Oracle seeks $9.3B for Google's use of Java in Android - <AUTHOR> http://www.networkworld.com/article/3048814/oracle-seeks-93-billion-for-googles-use-of-java-in-android.html <comment><USER2> Man, Oracle really does not give a shit about its reputation.

<comment><USER3> You wouldn't give a shit either if you could get nearly 10bln dollars for it.

Most people would sell their mother for that amount, and it's a bit hard to come to your investors and say well guys we could've gotten 10bln which would give you a heck of a dividend but we cared about our reputation too much so we passed on it.

<comment><USER4> Yeah, but how much have they expended on this legal adventure already? It has been going on for ~6 years now and there's no end in sight, no clear victory for anybody. Doesn't Oracle have better things to do?

<comment><USER3> Considerably less than 10bln, say even if they spent 100m on legal fees, that's still about 1% of what they would end up earning that's 1:100 return on investment no one would in their right mind would pass on that.

<comment><USER4> OK, but it is still a roll of the dice and there are costs beyond legal fees. 1:100 is _highly_ unlikely. Lawsuits are a crappy way to make money for a software company.

<comment><USER5> Creating a startup to service the CIA is a pretty crap move too; Oracle's launch was largely fueled by creating the database for the CIA in the late 1970s.

<comment><USER3> You mean like Google(Keyhole/Google Earth) and Facebook which both received funding from the CIA through their investment company In-Q-Tel?

[https://www.iqt.org/](https://www.iqt.org/)

<comment><USER5> If you're going down that path, might as well reference that the research done by Page & Brin that created Google was funded in part by DARPA.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> What does the API ruling mean for the rest of us?

If I were to write an ISC licensed clean room implementation of Apple UIKit, would Apple be in the right to bury me?

If Oracle thinks they can ask for 9.3 billion and are likely expecting to get 1 or 2, it sounds scary.

But I hope this will lead to more and more open APIs without a single entity holding the keys and people being very scared to use closed and copyrighted APIs. If less people use it, its importance will equally be diminishing. That's the hope.

<comment><USER7> _If I were to write an ISC licensed clean room implementation of Apple UIKit, would Apple be in the right to bury me?_

"The appeals court reversed the district court on the central issue, holding that the "structure, sequence and organization" of an API was copyrightable"[0]

That's pretty clear. Even if you re-implement every function by hand, if you keep the same API, then it can be a copyright infringement. Note that you may still have other defenses such as license agreements, or fair use. But this ruling considers copying API/function declarations the same as actual code.

[0] - [https://en.wikipedia.org/wiki/Oracle_America,_Inc._v._Google...](https://en.wikipedia.org/wiki/Oracle_America,_Inc._v._Google,_Inc).

<comment><USER8> How did the original PC clones get away with reverse engineering / re- implementing the IBM BIOS? Or alternatives to MS-DOS like DR-DOS? Is it just that nobody thought to use this attack?

<comment><USER9> I don't think anyone but Oracle would stoop so low as to use this attack.

<comment><USER10> What this means to me is do not use Oracle MSSQL use mariadb [https://mariadb.org/](https://mariadb.org/) instead.

<comment><USER11> I'd be wary to use the opensource alternative that shares APIs with Oracle's. Postgress sounds like a safer bet to my ears.

</comment></comment></comment></comment></comment></comment><comment><USER12> Does anyone have any insight/source on why Java was a good choice for Android at the time it was created? I got lost in a sea of garbage while trying to find anything about that. I would like to understand why Java and not something else.

<comment><USER13> It's a fast, open source, memory managed language that already had very good traction.

Google just underestimated the idiocy of the US court system.

<comment><USER14> Java was chosen by Android Inc. though, not Google.

<comment><USER13> You're right, but Google released the first Android handsets.

Actually I forgot when the Sun/Oracle sale happened. Android 1.0 was released before Oracle bought Sun. Though I suppose there was always the possibility of legal action by Sun.

<comment><USER15> Google knew Java was a risk for Android and memos disclosed in the court case show that Google was trying to figure out possible solutions.

Schmidt (being an ex-Sun executive) reached out to Sun to talk about an alliance.

[http://icdn4.digitaltrends.com/image/google- schmidt-610x452....](http://icdn4.digitaltrends.com/image/google- schmidt-610x452.png)

</comment></comment></comment></comment></comment><comment><USER16> 9.3 billion for doing squat and not improving a damn thing. get real.

<comment><USER17> For the record, it was not Oracle that was "doing squat". Oracles's JDK keeps improving, and btw Oracle is paying for most of it. Since Android "fork", Oracle added generics and lambdas and G1 and bazillion other improvements.

The company that was "doing squat" was Google. Their shitty (and incompatible) Java implementation is where Oracle's was 6 years ago.

<comment><USER18> I am afraid you are digressing. Oracle maintains and has rights for the language Java and Oracle JVM. Google has power over Android. codecamper isnt talking about what improvements current Java has or how how shitty the Android java is. IT is about Android itself. Google contributed most to Android, Oracle did not.

<comment><USER17> That is not what "digressing" means. When someone talks on topic, that is not "digressing". Why not check an online dictionary, they are free and super helpful.

<comment><USER19> Im afraid you are digressing from the points given by bipin_nag. :-)

</comment></comment></comment></comment></comment><comment><USER20> What was the reason that the appeals court overturned the ruling on APIs?

For $9.3 billion - surely it is is economically viable for Google to spend 10 million on a coordinated and public campaign to lobby lawmakers to change the law? If they did it publicly then they'd have huge support.

Heck, Google could even openly label Oracke as greedy, conniving bastards and almost certainly no amount of protest from Oracle would be convincing! All Google need to point out is that Oracle are screwing a majority of Android users.

A side note: they must truly be regretting choosing Java.

<comment><USER21> Changing the law would not be retrospective though.

<comment><USER22> Unless they made it retrospective.

<comment><USER20> Or the Supreme Court did their job and agreed to listen to Google's arguments.

</comment></comment></comment></comment><comment><USER5> Never understood why Google didn't acquire Java from Sun.

</comment><comment><USER23> > "In the first trial, a jury found Google had infringed Oracle's copyright by > copying into Android the "structure, sequence and organization" of 37 Java > application programming interfaces"

I don't think these trials have been about technically using Java as a whole have they? They are about specifically copy/pasting those 37 classes into the Android code base. If I remember correctly, all other part of Android were basically a clean room implementation that did not even allegedly infringe on anything. They just screwed up in those few places.

<comment><USER24> IIRC the appeals court ruled that the "'structure, sequence and organization' of an API was copyrightable". So even if they hadn't copied a small number of classes¹, they'd still be liable if that decision holds.

¹ Or accidentally implemented them using the exact same code, which is quite possible given how trivial the code in question was - see rangeCheck

</comment></comment><comment><USER25> Could CPU instruction sets be copyrighted? Could emulation become a crime?

</comment><comment><USER26> This may be one of the reasons Google invented Go (language). I wouldn't be surprised to see if future versions of their platforms are Go-lang only. Make Java obsolete

<comment><USER27> Go is entirely pointless as a GUI language - it has a niche it tries to fit well.

Dart is much much better as a Java replacement and efforts like flutter are really promising for cross language dev - IPC architecture behind it and chrome (Mojo) is how Android should have been implemented, then it doesn't matter what languages you use they are trivial to swap because IDL defined interfaces can be reimplemented transparently and client API can be generated automatically. Instead you are locked in to their JVM

<comment> awinter-py interesting to see that the highly-supported VM platforms are spawning ecosystems of languages that target other languages. javascript is the best example but JVM is a close second (clojure, scala, kotlin).

the trade-off here is accepting build slowness & complexity in exchange for escaping the negatives of the default language for your platform.

I think we won't get off this trend until we figure out a bytecode format that balances sandboxing and portability. WASM?

<comment><USER27> I agree but I don't understand how that relates to Dart (has a standalone VM of decent quality) or Mojo (IPC API language - basically abstracts stuff on a OS process level - cross language/VM/process interop being transparent)

<comment> awinter-py Both great products with great technology but neither is ubiquitous. JVM & javascript have pentrated their target audience enough that 'building on top' saves your users some installation work.

</comment></comment></comment></comment></comment><comment><USER28> I hate Java because I hate the company behind it

</comment><comment><USER29> Expected from Oracle.</comment>


Healthcare Sector Vulnerable to Hackers - <AUTHOR> http://m.washingtonpost.com/investigations/health-care-sector-vulnerable-to-hackers-researchers-say/2012/12/25/72933598-3e50-11e2-ae43-cf491b837f7b_story.html

<comment><AUTHOR> This observation doesn't surprise me: "I have never seen an industry with more gaping security holes," said Avi Rubin, a computer scientist and technical director of the Information Security Institute at Johns Hopkins University. "If our financial industry regarded security the way the health-care sector does, I would stuff my cash in a mattress under my bed."</comment>


Ask HN: What day to launch, how to get press coverage? - <AUTHOR>

From what I've gathered the best time to launch is Tuesday at 10AM (pacific). Do you guys think that the day and time we launch really matters?
I'm also curious about the best way to get PR and coverage on the major blogs, even newspapers? Should we seek an embargo even if we're pitching multiple blogs? Or, should we offer an exclusive to a single blog?
Everyone says it's about developing relationships with the bloggers/journalists - but the main way people do that seems to be with tips and leaking stories. What about those of us who don't have juicy details about the next google purchase? Is simply commenting on their posts enough? And what about getting in touch with newspaper journalists? I've signed up for HARO, but what else can I do?
Any tips, advice, stories from your experience would be great. Thanks. <comment><USER2> Do you need to "launch" ?</comment>


Which Platform You Should Target For Your First App: Android Or iPhone? - <AUTHOR> http://theappentrepreneur.com/which-platform-you-should-target-for-your-first-app-android-or-iphone/

<comment><USER2> "Apple does not have a good debugging solution compared to Android for testing your apps."

That's a pretty absurd claim. Xcode has a fine debugger, comes with Instruments for various kinds of profiling, and can simulate multiple versions of iOS as well as multiple types of hardware (including various screen sizes).

I haven't done much Android development, but I have a hard time believing Android debugging is somehow magically significantly better than iOS debugging.

<comment><USER3> >I haven't done much Android development, but I have a hard time believing Android debugging is somehow magically significantly better than iOS debugging.

Oh, the irony. I don't know X, but I sure know Y is better than X. Keep up the good work, Einstein.

<comment><USER2> "I haven't done much of X" != "I don't know X".

Keep up the good work, Einstein.

</comment></comment></comment><comment><USER4> I think it helps significantly to qualify what kind of app we're talking about (because then the demographics wanting each will vary) and revenue models. Game apps in general seem to do significantly better on the Apple store. At the very least, there's significantly more games in the Apple App Store than the Play Store. That likely has to do with the demographics that hold Android vs iOS phones. It also doesn't account for the alternative revenue model that most Android games take, that is the ad-driven model. If you're in it for the revenue, Android's ad-driven allowances (as much as I dislike them) may be a valid approach. For most other types of apps (productivity, education etc it's a toss up in my opinion, and will likely come down again to pricing model.

Might also help to consider where you're developing for. Different countries each have VASTLY different usage numbers for the different platforms. Big statistics that cover the whole globe aren't altogether that useful.

