Highlight.js – Syntax highlighting for the Web - <AUTHOR> https://highlightjs.org/ <comment><USER2> It should be mentioned that this does not support and will indeed never support line numbers due to some strange opinions of the lead developer:

[http://highlightjs.readthedocs.org/en/latest/line- numbers.ht...](http://highlightjs.readthedocs.org/en/latest/line-numbers.html)

<comment><USER3> [http://prismjs.com/](http://prismjs.com/) is an alternative that supports line numbers.

<comment><USER4> And in particular prismjs lets you select lines of code without selecting the line numbers, which you probably do not want.

<comment><USER5> Why wouldn't I want that?

If I am copying and pasting code from a website, it usually goes to my editor and I don't want to have to delete the line numbers from it.

<comment><USER6> You don't want the line numbers.

<comment><USER5> Oh if that's what he meant then I read it the wrong way.

</comment></comment></comment></comment></comment></comment><comment><USER7> This is my favorite syntax highlighting JS library, by far.

The approach this library takes to building the highlighted DOM tree is very clever. It represents the original DOM and the highlighted code output as separate streams of tag open / close events and then merges them together. This allows the highlighter to maintain the pre-existing DOM structure of the highlighted code! The language auto-detection and sub-language handling are also very neat.

If you like interesting codebases, I'd recommend giving it a quick read. :)

<comment><USER8> Sounds exactly like what I implemented 4 years ago.

Here is where you extract the existing HTML tags: [https://github.com/ioquatix/jquery- syntax/blob/97e38d08924d7...](https://github.com/ioquatix/jquery- syntax/blob/97e38d08924d776713108ed392fe3e6701b9d2c8/source/jquery.syntax.core.js#L1118-L1119)

When you brush the code (extract highlighing information) you provide the set of initial matches which are converted into a tree: [https://github.com/ioquatix/jquery- syntax/blob/97e38d08924d7...](https://github.com/ioquatix/jquery- syntax/blob/97e38d08924d776713108ed392fe3e6701b9d2c8/source/jquery.syntax.core.js#L1088) \- there is no merge step, they are merged in place in the tree which is then used to generate DOM (or whatever you like really) output.

I never implemented language auto-detection but I'm sure I've seen that implemented before prism before, perhaps Google's Prettify might have been one of the first to do it. It basically highlights using all available brushes and looks at which one matches the most tokens - not sure if this is how it is currently implemented though. My feeling is that you usually know what language you are highlighting, the auto-highlighter wouldn't always get it right, and the cost of loading all brushes/languages is pretty high (imagine for example you have 100 different languages supported, you'd have to do all of them)..

The sub-language handling in jQuery.Syntax is as precise as possible: [https://github.com/ioquatix/jquery- syntax/blob/97e38d08924d7...](https://github.com/ioquatix/jquery- syntax/blob/97e38d08924d776713108ed392fe3e6701b9d2c8/source/jquery.syntax.brush.html.js#L14-L17)

Basically, if you match some sub-portion of the code, you then highlight that using a different brush. Sometimes it's almost impossible to know though (e.g. diffs which may be incomplete).

</comment></comment><comment><USER9> In my opinion it's irresponsible to use highlighters like these. At least when you use them like advertised. Why does no one bat an eyelid at letting the clients handle the highlighting?

The highlighting (lexing) could (and should) be done ONCE at the server. Imagine some high traffic blogs with hundreds of millions of hits combined - all these clients downloading the highlighting libs + lexers for 50 different languages that will never be used on the blog anyway. The wasted energy here is probably even measurable.

Cons when letting the clients handle syntax highlighting:

\- Much slower load times

\- Wasted energy

\- Can fail because of JS crashing

\- Noscript users won't get any highlighting (and your blog targets technical users, right? They are more likely to use no script)

\- Slow mobile devices will have a harder time loading the site (or depending on javascript engine - failing highlight)

\- (if no site optimization is made) the client will download lexers for languages not used on the blog

Cons when the server do the lexing ONCE:

\- NOTHING

Note that this rant isn't targeted at Highlight.js. It's a good highlighter - I use it myself at my blog. Except I use it on the server via a CGI script. It took me no more than 2 minutes to set up.

<comment><USER10> _Except I use it on the server via a CGI script. It took me no more than 2 minutes to set up._

How about you write a tutorial about this and submit it to HN? This is probably a better way to make people adapt your approach than a rant, no matter how valid your points are :)

<comment><USER9> That's a good idea! I should make a blog post about it. And maybe be less ranty. ;)

</comment></comment></comment><comment><USER11> At one point I got really into the idea of ASTs for languages. I've used pygments, the python syntax highlighter, with the intention of parsing the meaning of code.

These syntax highlighters are great but I think that underlie the lack of a defined and accessible AST parse definition for most languages. Highlight.js and others kind of just rely regexes-- [https://github.com/isagalaev/highlight.js/blob/master/src/la...](https://github.com/isagalaev/highlight.js/blob/master/src/languages/python.js)

