on a 2nd edition that seems much improved. Here's a link to the draft:

<http://www.ccs.neu.edu/home/matthias/HtDP2e/>

<comment><USER4> That is edition is also moving from PLT Scheme to the renamed Racket (<http://racket-lang.org/>).

Here is the announcement:

[http://blog.racket-lang.org/2010/06/plt-is-happy-to- announce...](http://blog.racket-lang.org/2010/06/plt-is-happy-to-announce- release-of.html)

</comment></comment><comment><USER5> sicp <http://mitpress.mit.edu/sicp/>

htdp (this thread)

plai <http://www.cs.brown.edu/~sk/Publications/Books/ProgLangs/>

eopl <http://www.cs.indiana.edu/eopl/>

Also,

htdw <http://world.cs.brown.edu/1/>

<comment><USER6> Are there any of such books available in epub format so that I can read on my mobile device?

</comment></comment><comment><USER7> Really good book. GA Tech used this as their "Intro to CS" text until they decided that learning scheme was too much for business and inta majors (everyone in the school had to take the class). I'd recommend this as a potential alternative for those thinking about learning to program using SICP. The latter dives into some more advanced topics, but this is much more accessible to newbies imo.

<comment><USER8> I think GATech used SICP for a semester or two as well.

</comment></comment><comment><USER9> This was used at Waterloo in CS 135 back when I took it (maybe it still is the text?). An introduction to programming that really is an introduction to programming. On an unrelated note, this suddenly reminds me of "Assembly Language Step By Step" (<http://www.duntemann.com/assembly.html>). Another introductory book I thought was absolutely wonderful back when I read it, but goes about things entirely the opposite way from this book - <USER2> programming (from scratch!) at the lowest possible level. Maybe the desire to memorize the names and functions of the x86 instruction set isn't so different from an obsession with pokemon or whatever the latest childrens fad is. Both approaches appeal to me, but maybe that isn't true for people in general.

<comment><USER10> I've heard that(Scheme && Assember) a lot.

Could be that programs that write programs are really powerful/exciting and that it is really possible only in both ends of the expressiveness spectrum.

</comment></comment><comment><USER11> I will upvote this thing all day (figuratively speaking of course). Going through this was a big level-up for me.

<comment><USER12> > Going through this was a big level-up for me.

That's a very nice way of putting it. I too feel a lot more confident about an entire class of problems thanks to HTDP. The only problem I have with the book is that the generative recursion stuff is not as well done as the structural recursion portions, but I guess that could be because generative recursion portions are inherently more creativity requiring/difficult than the structural portions. Anyway, that portion is being revamped for 2e so I'm looking forward to relearning it.

<comment><USER11> I didn't realize it was being revamped. I had to skip some of the algorithm parts for lack of math (which I'm also studying). IME Part V was by far the hardest part of the book. I often found the language confusing and had to puzzle things out slowly that once I understood them, it seemed they could be more simply put. (Of course in order for that criticism to be useful I would have to develop it and provide details.) There seems to be a lot of value placed on abstraction, to the point that it's sometimes hard to follow. I don't know if it's just me or if it's just a result of the authors being so darn smart.

</comment></comment></comment><comment><USER13> Findler was my Intro to CS prof. <http://www.eecs.northwestern.edu/~robby/uc- courses/> Great teacher.

<comment><USER14> I loved his Macro Talk. <http://www.youtube.com/watch?v=GBpfOpk-ZBU>

</comment></comment><comment><USER15> How I wish I had access to such books 11 years back. Very nice book. Thanks for sharing.

</comment><comment><USER16> Great book, but how often it has already been posted on HackerNews?</comment>


Ask HN: Share encouraging advice - <AUTHOR>

The great John Maeda once said;
"When you're younger, think less and do more; when you're older, do less and think more."
...
"I see a lot of (especially young) people get frozen by the paralysis of indecision. Just start making stuff until something catches." ~Jonathan Harris <comment><USER2> Theodore Roosevelt's The Man in the Arena:

"It is not the critic who counts; not the man who points out how the strong man stumbles, or where the doer of deeds could have done them better. The credit belongs to the man who is actually in the arena, whose face is marred by dust and sweat and blood; who strives valiantly; who errs, who comes short again and again, because there is no effort without error and shortcoming; but who does actually strive to do the deeds; who knows great enthusiasms, the great devotions; who spends himself in a worthy cause; who at the best knows in the end the triumph of high achievement, and who at the worst, if he fails, at least fails while daring greatly, so that his place shall never be with those cold and timid souls who neither know victory nor defeat."