As a last point, I highly doubt that Android fragmentation is going to be the major reason why development is going to cost 20% more. That just seems wrong and arbitrary, especially with all the measures Google has taken to patch it (a la ICS). I could just as well say that the Apple app submission process is a hellish procedure that will cause massive delays and increased cost. It's really hard to say which is more costly to develop for due to all the variables.

Last throw in, just on an intuition, I'd develop for Android first, simply due to the significant reach in my country, greater experience with it and the type of app I'm considering. All in all, with so many variables, it's really hard to explicitly say.

</comment><comment><USER5> The most important thing to consider when starting an app is what the landscape will look like in one or two years, or more. I'd bet on Android over Apple and Windows, but a fork of Android could beat them all.

<comment><USER6> Two years is long enough to build for all platforms...

</comment></comment><comment><USER6> It's simple: if you intend to sell the app, build first for iOS. If the app isn't something users will use daily, just use HTML. If neither of those are true, build for Android and iOS with iOS first.

<comment><USER7> How did you deduce this?

<comment><USER6> iOS users buy apps 6x as much as Android. The article itself says that.

HTML is fast to develop relative to native apps therefore if the app is ideally used infrequently, a native experience isn't worthwhile. There are exceptions, of course.

The last option is just a default last option.

<comment><USER8> That data is from mid 2011. The difference should be much smaller now, if there is any. Android had like 150-200 million devices back then. Now it has over 500 million.

This is why this article is BS, because most of the data used in it is extremely irrelevant for the Android ecosystem right now. This article should've been written in 2011. Not at the end of 2012. The Android ecosystem has grown and improved a lot since then.

<comment><USER6> Can you share data showing otherwise?

Here's an article from a few weeks ago supporting my claim: [http://m.guardiannews.com/technology/appsblog/2012/dec/04/io...](http://m.guardiannews.com/technology/appsblog/2012/dec/04/ios- android-revenues-downloads-country)

Edit: to clarify, Android is doing better, but it is still no match for iOS.

<comment><USER9> I want to know how many of those apps replace basic functionality that is just built into Android. There are am absurd number of paid apps and services that have no purpose on android because the functionality is built into the OS or the Google Apps.

<comment><USER6> Interesting point. Could you elaborate?

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> As an investor in companies building mobile apps, I get asked this question constantly.

My response depends somewhat on the application and the market, but it's pretty clear at this point that these are two completely separate efforts. It's not quite as bad as developing for Mac vs. Windows, but close (and getting closer all the time.)

So I recommend two separate development efforts. I almost always recommend leading with iOS, but not syncing up the functionality perfectly so that some of the design experiments as you iterate happen on Android.

Tight communication between two separate teams is key. If you only have one dev working on the whole thing, just choose one - and - in most cases, this should be iOS

</comment><comment><USER11> Been in both situations and IMO I would recommend Android, especially for a startup. Remember, release fast, release often is today's mantra and this simply cannot be done with Apple. I mean, you'll lose a whole month of Apple bureaucracy before having the least hintch that your app fails because of some bug in your live setup. Small details which you can't sand off when you have those LONG release cycles. Because of this I've always seen Android apps evolve much more faster and provide meaningful feedback from day one after the first beta release. With Apple you can't have a beta release, nothing can go wrong, everything has to be perfect the first time. For example, right now we have in both stores the same app with version 1.1.1 for iOS and 4.3.2 for Android. The IOS one is using the first version of our backend API while the Android one has forced the API to change four times because of business needs which have made the app evolve. So basically, we release an MVP for IOS which is there, idle. And we have an Android app which is evolving fast, is providing cohort data, feedback, business models and new ideas are being developed only for it. I would have waited after three or four android releases before going the IOS way.

</comment><comment><USER12> If your app can be developed as a web app first that may be ideal. Building with a responsive design will allow it to work on both devices initially. Then you can watch your statistics to learn where is it more successful and build for that platform first.

</comment><comment><USER13> iOS has negligible piracy? That's news to me.

<comment><USER14> I think that piracy should be a non-concern at all. The first barrier is getting a product out there that someone, anyone is actually using. With the massive over saturation of the app stores, and the "if it is not on the first page it does not exist" mentality visibility is much bigger problem. If you have the audience from somewhere else you may be able to make them install an app. But otherwise - with the current incarnation of the walled gardens this will be a tough one.

<comment><USER13> I can't find the article right now, but there was recently a game developer that was crippled by piracy. Essentially the online part of the iOS game was swamped with pirate users, and there wasn't enough funding from real users for the servers to be sustainable or even worthwhile.

<comment><USER14> That is a different problem. If people play your game it means you are doing something right, so you must work on your revenue and communication with users strategy. Also if you have client server architecture you have much easier time just discarding the pirate users. If apple prevents you from distinguishing between types of users - that is serious platform deficiency. Otherwise it just requires a DB check before allowing access of the user to the server.

There have been cases where a product receives critical acclaim, is widely pirated and failed commercially.

XBOX 360 had the ability to pirate games since 2007-ish, and PS3 was much harder in this department. You didn't see abandonment of the X360 platform from the developers.

<comment><USER13> I don't think the App has any way of knowing if it is running without the proper signing or not. They can try and read outside of their sandbox, but Apple doesn't seem to acknowledge piracy as an issue, so the APi doesn't exist.

</comment></comment></comment></comment></comment><comment><USER15> The article seems to be discussing the overall history, but it should focus on the present. Android has grown a lot in the past couple of years so how does it compare to iOS now?

</comment><comment><USER16> For a non-game app, how hard it is to use cross-platform tools such as Sencha/PhoneGap to develop for both Android and iPhone (and maybe even for tablet) at the same time?

</comment><comment><USER17> For most apps, an HTML wrapper like PhoneGap works great, so might as well do both at the same time.

</comment><comment><USER18> Why not target both?

</comment><comment><USER19> if you are relatively the nobody: Android (people try stuff only when it is free, though Iphone does have free aps, the notion around Iphone is the opposite, that all apps are paid ones. the reason being android is a free OS, IOS is not.

<comment><USER9> I've never heard a user say, "I don't want to buy apps because Samsung didn't build or license Android." Most users don't even know what that means.

<comment><USER19> so what do you intend to say my friend ?

</comment></comment></comment><comment><USER9> The numbers in this article are _quite_ out of date.</comment>


Electron memory usage compared to other cross-platform frameworks - <AUTHOR> http://roryok.com/blog/2017/08/electron-memory-usage-compared-to-other-cross-platform-frameworks/ <comment><AUTHOR> This is a self post. hope that's not frowned upon here. I just compared the memory usage of a bunch of cross platform frameworks and wanted to share my findings

<comment><USER2> Self posting is not frowned upon in general. Personally, I appreciate it because it allows the author to discuss and explain their work.</comment></comment>


Ask HN: How can I grow my webapp? - <AUTHOR>

I put together a web application evenings and weekends over the Summer- Lonava.com - It's a Social News site (like Reddit/HN), where people post under their real names.
The problem is, I'm not really getting any traction at all.
I tried posting to HN for advice (http://news.ycombinator.com/item?id=1628254), and I've tried advertising on Reddit (http://www.reddit.com/comments/d4oyu/lonava_is_a_redditlike_site_i_put_together_where/) and Google, but registrations have been next to nothing.
I'm not shooting for FB-levels, but I figured I could at least get a few dozen people to give it a shot. What else can I do to try growing the site?
Should I try pivoting the site, dropping the key differentiating feature (real names), and relaunching as a generic anonymous reddit/4chan clone?
What other strategies do you have for growing a userbase? <comment><USER2> I'd drop the real names - people do want anonymity (for example, posting about problems with their job or spouse) and the membership fee.

Instead why not have exclusivity ? People can create groups - like subreddits - but you can only post to a group if you are a member. Membership might be invite only, or you have to apply. That will keep out the spammers and trolls - bad behaviour gets your membership revoked. Let the people running the groups decide on their own membership (some might make it open to all, others might only allow friends etc).

<comment><AUTHOR> Hrmm.. Under that scenario, I'd transition from a Reddit-like model, to more of a Meta-filter like model.

That could be interesting, but would probably fit a forum-like discussion site, better than a news-aggregation site, no?

I suppose I could redesign it to be forum-skinned, and drop the news importing, and the real names, but at that point, what's left?

<comment><USER2> Imagine something like Reddit, with groups(subreddits) for programming, US politics, Twilight, whatever.

Each group can do auto news aggregation - maybe by customizing what RSS feeds get fed into the group. Each group gets to set a theme. Most important though is that each group gets to set the rules.

For example:

\- who can post to the group ?

\- who can comment ?

\- how do you get to join the group ?

So for a programming group I want it to be invite only (you apply for membership, the group owner gets an email, and clicks a link to let you in). I also want to allow only members to be able to post links and comments. As group moderator, I can also ban people who break the rules.

Another group might let any site member post, and so on. Another may or may not allow profanity, or NSFW posts.

</comment></comment></comment><comment><USER3> You're in a bit of a predicament with the verified name aspect. On the one hand it is an interesting idea, on the other it creates a lot of friction with respect to users creating fully-functioning accounts. The process is so onerous (by web-standards, mind you), that it'll be tough to get many users participating at the outset on a nascent site.

I'd also consider narrowing or focusing on a specific topical niche (possibly with a better brand-name that might give a n00b some hints about what the site is and what it can do).

I see you have also seeded the site with some content, but you may also need to artificially seed the site with some user participation (via "fake" accounts). I know this runs counter to your idea of "real/verified" users, but one of the toughest things about growing a userbase is convincing people that there's some worthwhile activity going on at your site to begin with. If they arrive and there's no discussion taking place, most of them will just as soon leave (there's no compelling reason for them to register to comment to nobody when they can just as soon go register at reddit or hacker news to talk to folks).

You should also look at using SEO urls for a lot of your pages. So rather than <http://lonava.com/stories/314687>, use a url like [http://lonava.com/stories/sonys-hirai-were-over-10-years- fro...](http://lonava.com/stories/sonys-hirai-were-over-10-years-from-a- discless-ps3)

Once you fix some of the simple stuff, you can start taking a crack at things like link-building, link-bait, link exchanges, forum postings, ad-word campaigns and viral strategies.

So I have no panacea for you. Growing an audience can sometimes require a number of small tactical moves.

One last thought: In a prior job I had worked on an account verification product. There many, many companies out there who are interested in such technologies for a variety of purposes (usually for financial transactions). Your application may have a hidden gem beneath the surface that is more valuable than the aggregator: the identity verification component. You might want to look at some of the verification solutions out there and see if there's some opportunity for you.

<comment><AUTHOR> I appreciate the points, thanks again for taking the time.

I don't know that "fake" accounts would work, but what I might be able to do is to convince some of my friends to each reply to a half dozen articles a day. Even if I had to needle them until they did, it would provide some content.

For the SEO-level- Reddit does that, and I suppose I could. As I user, I prefer a short, straightforward URL, but I suppose I could see why generating Google traffic might outweigh that. Fair enough. Thanks! ;)

The acct verification product I'm using is off-the-shelf. It was a pain in the ass to find one that was both affordable and reliable, but It's working pretty well. I don't really think I could/should leverage it.

