What Pythonistas Think of Ruby - <AUTHOR> http://blog.peepcode.com/tutorials/2010/what-pythonistas-think-of-ruby <comment> old-gregg As someone who did nothing but Rails since 06 (two Rails-powered startups, plus some Rails contracting), allow me to explain why I dumped Ruby/Rails and switched to Python/Pylons.

Batteries. Ruby is great, but outside of Rails you are on your own. Even basic things like geometry needs to be coded by hand. Python (and almost anything else) simply destroys Ruby when it comes to generic non-web centric libraries. And the situation isn't changing: most new Ruby "libraries" are just add-ons to Rails, seriously, how many Rails unit testing frameworks, paginators and file upload handlers do we need?

People. Python hackers are much, much nicer folks to hang around with. I don't like to start a war here so I'll refrain from going further with this point. Besides, I feel like Zed Shaw said it all.

<comment><USER2> Do you really have to switch from one to another? I learned both languages, love them both, and use them both. There's too much hate in the world of programming languages.

<comment><USER3> The fights are so vicious because the stakes are so small. (Originally said about academics, but works for programmers, too.)

<comment><USER4> I have the definitive impression that the Pythonistas are more interested in this fighting than most other language cultures.

I might be wrong, but I really can't mention any other group of people trolling Perl discussions. It is the same for Ruby?

It really seems strange for a language which got the name from Monthy Python. (-: Is it some inferiority feelings to environments which are _fun_? :-)

<comment><USER5> _I might be wrong, but I really can't mention any other group of people trolling Perl discussions._

 _Everyone_ is out trolling the Perl discussions. PHP developers hate us, Java developers hate us, Ruby developers hate us, and Python developers hate us. I think this is funny, because we generally don't hate the other languages, we just embrace and extend their good ideas for Perl. (The Perl community has come up with a few good ideas on their own, but the best ideas have been borrowed from other languages. Moose is from Smalltalk and CL; PSGI is from Python; Plack is from Ruby; Catalyst is from Java; etc. I think, in general, the stolen ideas have been improved upon in Perl; I like using Moose a lot more than I like using CLOS -- and I like using CLOS a lot.)

The only place outside of the Perl community where I can admit to liking Perl (and not be flamed) is #haskell. But everyone is nice there.

(I've even been trolled in real life over my like of Perl. I was going after some girl, who apparently had a friend that was a Java developer. Perl came up, I came up, and it was resolved "he must not be very good at programming if he prefers Perl over Java". Guess who got the girl? Not the Perl programmer.)

<comment><USER6> > Moose is from Smalltalk and CL...

... and Perl 6.

<comment><USER5> Yes, you're right. Adding state to traits is definitely a Perl 6 innovation.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> > Ruby takes full advantage of the Lisp chainsaw.

I always get a little sad and slightly irritated when I hear people say things like this. This is a statement born from ignorance and misunderstanding.

What ruby does to present micro-DSLs are what any language that lets the programmer influence the scope of single dispatch and has a lightweight syntax for function calls can do. They are not what Lisp macros do, and do not even approach all the common "easy" uses cases for macros. Further, they also incur a much larger runtime performance penalty, whereas macros incur none.

Ruby has so many merits on its own. There is no need to drum up nonsense about how it's a "lisp without the parenthesis".

<comment><USER8> You might be taking the statement out of context, and you are certainly quoting it out of context (although brevity is appreciated.)

The statement in the talk was made to illustrate the differences between Ruby and Python, and it was not made to suggest that Ruby was replicating all the benefits of Lisp.

<comment><USER7> I understand the intent, but I do not feel that it loses its incorrectness by taking it out of context.

That people even feel this comparison is appropriate is what has me depressed. It represents a fairly fundamental set of misunderstandings.

<comment><USER6> > That people even feel this comparison is appropriate is what has me > depressed.

I agree; you can replace the term "DSL" with "API" in almost every case without losing any essential meaning. (You have to give the hipper-than-thou language pseudo-advocacy, but that's no loss.)

<comment><USER9> I think in those contexts, DSL is more a description of how an API _feels_ to use, than a precise technical categorisation.`

Ergonomic distinctions are useful though, as is the distinction between declarative-style APIs and more imperative ones, which 'DSL' is often used to make.

<comment><USER10> I have yet to see a Ruby "DSL" that didn't feel like Ruby. That is,

      unless you.talk :like => "this"

<comment><USER11> Those are just the "english-y" DSLs. Not all are attempting to read like english. And even for those that are, the point isn't to be writing in english, the point is to be at least halfway readable to a non-programmer reading over your shoulder.

<comment><USER10> Okay, but it's not really all that clear that "sum.should == 3" is actually any more readable than "assert(sum == 3)". (Do you really have non-programmers reading code over your shoulder? I can't think of any case in a 10+ year career where that's happened.)

<comment><USER11> I don't personally use the stuff. :) But I have seen environments where that does happen, and it works pretty well for them.

If you're not doing that, I think they're kind of silly.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> I am one of those people who accepted the lisp religion of "syntax is evil". I have a descent knowledge of python, and I've read a few ruby tutorials.

Neither python nor ruby are lisp. Python is not cool because of generators, list comprehensions, decorators or any other feature. Ruby is not cool because of blocks or monkey patching(im suspicions of anything called MONKEY patching). Ruby and python are cool because of really cool libraries and the way people use these languages, not because they have especially well designed syntax.

Instead of arguing about how cool your crappy syntax is, argue about which has the better libraries, which implementation is better, which is used for cooler projects. Non of these languages can top lisp when it comes to expressiveness and flexibility.

<comment><USER13> Syntax is human. Syntax is ergonomics. A programming language is the bridge between man and machine. Lisp, I would argue, is far more about the machine than the man and that is the simple reason why it's not more popular.

Python was cool before the libraries; that's why those libraries got written in the first place. Lisp has been around forever and is still lacking in libraries and other support.

<comment><USER12> "Lisp, I would argue, is far more about the machine than the man and that is the simple reason why it's not more popular."

Pleas do, i would love to hear your argument. I fail to see how lisp is less humane than python, when i find it to be exactly the opposite.

Edit: what i meant was that lisp is more about the human, not that python is more about the machine, i hope i don't get misunderstood.

<comment><USER14> As a non lisp programmer, it is hard for me to automatically see what is going on in a lisp program because of mismatched " ' " and a lot of parenthesis. I believe this is one of his points. When I was learning python, or ruby, for that matter ( I use both! ) I never felt like I had no idea what was going on in the code even before I learned the languages.

<comment><USER15> Should this really be so surprising, though? Lisp is based on a different model of computation than Python and Ruby. You can't follow non-trivial C code without understanding pointers, or Prolog without understanding unification.

Syntax aside, the semantics of Python are intended to be unsurprising to people with a conventional programming background. I don't have any practical experience with Ruby, but it looks like a mishmash of Smalltalk and Perl to me, and I can usually get the gist of code snippets. Likewise, I can kinda- sorta follow written Dutch (since I've studied German and speak English fluently), but I wouldn't expect to be able to just read Thai.

<comment><USER16> > I don't have any practical experience with Ruby, but it looks like a > mishmash of Smalltalk and Perl to me

Those are, I think, probably the two most influential sources of inspiration for how the language is put together, in terms of the actual end result.

</comment></comment></comment></comment></comment></comment><comment><USER17> Wow. First a post on awesomeness of Haml, leading to the usual "Is not!", "Is too!" discussion.

Now a post on Python v. Ruby?

It must be Shark Week on HN.

</comment><comment><USER18> Not related to the article, but I really like the setting and layout of the top section. Felt like I was reading a magazine!

<comment><AUTHOR> These fancy new blogazines, as the kids are calling them, make me really wish I had design chops. My regular old blog looks so lame and uninteresting by comparison.

<comment><USER19> Raganworld's markdown rendered blog @ github <http://github.com/raganwald/homoiconic> has convinced me that while eye-candy and design is great, it is the content of the blog post itself that is of more value to me as a reader.

<comment><USER20> Ironically, it did the opposite for me. I used to read and enjoy Reg's blog posts. Since he made the change to the new format, I don't think I've read anything he's written there: it doesn't work like anything else any more, and while his blog was one of those I enjoyed, I rarely go out of my way to find content like that when there are many other blogs competing for my limited spare time.

</comment></comment></comment></comment><comment><USER21> Python versus Ruby has always struck me as one of the absurd battles ever. The two languages seem to address a very similar space and have broadly similar features sets.

Yes there are points of variation but both seem to work really well. People build cool and useful stuff in both. People are productive in both.

As for me - I personally like the syntax of Python better. That could be because I learnt it first - or it could just be something in me. Who knows?

and who cares...

<comment><USER22> I think a big reason why it comes up so often is that it's rarely worth the mental real-estate to become proficient in both since they are so similar in design and problem domain.

There is significant diminished utility in learning python after knowing ruby or vice versa. You're better of learning something totally different (like haskell!) since you already have a flexible modern scripting language with a great web-framework in your toolkit.

However since each language has its trade offs, people have to keep convincing themselves (loudly and publicly, usually) that they made the right decision.

So basically, it's contentious and will always be that way for the same reasons that people still debate vim vs emacs after twenty years.