It'd be great if we could parse through programming languages to get their meaning. I want to get tuples back!

``` a = 23 ``` would give

(variable(name=a), assignedTo, number(23))

This does exist for some languages, but mostly compiled ones. But it would make the syntax highlighting even more robust! Antlr is the best one around at the moment. [http://www.antlr.org/](http://www.antlr.org/)

<comment><USER8> I believe CodeMirror does something like this. It uses restartable parsers (or it used to) to make parsing fast while editing.

I experimented editing code using jQuery.Syntax. I used the match tree it generated to figure out where to restart parsing and it was pretty fast, it would only re-evaluate the current line in most cases.

<comment><USER12> CodeMirror still uses the restartable parsers. But they produce a flat sequence of styles, not a hierarchical AST. E.g. ` _foo_ _bar_ * baz _` in markdown becomes _foo  __bar __ baz*. Also, most parsers reuse a small set of style names (that are covered by themes) without much regard to semantic appropriateness. E.g. markdown lists cycle through 'variable-2', 'variable-3', 'keyword'.

</comment></comment></comment><comment><USER13> We use highlight.js at Resonant Core for our blog posts. After reading the comments here, I'm considering forking it to support line numbers :)

<comment><USER14> It would be really helpful when presenting at Events.

A lot of events record the presenters screen and the presenter but expect the presenter to stand in one spot so they don't need a cameraman.

So, it does not work very well to point at a screen when presenting.

<comment><USER13> It _should_ be a trivial patch. I'll see about getting it done tonight.

<comment><USER15> Famous last words ;)

</comment></comment></comment></comment><comment><USER16> Anyone know of one of these that supports some kind of callouts?

Basically I want to be able to annotate groups of 1 or more lines, something like this, probably using some kind of inline comment

[http://reference.bitreactive.com/reference/images/tutorial/s...](http://reference.bitreactive.com/reference/images/tutorial/send_email_java_code_annotated.png)

<comment><USER8> jQuery.Syntax does support preserving the original DOM elements, so you could do this.

</comment></comment><comment><USER17> I've tried Highlight.js before and I was never really a big fan of it. It seemed too heavy last time I tried it. I've been using rainbow.js for a year or two now.

[http://craig.is/making/rainbows/](http://craig.is/making/rainbows/)

<comment><USER18> Rainbow doesn't seem to have line numbers. Is there another module available that allows integration of lone numbers?

</comment></comment><comment><USER19> What's the recommended way of using something like this or prism.js to highlight a simple textarea containing code?

I'm not talking a full-on programming editor, that's a much larger scope. Rather, I have an admin tool with a <textarea> that allows entering short code snippets, and it would be handy to see highlighting as you type. Even at this low level of complexity, is it simpler to just embed something like Ace, or is there an easy way to use a highlighting library?

<comment><USER20> Have you looked at CodeMirror? It might be a better fit for highlighting editable text.

</comment></comment><comment><USER21> I like it, however, it is possible to make a "click all" checkbox for the "other" languages. You now, I mean: "click, click, click, click ..." ;)

<comment><USER22> Paste in console: $('input[type=checkbox]').prop('checked', true);

<comment><USER23> You sir are brilliant!

</comment></comment></comment><comment><USER24> This isn't really related to the act of highlighting syntax, but I noticed the example code for Elixir at [https://highlightjs.org/static/demo/](https://highlightjs.org/static/demo/) is quite out of date. Records generally aren't used anymore, and the syntax to send a message to a process has changed from `pid <\- message` to `send(pid, message)`

</comment><comment><USER25> Used this in a project[0] a little while ago and found it really easy to work with. The syntax detection was an added bonus that I had expected to need another library for.

[http://cmdv.io](http://cmdv.io)

edit: I should mention that this might be a cool example for someone looking to use hljs in React/Flux-- I tried to make it fairly clean. There's a github link on the bottom-left of the website.

<comment><USER26> Out of curiosity, are there any decent libraries you looked at for doing language detection? Thhat's the main reason I'm using Highlight.js in one of my projects instead of Prism or Rainbow.

Unfortunately, the tradeoff is no support for generating a display with line numbers. In my case, that was the lesser of two evils, but I wouldn't mind using two libraries if it meant I could get everything I want.

<comment><USER25> Just reading out of my notes, the only non-highlighting detector I was looking at was [https://github.com/blakeembrey/node-language- detect](https://github.com/blakeembrey/node-language-detect), but it's not widely used or developed as far as i can tell.

If you have Ruby in your stack, it's easy -- use github's own [https://github.com/github/linguist](https://github.com/github/linguist)

You might also be able to use just the language definition files from [https://github.com/syntaxhighlighter](https://github.com/syntaxhighlighter)

</comment></comment></comment><comment><USER27> Here's a hosted version of the HighlightJS developer tool: [http://highlightjs-developer.appspot.com/](http://highlightjs- developer.appspot.com/)

Planning to open source an http API (similar to [http://markup.su/highlighter](http://markup.su/highlighter)).

</comment><comment><USER28> This is my favorite syntax highlighting library. The best feature is that it returns a continuation of the code being highlighted which means you can highlight code that's being streamed to you line by line. I couldn't find another library that does that.

</comment><comment><USER29> I use this on my personal site, seen here:

[https://www.dougcodes.com/go-lang/building-a-web- application...](https://www.dougcodes.com/go-lang/building-a-web-application- with-martini-and-gorm-part-1)

Dead easy to implement, just set it and forget it.

</comment><comment><USER30> Is this news? I've been using this for quite a while.

<comment><USER31> So, you using it seems like validation that this is a good contribution?

<comment><USER32> It's like posting jQuery.

</comment></comment></comment><comment><USER33> Why prefer this over something server-side, like Pygments, when you can use the latter? I don't see many advantages to the client-side approach.

<comment><USER34> You may have users actually writing 'code' on the client side. For those cases a client-side solution gives a better experience that requires less code (no roundtrip to server needed).

</comment></comment><comment><USER35> Used this along with markdown to html conversion, works pretty well. will try prismjs.com mentioned here, was unaware of that though.

</comment><comment><USER36> How does this compare with Prettify?

<comment><USER37> I did a comparison of Syntax Highlighter, Prettify and Highlight.js for weblogs.asp.net. I ended up preferring Highlight.js. My notes:

• SyntaxHighlighter

generates tons of nested tables, doesn't work well with Bootstrap (overflows into right rail)

• Google Prettify

Worked okay, but kind of ugly. Had to use jQuery to apply "prettyprint" class to all pre elements.

• Highlight.js

Easy to set up, lots of themes, seems pretty quick, regular updates

Sample post: [http://weblogs.asp.net/jongalloway/looking-at-asp-net- mvc-5-...](http://weblogs.asp.net/jongalloway/looking-at-asp-net-mvc-5-1-and- web-api-2-1-part-4-web-api-help-pages-bson-and-global-error-handling)

Highlight.js + styles are hosted on cdnjs, which makes it easy to host on a blog.

</comment></comment><comment><USER38> This looks really useful. I'm wondering if there is a way to get modern fortran in the fold.</comment>


Ask HN: Server colocation - <AUTHOR> What are some good cheap providers?  I have a few EC2 machines, but I also have a few personal boxes sitting around that I would like to get online.<p>Anything in the $50 range that will take a mini tower? Or will I be stuck with 1U of space? <comment><USER2> Are you sure you want to "own" the box? I had nothing but trouble trying to maintain a little gaggle of self made boxen at various data centers.

I ended up changing almost all of them to these little $39/month dedicated marvels at interserver. They mess with the hardware, I get the goodness.

[http://www.interserver.net/custom-managed-dedicated- servers....](http://www.interserver.net/custom-managed-dedicated-servers.html)

<comment><AUTHOR> I would just keep renting VPS/EC2 machines, but I really need high RAM machines. 8-16GB, and I already have the boxes here, and I just want to get them online 24/7.

</comment></comment><comment><USER3> I used to install CoLo boxen for clients, sometimes dozens in any given data center. Unless you have network KVM or its equivalent, you'll end up hating the idea. And you need to plan for backups too.

With a mini tower, you'll most probably have to get a shelf and pay for at least 3-4U if you lay it on its side, more if standing upright. Since stuff is always rack mounted, cooling can be an issue as well. Rack mount servers are designed for that environment.

Since you are already using EC2, why not dial up a couple of micro instances. If you are running Linux or BSD, then do your numbers. Sometimes it works out cheaper to host multiple processes on a single larger instance.</comment>


Show HN: A tool to help your clients scope development projects - <AUTHOR> https://theworkmob.com/scope/

<comment><AUTHOR> We're also hacking on a more in-depth version [https://theworkmob.com/sitdowns/demo/](https://theworkmob.com/sitdowns/demo/)

Love to hear what you all think</comment>


Google CEO Sundar Pichai on Achieving Quantum Supremacy - <AUTHOR> https://www.technologyreview.com/s/614608/google-ceo-quantum-supremacy-interview-with-sundar-pichai/ <comment><USER2> Isn't it also possible for analytical computers to outperform digital computers by orders of magnitude? How sure are they that Google's computer got its performance advantage through quantum effects?</comment>


WHO: COVID-19 in 29 countries last Monday, now 56 - <AUTHOR> https://www.npr.org/sections/goatsandsoda/2020/02/28/810452948/who-says-risk-of-covid-19-is-now-very-high-at-a-global-level <comment><USER2> > "We do not see evidence as yet that the virus is spreading freely in > communities," the WHO director-general said.

No longer true: CDC Confirms Possible Instance of Community Spread of COVID-19 in U.S.

[https://www.cdc.gov/media/releases/2020/s0226-Covid-19-sprea...](https://www.cdc.gov/media/releases/2020/s0226-Covid-19-spread.html)

<comment><USER3> Only 2 so far. I think there is a chance the us can avoid significant spread.

<comment><USER4> To the best of my knowledge (and not trying my to incite panic), there are only 200 test kits in the entire state of CA. The official numbers are meaningless given the inability to actually test. Why do you believe the US will be able to quarantine the entire Bay Area?

<comment><USER5> There are no concentrations of flu and respiratory problems according to hospital case managers. Clusters aren't likely to stay hidden for very long, even without kits. I don't think the goal is to quarantine entire regions, just to slow it down by limiting groups of people in affected areas.

<comment><USER6> Of course not. Did you see the article of a person being billed $3000 for a coronavirus test?

Testing it should be free (based on symptoms) if US wants to stop the disease from spreading.

<comment><USER7> One of the joys of lacking a real healthcare system

</comment></comment></comment></comment></comment></comment><comment><USER8> Right now it is all about slowing down the onset of the eventual peak. Any delaying action will give healthcare systems in countries that are really working on preparations (and they all should be) time to get more capacity in place. The sooner that peak hits the harder it will be, the more people will die.

</comment><comment><USER9> _On the basis of a case definition requiring a diagnosis of pneumonia, the currently reported case fatality rate is approximately 2%. In another article in the Journal, Guan et al. report mortality of 1.4% among 1099 patients with laboratory-confirmed Covid-19; these patients had a wide spectrum of disease severity.

If one assumes that the number of asymptomatic or minimally symptomatic cases is several times as high as the number of reported cases, the case fatality rate may be considerably less than 1%.