<comment><USER3> Ah, I thought you had "rolled-your-own" for the verification solution. If you went off the shelf, you can't really leverage it as you say.

By the way, here's a hacker news equivalent for internet marketing that I've found useful (since marketing is a key component of audience building): <http://sphinn.com/>

Good luck!

<comment><AUTHOR> Thanks, I'll take a look at that site. I've been reading SEOMoz, but there's a lot more I can/should do, a resource like yours is a great step!</comment></comment></comment></comment>


New notification tool - <AUTHOR> http://www.kitwall.com <comment><AUTHOR> This tool helps anyone publish to their audiences. Elimintaes the chat between members and keeps the focus on the messages. Ideal for corporate and announcement purposes. Normal use cases, PTAs, capaigning, office communications, event organization etc.</comment>


Canon to begin acquisition of the ".canon" Top-Level Domain name - <AUTHOR> http://www.canon.com/news/2010/mar16e.html

<comment><USER2> I am th only one who hate the idea of generic top-level domains? Will their web site be accessible just as <http://.canon>? .

<comment><USER3> There's nothing technical DNS-wise that would prevent the name 'canon' from resolving to an IP address, so <http://canon> could work. They could also add a MX record for the name 'canon' so @canon e-mail addresses would work too. Maybe ICANN has rules around gTLDs that would prevent this type of use?

<comment><USER4> I'm sure this will break a ridiculous number of regular expressions for email address validation.

<comment><USER5> Yes, but that is their own fault for trying to use a regex to validate email addresses. :)

<comment><USER6> (?:(?:\r\n)?[ \t]) _(?:(?:(?:[^() <>@,;:\\\".\\[\\] \000-\031]+(?:(?:(?:\r\n)?[ \t] )+|\Z|(?=[\\["()<>@,;:\\\".\\[\\]]))|"(?:[^\"\r\\\\]|\\\\.|(?:(?:\r\n)?[ \t]))_"(?:(?: \r\n)?[ \t]) _)(?:\\.(?:(?:\r\n)?[ \t])_ (?:[^()<>@,;:\\\".\\[\\] \000-\031]+(?:(?:( ?:\r\n)?[ \t])+|\Z|(?=[\\["()<>@,;:\\\".\\[\\]]))|"(?:[^\"\r\\\\]|\\\\.|(?:(?:\r\n)?[ \t])) _"(?:(?:\r\n)?[ \t])_ )) _@(?:(?:\r\n)?[ \t])_ (?:[^()<>@,;:\\\".\\[\\] \000-\0 31]+(?:(?:(?:\r\n)?[ \t])+|\Z|(?=[\\["()<>@,;:\\\".\\[\\]]))|\\[([^\\[\\]\r\\\\]|\\\\.) _\ ](?:(?:\r\n)?[ \t])_ )(?:\\.(?:(?:\r\n)?[ \t]) _(?:[^() <>@,;:\\\".\\[\\] \000-\031]+ (?:(?:(?:\r\n)?[ \t])+|\Z|(?=[\\["()<>@,;:\\\".\\[\\]]))|\\[([^\\[\\]\r\\\\]|\\\\.)_\\](?: (?:\r\n)?[ \t]) _))_ |(?:[^()<>@,;:\\\".\\[\\] \000-\031]+(?:(?:(?:\r\n)?[ \t])+|\Z |(?=[\\["()<>@,;:\\\".\\[\\]]))|"(?:[^\"\r\\\\]|\\\\.|(?:(?:\r\n)?[ \t])) _"(?:(?:\r\n) ?[ \t])_ ) _\ <(?:(?:\r\n)?[ \t])_(?:@(?:[^()<>@,;:\\\".\\[\\] \000-\031]+(?:(?:(?:\ r\n)?[ \t])+|\Z|(?=[\\["()<>@,;:\\\".\\[\\]]))|\\[([^\\[\\]\r\\\\]|\\\\.) _\\](?:(?:\r\n)?[ \t])_ )(?:\\.(?:(?:\r\n)?[ \t]) _(?:[^() <>@,;:\\\".\\[\\] \000-\031]+(?:(?:(?:\r\n) ?[ \t])+|\Z|(?=[\\["()<>@,;:\\\".\\[\\]]))|\\[([^\\[\\]\r\\\\]|\\\\.)_\\](?:(?:\r\n)?[ \t] ) _))_ (?:,@(?:(?:\r\n)?[ \t]) _(?:[^() <>@,;:\\\".\\[\\] \000-\031]+(?:(?:(?:\r\n)?[ \t])+|\Z|(?=[\\["()<>@,;:\\\".\\[\\]]))|\\[([^\\[\\]\r\\\\]|\\\\.)_\\](?:(?:\r\n)?[ \t])* )(?:\\.(?:(?:\r\n)?[ \t]) _(?:[^() <>@,;:\\\".\\[\\] \000-\031]+(?:(?:(?:\r\n)?[ \t] )+|\Z|(?=[\\["()<>@,;:\\\".\\[\\]]))|\\[([^\\[\\]\r\\\\]|\\\\.)_\\](?:(?:\r\n)?[ \t]) _))_ ) _:(?:(?:\r\n)?[ \t])_ )?(?:[^()<>@,;:\\\".\\[\\] \000-\031]+(?:(?:(?:\r\n)?[ \t])+ |\Z|(?=[\\["()<>@,;:\\\".\\[\\]]))|"(?:[^\"\r\\\\]|\\\\.|(?:(?:\r\n)?[ \t])) _"(?:(?:\r \n)?[ \t])_ )(?:\\.(?:(?:\r\n)?[ \t]) _(?:[^() <>@,;:\\\".\\[\\] \000-\031]+(?:(?:(?: \r\n)?[ \t])+|\Z|(?=[\\["()<>@,;:\\\".\\[\\]]))|"(?:[^\"\r\\\\]|\\\\.|(?:(?:\r\n)?[ \t ]))_"(?:(?:\r\n)?[ \t]) _))_ @(?:(?:\r\n)?[ \t]) _(?:[^() <>@,;:\\\".\\[\\] \000-\031 ]+(?:(?:(?:\r\n)?[ \t])+|\Z|(?=[\\["()<>@,;:\\\".\\[\\]]))|\\[([^\\[\\]\r\\\\]|\\\\.)_\\]( ?:(?:\r\n)?[ \t]) _)(?:\\.(?:(?:\r\n)?[ \t])_ (?:[^()<>@,;:\\\".\\[\\] \000-\031]+(? :(?:(?:\r\n)?[ \t])+|\Z|(?=[\\["()<>@,;:\\\".\\[\\]]))|\\[([^\\[\\]\r\\\\]|\\\\.) _\\](?:(? :\r\n)?[ \t])_ )) _\ >(?:(?:\r\n)?[ \t])_)|(?:[^()<>@,;:\\\".\\[\\] \000-\031]+(?:(? :(?:\r\n)?[ \t])+|\Z|(?=[\\["()<>@,;:\\\".\\[\\]]))|"(?:[^\"\r\\\\]|\\\\.|(?:(?:\r\n)? [ \t])) _"(?:(?:\r\n)?[ \t])_ ) _:(?:(?:\r\n)?[ \t])_ (?:(?:(?:[^()<>@,;:\\\".\\[\\] \000-\031]+(?:(?:(?:\r\n)?[ \t])+|\Z|(?=[\\["()<>@,;:\\\".\\[\\]]))|"(?:[^\"\r\\\\]| \\\\.|(?:(?:\r\n)?[ \t])) _"(?:(?:\r\n)?[ \t])_ )(?:\\.(?:(?:\r\n)?[ \t]) _(?:[^() <> @,;:\\\".\\[\\] \000-\031]+(?:(?:(?:\r\n)?[ \t])+|\Z|(?=[\\["()<>@,;:\\\".\\[\\]]))|" (?:[^\"\r\\\\]|\\\\.|(?:(?:\r\n)?[ \t]))_"(?:(?:\r\n)?[ \t]) _))_ @(?:(?:\r\n)?[ \t] ) _(?:[^() <>@,;:\\\".\\[\\] \000-\031]+(?:(?:(?:\r\n)?[ \t])+|\Z|(?=[\\["()<>@,;:\\\ ".\\[\\]]))|\\[([^\\[\\]\r\\\\]|\\\\.)_\\](?:(?:\r\n)?[ \t]) _)(?:\\.(?:(?:\r\n)?[ \t])_ (? :[^()<>@,;:\\\".\\[\\] \000-\031]+(?:(?:(?:\r\n)?[ \t])+|\Z|(?=[\\["()<>@,;:\\\".\\[ \\]]))|\\[([^\\[\\]\r\\\\]|\\\\.) _\\](?:(?:\r\n)?[ \t])_ )) _|(?:[^() <>@,;:\\\".\\[\\] \000- \031]+(?:(?:(?:\r\n)?[ \t])+|\Z|(?=[\\["()<>@,;:\\\".\\[\\]]))|"(?:[^\"\r\\\\]|\\\\.|( ?:(?:\r\n)?[ \t]))_"(?:(?:\r\n)?[ \t]) _)_ \<(?:(?:\r\n)?[ \t]) _(?:@(?:[^() <>@,; :\\\".\\[\\] \000-\031]+(?:(?:(?:\r\n)?[ \t])+|\Z|(?=[\\["()<>@,;:\\\".\\[\\]]))|\\[([ ^\\[\\]\r\\\\]|\\\\.)_\\](?:(?:\r\n)?[ \t]) _)(?:\\.(?:(?:\r\n)?[ \t])_ (?:[^()<>@,;:\\\" .\\[\\] \000-\031]+(?:(?:(?:\r\n)?[ \t])+|\Z|(?=[\\["()<>@,;:\\\".\\[\\]]))|\\[([^\\[\ ]\r\\\\]|\\\\.) _\\](?:(?:\r\n)?[ \t])_ )) _(?:,@(?:(?:\r\n)?[ \t])_ (?:[^()<>@,;:\\\".\ [\\] \000-\031]+(?:(?:(?:\r\n)?[ \t])+|\Z|(?=[\\["()<>@,;:\\\".\\[\\]]))|\\[([^\\[\\]\ r\\\\]|\\\\.) _\\](?:(?:\r\n)?[ \t])_ )(?:\\.(?:(?:\r\n)?[ \t]) _(?:[^() <>@,;:\\\".\\[\\] \000-\031]+(?:(?:(?:\r\n)?[ \t])+|\Z|(?=[\\["()<>@,;:\\\".\\[\\]]))|\\[([^\\[\\]\r\\\\] |\\\\.)_\\](?:(?:\r\n)?[ \t]) _))_ ) _:(?:(?:\r\n)?[ \t])_ )?(?:[^()<>@,;:\\\".\\[\\] \0 00-\031]+(?:(?:(?:\r\n)?[ \t])+|\Z|(?=[\\["()<>@,;:\\\".\\[\\]]))|"(?:[^\"\r\\\\]|\\\ .|(?:(?:\r\n)?[ \t])) _"(?:(?:\r\n)?[ \t])_ )(?:\\.(?:(?:\r\n)?[ \t]) _(?:[^() <>@, ;:\\\".\\[\\] \000-\031]+(?:(?:(?:\r\n)?[ \t])+|\Z|(?=[\\["()<>@,;:\\\".\\[\\]]))|"(? :[^\"\r\\\\]|\\\\.|(?:(?:\r\n)?[ \t]))_"(?:(?:\r\n)?[ \t]) _))_ @(?:(?:\r\n)?[ \t])* (?:[^()<>@,;:\\\".\\[\\] \000-\031]+(?:(?:(?:\r\n)?[ \t])+|\Z|(?=[\\["()<>@,;:\\\". \\[\\]]))|\\[([^\\[\\]\r\\\\]|\\\\.) _\\](?:(?:\r\n)?[ \t])_ )(?:\\.(?:(?:\r\n)?[ \t]) _(?:[ ^() <>@,;:\\\".\\[\\] \000-\031]+(?:(?:(?:\r\n)?[ \t])+|\Z|(?=[\\["()<>@,;:\\\".\\[\\] ]))|\\[([^\\[\\]\r\\\\]|\\\\.)_\\](?:(?:\r\n)?[ \t]) _))_ \>(?:(?:\r\n)?[ \t]) _)(?:,\s_ ( ?:(?:[^()<>@,;:\\\".\\[\\] \000-\031]+(?:(?:(?:\r\n)?[ \t])+|\Z|(?=[\\["()<>@,;:\\\ ".\\[\\]]))|"(?:[^\"\r\\\\]|\\\\.|(?:(?:\r\n)?[ \t])) _"(?:(?:\r\n)?[ \t])_ )(?:\\.(?:( ?:\r\n)?[ \t]) _(?:[^() <>@,;:\\\".\\[\\] \000-\031]+(?:(?:(?:\r\n)?[ \t])+|\Z|(?=[ \\["()<>@,;:\\\".\\[\\]]))|"(?:[^\"\r\\\\]|\\\\.|(?:(?:\r\n)?[ \t]))_"(?:(?:\r\n)?[ \t ]) _))_ @(?:(?:\r\n)?[ \t]) _(?:[^() <>@,;:\\\".\\[\\] \000-\031]+(?:(?:(?:\r\n)?[ \t ])+|\Z|(?=[\\["()<>@,;:\\\".\\[\\]]))|\\[([^\\[\\]\r\\\\]|\\\\.)_\\](?:(?:\r\n)?[ \t]) _)(? :\\.(?:(?:\r\n)?[ \t])_ (?:[^()<>@,;:\\\".\\[\\] \000-\031]+(?:(?:(?:\r\n)?[ \t])+| \Z|(?=[\\["()<>@,;:\\\".\\[\\]]))|\\[([^\\[\\]\r\\\\]|\\\\.) _\\](?:(?:\r\n)?[ \t])_ )) _|(?: [^() <>@,;:\\\".\\[\\] \000-\031]+(?:(?:(?:\r\n)?[ \t])+|\Z|(?=[\\["()<>@,;:\\\".\\[\ ]]))|"(?:[^\"\r\\\\]|\\\\.|(?:(?:\r\n)?[ \t]))_"(?:(?:\r\n)?[ \t]) _)_ \<(?:(?:\r\n) ?[ \t]) _(?:@(?:[^() <>@,;:\\\".\\[\\] \000-\031]+(?:(?:(?:\r\n)?[ \t])+|\Z|(?=[\\[" ()<>@,;:\\\".\\[\\]]))|\\[([^\\[\\]\r\\\\]|\\\\.)_\\](?:(?:\r\n)?[ \t]) _)(?:\\.(?:(?:\r\n) ?[ \t])_ (?:[^()<>@,;:\\\".\\[\\] \000-\031]+(?:(?:(?:\r\n)?[ \t])+|\Z|(?=[\\["()<> @,;:\\\".\\[\\]]))|\\[([^\\[\\]\r\\\\]|\\\\.) _\\](?:(?:\r\n)?[ \t])_ )) _(?:,@(?:(?:\r\n)?[ \t])_ (?:[^()<>@,;:\\\".\\[\\] \000-\031]+(?:(?:(?:\r\n)?[ \t])+|\Z|(?=[\\["()<>@, ;:\\\".\\[\\]]))|\\[([^\\[\\]\r\\\\]|\\\\.) _\\](?:(?:\r\n)?[ \t])_ )(?:\\.(?:(?:\r\n)?[ \t] ) _(?:[^() <>@,;:\\\".\\[\\] \000-\031]+(?:(?:(?:\r\n)?[ \t])+|\Z|(?=[\\["()<>@,;:\\\ ".\\[\\]]))|\\[([^\\[\\]\r\\\\]|\\\\.)_\\](?:(?:\r\n)?[ \t]) _))_ ) _:(?:(?:\r\n)?[ \t])_ )? (?:[^()<>@,;:\\\".\\[\\] \000-\031]+(?:(?:(?:\r\n)?[ \t])+|\Z|(?=[\\["()<>@,;:\\\". \\[\\]]))|"(?:[^\"\r\\\\]|\\\\.|(?:(?:\r\n)?[ \t])) _"(?:(?:\r\n)?[ \t])_ )(?:\\.(?:(?: \r\n)?[ \t]) _(?:[^() <>@,;:\\\".\\[\\] \000-\031]+(?:(?:(?:\r\n)?[ \t])+|\Z|(?=[\\[ "()<>@,;:\\\".\\[\\]]))|"(?:[^\"\r\\\\]|\\\\.|(?:(?:\r\n)?[ \t]))_"(?:(?:\r\n)?[ \t]) _))_ @(?:(?:\r\n)?[ \t]) _(?:[^() <>@,;:\\\".\\[\\] \000-\031]+(?:(?:(?:\r\n)?[ \t]) +|\Z|(?=[\\["()<>@,;:\\\".\\[\\]]))|\\[([^\\[\\]\r\\\\]|\\\\.)_\\](?:(?:\r\n)?[ \t]) _)(?:\ .(?:(?:\r\n)?[ \t])_ (?:[^()<>@,;:\\\".\\[\\] \000-\031]+(?:(?:(?:\r\n)?[ \t])+|\Z |(?=[\\["()<>@,;:\\\".\\[\\]]))|\\[([^\\[\\]\r\\\\]|\\\\.) _\\](?:(?:\r\n)?[ \t])_ )) _\ >(?:( ?:\r\n)?[ \t])_)) _)?;\s_ )

