Unicorn: lightweight, multi-platform, multi-architecture CPU emulator framework - <AUTHOR> https://www.unicorn-engine.org/ <comment><USER2> So many projects use the name "unicorn", that I think we should declare a moratorium on its usage. There are plenty of mythological creatures to go around.[0] If you feel the need for your project to be 'corny' may I suggest naming it after the bicorn[1], which has double the horns and is therefore twice as interesting.

[0]: [https://en.wikipedia.org/wiki/List_of_legendary_creatures_by...](https://en.wikipedia.org/wiki/List_of_legendary_creatures_by_type)

[1]: [https://en.wikipedia.org/wiki/Bicorn_and_Chichevache](https://en.wikipedia.org/wiki/Bicorn_and_Chichevache)

<comment><USER3> Why didn't they name it Multicorn?

<comment><USER4> That name is also taken:

[https://multicorn.org/](https://multicorn.org/)

<comment><USER5> Disappointing that their logo is just a unicorn. :/

</comment></comment></comment></comment><comment><USER6> It's the core of qemu, refactored out to something that's usable by other clients.

For emulators it's great for getttig started and prototyping, but if you care about perf you end up migrating to a more integrated solution. Sort of like how V8 was originally based on llvm, but wrote their own backend.

<comment><USER7> V8 wasn't originally based on llvm. If anything, it was based on Strongtalk. [https://github.com/v8/v8/commit/43d26ecc3563a46f62a022403066...](https://github.com/v8/v8/commit/43d26ecc3563a46f62a0224030667c8f8f3f6ceb)

<comment><USER6> Oh, my bad, misremembered.

<comment><USER8> You may be thinking of Rubinius?

<comment><USER6> Nah, I was thinking of JavaScriptCore. They replaced their last tier JIT a few years back; it used to be LLVM, but now it's a custom backend "B3".

</comment></comment></comment></comment></comment><comment><USER9> The Nintendo Switch emulator `yuzu` started out using this, but has been gradually moving to [https://github.com/MerryMage/dynarmic](https://github.com/MerryMage/dynarmic) instead.

<comment><USER10> Is there more context on why they're switching / how they gradually move over? I'm very interested.

<comment><USER11> Hey, author of dynarmic here.

> more context on why they're switching

I started working on an AArch64 (ARMv8) frontend for dynarmic upon request from yuzu's developers. At the time, they decided to switch over because dynarmic has better performance compared to unicorn.

To be honest, I feel like unicorn has instrumentation as a primary goal. Dynarmic has different goals: (a) performance and (b) ease of integration into pre-existing/custom emulated memory systems.

When I last looked at unicorn it didn't quite have a full ARMv8 implementation; yuzu maintains a fork of unicorn that follows upstream qemu more closely at [https://github.com/yuzu-emu/unicorn](https://github.com/yuzu- emu/unicorn). We use this version of unicorn to test dynarmic by fuzzing the emulators against each other to ensure accuracy of emulation.

> how they gradually move over

Dynarmic has "fallback" capability -- if an instruction isn't implemented, a user-provided callback is called so the library user can provide an implementation of the unimplemented instruction. yuzu uses unicorn as the fallback implementation. This was helpful for getting the system up and running in the early days.

We're not quite at full ARMv8 support yet (we're at about 70% --- half- precision floating point support and ARM pointer authentication are the biggest unimplemented features), but the vast majority of guest applications in yuzu do not currently fallback to unicorn.

<comment><USER12> QEMU hasn't got round to pointer-authentication yet either, so that's pretty good going.

I like the "fuzz-test one implementation against another" approach. That's quite similar to how we test QEMU against real hardware (at least for straightforward userspace insns): [https://git.linaro.org/people/peter.maydell/risu.git/tree/RE...](https://git.linaro.org/people/peter.maydell/risu.git/tree/README)

(Upstream in QEMU we're talking/working on trying to improve our support for instrumentation. But definitely today we don't do anything much in that area.)

<comment><USER11> > QEMU hasn't got round to pointer-authentication yet either, so that's pretty > good going.

Thanks very much! I do however note we're not trying for full system emulation for v8; we're primarily interested in userspace emulation since that's our primary usecase, so system instructions aren't necessary for us, which does reduce our workload!

While we're on that topic, we make a few simplifying assumptions for performance reasons (e.g. no self-modifying code). Thinking about it, I feel like I should document these assumptions somewhere; I'll do that when I can.

> That's quite similar to how we test QEMU against real hardware

That's great! I love semi-automated testing.

An emulator vs emulator fuzz test has some advantages: You can test more instructions than you are able to on hardware. For example, you can test arbitrary jump instructions and memory instructions (assuming the emulations have sufficient instrumentation to catch arbitrary memory reads/writes and jumps off into the ether).

We fuzz against unicorn here: [https://github.com/MerryMage/dynarmic/blob/master/tests/A64/...](https://github.com/MerryMage/dynarmic/blob/master/tests/A64/fuzz_with_unicorn.cpp). This uses our instruction table ([https://github.com/MerryMage/dynarmic/blob/master/src/fronte...](https://github.com/MerryMage/dynarmic/blob/master/src/frontend/A64/decoder/a64.inc)) to generate instructions.

</comment></comment></comment></comment></comment><comment><USER13> This is so cool! Especially for us university students who are taught MIPS in our compilers course, it will be cool to use this to re-create the emulator our University uses to run our MIPS ASM code.

<comment><USER14> I remember we did SPARC assembly in college and the only way to test your program was to ssh into a single ancient SPARC server.

I actually started building an emulator because I thought it might be easier than dealing with that workflow. One sleepless weekend later it turned out I was very wrong.

</comment></comment><comment><USER15> QEMU supports PowerPC, but this appears not to.

<comment><USER16> It seems from the changelog that it compiles and runs on PowerPC but that it won't emulate PowerPC. That seems a bit odd to me in itself. It's extra odd that they aren't supporting something the trunk project does which is still fairly widely used.

<comment><USER17> I was wondering about that since safety-critical still uses lots of PPC products like Freescale's. Industry folks probably have boards to work with. Hobbyists or small businesses trying to get in the game might need Qemu or something to experiment on good, x86 boxes. I kept a Mac PPC for it, too, but they'll diverge due to age.

So, PPC support was one one of first considerations looking at Unicorn. Thanks for posting that it's partly there.

</comment></comment></comment><comment><USER18> Github link was kinda hard to find: [https://github.com/unicorn- engine/unicorn](https://github.com/unicorn-engine/unicorn)

<comment><USER19> Download->git repository (from the link posted here..) wasn't _that_ hard to find.

<comment><USER18> Oh I just assumed Download linked straight to a zip file or something so I instinctively skipped over it.

</comment></comment></comment><comment><USER20> If my understanding is correct, this would be great for people who are stuck in non-root situations and need to run something (very prevalent in DoD and enterprise / large school situations). Hopefully they package it in a way that can run without root, as that was always my main application for QEMU.

</comment><comment><USER21> Thought this was related to the unicorn app server.

[https://en.wikipedia.org/wiki/Unicorn_(web_server)](https://en.wikipedia.org/wiki/Unicorn_\(web_server\))

Change the name my dude

</comment><comment><USER22> It's cool that they support SPARC and a wide variety of other architectures.

Edit: Looks like they are based on QEMU.

</comment><comment><USER23> I used this. It's really rough around the edges but if you use it correctly it works brilliantly.

</comment><comment><USER24> Is this able to run on webasm?</comment>


Benz remotely controlled vehicle stuck in cruise control mode for 1h at 120km/h - <AUTHOR> https://www.facebook.com/PeoplesDaily/videos/1864757720242703/ <comment><USER2> Nothing about this story makes sense, and it's so sketchily sourced I'm surprised to see it here on HN.

For starters if the problem was with cruise control, how would opening the drivers side door 'slightly' slow the car to half it's speed? Setting aside the physics here, cruise control would simply increase the throttle until it got back to it's set speed.

Also questionable is the idea that MB would be able to remotely control the vehicle when _every system_ other than the throttle had failed. Brakes failed, ignition failed, transmission failed, but the throttle and cruise control were still hunky-dory? That sounds a lot more like either a complete fabrication or someone who screwed up while trying to hack their car's CAN-BUS...

