Automating Development Environments with Vagrant and Puppet - <AUTHOR> http://blog.kloudless.com/2013/07/01/automating-development-environments-with-vagrant-and-puppet/ <comment><USER2> This is a very nice write up. If anyone is interested, I've put several screencasts together about Vagrant [1], creating a Vagrant box with Veewee [2], and Learning Puppet with Vagrant.

[1] [http://sysadmincasts.com/episodes/4-vagrant](http://sysadmincasts.com/episodes/4-vagrant)

[2] [http://sysadmincasts.com/episodes/5-create-a-vagrant-box- wit...](http://sysadmincasts.com/episodes/5-create-a-vagrant-box-with-veewee)

[3] [http://sysadmincasts.com/episodes/8-learning-puppet-with- vag...](http://sysadmincasts.com/episodes/8-learning-puppet-with-vagrant)

<comment><AUTHOR> Thanks! I just got started with Vagrant and figured I should share my experience!

<comment><USER3> Thanks analogAndroid - I'm just getting started with Puppet and Vagrant too. Great article, hoping to learn more from you!

<comment><AUTHOR> You are welcome! Let me know if there are any things that you would be particularly interested in hearing about!

</comment></comment></comment></comment><comment><USER4> I have been using Vagrant for development on my Mac for over a year now and it has made having consistent dev, test and prod environments so much easier. I see others who dev on a Mac and deploy to Ubuntu running into a myriad of issues, ranging from libraries not compiling correctly to TCP sockets lingering on TIME_WAIT for different periods of time. It's nice to avoid that class of bugs.

</comment><comment><USER5> The limitation with this type of approach is the assumption of a conventional (and, some would say, out of date) architecture, ie. single service on a single VM on a single cloud provider.

Topology specification, firewalling, resource constraints (bandwidth, IO speed/resilience... ie. RAID/backup persistence safety), service cohabitation or codependence, performance/capacity testing, cost, cloud provider abstraction, public DNS+SSL+sofware package distribution infrastructure dependencies, legal jurisdiction considerations, speed of instantiation, etc. are all realistic considerations (often requirements) for much modern infrastructure.

In short: this only gets you half-way, for relatively simple examples. But if your workload is within that space, by all means go for it.

(PS. Before anyone snaps 'you can manage multiple hosts with <tool>', sure. But the architecture of the tools begins to present issues.)

<comment><USER6> > ie. single service on a single VM on a single cloud provider.

Vagrant allows you to specify groups of VMs that spin up together.

Your general point that it doesn't simulate production perfectly is correct. But this is one case where the perfect is the enemy of the good.

<comment><USER7> Apparently to simulate production to the level OP requires, the only solution is to have the users test your product--the only way to perfectly simulate reality is reality.

</comment></comment></comment><comment><USER8> If you're interested in getting up and running with a full development environment, I created a minimal LAMP stack utilizing the deliciousness of Vagrant and Chef. It's available on GitHub [https://github.com/MiniCodeMonkey/Vagrant-LAMP- Stack](https://github.com/MiniCodeMonkey/Vagrant-LAMP-Stack)

There has been a lot of discussions about which provisioner to use, but at the end of the day they all achieve the same goal. I would personally just use one that you feel comfortable with, in the sense of configuration system and structure.

<comment><USER9> How timely - I happen to be reading this while waiting for my environment to finish setting up :-)

Thank you for your work!

(Any chance it might work with Vagrant v2 soon?)

</comment></comment><comment><USER10> I myself am also a big fan of vagrant although it can be tough on your machine when working on multiple projects at the same time. Often times I find myself running out of memory and it can be quite tedious having to halt and bring back my vagrant boxes when I jump from project to project. Perhaps docker can address this issue someday?

<comment><USER11> use vagrant suspend to store the vm in the current state. resume is pretty much instant.

</comment></comment><comment><USER12> If you're just getting started with Vagrant and find yourself stuck, try a different provisioner. I had a lot of trouble wrapping my head around Puppet, but was up and running with Ansible very quickly. Puppet, Chef and Ansible can all be used to build out your Vagrant VM's environment.

<comment><USER13> I just read about Vagrant, and Ansible last week -- I would love to read the ansible playbooks of folks to see what they are doing with them, and to learn more about how its done.

Ideally, I'd love to find some vagrant scripts and ansible playbooks to bring Amazon ec2 instances up and down and configure them with a standard set of packages.

</comment></comment><comment><USER14> Nice write up. I have been using Vagrant for a while now and it has made it really easy to move environments around to different machines. Mitchell Hashimoto is a brilliant guy.

</comment><comment><USER15> I did a bit of extra work to make my puppet manifests work outside of vagrant too, so I can use a simple script to install to any Ubuntu base box (e.g. bare metal, EC2, docker, etc) - [https://github.com/mozilla/socorro/blob/master/puppet/ubuntu...](https://github.com/mozilla/socorro/blob/master/puppet/ubuntu- bootstrap.sh)

</comment><comment><USER16> This could have been 1/10th the content

[https://puphpet.com/](https://puphpet.com/)

<comment><AUTHOR> Oh yeah, that is true, but the point is to learn how to do it by hand so you can do more than just bring up a php app (like develop django or rails or anything else).

<comment><USER17> Other languages are on my to-do list for PuPHPet!

</comment></comment></comment><comment><USER18> The author should really check out saltstack (with or without vagrant).

<comment><AUTHOR> I have checked out saltstack (not in too much detail, since I have been busy with puppet). But I wasn't sure if there was an equivalent to exported resources in saltstack (I want to use them for automated monitoring and orchestrating of other services), since that is a pretty useful thing and I was somewhat skeptical about having everything defined in YAML, since there are somethings that I think one wouldn't be able to do... but I have been meaning to look into it!

</comment></comment><comment><USER19> why are people not using Docker as compared to Vagrant ? Doesnt it consume way less memory ?

<comment><USER20> can docker have different operating systems with different kernels (win, freebsd, debian lin, ubuntu) running on the same machine? or same o/s with different kernels? different modules?

the old vps vs. container discussion.

<comment><USER21> It is possible to run a VM inside Docker and still retain some advantages of containers, but not all of them since there is a "VM" in the sentence :)</comment></comment></comment>


Google wins final approval to acquire Motorola; deal to close imminently - <AUTHOR> http://www.businessweek.com/news/2012-05-19/google-wins-final-needed-approval-for-motorola-mobility-purchase

<comment><USER2> "This page is not available for mobile viewing at this time."

I am assuming that the article is just text, and that that text is somehow not available because my user-agent claims that I am on a mobile device. Why?

<comment><USER3> With the amount of link spam on the sides and the usage of flash ads, I think they couldn't guarantee you would get to see the site in it's full glory on a mobile device.

</comment></comment><comment><USER4> This is sort of a non story at this point. More interested to know what Google plans to do with Motorola now that they have it. Will they really manufacture their own phone in house? Or are they just going to engage in patent wars?

<comment><USER5> All indications are that Motorola Mobility will continue to be run as a separate entity, though I wouldn't be surprised to see unlocked bootloaders and a more stock Android feel on newer devices produced by the company.

</comment></comment><comment><USER6> Hopefully this means more stock Android devices arriving on the market.

</comment><comment><USER7> Can someone explain why Google must have sought Chinese approval? Both companies are American, so what's the problem? Why get approval in US,Europe,China but not somewhere else?

<comment><USER8> It doesn't matter what nationality the company has, but rather the laws of the countries where it operates.</comment></comment>


The Future of Computing - An Interview with Yukihiro "Matz" Matsumoto - <AUTHOR> http://fredwu.me/post/54175219257/the-future-of-computing-the-future-of-computer-programmers <comment><USER2> The idea that faster parallel hardware will lead to a parallel software future is nice, but I don't really buy it. For example the move towards cloud computing is the big thing these days but its completely orthogonal to that. The cost savings from cloud services are driven by making highly parallel hardware look like an awful lot of one or perhaps two core servers for dozens of clients at the same time.

In other words the big ground breaking world shaking trend in computing isn't about running clever parallel applications on clever parallel hardware at all, instead its about leveraging that hardware to make good old single threaded applications run as cheaply as possible.

<comment><USER3> Everyone's niche in the industry taints their perspective; we're clearly on opposite ends of this spectrum. Over the past 10 years, I have seen a shift from Unix/Linux x86 servers, to beowulf clusters, to GPU based clusters, and most recently a project with Intel Phi boards.

A common thread throughout this progression has been the lack of proper software and tools to parallelize the workload. The team is constantly on the lookout for new tools and is thrilled about upcoming technologies like Parallella.

In your field, where cheap CPU cycles is paramount, you may not see it. But for our team running the sims, your "good old single threaded" performance has been meaningless for years.

</comment></comment><comment><USER4> Don't listen to the naysayers. It was a nice interview and article. I found the fonts perfectly readable and I liked the interspersing of images.

<comment><USER5> I was going to comment on that too. The typeface made the content a pleasure to read. Matz just seems like a happy, genuine guy from all the articles and videos I've seen him in.

</comment></comment><comment><USER6> I see the sparse fourier transform and other tweaks to the FFT creating decentralized p2p systems where video and audio sharing requires little bandwidth. Centralization is doomed, it's just too expensive to maintain now with the entire world getting new devices and connecting by the millions everyday. As for languages Lisp will still be alive! :)

Re: the article font, it looks fine on Firefox nightly build running on Debian wheezy

</comment><comment><USER7> Well, in the spirit of the topic, here are my counter-predictions.

I'm betting that between now and quantum computers, memristors will play a significant role, and (as I understand them) they'll push us much further toward parallel computing than multi-core and device networking would. A friend of mine believes they will behave as a network of small computing units, so he's betting on an actor model. We'll see!

The book "Trillions" [1] talks a lot about computing future, and focuses very heavily on the idea of "device fungibility" with "data liquidity" \- basically the idea that the computing device is insignificant and replaceable, as the computing work&data can move freely between them. When you consider how prevalent general-computing devices are-- microwaves, toasters, cars, phones, dish-washers, toys, etc-- this is pretty compelling. I highly recommend that book.

