Show HN: Writing my first interpreter in C for fun - <AUTHOR> https://github.com/incrediblesound/huo <comment><USER2> Sometimes i wish for compiler tutorials that progress feature by feature, starting with simple features, rather than starting with complicated things like parsing expressions with multiple op codes (op codes being implemented as function calls, so it gets even more complicated)...

For example, a sequence like this:

1\. variable assignment

2\. commands of one parameter

3\. if / branch statements

4\. much later: nested expressions, function calls, multiple stacks, environments

basically, starting with an abstraction of 3 parameter opcodes, and then slowly building features up the abstraction layers, as well as slowly building down the optimization layers, step by step.

<comment><USER3> You are looking for this, "let's build a compiler" [http://www.stack.nl/~marcov/compiler.pdf](http://www.stack.nl/~marcov/compiler.pdf)

<comment><USER2> not exactly. more like an expanded version of chapter 5 of sicp [https://mitpress.mit.edu/sicp/full-text/book/book- Z-H-31.htm...](https://mitpress.mit.edu/sicp/full-text/book/book-Z-H-31.html)

I will put it on github if i ever get around to writing one myself.

I am thinking something targeting / including a toy version of qemu.

</comment></comment></comment><comment><USER4> Hey this is great work! What resources would you recommend for someone else who wants to build their own toy language for fun and practice?

<comment><USER5> The classic way would be to start out with LEX/FLEX and YACC.

<comment><USER6> Forget about lex, flex, bison, yacc and all that. It's way easier and more important to start with a hand written recursive descent parser.

<comment><USER7> Q: Why do those programs exist? Lex and yacc originally come from Bell Labs. Why wouldn't they use what you recommend instead?

And when I look at the credits for lex and yacc today I see some very capable programmers. Why do these programs exist? I may be biased somewhat as I use them regularly for small tasks, but my question is an honest one.

Also, someone else mentioned swi-prolog. I think gprolog is just as easy and is noticably faster. Curious what HN readers think are the advantages to swi- prolog.

<comment><USER8> Because many don't know any better and are stuck in 70's parser tools mindset.

Tools like ANTLR[0], SableCC[1], JavaCC[2], MPS[5] and approaches like Attribute Grammars[3], Parsing expression grammars[4] are much more suitable for the modern days.

I don't know gprolog, but SWI has GUI tooling, compilation and I was already using it in 1997, so it is very sound toolchain.

[0] - [http://www.antlr.org/](http://www.antlr.org/)

[1] - [https://github.com/SableCC/sablecc](https://github.com/SableCC/sablecc)

[2] - [https://javacc.java.net/doc/JJTree.html](https://javacc.java.net/doc/JJTree.html)

[3] - [https://wiki.haskell.org/Attribute_grammar](https://wiki.haskell.org/Attribute_grammar)

[4] - [https://en.wikipedia.org/wiki/Parsing_expression_grammar](https://en.wikipedia.org/wiki/Parsing_expression_grammar)

[5] - [https://www.jetbrains.com/mps](https://www.jetbrains.com/mps)

<comment><USER9> I've tried Antlr and it was a horrible experience compared to Menhir: Being stuck with LL(n) causes a lot of unnecessary refactoring, the syntax for anything out of the ordinary is arcane and IMO not well documented.

Give me the 70's tools any day.

<comment><USER10> Menhir is hardly a 70s tool...

<comment><USER11> This is true of course. But it is ocamlyacc compatible and uses a separate lexer.

I'd at least say that it is using the lex/yacc _approach_ , which I actually like.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Here are my compiler resources:

[https://github.com/melling/ComputerLanguages/blob/master/com...](https://github.com/melling/ComputerLanguages/blob/master/compilers.org)

</comment><comment><USER13> Very cool. Knowing little about programming language implementation, I wonder what it would take to make a compiler. For so simple a language, I would think it would be not much harder, no?

<comment><USER14> Depends what you compile to. Writing a register allocator may be a little tricky (if you compile to a VM/Assembly/..), though if you compile to something like C, it's very easy. LLVM is another alternative which is also relatively simple to learn.

<comment><USER15> Spilling every variable to memory isn't too bad if you just want it to work and aren't worried about performance.

</comment></comment></comment><comment><USER16> Now to make it self hosting. ;)

</comment><comment><USER17> Nice! If you're looking for another fun challenge, make your language compile into bytecode and execute that instead of an AST. :)

<comment><USER18> ASTs are fighting back these days! I work with a system at Oracle for going straight from AST to JIT, with no bytecode, and it's proving to be very fast and very easy.

<comment><USER19> That is super cool! Are there any public resources available about this?

<comment><USER18> The key paper: [http://lafo.ssw.uni- linz.ac.at/papers/2013_Onward_OneVMToRul...](http://lafo.ssw.uni- linz.ac.at/papers/2013_Onward_OneVMToRuleThemAll.pdf)

There's implementations of Ruby, JS, R, Python, etc, using it.

I have a blog about the Ruby effort [http://chrisseaton.com/rubytruffle/](http://chrisseaton.com/rubytruffle/)

</comment></comment></comment></comment><comment><USER20> That's a nice set of readable code. I made a minor change just to add in floats instead of ints, which wasn't too hard to accomplish thanks to your structure.

(Though my changes are ugly).

If/When you get to implementing functions things will get really useful :)

<comment><AUTHOR> I just realized reading your comment that I did implement functions but I forgot to document them! I will update the readme immediately.

If you look in the main file, huo.c, you will see something called store_defs. That function takes the ASTs of defined functions and stores them in a key-val type store. If someone invokes a user-defined function I just grab the AST, replace the variables with the values they passed in and execute it. That code is in process_defs and is invoked by execute.

<comment><USER20> Wonderful news. I managed to gloss over that :)

</comment></comment></comment><comment><USER21> Nice work.

You may want to take a look at Bison/Flex. While they don't suit the tastes of everyone, it's good to know how to work with them. For example, BASH parser is written using those tools.

</comment><comment><USER22> Nice work. What would take, to make it into a REPL? I haven't looked closely at the code yet, so maybe it's close to being there.

<comment><AUTHOR> That's a good idea. I don't think it would be hard, you just get the interpreter to run in a loop and read from the keyboard input. I'll put that on the list for upcoming features :-)</comment></comment>


Ask HN:Delete post - <AUTHOR> Thanks everyone for the suggestions! <comment><USER3> I'm a YC founder from S15 and was working at another YC company as an employee when we got the idea to apply to YC. Not exactly the same situation, but I've been here, and several founders in our batch went through similar situations. Feel free to email me if you want to discuss specifics - it will remain 100% confidential.

1.) This is really tricky from your brief description. Hire a lawyer asap if you're even remotely serious about leaving and doing your side hustle full time. Not trying to discourage you, but there are going to be some IP issues to sort through that shouldn't be ignored.

2.) Ideally if you leave and apply to YC, you want to have your boss say positive things about you. It's not just for YC: every single investor will ask you about the jobs you've had before you started your company. If there are any red flags that you or your company are going to get sued, they won't invest. The best way to handle this is by ending on good terms (and ideally getting some sort of IP release agreement with the help of a lawyer [but that may not be feasible, given the new direction your current employer]).

</comment><comment><USER4> Former lawyer here. You should read over your employment agreement and see how broad the IP assignment clause is. Then you should probably talk to an employment or IP lawyer about how to proceed. Hopefully you could stay with the company and have them "acquire" the work you've done already in this new industry.

<comment><USER5> The state he works in will be important, too - right? If it's California - <USER2> what extent are his activities outside of work protected?

</comment></comment><comment><USER6> Agreed that the IP assignment is a big issue albeit you should never join a company to gain IP on a technology that will be used for a different industry (i.e. all startups focus on a platform/specific technology for one industry than move/multiply to others). In my personal opinion, it's all in how closely related the idea is (hence the recommendations for seeking an attorney). At the end of the day, I think you may be safe if you

A) have no specific ideas/ideals built into the software from your current company B) do not leverage company resources, assets or even insights to have improved the capability of your product (i.e. your knowledge is complementary, not created or originated close to the product the company has created) C) Prove that you deployed your product capability prior to having shifted and/or joined the company

1) In the end, if you really are big on this -- you should probably leave the company and be able to demonstrate to yourself and your investors that you deployed capability (or planned product) prior to joining the company.

2) I would be less concerned here assuming your time here is under 6 months, you can simply not choose to display it (i.e. the idea that you'll be YC ready in the next 6 months -- enough time for you to belittle/reduce/erase the time you were at the current company -- would mean that you're a lot further along. Thus by the time you're YC ready, none of this will have mattered.

P.S. I think you'll be good with YC. As a member of an existing top accelerator (Forbes B2B top rated) in Silicon Valley, most of them do not care if you have a similar idea (speak to the impact and traction instead of the idea), I believe your differentiation (not having taken from the company) and purity of code (not having been influenced or using company resources) will set you free.

</comment><comment><USER7> If you tell him now he should be able to tell you've built it over time. Who knows, maybe you can even make a deal since it's already a YC company. Not entirely sure how that works but I think it goes without saying that before you do anything you should talk to an attorney to review everything and give you advice.

<comment><USER6> This level of honesty and integrity is most important. Belief is the new currency -- in your own purity (alongside others ) -- will be key

</comment></comment><comment><USER8> Talk to an employment lawyer. Seriously, they can help shed a lot of clarity on a situation like this.

There are a lot of different ways to game out a situation like this and they depend a lot on your relationship with your boss, what outcome you want, and the specifics of your agreements.

</comment><comment><USER9> Why not join forces? You put the existing code, he puts some experience, clients and contacts.

</comment><comment><USER10> How successful do you think your current boss is going to be in this new market?

If you feel your own chances are somehow better than hers, then explain the situation, and try to part on the best possible terms. Definitely talk to a lawyer now if this is a likely course. You may not own what you think you own.