<comment><USER23> This right here is the exact reason that I, as a fairly experienced and hopefully pretty good Python programmer feel absolutely no desire to learn Ruby. It doesn't offer me anything in terms of making me think differently about programming than Python, and I don't see any particular domain (other than, of course, Rails) where it offers an advantage in libraries or anything. On the other hand, had I stumbled upon Ruby first and then found out about Python, I'm sure I probably wouldn't feel any need to learn Python, either.

</comment></comment></comment><comment><USER24> My take away: As a Python developer, I should really check out Ruby. It's like Python in some ways, but in other ways it may help give me an additional perspective on programming.

Thanks for the article! Mark

<comment><USER11> More replies like this one, please!

</comment></comment><comment><USER25> "The Seattle Python community represented there was almost painfully polite. ... I later learned that this may be an attribute unique to Seattle Python developers."

When I lived in Seattle, I read that musicians, playing in PNW clubs and venues and noticing a lower audience energy level than they were used to, sometimes had to be reassured by club owners that yes, the audience really does like you, really, it's just that PNW audiences are more subdued, laid back and polite.

</comment><comment><USER26> It's not self.call(:my_method) --- that's nuts. It's my_method[param1, param2] which is aliased to my_method.call(param1, param2). Ruby's syntax can be a crapfest (like Procs not being callable without [] instead of () for example), but this isn't an example.

<comment><USER27> proc[arg1,arg2] is terrible; strictly worse than proc.call arg1, arg2. When I see an id followed by brackets, I'm looking at a collection, not a callable. This is only exacerbated by Ruby's weird/useful [index,length] convention.

<comment><USER26> I think what we both want is proc(arg1, arg2).

<comment><USER28> In newer versions of Ruby you can do proc.(arg1, arg2), which I think is a decent compromise.

</comment></comment></comment></comment><comment><USER29> I think this is a good explanation of some of the very real differences between Python and Ruby. The lambda issue is almost enough to get me back to Ruby after switching to Python. I stick with Python mostly because of syntax (especially significant whitespace) and the batteries-included philosophy. I'm also in love with a Python library called pyparsing, the equivalent of which I haven't seen in any other language.

<comment><USER30> I'm not sure I get the lambda issue. If you want a > 1 line lambda why not just define a function?

        def a(x):
            def b():
               print x
            return b

Not sure what a prototypical ruby usecase would be.

<comment><USER31> The other side of the argument: why support anonymous functions, but restrict them to one line? That seems highly arbitrary.

<comment><USER32> Nope - not arbitrary, it is because of the indentation scoping rules. Try coming up with a syntax for statement based lambdas that isn't ugly as heck.

<comment><USER33> First, links for context.

Guido's take: <http://www.artima.com/weblogs/viewpost.jsp?thread=147358>

Arcieri's take: [http://www.unlimitednovelty.com/2009/03/indentation- sensitiv...](http://www.unlimitednovelty.com/2009/03/indentation-sensitivity- post-mortem.html)

It's not hard if we disallow statements, and make everything into an expression that returns a value -- something that Ruby does right. The value of a block of statements is just the value of the last statement in the block.

So, whether you call it a function, or a method, or a lambda, or a block, whitespace with multi-line expressions can be made to work.

The commonly-cited lambda-with-multiple-prints example, in CoffeeScript:

        count: ->
          print 'one'
          print 'two'
          print 'three'

</comment></comment></comment></comment></comment><comment><USER34> That's not a python, that's a milk snake. Feel free to downvote me for pointing that out.

</comment><comment><USER35> "Without powerful blocks and lambdas, you can't have Rake. You can't have RSpec. You can't have Sinatra's clear REST syntax."

Can anyone explain why?

<comment><USER36> Disagree on "REST syntax". Python could do just as well:

Sinatra:

      get '/hi' do
        "Hello World!"
      end

Python 2:

      @get('/hi')
      def hello():
        return "Hello World"

Python 3:

      def hello() -> "/hi":
        return "Hello World"

<comment><USER37> A Rubyist would argue that that Python 2 syntax is anything but clear.

I have no idea what that Python 3 snippet is doing... care to share? That looks like something that's hard to Google...

<comment><USER32> As a Pythonista I have no idea what the Ruby snippet is doing. Readability depends entirely on context.

The Python 3 version is using a function annotation.

In Python 2 or 3 you could use a context manager (with statement) to similar effect.

<comment><USER38> _As a Pythonista I have no idea what the Ruby snippet is doing. Readability depends entirely on context._

Oh, come on. You're just disagreeing for effect here.

I've never used Ruby but that snippet is clear as day.

The Python 3 snippet suggests to me that the output would be "/hi" though :)

<comment><USER39>
      Oh, come on. You're just disagreeing for effect here.
      I've never used Ruby but that snippet is clear as day.

The hell it is. I find it quite confusing. I'll take the Python 2 solution anyday, which clearly seperates _what_ is called from _when_ it is called. One of the main problems with the 'my language is so flexible' approach is that inventing concise solutions becomes a goal in itself.

<comment><USER37> > which clearly seperates what is called from when it is called

You're passing some code as an argument to a function. Many other languages do this. Do you hate Lisp and Haskell, too? Do you not use continuations in Python? Or callback functions?

<comment><USER39> If you pass a function as an argument to a function, you're still separating _what_ from _when_ : the function declaration shows _what_ ; the invocation of the function shows _when_. It doesn't matter whether it's

      def foo(f):
        f()

or

      (define (foo f) (f))

That has nothing to do with annotating a function to show it binds to some URL and is invoked when an HTTP GET request is received with that URL. I don't like having to scroll through a source file to discover such bindings and I actually prefer them to be defined at a separate place. In that sense, the Python 2 solution isn't good either and suffers from the same problem I described earlier: people try to be so concise that they loose sight of other goals.

<comment><USER37> The Ruby code is not an annotation. It's very close to passing an anonymous function to a function. The definition of get is

        def get(path, opts={}, &block)

See that &block? Here's the actual source of get:

          # Defining a `GET` handler also automatically defines
          # a `HEAD` handler.
          def get(path, opts={}, &block)
            conditions = @conditions.dup
            route('GET', path, opts, &block)

            @conditions = conditions
            route('HEAD', path, opts, &block)
          end

Think of it as "I'm registering this block as a callback, to be called when this url is processed." I'm not sure how else you'd like to have a web DSL written; every web library I've used has worked this way.

<comment><USER39> _The Ruby code is not an annotation._

Which is exactly the problem: it should be, because it is meta-information about when the function is supposed to be called. It's not a good idea to wrap that into a function, together with the code that is supposed to be executed, because you are mixing two completely different kinds of information into some new function. This code is being too clever for it's own good: it condenses information so far that you are forced to think harder about what each piece means. I consider this is one of the main dangers of languages like Ruby: it's proponents lose sight of the fact that they are coming full circle, back to writing code that's so clever that no one in the future will understand it.

 _every web library I've used has worked this way._

I doubt that we've used a disjoint set of web libraries, so my only answer can be: no, they haven't worked that way. Most libraries map paths to named functions separately from implementing the functions.

Conciseness is not an ultimate goal; in fact, it is rather the opposite, as those that suffered under the clever C hacks of others will tell you. To paraphrase Santanyana: people have forgotten the past and are repeating it.

<comment><USER37> I guess we'll just have to agree to disagree on this. By keeping the function definition near the route instead of just defining a name, I feel that it's much, much cleaner.

> I doubt that we've used a disjoint set of web libraries,

I guess I mis-spoke slightly. I meant assigning a function to a route, because I consider that (in this case) it's an anonymous function to be an irrelevant detail. Basically, to me

        get "/hello", hello
        def hello
            puts "hello"
         end

to be the as clear or less clear than the way Sinatra does it. Rails and Zend (the two frameworks I've used the most) put that 'def hello' in another file, elsewhere.

Anyway, thanks for the discussion. We've apparently boiled it down to taste, so it's a good thing there are multiple languages, I guess.

<comment><USER39> Thanks to you as well :). I even may come to see it your way in the near future, as it seems I'm going to be doing some Ruby coding for my new employer.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER40> A main take away point: Ruby is better for writing DSLs (which is what I am doing for one customer right now)

<comment><USER41> Smalltalk is even better. Advanced Smalltalk _is_ morphing Smalltalk into a DSL. You can even write your own domain specific if-then-else analogues, and it looks 1st class like the Standard conditional logic. Yet the implementation is just a plain vanilla method.

<comment><USER42> You can't morph Smalltalk into a DSL as Smalltalk itself is nothing but a DSL; syntactically every single control structure is library.

<comment><USER41> I prefer to think of it this way: DSL are syntactic 1st class citizens in Smalltalk. (Not 1st class for optimizations, though)

To say Smalltalk IDS is a bit useless. Sure, if your "domain" is some Turing- complete language.

<comment><USER42> > Sure, if your "domain" is some Turing-complete language.

Which is exactly what Smalltalk is. Pick any other domain, and you can use the same syntactic elements used to build the base language to extend it into that particular domain.

Ruby DSL's control structures tend to look nothing like Ruby the language's control structures; Smalltalk DSL's control structures look exactly like Smalltalk the language's control structures.

</comment></comment></comment></comment></comment><comment><USER43>
        Python lambdas are limited to one line and can't contain
        statements (for, if, def, etc.). Which leaves me
        wondering, what's the point?