<comment><USER7> I wish people would stop posting that. Yes, that covers most (though not all) of the RFC definitions of what constitutes an email address, but in practice you only want to accept a tiny subset of those.

<comment><USER8> Curious: Why would you want to accept only a tiny subset of those? What do you gain by that?

<comment><USER7> Well, the really simple example is the string "postmaster". It is a perfectly legitimate email address, and almost always deliverable. But rarely something you want to actually accept.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> "With the adoption of the new gTLD system, which enables the direct utilization of the Canon brand, Canon hopes to globally integrate open communication policies that are intuitive and easier to remember compared with existing domain names such as "canon.com.""

Yeah, because canon.com is really unintuitive and hard to remember.

Besides, I'm thinking lots of confusion will ensue. You see a TV ad: "Visit us on the web at canon!" Typical human being: "Well, what's their address? They forgot to tell!"

<comment><USER10> "Visit us at ICANN keyword Canon!"

</comment></comment><comment><USER11> Who's going to be the first to try registering pachelbels.canon?

<comment><USER12> This really is going to be like the early days of the Internet all over again.

</comment></comment><comment><USER13> Honestly, I wish this is how it was from the very beginning (minus the huge cost of entry).

If you think about it, what really was the point of .com, .net, .org etc... Does it really make sense that you can have both twitter.com and twitter.net? In both cases, you recognize "twitter" as the name, with .com and .net as fodder. And considering that twitter does not own twitter.net shows how meaningless that .net domain is.

So you currently have twitter.com/yourname, when it could be just yourname.twitter. Or yourname.facebook. And instead of firstname.lastname@example.com, it would just be yourname@gmail. blahblah@hotmail. whosit@yahoo. mikeymike@doodad. stevejobs@apple. pg@yc.

Furthermore, the ".com" has always been a blemish to branding. You have this beautiful simple brand name (Nike, Apple, Cisco) but then you have to advertise the url (nike.com, apple.com, cisco.com), both decapping your name and sticking the .com on the end.

I know this whole .com, .net, .org, .ly has been ingrained into our structure and psyche, but just consider the above to see how much simpler it could be.

</comment><comment><USER14> Shoot, was it MyWedding.canon or MyWedding.nikon?

<comment><USER15> Cannon would likely have e05.cannon i bet you meant to type MyWedding.HackerNewsPhotographyInc

Thats not so bad, in my opinion.

</comment></comment><comment><USER16> This, completely separately from anything Canon the company is doing, seems like a useful TLD. HarryPotter.canon, Firefly.canon, etc—to be able to tell when you're not looking at a fan-site of a creative work, but rather a place where any messages delivered through it can be considered, well, _canonical_.

<comment><USER17> Since when can you tell anything about a site by looking at the TLD?

<comment><USER16> To register a .ca domain, I have to be a Canadian citizen. To register a .edu domain, you have to be an accredited university (and you don't really "register" for it either—you just tell EDUCASE who the administrative contact is going to be, and they set everything else up.) In my fantasy-land, .canon could be handled by some international dual of the Writer's Guild in the same way.

</comment></comment></comment><comment><USER18> So, Canon realizes that half of the programs in the world (if not more) that autodetect urls aren't going to detect <http://canon> or anemailusername@cannon as urls/emails, right?That limits what they can really do with this.

I guess they could have other stuff redirect to <http://canon>, and urls for "subdomains", which are now normal domains, become nice and might catch some more url detectors. <http://slr.canon> and the like. It's still a major problem.

<comment><USER19> Of course, they own canon.com, and <http://canon> will generally redirect there. Then they set up their own nameserver to simply do things like redirect blah.blah.canon.com to blah.blah.canon.

Then you find yourself asking what the point of all this is again because DNS is already hierarchical and once you own canon.com you already own an effectively-infinite series of subdomains, so Canon is spending $185,000 + ongoing maintenance so they can trim ".com" off and incur first-mover expenses as they encounter those problems you mention and that seems hardly worth it. But hey, who am I to argue?

</comment></comment><comment><USER20> IMHO too many TLD is harmful. It creates conflict with LAN hostnames.

<comment><USER21> User: I can't get to the canon website it just shows a print queue for the other floor.

Sysadmin: . . . %$#%#$%@

</comment></comment><comment><USER22> "The new gTLD system is expected to allow a company name, brand name, geographic region, or service type to be used as a gTLD within website and e-mail addresses."

So I guess we can expect more of these soon. Probably a few years of super expensive costs before the floodgates are opened.

</comment><comment><USER23> I like this. For years, people have been tasked with remembering if a site was .com, .org, etc. My parents often just type "google" or "ebay" into the address bar, and expect it to go there. Now it will, using proper DNS architecture instead of relying on google or opendns.

<comment> loup-vaillant The _address_ bar? If so, your parents are a rare breed indeed. Most people, even programmers, even when given the exact domain name, even with "awesome" auto completion, use the search bar anyway.

</comment></comment><comment><USER24> Is this an attempt to bypass search engines? So I go to an address bar, and search for "canon" which in the old days would do a google search on that... but on the new days checks for a TLD and goes to <http://canon> ... ?