<comment><USER3> Cruise control on both of my cars is closer to "set throttle" than "set speed". Neither will increase throttle to keep speed when going up a hill for example.

<comment><USER4> That's not typical for cruise control; even cars in the 80s with cruise control would increase throttle uphills.

<comment><USER5> Which is and always has been a downright awful and dangerous feature. Going up a steep hill? Put the pedal to the metal so we can fly past other cars at 65 MPH.

<comment><USER6> Or would be a lot safer and more efficient if everyone just went a constant speed on the freeways. My cruise control also operates he brakes so my set speed is held going up and down hills.

</comment></comment></comment></comment></comment><comment><USER7> So I'd be really interested in knowing how a failure like this happens in a human-safety-critical application.

I assume every software engineer under the age of ~50 would have learned about events like the Therac-25 incidents during their education. Is there genuinely no robust software quality regime in place for critical systems like this in vehicles?

There are so many worrying things here: such a bad failure occurring in the first place; the lack of any physical fallback or failsafe; the _ability of the dealer to remotely control the car 's operation_ (!!) – any of these by themselves fills me with dread.

<comment><USER8> Or the owner attempted to flash his own ECU and messed it up. Granted, this is more common in the rice-burning crowd than the Benz driving crowd, but there is still some overlap.

Edit: Just saw that the driver was an "amateur car racer", which exponentially increases the chances that he re-flashed his ECU.

<comment><USER7> That's interesting, in the sense that it might explain a software failure, but it doesn't really explain why this wasn't failsafe anyway (given the possibility of a non-flashed ECU failing) nor why remote access was possible. I guess something doesn't add up here.

<comment><USER8> It's possibly Benz went to the trouble of doing a rigorous analysis of their ECU to verify that there were no faulting conditions that would impact safety and thus decided to use it as the backstop. The safety guarantee from the software could be compromised by an unauthorized modification.

Personally I don't like trusting safety systems entirely to software, but I could see it being a decision a big corporation makes to simplify manufacturing (cut costs).

</comment></comment></comment></comment><comment><USER9> Feels difficult to believe. He reduced speed by 60kmh by opening a door "slightly"? Why did the cruise control not compensate for it? Both brake systems failed at the same time? In addition, the automatic gearbox was somehow stuck in D? Sorry, but I'm sure it's either human error or a publicity stunt

Edit: I didn't know the C class has any remote control capabilities. Does anyone know more?

</comment><comment><USER10> This is a somewhat misleading title. The car was intentionally set to cruise control by the owner, but the cruise control could not be turned off until Mercedes remotely found a way to disable it about 100km later.

<comment><USER11> Personally that's exactly what I got from the title; it says it was stuck in cruise control. To me that indicates cruise control had been enabled, and then became stuck on.

<comment><USER10> I believe I was misled by "remotely controlled vehicle stuck in cruise control," which (to me) implies that the remote control feature was somehow relevant to not being able to disable the cruise control. The article did not talk about remote control until it mentioned using it to disable the cruise control.

</comment></comment></comment><comment><USER12> That headline is misleading. I read it as them controlling it for 1 hour which wasn't the case.

I am a little surprised that the brakes didn't work. Are brakes "fly-by-wire" now? Otherwise you should be able to slam the brakes even if the car is full throttle. I have tried this with several cars and the brakes we always stronger than the engine.

<comment><USER13> Brakes are fly-by-wire on new cars because slamming the brake is not the most optimal strategy for stopping the car as fast as you can. And it can also damage the car.

<comment><USER14> I'd choose damaging the car over this scenario any day.

<comment><USER12> I also don't know how braking hard would damage the car.

</comment></comment></comment></comment><comment><USER15> I'm not sure how much i believe a post from facebook from "People's Daily, China". The video can for sure be named: "Police high speed chase through toll booth"

<comment><USER16> Lots of stuff is completely off with this. If you're stuck in cruise control at 120km/h for an hour you will drive 120km, not 100km.

Also, what about just turning the engine off? Or... break.

<comment><USER17> > Also, what about just turning the engine off? Or... break.

It says the brakes didn't work, and push-button start cars don't have an easy way to "just turn the engine off".

<comment><USER18> Mine has a "hold button for 5 seconds" type override - don't know if that's universal though.

<comment><USER19> Don't tell me it's the ACPI hard shutdown signal, that would be scary.

</comment></comment></comment></comment></comment><comment><USER20> I'm skeptical:

 _During a tense time of waiting and praying, Xue, an amateur car racer himself, tried opening the car door slightly to help slow the car down, which slowed to 60km /h, but nothing else could be done_

If the car was trying to maintain 120kph, I'm skeptical that opening a door partially (or even all the way) slowed it to 60kph.

</comment><comment><USER21> While this newish whiz-bang Mercedes Benz might be too modern to have a physical ignition lock these stories always make me wonder: why do all these people who are confronted with runaway vehicles forget the simple solution of switching off the engine? Just turn the key in the lock to the 'off' position but don't remove it, the engine will switch off and the car or motorbike will come to a halt. I've done this several times with my motorbike when one of the Bowden cables between the throttle grip and a carburetor froze during travel (as in 'water in cable freezes to ice', I ride the thing in wintertime here in Sweden). By switching the lock between 'on' and 'off' I've used it in a similar way as the 'blip switch' in early airplanes with rotary engines which lacked an adjustable throttle, they were either 'on' or 'off' and could be pulsed on landing by using the 'blip switch'.

When I mention this people often start about losing power steering but that is of no concern, power steering is only effective at lower speeds anyway. Servo brakes are powered by the intake vacuum so that won't be an issue either, even it the vacuum fails or the power comes from another source (e.g. an electric or engine-driven pump) there is generally a pressure reservoir which holds enough pressure for several brake actions. And even in case the servo totally fails the brakes still work, as does the parking brake.

To conclude, as long as you're in a vehicle with a physical ignition lock the first thing to try is just to switch off the engine. As long as you keep the key in the lock the steering lock should not engage (something to test next time you turn off the engine).

</comment><comment><AUTHOR> Sorry for the misleading title. I tried my best to contain the title short enough to submit. Please change the title for a better one. Or suggest a better one, I will change it ASAP. Thanks.

</comment><comment><USER22> In the "good" old days there were several things you could do:

\- turn off the ignition (now purely software-controlled in keyless systems)

\- put transmission to neutral (a physical link doesn't necessarily exist anymore in automatic transmissions, still possible in manuals)

\- jump on the brake pedal as hard as you can (I suspect that a hydraulic link to brakes must still exist, possibly by law, but there are ABS and stability control units in between that can add to or remove from the brake pressure so it's not entirely driver controlled anymore, could lead to a failure path)

\- use parking brake to assist in braking (now often controlled by an electric motor automatically, doesn't engage while driving)

There were occasional similar failures like the accelerator pedal getting stuck under the floor mat or throttle cable getting stuck but you could do a number of things listed above. Cruise controls systems were heavily designed to disengage at the slightest disturbance because they were separate control modules: early vacuum-operated designs could—plausibly, I don't have first hand knowledge—have a microswitch in the brake pedal that would just pull a relay to shut off current from the control module, restoring normal accelerator operation. Pretty much bullet proof.

Software is indeed capable of creating failure modes that were pretty much unimaginable previously.

<comment><USER23> I'd start pulling fuses, Die Hard style.

</comment></comment><comment><USER24> I'm not sure what is more disturbing here, the fact that the car had such a dangerous malfunction in the first place, the fact that there was no reliable hardware-based mechanism to bring it safely to a halt when the software failed catastrophically, or the fact that the service team could remote in and take control of the vehicle. Everything about this is not just bad in itself but betrays a more fundamental lack of safe and secure design.

<comment><USER25> Totally agreed. Why can't he just slam the brakes? I thought they are supposed to be stronger than the engine?!

<comment><USER26> Electronic control - it's not a direct physical connection anymore.

Follow on for mechanics/mechanical engineers: if the accelerator is down and you're already moving, can the brakes stop a car? It seems like you'd either not stop or "break" abs and force the wheels to lock which is also bad at speed...

<comment><USER16> This is complete nonsense, go into any car without starting it and pump the breaks.