As much as I wish that the python lambda syntax was more powerful, they are ridiculously useful for one-liners where you can't use forms that require whitespace indentation. Everything must consist of set operations.

        cat file | python -c "import sys; lines=sys.stdin.readlines(); lines_i_care_about = [str(l.split(',')[2]) for l in lines if l.split(',')>=3]; print '\n'.join( lines_i_care_about )

(yes you could do this example in awk or sed, but that's not the point)

<comment><USER44> As others have pointed out, you could just use a non-anonymous function defined in the current scope in place of a lamba...

</comment></comment><comment><USER45> "Lisp chainsaw"?

Definition or reference, anyone? Although I can probably guess where this is leading....

<comment><USER46> It's a play on the old description of Perl as a _swiss army chainsaw_

</comment></comment><comment><USER47> I hate this stupids discussions and I have seen many pythonist criticizing ruby..why?...because think ruby is a rival?...I use java and ruby..one reason for never choose python is his fanboy community w close mind and always criticizing the other languages..like java..c# ruby...yes..your language is better and is perfect but not everybody prefer it...if you learned a language only for speak bad of it is better no learn it, when you has a few days using ruby is than understand all thing back it...star type code without parentesis and see it look better and is most readeable (I remember you I come from java), I use a bit python and his syntaxis is good but i don't like all...never I feel good using it (I feel more limited) but I don't writte a article criticizing python, ruby is the language for peoples without limits and free mind, RUBY IS THE MOST ELEGANT LANGUAGE I HAVE KNOW, and is very readeable (no exceeds python but is very readeable) for all other reasons I think python could win the discussion forget this discussions and allow ourselves know new ways to learn and write, this discussion are like the religions discussion, nobody win and only works for create bad ideas for the others...peace and sorry for my bad english, I'm germany

</comment><comment><USER48> I believe Python has a yield statement, or am I missing something?

[http://docs.python.org/whatsnew/2.5.html#pep-342-new- generat...](http://docs.python.org/whatsnew/2.5.html#pep-342-new-generator- features)

<comment><USER49> Indeed. Perhaps the Ruby one works different?

<comment><USER50> Yep. `yield` in Ruby is a normal anonymous method call. It pushes a new frame onto the stack. `yield` in Python works more like Ruby's [Generator]([http://ruby- doc.org/stdlib/libdoc/generator/rdoc/classes/Gen...](http://ruby- doc.org/stdlib/libdoc/generator/rdoc/classes/Generator.html)). It freezes the current stack frame's state and resumes execution somewhere else, returning again to the same place on the next iteration. They're very different things really.

More about Python's generators here:

<http://www.python.org/dev/peps/pep-0255/>

<comment><USER48> So what would yield in Ruby be like in Python? Surely there must be some analogue?

<comment><USER50> You can pass an anonymous function or lambda:

        def foo(thing, block):
          thing = "cruel " + thing
          block(thing) # like `yield thing' or 'block.call' in ruby

        def bar(thing):
          return "hello " + thing

        foo('world', bar)

        # or:
        foo('world', lambda x: "hello " + x)

Ruby's blocks are really just sugar for passing an anonymous function in the last argument and yield is just sugar for calling that function. The example above in Ruby would be:

        def foo(thing)
          yield thing
        end

        foo('world') { |thing| "hello " + thing }

</comment></comment></comment></comment></comment><comment><USER51> Nice article. One correction: python _does_ have 'yield'.</comment>


Ask HN: How do I make sure my website is GDPR compliant? - <AUTHOR> Hey folks,
I have a side project (a web app) which requires login via Facebook and Google to work. I intend to release it publicly but before that I want to make sure I'm GDPR compliant.
The web app stores minimal info for the user such as the email (encrypted) and their first name (the data is provided from the social networks I mentioned above).
I looked online for help on how to make sure a web app is GDPR compliant but it's confusing. Is there someone here with actual experience on this who can provide some guidance? Is there an official guide in layman's terms on how to do that?
Thanks <comment><USER2> Sounds like you're already compliant. Storing metadata about a registered user is perfectly acceptable under the GDPR for functional & legitimate interest purposes. I would recommend adding a way for a user to delete their account, unless the third-party login provider gives you web hooks on when OAuth consent is revoked in which case you can use that as the signal to delete all PII stored locally.

</comment><comment><USER3> Gdpr compliance does not exist and is a long living fad sold by consultancy companies. To make sure you align with gdpr regulations: Just do not store personal data of customers. Never. Most important things to know [https://nocomplexity.com/gdpr-principles/](https://nocomplexity.com/gdpr- principles/)</comment>


About TechCrunch (2005) - <AUTHOR> http://web.archive.org/web/20051024041505/http://www.techcrunch.com/?p=2

<comment><USER2> What happened to Keith Teare? I didn't realise he was involved as I only ever heard of Arrington

</comment><comment><USER3> Sounds a lot more interesting than what it became.</comment>


Show HN: I made a command line notebook with multi device sync - <AUTHOR> https://www.getdnote.com/ <comment><USER2> I can't say much without using it but it looks good! I'm curious how the site is made which is one of the strengths of your idea here and communicating what it does. How was it made?

<comment><AUTHOR> It's a static site made with Hugo [0] without any theme. The CLI is free so feel free to try. Thanks.

\- [0] [https://github.com/gohugoio/hugo](https://github.com/gohugoio/hugo)</comment></comment>


Ask HN: Anyone knows tool to rewrite HTTP content - <AUTHOR>

Hello, I need a tool to rewrite content of HTTP exchanges. I can not control front end, nor the server but need to reformat/edit the content. Are there any tools to do that. IBM's WBI (webby) seems dead and could not find an alternative so far. Any leads appreciated. Thanks. <comment><USER2> If you need to do this manually, then Burp Proxy (<http://portswigger.net/proxy/>) might be useful. However if you need automate that then you'd probably have to implement your own custom HTTP proxy. Just find a library for your favorite language that can help with that.

</comment><comment><USER3> Privoxy can do some fancy stuff playing the middleman between your frontend and the internet.

Link to docs: <http://www.privoxy.org/user-manual/actions-file.html></comment>


The West's failed fight against China's 'Cloud Hopper' hackers - <AUTHOR> https://www.reuters.com/article/us-china-cyber-cloudhopper-special-repor/special-report-inside-the-wests-failed-fight-against-chinas-cloud-hopper-hackers-idUSKCN1TR1DK <comment><USER2> So basically, the cloud providers got hacked over and over but didn't tell all their clients, who in turn had to discover they used a provided with bad security one by one.

I don't know if the fact HP got hacked repeatedly is stronger evidence in favour of the competence of the attacker or of the incompetence of HP.

<comment><USER3> Why not both? At least, it's safer to assume both when choosing a platform and where to spend dollars. Security is important yet, in my experience, even more underfunded than reliability -- features are generally king. A platform that repeatedly gets breached shows they don't value security as much as they should. An attacker that has been successful previously should continue to be successful except against those targets that secure themselves.

</comment></comment><comment><USER4> Some top-notch reporting from Reuters here, I think. Kudos to them for sinking this level of editorial resource into a story.

</comment><comment><USER5> Shows the advantage of on prem vs cloud

<comment><USER6> It's just the medium, your servers are vulnerable no matter on prem or cloud.

<comment><USER7> The authors of SPECTRE, Meltdown, Rowhammer (1-4),and whatever else is next would probably disagree with you. Running in cloud providers absolutely without doubt exposes your presence to hostile neighbors scheduled on the same hyoervisor.

<comment><USER8> Security is all about making the best compromises and shoring up the weakest links.

SPECTRE, Meltdown, Rowhammer are just a few risks amongst thousands. Most importantly they at least have runtime signatures that could be detected.

There are weaker areas for directed attacks against an organisation (e.g. spear-fishing).

When attacked by highly skilled, highly motivated, highly resourced and foreign opponents, an org may find they are better relying upon an external team for securing your VMs. I would expect Google Cloud to be far better than the majority of fortune 500 companies at securing hypervisors and VMs.

<comment><USER7> a) You're ignoring the "and whatever else is next" part of my statement. If you're on-prem, you don't need to worry about hostile neighbors. Google Cloud engineers could be great at securing public cloud workloads, but even they don't know what's yet to be found.

b) You're not running untrusted, random stranger code on your Fortune 500 VM's. I can't signup for an account on Ford's VM's and start ripping through memory like I can with a public cloud.

</comment></comment></comment></comment></comment><comment><USER9> >APT10 often attacked a service provider's system by "spear-phishing" – sending company employees emails

sigh...

<comment><USER10> It's a fairly complex and difficult task to phish proof your corporation.

<comment><USER11> Especially when IT is more interested in outsourcing every possible service to a different company/domain. Office 365 alone involves a pretty staggering number, including such self-evidently trustworthy gems as "microsoftonline.com", "azurewebsites.net", and "aka.ms". It's hard to keep up with what's legitimate when seemingly everything you do involves a different domain with a different design language and account management process. Then there's the increasingly popular practice of running things "in-house" but actually on some half-assed cloud stack (What the heck _are_ those stupid CloudFront subdomains, anyhow?).

<comment><USER12> > It's hard to keep up with what's legitimate when seemingly everything you do > involves a different domain with a different design language and account > management process.

Seriously, right!

[https://microsoftazuresponsorships.com](https://microsoftazuresponsorships.com) [https://getlicensingready.com/](https://getlicensingready.com/) [https://sysinternals.com](https://sysinternals.com) (fairly popular and well- known!) [https://www.microsoftpartnercommunity.com/](https://www.microsoftpartnercommunity.com/) [https://azureedge.net](https://azureedge.net)

etc

<comment><USER13> More egregious to me has always been my various banks which start out at with bankofamerica.com, chase.com etc but after authentication and some hops I'm usually at something phishtastic like bankfrontend.com.

