Recreating the oldest aerial photo - <AUTHOR> http://blog.davidad.net/post/47278329434/recreating-the-oldest-aerial-photo

<comment><USER2> I've seen this done several times previously with the original photograph above. From example page 16 of "How buildings Learn" by Stewart Brand from 1994 (a really great book) has this exact comparison with a photograph from 1981 (the tall building the the exact centre is missing). There is another example from last year here: <http://stevedunwell.com/aboveandbeyond/?p=27> and another here <http://www.boston.com/ae/specials/aerialboston/>

<comment><USER3> _How buildings Learn" by Stewart Brand from 1994 (a really great book)_

Yes. Stewart Brand should need no introduction to readers of HN for his many influences on high-tech industry, but I'm always telling friends about _How Buildings Learn: What Happens After They're Built,_

[http://www.amazon.com/How-Buildings-Learn-Happens- Theyre/dp/...](http://www.amazon.com/How-Buildings-Learn-Happens- Theyre/dp/0140139966)

especially friends who study architecture.

</comment></comment><comment><USER4> It's amazing to see the buildings that are still there. Moving the mouse quickly left and right on the comparison picture shows up quite a few buildings that appear unchanged.

<comment><USER5> In some areas of Boston, you'd actually see a large number of buildings still there from 1860--although that would be just a little early for the Back Bay to be fully completed. The aa in this photo is, to a large degree, the West End which was mostly torn down to construct the concrete monstrosity which is Government Center among other changes.

</comment></comment><comment><USER6> It's fascinating to see how some of the main constructs that help define a city ie. major roads, intersections, are still highly visible and intact over 100 years later.

Would recommend "The City in History" by Lewis Mumford. Great read about how cities have formed, died, and some renewed throughout history.

<comment><USER7> Fascinating, but probably shouldn't be surprising. By 1860, Boston was already 1/3 of it present size--too developed for wholesale re-layouts to happen without something major (like the Great Chicago fire did in Chicago).

Look at this map of lower Manhattan from the 1600's to today: <http://www.racontrs.com/stories/nyc-land-reclamation>. Look how, aside from land reclamation, the basic street architecture has changed little since the mid 1700's.

</comment></comment><comment><USER8> Very cool. My company has offices on the left hand edge by the Old South Meeting house spire near Milk St. Amazing how much stuff has changes and stayed the same. The spire's was where the revolution started in 1773. It's now dwarfed on all sides.</comment>


LinkedIn Wants More Cash, Offers to Sell $1.15B Worth of Stock - <AUTHOR> http://allthingsd.com/20130903/linkedin-wants-more-cash-offers-to-sell-1-15b-worth-of-stock/

<comment><USER2> At a P/E of 935, I would also sell all the shares I could.

[http://finance.yahoo.com/q?s=LNKD](http://finance.yahoo.com/q?s=LNKD)

<comment><USER3> So... why would it be a bad idea to short the stock now? Somebody talk me out of it before I make an expensive mistake.

<comment><USER4> Shorting excellent companies that make lots of money is generally a bad idea.

<comment><USER5> They made $3.7M last quarter. That's not "lots of money" for a $32B market cap.

<comment><USER4> Those are gaap earnings which are of minor relevance for high growth companies prioritizing usage and revenue expansion. The company made $363 million in revenues last quarter.

<comment><USER5> OK so I'm not a finance guy at all, but can you explain what I'm not getting:

[http://www.google.com/finance?q=NYSE%3ALNKD&fstype=ii](http://www.google.com/finance?q=NYSE%3ALNKD&fstype=ii)

363M revenue. Minus a ton of things for operating income of 8M. Then tax brings it to 3.7M.

On what basis are we supposed to think LinkedIn is suddenly going to eliminate > $300M of quarterly costs?

If you do the "1 times revenue" (so about 1BN) that's still not close to being worth 32B.

I asked the same things when I was 18 in the dot-com boom and got hand-wavy responses and people talking about eyeballs and stuff. Why is this fundamentally different? I understand if it's too much to explain in a comment, but could you link to some introduction that explains why a company's costs should be ignored?

Also, why the stock would go _up_ when they meet expectations? If you bought into the high P/E at $100 on the logic of "yeah the PE is high, but it's growing into it" then you'd expect the PE to lower as they meet their goals. Instead the PE stays around the same area and the stock goes up. That does not sound rational. Edit: Like, 1% profit margin, so even if they magically multiply that by 10 or 20 times, that'd still mean a PE in the hundreds.

<comment><USER4> A $1.5b run-rate on a product with $0 COGS and 60% growth after just 10 years in business is "making lots of money".

<comment><USER6> Keep telling yourself revenue matters without profits, and see if that lasts another 10 years. 60% growth after ten years but no profits? The only 'type' of company that is, is a loser. Some would argue even Amazon has an unsustainable formula and LinkedIn is no Amazon.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> LinkedIn is doomed the moment real competition appears. People only use it while grimacing with disgust.

<comment><USER8> Why? I like it.

<comment><USER9> I'm curious about this as well. I don't use the site, but I see a lot of hate toward it (much of it seemingly unexplained).

<comment><USER10> This is a good example of why everyone who has any sense dislikes the company: [http://community.linkedin.com/questions/8947/how-do-i- preven...](http://community.linkedin.com/questions/8947/how-do-i-prevent- linkedin-from-spamming-everyone-i.html)

Long story short: They're slimy.

<comment><USER8> OK but once you're in already, and you aren't connecting your address book (hmm, what else are they going to do with it?) what sucks about LinkedIn so much relative to other social networks?

</comment></comment></comment></comment></comment><comment><USER11> I'd be very careful to buy stock at LinkedIn. I'm not surprised there's high engagement as LinkedIn is full of dark patterns designed to drive engagement but this is bound to backfire sooner or later, many of which I'm sure you've all read about here already if not experienced. There are only so many frustrations users are willing to put up with.

</comment><comment><USER12> All I can think of is walled gardens need upkeep

LinkedIn is the most amazing business node graph out there - for a professional person online it has _everybody_ and uptodate. But there is a wafer thin business model if they played their hand brilliantly - and they play it like a drunk Captain Hook trying second dealing in Vegas.

I just hope that when / if it all collapses we can club together and transfer out the edge connections.

<comment><USER13> Can you explain what you mean? It's not obvious to me from my perspective.

<comment><USER14> Could linkedin use it's data for nefarious purposes? Yes.

Could some professionals ask to be compensated for being on the network? Yes.

Have the professionals on linkedin realized the above? No.

<comment><USER12> Many professionals are compensated for being on LinkedIn - just not by LinkedIn direct !

Oh and I consider the spam I have to wade through to use it a nefarious purpose :-)

</comment></comment></comment></comment><comment><USER15> Does this dilute existing LinkedIn shareholders?

<comment><USER16> Yes. According to the prospectus[1] 4,165,972 shares new shares are being issues raising the outstanding Class A shares to 97,732,877.

This is part of the reason there was a bit of a sell off after the announcement.

[1] [http://www.sec.gov/Archives/edgar/data/1271024/0001047469130...](http://www.sec.gov/Archives/edgar/data/1271024/000104746913008826/a2216551zs-3asr.htm#ca46401_prospectus_summary)

<comment><USER17> Mathematically, their price should go down exactly (due to this announcement) (1 - Old # of outstanding shares / New # of outstanding shares)%

<comment><USER18> Only if you think the money they're getting for selling the stock is worthless...

<comment><USER17> Oy vey, I knew I was doing something wrong, I was just too focused on the math :)

</comment></comment></comment></comment></comment><comment><USER19> Stop giving them your money. Let them collapse like capitalism intends.</comment>


Videos from Reflections | Projections 2009. - <AUTHOR> http://www.acm.uiuc.edu/conference/2009/video/

<comment><AUTHOR> More info at <http://www.acm.uiuc.edu/conference/2009/speakers.html> and <http://www.acm.uiuc.edu/conference/2009/schedule.html></comment>


Show HN: XSScrapy – fast command line XSS vulnerability spider - <AUTHOR> https://github.com/DanMcInerney/xsscrapy

<comment><USER2> Does this also work for dynamic "ajax" sites that have their DOM built in script?</comment>


A review of Yasha Levine's "Surveillance Valley" - <AUTHOR> https://librarianshipwreck.wordpress.com/2018/06/08/all-watched-over-by-machines-a-review-of-yasha-levines-surveillance-valley/ <comment><USER2> He makes some good points. But some are just silly:

> Noting that, "Tor works only if people are dedicated to maintaining a strict > anonymous Internet routine," one consisting of dummy e-mail accounts and all > transactions carried out in Bitcoin, Levine suggests that what Tor offers is > "a false sense of privacy" (213).

That's like saying that you'll be killed if you run across a freeway. I do agree that Tor Project ought to teach better OPSEC, however.

And this is just plain wrong:

> Yet, as the case of Ross Ulbricht (the "Dread Pirate Roberts" of Silk Road > notoriety) demonstrated, Tor may not be as impervious as it seems – > researchers at Carnegie Mellon University "had figured out a cheap and easy > way to crack Tor's super-secure network" (263).