This suggests that the overall clinical consequences of Covid-19 may ultimately be more akin to those of a severe seasonal influenza (which has a case fatality rate of approximately 0.1%) or a pandemic influenza (similar to those in 1957 and 1968) rather than a disease similar to SARS or MERS, which have had case fatality rates of 9 to 10% and 36%, respectively._

— New England Journal of Medicine, Feb 28, 2020

[https://www.nejm.org/doi/full/10.1056/NEJMe2002387?query=rec...](https://www.nejm.org/doi/full/10.1056/NEJMe2002387?query=recirc_curatedRelated_article)

<comment><USER10> _If one assumes that the number of asymptomatic or minimally symptomatic cases is several times as high as the number of reported cases, the case fatality rate may be considerably less than 1%._

Well sure, if one assumes that, you can easily make yourself feel better. But is there a specific reason to believe this? The widespread contact tracing and testing in SK, Singapore, and Italy are not comforting. If there was a huge number of asymptomatic cases, wouldn't they be finding them?

<comment><USER9> The point is that the fatality rate depends on the denominator chosen.

Choosing a denominator of only people with COVID who go on to develop pneumonia, results in a rate of 2%.

Choosing a denominator of all people with laboratory confirmed cases of COVID, results in a rate of 1.4%.

Clearly a denominator of "everyone who was infected with COVID" is larger than the denominator of "everyone with a laboratory confirmed case".

The question is, how much larger? The number of reports of asymptomatic and mild cases which are asked _not_ to go to a hospital are specific reasons why the true fatality rate is less than 1.4% and may be _considerably_ less than 1%.

<comment><USER10> _The number of reports of asymptomatic and mild cases which are asked not to go to a hospital are specific reasons why the true fatality rate is less than 1.4% and may be considerably less than 1%_

Total speculation. There is no reliable data on how many uncounted people there are. I've been watching your comments on here for days and it's clear you want this to be overblown, as we all do, but you're intentionally twisting the uncertainty in the evidence and data to try and downplay things. Things _could_ turn out to be worse than we think, not better. Look at the death rates in Italy and Iran. Not to mention how high hospitalization rates could overwhelm our medical infrastructure and push the mortality rate even higher.

In short, unless you're a working expert in a relevant field, there's exactly zero reason to listen to you. I'll continue to listen to what health officials are saying, and watch what they're doing. And when I do that, it's pretty clear that you and others like you who claim this is overblown and no big deal are almost certainly wrong.

<comment><USER9> > _In short, unless you 're a working expert in a relevant field_

FYI, the italicized portion was a quote from the New England Journal of Medicine from a working expert in a relevant field.

</comment></comment></comment></comment></comment><comment><USER11> It's been spreading since November 2019, initially news of it was muzzled by China and then they didn't know or didn't have tests for it in other countries.

So it's going to popup everywhere. Any town with an international airport or university with international students will be flooded with cases in a month. Absolutely no-one has immunity since it's never existed before and since everyone feels entitled to still go to work or shop while very sick, it will spread like wildfire.

Also remember there are millions upon millions in the USA without any kind of insurance or easy access to healthcare.

<comment><USER12> Not to mention that political leadership and one corner of the media is throwing chaff in the air and blaming the Democrats and mainstream media for sensationalizing the virus. Trust, which is absolutely key to having the population take action, has been eroded.

<comment><USER13> They are taking action, there's no hand sanitizer on the shelves

</comment></comment></comment><comment><USER14> [https://www.mercurynews.com/2020/02/28/santa-clara-county- an...](https://www.mercurynews.com/2020/02/28/santa-clara-county-announces- new-coronavirus-case/)

Second community acquired infection and it's in the heart of the valley.

<comment><USER15> Given the incubation time, the virus has been spreading in the community for at least 1-2 weeks. Not a US citizen and don't really understand how things work there, but you'd think it's time for a response at scale to have any chance of containment. From a distance, it seems politics is interfering with this.

<comment><USER16> The smart thing to do at this point would be to abandon the fool's hope that this will be contained in the US, stop trying to track cases and spread, and just work on shoring up the heath care system for when it's inevitably going to be overrun. Trying to keep it contained now is like putting up a truckload of sandbags to stop a tidal wave.

If it wasn't possible to be reinfected, I'd say the wise thing to do would be to get yourself infected now, while you can still get a respirator in the hospital.

<comment><USER14> That assumes you can't get it twice, which we don't know yet. It also assumes there are no long-term effects, and there are already reports of lung fibrosis. You're better off delaying it as long as possible. Work from home if you can, and try to avoid non-essential travel while people work on better treatments.

<comment><USER16> > That assumes you can't get it twice

I'm assuming you can get it twice, based on recent news[1], that's why I said:

> If it wasn't possible to be reinfected

[1] [https://thehill.com/changing-america/well- being/prevention-c...](https://thehill.com/changing-america/well- being/prevention-cures/484942-japan-confirms-first-case-of-person-reinfected)

<comment><USER14> Sorry, missed that.

</comment></comment></comment></comment></comment></comment><comment><USER9> There are only 4 countries outside of China which have at least 100 confirmed COVID cases.

There are only 3 countries outside of China which have had at least 10 COVID deaths.

The story at this point has been blown massively out of proportion relative to a typical flu season. How many more people died last week from flu-related complications than died of COVID?

It's wise to take precautions, but it should be done rationally. IMO, I think prophecies of WWIII level calamity should be flagged, as it's not healthy discussion but more like gruesome fan fiction.

<comment><USER17> In other thread, people commented that "it's becoming real" because now we have TWO cases in US among the population over 300M. The current economic damage is at least $50M/death due to COVID-19 virus! I'm not sure if this is the most dangerous disease but its certainly most expensive diseases the world has seen so far. So yes, the hype is real.

<comment><USER18> how are you measuring economic damage?

<comment><USER17> Loss in the stock market, manufacturing, 10% of China population in lockdown. The number of deaths so far is under 2500.</comment></comment></comment></comment>


Cloudflare introduces two-factor authentication - <AUTHOR> http://blog.cloudflare.com/2-factor-authentication-now-available

<comment><USER2> Looks like a lot of comments on the original article are asking why Cloudflare didn't go with Google Authenticator, and I have to admit I'm curious about that myself.

Edit: Cloudflare left an answer in the comments of their blog about why they chose Authy, so I'm copy/pasting it here:

"Thanks everyone for your comments, we appreciate the feedback. Some insight on why we chose Authy (more on this in a blog post to follow)...

1\. Authy app will support google authenticator tokens within the next 2 weeks.

2\. We chose Authy to solve many of the problems with Google Authenticator. Once you start using Authy you'll notice everything works seamlessly. Google Authenticator on the other hand has a few problems:

\- If you lose your phone, there is no way to revoke access to your token.

\- Google Authenticator depends on the time of the phone to be right for it to work correctly (same as Authy). But Authy will automatically sync this time for you in the background so you never have to worry, your tokens will always work. \- If you change your phone, Google Authenticator requires you to go and reconfigure all of your accounts. With Authy all your accounts are synced, so when you upgrade and re-install Authy everything will be setup the way you expect it.

\- Authy uses 256 bit keys, while Google uses 128 bit keys.

\- Last year RSA was compromised and all their clients had to manually reset their keys. Google Authenticator has the same issue, if the keys were ever compromised everyone would have to manually reset the keys. Authy has a built- in reset mechanism that will automatically reset the keys for you if they are ever compromised."

<comment><AUTHOR> > Cloudflare left an answer in the comments

They made a whole new post to address that — [http://blog.cloudflare.com/choosing-a-two-factor- authenticat...](http://blog.cloudflare.com/choosing-a-two-factor- authentication-system)

</comment></comment><comment><USER3> I can't wait for the day that someone implementing two-factor authentication doesn't call for a Hacker News post. It's a little frightening how easy it would be for major damage to be done to a business or individual with just a single stolen password when you consider how many important services don't offer two-factor authentication (banks, brokerages, registrars, DNS providers, VPS hosts, Heroku).

<comment><USER4> Agree. This is happening, slowly but surely. Hopefully we at authy can help make it faster.

</comment></comment><comment><USER5> From authy.com (the service provider for two-factor cloudflare is using):

> It's like magic, except it's math.

<comment><USER4> What's wrong with that?

We take security seriously, and our product is rock-solid. That doesn't mean we need to act as if we were distant/dead.

If you ever contact support or read our documentation etc you'll notice we are very approchable and don't bother appearing serious/distant like other enterprises do - our product speaks for itself.

</comment></comment><comment><USER6> I have no clue why one would want to use Authy over plain TOTP (as implemented by Google Authenticator, for example). Or, if Authy also relies on TOTP, why make a big thing out of it?

</comment><comment><USER7> Been waiting for the text message to arrive for the past 15 minutes or so! I hope this is rolled out to all countries.

<comment><USER4> We do support almost every country, but depending on network congestion SMS is not that reliable.

If you are waiting for the registration PIN? Click the text-me the pin again (if you do so twice) the button changes to call me. Then we will instantly call you. Let me know if that works.

<comment><USER8> Who are you using for messaging? When I registered this morning (in Australia), each message was sent to me twice. First from BulkSMS and then from an Australian mobile (cell) number.

There wasn't too much of a delay however (less then 1 minute)

<comment><USER4> We use twilio(first), then bulksms then clickatell and finally nexmo. Sometimes we send 2 SMS's because the carrier takes too long to confirm if the SMS arrived.</comment></comment></comment></comment>


Types of Network Effects and How to Hack Them - <AUTHOR> https://hackernoon.com/the-5-types-of-network-effects-and-how-to-hack-them-a5b54745eed2 <comment><USER2> /offtopic, strange to see `word-break:break-all;` in a long-form blog post. Trading readability for clean looking lines isn't worth it IMO.</comment>


Simple and Minimalistic Server Dashboard - <AUTHOR> https://github.com/B-Software/Ward <comment><USER2> I like the design, but honestly this doesn't seem to give you any added value when compared to Grafana + node_exporter + Prometheus or dtop [0][1]. But anyways, I like the clean UI of this solution

[0]: [https://github.com/ddierickx/dtop](https://github.com/ddierickx/dtop) [1]: [https://github.com/denysvitali/dtop](https://github.com/denysvitali/dtop) (my fork)</comment>


Know your NeRD: What submariners can expect from their new e-readers - <AUTHOR> http://www.navytimes.com/article/20140513/NEWS04/305130061 <comment><USER2> > Fiction: "The Lord of the Rings" (J.R.R. Tolkien); "Game of Thrones" (George > R.R. Martin); "Slaughterhouse Five" (Kurt Vonnegut); "Blood Meridian" > (Cormac McCarthy); "The Stand" (Stephen King).

> Nonfiction: "The Electric Kool-Aid Acid Test" (Tom Wolfe); "Halsey's > Typhoon" (Tom Clavin); "Band of Brothers" (Stephen Ambrose); "Into the Wild" > (Jon Krakauer); "Guns of August" (Barbara Tuchman).

about 300 titles (not sure what the proportion of navy specific material, public domain and commercially licensed title are).