<http://en.wikipedia.org/wiki/The_Man_in_the_Arena>

</comment><comment><USER3> Too often we are scared.

Scared of what we might not be able to do.

Scared of what people might think if we tried.

We let our fears stand in the way of our hopes.

We say no when we want to say yes.

We sit quietly when we want to scream.

And we shout with the others,

when we should keep our mouths shut.

Why?

After all,

we do only go around once.

There's really no time to be afraid.

So stop.

Try something you've never tried.

Risk it.

Enter a triathlon.

Write a letter to the editor.

Demand a raise.

Call winners at the toughest court.

Throw away your television.

Bicycle across the United States.

Try bobsledding.

Try anything.

Speak out against the designated hitter.

Travel to a country where you don't speak the language.

Patent something.

Call her.

You have nothing to lose

and everything

everything

everything to gain.

JUST DO IT.

([http://joshpremuda.com/wp-content/uploads/2009/10/Barry- Sand...](http://joshpremuda.com/wp-content/uploads/2009/10/Barry-Sanders-Nike- Ad.jpg))

</comment><comment><USER4> "I have never let my schooling interfere with my education."

\-- Mark Twain

"So I wanted to project myself forward to age 80 and say, 'Okay, now I'm looking back on my life. I want to have minimized the number of regrets I have.' I knew that when I was 80 I was not going to regret having tried this. I was not going to regret trying to participate in this thing called the Internet that I thought was going to be a really big deal. I knew that if I failed I wouldn't regret that, but I knew the one thing I might regret is not ever having tried. I knew that that would haunt me every day, and so when I thought about it that way it was an incredibly easy decision. And I think that's very good."

\-- Jeff Bezos, Regret Minimization Framework (<http://www.youtube.com/watch?v=jwG_qR6XmDQ>)

</comment><comment><USER5> Nice quote there. Few of my favourites.

mark twain: "Dance like nobody's watching; Love like you've never been hurt. Sing like nobody's listening; Live like it's heaven on earth."

Einstein: "imagination is more important than knowledge"

Programmers quote:"I find that most people get upset by mistakes. I generally don't. I have always thought that the reason is that I am trained to accept that there will be mistakes, because compilation errors are a norm. When they happen, you fix them, and move on with your life. If you get upset over compilation errors, you won't last in this biz"

trotsky: "those who make peaceful revolution impossible make violent revolution inevitable"

"always end on a quote"

</comment><comment><USER6> "Maximize your serendipity." - Nassim Taleb

"No matter how much faculty of idle seeing a man has, the step from knowing to doing is rarely taken." - Ralph Waldo Emerson

"A regular paycheck and crack cocaine have a lot in common." - Felix Dennis

"Not the lowest hanging fruit. You want the highest RoI fruit." - Me =)

</comment><comment><USER7> "The infinite possibilities each day holds should stagger the mind. The sheer number of experiences I could have is uncountable, breathtaking, and I'm sitting here refreshing my inbox. We live trapped in loops, reliving a few days over and over, and we envision only a handful of paths laid out before us. We see the same things every day, we respond the same way, we think the same thoughts, each day a slight variation on the last, every moment smoothly following the gentle curves of societal norms. We act like if we just get through today, tomorrow our dreams will come back to us. And no, I don't have all the answers. I don't know how to jolt myself into seeing what each moment could become. But I do know one thing: the solution doesn't involve watering down my every little idea and creative impulse for the sake of some day easing my fit into a mold. It doesn't involve tempering my life to better fit someone's expectations. It doesn't involve constantly holding back for fear of shaking things up. This is very important, so I want to say it as clearly as I can: FUCK. THAT. SHIT." xkcd

</comment><comment><USER8> "If you're going through hell, keep going." - Winston Churchill

"There are no right and wrong decisions. Make a decision and then [work hard enough to] make sure it was the right one." -My Mom

 _Both of these have gotten me through some dark days, both career-wise and personally._

</comment><comment><USER9> Opportunity is missed by most people because it is dressed in overalls and looks like work. - Thomas Edison

</comment><comment><USER10> _If you continue to do what you do, you will continue to get what you get._

\--Anon, Chinese proverb

<comment><USER11> And that's really the most important thing a startup founder needs to know.

</comment></comment><comment><USER12> "Do something that scares you, every day"

From the 'sunscreen' speech.

The whole thing is worth listening to or reading.