Now, I personally think localized connectivity&sync between devices, strong P2P Web infrastructure, and more powerful client participation in the network will alter the importance of vertical-scaling central services and give much more interesting experiences to boot (as things in your proximate range will factor much more largely into your computing network). "Cloud computing" as we have it now is really just renting instead of buying. Yes, you can easily spin up a new server instance, but it's much more interesting to imagine distributing a script which causes interconnected browser peers to align under your software. Easy server spin-up? Try no server! This means users can drive the composition of the network's application software, which should create a much richer system.

Considering privacy issues, I think it's an important change. Not only is it inefficient to always participate in centralized services and public networks, it's unsafe. P2P and localized network topologies improve that situation. Similar points can be made about network resiliency and single-points-of- failure-- how efficient is it to require full uptime from central points vs. minimal uptime from a mesh? I imagine it depends on the complexity of decentralized systems, but I'm optimistic about it.

Along with network infrastructure and computing device changes, I think the new VR/AR technology is going to flip computing on its head. Not only do we gain much more "information surface area" \- meaning we can represent a lot more knowledge about the system - but we gain a ton of UX metaphors that 2d can't do. One thing I get excited about is the "full spectrum view" of a system, where you're able to watch every message passed and every mutation made, because in the background you can see them moving between endpoints, and, hey, that process shouldn't be reading that, or, ha, that's where that file is saving to.

So TL;DR: I say the future of computing is VR/AR, peer-connective, user- driven, and massively parallel.

1 [http://www.amazon.com/Trillions-Thriving-Emerging- Informatio...](http://www.amazon.com/Trillions-Thriving-Emerging-Information- Ecology/dp/1118176073)

<comment><USER8> Right now, datacenters are just starting to fully abstract the OS from the hardware -- physical servers run "hypervisor OSes", which can host several virtual servers and live-transfer them from physical host to physical host. And the hypervisor OS does little else.

Meanwhile, virtual servers handle all of the actual software tasks. Through advanced routing, these virtual servers remain connected regardless of which physical server hosts them, and even while being moved from one physical host to another. Thanks to virtual HDDs on SANs, these virtual servers can always reach their virtual HDDs, regardless of physical device failures.

Virtualization tech has already entered browsers. And browsers are slowly becoming the entire client, as we've seen with Chromebooks. It's just a matter of time for these movements to all collide, allowing for virtual servers to freely roam the spare memory and CPU space of all of your browser-OS-based computing devices.

This would be sort of like running Hyper-V on all of your users' Win8 desktops to host your email, directory, database, and information servers. Boom, no server!

<comment><USER9> Those that work in this area do not believe virtualization is the answer to our large distributed system cluster woes. They work great for cloud computing utilities that take customers, but are unnecessary overhead for the high performance stuff (Hadoop, MapReduce, Spark, etc...).

</comment></comment></comment><comment><USER10> Thank you for the post and translation. I really enjoyed reading it.

</comment><comment><USER11> Thank you for the translation Fred.

</comment><comment><USER12> Ruby brought me back into programming. Thank you Matz.

I hope that the future of Ruby will include better support for concurrency.

<comment><USER13> I don't really see simple concurrency happening in Ruby. Unless either:

1) The design of MRI changes fundamentally in the next few years 2) More room is made for alternative implementations like Rubinius or JRuby

<comment><USER14> JRuby is a very mature and widely used implementation by now. Granted, it's a bit isolated from the world of MRI libraries with compiled extensions, but compatibility story is getting better with every day. Besides, you are within arm's reach from the java library world.

<comment><USER13> That's the point though, as sad as it is, it's not "there" if it's not drop- in, given the stranglehold MRI has on the Ruby world.

You can run most applications with JRuby but to my knowledge, it always involves fiddling and tweaking.

For a Rails application, using the jdbc adapter or Puma/Trinidad instead of the regular servers for example. I am not saying this is a proper justification but it does prevent people from testing it further.

Also, I am still looking for actual and undeniable proof that using JRuby instead of MRI does actually bring better scaling/performance/memory management/tooling. So far, the examples I have seen are conclusive, but still limited to very particular use cases. That Heroku now officially supports JRuby is a big plus I would say.

</comment></comment></comment></comment><comment><USER15> This interview was not about Ruby. I don't know why Matz always starts his computing/programming journey from 1993 ? Its as if nothing existed before that magical year.

<rant> This is hard to read, at least in firefox. Why the hell can't the author keep the font consistent throughout the article?(interview).

Its ok to print a picture or a two. But 5+ images, why ? </rant>

<comment><AUTHOR> Blog author here. I am sorry you found it difficult to read. Would you mind posting more information about your set up? (OS, Firefox version?) As I've just checked and the fonts should be Lucida Sans, Helvetica Neue or Helvetica depending on what's available in your system throughout.

In terms of the images - they were all from the original interview article (linked in my post).

P.S. I am not sure what gave the impression that the interview was about Ruby, as "Ruby" is not mentioned in the title.

<comment><USER15> Read my comment again. I said even though the article is _not_ about ruby, Matz unfailingly starts from 1993. The headings in your article before every question makes it hard to read. The font size of the question is 3x smaller than the answer font size. Top that up with the images in between the answers.

My OS is Centos 6.1(32 bit) and the browser is Mozilla Firefox 10.0.1 .

I am sorry if this sounds aggressive. But very rarely do we get the chance to interview some amazing men. When you do(or even translate), please don't mess up.

Few days ago, a Donald Knuth interview appeared. It was a good read. May be I got carried away.

Sorry anyway.

<comment><USER16> The validity of your criticism aside, some of which I don't agree with but will get to later, I think you could deliver with a lot more respect. Treating people in this way is unnecessary, whether or not you don't like how Matz was interviewed or how it was translated. You are right, you do sound aggressive, unduly so. If you're aware of that and you're actually sorry, why haven't you made steps to change it?

Secondly, he probably uses that as a starting point because that's when he produced the work he is known for. He isn't saying computing didn't exist before this date, it's just a frame of reference. "Back when I first invented Ruby 20 years ago...". What is wrong with this? Would you rather "Back when Guido invented Python 20+ years ago..." or "20 years ago"? It's an irrelevant detail.

If you're on CentOS 6.1 and your browser is Firefox 10, why are 5 images on a page such a problem? I didn't think it made things any harder to read at all and certainly didn't affect performance.

The increase of font size on the answers puts emphasis on the answers. I don't think this is a good idea but the intention is good and did not make the document anymore painful to read.

To finish, my eyesight isn't great and I read the article without my glasses.

Please man, you can deliver criticism without being a jerk. It's purely subjective and delivering with such disrespect makes you look arrogant, as though your opinion is law.</comment></comment></comment></comment>


Gotalk - <AUTHOR> http://rsms.me/2015/01/21/gotalk.html

<comment><USER2> I'm one of the Core authors of the Kite library (library for writing micro services). I wrote an extensive introduction here on GopherAcademy: [http://blog.gopheracademy.com/birthday-bash-2014/kite- micros...](http://blog.gopheracademy.com/birthday-bash-2014/kite-microservice- library/)

I think Gotalk and Kite have a lot of common (for example we have also kite.js, to talk with browsers). The mission of the Kite library is the same as with Gotalk, mainly to communicate two pieces of software in an easy way. However in order to achieve this Kite also has an inbuilt service discovery mechanism. I think this is really important because with time you are app number will increase and service discovery is a must have. There are many differences too, for example protocol (we use JSON).

Congrats on shipping this, I'm really looking forward to see how it evolves and how you solve upcoming problems (such as poor network conditions where Websocket badly fails).

<comment><USER3> Wouldn't it be more fair to compare Gotalk to Kite's underlying dnode- protocol[1] ?

Personally Gotalk's protocol seems much better thought out; size-prefixed messaging, rpc & streaming support, multiplexing (especially important with WebSocket). The only missing bit would be some form of heart-beating.

* [1] [https://github.com/substack/dnode-protocol](https://github.com/substack/dnode-protocol)

<comment><USER4> Messages need to be encrypted by default.

No more cleartext protocols on the network anymore please, for obvious reasons.

<comment><USER5> With Gotalk, you can use the byte-buffer request and response functionality (instead of the JSON-encoding versions) and e.g. dec.XORKeyStream(inbuf, payload) in your handler when receiving a payload followed by enc.XORKeyStream(payload, outbuf) when responding.

<comment> irq-1 You could add symmetric encryption before and after putting anything on the network, and let users turn it on with a simple setting. Here's the fun part: you could use go generators to create a local key when the package is compiled. Then you wouldn't need to embed a key, or ask the user to generate and pass in a key.

</comment></comment></comment></comment></comment><comment><USER6> This looks a lot like Open RPC, formerly Sun RPC ([https://en.wikipedia.org/wiki/Open_Network_Computing_Remote_...](https://en.wikipedia.org/wiki/Open_Network_Computing_Remote_Procedure_Call)) It's a binary-format remote procedure call. Why not just implement that for Go? Then you can interoperate with existing implementations for other languages. There are lots of standards for this sort of thing, from SOAP to Google Protocol Buffers.

Opening this up for connection to potentially hostile nodes requires more design. What about denial of service problems? Can someone open a connection and tie up resources?

<comment><USER7> The complementary wire format for OpenRPC is XDR, which is an RFC: [http://tools.ietf.org/html/rfc4506.html](http://tools.ietf.org/html/rfc4506.html)

</comment></comment><comment><USER8> The author was Spotify's original designer:

[http://rsms.me/about/spotify/](http://rsms.me/about/spotify/)

</comment><comment><USER9> If anyone is interested, I've started playing around with a Python implementation here: [https://github.com/gtaylor/python- gotalk](https://github.com/gtaylor/python-gotalk)

I'm mostly focused on the marshalling/unmarshalling of the various message types right now.

</comment><comment><USER10> Awesome work, congrats! IMO it would be great if the serialisation/pipelining protocol was decoupled from this library so that you could easily create compatible clients and servers in a language other than Go.

<comment><USER5> If you have a look at protocol.go as well as the "Wire format" section of README.md, you'll find that the Gotalk protocol is decoupled from the Sock type, handlers and other parts of the Go package. The JavaScript implementation similarly provides protocol functions in js/gotalk/protocol.js — I hope I didn't misunderstand your question :)

</comment></comment><comment><USER11> What's the major difference between Gotalk and Socket.IO?