Note the high price -- $3k/unit. That is typical in that domain. It is funny because a lot of things they assert to have is actually lack of features -- lack of wifi, lack of cameras. And probably most important -- presumably made in US. In that market there are really ridiculous markups. You just have to know someone who knows someone to get the contract. It (this market) is also mostly immune to being exported overseas -- just due to basic security and trade regulations.

Informally one can say, "a new mac is cheaper than that!". And yeah it is. But this is a mac built to spec, all made in Ohio probably. Interesting what macs would cost in that case if there built to order in smaller batches and made in Ohio, all having strange requirements like FIPS-140-2 compliant crypto libraries enabled and other random red tape restrictions slapped on them....

<comment><USER3> The whole thing is utter BS. When at Lockheed; we sold POS Panasonic ToughBooks in a Pelican case with foam lining, an overall retail value of $2,500 to the DOD at a nice price of $25,000.

No, don't be fooled in thinking "oh, that must have included software licensing costs for X Y or Z."

NOPE

That was millions in separate fees... literally a $25 charge for $2,500 in equipment costs at their RETAIL value (i.e. not what the actual cost TO Lockheed was, as they were bought in qty)

<comment><USER4> I had commented on a different thread, listing down a bunch of ways money gets transferred from poor/middle class to rich in an institutionalized way.

This is a prime example!

<comment><USER5> _Grumble grumble_ job creators! _something something_

<comment><USER6> "job creator" is the new "slave owner" but hey, somebody has to do it... employ or be employed, no better alternative at horizon I'm afraid.

</comment></comment></comment></comment></comment><comment><USER7> It's pretty much an open secret that most of the crew takes their own devices with them. Not sure how 5 per boat is going to change that, particularly with a fixed reading selection.

<comment><USER8> Presumably in the same way having a physical library aboard would--if someone wants to read a particular (classic) book, they can, even during a radio- silent mission.

<comment><USER9> Except that this is the equivalent of a library that only 5 crew members can borrow from at once. I'm not sure how useful that is.

</comment></comment></comment><comment><USER10> Note that the cost of each device includes "the rights to all the books loaded on it," so this is more like a civilian e-reader with a lot of content on it than just an empty $3k Kindle or equivalent.

Still, I wonder how many of the titles were free, or nearly so, and what kind of price break one could get on 100's of titles.

For those wondering: why not a Kindle/Android/etc.? - same reason you can't bring a Furby toy into a secured area - it contains a recording device!

<comment><USER11> > _same reason you can 't bring a Furby toy into a secured area - it contains > a recording device!_

Well, _technically_ speaking, a Furby doesn't contain a recording device at all. But the important thing is that it _might_. It doesn't, but _it might!_ Can America take that risk?

<comment><USER12> Your code contains an eval($_GET['foo']);. _Technically_ speaking, your UI is doing nothing bad, but the important thing is that it _might_. Can your company take that risk?

Seriously, it's not worth calling something a _secured_ area if you ignore the most obvious attack vectors. Banning Furbies is a reasonable action.

<comment><USER13> Banning furbies because they "learn and repeat words" is a stupid reason, because they had an inbuilt list of about 100 English words that they could "learn".

Thus, you could talk state secrets to it all day every day for a year and all it would learn would be its internal list of words.

Having said that banning furbies is probably a good way to remind people about recording devices and banning furbies was probably a sensible thing to do.

[http://news.bbc.co.uk/1/hi/world/americas/254094.stm](http://news.bbc.co.uk/1/hi/world/americas/254094.stm)

</comment></comment></comment></comment><comment><USER14> I'd have expected to see many of those titles on a military-issue e-reader, but _The Electric Kool-Aid Acid Test_?

<comment><USER15> You might be surprised to hear that there are many free-thinkers in the military. It's a little slice of America, with just about every subculture represented.

What I'm surprised to hear is that they're including a bunch of military reading on these. While I love war books and tactics, when I'm off doing military shit 24/7, the last thing I want to do with my rare free time is read a military book. Give me something that gets my mind off it all.

<comment><USER16> People can and do have a personal interest in their field of work, and that's a good thing.

Let's assume that you're a software engineer and for the sake of argument that your employer has to provide you with your reading: If that reading compendium included SICP and Code Complete (besides a large selection of mainstream fiction and sci-fi etc), would you be "surprised to hear" that, too?

<comment><USER15> The software engineer parallel isn't totally the same. It's hard to understand unless you've been there but military exercises/war are an all-encompassing thing. You're eating and breathing this stuff 24/7 whether you like it or not. During these things, it can be difficult to feel like you're a civilian, especially when you can't even wear civilian clothes.

But yeah, you are right, there are some people who can do it all day and night and still not get enough. War movies and books are very popular with Soldiers.

</comment></comment></comment></comment><comment><USER17> I've been listening to the ANTIC 8-bit Atari computer podcast, and one of the hosts is a former submariner. He has a story about bringing his 8-bit Atari computer on a tour once and writing some utility software that helped with sub operations on his downtime.

It seems submariners have a pretty wide berth (pun intended) to bring on all sorts of stuff if they can fit it in their very tiny personal spaces.

If I had to guess, I'd bet most of the folks on board a sub have "solved" their e-reader problem in various ways already. I'm also kind of surprised various manuals and procedure guides haven't found their way onto official e-readers/tablets in each compartment already.

</comment><comment><USER18> 300 paperbacks don't take up that much space and there are no security concerns with them. Heck, each sailor can bring 1 paperback as part of their kit, then they swap as they read them.

And besides, to get a secure device, they could take an ordinary Kindle, load it up, then physically remove the wifi and usb circuitry.

</comment><comment><USER19> Partly the math sounds bad because it is bad math. Someone saw that they got a $1M contract and delivered the first 300 custom e-readers. The next 300 probably won't cost that much, and then the numbers won't be so interesting. To me that doesn't sound that bad if they really developed everything from scratch.

</comment><comment><USER20> How many e-readers have cameras?

</comment><comment><USER21> God to know that American tax dollars are being well spent. Buy some kindles.

</comment><comment><USER22> Fixed selection of titles with no possibility of putting one's own content... Indoctrination much?</comment>


A New Superbacteria, Immune To Most Antibiotics, Found Spreading Fast - <AUTHOR> http://www.popsci.com/science/article/2010-08/new-bacterial-mutation-makes-common-bacteria-resistant-almost-every-antibiotic

<comment><USER2> This isn't just "a" bacteria, but a gene making a number of existing bacteria types resistant.

The article cites "E. coli and Klebsiella pneumoniae" as already affected. It looks like cases in the U.K. link back to Pakistan and India. When resistant versions of those hit the gut some will be in for tough times. MRSA is serious, this is worse.

[http://www.guardian.co.uk/science/2010/aug/11/antibiotics- ef...](http://www.guardian.co.uk/science/2010/aug/11/antibiotics-efficiency- drug-resistant-bacteria)

</comment><comment><USER3> They're enterobacteriaceae that are resistant to carbapenems. See [http://www.cdc.gov/mmwr/preview/mmwrhtml/mm5924a5.htm?s_cid=...](http://www.cdc.gov/mmwr/preview/mmwrhtml/mm5924a5.htm?s_cid=mm5924a5_w) for more details.</comment>


Pentagon/NATO plans for robots making "trusted" decisions on lethal force - <AUTHOR> https://medium.com/insurge-intelligence/the-pentagon-is-building-a-self-aware-killer-robot-army-fueled-by-social-media-bd1b55944298 <comment><AUTHOR> I had a really hard time extracting a non-misleading summary and then shrink that to 80 chars or less, and an equally hard time resisting the urge to make it something about not allowing a killer robot gap.

> _To prevent being surpassed by rivals, the United States should fully commit > itself to harnessing the potential of fully autonomous targeting._</comment>


The 2012 Perl 6 Coding Contest - <AUTHOR> http://strangelyconsistent.org/blog/the-2012-perl-6-coding-contest <comment><USER2> Is there a production-grade implementation available yet? If so, who is using it, and what are they using it for?

I look into Perl 6 every few years, but there's never a high-quality implementation of it. The ones that do exist end up being esoteric, experimental, or otherwise not really usable like Perl 5 is.

<comment><USER3> _Is there a production-grade implementation available yet?_

Depends on your use case: There are two reasonably complete and stable Perl6 implementations - Rakudo on Parrot and Niecza on .NET/Mono.

What needs to be addressed before Perl6 can be recommended for _arbitrary_ production use are modules and performance:

The module ecosystem[1] is somewhat ad-hoc and modules may have bit-rotten, so batteries are not included.

Rakudo is more feature-complete, but performance is less-than-awesome and Niecza might be a better choice if that's relevant and you're comfortable with the CLR. The performance issue can be somewhat mitigated by implementing critical code in C (in case of Rakudo) or C# (in case of Niecza), but that's more of a band-aid than a real solution.

You might also want to take a look at the Perl6 advent calendar[2] to gain some insights into the current state of Perl6.

[1] <http://modules.perl6.org/>

[2] [http://perl6advent.wordpress.com/2012/12/01/perl-6-advent- ca...](http://perl6advent.wordpress.com/2012/12/01/perl-6-advent- calendar-2012-table-of-contents/)

<comment><USER4> Are there any benchmarks available that compare Rakudo's performance with PHP, Python and Ruby?

<comment><USER3> Not that I'm aware of. Rule of thumb from my totally unscientific personal observations would be that the Rakudo of today is _at least_ one, perhaps even two orders of magnitude slower than the others...

</comment></comment></comment></comment><comment><USER5> It would be excellent to have examples from last year easily linked to. I think people would love to see some sample code.

<comment><USER6> I'll make sure to link to previous years. In the meantime, here are the links to the 2010 edition:

Tasks: [http://strangelyconsistent.org/blog/masaks-perl-6-coding- con...](http://strangelyconsistent.org/blog/masaks-perl-6-coding-contest)

Code reviews: <http://strangelyconsistent.org/p6cc2010/></comment></comment>


Raspberry Pi at Maker Faire NY 2011 (video) - <AUTHOR> http://www.geek.com/articles/chips/raspberry-pi-at-maker-faire-ny-2011-20110919/

<comment><USER2> I think this is a great project. I wonder a bit about the size of the board (in that it is not clear to me that making the board smaller helps beyond a certain economy of PCB square inches).

It is fascinating to see 'microcomputers' done all over again, which is to say that back in the day when computers were $100,000 and you could build your own computer for less than $1,000 with over four thousand bytes of memory :-) but they were simpler machines and great for learning on.

Now we're seeing projects with AVR's and ARM chips which are similar (although without some of the independent interactivity of those older machines sometimes) and I find that great because to 'learn' computers it really helps to start on something where you can keep the whole OS in your head rather than say a modern Linux distro or a commercial OS.</comment>


Show HN: Easy url redirection for your apps - Redirect App - <AUTHOR> http://redirectapp.com/ <comment><USER2> Seems good, but why should I use this over an .htaccess file? If anything, a redirect to your server and then back to mine would add latency.

<comment><AUTHOR> It wouldn't really add latency

Here is a sequence diagram depicting the flow:

\- With RedirectApp: <http://i.imgur.com/kej9j.png>

        Client(Browser)->RedirectApp: Makes a get request