</comment><comment><USER12> The general public already has enough trouble remembering what sites are .com, .net, and .org, and most are flummoxed by amusing uses of other national TLDs. What purpose can this possibly serve Canon other than as a status symbol?

<comment><USER25> The general public will get used to it, I imagine.

</comment></comment><comment><USER26> does anybody know what you have to do to register your own top-level domain? i hope it's very very expensive, or else we've got another early-nineties-style land-grab on our hands.

<comment><USER27> It's pretty darn expensive, starting with a $185,000 "evaluation fee" to ICANN, and then whatever it costs to run a registrar. (I expect you'll be able to outsource the latter.)

See <http://www.icann.org/en/topics/new-gtlds/strategy-faq.htm>

</comment></comment><comment><USER28> Lets all pitch in and buy .localdomain ...

</comment><comment><USER29> The Internet needs a better API, architecture.

<comment><USER19> DNS is a wonderful protocol for the most part. The problems you think you have with it are almost certainly problems with the centrally-run canonical DNS, but nothing stops you from not using it. You can use whatever DNS you like, set up a parallel internet if you like. Of course, nobody can find you, but that's the price of nonconformity. However, the mere fact that this is possible will always tend to rein in the central repository, because if they get bad enough, we can leave. It might hurt, but we can leave.

<comment><USER30> This sounds really interesting. Would you advise some further reading on this topic? Thanks.

<comment><USER19> Honestly, the Wikipedia article is a pretty good start. From there you can branch out into the RFCs if you want to really dig in, or go some other routes.

By the way, don't be afraid to read the actual RFCs; many of them are quite approachable with only moderate knowledge. Most of them discuss not just the what, but the why, and it's generally OK to skip a section you don't care about. Then, after reading the RFCs, you'll usually find that even if you still don't understand it all, you understand it better than most people.</comment></comment></comment></comment>


Coding meets dance – weird but fun - <AUTHOR> http://robotics.ovh/?robofun <comment><AUTHOR> Try to interact with robots!</comment>


"Create file in c:\windows called perfc with no extension and #petya won't run" - <AUTHOR> https://twitter.com/0xAmit/status/879778335286452224 <comment><AUTHOR> Also it looks like you have a change to recover your files until you restart the infected machine. See

[https://twitter.com/hackerfantastic/status/87979028071470694...](https://twitter.com/hackerfantastic/status/879790280714706944)

      If you are infected with Petya and your machine has
      crashed/powered off. DO NOT POWER UP. Use a LiveCD or
      external machine to recover files

</comment><comment><AUTHOR> "Petya Ransomware Attack – What's Known"

[https://www.malwaretech.com/2017/06/petya-ransomware- attack-...](https://www.malwaretech.com/2017/06/petya-ransomware-attack-whats- known.html)

      Kill Switch

      Although some companies have claimed to have found a kill
      switch, this is nothing more than PR as the so called "kill
      switch" is only activated by modifying files on your own
      system (which can be done to stop most malware) and is not
      doable remotely like the WannaCry was. Furthermore, as
      stated above it's unlikely the Perya ransomware is still
      spreading and the damage has already been done, thus a
      kill-switch would be futile.</comment>


The Datacenter as a Computer [pdf] - <AUTHOR> http://web.eecs.umich.edu/~mosharaf/Readings/DC-Computer.pdf <comment><AUTHOR> Found this recently, and wanted to share. I'm sure someone will find this interesting.

Partly written by Url Holzle, of Google.</comment>


Killer cops, drone wars and the crisis of democracy - <AUTHOR> http://www.salon.com/2014/12/06/killer_cops_drone_wars_and_the_crisis_of_democracy/

<comment><USER2> those of us who are part of the silent majority, witnessing the dismantling of our democratic institutions, all in the name of combatting terrorism, fighting the drug wars, and eradicating the 'isms... are going to have to start getting off our collective a$$es and speak out against these injustices; otherwise we're going to wake up one day and realize there is no one left to speak or act for us. when i read something like the salon article -- and there are too many reports like this, to write them off as aberations -- i am reminded of the niemöller quotation:

"First they came for the Socialists, and I did not speak out -- Because I was not a Socialist. . . . Then they came for me -- and there was no one left to speak for me." [1]

[1] [http://www.ushmm.org/wlc/en/article.php?ModuleId=10007392](http://www.ushmm.org/wlc/en/article.php?ModuleId=10007392)</comment>


Ask HN: What wont you learn (probably) as a self-taught programmer? - <AUTHOR>

I have spent the past year writing python, primarily for statistics and data mining, but also for websites with django. I haven't worked in a professional setting since last year when I wrote 100% entry-level php. I haven't taken any cs courses, and I'm wondering what valuable skills I'm probably missing. I know there are many :) <comment><USER2> Obviously it depends on the person. A self-taught programmer is likely to miss out on the idea of abstraction (data and code) early on. Lots of things might just seem arbitrary or "magical". A solid CS curriculum will do a good job of showing the "big" picture that can be missed by a self-taught programmer.

That said, there aren't any magical skills taught in CS courses that you can't easily find online. Teaching yourself gives you the advantage of being able to focus on what you find interesting, and can get you in the habit of continually learning. You can never know enough, so getting in the habit of teaching yourself something new all the time is great.

Things you might have missed include pointers (how they work), thinking recursively and building a compiler. Those are all used to weed out weaker CS students. I think the key for self-teaching is to get to a point where things no longer seem arbitrary or magical. From there it's easy to see what you like and don't like, and focus on what you're really interested in.

</comment><comment><USER3> The biggest thing you will miss is how much better some of your peers (and elders) are, who they are and where you can find their stuff. This has gotten a lot better since the web came around so you have an easier time of it than some old hand autodidact.

Self taught programmer here, it took reading a pile of source code and a bunch of links posted on HN for me to realize that I wasn't half as sharp as I thought I was.

Pretty humbling, the upside is that now there is more to learn.

CS courses as such are not the main differentiating factor between self-taught and not when it comes to quality, it is who you learn from, what and how.

If you teach yourself there are problems with perspective and breadth of knowledge about the field as a whole where a mentor could probably make you move much faster.

</comment><comment><USER4> 1) Architecture. Understanding what the actual hardware is doing when you walk through a program. Knowing this can help answer questions like: Why does a variable go out of scope? When a data file might benefit from an index.

2) Algorithms. Learning the math behind why one approach is significantly faster can change the way you think about solving problems.

3) Approach. More advanced thinking around handling information. Why might you use a btree vs a linked list etc. Can I achieve the same result using less memory?

</comment><comment><USER5> back in the day when i was "bootstrappping myself" i decided the answer was functional programming and compilers. i don't regret for a minute looking at both of those (i was a hipster haskell programmer - using it _way_ before it was cool... ;o)

these days functional programming is pretty much mainstream, but more declarative approaches are still quite obscure - i think learning a little prolog and datalog helped me better deal with sql, but i still don't feel comfortable with these topics so have recently been trying to understand more using stack overflow as motivation (latest attempt: [http://stackoverflow.com/questions/7076349/is-there-a- good-w...](http://stackoverflow.com/questions/7076349/is-there-a-good-way-to- do-this-type-of-mining/7237972#7237972)). i also feel i am slipping behind on distributed computing, so i guess i should be looking there next.

(i only started using stack overflow "seriously" about a month ago and i think it's great for learning - you can treat questions at the edge of your expertise as homework, or just read other people's answers).</comment>


NSA Said to Exploit Heartbleed Bug for Intelligence for Years - <AUTHOR> http://www.bloomberg.com/news/2014-04-11/nsa-said-to-have-used-heartbleed-bug-exposing-consumers.html <comment><USER2> Bloomberg really puts its bias on display:

 _> The Heartbleed flaw, introduced in early 2012 in a minor adjustment to the OpenSSL protocol, highlights one of the failings of open source software development._

And its discovery and resolution highlights one of the advantages of open- source software development.

<comment><USER3> > _And its discovery and resolution highlights one of the advantages of open- > source software development._

I wouldn't say that its discovery (two years later) says anything good about open source development.

<comment><USER4> And I also wouldn't say that the existence of a bug was caused by the license that was used. It's not like me keeping all the code to myself would make me a better programmer.

</comment></comment></comment><comment><USER5> Here we observe a side affect of the NSA/GHCQ operating in a manner which always gives _offensive capability_ precedence over the _defense_ of civilian systems.

In case you haven't made the time yet -- ACLU's interview of Snowden at SXSW was excellent and dives into the implications of this: [https://www.youtube.com/watch?v=UIhS9aB- qgU](https://www.youtube.com/watch?v=UIhS9aB-qgU)

On another (ironic) note this PSA from the US government is about 2 years late: [http://www.bbc.com/news/technology-26985818](http://www.bbc.com/news/technology-26985818)

</comment><comment><USER6> I don't know if Heartbleed could reach this point, but I think probably the only possibility for getting average citizens up in arms about this kind of thing is for them to start seeing major _personal_ detrimental effects (like oops, all my email has been stolen and deleted and my bank account's empty), and then learn that the NSA could have easily prevented it if they weren't having so much fun being super-hackers instead.

<comment><USER7> I don't think average people (so to speak) really care about their email.

<comment><USER8> Even n00bs understand that if their email gets jacked, that can be used to reset all their other passwords and jack those accounts.

<comment><USER9> I'm not so sure, I know plenty of people who don't realize that until it's pointed out to them. Even then, many don't even care ("I don't have anything important anyways...").

<comment><USER10> Should be possible to convince them with "Hacker makes incriminating but false post on your Facebook" -> "Employer checks your Facebook" -> "Employer shows you the door."

"Why would anybody do that?" For the lulz ("random acts of malice"), sadly.

</comment></comment></comment></comment></comment><comment><USER11> This is how NSA "protects America" and its infrastructure from "cybercrime" \- by allowing a bug like this to exist for years without telling anyone about it.

I hope it's now clear to everyone what NSA's vision about "cybersecurity" is. They think having vulnerabilities like this in the Internet's infrastructure is a _good thing_ , because then they get to attack their "targets", to "protect us". It has nothing to do with _actual security_. Weakness is strength. Vulnerability is security.

</comment><comment><USER12> This looks like another case where the actions of the NSA are the _opposite_ of what's in the best interest of US Citizens.

<comment><USER13> Was it though? The NSA's job is to spy on behalf of the country. While keeping the bug a secret put people at risk, there is an argument to be made that it was a useful tool. Law enforcement regularly makes the decision to allow low level criminals to continue to commit crimes in order to catch their leaders even though doing so puts people at risk. There are always tradeoffs.

<comment><USER14> Their job is not to spy on behalf of the country.

Their job is to keep us safe.

Letting us all run around with humungous holes in our security for years was a risk to our national security. How do you think the Chinese were able to clone our weapons systems so well? Shit like this.

<comment><USER15> Yeah NSA's job is to fix open source bugs, whatever.

NSA is a spy agency, expecting them not to use vulnerabilities they find is like sending them into a gunfight with a pocketful of rocks. Ask the Palestinians how that works out in the long run.

I think much of the NSA's surveillance is unconstitutional and should be rolled back by at least 2 orders of magnitude. That doesn't have to entail turning the world over to Russian and Chinese hackers.