<http://www.google.com/search?q=sunscreen+speech>

</comment><comment><USER9> "The simplest way to get what you want is to deserve it"

"Deliver to world what you would buy if you were on the other end of the deal"

"Have lots of assiduity. That means you sit down on your ass and do it until it's done"

All Charlie Munger

</comment><comment><USER13> "At any moment that you find yourself hesitating, or if at any moment you find yourself putting off until tomorrow trying some new piece of behavior that you could do today, or doing something you've done before, then all you need to do is glance over your left shoulder, and there will be a fleeting shadow. That shadow represents your death, and at any moment it might step forward, place its hand on your shoulder and take you. So that the act that you are presently engaged in might be your very last act and therefore fully representative of you as your last act on this planet." - Carlos Castaneda, Don Juan

</comment><comment><USER14> "It's better to be a pirate than to join the Navy"

\-- Steve Jobs

</comment><comment><USER15> "You can't wait for inspiration. You have to go after it with a club."

\- Jack London

</comment><comment><USER16> "You are what you choose."

"No one ever lay on their deathbed saying 'I wish I'd watched more TV.'"

</comment><comment><USER9> The thoughts of others were light and fleeting, of lovers meeting or luck or fame, mine were of trouble and mine were steady, and I was ready when trouble came. \- Houseman

</comment><comment><USER9> "Decide what you would be and then do what you have to do"

</comment><comment><USER9> <http://www.youtube.com/watch?v=GEkz1XK75XE>

</comment><comment><USER9> "There is 0 value in fear and anxiety"

</comment><comment><USER17> Do you want to go to your grave saying, "I wish I had . . ."?

</comment><comment><USER3> "A prayer for the wild at heart, kept in cages."

\- Tennessee Williams

</comment><comment><USER9> Just do it - Nike</comment>


YC Summer 2018 invites - <AUTHOR> Has anyone received the yc summer 2018 interview invites/rejects yet ? <comment><USER2> Nothing yet, I've also not received any video views.

</comment><comment><USER3> Nothing here</comment>


Martin Manley: My Life and Death - <AUTHOR> http://www.zeroshare.info

<comment><USER2> The page "Why Age 60?" was pretty upbeat. I don't know how to feel about him referencing a ST:TNG episode for justification of suicide. [http://www.zeroshare.info/why_age_60](http://www.zeroshare.info/why_age_60)

</comment><comment><USER3> Lots of duplicates of this already:

[https://www.hnsearch.com/search#request/all&q=manley](https://www.hnsearch.com/search#request/all&q=manley)

<comment><AUTHOR> Sorry, I didn't see those. I count on the site to flag for duplicates. Apparently it can miss some.</comment></comment>


Ask HN: Any programmer/developer using Windows as their primary OS? - <AUTHOR> <comment><USER2> At my new job, yes, but I solved the hideous problem by installing Babun, which is a package of a fairly good terminal emulator (mintty), cygwin, package manager, and my beloved zsh :-) I can use vim, grep, ls, find, sed, shell scripts, and much more. Like on Linux but without the possiblity to choose fluxbox as window manager.

</comment><comment><USER3> Yes

<comment><USER4> I wish I had more upvotes to give this answer!

</comment></comment><comment><USER5> I would suspect most are.. I doubt they read HN though

</comment><comment><USER6> I'm using it at work and it's a pain. Don't go down that path unless you're writing windows applications. For anything else, use a real OS

<comment><USER7> I'm using it at work and it's a pleasure.

Use whatever fits your workflow and try not to be put off by comments like this that offer no useful information.</comment></comment>


Chinese Company Unveils $48,000 'Tesla Model S' Knockoff - <AUTHOR> http://nextshark.com/china-youxia-x-tesla-model-s/ <comment><USER2> Gets half the range of Model S, twice as slow acceleration, and hopefully the batteries don't randomly explode. You would be better off getting a cheaper Model 3.

<comment><USER3> Chinese Company Unveils $48,000 electric car which looks like the Model S, with Chinese characteristics.</comment></comment>


Show HN: Angular 4 Material Point-of-Sale - <AUTHOR> https://angularpos.samfinan.com <comment><AUTHOR> GitHub: [https://github.com/samcfinan/Angular-4-Material- POS](https://github.com/samcfinan/Angular-4-Material-POS)

A basic point-of-sale demo application built in Angular 4. This project uses Angular Material UI elements ([https://material.angular.io](https://material.angular.io)) and a Firebase Cloud Firestore and Firebase Auth backend ([https://firebase.google.com](https://firebase.google.com)).