        RedirectApp->Client(Browser): Returns an http redirect response
        Client(Browser)->Your Website: Makes the final request

\- With .htaaccess: <http://i.imgur.com/LyvZs.png>

        Client(Browser)->Your Website: Makes a get request
        Your Website->Client(Browser): Returns an http redirect response
        Client(Browser)->Your Website: Makes the final request

The advantage of using RedirectApp is that you don't have to mess with your .htaccess file. This might not seem very helpful for one app, but when you have dozens of apps/websites, RedirectApp makes this very simple.</comment></comment>


The man who discovered umami - <AUTHOR> https://www.bbc.com/future/article/20190503-the-mystery-taste-that-always-eluded-us <comment><USER2> For a vegetarian like me, MSG is a god send. Savory oatmeal spiced up with MSG, a dab of miso paste, and other spices has been my daily breakfast for a couple of years. It's surprising that not many people know about MSG or shy away from it because of nonsensical urban myths.

<comment><USER3> Even for non vegetarians, MSG (monosodium glutamate) is a pretty cool addition to the kitchen toolbox, just order some and start experimenting!

Do some controlled ones, for example split a portion into two, ask a 2nd person to sprinkle some onto one of them and try both of them and guess which one has MSG on it.

<comment><USER4> I think the jury is still out on how (un)healthy extensive use of MSG is [0].

> In conclusion we would like to state that although MSG has proven its value > as an enhancer of flavour, different studies have hinted at possible toxic > effects related to this popular food-additive. These toxic effects include > CNS disorder, obesity, disruptions in adipose tissue physiology, hepatic > damage, CRS and reproductive malfunctions. These threats might have hitherto > been underestimated. In the meantime, people keep using ever larger amounts > of MSG unaware of the possible consequences. Further studies need to be > undertaken in order to assess the connection between MSG and cardiovascular > disorders, headache, and hypertension in human models. MSG is a > controversial food-additive used in canned food, crackers, meat, salad > dressings, frozen dinners and a myriad of other products. It is found in > local supermarkets, restaurants and school cafeterias alike. While MSG > probably has huge benefits to the food industry, the ubiquitous use of this > food-additive could have negative consequences for public health. If more > substantive evidence of MSG-toxicity would be provided, a total ban on the > use of MSG as a flavour enhancer would not be unwise to consider.

[0] [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5938543/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5938543/)

<comment><USER5> It is just sea weed extract, maybe they should rename it to that as everyone thinks sea weed is a health food. Sushi is full of natural MSG.

Here is a good article on how MSG got a bad wrap:

[https://fivethirtyeight.com/features/how-msg-got-a-bad- rap-f...](https://fivethirtyeight.com/features/how-msg-got-a-bad-rap-flawed- science-and-xenophobia/)

<comment> atom-morgan That's...a huge branding error. Seriously, Organic Seaweed Salt (GF/V) would fly off the shelves at Whole Foods.

<comment><USER6> Someone should tell B&G Foods, given it is way past time for them to modernize the Accent brand anyway (people see it in my spice cabinet and wonder what's with the "weird 60s salt shaker").

[https://www.accentflavor.com/product/flavor- enhancer](https://www.accentflavor.com/product/flavor-enhancer)

</comment></comment></comment></comment></comment></comment><comment><USER7> I think much of the fear surrounding monosodium glutamate (MSG) simply comes down to its common name being a chemical. Imagine saying "pass the sodium chloride" at the dinner table.

Meanwhile, in Japan, MSG is commonly referred to by the brand name "Aji-no- moto", which means "essence of taste." It can be found in most households.

<comment><USER8> Well, wait until you've researched DHMO! [https://www.dhmo.org/facts.html](https://www.dhmo.org/facts.html)

> Should I be concerned about Dihydrogen Monoxide?

> Yes, you should be concerned about DHMO! Although the U.S. Government and > the Centers for Disease Control (CDC) do not classify Dihydrogen Monoxide as > a toxic or carcinogenic substance (as it does with better known chemicals > such as hydrochloric acid and benzene), DHMO is a constituent of many known > toxic substances, diseases and disease-causing agents, environmental hazards > and can even be lethal to humans in quantities as small as a thimbleful.

<comment><USER9> [https://en.wikipedia.org/wiki/Dihydrogen_monoxide_parody](https://en.wikipedia.org/wiki/Dihydrogen_monoxide_parody) :P

<comment><USER8> shhh ;).

</comment></comment></comment></comment><comment><USER10> That was a great read. I just shared it with everyone I know who loves to cook.

I usually make Ramen soup about three nights a week. My wife and I never get tired of it because I have several different savory ingredients combinations that I use, but I almost always use a lot of seaweed of various types, dried shiitake mushrooms, and bonita flakes. I also have a few different types of noodles that I use, for variety.

My ramen differs from most recipes because I use about three times the amount of vegetables as cooked Ramen noodles.

Even the broth of Ramen Soup is especially savory, a treat after the noodles and vegetables are all eaten.

<comment><USER11> Ha -- I do the same (but not 3x/wk)! Imho, standard Japanese-style ramen is just a starting point, a set of suggestions, but ramen soups can be made very flexibly in terms of ingredients and flavor profiles. My entire family prefer homemade to restaurant ramen because it's so easy to customize based on taste- of-the-day.

</comment></comment><comment><USER12> In Korean cooking, there is a flavor known as "cool". Think thin, really heated broth, spicy with green pepper spiciness, the more nasal type (as opposed to red spiciness, more tongue prominent)

In Chinese cooking, there is the "numbing" flavor, red sichuan pepper, white pepper, cloves, et al.

Flavor is simply more complex than the headline that there are only four, and _______.

<comment><USER13> I've heard about the "numbing" effect of those peppers, but never tracked down the real thing here in the US. Are you aware of any literature on it?

<comment><USER14> You can buy Sichuan pepper off the supermarket spice rack in the UK, it's not obscure at all. Pop one in your mouth and chew it and you will immediately notice the distinctive sensation. Are you sure you were looking for the right thing?

<comment><USER15> It was obscure for a while here in the UK in recent times - as imports were banned due to some kind of plant disease.

Same thing has happened with curry leaves on multiple occasions too.

</comment></comment></comment></comment><comment><USER16> Is there some way to experience what umami actually tastes like? I've never been able to wrap my head around it.

<comment><USER17> Go to a Chinese shop, and buy a bag of white powder called "MSG" or mono sodium glutamate. MSG is to umami as sugar is to sweet, salt to salty, citric acid to sour.

<comment><USER18> You know it's sold in American stores too, right? The brand I know of is called Accent.

[https://www.walmart.com/ip/Accent-Flavor-Enhancer- Shaker-4-5...](https://www.walmart.com/ip/Accent-Flavor-Enhancer- Shaker-4-5-Oz/10291600)

<comment><USER17> Apologies, I'm not American.

<comment><USER19> You made a good call though, because the Accent brand is about 10 times more expensive than the Aji-no-moto brand.

</comment></comment></comment></comment></comment><comment><USER20> I have not read the whole article so apologies if this is touched on but is "discovered" really the right word here? The foods and molecules that have this flavor were already being consumed long before the term was coined.

<comment><USER21> I think discovered is exactly the right word.

Sort of like India was discovered by Columbus, of course people were living in India before.

<comment><USER22> > India was discovered by Columbus

Maybe you mean "West Indies"?

<comment><USER21> Phew, yes my bad

</comment></comment></comment></comment><comment><USER23> There's a good SYSK episode summarizing the history of Umami: [https://www.iheart.com/podcast/105-stuff-you-should- know-269...](https://www.iheart.com/podcast/105-stuff-you-should- know-26940277/episode/how-umami-works-29467549/)

</comment><comment><USER24> Is there a good website that can convince people that MSG is actually safe to eat?

</comment><comment><USER25> Anyone else read this as... To the man who discovered your mommy?

They call him papi.</comment>


Twitter clients that can filter tweets by regex? - <AUTHOR>

Want to filter out tweets containing http://4sq.com or http://gowal.la.<p>Any recommendations on how to do this? <comment><USER2> What is this for? You can use the search API directly (it works with URLs):

<http://apiwiki.twitter.com/Twitter-API-Documentation>

If you truly want regex support, just grab a lot of tweets with the API, and filter client-side.

<comment><AUTHOR> I am looking for an existing Twitter client that can filter by regex while still having all of the bells and whistles. Building my own would be a last resort.

<comment><USER3> Checkout Yahoo BOSS, you can whip up your own client pretty easily in Python or Ruby.

</comment></comment></comment><comment><USER4> Twitter clients on the desktop suck.

yorufukurou does regex and is generally tolerable (OS X) <http://sites.google.com/site/yorufukurou/home-en>

Apart from that, it's easy to roll your own stuff - for example using the tweepy python library.

</comment><comment><USER3> BYO with Yahoo BOSS. Here's an example app: [http://zooie.wordpress.com/2009/01/15/twitter-boss-real- time...](http://zooie.wordpress.com/2009/01/15/twitter-boss-real-time-search/)</comment>


The New York Times Removes Its Articles from Apple News - <AUTHOR> https://www.engadget.com/new-york-times-leaves-apple-news-app-183623496.html <comment><USER2> Not terribly surprising honestly. That's pretty much the nature of aggregators. People are far more loyal to the aggregator than the content that underpins it. And once the aggregator captures enough of your audience they can drive your margins to zero since they have more data than you about how well you're doing.

Aggregators are great for small shops since they do all the customer acquisition work and audience building for you but a raw deal for large shops since they siphon your organic customers and charge a premium to get them back.

It will be interesting to see how this plays out since news is more fungible than other media properties and if NYT is the one of only a few defectors then they'll lose big and get a much worse deal when they try to come back.

</comment><comment><USER3> I dumped the apple news app shortly after they finished soft launching. It turned from the slick clean usable news app to, "BUY APPLE NEWS+" blasted in your face constantly. A pity really.</comment>


JavaScript Is Not Expressive - <AUTHOR> http://jezenthomas.com/javascript-is-not-expressive/ <comment><USER2> Please look at the extensions of JS in ES6 for better solutions of the problems you talk about in the article. Symbols for example

export const ADD_TODO = 'ADD_TODO'

Can be written as

export const ADD_TODO = Symbol()

Also:

The class statement that helps express the intention of a function.

The power of JS is that you can choose your own style and evolve the code between paradigms when you need to. Most other languages forces you to one paradigm.

<comment><USER3> C++, C#, PHP, Python, Ruby, and probably many other languages also support multiple paradigms. Few modern languages are deeply coupled with a paradigm, and the ones that are aren't popular.

I personally strongly prefer languages that force a paradigm and therefore decrease creativity and variation between coding styles.

</comment></comment><comment><USER3> TypeScript with tslint solved the specific problems mentioned here. That said, experienced devs know JS sucks, but we use it because it's popular. We need a better language that rivals JS in popularity.</comment>


LinkedIn forcing password resets due to Gawker hack - <AUTHOR> http://www.centernetworks.com/linkedin-forcing-all-passwords-to-change

<comment><USER2> I was not impressed by this. It would have been nice of LinkedIn to include a more specific reason for requiring a password reset other than "We have recently disabled your account for security reasons.". I was in panic mode this morning thinking that someone had gotten into my LinkedIn account (and email) and triggered my account to be locked.