<comment><USER27> Its not. [https://en.wikipedia.org/wiki/Drive_by_wire](https://en.wikipedia.org/wiki/Drive_by_wire)

</comment></comment></comment></comment></comment><comment><USER28> Why couldn't you just hit the ignition to turn the engine off?

<comment><USER29> New cars these days don't all have this option: electronic starters have keyless ignition, activated when the key is nearby.

[http://www.worldwidemotors.com/blog/how-to-use-push- button-s...](http://www.worldwidemotors.com/blog/how-to-use-push-button-start- in-your-mercedes-benz/)

Personally, I'm concerned there is no manual brake override.

If I drove a Mercedes I'd test using manual ignition, maybe pulling the key out would stop the car.

<comment><USER30> >activated when the key is nearby.

throw the key out the window?

<comment><USER17> I tested this when my dad got one of the push-button start cars. Doesn't work, at least not in his Acura.

<comment><USER16> Give it a few minutes and it will start to complain, and then you will lose engine, but not electrical power.

</comment></comment></comment></comment></comment><comment><USER31> Interestingly this has nothing to do with self driving. Though, if the dealer could control is remotely why did it take an hour to do so?

<comment><USER32> May be the (designed) logic flaw. My guess is on a safety override that painted itself into a corner. For example, no remote override of a cruise control while moving.

</comment></comment><comment><USER33> What I mostly took away from this is that automakers can remotely force stop your vehicle if they so desire. Kind of creepy.

<comment><USER34> I don't find it more or less creepy than what we discover companies doing under the hood on our smartphone apps, computers, sharing personal info, etc.

</comment></comment><comment><USER35> Reminds me of reading the Fortean times when I was younger. Sounds like a made up or exaggerated story.

Telltale statement > "According to a local media report". So this is a report of a report. Hmmmm.

</comment><comment><USER36> FWIW, this happened to a friend's Ford explorer with faulty electronics, self driving cars don't have a monopoly on automobile malfunctions

</comment><comment><USER37> The fact that it was able to be remotely controlled is exposing it to a whole world of bugs and hacks

</comment><comment><USER38> Covert intelligence operation (hit-job) gone awry? Maybe the driver was a target of the CIA ..

</comment><comment><USER39> This makes me want _less_ software control in my vehicle. Ideally none.

<comment><USER6> So carburetors and no abs or traction control?

<comment><USER27> Im not saying I agree with OP, but you picked three things that existed in cars before computers.

<comment><USER6> ABS uses software, I'm not aware of a mechanical ABS.

Limited slip differentials in all their varieties still don't do what stability control and traction control do. You need software for the systems to perform in a way we have come to expect.

A car without any software at all would be carbureted and have no ABS or traction/stability control.

<comment><USER27> [https://en.wikipedia.org/wiki/Anti- lock_braking_system#Early...](https://en.wikipedia.org/wiki/Anti- lock_braking_system#Early_systems)

[https://en.wikipedia.org/wiki/Fuel_injection#Mechanical_inje...](https://en.wikipedia.org/wiki/Fuel_injection#Mechanical_injection)

I'm not saying computers don't do these things better.

<comment><USER6> From your link:

> A fully mechanical system saw limited automobile use in the 1960s in the > Ferguson P99 racing car, the Jensen FF, and the experimental all wheel drive > Ford Zodiac, but saw no further use; the system proved expensive and > unreliable.

Those systems were used in aircraft, not cars. The operation was significantly different as well.

Anyone who owns a car with mechanical fuel injection will tell you how much more reliable carburetors are.

My point is simple: we have used software in automotive systems for decades and those systems have proven to be reliable. Removing _all_ software from a car will not make it safer just because new automation systems are poorly built.</comment></comment></comment></comment></comment></comment>


Yahoo Voices Hacked, Usernames and Passwords Posted Online. - <AUTHOR> http://news.yahoo.com/yahoo-voice-hacked-usernames-passwords-posted-online-013617215.html

<comment><USER2> At the risk of essentially slashdotting myself or making my web host very angry at me, I have stripped out the passwords so that the only component remaining is the email addresses, in case you want to check whether you were part of the breach. (I was not! hooray!)

I am hosting this at: <http://drostie.org/yahoo_leak.txt> . If I receive too much traffic I may simply pastebin it.

<comment><USER3> Thank you. One of my email addresses is there. Thankfully it's just an account I use for fantasy baseball. Super obnoxious, though.

</comment></comment><comment><USER4> I love how this is a story about Yahoo, reported on Mashable, then cross- posted to Yahoo News.

<comment><USER5> [http://cheezburger.com/6419346176?utm_source=trans&utm_m...](http://cheezburger.com/6419346176?utm_source=trans&utm_medium=email&utm_campaign=transglobal)

I made this for that very reason.

</comment></comment><comment><USER6> I think these accounts were prior to Yahoo! Acquisition of associatedcontent. There is NO WAY for a "native" yahoo property to store plain text passwords. Of course this is a yahoo fault to buy a company with such a weak security...

If this was a leak in yahoo, the number of users with a yahoo e-mail would be much, much higher.

<comment><USER7> I presume that means also that the passwords could be different from the actual yahoo account passwords? Of course people might have kept them the same...

</comment></comment><comment><USER8> This story is incorrect to boot. It was Yahoo! VOICES with an (S) not Yahoo Voice.

<comment><USER9> Well, I find it pretty ridiculous that Yahoo has so many products that Voice and Voices are different products.

<comment><USER10> I've never heard of either...either.

</comment></comment></comment><comment><USER11> I can understand the joy feeling for someone to hack something, but what's the point of posting people's passwords online?

<comment><USER12> Could be blackmail gone unanswered (e.g pay us or we publish), could be hatred of Yahoo (either a competitioner, an employee, or just someone who feels wronged).

Or it could be a need to prove onself -- see what I can do, now fear my wrath.

Or it could simply be hatred of humanity, you embarrass people enough and they may lass out on you -- in this case by putting your password online, in other cases by bringing a gun to school.

Summing up, it strongly depends on who did it.

</comment></comment><comment><USER13> We did an analysis of the dump:

[http://blog.sucuri.net/2012/07/analysis-of-yahoo-voice- passw...](http://blog.sucuri.net/2012/07/analysis-of-yahoo-voice-password- leak-453441-passwords-exposed.html)

Interesting is the lack of "yahoo" as part of the passwords... I would expect a much higher % from a yahoo leak.

<comment><USER14> +1 for ninja being 4th most used password

</comment></comment><comment><USER15> A co-worker's Yahoo account started IM'ing spam links to everybody in his friend list yesterday. This might be why.

</comment><comment><USER16> It's a bit sad that the first bit of correspondence from Yahoo was actually just a syndicated news article from another source.

It makes you stop and think about whether they take security and their customers seriously.

</comment><comment><USER17> Anyone know exactly what it means to be a yahoo voice user? I use yahoo chat, and I think I've used voice chat in the past, but I don't see my username in the dump drostie posted.

</comment><comment><USER18> Is there a simple and free service that sends me an email once my address shows up in one of the various dumps that leak to the net these days?

</comment><comment><USER13> A quick tool for end users to check if their emails were compromised:

<http://labs.sucuri.net/?yahooleak>

</comment><comment><USER19> Something something nail in the coffin.

</comment><comment><USER20> WTF - Yahoo news posting about Yahoo's username password hacked...this is seriously ridiculous.

<comment><USER21> No, ridiculous would be them trying to cover it up.

This is perfectly normal.

<comment><USER22> I guess its surprising that it does not cite a official press release from the company, (which is what you would normally expect), but to another news site. Also if one of your products faces such a crisis situation, would you want your users to read the company's reaction in such dispassionate, unapologetic language?</comment></comment></comment>


Choo: A New, Functional Front End App Framework in 7KB - <AUTHOR> https://github.com/yoshuawuyts/choo?hn <comment><USER2> Pretty nifty... I like the view engine, and that it uses string templates, which makes sense for a lighter templating system. Overall nifty. I also appreciate that there's comparisons to some other alternatives, while not really bashing anything.

Personally, I've been pretty happy with preact for a few small things with redux. Though it's a bit larger, react does have a _lot_ of safety net features, and _very_ clear error messages when things aren't right, far more so than I saw with ng2.