<comment><USER14> Reading this gives me anxiety.

</comment></comment></comment></comment></comment></comment><comment><USER15> So they're state sponsored attacks and then they deny any and all culpability? Europe needs to join the hard line on China.

<comment><USER16> So where's the proof that they are state sponsored? I failed to find that from the article?

<comment><USER15> > Computer systems owned by a subsidiary of Huntington Ingalls were connecting > to a foreign server controlled by APT10.

APT10 is a state sponsored hacking group.

<comment><USER17> How are you making that claim? The only evidence I can find is an Uber receipt showing someone allegedly connected to APT10 visiting a MSS building.

<comment><USER18> Which claim are you doubting? Are you doubting that APT10 hacked Huntington Ingalls, or are you doubting that APT10 is state sponsored?

<comment><USER17> The latter.

<comment><USER18> There's a fair amount of evidence that APT10 is sponsored by China here[1]. It's not 100% proof, but what are the alternatives, and what chances do they have? The alternative possibilities seem slim to me.

The US government accused them of working for China[2]. Of course not everything the US government says is true, but it seems likely to me this is true and they have some non-public evidence to back it up.

[1] [https://www.crowdstrike.com/blog/two-birds-one-stone- panda/](https://www.crowdstrike.com/blog/two-birds-one-stone-panda/)

[2] [https://www.justice.gov/opa/press- release/file/1121706/downl...](https://www.justice.gov/opa/press- release/file/1121706/download)

<comment><USER17> >There's a fair amount of evidence that APT10 is sponsored by China here

All I'm seeing is the Uber receipt, which even they say they can't verify.

>It's not 100% proof, but what are the alternatives, and what chances do they have?

The alternative is that they are black hat hackers, which is very likely.

>Of course not everything the US government says is true, but it seems likely to me this is true and they have some non-public evidence to back it up.

The default position should be skepticism, and any evidence should be made public before a "hard line" is taken on China.

<comment><USER18> >All I'm seeing is the Uber receipt, which even they say they can't verify.

There's other stuff there. For example Gao was recruiting for Laoying Baichen Instruments which shares an address with CNITSEC (which is run by MSS). CNITSEC has in the past been confirmed to work with APT3.

>The alternative is that they are black hat hackers, which is very likely.

Are there a lot of advanced Chinese black hat hackers that don't work with the Chinese government? Because it seems like there are a lot of advanced Chinese hackers that work for the government. For example APT3 and APT1. Also the APT10 stuff appears to have happened during Chinese working hours, which is indicative of government work[1].

[1] [https://intrusiontruth.wordpress.com/2018/08/09/was- apt10-th...](https://intrusiontruth.wordpress.com/2018/08/09/was-apt10-the- work-of-individuals-a-company-or-the-state/)

<comment><USER17> >There's other stuff there. For example Gao was recruiting for Laoying Baichen Instruments which shares an address with CNITSEC

They can't verify that was Gao, that the poster represented that company, or show that they occupied the office building with the other company.

>Are there a lot of advanced Chinese black hat hackers that don't work with the Chinese government? Because it seems like there are a lot of advanced Chinese hackers that work for the government

Any hack reported by the western media immediately gets linked to the government, no matter how thin the evidence is. Chinese people can be smart and motivated by greed too, and they have a ton of people.

If you personally think China is behind this based on the released evidence, that's fine. Using it as justification for attacks on the Chinese requires more proof to even be considered.

<comment><USER18> >Any hack reported by the western media immediately gets linked to the government, no matter how thin the evidence is.

The October hack of Facebook[1] didn't seem to be blamed on any government by the media. It seems to me like a fairly sophisticated attack that could have been done by a government.

And the western media blames some hacks on the US government and its allies as well[2][3].

> Chinese people can be smart and motivated by greed too

How do they plan to make money by hacking NASA and the US military's shipbuilder? They're not installing ransomware asking for bitcoin payment. If they want to hack for money, I would think they would target credit cards, or banks, or better yet: cryptocurrency exchanges. Or maybe popular websites whose databases they can use for credential stuffing. One way to make money by hacking NASA is to be paid by the Chinese government.

[1] [https://www.nytimes.com/2018/10/12/technology/facebook- hack-...](https://www.nytimes.com/2018/10/12/technology/facebook-hack- investigation.html)

[2] [https://www.reuters.com/article/us-usa-cyber-yandex- exclusiv...](https://www.reuters.com/article/us-usa-cyber-yandex- exclusive/exclusive-western-intelligence-hacked-russias-google-yandex-to-spy- on-accounts-sources-idUSKCN1TS2SX)

[3] [https://www.nytimes.com/2010/09/30/world/middleeast/30worm.h...](https://www.nytimes.com/2010/09/30/world/middleeast/30worm.html)

<comment><USER17> >The October hack of Facebook[1] didn't seem to be blamed on any government by the media. It seems to me like a fairly sophisticated attack that could have been done by a government.

Sorry, I should have said "any hack originating in China." Poor wording on my part.

>How do they plan to make money by hacking NASA and the US military's shipbuilder?

Their methods were to gain access to a machine, and then try to use that access to jump to client servers. There's nothing saying NASA or government contactor's were specifically targeted, but seem like excellent jump targets if an opportunity arose.</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


U.S. Financial Regulator and Banks Urge Action on Climate - <AUTHOR> https://arstechnica.com/tech-policy/2020/09/climate-change-may-wreck-economy-unless-we-act-soon-federal-report-warns/ <comment><USER2> If only there was some part of the government or agency whose job it was to consistently keep tabs on how the environment is doing for the purpose of protecting it.

Snark aside (and putting on my cynic cap), I wonder if most of the institutions and independently wealthy have already planned for the worst case at this point. Owning property in in New Zealand looks better and better by the month/year.

<comment><USER3> Why New Zealand rather than anywhere else?

<comment><USER4> Bugging out to New Zealand is a meme among rich techies: [https://www.bloomberg.com/features/2018-rich-new-zealand- doo...](https://www.bloomberg.com/features/2018-rich-new-zealand-doomsday- preppers/)

<comment><USER5> It also has to do with mild weather, access to resources like water and arable land, and a stable society. Although their biggest weakness would be inability to defend itself due to low population versus, for example, China.

<comment><USER6> China takes over countries using financial pressure (either through aid or financing loans) and broad pro-China deals (universities not being able to speak of Taiwan as a country, etc). Their MO is not generally invasions, so worrying about them is not sensible.

</comment></comment></comment></comment></comment><comment><USER7> >> But in order to mitigate climate change, the US—through Congress—needs to adopt a carbon pricing scheme that is "fair, economy-wide, and effective in reducing emissions consistent with the Paris Agreement."

That sounds like another plea for cabon credits and some kind of market for them - you know, so wallstreet can play middleman.

The only fair way is IMHO to tax any carbon based fuel coming into the country or out of the ground. Whomever uses it will ultimately pay the higher price for it. Anything else is just playing favorites. I'm not a fan of it BTW, just pointing out what a fair way to penalize cabon use would be.

<comment><USER8> >The only fair way is IMHO to tax any carbon based fuel coming into the country or out of the ground.

what about cow farts?

<comment><USER9> Are they not also carbon based fuels coming out of the ground? The farts are a byproduct of digested organic matter like corn and grass, and contain some unusable or "un-harvest-able" fuel(s)?

</comment></comment></comment><comment><USER10> Makes you wonder if any of the players mentioned here are involved. [https://thegrayzone.com/2020/09/07/green-billionaires- planet...](https://thegrayzone.com/2020/09/07/green-billionaires-planet-of- the-humans/)

</comment><comment><USER11> Yep, as expected, they begin to care once it hits their bottom line.

<comment><AUTHOR> 1\. They have mortgages in places like California that are burning up.

2\. Note the CFTC and "banks" would be involved in trading of carbon credits so that's another interest they have in a solution.

I have to admit that I'm skeptical of carbon credits because they will be gamed by Enron-style traders and diverted towards things that look like they work, and away from things that really work.

For instance, some people claim you can absorb CO2 by grinding up Olvine rock and spreading it at the beach. Maybe it works. It's hard to measure because it happens over a wide area.

If you capture carbon from a fossil fuel power plant or biofuel facility or direct carbon capture you pump CO2 into a well and can measure it going in the same way people measured methane going out. That's for real, rock crushing less so, but if rock crushing appears to be cheaper Wall Street will crush rocks while the Earth burns.

<comment><USER12> Carbon credits are bullshit, just like additional 10 cents for a plastic shopping bag at grocery stores. Consumers will easily swallow the costs and things will continue as usual, unless of course, carbon credits are actually used towards initiatives that move the entire planet towards sustainability.

A decade ago, you could buy these credits to offset your own carbon footprint with the promise that they would be used to support reforestation efforts across the globe. Years later I found out through a friend who would help charities that received those credits, that they would definitely plant trees, but the number advertised on the credits and the actual trees planted were different. Also, no one would take care of the trees for long and only few would survive.

<comment><USER13> Has the 10 cent surcharge on plastic bags not had an affect? When it was implemented in my area I saw most people switch to reusable bags over the course of a month, and many restaurants stopped giving out bags unless they were specifically requested.