<comment><USER3> They were under absolutely no obligation to do this. Anyone could predict that some subset of their users would get pissy about it. They did it anyways because it was the right thing to do. My esteem for LinkedIn just grew by leaps.

<comment><USER2> I wasn't pissy about them resetting my password, I was scared that my LinkedIn account and who knows what else had been compromised in relation to the Gawker incident.

It was a good move by LinkedIn to force a password reset. It would have been a GREAT move if they had told me it was precautionary instead of me having to guess why my account was locked.

<comment><USER3> Understand that all parties involved here were under time pressure. They incurred a small amount of angst amongst their users, but may have averted a very large amount of pain. They made the right call; they acted fast rather than getting the messaging exactly right.

</comment></comment></comment></comment><comment><USER4> The most interesting thing about this to me is that they're obviously only emailing people who's emails were in the gawker data. Eg: I didn't receive one of these because I don't have a gawker account. Very cool.

<comment><USER5> This would also mean they downloaded the copy of gawker's hacked database, which is probably why they didn't provide more details.

<comment><USER4> Definitely a possibility. There are some alternatives now though, like the list[1] of MD5'd emails that has been circulating that you can use to check against. That's how I confirmed that I wasn't in there, personally.

[1]: <http://www.google.com/fusiontables/DataSource?dsrcid=350662>

</comment></comment></comment><comment><USER6> I was really impressed about this. I changed most of my other password but forgot about LinkedIn. I think it's really responsible of them to proactively take the initiative on this.

</comment><comment><USER7> Unfortunately for happiness, they reset my password after I'd already done so myself.

<comment><USER8> Same here. I had taken this as an opportunity to change a bunch of passwords even though they weren't the same as the one I used on Gawker.

</comment></comment><comment><USER9> Yesterday I had to change my GMail & Twitter password, today I got mail from LinkedIn to change my password. What is going on!?

Update: If your md5(email) is on this list <http://www.google.com/fusiontables/DataSource?dsrcid=350662> Google, Twitter, LinkedIn and probably other sites will ask you to change(reset) your password.

That happened to me.

</comment><comment><USER10> Interestingly enough, my _former_ LinkedIn email was on the Gawker list but my current email with them (to which they sent the alert) was not. Guess that means they are holding on to all previous email accounts?

<comment><USER11> Yes they are, and they are even keeping track and which of those email account are bouncing back.

See: [https://www.linkedin.com/secure/settings?emadd=&goback=....](https://www.linkedin.com/secure/settings?emadd=&goback=.aas)

<comment><USER10> But I went even further, deleting my old email address from that list several months ago. That page only shows my (current) email, which was not on the Gawker list. LinkedIn seems to be keeping around the old email addresses, even after you delete them.

</comment></comment></comment><comment><USER12> LinkedIn is one of the sites that limit the length of your password and what it can maintain. I've emailed their staff many times, and they simply respond that those are the password restrictions.

<comment><USER13> Did the staff respond with _why_ those are the password restrictions?

</comment></comment><comment><USER14> Is LinkedIn completely down for anyone else? The site's been devolving all afternoon for me. First it said there was a problem and they'd redirect to the homepage in a few minutes. Then there was a LinkedIn-branded Sun ONE Web Server landing page that just had features of ONE for the last hour or so. I just checked back and now it's a totally stock landing page without the linkedin logo. Something seems to be seriously FUBAR today.

</comment><comment><USER15> Blizzard did it too for the battle.net thing.

<comment><USER16> Yes, as well as an explanatory note so you knew exactly what was going on - while I appreciate the sentiment, I wish LinkedIn would've done the same.

</comment></comment><comment><USER17> And now it seems like they are down, just after I reset my password: [http://img.skitch.com/20101214-jk1wagxdf1kn4af4eq9tw2s4na.jp...](http://img.skitch.com/20101214-jk1wagxdf1kn4af4eq9tw2s4na.jpg)

Something about this makes me feel nervous..

<comment><USER18> I'm not getting any outage messages, but when I submit the new password form, I get "An unexpected error has occured." And my new password doesn't work, so I'm still locked out.

</comment></comment><comment><USER19> And no doubt the phishers are already cooking up emails to this effect too...

<comment><USER20> Got an email from mint.com long after I closed that account, asking me to verify a bank connection that wasn't working.

Headers look legit, but man things like these are going to bite people _hard_.

</comment></comment><comment><USER21> Looks the same to me. Is it only for the premium accounts?

<comment><USER22> As people have mentioned above, it seems to have only been for people whose emails were in the gawker dump.

</comment></comment><comment><USER23> I think it's a little silly to force this site-wide. In my experience, most people don't make accounts to comment on tech blogs, and those that do are probably already privvy to the need to change a password when a big database of passwords containing or potentially containing your password is released.

I think it is weird for big companies to act like this has such far-reaching effects; 1.5 million users is not that many in the overall scheme of things, and how many of your users intersect? Apparently LinkedIn thinks that most business people who read that a LinkedIn account would make employers think you were smart and cool also had an account with the same credentials at Gawker.

<comment><USER3> Huh? They have a list of email addresses for which passwords were disclosed. If your email address was on the list and you held a LinkedIn account, they zeroed out your password and made you reset it. They didn't reset _everyone's_ account, did they?

<comment><USER23> My understanding was that they had reset everyone's account. I don't think it was defined or not in the article. If they haven't reset everyone's account, disregard my comment, sorry for the misunderstanding. :)

<comment><USER4> Mine was definitely not reset, and I don't have a gawker account. My wife's account was also not affected (and likewise, she has no gawker account).

Considering the availability of the list of email addresses it would be pretty silly to force a reset for everyone.</comment></comment></comment></comment>


Transient Smartphone "Blindness" (2016) - <AUTHOR> https://www.nejm.org/doi/full/10.1056/NEJMc1514294 <comment><USER2> > When the patients were seen in our neuro-ophthalmic clinic, detailed history > taking revealed that symptoms occurred only after several minutes of viewing > a smartphone screen, in the dark, while lying in bed (before going to sleep > in the first case and after waking in the second).

And does that gives permanent or lasting deficiency ?</comment>


Show HN: I made an Android app that gives you an extra phone number to give out - <AUTHOR> https://market.android.com/details?id=net.tyx.extraphone

<comment><AUTHOR> I built this using the Twilio API, which I really enjoy using.

The app is a little expensive; I can lower the price later if I move to a different solution, for example my own asterisk server.

Also looking to use in-app purchasing and/or new subscription model as appropriate for each platform (Android/IOS).

<comment><USER2> That's a very neat looking concept, and congratulations on getting it out there.

I don't see any link between a dollar price and the purchase of credits, however - could you add or address that?

(It seems you get 360 credits for 8.95 but doesn't indicate how much it costs to buy extra credits beyond the initial ones)

<comment><AUTHOR> Ah, thank you. Yes, additional credits will be able to be purchased at the same rate. (I'm actually just waiting on Android 2.3, which includes in-app purchasing, which would be perfect for purchasing additional credits.)

</comment></comment></comment><comment><USER3> ...Or you could use Google Voice in the same way for free. In fact, you can selectively block from GV (send certain callers to "number is no longer in service"), which makes it better than a throw away, IMO.

<comment><AUTHOR> Actually, I use Google Voice as my main phone number. I don't even want to give _that_ out -- so same exact problem for me. <shrug> Selective blocking is only a partial solution; your number is still "out there".

Well, that is why I built the app, anyway =)

Something neat about just being able to "buy" an extra number from the market.

<comment><USER4> As someone who also uses GV as a "real" number, I love the option to flush your number and get a new one. It's like the voice equivalent of "cleaning house" on social networking sites.

</comment></comment></comment><comment><USER5> Tried to access android marketplace using chrome and this is what I got :)

<http://i.imgur.com/ZpqWg.png>

<comment><USER6> Chrome 11 on OSX gave me this: <http://i.imgur.com/nUyaP.png>

</comment></comment><comment><USER7> Fantastic. It's really hard to come up with a good pricing scheme. I've found that simple is better than cheap. If you can figure out a flat rate, or some other scheme that doesn't make me have to do math, I'm much likelier to join.

</comment><comment><USER8> Cool idea. It also has other possible uses outside of giving it to potential stalkers. Adding basic analytics would make it useful for A/B testing offers on TV or in print media, for instance.

</comment><comment><USER9> Price per credit?

Very nice idea, and the page is a great sell. Definitely need a more useful developer website landing page, though.

</comment><comment><USER10> I like it. A reviewer says, "shouting numbers in a crowded bar isn't a particularly fun sport". Exactly (<http://www.youtube.com/watch?v=m50xrDcj0fc>).

I'm a big fan of the .tel TLD for this, and other reasons: publish contact information dynamically, it's fast, reliable, gives you fine grained privacy controls, etc. etc.

I don't understand why this hasn't really caught on yet. The implications for the telco market would be huge if more people used DNS to its full potential.

<comment><USER11> Hasn't caught on because it isn't simple. I hardly think dealing with registrars is an activity people relish. Startup Idea?

<comment><USER10> That's a very good point, although it's changing; specialist registrars/resellers, directory publishers, and VOIP companies are all showing interest now. But I was thinking more about early adopters - the type of people who hang out on HN and register domains in their sleep :)

</comment></comment></comment><comment><USER12> Wouldn't I get phone calls from the disgruntled last person who had the phone number? I suppose even then at least it would be temporary ...

<comment><AUTHOR> Numbers go out of service for 6 months before being reused, IIRC. The carrier may even lengthen the time if the number is actively getting calls during the hold time.

</comment></comment><comment><USER13> Brilliant idea, the image on your page describing it very well!

</comment><comment><USER14> Do you have a QR code for this app?

Market search doesn't find it for me (from the phone) and all QR codes I find on the web give me a 404.

</comment><comment><USER15> Tiny market, isn't it? How many geeky guy Android users are giving out their numbers at bars?

</comment><comment><USER16> Are you in North Jersey? Recognize the 201 in the screenshot :)

</comment><comment><USER17> Does it work in the UK perchance?

<comment><USER18> I dont know if this one does but what I did was get a SkypeOut number and used Skype to call out when I was in Barcelona to call my friends in the US. So at least you can call people in the US cheap =\ ([http://www.skype.com/intl/en- us/features/allfeatures/call-ph...](http://www.skype.com/intl/en- us/features/allfeatures/call-phones-and-mobiles/))

</comment></comment><comment><USER19> Great idea.

</comment><comment><USER19> Perfect for celebs. Know any?

<comment><USER10> I heard Michael Jackson used to change his number on a biweekly basis. Would be quite interesting to see a survey on this group. See my other comment for a neat solution ;)</comment></comment>


Best Bluetooth Microphones and Most People Use for Mobile - <AUTHOR> https://www.axfon.com/best-bluetooth-microphones-and-most-people-use-for-mobile/ <comment><USER2> Amazon affiliate links (tag axfon-20)</comment>