In general, I'm really liking this movement towards micro-ui frameworks and though I would just assume stick to react+redux patterns, seeing things like this make me smile, as I'd rather move in this direction than the banana+gorilla+jungle that is angular (though the work towards getting tree shaking functional is interesting, I'm not a fan of the abstractions)</comment>


Facebook has cut off Prisma's Live Video access - <AUTHOR> https://techcrunch.com/2016/11/30/facebook-has-cut-off-prismas-live-video-access/ <comment><USER2> > Of course it's Facebook's API and they can do what they like about who can > access it

I'm a bit annoyed by this reaction... Basically the likes of Google and Facebook have been abusing it to translate their monopoly in mature markets into competitive advantage in emerging markets.

Maybe it's time that, just like FB and Google are campaigning for the comoditization of broadband, we campaign for the classification of parts of their platforms/APIs as public utility.

<comment><USER3> At which point, unless you are unsarcastically calling for the nationalization of Facebook, they simply turn the features off.

<comment><USER4> I hate walled gardens and I'm all for trying to move you and, at least tech friends, to platforms people control.

But the trouble is Facebook, Amazon, Google .. these companies are not only huge, they control distribution networks. Let's look at when Amazon removes a book from their store. Sure any retailer can choose not to supply a book, but when Amazon does it, their distribution network as become so large and central for most people that it does effectively censor the book. There are millions of people who only buy books through their service.

I'm not saying they should be public entities, but you need to be aware of the fact that they do effectively control the flow of information just due to their sheer market share.

<comment><USER5> "these companies are not only huge, they control distribution networks"

They're huge precisely because they control distribution networks.

</comment></comment></comment></comment><comment><USER6> Given the popularity of various photo/video manipulation applications on mobile, I'm surprised by Facebook's decision here. If Prisma had gotten a bump in traction with this, every other video/photo app would be immediately clamoring to add FB Live Streaming to their product. In a year, sending live video to FB would be as common a feature as sending photos to Instagram.

Who gives a shit about cannibalizing live video filters, a feature that had no need for existing other than to create parity with Snapchat's filters, when you could give your pet platform, live video which drives massive ad-revenue, the appearance of ubiquity?

<comment><USER7> This is a very good point, and shows some small thinking on facebook's part. Let's also not forget that regularly, when Facebook/Google/etc launch a feature which is competing with an existing start-up, the start-up often wins (somebody please give me examples here, I'm struggling to come up with any, but I'm quite sure they exist).

Should facebook care if a 3rd party is implementing a feature on their platform vs them supplying it themselves? Facebook's business model is to get data and sell ads. I don't see how this Prisma's live video would affect either of those things negatively.

<comment><USER8> Snapchat. Facebook launched a number of equivalent features. None of them got traction.

</comment></comment></comment><comment><USER9> In other words, FB probably has something similar in the pipeline and the people who wrote the ToS weren't aware of it.

<comment><USER10> Yep, this is mentioned in the article:

[https://techcrunch.com/2016/10/25/facebook-video- filters/](https://techcrunch.com/2016/10/25/facebook-video-filters/)

</comment></comment><comment><USER11> I'm having a hard time understanding why you'd build up a product as a add-on to or heavily reliant on a closed(ish) platform. You're putting yourself at the mercy of a large corporation, that usually doesn't end well.

<comment><USER6> I agree completely but that's not what happened in this case. Sending live video to Facebook is just one feature that was recently added to the already popular photo manipulation app, Prisma[1].

1\. [http://prisma-ai.com/](http://prisma-ai.com/)

</comment></comment><comment><USER12> I was working on a live streaming app and considered using FB but their API docs weren't accurate and when I did manage to get in touch with support their reaction was kind of "oh well." At that point I realized it would be a bad idea to put so much effort into something that could be shuttered by a 3rd party.

For the record, FB live docs are pretty clear about not allowing streaming from mobile devices.

</comment><comment><USER13> Re-stating the facts of the case for the comments:

\- This is a post-processing app. If you're familiar with Instagram, the mechanics are the same: you either use the basic built-in camera, or select an existing photo. Then, you choose a filter, tune the filter, and after some processing, your result is ready.

\- The finished image can be saved on the device, or exported directly to Instagram or Facebook.

\- Recently, their camera gained a new button, to livestream to Facebook instead. The filters can be changed at any time during the broadcast.

\- Facebook has revoked their API access to this livestream feature.

\- Facebook is indeed working on style transfer for live video [1].

So this wasn't the case of a third-party app _depending_ on a big platform's APIs and playing within their own walled garden. Rather, it's a related, but different case of betting on the tech instead of the community [2], effectively being a free tech demo and hoping to attract investor interest.

While this may still work, the concept was quickly copied, -- in some cases, deliberately, like in the case of VK's Vinci [3]. In addition, the Prisma founder's previous employer, Mail.ru, released the similar app Artisto soon after, which worked on videos before Prisma did.

[1] [https://code.facebook.com/posts/196146247499076](https://code.facebook.com/posts/196146247499076) [2] [http://www.businessinsider.com/prisma-labs-app-profile- inter...](http://www.businessinsider.com/prisma-labs-app-profile-interview- with-ceo-alexey-moiseenkov-2016-8) [3] [https://www.technohacker.com/vkontakte-launched-its- prisma-c...](https://www.technohacker.com/vkontakte-launched-its-prisma-clone- vinci/)

</comment><comment><USER14> This is why, if you do something like this, do it multi-platform. Offer it on Facebook, via your own site, and maybe on some phone platform. That way, you can't be shut down by one vendor, and a vendor may think twice about shutting you down and losing your customers to another platform.

</comment><comment><USER15> Once again, building on FB api == bad idea.

Sadly, FB has eaten so much of the world - there may not be much of an alternative.

</comment><comment><USER16> Are people serious about style transferring while live-streaming? I mean it is cool and fun, but isn't it also a distraction once people get used to it?

<comment><USER17> It's a gimmick that is currently hot, increases usage of the platform, and with most creative platforms could yield a video going viral.

The same argument could be made with photo filters (e.g. Apple building them directly into iOS) but extended to live streaming video.

</comment></comment><comment><USER18> I didn't even know about "style transfer", is this a big thing in other coountries (as Prisma seems to be Russian)?

<comment><AUTHOR> Yeah it is. It was a Top 10 app in 77 countries on the App store around its release.

[https://www.bloomberg.com/news/articles/2016-07-27/eastern-e...](https://www.bloomberg.com/news/articles/2016-07-27/eastern- europe-spawns-another-viral-hit-with-prisma-photo-app)

<comment><USER18> Interesting, thanks for the link!

</comment></comment></comment><comment><USER19> i'm doing my masters in computer vision and augmented reality and am really surprised how these apps keep getting really big which are essentially just implementations of research papers that are out there and public. In a way it makes me feel good because i know "i could do that". But obviously the hardest part is having the idea in the first place.</comment>


Brain Cells Observed Summoning a Memory - <AUTHOR> http://www.nytimes.com/2008/09/05/science/05brain.html

<comment><USER2> aargh.

i don't know if there's already an informal policy about this. i'm new here. but if there isn't one, i'd suggest that if you post an nytimes link, at least post a username/password from bugmenot in the comments. best would be to post the google-affiliate version of the url that lets you not have to login. (i don't remember how to do that.)

<comment><USER3> Let me summarize [every neuroscience article ever]:

\- the brain is very complicated

\- the feeling of control over one's thoughts is largely an illusion

\- through clever experiments we can make small steps in understanding</comment></comment>


Facebook blocks links to Turkish protest organizing tool - <AUTHOR>

This mapping / SMS reporting tool is being used by protesters in Istanbul, Izmir, and Ankara for a variety of needs:
http://tidepools.co/gezi
Facebook, which was the main channel to share this tool in Turkey, has now blocked the URL from posts and messages.
Try posting or messaging with that link embedded and you will be prohibited. Here's a screenshot:
http://imgur.com/1IIFlZi <comment><USER2> If you get stuck, try this: <http://tidepools.dreamcats.org/>

You can take the html and put that up anywhere you have a domain and it should set up a redirect.

