Windows Hello – Biometric authentication to Windows 10 devices - <AUTHOR> http://blogs.windows.com/bloggingwindows/2015/03/17/making-windows-10-more-personal-and-more-secure-with-windows-hello/ <comment><USER2> I hope that PINs and such always remain alternatives to biometrics. My usual concern -- if the locally stored biometric data is compromised (malware, poor crypto, etc.), I need a way to "change my password", which isn't really possible for something like facial recognition. Likewise, I'm curious if there's a fallback authentication method for people who lose a finger, get their faces deformed, etc.

That said, the whole device-based authentication piece seems useful. A Windows 10 computer is now one factor in a 2FA scheme and the OS (and at least one of its browsers) gets to be directly integrated into Microsoft's SSO scheme.

<comment><USER3> You don't need to only worry about your device being compromised, your biometric credentials are being leaked by your mere _existence_.

Before long, I can imagine someone being able to build facial models capable of fooling recognition systems using only a few source images. Your finger prints are _everywhere_. Iris would be a bit harder, for now, but potentially possible with an image of high enough resolution.

<comment><USER4> Fingerprint and iris scanners have been compromised with nothing more than a high resolution image [https://www.youtube.com/watch?v=vVivA0eoNGM](https://www.youtube.com/watch?v=vVivA0eoNGM)

</comment></comment></comment><comment><USER5> As someone who actively researches biometric authentication, when I hear/read someone saying that biometrics are "usernames" and not "passwords", I automatically think they fundamentally misunderstand what a biometric is.

A biometric is both a 'username' and a 'password' \- for instance, when you access your computer/device/whatnot you type in your username and your password to identify to the system that _you_ are requesting access (on mobile the account is implied). When using a biometric, the system will have a stored template (similar to a password) that it associates to the system user account, and in ideal situations you (the user) do not need to do anything other than be present to access the system resources. It's a difference between identification and verification. Do you go to your friends each time they ask you something and say "are you so and so?", or have you already identified who they are? Based on the video it seems that MS is starting to understand this difference. Check out the video at ~2:35. He sits down at the login screen, and it just opens the desktop. For consumer applications this is really the goal of any biometric system.

Now spoofing and biometric template data being stolen are still real problems. Unfortunately, spoofing is not a very hot topic in the biometric field (usually conferences only have a relatively small percentage of papers on the subject), but given more consumer applications I'm hoping more funding will start to head that way. Concerning biometric template data, no you can't change it in it's most raw format, your fingerprint is static..that's what so great about it. However, there are methods such as key-binding where the template is itself encrypted with a private key. This however leads to more passwords... In any case, it's unfortunately up to companies like MS to start paving the way to successful implementations - if the data breaches we hear about almost monthly (Uber, Target, etc) are any indication, your password is just as at risk as your fingerprint.

<comment><USER6> "A biometric is both a 'username' and a 'password' "

This is true, but usually people don't go around showing their passwords to any camera they walk by or surface they touch. That is why people say that it is more appropriate for biometrics to identify someone than it is to provide their authentication.

"our password is just as at risk as your fingerprint."

Also true, but what do you do when these breaches happen if the data is biometric? You can't send out an e-mail asking people to change their fingerprints or face. With existing password infrastructures after a breach the infrastructure can be upgraded to prevent that breach, then the users can be told to change their passwords, then that vulnerability is closed. Once a person's biometric data is stolen (or just taken from the hundreds of sources of our biometric data we leave around daily in the form of pictures and fingerprints) that's it, you can't close whatever breach they used to get in and then move on, because the user can't change their "password" to one that has not been compromised. That account is forever breached.

Biometrics violate several of the requirements for something that can be used as authentication, which is why they are great as identifiers, but terrible as authenticators.

<comment><USER5> > usually people don't go around showing their passwords to any camera they > walk by or surface they touch. That is why people say that it is more > appropriate for biometrics to identify someone than it is to provide their > authentication.

Yea i see the point, but there will always need to be an asterisk after the statement, "a biometric is a username, not a password", because it's only valid in the sense there are concerns about the security of the biometric template. Down the line maybe we'll figure out this spoofing/liveness test thing, but we won't find out while many instantly write off the merit of the system to begin with.

> what do you do when these breaches happen if the data is biometric? You > can't send out an e-mail asking people to change their fingerprints or face.

I did mention this somewhat in the original post. Saving a raw biometric template (minutiae points or whatnot) is synonymous to keeping a database of plain text passwords. It's just wrong. The data breaches (Uber, Target, etc.) are proof that in 2015, we still have this problem. I would never trust a start-up or large corporation with consumer grade biometric authentication. However, on my laptop a different story...i've been using the Thinkpad fingerprint reader for years and love it.

<comment><USER7> > Yea I see the point, but there will always need to be an asterisk after the > statement, "a biometric is a username, not a password", because it's only > valid in the sense there are concerns about the security of the biometric > template. Down the line maybe we'll figure out this spoofing/liveness test > thing, but we won't find out while many instantly write off the merit of the > system to begin with.

Any sensor accurate enough to perform biometrics is simultaneously accurate enough to create a spoof capable of fooling the authentication sensor. The only way to avoid this requires an active activity, at which case you've just duplicated the password [e.g. the act of typing is identical to the act of sufficient action to make it virtually impossible to duplicate] which has better known security characteristics.

> I did mention this somewhat in the original post. Saving a raw biometric > template (minutiae points or whatnot) is synonymous to keeping a database of > plain text passwords. It's just wrong. The data breaches (Uber, Target, > etc.) are proof that in 2015, we still have this problem. I would never > trust a start-up or large corporation with consumer grade biometric > authentication. However, on my laptop a different story...i've been using > the Thinkpad fingerprint reader for years and love it.

A single breach and you cannot rely on biometric data for life is the reason this is only safe to use as a "username" and not a password. You won't be able to significantly change your biometrics w/o breaking other identification issues.

Biometrics are only valid as a username or secondary authentication factor.

<comment><USER5> >The only way to avoid this requires an active activity, at which case you've just duplicated the password [e.g. the act of typing is identical to the act of sufficient action to make it virtually impossible to duplicate] which has better known security characteristics.

Only way is active activity? Or just the only way you can think of?

>A single breach and you cannot rely on biometric data for life is the reason this is only safe to use as a "username" and not a password. You won't be able to significantly change your biometrics w/o breaking other identification issues.

You're assuming all recognition algorithms of the same biometric produce the same raw template. That if I get one I can gain access on another.

>Biometrics are only valid as a username or secondary authentication factor

It's often frustrating to discuss things with those who clearly know little about the topic and yet declare their opinion as fact.

<comment><USER6> >You're assuming all recognition algorithms of the same biometric produce the same raw template. That if I get one I can gain access on another.

Well, is that an unreasonable assumption? With passwords knowing what one person's password used to be or even knowing one hash of their current password tells you nothing about a different hash of their current password. With biometric data points presumably if they get accurate and detailed enough (which you already admit they would have to do to be a valid authentication mechanism) you can extrapolate. Faces are known quantities. Knowing how 999 points of your face are arranged _does_ give you data about how other points on your face are likely to be arranged. We already have modelling software capable of this, so it doesn't seem unreasonable that such methods may be improved if facial recognition gains traction. At the very least it brings down the solution space to a much smaller size the more data points are used, which is the opposite of what happens when more data points (characters) are used in alpha-numeric passwords.

>It's often frustrating to discuss things with those who clearly know little about the topic and yet declare their opinion as fact.

I would agree. Especially opinions like how others "clearly know little about the topic".

But is it as frustrating as someone explaining their reasoning for their statement and then you ignoring that reasoning to discuss their closing statement as the entire argument?

<comment><USER5> > Well, is that an unreasonable assumption? With passwords knowing what one > person's password used to be or even knowing one hash of their current > password tells you nothing about a different hash of their current password.

Yea it is, this is very different from a password, even though it's being used in a similar way. Lets take fingerprints as an example - algorithm A uses minutiae points, and algorithm B does a simple normalized cross correlation between the two images. While this is a toy example, you can see there is a clear difference in what is being stored or even hashed.

> At the very least it brings down the solution space to a much smaller size > the more data points are used, which is the opposite of what happens when > more data points (characters) are used in alpha-numeric passwords.

No, it doesn't. You'd have better luck using a facebook profile picture printed on an old inkjet than you would trying to use a specific template as the 'solution space' of what other templates may be.

> But is it as frustrating as someone explaining their reasoning for their > statement and then you ignoring that reasoning to discuss their closing > statement as the entire argument?

I admit that it wasn't the classiest way to respond, and i apologize for it (i'm not going to delete it though, i wrote it and i won't run from it), but the same arguments keep coming up over and over again, and it's very clear that the users making these statements not reading any previous replies so i wasn't going to waste my time going over all the points again and again.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Convenient, for sure.

However, I always have the choice of not giving up my passwords, under (even painful) threat. Also, someone cannot get my passwords if I am dead. Ever.

Unfortunately, with biometrics, it is quite easy to force me to put my face/finger/iris in front of the machine and unlock it. Even if I am (freshly) dead.

Not that cool, really.

<comment><USER9> Real talk: I feel like the demographic of people who read and comment on HN is primarily people for whom "painful threat" is purely theoretical. Downstream folks are talking about preventing information leak if the adversary is literally willing to kill you via torture.