Ross outed himself. In a post on bitcointalk.org, he announced SR in a thread about "heroin stores", using an account created using his real name.[0] In a later post, using the same account, he advertised for a coder, and included his real-name Gmail address.[1] And he got a visit from the FBI, after ordering a bunch of fake ID from SR.[2] So he was a person of interest in their SF office. Also, the SR server was misconfigured, such that Apache error messages bypassed Tor.[3] And oh yeah, also the infamous Stack Overflow post, looking for PHP help.[4]

And all that went down _before_ the CMU attack. There were many prosecutions after CMP "researchers" turned over data to the FBI. But SR wasn't one of them.

Overall, it's just polemical and agenda-driven.

0) [https://bitcointalk.org/index.php?topic=175.msg42670#msg4267...](https://bitcointalk.org/index.php?topic=175.msg42670#msg42670)

1) [https://bitcointalk.org/index.php?topic=47811.msg568744#msg5...](https://bitcointalk.org/index.php?topic=47811.msg568744#msg568744)

2) [https://arstechnica.com/tech-policy/2013/10/how-the-feds- too...](https://arstechnica.com/tech-policy/2013/10/how-the-feds-took-down- the-dread-pirate-roberts/)

3) [https://www.wired.com/2014/09/the-fbi-finally-says-how-it- le...](https://www.wired.com/2014/09/the-fbi-finally-says-how-it-legally- pinpointed-silk-roads-server/)

4) [https://stackoverflow.com/questions/15445285/how-can-i- conne...](https://stackoverflow.com/questions/15445285/how-can-i-connect-to-a- tor-hidden-service-using-curl-in-php)

</comment><comment><USER3> The other part of the allusion to Richard Brautigan's poem (emphasis mine):

"I like to think

(it has to be!)

of a cybernetic ecology

where we are free of our labors

and joined back to nature,

returned to our mammal

brothers and sisters,

and all watched over

by machines _of loving grace_."

<comment><USER4> Further, the legal theory behind warrant-less mass surveillance is that you aren't being watched over until a human opens up your documents.

<comment><USER5> That's a bit like saying all the nation's classified material is secret because no one has checked it out from the National Archive yet.

The data shouldn't exist in the first place.

</comment></comment></comment><comment><USER6> > Surveillance Valley is a troubling book, but it is an important book... What > it demonstrates in stark relief is that surveillance and unnerving links to > the military-industrial complex are not signs that the Internet has gone > awry, but signs that the Internet is functioning as intended.

</comment><comment><USER7> The five eyes IC apparatus has invested in Tor relays and mitm attacks of Tor exit traffic so much so that I personally think using Tor endangers you [1]. They were doing this ~10 years ago (public info - [2]).

As for the surveillance state,I keep pondering other aspects of society. Like how public restrooms are intentionally designed to lack privacy,how in the military and prison you're expected to be comfortable with being completely naked around others and how it is completely acceptable for an arrested citizen to be forced to undress in front of other prisoners and possibly undergo a full on body cavity search all without the chance to defend his accusation in court. I could go on,but you get the point.

I am not so sure the people want privacy. Or maybe they think so lowly of their freedoms,short term safety is always more preferable.

From the intelligence community's perspective, it's all about information control. They do this in other countries. They topple regimes and adjust public opinion in the inteterests of western security and economical goals. If I was in their shoes, I can see myself using fear of other countries doing the same thing against us and use that as an excuse to "beat them to the punch" and take control of information flow in the west.

They simply don't have the clear consent of the people to use the means they use by which they justify the end goal: national security. Regardless of how oblivious and clueless the people may be, the very foundation of a democratic republic is consent. An agent or officer of any democratic republic who persistently acts in subversion of the people's consent is a traitor even if no particular law is broken.

[1] [https://www.schneier.com/blog/archives/2013/10/how_the_nsa_a...](https://www.schneier.com/blog/archives/2013/10/how_the_nsa_att.html) [2] [https://resources.infosecinstitute.com/german- intelligence-f...](https://resources.infosecinstitute.com/german-intelligence- first-developed-attacks-tor-network-advises-not-use/)

</comment><comment><USER8> > many people have their hopes invested in the belief that these companies are > building a better brighter future

OT, but I'm reminded of how many times in recent history that we (as humans) have hitched hope for a better future on some tangential circumstance:

\- the socialist notion that industrialization would bring about peace, equality and well-being for all

\- the liberal notion that freedom from tyranny would bring about peace, equality and well-being for all (through trade)

\- the general notion that airplanes would bring about peace since no-one would be so demonic as to drop bombs on people from the air.

Those dreams are now in shambles. I find it prudent to be highly skeptical of similar claims that have not yet been similarly disproved, i.e.

\- the feminist notion that freedom from patriarchy will bring about peace and equality for all

\- the popular notion that atomic weapons will end all wars since no-one would be so crazy as to start an nuclear war.

I think it's time to hitch our hopes on simply not starting wars, and simply divert our productivity towards environmental sustainability and general well- being for all, instead of waiting for some tangential causations like those mentioned to do the trick, which in hindsight doesn't amount to much more than marketing fluff.

<comment><USER9> You are heavily oversimplifying (to the point of incorrectness) every concept you outline, reducing them all down to various flavors of utopianism. On top of that, your final call to action is a mirror reflection of what you just criticized. The truth of the matter is these concepts and many others are all weaving together in a complicated and nuanced way.

<comment><USER8> Simplifying - guilty as charged. Please show me a statement that is not. But agreed there are limits to how oversimplified things may be portrayed. I sometimes grant myself some leeway in search of a larger picture however, when I assess that someone applying some philosophers charity might find value in it [0]

The main difference between those "Utopian dreams" I refer to and my own suggestion is that they hitch hopes on some technology or extraneous happening (the extent to which certainly is debatable), I just wish we would put ourselves and our own moral agency in the drivers seat more.

[0] [https://en.wikipedia.org/wiki/Principle_of_charity](https://en.wikipedia.org/wiki/Principle_of_charity)

</comment></comment></comment><comment><USER10> If you enjoyed this review, Adam Curtis' "All watched over by machines of loving grace" documentary series[1] is an absolutely beautiful watch.

[1] - [https://topdocumentaryfilms.com/all-watched-over-by- machines...](https://topdocumentaryfilms.com/all-watched-over-by-machines-of- loving-grace/)

<comment><USER11> I found the part tying the East Asian economic problems and their causes to the GFC absolutely fascinating. Definitely recommend.</comment></comment>


The silent icelandic revolution the media don't tell you about - <AUTHOR> http://www.aljunnah.com/2011/02/the-other-revolution-of-iceland/

<comment><USER2> What a fantastic example of author bias.

Just because a large amount of the population takes to the streets, and just because the government resigns, it's not a revolution. A revolution means that the people are trying to change the form of government, which is absolutely not what happened. An overwhelming majority of the Icelandic are perfectly happy with their current form of a liberal, western, parliamentary republic.

The result of the protests was that the government resigned, held a re- election, and put the icesave bill to a referendum. There's absolutely nothing revolutionary about this, this is exactly how our liberal democracies are supposed to work.

But if you're from a region where there aren't any liberal democracies, I can understand why a reporter would write this funnily biased piece, drawing parallells between the actual protests and revolutions in Tunisia and Egypt, and the protests in Iceland.

<comment><USER3> Given the stress that the Icelandic people were put under it is a credit to them and their democracy that there wasn't more violence.

The media in the UK covered the 'revolution' closely because of the many ties between the two countries. I can imagine most people in the middle east know little or nothing about Iceland so why would the media cover ten thousand people standing peacefully in the cold outside a parliament building making reasonable demands.

</comment></comment><comment><USER4> This feels hardly readable. Anyone else having a lot of difficulty with the English here?

<comment><USER5> Yeah I didn't understand much the article as well...

</comment></comment><comment><USER6> As an Icelander I must say this article is terribly poorly written. I don't really understand what this silent revolution is about. Generally speaking, if a "revolution" isn't discussed by any media outlet and cannot be found on Google (in a country where government censorship essentially does not exist) I'd say that it isn't just silent, it simply doesn't exist.

There was never a referendum on whether banks should be recapitalized or not, they simply were recapitalized. However there was a referendum on the Icesave deal (about terms of repayments of deposits of UK/Dutch depositors into an Icelandic bank) after the president was petitioned not to agree with the parliament decision to do so. The president formally has power to do this but no president acted on it until the incumbent one in 2004 (50 years after Iceland became a sovereign state) and again in 2010 regarding the Icesave deal. This deal is actually quite different from what the Irish government is currently doing by saving its bank system, the old Icelandic banks did go into bankruptcy in 2008 have since been restarted as new institutions partly owned by the government and partly by the old bankrupt estates. The deal is about sovereign political responsibility and having a national referendum about it is quite paradoxical in my view since the end result is basically asking: Do you want to pay a great deal of money or not?

Of course the matter is more complicated than that. And is subject to lengthy spin-filled bullshit ridden politics.