</comment><comment><USER3> ... which suggests to me that facebook's sustained block of the legitimate news source westpapuamedia.info \- despite ongoing attempts by the publishers and their readers to have it reviewed - is precisely what supporters of the site claim it to be: active submission to pressure from the murderous TNI

</comment><comment><USER4> I got the same message today on something unrelated, it's not anything sinister. It's just facebook's worm control type thing and is only because the link has been posted a lot recently.

</comment><comment><USER5> It is automatic spam filter, not intentional. The filter is removed after contacting with Facebook thanks to this post.

</comment><comment><USER6> It's letting me post the link from USA.

<comment><USER7> I'm able to post the link from Turkey too.

<comment><USER6> That's good to hear! Once this got publicity, I'm sure Facebook expedited the removal of the block. Whether the block was intentional or not.

</comment></comment></comment><comment> cm-t Hi,

Nice Streisand effect from /r/technology

</comment><comment><USER8> Automatic spam control</comment>


The ugliest C feature: <tgmath.h> - <AUTHOR> http://carolina.mff.cuni.cz/~trmac/blog/2005/the-ugliest-c-feature-tgmathh/ <comment><USER2> _0, 0L, 1 - 1, (((1 - 1))), (void_ )0 and (void _)(1 - 1) are null pointer constants_

...

 _if one operand is a null pointer constant, the result has the type of the other operand;_

This is quite possibly one of the most idiotic semantics I've ever seen specified for a language. Why does the _type_ of an expression depend on the _partially evaluated_ result of one of its subexpressions? This by itself is enough to throw out the window any sane reduction semantics (an important mechanism in language design whereby semantics are defined by specifying how to transform any program into an equivalent but strictly smaller program), though I'm sure there are plenty more such constructs in C.

Ridiculous semantics like this are not only the definition of C99; they're the definition of _designed by committee_.

<comment><USER3> Generally the committees that design these kinds of things are knowledgeable and careful, so think carefully before accusing them.

In the above case, I wonder if it's related to

        #define NULL ...something that is a null pointer constant...

and then wanting expressions like

        test ? some_double_pointer : NULL
        test ? NULL : some_int_pointer

to have the type one would "expect" rather than whatever type NULL has in isolation.

<comment><USER4> It's even simpler. A lot of legacy code out there uses "0" (not NULL or even (void ∗)0, just 0) in place of NULL. So it's very important for backwards compatibility that "test ? (double ∗)x : 0" or "test ? 0 : (int ∗)x" return double ∗ or int ∗, respectively.

I'm not sure why the definition of a null pointer has to be so liberal, but I suspect there's a backwards compatibility constraint in there.

<comment><USER5> I'm not sure if this covers C++ only, but here's what Stroustrup has to say:

"In C++, the definition of NULL is 0, so there is only an aesthetic difference. I prefer to avoid macros, so I use 0."

<comment><USER6> That definition is indeed C++-only.

<comment><USER7> Not sure in which sense it is C++ only. 0 is a null pointer constant in C.

<comment><USER6> My mistake. I could have sworn that only C++ defined 0 to be equivalent to a null pointer. I guess my confusion stemmed from the fact that the NULL preprocessor macro in C++ is actually defined to be just "0" (or a magical- seeming "__null" in recent versions of g++), whereas in any modern C implementation I've seen, it's "((void *)0)".

Though there are cases in which passing an unadorned "0" as a null pointer can be wrong; there's a null-terminated varargs function example here:

<http://c-faq.com/null/null2.html>

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Uglier than trigraphs?

Also, I've long wondered why complex numbers were added to C. They seem like an inappropiately feature for a systems language.

<comment><USER9> Trigraphs are certainly _weird_ , but they're also simple enough that I wouldn't really consider them ugly.

I assume complex numbers were added for the same reason as tgmath.h: a mostly failed attempt to get people to switch from Fortran to C.

</comment></comment><comment><USER10> C11 has type-generic expressions that allow arbitrary functions to have the same semantics as the tgmath functions.

</comment><comment><USER11> Seriously? man hcreate

Edit: I guess that isn't so ugly as it is completely pointless. There's a difference.

<comment><USER12> Oh my. For those situations where you need a hash table, but only one?

<comment><USER13> ...that can not resize?

</comment></comment></comment><comment><USER14> Keep in mind that "the ugliest C feature" was committed in 2000, and the article was written in 2005. Things were a mite different in 2000, so this was probably more necessary.

Even if this isn't necessary today, it's a pretty interesting brain exercise.

<comment><USER7> glibc still includes similar code. (There are type-switch builtin functions in gcc that could have replaced it).

</comment></comment><comment><USER15> For xplatform development on OSX & iOS tgmath OS great.

In fact clang recently added an extension to c for function overloading in a clean way.

<comment><USER16> How often do you really need to make sure you get the float versions rather than simply using the double versions everywhere and dealing with the minor speed hit? The tgmath stuff is really for scientific computing. For simple trigonometry on UI elements and such, there's no noticeable advantage to using e.g. cosf rather than plain cos and letting conversions happen.

</comment></comment><comment><USER17> tl;dr hacking an unsupported feature (function overloading) into a language that doesn't support it is ugly and/or results in leaky abstractions.

<comment><USER18> He also isn't quite up to speed with Fortran overloading. It is fairly easy to define interfaces that can call different functions based on input type, but it still isn't as nice as C++.

<http://pastebin.com/1ewMcDaA></comment></comment>


The IEEE has finally ratified 802.11n - <AUTHOR> http://www.programmica.info/2009/09/80211n-wi-fi.html

<comment><USER2> Seven years. What a colossal failure for the IEEE. Any insight on why it took so long?

<comment><USER3> The Aussie government research lab CSIRO held patents on some of the technology and only agreed a resolution early this year.

<comment><USER4> How can there be patentable technology in a specification?

If it's a specification shouldn't it by definition omit implementation details?

<comment><USER5> Often there's only one natural way to implement something. For example, AFAIK everyone uses FFT to implement OFDM.

</comment></comment></comment></comment><comment><USER6> Do we infer the lack of needed standards?

<comment><USER7> Good standards are discovered not imposed.

</comment></comment><comment><USER8> What does this mean for me? Will I get super fast wifi now? how fast?

<comment><USER9> All the devices out there that say "802.11n" on the box also have a disclaimer saying "draft standard". Now they can omit the disclaimer.</comment></comment>


Keep your CRUD off the Internet - <AUTHOR> http://www.ericsink.com/entries/crud.html

<comment><USER2> Aside from being an advertisement, this does make a reasonably decent point for some use cases... though I don't believe most of them are ones that are commonly solved with web-based CRUD.

However, letting people do these things offline on mobile devices introduces non-trivial problems of its own.

You've now turned your presumably-consistent, probably-IT-department-managed central database into, at best, a hub that's only eventually consistent. Someone's on vacation and made some updates on their phone? Sure, it looks like it was applied. Better hope they get back in cell range or on a network again for long enough to update -- and that they have a way to monitor it and ensure it was successful -- and at this point you're losing at least part of the convenience this was supposed to enable.

You've also now created the necessity for more robust conflict resolution. When you get two people editing the same data in a live web form, you can at least invalidate the second person's update if you're keeping last-updated timestamps. This approach falls on its face in an edit-offline-then-upload model because you now either have to automatically merge changes (yikes), re- create deleted records that were edited (and deal with dead references, yikes), or implement a prompt to get the user to resolve it themselves (unhappy user and yikes).

Of course, you also have to decide who should get how much and which of your data synced, make sure it's secure, and supply some mechanism so that a careless user can't drop his phone while not locked and allow someone remote access. Making sure the data is irretrievable without the phone being unlocked and the user signed in to the app is the least of your worries, but still something to worry about. Plus you have the potential for sensitive user data being distributed to places it shouldn't be, e.g. PCI compliance issues...

I'm sure there are other issues here, but this is not a replacement; with just these issues it's a totally different paradigm. That doesn't mean it's a bad idea, but it definitely will not drop in nicely and take all that awful CRUD out of our internets.

<comment><USER3> So why do you suggest ? dropping any offline/online sync feature because the implications (for crud apps)? i guess you could have a system checking what resource has been updated since last connection and explicitly alerting the user the commit has failed due to an update that happened between the offline edit and the connection, or keep track of all the versions ( which is hard to manage if resources have relationships and depend on other resources ) Anyway that's a subject i'm really into so any resource on the matter is welcomed , i'm really looking for the holy grail of data syncing.