In the real world, torture is a fairly effective way to make somebody divulge information, especially in the case where it can be readily checked (by trying the password they divulge). It's a fairly well proven fact that living beings will do pretty much anything to make the pain stop. For recent reference, this HN article, where he repeatedly complied with demands, even including lying about being tortured, in the hope that it would make the torture stop:

[https://news.ycombinator.com/item?id=9213753](https://news.ycombinator.com/item?id=9213753)

<comment><USER10> Not gonna lie, under threat of severe physical damage or death, I'd give away everything I know. Granted, I don't have access to nuclear weapons or anything, but I wouldn't care who gets effed up as long as I'm intact...

</comment></comment></comment><comment><USER11> I honestly think biometric is just eye-candy. The real interesting thing here is MS Passport.

Passwords are only broken because for most intended purposes they act as a symmetric key that you happen to leave around everywhere and when it leaks, you have a problem.

If we had a web standard for asymmetric key authentication, you just unlock your device and your device authenticates you. A leaked public key (created for a single service) is useless.

And once you only need to unlock ONE device, you might as well remember that single password, because at that point it is way more secure than a fingerprint.

Of course devices break and get stolen, so you need to back up your keychain, and I bet that is exactly what MS Passport does for you, which is why it will never be adapted by other vendors.

</comment><comment><USER12> One thing I like about passwords is that they give me the choice to _not_ unlock something, should I wish that, which isn't the case with biometrics. Say I'm a journalist who gets stopped at the border of a country and am asked to open up my computer. If I want to, I can refuse - and face the consequences but still, i can make that choice. With biometrics all they'd have to do is force my finger onto the scanner, or put the computer in front of me and scan my iris or face. That's a big downside.

Also, after everything we know about Microsoft and and the security services, there's absolutely no way I'd give them my biometric data.

<comment><USER13> That's not a downside. Why should you be allowed to smuggle contraband into the country?

<comment><USER12> I had the linked image in mind when I wrote that, of a journalist whose laptop was shot by Israeli border police whilst she was being interrogated.

[http://lilyasussman.com/2009/11/30/im-sorry-but-we-blew- up-y...](http://lilyasussman.com/2009/11/30/im-sorry-but-we-blew-up-your- laptop-welcome-to-israel/)

Actually the reference doesn't totally work in hindsight because she was never asked for her password, but it seems as though it was encrypted and hence they just destroyed her laptop instead of asking her for the pw. If it had biometrics they might have just forced her to open it. So actually, the example might work after all.

<comment><USER13> If you are unwilling to allow border guards to inspect something you are attempting to bring into their country, then you should be prepared for them to tell you to leave it outside at best or punish you for attempted smuggling at worst. I am skeptical of the story you linked as it's entirely from the perspective of the smuggler, but I don't see any reason to believe anything wrong happened there.

</comment></comment></comment></comment><comment><USER14> _with technology that is much safer than traditional passwords_

From what I understand this is simply not true - could someone with a security background weigh in if this statement has any basis (were they comparing to <first_name>-"1234" and "user"-"password")?

</comment><comment><USER15> I'd love to understand more about how the face recognition works. Does it have any way to combat someone just printing out a picture of your face and holding it up? I've done some simple face recognition stuff with OpenCV and it's super easy to fool with photos.

<comment><USER16> _Windows Hello uses a combination of special hardware and software to accurately verify it is you – not a picture of you or someone trying to impersonate you. The cameras use infrared technology to identify your face or iris and can recognize you in a variety of lighting conditions._

and later in the webpage:

 _all OEM systems incorporating the Intel® RealSense™ 3D Camera (F200) will support the facial and iris unlock features of Windows Hello_

So by reading this we can assume it does more than 2D recognitions since this is a "3D Camera"

<comment><USER17> 3D models have been created out of 2D images before. I'm not saying this will be hackable from day one, but it will probably take a few short years for a well sponsored and motivated attacker. Hopefully the technology will also keep up and within a year or two we'll see updated versions that make it even harder to replicate.

However, if I were to pick, I'd go for fingerprint recognition instead. Images of people's faces are everywhere online. It's much less likely to have a good photo of your fingerprints.

</comment></comment></comment><comment><USER18> They claim physical access for "hacking" is required, but that is not true. As long as you have a root access on a device you can do anything from anywhere. I don't see how this replaces or improves passwords from this perspective. Yes it is easier for the user, since they don't have to remember the password, but everything else stays the same.

<comment><USER19> > As long as you have a root access on a device you can do anything from > anywhere.

As Raymond Chen likes to say, "it rather involved being on the other side of this airtight hatchway." Once you have root, yes, you have compromised the machine.

<comment><USER20> But if it is a biometric password then you compromised all machines of a user.

</comment></comment></comment><comment><USER21> Biometrics sound like the next frontier for milking licensing revenue. Pretty soon they will offer a discounted license for office, but only for one biometricly identified user. Multiple users, such as library users, will require the special license, even though they are all using the same computer.

<comment><USER5> Never thought of this...i hope not.

</comment></comment><comment><USER22> I hope this will make laptop vendors and others include IR capabilities in their devices, and that those are usable outside Windows Hello. Would be cool to see what other uses people could come up with, for this "baby-kinect".

</comment><comment><USER23> It would be interesting if Cortana would get speaker recognition on top of speech recognition. Plus, she could ask you a question based on something (maybe whom you met for lunch a few days ago)to counter recorded voice attacks.

</comment><comment><USER24> This was demoed to my employer when Microsoft came through a month ago. I was not impressed -- biometrics are a username, not a password.

edit: the article does not cover using your voice. I'm 99% sure they demoed to us the ability to use a custom phrase to authenticate with your voice as well.

<comment><USER25> > biometrics are a username, not a password.

Can you clarify what you mean by that. People like to parrot it, but few if any will explain why they feel that way.

If you simply mean that you don't find it secure enough, wouldn't that really depend on the use-case? For example, what may not be secure enough to log into a DC, may be secure enough to let the secretary log into their computer which just has access to address books and calendars. It is all relative.

Some biometric systems are fairly secure, like fingerprints. The cost and skill required to extract and reproduce a fingerprint so it is scannable make it a non-trivial affair. While the security services and a dedicated adversary could, for 80%+ of normal computer users it is a non-threat.

Android's face unlock may have been trivially beaten but it reads like Microsoft are using multi-level photography (i.e. both IR for under-the-skin and visible light for on-the-skin) to extract a layered model of a person's face and head which could (maybe) prove harder to bypass with just a photograph.

<comment><USER26> Biometrics is identification, not authentication.

It identifies who you are talking to, which is not the same as confirming who you are talking to (verifying authenticity of identity.)

<comment><USER27> An iris scan does not identify who you are talking to. A fingerprint scan does not either. These are unique to an individual, if they were the person who set them up, then it is, in 99% of cases, a unique element to a person that can be used to authenticate them.

That's a whole of a lot better than a password, which _can_ be shared by multiple people.

</comment></comment></comment></comment><comment><USER28> Great! While we're at it: Can i please use my Microsoft Account to Remote Desktop into any currently available Device that is registered to my account, without having to jump through the hoops of doing all the port and network configuration beforehand?

</comment><comment><USER29> Great! Now the FBI does not even have to arrest me to get my fingerprints and retina scanned!

<comment><USER30> The video says it never stores image on the device: [https://youtu.be/1AsoSnOmhvU?t=3m12s](https://youtu.be/1AsoSnOmhvU?t=3m12s)

I'd assume it's doing the equivalent of password hashing, so the authentication mechanism just verifies a hash match.

</comment></comment><comment><USER31> I don't think I'm comfortable with this.

</comment><comment><USER17> They say the passwords or biometric data will be kept in hardware - what does that mean exactly? Is it the TPM? TPM 1.2? 2.0?

</comment><comment><USER32> The only insecure part about passwords is the human element.

<comment><USER18> What about password website leaks? Surely that is not my fault.

Technically that is also the human element but I think you are talking specifically about users.

</comment></comment><comment><USER33> 3d camera!!..next what? Kinect inside may phone/laptop..wow..!!</comment>


Is Object-Oriented Programming a Trillion Dollar Disaster? - <AUTHOR> https://developers.slashdot.org/story/19/07/22/0426201/is-object-oriented-programming-a-trillion-dollar-disaster <comment><USER2> There are times where in Lisp, OOP makes things so much easier and clearer. The way that Lisp does OOP (should you choose to even use CLOS) is fascinating and comprehensive. But as with everything else in Lisp, style is personal, and you aren't locked in to any particular set of rules in that regard.

But I do get the subtlety whereby Java's implementation (and everything that came thereafter) is what the author is poking at.</comment>


Linux 4.19 - <AUTHOR> https://lkml.org/lkml/2018/10/22/184 <comment><USER2> The first version which boots on RISC-V hardware (and QEMU) out of the box. Previous versions needed out of tree patches[1] for essential IRQ and device driver support. Excellent work by many people getting these upstream.

[1] [https://github.com/riscv/riscv-linux](https://github.com/riscv/riscv- linux)

<comment><USER2> I'm afraid to say there's a small correction after I went to the RISC-V BoF tonight[1]. This kernel only boots on QEMU (which I had tested), but still requires a small number of driver patches to boot on the HiFive Unleashed board - I did not get around to testing this because our boards are all consumed building Fedora and it's not very convenient to reboot them. They are expecting these extra drivers will be upstream in 4.20.