About the constituent assembly: It was supposed to have already started but due to legal issues in the elections it hasn't started yet and is in a bit of a limbo. The matter of this assembly is, of course, quite political as well.

Finally, the exaggerated comments on "capitalism" and "communism" in the article are very exaggerated. Iceland has conventionally been a nordic welfare state with a strong healthcare system, public school system, etc. The atmosphere before 2008 was leaning towards the right but shifted a bit to the left after the big bank collapse. It feels to me it's shifting back to the right now as people realize that huge tax hikes aren't that great either.

Bottom line: this article is terrible, poorly written and not very informative. I don't really understand how it got any attention on HN.

</comment><comment><USER7> Why are we citing an article on a militant Jihadi website? I'm sorry, but since when is HN an outlet for crackpot militant religious groups?

P.S. Whoever pens that site doesn't quite grok Islam. Says "there are no copyrights in Islam" in all footers. Without copyright, or at least attribution, there wouldn't be Islam today (i.e. the Sunnah is all citations that would collapse if unattributed.)

<comment><USER8> Not sure why you've been downvoted here, you make a valid remark. I'm pretty sure the flag on this site's logo is the flag of the jihad. Since that wave of 'revolutions' in the middle east has started, a lot of disinformation has been spreading, and some wolves seem to be hiding behind the cute flock of sheep. It wouldn't hurt to care of where we're picking our news from, and take everything with a pinch of salt

<comment><USER7> You need not quote revolution: it's real. And Jihadis have NOTHING to do with the Arab Spring. They would rather kill strangers in strange lands, instead of actually rising up against their own despots.

Saudi Arabia funds them, and you heard what the fuckwit Mufti said about the Egyptian uprising: he said Mubarak is the rightful rules of the soil and Muslims must obey him.

Muslim people have woken up to the lies of the Islamists.

</comment></comment></comment><comment><USER9> Has anybody killed anybody or threatened to kill anybody?

No?

Yeah, I wouldn't count on the media paying much attention.

</comment><comment><USER10> Is this in regards to the Icesave bill? [http://www.icenews.is/index.php/2011/02/16/iceland- parliamen...](http://www.icenews.is/index.php/2011/02/16/iceland-parliament- votes-yes-on-icesave-repayment-bill/#more-21234)

It looks like something much different is happening than what is described in the article. I'm highly skeptical of the claims in this article. It seems light on facts and heavy on opinion.

<comment><USER11> * it has taken a long time to get to this stage.

* the first version "the people" rejected, imagine that in UK.

* they ultimately have to pay (not by choice)

* notice how they plan on forcing the banks to pay for it (yes most owned by the government) not by taxing their people who have already suffered.</comment></comment>


Why is there no looting in Japan? - <AUTHOR> http://blogs.telegraph.co.uk/news/edwest/100079703/why-is-there-no-looting-in-japan/ This is a short piece that asks a very interesting question. There are a few anecdotal statements about how other cultures have witnessed large levels of looting during catastrophes. <comment><USER2> Gee, I don't know, but one has to look at the vast differences between an almost entirely homogenous Japanese society, where almost all of the population is brainwashed from birth to act in cooperation and those of a vastly multicultural society where the majority of the wealth has been held almost exclusively by a homogenous segment of the population who have used this wealth and influence to socially and economically stigmatize the other groups to isolate them while profiting at their expense. This has led to a perpetual stimulation of racial, ethnic and economic strife which when given the chance to manifest itself unpunished, will do so and on a large scale.

The looting is all counter-productive of course, because once tensions settle down, the wealthy elites will use the past uncivil behavior as further reasoning to impose even more drastic measures against the oppressed by instigating fear, uncertainty and doubt in the minds of those who view themselves as potential victims and co-opting them into participating in a new round of legalized ethnic and socio-economic cleansing. See New Orleans, Detroit, Los Angeles, New York, et al.

<comment><USER3> "where the majority of the wealth has been held almost exclusively by a homogenous segment of the population who have used this wealth and influence to socially and economically stigmatize the other groups to isolate them while profiting at their expense"

What about the vast majority of the wealthy that have earned their money through hard-work and success? Are they somehow doing everyone less fortunate than them a disservice solely because they have wealth?

I also don't see how Japan is any different. There are just as many wealthy people in Japan as there is in the US.

"This has led to a perpetual stimulation of racial, ethnic and economic strife which when given the chance to manifest itself unpunished, will do so and on a large scale."

It's because some cultures continue to spawn uneducated people that decide to loot and steal when they think they can get away with it. Look at the culture in Japan: Most families, even when they are poor, are educated and instill that education in their kids.

Another problem is broken households. Having kids at 16 years old with no father around is only going to decrease the chances of your kids success (and your own).

<comment><USER2> "Having kids at 16 years old with no father around is"

what happens to some people. The actual teen birth rate in the US is 4.15%, no data on whether or not the father was part of the family unit post-partum. Are you suggesting that 4.15% of the US population is vastly responsible for looting during natural disasters or riots? Or are you just beating up on teen mothers with rudimentary sexual education, little understanding of the workings of an advanced society (which encompasses most if not all teenagers) or lack of funding/access to family planning?

Your politically regressive talking points have little value in any argument that anyone can easily pick apart with statistics. I do that for fun. It's easier to state that you think that poor, black people are naturally prone to looting and there's nothing that anyone can say or do that will change your mind. I'd respect more for your ignorance than for your feeble attempt to explain your position.

<comment><USER3> " Are you suggesting that 4.15% of the US population is vastly responsible for looting during natural disasters or riots?"

You really look at statistics for fun..really? It sure doesn't sound like it. Of course not ALL will be responsible, but more often then not, the people responsible for looting are uneducated and poor.

"Or are you just beating up on teen mothers with rudimentary sexual education, little understanding of the workings of an advanced society (which encompasses most if not all teenagers) or lack of funding/access to family planning?"

I blame the parents, for not giving them the proper education when it comes to protection. I am interested in the statistics on the parents of teenage mothers. How many of them were also teenage mothers and how many families only had one parent? We also won't be able to see the number of two-parent families that just didn't spend any time with their kids.

"I do that for fun. It's easier to state that you think that poor, black people are naturally prone to looting and there's nothing that anyone can say or do that will change your mind. I'd respect more for your ignorance than for your feeble attempt to explain your position."

You mentioned race, I didn't, which shows your ignorance. I'm talking about culture, which many times is separated by race.

The problem is that we can't even show statistics that prove that one race might, on average, be committing crimes or are in any way different than another, without being labeled a racist. So, I'm not going to even bother.

Without being able to figure out why, there will never be a solution to the problem. Even if we knew why, there will always be people that decide to have kids early or make poor life decisions. It's the price of living in a free society.</comment></comment></comment></comment>


Important Notice to Our Users - <AUTHOR> http://news.spotify.com/us/2014/05/27/important-notice-to-our-users/ <comment><USER3> Interesting note: there are now two apps in the Google Play Store under Spotify Ltd. The first one -- Spotify, is the existing app. [https://play.google.com/store/apps/details?id=com.spotify.mo...](https://play.google.com/store/apps/details?id=com.spotify.mobile.android.ui)

It has the package name 'com.spotify.mobile.android.ui'.

The new one is 'Spotify Music,' which appears to be brand new. [https://play.google.com/store/apps/details?id=com.spotify.mu...](https://play.google.com/store/apps/details?id=com.spotify.music)

It has the package name 'com.spotify.music.'

To me, this indicates that the signing keys for the Android app were also stolen during the breach.

<comment><USER4> No, look here:

[https://support.spotify.com/us/problems/#!/article/downloadi...](https://support.spotify.com/us/problems/#!/article/downloading- android-update)

That article has a link to com.spotify.music

<comment><USER5> The article probably needs updating.

Because right now `com.spotify.music` is just over 1MB (down from 15MB) and just shows this screen:

[http://i.imgur.com/lZYDyBt.png](http://i.imgur.com/lZYDyBt.png)

Hitting the "Download" button takes you to the "Spotify Music" app page on the Play store.

<comment><USER4> It's the other way around. Go here:

[https://play.google.com/store/apps/details?id=com.spotify.mo...](https://play.google.com/store/apps/details?id=com.spotify.mobile.android.ui)

Use this online tool to install on your device, then open it from the notification drawer and you'll get the screen above. Then do the same from here:

[https://play.google.com/store/apps/details?id=com.spotify.mu...](https://play.google.com/store/apps/details?id=com.spotify.music)

and also scroll down and note that the size is 14MB - i.e. com.spotify.music is the new one.

Anyway, whilst you had that wrong, I had misunderstood. I think Shank was saying that the signing keys for com.spotify.mobile.android.ui were stolen which is why they then changed it to com.spotify.music - which is a reasonable explanation. I had thought that he meant the attacker uploaded com.spotify.music or something.

The reviews are a disaster though. I know those people are just the minority of morons who don't understand what's going on, but holy shit they shout loud. As a Spotify Premium customer I hope it doesn't cause them any major issues.

</comment></comment></comment></comment><comment><USER6> The complete lack of concrete information and the fact that the "incident" applies to only one user suggests something was discovered that triggered the company lawyers to engage cover-your-ass mode.