<comment><USER3> Socket.IO is for pubsub only, Gotalk is much more versatile than that.

<comment><USER12> It most definitely is not.

[http://socket.io/docs/#sending-and-getting- data-(acknowledge...](http://socket.io/docs/#sending-and-getting- data-\(acknowledgements\))

Could be used to serve a similar purpose to this lib.

</comment></comment></comment><comment><USER13> I worked on a project using Akka (Scala), and this seems to have the same core aspects as that (well, it's just message passing but easy to set up and thel like). Hope this catches on, seems like a very promising library

<comment><USER5> Akka makes some impressive claims, like 400 bytes of memory usage for an entire actor "coroutine." I'm not well-versed in Scala, but it looks like a pretty novel API (i.e. the GreetingActor example et al.)

<comment><USER14> 400bytes? Seems to be the absoulute minimum because Parallel Universe also claims that Quasar's fibers only use 400 bytes.

</comment></comment></comment><comment><USER15> Nice project! The callbacks on event listeners reminds me a lot of javascript and can get messy. Go handles this with channels. Why did you decide not to use channels to emit events?

</comment><comment><USER16> Does this improve at all upon Cap'n Proto RPC?

[https://capnproto.org/rpc.html](https://capnproto.org/rpc.html)

Why not use that?

</comment><comment><USER17> Nice thingy, I always loved the writing style of Rasmus. Good work, and stellar exposition.

<comment><USER5> Thanks!

</comment></comment><comment><USER18> Only 3 bytes for requestid ? is not too few ?

</comment><comment><USER19> What's wrong with json-rpc?</comment>


Two-factor authentication is a mess - <AUTHOR> https://www.theverge.com/2017/7/10/15946642/two-factor-authentication-online-security-mess <comment><USER2> I'm of the opinion that the accelerant for this dumpster fire is that companies are allowed to define "two-factor authentication". Security questions? Nope. "Choose the picture"? Nope. SMS? Again, close but nope. But because we sadly let just about anything beyond UID/PWD under the 2FA tent, that's what we ended up with.

The article identifies 2012 as when the mess started. Oh, no, it goes back at least five years prior. I worked at a company implementing biometrics as an authentication factor. The Feds had just mandated 2FA for banks and the like. Man, we're all going to be rich soon! Nope, I never made a dime off those options, and last I checked the company has pivoted twice and may not even be in business anymore. What happened, we were practically handed a money printing press? What happened was that banks and the like were allowed to use those half-assed implementations like security questions. Yes, security questions counted as 2FA. The "choose a picture" was allowed. So our relatively expensive system was rejected in favor of the less expensive, half- assed systems. And ten years later, here we are, with a bunch of security questions that can be answered by anyone you've friended on Facebook, and SMS that can be social-engineered.

From where I stand, it comes down to money (doesn't it always?). RSA fobs, biometric systems, they all cost money and have high support costs. Because that's what security is: it costs money, and it adds inconvenience. Well, we can't have that, so we'll implement a JS library we found on github, reset passwords over the phone for anyone that says the right things, and we save money.

</comment><comment><USER3> One thing I'd like is different levels of authentication based on the importance of the action.

When I bought I house I drained by savings account and my brokerage account. It was scary that I could instantly transfer my life savings, with just a few clicks from the regular online screens I use each day. Such events should have extra authentication and some delays - like I need to take ID to a branch.

Similarly for domains - if someone wants to change some dns settings - 2FA is good enough. If someone wants transfer the domain I'd like a much higher level of proof including physical mail sent to my address and a month-long delay with multiple confirmations. I'm surprised the cut-throat world of registrars don't compete on this.

<comment><USER4> >> I'm surprised the cut-throat world of registrars don't compete on this.

How many people go looking for that though? For _most_ people my guess is people go shopping for CHEAP first, EASY second, maybe LOOKS GOOD third, and some where down that list is "much more secure". I hate to say, I rarely go looking for the more secure option of anything.

<comment><USER5> It's why I started doing more of my business with Hover.com. I wanted a reliable looking company with 2FA. That was important to me.

<comment><USER6> I was at Hover and moved most of my domains to NameCheap. The _only_ way I could change my last name on my Hover account was to remove 2FA to prove that I was the owner of the account. No ability to give them a code verbally, etc. Remove, change my name, re-add. It didn't sit well with me for some reason.

</comment></comment></comment></comment><comment><USER7> It drives me nuts when sites insist on using SMS or Authy instead of TOTP for 2FA. I get that some users might not be sophisticated or motivated enough to setup TOTP but when somewhere like Cloudflare insists on ONLY using Authy it makes me want to look elsewhere for service.

I've spoken to AT&T numerous times to see what extra steps I can take to secure my account against any changes. So far all that's led to is an eight digit number I have to provide when making any changes. Better than nothing, but something tells me their CS people would still cave too easily to social engineering.

<comment><USER8> I just consider them as not supporting 2FA. I'm looking at you, Namecheap. My domain registrar not having two-factor authentication in 2017 is preposterous.

<comment><USER9> Namecheap does have 2fa... [https://www.namecheap.com/support/knowledgebase/article.aspx...](https://www.namecheap.com/support/knowledgebase/article.aspx/9253/45/how- to-two-factor-authentication)

Do you mean because they only support SMS based 2fa?

Considering they have a drop down menu it's possible they just have not had time to develop the other options?

<comment><USER10> As of January, 2014 Namecheap said[1]: "Currently, we only accept SMS authentication but Google Authenticator, Authy, and TOTP authentication are planned."

More than three years seems to me a long development cycle to add TOTP support. Am I being disingenuous to think they just don't care?

[1] [https://blog.namecheap.com/account- security/](https://blog.namecheap.com/account-security/)

<comment><USER11> It's not that they don't care. It's that $CARE_AMOUNT < $ESTIMATED_COST.

That formula would immediately shift if a high profile website registered on Namecheap encounters an SMS hijacking.

<comment><USER12> TOTP codes are straightforward to bootstrap. It's not rocket science.

<comment><USER11> At scale the cost of implementing a feature as wide ranging as 2FA is well beyond the tech cost. A basic TOTP implementation can be coded from scratch in an afternoon[1].

The real cost is testing to make sure a code change like this doesn't break existing users and estimating the additional support overhead of dealing with users that lose their two-factor devices.

[1] _Seriously the RFC is very straightforward and readable:_ [https://tools.ietf.org/html/rfc6238](https://tools.ietf.org/html/rfc6238)

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> >The rush to check that box has led to usability problems as well as security problems. Boroditsky points to Apple's iCloud system, which came under fire after easily guessed account-recovery questions enabled the mass theft of nude photos in 2014.

I'm still amazed by how many websites still use this "security question" mechanism. It's almost always the same questions too, "what's your mother's maiden name", "what's your childhood's pet name" etc... It's so easy to get the answers to these questions through the tiniest bit of social engineering, or even just exploring their facebook profiles.

It's crazy how many websites manage to handle auth credentials incredibly poorly, it ought to be a solved problem by now. Last week I created an account on [https://www.comedie-francaise.fr/](https://www.comedie-francaise.fr/), it used javascript to prevent me from pasting the password in the field (very convenient when you use a password manager, I had tweak the source to remove the limitation). Now that's pretty silly, but what's even sillier is that they then emailed me a password "reminder" in plaintext!

So when so many websites can't seem to handle regular user+password login properly, it's not surprising that 2FA ends up being a huge mess.

</comment><comment><USER14> Namecheap is still the big one that only supports SMS 2FA for me. It has apparently been a big engineering project to add TOTP support so they've delayed it for many (4+) years. They did recently blog they were pausing all other development to add TOTP support but there has been no progress update and their initial promise of "in 60 days" has since passed...

[https://blog.namecheap.com/authy-based-2-factor- authenticati...](https://blog.namecheap.com/authy-based-2-factor- authentication-is-coming/)

<comment><USER15> I've just moved my domains to porkbun.com instead, since they support TOTP and have equivalent or better prices.

<comment><USER16> I just buy my domain from AWS since I'm already using them for hosting. One less account to deal with and one less attack surface.

<comment><USER17> >one less attack surface

Yes, but your Amazon attack surface just got bigger.

</comment></comment></comment></comment><comment><USER18> I think there are two big aspects that need to be kept distinct.

First, is large-scale ATOs. This is, IMO, the real reason why major services implement 2FA. To the best of my knowledge, despite the insecurity of SMS, there's no evidence that an attacker can massively take over accounts of a set of users with 2FA enabled.

Then, there's attacking a single target user. I don't think there will ever be a solution for that, unless the user is really careful. 2FA offers a 2nd factor, but you still need a strong 1st factor to reduce the attacker power.

For example, storing a strong password in a pwd manager is useless when you loose your phone (assuming an attacker can unlock the screen), as both factors are on the same device, making the 2FA de-factor a single factor auth.

Currently, again IMO, the only way to achieve a secure two-factor auth, is to have a strong password that you _remember_ , and a second factor that proves you have a device.

</comment><comment><USER19> > _At the same time, it's proven difficult to kill off particular types of > two-factor even after they're shown to be insecure. The National Institute > of Standards and Technology quietly withdrew support for SMS-based two- > factor in August, pointing to the risk of interception or spoofing, but tech > companies have been slow to respond. If anything, services are relying more > on SMS as Twitter and PayPal look to tie accounts more closely to phone > numbers. It's less secure, but easier to use. As long as it's two-factor, > few account holders know the difference._

Is perfect the enemy of better here? I would think that having a second factor is probably orders of magnitude more secure than not having one, even if it's a hijackable medium like sms.

</comment><comment><USER16> Please critique this wild-ass idea of mine:

When the user makes their first purchase, print out five identical business cards and send it to them by snail-mail. (If you're selling physical products then obviously ship it with the product).

The front of the card is a regular business card; the back says "Use this code for a 10% discount on your next checkout: correct-horse-battery-staple-OTOP- backup-code" and a OTOP QR code.