Otherwise use what you have to your advantage at the current company. Maybe folding your work into your employers is worth additional equity or salary.

</comment><comment><USER11> Editing out my comment to remove OP's identifiable info since they deleted the post. Wise up OP. You may not get a second chance.

<comment><USER12> This is a good point, you might want to delete this while you still can and get advice from a lawyer.

</comment></comment><comment><USER13> Check your employment contract. If you have real money riding on your side gig, then it might make sense to have a lawyer go over your employment contract as well.

Worst case scenario, you find the we-own-everything-you-produce-period clause, in which case what you did in the complimentary industry on your own time is still the property of the company.

<comment><USER14> The broadest versions of those clauses are invalid in some places, notably including California. But even California allows the employer to take ownership of certain things done on employees' own time, and many other places do allow the broadest clauses.

So yes, I agree with the advice to consult a lawyer and bring all relevant legalese for their review.

</comment></comment><comment><USER15> Have you consulted your employment agreement? It's possible your contract assigns this work to your employer already. You should probably consult a lawyer on how to proceed, regardless.

</comment><comment><USER16> How related are the two? If they are quite related, then I think that is something you should have bought up when interviewing.</comment>


Entrepreneur crowdsources decision to go to Harvard Business School or not - <AUTHOR> http://bostinnovation.com/2011/08/08/successful-entrepreneur-crowdsourcing-his-decision-to-go-to-harvard-business-school-you-can-vote/

<comment><USER2> More importantly: Entrepreneur receives data from people voting.

You are signing up with Facebook Connect in order to vote. Which means he will receive more data to add to his companies database. I think this kid is to smart of HBS! He is outplaying everyone who is voting and not realizing that they are providing him datasets.

</comment><comment><USER3> Genius twofer campaign... #1 the landing page from his press release (shouldigotoharvard.com) 301 redirects to collegebuddy.com, so that ensures all the high authority media links boost collegebuddy.com (which hasn't even been released yet... any bets it will be .edu leadgen?), and #2 to vote, you have to install the BookRenter facebook app, so that surely helps their Facebook marketing (you can also post to Twitter (gee thanks), or auth to Gmail and give access to your contacts (um, no)).

</comment><comment><USER4> He's not 'crowdsourcing' his decision. Their final tally is not binding on him, and it doesn't have any immediate effect. Instead, he's simply asking for opinions.

I think it makes for interesting data, but let's call it what it is.</comment>


A San Francisco rent control parable - <AUTHOR> http://pandodaily.com/2013/06/12/a-san-francisco-rent-control-parable/

<comment><USER2> While there are many things hillariously bad about this article, his first mistake may be in assuming that renting his apartment is even covered by rent control. This is not an uncommon mistake either, there are some pretty dumb landlords out there.

The SF Rent board covers most of the exclusions in plain english.

<comment><USER3> To fill in: post 1979 construction is exempt, and condo'd units require just cause eviction but have no controls on rent increase (my understanding is the landlord can arbitrarily raise the rent.) I'm not sure how TICs are covered. Source: I've sued a landlord for blatant violations of sf rental law, and at one point, had 5 lawyers involved. The experience sucked ass and, in practice, tenant protections in sf are tissue thin when when a landlord is malicious.

also: Bryan is a former ibanker. I'd be shocked, shocked! to find out he's a mixture of stupid and venal. Also, any lawyer involved in a rent lawsuit against Bryan will hopefully find this article and it certainly can be admitted as evidence.

<comment><USER2> > Also, any lawyer involved in a rent lawsuit against Bryan will hopefully > find this article and it certainly can be admitted as evidence.

Yeah, I'm not sure that was the wisest move on his part.

</comment></comment></comment><comment><USER4> _> Anybody who supports rent control is either (a) uneducated, or (b) benefiting from it._

Wow, who would've thought that people who are being rent discriminated against support measures that help protect them from it?

Assuming that 20something males are fratboys that do drugs and trash the place is heinous discrimination. You wouldn't discriminate against a Muslim candidate because of a stereotype, thinking they'll run a terror cell from your rental?

Landlords like this make my blood boil.</comment>


Show HN: Rally, a new iPhone app to set up your next sports match - <AUTHOR> https://itunes.apple.com/us/app/rally/id912875532?ls=1&mt=8

<comment><AUTHOR> Hi guys, any and all feedback is hugely appreciated.

\+ Currently works for tennis and squash

\+ App is centred around 'networks' which are created by users. This might be your workplace, or perhaps an extended group of friends

\+ The app automatically manages a leaderboard for every network

Our big question: would you ever use something like this? If so, what changes/improvements does it need?

<comment><USER2> My office would use it right now. Can you add table tennis?

<comment><USER2> Also, can you support other login methods besides Facebook?

<comment><AUTHOR> Out of interest - is that a request for people who don't have fb accounts, or simply don't want to use fb (perhaps for privacy reasons)?

<comment><USER2> Privacy concerns.

<comment><AUTHOR> I'll look into implementing a email + password. But this might take a little longer, as you need to have features for people who forget their password, so forth. I agree it ultimately needs to be there if this is going to be a versatile tool

</comment></comment></comment></comment></comment></comment><comment><USER3> This is cool. I'm going to show it to my office for squash? What sports are you adding next?</comment>


Ask HN: how do the "Top charts" and "Most popular" algorithms work? - <AUTHOR>

Does anyone know what are the "top charts" & "most popular" ranking algorithms on the appstore? Is it based on the number of downloads, reviews, ratings? <comment><USER2> These lists are done using a selection algorithm. For instance Sort-Key-Top: [http://cpansearch.perl.org/src/SALVA/Sort-Key- Top-0.06/READM...](http://cpansearch.perl.org/src/SALVA/Sort-Key- Top-0.06/README)

</comment><comment><USER3> It depends on the vendor. I believe that "most popular" algorithms are usually based around time vs. downloads (as opposed to the more flawed # of downloads only).

<comment><AUTHOR> Sorry my question wasn't precise enough: I was referring to the algorithms of the iOS Appstore.</comment></comment>


PI-xel – an image filtering algorithm to make images more compressible - <AUTHOR> http://www.pi-xel.io <comment><USER2> Looks like a Weak(low quality), weaker(med quality) and even weaker(high quality) Gaussian blurring on everything in the images to me, can't see any benefits to it

<comment><AUTHOR> Hi, really appreciate your honesty. Although it's not just blur under the hood, if that's all what the end user see, that all that counts.</comment></comment>


Detroit's fabled Packard plant gets makeover - <AUTHOR> http://www.detroitnews.com/story/news/local/detroit-city/2017/05/15/detroit-packard-plant/101733400/ <comment><USER2> This is really cool, but I feel some skepticism. I grew up in metro Detroit, live nearby in A2, and commute to Detroit proper weekly for meetings. A lot of the people moving to Detroit are like me -- young, unmarried, working in creative, marketing or tech. We are able to have a lot of fun living there. But relatively few of us stay as we age and get married and build families, for fairly sound reasons, like poor quality of schools and poor quality of emergency services. I worry that we are building a place to be partied but not really lived in.

<comment><USER3> Now I'm curious: what about Detroit makes it attractive as a party town?

<comment><USER4> Look up the history of Theater Bizarre and go down the rabbit hole at your own leisure.

Edit: Sorry that feels very google it for yourself. I don't mean it that way. That's a good starting topic to find the other crazy things that happen here. The Dirty Show is another one.

<comment><USER5> I didn't take it that way. You offered up a ( in Amazon's parlance ) a Statistically Improbable Phrase, which presumably is a noun, and presumably has something to do with the parent topic. Not only that, you offered a helpful disclaimer which showed great respect for your reader's time. I award you 8 out of 10 points.

</comment></comment></comment></comment><comment><USER6> No, Packard plant starts to maybe get makeover. This was a groundbreaking ceremony, not an opening. And this phase is just 121,000 square feet of office space. That's about 2/3 of a standard WalMart.

The Michigan Central Railroad Station refurbishing was more promising. It's one of America's most impressive abandoned buildings. There was a project to refurbish it, and that got far enough that the windows were replaced, an elevator replaced, and the building secured. But it's still empty.

[1] [https://goo.gl/maps/m6JZbPCqKqv](https://goo.gl/maps/m6JZbPCqKqv)

</comment><comment><USER7> This is big news for Detroit. Probably along with the train station, the Packard Plant was a symbol of the D's blighted era.

If you're wondering what this looked like before, Anthony Bourdain made a stop to this site on his show a couple years back, now getting $20M+ in development:

[https://www.youtube.com/watch?v=WpF8eZ3bPqE](https://www.youtube.com/watch?v=WpF8eZ3bPqE)

Lot of good things happening there right now.

</comment><comment><USER8> "Tests, meanwhile, have found arsenic and selenium in the soil on the site."

Why did they even bother testing? Perhaps it was required by law or as a condition of sale or permitting. But it's all liability and no benefit.

Obviously the site should be expected to be contaminated. Train your workers, give them proper equipment, and enforce safe working procedures. Cover and contain the soil. Use a reputable soil disposal company--i.e. one that also assumes the soil to be contaminated and directs it to safe usage, such as filler for road construction. As long as a developer does the ethical thing, why expect him to risk his entire investment? It's not just his money stake-- everybody in that community has a stake in the project's success.

</comment><comment><USER9> I credit this place and the other abandoned warehouses of Detroit for my interest in public policy issues (e.g., economic development, labor policy). These places were also a great source of entertainment during my high school days. The Packard Plant was a bit legendary for parties (raves) in the 90s.

"It was just under ten years ago that my friends and I began traveling from our suburban homes in Royal Oak, Michigan into Detroit looking for nightlife. We were typical middle-class teenagers seeking to change our environment and explore the 'underground' of an aging city. The destination was often an abandoned warehouse converted into a makeshift nightclub, where by 2 a.m. bass shook the rundown building from foundation to roof. Over time and after becoming acutely more observant, however, I realized that these surroundings were more than a suburban nightlife. The boarded-up homes, the all too rare museums, and the businesses polarized between mild victory and failure, all came into context—my observations matured. Through the study of economics, these observations became first-hand illustrations of poverty, real estate markets and labor dilemmas.