Turing as a Runner (1999) - happy-go-lucky http://www-groups.dcs.st-and.ac.uk/~history/Extras/Turing_running.html <comment><AUTHOR> People should organise a running contest to honor him and call it "The Turing Compete".

<comment><USER2> There was a CMU CS intramural basketball team in the '80s called "The Turing Machine".

<comment><USER3> I don't know what Turing's view of cricket was, but you could imagine holding a Turing Test cricket event in his honor.

</comment></comment></comment><comment><USER4> "His time was 2 hours 46.03 minutes which by modern marathon times does not look so great "

yes it does!

<comment><USER5> This is in the context of Olympic qualification. Today I believe you need to run under 2 hours 11.5 minutes to qualify.

</comment></comment><comment><USER6> Also related, this reminiscence by Alan Garner, the author. [https://www.theguardian.com/books/2011/nov/11/alan-turing- my...](https://www.theguardian.com/books/2011/nov/11/alan-turing-my-hero-alan- garner)

</comment><comment><USER7> My favorite story is the game that Turing invented with one of his chess-and- running buddies (Champernowne?) where one would have to jog around the house after each chess move.</comment>


Fluxcapacitor will run your tests faster - <AUTHOR> https://idea.popcount.org/2013-07-19-how-to-sleep-a-million-years/

<comment><USER2> Really cool project, but I don't think it would speed up my tests, as none of them use time like the examples in the article. For example, If I need to test expiration in Redis, I would just mock out the call to redis to return an object or nil.</comment>


IPv6 privacy addresses crashed the MIT CSAIL network - <AUTHOR> http://blog.bimajority.org/2014/09/05/the-network-nightmare-that-ate-my-week/ <comment><USER2> The "issues with IPv6" are with education, operation, configuration.

I personally ran WiFi networks with 8000+ wireless clients on a _single_ /64 subnet (my employer's CiscoLive conference), and assisted/consulted in running the networks with more than 25000 clients on a single /64 subnet (Mobile World Congress).

The default kinda suck, and the bugs may happen. but the statement "IPv6 is not ready for production" is wrong.

I'd be happy to volunteer a reasonable amount of time to work with the OP or others having a network of >1000 hosts, to debug the issues like this, time permitting, vendor independent. (glass houses and all that).

There are bazillion knobs in IPv6 and a lot of things can be fixed by just tweaking the defaults (which kinda suck).

Network of <500-700 nodes generally don't need to bother much. It's not optimal a lot of times with the defaults but it will work.

EDIT:

the seeming "charity" of volunteering the time isn't. I want to understand what is broken, so we can bring it up back to IETF and get it fixed + make better educational publicity to prevent folks shooting themselves in the foot. It'll make it to the stacks in another decade, but it will. IPv6 is powering nontrivial millions of hosts _now_ \- so the correct words to use "needs tweaking for my network", not "not ready for production". Let's see what the tweaks are and if we can incorporate them into the protocol, if necessary.

<comment><USER3> Why add such knobs, if they weren't there in the first place, haven't been tested, and obviously are causing nontrivial problems?

<comment><USER4> It seems to me that the presence of a "bazillion knobs" is a bug in itself. A stable system can not depend on puny humans for its operation—nor should a design be able to blame puny humans for its failure.

<comment><USER5> My philosophy for a long time has been "every tunable parameter is a design weakness, and every one that must be tuned is a bug."

It's hard to achieve this in practice, but I keep it in mind as a goal.

<comment><USER6> The maxim "every tuneable parameter is a design weakness" applies for top-down design, but not so much for something as foundational as the IP layer.

In the 70s, TCP's inventors imbued it with solid fundamentals, but could not have anticipated how the protocol would need to evolve in the future w.r.t. security and performance. For IPv6, there are unknowns that will only encountered at scale, and implementors are hugely motivated to play fast and loose with the spec. (TCP Fast Open converts!)

Bottom-up systems have inherent wiggle room, and shipping them with sensible defaults is only possible in the short term. That's not to say we should design over-complicated systems, but just that fine tuners are not a weakness.

<comment><USER5> I sort of disagree.

Every tunable parameter ought to be _computable_. If it isn't, it's because I haven't been smart enough to figure out how to auto-tune it.

At least that's the stick I bash myself over the head with. :)

</comment></comment></comment></comment></comment></comment><comment><USER7> The title should probably read,"Bugs in JunOS caused network downtime."

This isn't really news. There are bugs in all routing and switching OS's. That's why they hire support people. This isn't me trying to rag on Juniper. I know lots of people who work for JTAC and they're incredibly smart folks. I'm sure they'll get this sorted out and fixed in JunOS and, like any bug, merged into upstream releases.

This isn't me trying to point out that IPv6 is infallible. There might be some design choices that the IETF made with IPv6 that were stupid, but mostly they got it right, and it's too late now to change most of them anyways.

This is just reality with new software. New software has bugs.

You can blame it on MLD, but really MLD is no more complicated than IGMP. You can blame it on NDP, but really NDP isn't much more complicated than ARP.

At a minimum IPv4 required ARP to function. However, in reality it also required atleast IGMPv2. Since without IGMP, or some way to manage multicast, how are you going to get something like VRRP to work. Link-layer multicast is not new to IPv6.

<comment><USER2> ++.

A small nit to add: IPv4 did not have 1+ multicast groups per every host. That's a dramatic difference in terms of capacity on the middle-gear which escapes if one thinks of IPv6 as "IPv4 with bigger addresses".

<comment><USER7> Thanks for the upvote :)

And you're right about the additional mcast addresses required by IPv6 NDP. It's called the 'solicited-node multicast address' that every host must join.

My historical guess about why multicast was chosen over broadcast for NDP was due to NBMA networks. In the 1990's NBMA networks(frame-relay) were much more common than they are today. And NDP just makes more sense than ARP over NBMA networks. This is just a guess.

Someone else suggested DOCSIS was the reason that multicast was chosen instead of broadcast. I doubt this. I'm not that familiar with DOCSIS, but I think it has a broadcast type link-layer. Also, IPv6 predates DOCSIS.

It could well turn out that multicast was the right choice for NDP once we get over the inevitable roll out problems. NBMA networks could return in 20-30 years. You never know.

<comment><USER2> You're right, DOCSIS has nothing to do with it.

The "classic" rationale to choose multicast over broadcast was to try and limit the amount of time to process NDP traffic vs. the time the hosts have to process the ARP broadcast traffic in IPv4. 15 years ago that took a nontrivial amount of host resources, and with the way NDP constructs the solicited node multicast, even if you just flood every packet on the link, you still can filter the packets that are not for you at the NIC HW level.

And since there are 16 million unique solicited node multicast addresses, in principle the scaling is pretty impressive.

Multicast is a definitely a good choice in the long term, though the "here and now" interaction with some protocols is a bit tricky - e.g. 802.11 WiFi ([http://tools.ietf.org/html/draft-vyncke-6man-mcast-not- effic...](http://tools.ietf.org/html/draft-vyncke-6man-mcast-not-efficient-01) and [http://tools.ietf.org/html/draft-yourtchenko-colitti-nd- redu...](http://tools.ietf.org/html/draft-yourtchenko-colitti-nd-reduce- multicast-00)) - though it's not the only offender and frequently not the biggest one (service advertisements may consume a comparable and bigger amount of bandwidth on the volatile network).

On NBMA: you can have such a network today in a public WiFi scenario where you do not hosts directly talking to each other but want them to access the internet. In the wired case the moniker is "Private VLANs".

With IPv6 you can clear the on-link bit, and make NBMA work quite elegantly. But, depending on the exact details, [http://tools.ietf.org/html/rfc4903](http://tools.ietf.org/html/rfc4903) does list quite a few interesting challenges - quite an informative read.

BTW, if you are interested more in the "why" rather than just "how" of IPv6, take a look at this: [http://www.internetsociety.org/deploy360/resources/ebook- ipv...](http://www.internetsociety.org/deploy360/resources/ebook-ipv6-for- ipv4-experts-available-in-english-and-russian/)

It's a gem: free, very good quality material, and written as if you are co- designing with the author by solving various problems you see on IPv4 networks, and the protocol evolves into what is the IPv6 today.

<comment><USER7> Thanks again for the excellent response, and for the history lesson on why multicast was chosen over broadcast for NDP.

I've done tons of work in private vlans over the years. I was part of a months long effort to find and document bugs in private vlans at a vendor, where my primary focus was to find and document bugs only in private vlans.

Residential ISPs love private vlans because it prevents different customers from seeing each other's broadcast traffic. DHCP Snooping to prevent things like ARP spoofing, in combination with private vlans to limit broadcast traffic will mostly lock things down pretty well.

It's funny you should provide a link to a resource from the Deploy360 Programme. I just finished doing a stint with the Deploy360 Programme as a writer working on, among other things, IPv6 resources. My real name is Andrew McConachie.

<comment><USER2> Very nice to meet you!

Totally agreed on the residential ISPs loving PVLANs.

And thanks for your work with deploy360 and helping to get better information to people !

</comment></comment></comment></comment></comment></comment><comment><USER8> We've also hit this Intel Ethernet driver bug, even though we don't have IPv6 deployed. Linux will send MLD packets on bridged ports by default, triggering the Intel driver bug on Windows machines.

With only two Windows machines saturating their Gigabit Ethernet connection whenever they went into standby, we managed to crash the university's switches big time (we're a group with our own VLAN within the university's network, so we make use of their network equipment).

Naturally, because the issue only occurs during standby, and usually users don't log off thus preventing Windows from sleeping, we first hit the bug during the Christmas holidays (2013). The culprit hosts were all in use for just a couple of months. In the end, it took a couple of hours to reproduce this bug during working hours!

We fixed it by using different NICs (we didn't want to rely on the Intel driver to be updated after a clean install; Windows Update doesn't have the fixed version), and by disabling MLD snooping on the Linux hosts, since we aren't yet using IPv6 anyways. This prevents the Intel bug from being triggered in our environment.

</comment><comment><USER9> As someone watching from the sidelines I had no idea there were such major issues with IPv6. It seems like IPv6 has been out there for a long time (about 10 years) in terms of being supported by OS's and networking hardware, if not ISP's. So I would have thought that cutting edge institutions (like MIT) would already have years of experience with it and have worked out most of the kinks by now.

If this is not the case what does it mean for more widespread IPv6 adoption ? If such adoption is significantly delayed or stalled what will the consequences be, both for current Internet growth in the face of IPv4 address depletion and for new technologies like IoT ?

<comment><USER10> I haven't been on the front lines of new protocol deployment for a long time now, but the pattern then (and it appears unchanged) was that larger deployments brought out 2nd and 3rd order issues with the protocol. The old joke was "How can you tell someone is a pioneer?" answer, "Count the number of arrows in their back." which expressed that folks who adopted new protocols bore much of the burden of their failure and revision. Sounds like CSAIL has made some great progress in this respect.

<comment><USER2> A very astute observation!

But...

There are already quite large both enterprise and service provider networks already using IPv6. It's more in-between the "pioneers did not document the thorns they hit, so the others would not" and "the future is not evenly distributed yet, so we don't know about it" territory.