<comment><USER2> I think the viable scope of such a replacement is there but probably very limited. In my opinion it depends on the type, format, frequency of editing, sensitivity, and many other properties of the data you're working with.

Perhaps the solution isn't sending CRUD mobile, but rather replacing it in some circumstances with more limited, potentially check-in/check-out, simplified and abstracted workflows that make sense in specific situations. Trying to replace it like this in a general sense presents more problems than it solves.

</comment></comment></comment><comment><USER4> For apps that read a lot more than they write, there exist ACID databases in which reads don't have to touch network, while retaining consistent writes. Datomic is one; for those who have never studied datomic, the database storage is immutable in the same way that Git commits are immutable, which enables a lot of git-like things in your database, like queries without network. That way your apps can be fast without giving up ACID.

I don't know if anything like Datomic exists on mobile; and OP is talking about mobile apps not webapps; so OP may be kind of correct, at least today.

<comment><USER5> I need to look at Datomic.

Zumero could also be described as having similar characteristics as Git. It's like a DVCS, except for stuff that looks like rows and columns instead of stuff that looks like directories and files.

I'm sure that any decentralized database violates ACID in some way, but Zumero is pretty darn ACIDic. All the local CRUD operations are ACID. And the sync to the server is ACID, or highly corrosive at minimum. But yes, the two operations are separate.

</comment></comment><comment><USER6> With everything going mobile, and mobile not being so well connected, i'm looking at writing to local mobile storage, and then later syncing that storage to the server, when a connection is available.

This is perfect timing for me.

Thx.

<comment><USER3> I'm looking for some articles about how to do syncing 101 by the way , i heard it's kind of hard. If anyone has good links about the subject ( on HTML5 offline/online sync <=> db server ) , it would be great.

<comment><USER7> I made a kind of todo/list pet project with html5 local storage earlier. All the front end was based on that storage, then it was only a matter of syncing. To do that I kept a queue in local storage, that I only emptied after a successful sync. Then you need to define conflict rules based on what you synced, and that is case-by-case.

For instance for me, deleting a task meant anything else regarding that task later was disregarded, it's deleted. Updates to tasks were treated by timestamp. For creating tasks, I had to have a temporary id that I updated after syncing, to a permanent id.

tldr; queue, precedence rules and timestamps.

</comment></comment></comment><comment><USER8> I disagree. This surely depends on the type of crud application you're trying to build. We have a few in house business apps here, REST API and a JS frontend in the browser. Works fine, and since all our operations are atomic everything that doesn't come back with a 200 OK is fairly easy and generic to handle. The system also wouldn't be really usefull if the data weren't always up to date.

I get the point OP is trying to make but it really depends on what you are trying to build.

</comment><comment><USER9> It seems to me that sync is the last mile for a great write once deploy everywhere (Mobile + Web apps) framework.

What I really want is a meta framework that runs rails/django for backend + angular/ember for frontend + cordova/phonegap for mobile + responsive display with HTML/JS/CSS + something for syncing to allow offline mobile. Ideally this would be loosely coupled so you could choose your components (i.e. write a native mobile app if you want, or do the backend with Go, etc.)

The two pieces still missing are the sync component and the glue that keeps you from having to define the same thing multiple times. Unless there's something open source I'm unaware of.

</comment><comment><USER10> How is this going to sync just a slice of the database rather than everything in a given table? I would only want to publish one subset rather than all rows?

<comment><USER5> At the present time, Zumero doesn't allow sync of a partial table. If we sync only part of a table down to a device, then SQLite doesn't have the ability to enforce a UNIQUE constraint.

SQLite does have excellent support for using multiple database files together (using ATTACH), so there is plenty of opportunity for setting things up to ensure that each device only syncs the data it needs.

</comment></comment><comment><USER11> Like others have stated, I think it depends. Look at your target market. If the market is the USA, mobile connections are getting more reliable and really fast (LTE) and this isn't much of a problem.

OP should market this to devs focusing on countries where mobile networks stink.

<comment><USER12> And where would that be? I thought it was the U.S. which was backwards !! :) (and I live in Uruguay, South America).

That said, I'd love it if more of my apps worked offline with sync.

<comment><USER11> Where? I don't know, but according to the speed test I just ran on my Verizon iPhone 5 I have 30 mbps down and 12 mbs upstream plus 70ms response time. With that speed/latency combo, poor network connection quality and offline syncing just isn't a problem that needs to be solved.

<comment><USER12> I was agreeing with you, I just was saying that it was the U.S. which often lagged in cell phone standards adoption, so if the U.S. has great conectivity, and even South America has good connections (I have a slower connection but it's at least 1 mbps, more than enough for a CRUD app !!! ), where do they need that cache? Africa? And I've read that they have pretty decent cellphone infrastructure there, having bypassed landlines entirely, so maybe not even there.

Summary: with good cellphone connections everywhere, one of the points is not as strong. There still are dead spots, but enough to warrant the extra complexity of sync?

<comment><USER11> Good points.

</comment></comment></comment></comment></comment><comment><USER13> Nice approach; I like going through the SQLite API.

<comment><USER14> _cough_ WebSQL _cough_

So many apps, HTML5 or native, could benefit from an offline sync story. That wheel doesn't need to be re-invented over and over again.

This reminds me a lot of WebSQL, which I've always been sad was killed.

<comment><USER15> The cool thing about using SQLite as a basis for sync is that it leverages all that we know re: RDBMS merging, syncing and conflict resolution at scale. And, from a skills perspective, leverages our team's existing knowledge in SQL.

We have use cases where mobile devices may be offline for minutes at a time (in hotels and conference halls where wireless is either sketchy or un-usably slow). I can definitely see us using this. I may check out the Couch thing as well, although we use Cassandra for NoSQL scenarios.</comment></comment></comment>


Campaign to name hurricanes after climate change deniers - <AUTHOR> http://climatenamechange.org/

<comment><USER2> Wow, is that a dumb idea. This might be a good time to re-read hurricane expert Chris Landsea's 2005 resignation letter from the IPCC:

[http://cstpr.colorado.edu/prometheus/archives/science_policy...](http://cstpr.colorado.edu/prometheus/archives/science_policy_general/000318chris_landsea_leaves.html)

Quote: "It is beyond me why my colleagues would utilize the media to push an unsupported agenda that recent hurricane activity has been due to global warming."

</comment><comment><USER3> Without getting into the dogma of this discussion is this going to change the minds of these people? I could see this becoming a "badge" of sorts for the deniers.

<comment><USER4> I imagine the idea is not to change their minds, but change the minds of people who are sitting on the fence.

I thought this was a bad idea until I saw that all of the proposed people are politicians.

</comment></comment><comment><USER5> Oh yeah, attacking the disbelievers for their blasphemy in the name of Science is a great idea.

<comment><USER6> Yes, that is how science works. Its called the scientific method.

1\. Make up an untestable idea where you don't even know the sign of the result.

2\. Shame others into accepting it.

3\. Celebrate science.

</comment></comment><comment><USER7> [http://www.washingtonpost.com/blogs/capital-weather- gang/wp/...](http://www.washingtonpost.com/blogs/capital-weather- gang/wp/2013/08/26/group-wants-hurricanes-named-after-politicians-who-deny- climate-change/)

Will hurricane "Jim" really make people think about Senator Inhofe? I don't think so.

<comment><USER8> In the video, the hurricanes had the first and last names of the politicians.</comment></comment>


How does Diffie-Hellman Work? - <AUTHOR> https://kndrck.co/posts/zk_how_does_diffie-hellman_work/ <comment><USER2> Thank you for this very understandable explanation</comment>


IJaaS: IntelliJ as a Java server that does autocompletion for Vim - <AUTHOR> https://github.com/google/ijaas <comment><USER2> anything similar for Emacs?</comment>


Show HN: Hashdog – MD5 breaker in Io.js/ES6 - <AUTHOR> https://github.com/logotype/hashdog

<comment><USER3> Interesting project.

I see in some classes you set the object "self" to "this" and use it later in anonymous functions. That seems to be a common pattern in a lot of peoples code.