...

I clearly remember paying $20 to stumble into a nearly pitch dark doorway of Detroit's Packard Plant. The walls of the abandoned building, certainly the size of a football stadium, were adorned with black garbage-bag-like plastic to create boundaries for the event. There were some scarce hanging lamps and one other thing that looked a touch unreal: an industrial heater. Seriously, it looked like someone had taken the propulsion unit from a fighter jet and mounted it on the floor. Its flames poured out a good 6-8 feet and the only thing keeping you from igniting yourself was a a remote, albeit real, sense of mortality. That was it in terms of the venue. One thousand other kids paid the same and made the same entrance into the city's largest expense-free nightclub...it was a good time before glowsticks and pacifiers made their way into the scene. "

[https://technotarek.com/shows/richie- hawtin](https://technotarek.com/shows/richie-hawtin)

</comment><comment><USER10> Regarding the contamination: Why are property developers, especially factory/industrial ones, not required to post bonds or insurance that provides cleanup and restoration after a company bankruptcy?

The current model shifts all the liability to the taxpayer or worse to new developers as contaminant presence is a significant barrier to redevelopment of unused areas. Or in case of nuclear, the public is stuck with literally hundreds of billions of euros with cleaning up nuclear plants - no one sane believes that the energy companies have enough cash to cover for it.

</comment><comment><USER11> All of this development makes me wonder if Detroit could eventually rival Chicago as the tech hub in the Midwest

<comment><USER12> The thing you need for a tech hub is an influx of young people. It seems more likely that they're moving away from Detroit than to it, but is there a way to look at the data?

<comment><USER13> Don't worry--they're all getting priced out of Seattle/SF/DC/Denver/Portland/Texas. Give it 15 years.

<comment><USER14> Not all of Texas, surely?

<comment><USER3> It's starting to get that way with the populated parts.

Dallas used to be dirt cheap not even ten years ago, but it's rapidly changing.

Personal anecdote: I remember signing my first lease on my townhouse in 2007, and I was paying $1050/month for a ~1500 sq. ft. place in a decent neighborhood in Far North Dallas. It steadily goes up every year, but this year was the biggest leap ever: my lease went up to $1334/month from $1270/month last year.

Why is everything going up? Because as our economy grows and large companies from out of state relocate their offices to Dallas, people are moving here in droves, putting a strain on available housing. Dallas-Fort Worth-Arlington is now the fastest-growing metropolitan area in the US. What's more is that when the housing bubble burst in 2008, housing prices in Dallas didn't go down but construction ground to a halt. During the Great Recession, housing prices stagnated instead of going down, and now that the recession's over and jobs are up, housing prices are going way up, and construction is still slow.

And it's not just Dallas; Austin has recently become very expensive, and it's probably worse there than it is here. Not sure about Houston or San Antonio, but I wouldn't be surprised if they start getting expensive soon if they aren't already. Are there other parts of Texas you can move to? Sure, if you want to be in the middle of nowhere. There's nothing to do, especially if you're used to a major metropolitan area, and very little likelihood of meeting people who share your interests. The cities in Texas are also blue islands in a sea of red, so if you're LGBT you may find yourself unwelcome in small towns, and unless you're extremely conservative you are unlikely to find people you have anything in common with. And of course you're not likely to find a job in the tech industry; I guess you'd be OK if you work remotely, but you better hope you don't ever lose your job.

If you're curious, here are some news articles on the rising housing prices in Dallas caused by the population explosion. Be warned that dallasnews.com has an easily-bypassed paywall, so you'll want to open an incognito tab for it.

[http://www.dentonrc.com/news/state/2017/05/15/housing- market...](http://www.dentonrc.com/news/state/2017/05/15/housing-market- stretches)

[https://www.dallasnews.com/business/real- estate/2017/05/12/n...](https://www.dallasnews.com/business/real- estate/2017/05/12/not-enough-houses-as-toyota-moves-to-plano)

[https://qz.com/978602/the-main-reason-americans-are- ditching...](https://qz.com/978602/the-main-reason-americans-are-ditching-ny- and-flocking-to-the-land-of-the-cowboys/)

[https://www.dallasnews.com/business/toyota/2017/05/09/plano-...](https://www.dallasnews.com/business/toyota/2017/05/09/plano- readies-roads-first-wave-toyota-employees-traffic-comes) (this is more about the impending traffic apocalypse than rising housing prices, but it's still worth a read)

[https://www.dmagazine.com/frontburner/2017/05/the-whole- city...](https://www.dmagazine.com/frontburner/2017/05/the-whole-city-needs- to-be-paying-attention-to-what-is-happening-in-west-dallas/)

And that's just what I've seen posted to /r/Dallas in the last week. I remember finding a graph of housing prices in the last 20 years or so comparing Dallas to other major cities, showing that Dallas was the only one that didn't take a huge hit in 2008, and I wish I could find it again.

<comment><USER15> Property Taxes is also hurting Texans..

I live in Austin, in a neighborhood where 4 years ago the houses were 115k. Just this month we saw some of our first 425k sales.. and this was a blue collar non HOA homely neighborhood but Apple moved in and investors have followed.

<comment><USER16> 115K to 425K in 4 years? Which neighborhood is that? Even on the Eastside that seems insane.

<comment><USER15> The neighborhood surrounding Apple's new campus in north Austin.

non investor homes hit 320k+.. but that investor flip was a whole knew game for this hood.</comment></comment></comment></comment></comment></comment></comment></comment>


A page showing just the latest news.yc comments - <AUTHOR> http://news.ycombinator.com/newcomments <comment><USER2> On an unrelated note, I think there is an inherent conflict from having submissions count for karma. On one hand, it (supposedly) motivates user contributions. On the other hand, it's much harder for end users to identify others who consistently post insightful comments.

</comment><comment><USER3> In other YC news, the edit comment links seem to have disappeared. Edit: For older comments anyway!

<comment><USER4> It's always disappeared for comments of a certain age.

</comment></comment><comment><AUTHOR> how about showing what the top-level article is for each comment? like reddit does:

<http://reddit.com/user/joshwa/comments></comment>


"A sleep(1) is put into all SSL_read() and SSL_write() calls..." - <AUTHOR> http://bugs.python.org/issue9075

<comment><USER2> It looks like someone forgot to remove the "speed-up loop".

<http://thedailywtf.com/Articles/The-Speedup-Loop.aspx>

<comment><USER3> That's both hilarious and frightening all at once. Luckily static analysis tools catch that kind of stuff very easily now...

<comment><USER4> Additionally I think you'd be hard pressed to find a modern compiler (for some loose definition of modern) which would not optimize that loop away.

<comment><USER5> At that point they would just turn _on_ the optimizations as an "insurance".

<comment><USER6> Don't you mean off?

</comment></comment></comment></comment></comment><comment><USER7> As the bug report mentions, the sleep(1) call appears to be wrapped in a #define that (I assume) won't be active in normal OpenSSL builds. At least in v0.9.8o (the only one I checked) the only references I see are:

ssl/s2_pkt.c:

        #ifdef PKT_DEBUG
            if (s->debug & 0x01) sleep(1);
        #endif

There are two references like that to PKT_DEBUG (read and write); the only other is:

ssl/ssl_locl.h:

        /*#define PKT_DEBUG 1   */

I suspect this is a non-issue. Interesting though.

</comment><comment><USER8> Wow I wonder how many people gave up using the ssl lib as too slow due to this bug?

</comment><comment><USER9> I bet removing this causes something somewhere to break.

<comment><USER10> is sleep(1) noisy?

if so, it might be vs timing attacks

<comment><USER11> Sleep(1) is _very_ noisy on Windows machines. The time slice given by default is ~15-20ms [1], and calling Sleep(<15) relinquishes the rest of the time slice. Windows has a multimedia API that can be used to get intervals down to 1ms, but it requires system calls that increase your system load. So you usually just need to use proper synchronization anyways, which is what the Python guys should have done :)

This crummy Sleep() implementation has some nice effects on programmers. Those who like to solve problems with lots of copy/paste code are forced to think about using proper synchronization primitives when running high resolution loops that wait for events, or their code just won't run very fast.

[1] [http://social.msdn.microsoft.com/forums/en- US/clr/thread/fac...](http://social.msdn.microsoft.com/forums/en- US/clr/thread/facc2b57-9a27-4049-bb32-ef093fbf4c29/)

<comment><USER12> When I did driver programming in Windows, it was well-known that Sleep had a resolution of 10 ms; it is based on the interrupt timer (not the high frequency timer). You could change the interrupt timer's duration, but its ticks are what guide Sleep. Not counting the effect of context switching, since you are waiting for the timer ticks, your actual times vary from 10 ms to 19.9999 ms. 15 ms is a nice way to say "on average", but I would not rely on that measure.

Timers are hard to get right. Tread warily, programmers! This is one of those areas where it is good to understand some things about the computer hardware behind the software.

EDIT: I should add that the high frequency timer is not a panacea either. It will work for you most of the time, but there are two circumstances that will occasionally trip you:

(1) At least in Windows XP and 2000, there is a KB (I do not remember it now) that explains that for a certain small set of manufacturers, if there is a sudden spike in high load on the PCI bus, the high frequencer timer will be jumped ahead to account for the lost time during that laggy spike. This correction is not accurate. This means that if your initial timestamp is X, and you are waiting for it to be X+Y, wall clock time may be between X and X+Y, but Windows itself altered the timestamp to be X+Y+Z, and your software thinks the time has elapsed. I personally experienced this bug.