[1] [https://osseu18.sched.com/event/Fwx7/bof-risc-v-sw- ecosystem...](https://osseu18.sched.com/event/Fwx7/bof-risc-v-sw-ecosystem- status-and-needs-atish-patra-western-digital-olof-johansson-palmer-dabbelt- paul-walmsley-risc-v)

</comment></comment><comment><USER3> See summary at [https://kernelnewbies.org/Linux_4.19](https://kernelnewbies.org/Linux_4.19)

<comment><USER4> From the page:

> Add EROFS (Enhanced Read-Only File System), a lightweight read-only file > system with modern designs for scenarios which need high-performance read- > only requirements, eg. firmwares in mobile phone or LIVECDs

and

> It is a experimental project, under the staging directory, and still expects > to make changes to the on-disk layout.

I see it's included in the 4.19 branch of the Raspberry Pi fork of the kernel as well.

[https://github.com/raspberrypi/linux/tree/rpi-4.19.y/drivers...](https://github.com/raspberrypi/linux/tree/rpi-4.19.y/drivers/staging/erofs)

There is no public, open source mkfs utility/integration for it yet far as I can tell, but it seems from the original public announcement of EROFS on LKML that it will be released eventually.

> the open source of erofs-mkfs is _still_ in progress, it will be released as > soon as the internal process ends.

[https://lkml.org/lkml/2018/5/31/306](https://lkml.org/lkml/2018/5/31/306)

<comment><USER5> That's really nice. I remember having to use Read-Only on a few Raspberry Pi projects because they have a tendency to corrupt SD cards. Getting a free storage performance boost would really improve usability for my past use cases.

<comment><USER6> I recommend only writing when it is necessary, so e.g. you might want to log to /dev/null or tmpfs (I chose the latter but it adds up in RAM). Also, disable swap if at all feasible.

On top of that I recommend industrial grade SD cards using (a)MLC. They might be a bit more expensive but it is worth the stability.

I learned this from these posts (among others in the same thread 'Raspberry Pi microSD card performance comparison') [1] [2]

[1] [https://news.ycombinator.com/item?id=16776344](https://news.ycombinator.com/item?id=16776344)

[2] [https://news.ycombinator.com/item?id=16777238](https://news.ycombinator.com/item?id=16777238)

<comment><USER5> Thanks for the links, they were good reads.

Coincidentally, for those projects I did end up mounting to a tmpfs, syncing configs from a server, and writing them to a SPI flash chip with FEC. Fun to know that others suggest the same!

I was just thinking along the lines of performance improvement for the absolute garbage SD card speeds. I just remember how flipping long it would take to load a program off those things.

</comment></comment></comment></comment></comment><comment><USER7> Although it doesn't specifically mention it, this kernel supports Apple's Magic Trackpad 2, which is a real blessing.

Original source: [https://github.com/robotrovsky/Linux-Magic- Trackpad-2-Driver](https://github.com/robotrovsky/Linux-Magic- Trackpad-2-Driver)

I've been using this since last night, and with some tweaking, it works really well.

<comment><USER6> With haptic feedback support? That's amazing, I just bought one of these (as it is the best trackpad available by a long shot). Even Windows doesn't support this. I did find this one [1], but it doesn't seem to be signed so a shady source.

[1] [http://extramagic.forbootcamp.org/](http://extramagic.forbootcamp.org/)

<comment><USER7> Not sure about haptic feedback yet.

For Windows, try [https://github.com/imbushuo/mac-precision- touchpad/releases](https://github.com/imbushuo/mac-precision- touchpad/releases)

I went through a lot of sketchy drivers like that one you mentioned, but this one worked the best without any helper apps to mess around with.

Its a shame its taken so long for other OSs to support such a great device.

<comment><USER6> Thanks for the link. I did search quite a bit, but I did not find that one.

I noticed a few things from the link: the Apple Magic Trackpad 2 support is "not stable", and it does not appear to be usable via Bluetooth.

<comment><USER7> With Linux, the latest kernel will allow for bluetooth connectivity. If you search for `Linux Magic Trackpad 2` you'll see some of the discussions.

It takes a bit of messing around, but once you get it, it'll stay working nicely.

One issue I had with Linux, which is probably an easy fix, is that Powertop wanted to sleep the trackpad after 10s of non-use.

With Windows, I tried to get the bluetooth working on a non-bootcamp install and couldn't get it going. I don't doubt that they'll sort it out. A few versions of W10 ago some were using the bootcamp drivers with moderate success.

</comment></comment></comment></comment></comment><comment><USER8> I've read a few things about the latest happenings with regards to Linus and the kernel, but I feel like I'm missing something here. Can someone summarize for me, or point me at a good summary?

Edit: Who is Greg KH and why is this significant and what is the relationship between Greg KH and Linus (and the community)?

<comment><USER9> Regarding Linus, he spoke to the BBC and explained in his own words his position: [https://www.bbc.com/news/technology-45664640](https://www.bbc.com/news/technology-45664640)

This ZDNet article summarizes some of the points Linus made, if you want the short version: [https://www.zdnet.com/article/linus-torvalds- answers-5-quest...](https://www.zdnet.com/article/linus-torvalds- answers-5-questions-in-bbc-letter/)

<comment><USER10> Haha, I found a possible Freudian slip in the article: "Code of Conflict (CoC)". Yes, it says "Conflict", which is unintentionally true, as it indeed caused more conflict than not. [1]

[1] Archived: [https://web.archive.org/web/20181011105751/https://www.bbc.c...](https://web.archive.org/web/20181011105751/https://www.bbc.com/news/technology-45664640)

<comment><USER11> The Code of Conflict is a real thing, predating the current mess

[https://www.linuxfoundation.org/blog/2015/03/on-the-linux- ke...](https://www.linuxfoundation.org/blog/2015/03/on-the-linux-kernels-code- of-conflict/)

</comment></comment></comment></comment><comment><USER12> I think all this handwringing over the CoC would have more weight for me if:

a) It came from major Linux contributors.

b) It didn't assume a conspiracy to not only oust Linus but also get him to dance to their tune.

<comment><USER13> You're using a line of argument that I see quite often in day to day stuff (outside the kernel) so I have to push back on this.

>would have more weight for me if [...] It came from major Linux contributors.

The group of people you would give the most weight to the opinion of are also the group under the most pressured not to voice dissent publicly.

It isn't wrong to look to them or give large weight to their positions. The error is in assuming that we can know their position beyond their choice not to rock the boat. It might be very easy (they're in full agreement) or very tricky (blood boiling, but "not their hill to die on").

All we know is that they do not dissent to the level that they are willing to risk their involvement in the project at hand, or have a damaged reputation when they try to participate in another.

<comment><USER12> Perhaps. But usually if their blood is boiling they will leak indirectly as anonymous sources, via unnamed "friends", or whatever other euphemism the press likes to use.

</comment></comment></comment><comment> jf- I'm seeing a lot of people stating that they're worried about this code of conduct. Since I've not read it or any commentary about it, can someone tell me why it's so worrying? Is there a sincere fear that Linux will be damaged as a result? If so, how?

<comment><USER14> Here is a good starting point to research the critique of this document: [https://bugs.ruby-lang.org/issues/12004#note-6](https://bugs.ruby- lang.org/issues/12004#note-6) . Its point is particularly apt:

> Given a choice between only two extremes, I'd far rather have Linus Torvalds > telling me I'm an idiot and my code is shit, then exist in an offense taking > culture where various forms of criticism are re-branded as "harassment."

However, the Linux copy has cut one of the more malicious paragraphs: [https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c1d1ba844f01e747aa0272a4ee5c886024cd90eb)

<comment><USER10> I would like to extend this point: "I'd rather have Linus Torvalds telling me I'm an idiot and my code is shit, than ... releasing kernel with my shitty code and EVERYONE thinking that I'm an idiot".

<comment><USER15> But this is a false dichotomy.

They could just refuse your code without calling you an idiot.

<comment><USER16> Of course there exist examples of Linus calling or even implying that individual people / organisations are "idiots" and they are wrong (and he has acknowledged this). But in the vast majority of cases the criticism is aimed at the code itself and I genuinely don't see the issue with this.

<comment><USER15> Neither do I

</comment></comment></comment></comment></comment></comment><comment><USER17> The guy managed to write more about himself than the patch. Is this the new format? I thought I was reading a Medium blog post.

<comment><USER18> It's the first time that he's the one to sign off the release rather than Linus, so it's appropriate to explain a bit.

</comment></comment><comment><USER19> Linus may have been sincere in his writing, people saw him as this verbally abusive boogeyman who would tear people apart, which led him to become that type of person more and more.

The embrace and extend going on over in Redmond right now is threatening though, what better time to use your clout and power over a competitors org (that your a member of now) than when you have forked what depended on their software, extended it to work on your platform, and now want to take the wind out of their sails.

The recent reaction from Valve is telling, I think Gabe is fearful about the current state of affairs. We really don't know all the pieces of this puzzle though, so best to watch our backs. Avoid vendor lock-in, its the devil.

<comment><USER20> Can you provide more context re: "The recent reaction from Valve is telling, I think Gabe is fearful about the current state of affairs" ?

<comment><USER21> I think it's a reference to steam proton, a compatibility layer they built to run windows games on linux.