<comment><USER16> _> >That doesn't have to entail turning the world over to Russian and Chinese hackers._

Boogey man FUD, I'm not worried about any hackers from [Insert_forgein_country_elites_want_you_to_hate]. The USgov, NSA and corrupt law enforcement are the only terrorists I'm worried about.

<comment><USER17> Pretty interesting statement.

Why? Nations have track records of not killing/spying on each others?

<comment><USER18> Nations certainly have a record of killing large numbers of their citizens - particularly in the past century.

It's reasonably to be suspicious of government.

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> Evidence? And if so, pretty much what we expected and exactly why this behaviour is terrible

<comment><USER20> >> The U.S. National Security Agency knew for at least two years about a flaw in the way that many websites send sensitive information, now dubbed the Heartbleed bug, and regularly used it to gather critical intelligence, _two people familiar with the matter said._

(emphasis mine)

It's pretty weak IMHO but I don't really doubt it.

<comment><USER21> Probability that story is true | Bloomberg reporting it == Probability that the sources are right * Probability that Bloomberg isn't lying about having sources ~= 80%.

The sources could be lying for many reasons. As a prank, to discredit Bloomberg when they report on other NSA stories, because they're embarrassed the NSA didn't know earlier, etc. But Bloomberg knows this and presumably required some evidence to satisfy themselves before reporting. So the deciding factor is really Bloomberg's reliability.

<comment><USER22> Why do you think Bloomberg was any more thorough in its Heartbleed investigation than Newsweek was in outing Dorian Nakamoto as the author of Bitcoin?

<comment><USER23> Newsweek was purchased by some shady people and hasn't been famous for investigation for... ever?; Bloomberg is one of the leading financial periodicals which is a major part of the Bloomberg empire and hooked into all sorts of circles. Would you be so skeptical if it was being reported on nytimes.com?

</comment></comment></comment></comment></comment><comment><USER24> I've been seeing a lot of comments recently along the lines that we "need" more evidence before we assume that the NSA took advantage of heartbleed. I don't get that at all.

I'd love to have harder evidence of what the NSA has been up to. I get that. But here are some things we know: the NSA believes its mission is to collect 100% of the world's data, with the possible exception of data that definitely belongs to US citizens. The NSA has boasted internally of cracking SSL implementations as part of its work. The NSA employs more people who are qualified for and tasked with finding this kind of exploit than anyone else. The NSA's leadership is willing to lie under oath to Congress -- let alone to anyone else -- about its activities. The NSA's secrets are about as heavily defended as secrets can be -- actually providing the kind of evidence requested here is widely considered treason against the United States. And now an investigative reporter with a serious reputation says that he has two sources who can confirm that the NSA knew about heartbleed shortly after it was created.

So let's assume you might behave differently in some way -- in any way -- if the NSA knew about and exploited heartbleed. You have imperfect information and you have to make a call. What else could you "need" before you decide to behave as though this article is accurate?

I think we "need" to assume that the NSA took advantage of heartbleed starting shortly after it was introduced. We'd just "like" to have a little more confirmation about what the hell they've been up to.

</comment><comment><USER25> No fucking way. This is _disastrous_ PR stuff, second only to the Snowden revelations.

It should be clear by now that the NSA does not restrict themselves from anything... and should be disbanded.

<comment><USER26> I don't know how "disastrous" this really is.

NSA knows approximately 1 zillion vulnerabilities we don't know about and won't know about. They range from RCE's in Windows and Apache to flaws in cryptographic hash functions.

It's NSA's charter to stockpile these things, and, yeah, to use them against foreign adversaries.

It's bad though, because this one was so easily exploitable. It's the kind of thing a reasonable organization finds out about and wants fixed ASAP.

<comment><USER27> > It's NSA's charter to stockpile these things, and, yeah, to use them against > foreign adversaries.

I don't see how leaving American companies vulnerable fulfills the NSA's charter.

<comment><USER26> American companies are vulnerable to literally hundreds of vulnerabilities NSA knows about; that's something that was widely known (public, in fact) almost a decade before Snowden.

I agree that this bug is different, but that might have been a subtle case to make inside the organization.

<comment><USER25> The worst problem with the NSA knowing about Heartbleed is the total lack of accountability.

If I were _any_ US-based company CEO whose customers got hacked by Heartbleed exploits, I'd drag their corpses to the court if necessary.

Sidenote: People have asked "Why are you doing JS-based cryptography on passwords if you have HTTPS?" \- here we have the ideal answer. Encrypting the passwords using public-key crypto in addition to HTTPS and doing the decryption in RoR/PHP/nodejs would at least have spared the users from the need to change their passwords.

<comment><USER28> It wasn't _traffic_ that was revealed, it was _server memory_. Which could just have easily contained the decrypted passwords as the encrypted ones.

<comment><USER25> Heartbleed only leaks SSL-related memory - not program memory!

</comment></comment></comment></comment></comment></comment></comment><comment><USER29> The NSA protected us by not disclosing to us a serious security vulnerability in our software. It is hard for me to wrap my brain around reasoning of the intelligence agencies.

<comment><USER30> To be fair to the NSA, it's not just them. Many other government agencies operate under the assumption that society is better off if people are protected from themselves. It's why we have FCC censorship and the war on drugs. Questioning this core assumption is verboten in these organizations because it is equivalent to questioning their reason for existing. So when they take criticism from the public they naturally retreat to their core assumptions and values, even if they have to dress it up with doublespeak.

</comment></comment><comment><USER31> > _two people familiar with the matter said_

As much as Snowden has shown us the amount of effort NSA puts into this kind of stuff, I think we need more evidence than this article is giving.

</comment><comment><USER26> Yeah, that's not good.

</comment><comment><USER32> This is according to "two people familiar with the matter". While nobody would be surprised that the NSA had exploited heartbleed, this article gives no compelling proof.

I wish newspaper articles had a bit of metadata that indicated whether the sources are verifiable. Then we wouldn't have to waste any time reading them when they aren't.

</comment><comment><USER33> "It flies in the face of the agency's comments that defense comes first"

The NSA needs to be dissolved. It is a costly liability whose actions work against the nations interests as a whole.

</comment><comment><USER34> Good luck trying to wiggle out of this one, NSA.

</comment><comment><AUTHOR> The NSA is denying this report.

> Statement: NSA was not aware of the recently identified Heartbleed > vulnerability until it was made public.

[https://twitter.com/NSA_PAO/status/454720059156754434](https://twitter.com/NSA_PAO/status/454720059156754434)

<comment><USER35> Full statement: [http://twitter.com/ajamlive/status/454724369429045248/photo/...](http://twitter.com/ajamlive/status/454724369429045248/photo/1)

The NSA has a good history recently of lying through their teeth, and the bit at the end "Unless there is a clear national security or law enforcement need..." is a pretty damned large asterisk.

</comment></comment><comment><USER36> So is there a single shred of evidence besides something unquoted by `two people familiar with the matter said`

because if not this is just straight up link bait.

</comment><comment><USER37> It's going to be pretty hard to say you're playing "defense" with a straight face after this one.

</comment><comment><USER38> It certainly seems believable, but do we have anything more concrete to go on than "two people familiar with the matter?" Is that even two people with top- secret clearance at the NSA?

<comment><USER39> Well, consider what that would look like. Given the way that the US Government has pursued Snowden and other whistleblowers for embarrassing them, if you had privileged information indicating that the government was deliberately leaving nearly all Americans' online information exposed, would you want your name attached to it?

<comment><USER31> I think lauradhamilton's point is that "familiar with the matter" is too subjective.

<comment><USER39> Oh, I totally get that, and agree. I'm just saying that even if these are bulletproof sources with deep insider knowledge, it would be incredibly risky for them to associate any credentials other than "familiar with the matter" with the story.

It's wiggle-room a mile wide, but I'm not sure if there's a better alternative given the current climate.

</comment></comment></comment></comment><comment><USER40> While there's no evidence (yet) that the NSA knew about or exploited this bug, I would not be the least bit surprised if they did. Honestly, my first thought when reading about Heartbleed was "I wonder how much the NSA paid the contributor. Or did they just threaten his family?" It seems there have been a lot of "oops" errors being found in critical security systems these days, and every single one of them is directly beneficial to the NSA and its mission to "h4ck the plan37!"

</comment><comment><USER41> A reasonable policy upon discovering this type of bug is to allow the agency a fix period of time to exploit the bug and then require that they provide support in fixing the bugs for as many major US companies and institutions as possible as quickly as possible.

If they are given carte blanche to use the exploit indefinitely, they will keep it forever and let the world discover and exploit it as well. If they have a finite time period like 1-3 months, they will prioritize exploiting those systems that are actually valuable for national security. While they are doing so, they should keep an auditable log of all the systems they use the exploit against so that oversight may be performed in hindsight. Furthermore, they should absolutely be barred from using any exploit against a target with a US-based IP, or possibly even any IP address in allied nations.

It is far less likely that the agency will have the opportunity to abuse exploits if they are forced to prioritize targets due to a fixed deadline on disclosure.

During the deadline period, they should also be working on a plan that minimizes the amount of damages once disclosure is forced. i.e. there should be a list of people and companies that get the information first and everyone on the list should be people in charge of protecting computer systems (i.e. no one involved in offensive activities is on the list). Companies like Google, Facebook, Akamai, Apple and the package maintainers for all the major *nix distros should be on that shortlist of those that get priority notification.

</comment><comment><USER42> > _The agency found the Heartbleed glitch shortly after its introduction, > according to one of the people familiar with the matter,_

Presumably if the anonymous sources here were discovered, they'd be in big criminal trouble, right? I am curious how far the government goes to try and discover them.

And I think there is no way these anonymous sources would have contacted the journalists without Snowden going first, to establish the context and interest. Snowden's actions continue to benefit us all, cascading.

<comment><USER43> Not necessarily, this might actually be an approved ass-covering leak.

You may think it's awful that the NSA knew for 2 years, and didn't push fixes... but their funders and overseers, in Congress and the DoD, would be more likely angry if, given the NSA's massive budget and mission, the NSA _didn 't_ know about this bug right away via code audit/analysis. Knowing vulnerabilities first is the whole job of the "Cyber Command".

And, the best defense isn't necessarily a panicked fire-drill of preemptive patching ASAP, if you're sure you're the only ones who know. It could make tactical and economic sense to simply prepare contingency plans, and wait for the first evidence of a 2nd-discoverer.

<comment><USER41> A possible smoking gun in this case would be to check if most of the NSA's and the DOD systems over which it has oversight were not vulnerable this entire time while the private sector remained vulnerable.

If they truly didn't know about this, you'd expect that a lot of the US government infrastructure has also been vulnerable this entire time.

I've seen the Alexa top 1000 list showing who was vulnerable. I wonder if there is a similar list for the top 1000 computer systems and networks over which the NSA has security oversight.

</comment></comment></comment><comment><USER44> Whether it's true or not, I think the correct thing for the NSA to do would be to _say_ that they knew about it for years and exploited it. That is their job, after all.

<comment><USER45> NSA has two jobs:

1\. Gain signals intelligence on specified foreign targets. 2\. Protect U.S. signals from having the same done to the U.S. by other states.