(2) You actually have more than one high frequency timer -- one for each CPU on your system. Once you start playing on a system with multiple CPUs, how do you guarantee that the API is providing you a timestamp from the same timer? I remember there may have been way to choose if you dropped to assembly to make the query but that the API at the time did not support a choice. The timer starts upon power-up. If one CPU powers up after the other, you will have a timestamp skew. Some high frequency software algorithms attempt to correct for this skew. I do not know all the details to that now.

<comment><USER13> Presumably the high frequency counter is driven off the cycle counter, and not the Intel High Precision HPET Timers.

<comment><USER12> <http://en.wikipedia.org/wiki/Time_Stamp_Counter>

"The issue has two components: rate of tick and whether all cores (processors) have identical values in their time-keeping registers. There is no promise that the timestamp counters of multiple CPUs on a single motherboard will be synchronized. In such cases, programmers can only get reliable results by locking their code to a single CPU."

The entry also mentions that hibernation can affect the counters. I wonder if power savings implementations that speed up or slow the CPU could also have an effect.

<comment><USER13> Yes. The TSC, which counts cycles, is what WinAPI reads with GetTickCount(), and is not the same thing as the HPET timers.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> A second long sleep on every read or write? If this was actually happening, it sounds like it could create unheard of performance issues for any significant transfer.

Or was this not noticed because all the major frameworks like cherrypy and twisted are still using the pyopenssl wrapper?

Is there any evidence that this bugfix actually changes the performance?

<comment><USER15> Don't you mean a millisecond long sleep? I never saw a sleep function that interpreted its parameter as seconds. Edit: Well, now I know better.

<comment><USER16> It does on Linux, from `man 3 sleep`:

<http://paste.pocoo.org/show/229678/>

<comment><USER14> This is what I was going on, I checked that man page, incredulously...

</comment></comment></comment></comment><comment><USER17> I love Ben's response in the discussion prior to the SVN check-in.

</comment><comment><USER18> I have been working on a replay tool in python. I had to add sleeps because it was sending packets faster than the NIC could send them in order.

<comment><USER19> That's not a reliable way to do that. It should block.

<comment><USER18> it is actually more reliable to sleep than to block. by definition blocking is unreliable because you don't know exactly when it will unblock. You do know when a sleep will end though. I also want a variable delay between writes.

<comment><USER19> Uhhh. I think you need to study this topic some more.

> it is actually more reliable to sleep than to block. by definition blocking > is unreliable because you don't know exactly when it will unblock.

A block will end when the nic can handle more data. You can't just wait a second and assume the nic can handle the data. That's where the "unreliable" part comes in. You assume it can handle the data, but you are not checking. And the way to check is either by polling, blocking, or receiving a signal. Waiting is not a way to check.

> You do know when a sleep will end though.

It makes no difference that you know when the sleep will end. It's irrelevant - all you care about is can the nic accept more data or not.

> I also want a variable delay between writes.

If you want variable delays then do that, but that has nothing whatsoever to do with making sure the nic doesn't lose data.

<comment><USER18> cool, I'll check the nic status before sending if I ever want to maximize throughput. But I'll probably rewrite it in C at that point too.

<comment><USER13> "Check the NIC status"? What network API are you using? Even if you're injecting with libpcap, you can still just select() on the device handle.

<comment><USER18> I am not using an API, I am writing to the driver

<comment><USER13> Just use Winpcap instead of wasting time reinventing this wheel.</comment></comment></comment></comment></comment></comment></comment></comment>


Rapidstring: Maybe the fastest string library ever - <AUTHOR> https://github.com/boyerjohn/rapidstring <comment><USER2> Hey there, creator of the library here. Strangely enough my initial post about this on HN received no attention, but better late than never!

If any of you have some questions or feedback, I would be delighted to hear it.

<comment><USER3> Hey man don't worry about that, that's just the way of life. People notice things when they do, that part's not up to us. I've seen articles here posted _years_ after they were written.

Very nice and thoroughly documented code! Well done! What gave you the initial idea to write this maybe-fastest-ever string library? Did you just have an idea one day of how it could be done and you just went for it? Or did you have a performance issue and come up with this to speed something up at work, or what?

<comment><USER2> I just really needed a string library written in C, and it didn't seem as though there were many options. The first thing I found was the Simple Dynamic Strings library, but it wasn't maintained and depended on GCC extensions, so I decided to write my own. After getting a basic functional concatenation, I benchmarked it against std::string to see how slow it was, and to my great surprise, it was actually faster. From that point, I realized I can actually write some pretty fast code, and I decided to make the library centered around that.

<comment><USER3> I'm surprised to hear it was faster, I just assumed C++ standard library is optimized for speed since I thought that's what C++ is known for compared to JavaScript.

</comment></comment></comment></comment><comment><USER4> I like the stack trick.

But it's still just a membuf library, without any string support. No encoding, no Unicode, no upper/lower/fc/norm support, which would be important to compare or find strings. And coreutils (e.g grep) still have no unicode support. It's 2018, not the seventies anymore. Unicode strings need to be normalized to be able to be found.

<comment><USER5> I think instead is better to title this as "maybe the fastest ascii string library"

<comment><USER2> Unicode is supported with UTF-8, only different character types aren't supported because generics are messy in C. I thought of accepting void* to support wchar_t and others, but some performance penalties came with it so I decided against it.

<comment><USER6> No, having different character types (I believe you are referring to C11's `char16_t` and `char32_t`?) is not a requirement for Unicode support. At the very least you need to have a single function or two that...

* Receives a string expected to be encoded in UTF-8, and an offset to it expected to be a UTF-8 sequence boundary.

* Scans forward or backward for the next or previous UTF-8 sequence boundary.

* Optionally returns the code point for the scanned UTF-8 sequence.

* Has proper error handling for every imaginable cases: out of boundary, not a boundary, not a valid UTF-8 sequence. (OOB case needs to be handled because it will be the end condition of the iteration. Preferably should be distinct from other error conditions.)

Every other functionality can build upon this little function, in particular the iteration and UTF-8 validation will be trivial. The full Unicode support including case mapping, folding, normalization and property lookup will of course require a not-so-small table but is not strictly necessary anyway.

Björn Höhrmann's Flexible and Economical UTF-8 Decoder [1] will be handy for a concise implementation.

[1] [https://bjoern.hoehrmann.de/utf-8/decoder/dfa/](https://bjoern.hoehrmann.de/utf-8/decoder/dfa/)

<comment><USER7> I don't see any functions in the OP's library that would require dedicated UTF-8 handling. The string length is given in bytes, not characters or codepoints. There's no functionality to give you the character at n-th location etc... you can easily implement all UNICODE-specific functionality in a separate library and use it together with the OPs library. IMHO that's even preferable.

<comment><USER4> Yes, but don't call it string library then. Strings should handle strings, and strings are unicode now. Unicode needs to be normalized and needs case- insensitive support.

And it's not easy. I implemented the third of its kind. First there was ICU, which is overly bloated. You don't need 30MB for a simple string libc. Then there is libunistring which has overly slow iterators, so not usable for coreutils. And then there's my safelibc, which is small and fast, but only for wide-chars, not utf-8.

I fixed and updated the musl case-mapping, making it 2x faster, but this is not in yet. And there's not even a properly spec'ed wcscmp/wcsicmp to find strings. glibc is an overall mess. I won't touch that. wcsicmp/wcsfc/wcsnorm are not even in POSIX.

<comment><USER8> Why try to redefine the word "string?"

In computer jargon I believe CISC and the PDP-11 have seniority. That's why all multi-word functions like memcpy are in C's string.h header.

<comment><USER6> Hey, even C contains a locale-dependent string comparison, namely `strcoll` (since 1990!).

I admit two words "string" and "text" are now interchangable. But that doesn't make strings have less requirements, people are just expecting more out of strings.

</comment></comment></comment></comment></comment></comment></comment></comment><comment> sid-kap The author's last name gives some credibility that they might be good with strings.

<comment><USER9> True, but sadly no relation in this case, it appears.

<comment><USER2> As it turns out, I actually have the Boyer-Moore string searching algorithm as one of the planned features in the Project section on GitHub.

<comment><USER10> Boyer Moore is OK, but there are better algorithms available. The simpler Horspool variant is usually a fair bit faster and also easier to implement. For short strings, e.g. less than 12 character, the ShiftOr algorithm is hard to beat. I've spent quite a bit of time writing and profiling different search algorithms as part of the byteseek project on GitHub. Let me know if you'd like details on other possible options.

<comment><USER2> I would most definitely be interested. I always assumed that certain algorithms are better suited for certain string sizes, but I was never sure which ones. The ideal implementation is probably combining multiple algorithms with ranges of the string size.

<comment><USER10> Absolutely true that there isn't a single algorithm that beats all the others. Of the general string search algorithms which don't use specialized CPU instructions to obtain speedups, I would recommend:

1\. ShiftOr for short strings. Easy to implement.

This algorithm is not sub-linear like Boyer Moore - it examines every position, but it uses bit-parallelism to validate a match, making it outperform algorithms that rely on jumping then separate verification stages, for short strings.

2\. Variants of Wu-Manber for longer strings. Hard to find a good description, but not too hard to implement.

Wu-Manber is a search algorithm designed for multi-pattern searching, based on Boyer-Moore-Horspool and hashes. However, it also performs really well for single-pattern searching. I have encountered variants of this in various places, e.g. Lecroq's in "Fast Exact String Matching Algorithms".

These algorithms use a hash of a q-gram to look up how far it's safe to shift. Q-grams tend to appear less frequently in search patterns vs. single characters, so you get longer jumps, at the cost of reading more characters and producing a hash.

3\. Horspool (or Boyer-Moore-Horspool).

This algorithm performs quite well - not as well as ShiftOr for shorter patterns or Wu-Manber variants for longer ones, but still respectable. It's essentially Boyer-Moore but only using one of the shift tables, which makes it much easier to implement.