</comment></comment></comment><comment><USER22> Related: [https://lkml.org/lkml/2018/10/22/188](https://lkml.org/lkml/2018/10/22/188) Can't agree more.

</comment><comment><USER23> Having someone else manage merges into the stable kernel branch isn't new. In the old kernel dev model (circa 2.x kernels) after the first few patches in a new stable kernel, Linus always used to delegate stable maintenance to someone else (Alan Cox) so he had more time to work on the experimental branch. So Alan would maintain 2.0 and Linus 2.1 for example.

</comment><comment><USER24> Some important fixes in amdgpu for Vega there. It's finally waking up from sleep properly when using DisplayPort.

<comment><USER25> This was my biggest issue with 4.17 & 4.18. I just recently upgraded my system to a Ryzen 2400 and I have had quite a few issues. Keeping up with the latest kernel builds with ukuu has helped but it would be nice to have a stable kernel that works with my CPU/GPU. Hopefully, 4.19 will make it to stable tonight and I can upgrade tomorrow. :)

<comment><USER24> I have Vega 56 and was bugged by it in 4.17/4.18 cycle. Finally 4.19-rc fixed it. But there are a few DisplayPort 1.2 related annoyances that still remain.

</comment></comment></comment><comment><USER26> OpenCV 3.4.2 not capturing Picam on Raspberry Pi 3.

</comment><comment><USER27> I think the code of conduct stuff worked out well in the end, especially as cooler heads prevailed.

In the `code-of-conduct-interpretation.rst` document they write:

``` The initial Code of Conduct Committee consists of volunteer members of the TAB, as well as a professional mediator acting as a neutral third party. The first task of the committee is to establish documented processes, which will be made public. ```

``` Any decisions by the committee will be brought to the TAB, for implementation of enforcement with the relevant maintainers if needed. A decision by the Code of Conduct Committee can be overturned by the TAB by a two-thirds vote. ```

Ultimately this tempers the worries of many about the C-o-C resulting in a tool used by those with politically charged agendas.

<comment><USER28> Is it a worry, rather than simply being crass, when the author of the CoC herself has said that it is indeed a political document[1]?

[1] [https://twitter.com/CoralineAda/status/1041465346656530432](https://twitter.com/CoralineAda/status/1041465346656530432)

<comment><USER19> The CoC being a political document is expected, it is laying the boundaries that define acceptable behavior, an inherently political task.

On that ssamw tangent, the GPL series of license is inherently political. I personally like the political ideology espoused, but some do not despite how other licenses leave these developers with many users and proprietary forks, buf no added code, docs or community.

<comment><USER29> > The CoC being a political document is expected

I agree that both CoC and GPL are political.

Developers need to understand something: CoC a political document written by someone opposing one of important principles of free software, meritocracy. [https://postmeritocracy.org/](https://postmeritocracy.org/)

Now here's a big difference: linux was developed under GPL from the very beginning. If you didn't like the politics behind GPL, you didn't contribute. Now, there are people who try to push their politics everywhere, because "everything is political", even math. Why should you accept their politics? Why should linux change its politics? Why must CoC be accepted? Why should developers accept the politics of CoC, after making contributions under promises of GPL?

<comment><USER30> I'm a huge fan of CoC's.

It allows us to codify the spirit of the law, to be used as a fall-back plan when the letter of the law is being gamed. CoC's allow judgement, in contrast to zero tolerance policies which prohibit judgement.

One of orgs I volunteer for had our own #metoo drama. Actual rape, assaults, harassment, etc. Some stomach turning stuff. It made the news. There have been some out of court settlements.

Per the bylaws, we didn't have any way to remove the perpetrator. Adopting a CoC allowed the org membership to impeach the leader. (Maybe like a vote of no confidence works in parliamentary systems.)

Concerns about CoC's being weaponized, misused, abused... Whatever. Of course there's always oversteer, friendly fire. As if abuse didn't exist before CoC's.

I happily accept those occasional failures and let the balance be figured out over time. Rather than going back to denial and inaction.

In other words, I choose 98% awesome over 100% terrible, and happily work to further reduce that 2% gap.

<comment><USER31> > In other words, I choose 98% awesome over 100% terrible, and happily work to > further reduce that 2% gap.

Made up percentages but I understand what you are trying to convey.

</comment></comment></comment></comment></comment></comment><comment><USER32> I feel really worried about the Kernel project now that they have let Identity Politics breach their walls. These kind of things have a tendency to split a community rather than unite it.

The kernel project is surely one of the most successful software projects ever. Having survived for 20 years, why change a winning formula?

I have always considered Linus un-political and more interested in getting sh*t done and getting it right above anything else, so why he would sign-off on this is a mystery to me.

<comment><USER33> The community was already split. Those who tolerated his behaviour and those who didn't.

<comment><USER32> I don't think it was, at least not that black and white. If the community really was that split the project would not have survived for 20 years. Surely we would have seen a fork where the involved factions split off.

I think this is a very vocal minority in play here. From my understanding these changes did not come from any of the core contributors but rather from activists. The used divide and rule; if you don't sign off on our political documents you are with "them" and we will let everyone know what a horrible human being you are.

<comment><USER33> I said nothing of how big the split was.

It seems the loud voices about how bad the CoC is aren't actually kernel devs...

But there is atleast one known kernel dev who spoke up about Linus' behaviour, and eventually just quit developing for the kernel.

edit: not to mention those who don't want to touch the kernel because of his behaviour. one guy said the only contributions he makes to the kernel are for his employer. if it wasn't for that, he'd not touch it.

<comment><USER34> So out of ~6k developers you only know of two malcontents? I don't think that is what 'split' means.

</comment></comment></comment></comment></comment><comment><USER22> It is very disturbing for me to see Greg KH being at the top and deciding what goes into Linux. There is history of agenda that doesn't align best with kernel user interests. Can't forget d-bus events very related to this person. I did switch to FreeBSD couple of years ago but I love linux and it is not easiest to observe all the latest events.

<comment><USER35> Greg KH already decides what goes into the "stable" Linux series (4.y.z, for instance 4.18.15), which is what most people actually use. Besides, he assumed after the 4.19 merge window, and he's handed the 4.20 merge window back to Linus; it's in the merge window that new features come in (after the merge window closes it's mostly only bugfixes), so it's still Linus who gets to decide.

<comment><USER22> Is stable different from latest? I am not sure how much independent decision space he has, otherwise we would have d-bus in stable long time ago. Maybe I don't know the process well enough but I would be surprised that Greg can merge something that isn't approved in latest.

Fingers crossed it is only 4.19, I am kind of seeing this as a bigger event but I may be wrong.

<comment><USER36> Parent poster was referring to the "LTS" kernels: [https://www.kernel.org/category/releases.html](https://www.kernel.org/category/releases.html)

A good number of Linux distributions are based on an LTS release instead of a mainline release.

<comment><USER22> Yes, I am aware of that but are LTS kernels in any for different from the mainline kernel? Can LTS kernel contain code that is not approved and tested in mainline first? They are 'older' but they contain same feature set that is already approved by Linus, right?</comment></comment></comment></comment></comment>


Ask HN: Who hires Infosys and Cognizant? - <AUTHOR> Infosys and Cognizant are everywhere. Who actually hires them and how are they so massive? Has anyone personally worked for them? Or used them as a client? <comment><USER2> Loads of companies do! Mostly bigger companies though. They've got tons of IT resources in India, resources that are scarce & expensive in US/Europe. So they outsource IT work for you while having consultants at the client as liaison between business & the outsourced development.

</comment><comment><USER3> Most fortune 500's. It takes a lot of time and effort to build a good development team. So once you have swapped internal for external it's very difficult to bring it back in house.

Going from a good team of 10 developers to a good team of 100 developers can easily take 5 years if you want to maintain quality. And you probably won't see major dividends for another 5 years on top of that. How many senior managers are invested enough in a company to take a 10-15 year view on it?

On the other hand if I need a $50 million project finished within the next year I can get 150 average quality developers next week from Infosys.

<comment><USER3> Now as a startup if you are trying to compete with the big players who have 100x as much capital you need the top 20% developers. And you won't get them going through the consulting giants.

And having someone to blame is very important for a senior manager.... But useless for a startup founder or small business owner.

</comment></comment><comment><USER4> Yes, we have a large cognizant contract right now. My company has hired about 300 cognizant resources both onshore and offshore. The overall strategy seems to be leverage each employee with ~5 contractors. All employees are actually just product managers, PMs and SMEs and management. All dev, QA, dev ops, dba, networking, L1-3 monitoring etc has been outsourced.

I also used to work for a well known national retailer who employed a similar strategy. There were only ~40 employees running a project of 400 people, 3 years and $100M. It's a common approach.

</comment><comment><USER5> You can public companies file annual reports that explain the basic operation of their business.

Infosys reports they focus on the following industries [1]:

      Financial services
      Manufacturing
      Retail, consumer packaged goods, logistics
      Energy, Utilities, Communications
      Life Sciences, Healthcare & Insurance

I wouldn't hire them, but I'm not Proctor and Gamble so they'll probably survive my disinterest.