It seems like naming the "self" object something more descriptive and specific would make sense in general, but I can't help wondering if there is a more fundamental reason for using "self".

Is this common in OO parlance for a reason?

<comment><USER4> That is a common JS idiom because the binding of "this" changes inside function calls, so one must capture the outer binding of "this" which when used in an object scenario does behave like the same keyword used in traditional OO. The naming of "self" could just be a synonym or a nod to Python (I'd have to do research to know definitively)

<comment><USER3> That makes sense. I wonder though if there is a better convention than "self". That by itself (to me at least) does not say much about which "self" we are describing. Maybe it is just a matter of personal preference, but I like to be more specific and descriptive.

It reminds me of the practice of using "throw-away" variables in for loops. Personally I would still rather name the variable "loop" instead of "i".

<comment><USER4> Ok, you are free to propose an alternative - either here or to your team - <USER2> be sure you and your team are prepared to have to adjust if and when you join another JS team.

And if I had to name loop variables "loop" I would lose my mind. But I'm glad it works for you and your team, so long as you never have nested for loops.

</comment></comment></comment></comment><comment><AUTHOR> I don't claim this to be fast, as it isn't really optimized for performance at all. I created this mainly as a learning experience using ECMAScript 6, as well as multiple processes in node/io. The plan is to add more options later, or perhaps another interesting way could be to see how fast this thing can be.

</comment><comment><AUTHOR> a few updates, now includes a CLI. other stuff will be updated soon!</comment>


Ask HN: Does the GDPR make public blockchains impossible? - <AUTHOR> If for example, someone put personal data of Europeans online using a service like https://chainy.link after the GDPR goes into effect, will the protocol be in Violation of the GDPR? What, if any effect will this have on public blockchain protocol development? <comment><USER2> GDPR raises the level protection that personal data receives. It may turn out that blockchain based protocols are not a good choice to store personal data, just like you wouldn't store credit card information public. The law itself doesn't care which technology is used to store personal data and so far the only exceptions are if other laws overwrite the requirement, e.g. tax law.

Lots have been written about blockchain and GDPR, I haven't seen a conclusive solution yet. E.g. [https://medium.com/wearetheledger/the-blockchain-gdpr- parado...](https://medium.com/wearetheledger/the-blockchain-gdpr-paradox- fc51e663d047)</comment>


Account Chooser - for the next generation of web sign in - <AUTHOR> http://accountchooser.com/

<comment><USER2> Think long and hard before you implement something like this on your website. Implementing the bog-standard login system is a one-morning task for any engineer capable of writing a web app. Supporting multiple logins well can occupy teams of competent developers continuously and they will _still_ screw it up. The underlying OpenID/etc protocols are some of the worst designed you will ever have the misfortune of working with. Your users will _hate_ the experience of using them on your site, largely because a) they do not understand them, b) they do not solve a real user problem, and c) when you screw up your implementation -- and you will -- you will lock them out of their accounts.

<comment><USER3> > b) they do not solve a real user problem

I might be part of a minority, but I love websites which let me sign up with OpenID/Twitter/Facebook. No need to fill out the same registration forms over and over again or having to wait endlessly for confirmation emails. Moreover no need to remember which username/password I used for which sites, etc.

</comment></comment><comment><USER4> I don't see anything in the GITkit documentation where Google promises any kind of uptime number or notification window before disabling the service and leaving you with no way† for your users to authenticate to your service.

† You could try get them to do a password recovery procedure since you kept their email address, but I'd rather not send out an "I'm sorry, we lost your password." message to customers.

</comment><comment><USER5> Perhaps a little premature post: looking at <http://accountchooser.com/how.html> (as of 8/29 at 12:23pm) there are a host of "image coming soon" placeholders. At least finish up your first sentence before broadcasting.

</comment><comment><USER6> The site is going fairly unresponsive, is this a login service like Janrain RPX or is this more akin to a component that you integrate yourself, like AuthLogic?

</comment><comment><USER7> Tried signing in to the "Sample Store" on the site using Gmail, but the attempt merely resulted in a blank popup window on Firefox 6. It's a shame because it looked quite promising until then.

<comment><USER8> I got a little past that, up to a perpetual "Signing in" progress ticker.

(After refreshing, I could verify that I was not logged in, but I'm not sure if the demo was supposed to go as far as managing session cookies anyway.)

</comment></comment><comment><AUTHOR> there's the official Account Chooser Working Group Charter proposal announcement - [https://sites.google.com/site/oauthgoog/workinggroupcharter/...](https://sites.google.com/site/oauthgoog/workinggroupcharter/acwgannounce)

</comment><comment><USER9> How are they different from OpenID?

</comment><comment><USER10> is that opencart extension available somewhere? would be great to release it.</comment>


CodeShip: Our Experience with Immutable Infrastructure - <AUTHOR> http://blog.codeship.com/immutable-deployments/ <comment><USER2> Gah, giant twitter button taking up like 10% of vertical space on mobile. Wtf? Combine it with the permanent menu bar at the top and its like I'm reading on an iPhone 3 here.</comment>


Elemental: C++ library for distributed-memory linear algebra and optimization - <AUTHOR> https://github.com/elemental/Elemental <comment><USER2> I am the lead author of Elemental and am surprised to find this here. I'll try to answer any questions.

<comment> semi-extrinsic I understand (correct me if I'm wrong) that Elemental started somehow as a by- product of your PhD work. How did you find keeping working on it after the thesis, and growing a small team? Anything in particular that you think was important for this to succeed (I mean the keeping-on part, not the technical part)?

<comment><USER2> The brutally honest answer would be that I prioritize its development above everything else. I have no idea if this is sustainable in the long term, but I don't plan on slowing the development down as long as I have an income.

When I was finishing my PhD I turned down several industry opportunities for fear of having to stop development. I am currently a (tenure track) assistant professor but increasingly worry about academia's lack of respect for library development.

<comment><USER3> At this point, I don't think it'll help you, but about a decade ago, COIN-OR was put together to partially provide an organization that helps give academics a place to peer review and receive credit for the codes they generate ([http://www.coin-or.org/](http://www.coin-or.org/)). The other reason was to provide a place to host open source optimization codes before things like Github became popular. Now, did it every really live up to that promise? Not as much as I'd like. Honestly, after IBM purchased ILOG, it looked like their support dropped off pretty significantly and IBM was always the largest backer. That and a number of key people retired. In any case, there was just an election, but I know they're still looking for people to help drive the organization forward. As an assistant prof, it's a risk, but perhaps one worth looking at at least in the sense of what some kind of organization with moderate backing looked like that was trying to give academics better credit for their codes.

<comment><USER2> This is a great point. I'm an outsider in the optimization and OR communities (having started out in HPC linear algebra) but have a lot of respect for what I've seen from COIN-OR.

</comment></comment></comment></comment></comment><comment><USER4> Tldr from the website: _Elemental is an open-source library for distributed- memory dense and sparse-direct linear algebra and optimization which builds on top of BLAS, LAPACK, and MPI using modern C++ and additionally exposes interfaces to C and Python (with a Julia interface beginning development)._

It'll be interesting to see the how the Julia interface behaves and how big the performance penalty is going to be.

<comment> semi-extrinsic PETSc has an Elemental interface for doing dense linear algebra. Can't do much better for an endorsement than that.

<comment><USER2> I'm definitely happy that the PETSc developers have put up with Elemental being such a moving target (it has expanded from dense factorizations to sparse-direct, Interior Point Methods, and now some number theory), as there have been substantial growing pains. Barry Smith has also been nice enough to poke me any time Elemental isn't valgrind clean.

</comment></comment></comment><comment><USER3> When you say that you can do arbitrary precision linear algebra, do you control the scalar type or is the code templated on it? Basically, can we run the factorizations over arbitrary scalar types, which allows things like automatic differentiation over the factorizations?

How does the performance of the linear algebra compare to other templated linear algebra codes like Eigen?

<comment><USER2> As of a few days ago, Elemental supports a BigFloat class which wraps MPFR along with MPI wrappers and distributed matrix classes which template over it.

It would be a modest project to support other datatypes, as the main obstacles are MPI wrappers and perhaps some explicit instantiations. I would be happy to respond in excruciating detail on email@example.com.