I've volunteered myself to understand which of the two and to do whatever is actionable.

</comment></comment></comment><comment><USER11>
        I used Ubuntu as an example, but it is hardly the worst offender. We have seen
        Windows machines with more than 300 IPv6 addresses

Wow! I don't operate a very large network, but I do operate an IPv6 network and I've never seen one of our machines use more than 2 addresses. I feel like they've got some other configuration option or oddity going on that's causing a lot of these problems, but I am guessing they're much smarter than I am, so I don't know what to say.

Could someone elaborate on this? I've never seen this behavior on an IPv6 network, and I'm just running a server or two with radvd and no custom switch configuration.

<comment><USER12> Do you use privacy addresses ?

I don't, the /64 is identifiable as "my house" so there is no reason to hide which particular machine is doing something.

<comment><USER13> A house may have multiple people living there, multiple devices, visitors, etc.

You could track a person connecting through multiple locations by using their MAC address used to assign their IP. i.e. if I am connecting with my laptop from various places, my IP address will be roughly the same, only the network prefix will change.

<comment><USER12> A house could have multiple users, mine doesn't.

I would maybe see turning on privacy addresses as part of a general "leaving home" script that also turned on other stuff like the firewall.

<comment><USER2> You are completely right. Privacy IPv6 address are an illusion when used in a household that has effectively an active /64 per subscriber.

(Those who say "but IPv4..." last time my IPv4 address changed, was half a year ago). Anyway this is mostly a political give-in, that happens to also help ruggedize the rest of the stack (the relatively rapid change of privacy addresses uncovers more bugs than we'd otherwise find - so from that standpoint they're to be advocated). But privacy.. huh.

Last IETF there was precisely this discussion that one might want to force a new /64 on themselves, and privacy addresses have nothing to do with that. (DHC WG, FWIW).

<comment> X-Istence Comcast is more than willing to send you more than one /64 prefix if you ask for it!

<comment><USER2> "effectively an active /64". Comcast folks did a ton of testing with the CPEs, and very very few could ask for anything than an active /64, that's why this qualifier :-)

There's active (and pretty cool) work in the HomeNet IETF workgroup, with running code and all ([http://www.homewrt.org/doku.php](http://www.homewrt.org/doku.php)) to make the multi-subnet home network a sane reality.

But a different /64 from within the same /56 helps not much, and indeed to correctly reflect the spirit of the discussion in the DHC working group, would be to say "I want to be able to press a button and release my currently used allocation and get some completely new one, be it /48, /56 or whatever".

Thanks for the correction!

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> An issue glossed over by people is:

 _" the entire TCAM space dedicated to IPv6 multicast is only 3,000 entries"_

Some mid-level switches normally have TCAM space for hundreds of thousands, or millions of entries, IPv4 or IPv6. Maybe their vendor artificially crippled their line of switches, or maybe the switches were deployed with a configuration error. It is probably the former though. Network vendors like to make you believe some features cost _a lot_ to implement and that you _really_ need their highest-level gear, when in fact even the biggest TCAM in silicon cost a few tens of dollars, at most.

</comment><comment><USER15> Nobody on this thread really seems to be talking about one of the issues brought up in the IPv6 analysis (though I'm not sure if it caused their outages - any time I read a post mortem with the phrase, "bridge loops" I usually don't look any further - that alone is enough to bring a network down)

If I read the post correctly, one of the roots of their problems seems to be that either (A) Traffic flooding causing excess traffic as a result of multicast packets being flooded over their network, or (B) If they used MLD snooping to reduce the flooding, the switches they have only support 3,000 entries for multicast groups - which are quickly exceeded with the privacy IPv6 addresses that are generated by the hosts (each of which creates it's own multicast entry, and some of their hosts had 10+ addresses)

Other than turning off privacy based IPv6 addresses, and moving to something like RFC 7217, is there a solution? Increasing the number of multicast entries on the switch to something larger, say, around 30,000 entries combined with reducing the length of time in which a privacy address is valid (and therefore requiring a group) from one day, to say, one hour?

</comment><comment><USER3> What's the reasoning for dropping ARP? It seemed like a simple architecture. The post seems to indicate IPv6 requires a ton more hardware resources. And if Juniper doesn't have a basic feature like MLD snooping after all this time, uh? Shouldn't practically designing a high-volume switch be part of creating such a fundamental protocol? (I know designing 2 elegant implementations of other protocols would have fixed a ton of things in nasty protocols like HTTP - dumbass things like line folding and comments-in-headers.)

Is this a case of idiocy seeping through the IETF because they can? It's pretty easy to write something down on paper if you don't have to implement engineering and product management on the result. Or because you're out of touch with reality, like the source routing feature which was kept in IPv6 despite it only ever being a problem in IPv4? Or is this a case of the protocol being superior and vendors just being very lazy?

<comment><USER16> It seems like they really wanted to push multicast as a "first-class" mode of the protocol, and by weaving it into the core of IPv6 they've forced everyone to have a somewhat exercised implementation of it in their stack.

<comment><USER3> So pushing something no one uses, and has significantly narrow uses, and still isn't deployed publicly, into the core... How is that anything but self- serving protocol designers? How do they get away with that?

<comment><USER17> I'm a private customer, and I use IPv4 Multicast. My ISP uses it to distribute IPTV streams.

Don't generalize from "I don't know anybody who uses" to "nobody uses".

<comment><USER18> A good portion of the bandwidth being used on the Internet could be done over multicast if it were widely supported.

For example, popular content on Hulu could be multicast. You'd download the beginning of the video over HTTP but simultaneously tune into the multicast that started the most recently. Once the two streams meet you drop the HTTP connection. If widely deployed this would reduce costs for both Hulu and ISPs, and for places where multicast doesn't work it can fall back to HTTP.

</comment></comment></comment></comment></comment><comment><USER19> Here's a proposed algorithm for making privacy addresses more manageable:

[http://tools.ietf.org/html/rfc7217](http://tools.ietf.org/html/rfc7217)

Essentially, the suffix is hash(secret | prefix), so your address is stable on a given network, but changes as you roam between networks.

<comment><USER20> A small domain encryption scheme, rather than a hash, would make more sense... that way there'd be no collisions. SDE isn't that much harder to put together in hardware.

<comment><USER19> The subnet space is 64 bits long. Collisions between pseudo-random values only become likely when you have billions of nodes, so it's not worth the effort to preemptively avoid them.

This would also require all nodes to implement the same algorithm, which means it's not incrementally deployable.

Edit: The actual RFC7217 algorithm contains a DAD_Counter field in the hash input. In the event of a collision, the counter increments, generating a new address.

</comment></comment></comment><comment><USER21> _the random address is changed regularly, typically daily, but the old random addresses are kept around for a fairly long time_

I don't understand this part. I have Ubuntu machines in a network which is technically /48 but only one /64 prefix is announced by radvd and they all have only two addresses, one derived from MAC and one private/random changing over time. They certainly never have eight.

Are those previous addresses not visable in ifconfig or ip -6 addr show?

<comment><USER22> I think this may have changed (in 14.04?) as I remember having more addresses in the past but don't now.

<comment><USER21> I have 14.04s and OP talks about 14.04s.

 _Thus, a typical machine — say, an Ubuntu 14.04 workstation with the default configuration_

</comment></comment></comment><comment><USER23> This is now the second major network that I've heard ran into this exact problem. The update to Windows caused the end-user nodes to send out lots of IPv6 packets The access layer switches went to full CPU utilization, and you ended up with packet storms across the network. There really should be an advisory about this.

</comment><comment><USER24> It would have been interesting to see a network diagram.

</comment><comment><USER25> Advocate the engineering principle fault domains to isolate the problem with L2 broadcasts with L3 routers between the L2.

</comment><comment><USER26> Wow.

I have no idea where to even start - this article was written by someone who has no large scale IPv6 deployment experience. There are errors upon, back-to- back, errors in what's assumed and the expected results and assertions with the vendor (Juniper) and the protocol operation (IPv6).

I'm not surprised that it's towards the top of HN but it shows the relative understanding of the HN crowd with regard to complex network related topics.

<comment><USER15> I'm pretty familiar with "complex network related topics" \- and I think this is the most interesting IPv6 related post on HN in 2+ years (there may have been others that got by me).

I"m curious - are you someone with "large scale IPv6 deployment experience?" \- in particularly, how would you have approached their issues regarding MLD snooping and TCAM exhaustion?

<comment><USER26> It may be interesting, but my point was that there is nothing in this article to learn from with the exception of problematic code from a network vendor.

Yes - I am. I deployed a 4 state IPv6 overlay servicing 250k subscribers on one of the very first (fully rolled out) DOCSIS 3 HFC networks in the US. I was responsible for the security and performance of the architecture. This rollout started in 2010. The TCAM exhaustion was self inflicted based on the hints of design throughout the article and the original authors understand of MLD is, just generally, incorrect unfortunately.</comment></comment></comment>


First Particle Beam to Shoot Through the Large Hadron Collider Tomorrow - <AUTHOR> http://io9.com/5034820/first-particle-beam-to-shoot-through-the-large-hadron-collider-tomorrow <comment><USER2> Tell everyone who doesn't know that particles with even greater energy have been hitting the Earth for billions of years. So if something bad could happen from operating the LHC, it probably would've already happened.

<comment><USER3> The problem with Hadron is that two particles will hit each other precisely head on, which is not what happens when cosmic energy passes through the earth.

Even the project's organizers admit there's a remote chance of destroying the planet through black holes or the creation of matter-altering stranglets.

I don't think the head-on collisions start until 2012 though.

<comment><USER2> Uh, what exactly do you mean by "precisely head on?" The particles are aimed only such that you have one stream going through the same region of space as another stream. They are not taking an individual particle and aiming it marksman-like at another individual particle.

Even if this were the case, ever hear of "Relativity?" The whole point is that there are no special reference frames. A particle hitting another oncoming "head on" is the same as another hitting a "stationary" one. The point being: there is no distinction between the LHC's particle collisions and cosmic rays colliding with matter around our planet.

And as far as "remote chance" goes, given the huge number of collisions that already happen with even greater energies, this chance must be about as remote as a droplet of water being thrown spontaneously from a still glass of water to the ceiling. There is a finite probability, but it's so low, it's practically zero.

<http://skeptoid.com/episodes/4109></comment></comment></comment>