[1] [http://www.infosys.com/investors/reports-filings/annual- repo...](http://www.infosys.com/investors/reports-filings/annual- report/form20f/Documents/form20F-2015.pdf)

</comment><comment><USER6> [https://www.google.com/search?q=infosys+case+studies](https://www.google.com/search?q=infosys+case+studies)</comment>


Discord Postmortem from Friday - <AUTHOR> https://status.discordapp.com/incidents/qk9cdgnqnhcn <comment><USER2> It's worth noting that the instance migration basically null-routed the redis VM for a good 30 minutes, until we manually intervened and restarted it. The instance was completely disconnected from the internal network immediately following the migration. From what we could gather from instance logs, the routing table on the VM was completely dropped and it could not even connect to the magic metadata service (metadata.internal - we saw "no route to host" errors for that). This is a pretty serious bug within GCP and we've already opened a case with them hoping they can get a fix. I think this is the 4th or 5th major bug we've encountered with their live migration system that could have, or has led to an outage or internal service degradation. GCP team has seriously investigated and fixed every bug we've reported to them so far, so props to them for that! Live migration is incredibly difficult to get right.

We believe this triggered a bug in the redis-py python driver we use (specifically this one: [https://github.com/andymccurdy/redis- py/pull/886](https://github.com/andymccurdy/redis-py/pull/886)) that made us have to rolling restart our API cluster in the first place, to get the connection pools back into a working state. redis-sentinel had appropriately detected the instance going away, and initiated a fail-over almost immediately following the instance going offline, but due to the odd network situation that was caused by the migration (absolute packet loss instead of connections being reset) - the client driver was unable to properly fail-over to the new master. We already have work planned for our own connection pooling logic for redis-py - as right now the state of the drive in HA redis is actually pretty awful, and the maintainer doesn't appear to have the time to close or look at PRs that address these issues (we opened one that fixes a pretty serious bug during fail-over in march [https://github.com/andymccurdy/redis- py/pull/847](https://github.com/andymccurdy/redis-py/pull/847) that has yet to be addressed).

<comment><USER3> For those of us unfamiliar with GCP, do you mean that the default-route of your VM was unable to route its traffic? Or is there a routing config running on customer VMs that GCP live-manages?

<comment><AUTHOR> GCP has a virtual networking stack to support a bunch of crazy (and awesome) features Google has built. Unfortunately the complexity here seems to hurt power-users like us. In this case it appears that for some unknown reason the node failed to program its network stack when coming up, meaning it was completely unavailable (even the metadata service used internally by google failed).

</comment></comment></comment><comment><USER4> The level of detail and linearity is impressive.

At this scale, it seems like it may be warranted to start using reliability testing in production in like with Netflix.

At the end I see mention of a library with flaws. I am curious as to which library that is, given I develop some projects in Elixir.

<comment><AUTHOR> Thanks, we try our best with these. Past experience has shown they can be very valuable, and help everyone at the company get context on the system and how we handle failures.

Reliability testing is definitely something we're interested in as we spin up more SRE/reliability focused individuals, but also has probably the least amount of cost-benefit for us (compared to engineering effort on improving the things we know need work). Some of the failure in the system we experienced is related to issues we know about, but haven't prioritized (read; had time for) yet.

For the library, we believe the bug is related to hackney and the fact it uses the high priority setting for its pool process. For some reason (this is the part we're not entirely sure on, and still spending some time investigating) this high priority process got stuck and consumed all of the scheduler time (presumably related to the earlier API degradation), breaking the distribution port and the application in a weird way. Oddly enough the systems we run on are SMP, so in theory one rogue process should not be able to have this effect.

<comment><USER4> That is indeed very odd! Thank you for sharing. Hackney, through another library, is used in a telegram api wrapper that I wrote up. Though my stuff usually runs on a $5 vps, nothing with multiple cores.

</comment></comment></comment><comment><USER5> Ever since they launched screen sharing, I've uninstalled both Skype and Hangouts and relied entirely on it for pair programming sessions. The smoothness of the reproduction is just incredible, and I don't see myself going back soon.

</comment><comment><USER6> I'm really impressed. I was using Discord for most of this weekend, specifically Friday and Saturday. Never noticed any issues.

<comment><USER7> They don't have a posted outage for Saturday, but I noticed issues with it on Saturday evening/night I believe. I'm wondering if it was related to the issues that they included in the post-mortem.

<comment><AUTHOR> Very possible you saw a slight interruption around 11:30PST for around 10 minutes until we found and decommissioned the host that experienced this problem. We generally don't update status until we can verify impact/source, we see tons of limited outages from ISPs misbehaving.

</comment></comment></comment><comment><USER8> We had the exact same issue with RMQ (HA setup) on GCP (running on GKE) a few weeks ago. Tried contacting support about this, it's paid - no customer support for their own bugs.

The solution we came up so far is to disable automatic migrations. Not sure if that option actually does anything.

<comment><USER9> You can't disable automatic migrations in GCP. You can choose between allowing live migrations (move the instance while it's still running) or (hard) instance reboots.

<comment><USER8> You're right. I meant hard reboots.

</comment></comment></comment><comment><USER10> Does anyone use discord for work?

<comment><USER11> I have informally with co-workers. But not in any official capacity.

It's like 20x better than every other product out there though. And their new video chat + screen sharing is pretty great. The bandwidth is far higher than any other competitors I've used.

My brother and I were playing 1080p videos on each of our screens and watching the other's, just to test it out. Obviously it wasn't full quality, but it kept the frame rate up and looked presentable at least to 720p.

<comment><USER12> Weird, I find Discord's audio quality especially to be terrible.

And their lack of scalable monetization leads me worried about its longterm success as a platform - they are adding more cost-intensive features and continuing to try to support it with what is essentially a $5 monthly donation model.

<comment><AUTHOR> Can you give more explicit examples of the bad audio quality you experience? I'd be happy to forward this onto our native team to look into if there are some concrete things they can look at. Generally 99% of the audio issues we see people experience are due to ISP/peering/DDoS/etc issues, most of which are handled automatically by our servers within a few minutes.

<comment><USER13> FWIW, a serious feature that I would pay you money for right-here-right-now is the ability to multitrack audio. Let me give you many dollars to route each voice to a separate Soundflower channel, so that I can mix them outside of Discord, and I will give you said monies. I'm pretty sure you're even sending unmixed streams down? But I can't get at them!

This probably involves not being Electron (from my own adventures in the area), so I don't hold out much hope, but it keeps Discord from replacing Extremely Expensive And Bad solutions like SkypeTX for me.

<comment><USER14> The first thing I was thinking is using PulseAudio somehow. It has some bad image issues but its swiss-knife-of-audio-routing chops are undeniably present. It's Linux only though, so probably wouldn't be useful here.

I'm trying to figure out what the actual context in question is, particularly in terms of technical connectivity. Is this being used for remote DJing? Or conferencing? Or an audio recording situation?

If you're prepared to throw money at the situation, it's _possible_ this may be fixable with a simple bespoke solution. I say "possible" because, unfortunately, I just did some digging and found [https://bugs.chromium.org/p/chromium/issues/detail?id=453876](https://bugs.chromium.org/p/chromium/issues/detail?id=453876):

> _Unfortunately we don 't support multi-channel > 2 nor multiple devices at > the moment._

> ...

> _Are there any future plans to support these two features? Is this a w3c > issue or a Chrome issue?_

> ...

> _I am quite skeptical about this; I was told this requires a huge change in > our WebRTC-side infrastructure, but I am not sure what the current status > is._

> _The spec indicates getUserMedia can be configured with 'channel count', so > I assume this is Chrome issue._

That immediately nukes WebRTC :(

Could make for a fun project. I'm very fascinated with audio handling myself and this sounds interesting, but I'm unsure I'd personally have the skills (or mental stamina/attention span :< ) to be sure I could follow through. I'm also only on a Linux box, which brings up the platform-native problem.

<comment><USER13> Sorry, just saw this. I need to split audio to mix and level it for stuff like live-streamed podcasts. So, on top of that, I need to pull video.

Honestly, the best answer is probably to continue using multiple Skype instances. Which is gross. But, y'know.

<comment><USER14> It's fine - you actually saw it, which is cool :) some of my other past replies have gone completely unnoticed

I see. I get the impression this is collaborative podcasting with multiple people that have multiple microphones. (I can't figure out why else you'd need multichannel A+V transport.) FWIW, it does sound like Skype is probably your best bet for the time being (unfortunately). It's simple, it works for everyone, etc.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> Funny definition of HA. :)</comment>


Huge breakthrough in "direct to brain" learning - <AUTHOR> http://www.nzherald.co.nz/technology/news/article.cfm?c_id=5&objectid=10774546

<comment><USER2> Man I hate pop science articles that don't give any way to find the original research. Here's the full text: <http://www.ncbi.nlm.nih.gov/pmc/articles/PMC3297423/>

So basically, forget everything you read in the Herald article. Except for this quote:

>A more understandable analogy could the scene from the action movie The Matrix where the star, Keanu Reeves learns kung fu by being plugged into a machine - except this method is considerably less invasive.

Remember that quote as an example of when you should stop reading a science article and start digging for the actual study.