4\. Qgram-Filtering by Branislav Durian, Hannu Peltola, Leena Salmela and Jorma Tarhio

For longer patterns, this algorithm outperforms the others mostly. However, it can be a bit complicated to implement well, and it has some nasty worst-cases (rarely encountered) where the performance becomes absolutely dreadful. For that reason I tend not to use it.

There are hundreds of possible search algorithms available now (see [https://github.com/smart-tool/smart](https://github.com/smart-tool/smart) for implementations of many of them with a benchmark tool). However, it's hard to figure out exactly which algorithm is the best given your data and pattern. For that reason, I tend to keep things simple.

I would just use ShiftOr for short patterns, and another one for longer patterns. I would tend to use a Wu-Manber variant there, but Horspool would probably give acceptable performance.

The only other consideration is the time it takes to build the pattern indexes. For short searches, or if you have to re-build the pattern index on each repeated search, it can actually be quicker to just do a naive "check the string at each position" search, since it doesn't require building anything before searching.

<comment><USER11> In my experience, it is difficult to beat a very simple heuristic in most settings: when provided a string, pick the most infrequently occurring byte in that string, and use that as your skip loop in a vector optimized routine such as memchr. If you guess the right byte, you'll spend most of your time in a highly optimized routine that makes the most out of your CPU.

Picking the right byte can be tricky, but a static common sense ranking actually works quite well. At least, the users of ripgrep seem to think so. :-)

For some reason, I've never seen this algorithm described in the literature. It doesn't have nice theoretical properties, but it's quite practical.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> So... whats the magic sauce?

</comment><comment><USER13> I'd be more interested in "this is faster than X" claims if it does a fair comparison - pushing the implementation out of the header. Otherwise (depending on operation) inlining ends up significantly throwing off performance numbers.

That said it's much easier to make faster than libN string libraries if you don't have abi constraints to deal with.

This uses any value struct to hold much of its metadata which causes all sorts of abi issues - basically, if your own app uses this it can't expose it to plugins or anything, otherwise any update could break existing compiled plugins.

<comment><USER2> Most of the STL is header only, which is what the library is compared to in the benchmarks. Both would be just as likely to get inlined.

</comment></comment><comment><USER14> looks loke the api would really shine if coded with c++ constructors and destructors. maybe rvalue ref would help too.

</comment><comment><USER15> Hi, John! Why did you chose to store 'size' and 'capacity' in the 'rs_heap' struct instead of at the beginning of the heap-allocated buffer pointed to by 'buffer'? Did you find it was preferable to have a larger 'rs_heap'?

<comment><USER16> > Why did you chose to store 'size' and 'capacity' in the 'rs_heap' struct > instead of at the beginning of the heap-allocated buffer pointed to by > 'buffer'?

Why would you store the size and capacity as part of the buffer? It makes the buffer more complex (you need a separate unsized struct or some mess special- casing the first 16 bytes or so), wastes heap size, requires dereferencing before you can even check on size & capacity, and makes SSO harder/more limited.

AFAIK both C++'s std::string and Rust's String store size and capacity on the stack, separate from the buffer.

<comment><USER15> > Why would you store the size and capacity as part of the buffer?

To decrease the memory footprint of your small strings. It can see how some uses cases where a large proportion of strings are very small would benefit from it.

I was just curious to know if that design decision was based on analysis of a real use case, or if it was due to a compatibility issue or something.

<comment><USER16> > To decrease the memory footprint of your small strings. It can see how some > uses cases where a large proportion of strings are very small would benefit > from it.

If you do that you have to spill your SSO to the heap way earlier, rapidstring would have 15 bytes SSO instead of the current 31, and std::string would be limited to 7 compared to the current 23~31.

<comment><USER15> It is a trade off. I see the length limit is 23 for SSO-23, but it could have been arbitrarily larger. What is the basis for the determination of those magic length limit targets?

<comment><USER16> The size of the pre-existing non-SSO string. SSO-23 is predicated on a stack layout of (pointer, capacity, size) (as in Clang). That's why SSO-23 applied to the pre-existing MSVC or GCC std::string yields 31 on-stack bytes, they have a stack size of 32 bytes.

</comment></comment></comment></comment></comment></comment><comment><USER17> Is performance really the first thing we should worry about when it comes to string libraries for C? Given the dismal history of character arrays in C, I'd expect safety to be the first thing on the mind of any library implementer, and the first thing mentioned in the README. Also, the second, third, and fourth things.

<comment><USER18> In what sense would safety be such a high priority for a high performance string library? I found this blog post was good at illustrating why undefined...similar to unsafe...operations exist [https://nullprogram.com/blog/2018/07/20/](https://nullprogram.com/blog/2018/07/20/)

</comment></comment><comment><USER19> I wish more containers had stack-resident small-size optimization.

</comment><comment><USER20> >rapidstring is maybe the fastest string library ever written in ANSI C</comment>


Show HN: Boundr – tool to draw and extract polygon boundaries from Google Maps - <AUTHOR> https://getinsightico.com/labs/boundr/ <comment><USER2> An interesting tool that I'm not totally sure of the use case.

Be careful with drawing multiple polygons -- each one stays on the map, but the kml export only includes the last one you drew.

<comment><AUTHOR> Thanks. I personally used this to draw boundaries from images.

If anyone's interested, I can add an image overlay support to make tracing easier.

<comment><USER3> That sounds good, I can help out if you go opensource.

<comment><AUTHOR> Sure. Any recommendations on an open source license?

<comment><USER3> MIT should be good for this project, also Creative Commons can cover your needs. Github should be good to host it, so you can manage your repo with issues and pull requests.

</comment></comment></comment></comment></comment><comment><USER4> Nice, I'd use it. Having the ability to search by address would save a lot of zooming though. Is this just a straight overlay on the existing Google Map widget (which would make customizing easy)?

<comment><AUTHOR> Search by address is coming on its way. Yes, it is a straight overlay on the existing Google Map. Would be easy to switch out the maps as well.</comment></comment>


Best Open Python Books - <AUTHOR> http://pythonbooks.revolunet.com <comment><USER2> I'm a big fan of Text Processing In Python, which has excellent chapters on a bunch of topics including regular expressions, parsers and even compression algorithms. It's available online (from the author's own website) here: <http://gnosis.cx/TPiP/>

</comment><comment><USER3> So, just for a bit of (opinionated) guidance, since the question of "What book should I read to learn Python itself" will never go away, if you are a beginner, I would recommend Zed Shaw's book there, or if you try it and don't like its style (or want to compliment it), then Downey's _How to Think Like a Computer Scientist_ is also pretty good.

If you're already coming from some other language, or would classify yourself as something other than a beginner, the best resource is the official tutorial (<http://docs.python.org/tut>), which isn't listed on that list.

Also since it comes up so often, Dive Into Python is _not_ a resource that I would recommend. From what I've seen, Google's video series is mediocre, and an OK intro if books are not for you. The recent Udacity course hasn't been too great from the small samples I've seen from it either, but I can't say that's enough to say "skip it" conclusively. I also was recently made aware of KOANS for Python (<https://github.com/gregmalcolm/python_koans>) which, though I haven't gone through it, I'd very much agree with ideologically as a good beginner's resource to complement a book.

<comment><USER4> I agree with this, but I'll throw out one other way to learn Python if you already know a programming language:

1\. Blast through just about any book and type in all the code getting it all to run. DO NOT just read the book. Coders constantly equate "I read about it" with "I can do it".

2\. Go to any web framework that has a decent tutorial and build whatever they have you build. If web isn't your thing then find your thing and do that.

3\. Pick a random thing (website, game, log parser) and try to replicate a small version of it.

4\. Then try writing all the major algorithms in that language. Linked Lists, Arrays, Hashmaps, Binary Trees, string search and some hashing at a minimum.

That'll get you up to speed in the language quick, assuming you already know a couple of other ones.

<comment><USER5> Hey Zed! Thanks for all your great work! Signed, your student.

<comment><USER6> Paul McCartney does programming? Woah.

</comment></comment></comment></comment><comment><USER7> There's also "Good to Great Python Reads": <http://jessenoller.com/good-to- great-python-reads/>

</comment><comment><USER8> Learn Python The Hard Way (by zed shaw) <http://learnpythonthehardway.org/>

The online HTML version is free

</comment><comment><USER9> A few more here <http://hackershelf.com/topic/python/>

</comment><comment><USER10> <http://web2py.com/book> I never see any of the cool guys mentioning web2py. Thinking of using it in an upcoming project. Wonder what is "wrong" with it? :-)

<comment><USER11> [http://www.reddit.com/r/Python/comments/ex54j/seeking_clarif...](http://www.reddit.com/r/Python/comments/ex54j/seeking_clarification_on_pylonsturbogearspyramid/c1bo1v5) summarizes my feelings on it nicely.

<comment><USER12> And if I may add mine - the arguments brought forth by Jacobian (Kaplan Moss, of Django fame) and Mitsushiko (Ronacher, of Flask fame) belong in the fiction department. Hundreds of web2py apps later, no one is confused by the additional 15 builtins, or by the concat-then-exec behavior. I am active on the web2py mailing list, and in two years and thousands of newbie questions, I don't remember a single one where this caused the fearful confusion that jacobian and matsushiko fear so much.

If you have any experience programming and want to learn Python for the purpose of developing web applications, the web2py book is a good resource.

</comment></comment></comment><comment><USER13> Any idea why The Django Book (<http://www.djangobook.com/>) is not on the list? It seems to be the go-to Django beginner's book for many people.

<comment><USER14> The Django Book, though great, is ridiculously out of date - the print version is written for Django 0.96, the incomplete web version is for Django 1.0, and Django 1.4 was just released.

It's a great resource, and was very useful to myself when learning Django back in the day, but the regular Django docs have far surpassed it on my made up usefulness scale.

<comment><USER13> Well I guess that makes sense, seeing that version 2 hasn't been updated since 2009. Too bad though, it is really well-written.