The second responsibility is why there are things like SELinux, NSA "Suite B" cryptography, etc. It has also led to security bugfixes to open source code (such as X.org) used by NSA or within government.

The reason that both duties are held in NSA is because the best way to defend against the best SIGINT hackers in the world is to have the expertise of the best SIGINT hackers in the world. It's why NFL teams have their offense practice against their own defense and vice versa.

In this case the flaw is so completely egregious (and relatively easy to spot for other states' spy agencies reviewing commit diffs) that the duty of NSA would quite clearly to have been to get OpenSSL fixed, if only because so much government IT could be affected by this.

The bug was introduced pre-Snowden as well, so it's not like NSA didn't have other cyber weapons to use to achieve the effects they need. So if it's true that NSA knew about the bug and let it remain open to protect "methods and sources" then they definitely chose wrong and someone needs to explain how they came to that choice...

</comment></comment><comment><USER46> Your friends tell you about your flaws and shortcomings. The people who keep quiet or even exploit your flaws? They are not your friends.

So, what's to keep some organization that runs a package repo from publishing OpenSSL packages that claim to be like OpenSSL 1.0.1g but actually display the heartbleed bug? I also ask myself, would the NSA seek to implement such a thing? They would, though that is an entirely different question from if they have.

<comment><USER25> This is why you can, on Debian/xbuntu, always run a apt-build from the source and verify the patch is present in the code. Or on Gentoo, it's building from source anyways.

(Or just use Debian in the Gentoo flavour from the beginning)

</comment></comment><comment><USER47> I hesitate to believe that in 2 years time, the agency hasn't found another backdoor to the web. OpenSSL might be patched, but what else is still vulnerable?

</comment><comment><USER48> I'm wondering if any State Attorney Generals are tech savvy, don't like the current administration, and want some publicity[1] enough to start an investigation? I would imagine a subpoena asking for the financial records of the OpenSSL contributors would be a first step (to find Gov payments). I can see a very scary witch hunt.

1) that part might be a little rhetorical, every AG likes good publicity.

<comment><USER26> Presumably, any State Attorney General will have gone to law school, and will thus know that the Federal Government is immune to suits from the states.

<comment><USER48> They are not actually immune, states sue the federal government (or at least departments) all the time. Look at the ACA cases for an example. They can also go after the individual people involved as long as they are not serving in the government.

<comment><USER26> The states can presumably go to court to keep from being compelled to comply with an unconstitutional law. They cannot sue the state for damages.

<comment><USER48> The states can go for a variety of reasons when the feel the federal government is overstepping their bounds or has committed a constitutional violation. They can open investigations into federal behavior.

I never said anything about damages.

</comment></comment></comment></comment></comment><comment><USER42> > _The SSL protocol has a history of security problems, Lewis said, and is not > the primary form of protection governments and others use to transmit highly > sensitive information._

> _"I knew hackers who could break it nearly 15 years ago," Lewis said of the > SSL protocol._

Anyone know wtf he's talking about?

<comment><USER39> TLS has been subject to a lot of attacks:

[http://en.wikipedia.org/wiki/Transport_Layer_Security#Attack...](http://en.wikipedia.org/wiki/Transport_Layer_Security#Attacks_against_TLS.2FSSL)

Plus, since the whole thing is based on CAs, if you can get an intermediate cert (and does anything think the NSA can't?) and you have the means to MITM someone, that's as good as breaking it, too.

15 years ago, we were using keys with much lower entropy, as well, which may have simply been outpaced by computing power.

</comment></comment><comment><USER49> The US government seems intent on destroying the viability of the Internet as a commerce platform.

</comment><comment><USER50> FWIW, we asked the NSA and NSC; both deny:

[http://www.nbcnews.com/tech/security/nsa-denies-it-used- hear...](http://www.nbcnews.com/tech/security/nsa-denies-it-used-heartbleed- bug-gather-intelligence-n78356)

</comment><comment><USER51> > highlights one of the failings of open source software development.

Sorry? Paid programmers writing closed code with probably less review and auditing have been shown to create less bugs? What are they trying to say?

<comment><USER52> What data did you use to estimate the probability of code review? Would be interesting to see if anyone has studied this.

</comment></comment><comment><USER53> I've never understood theories about NSA capability. Everyone complains that Government officials are barely competent, if at all, yet when it comes to NSA, those same people think NSA staff is at least ten times as brilliant as the general population.

Everything I've seen NSA do is largely based on the same techniques Google uses, except 10 years later, much more expensively, and with much uglier PowerPoint presentations. The only thing NSA has that private organizations don't is the compelled cooperation of telecom companies.

</comment><comment><USER54> What upsets me the most is that they new this existed, and that a lot of the US economy relies on our tech companies, and they did nothing to inform the companies about the security flaw.

</comment><comment><USER55> Now would be the time to start looking up the backgrounds of the people who implemented heartbeat support. For instance, the same guy responsible for the Heartbeat spec was the author of the OpenSSL implementation.

While we do not want to make this into a witch hunt, now that the NSA is involved in Heartbleed, we should definitely rule out malice by checking for direct ties between contributors of known flawed/malicious code related to the implementation of Heartbeat.

<comment><USER41> We absolutely do not want this. We rely on the goodwill of a lot of really smart people to produce the open source security software we rely. Even if the person who introduced this bug did in fact conspire with the NSA, we would do far more damage by going on a witch hunt. The majority of people working on this software are well-intentioned and if contributing to open source means that they risk being subject to a witch hunt for their contributions they will be far less likely to partake.

The only reasonable course of action is to apply oversight of the NSA. If people in open-source are moles, the only reasonable way to discover this is via oversight of the agency. If there are moles, there are records within the agency showing this to be the case. Getting ahold of those records is how you prove this and you get those records by getting congress to do their job and provide oversight.

<comment><USER55> Sounds like an great plan. Perhaps you could provide an example from history where your idea works? I'm having difficulty finding one.

</comment></comment></comment><comment><USER56> > The U.S. National Security Agency knew for at least two years about a flaw > in the way that many websites send sensitive information, now dubbed the > Heartbleed bug [...]

Interesting that they say "at least" two years. The bug is two years old, so they could have also chosen to say "at most" two years or "up to" two years. Least biased would be to just say "since the bug was introduced, two years ago".

</comment><comment><USER57> s/Flawed Protocol/Flawed Implementation/

</comment><comment><USER11> Well this was flagged fast.

</comment><comment><USER58> Sounds plausible to me. I would think the NSA, and other spy agencies, pour over every release of a security package to see if any exploitable errors were made.

</comment><comment><USER59> Do we have anything that leads us to believe the NSA was aware of heartbleed at all before we found out, other than speculation because of their resources?

<comment><USER60> We have "two people familiar with the matter" which is to say sources that Bloomberg thought were credible enough to lead a story with.

<comment><USER28> Who is "familiar with the matter"? NSA insiders? People who've read the Snowden docs?

I wonder if Bruce "probability is close to one that every target has had its private keys extracted by multiple intelligence agencies" Schneier is one of them.

</comment></comment></comment><comment><USER61> You can assume that any bug in open source software that could have been found using systematic and automated analysis has already been found by the NSA.

</comment><comment><USER62> My first thought: if this is the case, then why did they try so hard (and get "trolled" in the progress) to get the SSL keys from Lavabit?

<comment><USER26> Because NSA didn't try to get Lavabit's keys at all; DOJ did. Two very different organizations. Not as incestuously linked as people think they are.

Also, worth mentioning: it's not particularly easy to get private keys out of servers with the bug.

<comment><USER62> That makes sense, I guess. I'm not American so I don't know much about the inner workings of these institutions.

Is it unlikely for FBI to ask NSA's help?

<comment><USER26> It is probably illegal for FBI to ask for NSA's help in gaining evidence for a US criminal case, although pointing that out is sure to start a raucous subthread about "parallel construction".

<comment><USER43> If it's "probably illegal", surely you can cite the law?

Notably, the FISA cell phone record orders passed information to the NSA _through_ the FBI, so no hint of a "chinese wall" there. Secret bulk collection for 'national security', everyone bathing in the same pool of data.

I do suspect it's policy not to casually request, or become overly dependent on, such NSA-to-domestic sharing. And – as we've seen in the "parallel construction" revelations you allude to – it's definitely policy to try to obscure any such sharing when it happens.

But to reassure people that it's "probably illegal" is flimsy hand-waving when you can't name the law, and there's public evidence that it happens to the contrary.

</comment></comment></comment></comment></comment><comment><USER63> This is flamebait. Sad it's getting so many upvotes.

<comment><USER64> I agree, in the first 3 paragraphs I shook my head 3 times

"two people familiar with the matter said." <\- so you made it up

"threatens to renew the rancorous debate over the role of the government's top computer experts." <\- you made this up as well

"Heartbleed appears to be one of the biggest glitches in the Internet's history" <\- Not even close.

"as many as two-thirds of the world's websites" <\- less than 17% of SSL based webservers, certainly not two-thirds of the entire freakin internet.

"it's possible that cybercriminals missed the potential in the same way security professionals did, suggested Tal Klein, vice president of marketing at Adallom"

"this article is shite, suggested ikt, junior vice president of Compuglobalhypermeganet"

<comment><USER63> The point about it being VERY serious, I can accept. The rest... yep, pure bull. Also "btw Open Source sucks, proprietary good".

The article is rubbish.</comment></comment></comment>


Meet Brain, the AI Engine That Wants to Replace Search - <AUTHOR> http://techcrunch.com/2016/02/25/meet-brain-the-ai-engine-that-wants-to-replace-search/ <comment><USER2> This is actually the thing that I mean about not caring that much about privacy, what I care about is the application providing me the best and most relevant information at any time and to do that it needs to have my information. The problem is that the business model of most companies is predicated on 1. harming their users with the information those users give them ( one can be harmed by giving up information if it makes it more difficult for to get credit, jobs, insurance, and so forth) 2. Allowing their true customers (not the users, but the advertisers) to give less than perfect information in the hopes of extracting money.

So the problem really there is - what is Brain's business model going to be.

</comment><comment><USER3> Their logo and "sample user profile" pic really bother my programmer's brain. Unmatched parentheses everywhere!

The idea is a bit scary, though. Giving up to some app not only your current and past information, but all your goals and ambitions—essentially all of who you are—and then relying on the app to essentially do a lot of thinking for you.

If this thing works, it would be a gold mine for the advertisers to plug in their products as something you really want. "[...] it could devise an ideal workout regimen for the marathon..." Ideal according to whom? Some gym that paid for advertisement?

This is a very interesting issue how this sort of AI is literally akin to giving up a part of your mind to third parties. And if someone's thinking FOR you, the biggest question stands: what protection from malice do you retain?</comment>


Random, but not by chance: A new kind of random number generator - <AUTHOR> http://esciencenews.com/articles/2010/04/14/random.not.chance

<comment><USER2> How is this better than existing technology? [http://en.wikipedia.org/wiki/Hardware_random_number_generato...](http://en.wikipedia.org/wiki/Hardware_random_number_generator)

<comment><USER3> The article answers that question, if you had bothered to read it. Current hardware RNGs rely on Newtonian physics and generate numbers which -- if you had sufficient knowledge of starting conditions -- you could predict. The method described in the article uses quantum entanglement to produce completely unpredictable numbers.