<comment><USER14> The point of charging for plastic bags is not the money, it is to force store employees to ask people how many bags they need (since they are required by law to charge for it).

Many customers, with the most basic of reminders, will choose to skip the bag, or bring their own.

</comment></comment></comment></comment></comment><comment><USER15> Love the gaslighting here: the current predicament in CA and OR has nothing to do with climate and everything to do with incompetent forest management and logging bans. Yet if you read mainstream press (or listen to e.g. Obama) you'd never know.

<comment><USER16> It's both. The forest management issues mean there are more fires. Climate change means those fires tend to burn hotter and faster.

<comment><USER17> Strangely Canada didn't have any significant fire, while the last two three years there were, and the climate now it's even worse (we are closing in 10 years until we are wiped out).

This year there were less people camping and out in the woods, and not gender reveal party around here either.</comment></comment></comment>


Samsung to halt production at its last computer factory in China - <AUTHOR> https://www.reuters.com/article/us-samsung-elec-china-pc-idUSKBN24X3K4 <comment><USER2> >> amid rising Chinese labour costs, a U.S.-China trade war and the blow from the COVID-19 pandemic.

Do companies think about the military situation over there?

<comment><USER3> Wait ... Chinese labor is now also too expensive? Give me a fucking break already. What do these people want, slaves?

I leave this here:

[https://www.theonion.com/jeff-bezos-tables-latest- breakthrou...](https://www.theonion.com/jeff-bezos-tables-latest-breakthrough- cost-cutting-idea-1824144898/amp)

<comment><USER4> China hasn't competed on labor cost for a while. They now have the largest concentration of manufacturing and tooling skill in one place.

Cheap labor seekers are going to cheaper parts of India (but that won't stay cheap for long), Africa, Indonesia, etc. Africa is establishing some kind of union to reduce concerns about stability, and if that works we will see the 80s-90s in China repeated there.

Someday there won't be any large pools of cheap labor left. Unless automation is much cheaper by then, we will see massive inflation in manufactured goods.

Also: if Africa industrializes and we don't have cheap fossil fuel alternatives, we should just start moving Miami and building the New York Sea Wall. Another half billion to billion people will be joining the new global middle class, and after centuries of colonialism Africa is not going to listen to Westerners asking them nicely to stay poor so we can meet a CO2 target.

<comment><USER5> China's strength was never cheap labour.

1\. Educated people (most former communist countries have fewer analphabets than the US)

2\. Tons of people

3\. Infrastructure and clustering.

4\. The political will to move forward.

You won't see this in Africa. India is possible but unlikely.

<comment><USER5> Nut sure why this is also downvoted. Feel free to disagree. I have a PhD in a STEM field and live in China. I think my opinion has some value.

<comment><USER6> Currently doing a PhD in a STEM field in the USA.

I think your points are generally right but vastly oversimplifies the situation.

>1\. Educated people (most former communist countries have fewer analphabets than the US)

Literacy != education. In the USA, we used to talk about the 3 R's: reading, 'riting, and 'rithmetic. That's the base level. I would equate education with higher-level thought processes developed in college. Re communist countries: yes, this is where communist control can be effective, but it also stifles creative thought (are you really sure the state's education regime is correct?)

>2\. Tons of people

Certainly helpful, when used correctly. Definitely drives the cost of labor lower, though (simple supply-demand relationship).

>3\. Infrastructure and clustering.

To an extent, sure, but the infrastructure development is more a consequence of the large amounts of people. Also, you get more bang for the buck when you build infrastructure there because so many people now live in population centers.

>4\. The political will to move forward.

This is the primary point I would say is wrong. We have plenty of political will in the USA. However, we also have much clearer legal separation between private and public companies. The CCP holds a very different view on how private companies should exist. We in the USA theoretically can block companies from operating in certain countries, but we choose to not do so in most cases. Liberty is much more protected in the USA, which may hurt short term but works best long term.

As to your projections:

>won't see this in Africa

I presently agree, but no one expected China to do as well as it has 50 years ago.

>India is possible but unlikely

As China and India continue their border clashes, they will grow more distant. I expect the West to align with India than China, given than Indian values more closely align with the West.

<comment><USER5> "Literacy != education."

Irrelevant for many jobs. What to do with people who can not read?

"Certainly helpful, when used correctly. Definitely drives the cost of labor lower, though"

Why should this be the case? The labor is probably lower in Benin. Yet, nobody moves there.

">3\. Infrastructure and clustering. To an extent, sure"

No. In fact there was a study from a business school that showed that this is the most important point about China. Clustering. All the suppliers and sub- suppliers that can work hand in hand.

">4\. The political will to move forward. This is the primary point I would say is wrong. We have plenty of political will in the USA."

As a immigrant in both systems and a naturalized US citizen I tell you that this is not my impression.

<comment><USER6> >What to do with people who can not read?

They can do jobs which don't require high literacy rates. Farming is such an example. The USA has plenty of Mexican immigrants who don't know English yet are still highly capable at performing manual labor.

Also, as a counterexample to your point about former communist states leaving higher literacy rates: a Marxist-Leninist state existed in Benin until 1990, but they still have one of the lowest literacy rates in the world [1].

>Why should this be the case? The labor is probably lower in Benin. Yet, nobody moves there.

The principle is just supply and demand. If you increase labor supply and keep demand stable, the cost of labor decreases (on the other end of this spectrum, tight labor markets drive wages higher).

But considering why Benin isn't the manufacturing powerhouse of the world (with only 11.3 million people) is tightly coupled with political realities. For example: does their country need those manufacturing jobs? CAN the country support those jobs? Apparently cotton is 40% of Benin's GDP and ~80% of their official exports. Political instability in Africa generally hurts all other African nations. Perhaps the African Union will help them [2].

>All the suppliers and sub-suppliers that can work hand in hand.

Oh, clustering is highly effective. There's plenty of clustering in the USA as well. That said, the CCP has much more control over all industries, so they can force clustering with greater ease. Ascribing economic success to clustering oversimplifies the broader context.

>As a immigrant in both systems and a naturalized US citizen I tell you that this is not my impression.

Well, as a person born and raised in the USA and surrounded by hard-working immigrant family members, I attest otherwise. Mainstream news in both China and the USA is manufactured and does not reflect the reality of how people feel. People here want change, and it's coming.

Sources:

[1] [https://en.wikipedia.org/wiki/Benin#Education](https://en.wikipedia.org/wiki/Benin#Education)

[2] [https://au.int/](https://au.int/)</comment></comment></comment></comment></comment></comment></comment></comment>


Viber adds end-to-end encryption, hidden chats as message app privacy wave grows - <AUTHOR> http://techcrunch.com/2016/04/19/viber-adds-end-to-end-encryption-hidden-chats-universal-delete-as-messaging-app-privacy-grows/ <comment><AUTHOR> As ever, I genuinely and eagerly await the response from @Moxie and others on here (whom have a huge amount more knowledge of encryption than I do) and their analysis of this. My first response is...wouldn't touch Viber with a barge-poll. Not open source, a strong Israeli Defence connection at the board level etc etc etc</comment>


Sniffing images in 350 lines of C - <AUTHOR> http://theorymatters.wordpress.com/2010/01/23/sniffing-images-in-300-lines/ Uses the Boyer-Moore algorithm to retrive the starting/ending bytes of JPEG images <comment><USER2> Nicely done. I notice the author used _uthash_. I can't say enough good things about that software. When you find yourself in C and missing the keyed lookup data structures of higher level languages, reach for uthash.

If you are more interested in the result than the process, _aptitude install driftnet_.</comment>


Show HN: SQL-like queries on in-memory Java collections/arrays - <AUTHOR> https://github.com/sangupta/gather <comment><USER2> I would recommend people to use a persistent collection library like Vavr instead (many other options too).

It provides the same functionality but without string field references (a disaster for refactoring). Additionally it won't require learning a new DSL for basic comparisons because the logic is contained in normal Java code with lambdas and method references.

this:

      Gather query = Gather.where("age").greaterThan(50).and("status").is("active");
      List<Employee> filtered = query.find(employees);

becomes this:

      List<Employee> filtered = employess.filter(e -> e.age > 50 && e.status.equals("active"));

<comment><AUTHOR> Gather was aimed at JDK 7 since there is still a lot of legacy code around. For JDK 8, lambdas surely work better.

<comment><USER2> Fair enough, what's the performance hit of reflection like for larger collection sizes? is this library intended for exploring data during development or a production system?

<comment><AUTHOR> I ran some performance tests and added a basic caching layer on reflection - that improved it by around 50% in the very basic of tests. You may look at the results in README at [https://github.com/sangupta/gather](https://github.com/sangupta/gather) repo.

</comment></comment></comment></comment><comment><USER3> It looks awesome, more like Microsoft LINQ. I used to love LINQ but it only works good with MS SQL Server.