</comment></comment></comment><comment><USER15> Here's one, Building Skills in Python: <http://www.itmaybeahack.com/homepage/books/python.html>

</comment><comment><USER16> Learning Python by Mark Lutz is worth a mention for those who want to understand the "why" as well as the "how".

<comment><USER17> But Learning Python isn't free, is it?

<comment><USER16> Ah, yes, correct.

</comment></comment></comment><comment><USER18> I would add the Python Cookbook. Technically the book is not free but all the code is available at ActiveState.

</comment><comment><USER19> The Python Challenge is a great way to apply what you learned from other resources towards a fun practical experience: <http://www.pythonchallenge.com/>

</comment><comment><USER20> <http://www.greenteapress.com/thinkpython/thinkpython.html>

</comment><comment><USER21> Thank you. Nice to have them in one place and free at the same time.

</comment><comment><USER22> thanks for the links.</comment>


Google Is Said to Not Renew Pentagon Contract That Upset Employees - <AUTHOR> https://www.nytimes.com/2018/06/01/technology/google-pentagon-project-maven.html <comment><USER2> Existing discussion: [https://news.ycombinator.com/item?id=17208892](https://news.ycombinator.com/item?id=17208892)

</comment><comment><USER3> This sends a more powerful message than if the corporation had just avoided the work in the first place. I am hopeful and inspired by the employees stand.

Lights are shining through the cracks in the conflict dominated narrative of these times, and we have never had greater means to analyse and resolve our troubles with each other and with our environment.

Thankyou Googlers for showing up for resolution.

<comment><USER4> In the end, who-ever ordered that work is still going to get what they want. They'll just hire it out to someone else, no?

<comment> sjm-lbm That's one of the strange problems here. It'll probabally get farmed out to a less technically proficient team which, ironically, could lead to an increase in the loss of innocent life.

<comment><USER5> That could be the outcome, yes, or the outcome could be entirely different. It could be that the projects gets farmed out to a less-than-competent contractor that is willing to work on it, with a result that is so spectacularly bad (along any given dimension, not just how many innocent lives are affected) that the project dies.

That, too, is a complete guess and just one of many hypothetical outcomes. I don't think there is _any_ sufficient ground to infer that "if Google does not do it, it will be worse".

</comment></comment></comment></comment><comment><USER6> It seems like most of the commenters in this thread accept that military AI is inevitable, somebody will do the work. Could we collectively make a different choice? It's a damn important choice to make.

</comment><comment><USER7> > could be used to improve the targeting of drone strikes

They prefer inaccurate drone strikes that kill innocents?

</comment><comment><USER8> How does NYT software allow a backwards "smart quote" to get published?

> "So, we are working on it,

<comment><USER9> Unicode copy-paste

</comment></comment><comment><USER10> In capitalism, someone else fills the void in a profitable market.

Will it be another large company or a startup?

<comment><USER11> "If we don't, someone else will" is not an ethical get-out-of-jail-free card. Literally anything will happen in a capitalist market, if someone is willing to pay for it. Does that mean everything that someone will pay for is ethical and you shouldn't bother trying to abstain from it?

If you want to be pragmatic about it, the fewer people who are willing to do X, theoretically the higher the price goes, possibly to the point where no one wants to pay to do X anymore. So refusing to do X is not just an empty gesture.

<comment><USER12> > "If we don't, someone else will" is not an ethical get-out-of-jail-free > card.

True, but at the same time, "let's not do this" also isn't an ethical get-out- of-jail-free card. Google engineers can act all high and mighty morally, but guess what: it doesn't matter at all either way.

<comment><USER13> What Google engineers are doing in this situation is strictly better both in the utilitarian and in the Kantian sense. Saying "it doesn't matter at all either way" is a non-argument.</comment></comment></comment></comment>


He had AppleCare. Then Apple sent his broken iMac to Best Buy - <AUTHOR> https://www.zdnet.com/article/he-had-applecare-then-apple-sent-his-broken-imac-to-best-buy/ <comment><USER2> So. Why do you need someone at Apple to replace a harddisc/memory module ? Why does it matter if someone at Apple installs your OS or someone at Best Buy does ?

People seem to be making an issue out of nothing. I'm sure he would have screamed a lot louder if he hadn't bought AppleCare. At least Apple FIXED his iMac rather than just demanding he bought a new one...

You can't win against some people.</comment>


Massive Multi-Touch on the Web [Video Demo] - <AUTHOR> http://www.intuilab.com/technology/html5

<comment><USER2> Thanks for declaring your patent for continuous gesture recognition. Wouldn't want to confuse that with a normal interaction.</comment>


Silly mistake on Wikipedia? See Dr. Satnam in cast and plot - <AUTHOR> http://en.wikipedia.org/wiki/2012_(film)

<comment><USER2> I'm missing what the mistake is, I think. Though in any case the article's talk page might be a better place to bring it up: <http://en.wikipedia.org/wiki/Talk:2012_(film)>

<comment><AUTHOR> Dr. Satnam, who is the physicist who discovers the whole phenomenon (as told in the plot) is mentioned as an Indian IT support manager? Is that a joke??

<comment><USER2> Oh ok, I see that when I look at the previous version in the article history; it looks like it was fixed 30 mins ago though: [http://en.wikipedia.org/w/index.php?title=2012_(film)&di...](http://en.wikipedia.org/w/index.php?title=2012_\(film\)&diff=466686468&oldid=466351744)</comment></comment></comment>


Dart2js: new browsers can break deployed apps - <AUTHOR> https://code.google.com/p/dart/issues/detail?id=13285 <comment><AUTHOR> You need to recompile your Dart apps from time to time until bug 13285 gets fixed.

If you have an app deployed, it could break every day. You need to test it in every new version of your supported browsers.</comment>


Google confirms dark mode is a huge help for battery life on Android - <AUTHOR> https://www.theverge.com/2018/11/8/18076502/google-dark-mode-android-battery-life <comment><USER2> they decided to open their eyes? the community proved that on the first oled phone, and it was already a big difference.

most apps from android 2 onwards have a "total dark oled" theme because of this initial community research</comment>


Ask HN: What SDK was Temple Run created with? - <AUTHOR>

I have a hunch they used Unity 3D (http://unity3d.com/) but I couldn't find it in their showcase, nor could I find any articles online on how they developed it. Can anyone confirm? <comment><USER2> Have you asked the developer?</comment>


How your resumé actually gets reviewed at tech companies - <AUTHOR> https://medium.com/the-mission/2-minutes-thats-how-long-recruiters-take-to-review-your-resum%C3%A9-make-it-stand-out-1634bc72bf7 <comment><USER2> No mention of Applicant Tracking Systems (ATS)</comment>


What's my lat-lon? - <AUTHOR> http://whatsmylatlon.com

<comment><USER2> They should drop the needless extra digits. There is no way that they know my position (or anyone's position) accurately enough to need to report it to a resolution of approximately 100 nanometers.

</comment><comment><USER3> Not bad, but you should get rid of jQuery, it's absolutely not needed in here.</comment>


Mobile startup entrepreneurs - <AUTHOR>

<comment><AUTHOR> Hi Guys. We are a mobile startup that also writes a blog about the industry.If you are a mobile startup, we would like to profile your company. EMail us. cribornament (at) gmail (dot) com cribornament (dot) com

<comment><USER2> link: <http://www.cribornament.com/></comment></comment>


Show HN: Chardin.js, beautiful instructions for apps - <AUTHOR> http://heelhook.github.com/chardin.js/?hn

<comment><USER2> I did raise a ticket on this but as a more general thing:

What is it with js libraries using data- tags without any kind of "namespacing". For example this library uses data-intro which could easily clash with other things in future.

Would it not be good for everyone to be a good citizen and instead do things like data-ch-intro? Just a few characters from your project name to reduce the chances of clashes.

<comment><AUTHOR> I think that's an interesting point, and certainly a problem that will grow as data attributes become even more widely used.

Perhaps there's even use for a little database that keeps track of the different data attributes used by different libraries so that authors could easily find out if their name of choice will collide with someone else's, at least as a forewarning to its user about possible incompatibilities.

<comment><USER2> Another option (Although much more complicated) would be to make the used data attributes configurable in the script.

Maximum flexibility for the end-user but a bit of a PITA for library developers.

<comment><USER3> This is the way to go, and really not that hard to implement for the library developers

</comment></comment></comment></comment><comment><USER4> Looks really nice, but I always feel that if you need some kind of guided tour for your app, you've already shot yourself in the foot.

<comment><AUTHOR> Not necessarily. I do agree that requiring a tour can be an indication that your app is too complex, but sometimes its just a good opportunity to display some light marketing (as in, show stuff behind your app that might be abstracted from the interface in order to avoid cluttering it).

In the use case I built Chardin.js for, I'm using it to display stuff that happens behind the scenes that the user is abstracted for, but I still want the user to know its happening (perception of value is almost as important as value delivered!).

<comment><USER5> Also, some web apps are power tools for a specific group of employees, rather than a consumer-facing app. In college I worked on a dormitory reservation system that was fairly complex, and was only used by administrators and front desk workers (and they went through brief training for the system). I built a quick little "help mode" overlay system that worked well enough, but something like this would have been a great alternative.

<comment><USER4> True, there are certainly exceptions. I wouldn't want this on a social network, but something like a browser based 3D modeling tool is another story.

</comment></comment></comment></comment><comment><USER6> Very well done! I personally like this style of on-boarding versus the "tour" style where you have to click around a bunch of times to see everything. Again, nicely done!

<comment><AUTHOR> Yeah, I loved the recent gmail new compose "tour" and used it as inspiration because I'm not too fond of multi-steps tours.

</comment></comment><comment><USER7> This is awesome, I literally was going to research javascript intro/tutorials today. Off to a great start!

Have you tested across browsers? I just need it to work in webkit/mozilla. maybe ie10.

<comment><AUTHOR> It does work on webkit/mozilla. I don't have access to IE10 though, so don't know about it.