The alternative explanation would be that Spotify has adopted a total transparency policy that includes even the smallest of incidents, but the total lack of information about what the Android update actually changes doesn't support that.

Am I missing something here?

<comment><USER7> You may have missed:

"Hey, this also has the nice benefit that customers will upgrade to our latest version."

<comment><USER8> Given that they are only urging Android users to update, it looks like this isn't a new version, but rather a hotfix for some issue that only existed in the Android app.

</comment></comment></comment><comment><USER9> I received an unauthorized password reset attempt over the weekend. Seems like I probably wasn't the only one.

<comment><USER10> With the size of the spotify users, that might also have been a typo. Or a targeted attack... but to gain what exactly?

</comment></comment><comment><USER11> What's the connection with the Android app? Did someone backdoor it, or something?

<comment><USER12> maybe it transmits the password or session token in an insecure way?

<comment><USER13> As best I can tell from sniffing, it isn't doing anything overtly insecure.

</comment></comment></comment><comment><USER14> It's surprising how the titles of such posts never mention the content, just "Important Information".

</comment><comment><USER15> Interesting note at the end about offline playists having to be re-downloaded. That, and the phrase 'internal company data' has me curious if the breach was some kind theft of media, as opposed to user credentials and info.

<comment><USER16> It sounded like that's a result of the upgrade on Android - presumably they've changed something recently about how they store the offline play lists.

<comment><USER3> Offline playlists are encrypted by Spotify. Presumably this change means that the encryption keys used by Spotify to store offline data were compromised.

<comment><USER17> Actually, it looks like the "upgrade" is actually a new app entirely, so it's probably just that since it's a new app, the offline data has to be regenerated.

</comment></comment></comment></comment><comment><USER14> It's surprising how the titles of such posts always never mention the content, just "Important Information".

</comment><comment><USER18> sounds like aftermath of heartbleed

<comment><USER19> Possibly, but why wouldn't they say so? It seems reasonable to me that they would blame the heartbleed bug instead of taking the blow themselves.

</comment></comment><comment><USER20> Looks like somebody REALLY wanted to know what their girlfriend had been listening to.

<comment><USER21> Spotify is a paid service, and they store user-sensitive data. Don't underestimate the impact of a breach.

<comment><USER22> I think the joke was because only one user's data was apparently accessed.

</comment></comment></comment><comment><USER23> Two things missing from this statement that should be part of this note and every note like it:

1) How were the passwords stored (hashed? what algorithm? what parameters?)

2) How were the CC #'s stored (encrypted? what cipher/mode/etc?)

<comment><USER24> > Our evidence shows that only one Spotify user's data has been accessed and > this did not include any password, financial or payment information.

<comment><USER25> I think the point here is if your data has been breached you should be reassuring people that password and payment details even if accessed aren't easily readable.

</comment></comment></comment><comment><USER26> |We take these matters very seriously

This phrase seems to appear often in press releases and I feel that it usually indicates the opposite. If you feel the need to SAY that, it's probably because you've done something that implies you don't.

<comment><USER22> That seems like an unreasonable standard. If you take things seriously - <USER2> can't SAY that you do otherwise people will think that you don't.

</comment></comment><comment><USER27> I don't understand why they bother announcing such vague information. Just say 'security breach' in two words and stop instead of this word diarrhea.

<comment><USER28> Attention: Not everyone is tech-savvy, tech-anything, or security-anything. Saying "Security breach, no biggie" is not a proper way to communicate with the general public about a service for which they pay.

-Scope of breach? Check

-Actions taken? Kind of (investigating, patching apps)

-Actions required by users? Check

-Reassurance that everything will be alright, stop cancelling your credit cards? Check

</comment></comment><comment><USER29> The most interesting part to me is that the comments rant about the new app instead of discussing the security issue. Their users really want to be heard. Those are dedicated users whose hatred for the app is fueled by love for the product or company. Spotify should at least let them know that they're listening.

</comment><comment><USER30> Received a similar message from eBay (french):

"Cher membre eBay,

Afin que les utilisateurs d'eBay continuent de bénéficier d'une expérience fiable et sécurisée sur notre site, nous demandons à tous nos membres de modifier leur mot de passe.

En voici les raisons : nous avons récemment découvert que notre réseau informatique avait été la cible d'une cyberattaque. Cette attaque a eu pour effet de compromettre une base de données contenant les mots de passe des utilisateurs eBay.

Il est important de souligner que rien n'indique qu'il y ait eu accès à vos données financières ou que celles-ci aient été compromises. Par ailleurs, votre mot de passe était crypté. "</comment>


Nobody Understands Probability - <AUTHOR> http://jsteinhardt.wordpress.com/2010/09/13/nobody-understands-probability/ <comment><USER2> For those who didn't make it all the way down:

 _People often intuitively think of probabilities as a fact about the world, when in reality probabilities are a fact about our model of the world._

<comment><USER3> There are at least two interpretations of probability. Firstly the epistemological, as you say, represents our lack of knowledge about the world. Secondly the aleatory truly represents the phenomenon of chance in the world.

The best interpretation of quantum theory for example (as I understand it) takes the latter view that randomness is genuinely physically manifested, and does not simply represent our inability to model reality.

<comment><USER4> I think you're confusing concepts. The original point is about the difference between the _map_ and the _territory_. And, because I'm (finally) systematically going through Eliezer's sequences: <http://wiki.lesswrong.com/wiki/Map_and_Territory_(sequence)>

Your second paragraph is about a particular map: quantum theory. Quantum theory has probabilities in it. The dominant interpretation of quantum theory is that the probabilities accurately represent what happens in the universe; they are not artifacts for us to correct. But there is still a difference between our map (quantum theory) and the territory (the universe itself).

Put another way: quantum theory is a map with uncertainty baked into it. But this uncertainty has been _accurately mapped_.

<comment><USER3> No I don't think so. Unlike statistical physics, where probabilities are simply a mathematical technique for dealing with uncertainty, quantum mechanics actually postulates that randomness is inherent to the universe.

If you disagree with me, please describe how your concept of "maps and territories" applies to the StatPhys/QM distinction.

<comment><USER4> Suppose I accurately map the coastline, and every relevant part of the coastline is depicted in my map. But the map is _not_ the same as the coastline itself.

If my coastline has some feature that blips in and out of existence in a predictable way, I can integrate that into my map. My map then has uncertainty in it. That uncertainty is an accurate reflection of the coastline itself - but there is still a distinction between the map and the coastline.

I don't disagree with your second sentence. But there is still a difference between our theory of quantum mechanics and the universe itself.

</comment></comment></comment></comment></comment><comment><USER5> The odds of _nobody_ understanding probability is near-zero...

<comment><USER6> I figured there was a good chance someone would say that.

</comment></comment><comment><USER7> This essay by Yudkowsky is also helpful.

<http://yudkowsky.net/rational/bayes>

</comment><comment><USER8> > _However, the answer is not, in fact, 1/3. Why is this?_

This seems like a canard to me.

Here is my defense of 1/3 as a correct answer: <http://gist.github.com/578386>

> _Is Bayes' theorem wrong?_

> _No, the answer comes from an unfortunate namespace collision in the word > "given". The man "gave" us the information that he has at least one male > child. By this we mean that he asserted the statement "I have at least one > male child." Now our issue is when we confuse this with being "given" that > the man has at least one male child, in the sense that we should restrict to > the set of universes in which the man has at least one male child. This is a > very different statement than the previous one. For instance, it rules out > universes where the man has two girls, but is lying to us._

No, we are assuming that the givens are facts that are true.

> _Even if we decide to ignore the possibility that the man is lying, we > should note that most universes where the man has at least one son don't > even involve him informing us of this fact, and so it may be the case that > proportionally more universes where the man has two boys involve him telling > us "I have at least one male child", relative to the proportion of such > universes where the man has one boy and one girl. In this case the > probability that he has two boys would end up being greater than 1/3._

No, we don't have to consider universes where the man has at least one male child but does not inform of us of this fact. We have a set of givens that are assumed to be true, and based on those givens and the rules of logic, we can make justifiable statements of probabilities.

<comment><USER9> 1/3 isn't correct, and I find the OP's explanation to be overly complex.

The set of possibilities for two genders of two children is GG, GB, and BB. In your possibilities, GB and BG are exactly the same set (order doesn't matter in a set, only membership), so you don't have 4 possibilities, you have 3 total. Since the guy asserted that one of them is a boy, you can rule out the GG possibility. This leaves only GB and BB as possible results, both of which have a 1/2 chance of being the correct one. The guy never makes a claim that the first child or the second child is the boy (but, this doesn't change the possibility that he has two boys, it just changes which one you remove from the possibilities based on the provided information).

I'm not sure that it's that people don't understand statistics (although I'm not in a position to confirm or deny that), it's that people don't understand set theory. At least if you're going to use this "genders of two children" as example.