</comment><comment><USER3> This is yet another case of reporters grossly exaggerating a discovery. It was discussed 10 months ago on Less Wrong: <http://lesswrong.com/lw/8th/link_matrixstyle_learning/>. Here's the actual paper: [http://commonsenseatheism.com/wp- content/uploads/2011/12/Shi...](http://commonsenseatheism.com/wp- content/uploads/2011/12/Shibata-et-al-Perceptual-Learning-Incepted-by-Decoded- fMRI-Neurofeedback-Without-Stimulus-Presentation.pdf)

Also, it was already known that parts of the brain can be programmed by visual stimuli. See <http://en.wikipedia.org/wiki/McCollough_effect> and <http://www.cheswick.com/ches/projects/me/index.html>.

</comment><comment><USER4> Is this New Zealand's version of The Onion? Also, the "article" is from 8:18 AM Wednesday Dec 21, 2011 and the "X-ray picture" should remove the last doubts.

I have to admit, although I was in disbelief from the beginning, it got me quite excited and at some point thinking "Wow, if this is true, I should dropp everything and get into this field NOW"

Nice prank to make it to the front page.

</comment><comment><USER5> This is a crap link, and as such doesn't belong on HN at all.

<http://ycombinator.com/newswelcome.html>

"Essentially there are two rules here: don't post or upvote crap links, and don't be rude or dumb in comment threads."

Several helpful comments have already pointed out that the press release submitted here is full of wrong factual statements. Moreover, it is old and thus now "news." I have flagged it, which is all anyone can do about a crap submission in the absence of being able to downvote submitted articles.

</comment><comment><USER6> The actual article is not nearly as shocking as the hn title. They have not been able to implant any thougths yet. What they did was merely put people in a mental state where they can perform certain actions better.

<comment><USER2> No, they didn't even do that.

What they did, in a nutshell, is show strong evidence that the adult visual cortex can be trained. There's a lot of discussion about "induction" here, but the only intervention here was presenting them with images.

The experiment goes like this (as far as I can tell):

1\. Have a bunch of subjects perform a multiple choice visual identification task and scan their visual cortex with an fMRI while they do it.

2\. Build a statistical model that lets you predict, based on an fMRI, which of the three answers the respondent gave.

3\. Have the subjects do more of the same kind of test, repeatedly, but without answering; just have them stare for six seconds. Use the statistical model to classify which answer they would give, and show them a circle that gets larger depending on how strongly the model classifies the answer as correct. Ask subjects to maximize the size of this circle without telling them what it means.

4\. Repeat step 1 and measure the change in accuracy.

What did they find? The subjects improved at the task, even though they didn't know what they were supposed to be doing.

Incredibly cool, and completely unrelated to "direct to brain" learning.</comment></comment>


You can build Linus Torvalds' PC: Here's all the hardware and where to buy it - <AUTHOR> https://www.zdnet.com/article/you-can-build-linus-torvalds-pc-heres-all-the-hardware-and-where-to-buy-it/ <comment><USER2> For me the most interesting part was actually the fact he uses Fedora. It would be interesting to know about other distinguished devs and their distros of choice.

<comment><USER3> I believe Greg Hartman-Kroah uses OpenSUSE.</comment></comment>


Ask HN: What do you think of the Dart language? - <AUTHOR> I don't often see submissions related to this language with the exception of a few posts about FLUTTER. I am starting to use it now and would like to have a general opinion about the language. Especially if you have previous experience with similar more established languages.<p>Thank you very much for your help. <comment><USER2> Dart is OOP and class based. That makes not want to spend time with it. I am not a fan of class based applications.

<comment><USER3> why?

<comment><USER2> Complexity.

[https://www.infoq.com/presentations/Simple-Made- Easy/](https://www.infoq.com/presentations/Simple-Made-Easy/)

The goal of class based OOP is extension. When something is extended you then have the original and an extended derivative. What was one is now two, or more. That might be easy, but it certainly is complex. Complexity is to make many.

I prefer simplicity and predictability.

<comment> non-entity I take it you're unemployed then?

<comment><USER2> I've never had trouble finding work as a senior software engineer, but currently I've managed to escape the nonsense.

I have found from working in Java heavy industries that people most reliant on OOP tend be school educated developers with little or no capacity for self education. These tend to be the developers most concerned with job security. Very few (almost none) self-taught developers I've known openly embrace OOP as their preferred paradigm.

High insecurity among software developers is why I've grown to dislike writing software in the corporate world and why I was happy to accept a management opportunity doing something unrelated.</comment></comment></comment></comment></comment>


Largest cruise liner gets outfitted with fiber like Internet - <AUTHOR> http://www.o3bnetworks.com/1791

<comment><USER2> Well damn. I misread the headline and already started thinking through how aggressive you would have to cache if you were on a cruise liner, had a satellite connection to the rest of the world, but had fiber across the ship for guests.

Then I read how O3 does it - apparently the satellites track the ship and you get a dedicated link. Good god that has to be expensive.

<comment><AUTHOR> Definitely expensive..but compared to what exists now, probably worth it. How else will people be able to upload vacation photos to instagram!

</comment></comment><comment><USER3> "which delivers the reach of satellite and the SPEED and LATENCY of FIBER"

False marketing of the month!

<comment><USER4> Well, technically - if you're thousands of miles out to sea, bouncing a signal to a satellite in orbit a few hundred kilometers above the earth may well equal the speed and latency of an equivalent fiber connection...

<comment><USER5> GEO is 22236 miles up. Consider that you'll usually be bouncing data at least 50000 miles through the lossy atmosphere. It's the distance and lost packets that cause the main latency issues.

You could got for a LEO (upward of 500m) but they need much more power to stay up and you need so many more satellites. It's not impossible but I would have thought it to be prohibitively expensive for an ISP (or a cruise liner full of oldies).

Not to mention that this thing is going to connect to a base station and you're then your connection is in the hands of the actual fibre gods.

Compare that to a real connection: I have ADSL in the UK. I ping a server of mine in California. ~5000miles in 130ms. You could spend billions on a peering satellite network and your first hop (past any boat-board proxy) will still be longer than a DSL equivalent's whole TCP connection.

Unless, that is, they're using unicorns to beam the data with fairy dust neutrinos. That probably would be faster.

Note: I'm not saying annything about bandwidth. You _can_ get crazy-high bandwidth through a P2P dish, but latency has always been an issue when you're dealing with orbits and the atmosphere.</comment></comment></comment>


Ruby Feature: Compress a Sequence of Ends - <AUTHOR> http://redmine.ruby-lang.org/issues/5054

<comment><USER2> I _really_ don't like this at all. Nesting many levels deep is often a code smell, so seeing an end chain like that is a quick way to find candidates for refactoring.

</comment><comment><USER3> First reading, I thought it was a joke.

Now I'm just worried.

</comment><comment><USER4> I'd like to see how an IDE would handle this.</comment>


LCH colors in CSS: what, why, and how? - <AUTHOR> http://lea.verou.me/2020/04/lch-colors-in-css-what-why-and-how/ <comment><USER2> (Reposting my comment from Lobsters)

Yeah, the LCH color space is much more useful than HSL. I wish more software had color pickers that supported it.

Another useful color space, closely related to LCH, is HSLuv ([https://www.hsluv.org/](https://www.hsluv.org/)). Its only difference is that instead of an absolute chroma (colorfulness) component, it has a relative saturation component, scaled so that 100% saturation means the maximum possible chroma sRGB allows for that hue and lightness.

HSLuv's relative saturation makes it ideal for generating colors for today's sRGB-restricted CSS, because its colors are always displayable, no matter their saturation value. This avoids LCH's problem where a color with too high a chroma value must be rounded to the nearest displayable color. The downside of relative saturation is that two different colors with the same saturation value might not look equally colorful.

HSLuv has a comparison page ([https://www.hsluv.org/comparison/](https://www.hsluv.org/comparison/)) that compares HSLuv, CIELUV LCh, and other color models. The charts do a good job of helping you understand how each color model works.

The home page for HSLuv also has a nice color picker that I sometimes use instead of the color picker built into various graphics software. It's good to learn of the article author's LCH Colour picker at [https://css.land/lch/](https://css.land/lch/) – that's a much easier-to-use LCH color picker than the other one I've seen, [http://davidjohnstone.net/pages/lch-lab-colour-gradient- pick...](http://davidjohnstone.net/pages/lch-lab-colour-gradient-picker). But something I prefer about HSLuv's color picker is that the sliders' colors show the final color you will get if you move that slider to that position, whereas the article author's LCH Colour picker seems to do some weird hybrid of that behavior and making the sliders always show the same colors.</comment>


Leonid Kadenyuk, First Astronaut of independed Ukraine, Has Died - <AUTHOR> https://www.ukrinform.net/rubric-society/2393269-first-ukrainian-astronaut-kadenyuk-dies.html <comment><AUTHOR> Leonid Kadenyuk was astronaut of STS-87 mission.

Year ago[1] (February 4, 2017), in one of his interviews on Hromadske Radio[2], he told:

> Interviewer: Did You took record of National Anthem of Ukraine on "Columbia" > board?

> Leonid Kadenyuk: Every astronaut of this mission should request some music > as alarm-clock sound. At 7 oclock in the morning from flight control center > in Houston streamed some music on ship board, as alternative to classic > alarm-clock sound. When I was asked for request melody, I thought, why not > Anthem of Ukraine. And then told "Let's Anthem of Ukraine will sound".