When the user uses the discount code during checkout, offer them a 20% discount if they scan the QR code and successfully setup 2FA.

This way you "trick" the user into properly setting up 2FA and also holding five physical copies of their OTOP backup code in a fairly innocent looking format.

<comment><USER6> I throw out every business card I get with a package. I never scan the QR codes. I can only imagine the nightmare of recovering 2FA for someone who was tricked into setting it up without really understanding it. Just getting my relatively technically savvy mom on a passowrd manager took some work.

<comment><USER16> It's fine if the user throws it out. The whole scheme is optional and the code is never activated until the user types it in first.

The user can either:

1\. Throw it away. Then nothing happens; no 2FA is set up.

2\. Type in the code in for a 10% discount. Again, no 2FA is set up so the user's security is never worst off than before.

3\. Type in the code and setup 2FA. This is case the user is tech-savvy enough to properly setup 2FA and successfully authenticate with it (in order to claim the 20% discount) so they (hopefully) realize the importance and convenience of the pre-printed physical backup codes and will (hopefully) stash them away somewhere safe.

<comment><USER20> The problem happens when someone claims the 20% discount, but doesn't understand that they need to keep the card.

</comment></comment></comment></comment><comment><USER21> I'm looking forward to more genuine MFA. For my site, I'm experimenting with the ability to identify yourself with as many email address identities as you want (in the future the plan is to add more types including oauth, sms, etc.). If you're a regular person, you can just use one. If you're cagey, maybe two or three. Straight up paranoid, how about 10?

The point is that you are basically using an extensible claims-based approach to identity to create "aggregate identities". In the case of a beginner user, it just looks like "my account". More advanced users can add more security as necessary.

<comment><USER22> So instead of hacking 1 email/account they would just hack 2 or 3? I don't think that is adding any real security as those accounts would still just be protected by regular passwords. It makes it a tad bit harder for a hacker but not prohibitively so, because if they got the credentials to your first account then the others are probably not too much harder.

The real power of 2FA is having the code generated by you, the human, via your hardware device or software physically controlled by you and not another automated machine.

<comment><USER21> > _So instead of hacking 1 email /account they would just hack 2 or 3? I don't > think that is adding any real security as those accounts would still just be > protected by regular passwords. It makes it a tad bit harder for a hacker > but not prohibitively so, because if they got the credentials to your first > account then the others are probably not too much harder._

That's certainly one of the thoughts that I had originally! But if you look at the details, perhaps it will become a bit clearer for you: Each of my email accounts are themselves protected by 2FA, so "those accounts" are not just "protected by regular passwords".

You can have email accounts with multiple email providers, e.g. gmail, outlook, etc. So, depending on _how_ your email account gets compromised, this gives you additional layering of security. If mail provider X has a security breach, no big deal, because you also are using provider Y.

More generally, this can be seen with _any_ factor in authentication, i.e. a claim. If any claim X is compromised, by any particular attack vector, then you also have Y, Z, etc. in play, depending on your security vs. convenience configuration.

And as I stated, email is only _one_ of the avenues used to provide evidence for a claim. In the future, Oauth(2) tokens, sms, etc. The point is that it's an extensible mechanism for genuine MFA, instead of hard-coding in the "2" in 2FA. And that diversity is where the "real power" of multi-factor authentication comes into play.

<comment><USER22> This really does just seem like 2FA with extra steps.

You can't add N factors to multi factor authentication by adding more accounts. That's just lightly strengthening the first factor (something you know which is a few different accounts) with a splattering of the second factor (those accounts rely on something you have such as your phone). The third factor of something you are doesn't even come into play in this solution.

Having 2FA set up for the account in question makes it reasonably secure. Relying on a second account that also has 2FA enabled does not make it twice as secure. It might make it slightly more secure but not by a lot. It's even likely that the second account is using the same device for the second factor as the first account which negates any added security.

The best you can do in a scheme like this is shift the trust based security to second entity. It's the same level of security but just handled by something you might trust more. (Google/Facebook vs some random website I had to make an account for).

<comment><USER21> > _Relying on a second account that also has 2FA enabled does not make it > twice as secure._

This is an absurd statement that I didn't imply, but perhaps you inferred?

> _The third factor of something you are doesn 't even come into play in this > solution._

As I've said, the point is to allow for additional claims to be given. "Something you are", i.e. biometrics, is _certainly_ "in play" in this solution. It is yet another claim to add to establish an identity. The point is that the identification is extensible, and that _it 's left to the end user_ to make the opinions that you're depicting rather insouciantly as some kind of "absolute truth", when what we're actually talking about is trade-offs with security vs. convenience, as well as defense-in-depth.

> _It 's even likely that the second account is using the same device for the > second factor as the first account which negates any added security._

You're assuming that the attack vector is only at the end device. Of course diversification of hardware like a keyfob or smart card is an added layer of defense. But that doesn't mean that there is no value in multiple identities from the same device. It all depends on the specifics of how your device is compromised, or even if it's your device that is compromised in the first place. As I said, what if you have a single email address hacked or a single email (or oauth, or sms, or whoever) has a data breach?

> _The best you can do in a scheme like this is shift the trust based security > to second entity._

Creating your own user/pass scheme, or your own oauth server is certainly one of the options we have, so again this is not "shifting to a second entity".

I'm wondering if this is just trolling at this point? You're making simply outlandish remarks with numerous assumptions and with little regard to what I'm actually saying.

</comment></comment></comment></comment></comment><comment><USER23> Doesn't help that major organizations that use 2FA (facebook / instagram) have had their iterations completely broken (and documented by many, many people) and they still won't fix it.

[https://medium.com/@joelrunyon/instagrams-security- features-...](https://medium.com/@joelrunyon/instagrams-security-features-are- broken-and-they-won-t-do-anything-about-it-16233f0935b0)

</comment><comment><USER24> I've finally arrived at a pretty comfortable 2FA setup: A Yubikey Neo for TOTP, so I can get codes on any of my devices (including my smartphone via NFC), and a dedicated dumbphone with a worldwide roaming SIM in it where SMS works (and is dirt cheap to receive) no matter where in the world I am.

I still much prefer TOTP whenever possible as the phone is potentially vulnerable to social engineering against the SIM provider.

</comment><comment><USER25> > Avoid: SMS has been at the center of a lot of two-factor hacks, most > recently as a way to hijack Telegram accounts in Iran. High-security > accounts are already moving away from it, but a frightening number of > services still keep it as an option, giving anyone who compromises your > carrier account an easy way in.

I feel like this is badly phrased. SMS 2FA is far worse than other types, but still better than no 2FA.

<comment><USER4> >> SMS 2FA is far worse than other types, but still better than no 2FA.

It seems like every time I read about how SMS2FA was hacked it was done by some state level power that would've gotten in through some other method. I don't know if that's confirmation bias or actually true, but I think you're right, SMS is better than no 2FA. Just because the NSA etc... can easily break it doesn't mean it's useless right now. (maybe not the case in a year or two?)

<comment><USER26> > It seems like every time I read about how SMS2FA was hacked it was done by > some state level power...

It seems to be a lot more vulnerable than that. Perhaps the biggest problem is that the phone companies do not treat your phone number as being a component of a 2FA system (and, to be fair, that was never the intent). This is from the linked article by Cody Brown, "How to lose $8k worth of bitcoin in 15 minutes with Verizon and Coinbase.com":

"Of all the things that went down in the factors that lead to this hack, Verizon Wireless is what I was massively unprepared for. After talking at length with customer service reps, I learned that the hacker did not need to give them my pin number or my social security number and was able to get approval to takeover my cell phone number with simple billing information."

See also: [https://krebsonsecurity.com/2016/09/the-limits-of-sms- for-2-...](https://krebsonsecurity.com/2016/09/the-limits-of-sms-for-2-factor- authentication/)

<comment><USER27> > It seems like every time I read about how SMS2FA was hacked it was done by > some state level power... It seems to be a lot more vulnerable than that. > Perhaps the biggest problem is that the phone companies do not treat your > phone number as being a component of a 2FA system (and, to be fair, that was > never the intent).

I think this sums up the problem.

BUT

SMS is likely the most convenient way for non geeks to use. And, as far as I am concern it seems only ( or especially ) Telecoms in US are vulnerable. In places like China / Hong Kong / Japan / Korea, you cant change your recovery code or what ever without your personal ID.

</comment></comment></comment></comment><comment><USER28> What I don't like is everyone using different 2FA standards, so you end up having to use different apps to find the code for a given service.

Recently Google and Lastpass are supporting push notification for 2nd factor in lieu of manually inputting a code. That seems like it'd be more secure than TOTP, but does require an internet connection to receive the notification.

</comment><comment><USER29> people's phones have their passwords from their google/firefox accounts, their email, and tend to be their 2FA device for google authenticator... not really 2FA anymore

to be fair if you are running the latest android or have an iphone that's probably better than having it all on your exploit ridden PC, but it's still 1FA

<comment><USER30> Having a secure way to log in to your phone is supposed to be the second factor.

</comment></comment><comment><USER31> Got to use TOTP or FIDO (U2F). Can't rely on SMS (SS7) attacks. Here's some TOTP/HOTP software I wrote:

        https://github.com/w8rbt/oathgen

        https://github.com/w8rbt/goathgen

</comment><comment><USER32> I lost my 2FA to AWS (my phone broke), now I have to provide:

1) A completed, signed, and notarized Identity Verification Form and Affidavit 2) A photocopy of the AWS account owner's primary proof of identification, such as a State driver's license or US passport. (note that I don't live in the US) 3) A photocopy of the AWS account owner's proof of address matching the address on record (I don't live there anymore)

in order to stop them from billing me every month for resources I don't use.

I lost my MongoLab token as well, now I can only access my database over a connection string.

Now I don't enable 2FA, the chances of me losing my token are higher than the chances of me being hacked. And after 2 or 3 years I don't remember where my backup tokens are so that's not a realistic option

<comment><USER33> I only enable 2FA if it's TOTP or HOTP. In the case of TOTP I save the key (the data in the QR code) in my password manager (KeePass), in the case of HOTP my backup key is in my fireproof safe at home along with other important documents. That's admittedly a small portable box with a carry handle, so easy for a burglar to steal, but it's also easy to get to and I can take it with me if I ever have to evacuate or move.