<comment><USER8> > _The set of possibilities for two genders of two children is GG, GB, and > BB._

Yes, but there are two equally probable paths to arrive at _(set-theoretic) GB_. Each of these paths is equally probably to the remaining paths, _BB_ and _GG_. There are 4 possible paths, and _(set-theoretic) GB_ is the result of 2 of them.

Your application of set theory is inappropriate given 2 independent events.

<comment><USER9> The question isn't what is the probability of any one of the paths, the question is about the probability of the final result.

A fork in the road that joins up again gives each fork equal probability of reaching the destination.

<comment><USER10> You can't understand the final result in isolation. Out of all men with two children, the probability that they will have two daughters is 1/4, the probability that they will have two sons is 1/4. This leaves heterogeneous offspring occurring 1/2 the time.

If the man is able to make the statement "I have two kids, at least one's a boy", this puts him among the 3/4 of all men with one or two sons. The probability of a man with two sons cannot jump from 1/4 to 3/8 (half of 3/4), as you assert earlier.

It's unintuitive, but it's more obvious when you negate the statement: "I have two children, but I do not have two daughters."

<comment><USER11> Perhaps this would offer an equally appealing explanation: if the man said, "I have two children but at least _my firstborn_ is not a girl..." then the intuitively appealing response of 1/2 becomes roughly correct.

</comment></comment></comment></comment></comment></comment><comment><USER12> If you're lucky enough to attend UIUC, I highly recommend taking ECE 413 to get a thorough introduction to these concepts. It's unfortunate that none of the class materials are online since it goes well above and beyond what is taught in most undergraduate CS courses on statistics. Taking it was hard, but it made me a much better engineer.

Edit: I suppose this applies to anybody in college. Take the hard statistics course that goes over this stuff. It's really valuable, and pretty hard to pick up on your own.

</comment><comment><USER13> A more thorough introduction to this topic is "Probability Theory: The Logic of Science" by E. T. Jaynes (<http://www-biba.inrialpes.fr/Jaynes/prob.html>).

</comment><comment><USER14> This article is not particularly clear. It doesn't have a clear discussion of Bayesian versus frequentist interpretations of probability or inferential statements that are conditioned on the unobserved true parameter versus the observed data. It's hard to understand the subtlety of probability without understanding p(theta), p(x), p(theta|x) and p(x|theta).

<comment><USER15> I've read several pieces on Bayesian stats, and I've done some nontrivial statistics before. It _still_ confuses me that p(data) != 1. I kinda wish the author had gone into detail about how to calculate the probability of an already-observed event.

<comment><USER16> You're confusing p(data) with p(data|data) which is, trivially, equal to 1.

p(data) is better formulated as p(data|F) where F codifies your assumptions about the possible generative probability models that you're building your likelihood function from. Or, similarly, F codifies your understanding of the world and the possible things that could occur within it.

This makes p(data|F) a perfect normalizing constant for the numerator of Bayes' Theorem since the numerator implies a choice of a _specific_ model in the family F, but p(data|F) averages over all possible models/worlds/parameter choices (contained in F).

</comment></comment></comment><comment><USER17> 'Let's consider an example. Suppose that a man comes up to you and says "I have two children. At least one of them is a boy." What is the probability that they are both boys?'.

Am I missing something or in his attempt to solve the problem, does he implicitly assume statistical dependence?

If statistical independence is assumed, with P(Boy) = P(Girl) = 1/2, then the answer to the problem is very simple. P(Boy | Boy) = P(Boy) = 1/2.

Maybe I just don't understand probability :(

<comment><USER16> The basic formation (which the author argues is not subtle enough to be true) is better thought of step by step.

 _Suppose a man comes up to you and says "I have two children"_

At this point you build a set of possible realities, your model. There are four possibilities: {BB, BG, GB, GG}. This space fully describes a model whereupon there are two distinct, children with genders. Additionally, via assumption of independence and equal likelihood, you can assign probabilities to each observation, {BB:1/4, BG:1/4, GB:1/4, GG:1/4}.

 _"At least one of them is a boy."_

At this point, you update your realities by removing the one firmly contradicted by the new evidence. Your new space is {BB, BG, GB} and when you renormalize the probabilities you get {BB:1/3, BG:1/3, GB:1/3} which leads to the idea that the probability at this point that the man has two boys is 1/3rd.

The author suggests however that during that second step, you should also take into account the possibility that this guy is lying or that the fact that he's proffering this information actually changes the likelihoods of those four scenarios in a way different from just multiplying one of them by 0. So perhaps the likelihood of hearing "At least one of them is a boy" is reflected like this:

{BB:0.35, BG:0.32, GB:0.32, GG:0.01}

And your new belief in each of these realities reflects that like so (renormalized)

{BB: 0.35, BG:0.32, GB:0.32, 0.01}

So now I feel even more confident that he has two boys.

<comment><USER17> Thanks for your explanation. I think his first renormalization process is wrong. Because once we know there is a boy, the problem space is reduced do "What's the probability of a boy?" which is 1/2. It has nothing to do with probabilities involving the known child.

<comment><USER15> The problem space is not reduced to the gender of the unspecified child. The important distinction is that "One of my children is a boy" is a statement about _both_ children, not just one of them. Compare that statement to "My first-born child is a boy," and it may make more sense.

<comment><USER17> I appreciate your reply. But I'm still not clear on it. Because of this: "At least one of them is a boy." As I see it, this statement contains the following pieces of information: 1\. There are two children. 2\. One of them is a boy. The question is... what's the probability of there being two boys? Considering the information we've got, there are two possible scenarios remaining 1. [B, B] 2. [B, G]. So we have P = 0.5. No?

<comment><USER18> Three scenarios remain: [B,B], [B,G], [G,B], so the answer is 1/3.

Maybe you were thinking that the order doesn't matter. In that case, what was the probability of getting a boy and a girl, in any order? 1/4 + 1/4 = 1/2. So that's still twice as likely as getting two boys, and that ratio (2:1) will still hold after eliminating [G,G]. You again get 1/3.

Some people find it easier to picture it in terms of frequencies. Imagine 1000 families. What fraction of them have two boys, among those that have at least one boy?

<comment><USER17> ced, yes i was thinking that the order doesn't matter. I think this is what it comes down to. Do you think that order matters? If so, why?

yes i do find it easier to picture in terms of frequencies. in this case, take 1000 families which fulfill the criteria of "2 children with at least 1 boy". what is the probability that a family will have 2 boys? we have not sampled randomly. we have sampled according to the "2 children with at least 1 boy" criteria. we are not dealing with two random variables. one variable is fixed and we sampled according to it. now we are working with one independent random variable within that sample. that random variable has P = 1/2.

is there a flaw in my logic? if there is, please highlight it. i think the main confusion is: 1\. we have sampled according to particular criteria. 2\. we need to calculate a probability within that sample. NOT the population that sample was taken from.

<comment><USER16> In a sampling of 1000 families, the expected values of each kind of family is as follows:

      2xB : 250
      1xB, 1xG: 500
      2xG : 250

Sampling this population ignoring any family that has no boys leads to the probabilities

      2xB : 1/3
      1xB, 1xG: 2/3rds

You're still looking at the same probabilities; the models agree.

I don't fully understand your two random variables formulation. I think the confusion you're getting at is that there is an assumption that the chance of any given birth being male is theta = 0.5. The question however is not

"I have two children, at least one is a boy, what is the probability that my next child is a boy?"

It instead has to do with binomial probabilities on the space of a few repeated trials under parameter theta. The distribution is no longer flat.

Here's a more stark example of a similar form.

"I have 300 children, and at least 1 is a boy. What are the odds that I have no girls?"

<comment><USER17> ok, you stated this very well. It's now clear where the confusions arises: "Sampling this population ignoring any family that has no boys." Yes, with this interpretation the answer is 1/3, but it's contrary to my interpretation.

Actually, for anyone who is interested, see "Boy or Girl paradox". There is literature on this which discusses the different interpretations.

<comment><USER16> That sampling arises because being part of the population which has no boys is * necessary and sufficient* to (truthfully) make the statement that forms the paradox.

The alternative interpretation of the paradox arises when the wording of the paradox is construed to _identify_ one of the children as male or female. In this case (stating something like "my first child is male"), being part of the population (x \in {BB, BG}) is necessary and sufficient and leads to the 1/2 probability of having two boys.

In short, the question becomes whether you believe the child is identified in the wording of the question. Honestly, the author of the paradox goes pretty far out of their way to say "at least one of the children is male" avoiding that identification.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> since we are talking about probability-theory, thought folks here might find gnedenko pretty interesting: [ [http://www-history.mcs.st- andrews.ac.uk/Biographies/Gnedenko...](http://www-history.mcs.st- andrews.ac.uk/Biographies/Gnedenko.html) ]

</comment><comment><USER20> "Nobody"? That's not likely...