<comment><AUTHOR> Thanks. LINQ was definitely a part inspiration in its development. Let me know if you would like more features to be baked in.</comment></comment>


Ask HN: I want to hack entrepreneurship, are you interested? - <AUTHOR>

Hello fellow hackers, I come to you with a quick question, though an important one. You have the power to decide the course of my next project. The decision is yours, which is why your honest opinion is so important to me.
To give you a rundown of things: I'm going to be launching a newsletter soon. We're talking less than a month here. This newsletter is targeted towards people just like you and me.
Now, what do I mean by 'someone like you and me'? Well, allow me to elaborate.
What I'm assuming is that you are currently in a similar place to where I used to be - you're a person who has a deep interest in creating a startup and make it into a business, but don't have the exact concrete steps to do it or the time to do the necessary research and get started.
Maybe you do what I used to do - you read HN, Business Insider, AVC, Techcrunch and similar publications regularly, but realize that all of the real gems are scattered and that there's need for a real methodology that shows you how to discover a (real) problem, find an audience effectively and launch successfully to paying customers in an easy-to-understand fashion from beginning to end.
Now, let me be clear here: I'm not talking about Customer Development (which is good in its own right), but rather a series of methods with concrete steps in them for you to run with in order to discover a profitable market to exploit. All done in a complete, professional and easy-to-comprehend manner.
I have experience in the business field and would love to share my hard-earned lessons and wisdom gems with you. I've read a lot of advice from blogs, mentors, HN people and people from several other places. I've read nearly every startup-related and entrepreneurship book out there (Rework, Crossing the Chasm, Four Steps to the Epiphany, From Good to Great, etc.) and implemented their advice into my own business.
In short, I know what can work for a startup and what doesn't.
When talking to my programmer friends, most tell me they'd like to handle the business part of things by themselves, but have little idea of how to go about it. Which is why they hire consultants who provide poor ROI or have to give away a part of their startups in order to get things done. That to me is a problem waiting to get resolved.
Now, I have a confession to make: I really love HN and the hacker mentality behind its community. PG and the HN community in general have made this site one of my favorite places on the internet. I love coming here, reading different experiences and contributing to discussions myself. I'm sure you love it just as much as I do and believe that there's no reason entrepreneurship shouldn't be hacked as well.
So my question to you is: are YOU interested in something like what I've just described? Basically a subscription to a service which shows you how to start, test, market, hire the right people for and sustain a profitable business starting from scratch.
By the way, I'm going to consult a couple of other startup and entrepreneurship outlets for this, but HN's opinion will have the most impact in this decision.
It's important that you know that I'll be super transparent with everything, so you can expect regular updates from this moment on of how things are going with this project and where I'm going with it during each particular month.
TL;DR: Would you like to learn how to start a startup, do the marketing for it, create an audience, hire the right people to create your team and turn it into a sustainable business?
Disclaimer: There'll be a small monthly fee involved so that it can be worthwhile for every one of us, though the actual value will surpass the monetary cost by an order of magnitude.
If you'd like me to include you into the preliminary list of interested people, just let me know in your post please.
Thank you in advance for letting me know your opinions, all questions and thoughts will be taken into consideration and responded to. <comment><USER2> I recommend setting up a Google spreadsheet form to collect emails during this preliminary stage. Mark me down, please.

<comment><AUTHOR> Consider it done, thank you. I'll be making the first update when the month runs out and take you up on that suggestion. Google spreadsheet is a nice idea. Appreciate it!

</comment></comment><comment><USER3> I would be interested in a subscription services which shows "how to start, validate and test idea, market product, hire the right people for and sustain a profitable business starting from scratch."

<comment><AUTHOR> Thank you! I'm adding you to the list of interest. Can I get your email please or should I use DigLig to contact you?</comment></comment>


Our misplaced obsession with simplicity - <AUTHOR> http://www.drdobbs.com/architecture-and-design/the-misplaced-obsession-with-simplicity/240157265

<comment><USER2> It is tempting to say that this is a roundabout way of repeating Einstein's "Make it as simple as possible, but no simpler." But in fact, it's saying "Make it no more complex than necessary," which more clearly communicates that sometimes things are not reducible to simplicity.</comment>


Ask HN: Why do some people have a keybase info in their HN profiles? - <AUTHOR> I understand that keybase is a way to encrypt things, but what is the benefit of having it in one's HN profile? <comment><USER2> It's a proof that you control the profile. You claim on your Keybase profile that you control an HN (or Twitter, reddit, ...) account, and then you post a proof on that service to verify that you do indeed control it. [https://book.keybase.io/account#proofs](https://book.keybase.io/account#proofs)

<comment><AUTHOR> Oh I see- thank you very much!

<comment><USER2> No problem!</comment></comment></comment>


Ask HN: Is Strangeloop a worthwhile conference for cloud developers? - <AUTHOR>

I've just come across Strangeloop, and was wondering if anyone had reviews of past years. I'm mostly interested in cloud-related material, and was wondering if it's worth attending. <comment><USER2> I'm the founder of Strange Loop. Cloud is not necessarily a focus of the conference but it does contain some cloud-related content, for things like distributed systems in particular.</comment>


Show HN: Secure Linux Apps on the Mac Desktop Through Docker - <AUTHOR> http://blog.alexellis.io/linux-desktop-on-mac/ <comment><USER2> Also interesting are solutions using xpra, especially when are working over a remote connection. In this case you are not running X on the Mac, but a xpra client (a simple app).

For an example see Docker's blog: [https://blog.docker.com/2013/07/docker- desktop-your-desktop-...](https://blog.docker.com/2013/07/docker-desktop-your- desktop-over-ssh-running-inside-of-a-docker-container/)

<comment><AUTHOR> There is also the possibility of installing a VNC server inside the container and a desktop environment, then connecting to that. I did this when I wanted MonoDevelop on my Mac without having to install the mandatory 3-5gb of "Xamarin Studio" mobile emulators etc. Btw thanks for the link back to xpra.

</comment></comment><comment><AUTHOR> Let's look at how to bring Linux X11 apps to the Mac desktop with Docker. Run and test multiple versions of apps. Secure your surfing through isolation.

<comment><USER3> Regarding X11 apps on OS X: what about XQuartz [1]? If the source isn't platform-dependent, you wouldn't even need Docker.

[1]: [https://en.wikipedia.org/wiki/XQuartz](https://en.wikipedia.org/wiki/XQuartz)

<comment><AUTHOR> Yes, agreed.. for instance when I open XQuartz we get xterm for free.. running I guess natively and exporting to the local display. The angle I wanted to look at was containerisation for visual apps on the Mac desktop.</comment></comment></comment>


Choosing a bad password, the Rebekah Wade way. - <AUTHOR> http://blog.jgc.org/2011/07/choosing-bad-password.html

<comment><USER2> I find in talking with people about passwords that most have the "it won't happen to me" syndrome or the "I'm not that important" syndrome and thus they feel it is OK to use weak passwords. The last person I spoke with about this used this logic, "It's not like I work for the CIA. So why bother?"

And always, after their account becomes compromised, they understand that the bad guys may just want access to resources so they can send spam, or do other illegal things. Sadly, it seems to always take something like this to make the point fully understood and after that the person is fully on-board with password security.

Just my experience.

</comment><comment><USER3> So, there are more and more murmurings about this in comments on posts like this one. I guess I'll kick this one off this time:

Passwords make for terrible security. Non-computer folk just don't want to devote the necessary headspace required to do it right. Hell, I handle this stuff for other people all the time, generate on average a few new random passwords of varying lengths every day, have memorized tons of the buggers -- including some rather ugly ones -- and I'm _still_ not doing it right.

No, I don't know what would be better than passwords.

But I'm looking forward to it when it shows up.

<comment><USER4> I predict that these problems will be finally solved when commodity webcams are good enough for secure retina/iris scanning.

<comment><USER5> Unfortunately, this doesn't solve the problem:

To do iris-scanning security, there must be a back-end database with the characteristics ("fingerprint") of each user's iris.

This database will be secured as strongly/effectively as a password database because it contains authentication credentials.

Unfortunately, password databases get broken into, and similarly iris databases will also get broken into.

The attacker then has to simply convert the iris fingerprint back into an image to replay to the authentication process.

This is probably easier than reversing a password hash (because the fingerprinting algorithm is unlikely to be optimised against reversing), and certainly no harder.

(This is assuming untrusted client-side hardware.)

<comment><USER6> Ideally, you wouldn't store the iris fingerprint itself - that's just as bad as storing a cleartext password today.

Rather, a good solution would involve deriving a (site-specific) token from the fingerprint and handing it off to the remote service, which then deals with it in much the same way we expect sites to deal with passwords.

This, of course, presupposes that we can retrieve a consistent and unique fingerprint from the same iris from various different images of it, and breaks down if all we can do is check an iris image to see if it matches a fingerprint.

<comment><USER5> You appear to be suggesting that the real security benefit would come from off-loading the authentication process onto a third party, but we can already do that with password authentication by using OpenID / Facebook Connect / whatever.

It's not clear how using iris fingerprints rather than passwords really adds anything other than to increase the risk of a false negative, and introducing a third party dependency.

(I do take your point about storing a hash of the iris fingerprint, though. How this would intefere with the matching process is, I guess, outside of both our areas.)

<comment><USER6> The real security benefit, I guess, is that people don't need to remember _any_ passwords. The biggest weakness of password schemes is that most people choose weak passwords that they can remember, rather than strong passwords. If you could consistently derive a password from biometric data, then that sidesteps the entire issue (there are no "weak fingerprints").

And if you could consistently derive the key from the biometric data entirely on the client, then you wouldn't even need an authentication provider, instead transparently treating the resulting authentication token as a password.

<comment><USER5> If you use a biometric fingerprint instead of a password you will soon find that passwords can be changed, but biometrics can't.

If a password database is compromised, you have a problem, but you can change everyone's passwords.

If an iris database is compromised, you _really_ have a problem.

Biometrics are also susceptible to replay attacks, where sort-of-alternatives (such as tokens) aren't.