<comment><USER8> Saving the 2FA key along with your password makes it a single factor. I just add every new key to my Yubikey (as well as FreeOTP on my phone), so I have a backup if one breaks (this is on top of the backup codes).

</comment></comment></comment><comment><USER34> > It was supposed to be a one-stop security fix.

I use 2FA as much as the next person but I have realistic expectations that it's not a magical fix for everything.

</comment><comment><USER35> The big problem is no so much that 2FA is broken but bitcoin makes breaking 2FA so much more lucrative.</comment>


Show HN: GoldenLayout – build multi-screen webapps - <AUTHOR> http://golden-layout.com/#start <comment><USER2> This is the 6th appearance of this lib on HN. That said, it is still one of the most clever things I've seen in terms of front end libs. I stumbled upon it independently about 1.5 years ago, right before the author switched from some restrictive licenses to MIT. Still waiting to see someone implement something amazing with it though. We had mockups for something cool at my last job, but senior management decided to do everything in ServiceNow instead...

</comment><comment><USER3> In a game development shop a lot of people would use multiple monitors (usually 2 or 3). Their level/model/etc. editor would normally do proper window docking, where it would restore the previous state of windows properly (or at best it could). To me it's one of the things where desktop still shines (apart from other things). But if this is possible with the browser, then it might change the mindset.

I haven't tried it yet, as I'm typing from my "single"-yet screen laptop, but would try it out later again.

I hope it preserve/restore the layout as it was, but other than that it looks really sleek!

Visual Studio kind of established how docks should work, and other Ui systems still need to catch up (Qt I'm talking about you :)).

</comment><comment><USER4> For those who have checked this before: The license has changed from GPL to MIT.

<comment><USER5> Looks like this change occurred over a year ago.

[https://news.ycombinator.com/item?id=11471082](https://news.ycombinator.com/item?id=11471082)

</comment></comment><comment><USER6> I should go through each and every 1000+ star project on Github, sometime. Stuff like this is really great.

</comment><comment><USER7> I like the concept. One thing that stands out for me though is its dependency with jQuery. Not sure if it is a deal breaker, but if one could ship quality and nicely looking apps with it, then the same won't really matter.

</comment><comment><USER8> troika: I'm having a hard time getting GL to work with React and Redux. There's a Github repo showing it working together, but it's achieved by wrapping the component, and I haven't resolved all of the issues. Namely, that this repo seems to work when referencing React js files from a CDN, but for some reason, fails when building them in the app. Also, refs in components seem to be a problem when wrapped in this way. Wondering if there's a better way to handle these.

[https://github.com/andrewcapodieci/golden-layout-react- redux](https://github.com/andrewcapodieci/golden-layout-react-redux)

Looks very promising, but I'm wondering if you've tried this combination successfully. I also haven't figured out yet whether redux and pop-out windows will work properly.

</comment><comment><USER9> I used it for a bit there were some bugs and such so I ended up writing a "lite" version, that is admittedly crappy but did just what I needed [https://github.com/joshribakoff/dockable](https://github.com/joshribakoff/dockable)

</comment><comment><USER10> Frequently pops up as a comparison to my lighter library, Split.js[0]. If you're just looking for draggable split views.

[0] [http://github.com/nathancahill/Split.js/](http://github.com/nathancahill/Split.js/)

</comment><comment><USER11> After making 5 clicks something broke and one div renders at the bottom of the page :(

</comment><comment><USER12> Just a low-effort initial observation: "Works in IE8+, FF, Chrome" but the demo depicts an iMac display :-)

EDIT: Seems to work fine in Safari too!

<comment><USER13> Even lower-effort initial observation: I have to scroll horizontally to see the whole page with my portrait-orientation display.

<comment><USER14> I wanted to run 3x portrait so bad until I realized that side scrolling would have to become a fact of life for me to do so.

<comment><USER13> I got a chance to do this when an office reorg temporarily granted me a third monitor. The occasional horizontal scroll was more than compensated for by the feeling of godlike power.

<comment><USER15> 3x portrait 1x landscape has driven me mad with power. They're 4k, so I don't actually have to scroll here. Only downside is having to buy my own monitors for work because I've spoiled myself.

10/10 would sell my soul for more pixels again.

</comment></comment></comment></comment></comment><comment><USER16> I made a panel "full", but cannot make it go back to its original size, I can only close it or break it out.

<comment><USER17> The "_" button works for me (i.e. the middle of the three breakout, minimize, close buttons). I expected it to minimize the window to a taskbar, like in Windows, but it restores it to the original size instead. I found this unintuitive but don't know a better icon.

</comment></comment><comment><USER18> This seems like software that would take over the computer, such as a customer service app, a monitoring app, etc. In other words, it might be the only thing your running on the computer (in the foreground). I rarely use a desktop app that makes use (effective or otherwise) of multiple monitors.

<comment><USER14> I believe the word you're looking for is "kiosk." :)

</comment></comment><comment><USER19> I think the last time I saw this it was a spinoff off a market trading application that was (at the time and even now) one of the most impressive web applications I'd seen.

I can't remember the damn name though.

<comment><USER20> Cheers, it's "the Merchant" ([https://vimeo.com/143728632](https://vimeo.com/143728632)) - it also started [https://deepstream.io/](https://deepstream.io/) \- this was one helpful app :-)

<comment><USER19> That's the one!

I was looking for it the other week to show someone what you can do on the web these days.

</comment></comment></comment><comment><USER21> Great library, seen it pop up here a few times. Slightly off topic, on the website it says:

> "free as in beer, speech & love"

...In what world is beer free? ;) haha

<comment><USER22> Probably the same world where speech and love are free. :)

Roughly:

Free as in beer means you don't have to pay money to use it.

Free as in speech means you have freedom to use or modify it in any way you want

Free as in love means it will happily plays with all other software and systems

<comment><USER23> I've been on the internet for decades, and that phrase never sat well with me; Beer Money is a real phrase, and AFAICR I've always been required to tender a fee for the right to undock a beer container from the beer-temperature- control-apparatus or purge beer fluid from a heat controlled storage vessel.

<comment><USER24> Have you never been invited over and been offered to fetch yourself some beer from the fridge? It'd be weird for a friend to require you to tender a fee before doing so, and they'd also be quite annoyed if you started stockpiling the beer being offered to you and started reselling it. In my mind the phrase conjures the right frame of mind: "Hey! Check out this piece of code I've written, friend! Feel free to use it!"

<comment><USER23> That is a perfect way to put it for me to understand it...

Thanks. I feel obtuse for not getting that for so long.

</comment></comment></comment></comment></comment><comment><USER25> Noticed a small niggle. The X on the focused tab will not highlight on mouseover, this unlike when mousing over the X of an unfocused tab.

</comment><comment><USER26> "powerful persistence" and a picture of two floppy disks.

I'm in my early 30's and I haven't ever personally owned a computer that _included_ a floppy drive. I did buy a USB one with my late 90's iMac, for compatibility with the school but I think you get my point.

<comment><USER27> Your point is wrong. Even kids who were born after floppy disks fell into disuse recognize the symbology as representing "save" or "persist". Apparently the letter "A" used to represent a bull. Doesn't mean it is useless to us today, far from it.

<comment><USER26> They recognise it because software uses it still, nothing more.

</comment></comment></comment><comment><USER28> Columns are vertical, rows are horizontal.

</comment><comment><USER29> It renders totally non-usable on mobile S:</comment>


How the language you speak changes your view of the world - <AUTHOR> https://agenda.weforum.org/2015/04/how-the-language-you-speak-changes-your-view-of-the-world/ <comment><USER2> If you know several different languages, the advantage is not that your view is _enhanced_ , but rather you are more aware of the false contributions of language to thought; you are more aware that some pattern of thinking is just really some linguistic convention and not real semantics.

For instance, you are more likely to spot someone's equivocation: confusing multiple meanings of some term in the same argument. Right away you realize: "Doh, in this other language I know, those two concepts are not even the same word; what he's saying doesn't _translate_."

<comment><USER3> I was never that good of a Japanese speaker so someone can correct me if I'm wrong, but to me it felt like there was a lot more ambiguity about things in Japanese than in English. And I definitely found when I used it for long periods of time, even my way of perceiving the world around me changed, in a way that seemed closer to how the Japanese I knew perceived it. I never knew if this was a cause or an effect. And I _definitely_ experienced, as you say, knowing that there was no way to translate something to English without losing its Japanese "feeling".

<comment><USER4> There are very few differences between German and English, but there are tons of difference between European languages and Asian ones.

I studied in Korea, I was specially interested in Hangul, and found Japanese extremely similar to Korean in the cultural side of things.

For example, there is a iconic concept in the US of "bad guy", "rebel against the world". It simply does not exist in Korea, or in Japan by the way. You can't talk about "bad guys"to them, because it does not exist in their world.

The same happens with different levels of respect and politeness in Japan, it does not match anything the Western world has.

Words are like icons or shortcuts for something the culture has.

The intimate relationships, the families, the social contracts,violence, the way of working... it is simply another world of thinking.

<comment><USER5> "There are very few differences between German and English,"

While English is, more or less, a simplified version of German I still would not agree to your statement. English has no declension (a simplification of a grammar). [http://en.wikipedia.org/wiki/Declension](http://en.wikipedia.org/wiki/Declension)

In German it does not make a difference if you say "Dog bites Man" or "Man bites Dog". The word order is very flexible and it is always clear who bites whom. This is a major difference in a language.

<comment><USER6> The lack of grammatical genders in English is also a significant difference from German, IMHO.

It's interesting that of the largest economies in the world, the non- grammatical-gender languages seem to reign supreme (English, Chinese, Japanese).

<comment><USER5> "the non-grammatical-gender languages seem to reign supreme " Hm. Seems like bullship.

Portuguese? (Brazil) Russian? I suspect Indian (Hindi) might have genders too. German is not a tiny Economy by the way.

<comment><USER6> Top 3 are all genderless and, combined, vastly outsize the remaining 7 on the top 10.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Isn't this called the Sapir-Worf hypothesis?