</comment><comment><USER21> Never use absolutes?</comment>


Wolfram Problem Generator - <AUTHOR> http://www.wolframalpha.com/pro/problem-generator.html

<comment><USER2> Is there a similar service for Computer Science?</comment>


OpenBSD kernel source file style guide - <AUTHOR> http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man9/style.9?query=style&arch=i386 <comment><USER2> I've never written code with it, but the BSDs use these macros to implement rudimentary generic types in C: [http://www.openbsd.org/cgi- bin/man.cgi/OpenBSD-current/man3/...](http://www.openbsd.org/cgi- bin/man.cgi/OpenBSD-current/man3/LIST_EMPTY.3?query=queue&sec=3&arch=i386). Nice.

However, I've only had horrible experiences trying to read the BSDs' kernel code. There are way too many statements like "mst_fqd->f_do_skb((struct mfq_t *) q);"

<comment><USER3> Yes! That's a really good implementations of linked lists using only preprocessor macros.

sys/queue.h is also provided in all Linux systems.

Easy to use, type-checked by the compiler and a lot faster than a "generic" linked list with pointers to the data. Here, the next/previous pointers get embedded in the payload struct itself.

</comment></comment><comment><USER4> Linux's is very long in comparison to the BSD's. It seems to have weird edge- cases and possibly unnecessary explanations.

[https://www.kernel.org/doc/Documentation/CodingStyle](https://www.kernel.org/doc/Documentation/CodingStyle)

Example: Why is the comment style different in net/? It seems to serve no obvious purpose.

Too many cooks :-)

<comment><USER5> Likely because /net was done before the coding standard and by some 3rd party contributor -- and doing non-functional whitespace/formatting commits is a no- no in most large projects.

<comment><USER6> Linux kernel does have a lot of non-functional formatting commits. [https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux....](https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/log/?qt=grep&q=formatting)

These non-functional commits happen more in areas under active development, while established and inactive projects with less than enough watching eyes want to avoid this kind of non-essential changes.

<comment><USER5> the link you provided has no "just formatting only" changes. The non- functional changes you see there are updating documentation in comments. That is a big difference. You won't ever see "i just felt like we should have an extra blank line here" changes.

<comment><USER7> Hunh? Try the _staging: unisys: fix formatting in timskmod.h_ patch - e5700df52 [1]

        diff --git a/drivers/staging/unisys/include/timskmod.h b/drivers/staging/unisys/include/timskmod.h
        index b20fc9d..59144ba 100644
        --- a/drivers/staging/unisys/include/timskmod.h
        +++ b/drivers/staging/unisys/include/timskmod.h
        @@ -293,6 +293,7 @@ static inline struct cdev *cdev_alloc_init(struct module *owner,
         					   const struct file_operations *fops)
         {
         	struct cdev *cdev = NULL;
        +
         	cdev = cdev_alloc();
         	if (!cdev)
         		return NULL;

(This commit just happened to be the only one I peeked at from the link above - and is particularly apropos)

1\. [https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux....](https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e5700df5238577e4e570d08a8ee1aa126731dae7)

<comment><USER5> well i stand corrected it seems. although if that is from staging, then it will likely get squashed before merged into mainline (meaning this commit won't actually stay in the history).

<comment><USER8> Staging is an exception. Staging is a place to put low-quality drivers developed outside the Linux kernel community, to be fixed to Linux kernel standards before being moved into the normal tree. One of the many things done to a driver in staging is to fix the source code formatting. The commits won't get squashed, since it's part of the mainline git repository, which is never squashed.

So yeah, on staging you can expect to see lots of non-functional changes, mixed with functional changes.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> The first published BSD KNF can be found various places including here: [https://stuff.mit.edu/afs/athena/astaff/reference/4.4lite/us...](https://stuff.mit.edu/afs/athena/astaff/reference/4.4lite/usr/src/admin/style/style)

Like the Linux kernel style, this is essentially K&R style, and the style most of Unix was written in.

</comment><comment><USER10> openbsd is the only project which manpages are not mostly useless. You have even a starting guide there.

<comment><USER11> FreeBSD's manpages are also quite excellent. I haven't had to refer to NetBSD's but I'd suspect it's also good.

On the Linux side, Debian tends to support manpages better than others (they're required by Policy, though they're not release-critical).

</comment></comment><comment><USER12> I never understand the desire to omit braces in single line blocks.

sure

       for ()
           foo

saves you a line, but it's a bug waiting to happen.

<comment><USER13> People keep saying that, but do bugs like that really happen? In my entire career as a professional software developer I've never seen it happening. Not once.

<comment><USER14> Oh yes it does.

[https://www.imperialviolet.org/2014/02/22/applebug.html](https://www.imperialviolet.org/2014/02/22/applebug.html)

<comment><USER13> Fair enough. That being said, -Wunreachable-code would have caught that.

<comment><USER15> >Fair enough. That being said, -Wunreachable-code would have caught that.

-Wunreachable-code was disabled in gcc years ago.

<comment><USER13> Yes, but I would assume that Apple uses clang internally?

</comment></comment></comment></comment></comment></comment><comment><USER16> I like that it's short.

</comment><comment><USER17> Archaic and impractical. Example: Instead of using Linux' pragmatic approach to function prototypes:

"In function prototypes, include parameter names with their data types. Although this is not required by the C language, it is preferred in Linux because it is a simple way to add valuable information for the reader."

OpenBSD enforces this:

"Prototypes should not have variable names associated with the types; i.e., void function(int); not: void function(int a);"

Instead of letting the code tell the parameters' purposes, this now has to be deduced from informal descriptions, or the function definition in some .c file.

<comment><USER18> What would be a reason for leaving out the parameter names? Genuinely curious.

<comment><USER19> DRY principle - you give the variables a name once, in the function definition. e.g:

        //decl in the header
        int pow(int exponent, int base);

if you only look at the header you might think that the arguments are one way, but

        //actual definition
        int pow(int base, int exponent){
          //math is correct but base <-> exponent..
        }

i'm not saying i agree with this at all - it's a contrived example..!

<comment><USER20> CVE-2014-3956

<comment><USER21> Replying with a CVE is like icing on the cake. :) It really shows that OpenBSD devs take security seriously. Funny timing, I was just reading Absolute OpenBSD.

<comment><USER22> It also demonstrates that sometimes, there are additional constraints that you may not understand in choices you may not agree with.

</comment></comment></comment></comment></comment></comment><comment><USER23> This is the first time I've heard of a style guide that demands a mixture of tabs and spaces. I thought this was very much frowned upon.

<comment><USER24> Tabs for indentation, spaces for alignment. This is the only sane standard.

<comment><USER25> I still find it discomforting that it mandates the use of tabs in the middle of the line -

      void<tab>function(int);

A cleaner option is "tabs for indentation, spaces for alignment", but with tabs allowed at the beginning of line _only_. This way opening a file in an editor with a different tab size will still preserve the alignment of the parts.

</comment></comment></comment><comment><USER26> Here's a question, since the man page mentions splint. Has anyone here ever managed to reach a splint warning-free project?</comment>


TransferWise releases end-of-year financials publicly - <AUTHOR> https://transferwise.com/gb/blog/closer-to-money-without-borders <comment><AUTHOR> Link to the actual report: [https://lienzo.s3.amazonaws.com/images/TW_Group_financials_F...](https://lienzo.s3.amazonaws.com/images/TW_Group_financials_FY_2018.pdf)</comment>


Full House - <AUTHOR> http://www.slate.com/articles/business/metropolis/2016/08/boulder_colorado_s_picklebric_show_why_expensive_cities_need_group_housing.html?wpsrc=sh_all_dt_tw_bot <comment><USER2> There are two solutions:

1) move outside a major city. I've never lived directly in a major city and have always been able to afford apartment rent. Even when I was making slightly above minimum wage.

2) Cities need to change the rules on housing. San Francisco, for instance, has an artificial housing shortage. The city artificially limits the amount of housing (height and amount), and since demand increases every year, the price also increases. While this is great for anyone that owns property, it's bad for renters.

Most left-leaning cities do this and then turn around and complain that rent- prices are too high. I often wonder if they tech econ 101 anymore.</comment>


Ask HN: Would You Recommend Firebase? - <AUTHOR> <comment><USER2> As always, it depends. If you are a large enterprise I would not. It is good for starters and small organizations.

What are you planning to use it for and how big are your datasets?

<comment><AUTHOR> Let's say highly scalable app without surprise bills :)

<comment><USER3> Then no.

Is it scalable, yes, if you scale can there be surprise bills, yes. Is it a capable system, mostly.

I agree with the other answer, it depends. If you are just starting and want a quick way to stand up something and get an MVP out and prove it is viable, use it. But just build your product with the foresight that it isn't probably where you want to base yourself forever. Don't lock yourself into firebase only features etc.

We use it today (for an MVP) and are moving off it for the final product, not necessarily because of surprise bills or major problems but because data security and industry requirements don't accept Firebase as secure. To be fair, I'd move off it either way, as it isn't a great backend to be on for an enterprise application IMO. But for getting something up and testable, sure, it is quick, and pretty easy to prototype with.

<comment><AUTHOR> Hmmm I would just rather build it right the first time then. MERN stack you think?

<comment><USER3> Just depends on your application. Hard to judge without more understanding.