[1] [https://hromadskeradio.org/programs/rankova-hvylya/ty- povyne...](https://hromadskeradio.org/programs/rankova-hvylya/ty-povynen- vmity-posadyty-100-tonnyy-korabel-z-kosmosu-bez-dvyguniv-leonid-kadenyuk)

[2] [https://hromadskeradio.org/guests/leonid- kadenyuk](https://hromadskeradio.org/guests/leonid-kadenyuk)</comment>


Tab Snooze – Snooze tabs for later - <AUTHOR> https://github.com/athyuttamre/tab-snooze <comment><USER2> I use Firefox Tab Groups feature [1] for this use case.

I found this feature by mistake, but I was thinking about something like this. I placed Tab Groups button next to Open New Tab button on the right, so it's accessible.

Keyboard shortcuts:

\- Ctrl+Shift+E - show Tab Groups

\- Ctrl+Backtick (Tilde) - switch Tab Group

Good thing with this setup is to use Suspend-Tab addon [2] so after few hours tab can unload itself. But it's seems broken now.

I would prefer extension which would suspend javascript execution on not active tabs with option to not suspend selected tabs or white list. But I couldn't find it.

Maybe I will have to write it myself, but I don't know is it possible. Note: 'suspend javascript execution' and not 'disable javascript and reload'.

[1] [https://support.mozilla.org/en-US/kb/tab-groups-organize- tab...](https://support.mozilla.org/en-US/kb/tab-groups-organize-tabs)

[2] [https://addons.mozilla.org/en-US/firefox/addon/suspend- tab/](https://addons.mozilla.org/en-US/firefox/addon/suspend-tab/)

<comment><USER3> > I would prefer extension which would suspend javascript execution on not > active tabs with option to not suspend selected tabs or white list. But I > couldn't find it.

You're looking for this [0]

[0] [https://hg.adblockplus.org/suspendbackgroundtabs/](https://hg.adblockplus.org/suspendbackgroundtabs/)

<comment><USER2> Thanks, I will look in to it.

Do you maybe know the reason it's no longer on Firefox Add-Ons? Firefox Add- Ons says it was removed by the author.

<comment><USER3> Sorry, I have no idea.

</comment></comment></comment></comment><comment><USER4> This supposedly "snoozes tabs for later". I still don't know what it does. Could someone explain? You can assume I know what Chrome is.

<comment><USER5> The way this feature works in mailbox is you can "snooze" an email. After making your timeframe selection, it will leave your inbox, then return when you selected. For example, if you get a work email on the weekend about something you need to take care of on Monday, you can snooze it until "Next week" and it the email will immediately leave your inbox, then return the following Monday.

</comment></comment><comment><USER6> In a similar vein - this saved my sanity: [https://www.one- tab.com/](https://www.one-tab.com/)

I now have 6000 saved tabs that deep down I know I'll never look at. :-)

</comment><comment><USER7> Neat idea. Sometimes I use Instapaper for articles and blogs that I want to save or just read later, but sometimes I end up leaving tabs open as a reminder to do something. (currently I have 9 open "reminder" tabs that I need to deal with at some point, just not today)

</comment><comment><USER8> I thought, or hoped, that this would be an "Unload this tab" Firefox plugin. Sadly, I was wrong, and such a plugin seems as yet merely theoretical.

<comment><USER9> What about [https://addons.mozilla.org/en- US/firefox/addon/unloadtab/](https://addons.mozilla.org/en- US/firefox/addon/unloadtab/) or [https://addons.mozilla.org/en- US/firefox/addon/suspend-tab/](https://addons.mozilla.org/en- US/firefox/addon/suspend-tab/)?

<comment><USER2> I was using suspend-tab but update or two ago it stopped working correctly. As stated on add-on's page:

> (On the other hand, because this addon calls very unstable/internal APIs of > Firefox itself, this can be disabled by Firefox's update in the future.)

<comment><USER10> I've been using this for the past week or so without any issues: [https://addons.mozilla.org/en-US/firefox/addon/auto- unload-t...](https://addons.mozilla.org/en-US/firefox/addon/auto-unload-tab/)

</comment></comment></comment></comment><comment><USER11> I like Mailbox (though some more transparency into the roadmap might be nice), but I'm not sure of the point of this. Kind of like an Instapaper-style thing for reading later I guess?

<comment><USER12> I frequently find I have dozens of tabs open at any given time. Usually because I want to watch some video, or read some article. Unfortunately I don't have time to look at the tab right now. It usually stays open for a few days (because I forget it's open because I can't see it) until eventually I just end up closing the tab because I realize I'll never get around to reading it.

I find "read it later" solutions less appealing because they're a big bucket where I put my anything that's mildly interesting. It's also an entirely separate section of the browser (or a whole other app) whereas this plugin leverages existing workflows.

I'm sure everyone is different but if I could snooze a bunch of tabs until the weekend or until I start my commute home, that'd be pretty cool.

</comment></comment><comment><USER13> Hello everyone! I'm the developer. Just found out it was posted here, haha.

Any and all questions welcome!

</comment><comment><USER14> Looks really useful! Kind of a mitigator for those bookmarks you make to read later but never do.

Good work!

</comment><comment><USER15> "Please don't do things to make titles stand out, like using uppercase or _exclamation points, or adding a parenthetical remark saying how great an article is._ It's implicit in submitting something that you think it's important." [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment><comment><USER16> I bookmark every website that I want to read/watch at some point with "todo". It's getting a bit large now.

</comment><comment> prakash-news does anyone of you have a ie hack...nothing major, just saying. ya firefox and chrome have the absolute ability to get this stuff done with ease of user experience and interface.</comment>


15 Fundamental Laws of the Internet - <AUTHOR> https://www.exceptionnotfound.net/15-fundamental-laws-of-the-internet/ <comment><USER2> "meme engineering" \- These days I feel like some people would willing pay for and complete a 4 year Meme Engineering degree if they could.</comment>


Smart Contracts will never work if we treat them as normal programs - <AUTHOR> http://www.contracts11.com/smart-contracts-will-never-work-if-we-treat-them-as-normal-programs/ <comment><USER2> Perhaps I miss the point, but how can we be sure there are no bugs in ACE?

<comment><USER3> In the ACE specification or the ACE program? In case of the specification, the language is designed to be easily verifiable, also through the generated test suite. This allows a domain expert to check it, as well as a programmer if required.

In case of the ACE program, it's a program so can indeed have bugs. But at least then we only have to verify the implementation of a single program, instead of all of them.

</comment></comment><comment><USER4> So ACE is Gherkin for contracts?

<comment><USER5> Ace and Gherkin are related in the sense that both are ment to express program behaviour in a language that domain experts can understand. Ace is more geared towards expressing contracts. The language is designed in cooperation with lawyers to resemble traditional contracts as much as possible. Ace must have the property that one very important aspect of contracts, the handling of disagreements (or exceptions as programmers call them) can be clearly expressed.

There are other differences in approach. In Gherkin, a programmer needs to implement the test for each step manually. This has a risk of introducing bugs. To reduce that risk, Ace translates to an ethereum contract as well as a test suite.

It is not always possible to generate a complete contract. In that case a programmer has to fill in the operational details.

However, it is always possible to generate an executable test suite. This guarantees that an implementation can always be checked to conform to the contract as specified in ACE.

So any "error" (i.e. disagreement between the contract parties) when executing the contract can be traced back to: \- an "error" in the ace contract (the parties agreeing to the contract should decide what to do) \- an error in the ace implementation (ace has to be open source to minimise the risks here, just like the bitcoin an ethereum software)

</comment></comment><comment><USER6> Nice read!</comment>


Unheralded Mathematician Bridges the Prime Gap - <AUTHOR> https://simonsfoundation.org/features/science-news/unheralded-mathematician-bridges-the-prime-gap/

<comment><USER2> > Without communicating with the field's experts, Zhang started thinking about > the problem. After three years, however, he had made no progress. "I was so > tired," he said.

> To take a break, Zhang visited a friend in Colorado last summer. There, on > July 3, during a half-hour lull in his friend's backyard before leaving for > a concert, the solution suddenly came to him. "I immediately realized that > it would work," he said.

<http://c2.com/cgi/wiki?FeynmanAlgorithm>

      Write down the problem.
      Think real hard.
      Write down the solution.

<comment><USER3> Been there, done that.

It is not as glorious as it sounds. I had some very strong intuitions about some obscure computer science problem (maybe 10 people worked on it worldwide, but I think they gave up already). I was thinking about this problem for at least one year, with some periods of very intensive thinking. I could have really used that time more productively, because that was already quite a busy period for me, but the solution seemed so close.

After about one year, I finally had a solution mapped out, which I think would work. However, there were some major implementation problems (memory complexity). That was the time when I was finally able to let it go.

So the advise that I would give to people is: focus on real-world problem, that real people have.

<comment><USER4> > focus on real-world problem, that real people have.

Because the world would be a much better place today if we hadn't bothered about quantum mechanics, special and general relativity or even advanced mathematics to handle these topics. Sure, this sort of thing won't solve the problems of this specific time period, but it might well be relevant to a future generation's problems.

<comment><USER5> Quantum mechanics solved a bunch of real world problems that were relevant at the time. As one example, people were trying to predict heat capacities of gases (for things like chemical engineering industrial processes) and the theory they had, based on equipartition, produced results that didn't match experiment at room temperature. And we're not talking a few percent mismatch; we're talking significant differences.

Special relativity likewise addressed specific experimental problems people were having.