</comment></comment><comment><USER8> And it works in IE8! Thanks for this.

<comment><AUTHOR> Cool! Totally accidental as I don't have an IE to test on, so good to know! Thanks :)

<comment><USER9> <http://www.browserstack.com/> has been great for me. I hated having to keep a bunch of windows VMs hanging around on my HDD just for IE testing.

</comment></comment></comment><comment><USER10> I don't understand why there are some people who doesn't open source their work to help other people, but try to comment on goood things. Open source thing first, comment later, please. Thank you, good people.

</comment><comment><USER11> Very cool!

I think it would be worth displaying each message one at a time with a delay in between (that way they could function as a sequential tour in addition to coach marks).

<comment><USER12> Something similar to that was posted on HN a few weeks ago, unfortunately I don't have the discussion link but I did star the repo[0]

[0] <http://usablica.github.com/intro.js/>

<comment><AUTHOR> Yeah, I contributed some code to that repo and wrote the rails gem for it[0] and I'm a fan of it, this is just a different take that I found works better for some use cases.

Thanks for sharing!

[0]: <https://github.com/heelhook/intro.js-rails>

<comment><USER12> Definitely two excellent use cases and implementations of a similar idea (step-by-step "tour" v. full-page documentation/explanation), good job.

</comment></comment></comment></comment><comment><USER13> Very impressive. It doesn't respond well to resizing the browser but maybe it is just a matter of playing with css "position" or something. Also, great name!

<comment><AUTHOR> Thanks! Yeah, I haven't implemented the resizing support, mind filing an issue?

Thanks!

</comment></comment><comment><USER14> Really cool, can't wait to use it :)

</comment><comment><USER15> A new one of these shows up on hacker news once a week, but this is the best one yet.

</comment><comment><USER16> Overly picky, I know, but it doesn't cope with font size changes...

<comment><USER17> I just create a patch for that <https://github.com/heelhook/chardin.js/pull/2>

</comment></comment><comment><USER18> Awesome :) This stuff is neatly done.

</comment><comment><USER19> It doesn't open again in Firefox 20

<comment><USER20> Or 19

<comment><USER21> And Chrome Version 23.0.1271.95

</comment></comment></comment><comment><USER22> Simple and elegant, very nice :)

</comment><comment><USER23> looks neat :). Good one.

</comment><comment><USER24> really impressive</comment>


In Ecuador, Political Actors Must Step Away From Ola Bini's Case - <AUTHOR> https://www.eff.org/deeplinks/2019/08/ecuador-political-actors-must-step-away-ola-binis-case <comment><USER2> The clear vendetta against Assange, his colleagues (either direct or indirect), Wikileaks and publishers in general is a clear and present danger to the rule of law across the Western world.

Journalists, activists, publishers and security researchers are _all being directly harassed and maligned_ by the US and its allies purely because Wikileaks revealed information the US would rather it hadn't. It's a disgusting affront to the rule of law.

Craig Murray's latest piece on the DNC lawsuit being thrown out is incredibly informative about exactly how this narrative is created and spun to turn people against WL and its affiliates / allies / peers.

[https://www.craigmurray.org.uk/archives/2019/08/in-the- world...](https://www.craigmurray.org.uk/archives/2019/08/in-the-world-of- truth-and-fact-russiagate-is-dead-in-the-world-of-the-political-establishment- it-is-still-the-new-42/)

</comment><comment><USER3> The article talks about this case being a political one, but they never make clear _what_ political motivation is involved...

<comment><USER4> Makes sense to me. If they did, we'd be discussing the merit of those motivations and the ideas of each side. But that's the opposite of what they're trying to achieve. Until there's a reasonable court case happening, they concentrate on getting the politics away. A proper trial for Ola Bini is the goal and what people should be talking about first.</comment></comment>


Ask HN: Which Open Source Project Could Use UI Help? - <AUTHOR> To celebrate the launch of our new service (http://fairpixels.pro) where we offer unlimited UI and Brand design to Software Companies, we wanted to help one or two OSS projects for Free by redesigning their UI. No strings attached. Which OSS could really benefit from a UI (+ possibly branding) upgrade? Who do we contact? <comment><USER2> My open-source project just launched last month, [https://servicebot.io](https://servicebot.io), we've been struggling with our branding and gaining traction.

Our code is on github at [https://github.com/service- bot/servicebot](https://github.com/service-bot/servicebot)</comment>


New iPad Invitation Poster Making App DIY - <AUTHOR> http://itunes.com/app/Invitempt

<comment><AUTHOR> Invitempt is invite making for the DIY generation. So cool you can create any custom invite, poster or card with any graphic off the internet. It hooks into your contacts & you can mail them or save to your device and upload to Evite, Facebook or whatever... itunes.com/app/Invitempt for iPad Amazing!

</comment><comment><AUTHOR> LMK what you think or features you are dying for. Please 5 star it---</comment>


Stanford CS major seeks sales/marketing monkey - <AUTHOR> http://andrewchenblog.com/2011/02/05/stanford-cs-major-seeks-salesmarketing-monkey/ <comment><USER2> Can we stop saying monkeys? This attitude does not help.

A software business needs people with skills to _make_ stuff as well as people with skills to _sell_ that stuff. Neither is more important than other, nor can exist without the other.

<comment><USER3> If neither is more important, why do the business monkeys get paid significantly more than the programming monkeys?

<comment><USER4> "Important" is subjective. Compensation equals the intersection of supply and demand. There are fewer business monkeys than code monkeys, and demand is higher, so they make more. Teachers are more "important" than shortstops, but who are better compensated?

Nerds never seem to get this. If the MBAs are so worthless and overpaid, pick up the reigns and do it yourself... what's that? You say dealing with people is difficult? .......

<comment><USER5> I really doubt that there are fewer business monkeys than code monkeys. In 2008, 335,000 students graduated college with a degree in business, while only 40,000 graduated with a degree in computer science or a related field. An additional 70,000 studied other types of engineering, meaning there are about three business majors for every engineer.

<http://nces.ed.gov/programs/digest/d09/figures/fig_15.asp>

</comment></comment></comment></comment><comment><USER5> Some businesses are run by engineers and are really successful because they solve difficult problems really well. They have sales/marketing people, but their main focus is in engineering. Google is a great example of such a company.

Other businesses are run by businessmen and are really successful because they can sell and market things that other people/businesses are willing to pay a lot of money for. They might have a few coders, but they focus on sales because their business is in exploiting the difference between the value some software brings and the cost it takes to produce the software. Oracle does this, and they're tremendously profitable, too.

Engineers make things. Salespeople get people to pay money for them. They're both necessary, but the importance of each really depends on the industry. It doesn't take a few thousand of the brightest minds in the world to make a mediocre database. And it doesn't take a giant marketing team to sell ad space through an auction.

But if you're going to change the world with new technology, you'll want a company run by engineers. If you're going to exploit a niche in corporate bureaucracy, you'll want lots of sales/business guys.

<comment><USER6> Do you have any data to support your assertion, i.e, that companies with engineer CEOs are in aggregate more successful than those run by non- engineers? We can go back and forth anecdotally, but that doesn't mean much :-). You may very well be right, I'm just wondering.

<comment><USER5> That's not what I'm trying to say. I'm saying some businesses are more effectively run by engineers and others are more effectively run by MBAs. It depends on what the business is trying to do.

</comment></comment></comment><comment><USER7> There are jerks in all walks of life. If you don't like your MBA, go find a better one. Treating people like monkeys is the problem, not the solution.

</comment><comment><USER8> I think they're trying to be funny. It certainly does not come across as funny, however. So, if they really seek a sales and marketing person, they should avoid using loaded words like monkey, droid, etc.

See the satirical post about the terms rockstar and ninja, as it refers to employees. <http://news.ycombinator.com/item?id=2180233>

</comment><comment><USER9> To be fair, I've hung out with some of the folks in the business school here at the UChicago, and there are some really bright and useful folks that I would be delighted to work with again. Participated in their new venture challenge thing with the bump folks and I found my teammates and many of the other folks there to be smart, motivated, and very skilled at necessary things that I never, ever want to become good at.

</comment><comment><USER10> Never Work for a Stanford Student Again [http://norfolk.cs.washington.edu/htbin- post/unrestricted/col...](http://norfolk.cs.washington.edu/htbin- post/unrestricted/colloq/details.cgi?id=948) seems relevant.

</comment><comment><USER11> If I'm a code monkey, where's my banana?

What? I don't even get a banana?

Screw this, I'm going to be a Librarian.</comment>


Are US Courts Going Dark? - <AUTHOR> https://www.justsecurity.org/30920/courts-going-dark/ <comment><USER2> Counter example: Volkswagen diesel case, Judge Charles Breyer

All litigation should follow this model. No delays, and transparent to the public. No PACER account needed.

</comment><comment><USER3> What would be the significance of courts passing from predominantly public to private? Are there are clues from history about possible future effects of this?

<comment><USER4> One consequence is unbalanced justice.

In the case of mandatory binding arbitration, as a citizen you will be denied public access to prior cases. The monkey court that is arbitration does not require the arbiter to be impartial, the arbitration is not required to follow the rule of law, and the previous cases are secret to everyone but the corporation you must challenge.

In arbitration you face a biased arbiter, secret proceedings, with secret results. You face unlimited financial liability and you don't know what a good argument will be, as all prior arguments are secret.

We won't the consequence of a secret court system run for and by corporations for a long time.</comment></comment>


Smartphone Hardening non-root Guide 2.0 (for normal people) - <AUTHOR> https://dev.lemmy.ml/post/38770 <comment><USER2> A bunch of app suggestions for reading reddit and watching youtube is terrible security advice and borderline dangerous. People should refrain from providing any (pseudo) security advice unless they know what they are talking about.

There may exist people with a genuine need for device hardening and I hope they do not read this article.