<comment><USER2> Wow, you're both douchy and wrong. The article doesn't say anything about the techonology which I linked to. Did YOU "bother to read it"?

The article says that Newtonian physics does not allow any randomness, which is fairly obvious and has nothing to do with the hardware I'm asking about.

The article also discusses 'pseudo-random number generators', which, I'm assuming since this is HN, you know are purely software-based.

The Wikipedia page which I linked to, claims that currently used hardware uses 'thermal noise' and 'other quantum phenomena', which you might have realized "if you had bothered to read it".

If you don't mind now, I was really hoping to learn something about a technology which I am sincerely interested in.</comment></comment></comment>


John Tyndall's blue sky apparatus - <AUTHOR> http://www.rigb.org/our-history/iconic-objects/iconic-objects-list/tyndall-blue-sky <comment><USER2> Apropos of nothing but this is a simple apparatus that makes for an awesome science fair project.

<comment><USER3> obligatory: [https://xkcd.com/1145/](https://xkcd.com/1145/)</comment></comment>


EBay slashes Google ads, escalating rift. Analyst: 'The two companies have been on a collision course for a long time' - <AUTHOR> http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2007/06/14/BUG9LQER0T1.DTL <comment><USER2> Where will I get my human remains ( <http://www.flickr.com/photos/merlin/55319283/in/set-1207345/> ) now?

"San Jose's eBay cut its advertising Monday shortly after Google unveiled plans for a party in Boston to hawk its online payment service, Google Checkout. Attendees of eBay's user conference, eBay Live, which starts today, were all invited for free drinks, food and massages."

This is a little nutty. It's an increasingly bad business strategy to take total control over a small market rather than some control over a big one.

</comment><comment><USER3> "For years, eBay has been Google's biggest U.S. advertiser"

Wow... seems odd that they didn't set up their own ad network earlier. I just don't see the lock-in for on-line ads - switching costs are low, and network effects are not really a factor.

<comment><USER4> I think the ads on Google search results pages were more important than AdSense, a few advertisers have said the conversion rates are much higher on the search results than on AdSense pages. But I wouldn't put it past eBay to start an AdSense competitor.

</comment></comment><comment><USER5> "In any case, eBay Live is frequently a stage for drama, and not just with Google. Alibaba, an eBay rival in China, found out the hard way at eBay Live last year in Las Vegas.

It had rented a restaurant in the hotel where eBay Live was holding a party.

An eBay executive who found out tried unsuccessfully to rent the restaurant from under Alibaba, according to an Alibaba executive and a hotel employee present during the animated discussion. The eBay executive eventually forced Alibaba to remove all of its signs."

So let me get this straight... EBay executives are a bunch of insecure bullying assholes? That, and they just gave up 188.3 million clicks from Google? Note, however that searching Google for "used Playstation 3" still gives me tons of appropriate results - including from other auctions.

<comment><USER6> Your experience on Google is no worse, but if eBay doesn't come back, Google's losing on the order of billions since they aren't selling high-priced ads at large volume to eBay.

</comment></comment><comment><USER7> Here it is. Google's achilles heel. They rely heavily on some of their competitors for revenue. Advertising will get in the way of technical innovation and head on competition.

Get out there young entrepreneurs! Google might still be the big leader in search, but their domination of all the commerce and information on the internet is certainly not guaranteed. They have enormous conflicts of interest.

<comment><USER8> It's their Achilles heel until it isn't, ya know? Microsoft was the software company with invaluable relationships creating products for, say, Apple, until that relationship wasn't as crucial to their being anymore.

But I definitely agree on your sentiments about the conflicts of interest. There's a lot of things to consider.

<comment><USER7> But right now, ebay is enough of a customer that google (even with all its growth and revenue) can't risk competing with them.

That's something of a market inefficiency. But, I agree, it's one that may close quickly.</comment></comment></comment>


VxWorks now with C++17 and Rust support, alongside Ada and SPARK - <AUTHOR> https://www.windriver.com/news/press/pr.html?ID=22444 <comment><USER2> Another thing that I'm really surprised about is the salary range for the C++ developers with RTOS experience. In case we compare this with frontend React developers, then difference will be more than 50% (React guys will be paid more). According to my understanding C++ development for projects that require RTOS is much more demanding in terms of skill and corresponding experience. I would also assume that there are much less developers with VxWorks experience: within my region I may find around 40 people with VxWorks in their CV on the job board against 1000 developers with React experience. I really hardly get the economics of the modern IT job market.

<comment><USER3> The ratio what matters not the number of devs available.

demand / supply

You might find 1000 devs with react but if the need is 10000 while there is 50 for 40 VxWorks devs then it explains the salary.

If you downvote pls. explain how supply and demand is not a thing for tech salaries.

<comment><USER4> I agree with you, as ultimately an employer will have to raise wages to get/keep employees.

But it's not really enough to explain it because the engineers who do Vx could always just switch to a better paying platform.

I wonder if the low salary indicates that the Vx Devs at that low price aren't able to switch out. Either due to location, lack of ability, or some other capture.

<comment><USER3> As anecdotal evidence I know many developers (including myself) who refuse to touch frontend. It still stands, supply and demand rules apply. Does not matter why the supply is low or the demand is high.

<comment><USER5> Yeah, frontend dev is it's own beast. I've seen competent C++ devs at a complete loss when facing JavaScript. Especially if they've never done any asynchronous programming before.

<comment><USER3> I have done async in Clojure, Erlang (Elixir) and Rust but never touched Javascript (wat?). Not sure you can attribute async to frontend development. Erlang predates Javascript by almost 10 years.

<comment><USER5> > Not sure you can attribute async to frontend development.

Not trying to do that. But (unlike C++), you _have_ to understand async to use JavaScript sensibly. _If_ for whatever reason you haven't come across it another language, then you might struggle (esp. if you're coming from C or C++ where the skills required are very different).

<comment><USER6> Embedded systems are entirely event driven, often using a large number of callbacks as c function pointers. Really not much different actually.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Details are a bit sparse, they likely support Rust only in RTP[0], not in Kernel. If someone has a more technical resource, I am interested.

This is an important milestone, because this is a significant actor in the embedded world, where suppliers are often rather conservative regarding language/toolchains they provide, that is putting some of its weight behind Rust.

[0] RTP are VxWorks Real Time Processes.

<comment><USER8> Considering it's mentioned alongside Python and Boost, it's most likely as a userland process too.

</comment></comment><comment><USER9> Do we have any hn members who develop voor vxworks? If so could you please describe how and what you do?

<comment><USER10> I am one of the OS developers for a military vehicle that utilizes vxWorks and Linux. It's honestly no different than other OS work out there. Documentation and help outside of WindRiver's official docs are more scarce, and open source support is smaller, but grasping how an RTOS works vs a GPOS isn't any major mental leap. If you can program in C and understand communication protocols like i2c, UART, SPI, CAN, etc. then it's not terrible.

Right now, we are looking at moving away from vxWorks and onto a Yocto-built Linux with the RT patches to the scheduler. From a requirements standpoint, the RT patches meet our needs for "real time" since our timings require more of a soft real time than a hard one. There's also way more support out there for Linux, and I am also slightly biased in that I am more of a Linux guy than a vxWorks guy simply due to familiarity and ease of troubleshooting.

This latest news with vxWorks is great, however. I actually sent this to management because we are attempting to figure out what direction to take as our current version is reaching EOL.

<comment><USER11> >Right now, we are looking at moving away from vxWorks and onto a Yocto-built Linux

This decision is probably out of your hands, but I'm happy to share a few words of caution. I've been the yocto distro maintainer at a large firm for about three years and I absolutely despise it. BMW released a slide deck about their experience with yocto, and it was mostly "it sucks." I read that recently and it matched my experience down to a t.

If you absolutely need third party commercial support, yocto is probably the only game in town, but if you don't, I would highly recommend looking at nix (which recently gained cross compile support) or buildroot.

I'm dead serious about avoiding yocto if at all possible, I've seen things I wish I could unsee. But that sounds about right for a military project.

EDIT: I put my email into my profile if you want to chat about yocto more in depth.

</comment></comment></comment><comment><USER12> There have been a lot of changes to Rust's libstd recently for vxworks [0]. Expect it to be a bit buggy until Rust 1.42 or so.

[0]: [https://github.com/rust- lang/rust/pulls?utf8=%E2%9C%93&q=is%...](https://github.com/rust- lang/rust/pulls?utf8=%E2%9C%93&q=is%3Apr+author%3Abaoshanpang)

</comment><comment><USER13> This is huge for folks developing with VxWorks. And for rust adoption in general.</comment>


GoDaddy VP Caught Bidding Against Customers in Domain Auctions - <AUTHOR> http://domainnamewire.com/2008/06/20/expired-domain-services-let-employees-bid-against-customers/

<comment><USER2> Domain auctions are always a voodoo science.

Especially when you're talking about domain sniping, and the subsequent silent auctions where you don't really know if you're bidding against ANYONE, but you still have to put in a maximum bid just in case, and you don't get any feedback on whether you've bid enough money or not until after the auction is over.

There's so little visibility that no one really knows what's going on or if they're inflating prices or using fake people to auction against you or anything.

What do you guys think about a true registry-level wait list policy? Maybe combined with open auctions if there's more than one person waiting. Then we wouldn't have these companies with hundreds of fake registrars constantly pinging the registry getting away with all this stuff.

</comment><comment><USER3> The guy runs <http://dnforum.com> \- he is a very well known domainer. He just took the job not too long ago. There was a thread about it on DNForum.

GoDaddy knew this - it is probably why they hired him. By doing that they probably knew that he would continue his domaining business activities. (Which could, at some point in the future, create a conflict of interest.)

That said.. I don't think this is that big of a deal. So the guy won a few domain auctions - if he wasn't there someone else would have won them. He just happens to be the person that won in this case.

<comment><AUTHOR> The problem is there's a huge conflict of interest. He could easily bid up auctions he had no intention of winning, thus inflating prices. Another is he might be able to see the bids or domain watchlists of other bidders, which gives him a huge advantage.

<comment><USER3> I don't understand.. why would he specifically want to bid up auctions? To boost GoDaddy's revenue?

If GoDaddy wanted to do that, why do they need him - couldn't they already have been doing that, before they hired him??

<comment><AUTHOR> I'm not saying he specifically bid up auctions, but there's a possibility. So it weakens trust with all parties involved. All the other major companies have some policy against this (not all). I would also figure that his compensation is tied to the performance of his division (domain auctions).

It's almost like saying, "I don't see the problem with that figure skater also judging the event."

:)

</comment></comment></comment></comment><comment><AUTHOR> I've already transferred 80% of my domains away from GoDaddy. This last breach of goodwill and trust has motivated me to move the rest.

<comment><USER4> yeah dude, I would have done the same lol

Time for other companies to get ready with additional servers for massive switching haha

</comment></comment><comment><USER5> That's just unacceptable behavior.

If we were really a force as internet consumers, we should drop them in mass to show them not to fuck up with us.

And every wrongdoer after them.

</comment><comment><USER4> Auction rigging to generate bigger revenues eh

Could this company be sued for this?</comment>