The purpose is to demonstrate a simple POS using modern frameworks. Users can perform transactions, add/modify products (with image upload), create new user accounts, and see a paginated transaction history. Adding/removing users and products is restriced to Admin users.

DEMO: [https://angularpos.samfinan.com](https://angularpos.samfinan.com)</comment>


Odor biomarker for Alzheimer's disease - <AUTHOR> http://medicalxpress.com/news/2016-01-odor-biomarker-alzheimer-disease.html <comment><USER2> Reminds me of this, regarding a woman who (allegedly) can smell Parkinson's:

[http://www.medicalnewstoday.com/articles/301485.php](http://www.medicalnewstoday.com/articles/301485.php)

While I know of no reason to dismiss these out of hand, I'd also be more comfortable seeing them discussed in more depth. Can anyone with actual medical knowledge speak up?

<comment><USER3> There's a slightly longer press release about the Alzheimers findings at [http://www.monell.org/news/news_releases/alzheimers_disease_...](http://www.monell.org/news/news_releases/alzheimers_disease_odor;) searching for the co-authors' names led to what appears to be the paper: [http://www.nature.com/articles/srep19495](http://www.nature.com/articles/srep19495)

"Volatile metabalome" sounds so much more scholarly than "pee smell"!

<comment><USER4> Fixed link: [http://www.monell.org/news/news_releases/alzheimers_disease_...](http://www.monell.org/news/news_releases/alzheimers_disease_odor)

</comment></comment></comment><comment><USER5> Another article where the editor is not up to date. Alzheimer is already known to be reversable (curable). Dr Dale Bredesen wrote an article about how he reversed Alzheimer in 9 out of 10 patients: [http://www.impactaging.com/papers/v6/n9/full/100690.html](http://www.impactaging.com/papers/v6/n9/full/100690.html)

<comment><USER6> Can you provide a secondary source with similar claims?

<comment><USER7> Yeah, bold claims.

<comment><USER8> That article smells fishy as hell. And if Alzheimer's were treatable, today, it would be a huge huge deal, not something being peddled around as a miracle cure on the basis of a 10-person "study".

They're making progress though. They've found at least one candidate drug that appears to clear up the Amyloid-beta plaques in mice.

[http://www.nature.com/ncomms/2015/151208/ncomms9997/full/nco...](http://www.nature.com/ncomms/2015/151208/ncomms9997/full/ncomms9997.html)

<comment><USER9> But are Amyloid-beta plaques a proven _cause_ of Alzheimer's? Or is it just correlation at this point?

<comment><USER8> If you inject amyloid-beta peptide extract from an AD-infected mouse into the brain of another, it then starts growing the usual plaques[1]. And A-beta plaque deposits are basically the distinguishing characteristic of Alzheimer's. So in my book that's very strong experimental evidence that A-beta is the causal mechanism of Alzheimer's and not merely a side effect.

It seems to be basically a misfolded protein, like CJD or mad-cow.

Usual caveats - nothing in science is ever proven to 100% certainty. Remove seal before use. Ask your doctor if Alzheimer's is right for you.

[1] [http://www.jneurosci.org/content/20/10/3606.full](http://www.jneurosci.org/content/20/10/3606.full)</comment></comment></comment></comment></comment></comment>


Japanese self-driving parcel delivery van to start real world testing - <AUTHOR> https://www.roboneko-yamato.com/ <comment><AUTHOR> The van has delivery lockers inside. You can call it to receive your parcel or send one yourself.</comment>


Startup Advice: Lead like a Dictator  - <AUTHOR> http://www.junloayza.com/startup-tips/startup-advice-lead-like-fidel-castro/

<comment><AUTHOR> I think a lot of the points are good, but the wording is dangerously wrong on some:

"Wrong: Find people to work for your for free and let them do as they please | Right: Selectively recruit people to work on your team for free and tell them exactly what they should be doing"

Yes, you have to find the right people. Even those working for free might be too expensive if they hurt your overall progress. And their interests have to be perfectly aligned with yours, so that even when left alone they produce good, useful results. But this comes off a bit as permission to micromanage, which would kill any normal hacker.