I would use whatever you know and not try to add new learning in unless you absolutely need to.</comment></comment></comment></comment></comment>


Automated killer robots 'threat to humanity' - <AUTHOR> http://www.breitbart.com/article.php?id=080227111811.y9syyq8p&show_article=1 <comment><USER2> 'Captured robots would not be difficult to reverse engineer, and could easily replace suicide bombers as the weapon-of-choice. "I don't know why that has not happened already," he said.'

Perhaps because Al Qaeda is rather heavy on the "screaming genocidal religious nutcase" types and rather light on the "genius robot engineer" types?

</comment><comment><USER3> On the front page: <http://news.ycombinator.com/item?id=124630></comment>


Ask HN: New Research Papers on Data Structures and Algorithms? - <AUTHOR> Hi there, I was reading lately the EPFL papers on Array Mapped Tries and HAMTs (Hash Array Mapped Tries), and I become really curious to know more about new researches in the topics of Data Structures and Algorithms. Where can I find such papers and related discussions? <comment><USER2> There's a Stack Exchange site for theoretical computer science. You might find some discussion of algorithms there:

[https://cstheory.stackexchange.com/](https://cstheory.stackexchange.com/)

Also, look up the web sites of the authors of the papers you've been reading and see what else they've been working on. Maybe they also have blogs where they discuss their work.

<comment><AUTHOR> Thanks a lot! Will check them out.

</comment></comment><comment><USER3> Go to Google Scholar (scholar.google.com), type in "Data structures and algorithms" (or some such) hit enter and then adjust the publication date in the side pane.

BTW, Scholar is a search engine for academic articles and books (covering law, the social and natural sciences and engineering, afaik).</comment>


Widespread and rapid thermokarst development in cold permafrost [ ] - <AUTHOR> https://agupubs.onlinelibrary.wiley.com/doi/abs/10.1029/2019GL082187 <comment><AUTHOR> Full title is >Climate change drives widespread and rapid thermokarst development in very cold permafrost in the Canadian High Arctic

But 80 character limit

Its the paper that went through the media recently

[https://www.theguardian.com/environment/2019/jun/18/arctic-p...](https://www.theguardian.com/environment/2019/jun/18/arctic- permafrost-canada-science-climate-crisis)</comment>


Ask HN: If I learn one programming language, what should it be? - <AUTHOR>

I want to dedicate a few months to learning a programming language (part time) in order to achieve the following two goals:
1) Be better prepared, as a founder, to understand engineers. 2) Add a "hard" skill I can use to earn money on the side (e.g., while bootstrapping).
To clarify, I'm not a founder yet, but that may change soon. I have very basic knowledge of programming: a semester of C++ (15 years ago) and some dabbling in AppleScript, shell scripts, and html/php/css.
Of course, I realize that I won't master anything with only a few months of study. Nevertheless, I'd like to do what I can to improve my chops in the time I have.
If you were in my shoes, what language would you invest in? Can you recommend any resources to help me learn it (e.g., books, online resources)?
I'd really appreciate advice from the HN community. <comment><USER3> I'd have to say Python; while its not always the best choice to use, its a great language to learn, because its used in lots of domains and because it a very good place to learn the basics of lots of different aspects of programming, and it has great learning material available for both general programming and many specific application domains and platforms, so it supports lots of approaches. If you decide to continue with it, its easy to keep learning with it; and if you decide to switch languages, its easy to take the lessons learned in Python to lots of other languages.

</comment><comment><USER4> I would recommend Java. Recent surveys of programming languages have ranked Java as the second most widely used programming language after JavaScript.

Java is a strongly-typed "classical" object-oriented language with C-like syntax. These characteristics make it an ideal foundation upon which to build your knowledge of programming.

Many of the newer and more popular languages deviate from the "classical" way of doing things. For example, many are loosely typed. Some use a simpler syntax without semicolons or curly braces. Others have a non-traditional OO model, or a hybrid OO / functional model.

You will likely encounter problems if you skip over the "classical" style languages and head straight for something like Ruby or JavaScript. For example, when you start to get into the more advanced parts of JavaScript, all of the books and tutorials explain things by contrasting with Java or C#. Therefore, if you don't have that classical knowledge, the comparisons will be meaningless.

If you start with a loosely typed language, you won't understand why your JavaScript developers are debating using TypeScript, or why your Ruby devs are debating switching to Java or Scala to build the app to scale. If you start with Ruby or Python you will never be comfortable with languages that use curly braces and semicolons.

I started out by learning PHP. It was a mistake. If I could go back in time I would have learned Java first. When I started to learn object-oriented programming it was tough because I had to unlearn the procedural way of thinking which was very common amongst PHP developers at the time. When I wanted to learn Android development I was confused by the use of types in method signatures. I had to go and learn Java-101 before I could do anything more than write a layout file.

I hope this helps...

</comment><comment><USER5> There are a number of good answers here on general programming. If you want your knowledge to be relevant to your startup, it might depend on what kind of startup you're doing. Will it be mobile focused or Web, for example?

If web, you might go after JavaScript and some back end language (you already have some PHP background), plus HTML and CSS. Build a simple Web site.

If mobile, pick your poison. Many mobile startups start with iOS. Now is a great time to learn iOS since Swift lowers the barrier to entry significantly. If you're going after the larger Android ecosystem, then Java. Android also has the advantage that you can develop on other OS'es like Windows.

I would also recommend getting a great book and working though the examples. Then supplement with what you can find on the Web.

Good luck learning and with your startup!

</comment><comment><USER6> Javascript is pretty widely applicable these days, even if it's maybe not a thing of beauty.

<comment><USER7> I agree. A lot of people have adopted it and there's a large community. Perfect for someone starting out. You will be googling/stack overflowing a lot so its good to know there are a lot of resources behind it. Plus you know th e language is growing not dying.

<comment><AUTHOR> I really appreciate the feedback. JavaScript is supposed to be complicated. Let's say I study 20 hours a week for three months. Can I get off the ground with it?

<comment><USER6> JavaScript is kind of ugly in some ways, but not really complicated. You could easily pick up the basics in that time frame.

I've heard people say good things about this book:

[http://www.amazon.com/JavaScript-Good-Parts-Douglas- Crockfor...](http://www.amazon.com/JavaScript-Good-Parts-Douglas- Crockford/dp/0596517742/?tag=dedasys-20)

But I've never read it myself.

<comment><AUTHOR> That's encouraging. Thanks for the reference.

</comment></comment></comment></comment></comment><comment><USER8> First pick a platform, are you more interested in native mobile or something web based. I primarily work with PHP but I've also tried Ruby and Python. Either one could be my next. Truth be told, just make sure you keep asking "why" and understand the basics. After that, switching to a different language will be pretty easy and you'll mostly have to worry about learning the popular frameworks and libraries.

</comment><comment><USER9> Java. Despite what you may hear about it, this remains the number one or two (depending on who you ask) language in use.

It has a HUGE amount of libraries available and the standard library (SE and EE) cover a lot of ground.

<comment><USER10> nada, too much overhead... get something lightweight... you can run python in the terminal.

<comment><USER11> You are aware that you can also run Java "in the terminal" right?

</comment></comment></comment><comment><USER12> Whatever strikes your fancy. If you're pursuing startup culture at your age, and you aren't trying to become a developer/engineer yourself -- you have all the freedom in the world.

You've probably got more honed skills to contribute actively, and you won't have opportunity to make especially useful contributions programming in anything that's widespread. So you can dable in something popular to be able to read it better, explore something esoteric to have something novel in your toolkit, or just pursue something that's personally practical like the systems scripting and web stuff you've already been toying with.

Don't overthink it. Just find the one that gets you excited and spend whatever time on it you'd like.

</comment><comment><USER13> Python if looking at a dynamic language! It will get you up and running in no time; the syntax is also very easy to understand and easy on the eyes...If you want a statically typed language then go with Go..it feels like python with types

</comment><comment><USER14> While I hate actually using it for production tasks, I have to admit that Python is the best language ever to learn. Its syntax doesn't really get in the way at all and it is extremely understandable. It's also widespread.

<comment><AUTHOR> Why do you hate using Python for production tasks?

<comment><USER14> In my experience/opinion: get over a certain number of lines of code and the type system starts getting in the way rather than getting out of the way. This number is not obvious and is very easy to pass without realizing it until it's too late.

<comment><USER15> Hey, not arguing, just curious, do you have some examples of times where the type system has gotten in the way? And what languages you prefer to use for production systems that don't have those problems?

<comment><USER16> Simple example: Say you're working with an external library. And say you need to work with this function:

        def convert_to_int(val):
            ....

What type should val be? Do you pass the object, or a string representation of the object, or...?

The problem with Python - and non-statically-typed languages in general - <USER2> that function signatures don't need to be defined upfront, which leaves it up to the programmer to figure out the inner workings of the functions. This is a huge pain point when working with other people's code.

Python 3 introduced function annotations, which is great. But again, the problem here is that function annotations are opt-in. It's still up to the developer to add the annotations.

</comment></comment></comment></comment></comment><comment><USER17> > Be better prepared, as a founder, to understand engineers.