<comment><USER6> Which is why, as I mentioned, you _don't store the biometrics_. You don't even send them to the remote service.

Hash + Salt on the client, submit the result. Unique salt for each remote service, and you can change it for a particular remote service if it turns out they do stupid shit with it.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> I'm sorry, but when was the last time anyone heard of anyone _guessing_ a password? Sure, it's a very easy password to brute force, but it doesn't matter that it's the number of the paper, because nobody would have thought to try it, along with the thousands of other things it could be, each spelt in a variety of ways.

It's much more probable that they brute-forced it in microseconds from the md5 hash, which is where the actual weakness is. I will go so far as to say that, had they used bcrypt, this would have not been broken, because people don't usually go around gathering personal data about you to try by hand (unless you have the CIA interested, that is, and then they can get in in easier ways).

<comment><USER8> I pulled a machine out of a garbage pile once. Booted it up, it required a password, I guessed "password" and it logged me in as the CEO of the company.

So, in your case, the last time you heard of anyone guessing a password was about a second ago.

<comment><USER9> A college student I know likes to play a certain online game. Some accounts have items and status symbols that are valuable in-game, but the accounts are abandoned for years. Some names are even intrinsically valuable (names like "Sun" or something like that). This college student, at least once a month, guesses the correct password for these old accounts based on information the users provided years ago.

<comment><USER8> That is far cooler than what I did: your friend actually engages in an intellectual exercise, I just got lucky with a guess.

<comment><USER9> Your story is certainly one to remember though (and lucky that it was a business owner!) I have to say though, it's quite fascinating to watch my friend work. She would make a gifted detective...

</comment></comment></comment></comment></comment><comment><USER10> And still this is yet another hacking that has little to do with choosing a bad password but with the use of the wrong algorithm to store it (md5) and poor implementation of security on the server.

<comment><USER5> Choosing (one of) your phone numbers as a password really is _all about choosing a bad password_.

The back-end could be using bcrypt with a ridiculous work factor, and server security could be state of the art, but choosing your phone number as a password will always be a poor decision.

<comment><USER11> > _but choosing your phone number as a password will always be a poor > decision_

Always? OK, I've reset my HN password to [one of] my phone number. So you can log in as me now?

No of course you can't. You don't even know how many digits it is, did I include + for an international number, did I use brackets, hyphens, dots ( _comme une gars Francais_ )? How will you connect my online ID with my phone number¹?

Once you have my password what are you going to do? Right flames and lose me karma? I can just start a new account if needs be, nothing lost really.

For many accounts a phone number is probably a good enough password IMO. For accounts that handle money? No way. For email accounts that receive reset passwords? Not a chance. For posting drivel on tech chat forums ... it'll be fine!

\--

¹ If you can I'd prefer you didn't print it.

<comment><USER5> FWIW, a couple of minutes googling found 3 seemingly-valid phone numbers for you.

<comment><USER11> Ha, I have 4 (actually 5 but I don't remember the twilio one) ... do you want to give me the end digits for confirmation purposes, last 4 digits should be enough.

<comment><USER5> _deleted_

<comment><USER11> Lolz, totally forgot about whois!!

Interestingly I searched for the numbers as I'd use them along with a substring of my username and didn't find them. Did you really Google or were you using the term generically? I tried both Google and Bing.

Well done now you can destroy my HN karma (no not really).

<comment><USER5> First google hit for "pbhj" is an seomoz profile for a web person person in the UK, which superficially matches the fact that pbhjpbhj has an account on hacker news and their previous comment here had talked about living in the UK.

The seomoz profile lists a couple of websites. One of those sites has a phone number on the /contact page, and the /about page on the other links to another business (not totally sure how I originally found that, but this is currently the quickest way to get there.)

That business has a couple more phone numbers listed on their homepage, which also matches the phone numbers on the shopfront on google street view.

This can also be cross-checked with whois.

A bit more googling (literally) of your names found an alternative (possibly old?) address in the same town, and googling that pulled up a fourth number.

<comment><USER11> Nice work courteous and complete. Funny because I usually do this the other way around. I'm not getting the SEOmoz profile high in the SERPs.

I never used to give away my location but got tired of anonymity for it's own sake. Think I'll be reviewing my online exposure now. It's been something I've worried over a little recently but it's hard to keep work/home separate (which I prefer) in many ways. Thanks for getting back to me.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> This is a great way to choose a password. If her password was selected because of the tip line displayed in bold at the top of the page, then this is probably the ONLY site she uses the password for. Assuming the site isn't holding any sensitive information, the most someone could do by accessing her account here is comment under her username.

If the passwords are stolen (as happened here) the passwords are worthless in that they won't give access to any other sites she may have accounts at, including her banking and other sensitive accounts.

</comment><comment><USER13> Why was the salt her name?</comment>


Google's Feed Reading Service Unusable Since Sunday - <AUTHOR> http://techcrunch.com/2013/02/11/the-googlereaderpocalypse-is-upon-us-googles-feed-reading-service-unusable-since-sunday/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29 <comment><USER2> I got the same revived old entries. Google Reader works, but had a blip yesterday. Mark stuff as read again and move on people.

BTW, I read this story on Google Reader, fwiw.

<comment><USER3> The blip is _still_ occurring today. Every five minutes my Reader says 1000+ new entries.

</comment></comment><comment><USER4> What are the appropriately open / stripped down alternatives? I don't need a social network (or even 10s update rates), just a cloud that knows what I've already read.

<comment><USER5> NewsBlur is an open source alternative that's worked great for me over the past year or so. Even if GR isn't destined to be shut down, NewsBlur's worth the switch just for the Intelligence feature.

</comment></comment><comment><USER3> This is really messing with my news consumption. Looking for best alternatives.

</comment><comment><USER6> I haven't seen any problems in Reeder, which uses Google Reader as a back-end server for feeds and "read/unread" state.

Perhaps this is just a problem in the web client code?

<comment><USER3> According to the article, it is a problem for clients that use it as a back- end too. Seems like it isn't affecting everyone though.

</comment></comment><comment><USER7> I noticed problems with Google Reader last night. Not present in Firefox and they went away when I restarted Chrome.

<comment><USER3> It's been on and off for me since yesterday.

</comment></comment><comment><USER8> I expect Google will discontinue the Reader at some point and suggest to use Google+ instead.

<comment><USER3> That would drive me crazy. RSS might not be the perfect technology, but for someone like me, who likes to skim headlines and brief summaries throughout the day, it's a great way to keep everything organized. I don't want all of my RSS feed to be social.

<comment><USER9> IMO RSS is one of the backbones of the social net. There are a lot of people out there that pull content into the social networks from their rss stream.

There is also this: From my experience, social networks as they exist today are totally useless for keeping up with a large number of information sources. It is just impossible to keep things sorted. Maybe I'm doing it wrong?

</comment></comment></comment><comment><USER3> It's back up for me it seems. Knock on wood, I guess.

</comment><comment><USER10> Works fine for me.

<comment><USER11> Same here. Haven't had any problems yet.</comment></comment>


Microsoft sues Motorola for patent infringement - <AUTHOR> http://androidcommunity.com/microsoft-sues-motorola-for-patent-infringement-20110823/

<comment><USER2> Here's the original article: [http://www.theinquirer.net/inquirer/news/2103672/microsoft-i...](http://www.theinquirer.net/inquirer/news/2103672/microsoft- issues-google-s-motorola-android-patents)</comment>


I'd like to invest my time in your startup - <AUTHOR> http://www.monkeymeister.com/2013/05/id-like-to-invest-my-time-in-your-startup/ <comment><USER2> Giving equity to contractors is a bad idea. Contractors can't vest, and you're effectively granting unlimited upside in exchange for the assumption of very, very little risk (he's literally promising "evenings and weekends" time) and the delivery of transactional services.

A better plan for an offer like this is deferred compensation.

<comment><AUTHOR> Of course there's risk - very large risk. The fact I'm willing to subscribe contractually to a minimum number of hours in return for a small percentage of what could potentially turn out to be nothing should the startup go belly up. That's the fun of it - I'm along for the ride - not looking to make a quick buck.

That's why deferred compensation isn't of interest.

<comment><USER3> People who work on their own startups on evenings and weekends aren't generally considered to be taking a very large risk. People who'd do contracting for equity in other startups where there is already some traction likely less so since there is more likelihood of those startups being successful.

Also your post implies you are looking to do this for multiple startups. Not only does this kind of send a bad message that you'd not be that invested in a company you literally owned, but it also reduces your risk profile since you are trying to "diversify."

<comment><USER4> Don't startup advisors like Tim Ferris do basically the same thing? Advice/market/time for a small amount of equity? The only difference here seems to be that it's developer skills instead.

<comment><USER5> Advisors should provide connections to get your business to the next stage. Whether that means helping you land a Series A or getting you intros to business partners, it's typically worth a lot more than dev skills - which is why they can justify taking equity.

</comment></comment></comment></comment></comment><comment><USER3> I hate to be that guy, but part time, evenings and weekend only, remote workers who want equity and not hourly/project compensation are basically the exact opposite of the type of employment arrangement startup founders are probably interested in. I'd be happy to proven wrong but sounds like a pretty raw deal for founders, since this type of arrangement not only dilutes them or takes from the options pool (which, if they are funded, is a _much bigger deal_ than paying the person) but also introduces all kinds of overhead and unnecessary pain in dealing with the logistics and lack of focus the employee will inevitably have.