The emphasis on results is well placed though - in my experience, people crossing over into startup life don't always realize that "hours worked" doesn't equate to anything really useful. It all comes down to the progress made. Big companies can afford to estimate the average production per hour for a given employee and pay appropriately, and then take some time to see if it works out. Startups don't financially or strategically have that kind of leeway for key employees.</comment>


DDOS on Namecheap Free DNS and Default DNS V2 - <AUTHOR> http://status.namecheap.com/?p=14846 <comment><USER2> We are in the process of mitigating a large scale DDoS attack against our global DNS platform. We expect service to return to normal very shortly. Stay tuned and let me know if you have any questions. firstname.lastname@example.com

<comment><USER2> I'd also like to add that we have redunancy on our DNS V1. I advise switching over to this, in the meantime. Please find the tutorial here: [https://www.namecheap.com/support/knowledgebase/article.aspx...](https://www.namecheap.com/support/knowledgebase/article.aspx/923/10/what- is-the-difference-between-your-dns-system-v-1-and-v-2)

<comment><USER3> ETA how long it will take for the transfer to be completed? I know that editing host records usually is instantaneous (unlike other providers), but we're talking about changing the DNS servers here.

<comment><USER3> Looks to be up around five to ten minutes after executing the change. Not too terrible.

</comment></comment></comment></comment><comment><USER4> Weird, I haven't researched DNS as well as I should have. I always lived under the impression that there was this extensive DNS cache network where intermediaries responded to queries with cached results from root DNS servers.

Instead, the second that this DDos hits is the second we have websites stopping working.

How is it that in this day and age we can't have distributed caches of DNS entries at our providers of _full_ dns databases. I mean there can't be more than like a few billion dns entries in the world _total_ , which fits easily in a modern desktop computers RAM.

If that is an underestimate, I can't believe a single modern server wouldn't be able to mirror the world's DNS queries for at least a providers worth of users.

<comment><USER5> Depends on the TTL (time to live) settings for the DNS entries, doesn't it?

<comment><USER4> Yes, perhaps there lies our folly. It's the choice between being flexible in ability to move our servers really quick, or being tolerant of DNS servers going down.

I sort of hoped that a DNS client would just use an expired DNS result in case the servers would not respond, but perhaps that is naieve/dumb.

<comment><USER6> > I sort of hoped that a DNS client would just use an expired DNS result in > case the servers would not respond

This would break the whole concept of TTLs.

> but perhaps that is naieve/dumb.

Not at all. Hard problems are hard to solve.

</comment></comment></comment></comment><comment><USER7> How would one add (say) AWS Route53 as a secondary DNS?

I assume you'd make sure the DNS records are the same in both DNS portals; and then add Route53 as 3rd & 4th nameservers with the first and second still being Namecheap?

<comment> wes-exp It seems like secondary DNS is not supported, but you can change your primary DNS with the "Transfer DNS to Webhost" option.

</comment></comment><comment><USER8> If your site is down and you are on v2, Switch to v1. It only takes a minute and it works.

<comment><USER9> I switched and it's the same, still down.

<comment><USER8> At first I thought the same. I went in to edit records, and I hit save. I checked again and it was working. I assumed there was just a delay of a minute or so and that clicking save was a coincidence.

My domain is on v1 now and its still working.

</comment></comment></comment><comment><USER10> I recently switched most of my domains to DNSMadeEasy because they are constantly in the top for speed[1], provide a top tier anycast network and for what you get are a great value.

If you want speed and readability I suggest switching to a paid DNS provider.

1: [http://www.solvedns.com/dns- comparison/2014/01](http://www.solvedns.com/dns-comparison/2014/01)

BTW I'm not in any way affiliated, just like the service.

</comment><comment><USER11> Best of luck to their support team. Outages can make tech support's life miserable. If you call in, just remember the person on the other side of the phone has likely been yelled at all morning for something that wasn't their fault. Totally reasonable to be upset at the situation, just don't take it out on the tech you're talking to!

<comment><USER12> Job security ;).. j/k! I imagine it must not be fun

</comment></comment><comment><USER13> May this have been a problem lasting for a week?

I am monitoring a few servers with DNS records. And the last week I have found all the servers unresponsive (by DNS, not tried directly) from time to time. And after an extensive amount of troubleshooting I am unable to find a problem.

</comment><comment><AUTHOR> If you're affected, you can switch your domains to their DNSv1. Seems pretty quick for most people.

Via [https://news.ycombinator.com/user?id=edwhitesell](https://news.ycombinator.com/user?id=edwhitesell)

</comment><comment><USER12> I don't know how this website works, but I can't see the latest posts at the top of the page! I'm looking for the latest info on the issue. Are you up and running? Should I move back to v2? Thanks

</comment><comment><USER14> Is there any point in freaking out or do we just have to wait this one out?