As for performance: Elemental is focused on distributed-memory functionality but still achieves performance comparable to optimized libraries when run on a single process (indeed, Elemental often maps down to OpenBLAS, MKL, etc. when run with only one process).

</comment></comment><comment><USER5> Does this overlap functionally with TensorFlow ([1])? How are the two different?

[1] [https://www.tensorflow.org/](https://www.tensorflow.org/)

<comment><USER2> I would say that the goals align much more than the current approaches, which are somewhat orthogonal. My focus in developing Elemental has been on expanding from the scope of libraries like ScaLAPACK (which focused on distributed dense linear algebra) into more general algorithms (e.g., Interior Point Methods and lattice reduction) and modern programming practices (using templates to support arbitrary-precision versions of the above).

Arguably the biggest weakness of Elemental is its lack of focus on dynamic scheduling at an intranodal level, though this can to a large degree be pushed into a local BLAS layer. One of the big items on my wish list would be proper integration of intranodal dynamic scheduling with the current high-performance internodal static scheduling.

The current TensorFlow releases seem to be primarily focused on intranodal dynamic scheduling; there has been a substantial amount of work in this area from the PLASMA [1] and (less recently) SuperMatrix [2] projects.

[1] [http://icl.cs.utk.edu/plasma/](http://icl.cs.utk.edu/plasma/) [2] [http://www.cs.utexas.edu/users/flame/pubs/SuperMatrixTR.pdf](http://www.cs.utexas.edu/users/flame/pubs/SuperMatrixTR.pdf)

<comment><USER6> How about dask's distrubted array? Do you know how the architecture and goals compare to Elemental?

<comment><USER2> Distributed [1] is very new and seems to have similar core architectural goals as TensorFlow. But perhaps I'm being too politically correct: both make use of very course-grain parallelism relative to a typical distributed-memory linear algebra library (e.g., the current communication mechanisms of both are likely to be too course-grain to efficiently support distributed dense matrix inversion or eigensolvers; not that this is likely to be a design goal of either).

[1] [http://matthewrocklin.com/blog/work/2015/06/23/Distributed/](http://matthewrocklin.com/blog/work/2015/06/23/Distributed/)

<comment><USER6> I think distributed's scheduler has seen much iteration since then and is now based on tornado. I wonder if that changes your assessment.

Also what do you think of Julia's native distributed capabilities and this library here: [https://github.com/shashi/ComputeFramework.jl](https://github.com/shashi/ComputeFramework.jl)</comment></comment></comment></comment></comment>


What's the best way to edit remote configuration files locally? - <AUTHOR> As far as I can tell the safest/best way to remotely edit root-owned config files is using etckeeper, cloning & pushing. Any better options? <comment><USER2> For me emacs' Tramp does good job. With recent versions you can use sudo on remote host, so no problems with ownership.</comment>


Ask HN: Is it "dirty" to have an "Import from [competitor]" feature? - <AUTHOR>

Considering a feature in one of our products that would ease migration from a competitor's product. After reading the Loic Le Meur post on here recently, I'm wondering if such a feature is unethical, dirty, low, or un-nice.<p>Thoughts? <comment><USER2> Uhm... no? Why would it be "dirty" to do that? As long as you have a valid way to access the data you're just doing your customer a favor.

I think it's only dirty if you're not upfront with the customer about what you are going to bring in from your competitor and/or what you're going to do with the data.

</comment><comment><USER3> My thought is that it is "dirty" to not allow your customer to easily export their data from your project.

If a customer chooses to use a competing product, and you make it hard for them to do so in order to keep them, you've already gone from being a help to being a barrier to your customer.

If someone else comes along and removes your artificially erected barrier at their expense, so be it. Perhaps next time, it would pay to work with your customers, and not against them.

<comment><USER4> This is sometimes easier said than done.

We have a system that is made up of about 30-40 tables of associated data. The software itself allows many levels of reporting on the data, and we take nightly snapshot backups of the data for restores. So, the customer need not worry about the integrity of their data or getting it back out in a meaningful manner.

However, developing a system of export would not only be extremely expensive, but would be done so to allow our customers to leave.

We are working on an API that would allow some interaction with the data, and I suppose someone could write a form of export tool from the API if they choose, but I don't think we are going to do this.

I can see how important it might be to have export tools for a contact manager, or other small, single-use apps, but it's just not realistic, nor does it make good business sense when you have massive data sets and invest greatly into support and data backups/management.

<comment><USER3> The choices you make for you and your app are yours alone, and each must be weighed against your other needs. I didn't mean to imply that exporting your customer's data was an easy or priority job.

However, you don't operate your business in a sandbox. We're moving, ever so slowly into a world where ownership of data is becoming a very real concern for many of your would be customers. You will run the risk that either a new customer finds your terms unacceptable, or even worse, that your competitor does this extremely expensive task for you.

There are many situations and each deserves it's own investigation. I'm merely stating a design principle that is good to practice.

</comment></comment></comment><comment><USER5> Not at all, as long as you provide an easy and open way to export your data for your users (and potentially your competitors) to use.

</comment><comment><USER6> Check whether you would be violating the Terms of Use of the competitor's product (e.g. by screen-scraping their site). Of course, if you are small you are less likely to be sued so you might want to take the risk.

<comment><USER7> You know what, if that would be in their 'terms of service' then they can go jump of a cliff. To lock in your users data may be in your terms of service but that does not mean it will stand up in court. Portability is pretty much a given, whether you're the phone company or a web site it should not matter.

Any website that wants to play nice opens up their users contents at their request and competes on quality, not lock in to make sure as few users as possible make use of it.

<comment><USER8> "To lock in your users data may be in your terms of service but that does not mean it will stand up in court. Portability is pretty much a given..."

It is a given in terms of best practices in various regards, but not in law (at least not in the US or other jurisdictions with similar IP frameworks).

<comment><USER3> I'd be willing to bet it is, given 10 years or so.

</comment></comment></comment></comment><comment><USER9> As long as you have a "Export to [competitor]" feature as well I don't see what the problem is.

<comment><USER10> I don't even think you need that. Let your competitor break his head writing that code.

</comment></comment><comment><USER11> <http://www.joelonsoftware.com/articles/fog0000000052.html>

<comment><USER12> Wow! Great article! This pretty much sums up why you want to make it convenient for users to export your data.

</comment></comment><comment><USER13> I second the support for "export from your app". This signals that you're confident that customers will stay with you because they like your product, not because they are locked in. It may not be easy, but it's a way to reduce the risk of entry.

</comment><comment><USER14> I think you should probably shoot the competitor an e-mail and mention to them that you're doing it (and tell them about your useful export API, and ask if they can reciprocate!)

</comment><comment><USER15> Not at all. Especially, if you also offer an export feature. Trapping the user's data in your product is not nice.

</comment><comment><USER16> Gmail are a very obvious example of a large-scale product doing this.</comment>


Beating the bookies with their own numbers - <AUTHOR> https://arxiv.org/abs/1710.02824 <comment><USER3> I take it bookmakers don't just balance bets and take a slice, because it's more profitable to "bucket shop" (an old stock market crime term) and in effect, bet a little of their own money against their customers if they think the customers are wrong, using better models/predictive systems than their customers have to know when to do this. But the bookies don't take (so far, anyway!) reversion to the mean into account; therefore they don't partially discount their most extreme (compared to consensus) predictions, or not sufficiently. To profit from this error on their part you can find those edge cases and bet against the most extreme of the house's secret bets - <USER2> aren't really secret 'cause they skew they odds given (skew vs the odds created by bets actually received. But since the authors don't know those bets, they must be using consensus odds as a proxy, or comparing other betting services' odds.) Still thinking 'bout this though.</comment>


Uber Poaches PR Chief Whetstone from Google - <AUTHOR> http://blogs.wsj.com/digits/2015/05/13/uber-poaches-pr-chief-whetstone-from-google/?mod=WSJ_TechWSJD_NeedToKnow <comment><USER2> That would mean something if people were cattle that are herded around against their will. Time to stop using the meaningless word "poach".

<comment><USER3> I think the word "poach" accurately reflects the attitude corporations have toward their "human resources", even if it doesn't reflect either the legal or moral reality of the relationship.</comment></comment>