The only time this could be a good deal is if there was a real lack of engineering talent available for hire, so I guess if you consider startups outside of the talent hubs it could make sense. But even then, if the startup is considering remote workers, this is far less appealing than a full-time, M-F, salary based employee.

<comment><USER6> >are basically the exact opposite of the type of employment arrangement startup founders are probably interested in.

That all depends. For example, if I'm an average Joe with an idea for a web- app, I sure would like someone to build it for me for 10%-20% stake. Makes sense for me, not so much for the contractor. On the other hand, a mature startup with investors, option-pools, and technical talent, wouldn't really go for something like that. Too much hassle and not enough reward.

Between those two extremes I'm sure there's some middle-ground where it makes sense for both parties.

</comment></comment><comment><USER7> This is an interesting idea. As posed though, I don't think it is workable. As noted other places in the thread, equity for contract dev work is pretty silly.

Posed slightly differently though, he could be a technical co-founder for someone else who is also still working a day-job. Helping do bits of work for a "startup" with full-time founders does not deserve a large piece of equity. (I know the article said "small", but 8-18% as noted elsewhere in this thread by OP, is not in fact small.) Being a technical co-founder though would deserve this kind of equity or more, depending on how many people involved and what the work/money requirements were.

</comment><comment><USER8> I was initially very skeptical of this idea but then I thought: "Well, some of the money that investors would put into a startup would just go employees and other service providers - why not skip a step?"

There are definitely alignment issues and other landmines that may make this a bad idea, but at the same time, the best way to find out what's wrong with this model, how it can be improved, or how it could work in some form, is to try it out.

It'd be great if you posted a follow up in a month or two after you've gotten some traction.

</comment><comment><USER9> Handy to do the time zone translation, but keep in mind that there's 4 time zones here, so that's a 3 hour swing :-) I'm guessing you're assuming Pacific time - contrary to what HN might suggest, there ARE startups in the US that aren't in California. :-)

<comment><AUTHOR> Ooops, I do apologise : ) Would the 3 hour extra timeframe work in our favour or against?

<comment><USER10> You're 5 hours ahead of the east coast, 8 hours ahead of the west coast. Being available 1-6/7pm for the east coast seems fine.

And as others have said - it's a great idea, especially given the shortage of technical talent. The biggest challenge I could see would be whether you can provide enough hours (value) for each startup, while simultaneously working with enough startups to give you the multiple pies you mentioned, and all this on top of a full time job. In any case good luck, and let us know how it goes!

</comment></comment></comment><comment><USER11> Are you looking at opportunties that have achieved product market fit or are you interested in MVP's as well?

<comment><AUTHOR> Yup, I'd be interested in hearing about MVPs too.

<comment><USER11> Whats a good email for you.

<comment><AUTHOR> ryan at 40degreesnorth dot co dot uk would be fine

<comment><USER12> it is actually .co.uk :)

<comment><AUTHOR> Hah, cheers, edited :/

</comment></comment></comment></comment></comment></comment><comment><USER13> In general, I like your idea :) and I've tried this route myself. Here's how it failed for me:

Outside people can rarely judge the quality of your work. If you're willing to work for free, they'll assume that your work is worthless. At least I was treated quite bad by the startup that I tried to help...

</comment><comment><AUTHOR> I'm right here if anyone's got any ideas.

<comment><USER14> I think this is an incredibly interesting idea but you did post this on American holiday where many people will be away from their PCs.

<comment><AUTHOR> Ah dammit. You crazy Americans! I will have to repost, but at the moment it's actually getting loads of interest, so maybe it's helped!

<comment><USER15> It's the day we celebrate leaving the British, if that's not ironic enough

<comment><USER16> Thank you for saying British and not English :). Have heard it a bit too often today.

</comment></comment></comment></comment></comment><comment><USER17> Cool idea! I'd be down for a similar arrangement if anyone's interested

UI, UX, design. Frontend developer, backbone experience. YC alum. SF

email@example.com

</comment><comment><USER18> Nothing to really add to the discussion but +1 for using Pusher for your realtime features!

If you ever in London, come to our office and say hi!

</comment><comment><USER19> Sweat equity rising! Great! (Ps.I wish there was a video to demonstrate how Productiv.io works.)

</comment><comment><USER20> Smart idea. Those investors will surely sound good when pitching for funding later on.

</comment><comment><USER11> Part of why this is appealing for myself is that hint of a co-operative feel it has.

</comment><comment><USER21> Just a note >> I do have is 8 thumbs and 2 thumbs

Not sure if that is a joke or a typo

<comment><AUTHOR> Annnnd... that's what you get for writing late at night. Thanks.

</comment></comment><comment><USER22> After 13 years working essentially 2 high paying jobs how do you not have thousands of pounds to invest in businesses?

<comment><AUTHOR> Three words my friend. British. Mortgage. Rates.

:)</comment></comment>


Beta testers wanted -- tarsnap encrypted backup service - <AUTHOR> http://www.daemonology.net/blog/2008-05-06-tarsnap-beta-testing.html

<comment><USER2> Interesting that this came up today; I finally finished getting real backups going for my laptop's homedir.

Basically, I ended up using duplicity [1], which can back up to a mounted filesystem, WebDAV, ftp, ssh, or S3. It handles encryption and incremental backups, and compresses everything on the backup medium (in encrypted 5M archives, with a seprate index file). This is why I used it; davfs2 is very slow at creating files, and my homedir is mostly very small files. I intially tried rdiff-backup, but it was just way too slow creating all those files. Duplicity, however, is nice-n-fast; 1G of data compressed down to 85 5M files and the initial backup only took a half an hour (plus an hour or so for davfs2 to sync the data up to the server; damn slow DSL...). The incremental backup is also quick, usually only a few megs of data transfer and it takes about a minute to run.

Anyway, I don't see much reason to pay someone else to do this for you. Get duplicity, get an S3 account, and enjoy.

[1] <http://duplicity.nongnu.org/>

Now it's time to rsync up my music collection. I have 50G of storage to burn through, and the 200M full backup of my homedir just isn't doing it :)

<comment><AUTHOR> Duplicity provides incremental backups; it doesn't provide snapshotted backups. Snapshotted backups are the "best of both worlds" between full backups and incremental backups -- you get the semantics of full backups (each individual backup can be restored or deleted without touching the other backups) along with the efficiency and performance of incremental backups (if only a few files have changed since your last backup, taking a new backup is very fast).

It may be that duplicity is adequate for your needs, but I did consider it before I started writing tarsnap, and decided that duplicity wasn't good enough for me.

<comment><USER3> brackup?

<comment><AUTHOR> _brackup?_

I'm not sure exactly what you're asking here... but I'll try to answer some of the questions which you might be trying to ask. :-)

Yes, I am aware of brackup. Yes, brackup appears to do snapshotted backups. No, tarsnap is not brackup. Yes, there are some similarities in the implementations. Yes, I believe that tarsnap is superior to brackup; there are several reasons for this, including being better at recognizing unmodified data within modified files. There are also several other points where I believe that tarsnap is likely to be superior to brackup, but I haven't read enough of the brackup code to be certain exactly how brackup does everything.

If that doesn't answer your question... could you elaborate a little bit about what you'd like to know? (Maybe two words instead of one...)

</comment></comment></comment></comment><comment><USER4> I am /very/ interested, as I just searched for a good online backup system that worked with linux and came up empty handed.

Sadly, 30 cents/gig every month quits being an awesome deal when you got 200ish gigs of stuff you want backed up.

<comment><AUTHOR> You don't have to back up all of your data -- many beta testers have said things like "I have 400 MB of source code and documents which I'm going to back up, and 5 GB of music which I might back up... and 100 GB of ripped DVDs which I'm not going to bother with".

<comment><USER4> I realize that and I'm doing that, but I got more data than your example. Mine's more along these lines:

          20 GB source and documents I want backed up.
         150 GB CDs ripped to mp3 and flac I want backed up.
        1000 GB ripped DVDs I'm not going to bother with.

Oh, and a few gigs of pictures. :/

Maybe I'm just a digital pack rat...

<comment><AUTHOR> How fast is your internet connection? 150 GB of music would take a month uploading at 0.5 Mbps.

<comment><USER4> That's what rsync is for. ;) A month or so of uploading all day while I'm at work, and then a few mins a day from then on to upload the deltas.

I guess this brings up a good point. Does tarsnap do incremental backups?

<comment><AUTHOR> You can do incremental backups using tarsnap if you really want, using the --newer-mtime option (tarsnap can do anything that tar can do); but you don't actually want that. Tarsnap automatically does snapshotted backups (I posted some explanation of the difference a few minutes ago in <http://news.ycombinator.com/item?id=183213>) -- so all you need to do is tell tarsnap that you want to create another backup archive, and it will magically avoid storing multiple copies of the same data.

</comment></comment></comment></comment></comment></comment><comment><USER5> What happens if the backup service goes down? Does the client have a way to recover backups from S3 directly (or from the data files I've pulled down from S3)?

<comment><AUTHOR> If the backup service goes down, you can't get your backups. I have no intention of the backup service ever going down; and the data which I have stored on S3 is enough that I can bring a new server instance up even if I lose everything else.

As long as S3 doesn't lose any data, your backups are safe.

</comment></comment><comment> patrickg-zill Curious - would people pay $50 a month for 300GB of SSH-able space?</comment>