[http://en.wikipedia.org/wiki/Linguistic_relativity](http://en.wikipedia.org/wiki/Linguistic_relativity)

I'm not sure I can feel it personally. I suppose as with many polyglots, I tend to speak different languages in specific contexts. So it's hard to compare, which I guess is why these researchers are setting up specific situations to do this.

For instance, I only really know science/business words/ideas in English. I couldn't do a degree in my first language. And it's awkward to talk business in English with my family.

<comment><USER8> This is one of a long line of people arguing for or against what's essentially Sapir-Worf—people have been strongly divided on it for a long time. I'm surprised to see that something like this article is getting attention, though. I figured that at this late date you'd have to say something much more compelling/nuanced to be considered as adding to the subject.

</comment></comment><comment><USER9> I am raising my sons to be multi-lingual (German and English) and it is a wonderful thing indeed to see the mind expansion that occurs on your average code-switch .. especially in very young minds. "Daddy, the erdapfel sind too hot!", and "Das Feur makes me vv-aaaarmm!!" .. ;) Much amusement in such moments.

And socially, I think it sets the kids up a bit as well, because they are quite acclimated to the strange looks from strange people when you switch fluidly, between the languages. There is a huge caché, and the boys seem to be becoming aware of how to spend it.

<comment><USER10> Thanks for your comment. It brings up positive nostalgic memories for me. I grew up speaking, reading and writing three different languages, as well as constantly hearing another being yelled through the phone.

Not sure about the article; personally it's helped me be able to adapt quickly in lots of foreign places and realize that with a little time and enough "banging your head against a desk" anything can be understood (even Cyrillic alphabets).

<comment><USER11> Same here. Fluent in 4 languages. For me the best advantage is not learning just the language, but the whole culture. If you can't laugh to comedy standup stars and understand the culture of other people, it really doesn't help much if you are fluent in one language or more. Languages also promote a more liberal worldview and more tolerance for others.

<comment><USER9> I agree with you - the moment you learn another language, you step outside the borders of your own culture, metaphysically, and are able to see things from a different perspective than what is normal. That's the value - and the liability - of language, in my opinion.

The world would be a better place if we all spoke more than just our mother- tongues ..

</comment></comment></comment></comment><comment><USER12> A little bit related to article, as I'm not bilingual but just speaking English as another language and this come up after conversation with friend (another not native English speaker). I learned my English mostly thanks to computers and playing games, including classical RPGs.

I started to read Malazan Book of the Fallen[0], a very dark and heavy fantasy series. I started in English, then switched to my native language, now to have maximum fun from it (as I like it a lot), I read one book in native and then reread in English.

What I've noticed is that reading in my native language makes me feel much more connected to characters, I see the whole relations between persons more vividly and intensively. Then rereading in English, the same characters (which I already know and like!) feels much more distant and abstract.

But :)

All the fantasy scenes plays much better in my head in English than in my language. For some reasons sentences like "blood dripping from sword", "screams of souls", "massive", "darkness", "spread his wings" etc instantly trigger the feeling of magnificent and out-of-this-world scale of experiences. Even though translation is top-notch, for those parts I prefer the English version.

Very interesting experience.

[0] [http://en.wikipedia.org/wiki/Malazan_Book_of_the_Fallen](http://en.wikipedia.org/wiki/Malazan_Book_of_the_Fallen)

<comment><USER13> What about fantasy in your native language ? How does it feel ?

I am of the opinion that translated works are (unintended) betrayals of the original text. And that a `native` author will produce better wording (sigh, sorry about that) than a translator.

<comment><USER12> Do you mean originally written in my language? As coming from post soviet block, most of our fantasy is a bit different in a sense that from the beginning it doesn't involve epicness of Tolkien, Malazan, Black Company scale. From the beginning books focus on different things.

I would like to read some of them in English to see how's the difference in perception.

</comment></comment></comment><comment><USER8> Here's the kind of thing to expect from the article:

"Research with second language users shows a relationship between linguistic proficiency in such grammatical constructions and the frequency with which speakers mention the goals of events."

—where 'mentioning goals of events' means using the grammatical constructions these people are more proficient with. So, people who are more proficient with X use X more...

But, they're really trying to push their perspective, saying things like:

"The worldview assumed by German speakers is A HOLISTIC ONE – they tend to look at the event as a whole – whereas English speakers tend to zoom in on the event and focus only on the action."

The capital letters are mine, referring to their hypertext connecting to this paper: [http://www.degruyter.com/view/j/ling.2012.50.issue-4/ling-20...](http://www.degruyter.com/view/j/ling.2012.50.issue-4/ling-2012-0026/ling-2012-0026.xml)

—whose abstract makes it clear how much they're stretching it by saying "the worldview assumed by German speakers is a holistic one," and then following up with a section titled "Switch languages, change perspective"

edit: typo

<comment><USER14> They don't say what do bilinguals for the same exercice.

</comment></comment><comment><USER15> If you really want to expand your linguistic horizons, study sign language. Sign language is fundamentally different than spoken or written languages. It doesn't just substitute gestures for phonemes or written tokens. Its grammar (and it does have one) is three-dimensional. It also opens you up to the fascinating world of deaf culture, since teaching sign is one of the most popular ways for deaf people to earn extra money.

<comment><USER16> One interesting thing as of late is that there are some deaf people who are against ear implants because, as it solves deafness, it weakens deaf culture.

[http://www.dailykos.com/story/2013/11/17/1256259/-The- Cochle...](http://www.dailykos.com/story/2013/11/17/1256259/-The-Cochlear- Implant-Controversy)

<comment><USER17> That article isn't really balanced, and is really one person's (rather uninformed) opinion.

The cochlear implant debate is a bit more nuanced than that, and it is centered around children. One argument is that, often, the child may not be given a choice whether to be implanted. There are long-term considerations: the CI destroys any residual hearing and the capability for hearing aids to work so you can't "roll back" after the surgery, you can't do MRIs ever again, you are supposed to avoid high pressure/high impact activities (scuba diving, tackle football, etc) -- although many deaf people with CIs that disregard this advice. It's also a big commitment that requires years of auditory training to master, especially if you received the implant after the language development phase of childhood -- maybe 5 or 6 years of age.

It does seem the CI's effectiveness is inversely proportional to age of implantation, especially if you are going from zero hearing (with hearing aids) to a CI overnight. The younger you are, your brain has a chance to develop into the CI as it would with normal ears, and those kids are often functionally hearing. Which is totally fine with me, by the way.

Source: Deaf, use sign language, have a CI, although I don't wear it anymore. Me and my friends with CIs are no less a part of deaf culture because of it.

</comment></comment></comment><comment><USER18> Along these lines, I've often thought about the cognitive paths that could be explored or changed if I were to learn braille or sign language. Neuroscience has recently studied and given legitimacy to the state of 'Flow' or 'the Zone'[0] which has been long been understood in the physical realm, but is probably the same or similar in states of other creative activities, like speech or writing. I wonder if it may be easier to induce if one knew American (or any dialect) sign-language. Could we more readily produce eloquence or insight with the forced physicality athletes and meditation guru's use? And how much beautiful poetry and prose are we missing produced by the deaf community?

0\. Popularized in recent books by the psychologist Mihaly Csikszentmihalyi and journalist Steven Kotler.

<comment><USER8> From my understanding, 'flow' is basically when your mind has set on and is comfortable with some 'procedure' for doing something; at that point, there's no 'meta process' watching the procedure performed, looking for ways to correct it—the procedure just runs on its own (and it runs much more efficiently that way—kinda like representing a procedure in hardware instead of software). If there's much to that, it probably doesn't matter much whether the procedure has immediate physical consequences or receives data from the physical senses.

</comment></comment><comment><USER19> I was raised bilingual in German and English, growing up in Germany. For me both languages are very different and to this day I prefer English when I want to talk about ideas and areas where I explore while talking and I use German when I need to be precise. I could never pitch in German and really don't like talking about my projects in German, since everything needs to be exact and committed to.

<comment><USER20> English is my first language, I learnt Dutch (I'm fluent) as an adult. I have the same experience as you: English is extremely context sensitive, it's for "invention" \- it's a very natural language.

Dutch is more precise; there's less ambiguity. You have to think a little more before you speak (thanks to the differing subject-object-verb order). I've become a better engineer since learning it.

We're raising our kids bilingual because the benefits are just so clear; and I figure that if they get English/Dutch for free then German is very cheap so they can learn an east-asian language too..

<comment><USER21> >Dutch is more precise; there's less ambiguity.

Really? I would suggest that Dutch is plenty of ambiguity as you can omit a lot. e.g. "Ik moet naar de tandarts [gaan/rijden/fietsen/lopen/bellen/kijken/wijzen/zoeken]" ("I must [?] to the dentist").

<comment><USER22> If Dutch is anything like German, gaan means "go" and rijden/fietsen are along the lines "go by vehicle".

In German at least, you tend to use "go by vehicle" where English would just use "go". That is the preciseness English doesn't have.

Interesting that the "I must <x> to the Bla" construct exists in Dutch, English has it, but it's antiquated.

<comment><USER23> "We must away / We must away / We must away ere break of day / . . ."

</comment></comment></comment></comment></comment><comment><AUTHOR> What surprises me about this article is not that worldviews change, but how quickly these experimenters got it to happen. "When we surprised subjects by switching the language of the distracting numbers halfway through the experiment, the subjects' focus on goals versus process switched right along with it."

I would have expected it was a much slower process. It makes me wonder if we could observe similar effects in multilanguage code bases.

</comment><comment><USER24> I will speak with a point of view from Indonesian with Javanese ethnicity.

Most of Indonesian peoples can speak at least 2 languages. Our local or regional language and national language.

Me myself can use 4 languages: Javanese (native), Indonesian (native), English (intermediate), Japanese (beginner), Arabic (beginner). For the Javanese language there some tiers of politeness but the usage in society can be generalized to polite Javanese (kromo) that we use when speaking to elders and rough Javanese (ngoko) that we use with our peers.

I have read some articles that speak about language effects on mind or point of view. But since I was small I learned more than two languages I cannot really differ them. Something a kin to the expression of "asking a fish what is water".