<comment><USER4> If it's absolutely critical that your users get service right now, it might be a good idea to at least prepare a migration to other DNS servers, like perhaps those of Linode. If the situation doesn't improve within an hour or so, it might be that they don't have a good way to deal with it, and the outtage might take long, depending on the depth of the DDoSers pockets.

</comment></comment><comment><USER15> Any good suggestions for alternative DNS providers?

<comment><USER16> I moved most of my stuff to Route53 awhile back and for the most part I don't regret it.

<comment><USER5> Pricing doesn't seem too bad. $0.50 for a zone (domain) and $0.50 for a billion queries: [http://aws.amazon.com/route53/pricing/](http://aws.amazon.com/route53/pricing/)

<comment><USER17> Correction on the queries pricing:

$0.500 per million queries – first 1 Billion queries / month

$0.250 per million queries – over 1 Billion queries / month

</comment></comment></comment></comment><comment><USER18> This is so embarrassing for me. We just put out our school computer group's website up and boom - murphys law.

</comment><comment><USER19> That would explain why I'm getting a massive amount of tickets from my clients why their site is down.

</comment><comment><USER13> Down for me as well. Lost access to absolutely all of my company's services. TTL 60...

</comment><comment><USER20> yup, our app is down : (</comment>


No programmers for the future? - <AUTHOR> These days we're having so many programmers going for the sexy web and mobile platforms and actually very few people go for the low level or 'hardcore' semi-conductor stuff. I have only met 3 fellow x86 assembler programmers  and even when I go to stackoverflow.com to ask an intel x86 assembler language question, it may take 3 days for me to get a reply, while for a javascript or python question it takes just 2 minutes. If this is the case then who will create the next Linux? Android? Or what I'm I getting wrong? <comment><USER2> My feeling is that most such systems programming specialists are too busy working for their employers in the hardware, OS and embedded industries, to blog or participate actively in discussion forums. They are members of the "dark matter developers" group [1].

That said, a github search for assembly language repos and assembly language code phrases throws up some 270 repos and upwards of 100,000 code files. So I don't think asm is doing too badly. Your experience is probably only anecdotal.

May I suggest that you contribute your bit to popularising asm by putting up some of your projects here on Show HN. There must be other people like me who have been intimately familiar with asm in the past and felt the thrill of coding in it, but have lost touch with it and now feel intimidated by its verbosity.

Some interesting projects may rekindle that interest. For example, recently there was a "Show HN" of a bare bones assembly language game written by students for the raspberry pi, and that made me start learning ARM assembly. Put up something like that, or even something a lot simpler (personally, I'd be interested in a beginner's tutorial on coding and building a simple console program for Windows and Linux platforms, using modern x86_64 assembler and modern tools).

[1] [http://www.hanselman.com/blog/DarkMatterDevelopersTheUnseen9...](http://www.hanselman.com/blog/DarkMatterDevelopersTheUnseen99.aspx)

</comment><comment><USER3> I'm placing my bet that there will always be people who are interested in systems programming. They're the Night Watch ([http://research.microsoft.com/en- us/people/mickens/thenightw...](http://research.microsoft.com/en- us/people/mickens/thenightwatch.pdf))

There will always be people who after years of doing high level stuff, get curious about the low level implementations, start asking questions about how data is represented in the machines, and then get sucked in and they stay there.

I'm personally not too worried about the fact that there are fewer systems programmers, because those who do it in the future, are those who are interested in it. That will ensure higher quality software in general.

<comment><AUTHOR> True. So according to your point, today we may have quite a number of Mark Zuckerbergs but few of Bill Gates or Linus Tovarlds. Or I got it wrong?

<comment><USER3> I wouldn't put it as such. They're all one-offs.

But consider how fast gcc started supporting x86_64. I am not worried about the supply of people who do systems programming

</comment></comment></comment><comment><USER4> There will always be more "tool users" than "tool builders". I think what you're really lamenting is that the "tool users" are claiming the same title and status (aka "programmer"). Perhaps the "tool builders" need a new brand to set themselves apart. How about _electron whisperer_?

<comment><AUTHOR> Your point is valid Joe. The tool users dare not claim the same status. A googler can never claim he's Larry or Sergey

</comment></comment><comment><USER5> Maybe the systems programmers are on mailing lists instead of web forums?

</comment><comment><USER6> You are looking in the wrong places. Try places like edaboard. Just the microcontroller subforum has over 200,000 posts.</comment>