General relativity you may have more of a case for.

</comment></comment></comment></comment><comment><USER6> So, there's two (slightly off topic) questions this article raises that I've had for a while. Perhaps someone who's been in academia longer than I have can enlighten me.

First, the article talks about experts within the field. I've been a graduate student for about a year now, and within my field of research (molecular dynamics), I still have no idea who the "experts" are. I see the same names frequently pop up on papers I read -- are these the experts? I don't know of any online forums where people discuss MD; if they're out there, then they must be a secret. I'm sure I can't just email these professors and say "hey, want to chat?" So where does this group collaboration and unanimous identification of who the leaders in a field are come from? Conferences are only a few times a year; I can't imagine that's where all of these people meet up and socialize.

And secondly, how is this mathematician "virtually unknown", as the article puts it? The University of New Hampshire is surely a well-known institution. I'm sure it ranks top 100-500 in the world, right? And there's maybe 20-25 mathematics professors at each university. I also know math is very diverse, and an expert in topology isn't going to know too much about number theory. So within each "domain" of math, there can surely only be a few hundred in the world at any given time who are actively researching the subject. How can he be so unknown then?

<comment><USER7> I am a professional mathematician and number theorist, who has studied work closely related to Zhang's.

I had _never_ heard before of an older (40+) mathematician, who has done essentially no meaningful work in the subject before, and has virtually no publication record, coming out of seemingly nowhere and proving such a big theorem.

This is in no way a slight against older mathematicians, indeed many spectacular results are proved by people over 40, but they typically accumulate an excellent track record on the way.

Indeed, I fully assumed that this guy was full of shit. However, I have heard that well-known experts in the area have closely read Zhang's paper and found it to be correct.

This is enough to put a smile on my face. There is something wonderful about skepticism and cynicism being proven wrong, especially when the skepticism is my own.

<comment><USER6> Ah, I did not realize he had not really published before. I suppose that is very surprising. Also, the way your post is written seems to suggest that most results out of nowhere are "crankish". Are there really people who spend their time working on these things that aren't professional mathematicians and who submit flawed papers to math journals? I would think that would be an unproductive use of one's time...

<comment><USER7> > Are there really people who spend their time working on these things that > aren't professional mathematicians and who submit flawed papers to math > journals?

Yes, as well as people who are professional mathematicians (usually not well known) who also do so.

There is not a flood of such papers, but my thesis advisor, in his capacity as editor of the Proceedings of the American Mathematical Society, gets at least a dozen or so such papers each year. I refereed some of them, and had to explain to these authors why their proofs were mistaken.

<comment><USER8> Attempted proofs of Fermat's Last theorem by cranks used to be so common that Edmund Landau, a German mathematician, had a form letter for them: "Dear Sir/Madam: Your proof of Fermat's Last Theorem has been received. The first mistake is on page _____, line _____."

I have sometimes seen notes on the pages of prominent mathematicians that they don't have time to examine unsolicited attempts at major problems by amateurs so there must still be a good number. I also have known someone whose sibling is a software engineer and whose hobby is trying to resolve P ? NP.

<comment><USER9> I heard a talk by one of the main vetters of the P?NP problem (which itself was underwhelming; clearly presentations were not his strong suit) and he said there were vast numbers of attempted proofs, only a small fraction of which are even treated seriously, and none of which are considered for long enough to be considered "close" to complete. He seemed to believe that the only significant hope for the problem was in the hands of Ketan Mulmuley at UChicago (<http://www.cs.uchicago.edu/people/mulmuley>), but realistically a solution would not be found in our lifetimes.

This is not only interesting for that specific problem, but it was revealing in how many amateurs (including those with doctorates) who are completely over their head at the edge of our knowledge—the people who understand it well enough to evaluate an approach adequately don't submit because they understand the difficulty in ways most don't.

</comment></comment></comment></comment></comment></comment><comment><USER10> This is just utterly inspiring and something I've always dreamed about happening to me. Too often, people are proud of themselves after figuring out something that took a few days or even a few weeks to come up with. To stumble upon a solution when you had all but given up hope after three YEARS is just astounding and must amazing.

Congratulations to this mathematician. Inspiring. Truly inspiring.

<comment><USER11> _three YEARS_

Persistence, man, persistence.

The chinese have some saying that, loosely translated, "ten years is short to revenge a father's death."

<comment><USER12> 君子报仇十年不晚

Also this:

10 minutes on stage is 10 years practice behind stage.

<comment><USER11> Neato, thanks!

[http://en.wiktionary.org/wiki/%E5%90%9B%E5%AD%90%E6%8A%A5%E4...](http://en.wiktionary.org/wiki/%E5%90%9B%E5%AD%90%E6%8A%A5%E4%BB%87%EF%BC%8C%E5%8D%81%E5%B9%B4%E4%B8%8D%E6%99%9A)

"A nobleman bides his time for the perfect moment for revenge."

I swear I didn't make up the oedipalia! A chinese native mentioned it in passing years ago and the phrase stuck.

</comment></comment></comment></comment><comment><USER13> This is simply amazing. Stories like this are humbling, inspiring and provide a renewed appreciation for persistence.

Also, with respect to being unknown, the one thing that does pop up upon doing a search is his rating on ratemyprofessor: <http://www.ratemyprofessors.com/ShowRatings.jsp?tid=56169>.

<comment><USER14> The common refrains seem to be 1) easy tests 2) seems nice in class and 3) is mean one in one.

I wonder if 2 & 3 have anything to do with his shyness (as mentioned in the article) and his lack thereof when he gets to talking about math? Maybe he gets on a roll as far as math goes, but one-on-one interactions are more difficult?

Or maybe he was busy coming up with this bad-ass paper and didn't want to extend his office hours?

Either/or.

</comment></comment><comment><USER15> The Twin Prime conjecture is probably the most elementary unsolved mystery in math.

</comment><comment><USER16> Is the bound achieved by his proof actually 70000000? That looks like a suspiciously round number. Why can't they tell us the exact bound that he achieved? (Presumably some slightly smaller number?)

<comment><USER17> In math you often don't need super precise bounds. I think it just happens that 70m works. If you try harder you can probably find something more accurate. IMO even a bound like 100m is good because it's a finite number.

<comment><USER16> No, actually any proof that supplies a bound must also have some least bound that can be derived from that proof. It could be a calculation that starts from the bound, or it could be some calculation with a result that tells you what the bound is. To me it seems very unlikely that the actual bound was exactly 70000000 in either case.

It _could_ be that some super-expensive calculation is required for each candidate bound, and Zhang guessed 70000000 as a starting point and did the calculation for that number, which succeeded, but he didn't bother repeating it for any smaller numbers because it would cost him too much. But if that was the case, that would be interesting in itself.

</comment></comment></comment><comment><USER18> Also reported six days ago, although with comparatively little discussion:

<https://news.ycombinator.com/item?id=5703219>

</comment><comment><USER19> > Among large numbers, the expected gap between prime numbers is approximately > 2.3 times the number of digits; so, for example, among 100-digit numbers, > the expected gap between primes is about 230.

> no matter how sparse the primes become — you will keep finding prime pairs > that differ by less than 70 million.

Does this mean even for numbers longer than 70m/2.3 = 31m digits, there is bound to be at least one prime every 70m numbers or so?

<comment><USER20> Edit: Admittedly only skimmed the article, let alone the paper. Obviously there are an infinite number of primes and we've proved that ages ago. Do not read this comment, read the replies if you want a more accurate answer. Leaving it here for posterity.

Yup, at least according to the article:

"His paper shows that there is some number N smaller than 70 million such that there are infinitely many pairs of primes that differ by N. [...] [N]o matter how sparse the primes become — you will keep finding prime pairs that differ by less than 70 million."

So he proved that it there is some number N, not necessarily 70mil but below 70mil, is the "gap" between primes.

\</comment></comment><comment>--

This is an amazing development. On the other hand, we are also getting close to nailing the odd Goldbach Conjecture. I think it was just last year that Tao proved, without the Riemann Hypothesis, that every odd number N > 1 can be expressed at by the sum at most 5 primes. Wonderful to witness such great leaps in maths during one's own lifetime.

<comment><USER21> No, this isn't right.

He showed that there are infinitely many twin primes differing by 70 million from each. However, it could be that the next such twin prime, has its lower prime number more than 70million numbers further along.

What I mean is, there is allowed to be a gap larger than 70million with no primes in it, then all of a sudden, twin primes. But those twin primes with a gap less than 70million between them are guaranteed.

Basically, if you separate all adjacent pairs of primes, with no primes in between, you can separate this into two groups of those adjacent pairs with a gap less or equal to 70mil, or greater than 70mil. The first group has infinitely many members according to the proof. And the second group is probably not empty.

<comment><USER11> _And the second group is probably not empty._

We know _for sure_ it's non-empty by simple factorial arguments ITT or by appeal to the prime number theorem.

</comment></comment></comment><comment><USER22> Wondering if this impacts the security of public key encryption.

<comment><USER23> As part of properly generating RSA keys there are restrictions as to how close together the two primes numbers chosen can be. So no, twin primes bear no relevance to the problem.

[http://en.wikipedia.org/wiki/RSA_(algorithm)#Faulty_key_gene...](http://en.wikipedia.org/wiki/RSA_\(algorithm\)#Faulty_key_generation)</comment></comment>