Based on my own feelings and experiences there are some nuances that accompany each language that I have known. I cannot describe them with words yet, but a language would be appropriate on different settings, medias, and intended audiences.

There are some language usages that are not appropriate when used in a different settings but sometimes of course there are some usages that would also help exploring the meanings

</comment><comment><USER4> I see this a lot in China.

The monolingual people in China that only speak different versions of Chinese have serious difficulty with abstract ideas and concepts because of their language.

Chinese is so outdated and obsolete in so many ways. It has not evolved, yes you could understand today a 4.000 year old writing but at what cost?

It is a socking experience, because as a European I take evolution in languages for granted.

In some ways, Europeans took the Steve Jobs approach of using new tech, outdating the old, even in language, like Carmack saying f&ck you if you wanted to play his games with only a CPU, and then forcing you to buy newer and newer GPUs.

It is hard to read without training things written even 200-400 years ago, but we have powers that Chinese don't have, like using tones for emotions(we used tones for the language 4.000 years ago), flexibility, abstractions.

But you can only see those if you speak multiple languages.

<comment><USER25> >Chinese is so outdated and obsolete in so many ways.

This is really interesting. Could you expand on this? Do you find it to be something with the vocabulary, the grammar? What about the writing system? I've always wondered how the Chinese language writes loan words (Japanese handles this by having a system of phonetic spelling that's used alongside traditional Chinese characters).

And before anyone thinks it's absurd that one language could be better at expressing abstract ideas than others, imagine the limit case: a language with only one word. Pretty useless, right? Obviously no natural language is that limited, but that doesn't mean that a range of variation can't exist. It's an empirical matter whether it does.

<comment><USER4> "Do you find it to be something with the vocabulary, the grammar? What about the writing system?"

All the above. In everything. There are no tenses in Mandarin for example. The writing system is hell. Most Chinese have different levels of analphabetism because it has so many words.

"I've always wondered how the Chinese language writes loan words"

They have different transcription methods for that. They standardized in Pinyin: [http://en.wikipedia.org/wiki/Pinyin](http://en.wikipedia.org/wiki/Pinyin)

It is not for loan words, but THEIR OWN ones. They need this in order to know how something sounds!!. Most of them use memory, but you study pinyin if you are educated.

In fact, the same Chinese character sounds different in different Chinese languages, and even in the same language in different parts of the country!.

<comment><USER26> Chinese does not use formal tenses but they add words to tell time when it's useful to. The same can be said about the lack of grammar for social relationships and politeness levels in English compared to Japanese. Would you say that it is English's weakness?

Languages are rooted in culture and express by default what the culture values. One can claim that an aspect of a culture is more amenable to modernization than another, but to say one language is better than another in an absolute sense does not seem logical.

<comment><USER4> "The same can be said about the lack of grammar for social relationships and politeness levels in English compared to Japanese. Would you say that it is English's weakness?"

Yes. :-)

My native language is not English. So I don't believe English is perfect by any means, because I know other languages are better for other things.

For example, English way of writing is terrible for expressing sounds. Japanese or the korean ways are much better Or Spanish by the way.

Any country has a propaganda system in order to make people believe their system is the best, and you can't fight against it.

I know there is no way I could convince a Chinese person that the language they speak is outdated, because it is not rational fact but emotional. There are no rational facts against nationalistic dogmas people are feed since they are born.

In fact if it is the only language someone speaks this person is heavily invested in believing their system is the best.

If you go to North Korea all people there feel pity for the rest of the world, mostly because they don't know better.

"but to say one language is better than another in an absolute sense does not seem logical."

I had never said that one language is better than another in absolute sense.

I have said that Chinese is outdated. I have said that it is a better language for reading ancient works, but it has not evolved like other languages.

This is not something I say, this is something Chinese emperors' counselors agreed while having knowledge of other cultures, and their own(there were alphabetic systems inside China Like Mongol's). It was a conscious decision not to evolve the language, because of different reasons.

It is certainly not politically correct in China just the idea that if you force children to learn thousands of symbols in order to properly read, or the order of hundreds of groups in order to properly write, that there are simpler, more evolved ways.

Just comparing a system that requires high levels memory and five years of learning with another that requires one for doing the same is not something I wanted to do.

<comment><USER25> >For example, English way of writing is terrible for expressing sounds. Japanese or the korean ways are much better Or Spanish by the way.

Just wanted to point out that the style of syllabary that Japanese uses wouldn't be practical for English. Japanese has around 150 possible syllables, English has almost 16,000 [1].

[1] [http://semarch.linguistics.fas.nyu.edu/barker/Syllables/inde...](http://semarch.linguistics.fas.nyu.edu/barker/Syllables/index.txt)

</comment></comment></comment></comment></comment></comment><comment><USER27> On a related note: learning another writing system can also be enlightening. Last year I learned how to read Cyrillic and it was a valuable experience. Now I'll see tidbits on Russian-language forums that I can kinda make sense of, or jokes about people using faux Cyrillic[0] in band names, t-shirts, etc. :P

More practically, it makes you think about coverage of non-Latin characters in fonts! What does a Cyrillic "ya" (я) look like in your font of choice, for example? Also, I'm curious how most peoples' browsers display it here on HN! BTW, Fira Sans[1] and Noto Sans[2] are two open-source fonts with Cyrillic coverage.

[0] [https://en.wikipedia.org/wiki/Faux_Cyrillic](https://en.wikipedia.org/wiki/Faux_Cyrillic) [1] [http://www.carrois.com/fira-4-1/](http://www.carrois.com/fira-4-1/) [2] [https://www.google.com/fonts/specimen/Noto+Sans](https://www.google.com/fonts/specimen/Noto+Sans)

</comment><comment><USER28> "Learn a new language and get a new soul" — Czech proverb.

</comment><comment><USER29> isn't this the Sapir-Whorf hypothesis? I remember in linguistics class my professor spent an entire lecture on how it was so controversial. It's a pretty common-sense idea but neither of the two guys who developed it are linguists.

[https://en.wikipedia.org/wiki/Linguistic_relativity](https://en.wikipedia.org/wiki/Linguistic_relativity) [http://plato.stanford.edu/entries/relativism/supplement2.htm...](http://plato.stanford.edu/entries/relativism/supplement2.html)

</comment><comment><USER30> I took one semester of French in college after 4 years of Spanish in high school.

The most intriguing parts for me were around numbers and counting. For example, the number 80 is "quatre-vingts", which literally means 4 x 20.

I thought maybe this gave French youth an edge with arithmetic, and this slight edge might translate to strong mathematics foundations later in life. I have heard there is a strong emphasis on mathematics in their school curriculums, so maybe there is some correlation there.

<comment><USER31> English is really consistent here. 4321 is four thousand three hundred and twenty one. Probably the biggest inconsistency in English are the numbers 11 to 19.

Many European languages are not. Often with numbers between 11 and 99 are a weird special case. German puts the single digit first. As another poster mentioned 23 is "dreiundzwanzig" (literally "3 and 20"). French is worse where 97 is "quatre-vingts dix-sept" (literally "4 20s 10 7").

These are just the last remnants of a pre-decimal ("vigesimal" specifically) counting system.

I don't really see how weird rule exclusions on certain numbers would give anyone an advantage in math, particularly because even though the word means "4 20s" when you learn it, it's just a word and it may well just lead to questions like "why isn't 40 2 20s?" There is a cognitive cost with exclusions.

I remember reading a study once about how verbs became regular in English. There was a mathematical relationship between how often the word was used and how quickly it became regular. The less used, the quicker it happened.

This is why "to be" is irregular (as its the most common verb) whereas most other verbs (with <100 exclusions) follow a simple pattern.

It's probably the same with numbers. The numbers less than 100 are used far more often so their irregularity is preserved far longer than the less common numbers above 100.

<comment><USER7> But what is causing the irregularity? Is there any benefit to conjugating "to be" differently to everything else?

<comment><USER32> It's thought to be a combination of colloquialisms + the Indo-European ablaut system, wherein vowels would change depending on conjugation.

Consider how many English irregular verbs follow a pattern. Sing, sang, sung. Ring, rang, rung. These are ablaut conjugations.

</comment></comment></comment></comment><comment><USER5> "To speak another language is to possess another soul" Charlemagne

"We inhabit a language rather than a country. " Emil Cioran

"I speak Spanish to God, Italian to women, French to men and German to my horse." Charlemagne

"The limits of my language mean the limits of my world." Wittgenstein

<comment><USER33> _" I speak Spanish to God, Italian to women, French to men and German to my horse." Charlemagne_

I had learnt this line as attributed to Charles V, Holy Roman Emperor (king of both Spain as Carlos I, and of Germany as Karl V). Charlemagne could hardly have spoken those languages as they didn't quite yet exist around the year 800 A.D. when he lived, but spoke Rhenish Franconian, Latin, and some Greek [1]. Charlemagne was the first Holy Roman Emperor which could explain the confusion, but Charles V lived around 1500 A.D, seven centuries later.

[1] [https://en.wikipedia.org/wiki/Charlemagne#Language](https://en.wikipedia.org/wiki/Charlemagne#Language)

I have quoted those words myself for a number of years, but when checking before commenting I found out that he didn't ever say exactly that, but according to reports some 40 years after his death: [https://en.wikiquote.org/wiki/Charles_V,_Holy_Roman_Emperor#...](https://en.wikiquote.org/wiki/Charles_V,_Holy_Roman_Emperor#Misattributed)

 _" When Emperor Charles V used to say, as I hear, that the language of the Germans was military; that of the Spaniards pertained to love; that of the Italians was oratorical; that of the French was noble"._

 _" Indeed another, who was German, related that the same Charles V sometimes used to say: if it was necessary to talk with God, that he would talk in Spanish, which language suggests itself for the graveness and majesty of the Spaniards; if with friends, in Italian, for the dialect of the Italians was one of familiarity; if to caress someone, in French, for no language is tenderer than theirs; if to threaten someone or to speak harshly to them, in German, for their entire language is threatening, rough and vehement"._

Thanks for triggering me into correcting my misunderstanding. :-)

</comment></comment><comment><USER34> There is a linguist (Daniel Everett) who thinks language can make you less prompt to accept a religion [https://www.youtube.com/watch?v=BNajfMZGnuo](https://www.youtube.com/watch?v=BNajfMZGnuo)

</comment><comment><USER35> Steven Pinker has dispelled this notion in his book The Language Instinct.