EDIT: I'll leave my comment but I on second reading I notice that the author is specifically targeting normal people and is trying to make it accessible. Arguably should still not be called "hardening".

<comment><USER3> Came here to post this. The guide has nothing to do with actual hardening. Recommending those apps is borderline idiot's assumption of what security is.

I'd rather recommend to check the postmarketos wiki for supported devices, check what's the latest upstream aosp builds (like omnirom builds) and upstream supported kernel versions and recommend to buy based on that information.

Turned out for my case that there aren't many "real" aosp compatible devices.

The ones I tried out and confirmed were Nexus 4/5P (not 5X!), sony xperia x and compact variant aka kugo, xiaomi redmi note 4 and 8/8T (mido and willow or gingko) and some older, very very outdated devices.

Owned a kugo for a while but android 10 builds became super unstable and caused a lot of crashes and reboots.

Went for xiaomi redmi note 8 (ginkgo) and ignoring the shitty needing-windows- and-168h to unlock bootloader problem it's a very nice device.

Compiled LineageOS from sources, and together with the official releases for Magisk, Blokada, Appwarden, Oeffi, OsmAnd+ and Orbot/TOR browser with ublock0 and umatrix it's pretty much as tracker free as possible.

I also would never recommend any android lower than 10, due to the privacyguard integration that is missing in older versions (privacyguard aka app rights management for location, wifi access, storage access etc).

Sidenote here: TOR browser includes mozilla telemetry service, but you can disable that with appwarden. Reported it upstream, didn't have the time to fix it yet.

The only tracker regarding exodus' list is actually the crashdump reporting feature in Telegram which I disabled with Appwarden.

I also would recommend to use f-droid or the github releases of apps you want to install. A lot of builds on f-droid are outdated for years, so it's better to check the source directly to be sure.

Additionally, never install gapps, never install firefox for android, never install chrome, never install whatsapp or any fb product, never install apps that require admob or play services.

Check spywarewatchdog's blog or do mitmproxy audits yourself.

[1] [https://omnirom.org](https://omnirom.org)

[2] [https://wiki.postmarketos.org](https://wiki.postmarketos.org)

[3] [https://f-droid.org/packages](https://f-droid.org/packages)

[4] [https://reports.exodus-privacy.eu.org](https://reports.exodus- privacy.eu.org)

[...] probably forgot a hundred links...but textareas on smartphones are unusable.

<comment><USER4> >The ones I tried out and confirmed were Nexus 4/5P (not 5X!)

Why not the 5X? I have flashed AOSP Roms on my old 5x lots of times.

<comment><USER3> My knowledge is a bit outdated when it comes to the bullhead (and/or angler because they shared parts) kernel mods, but last time I checked huge parts of the firmware were relying on a legacy kernel version 3.x which is literally a decade old by now... And additionally wifi/bt/baseband had huge amount of proprietary blobs.

Please correct me if I'm wrong but it seems as this is also the case today.

</comment></comment></comment></comment><comment><USER5> >iPhone does not allow you to have privacy due to its blackbox nature

This is a stupid argument. My mobile banking app isn't open source either but I'm pretty sure it's reasonably private. Privacy <> open source. Two entirely separate topics than aren't mutually exclusive (or inclusive).

Besides I own & use both iOS & Android. My privacy worries are disproportionately on the android side. The respective pi-hole logs alone give me pause for thought. Canonical android seems OK, but the stuff that actually ships on specific manufacturers is infested for lack of better word. (Why did the pi-hole average block rate shoot up 400%? oh right friend with her android phone visited).

<comment><USER6> Block rates don't mean that much though. With Apple everything on an out-of- box iPhone goes through them so they only need one connection. A Samsung phone will want to talk to Google, Samsung, and whatever crap they have preloaded (in my case Facebook, OneDrive, "UpDay" and many others). They even made most of those system apps in case I'd have the audacity to remove Facebook :/ Of course they know how much I need it, much more than me.

Deep packet inspection is the only way to really tell (if they haven't done cert pinning, which I assume they have for stuff like activation).

I think the author's point is that you can at least harden Android a lot by uninstalling system apps and services, which you can't do on Apple. There's also many more options available for mitigation, like firewall software. I don't know whether that brings it to a better level than Apple. However loading another firmware certainly will (think LineageOS with MicroG or even nothing at all).

But I do agree that an Android out of the box (for most vendors!) is full of tracking, way more than Apple seems to do. And of course almost no user even tries to remove system apps.

<comment><USER5> >Block rates don't mean that much though.

Agreed. It's very much a questionable approximation. I do think it is indicative of the manufacturer's overall mindset towards these matters though.

>There's also many more options available for mitigation, like firewall software. I don't know whether that brings it to a better level than Apple.

You can probably do something like NextDNS. Most devices seem to use a domain not hardcoded IP

</comment></comment></comment><comment><USER7> If you're looking for a hardening guide for iOS, then try the iVerify app. It will help you detect jailbreaks, check critical security settings, and teach you about many more.

[https://blog.trailofbits.com/2019/11/14/introducing- iverify-...](https://blog.trailofbits.com/2019/11/14/introducing-iverify-the- security-toolkit-for-iphone-users/)

<comment><USER8> Hmmm. I know a thing or two about mobile devices and my best advice is to avoid installing ANY third-party applications, especially any "security/antivirus" apps that request dangerous permissions in order to break out of their sandbox.

I have examined several antivirus apps from well-known security companies and they ALL cause more privacy/security issues than most malware does.

Third party advertising SDK's that harvests the users location and social media data, accessing WhatsApp internal databases, access the users microphone, clipboard and camera.

But to be fair I have never looked at the app you mentioned but I have my doubts.

</comment></comment><comment><USER9> While I disabled a bunch of things using "Universal Android Debloater", there is a non-zero chance you wil end up disabling something important, or causing your phone to bootloop (which can require a full reset to fix). This shouldn't be recommended for non-nerds.

<comment><USER10> Yeah I used all the privacy settings of WPD (Windows Privacy Dashboard) on my computer and was never able to re-enable my microphone for visio-conferences !

</comment></comment><comment><USER11> Add _nomap to your SSID to stop Google from using your access point for location services.

[https://support.google.com/maps/answer/1725632?hl=en](https://support.google.com/maps/answer/1725632?hl=en)

<comment><USER12> The fact that you have to change your SSID to opt out of third parties using it is... shady at best. What happens when two competing third parties have conflicting name requirements for you to opt-out?

<comment><USER6> And how do you know they actually obey it? :/

Knowing Google it will still go somewhere.

</comment></comment></comment><comment><USER13> Meanwhile, about four posts down on the same HN front page is an article announcing Check Point just uncovered about 400 hardware exploits affecting Snapdragon chipsets so even after bulletproofing the OS you still have a zero trust environment and imho we best either get used to that or switch back to pen and paper processing.

[1] Snapdragon chip flaws put 1B Android phones at risk of data theft - [https://news.ycombinator.com/item?id=24092545](https://news.ycombinator.com/item?id=24092545)

<comment><USER14> Came here to mention this as well.

Really negates the security benefit to running a specific type of hardware.

A design is only considered secure until we realize that it isn't. And who can say that these vulnerabilities weren't being exploited before being disclosed to the public?

In my opinion choosing to have a smartphone in itself means accepting a degree of privacy loss of and risk if security issues in one form or another.

Phones are a big attack surface, and no design is perfect.

</comment></comment><comment><USER15> One of the first things this article lists is enabling Huawei screen capture and record. This is overall an unserious guide and of questionable provenance at best. Doesn't belong on HN.

</comment><comment><USER16> A low hanging fruit for locking down problematic apps would be to use Android profiles: [https://medium.com/@kloudtrader/reducing-whatsapp-digital- fo...](https://medium.com/@kloudtrader/reducing-whatsapp-digital-footprint-in- the-age-of-facebook-3e087fee0ae0)

</comment><comment><USER8> I find it ironic that the website that gives tips on hardening a mobile device requests that I enable JavaScript to view it.

I never enable JS on a mobile browser especially Safari on iOS.

There is something very, very wrong with WebKit and some very disturbing crash logs appear when viewing the WWW with JS enabled.

</comment><comment><USER17> For a secure and private OS which doesn't need root you can try GrapheneOS: [https://grapheneos.org/](https://grapheneos.org/)

No need to "harden" it after you install because things are locked down by default.

I've been using it for the last six months and I think it's fantastic.

<comment><USER18> How "hardened" is it? Can you completely control network traffic and permission access of every installed app?

For example, if you wanted to spoof the android_id (something you usually can't do with regular permissions) to some app, could you do that?

Also, is app storage isolated? This is a new feature in Android 10 but a pretty easy way to allow for cross-application tracking/fingerprinting in earlier Android versions.

I currently run Lineage with microG but I still had to get root access to effectively counter those things.

</comment></comment><comment><USER19> Great guide but I don't expect regular people being able to follow even the "not nerd" steps.

</comment><comment><USER20> I give it very low grades.

It suggests installing many closed source, Advertising-ridden apps from the play store.

And to one of those ad-ridden apps, it even suggest you use adb to give it supper powers of sorts.</comment>


Apple laid the groundwork for smart glasses at WWDC - <AUTHOR> https://www.businessinsider.com/apple-glasses-hints-from-wwdc-2019-2019-6 <comment><USER2> Hopefull Apple can resist the temptation and leave the camera out.

</comment><comment><USER3> They can take advantage of eyewear's rediculous margins and just start selling Apple branded frames with built-in AirPods.</comment>


Ask SAMA / PG: Will YC be dogfooding SAFE's for its own investments? - <AUTHOR>

<comment><AUTHOR> In the past YC invested with Series AA ( [http://ycombinator.com/seriesaa/](http://ycombinator.com/seriesaa/) ). Will it now use SAFEs ( [http://ycombinator.com/safe/](http://ycombinator.com/safe/) )? If not, would you mind elaborating why?

Thanks!</comment>