Be careful, you may start to suffer from the Dunning-Kruger effect[0]. You would only begin to understand what engineers are doing after a substantial experience with programming real world applications. However, your limited experience may make you over-confident in your abilities.

[0]: [http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect](http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect)

</comment><comment><USER18> Really should tailor it somewhat to what you intend to build.

I'd recommend Python or Javascript without knowing more.

Python is useful in a variety of applications, both web and desktop, multi- platform, low barrier to entry but will get you a long way.

Javascript _can_ be all you need on the web (though my stacks all have another language involved).

Python is great for the web as well, but you'll need javascript, too. It's pretty inescapable.

</comment><comment><USER19> A multi-paradigm, multi-type-system, multi-runtime, cross-platform one: C#.

</comment><comment><USER20> If you have a background on C++ I recommend to try something radically diferent like Clojure: [http://www.braveclojure.com](http://www.braveclojure.com)

</comment><comment><USER21> I'd vote python. It's pretty easy to learn and is very helpful for many types of programming.

</comment><comment><USER22> Why learn a single _programming language_? Why not several? and by doing so get an understanding about what programming and computation is all about. From 100,000 feet, most programming languages are similar. When you know several you begin to see the unifying structures they support, and that may give you some insight into how computation is related to problems.

<comment><USER23> I think learning one sounds hard for someone new, so learning two sounds impossible.

Inch by inch...

<comment><USER22> I strongly disagree. Learning multiple languages imparts understanding and provides an important perspective on what programming is about and how programs work, and how they go together. Languages are, for the most part, easy. What's hard is the other stuff.

</comment></comment></comment><comment><USER24> python might be best for a non-technical person to pick up.

</comment><comment><USER25> Java it teaches you how to use pure programing schemes :)

</comment><comment><USER26> Python 3.

It is fairly simple to learn. It is cross-platform. It is suitable for server- side programming. It has an extensive standard library and an active ecosystem for additional libraries. It has IPython. It uses, and therefore helps you learn, but does not force object-oriented programming. It has enough functional programming to let you explore that concept. It is widespread and easy to find support for. It has numerous tutorials taking a wide variety of approaches, you can easily find something that works for you. It has more active projects on GitHub than any language but JavaScript or Java ([http://githut.info/](http://githut.info/)).

Why not Python 2? Python 3 is better out of the box (comes with pip, has better standard libraries) and more consistent. As a new programmer, you won't need anything that's limited to Python 2.

Why not JavaScript? It's too strange. Most of what you learn in Python is fairly applicable across languages. JavaScript has a strange object model, doesn't distinguish int/float, has odd rules for scoping (var/no var, hoisting), has too many ways to do the same things (function / var f = function, new Object() / {} / Object.create), has a confusing concept of 'this'. Learning JavaScript will not help other mainstream languages click the way Python will.

Why not Ruby? Ruby and Python are, from a new programmers' perspective, completely equivalent, but Python seems to be winning the popularity contest, so you'll likely find more libraries, more tutorials, more help, etc. Ruby also tends to be more web-focused and thus less general-purpose (by the numbers, not by any technical limitation).

Why not C/C++? They are simply too low level for someone who isn't interested in programming full-time.

Why not Java? Java is improving but is historically bloated and incredibly verbose. You have deal with compilation and probably need an IDE. You absolutely must use object-oriented programming. Support for functional programming is either effectively non-existent or simply not as smooth depending on which version of Java you're using. Too much overhead (in terms of what you have to understand and deal with) for small, simple programs.

Why not Go or Rust? Too new to have thorough support. Uncertain future.

Why not Haskell / Clojure / Erlang / Factor / etc / etc / etc? Too esoteric for a new programmer.

Why not Objective-C or Swift? Too limited in scope.

Why not C#? Actually, if you're on Windows, this is a pretty good choice, but it's not fully cross-platform (yet) and doesn't have the variety of choices for server-side programming that Python does. It also doesn't have as extensive a set of open source libraries.

<comment><AUTHOR> Thank you for the detailed reply! A number of comments here favor Python for ease of entry and utility.

Do I understand correctly that Java is important, but with a much steeper learning curve?

<comment><USER26> Java is widespread. Whether it's important or not depends on the project. It's not so much that Java has a steep learning curve, it's that Java has the Java way of doing things (namely, object-oriented programming taken to the extreme) and you are required to do things that way. It's less flexible than Python in the way you can write your code. You have to have a firm grasp of object- oriented programming to do _anything_ in Java. There's a lot of theory you have to learn just to get started, which in Python can just be brushed aside until you're ready to tackle it.

And with Java, you're probably going to need a heavyweight IDE instead of just being able to use a plain text editor or a REPL or other interactive environment (which Java doesn't have).

</comment></comment></comment><comment><USER27> There's no point in only learning one language. If you can only program in one language, you literally can't program.

<comment><AUTHOR> I've had the same thought myself. However, I'm willing to take the risk. Besides, one thing leads to another.

<comment><USER27> This is not to say that learning one language is a waste of time when you then proceed to another language. But, learning one language isn't learning how to code, any moreso than learning how to punch is the same as learning karate -- you haven't begun learning karate until you have the basics of a wide variety of punches, kicks, and blocks; in the same way, you haven't begun to learn programming until you know the basics of a wide variety of languages and techniques.

At best, stopping at your first language will give you a false sense of competence that will lead you into making poor decisions.

By all means, learn a first programming language. But, which you choose doesn't much matter, because you'll need to learn a second and a third before you start to understand what it's all about.

<comment><USER28> You don't know 'true' mathematics until you study 18th century books in German ... I sense some sort of logical fallacy here.

If you can work with frameworks, write loops, classes, know inheritance, side- effects, polymorphism etc but don't know functional programming, then you're still a programmer in my eyes.

It's a scale imo, everything is relative.

<comment><USER27> Being a programmer implies a kind of mastery over the concepts, of the type that you only get with experience. You only get that experience by having experience with a variety of tools.

Knowing how to use a hammer doesn't make you an engineer. Knowing calculus doesn't make you a mathematician. Knowing how to make a fist doesn't mean you know karate. Knowing C doesn't make you a programmer. Instead, to be any of these things in any meaningful way, you need mastery of a whole constellation of related tools and techniques and ways of thinking, as well as the practice and experience to make them work together.

You can do a lot of things with a hammer, just as you can do a lot of things with any given programming language -- both are very useful general-purpose tools. A programmer should understand the hammers of the programming world (C), the flathead screwdrivers of the programming world (python), the phillips head screwdrivers of the programming world (SQL), the power jigsaws of the programming world (prolog), the needlenose vice-grips of the programming world (awk), and even some of the nylon jeweler's mallets of the programming world (erlang, haskell, befunge) in the same way that you would expect even a relatively mediocre mechanic to recognize and understand the use of all these tools.

A language is a single tool. Concepts are concepts, and you can apply concepts with inappropriate tools just fine (you can write object-oriented code in c or functional code in java the same way you can remove a bolt with vice grips or hammer in a nail with the handle of a chainsaw).</comment></comment></comment></comment></comment>


Ask HN: Web Workers to Run User Code in Browser - <AUTHOR> So I built Data Janitor (https://www.csvjson.com/datajanitor) a tool to allow users to clean and transform tabular data in the browser running their own JavaScript function. I use Web Workers to isolate the code for security and performance purposes (the user can press Stop to halt the worker).
With regards to security, is this a good idea? What can I do to further bullet proof this concept. I really want the code to run on the user's computer - not server-side. For efficiency and privacy reasons.
Worker JavaScript is here: https://github.com/martindrapeau/csvjson-app/blob/master/js/src/sandbox.js It is called here: https://github.com/martindrapeau/csvjson-app/blob/master/js/src/datajanitor-code.js#L100 <comment><USER2> I'm also developing a website that allows users to run their own code.

I have done some investigation on this topic, initially I did something similar to yours, run code in a webworker. But because I want the users to render graphics, webworker is very limited (offscreencanvas) and doesn't support mobile well.

[https://stackoverflow.com/questions/5044608/javascript- sandb...](https://stackoverflow.com/questions/5044608/javascript-sandbox)

both google and facebook have developed some kind of sandbox for javascript. I briefly checked the google thing, I didn't like it, because it put limitations on the javascript users can write. it also needs a compiler server, which adds complexity to my backend.

my current choice is similar to that of jsfiddle, codepen and observablehq.com, I let users to run code in a sandboxed iframe. I have some restrictions on the iframe and the iframe is served with a different domain, so it is isolated from my main site.

[https://stackoverflow.com/questions/8004001/how-does- jsfiddl...](https://stackoverflow.com/questions/8004001/how-does-jsfiddle- allow-and-execute-user-defined-javascript-without-being-danger)

<comment><AUTHOR> Yes, it seems a sandboxed iframe can offer an extra layer of security preventing XHR calls for instance.

In my case I do not want user code to gain access to the DOM.

Wondering if anyone's wrapped a worker inside an iframe to offer that extra security.

<comment><USER2> yes, I used iframe + worker at the beginning. I gave up worker for the above reason. I also don't want users to change dom actually.</comment></comment></comment>