[https://en.wikipedia.org/wiki/The_Language_Instinct](https://en.wikipedia.org/wiki/The_Language_Instinct)

<comment><USER36> That book makes sense, to a degree. Language does not tell us how to think, but it can constrain what we say. I find that our words reflect what we think, particularly when it comes to our prejudices.

Common indicators are language that is inclusive or exclusive (we/us/I Cs them/they), notions of gender (eg. Feminism indicates a prejudice toward one gender). I have found that when someone has a biased mindset (particularly an exclusive one) and you point out their mindset through their use of language, most moderate people start to think differently and as such, their language changes.

However, I find that emotive people and political correctness break this pattern. This parallels the "faith" gambit - logic never enters the equation.

</comment></comment><comment><USER37> Praying that nobody mentions the Sapir-Whorf s/Hypothesis/(Hoax|Strawman)

<comment><USER38> Well given that you _have_ mentioned it, why don't you want anyone else to mention it? It's obviously relevant.</comment></comment>


"Learn C the Hard Way" is no longer available for free - <AUTHOR> https://learncodethehardway.org/c/ <comment><USER2> If memory serves, the web version was always sort of an "alpha". The book now has a physical print edition, so I guess he wants that to take priority.

Kind of a bummer, but fortunately I already worked through the book when it was in alpha and saved a copy of all of my exercise solutions in case I need to refer back to them in the future.

EDIT: Looking at an Archive page reinforces my view on this: [http://web.archive.org/web/20150203094342/http://c.learncode...](http://web.archive.org/web/20150203094342/http://c.learncodethehardway.org/book)

"This is the in-progress free version of Learn C the Hard Way."

So my understanding is we were basically beta-testing his book for him and providing feedback in exchange for his making it free. He's finished it, smoothed it out, and finalized it with some additions and videos, so now he wants money for it. Seems fair enough to me.

I've seen the physical edition at Barnes and Noble a few times. I might thumb through it one day and see if there's enough content beyond what I pulled from the alpha to be worth buying.

</comment><comment><USER3> I just bought this book two days ago and I'm loving it so far. Apart from the last few chapters that are now complete, you also get videos of Zed discussing the code and exercises.

For the insane amount of work Zed's put in the material, I consider it a very worthwhile purchase. Given the tremendous amount of value I've derived from Zed's other free books, parting away with the $30 is the least I could do to support his efforts.

Thanks Zed for this excellent resource!

</comment><comment><USER4> The one in "Stuff that should be avoided"?: [http://www.iso-9899.info/wiki/Books#Stuff_that_should_be_avo...](http://www.iso-9899.info/wiki/Books#Stuff_that_should_be_avoided)

<comment><USER5> IMHO, that's the best endorsement for the book I've ever seen. Zed had a knack for pissing off people who spent too much time in theory and too little time building things.

I don't blame him for finally charging for it either. It's a good book and giving it away for free got him nothing but harassment and libel.

update: Beej's Guide to C[0] is also on that list.

[0]: [http://beej.us/guide/bgc/output/html/singlepage/bgc.html](http://beej.us/guide/bgc/output/html/singlepage/bgc.html)

<comment><USER6> This is the reason they gave to avoid it:

Too many factual problems and a presentation that gets you to do things wrongly before being shown how to do it correctly, and not even always then.[0]

[0]: [http://www.iso-9899.info/wiki/Main_Page#Stuff_that_should_be...](http://www.iso-9899.info/wiki/Main_Page#Stuff_that_should_be_avoided)

<comment><USER7> Yeah, but this is ##c: when they say "factual problems," they mean that at some point Zed said that a function took an array as an argument, or that the book didn't match up to the letter of the C standard. And "doing things wrong" means not checking the return value of every single syscall you use.

<comment><USER8> >And "doing things wrong" means not checking the return value of every single syscall you use.

There are people who think not checking every syscall is a good idea?

<comment><USER7> No, of course not, but they're a bit extreme about it.

</comment></comment></comment></comment></comment></comment><comment><USER9> [https://www.gnu.org/software/gnu-c-manual/gnu-c- manual.html](https://www.gnu.org/software/gnu-c-manual/gnu-c-manual.html)

This is my favorite C related documentation online. The first book on C I read was a PDF of K&R, I liked it. I used to think the paperback was way too expensive. Instead I bought C Primer Plus, never read it. Few books capture the gist of a language as well as K&R in as little space. Though Modern Perl and Programming in Lua also come to mind. If they ever make an updated version of K&R I would definitely buy it.

<comment><USER10> >I used to think the paperback was way too expensive.

How much was it?

<comment><USER9> Around $50 USD in Amazon, like today. I just thought it was too much for the quantity of pages. But really, few programming books are as good as K&R. I still think the editorial is particularly greedy when it comes to this book. Still I don't recommend any C book, other than K&R.

<comment><USER11> If you want to buy a cheap printed version search on abebooks.com. They usually have _international editions_ at competitive prices. I used to buy all my college textbooks from there.

</comment></comment></comment></comment><comment><USER12> I really enjoyed reading this book when I was re-learning C. I don't understand why It gets so much hate, the book gets you coding complex programs in a couple of days, unlike other C books where you have to read 300+ pages to finally start learning about pointers.

<comment><USER13> What C book has 300+ pages before you learn about pointers?

<comment><USER14> I went and checked - the book I first learned from, "Using C" by Clint Hicks, didn't introduce pointers until page 232. Not quite 300+, but not too far off either.

</comment></comment></comment><comment><USER15> I read it a while back and didn't think it was very good. I wouldn't pay $30 for it IMHO. There are better books out there.

<comment><USER16> I don't really give too much of a shit about this particular book, but this logic is, to me, amazing.

It's a book about programming --- a very specific kind of programming. The only reason for normal people to read is to acquire some new set of skills.

I am having a hard time thinking of any --- literally any --- new C programming skill I would value at less than $30.

That doesn't mean you can't reasonably warn people off a book! It might not be worth the time to read. It might be totally inaccurate, or fail to communicate any new skills. But otherwise, "I wouldn't pay $30 for it" wouldn't make sense even if the book were just 5 pages long.

<comment><USER17> it does if there is a better book available on the market for $20.

<comment><USER16> If I offered you a BMW M5 for $2000, would your first thought be, "hmm, I should check to see if someone is selling the same car for $1800"?

Programming book preferences are fine, useful even! Complaints about book _prices_ are silly. Take your career more seriously.

I guess my point is just: pretty much all technical books are fantastically, comically underpriced.

<comment><USER18> > If I offered you a BMW M5 for $2000, would your first thought be, "hmm, I > should check to see if someone is selling the same car for $1800"?

Firstly, probably yes. If you're selling way below the market price, there's something wrong with your BMW. But leaving that aside...BMW M5s are not nearly not as easy to produce or copy as books. I could probably generate a (horrible) learn to program in C book in a matter of days and put it up for sale for $30. I would appreciate someone telling the world "Don't buy this, it's a bad idea."

Now I maybe you have already read the book and know it's not particularly bad, or you think Zed's reputation as an author is good, or something else like that – and it's fine to offer those as rationales for buying the book. But the argument that " _Any book about C is likely to change your_ career* and you're quibbling over $30?" is a terrible argument IMO. The likely thing that happens with the average C book is that you read the first 10 pages, can't grasp some point that the author is particularly bad at explaining, and wander off to watch a Youtube video or something.

Now if your book is so engaging that it prevents this sort of attention wandering, _that_ is a book where you can reliably present this argument. One example (from my perspective) are the _Feynman Lectures on Physics_. I can read them for ages and ages without getting bored. If you or anyone else in the thread knows about _that_ kind of C book, let me know. K&R (surprisingly) is the closest I've come.

<comment><USER16> Just to be clear/pedantic:

If I offered you a $100,000 car for $2000, your first instinct would be to see if you could get it _cheaper_?

<comment><USER17> You are saying the value to the buyer is far, for more than the cover price.

I agree completely; it's a really important point.

But not everyone on HN is a professional programmer, and there are students, self-improvers, and individuals in other countries for whom the sentiment of "just buy it; it's sufficiently valuable to you" is tempered by the opportunity cost (yes; the opportunity cost of $10) and the need to get the best value/dollar.

This is probably why poverty is so self-sustaining: because you have to burn ridiculous effort over trivial nonsense. Your thin budget gets even thinner, and now you're stuck.

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> Ironically, the first customer testimonial I got on that page started with "Thanks so much for putting your book online."

I generally like stuff by Zed E. Shaw, though. Is there an official statement about this? Will he be making other books unavailable too?

</comment><comment><USER20> I actually emailed the author about this. He is in the process of revising the site for C. It will be available for free, or so he told me.

</comment><comment><USER21> For C++, there is a book called Accelerated C++ by Koenig and Moo. It was very enjoyable to work through it.

<comment><USER22> Their _Ruminations on C++_ book formed out of Koenig's columns is also excellent, if anyone is looking for an extra read. I have it on my desk right now :-)

<comment><USER21> How would you compare it to, for instance, Meyers' series of books?

<comment><USER22> Meyers is undoubtedly the master. Koenig certainly gives his own slant on things though and is enjoyable to read.

</comment></comment></comment></comment><comment><USER23> I've seen this referenced few times as a resource for learning C beyond the basics.

And my question for anyone who has gone through it, Is it worth the tag ?

</comment><comment><USER24> Wasn't this partially crowdsourced?

</comment><comment><USER25> From what I've seen the author sounds like an asshole that can't take criticism so I'm not sure I'd patronize his work either way.

</comment><comment><USER26> [https://github.com/davout/lcthw](https://github.com/davout/lcthw)

it's still available for free in other locations, just search.

<comment><USER27> Yes, you can usually find illegal copies of recent books. HN tends to frown on such links, though.</comment></comment>